diff --git a/[refs] b/[refs]
index 75643a51c860..20d52785339f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3886f91b9656773383f0f8779cb0cd695fd59da0
+refs/heads/master: 36a6f8c035760dcbd0c3acb4c2fd56268588a9cb
diff --git a/trunk/Documentation/device-mapper/dm-raid.txt b/trunk/Documentation/device-mapper/dm-raid.txt
index 56fb62b09fc5..728c38c242d6 100644
--- a/trunk/Documentation/device-mapper/dm-raid.txt
+++ b/trunk/Documentation/device-mapper/dm-raid.txt
@@ -141,4 +141,3 @@ Version History
 1.2.0	Handle creation of arrays that contain failed devices.
 1.3.0	Added support for RAID 10
 1.3.1	Allow device replacement/rebuild for RAID 10
-1.3.2   Fix/improve redundancy checking for RAID10
diff --git a/trunk/Documentation/hid/hid-sensor.txt b/trunk/Documentation/hid/hid-sensor.txt
old mode 100644
new mode 100755
diff --git a/trunk/Documentation/x86/boot.txt b/trunk/Documentation/x86/boot.txt
index 3edb4c2887a1..406d82d5d2bb 100644
--- a/trunk/Documentation/x86/boot.txt
+++ b/trunk/Documentation/x86/boot.txt
@@ -57,10 +57,6 @@ Protocol 2.10:	(Kernel 2.6.31) Added a protocol for relaxed alignment
 Protocol 2.11:	(Kernel 3.6) Added a field for offset of EFI handover
 		protocol entry point.
 
-Protocol 2.12:	(Kernel 3.9) Added the xloadflags field and extension fields
-	 	to struct boot_params for for loading bzImage and ramdisk
-		above 4G in 64bit.
-
 **** MEMORY LAYOUT
 
 The traditional memory map for the kernel loader, used for Image or
@@ -186,7 +182,7 @@ Offset	Proto	Name		Meaning
 0230/4	2.05+	kernel_alignment Physical addr alignment required for kernel
 0234/1	2.05+	relocatable_kernel Whether kernel is relocatable or not
 0235/1	2.10+	min_alignment	Minimum alignment, as a power of two
-0236/2	2.12+	xloadflags	Boot protocol option flags
+0236/2	N/A	pad3		Unused
 0238/4	2.06+	cmdline_size	Maximum size of the kernel command line
 023C/4	2.07+	hardware_subarch Hardware subarchitecture
 0240/8	2.07+	hardware_subarch_data Subarchitecture-specific data
@@ -586,27 +582,6 @@ Protocol:	2.10+
   misaligned kernel.  Therefore, a loader should typically try each
   power-of-two alignment from kernel_alignment down to this alignment.
 
-Field name:     xloadflags
-Type:           read
-Offset/size:    0x236/2
-Protocol:       2.12+
-
-  This field is a bitmask.
-
-  Bit 0 (read):	XLF_KERNEL_64
-	- If 1, this kernel has the legacy 64-bit entry point at 0x200.
-
-  Bit 1 (read): XLF_CAN_BE_LOADED_ABOVE_4G
-        - If 1, kernel/boot_params/cmdline/ramdisk can be above 4G.
-
-  Bit 2 (read):	XLF_EFI_HANDOVER_32
-	- If 1, the kernel supports the 32-bit EFI handoff entry point
-          given at handover_offset.
-
-  Bit 3 (read): XLF_EFI_HANDOVER_64
-	- If 1, the kernel supports the 64-bit EFI handoff entry point
-          given at handover_offset + 0x200.
-
 Field name:	cmdline_size
 Type:		read
 Offset/size:	0x238/4
diff --git a/trunk/Documentation/x86/zero-page.txt b/trunk/Documentation/x86/zero-page.txt
index 199f453cb4de..cf5437deda81 100644
--- a/trunk/Documentation/x86/zero-page.txt
+++ b/trunk/Documentation/x86/zero-page.txt
@@ -19,9 +19,6 @@ Offset	Proto	Name		Meaning
 090/010	ALL	hd1_info	hd1 disk parameter, OBSOLETE!!
 0A0/010	ALL	sys_desc_table	System description table (struct sys_desc_table)
 0B0/010	ALL	olpc_ofw_header	OLPC's OpenFirmware CIF and friends
-0C0/004	ALL	ext_ramdisk_image ramdisk_image high 32bits
-0C4/004	ALL	ext_ramdisk_size  ramdisk_size high 32bits
-0C8/004	ALL	ext_cmd_line_ptr  cmd_line_ptr high 32bits
 140/080	ALL	edid_info	Video mode setup (struct edid_info)
 1C0/020	ALL	efi_info	EFI 32 information (struct efi_info)
 1E0/004	ALL	alk_mem_k	Alternative mem check, in KB
@@ -30,7 +27,6 @@ Offset	Proto	Name		Meaning
 1E9/001	ALL	eddbuf_entries	Number of entries in eddbuf (below)
 1EA/001	ALL	edd_mbr_sig_buf_entries	Number of entries in edd_mbr_sig_buffer
 				(below)
-1EF/001	ALL	sentinel	Used to detect broken bootloaders
 290/040	ALL	edd_mbr_sig_buffer EDD MBR signatures
 2D0/A00	ALL	e820_map	E820 memory map table
 				(array of struct e820entry)
diff --git a/trunk/MAINTAINERS b/trunk/MAINTAINERS
index 212c255b9347..8ae709e34523 100644
--- a/trunk/MAINTAINERS
+++ b/trunk/MAINTAINERS
@@ -2966,7 +2966,7 @@ S:	Maintained
 F:	drivers/net/ethernet/i825xx/eexpress.*
 
 ETHERNET BRIDGE
-M:	Stephen Hemminger <stephen@networkplumber.org>
+M:	Stephen Hemminger <shemminger@vyatta.com>
 L:	bridge@lists.linux-foundation.org
 L:	netdev@vger.kernel.org
 W:	http://www.linuxfoundation.org/en/Net:Bridge
@@ -4905,7 +4905,7 @@ S:	Maintained
 
 MARVELL GIGABIT ETHERNET DRIVERS (skge/sky2)
 M:	Mirko Lindner <mlindner@marvell.com>
-M:	Stephen Hemminger <stephen@networkplumber.org>
+M:	Stephen Hemminger <shemminger@vyatta.com>
 L:	netdev@vger.kernel.org
 S:	Maintained
 F:	drivers/net/ethernet/marvell/sk*
@@ -5180,7 +5180,7 @@ S:	Supported
 F:	drivers/infiniband/hw/nes/
 
 NETEM NETWORK EMULATOR
-M:	Stephen Hemminger <stephen@networkplumber.org>
+M:	Stephen Hemminger <shemminger@vyatta.com>
 L:	netem@lists.linux-foundation.org
 S:	Maintained
 F:	net/sched/sch_netem.c
@@ -7088,7 +7088,7 @@ F:	include/uapi/sound/
 F:	sound/
 
 SOUND - SOC LAYER / DYNAMIC AUDIO POWER MANAGEMENT (ASoC)
-M:	Liam Girdwood <lgirdwood@gmail.com>
+M:	Liam Girdwood <lrg@ti.com>
 M:	Mark Brown <broonie@opensource.wolfsonmicro.com>
 T:	git git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
 L:	alsa-devel@alsa-project.org (moderated for non-subscribers)
diff --git a/trunk/Makefile b/trunk/Makefile
index 54dfde5e9f9e..2d3c92c774fb 100644
--- a/trunk/Makefile
+++ b/trunk/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
-NAME = Unicycling Gorilla
+EXTRAVERSION = -rc5
+NAME = Terrified Chipmunk
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/trunk/arch/mips/bcm47xx/Kconfig b/trunk/arch/mips/bcm47xx/Kconfig
index ba611927749b..d7af29f1fcf0 100644
--- a/trunk/arch/mips/bcm47xx/Kconfig
+++ b/trunk/arch/mips/bcm47xx/Kconfig
@@ -8,10 +8,8 @@ config BCM47XX_SSB
 	select SSB_DRIVER_EXTIF
 	select SSB_EMBEDDED
 	select SSB_B43_PCI_BRIDGE if PCI
-	select SSB_DRIVER_PCICORE if PCI
 	select SSB_PCICORE_HOSTMODE if PCI
 	select SSB_DRIVER_GPIO
-	select GPIOLIB
 	default y
 	help
 	 Add support for old Broadcom BCM47xx boards with Sonics Silicon Backplane support.
@@ -27,7 +25,6 @@ config BCM47XX_BCMA
 	select BCMA_HOST_PCI if PCI
 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
 	select BCMA_DRIVER_GPIO
-	select GPIOLIB
 	default y
 	help
 	 Add support for new Broadcom BCM47xx boards with Broadcom specific Advanced Microcontroller Bus.
diff --git a/trunk/arch/mips/cavium-octeon/executive/cvmx-l2c.c b/trunk/arch/mips/cavium-octeon/executive/cvmx-l2c.c
index 33b72144db31..9f883bf76953 100644
--- a/trunk/arch/mips/cavium-octeon/executive/cvmx-l2c.c
+++ b/trunk/arch/mips/cavium-octeon/executive/cvmx-l2c.c
@@ -30,7 +30,6 @@
  * measurement, and debugging facilities.
  */
 
-#include <linux/compiler.h>
 #include <linux/irqflags.h>
 #include <asm/octeon/cvmx.h>
 #include <asm/octeon/cvmx-l2c.h>
@@ -286,22 +285,22 @@ uint64_t cvmx_l2c_read_perf(uint32_t counter)
  */
 static void fault_in(uint64_t addr, int len)
 {
-	char *ptr;
-
+	volatile char *ptr;
+	volatile char dummy;
 	/*
 	 * Adjust addr and length so we get all cache lines even for
 	 * small ranges spanning two cache lines.
 	 */
 	len += addr & CVMX_CACHE_LINE_MASK;
 	addr &= ~CVMX_CACHE_LINE_MASK;
-	ptr = cvmx_phys_to_ptr(addr);
+	ptr = (volatile char *)cvmx_phys_to_ptr(addr);
 	/*
 	 * Invalidate L1 cache to make sure all loads result in data
 	 * being in L2.
 	 */
 	CVMX_DCACHE_INVALIDATE;
 	while (len > 0) {
-		ACCESS_ONCE(*ptr);
+		dummy += *ptr;
 		len -= CVMX_CACHE_LINE_SIZE;
 		ptr += CVMX_CACHE_LINE_SIZE;
 	}
diff --git a/trunk/arch/mips/include/uapi/asm/break.h b/trunk/arch/mips/include/asm/break.h
similarity index 100%
rename from trunk/arch/mips/include/uapi/asm/break.h
rename to trunk/arch/mips/include/asm/break.h
diff --git a/trunk/arch/mips/include/asm/dsp.h b/trunk/arch/mips/include/asm/dsp.h
index 7bfad0520e25..e9bfc0813c72 100644
--- a/trunk/arch/mips/include/asm/dsp.h
+++ b/trunk/arch/mips/include/asm/dsp.h
@@ -16,7 +16,7 @@
 #include <asm/mipsregs.h>
 
 #define DSP_DEFAULT	0x00000000
-#define DSP_MASK	0x3f
+#define DSP_MASK	0x3ff
 
 #define __enable_dsp_hazard()						\
 do {									\
diff --git a/trunk/arch/mips/include/asm/inst.h b/trunk/arch/mips/include/asm/inst.h
index 33c34adbecfa..ab84064283db 100644
--- a/trunk/arch/mips/include/asm/inst.h
+++ b/trunk/arch/mips/include/asm/inst.h
@@ -353,7 +353,6 @@ union mips_instruction {
 	struct u_format u_format;
 	struct c_format c_format;
 	struct r_format r_format;
-	struct p_format p_format;
 	struct f_format f_format;
 	struct ma_format ma_format;
 	struct b_format b_format;
diff --git a/trunk/arch/mips/include/asm/mach-pnx833x/war.h b/trunk/arch/mips/include/asm/mach-pnx833x/war.h
index e410df4e1b3a..edaa06d9d492 100644
--- a/trunk/arch/mips/include/asm/mach-pnx833x/war.h
+++ b/trunk/arch/mips/include/asm/mach-pnx833x/war.h
@@ -21,4 +21,4 @@
 #define R10000_LLSC_WAR			0
 #define MIPS34K_MISSED_ITLB_WAR		0
 
-#endif /* __ASM_MIPS_MACH_PNX833X_WAR_H */
+#endif /* __ASM_MIPS_MACH_PNX8550_WAR_H */
diff --git a/trunk/arch/mips/include/asm/pgtable-64.h b/trunk/arch/mips/include/asm/pgtable-64.h
index 013d5f781263..c63191055e69 100644
--- a/trunk/arch/mips/include/asm/pgtable-64.h
+++ b/trunk/arch/mips/include/asm/pgtable-64.h
@@ -230,7 +230,6 @@ static inline void pud_clear(pud_t *pudp)
 #else
 #define pte_pfn(x)		((unsigned long)((x).pte >> _PFN_SHIFT))
 #define pfn_pte(pfn, prot)	__pte(((pfn) << _PFN_SHIFT) | pgprot_val(prot))
-#define pfn_pmd(pfn, prot)	__pmd(((pfn) << _PFN_SHIFT) | pgprot_val(prot))
 #endif
 
 #define __pgd_offset(address)	pgd_index(address)
diff --git a/trunk/arch/mips/include/uapi/asm/Kbuild b/trunk/arch/mips/include/uapi/asm/Kbuild
index 77d4fb33f75a..a1a0452ac185 100644
--- a/trunk/arch/mips/include/uapi/asm/Kbuild
+++ b/trunk/arch/mips/include/uapi/asm/Kbuild
@@ -3,7 +3,6 @@ include include/uapi/asm-generic/Kbuild.asm
 
 header-y += auxvec.h
 header-y += bitsperlong.h
-header-y += break.h
 header-y += byteorder.h
 header-y += cachectl.h
 header-y += errno.h
diff --git a/trunk/arch/mips/kernel/ftrace.c b/trunk/arch/mips/kernel/ftrace.c
index 83fa1460e294..6a2d758dd8e9 100644
--- a/trunk/arch/mips/kernel/ftrace.c
+++ b/trunk/arch/mips/kernel/ftrace.c
@@ -25,12 +25,6 @@
 #define MCOUNT_OFFSET_INSNS 4
 #endif
 
-/* Arch override because MIPS doesn't need to run this from stop_machine() */
-void arch_ftrace_update_code(int command)
-{
-	ftrace_modify_all_code(command);
-}
-
 /*
  * Check if the address is in kernel space
  *
@@ -95,24 +89,6 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 	return 0;
 }
 
-#ifndef CONFIG_64BIT
-static int ftrace_modify_code_2(unsigned long ip, unsigned int new_code1,
-				unsigned int new_code2)
-{
-	int faulted;
-
-	safe_store_code(new_code1, ip, faulted);
-	if (unlikely(faulted))
-		return -EFAULT;
-	ip += 4;
-	safe_store_code(new_code2, ip, faulted);
-	if (unlikely(faulted))
-		return -EFAULT;
-	flush_icache_range(ip, ip + 8); /* original ip + 12 */
-	return 0;
-}
-#endif
-
 /*
  * The details about the calling site of mcount on MIPS
  *
@@ -155,18 +131,8 @@ int ftrace_make_nop(struct module *mod,
 	 * needed.
 	 */
 	new = in_kernel_space(ip) ? INSN_NOP : INSN_B_1F;
-#ifdef CONFIG_64BIT
+
 	return ftrace_modify_code(ip, new);
-#else
-	/*
-	 * On 32 bit MIPS platforms, gcc adds a stack adjust
-	 * instruction in the delay slot after the branch to
-	 * mcount and expects mcount to restore the sp on return.
-	 * This is based on a legacy API and does nothing but
-	 * waste instructions so it's being removed at runtime.
-	 */
-	return ftrace_modify_code_2(ip, new, INSN_NOP);
-#endif
 }
 
 int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr)
diff --git a/trunk/arch/mips/kernel/mcount.S b/trunk/arch/mips/kernel/mcount.S
index 165867673357..4c968e7efb74 100644
--- a/trunk/arch/mips/kernel/mcount.S
+++ b/trunk/arch/mips/kernel/mcount.S
@@ -46,8 +46,9 @@
 	PTR_L	a5, PT_R9(sp)
 	PTR_L	a6, PT_R10(sp)
 	PTR_L	a7, PT_R11(sp)
-#else
 	PTR_ADDIU	sp, PT_SIZE
+#else
+	PTR_ADDIU	sp, (PT_SIZE + 8)
 #endif
 .endm
 
@@ -68,9 +69,7 @@ NESTED(ftrace_caller, PT_SIZE, ra)
 	.globl _mcount
 _mcount:
 	b	ftrace_stub
-	addiu sp,sp,8
-
-	/* When tracing is activated, it calls ftrace_caller+8 (aka here) */
+	 nop
 	lw	t1, function_trace_stop
 	bnez	t1, ftrace_stub
 	 nop
diff --git a/trunk/arch/mips/kernel/vpe.c b/trunk/arch/mips/kernel/vpe.c
index 147cec19621d..eec690af6581 100644
--- a/trunk/arch/mips/kernel/vpe.c
+++ b/trunk/arch/mips/kernel/vpe.c
@@ -705,7 +705,7 @@ static int vpe_run(struct vpe * v)
 
 			printk(KERN_WARNING
 			       "VPE loader: TC %d is already in use.\n",
-			       v->tc->index);
+                               t->index);
 			return -ENOEXEC;
 		}
 	} else {
diff --git a/trunk/arch/mips/lantiq/irq.c b/trunk/arch/mips/lantiq/irq.c
index a7935bf0fecb..f36acd1b3808 100644
--- a/trunk/arch/mips/lantiq/irq.c
+++ b/trunk/arch/mips/lantiq/irq.c
@@ -408,7 +408,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent)
 #endif
 
 	/* tell oprofile which irq to use */
-	cp0_perfcount_irq = irq_create_mapping(ltq_domain, LTQ_PERF_IRQ);
+	cp0_perfcount_irq = LTQ_PERF_IRQ;
 
 	/*
 	 * if the timer irq is not one of the mips irqs we need to
diff --git a/trunk/arch/mips/lib/delay.c b/trunk/arch/mips/lib/delay.c
index 288f7954988d..dc81ca8dc0dd 100644
--- a/trunk/arch/mips/lib/delay.c
+++ b/trunk/arch/mips/lib/delay.c
@@ -21,7 +21,7 @@ void __delay(unsigned long loops)
 	"	.set	noreorder				\n"
 	"	.align	3					\n"
 	"1:	bnez	%0, 1b					\n"
-#if BITS_PER_LONG == 32
+#if __SIZEOF_LONG__ == 4
 	"	subu	%0, 1					\n"
 #else
 	"	dsubu	%0, 1					\n"
diff --git a/trunk/arch/mips/mm/ioremap.c b/trunk/arch/mips/mm/ioremap.c
index cacfd31e8ec9..7657fd21cd3f 100644
--- a/trunk/arch/mips/mm/ioremap.c
+++ b/trunk/arch/mips/mm/ioremap.c
@@ -190,3 +190,9 @@ void __iounmap(const volatile void __iomem *addr)
 
 EXPORT_SYMBOL(__ioremap);
 EXPORT_SYMBOL(__iounmap);
+
+int __virt_addr_valid(const volatile void *kaddr)
+{
+	return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
+}
+EXPORT_SYMBOL_GPL(__virt_addr_valid);
diff --git a/trunk/arch/mips/mm/mmap.c b/trunk/arch/mips/mm/mmap.c
index 7e5fe2790d8a..d9be7540a6be 100644
--- a/trunk/arch/mips/mm/mmap.c
+++ b/trunk/arch/mips/mm/mmap.c
@@ -192,9 +192,3 @@ unsigned long arch_randomize_brk(struct mm_struct *mm)
 
 	return ret;
 }
-
-int __virt_addr_valid(const volatile void *kaddr)
-{
-	return pfn_valid(PFN_DOWN(virt_to_phys(kaddr)));
-}
-EXPORT_SYMBOL_GPL(__virt_addr_valid);
diff --git a/trunk/arch/mips/netlogic/xlr/setup.c b/trunk/arch/mips/netlogic/xlr/setup.c
index c5ce6992ac4c..4e7f49d3d5a8 100644
--- a/trunk/arch/mips/netlogic/xlr/setup.c
+++ b/trunk/arch/mips/netlogic/xlr/setup.c
@@ -193,11 +193,8 @@ static void nlm_init_node(void)
 
 void __init prom_init(void)
 {
-	int *argv, *envp;		/* passed as 32 bit ptrs */
+	int i, *argv, *envp;		/* passed as 32 bit ptrs */
 	struct psb_info *prom_infop;
-#ifdef CONFIG_SMP
-	int i;
-#endif
 
 	/* truncate to 32 bit and sign extend all args */
 	argv = (int *)(long)(int)fw_arg1;
diff --git a/trunk/arch/mips/pci/pci-ar71xx.c b/trunk/arch/mips/pci/pci-ar71xx.c
index 6eaa4f2d0e38..1552522b8718 100644
--- a/trunk/arch/mips/pci/pci-ar71xx.c
+++ b/trunk/arch/mips/pci/pci-ar71xx.c
@@ -24,7 +24,7 @@
 #include <asm/mach-ath79/pci.h>
 
 #define AR71XX_PCI_MEM_BASE	0x10000000
-#define AR71XX_PCI_MEM_SIZE	0x07000000
+#define AR71XX_PCI_MEM_SIZE	0x08000000
 
 #define AR71XX_PCI_WIN0_OFFS		0x10000000
 #define AR71XX_PCI_WIN1_OFFS		0x11000000
diff --git a/trunk/arch/mips/pci/pci-ar724x.c b/trunk/arch/mips/pci/pci-ar724x.c
index c11c75be2d7e..86d77a666458 100644
--- a/trunk/arch/mips/pci/pci-ar724x.c
+++ b/trunk/arch/mips/pci/pci-ar724x.c
@@ -21,7 +21,7 @@
 #define AR724X_PCI_CTRL_SIZE	0x100
 
 #define AR724X_PCI_MEM_BASE	0x10000000
-#define AR724X_PCI_MEM_SIZE	0x04000000
+#define AR724X_PCI_MEM_SIZE	0x08000000
 
 #define AR724X_PCI_REG_RESET		0x18
 #define AR724X_PCI_REG_INT_STATUS	0x4c
diff --git a/trunk/arch/powerpc/kernel/entry_32.S b/trunk/arch/powerpc/kernel/entry_32.S
index e514de57a125..d22e73e4618b 100644
--- a/trunk/arch/powerpc/kernel/entry_32.S
+++ b/trunk/arch/powerpc/kernel/entry_32.S
@@ -439,8 +439,6 @@ ret_from_fork:
 ret_from_kernel_thread:
 	REST_NVGPRS(r1)
 	bl	schedule_tail
-	li	r3,0
-	stw	r3,0(r1)
 	mtlr	r14
 	mr	r3,r15
 	PPC440EP_ERR42
diff --git a/trunk/arch/powerpc/kernel/entry_64.S b/trunk/arch/powerpc/kernel/entry_64.S
index 3d990d3bd8ba..b310a0573625 100644
--- a/trunk/arch/powerpc/kernel/entry_64.S
+++ b/trunk/arch/powerpc/kernel/entry_64.S
@@ -664,19 +664,6 @@ resume_kernel:
 	ld	r4,TI_FLAGS(r9)
 	andi.	r0,r4,_TIF_NEED_RESCHED
 	bne	1b
-
-	/*
-	 * arch_local_irq_restore() from preempt_schedule_irq above may
-	 * enable hard interrupt but we really should disable interrupts
-	 * when we return from the interrupt, and so that we don't get
-	 * interrupted after loading SRR0/1.
-	 */
-#ifdef CONFIG_PPC_BOOK3E
-	wrteei	0
-#else
-	ld	r10,PACAKMSR(r13) /* Get kernel MSR without EE */
-	mtmsrd	r10,1		  /* Update machine state */
-#endif /* CONFIG_PPC_BOOK3E */
 #endif /* CONFIG_PREEMPT */
 
 	.globl	fast_exc_return_irq
diff --git a/trunk/arch/powerpc/kernel/kgdb.c b/trunk/arch/powerpc/kernel/kgdb.c
index a7bc7521c064..c470a40b29f5 100644
--- a/trunk/arch/powerpc/kernel/kgdb.c
+++ b/trunk/arch/powerpc/kernel/kgdb.c
@@ -154,12 +154,12 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs)
 static int kgdb_singlestep(struct pt_regs *regs)
 {
 	struct thread_info *thread_info, *exception_thread_info;
-	struct thread_info *backup_current_thread_info;
+	struct thread_info *backup_current_thread_info = \
+		(struct thread_info *)kmalloc(sizeof(struct thread_info), GFP_KERNEL);
 
 	if (user_mode(regs))
 		return 0;
 
-	backup_current_thread_info = (struct thread_info *)kmalloc(sizeof(struct thread_info), GFP_KERNEL);
 	/*
 	 * On Book E and perhaps other processors, singlestep is handled on
 	 * the critical exception stack.  This causes current_thread_info()
@@ -185,7 +185,6 @@ static int kgdb_singlestep(struct pt_regs *regs)
 		/* Restore current_thread_info lastly. */
 		memcpy(exception_thread_info, backup_current_thread_info, sizeof *thread_info);
 
-	kfree(backup_current_thread_info);
 	return 1;
 }
 
diff --git a/trunk/arch/powerpc/kernel/time.c b/trunk/arch/powerpc/kernel/time.c
index 127361e093f4..6f6b1cccc916 100644
--- a/trunk/arch/powerpc/kernel/time.c
+++ b/trunk/arch/powerpc/kernel/time.c
@@ -494,15 +494,10 @@ void timer_interrupt(struct pt_regs * regs)
 	set_dec(DECREMENTER_MAX);
 
 	/* Some implementations of hotplug will get timer interrupts while
-	 * offline, just ignore these and we also need to set
-	 * decrementers_next_tb as MAX to make sure __check_irq_replay
-	 * don't replay timer interrupt when return, otherwise we'll trap
-	 * here infinitely :(
+	 * offline, just ignore these
 	 */
-	if (!cpu_online(smp_processor_id())) {
-		*next_tb = ~(u64)0;
+	if (!cpu_online(smp_processor_id()))
 		return;
-	}
 
 	/* Conditionally hard-enable interrupts now that the DEC has been
 	 * bumped to its maximum value
diff --git a/trunk/arch/powerpc/oprofile/op_model_power4.c b/trunk/arch/powerpc/oprofile/op_model_power4.c
index f444b94935f5..315f9495e9b2 100644
--- a/trunk/arch/powerpc/oprofile/op_model_power4.c
+++ b/trunk/arch/powerpc/oprofile/op_model_power4.c
@@ -52,7 +52,7 @@ static int power7_marked_instr_event(u64 mmcr1)
 	for (pmc = 0; pmc < 4; pmc++) {
 		psel = mmcr1 & (OPROFILE_PM_PMCSEL_MSK
 				<< (OPROFILE_MAX_PMC_NUM - pmc)
-				* OPROFILE_PMSEL_FIELD_WIDTH);
+				* OPROFILE_MAX_PMC_NUM);
 		psel = (psel >> ((OPROFILE_MAX_PMC_NUM - pmc)
 				 * OPROFILE_PMSEL_FIELD_WIDTH)) & ~1ULL;
 		unit = mmcr1 & (OPROFILE_PM_UNIT_MSK
diff --git a/trunk/arch/powerpc/platforms/pasemi/cpufreq.c b/trunk/arch/powerpc/platforms/pasemi/cpufreq.c
index 890f30e70f98..95d00173029f 100644
--- a/trunk/arch/powerpc/platforms/pasemi/cpufreq.c
+++ b/trunk/arch/powerpc/platforms/pasemi/cpufreq.c
@@ -236,13 +236,6 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
 
 static int pas_cpufreq_cpu_exit(struct cpufreq_policy *policy)
 {
-	/*
-	 * We don't support CPU hotplug. Don't unmap after the system
-	 * has already made it to a running state.
-	 */
-	if (system_state != SYSTEM_BOOTING)
-		return 0;
-
 	if (sdcasr_mapbase)
 		iounmap(sdcasr_mapbase);
 	if (sdcpwr_mapbase)
diff --git a/trunk/arch/s390/include/asm/pgtable.h b/trunk/arch/s390/include/asm/pgtable.h
index 098adbb62660..c1d7930a82f4 100644
--- a/trunk/arch/s390/include/asm/pgtable.h
+++ b/trunk/arch/s390/include/asm/pgtable.h
@@ -1365,18 +1365,6 @@ static inline void pmdp_invalidate(struct vm_area_struct *vma,
 	__pmd_idte(address, pmdp);
 }
 
-#define __HAVE_ARCH_PMDP_SET_WRPROTECT
-static inline void pmdp_set_wrprotect(struct mm_struct *mm,
-				      unsigned long address, pmd_t *pmdp)
-{
-	pmd_t pmd = *pmdp;
-
-	if (pmd_write(pmd)) {
-		__pmd_idte(address, pmdp);
-		set_pmd_at(mm, address, pmdp, pmd_wrprotect(pmd));
-	}
-}
-
 static inline pmd_t mk_pmd_phys(unsigned long physpage, pgprot_t pgprot)
 {
 	pmd_t __pmd;
diff --git a/trunk/arch/x86/Kconfig b/trunk/arch/x86/Kconfig
index 225543bf45a5..79795af59810 100644
--- a/trunk/arch/x86/Kconfig
+++ b/trunk/arch/x86/Kconfig
@@ -2138,7 +2138,6 @@ config OLPC_XO1_RTC
 config OLPC_XO1_SCI
 	bool "OLPC XO-1 SCI extras"
 	depends on OLPC && OLPC_XO1_PM
-	depends on INPUT=y
 	select POWER_SUPPLY
 	select GPIO_CS5535
 	select MFD_CORE
diff --git a/trunk/arch/x86/boot/Makefile b/trunk/arch/x86/boot/Makefile
index 379814bc41e3..ccce0ed67dde 100644
--- a/trunk/arch/x86/boot/Makefile
+++ b/trunk/arch/x86/boot/Makefile
@@ -71,7 +71,7 @@ GCOV_PROFILE := n
 $(obj)/bzImage: asflags-y  := $(SVGA_MODE)
 
 quiet_cmd_image = BUILD   $@
-cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/zoffset.h > $@
+cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin > $@
 
 $(obj)/bzImage: $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/tools/build FORCE
 	$(call if_changed,image)
@@ -92,7 +92,7 @@ targets += voffset.h
 $(obj)/voffset.h: vmlinux FORCE
 	$(call if_changed,voffset)
 
-sed-zoffset := -e 's/^\([0-9a-fA-F]*\) . \(startup_32\|startup_64\|efi_pe_entry\|efi_stub_entry\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
+sed-zoffset := -e 's/^\([0-9a-fA-F]*\) . \(startup_32\|input_data\|_end\|z_.*\)$$/\#define ZO_\2 0x\1/p'
 
 quiet_cmd_zoffset = ZOFFSET $@
       cmd_zoffset = $(NM) $< | sed -n $(sed-zoffset) > $@
diff --git a/trunk/arch/x86/boot/compressed/eboot.c b/trunk/arch/x86/boot/compressed/eboot.c
index f8fa41190c35..18e329ca108e 100644
--- a/trunk/arch/x86/boot/compressed/eboot.c
+++ b/trunk/arch/x86/boot/compressed/eboot.c
@@ -256,10 +256,10 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
 	int i;
 	struct setup_data *data;
 
-	data = (struct setup_data *)(unsigned long)params->hdr.setup_data;
+	data = (struct setup_data *)params->hdr.setup_data;
 
 	while (data && data->next)
-		data = (struct setup_data *)(unsigned long)data->next;
+		data = (struct setup_data *)data->next;
 
 	status = efi_call_phys5(sys_table->boottime->locate_handle,
 				EFI_LOCATE_BY_PROTOCOL, &pci_proto,
@@ -295,18 +295,16 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
 		if (!pci)
 			continue;
 
-#ifdef CONFIG_X86_64
 		status = efi_call_phys4(pci->attributes, pci,
 					EfiPciIoAttributeOperationGet, 0,
 					&attributes);
-#else
-		status = efi_call_phys5(pci->attributes, pci,
-					EfiPciIoAttributeOperationGet, 0, 0,
-					&attributes);
-#endif
+
 		if (status != EFI_SUCCESS)
 			continue;
 
+		if (!(attributes & EFI_PCI_IO_ATTRIBUTE_EMBEDDED_ROM))
+			continue;
+
 		if (!pci->romimage || !pci->romsize)
 			continue;
 
@@ -347,9 +345,9 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
 		memcpy(rom->romdata, pci->romimage, pci->romsize);
 
 		if (data)
-			data->next = (unsigned long)rom;
+			data->next = (uint64_t)rom;
 		else
-			params->hdr.setup_data = (unsigned long)rom;
+			params->hdr.setup_data = (uint64_t)rom;
 
 		data = (struct setup_data *)rom;
 
@@ -434,9 +432,10 @@ static efi_status_t setup_gop(struct screen_info *si, efi_guid_t *proto,
 			 * Once we've found a GOP supporting ConOut,
 			 * don't bother looking any further.
 			 */
-			first_gop = gop;
 			if (conout_found)
 				break;
+
+			first_gop = gop;
 		}
 	}
 
diff --git a/trunk/arch/x86/boot/compressed/head_32.S b/trunk/arch/x86/boot/compressed/head_32.S
index 1e3184f6072f..aa4aaf1b2380 100644
--- a/trunk/arch/x86/boot/compressed/head_32.S
+++ b/trunk/arch/x86/boot/compressed/head_32.S
@@ -35,11 +35,11 @@ ENTRY(startup_32)
 #ifdef CONFIG_EFI_STUB
 	jmp	preferred_addr
 
+	.balign	0x10
 	/*
 	 * We don't need the return address, so set up the stack so
-	 * efi_main() can find its arguments.
+	 * efi_main() can find its arugments.
 	 */
-ENTRY(efi_pe_entry)
 	add	$0x4, %esp
 
 	call	make_boot_params
@@ -50,10 +50,8 @@ ENTRY(efi_pe_entry)
 	pushl	%eax
 	pushl	%esi
 	pushl	%ecx
-	sub	$0x4, %esp
 
-ENTRY(efi_stub_entry)
-	add	$0x4, %esp
+	.org 0x30,0x90
 	call	efi_main
 	cmpl	$0, %eax
 	movl	%eax, %esi
diff --git a/trunk/arch/x86/boot/compressed/head_64.S b/trunk/arch/x86/boot/compressed/head_64.S
index f5d1aaa0dec8..2c4b171eec33 100644
--- a/trunk/arch/x86/boot/compressed/head_64.S
+++ b/trunk/arch/x86/boot/compressed/head_64.S
@@ -201,12 +201,12 @@ ENTRY(startup_64)
 	 */
 #ifdef CONFIG_EFI_STUB
 	/*
-	 * The entry point for the PE/COFF executable is efi_pe_entry, so
-	 * only legacy boot loaders will execute this jmp.
+	 * The entry point for the PE/COFF executable is 0x210, so only
+	 * legacy boot loaders will execute this jmp.
 	 */
 	jmp	preferred_addr
 
-ENTRY(efi_pe_entry)
+	.org 0x210
 	mov	%rcx, %rdi
 	mov	%rdx, %rsi
 	pushq	%rdi
@@ -218,7 +218,7 @@ ENTRY(efi_pe_entry)
 	popq	%rsi
 	popq	%rdi
 
-ENTRY(efi_stub_entry)
+	.org 0x230,0x90
 	call	efi_main
 	movq	%rax,%rsi
 	cmpq	$0,%rax
diff --git a/trunk/arch/x86/boot/header.S b/trunk/arch/x86/boot/header.S
index 944ce595f767..8c132a625b94 100644
--- a/trunk/arch/x86/boot/header.S
+++ b/trunk/arch/x86/boot/header.S
@@ -21,7 +21,6 @@
 #include <asm/e820.h>
 #include <asm/page_types.h>
 #include <asm/setup.h>
-#include <asm/bootparam.h>
 #include "boot.h"
 #include "voffset.h"
 #include "zoffset.h"
@@ -256,9 +255,6 @@ section_table:
 	# header, from the old boot sector.
 
 	.section ".header", "a"
-	.globl	sentinel
-sentinel:	.byte 0xff, 0xff        /* Used to detect broken loaders */
-
 	.globl	hdr
 hdr:
 setup_sects:	.byte 0			/* Filled in by build.c */
@@ -283,7 +279,7 @@ _start:
 	# Part 2 of the header, from the old setup.S
 
 		.ascii	"HdrS"		# header signature
-		.word	0x020c		# header version number (>= 0x0105)
+		.word	0x020b		# header version number (>= 0x0105)
 					# or else old loadlin-1.5 will fail)
 		.globl realmode_swtch
 realmode_swtch:	.word	0, 0		# default_switch, SETUPSEG
@@ -301,7 +297,13 @@ type_of_loader:	.byte	0		# 0 means ancient bootloader, newer
 
 # flags, unused bits must be zero (RFU) bit within loadflags
 loadflags:
-		.byte	LOADED_HIGH	# The kernel is to be loaded high
+LOADED_HIGH	= 1			# If set, the kernel is loaded high
+CAN_USE_HEAP	= 0x80			# If set, the loader also has set
+					# heap_end_ptr to tell how much
+					# space behind setup.S can be used for
+					# heap purposes.
+					# Only the loader knows what is free
+		.byte	LOADED_HIGH
 
 setup_move_size: .word  0x8000		# size to move, when setup is not
 					# loaded at 0x90000. We will move setup
@@ -367,23 +369,7 @@ relocatable_kernel:    .byte 1
 relocatable_kernel:    .byte 0
 #endif
 min_alignment:		.byte MIN_KERNEL_ALIGN_LG2	# minimum alignment
-
-xloadflags:
-#ifdef CONFIG_X86_64
-# define XLF0 XLF_KERNEL_64			/* 64-bit kernel */
-#else
-# define XLF0 0
-#endif
-#ifdef CONFIG_EFI_STUB
-# ifdef CONFIG_X86_64
-#  define XLF23 XLF_EFI_HANDOVER_64		/* 64-bit EFI handover ok */
-# else
-#  define XLF23 XLF_EFI_HANDOVER_32		/* 32-bit EFI handover ok */
-# endif
-#else
-# define XLF23 0
-#endif
-			.word XLF0 | XLF23
+pad3:			.word 0
 
 cmdline_size:   .long   COMMAND_LINE_SIZE-1     #length of the command line,
                                                 #added with boot protocol
@@ -411,13 +397,8 @@ pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
 #define INIT_SIZE VO_INIT_SIZE
 #endif
 init_size:		.long INIT_SIZE		# kernel initialization size
-handover_offset:
-#ifdef CONFIG_EFI_STUB
-  			.long 0x30		# offset to the handover
+handover_offset:	.long 0x30		# offset to the handover
 						# protocol entry point
-#else
-			.long 0
-#endif
 
 # End of setup header #####################################################
 
diff --git a/trunk/arch/x86/boot/setup.ld b/trunk/arch/x86/boot/setup.ld
index 96a6c7563538..03c0683636b6 100644
--- a/trunk/arch/x86/boot/setup.ld
+++ b/trunk/arch/x86/boot/setup.ld
@@ -13,7 +13,7 @@ SECTIONS
 	.bstext		: { *(.bstext) }
 	.bsdata		: { *(.bsdata) }
 
-	. = 495;
+	. = 497;
 	.header		: { *(.header) }
 	.entrytext	: { *(.entrytext) }
 	.inittext	: { *(.inittext) }
diff --git a/trunk/arch/x86/boot/tools/build.c b/trunk/arch/x86/boot/tools/build.c
index 94c544650020..4b8e165ee572 100644
--- a/trunk/arch/x86/boot/tools/build.c
+++ b/trunk/arch/x86/boot/tools/build.c
@@ -52,10 +52,6 @@ int is_big_kernel;
 
 #define PECOFF_RELOC_RESERVE 0x20
 
-unsigned long efi_stub_entry;
-unsigned long efi_pe_entry;
-unsigned long startup_64;
-
 /*----------------------------------------------------------------------*/
 
 static const u32 crctab32[] = {
@@ -136,7 +132,7 @@ static void die(const char * str, ...)
 
 static void usage(void)
 {
-	die("Usage: build setup system [zoffset.h] [> image]");
+	die("Usage: build setup system [> image]");
 }
 
 #ifdef CONFIG_EFI_STUB
@@ -210,54 +206,30 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
 	 */
 	put_unaligned_le32(file_sz - 512, &buf[pe_header + 0x1c]);
 
+#ifdef CONFIG_X86_32
 	/*
-	 * Address of entry point for PE/COFF executable
+	 * Address of entry point.
+	 *
+	 * The EFI stub entry point is +16 bytes from the start of
+	 * the .text section.
 	 */
-	put_unaligned_le32(text_start + efi_pe_entry, &buf[pe_header + 0x28]);
+	put_unaligned_le32(text_start + 16, &buf[pe_header + 0x28]);
+#else
+	/*
+	 * Address of entry point. startup_32 is at the beginning and
+	 * the 64-bit entry point (startup_64) is always 512 bytes
+	 * after. The EFI stub entry point is 16 bytes after that, as
+	 * the first instruction allows legacy loaders to jump over
+	 * the EFI stub initialisation
+	 */
+	put_unaligned_le32(text_start + 528, &buf[pe_header + 0x28]);
+#endif /* CONFIG_X86_32 */
 
 	update_pecoff_section_header(".text", text_start, text_sz);
 }
 
 #endif /* CONFIG_EFI_STUB */
 
-
-/*
- * Parse zoffset.h and find the entry points. We could just #include zoffset.h
- * but that would mean tools/build would have to be rebuilt every time. It's
- * not as if parsing it is hard...
- */
-#define PARSE_ZOFS(p, sym) do { \
-	if (!strncmp(p, "#define ZO_" #sym " ", 11+sizeof(#sym)))	\
-		sym = strtoul(p + 11 + sizeof(#sym), NULL, 16);		\
-} while (0)
-
-static void parse_zoffset(char *fname)
-{
-	FILE *file;
-	char *p;
-	int c;
-
-	file = fopen(fname, "r");
-	if (!file)
-		die("Unable to open `%s': %m", fname);
-	c = fread(buf, 1, sizeof(buf) - 1, file);
-	if (ferror(file))
-		die("read-error on `zoffset.h'");
-	buf[c] = 0;
-
-	p = (char *)buf;
-
-	while (p && *p) {
-		PARSE_ZOFS(p, efi_stub_entry);
-		PARSE_ZOFS(p, efi_pe_entry);
-		PARSE_ZOFS(p, startup_64);
-
-		p = strchr(p, '\n');
-		while (p && (*p == '\r' || *p == '\n'))
-			p++;
-	}
-}
-
 int main(int argc, char ** argv)
 {
 	unsigned int i, sz, setup_sectors;
@@ -269,19 +241,7 @@ int main(int argc, char ** argv)
 	void *kernel;
 	u32 crc = 0xffffffffUL;
 
-	/* Defaults for old kernel */
-#ifdef CONFIG_X86_32
-	efi_pe_entry = 0x10;
-	efi_stub_entry = 0x30;
-#else
-	efi_pe_entry = 0x210;
-	efi_stub_entry = 0x230;
-	startup_64 = 0x200;
-#endif
-
-	if (argc == 4)
-		parse_zoffset(argv[3]);
-	else if (argc != 3)
+	if (argc != 3)
 		usage();
 
 	/* Copy the setup code */
@@ -339,11 +299,6 @@ int main(int argc, char ** argv)
 
 #ifdef CONFIG_EFI_STUB
 	update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
-
-#ifdef CONFIG_X86_64 /* Yes, this is really how we defined it :( */
-	efi_stub_entry -= 0x200;
-#endif
-	put_unaligned_le32(efi_stub_entry, &buf[0x264]);
 #endif
 
 	crc = partial_crc32(buf, i, crc);
diff --git a/trunk/arch/x86/include/asm/efi.h b/trunk/arch/x86/include/asm/efi.h
index 28677c55113f..6e8fdf5ad113 100644
--- a/trunk/arch/x86/include/asm/efi.h
+++ b/trunk/arch/x86/include/asm/efi.h
@@ -94,7 +94,6 @@ extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
 #endif /* CONFIG_X86_32 */
 
 extern int add_efi_memmap;
-extern unsigned long x86_efi_facility;
 extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
 extern int efi_memblock_x86_reserve_range(void);
 extern void efi_call_phys_prelog(void);
diff --git a/trunk/arch/x86/include/asm/uv/uv.h b/trunk/arch/x86/include/asm/uv/uv.h
index 062921ef34e9..b47c2a82ff15 100644
--- a/trunk/arch/x86/include/asm/uv/uv.h
+++ b/trunk/arch/x86/include/asm/uv/uv.h
@@ -16,7 +16,7 @@ extern void uv_system_init(void);
 extern const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
 						 struct mm_struct *mm,
 						 unsigned long start,
-						 unsigned long end,
+						 unsigned end,
 						 unsigned int cpu);
 
 #else	/* X86_UV */
diff --git a/trunk/arch/x86/include/uapi/asm/bootparam.h b/trunk/arch/x86/include/uapi/asm/bootparam.h
index c15ddaf90710..92862cd90201 100644
--- a/trunk/arch/x86/include/uapi/asm/bootparam.h
+++ b/trunk/arch/x86/include/uapi/asm/bootparam.h
@@ -1,31 +1,6 @@
 #ifndef _ASM_X86_BOOTPARAM_H
 #define _ASM_X86_BOOTPARAM_H
 
-/* setup_data types */
-#define SETUP_NONE			0
-#define SETUP_E820_EXT			1
-#define SETUP_DTB			2
-#define SETUP_PCI			3
-
-/* ram_size flags */
-#define RAMDISK_IMAGE_START_MASK	0x07FF
-#define RAMDISK_PROMPT_FLAG		0x8000
-#define RAMDISK_LOAD_FLAG		0x4000
-
-/* loadflags */
-#define LOADED_HIGH	(1<<0)
-#define QUIET_FLAG	(1<<5)
-#define KEEP_SEGMENTS	(1<<6)
-#define CAN_USE_HEAP	(1<<7)
-
-/* xloadflags */
-#define XLF_KERNEL_64			(1<<0)
-#define XLF_CAN_BE_LOADED_ABOVE_4G	(1<<1)
-#define XLF_EFI_HANDOVER_32		(1<<2)
-#define XLF_EFI_HANDOVER_64		(1<<3)
-
-#ifndef __ASSEMBLY__
-
 #include <linux/types.h>
 #include <linux/screen_info.h>
 #include <linux/apm_bios.h>
@@ -34,6 +9,12 @@
 #include <asm/ist.h>
 #include <video/edid.h>
 
+/* setup data types */
+#define SETUP_NONE			0
+#define SETUP_E820_EXT			1
+#define SETUP_DTB			2
+#define SETUP_PCI			3
+
 /* extensible setup data list node */
 struct setup_data {
 	__u64 next;
@@ -47,6 +28,9 @@ struct setup_header {
 	__u16	root_flags;
 	__u32	syssize;
 	__u16	ram_size;
+#define RAMDISK_IMAGE_START_MASK	0x07FF
+#define RAMDISK_PROMPT_FLAG		0x8000
+#define RAMDISK_LOAD_FLAG		0x4000
 	__u16	vid_mode;
 	__u16	root_dev;
 	__u16	boot_flag;
@@ -58,6 +42,10 @@ struct setup_header {
 	__u16	kernel_version;
 	__u8	type_of_loader;
 	__u8	loadflags;
+#define LOADED_HIGH	(1<<0)
+#define QUIET_FLAG	(1<<5)
+#define KEEP_SEGMENTS	(1<<6)
+#define CAN_USE_HEAP	(1<<7)
 	__u16	setup_move_size;
 	__u32	code32_start;
 	__u32	ramdisk_image;
@@ -70,8 +58,7 @@ struct setup_header {
 	__u32	initrd_addr_max;
 	__u32	kernel_alignment;
 	__u8	relocatable_kernel;
-	__u8	min_alignment;
-	__u16	xloadflags;
+	__u8	_pad2[3];
 	__u32	cmdline_size;
 	__u32	hardware_subarch;
 	__u64	hardware_subarch_data;
@@ -119,10 +106,7 @@ struct boot_params {
 	__u8  hd1_info[16];	/* obsolete! */		/* 0x090 */
 	struct sys_desc_table sys_desc_table;		/* 0x0a0 */
 	struct olpc_ofw_header olpc_ofw_header;		/* 0x0b0 */
-	__u32 ext_ramdisk_image;			/* 0x0c0 */
-	__u32 ext_ramdisk_size;				/* 0x0c4 */
-	__u32 ext_cmd_line_ptr;				/* 0x0c8 */
-	__u8  _pad4[116];				/* 0x0cc */
+	__u8  _pad4[128];				/* 0x0c0 */
 	struct edid_info edid_info;			/* 0x140 */
 	struct efi_info efi_info;			/* 0x1c0 */
 	__u32 alt_mem_k;				/* 0x1e0 */
@@ -131,20 +115,7 @@ struct boot_params {
 	__u8  eddbuf_entries;				/* 0x1e9 */
 	__u8  edd_mbr_sig_buf_entries;			/* 0x1ea */
 	__u8  kbd_status;				/* 0x1eb */
-	__u8  _pad5[3];					/* 0x1ec */
-	/*
-	 * The sentinel is set to a nonzero value (0xff) in header.S.
-	 *
-	 * A bootloader is supposed to only take setup_header and put
-	 * it into a clean boot_params buffer. If it turns out that
-	 * it is clumsy or too generous with the buffer, it most
-	 * probably will pick up the sentinel variable too. The fact
-	 * that this variable then is still 0xff will let kernel
-	 * know that some variables in boot_params are invalid and
-	 * kernel should zero out certain portions of boot_params.
-	 */
-	__u8  sentinel;					/* 0x1ef */
-	__u8  _pad6[1];					/* 0x1f0 */
+	__u8  _pad6[5];					/* 0x1ec */
 	struct setup_header hdr;    /* setup header */	/* 0x1f1 */
 	__u8  _pad7[0x290-0x1f1-sizeof(struct setup_header)];
 	__u32 edd_mbr_sig_buffer[EDD_MBR_SIG_MAX];	/* 0x290 */
@@ -163,6 +134,6 @@ enum {
 	X86_NR_SUBARCHS,
 };
 
-#endif /* __ASSEMBLY__ */
+
 
 #endif /* _ASM_X86_BOOTPARAM_H */
diff --git a/trunk/arch/x86/kernel/entry_64.S b/trunk/arch/x86/kernel/entry_64.S
index cb3c591339aa..07a7a04529bc 100644
--- a/trunk/arch/x86/kernel/entry_64.S
+++ b/trunk/arch/x86/kernel/entry_64.S
@@ -1781,7 +1781,6 @@ first_nmi:
 	 * Leave room for the "copied" frame
 	 */
 	subq $(5*8), %rsp
-	CFI_ADJUST_CFA_OFFSET 5*8
 
 	/* Copy the stack frame to the Saved frame */
 	.rept 5
@@ -1864,8 +1863,10 @@ end_repeat_nmi:
 nmi_swapgs:
 	SWAPGS_UNSAFE_STACK
 nmi_restore:
-	/* Pop the extra iret frame at once */
-	RESTORE_ALL 6*8
+	RESTORE_ALL 8
+
+	/* Pop the extra iret frame */
+	addq $(5*8), %rsp
 
 	/* Clear the NMI executing stack variable */
 	movq $0, 5*8(%rsp)
diff --git a/trunk/arch/x86/kernel/head_32.S b/trunk/arch/x86/kernel/head_32.S
index c8932c79e78b..8e7f6556028f 100644
--- a/trunk/arch/x86/kernel/head_32.S
+++ b/trunk/arch/x86/kernel/head_32.S
@@ -300,12 +300,6 @@ ENTRY(startup_32_smp)
 	leal -__PAGE_OFFSET(%ecx),%esp
 
 default_entry:
-#define CR0_STATE	(X86_CR0_PE | X86_CR0_MP | X86_CR0_ET | \
-			 X86_CR0_NE | X86_CR0_WP | X86_CR0_AM | \
-			 X86_CR0_PG)
-	movl $(CR0_STATE & ~X86_CR0_PG),%eax
-	movl %eax,%cr0
-
 /*
  *	New page tables may be in 4Mbyte page mode and may
  *	be using the global pages. 
@@ -370,7 +364,8 @@ default_entry:
  */
 	movl $pa(initial_page_table), %eax
 	movl %eax,%cr3		/* set the page table pointer.. */
-	movl $CR0_STATE,%eax
+	movl %cr0,%eax
+	orl  $X86_CR0_PG,%eax
 	movl %eax,%cr0		/* ..and set paging (PG) bit */
 	ljmp $__BOOT_CS,$1f	/* Clear prefetch and normalize %eip */
 1:
diff --git a/trunk/arch/x86/kernel/msr.c b/trunk/arch/x86/kernel/msr.c
index 4929502c1372..a7c5661f8496 100644
--- a/trunk/arch/x86/kernel/msr.c
+++ b/trunk/arch/x86/kernel/msr.c
@@ -174,9 +174,6 @@ static int msr_open(struct inode *inode, struct file *file)
 	unsigned int cpu;
 	struct cpuinfo_x86 *c;
 
-	if (!capable(CAP_SYS_RAWIO))
-		return -EPERM;
-
 	cpu = iminor(file->f_path.dentry->d_inode);
 	if (cpu >= nr_cpu_ids || !cpu_online(cpu))
 		return -ENXIO;	/* No such CPU */
diff --git a/trunk/arch/x86/kernel/pci-dma.c b/trunk/arch/x86/kernel/pci-dma.c
index 872079a67e4d..0f5dec5c80e0 100644
--- a/trunk/arch/x86/kernel/pci-dma.c
+++ b/trunk/arch/x86/kernel/pci-dma.c
@@ -56,7 +56,7 @@ struct device x86_dma_fallback_dev = {
 EXPORT_SYMBOL(x86_dma_fallback_dev);
 
 /* Number of entries preallocated for DMA-API debugging */
-#define PREALLOC_DMA_DEBUG_ENTRIES       65536
+#define PREALLOC_DMA_DEBUG_ENTRIES       32768
 
 int dma_set_mask(struct device *dev, u64 mask)
 {
diff --git a/trunk/arch/x86/kernel/reboot.c b/trunk/arch/x86/kernel/reboot.c
index 76fa1e9a2b39..4e8ba39eaf0f 100644
--- a/trunk/arch/x86/kernel/reboot.c
+++ b/trunk/arch/x86/kernel/reboot.c
@@ -584,7 +584,7 @@ static void native_machine_emergency_restart(void)
 			break;
 
 		case BOOT_EFI:
-			if (efi_enabled(EFI_RUNTIME_SERVICES))
+			if (efi_enabled)
 				efi.reset_system(reboot_mode ?
 						 EFI_RESET_WARM :
 						 EFI_RESET_COLD,
diff --git a/trunk/arch/x86/kernel/setup.c b/trunk/arch/x86/kernel/setup.c
index 8b24289cc10c..00f6c1472b85 100644
--- a/trunk/arch/x86/kernel/setup.c
+++ b/trunk/arch/x86/kernel/setup.c
@@ -807,15 +807,15 @@ void __init setup_arch(char **cmdline_p)
 #ifdef CONFIG_EFI
 	if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
 		     "EL32", 4)) {
-		set_bit(EFI_BOOT, &x86_efi_facility);
+		efi_enabled = 1;
+		efi_64bit = false;
 	} else if (!strncmp((char *)&boot_params.efi_info.efi_loader_signature,
 		     "EL64", 4)) {
-		set_bit(EFI_BOOT, &x86_efi_facility);
-		set_bit(EFI_64BIT, &x86_efi_facility);
+		efi_enabled = 1;
+		efi_64bit = true;
 	}
-
-	if (efi_enabled(EFI_BOOT))
-		efi_memblock_x86_reserve_range();
+	if (efi_enabled && efi_memblock_x86_reserve_range())
+		efi_enabled = 0;
 #endif
 
 	x86_init.oem.arch_setup();
@@ -888,7 +888,7 @@ void __init setup_arch(char **cmdline_p)
 
 	finish_e820_parsing();
 
-	if (efi_enabled(EFI_BOOT))
+	if (efi_enabled)
 		efi_init();
 
 	dmi_scan_machine();
@@ -971,7 +971,7 @@ void __init setup_arch(char **cmdline_p)
 	 * The EFI specification says that boot service code won't be called
 	 * after ExitBootServices(). This is, in fact, a lie.
 	 */
-	if (efi_enabled(EFI_MEMMAP))
+	if (efi_enabled)
 		efi_reserve_boot_services();
 
 	/* preallocate 4k for mptable mpc */
@@ -1114,7 +1114,7 @@ void __init setup_arch(char **cmdline_p)
 
 #ifdef CONFIG_VT
 #if defined(CONFIG_VGA_CONSOLE)
-	if (!efi_enabled(EFI_BOOT) || (efi_mem_type(0xa0000) != EFI_CONVENTIONAL_MEMORY))
+	if (!efi_enabled || (efi_mem_type(0xa0000) != EFI_CONVENTIONAL_MEMORY))
 		conswitchp = &vga_con;
 #elif defined(CONFIG_DUMMY_CONSOLE)
 	conswitchp = &dummy_con;
@@ -1131,14 +1131,14 @@ void __init setup_arch(char **cmdline_p)
 	register_refined_jiffies(CLOCK_TICK_RATE);
 
 #ifdef CONFIG_EFI
-	/* Once setup is done above, unmap the EFI memory map on
-	 * mismatched firmware/kernel archtectures since there is no
-	 * support for runtime services.
+	/* Once setup is done above, disable efi_enabled on mismatched
+	 * firmware/kernel archtectures since there is no support for
+	 * runtime services.
 	 */
-	if (efi_enabled(EFI_BOOT) &&
-	    IS_ENABLED(CONFIG_X86_64) != efi_enabled(EFI_64BIT)) {
+	if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) {
 		pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n");
 		efi_unmap_memmap();
+		efi_enabled = 0;
 	}
 #endif
 }
diff --git a/trunk/arch/x86/platform/efi/efi.c b/trunk/arch/x86/platform/efi/efi.c
index 77cf0090c0a3..ad4439145f85 100644
--- a/trunk/arch/x86/platform/efi/efi.c
+++ b/trunk/arch/x86/platform/efi/efi.c
@@ -51,6 +51,9 @@
 
 #define EFI_DEBUG	1
 
+int efi_enabled;
+EXPORT_SYMBOL(efi_enabled);
+
 struct efi __read_mostly efi = {
 	.mps        = EFI_INVALID_TABLE_ADDR,
 	.acpi       = EFI_INVALID_TABLE_ADDR,
@@ -66,28 +69,19 @@ EXPORT_SYMBOL(efi);
 
 struct efi_memory_map memmap;
 
+bool efi_64bit;
+
 static struct efi efi_phys __initdata;
 static efi_system_table_t efi_systab __initdata;
 
 static inline bool efi_is_native(void)
 {
-	return IS_ENABLED(CONFIG_X86_64) == efi_enabled(EFI_64BIT);
-}
-
-unsigned long x86_efi_facility;
-
-/*
- * Returns 1 if 'facility' is enabled, 0 otherwise.
- */
-int efi_enabled(int facility)
-{
-	return test_bit(facility, &x86_efi_facility) != 0;
+	return IS_ENABLED(CONFIG_X86_64) == efi_64bit;
 }
-EXPORT_SYMBOL(efi_enabled);
 
 static int __init setup_noefi(char *arg)
 {
-	clear_bit(EFI_BOOT, &x86_efi_facility);
+	efi_enabled = 0;
 	return 0;
 }
 early_param("noefi", setup_noefi);
@@ -432,7 +426,6 @@ void __init efi_reserve_boot_services(void)
 
 void __init efi_unmap_memmap(void)
 {
-	clear_bit(EFI_MEMMAP, &x86_efi_facility);
 	if (memmap.map) {
 		early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size);
 		memmap.map = NULL;
@@ -467,7 +460,7 @@ void __init efi_free_boot_services(void)
 
 static int __init efi_systab_init(void *phys)
 {
-	if (efi_enabled(EFI_64BIT)) {
+	if (efi_64bit) {
 		efi_system_table_64_t *systab64;
 		u64 tmp = 0;
 
@@ -559,7 +552,7 @@ static int __init efi_config_init(u64 tables, int nr_tables)
 	void *config_tables, *tablep;
 	int i, sz;
 
-	if (efi_enabled(EFI_64BIT))
+	if (efi_64bit)
 		sz = sizeof(efi_config_table_64_t);
 	else
 		sz = sizeof(efi_config_table_32_t);
@@ -579,7 +572,7 @@ static int __init efi_config_init(u64 tables, int nr_tables)
 		efi_guid_t guid;
 		unsigned long table;
 
-		if (efi_enabled(EFI_64BIT)) {
+		if (efi_64bit) {
 			u64 table64;
 			guid = ((efi_config_table_64_t *)tablep)->guid;
 			table64 = ((efi_config_table_64_t *)tablep)->table;
@@ -691,6 +684,7 @@ void __init efi_init(void)
 	if (boot_params.efi_info.efi_systab_hi ||
 	    boot_params.efi_info.efi_memmap_hi) {
 		pr_info("Table located above 4GB, disabling EFI.\n");
+		efi_enabled = 0;
 		return;
 	}
 	efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab;
@@ -700,10 +694,10 @@ void __init efi_init(void)
 			  ((__u64)boot_params.efi_info.efi_systab_hi<<32));
 #endif
 
-	if (efi_systab_init(efi_phys.systab))
+	if (efi_systab_init(efi_phys.systab)) {
+		efi_enabled = 0;
 		return;
-
-	set_bit(EFI_SYSTEM_TABLES, &x86_efi_facility);
+	}
 
 	/*
 	 * Show what we know for posterity
@@ -721,10 +715,10 @@ void __init efi_init(void)
 		efi.systab->hdr.revision >> 16,
 		efi.systab->hdr.revision & 0xffff, vendor);
 
-	if (efi_config_init(efi.systab->tables, efi.systab->nr_tables))
+	if (efi_config_init(efi.systab->tables, efi.systab->nr_tables)) {
+		efi_enabled = 0;
 		return;
-
-	set_bit(EFI_CONFIG_TABLES, &x86_efi_facility);
+	}
 
 	/*
 	 * Note: We currently don't support runtime services on an EFI
@@ -733,17 +727,15 @@ void __init efi_init(void)
 
 	if (!efi_is_native())
 		pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n");
-	else {
-		if (efi_runtime_init())
-			return;
-		set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility);
+	else if (efi_runtime_init()) {
+		efi_enabled = 0;
+		return;
 	}
 
-	if (efi_memmap_init())
+	if (efi_memmap_init()) {
+		efi_enabled = 0;
 		return;
-
-	set_bit(EFI_MEMMAP, &x86_efi_facility);
-
+	}
 #ifdef CONFIG_X86_32
 	if (efi_is_native()) {
 		x86_platform.get_wallclock = efi_get_time;
@@ -949,7 +941,7 @@ void __init efi_enter_virtual_mode(void)
 	 *
 	 * Call EFI services through wrapper functions.
 	 */
-	efi.runtime_version = efi_systab.hdr.revision;
+	efi.runtime_version = efi_systab.fw_revision;
 	efi.get_time = virt_efi_get_time;
 	efi.set_time = virt_efi_set_time;
 	efi.get_wakeup_time = virt_efi_get_wakeup_time;
@@ -977,9 +969,6 @@ u32 efi_mem_type(unsigned long phys_addr)
 	efi_memory_desc_t *md;
 	void *p;
 
-	if (!efi_enabled(EFI_MEMMAP))
-		return 0;
-
 	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
 		md = p;
 		if ((md->phys_addr <= phys_addr) &&
diff --git a/trunk/arch/x86/platform/efi/efi_64.c b/trunk/arch/x86/platform/efi/efi_64.c
index 2b2003860615..95fd505dfeb6 100644
--- a/trunk/arch/x86/platform/efi/efi_64.c
+++ b/trunk/arch/x86/platform/efi/efi_64.c
@@ -38,7 +38,7 @@
 #include <asm/cacheflush.h>
 #include <asm/fixmap.h>
 
-static pgd_t *save_pgd __initdata;
+static pgd_t save_pgd __initdata;
 static unsigned long efi_flags __initdata;
 
 static void __init early_code_mapping_set_exec(int executable)
@@ -61,20 +61,12 @@ static void __init early_code_mapping_set_exec(int executable)
 void __init efi_call_phys_prelog(void)
 {
 	unsigned long vaddress;
-	int pgd;
-	int n_pgds;
 
 	early_code_mapping_set_exec(1);
 	local_irq_save(efi_flags);
-
-	n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
-	save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
-
-	for (pgd = 0; pgd < n_pgds; pgd++) {
-		save_pgd[pgd] = *pgd_offset_k(pgd * PGDIR_SIZE);
-		vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
-		set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
-	}
+	vaddress = (unsigned long)__va(0x0UL);
+	save_pgd = *pgd_offset_k(0x0UL);
+	set_pgd(pgd_offset_k(0x0UL), *pgd_offset_k(vaddress));
 	__flush_tlb_all();
 }
 
@@ -83,11 +75,7 @@ void __init efi_call_phys_epilog(void)
 	/*
 	 * After the lock is released, the original page table is restored.
 	 */
-	int pgd;
-	int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
-	for (pgd = 0; pgd < n_pgds; pgd++)
-		set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
-	kfree(save_pgd);
+	set_pgd(pgd_offset_k(0x0UL), save_pgd);
 	__flush_tlb_all();
 	local_irq_restore(efi_flags);
 	early_code_mapping_set_exec(0);
diff --git a/trunk/arch/x86/platform/uv/tlb_uv.c b/trunk/arch/x86/platform/uv/tlb_uv.c
index dbbdca5f508c..b8b3a37c80cd 100644
--- a/trunk/arch/x86/platform/uv/tlb_uv.c
+++ b/trunk/arch/x86/platform/uv/tlb_uv.c
@@ -1034,8 +1034,7 @@ static int set_distrib_bits(struct cpumask *flush_mask, struct bau_control *bcp,
  * globally purge translation cache of a virtual address or all TLB's
  * @cpumask: mask of all cpu's in which the address is to be removed
  * @mm: mm_struct containing virtual address range
- * @start: start virtual address to be removed from TLB
- * @end: end virtual address to be remove from TLB
+ * @va: virtual address to be removed (or TLB_FLUSH_ALL for all TLB's on cpu)
  * @cpu: the current cpu
  *
  * This is the entry point for initiating any UV global TLB shootdown.
@@ -1057,7 +1056,7 @@ static int set_distrib_bits(struct cpumask *flush_mask, struct bau_control *bcp,
  */
 const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
 				struct mm_struct *mm, unsigned long start,
-				unsigned long end, unsigned int cpu)
+				unsigned end, unsigned int cpu)
 {
 	int locals = 0;
 	int remotes = 0;
@@ -1114,10 +1113,7 @@ const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
 
 	record_send_statistics(stat, locals, hubs, remotes, bau_desc);
 
-	if (!end || (end - start) <= PAGE_SIZE)
-		bau_desc->payload.address = start;
-	else
-		bau_desc->payload.address = TLB_FLUSH_ALL;
+	bau_desc->payload.address = start;
 	bau_desc->payload.sending_cpu = cpu;
 	/*
 	 * uv_flush_send_and_wait returns 0 if all cpu's were messaged,
diff --git a/trunk/arch/x86/tools/relocs.c b/trunk/arch/x86/tools/relocs.c
index 79d67bd507fa..5a1847d61930 100644
--- a/trunk/arch/x86/tools/relocs.c
+++ b/trunk/arch/x86/tools/relocs.c
@@ -814,14 +814,12 @@ int main(int argc, char **argv)
 	read_relocs(fp);
 	if (show_absolute_syms) {
 		print_absolute_symbols();
-		goto out;
+		return 0;
 	}
 	if (show_absolute_relocs) {
 		print_absolute_relocs();
-		goto out;
+		return 0;
 	}
 	emit_relocs(as_text, use_real_mode);
-out:
-	fclose(fp);
 	return 0;
 }
diff --git a/trunk/drivers/acpi/osl.c b/trunk/drivers/acpi/osl.c
index bd22f8667eed..3ff267861541 100644
--- a/trunk/drivers/acpi/osl.c
+++ b/trunk/drivers/acpi/osl.c
@@ -250,7 +250,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
 		return acpi_rsdp;
 #endif
 
-	if (efi_enabled(EFI_CONFIG_TABLES)) {
+	if (efi_enabled) {
 		if (efi.acpi20 != EFI_INVALID_TABLE_ADDR)
 			return efi.acpi20;
 		else if (efi.acpi != EFI_INVALID_TABLE_ADDR)
diff --git a/trunk/drivers/bluetooth/ath3k.c b/trunk/drivers/bluetooth/ath3k.c
index 33c9a44a9678..b00000e8aef6 100644
--- a/trunk/drivers/bluetooth/ath3k.c
+++ b/trunk/drivers/bluetooth/ath3k.c
@@ -77,15 +77,10 @@ static struct usb_device_id ath3k_table[] = {
 	{ USB_DEVICE(0x0CF3, 0x311D) },
 	{ USB_DEVICE(0x13d3, 0x3375) },
 	{ USB_DEVICE(0x04CA, 0x3005) },
-	{ USB_DEVICE(0x04CA, 0x3006) },
-	{ USB_DEVICE(0x04CA, 0x3008) },
 	{ USB_DEVICE(0x13d3, 0x3362) },
 	{ USB_DEVICE(0x0CF3, 0xE004) },
 	{ USB_DEVICE(0x0930, 0x0219) },
 	{ USB_DEVICE(0x0489, 0xe057) },
-	{ USB_DEVICE(0x13d3, 0x3393) },
-	{ USB_DEVICE(0x0489, 0xe04e) },
-	{ USB_DEVICE(0x0489, 0xe056) },
 
 	/* Atheros AR5BBU12 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE02C) },
@@ -109,15 +104,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
 	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU22 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
diff --git a/trunk/drivers/bluetooth/btusb.c b/trunk/drivers/bluetooth/btusb.c
index 7e351e345476..a1d4ede5b892 100644
--- a/trunk/drivers/bluetooth/btusb.c
+++ b/trunk/drivers/bluetooth/btusb.c
@@ -135,15 +135,10 @@ static struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
-	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
 	/* Atheros AR5BBU12 with sflash firmware */
 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/trunk/drivers/edac/edac_mc.c b/trunk/drivers/edac/edac_mc.c
index d1e9eb191f2b..281f566a5513 100644
--- a/trunk/drivers/edac/edac_mc.c
+++ b/trunk/drivers/edac/edac_mc.c
@@ -340,7 +340,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
 	/*
 	 * Alocate and fill the csrow/channels structs
 	 */
-	mci->csrows = kcalloc(tot_csrows, sizeof(*mci->csrows), GFP_KERNEL);
+	mci->csrows = kcalloc(sizeof(*mci->csrows), tot_csrows, GFP_KERNEL);
 	if (!mci->csrows)
 		goto error;
 	for (row = 0; row < tot_csrows; row++) {
@@ -351,7 +351,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
 		csr->csrow_idx = row;
 		csr->mci = mci;
 		csr->nr_channels = tot_channels;
-		csr->channels = kcalloc(tot_channels, sizeof(*csr->channels),
+		csr->channels = kcalloc(sizeof(*csr->channels), tot_channels,
 					GFP_KERNEL);
 		if (!csr->channels)
 			goto error;
@@ -369,7 +369,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
 	/*
 	 * Allocate and fill the dimm structs
 	 */
-	mci->dimms  = kcalloc(tot_dimms, sizeof(*mci->dimms), GFP_KERNEL);
+	mci->dimms  = kcalloc(sizeof(*mci->dimms), tot_dimms, GFP_KERNEL);
 	if (!mci->dimms)
 		goto error;
 
diff --git a/trunk/drivers/edac/edac_pci_sysfs.c b/trunk/drivers/edac/edac_pci_sysfs.c
index 0056c4dae9d5..dc6e905ee1a5 100644
--- a/trunk/drivers/edac/edac_pci_sysfs.c
+++ b/trunk/drivers/edac/edac_pci_sysfs.c
@@ -256,7 +256,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
 	struct edac_pci_dev_attribute *edac_pci_dev;
 	edac_pci_dev = (struct edac_pci_dev_attribute *)attr;
 
-	if (edac_pci_dev->store)
+	if (edac_pci_dev->show)
 		return edac_pci_dev->store(edac_pci_dev->value, buffer, count);
 	return -EIO;
 }
diff --git a/trunk/drivers/firmware/dmi_scan.c b/trunk/drivers/firmware/dmi_scan.c
index 982f1f5f5742..fd3ae6290d71 100644
--- a/trunk/drivers/firmware/dmi_scan.c
+++ b/trunk/drivers/firmware/dmi_scan.c
@@ -471,7 +471,7 @@ void __init dmi_scan_machine(void)
 	char __iomem *p, *q;
 	int rc;
 
-	if (efi_enabled(EFI_CONFIG_TABLES)) {
+	if (efi_enabled) {
 		if (efi.smbios == EFI_INVALID_TABLE_ADDR)
 			goto error;
 
diff --git a/trunk/drivers/firmware/efivars.c b/trunk/drivers/firmware/efivars.c
index f5596db0cf58..7b1c37497c9a 100644
--- a/trunk/drivers/firmware/efivars.c
+++ b/trunk/drivers/firmware/efivars.c
@@ -674,7 +674,7 @@ static int efi_status_to_err(efi_status_t status)
 		err = -EACCES;
 		break;
 	case EFI_NOT_FOUND:
-		err = -EIO;
+		err = -ENOENT;
 		break;
 	default:
 		err = -EINVAL;
@@ -793,7 +793,6 @@ static ssize_t efivarfs_file_write(struct file *file,
 		spin_unlock(&efivars->lock);
 		efivar_unregister(var);
 		drop_nlink(inode);
-		d_delete(file->f_dentry);
 		dput(file->f_dentry);
 
 	} else {
@@ -995,7 +994,7 @@ static int efivarfs_unlink(struct inode *dir, struct dentry *dentry)
 		list_del(&var->list);
 		spin_unlock(&efivars->lock);
 		efivar_unregister(var);
-		drop_nlink(dentry->d_inode);
+		drop_nlink(dir);
 		dput(dentry);
 		return 0;
 	}
@@ -1783,7 +1782,7 @@ efivars_init(void)
 	printk(KERN_INFO "EFI Variables Facility v%s %s\n", EFIVARS_VERSION,
 	       EFIVARS_DATE);
 
-	if (!efi_enabled(EFI_RUNTIME_SERVICES))
+	if (!efi_enabled)
 		return 0;
 
 	/* For now we'll register the efi directory at /sys/firmware/efi */
@@ -1823,7 +1822,7 @@ efivars_init(void)
 static void __exit
 efivars_exit(void)
 {
-	if (efi_enabled(EFI_RUNTIME_SERVICES)) {
+	if (efi_enabled) {
 		unregister_efivars(&__efivars);
 		kobject_put(efi_kobj);
 	}
diff --git a/trunk/drivers/firmware/iscsi_ibft_find.c b/trunk/drivers/firmware/iscsi_ibft_find.c
index 2224f1dc074b..4da4eb9ae926 100644
--- a/trunk/drivers/firmware/iscsi_ibft_find.c
+++ b/trunk/drivers/firmware/iscsi_ibft_find.c
@@ -99,7 +99,7 @@ unsigned long __init find_ibft_region(unsigned long *sizep)
 	/* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
 	 * only use ACPI for this */
 
-	if (!efi_enabled(EFI_BOOT))
+	if (!efi_enabled)
 		find_ibft_in_mem();
 
 	if (ibft_addr) {
diff --git a/trunk/drivers/gpu/drm/exynos/Kconfig b/trunk/drivers/gpu/drm/exynos/Kconfig
index 046bcda36abe..1d1f1e5e33f0 100644
--- a/trunk/drivers/gpu/drm/exynos/Kconfig
+++ b/trunk/drivers/gpu/drm/exynos/Kconfig
@@ -24,7 +24,7 @@ config DRM_EXYNOS_DMABUF
 
 config DRM_EXYNOS_FIMD
 	bool "Exynos DRM FIMD"
-	depends on DRM_EXYNOS && !FB_S3C && !ARCH_MULTIPLATFORM
+	depends on DRM_EXYNOS && !FB_S3C
 	help
 	  Choose this option if you want to use Exynos FIMD for DRM.
 
@@ -48,7 +48,7 @@ config DRM_EXYNOS_G2D
 
 config DRM_EXYNOS_IPP
 	bool "Exynos DRM IPP"
-	depends on DRM_EXYNOS && !ARCH_MULTIPLATFORM
+	depends on DRM_EXYNOS
 	help
 	  Choose this option if you want to use IPP feature for DRM.
 
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_connector.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_connector.c
index 4c5b6859c9ea..ab37437bad8a 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -18,6 +18,7 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
+#define MAX_EDID 256
 #define to_exynos_connector(x)	container_of(x, struct exynos_drm_connector,\
 				drm_connector)
 
@@ -95,9 +96,7 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
 					to_exynos_connector(connector);
 	struct exynos_drm_manager *manager = exynos_connector->manager;
 	struct exynos_drm_display_ops *display_ops = manager->display_ops;
-	struct edid *edid = NULL;
-	unsigned int count = 0;
-	int ret;
+	unsigned int count;
 
 	DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -115,21 +114,27 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
 	 * because lcd panel has only one mode.
 	 */
 	if (display_ops->get_edid) {
-		edid = display_ops->get_edid(manager->dev, connector);
-		if (IS_ERR_OR_NULL(edid)) {
-			ret = PTR_ERR(edid);
-			edid = NULL;
-			DRM_ERROR("Panel operation get_edid failed %d\n", ret);
-			goto out;
+		int ret;
+		void *edid;
+
+		edid = kzalloc(MAX_EDID, GFP_KERNEL);
+		if (!edid) {
+			DRM_ERROR("failed to allocate edid\n");
+			return 0;
 		}
 
-		count = drm_add_edid_modes(connector, edid);
-		if (count < 0) {
-			DRM_ERROR("Add edid modes failed %d\n", count);
-			goto out;
+		ret = display_ops->get_edid(manager->dev, connector,
+						edid, MAX_EDID);
+		if (ret < 0) {
+			DRM_ERROR("failed to get edid data.\n");
+			kfree(edid);
+			edid = NULL;
+			return 0;
 		}
 
 		drm_mode_connector_update_edid_property(connector, edid);
+		count = drm_add_edid_modes(connector, edid);
+		kfree(edid);
 	} else {
 		struct exynos_drm_panel_info *panel;
 		struct drm_display_mode *mode = drm_mode_create(connector->dev);
@@ -156,8 +161,6 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
 		count = 1;
 	}
 
-out:
-	kfree(edid);
 	return count;
 }
 
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index ba0a3aa78547..9df97714b6c0 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -19,7 +19,6 @@
 struct exynos_drm_dmabuf_attachment {
 	struct sg_table sgt;
 	enum dma_data_direction dir;
-	bool is_mapped;
 };
 
 static int exynos_gem_attach_dma_buf(struct dma_buf *dmabuf,
@@ -73,10 +72,17 @@ static struct sg_table *
 
 	DRM_DEBUG_PRIME("%s\n", __FILE__);
 
+	if (WARN_ON(dir == DMA_NONE))
+		return ERR_PTR(-EINVAL);
+
 	/* just return current sgt if already requested. */
-	if (exynos_attach->dir == dir && exynos_attach->is_mapped)
+	if (exynos_attach->dir == dir)
 		return &exynos_attach->sgt;
 
+	/* reattaching is not allowed. */
+	if (WARN_ON(exynos_attach->dir != DMA_NONE))
+		return ERR_PTR(-EBUSY);
+
 	buf = gem_obj->buffer;
 	if (!buf) {
 		DRM_ERROR("buffer is null.\n");
@@ -101,17 +107,13 @@ static struct sg_table *
 		wr = sg_next(wr);
 	}
 
-	if (dir != DMA_NONE) {
-		nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
-		if (!nents) {
-			DRM_ERROR("failed to map sgl with iommu.\n");
-			sg_free_table(sgt);
-			sgt = ERR_PTR(-EIO);
-			goto err_unlock;
-		}
+	nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
+	if (!nents) {
+		DRM_ERROR("failed to map sgl with iommu.\n");
+		sgt = ERR_PTR(-EIO);
+		goto err_unlock;
 	}
 
-	exynos_attach->is_mapped = true;
 	exynos_attach->dir = dir;
 	attach->priv = exynos_attach;
 
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_drv.h b/trunk/drivers/gpu/drm/exynos/exynos_drm_drv.h
index 4606fac7241a..b9e51bc09e81 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -148,8 +148,8 @@ struct exynos_drm_overlay {
 struct exynos_drm_display_ops {
 	enum exynos_drm_output_type type;
 	bool (*is_connected)(struct device *dev);
-	struct edid *(*get_edid)(struct device *dev,
-			struct drm_connector *connector);
+	int (*get_edid)(struct device *dev, struct drm_connector *connector,
+				u8 *edid, int len);
 	void *(*get_panel)(struct device *dev);
 	int (*check_timing)(struct device *dev, void *timing);
 	int (*power_on)(struct device *dev, int mode);
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 9a4c08e7453c..36c3905536a6 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -324,7 +324,7 @@ static void g2d_userptr_put_dma_addr(struct drm_device *drm_dev,
 	g2d_userptr = NULL;
 }
 
-static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
+dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
 					unsigned long userptr,
 					unsigned long size,
 					struct drm_file *filp,
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 28644539b305..850e9950b7da 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -108,17 +108,18 @@ static bool drm_hdmi_is_connected(struct device *dev)
 	return false;
 }
 
-static struct edid *drm_hdmi_get_edid(struct device *dev,
-			struct drm_connector *connector)
+static int drm_hdmi_get_edid(struct device *dev,
+		struct drm_connector *connector, u8 *edid, int len)
 {
 	struct drm_hdmi_context *ctx = to_context(dev);
 
 	DRM_DEBUG_KMS("%s\n", __FILE__);
 
 	if (hdmi_ops && hdmi_ops->get_edid)
-		return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector);
+		return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector, edid,
+					  len);
 
-	return NULL;
+	return 0;
 }
 
 static int drm_hdmi_check_timing(struct device *dev, void *timing)
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.h b/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
index d80516fc9ed7..784a7e9a766c 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
@@ -30,8 +30,8 @@ struct exynos_drm_hdmi_context {
 struct exynos_hdmi_ops {
 	/* display */
 	bool (*is_connected)(void *ctx);
-	struct edid *(*get_edid)(void *ctx,
-			struct drm_connector *connector);
+	int (*get_edid)(void *ctx, struct drm_connector *connector,
+			u8 *edid, int len);
 	int (*check_timing)(void *ctx, void *timing);
 	int (*power_on)(void *ctx, int mode);
 
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 1a556354e92f..0bda96454a02 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -869,7 +869,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
 	}
 }
 
-static void ipp_handle_cmd_work(struct device *dev,
+void ipp_handle_cmd_work(struct device *dev,
 		struct exynos_drm_ippdrv *ippdrv,
 		struct drm_exynos_ipp_cmd_work *cmd_work,
 		struct drm_exynos_ipp_cmd_node *c_node)
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index f976e29def6e..e9e83ef688f0 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -734,7 +734,7 @@ static int rotator_remove(struct platform_device *pdev)
 	return 0;
 }
 
-static struct rot_limit_table rot_limit_tbl = {
+struct rot_limit_table rot_limit_tbl = {
 	.ycbcr420_2p = {
 		.min_w = 32,
 		.min_h = 32,
@@ -751,7 +751,7 @@ static struct rot_limit_table rot_limit_tbl = {
 	},
 };
 
-static struct platform_device_id rotator_driver_ids[] = {
+struct platform_device_id rotator_driver_ids[] = {
 	{
 		.name		= "exynos-rot",
 		.driver_data	= (unsigned long)&rot_limit_tbl,
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/trunk/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index 13ccbd4bcfaa..d0ca3c4e06c6 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -98,12 +98,10 @@ static bool vidi_display_is_connected(struct device *dev)
 	return ctx->connected ? true : false;
 }
 
-static struct edid *vidi_get_edid(struct device *dev,
-			struct drm_connector *connector)
+static int vidi_get_edid(struct device *dev, struct drm_connector *connector,
+				u8 *edid, int len)
 {
 	struct vidi_context *ctx = get_vidi_context(dev);
-	struct edid *edid;
-	int edid_len;
 
 	DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -113,18 +111,13 @@ static struct edid *vidi_get_edid(struct device *dev,
 	 */
 	if (!ctx->raw_edid) {
 		DRM_DEBUG_KMS("raw_edid is null.\n");
-		return ERR_PTR(-EFAULT);
+		return -EFAULT;
 	}
 
-	edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
-	edid = kzalloc(edid_len, GFP_KERNEL);
-	if (!edid) {
-		DRM_DEBUG_KMS("failed to allocate edid\n");
-		return ERR_PTR(-ENOMEM);
-	}
+	memcpy(edid, ctx->raw_edid, min((1 + ctx->raw_edid->extensions)
+					* EDID_LENGTH, len));
 
-	memcpy(edid, ctx->raw_edid, edid_len);
-	return edid;
+	return 0;
 }
 
 static void *vidi_get_panel(struct device *dev)
@@ -521,6 +514,7 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
 	struct exynos_drm_manager *manager;
 	struct exynos_drm_display_ops *display_ops;
 	struct drm_exynos_vidi_connection *vidi = data;
+	struct edid *raw_edid;
 	int edid_len;
 
 	DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -557,11 +551,11 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
 	}
 
 	if (vidi->connection) {
-		struct edid *raw_edid  = (struct edid *)(uint32_t)vidi->edid;
-		if (!drm_edid_is_valid(raw_edid)) {
-			DRM_DEBUG_KMS("edid data is invalid.\n");
+		if (!vidi->edid) {
+			DRM_DEBUG_KMS("edid data is null.\n");
 			return -EINVAL;
 		}
+		raw_edid = (struct edid *)(uint32_t)vidi->edid;
 		edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;
 		ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);
 		if (!ctx->raw_edid) {
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_hdmi.c b/trunk/drivers/gpu/drm/exynos/exynos_hdmi.c
index fbab3c468603..41ff79d8ac8e 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -34,6 +34,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/io.h>
 #include <linux/of_gpio.h>
+#include <plat/gpio-cfg.h>
 
 #include <drm/exynos_drm.h>
 
@@ -97,7 +98,8 @@ struct hdmi_context {
 
 	void __iomem			*regs;
 	void				*parent_ctx;
-	int				irq;
+	int				external_irq;
+	int				internal_irq;
 
 	struct i2c_client		*ddc_port;
 	struct i2c_client		*hdmiphy_port;
@@ -1389,7 +1391,8 @@ static bool hdmi_is_connected(void *ctx)
 	return hdata->hpd;
 }
 
-static struct edid *hdmi_get_edid(void *ctx, struct drm_connector *connector)
+static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
+				u8 *edid, int len)
 {
 	struct edid *raw_edid;
 	struct hdmi_context *hdata = ctx;
@@ -1397,18 +1400,22 @@ static struct edid *hdmi_get_edid(void *ctx, struct drm_connector *connector)
 	DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
 	if (!hdata->ddc_port)
-		return ERR_PTR(-ENODEV);
+		return -ENODEV;
 
 	raw_edid = drm_get_edid(connector, hdata->ddc_port->adapter);
-	if (!raw_edid)
-		return ERR_PTR(-ENODEV);
-
-	hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
-	DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
-		(hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
-		raw_edid->width_cm, raw_edid->height_cm);
+	if (raw_edid) {
+		hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
+		memcpy(edid, raw_edid, min((1 + raw_edid->extensions)
+					* EDID_LENGTH, len));
+		DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
+			(hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
+			raw_edid->width_cm, raw_edid->height_cm);
+		kfree(raw_edid);
+	} else {
+		return -ENODEV;
+	}
 
-	return raw_edid;
+	return 0;
 }
 
 static int hdmi_v13_check_timing(struct fb_videomode *check_timing)
@@ -1645,16 +1652,16 @@ static void hdmi_conf_reset(struct hdmi_context *hdata)
 
 	/* resetting HDMI core */
 	hdmi_reg_writemask(hdata, reg,  0, HDMI_CORE_SW_RSTOUT);
-	usleep_range(10000, 12000);
+	mdelay(10);
 	hdmi_reg_writemask(hdata, reg, ~0, HDMI_CORE_SW_RSTOUT);
-	usleep_range(10000, 12000);
+	mdelay(10);
 }
 
 static void hdmi_conf_init(struct hdmi_context *hdata)
 {
 	struct hdmi_infoframe infoframe;
 
-	/* disable HPD interrupts from HDMI IP block, use GPIO instead */
+	/* disable HPD interrupts */
 	hdmi_reg_writemask(hdata, HDMI_INTC_CON, 0, HDMI_INTC_EN_GLOBAL |
 		HDMI_INTC_EN_HPD_PLUG | HDMI_INTC_EN_HPD_UNPLUG);
 
@@ -1772,7 +1779,7 @@ static void hdmi_v13_timing_apply(struct hdmi_context *hdata)
 		u32 val = hdmi_reg_read(hdata, HDMI_V13_PHY_STATUS);
 		if (val & HDMI_PHY_STATUS_READY)
 			break;
-		usleep_range(1000, 2000);
+		mdelay(1);
 	}
 	/* steady state not achieved */
 	if (tries == 0) {
@@ -1939,7 +1946,7 @@ static void hdmi_v14_timing_apply(struct hdmi_context *hdata)
 		u32 val = hdmi_reg_read(hdata, HDMI_PHY_STATUS_0);
 		if (val & HDMI_PHY_STATUS_READY)
 			break;
-		usleep_range(1000, 2000);
+		mdelay(1);
 	}
 	/* steady state not achieved */
 	if (tries == 0) {
@@ -1991,9 +1998,9 @@ static void hdmiphy_conf_reset(struct hdmi_context *hdata)
 
 	/* reset hdmiphy */
 	hdmi_reg_writemask(hdata, reg, ~0, HDMI_PHY_SW_RSTOUT);
-	usleep_range(10000, 12000);
+	mdelay(10);
 	hdmi_reg_writemask(hdata, reg,  0, HDMI_PHY_SW_RSTOUT);
-	usleep_range(10000, 12000);
+	mdelay(10);
 }
 
 static void hdmiphy_poweron(struct hdmi_context *hdata)
@@ -2041,7 +2048,7 @@ static void hdmiphy_conf_apply(struct hdmi_context *hdata)
 		return;
 	}
 
-	usleep_range(10000, 12000);
+	mdelay(10);
 
 	/* operation mode */
 	operation[0] = 0x1f;
@@ -2163,13 +2170,6 @@ static void hdmi_commit(void *ctx)
 
 	DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
-	mutex_lock(&hdata->hdmi_mutex);
-	if (!hdata->powered) {
-		mutex_unlock(&hdata->hdmi_mutex);
-		return;
-	}
-	mutex_unlock(&hdata->hdmi_mutex);
-
 	hdmi_conf_apply(hdata);
 }
 
@@ -2265,7 +2265,7 @@ static struct exynos_hdmi_ops hdmi_ops = {
 	.dpms		= hdmi_dpms,
 };
 
-static irqreturn_t hdmi_irq_thread(int irq, void *arg)
+static irqreturn_t hdmi_external_irq_thread(int irq, void *arg)
 {
 	struct exynos_drm_hdmi_context *ctx = arg;
 	struct hdmi_context *hdata = ctx->ctx;
@@ -2280,6 +2280,31 @@ static irqreturn_t hdmi_irq_thread(int irq, void *arg)
 	return IRQ_HANDLED;
 }
 
+static irqreturn_t hdmi_internal_irq_thread(int irq, void *arg)
+{
+	struct exynos_drm_hdmi_context *ctx = arg;
+	struct hdmi_context *hdata = ctx->ctx;
+	u32 intc_flag;
+
+	intc_flag = hdmi_reg_read(hdata, HDMI_INTC_FLAG);
+	/* clearing flags for HPD plug/unplug */
+	if (intc_flag & HDMI_INTC_FLAG_HPD_UNPLUG) {
+		DRM_DEBUG_KMS("unplugged\n");
+		hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
+			HDMI_INTC_FLAG_HPD_UNPLUG);
+	}
+	if (intc_flag & HDMI_INTC_FLAG_HPD_PLUG) {
+		DRM_DEBUG_KMS("plugged\n");
+		hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
+			HDMI_INTC_FLAG_HPD_PLUG);
+	}
+
+	if (ctx->drm_dev)
+		drm_helper_hpd_irq_event(ctx->drm_dev);
+
+	return IRQ_HANDLED;
+}
+
 static int hdmi_resources_init(struct hdmi_context *hdata)
 {
 	struct device *dev = hdata->dev;
@@ -2530,24 +2555,39 @@ static int hdmi_probe(struct platform_device *pdev)
 
 	hdata->hdmiphy_port = hdmi_hdmiphy;
 
-	hdata->irq = gpio_to_irq(hdata->hpd_gpio);
-	if (hdata->irq < 0) {
-		DRM_ERROR("failed to get GPIO irq\n");
-		ret = hdata->irq;
+	hdata->external_irq = gpio_to_irq(hdata->hpd_gpio);
+	if (hdata->external_irq < 0) {
+		DRM_ERROR("failed to get GPIO external irq\n");
+		ret = hdata->external_irq;
+		goto err_hdmiphy;
+	}
+
+	hdata->internal_irq = platform_get_irq(pdev, 0);
+	if (hdata->internal_irq < 0) {
+		DRM_ERROR("failed to get platform internal irq\n");
+		ret = hdata->internal_irq;
 		goto err_hdmiphy;
 	}
 
 	hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-	ret = request_threaded_irq(hdata->irq, NULL,
-			hdmi_irq_thread, IRQF_TRIGGER_RISING |
+	ret = request_threaded_irq(hdata->external_irq, NULL,
+			hdmi_external_irq_thread, IRQF_TRIGGER_RISING |
 			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
-			"hdmi", drm_hdmi_ctx);
+			"hdmi_external", drm_hdmi_ctx);
 	if (ret) {
-		DRM_ERROR("failed to register hdmi interrupt\n");
+		DRM_ERROR("failed to register hdmi external interrupt\n");
 		goto err_hdmiphy;
 	}
 
+	ret = request_threaded_irq(hdata->internal_irq, NULL,
+			hdmi_internal_irq_thread, IRQF_ONESHOT,
+			"hdmi_internal", drm_hdmi_ctx);
+	if (ret) {
+		DRM_ERROR("failed to register hdmi internal interrupt\n");
+		goto err_free_irq;
+	}
+
 	/* Attach HDMI Driver to common hdmi. */
 	exynos_hdmi_drv_attach(drm_hdmi_ctx);
 
@@ -2558,6 +2598,8 @@ static int hdmi_probe(struct platform_device *pdev)
 
 	return 0;
 
+err_free_irq:
+	free_irq(hdata->external_irq, drm_hdmi_ctx);
 err_hdmiphy:
 	i2c_del_driver(&hdmiphy_driver);
 err_ddc:
@@ -2575,7 +2617,8 @@ static int hdmi_remove(struct platform_device *pdev)
 
 	pm_runtime_disable(dev);
 
-	free_irq(hdata->irq, hdata);
+	free_irq(hdata->internal_irq, hdata);
+	free_irq(hdata->external_irq, hdata);
 
 
 	/* hdmiphy i2c driver */
@@ -2594,7 +2637,8 @@ static int hdmi_suspend(struct device *dev)
 
 	DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
-	disable_irq(hdata->irq);
+	disable_irq(hdata->internal_irq);
+	disable_irq(hdata->external_irq);
 
 	hdata->hpd = false;
 	if (ctx->drm_dev)
@@ -2619,7 +2663,8 @@ static int hdmi_resume(struct device *dev)
 
 	hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-	enable_irq(hdata->irq);
+	enable_irq(hdata->external_irq);
+	enable_irq(hdata->internal_irq);
 
 	if (!pm_runtime_suspended(dev)) {
 		DRM_DEBUG_KMS("%s : Already resumed\n", __func__);
diff --git a/trunk/drivers/gpu/drm/exynos/exynos_mixer.c b/trunk/drivers/gpu/drm/exynos/exynos_mixer.c
index c414584bfbae..c187ea33b748 100644
--- a/trunk/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/trunk/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -600,7 +600,7 @@ static void vp_win_reset(struct mixer_context *ctx)
 		/* waiting until VP_SRESET_PROCESSING is 0 */
 		if (~vp_reg_read(res, VP_SRESET) & VP_SRESET_PROCESSING)
 			break;
-		usleep_range(10000, 12000);
+		mdelay(10);
 	}
 	WARN(tries == 0, "failed to reset Video Processor\n");
 }
@@ -776,13 +776,6 @@ static void mixer_win_commit(void *ctx, int win)
 
 	DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
 
-	mutex_lock(&mixer_ctx->mixer_mutex);
-	if (!mixer_ctx->powered) {
-		mutex_unlock(&mixer_ctx->mixer_mutex);
-		return;
-	}
-	mutex_unlock(&mixer_ctx->mixer_mutex);
-
 	if (win > 1 && mixer_ctx->vp_enabled)
 		vp_video_buffer(mixer_ctx, win);
 	else
diff --git a/trunk/drivers/gpu/drm/i915/i915_debugfs.c b/trunk/drivers/gpu/drm/i915/i915_debugfs.c
index 9d4a2c2adf0e..7944d301518a 100644
--- a/trunk/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/trunk/drivers/gpu/drm/i915/i915_debugfs.c
@@ -30,7 +30,6 @@
 #include <linux/debugfs.h>
 #include <linux/slab.h>
 #include <linux/export.h>
-#include <generated/utsrelease.h>
 #include <drm/drmP.h>
 #include "intel_drv.h"
 #include "intel_ringbuffer.h"
@@ -691,7 +690,6 @@ static int i915_error_state(struct seq_file *m, void *unused)
 
 	seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
 		   error->time.tv_usec);
-	seq_printf(m, "Kernel: " UTS_RELEASE);
 	seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
 	seq_printf(m, "EIR: 0x%08x\n", error->eir);
 	seq_printf(m, "IER: 0x%08x\n", error->ier);
diff --git a/trunk/drivers/gpu/drm/i915/i915_reg.h b/trunk/drivers/gpu/drm/i915/i915_reg.h
index 59afb7eb6db6..b401788e1791 100644
--- a/trunk/drivers/gpu/drm/i915/i915_reg.h
+++ b/trunk/drivers/gpu/drm/i915/i915_reg.h
@@ -533,7 +533,6 @@
 #define MI_MODE		0x0209c
 # define VS_TIMER_DISPATCH				(1 << 6)
 # define MI_FLUSH_ENABLE				(1 << 12)
-# define ASYNC_FLIP_PERF_DISABLE			(1 << 14)
 
 #define GEN6_GT_MODE	0x20d0
 #define   GEN6_GT_MODE_HI				(1 << 9)
diff --git a/trunk/drivers/gpu/drm/i915/intel_ringbuffer.c b/trunk/drivers/gpu/drm/i915/intel_ringbuffer.c
index 42ff97d667d2..ae253e04c391 100644
--- a/trunk/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/trunk/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -505,25 +505,13 @@ static int init_render_ring(struct intel_ring_buffer *ring)
 	struct drm_i915_private *dev_priv = dev->dev_private;
 	int ret = init_ring_common(ring);
 
-	if (INTEL_INFO(dev)->gen > 3)
+	if (INTEL_INFO(dev)->gen > 3) {
 		I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(VS_TIMER_DISPATCH));
-
-	/* We need to disable the AsyncFlip performance optimisations in order
-	 * to use MI_WAIT_FOR_EVENT within the CS. It should already be
-	 * programmed to '1' on all products.
-	 */
-	if (INTEL_INFO(dev)->gen >= 6)
-		I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(ASYNC_FLIP_PERF_DISABLE));
-
-	/* Required for the hardware to program scanline values for waiting */
-	if (INTEL_INFO(dev)->gen == 6)
-		I915_WRITE(GFX_MODE,
-			   _MASKED_BIT_ENABLE(GFX_TLB_INVALIDATE_ALWAYS));
-
-	if (IS_GEN7(dev))
-		I915_WRITE(GFX_MODE_GEN7,
-			   _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
-			   _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
+		if (IS_GEN7(dev))
+			I915_WRITE(GFX_MODE_GEN7,
+				   _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
+				   _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
+	}
 
 	if (INTEL_INFO(dev)->gen >= 5) {
 		ret = init_pipe_control(ring);
diff --git a/trunk/drivers/gpu/drm/radeon/ni.c b/trunk/drivers/gpu/drm/radeon/ni.c
index 835992d8d067..59acabb45c9b 100644
--- a/trunk/drivers/gpu/drm/radeon/ni.c
+++ b/trunk/drivers/gpu/drm/radeon/ni.c
@@ -1216,7 +1216,7 @@ void cayman_dma_stop(struct radeon_device *rdev)
 int cayman_dma_resume(struct radeon_device *rdev)
 {
 	struct radeon_ring *ring;
-	u32 rb_cntl, dma_cntl, ib_cntl;
+	u32 rb_cntl, dma_cntl;
 	u32 rb_bufsz;
 	u32 reg_offset, wb_offset;
 	int i, r;
@@ -1265,11 +1265,7 @@ int cayman_dma_resume(struct radeon_device *rdev)
 		WREG32(DMA_RB_BASE + reg_offset, ring->gpu_addr >> 8);
 
 		/* enable DMA IBs */
-		ib_cntl = DMA_IB_ENABLE | CMD_VMID_FORCE;
-#ifdef __BIG_ENDIAN
-		ib_cntl |= DMA_IB_SWAP_ENABLE;
-#endif
-		WREG32(DMA_IB_CNTL + reg_offset, ib_cntl);
+		WREG32(DMA_IB_CNTL + reg_offset, DMA_IB_ENABLE | CMD_VMID_FORCE);
 
 		dma_cntl = RREG32(DMA_CNTL + reg_offset);
 		dma_cntl &= ~CTXEMPTY_INT_ENABLE;
diff --git a/trunk/drivers/gpu/drm/radeon/r600.c b/trunk/drivers/gpu/drm/radeon/r600.c
index bc2540b17c5e..3cb9d6089373 100644
--- a/trunk/drivers/gpu/drm/radeon/r600.c
+++ b/trunk/drivers/gpu/drm/radeon/r600.c
@@ -2313,7 +2313,7 @@ void r600_dma_stop(struct radeon_device *rdev)
 int r600_dma_resume(struct radeon_device *rdev)
 {
 	struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_DMA_INDEX];
-	u32 rb_cntl, dma_cntl, ib_cntl;
+	u32 rb_cntl, dma_cntl;
 	u32 rb_bufsz;
 	int r;
 
@@ -2353,11 +2353,7 @@ int r600_dma_resume(struct radeon_device *rdev)
 	WREG32(DMA_RB_BASE, ring->gpu_addr >> 8);
 
 	/* enable DMA IBs */
-	ib_cntl = DMA_IB_ENABLE;
-#ifdef __BIG_ENDIAN
-	ib_cntl |= DMA_IB_SWAP_ENABLE;
-#endif
-	WREG32(DMA_IB_CNTL, ib_cntl);
+	WREG32(DMA_IB_CNTL, DMA_IB_ENABLE);
 
 	dma_cntl = RREG32(DMA_CNTL);
 	dma_cntl &= ~CTXEMPTY_INT_ENABLE;
diff --git a/trunk/drivers/gpu/drm/radeon/radeon_cs.c b/trunk/drivers/gpu/drm/radeon/radeon_cs.c
index 5407459e56d2..469661fd1903 100644
--- a/trunk/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/trunk/drivers/gpu/drm/radeon/radeon_cs.c
@@ -286,8 +286,6 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
 			    p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
 				kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
 				kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
-				p->chunks[p->chunk_ib_idx].kpage[0] = NULL;
-				p->chunks[p->chunk_ib_idx].kpage[1] = NULL;
 				return -ENOMEM;
 			}
 		}
diff --git a/trunk/drivers/gpu/drm/radeon/radeon_cursor.c b/trunk/drivers/gpu/drm/radeon/radeon_cursor.c
index 0d67674b64b1..ad6df625e8b8 100644
--- a/trunk/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/trunk/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -241,8 +241,7 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
 		y = 0;
 	}
 
-	/* fixed on DCE6 and newer */
-	if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
+	if (ASIC_IS_AVIVO(rdev)) {
 		int i = 0;
 		struct drm_crtc *crtc_p;
 
diff --git a/trunk/drivers/gpu/drm/radeon/radeon_device.c b/trunk/drivers/gpu/drm/radeon/radeon_device.c
index 0d6562bb0c93..edfc54e41842 100644
--- a/trunk/drivers/gpu/drm/radeon/radeon_device.c
+++ b/trunk/drivers/gpu/drm/radeon/radeon_device.c
@@ -429,8 +429,7 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
 	uint32_t reg;
 
-	if (efi_enabled(EFI_BOOT) &&
-	    rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+	if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
 		return false;
 
 	/* first check CRTCs */
diff --git a/trunk/drivers/gpu/drm/radeon/radeon_display.c b/trunk/drivers/gpu/drm/radeon/radeon_display.c
index ff3def784619..1da2386d7cf7 100644
--- a/trunk/drivers/gpu/drm/radeon/radeon_display.c
+++ b/trunk/drivers/gpu/drm/radeon/radeon_display.c
@@ -1122,7 +1122,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
 	if (ret) {
 		kfree(radeon_fb);
 		drm_gem_object_unreference_unlocked(obj);
-		return ERR_PTR(ret);
+		return NULL;
 	}
 
 	return &radeon_fb->base;
diff --git a/trunk/drivers/hid/hid-ids.h b/trunk/drivers/hid/hid-ids.h
index 34e25471aeaa..4dfa605e2d14 100644
--- a/trunk/drivers/hid/hid-ids.h
+++ b/trunk/drivers/hid/hid-ids.h
@@ -306,9 +306,6 @@
 #define USB_VENDOR_ID_EZKEY		0x0518
 #define USB_DEVICE_ID_BTC_8193		0x0002
 
-#define USB_VENDOR_ID_FORMOSA          0x147a
-#define USB_DEVICE_ID_FORMOSA_IR_RECEIVER      0xe03e
-
 #define USB_VENDOR_ID_FREESCALE		0x15A2
 #define USB_DEVICE_ID_FREESCALE_MX28	0x004F
 
diff --git a/trunk/drivers/hid/i2c-hid/i2c-hid.c b/trunk/drivers/hid/i2c-hid/i2c-hid.c
index e766b5614ef5..12e4fdc810bf 100644
--- a/trunk/drivers/hid/i2c-hid/i2c-hid.c
+++ b/trunk/drivers/hid/i2c-hid/i2c-hid.c
@@ -540,24 +540,13 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
 {
 	struct i2c_client *client = hid->driver_data;
 	int report_id = buf[0];
-	int ret;
 
 	if (report_type == HID_INPUT_REPORT)
 		return -EINVAL;
 
-	if (report_id) {
-		buf++;
-		count--;
-	}
-
-	ret = i2c_hid_set_report(client,
+	return i2c_hid_set_report(client,
 				report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
 				report_id, buf, count);
-
-	if (report_id && ret >= 0)
-		ret++; /* add report_id to the number of transfered bytes */
-
-	return ret;
 }
 
 static int i2c_hid_parse(struct hid_device *hid)
diff --git a/trunk/drivers/hid/usbhid/hid-quirks.c b/trunk/drivers/hid/usbhid/hid-quirks.c
index e0e6abf1cd3b..ac9e35228254 100644
--- a/trunk/drivers/hid/usbhid/hid-quirks.c
+++ b/trunk/drivers/hid/usbhid/hid-quirks.c
@@ -70,7 +70,6 @@ static const struct hid_blacklist {
 	{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
-	{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
 	{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
 	{ USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/trunk/drivers/iommu/amd_iommu_init.c b/trunk/drivers/iommu/amd_iommu_init.c
index faf10ba1ed9a..81837b0710a9 100644
--- a/trunk/drivers/iommu/amd_iommu_init.c
+++ b/trunk/drivers/iommu/amd_iommu_init.c
@@ -974,38 +974,6 @@ static void __init free_iommu_all(void)
 	}
 }
 
-/*
- * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
- * Workaround:
- *     BIOS should disable L2B micellaneous clock gating by setting
- *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
- */
-static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
-{
-	u32 value;
-
-	if ((boot_cpu_data.x86 != 0x15) ||
-	    (boot_cpu_data.x86_model < 0x10) ||
-	    (boot_cpu_data.x86_model > 0x1f))
-		return;
-
-	pci_write_config_dword(iommu->dev, 0xf0, 0x90);
-	pci_read_config_dword(iommu->dev, 0xf4, &value);
-
-	if (value & BIT(2))
-		return;
-
-	/* Select NB indirect register 0x90 and enable writing */
-	pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
-
-	pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
-	pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
-		dev_name(&iommu->dev->dev));
-
-	/* Clear the enable writing bit */
-	pci_write_config_dword(iommu->dev, 0xf0, 0x90);
-}
-
 /*
  * This function clues the initialization function for one IOMMU
  * together and also allocates the command buffer and programs the
@@ -1204,8 +1172,6 @@ static int iommu_init_pci(struct amd_iommu *iommu)
 			iommu->stored_l2[i] = iommu_read_l2(iommu, i);
 	}
 
-	amd_iommu_erratum_746_workaround(iommu);
-
 	return pci_enable_device(iommu->dev);
 }
 
diff --git a/trunk/drivers/iommu/intel-iommu.c b/trunk/drivers/iommu/intel-iommu.c
index eca28014ef3e..b9d091157884 100644
--- a/trunk/drivers/iommu/intel-iommu.c
+++ b/trunk/drivers/iommu/intel-iommu.c
@@ -4234,21 +4234,6 @@ static struct iommu_ops intel_iommu_ops = {
 	.pgsize_bitmap	= INTEL_IOMMU_PGSIZES,
 };
 
-static void quirk_iommu_g4x_gfx(struct pci_dev *dev)
-{
-	/* G4x/GM45 integrated gfx dmar support is totally busted. */
-	printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
-	dmar_map_gfx = 0;
-}
-
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx);
-DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx);
-
 static void quirk_iommu_rwbf(struct pci_dev *dev)
 {
 	/*
@@ -4257,6 +4242,12 @@ static void quirk_iommu_rwbf(struct pci_dev *dev)
 	 */
 	printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
 	rwbf_quirk = 1;
+
+	/* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
+	if (dev->revision == 0x07) {
+		printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+		dmar_map_gfx = 0;
+	}
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
diff --git a/trunk/drivers/isdn/gigaset/capi.c b/trunk/drivers/isdn/gigaset/capi.c
index 03a0a01a4054..68452b768da2 100644
--- a/trunk/drivers/isdn/gigaset/capi.c
+++ b/trunk/drivers/isdn/gigaset/capi.c
@@ -248,8 +248,6 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
 		CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l,
 		CAPIMSG_CONTROL(data));
 	l -= 12;
-	if (l <= 0)
-		return;
 	dbgline = kmalloc(3 * l, GFP_ATOMIC);
 	if (!dbgline)
 		return;
diff --git a/trunk/drivers/md/dm-raid.c b/trunk/drivers/md/dm-raid.c
index 9e58dbd8d8cb..3d8984edeff7 100644
--- a/trunk/drivers/md/dm-raid.c
+++ b/trunk/drivers/md/dm-raid.c
@@ -340,22 +340,24 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 }
 
 /*
- * validate_raid_redundancy
+ * validate_rebuild_devices
  * @rs
  *
- * Determine if there are enough devices in the array that haven't
- * failed (or are being rebuilt) to form a usable array.
+ * Determine if the devices specified for rebuild can result in a valid
+ * usable array that is capable of rebuilding the given devices.
  *
  * Returns: 0 on success, -EINVAL on failure.
  */
-static int validate_raid_redundancy(struct raid_set *rs)
+static int validate_rebuild_devices(struct raid_set *rs)
 {
 	unsigned i, rebuild_cnt = 0;
 	unsigned rebuilds_per_group, copies, d;
 
+	if (!(rs->print_flags & DMPF_REBUILD))
+		return 0;
+
 	for (i = 0; i < rs->md.raid_disks; i++)
-		if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
-		    !rs->dev[i].rdev.sb_page)
+		if (!test_bit(In_sync, &rs->dev[i].rdev.flags))
 			rebuild_cnt++;
 
 	switch (rs->raid_type->level) {
@@ -391,24 +393,27 @@ static int validate_raid_redundancy(struct raid_set *rs)
 		 *          A    A    B    B    C
 		 *          C    D    D    E    E
 		 */
+		rebuilds_per_group = 0;
 		for (i = 0; i < rs->md.raid_disks * copies; i++) {
-			if (!(i % copies))
-				rebuilds_per_group = 0;
 			d = i % rs->md.raid_disks;
-			if ((!rs->dev[d].rdev.sb_page ||
-			     !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+			if (!test_bit(In_sync, &rs->dev[d].rdev.flags) &&
 			    (++rebuilds_per_group >= copies))
 				goto too_many;
+			if (!((i + 1) % copies))
+				rebuilds_per_group = 0;
 		}
 		break;
 	default:
-		if (rebuild_cnt)
-			return -EINVAL;
+		DMERR("The rebuild parameter is not supported for %s",
+		      rs->raid_type->name);
+		rs->ti->error = "Rebuild not supported for this RAID type";
+		return -EINVAL;
 	}
 
 	return 0;
 
 too_many:
+	rs->ti->error = "Too many rebuild devices specified";
 	return -EINVAL;
 }
 
@@ -659,6 +664,9 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
 	}
 	rs->md.dev_sectors = sectors_per_dev;
 
+	if (validate_rebuild_devices(rs))
+		return -EINVAL;
+
 	/* Assume there are no metadata devices until the drives are parsed */
 	rs->md.persistent = 0;
 	rs->md.external = 1;
@@ -987,10 +995,28 @@ static int super_validate(struct mddev *mddev, struct md_rdev *rdev)
 static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
 {
 	int ret;
+	unsigned redundancy = 0;
 	struct raid_dev *dev;
 	struct md_rdev *rdev, *tmp, *freshest;
 	struct mddev *mddev = &rs->md;
 
+	switch (rs->raid_type->level) {
+	case 1:
+		redundancy = rs->md.raid_disks - 1;
+		break;
+	case 4:
+	case 5:
+	case 6:
+		redundancy = rs->raid_type->parity_devs;
+		break;
+	case 10:
+		redundancy = raid10_md_layout_to_copies(mddev->layout) - 1;
+		break;
+	default:
+		ti->error = "Unknown RAID type";
+		return -EINVAL;
+	}
+
 	freshest = NULL;
 	rdev_for_each_safe(rdev, tmp, mddev) {
 		/*
@@ -1019,43 +1045,44 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
 			break;
 		default:
 			dev = container_of(rdev, struct raid_dev, rdev);
-			if (dev->meta_dev)
-				dm_put_device(ti, dev->meta_dev);
+			if (redundancy--) {
+				if (dev->meta_dev)
+					dm_put_device(ti, dev->meta_dev);
 
-			dev->meta_dev = NULL;
-			rdev->meta_bdev = NULL;
+				dev->meta_dev = NULL;
+				rdev->meta_bdev = NULL;
 
-			if (rdev->sb_page)
-				put_page(rdev->sb_page);
+				if (rdev->sb_page)
+					put_page(rdev->sb_page);
 
-			rdev->sb_page = NULL;
+				rdev->sb_page = NULL;
 
-			rdev->sb_loaded = 0;
+				rdev->sb_loaded = 0;
 
-			/*
-			 * We might be able to salvage the data device
-			 * even though the meta device has failed.  For
-			 * now, we behave as though '- -' had been
-			 * set for this device in the table.
-			 */
-			if (dev->data_dev)
-				dm_put_device(ti, dev->data_dev);
+				/*
+				 * We might be able to salvage the data device
+				 * even though the meta device has failed.  For
+				 * now, we behave as though '- -' had been
+				 * set for this device in the table.
+				 */
+				if (dev->data_dev)
+					dm_put_device(ti, dev->data_dev);
+
+				dev->data_dev = NULL;
+				rdev->bdev = NULL;
 
-			dev->data_dev = NULL;
-			rdev->bdev = NULL;
+				list_del(&rdev->same_set);
 
-			list_del(&rdev->same_set);
+				continue;
+			}
+			ti->error = "Failed to load superblock";
+			return ret;
 		}
 	}
 
 	if (!freshest)
 		return 0;
 
-	if (validate_raid_redundancy(rs)) {
-		rs->ti->error = "Insufficient redundancy to activate array";
-		return -EINVAL;
-	}
-
 	/*
 	 * Validation of the freshest device provides the source of
 	 * validation for the remaining devices.
@@ -1405,7 +1432,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
 	.name = "raid",
-	.version = {1, 4, 1},
+	.version = {1, 4, 0},
 	.module = THIS_MODULE,
 	.ctr = raid_ctr,
 	.dtr = raid_dtr,
diff --git a/trunk/drivers/md/dm-thin.c b/trunk/drivers/md/dm-thin.c
index 5409607d4875..675ae5274016 100644
--- a/trunk/drivers/md/dm-thin.c
+++ b/trunk/drivers/md/dm-thin.c
@@ -2746,9 +2746,19 @@ static int thin_iterate_devices(struct dm_target *ti,
 	return 0;
 }
 
+/*
+ * A thin device always inherits its queue limits from its pool.
+ */
+static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
+{
+	struct thin_c *tc = ti->private;
+
+	*limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
+}
+
 static struct target_type thin_target = {
 	.name = "thin",
-	.version = {1, 7, 0},
+	.version = {1, 6, 0},
 	.module	= THIS_MODULE,
 	.ctr = thin_ctr,
 	.dtr = thin_dtr,
@@ -2757,6 +2767,7 @@ static struct target_type thin_target = {
 	.postsuspend = thin_postsuspend,
 	.status = thin_status,
 	.iterate_devices = thin_iterate_devices,
+	.io_hints = thin_io_hints,
 };
 
 /*----------------------------------------------------------------*/
diff --git a/trunk/drivers/md/dm.c b/trunk/drivers/md/dm.c
index 314a0e2faf79..c72e4d5a9617 100644
--- a/trunk/drivers/md/dm.c
+++ b/trunk/drivers/md/dm.c
@@ -1188,7 +1188,6 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
 {
 	struct dm_target *ti;
 	sector_t len;
-	unsigned num_requests;
 
 	do {
 		ti = dm_table_find_target(ci->map, ci->sector);
@@ -1201,8 +1200,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
 		 * reconfiguration might also have changed that since the
 		 * check was performed.
 		 */
-		num_requests = get_num_requests ? get_num_requests(ti) : 0;
-		if (!num_requests)
+		if (!get_num_requests || !get_num_requests(ti))
 			return -EOPNOTSUPP;
 
 		if (is_split_required && !is_split_required(ti))
@@ -1210,7 +1208,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
 		else
 			len = min(ci->sector_count, max_io_len(ci->sector, ti));
 
-		__issue_target_requests(ci, ti, num_requests, len);
+		__issue_target_requests(ci, ti, ti->num_discard_requests, len);
 
 		ci->sector += len;
 	} while (ci->sector_count -= len);
diff --git a/trunk/drivers/mfd/Kconfig b/trunk/drivers/mfd/Kconfig
index ff553babf455..47ad4e270877 100644
--- a/trunk/drivers/mfd/Kconfig
+++ b/trunk/drivers/mfd/Kconfig
@@ -237,7 +237,6 @@ config MFD_TPS65910
 	depends on I2C=y && GPIOLIB
 	select MFD_CORE
 	select REGMAP_I2C
-	select REGMAP_IRQ
 	select IRQ_DOMAIN
 	help
 	  if you say yes here you get support for the TPS65910 series of
diff --git a/trunk/drivers/mfd/ab8500-core.c b/trunk/drivers/mfd/ab8500-core.c
index 4778bb124efe..e1650badd106 100644
--- a/trunk/drivers/mfd/ab8500-core.c
+++ b/trunk/drivers/mfd/ab8500-core.c
@@ -19,7 +19,6 @@
 #include <linux/mfd/core.h>
 #include <linux/mfd/abx500.h>
 #include <linux/mfd/abx500/ab8500.h>
-#include <linux/mfd/abx500/ab8500-bm.h>
 #include <linux/mfd/dbx500-prcmu.h>
 #include <linux/regulator/ab8500.h>
 #include <linux/of.h>
diff --git a/trunk/drivers/mfd/arizona-core.c b/trunk/drivers/mfd/arizona-core.c
index 222c03a5ddc0..bc8a3edb6bbf 100644
--- a/trunk/drivers/mfd/arizona-core.c
+++ b/trunk/drivers/mfd/arizona-core.c
@@ -239,12 +239,7 @@ static int arizona_runtime_resume(struct device *dev)
 		return ret;
 	}
 
-	ret = regcache_sync(arizona->regmap);
-	if (ret != 0) {
-		dev_err(arizona->dev, "Failed to restore register cache\n");
-		regulator_disable(arizona->dcvdd);
-		return ret;
-	}
+	regcache_sync(arizona->regmap);
 
 	return 0;
 }
diff --git a/trunk/drivers/mfd/arizona-irq.c b/trunk/drivers/mfd/arizona-irq.c
index 2bec5f0db3ee..74713bf5371f 100644
--- a/trunk/drivers/mfd/arizona-irq.c
+++ b/trunk/drivers/mfd/arizona-irq.c
@@ -176,7 +176,14 @@ int arizona_irq_init(struct arizona *arizona)
 		aod = &wm5102_aod;
 		irq = &wm5102_irq;
 
-		ctrlif_error = false;
+		switch (arizona->rev) {
+		case 0:
+		case 1:
+			ctrlif_error = false;
+			break;
+		default:
+			break;
+		}
 		break;
 #endif
 #ifdef CONFIG_MFD_WM5110
@@ -184,7 +191,14 @@ int arizona_irq_init(struct arizona *arizona)
 		aod = &wm5110_aod;
 		irq = &wm5110_irq;
 
-		ctrlif_error = false;
+		switch (arizona->rev) {
+		case 0:
+		case 1:
+			ctrlif_error = false;
+			break;
+		default:
+			break;
+		}
 		break;
 #endif
 	default:
diff --git a/trunk/drivers/mfd/da9052-i2c.c b/trunk/drivers/mfd/da9052-i2c.c
index 885e56780358..ac74a4d1daea 100644
--- a/trunk/drivers/mfd/da9052-i2c.c
+++ b/trunk/drivers/mfd/da9052-i2c.c
@@ -27,66 +27,6 @@
 #include <linux/of_device.h>
 #endif
 
-/* I2C safe register check */
-static inline bool i2c_safe_reg(unsigned char reg)
-{
-	switch (reg) {
-	case DA9052_STATUS_A_REG:
-	case DA9052_STATUS_B_REG:
-	case DA9052_STATUS_C_REG:
-	case DA9052_STATUS_D_REG:
-	case DA9052_ADC_RES_L_REG:
-	case DA9052_ADC_RES_H_REG:
-	case DA9052_VDD_RES_REG:
-	case DA9052_ICHG_AV_REG:
-	case DA9052_TBAT_RES_REG:
-	case DA9052_ADCIN4_RES_REG:
-	case DA9052_ADCIN5_RES_REG:
-	case DA9052_ADCIN6_RES_REG:
-	case DA9052_TJUNC_RES_REG:
-	case DA9052_TSI_X_MSB_REG:
-	case DA9052_TSI_Y_MSB_REG:
-	case DA9052_TSI_LSB_REG:
-	case DA9052_TSI_Z_MSB_REG:
-		return true;
-	default:
-		return false;
-	}
-}
-
-/*
- * There is an issue with DA9052 and DA9053_AA/BA/BB PMIC where the PMIC
- * gets lockup up or fails to respond following a system reset.
- * This fix is to follow any read or write with a dummy read to a safe
- * register.
- */
-int da9052_i2c_fix(struct da9052 *da9052, unsigned char reg)
-{
-	int val;
-
-	switch (da9052->chip_id) {
-	case DA9052:
-	case DA9053_AA:
-	case DA9053_BA:
-	case DA9053_BB:
-		/* A dummy read to a safe register address. */
-	if (!i2c_safe_reg(reg))
-			return regmap_read(da9052->regmap,
-					   DA9052_PARK_REGISTER,
-					   &val);
-		break;
-	default:
-		/*
-		 * For other chips parking of I2C register
-		 * to a safe place is not required.
-		 */
-		break;
-	}
-
-	return 0;
-}
-EXPORT_SYMBOL(da9052_i2c_fix);
-
 static int da9052_i2c_enable_multiwrite(struct da9052 *da9052)
 {
 	int reg_val, ret;
@@ -143,7 +83,6 @@ static int da9052_i2c_probe(struct i2c_client *client,
 
 	da9052->dev = &client->dev;
 	da9052->chip_irq = client->irq;
-	da9052->fix_io = da9052_i2c_fix;
 
 	i2c_set_clientdata(client, da9052);
 
diff --git a/trunk/drivers/mfd/db8500-prcmu.c b/trunk/drivers/mfd/db8500-prcmu.c
index 268f45d42394..dc8826d8d69d 100644
--- a/trunk/drivers/mfd/db8500-prcmu.c
+++ b/trunk/drivers/mfd/db8500-prcmu.c
@@ -2524,7 +2524,7 @@ static bool read_mailbox_0(void)
 
 		for (n = 0; n < NUM_PRCMU_WAKEUPS; n++) {
 			if (ev & prcmu_irq_bit[n])
-				generic_handle_irq(irq_find_mapping(db8500_irq_domain, n));
+				generic_handle_irq(IRQ_PRCMU_BASE + n);
 		}
 		r = true;
 		break;
@@ -2737,14 +2737,13 @@ static int db8500_irq_map(struct irq_domain *d, unsigned int virq,
 }
 
 static struct irq_domain_ops db8500_irq_ops = {
-	.map    = db8500_irq_map,
-	.xlate  = irq_domain_xlate_twocell,
+        .map    = db8500_irq_map,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int db8500_irq_init(struct device_node *np)
 {
-	int irq_base = 0;
-	int i;
+	int irq_base = -1;
 
 	/* In the device tree case, just take some IRQs */
 	if (!np)
@@ -2759,10 +2758,6 @@ static int db8500_irq_init(struct device_node *np)
 		return -ENOSYS;
 	}
 
-	/* All wakeups will be used, so create mappings for all */
-	for (i = 0; i < NUM_PRCMU_WAKEUPS; i++)
-		irq_create_mapping(db8500_irq_domain, i);
-
 	return 0;
 }
 
diff --git a/trunk/drivers/mfd/max77686.c b/trunk/drivers/mfd/max77686.c
index 4d73963cd8f0..f6878f8db57d 100644
--- a/trunk/drivers/mfd/max77686.c
+++ b/trunk/drivers/mfd/max77686.c
@@ -93,15 +93,6 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
 	if (max77686 == NULL)
 		return -ENOMEM;
 
-	i2c_set_clientdata(i2c, max77686);
-	max77686->dev = &i2c->dev;
-	max77686->i2c = i2c;
-	max77686->type = id->driver_data;
-
-	max77686->wakeup = pdata->wakeup;
-	max77686->irq_gpio = pdata->irq_gpio;
-	max77686->irq = i2c->irq;
-
 	max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
 	if (IS_ERR(max77686->regmap)) {
 		ret = PTR_ERR(max77686->regmap);
@@ -111,6 +102,15 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
 		return ret;
 	}
 
+	i2c_set_clientdata(i2c, max77686);
+	max77686->dev = &i2c->dev;
+	max77686->i2c = i2c;
+	max77686->type = id->driver_data;
+
+	max77686->wakeup = pdata->wakeup;
+	max77686->irq_gpio = pdata->irq_gpio;
+	max77686->irq = i2c->irq;
+
 	if (regmap_read(max77686->regmap,
 			 MAX77686_REG_DEVICE_ID, &data) < 0) {
 		dev_err(max77686->dev,
diff --git a/trunk/drivers/mfd/max77693.c b/trunk/drivers/mfd/max77693.c
index 9e60fed5ff82..cc5155e20494 100644
--- a/trunk/drivers/mfd/max77693.c
+++ b/trunk/drivers/mfd/max77693.c
@@ -114,37 +114,35 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 	u8 reg_data;
 	int ret = 0;
 
-	if (!pdata) {
-		dev_err(&i2c->dev, "No platform data found.\n");
-		return -EINVAL;
-	}
-
 	max77693 = devm_kzalloc(&i2c->dev,
 			sizeof(struct max77693_dev), GFP_KERNEL);
 	if (max77693 == NULL)
 		return -ENOMEM;
 
+	max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
+	if (IS_ERR(max77693->regmap)) {
+		ret = PTR_ERR(max77693->regmap);
+		dev_err(max77693->dev,"failed to allocate register map: %d\n",
+				ret);
+		goto err_regmap;
+	}
+
 	i2c_set_clientdata(i2c, max77693);
 	max77693->dev = &i2c->dev;
 	max77693->i2c = i2c;
 	max77693->irq = i2c->irq;
 	max77693->type = id->driver_data;
 
-	max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
-	if (IS_ERR(max77693->regmap)) {
-		ret = PTR_ERR(max77693->regmap);
-		dev_err(max77693->dev, "failed to allocate register map: %d\n",
-				ret);
-		return ret;
-	}
+	if (!pdata)
+		goto err_regmap;
 
 	max77693->wakeup = pdata->wakeup;
 
-	ret = max77693_read_reg(max77693->regmap, MAX77693_PMIC_REG_PMIC_ID2,
-				&reg_data);
-	if (ret < 0) {
+	if (max77693_read_reg(max77693->regmap,
+				MAX77693_PMIC_REG_PMIC_ID2, &reg_data) < 0) {
 		dev_err(max77693->dev, "device not found on this channel\n");
-		return ret;
+		ret = -ENODEV;
+		goto err_regmap;
 	} else
 		dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
 
@@ -165,7 +163,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 		ret = PTR_ERR(max77693->regmap_muic);
 		dev_err(max77693->dev,
 			"failed to allocate register map: %d\n", ret);
-		goto err_regmap_muic;
+		goto err_regmap;
 	}
 
 	ret = max77693_irq_init(max77693);
@@ -186,9 +184,9 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 err_mfd:
 	max77693_irq_exit(max77693);
 err_irq:
-err_regmap_muic:
 	i2c_unregister_device(max77693->muic);
 	i2c_unregister_device(max77693->haptic);
+err_regmap:
 	return ret;
 }
 
diff --git a/trunk/drivers/mfd/pcf50633-core.c b/trunk/drivers/mfd/pcf50633-core.c
index d11567307fbe..64803f13bcec 100644
--- a/trunk/drivers/mfd/pcf50633-core.c
+++ b/trunk/drivers/mfd/pcf50633-core.c
@@ -208,8 +208,6 @@ static int pcf50633_probe(struct i2c_client *client,
 	if (!pcf)
 		return -ENOMEM;
 
-	i2c_set_clientdata(client, pcf);
-	pcf->dev = &client->dev;
 	pcf->pdata = pdata;
 
 	mutex_init(&pcf->lock);
@@ -221,6 +219,9 @@ static int pcf50633_probe(struct i2c_client *client,
 		return ret;
 	}
 
+	i2c_set_clientdata(client, pcf);
+	pcf->dev = &client->dev;
+
 	version = pcf50633_reg_read(pcf, 0);
 	variant = pcf50633_reg_read(pcf, 1);
 	if (version < 0 || variant < 0) {
diff --git a/trunk/drivers/mfd/rtl8411.c b/trunk/drivers/mfd/rtl8411.c
index 3d3b4addf81a..89f046ca9e41 100644
--- a/trunk/drivers/mfd/rtl8411.c
+++ b/trunk/drivers/mfd/rtl8411.c
@@ -112,21 +112,6 @@ static int rtl8411_card_power_off(struct rtsx_pcr *pcr, int card)
 			BPP_LDO_POWB, BPP_LDO_SUSPEND);
 }
 
-static int rtl8411_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
-{
-	u8 mask, val;
-
-	mask = (BPP_REG_TUNED18 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_MASK;
-	if (voltage == OUTPUT_3V3)
-		val = (BPP_ASIC_3V3 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_3V3;
-	else if (voltage == OUTPUT_1V8)
-		val = (BPP_ASIC_1V8 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_1V8;
-	else
-		return -EINVAL;
-
-	return rtsx_pci_write_register(pcr, LDO_CTL, mask, val);
-}
-
 static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
 {
 	unsigned int card_exist;
@@ -178,18 +163,6 @@ static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
 	return card_exist;
 }
 
-static int rtl8411_conv_clk_and_div_n(int input, int dir)
-{
-	int output;
-
-	if (dir == CLK_TO_DIV_N)
-		output = input * 4 / 5 - 2;
-	else
-		output = (input + 2) * 5 / 4;
-
-	return output;
-}
-
 static const struct pcr_ops rtl8411_pcr_ops = {
 	.extra_init_hw = rtl8411_extra_init_hw,
 	.optimize_phy = NULL,
@@ -199,9 +172,7 @@ static const struct pcr_ops rtl8411_pcr_ops = {
 	.disable_auto_blink = rtl8411_disable_auto_blink,
 	.card_power_on = rtl8411_card_power_on,
 	.card_power_off = rtl8411_card_power_off,
-	.switch_output_voltage = rtl8411_switch_output_voltage,
 	.cd_deglitch = rtl8411_cd_deglitch,
-	.conv_clk_and_div_n = rtl8411_conv_clk_and_div_n,
 };
 
 /* SD Pull Control Enable:
diff --git a/trunk/drivers/mfd/rts5209.c b/trunk/drivers/mfd/rts5209.c
index 98fe0f39463e..283a4f148084 100644
--- a/trunk/drivers/mfd/rts5209.c
+++ b/trunk/drivers/mfd/rts5209.c
@@ -144,25 +144,6 @@ static int rts5209_card_power_off(struct rtsx_pcr *pcr, int card)
 	return rtsx_pci_send_cmd(pcr, 100);
 }
 
-static int rts5209_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
-{
-	int err;
-
-	if (voltage == OUTPUT_3V3) {
-		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
-		if (err < 0)
-			return err;
-	} else if (voltage == OUTPUT_1V8) {
-		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
-		if (err < 0)
-			return err;
-	} else {
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
 static const struct pcr_ops rts5209_pcr_ops = {
 	.extra_init_hw = rts5209_extra_init_hw,
 	.optimize_phy = rts5209_optimize_phy,
@@ -172,9 +153,7 @@ static const struct pcr_ops rts5209_pcr_ops = {
 	.disable_auto_blink = rts5209_disable_auto_blink,
 	.card_power_on = rts5209_card_power_on,
 	.card_power_off = rts5209_card_power_off,
-	.switch_output_voltage = rts5209_switch_output_voltage,
 	.cd_deglitch = NULL,
-	.conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/trunk/drivers/mfd/rts5229.c b/trunk/drivers/mfd/rts5229.c
index 29d889cbb9c5..b9dbab266fda 100644
--- a/trunk/drivers/mfd/rts5229.c
+++ b/trunk/drivers/mfd/rts5229.c
@@ -114,25 +114,6 @@ static int rts5229_card_power_off(struct rtsx_pcr *pcr, int card)
 	return rtsx_pci_send_cmd(pcr, 100);
 }
 
-static int rts5229_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
-{
-	int err;
-
-	if (voltage == OUTPUT_3V3) {
-		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
-		if (err < 0)
-			return err;
-	} else if (voltage == OUTPUT_1V8) {
-		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
-		if (err < 0)
-			return err;
-	} else {
-		return -EINVAL;
-	}
-
-	return 0;
-}
-
 static const struct pcr_ops rts5229_pcr_ops = {
 	.extra_init_hw = rts5229_extra_init_hw,
 	.optimize_phy = rts5229_optimize_phy,
@@ -142,9 +123,7 @@ static const struct pcr_ops rts5229_pcr_ops = {
 	.disable_auto_blink = rts5229_disable_auto_blink,
 	.card_power_on = rts5229_card_power_on,
 	.card_power_off = rts5229_card_power_off,
-	.switch_output_voltage = rts5229_switch_output_voltage,
 	.cd_deglitch = NULL,
-	.conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/trunk/drivers/mfd/rtsx_pcr.c b/trunk/drivers/mfd/rtsx_pcr.c
index 9fc57009e228..7a7b0bda4618 100644
--- a/trunk/drivers/mfd/rtsx_pcr.c
+++ b/trunk/drivers/mfd/rtsx_pcr.c
@@ -630,10 +630,7 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
 	if (clk == pcr->cur_clock)
 		return 0;
 
-	if (pcr->ops->conv_clk_and_div_n)
-		N = (u8)pcr->ops->conv_clk_and_div_n(clk, CLK_TO_DIV_N);
-	else
-		N = (u8)(clk - 2);
+	N = (u8)(clk - 2);
 	if ((clk <= 2) || (N > max_N))
 		return -EINVAL;
 
@@ -644,14 +641,7 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
 	/* Make sure that the SSC clock div_n is equal or greater than min_N */
 	div = CLK_DIV_1;
 	while ((N < min_N) && (div < max_div)) {
-		if (pcr->ops->conv_clk_and_div_n) {
-			int dbl_clk = pcr->ops->conv_clk_and_div_n(N,
-					DIV_N_TO_CLK) * 2;
-			N = (u8)pcr->ops->conv_clk_and_div_n(dbl_clk,
-					CLK_TO_DIV_N);
-		} else {
-			N = (N + 2) * 2 - 2;
-		}
+		N = (N + 2) * 2 - 2;
 		div++;
 	}
 	dev_dbg(&(pcr->pci->dev), "N = %d, div = %d\n", N, div);
@@ -713,15 +703,6 @@ int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card)
 }
 EXPORT_SYMBOL_GPL(rtsx_pci_card_power_off);
 
-int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
-{
-	if (pcr->ops->switch_output_voltage)
-		return pcr->ops->switch_output_voltage(pcr, voltage);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(rtsx_pci_switch_output_voltage);
-
 unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr)
 {
 	unsigned int val;
@@ -786,10 +767,10 @@ static void rtsx_pci_card_detect(struct work_struct *work)
 
 	spin_unlock_irqrestore(&pcr->lock, flags);
 
-	if ((card_detect & SD_EXIST) && pcr->slots[RTSX_SD_CARD].card_event)
+	if (card_detect & SD_EXIST)
 		pcr->slots[RTSX_SD_CARD].card_event(
 				pcr->slots[RTSX_SD_CARD].p_dev);
-	if ((card_detect & MS_EXIST) && pcr->slots[RTSX_MS_CARD].card_event)
+	if (card_detect & MS_EXIST)
 		pcr->slots[RTSX_MS_CARD].card_event(
 				pcr->slots[RTSX_MS_CARD].p_dev);
 }
diff --git a/trunk/drivers/mfd/tc3589x.c b/trunk/drivers/mfd/tc3589x.c
index ecc092c7f745..a06d66b929b1 100644
--- a/trunk/drivers/mfd/tc3589x.c
+++ b/trunk/drivers/mfd/tc3589x.c
@@ -219,18 +219,25 @@ static void tc3589x_irq_unmap(struct irq_domain *d, unsigned int virq)
 }
 
 static struct irq_domain_ops tc3589x_irq_ops = {
-	.map    = tc3589x_irq_map,
+        .map    = tc3589x_irq_map,
 	.unmap  = tc3589x_irq_unmap,
-	.xlate  = irq_domain_xlate_twocell,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int tc3589x_irq_init(struct tc3589x *tc3589x, struct device_node *np)
 {
 	int base = tc3589x->irq_base;
 
-	tc3589x->domain = irq_domain_add_simple(
-		np, TC3589x_NR_INTERNAL_IRQS, base,
-		&tc3589x_irq_ops, tc3589x);
+	if (base) {
+		tc3589x->domain = irq_domain_add_legacy(
+			NULL, TC3589x_NR_INTERNAL_IRQS, base,
+			0, &tc3589x_irq_ops, tc3589x);
+	}
+	else {
+		tc3589x->domain = irq_domain_add_linear(
+			np, TC3589x_NR_INTERNAL_IRQS,
+			&tc3589x_irq_ops, tc3589x);
+	}
 
 	if (!tc3589x->domain) {
 		dev_err(tc3589x->dev, "Failed to create irqdomain\n");
diff --git a/trunk/drivers/mfd/twl4030-power.c b/trunk/drivers/mfd/twl4030-power.c
index dd362c1078e1..4dae241e5017 100644
--- a/trunk/drivers/mfd/twl4030-power.c
+++ b/trunk/drivers/mfd/twl4030-power.c
@@ -159,7 +159,7 @@ static int twl4030_write_script_ins(u8 address, u16 pmb_message,
 static int twl4030_write_script(u8 address, struct twl4030_ins *script,
 				       int len)
 {
-	int err = -EINVAL;
+	int err;
 
 	for (; len; len--, address++, script++) {
 		if (len == 1) {
diff --git a/trunk/drivers/mfd/vexpress-config.c b/trunk/drivers/mfd/vexpress-config.c
index 3c1723aa6225..fae15d880758 100644
--- a/trunk/drivers/mfd/vexpress-config.c
+++ b/trunk/drivers/mfd/vexpress-config.c
@@ -67,7 +67,6 @@ struct vexpress_config_bridge *vexpress_config_bridge_register(
 
 	return bridge;
 }
-EXPORT_SYMBOL(vexpress_config_bridge_register);
 
 void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
 {
@@ -84,7 +83,6 @@ void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
 	while (!list_empty(&__bridge.transactions))
 		cpu_relax();
 }
-EXPORT_SYMBOL(vexpress_config_bridge_unregister);
 
 
 struct vexpress_config_func {
@@ -144,7 +142,6 @@ struct vexpress_config_func *__vexpress_config_func_get(struct device *dev,
 
 	return func;
 }
-EXPORT_SYMBOL(__vexpress_config_func_get);
 
 void vexpress_config_func_put(struct vexpress_config_func *func)
 {
@@ -152,7 +149,7 @@ void vexpress_config_func_put(struct vexpress_config_func *func)
 	of_node_put(func->bridge->node);
 	kfree(func);
 }
-EXPORT_SYMBOL(vexpress_config_func_put);
+
 
 struct vexpress_config_trans {
 	struct vexpress_config_func *func;
@@ -232,7 +229,6 @@ void vexpress_config_complete(struct vexpress_config_bridge *bridge,
 
 	complete(&trans->completion);
 }
-EXPORT_SYMBOL(vexpress_config_complete);
 
 int vexpress_config_wait(struct vexpress_config_trans *trans)
 {
@@ -240,7 +236,7 @@ int vexpress_config_wait(struct vexpress_config_trans *trans)
 
 	return trans->status;
 }
-EXPORT_SYMBOL(vexpress_config_wait);
+
 
 int vexpress_config_read(struct vexpress_config_func *func, int offset,
 		u32 *data)
diff --git a/trunk/drivers/mfd/wm5102-tables.c b/trunk/drivers/mfd/wm5102-tables.c
index 1133a64c2dc9..088872ab6338 100644
--- a/trunk/drivers/mfd/wm5102-tables.c
+++ b/trunk/drivers/mfd/wm5102-tables.c
@@ -1882,7 +1882,7 @@ static bool wm5102_volatile_register(struct device *dev, unsigned int reg)
 	}
 }
 
-#define WM5102_MAX_REGISTER 0x1a9800
+#define WM5102_MAX_REGISTER 0x1a8fff
 
 const struct regmap_config wm5102_spi_regmap = {
 	.reg_bits = 32,
diff --git a/trunk/drivers/mmc/host/rtsx_pci_sdmmc.c b/trunk/drivers/mmc/host/rtsx_pci_sdmmc.c
index f74b5adca642..571915dfb218 100644
--- a/trunk/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/trunk/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -1060,6 +1060,26 @@ static int sd_wait_voltage_stable_2(struct realtek_pci_sdmmc *host)
 	return 0;
 }
 
+static int sd_change_bank_voltage(struct realtek_pci_sdmmc *host, u8 voltage)
+{
+	struct rtsx_pcr *pcr = host->pcr;
+	int err;
+
+	if (voltage == SD_IO_3V3) {
+		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
+		if (err < 0)
+			return err;
+	} else if (voltage == SD_IO_1V8) {
+		err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
+		if (err < 0)
+			return err;
+	} else {
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
 {
 	struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -1078,11 +1098,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
 	rtsx_pci_start_run(pcr);
 
 	if (ios->signal_voltage == MMC_SIGNAL_VOLTAGE_330)
-		voltage = OUTPUT_3V3;
+		voltage = SD_IO_3V3;
 	else
-		voltage = OUTPUT_1V8;
+		voltage = SD_IO_1V8;
 
-	if (voltage == OUTPUT_1V8) {
+	if (voltage == SD_IO_1V8) {
 		err = rtsx_pci_write_register(pcr,
 				SD30_DRIVE_SEL, 0x07, DRIVER_TYPE_B);
 		if (err < 0)
@@ -1093,11 +1113,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
 			goto out;
 	}
 
-	err = rtsx_pci_switch_output_voltage(pcr, voltage);
+	err = sd_change_bank_voltage(host, voltage);
 	if (err < 0)
 		goto out;
 
-	if (voltage == OUTPUT_1V8) {
+	if (voltage == SD_IO_1V8) {
 		err = sd_wait_voltage_stable_2(host);
 		if (err < 0)
 			goto out;
diff --git a/trunk/drivers/net/can/c_can/c_can.c b/trunk/drivers/net/can/c_can/c_can.c
index 58607f196c9e..5233b8f58d77 100644
--- a/trunk/drivers/net/can/c_can/c_can.c
+++ b/trunk/drivers/net/can/c_can/c_can.c
@@ -960,7 +960,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
 		break;
 	case LEC_ACK_ERROR:
 		netdev_dbg(dev, "ack error\n");
-		cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
+		cf->data[2] |= (CAN_ERR_PROT_LOC_ACK |
 				CAN_ERR_PROT_LOC_ACK_DEL);
 		break;
 	case LEC_BIT1_ERROR:
@@ -973,7 +973,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
 		break;
 	case LEC_CRC_ERROR:
 		netdev_dbg(dev, "CRC error\n");
-		cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
+		cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
 				CAN_ERR_PROT_LOC_CRC_DEL);
 		break;
 	default:
diff --git a/trunk/drivers/net/can/pch_can.c b/trunk/drivers/net/can/pch_can.c
index 5c314a961970..7d1748575b1f 100644
--- a/trunk/drivers/net/can/pch_can.c
+++ b/trunk/drivers/net/can/pch_can.c
@@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
 		stats->rx_errors++;
 		break;
 	case PCH_CRC_ERR:
-		cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+		cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
 			       CAN_ERR_PROT_LOC_CRC_DEL;
 		priv->can.can_stats.bus_error++;
 		stats->rx_errors++;
diff --git a/trunk/drivers/net/can/ti_hecc.c b/trunk/drivers/net/can/ti_hecc.c
index 300581b24ff3..f898c6363729 100644
--- a/trunk/drivers/net/can/ti_hecc.c
+++ b/trunk/drivers/net/can/ti_hecc.c
@@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
 		}
 		if (err_status & HECC_CANES_CRCE) {
 			hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
-			cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+			cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
 					CAN_ERR_PROT_LOC_CRC_DEL;
 		}
 		if (err_status & HECC_CANES_ACKE) {
 			hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
-			cf->data[3] |= CAN_ERR_PROT_LOC_ACK |
+			cf->data[2] |= CAN_ERR_PROT_LOC_ACK |
 					CAN_ERR_PROT_LOC_ACK_DEL;
 		}
 	}
diff --git a/trunk/drivers/net/ethernet/3com/3c574_cs.c b/trunk/drivers/net/ethernet/3com/3c574_cs.c
index ffd8de28a76a..66df93638085 100644
--- a/trunk/drivers/net/ethernet/3com/3c574_cs.c
+++ b/trunk/drivers/net/ethernet/3com/3c574_cs.c
@@ -432,7 +432,7 @@ static int tc574_config(struct pcmcia_device *link)
 	netdev_info(dev, "%s at io %#3lx, irq %d, hw_addr %pM\n",
 		    cardname, dev->base_addr, dev->irq, dev->dev_addr);
 	netdev_info(dev, " %dK FIFO split %s Rx:Tx, %sMII interface.\n",
-		    8 << (config & Ram_size),
+		    8 << config & Ram_size,
 		    ram_split[(config & Ram_split) >> Ram_split_shift],
 		    config & Autoselect ? "autoselect " : "");
 
diff --git a/trunk/drivers/net/ethernet/broadcom/tg3.c b/trunk/drivers/net/ethernet/broadcom/tg3.c
index bdb086934cd9..78ea90c40e19 100644
--- a/trunk/drivers/net/ethernet/broadcom/tg3.c
+++ b/trunk/drivers/net/ethernet/broadcom/tg3.c
@@ -1283,26 +1283,14 @@ static int tg3_phy_auxctl_write(struct tg3 *tp, int reg, u32 set)
 	return tg3_writephy(tp, MII_TG3_AUX_CTRL, set | reg);
 }
 
-static int tg3_phy_toggle_auxctl_smdsp(struct tg3 *tp, bool enable)
-{
-	u32 val;
-	int err;
+#define TG3_PHY_AUXCTL_SMDSP_ENABLE(tp) \
+	tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
+			     MII_TG3_AUXCTL_ACTL_SMDSP_ENA | \
+			     MII_TG3_AUXCTL_ACTL_TX_6DB)
 
-	err = tg3_phy_auxctl_read(tp, MII_TG3_AUXCTL_SHDWSEL_AUXCTL, &val);
-
-	if (err)
-		return err;
-	if (enable)
-
-		val |= MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
-	else
-		val &= ~MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
-
-	err = tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL,
-				   val | MII_TG3_AUXCTL_ACTL_TX_6DB);
-
-	return err;
-}
+#define TG3_PHY_AUXCTL_SMDSP_DISABLE(tp) \
+	tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
+			     MII_TG3_AUXCTL_ACTL_TX_6DB);
 
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
@@ -2235,7 +2223,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
 
 	otp = tp->phy_otp;
 
-	if (tg3_phy_toggle_auxctl_smdsp(tp, true))
+	if (TG3_PHY_AUXCTL_SMDSP_ENABLE(tp))
 		return;
 
 	phy = ((otp & TG3_OTP_AGCTGT_MASK) >> TG3_OTP_AGCTGT_SHIFT);
@@ -2260,7 +2248,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
 	      ((otp & TG3_OTP_RCOFF_MASK) >> TG3_OTP_RCOFF_SHIFT);
 	tg3_phydsp_write(tp, MII_TG3_DSP_EXP97, phy);
 
-	tg3_phy_toggle_auxctl_smdsp(tp, false);
+	TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 }
 
 static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
@@ -2296,9 +2284,9 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
 
 	if (!tp->setlpicnt) {
 		if (current_link_up == 1 &&
-		   !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
+		   !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
 			tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, 0x0000);
-			tg3_phy_toggle_auxctl_smdsp(tp, false);
+			TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 		}
 
 		val = tr32(TG3_CPMU_EEE_MODE);
@@ -2314,11 +2302,11 @@ static void tg3_phy_eee_enable(struct tg3 *tp)
 	    (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
 	     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719 ||
 	     tg3_flag(tp, 57765_CLASS)) &&
-	    !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
+	    !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
 		val = MII_TG3_DSP_TAP26_ALNOKO |
 		      MII_TG3_DSP_TAP26_RMRXSTO;
 		tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, val);
-		tg3_phy_toggle_auxctl_smdsp(tp, false);
+		TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 	}
 
 	val = tr32(TG3_CPMU_EEE_MODE);
@@ -2462,7 +2450,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
 		tg3_writephy(tp, MII_CTRL1000,
 			     CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER);
 
-		err = tg3_phy_toggle_auxctl_smdsp(tp, true);
+		err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
 		if (err)
 			return err;
 
@@ -2483,7 +2471,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
 	tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x8200);
 	tg3_writephy(tp, MII_TG3_DSP_CONTROL, 0x0000);
 
-	tg3_phy_toggle_auxctl_smdsp(tp, false);
+	TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 
 	tg3_writephy(tp, MII_CTRL1000, phy9_orig);
 
@@ -2584,10 +2572,10 @@ static int tg3_phy_reset(struct tg3 *tp)
 
 out:
 	if ((tp->phy_flags & TG3_PHYFLG_ADC_BUG) &&
-	    !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
+	    !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
 		tg3_phydsp_write(tp, 0x201f, 0x2aaa);
 		tg3_phydsp_write(tp, 0x000a, 0x0323);
-		tg3_phy_toggle_auxctl_smdsp(tp, false);
+		TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 	}
 
 	if (tp->phy_flags & TG3_PHYFLG_5704_A0_BUG) {
@@ -2596,14 +2584,14 @@ static int tg3_phy_reset(struct tg3 *tp)
 	}
 
 	if (tp->phy_flags & TG3_PHYFLG_BER_BUG) {
-		if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
+		if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
 			tg3_phydsp_write(tp, 0x000a, 0x310b);
 			tg3_phydsp_write(tp, 0x201f, 0x9506);
 			tg3_phydsp_write(tp, 0x401f, 0x14e2);
-			tg3_phy_toggle_auxctl_smdsp(tp, false);
+			TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 		}
 	} else if (tp->phy_flags & TG3_PHYFLG_JITTER_BUG) {
-		if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
+		if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
 			tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
 			if (tp->phy_flags & TG3_PHYFLG_ADJUST_TRIM) {
 				tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x110b);
@@ -2612,7 +2600,7 @@ static int tg3_phy_reset(struct tg3 *tp)
 			} else
 				tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
 
-			tg3_phy_toggle_auxctl_smdsp(tp, false);
+			TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 		}
 	}
 
@@ -4021,7 +4009,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
 	tw32(TG3_CPMU_EEE_MODE,
 	     tr32(TG3_CPMU_EEE_MODE) & ~TG3_CPMU_EEEMD_LPI_ENABLE);
 
-	err = tg3_phy_toggle_auxctl_smdsp(tp, true);
+	err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
 	if (!err) {
 		u32 err2;
 
@@ -4054,7 +4042,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
 						 MII_TG3_DSP_CH34TP2_HIBW01);
 		}
 
-		err2 = tg3_phy_toggle_auxctl_smdsp(tp, false);
+		err2 = TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
 		if (!err)
 			err = err2;
 	}
@@ -6962,9 +6950,6 @@ static void tg3_poll_controller(struct net_device *dev)
 	int i;
 	struct tg3 *tp = netdev_priv(dev);
 
-	if (tg3_irq_sync(tp))
-		return;
-
 	for (i = 0; i < tp->irq_cnt; i++)
 		tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
 }
@@ -16382,7 +16367,6 @@ static int tg3_init_one(struct pci_dev *pdev,
 	tp->pm_cap = pm_cap;
 	tp->rx_mode = TG3_DEF_RX_MODE;
 	tp->tx_mode = TG3_DEF_TX_MODE;
-	tp->irq_sync = 1;
 
 	if (tg3_debug > 0)
 		tp->msg_enable = tg3_debug;
diff --git a/trunk/drivers/net/ethernet/calxeda/xgmac.c b/trunk/drivers/net/ethernet/calxeda/xgmac.c
index f7f02900f650..b407043ce9b0 100644
--- a/trunk/drivers/net/ethernet/calxeda/xgmac.c
+++ b/trunk/drivers/net/ethernet/calxeda/xgmac.c
@@ -548,10 +548,6 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p)
 		return -1;
 	}
 
-	/* All frames should fit into a single buffer */
-	if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))
-		return -1;
-
 	/* Check if packet has checksum already */
 	if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&
 		!(ext_status & RXDESC_IP_PAYLOAD_MASK))
diff --git a/trunk/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/trunk/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index c306df7d4568..f0718e1a8369 100644
--- a/trunk/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/trunk/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -1994,20 +1994,9 @@ static int set_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
 {
 	const struct port_info *pi = netdev_priv(dev);
 	struct adapter *adap = pi->adapter;
-	struct sge_rspq *q;
-	int i;
-	int r = 0;
-
-	for (i = pi->first_qset; i < pi->first_qset + pi->nqsets; i++) {
-		q = &adap->sge.ethrxq[i].rspq;
-		r = set_rxq_intr_params(adap, q, c->rx_coalesce_usecs,
-			c->rx_max_coalesced_frames);
-		if (r) {
-			dev_err(&dev->dev, "failed to set coalesce %d\n", r);
-			break;
-		}
-	}
-	return r;
+
+	return set_rxq_intr_params(adap, &adap->sge.ethrxq[pi->first_qset].rspq,
+			c->rx_coalesce_usecs, c->rx_max_coalesced_frames);
 }
 
 static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
diff --git a/trunk/drivers/net/ethernet/intel/ixgbe/Makefile b/trunk/drivers/net/ethernet/intel/ixgbe/Makefile
index 687c83d1bdab..f3a632bf8d96 100644
--- a/trunk/drivers/net/ethernet/intel/ixgbe/Makefile
+++ b/trunk/drivers/net/ethernet/intel/ixgbe/Makefile
@@ -32,7 +32,7 @@
 
 obj-$(CONFIG_IXGBE) += ixgbe.o
 
-ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o \
+ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o ixgbe_debugfs.o\
               ixgbe_82599.o ixgbe_82598.o ixgbe_phy.o ixgbe_sriov.o \
               ixgbe_mbx.o ixgbe_x540.o ixgbe_lib.o ixgbe_ptp.o
 
@@ -40,5 +40,4 @@ ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
                               ixgbe_dcb_82599.o ixgbe_dcb_nl.o
 
 ixgbe-$(CONFIG_IXGBE_HWMON) += ixgbe_sysfs.o
-ixgbe-$(CONFIG_DEBUG_FS) += ixgbe_debugfs.o
 ixgbe-$(CONFIG_FCOE:m=y) += ixgbe_fcoe.o
diff --git a/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c b/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
index 3504686d3af5..50aa546b8c7a 100644
--- a/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
+++ b/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
@@ -24,6 +24,9 @@
   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 
 *******************************************************************************/
+
+#ifdef CONFIG_DEBUG_FS
+
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
@@ -274,3 +277,5 @@ void ixgbe_dbg_exit(void)
 {
 	debugfs_remove_recursive(ixgbe_dbg_root);
 }
+
+#endif /* CONFIG_DEBUG_FS */
diff --git a/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index bb9256a1b0a9..1a751c9d09c4 100644
--- a/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/trunk/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -660,11 +660,11 @@ int ixgbe_ptp_hwtstamp_ioctl(struct ixgbe_adapter *adapter,
 		break;
 	case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
 		tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-		tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
+		tsync_rx_mtrl = IXGBE_RXMTRL_V1_SYNC_MSG;
 		break;
 	case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
 		tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-		tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
+		tsync_rx_mtrl = IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
 		break;
 	case HWTSTAMP_FILTER_PTP_V2_EVENT:
 	case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
diff --git a/trunk/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/trunk/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 6771b69f40d5..2b799f4f1c37 100644
--- a/trunk/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/trunk/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -630,15 +630,10 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
 		ring->tx_csum++;
 	}
 
-	if (mlx4_is_mfunc(mdev->dev) || priv->validate_loopback) {
-		/* Copy dst mac address to wqe. This allows loopback in eSwitch,
-		 * so that VFs and PF can communicate with each other
-		 */
-		ethh = (struct ethhdr *)skb->data;
-		tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
-		tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
-	}
-
+	/* Copy dst mac address to wqe */
+	ethh = (struct ethhdr *)skb->data;
+	tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
+	tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
 	/* Handle LSO (TSO) packets */
 	if (lso_header_size) {
 		/* Mark opcode as LSO */
diff --git a/trunk/drivers/net/ethernet/mellanox/mlx4/main.c b/trunk/drivers/net/ethernet/mellanox/mlx4/main.c
index a6542d75374c..e1bafffbc3b1 100644
--- a/trunk/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/trunk/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -1790,8 +1790,15 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
 	int i;
 
 	if (msi_x) {
-		nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
-			     nreq);
+		/* In multifunction mode each function gets 2 msi-X vectors
+		 * one for data path completions anf the other for asynch events
+		 * or command completions */
+		if (mlx4_is_mfunc(dev)) {
+			nreq = 2;
+		} else {
+			nreq = min_t(int, dev->caps.num_eqs -
+				     dev->caps.reserved_eqs, nreq);
+		}
 
 		entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
 		if (!entries)
diff --git a/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 695667d471a1..bc165f4d0f65 100644
--- a/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -144,7 +144,7 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter)
 					 buffrag->length, PCI_DMA_TODEVICE);
 			buffrag->dma = 0ULL;
 		}
-		for (j = 1; j < cmd_buf->frag_count; j++) {
+		for (j = 0; j < cmd_buf->frag_count; j++) {
 			buffrag++;
 			if (buffrag->dma) {
 				pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 69e321a65077..6098fd4adfeb 100644
--- a/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/trunk/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1963,12 +1963,10 @@ netxen_map_tx_skb(struct pci_dev *pdev,
 	while (--i >= 0) {
 		nf = &pbuf->frag_array[i+1];
 		pci_unmap_page(pdev, nf->dma, nf->length, PCI_DMA_TODEVICE);
-		nf->dma = 0ULL;
 	}
 
 	nf = &pbuf->frag_array[0];
 	pci_unmap_single(pdev, nf->dma, skb_headlen(skb), PCI_DMA_TODEVICE);
-	nf->dma = 0ULL;
 
 out_err:
 	return -ENOMEM;
diff --git a/trunk/drivers/net/ethernet/realtek/r8169.c b/trunk/drivers/net/ethernet/realtek/r8169.c
index 11702324a071..ed96f309bca8 100644
--- a/trunk/drivers/net/ethernet/realtek/r8169.c
+++ b/trunk/drivers/net/ethernet/realtek/r8169.c
@@ -1826,6 +1826,8 @@ static void rtl8169_rx_vlan_tag(struct RxDesc *desc, struct sk_buff *skb)
 
 	if (opts2 & RxVlanTag)
 		__vlan_hwaccel_put_tag(skb, swab16(opts2 & 0xffff));
+
+	desc->opts2 = 0;
 }
 
 static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd)
@@ -6062,6 +6064,8 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 			    !(status & (RxRWT | RxFOVF)) &&
 			    (dev->features & NETIF_F_RXALL))
 				goto process_pkt;
+
+			rtl8169_mark_to_asic(desc, rx_buf_sz);
 		} else {
 			struct sk_buff *skb;
 			dma_addr_t addr;
@@ -6082,14 +6086,16 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 			if (unlikely(rtl8169_fragmented_frame(status))) {
 				dev->stats.rx_dropped++;
 				dev->stats.rx_length_errors++;
-				goto release_descriptor;
+				rtl8169_mark_to_asic(desc, rx_buf_sz);
+				continue;
 			}
 
 			skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
 						  tp, pkt_size, addr);
+			rtl8169_mark_to_asic(desc, rx_buf_sz);
 			if (!skb) {
 				dev->stats.rx_dropped++;
-				goto release_descriptor;
+				continue;
 			}
 
 			rtl8169_rx_csum(skb, status);
@@ -6105,10 +6111,13 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
 			tp->rx_stats.bytes += pkt_size;
 			u64_stats_update_end(&tp->rx_stats.syncp);
 		}
-release_descriptor:
-		desc->opts2 = 0;
-		wmb();
-		rtl8169_mark_to_asic(desc, rx_buf_sz);
+
+		/* Work around for AMD plateform. */
+		if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
+		    (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
+			desc->opts2 = 0;
+			cur_rx++;
+		}
 	}
 
 	count = cur_rx - tp->cur_rx;
diff --git a/trunk/drivers/net/hyperv/hyperv_net.h b/trunk/drivers/net/hyperv/hyperv_net.h
index e6fe0d80d612..5fd6f4674326 100644
--- a/trunk/drivers/net/hyperv/hyperv_net.h
+++ b/trunk/drivers/net/hyperv/hyperv_net.h
@@ -84,7 +84,7 @@ struct hv_netvsc_packet {
 };
 
 struct netvsc_device_info {
-	unsigned char mac_adr[ETH_ALEN];
+	unsigned char mac_adr[6];
 	bool link_state;	/* 0 - link up, 1 - link down */
 	int  ring_size;
 };
diff --git a/trunk/drivers/net/hyperv/netvsc_drv.c b/trunk/drivers/net/hyperv/netvsc_drv.c
index 8264f0ef7692..f825a629a699 100644
--- a/trunk/drivers/net/hyperv/netvsc_drv.c
+++ b/trunk/drivers/net/hyperv/netvsc_drv.c
@@ -349,7 +349,7 @@ static int netvsc_set_mac_addr(struct net_device *ndev, void *p)
 	struct net_device_context *ndevctx = netdev_priv(ndev);
 	struct hv_device *hdev =  ndevctx->device_ctx;
 	struct sockaddr *addr = p;
-	char save_adr[ETH_ALEN];
+	char save_adr[14];
 	unsigned char save_aatype;
 	int err;
 
diff --git a/trunk/drivers/net/loopback.c b/trunk/drivers/net/loopback.c
index fcbf680c3e62..81f8f9e31db5 100644
--- a/trunk/drivers/net/loopback.c
+++ b/trunk/drivers/net/loopback.c
@@ -77,11 +77,6 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 
 	skb_orphan(skb);
 
-	/* Before queueing this packet to netif_rx(),
-	 * make sure dst is refcounted.
-	 */
-	skb_dst_force(skb);
-
 	skb->protocol = eth_type_trans(skb, dev);
 
 	/* it's OK to use per_cpu_ptr() because BHs are off */
diff --git a/trunk/drivers/net/macvlan.c b/trunk/drivers/net/macvlan.c
index d3fb97d97cbc..68a43fe602e7 100644
--- a/trunk/drivers/net/macvlan.c
+++ b/trunk/drivers/net/macvlan.c
@@ -822,10 +822,7 @@ static int macvlan_changelink(struct net_device *dev,
 
 static size_t macvlan_get_size(const struct net_device *dev)
 {
-	return (0
-		+ nla_total_size(4) /* IFLA_MACVLAN_MODE */
-		+ nla_total_size(2) /* IFLA_MACVLAN_FLAGS */
-		);
+	return nla_total_size(4);
 }
 
 static int macvlan_fill_info(struct sk_buff *skb,
diff --git a/trunk/drivers/net/phy/icplus.c b/trunk/drivers/net/phy/icplus.c
index b5ddd5077a80..d5199cb4caec 100644
--- a/trunk/drivers/net/phy/icplus.c
+++ b/trunk/drivers/net/phy/icplus.c
@@ -36,9 +36,8 @@ MODULE_LICENSE("GPL");
 
 /* IP101A/G - IP1001 */
 #define IP10XX_SPEC_CTRL_STATUS		16	/* Spec. Control Register */
-#define IP1001_RXPHASE_SEL		(1<<0)	/* Add delay on RX_CLK */
-#define IP1001_TXPHASE_SEL		(1<<1)	/* Add delay on TX_CLK */
 #define IP1001_SPEC_CTRL_STATUS_2	20	/* IP1001 Spec. Control Reg 2 */
+#define IP1001_PHASE_SEL_MASK		3	/* IP1001 RX/TXPHASE_SEL */
 #define IP1001_APS_ON			11	/* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON			2	/* IP101A/G APS Mode bit */
 #define IP101A_G_IRQ_CONF_STATUS	0x11	/* Conf Info IRQ & Status Reg */
@@ -139,24 +138,19 @@ static int ip1001_config_init(struct phy_device *phydev)
 	if (c < 0)
 		return c;
 
-	if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
-	    (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
-	    (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
-	    (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
+	/* INTR pin used: speed/link/duplex will cause an interrupt */
+	c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
+	if (c < 0)
+		return c;
 
+	if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
+		/* Additional delay (2ns) used to adjust RX clock phase
+		 * at RGMII interface */
 		c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
 		if (c < 0)
 			return c;
 
-		c &= ~(IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
-
-		if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
-			c |= (IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
-		else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
-			c |= IP1001_RXPHASE_SEL;
-		else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
-			c |= IP1001_TXPHASE_SEL;
-
+		c |= IP1001_PHASE_SEL_MASK;
 		c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
 		if (c < 0)
 			return c;
@@ -173,11 +167,6 @@ static int ip101a_g_config_init(struct phy_device *phydev)
 	if (c < 0)
 		return c;
 
-	/* INTR pin used: speed/link/duplex will cause an interrupt */
-	c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
-	if (c < 0)
-		return c;
-
 	/* Enable Auto Power Saving mode */
 	c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
 	c |= IP101A_G_APS_ON;
diff --git a/trunk/drivers/net/phy/marvell.c b/trunk/drivers/net/phy/marvell.c
index 22dec9c7ef05..5d2a3f215887 100644
--- a/trunk/drivers/net/phy/marvell.c
+++ b/trunk/drivers/net/phy/marvell.c
@@ -353,6 +353,15 @@ static int m88e1111_config_init(struct phy_device *phydev)
 	int err;
 	int temp;
 
+	/* Enable Fiber/Copper auto selection */
+	temp = phy_read(phydev, MII_M1111_PHY_EXT_SR);
+	temp &= ~MII_M1111_HWCFG_FIBER_COPPER_AUTO;
+	phy_write(phydev, MII_M1111_PHY_EXT_SR, temp);
+
+	temp = phy_read(phydev, MII_BMCR);
+	temp |= BMCR_RESET;
+	phy_write(phydev, MII_BMCR, temp);
+
 	if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
 	    (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
 	    (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
diff --git a/trunk/drivers/net/tun.c b/trunk/drivers/net/tun.c
index cc09b67c23bc..af372d0957fe 100644
--- a/trunk/drivers/net/tun.c
+++ b/trunk/drivers/net/tun.c
@@ -109,11 +109,11 @@ struct tap_filter {
 	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
 };
 
-/* DEFAULT_MAX_NUM_RSS_QUEUES were choosed to let the rx/tx queues allocated for
- * the netdevice to be fit in one page. So we can make sure the success of
- * memory allocation. TODO: increase the limit. */
-#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
-#define MAX_TAP_FLOWS  4096
+/* 1024 is probably a high enough limit: modern hypervisors seem to support on
+ * the order of 100-200 CPUs so this leaves us some breathing space if we want
+ * to match a queue per guest CPU.
+ */
+#define MAX_TAP_QUEUES 1024
 
 #define TUN_FLOW_EXPIRE (3 * HZ)
 
@@ -185,8 +185,6 @@ struct tun_struct {
 	unsigned long ageing_time;
 	unsigned int numdisabled;
 	struct list_head disabled;
-	void *security;
-	u32 flow_count;
 };
 
 static inline u32 tun_hashfn(u32 rxhash)
@@ -220,7 +218,6 @@ static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
 		e->queue_index = queue_index;
 		e->tun = tun;
 		hlist_add_head_rcu(&e->hash_link, head);
-		++tun->flow_count;
 	}
 	return e;
 }
@@ -231,7 +228,6 @@ static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
 		  e->rxhash, e->queue_index);
 	hlist_del_rcu(&e->hash_link);
 	kfree_rcu(e, rcu);
-	--tun->flow_count;
 }
 
 static void tun_flow_flush(struct tun_struct *tun)
@@ -321,8 +317,7 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
 		e->updated = jiffies;
 	} else {
 		spin_lock_bh(&tun->lock);
-		if (!tun_flow_find(head, rxhash) &&
-		    tun->flow_count < MAX_TAP_FLOWS)
+		if (!tun_flow_find(head, rxhash))
 			tun_flow_create(tun, head, rxhash, queue_index);
 
 		if (!timer_pending(&tun->flow_gc_timer))
@@ -495,10 +490,6 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
 	struct tun_file *tfile = file->private_data;
 	int err;
 
-	err = security_tun_dev_attach(tfile->socket.sk, tun->security);
-	if (err < 0)
-		goto out;
-
 	err = -EINVAL;
 	if (rtnl_dereference(tfile->tun))
 		goto out;
@@ -1382,7 +1373,6 @@ static void tun_free_netdev(struct net_device *dev)
 
 	BUG_ON(!(list_empty(&tun->disabled)));
 	tun_flow_uninit(tun);
-	security_tun_dev_free_security(tun->security);
 	free_netdev(dev);
 }
 
@@ -1572,7 +1562,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 		if (tun_not_capable(tun))
 			return -EPERM;
-		err = security_tun_dev_open(tun->security);
+		err = security_tun_dev_attach(tfile->socket.sk);
 		if (err < 0)
 			return err;
 
@@ -1587,8 +1577,6 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 	else {
 		char *name;
 		unsigned long flags = 0;
-		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
-			     MAX_TAP_QUEUES : 1;
 
 		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
 			return -EPERM;
@@ -1612,8 +1600,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 			name = ifr->ifr_name;
 
 		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
-				       tun_setup, queues, queues);
-
+				       tun_setup,
+				       MAX_TAP_QUEUES, MAX_TAP_QUEUES);
 		if (!dev)
 			return -ENOMEM;
 
@@ -1631,9 +1619,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
 		spin_lock_init(&tun->lock);
 
-		err = security_tun_dev_alloc_security(&tun->security);
-		if (err < 0)
-			goto err_free_dev;
+		security_tun_dev_post_create(&tfile->sk);
 
 		tun_net_init(dev);
 
@@ -1803,14 +1789,10 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
 
 	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
 		tun = tfile->detached;
-		if (!tun) {
+		if (!tun)
 			ret = -EINVAL;
-			goto unlock;
-		}
-		ret = security_tun_dev_attach_queue(tun->security);
-		if (ret < 0)
-			goto unlock;
-		ret = tun_attach(tun, file);
+		else
+			ret = tun_attach(tun, file);
 	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
 		tun = rtnl_dereference(tfile->tun);
 		if (!tun || !(tun->flags & TUN_TAP_MQ))
@@ -1820,7 +1802,6 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
 	} else
 		ret = -EINVAL;
 
-unlock:
 	rtnl_unlock();
 	return ret;
 }
diff --git a/trunk/drivers/net/usb/cdc_mbim.c b/trunk/drivers/net/usb/cdc_mbim.c
index 248d2dc765a5..42f51c71ec1f 100644
--- a/trunk/drivers/net/usb/cdc_mbim.c
+++ b/trunk/drivers/net/usb/cdc_mbim.c
@@ -374,21 +374,6 @@ static const struct driver_info cdc_mbim_info = {
 	.tx_fixup = cdc_mbim_tx_fixup,
 };
 
-/* MBIM and NCM devices should not need a ZLP after NTBs with
- * dwNtbOutMaxSize length. This driver_info is for the exceptional
- * devices requiring it anyway, allowing them to be supported without
- * forcing the performance penalty on all the sane devices.
- */
-static const struct driver_info cdc_mbim_info_zlp = {
-	.description = "CDC MBIM",
-	.flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
-	.bind = cdc_mbim_bind,
-	.unbind = cdc_mbim_unbind,
-	.manage_power = cdc_mbim_manage_power,
-	.rx_fixup = cdc_mbim_rx_fixup,
-	.tx_fixup = cdc_mbim_tx_fixup,
-};
-
 static const struct usb_device_id mbim_devs[] = {
 	/* This duplicate NCM entry is intentional. MBIM devices can
 	 * be disguised as NCM by default, and this is necessary to
@@ -400,10 +385,6 @@ static const struct usb_device_id mbim_devs[] = {
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
 	  .driver_info = (unsigned long)&cdc_mbim_info,
 	},
-	/* Sierra Wireless MC7710 need ZLPs */
-	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68a2, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
-	  .driver_info = (unsigned long)&cdc_mbim_info_zlp,
-	},
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
 	  .driver_info = (unsigned long)&cdc_mbim_info,
 	},
diff --git a/trunk/drivers/net/usb/cdc_ncm.c b/trunk/drivers/net/usb/cdc_ncm.c
index 9197b2c72ca3..71b6e92b8e9b 100644
--- a/trunk/drivers/net/usb/cdc_ncm.c
+++ b/trunk/drivers/net/usb/cdc_ncm.c
@@ -435,13 +435,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 		len -= temp;
 	}
 
-	/* some buggy devices have an IAD but no CDC Union */
-	if (!ctx->union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
-		ctx->control = intf;
-		ctx->data = usb_ifnum_to_if(dev->udev, intf->cur_altsetting->desc.bInterfaceNumber + 1);
-		dev_dbg(&intf->dev, "CDC Union missing - got slave from IAD\n");
-	}
-
 	/* check if we got everything */
 	if ((ctx->control == NULL) || (ctx->data == NULL) ||
 	    ((!ctx->mbim_desc) && ((ctx->ether_desc == NULL) || (ctx->control != intf))))
@@ -504,8 +497,7 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
 error2:
 	usb_set_intfdata(ctx->control, NULL);
 	usb_set_intfdata(ctx->data, NULL);
-	if (ctx->data != ctx->control)
-		usb_driver_release_interface(driver, ctx->data);
+	usb_driver_release_interface(driver, ctx->data);
 error:
 	cdc_ncm_free((struct cdc_ncm_ctx *)dev->data[0]);
 	dev->data[0] = 0;
@@ -1163,20 +1155,6 @@ static const struct driver_info wwan_info = {
 	.tx_fixup = cdc_ncm_tx_fixup,
 };
 
-/* Same as wwan_info, but with FLAG_NOARP  */
-static const struct driver_info wwan_noarp_info = {
-	.description = "Mobile Broadband Network Device (NO ARP)",
-	.flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
-			| FLAG_WWAN | FLAG_NOARP,
-	.bind = cdc_ncm_bind,
-	.unbind = cdc_ncm_unbind,
-	.check_connect = cdc_ncm_check_connect,
-	.manage_power = usbnet_manage_power,
-	.status = cdc_ncm_status,
-	.rx_fixup = cdc_ncm_rx_fixup,
-	.tx_fixup = cdc_ncm_tx_fixup,
-};
-
 static const struct usb_device_id cdc_devs[] = {
 	/* Ericsson MBM devices like F5521gw */
 	{ .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
@@ -1216,13 +1194,6 @@ static const struct usb_device_id cdc_devs[] = {
 	  .driver_info = (unsigned long)&wwan_info,
 	},
 
-	/* Infineon(now Intel) HSPA Modem platform */
-	{ USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
-		USB_CLASS_COMM,
-		USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
-	  .driver_info = (unsigned long)&wwan_noarp_info,
-	},
-
 	/* Generic CDC-NCM devices */
 	{ USB_INTERFACE_INFO(USB_CLASS_COMM,
 		USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
diff --git a/trunk/drivers/net/usb/dm9601.c b/trunk/drivers/net/usb/dm9601.c
index d7e99445518e..3f554c1149f3 100644
--- a/trunk/drivers/net/usb/dm9601.c
+++ b/trunk/drivers/net/usb/dm9601.c
@@ -45,12 +45,6 @@
 #define DM_MCAST_ADDR	0x16	/* 8 bytes */
 #define DM_GPR_CTRL	0x1e
 #define DM_GPR_DATA	0x1f
-#define DM_CHIP_ID	0x2c
-#define DM_MODE_CTRL	0x91	/* only on dm9620 */
-
-/* chip id values */
-#define ID_DM9601	0
-#define ID_DM9620	1
 
 #define DM_MAX_MCAST	64
 #define DM_MCAST_SIZE	8
@@ -59,6 +53,7 @@
 #define DM_RX_OVERHEAD	7	/* 3 byte header + 4 byte crc tail */
 #define DM_TIMEOUT	1000
 
+
 static int dm_read(struct usbnet *dev, u8 reg, u16 length, void *data)
 {
 	int err;
@@ -89,23 +84,32 @@ static int dm_write(struct usbnet *dev, u8 reg, u16 length, void *data)
 
 static int dm_write_reg(struct usbnet *dev, u8 reg, u8 value)
 {
-	return usbnet_write_cmd(dev, DM_WRITE_REG,
+	return usbnet_write_cmd(dev, DM_WRITE_REGS,
 				USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
 				value, reg, NULL, 0);
 }
 
-static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
+static void dm_write_async_helper(struct usbnet *dev, u8 reg, u8 value,
+				  u16 length, void *data)
 {
 	usbnet_write_cmd_async(dev, DM_WRITE_REGS,
 			       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			       0, reg, data, length);
+			       value, reg, data, length);
+}
+
+static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
+{
+	netdev_dbg(dev->net, "dm_write_async() reg=0x%02x length=%d\n", reg, length);
+
+	dm_write_async_helper(dev, reg, 0, length, data);
 }
 
 static void dm_write_reg_async(struct usbnet *dev, u8 reg, u8 value)
 {
-	usbnet_write_cmd_async(dev, DM_WRITE_REG,
-			       USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			       value, reg, NULL, 0);
+	netdev_dbg(dev->net, "dm_write_reg_async() reg=0x%02x value=0x%02x\n",
+		   reg, value);
+
+	dm_write_async_helper(dev, reg, value, 0, NULL);
 }
 
 static int dm_read_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 *value)
@@ -354,7 +358,7 @@ static const struct net_device_ops dm9601_netdev_ops = {
 static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
 {
 	int ret;
-	u8 mac[ETH_ALEN], id;
+	u8 mac[ETH_ALEN];
 
 	ret = usbnet_get_endpoints(dev, intf);
 	if (ret)
@@ -395,24 +399,6 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
 		__dm9601_set_mac_address(dev);
 	}
 
-	if (dm_read_reg(dev, DM_CHIP_ID, &id) < 0) {
-		netdev_err(dev->net, "Error reading chip ID\n");
-		ret = -ENODEV;
-		goto out;
-	}
-
-	/* put dm9620 devices in dm9601 mode */
-	if (id == ID_DM9620) {
-		u8 mode;
-
-		if (dm_read_reg(dev, DM_MODE_CTRL, &mode) < 0) {
-			netdev_err(dev->net, "Error reading MODE_CTRL\n");
-			ret = -ENODEV;
-			goto out;
-		}
-		dm_write_reg(dev, DM_MODE_CTRL, mode & 0x7f);
-	}
-
 	/* power up phy */
 	dm_write_reg(dev, DM_GPR_CTRL, 1);
 	dm_write_reg(dev, DM_GPR_DATA, 0);
@@ -595,10 +581,6 @@ static const struct usb_device_id products[] = {
 	 USB_DEVICE(0x0a46, 0x9000),	/* DM9000E */
 	 .driver_info = (unsigned long)&dm9601_info,
 	 },
-	{
-	 USB_DEVICE(0x0a46, 0x9620),	/* DM9620 USB to Fast Ethernet Adapter */
-	 .driver_info = (unsigned long)&dm9601_info,
-	 },
 	{},			// END
 };
 
diff --git a/trunk/drivers/net/usb/qmi_wwan.c b/trunk/drivers/net/usb/qmi_wwan.c
index 575a5839ee34..6a1ca500e612 100644
--- a/trunk/drivers/net/usb/qmi_wwan.c
+++ b/trunk/drivers/net/usb/qmi_wwan.c
@@ -433,7 +433,6 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x19d2, 0x0199, 1)},	/* ZTE MF820S */
 	{QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
 	{QMI_FIXED_INTF(0x19d2, 0x0257, 3)},	/* ZTE MF821 */
-	{QMI_FIXED_INTF(0x19d2, 0x0265, 4)},	/* ONDA MT8205 4G LTE */
 	{QMI_FIXED_INTF(0x19d2, 0x0284, 4)},	/* ZTE MF880 */
 	{QMI_FIXED_INTF(0x19d2, 0x0326, 4)},	/* ZTE MF821D */
 	{QMI_FIXED_INTF(0x19d2, 0x1008, 4)},	/* ZTE (Vodafone) K3570-Z */
@@ -460,7 +459,6 @@ static const struct usb_device_id products[] = {
 	{QMI_FIXED_INTF(0x1199, 0x68a2, 19)},	/* Sierra Wireless MC7710 in QMI mode */
 	{QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
-	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
 
 	/* 4. Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
diff --git a/trunk/drivers/net/usb/usbnet.c b/trunk/drivers/net/usb/usbnet.c
index f34b2ebee815..3d4bf01641b4 100644
--- a/trunk/drivers/net/usb/usbnet.c
+++ b/trunk/drivers/net/usb/usbnet.c
@@ -1448,10 +1448,6 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 		if ((dev->driver_info->flags & FLAG_WWAN) != 0)
 			strcpy(net->name, "wwan%d");
 
-		/* devices that cannot do ARP */
-		if ((dev->driver_info->flags & FLAG_NOARP) != 0)
-			net->flags |= IFF_NOARP;
-
 		/* maybe the remote can't receive an Ethernet MTU */
 		if (net->mtu > (dev->hard_mtu - net->hard_header_len))
 			net->mtu = dev->hard_mtu - net->hard_header_len;
diff --git a/trunk/drivers/net/virtio_net.c b/trunk/drivers/net/virtio_net.c
index 35c00c5ea02a..a6fcf15adc4f 100644
--- a/trunk/drivers/net/virtio_net.c
+++ b/trunk/drivers/net/virtio_net.c
@@ -26,7 +26,6 @@
 #include <linux/scatterlist.h>
 #include <linux/if_vlan.h>
 #include <linux/slab.h>
-#include <linux/cpu.h>
 
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -124,12 +123,6 @@ struct virtnet_info {
 
 	/* Does the affinity hint is set for virtqueues? */
 	bool affinity_hint_set;
-
-	/* Per-cpu variable to show the mapping from CPU to virtqueue */
-	int __percpu *vq_index;
-
-	/* CPU hot plug notifier */
-	struct notifier_block nb;
 };
 
 struct skb_vnet_hdr {
@@ -1020,75 +1013,32 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 	return 0;
 }
 
-static void virtnet_clean_affinity(struct virtnet_info *vi, long hcpu)
+static void virtnet_set_affinity(struct virtnet_info *vi, bool set)
 {
 	int i;
-	int cpu;
-
-	if (vi->affinity_hint_set) {
-		for (i = 0; i < vi->max_queue_pairs; i++) {
-			virtqueue_set_affinity(vi->rq[i].vq, -1);
-			virtqueue_set_affinity(vi->sq[i].vq, -1);
-		}
-
-		vi->affinity_hint_set = false;
-	}
-
-	i = 0;
-	for_each_online_cpu(cpu) {
-		if (cpu == hcpu) {
-			*per_cpu_ptr(vi->vq_index, cpu) = -1;
-		} else {
-			*per_cpu_ptr(vi->vq_index, cpu) =
-				++i % vi->curr_queue_pairs;
-		}
-	}
-}
-
-static void virtnet_set_affinity(struct virtnet_info *vi)
-{
-	int i;
-	int cpu;
 
 	/* In multiqueue mode, when the number of cpu is equal to the number of
 	 * queue pairs, we let the queue pairs to be private to one cpu by
 	 * setting the affinity hint to eliminate the contention.
 	 */
-	if (vi->curr_queue_pairs == 1 ||
-	    vi->max_queue_pairs != num_online_cpus()) {
-		virtnet_clean_affinity(vi, -1);
-		return;
+	if ((vi->curr_queue_pairs == 1 ||
+	     vi->max_queue_pairs != num_online_cpus()) && set) {
+		if (vi->affinity_hint_set)
+			set = false;
+		else
+			return;
 	}
 
-	i = 0;
-	for_each_online_cpu(cpu) {
+	for (i = 0; i < vi->max_queue_pairs; i++) {
+		int cpu = set ? i : -1;
 		virtqueue_set_affinity(vi->rq[i].vq, cpu);
 		virtqueue_set_affinity(vi->sq[i].vq, cpu);
-		*per_cpu_ptr(vi->vq_index, cpu) = i;
-		i++;
 	}
 
-	vi->affinity_hint_set = true;
-}
-
-static int virtnet_cpu_callback(struct notifier_block *nfb,
-			        unsigned long action, void *hcpu)
-{
-	struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
-
-	switch(action & ~CPU_TASKS_FROZEN) {
-	case CPU_ONLINE:
-	case CPU_DOWN_FAILED:
-	case CPU_DEAD:
-		virtnet_set_affinity(vi);
-		break;
-	case CPU_DOWN_PREPARE:
-		virtnet_clean_affinity(vi, (long)hcpu);
-		break;
-	default:
-		break;
-	}
-	return NOTIFY_OK;
+	if (set)
+		vi->affinity_hint_set = true;
+	else
+		vi->affinity_hint_set = false;
 }
 
 static void virtnet_get_ringparam(struct net_device *dev,
@@ -1132,15 +1082,13 @@ static int virtnet_set_channels(struct net_device *dev,
 	if (queue_pairs > vi->max_queue_pairs)
 		return -EINVAL;
 
-	get_online_cpus();
 	err = virtnet_set_queues(vi, queue_pairs);
 	if (!err) {
 		netif_set_real_num_tx_queues(dev, queue_pairs);
 		netif_set_real_num_rx_queues(dev, queue_pairs);
 
-		virtnet_set_affinity(vi);
+		virtnet_set_affinity(vi, true);
 	}
-	put_online_cpus();
 
 	return err;
 }
@@ -1179,19 +1127,12 @@ static int virtnet_change_mtu(struct net_device *dev, int new_mtu)
 
 /* To avoid contending a lock hold by a vcpu who would exit to host, select the
  * txq based on the processor id.
+ * TODO: handle cpu hotplug.
  */
 static u16 virtnet_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
-	int txq;
-	struct virtnet_info *vi = netdev_priv(dev);
-
-	if (skb_rx_queue_recorded(skb)) {
-		txq = skb_get_rx_queue(skb);
-	} else {
-		txq = *__this_cpu_ptr(vi->vq_index);
-		if (txq == -1)
-			txq = 0;
-	}
+	int txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) :
+		  smp_processor_id();
 
 	while (unlikely(txq >= dev->real_num_tx_queues))
 		txq -= dev->real_num_tx_queues;
@@ -1307,7 +1248,7 @@ static void virtnet_del_vqs(struct virtnet_info *vi)
 {
 	struct virtio_device *vdev = vi->vdev;
 
-	virtnet_clean_affinity(vi, -1);
+	virtnet_set_affinity(vi, false);
 
 	vdev->config->del_vqs(vdev);
 
@@ -1430,10 +1371,7 @@ static int init_vqs(struct virtnet_info *vi)
 	if (ret)
 		goto err_free;
 
-	get_online_cpus();
-	virtnet_set_affinity(vi);
-	put_online_cpus();
-
+	virtnet_set_affinity(vi, true);
 	return 0;
 
 err_free:
@@ -1515,10 +1453,6 @@ static int virtnet_probe(struct virtio_device *vdev)
 	if (vi->stats == NULL)
 		goto free;
 
-	vi->vq_index = alloc_percpu(int);
-	if (vi->vq_index == NULL)
-		goto free_stats;
-
 	mutex_init(&vi->config_lock);
 	vi->config_enable = true;
 	INIT_WORK(&vi->config_work, virtnet_config_changed_work);
@@ -1542,7 +1476,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 	/* Allocate/initialize the rx/tx queues, and invoke find_vqs */
 	err = init_vqs(vi);
 	if (err)
-		goto free_index;
+		goto free_stats;
 
 	netif_set_real_num_tx_queues(dev, 1);
 	netif_set_real_num_rx_queues(dev, 1);
@@ -1565,13 +1499,6 @@ static int virtnet_probe(struct virtio_device *vdev)
 		}
 	}
 
-	vi->nb.notifier_call = &virtnet_cpu_callback;
-	err = register_hotcpu_notifier(&vi->nb);
-	if (err) {
-		pr_debug("virtio_net: registering cpu notifier failed\n");
-		goto free_recv_bufs;
-	}
-
 	/* Assume link up if device can't report link status,
 	   otherwise get link status from config. */
 	if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
@@ -1593,8 +1520,6 @@ static int virtnet_probe(struct virtio_device *vdev)
 free_vqs:
 	cancel_delayed_work_sync(&vi->refill);
 	virtnet_del_vqs(vi);
-free_index:
-	free_percpu(vi->vq_index);
 free_stats:
 	free_percpu(vi->stats);
 free:
@@ -1618,8 +1543,6 @@ static void virtnet_remove(struct virtio_device *vdev)
 {
 	struct virtnet_info *vi = vdev->priv;
 
-	unregister_hotcpu_notifier(&vi->nb);
-
 	/* Prevent config work handler from accessing the device. */
 	mutex_lock(&vi->config_lock);
 	vi->config_enable = false;
@@ -1631,7 +1554,6 @@ static void virtnet_remove(struct virtio_device *vdev)
 
 	flush_work(&vi->config_work);
 
-	free_percpu(vi->vq_index);
 	free_percpu(vi->stats);
 	free_netdev(vi->dev);
 }
diff --git a/trunk/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/trunk/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 56317b0fb6b6..8b0d8dcd7625 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -976,8 +976,6 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
 					  AR_PHY_CL_TAB_1,
 					  AR_PHY_CL_TAB_2 };
 
-	ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
-
 	if (rtt) {
 		if (!ar9003_hw_rtt_restore(ah, chan))
 			run_rtt_cal = true;
diff --git a/trunk/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/trunk/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 3afc24bde6d6..ce19c09fa8e8 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -586,19 +586,32 @@ static void ar9003_hw_init_bb(struct ath_hw *ah,
 	ath9k_hw_synth_delay(ah, chan, synthDelay);
 }
 
-void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+static void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
 {
-	if (ah->caps.tx_chainmask == 5 || ah->caps.rx_chainmask == 5)
+	switch (rx) {
+	case 0x5:
 		REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
 			    AR_PHY_SWAP_ALT_CHAIN);
-
-	REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
-	REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
+	case 0x3:
+	case 0x1:
+	case 0x2:
+	case 0x7:
+		REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
+		REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
+		break;
+	default:
+		break;
+	}
 
 	if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && (tx == 0x7))
-		tx = 3;
+		REG_WRITE(ah, AR_SELFGEN_MASK, 0x3);
+	else
+		REG_WRITE(ah, AR_SELFGEN_MASK, tx);
 
-	REG_WRITE(ah, AR_SELFGEN_MASK, tx);
+	if (tx == 0x5) {
+		REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
+			    AR_PHY_SWAP_ALT_CHAIN);
+	}
 }
 
 /*
diff --git a/trunk/drivers/net/wireless/ath/ath9k/ath9k.h b/trunk/drivers/net/wireless/ath/ath9k/ath9k.h
index 42794c546a40..86e26a19efda 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/trunk/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -317,6 +317,7 @@ struct ath_rx {
 	u32 *rxlink;
 	u32 num_pkts;
 	unsigned int rxfilter;
+	spinlock_t rxbuflock;
 	struct list_head rxbuf;
 	struct ath_descdma rxdma;
 	struct ath_buf *rx_bufptr;
@@ -327,6 +328,7 @@ struct ath_rx {
 
 int ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
+void ath_flushrecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
 int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
@@ -644,6 +646,7 @@ void ath_ant_comb_update(struct ath_softc *sc);
 enum sc_op_flags {
 	SC_OP_INVALID,
 	SC_OP_BEACONS,
+	SC_OP_RXFLUSH,
 	SC_OP_ANI_RUN,
 	SC_OP_PRIM_STA_VIF,
 	SC_OP_HW_RESET,
diff --git a/trunk/drivers/net/wireless/ath/ath9k/beacon.c b/trunk/drivers/net/wireless/ath/ath9k/beacon.c
index 2ca355e94da6..531fffd801a3 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/beacon.c
@@ -147,7 +147,6 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
 				 skb->len, DMA_TO_DEVICE);
 		dev_kfree_skb_any(skb);
 		bf->bf_buf_addr = 0;
-		bf->bf_mpdu = NULL;
 	}
 
 	skb = ieee80211_beacon_get(hw, vif);
@@ -360,6 +359,7 @@ void ath9k_beacon_tasklet(unsigned long data)
 		return;
 
 	bf = ath9k_beacon_generate(sc->hw, vif);
+	WARN_ON(!bf);
 
 	if (sc->beacon.bmisscnt != 0) {
 		ath_dbg(common, BSTUCK, "resume beacon xmit after %u misses\n",
diff --git a/trunk/drivers/net/wireless/ath/ath9k/debug.c b/trunk/drivers/net/wireless/ath/ath9k/debug.c
index e585fc827c50..13ff9edc2401 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/debug.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/debug.c
@@ -861,6 +861,7 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 	RXS_ERR("RX-LENGTH-ERR", rx_len_err);
 	RXS_ERR("RX-OOM-ERR", rx_oom_err);
 	RXS_ERR("RX-RATE-ERR", rx_rate_err);
+	RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
 	RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
 
 	PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
diff --git a/trunk/drivers/net/wireless/ath/ath9k/debug.h b/trunk/drivers/net/wireless/ath/ath9k/debug.h
index 6df2ab62dcb7..375c3b46411e 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/debug.h
+++ b/trunk/drivers/net/wireless/ath/ath9k/debug.h
@@ -216,6 +216,7 @@ struct ath_tx_stats {
  * @rx_oom_err:  No. of frames dropped due to OOM issues.
  * @rx_rate_err:  No. of frames dropped due to rate errors.
  * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
+ * @rx_drop_rxflush: No. of frames dropped due to RX-FLUSH.
  * @rx_beacons:  No. of beacons received.
  * @rx_frags:  No. of rx-fragements received.
  */
@@ -234,6 +235,7 @@ struct ath_rx_stats {
 	u32 rx_oom_err;
 	u32 rx_rate_err;
 	u32 rx_too_many_frags_err;
+	u32 rx_drop_rxflush;
 	u32 rx_beacons;
 	u32 rx_frags;
 };
diff --git a/trunk/drivers/net/wireless/ath/ath9k/htc_hst.c b/trunk/drivers/net/wireless/ath/ath9k/htc_hst.c
index aac4a406a513..4a9570dfba72 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -344,8 +344,6 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
 			endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
 						  skb, htc_hdr->endpoint_id,
 						  txok);
-		} else {
-			kfree_skb(skb);
 		}
 	}
 
diff --git a/trunk/drivers/net/wireless/ath/ath9k/hw.h b/trunk/drivers/net/wireless/ath/ath9k/hw.h
index 9d26fc56ca56..7f1a8e91c908 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/hw.h
+++ b/trunk/drivers/net/wireless/ath/ath9k/hw.h
@@ -1066,7 +1066,6 @@ void ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
 bool ar9003_is_paprd_enabled(struct ath_hw *ah);
-void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/trunk/drivers/net/wireless/ath/ath9k/main.c b/trunk/drivers/net/wireless/ath/ath9k/main.c
index dd91f8fdc01c..be30a9af1528 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/main.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/main.c
@@ -182,7 +182,7 @@ static void ath_restart_work(struct ath_softc *sc)
 	ath_start_ani(sc);
 }
 
-static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx)
+static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
 {
 	struct ath_hw *ah = sc->sc_ah;
 	bool ret = true;
@@ -202,6 +202,14 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx)
 	if (!ath_drain_all_txq(sc, retry_tx))
 		ret = false;
 
+	if (!flush) {
+		if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+			ath_rx_tasklet(sc, 1, true);
+		ath_rx_tasklet(sc, 1, false);
+	} else {
+		ath_flushrecv(sc);
+	}
+
 	return ret;
 }
 
@@ -254,11 +262,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 	struct ath_common *common = ath9k_hw_common(ah);
 	struct ath9k_hw_cal_data *caldata = NULL;
 	bool fastcc = true;
+	bool flush = false;
 	int r;
 
 	__ath_cancel_work(sc);
 
-	tasklet_disable(&sc->intr_tq);
 	spin_lock_bh(&sc->sc_pcu_lock);
 
 	if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
@@ -268,10 +276,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
 	if (!hchan) {
 		fastcc = false;
+		flush = true;
 		hchan = ah->curchan;
 	}
 
-	if (!ath_prepare_reset(sc, retry_tx))
+	if (!ath_prepare_reset(sc, retry_tx, flush))
 		fastcc = false;
 
 	ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
@@ -293,8 +302,6 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
 out:
 	spin_unlock_bh(&sc->sc_pcu_lock);
-	tasklet_enable(&sc->intr_tq);
-
 	return r;
 }
 
@@ -797,7 +804,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 		ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
 	}
 
-	ath_prepare_reset(sc, false);
+	ath_prepare_reset(sc, false, true);
 
 	if (sc->rx.frag) {
 		dev_kfree_skb_any(sc->rx.frag);
@@ -1826,9 +1833,6 @@ static u32 fill_chainmask(u32 cap, u32 new)
 
 static bool validate_antenna_mask(struct ath_hw *ah, u32 val)
 {
-	if (AR_SREV_9300_20_OR_LATER(ah))
-		return true;
-
 	switch (val & 0x7) {
 	case 0x1:
 	case 0x3:
diff --git a/trunk/drivers/net/wireless/ath/ath9k/recv.c b/trunk/drivers/net/wireless/ath/ath9k/recv.c
index 90752f246970..d4df98a938bf 100644
--- a/trunk/drivers/net/wireless/ath/ath9k/recv.c
+++ b/trunk/drivers/net/wireless/ath/ath9k/recv.c
@@ -254,6 +254,8 @@ static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
 
 static void ath_edma_start_recv(struct ath_softc *sc)
 {
+	spin_lock_bh(&sc->rx.rxbuflock);
+
 	ath9k_hw_rxena(sc->sc_ah);
 
 	ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP,
@@ -265,6 +267,8 @@ static void ath_edma_start_recv(struct ath_softc *sc)
 	ath_opmode_init(sc);
 
 	ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
+
+	spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -281,6 +285,8 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
 	int error = 0;
 
 	spin_lock_init(&sc->sc_pcu_lock);
+	spin_lock_init(&sc->rx.rxbuflock);
+	clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 
 	common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
 			     sc->sc_ah->caps.rx_status_len;
@@ -441,6 +447,7 @@ int ath_startrecv(struct ath_softc *sc)
 		return 0;
 	}
 
+	spin_lock_bh(&sc->rx.rxbuflock);
 	if (list_empty(&sc->rx.rxbuf))
 		goto start_recv;
 
@@ -461,14 +468,9 @@ int ath_startrecv(struct ath_softc *sc)
 	ath_opmode_init(sc);
 	ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
-	return 0;
-}
+	spin_unlock_bh(&sc->rx.rxbuflock);
 
-static void ath_flushrecv(struct ath_softc *sc)
-{
-	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-		ath_rx_tasklet(sc, 1, true);
-	ath_rx_tasklet(sc, 1, false);
+	return 0;
 }
 
 bool ath_stoprecv(struct ath_softc *sc)
@@ -476,16 +478,16 @@ bool ath_stoprecv(struct ath_softc *sc)
 	struct ath_hw *ah = sc->sc_ah;
 	bool stopped, reset = false;
 
+	spin_lock_bh(&sc->rx.rxbuflock);
 	ath9k_hw_abortpcurecv(ah);
 	ath9k_hw_setrxfilter(ah, 0);
 	stopped = ath9k_hw_stopdmarecv(ah, &reset);
 
-	ath_flushrecv(sc);
-
 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
 		ath_edma_stop_recv(sc);
 	else
 		sc->rx.rxlink = NULL;
+	spin_unlock_bh(&sc->rx.rxbuflock);
 
 	if (!(ah->ah_flags & AH_UNPLUGGED) &&
 	    unlikely(!stopped)) {
@@ -497,6 +499,15 @@ bool ath_stoprecv(struct ath_softc *sc)
 	return stopped && !reset;
 }
 
+void ath_flushrecv(struct ath_softc *sc)
+{
+	set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
+	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+		ath_rx_tasklet(sc, 1, true);
+	ath_rx_tasklet(sc, 1, false);
+	clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
+}
+
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 {
 	/* Check whether the Beacon frame has DTIM indicating buffered bc/mc */
@@ -733,7 +744,6 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
 			return NULL;
 	}
 
-	list_del(&bf->list);
 	if (!bf->bf_mpdu)
 		return bf;
 
@@ -1049,12 +1059,16 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 		dma_type = DMA_FROM_DEVICE;
 
 	qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
+	spin_lock_bh(&sc->rx.rxbuflock);
 
 	tsf = ath9k_hw_gettsf64(ah);
 	tsf_lower = tsf & 0xffffffff;
 
 	do {
 		bool decrypt_error = false;
+		/* If handling rx interrupt and flush is in progress => exit */
+		if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
+			break;
 
 		memset(&rs, 0, sizeof(rs));
 		if (edma)
@@ -1097,6 +1111,15 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 
 		ath_debug_stat_rx(sc, &rs);
 
+		/*
+		 * If we're asked to flush receive queue, directly
+		 * chain it back at the queue without processing it.
+		 */
+		if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
+			RX_STAT_INC(rx_drop_rxflush);
+			goto requeue_drop_frag;
+		}
+
 		memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 
 		rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
@@ -1231,18 +1254,19 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 			sc->rx.frag = NULL;
 		}
 requeue:
-		list_add_tail(&bf->list, &sc->rx.rxbuf);
-		if (flush)
-			continue;
-
 		if (edma) {
+			list_add_tail(&bf->list, &sc->rx.rxbuf);
 			ath_rx_edma_buf_link(sc, qtype);
 		} else {
+			list_move_tail(&bf->list, &sc->rx.rxbuf);
 			ath_rx_buf_link(sc, bf);
-			ath9k_hw_rxena(ah);
+			if (!flush)
+				ath9k_hw_rxena(ah);
 		}
 	} while (1);
 
+	spin_unlock_bh(&sc->rx.rxbuflock);
+
 	if (!(ah->imask & ATH9K_INT_RXEOL)) {
 		ah->imask |= (ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
 		ath9k_hw_set_interrupts(ah);
diff --git a/trunk/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/trunk/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 0f71d1d4339d..1fbd8ecbe2ea 100644
--- a/trunk/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/trunk/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1407,10 +1407,9 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
 #endif
 	t->ms = ms;
 	t->periodic = (bool) periodic;
-	if (!t->set) {
-		t->set = true;
-		atomic_inc(&t->wl->callbacks);
-	}
+	t->set = true;
+
+	atomic_inc(&t->wl->callbacks);
 
 	ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
 }
diff --git a/trunk/drivers/net/wireless/iwlegacy/common.c b/trunk/drivers/net/wireless/iwlegacy/common.c
index 90b8970eadf0..7e16d10a7f14 100644
--- a/trunk/drivers/net/wireless/iwlegacy/common.c
+++ b/trunk/drivers/net/wireless/iwlegacy/common.c
@@ -3958,21 +3958,17 @@ il_connection_init_rx_config(struct il_priv *il)
 
 	memset(&il->staging, 0, sizeof(il->staging));
 
-	switch (il->iw_mode) {
-	case NL80211_IFTYPE_UNSPECIFIED:
+	if (!il->vif) {
 		il->staging.dev_type = RXON_DEV_TYPE_ESS;
-		break;
-	case NL80211_IFTYPE_STATION:
+	} else if (il->vif->type == NL80211_IFTYPE_STATION) {
 		il->staging.dev_type = RXON_DEV_TYPE_ESS;
 		il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
-		break;
-	case NL80211_IFTYPE_ADHOC:
+	} else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
 		il->staging.dev_type = RXON_DEV_TYPE_IBSS;
 		il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
 		il->staging.filter_flags =
 		    RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
-		break;
-	default:
+	} else {
 		IL_ERR("Unsupported interface type %d\n", il->vif->type);
 		return;
 	}
@@ -4554,7 +4550,8 @@ il_mac_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 EXPORT_SYMBOL(il_mac_add_interface);
 
 static void
-il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
+il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
+		      bool mode_change)
 {
 	lockdep_assert_held(&il->mutex);
 
@@ -4563,7 +4560,9 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
 		il_force_scan_end(il);
 	}
 
-	il_set_mode(il);
+	if (!mode_change)
+		il_set_mode(il);
+
 }
 
 void
@@ -4576,8 +4575,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
 	WARN_ON(il->vif != vif);
 	il->vif = NULL;
-	il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
-	il_teardown_interface(il, vif);
+
+	il_teardown_interface(il, vif, false);
 	memset(il->bssid, 0, ETH_ALEN);
 
 	D_MAC80211("leave\n");
@@ -4686,10 +4685,18 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
 	}
 
 	/* success */
+	il_teardown_interface(il, vif, true);
 	vif->type = newtype;
 	vif->p2p = false;
-	il->iw_mode = newtype;
-	il_teardown_interface(il, vif);
+	err = il_set_mode(il);
+	WARN_ON(err);
+	/*
+	 * We've switched internally, but submitting to the
+	 * device may have failed for some reason. Mask this
+	 * error, because otherwise mac80211 will not switch
+	 * (and set the interface type back) and we'll be
+	 * out of sync with it.
+	 */
 	err = 0;
 
 out:
diff --git a/trunk/drivers/net/wireless/iwlwifi/dvm/tx.c b/trunk/drivers/net/wireless/iwlwifi/dvm/tx.c
index 31534f7c0548..a790599fe2c2 100644
--- a/trunk/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/trunk/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1079,8 +1079,6 @@ static void iwlagn_set_tx_status(struct iwl_priv *priv,
 {
 	u16 status = le16_to_cpu(tx_resp->status.status);
 
-	info->flags &= ~IEEE80211_TX_CTL_AMPDU;
-
 	info->status.rates[0].count = tx_resp->failure_frame + 1;
 	info->flags |= iwl_tx_status_to_mac80211(status);
 	iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
diff --git a/trunk/drivers/net/wireless/mwifiex/cfg80211.c b/trunk/drivers/net/wireless/mwifiex/cfg80211.c
index cdb11b3964e2..efe525be27dd 100644
--- a/trunk/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/trunk/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1459,7 +1459,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
 	struct cfg80211_ssid req_ssid;
 	int ret, auth_type = 0;
 	struct cfg80211_bss *bss = NULL;
-	u8 is_scanning_required = 0;
+	u8 is_scanning_required = 0, config_bands = 0;
 
 	memset(&req_ssid, 0, sizeof(struct cfg80211_ssid));
 
@@ -1478,6 +1478,19 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
 	/* disconnect before try to associate */
 	mwifiex_deauthenticate(priv, NULL);
 
+	if (channel) {
+		if (mode == NL80211_IFTYPE_STATION) {
+			if (channel->band == IEEE80211_BAND_2GHZ)
+				config_bands = BAND_B | BAND_G | BAND_GN;
+			else
+				config_bands = BAND_A | BAND_AN;
+
+			if (!((config_bands | priv->adapter->fw_bands) &
+			      ~priv->adapter->fw_bands))
+				priv->adapter->config_bands = config_bands;
+		}
+	}
+
 	/* As this is new association, clear locally stored
 	 * keys and security related flags */
 	priv->sec_info.wpa_enabled = false;
@@ -1694,7 +1707,7 @@ static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
 
 		if (cfg80211_get_chandef_type(&params->chandef) !=
 						NL80211_CHAN_NO_HT)
-			config_bands |= BAND_G | BAND_GN;
+			config_bands |= BAND_GN;
 	} else {
 		if (cfg80211_get_chandef_type(&params->chandef) ==
 						NL80211_CHAN_NO_HT)
diff --git a/trunk/drivers/net/wireless/mwifiex/pcie.c b/trunk/drivers/net/wireless/mwifiex/pcie.c
index b879e1338a54..13fbc4eb1595 100644
--- a/trunk/drivers/net/wireless/mwifiex/pcie.c
+++ b/trunk/drivers/net/wireless/mwifiex/pcie.c
@@ -161,7 +161,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 
 	if (pdev) {
 		card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-		if (!card || !card->adapter) {
+		if (!card || card->adapter) {
 			pr_err("Card or adapter structure is not valid\n");
 			return 0;
 		}
diff --git a/trunk/drivers/net/wireless/mwifiex/sta_ioctl.c b/trunk/drivers/net/wireless/mwifiex/sta_ioctl.c
index f542bb8ccbc8..60e88b58039d 100644
--- a/trunk/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/trunk/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -283,20 +283,6 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
 		if (ret)
 			goto done;
 
-		if (bss_desc) {
-			u8 config_bands = 0;
-
-			if (mwifiex_band_to_radio_type((u8) bss_desc->bss_band)
-			    == HostCmd_SCAN_RADIO_TYPE_BG)
-				config_bands = BAND_B | BAND_G | BAND_GN;
-			else
-				config_bands = BAND_A | BAND_AN;
-
-			if (!((config_bands | adapter->fw_bands) &
-			      ~adapter->fw_bands))
-				adapter->config_bands = config_bands;
-		}
-
 		ret = mwifiex_check_network_compatibility(priv, bss_desc);
 		if (ret)
 			goto done;
diff --git a/trunk/drivers/net/wireless/rtlwifi/Kconfig b/trunk/drivers/net/wireless/rtlwifi/Kconfig
index b80bc4612581..21b1bbb93a7e 100644
--- a/trunk/drivers/net/wireless/rtlwifi/Kconfig
+++ b/trunk/drivers/net/wireless/rtlwifi/Kconfig
@@ -57,12 +57,12 @@ config RTL8192CU
 
 config RTLWIFI
 	tristate
-	depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
+	depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
 	default m
 
 config RTLWIFI_DEBUG
 	bool "Additional debugging output"
-	depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
+	depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
 	default y
 
 config RTL8192C_COMMON
diff --git a/trunk/drivers/pinctrl/Kconfig b/trunk/drivers/pinctrl/Kconfig
index efaecefe3f8c..c31aeb01bb00 100644
--- a/trunk/drivers/pinctrl/Kconfig
+++ b/trunk/drivers/pinctrl/Kconfig
@@ -181,6 +181,7 @@ config PINCTRL_COH901
 
 config PINCTRL_SAMSUNG
 	bool
+	depends on OF && GPIOLIB
 	select PINMUX
 	select PINCONF
 
diff --git a/trunk/drivers/pinctrl/mvebu/pinctrl-dove.c b/trunk/drivers/pinctrl/mvebu/pinctrl-dove.c
index 428ea96a94d3..69aba3697287 100644
--- a/trunk/drivers/pinctrl/mvebu/pinctrl-dove.c
+++ b/trunk/drivers/pinctrl/mvebu/pinctrl-dove.c
@@ -588,7 +588,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
 {
 	const struct of_device_id *match =
 		of_match_device(dove_pinctrl_of_match, &pdev->dev);
-	pdev->dev.platform_data = (void *)match->data;
+	pdev->dev.platform_data = match->data;
 
 	/*
 	 * General MPP Configuration Register is part of pdma registers.
diff --git a/trunk/drivers/pinctrl/mvebu/pinctrl-kirkwood.c b/trunk/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
index cdd483df673e..f12084e18057 100644
--- a/trunk/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
+++ b/trunk/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
@@ -66,9 +66,9 @@ static struct mvebu_mpp_mode mv88f6xxx_mpp_modes[] = {
 		MPP_VAR_FUNCTION(0x5, "sata0", "act",    V(0, 1, 1, 1, 1, 0)),
 		MPP_VAR_FUNCTION(0xb, "lcd", "vsync",    V(0, 0, 0, 0, 1, 0))),
 	MPP_MODE(6,
-		MPP_VAR_FUNCTION(0x1, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
-		MPP_VAR_FUNCTION(0x2, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
-		MPP_VAR_FUNCTION(0x3, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
+		MPP_VAR_FUNCTION(0x0, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
+		MPP_VAR_FUNCTION(0x1, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
+		MPP_VAR_FUNCTION(0x2, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
 	MPP_MODE(7,
 		MPP_VAR_FUNCTION(0x0, "gpo", NULL,       V(1, 1, 1, 1, 1, 1)),
 		MPP_VAR_FUNCTION(0x1, "pex", "rsto",     V(1, 1, 1, 1, 0, 1)),
@@ -458,7 +458,7 @@ static int kirkwood_pinctrl_probe(struct platform_device *pdev)
 {
 	const struct of_device_id *match =
 		of_match_device(kirkwood_pinctrl_of_match, &pdev->dev);
-	pdev->dev.platform_data = (void *)match->data;
+	pdev->dev.platform_data = match->data;
 	return mvebu_pinctrl_probe(pdev);
 }
 
diff --git a/trunk/drivers/pinctrl/pinctrl-exynos5440.c b/trunk/drivers/pinctrl/pinctrl-exynos5440.c
index 142729914c34..de05b64f0da6 100644
--- a/trunk/drivers/pinctrl/pinctrl-exynos5440.c
+++ b/trunk/drivers/pinctrl/pinctrl-exynos5440.c
@@ -599,7 +599,7 @@ static int exynos5440_gpio_direction_output(struct gpio_chip *gc, unsigned offse
 }
 
 /* parse the pin numbers listed in the 'samsung,exynos5440-pins' property */
-static int exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
+static int __init exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
 			struct device_node *cfg_np, unsigned int **pin_list,
 			unsigned int *npins)
 {
@@ -630,7 +630,7 @@ static int exynos5440_pinctrl_parse_dt_pins(struct platform_device *pdev,
  * Parse the information about all the available pin groups and pin functions
  * from device node of the pin-controller.
  */
-static int exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
+static int __init exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
 				struct exynos5440_pinctrl_priv_data *priv)
 {
 	struct device *dev = &pdev->dev;
@@ -723,7 +723,7 @@ static int exynos5440_pinctrl_parse_dt(struct platform_device *pdev,
 }
 
 /* register the pinctrl interface with the pinctrl subsystem */
-static int exynos5440_pinctrl_register(struct platform_device *pdev,
+static int __init exynos5440_pinctrl_register(struct platform_device *pdev,
 				struct exynos5440_pinctrl_priv_data *priv)
 {
 	struct device *dev = &pdev->dev;
@@ -798,7 +798,7 @@ static int exynos5440_pinctrl_register(struct platform_device *pdev,
 }
 
 /* register the gpiolib interface with the gpiolib subsystem */
-static int exynos5440_gpiolib_register(struct platform_device *pdev,
+static int __init exynos5440_gpiolib_register(struct platform_device *pdev,
 				struct exynos5440_pinctrl_priv_data *priv)
 {
 	struct gpio_chip *gc;
@@ -831,7 +831,7 @@ static int exynos5440_gpiolib_register(struct platform_device *pdev,
 }
 
 /* unregister the gpiolib interface with the gpiolib subsystem */
-static int exynos5440_gpiolib_unregister(struct platform_device *pdev,
+static int __init exynos5440_gpiolib_unregister(struct platform_device *pdev,
 				struct exynos5440_pinctrl_priv_data *priv)
 {
 	int ret = gpiochip_remove(priv->gc);
diff --git a/trunk/drivers/pinctrl/pinctrl-mxs.c b/trunk/drivers/pinctrl/pinctrl-mxs.c
index 23af9f1f9c35..dd227d21dcf2 100644
--- a/trunk/drivers/pinctrl/pinctrl-mxs.c
+++ b/trunk/drivers/pinctrl/pinctrl-mxs.c
@@ -146,7 +146,7 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
 static void mxs_dt_free_map(struct pinctrl_dev *pctldev,
 			    struct pinctrl_map *map, unsigned num_maps)
 {
-	u32 i;
+	int i;
 
 	for (i = 0; i < num_maps; i++) {
 		if (map[i].type == PIN_MAP_TYPE_MUX_GROUP)
@@ -203,7 +203,7 @@ static int mxs_pinctrl_enable(struct pinctrl_dev *pctldev, unsigned selector,
 	void __iomem *reg;
 	u8 bank, shift;
 	u16 pin;
-	u32 i;
+	int i;
 
 	for (i = 0; i < g->npins; i++) {
 		bank = PINID_TO_BANK(g->pins[i]);
@@ -256,7 +256,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
 	void __iomem *reg;
 	u8 ma, vol, pull, bank, shift;
 	u16 pin;
-	u32 i;
+	int i;
 
 	ma = CONFIG_TO_MA(config);
 	vol = CONFIG_TO_VOL(config);
@@ -345,7 +345,8 @@ static int mxs_pinctrl_parse_group(struct platform_device *pdev,
 	const char *propname = "fsl,pinmux-ids";
 	char *group;
 	int length = strlen(np->name) + SUFFIX_LEN;
-	u32 val, i;
+	int i;
+	u32 val;
 
 	group = devm_kzalloc(&pdev->dev, length, GFP_KERNEL);
 	if (!group)
diff --git a/trunk/drivers/pinctrl/pinctrl-nomadik.c b/trunk/drivers/pinctrl/pinctrl-nomadik.c
index 5767b18ebdff..1bb16ffb4e41 100644
--- a/trunk/drivers/pinctrl/pinctrl-nomadik.c
+++ b/trunk/drivers/pinctrl/pinctrl-nomadik.c
@@ -676,7 +676,7 @@ int nmk_gpio_set_mode(int gpio, int gpio_mode)
 }
 EXPORT_SYMBOL(nmk_gpio_set_mode);
 
-static int __maybe_unused nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
+static int nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
 {
 	int i;
 	u16 reg;
diff --git a/trunk/drivers/pinctrl/pinctrl-single.c b/trunk/drivers/pinctrl/pinctrl-single.c
index 5c32e880bcb2..f6a360b86eb6 100644
--- a/trunk/drivers/pinctrl/pinctrl-single.c
+++ b/trunk/drivers/pinctrl/pinctrl-single.c
@@ -30,6 +30,7 @@
 #define PCS_MUX_BITS_NAME		"pinctrl-single,bits"
 #define PCS_REG_NAME_LEN		((sizeof(unsigned long) * 2) + 1)
 #define PCS_OFF_DISABLED		~0U
+#define PCS_MAX_GPIO_VALUES		2
 
 /**
  * struct pcs_pingroup - pingroups for a function
@@ -76,6 +77,16 @@ struct pcs_function {
 	struct list_head node;
 };
 
+/**
+ * struct pcs_gpio_range - pinctrl gpio range
+ * @range:	subrange of the GPIO number space
+ * @gpio_func:	gpio function value in the pinmux register
+ */
+struct pcs_gpio_range {
+	struct pinctrl_gpio_range range;
+	int gpio_func;
+};
+
 /**
  * struct pcs_data - wrapper for data needed by pinctrl framework
  * @pa:		pindesc array
@@ -403,9 +414,26 @@ static void pcs_disable(struct pinctrl_dev *pctldev, unsigned fselector,
 }
 
 static int pcs_request_gpio(struct pinctrl_dev *pctldev,
-			struct pinctrl_gpio_range *range, unsigned offset)
+			    struct pinctrl_gpio_range *range, unsigned pin)
 {
-	return -ENOTSUPP;
+	struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
+	struct pcs_gpio_range *gpio = NULL;
+	int end, mux_bytes;
+	unsigned data;
+
+	gpio = container_of(range, struct pcs_gpio_range, range);
+	end = range->pin_base + range->npins - 1;
+	if (pin < range->pin_base || pin > end) {
+		dev_err(pctldev->dev,
+			"pin %d isn't in the range of %d to %d\n",
+			pin, range->pin_base, end);
+		return -EINVAL;
+	}
+	mux_bytes = pcs->width / BITS_PER_BYTE;
+	data = pcs->read(pcs->base + pin * mux_bytes) & ~pcs->fmask;
+	data |= gpio->gpio_func;
+	pcs->write(data, pcs->base + pin * mux_bytes);
+	return 0;
 }
 
 static struct pinmux_ops pcs_pinmux_ops = {
@@ -879,6 +907,49 @@ static void pcs_free_resources(struct pcs_device *pcs)
 
 static struct of_device_id pcs_of_match[];
 
+static int pcs_add_gpio_range(struct device_node *node, struct pcs_device *pcs)
+{
+	struct pcs_gpio_range *gpio;
+	struct device_node *child;
+	struct resource r;
+	const char name[] = "pinctrl-single";
+	u32 gpiores[PCS_MAX_GPIO_VALUES];
+	int ret, i = 0, mux_bytes = 0;
+
+	for_each_child_of_node(node, child) {
+		ret = of_address_to_resource(child, 0, &r);
+		if (ret < 0)
+			continue;
+		memset(gpiores, 0, sizeof(u32) * PCS_MAX_GPIO_VALUES);
+		ret = of_property_read_u32_array(child, "pinctrl-single,gpio",
+						 gpiores, PCS_MAX_GPIO_VALUES);
+		if (ret < 0)
+			continue;
+		gpio = devm_kzalloc(pcs->dev, sizeof(*gpio), GFP_KERNEL);
+		if (!gpio) {
+			dev_err(pcs->dev, "failed to allocate pcs gpio\n");
+			return -ENOMEM;
+		}
+		gpio->range.name = devm_kzalloc(pcs->dev, sizeof(name),
+						GFP_KERNEL);
+		if (!gpio->range.name) {
+			dev_err(pcs->dev, "failed to allocate range name\n");
+			return -ENOMEM;
+		}
+		memcpy((char *)gpio->range.name, name, sizeof(name));
+
+		gpio->range.id = i++;
+		gpio->range.base = gpiores[0];
+		gpio->gpio_func = gpiores[1];
+		mux_bytes = pcs->width / BITS_PER_BYTE;
+		gpio->range.pin_base = (r.start - pcs->res->start) / mux_bytes;
+		gpio->range.npins = (r.end - r.start) / mux_bytes + 1;
+
+		pinctrl_add_gpio_range(pcs->pctl, &gpio->range);
+	}
+	return 0;
+}
+
 static int pcs_probe(struct platform_device *pdev)
 {
 	struct device_node *np = pdev->dev.of_node;
@@ -975,6 +1046,10 @@ static int pcs_probe(struct platform_device *pdev)
 		goto free;
 	}
 
+	ret = pcs_add_gpio_range(np, pcs);
+	if (ret < 0)
+		goto free;
+
 	dev_info(pcs->dev, "%i pins at pa %p size %u\n",
 		 pcs->desc.npins, pcs->base, pcs->size);
 
diff --git a/trunk/drivers/platform/x86/ibm_rtl.c b/trunk/drivers/platform/x86/ibm_rtl.c
index 97c2be195efc..7481146a5b47 100644
--- a/trunk/drivers/platform/x86/ibm_rtl.c
+++ b/trunk/drivers/platform/x86/ibm_rtl.c
@@ -244,7 +244,7 @@ static int __init ibm_rtl_init(void) {
 	if (force)
 		pr_warn("module loaded by force\n");
 	/* first ensure that we are running on IBM HW */
-	else if (efi_enabled(EFI_BOOT) || !dmi_check_system(ibm_rtl_dmi_table))
+	else if (efi_enabled || !dmi_check_system(ibm_rtl_dmi_table))
 		return -ENODEV;
 
 	/* Get the address for the Extended BIOS Data Area */
diff --git a/trunk/drivers/platform/x86/samsung-laptop.c b/trunk/drivers/platform/x86/samsung-laptop.c
index d1f030053176..71623a2ff3e8 100644
--- a/trunk/drivers/platform/x86/samsung-laptop.c
+++ b/trunk/drivers/platform/x86/samsung-laptop.c
@@ -26,7 +26,6 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
-#include <linux/efi.h>
 #include <acpi/video.h>
 
 /*
@@ -1545,9 +1544,6 @@ static int __init samsung_init(void)
 	struct samsung_laptop *samsung;
 	int ret;
 
-	if (efi_enabled(EFI_BOOT))
-		return -ENODEV;
-
 	quirks = &samsung_unknown;
 	if (!force && !dmi_check_system(samsung_dmi_table))
 		return -ENODEV;
diff --git a/trunk/drivers/regulator/dbx500-prcmu.c b/trunk/drivers/regulator/dbx500-prcmu.c
index 89bd2faaef8c..261f3d2299bc 100644
--- a/trunk/drivers/regulator/dbx500-prcmu.c
+++ b/trunk/drivers/regulator/dbx500-prcmu.c
@@ -14,7 +14,6 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
-#include <linux/module.h>
 
 #include "dbx500-prcmu.h"
 
diff --git a/trunk/drivers/regulator/max77686.c b/trunk/drivers/regulator/max77686.c
index cca18a3c0294..b85040caaea3 100644
--- a/trunk/drivers/regulator/max77686.c
+++ b/trunk/drivers/regulator/max77686.c
@@ -379,10 +379,9 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
+static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
 					struct max77686_platform_data *pdata)
 {
-	struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
 	struct device_node *pmic_np, *regulators_np;
 	struct max77686_regulator_data *rdata;
 	struct of_regulator_match rmatch;
@@ -391,15 +390,15 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
 	pmic_np = iodev->dev->of_node;
 	regulators_np = of_find_node_by_name(pmic_np, "voltage-regulators");
 	if (!regulators_np) {
-		dev_err(&pdev->dev, "could not find regulators sub-node\n");
+		dev_err(iodev->dev, "could not find regulators sub-node\n");
 		return -EINVAL;
 	}
 
 	pdata->num_regulators = ARRAY_SIZE(regulators);
-	rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
+	rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
 			     pdata->num_regulators, GFP_KERNEL);
 	if (!rdata) {
-		dev_err(&pdev->dev,
+		dev_err(iodev->dev,
 			"could not allocate memory for regulator data\n");
 		return -ENOMEM;
 	}
@@ -408,7 +407,7 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
 		rmatch.name = regulators[i].name;
 		rmatch.init_data = NULL;
 		rmatch.of_node = NULL;
-		of_regulator_match(&pdev->dev, regulators_np, &rmatch, 1);
+		of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
 		rdata[i].initdata = rmatch.init_data;
 		rdata[i].of_node = rmatch.of_node;
 	}
@@ -418,7 +417,7 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
 	return 0;
 }
 #else
-static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
+static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
 					struct max77686_platform_data *pdata)
 {
 	return 0;
@@ -441,7 +440,7 @@ static int max77686_pmic_probe(struct platform_device *pdev)
 	}
 
 	if (iodev->dev->of_node) {
-		ret = max77686_pmic_dt_parse_pdata(pdev, pdata);
+		ret = max77686_pmic_dt_parse_pdata(iodev, pdata);
 		if (ret)
 			return ret;
 	}
diff --git a/trunk/drivers/regulator/max8907-regulator.c b/trunk/drivers/regulator/max8907-regulator.c
index d40cf7fdb546..d1a77512d83e 100644
--- a/trunk/drivers/regulator/max8907-regulator.c
+++ b/trunk/drivers/regulator/max8907-regulator.c
@@ -237,7 +237,8 @@ static int max8907_regulator_parse_dt(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
-	ret = of_regulator_match(&pdev->dev, regulators, max8907_matches,
+	ret = of_regulator_match(pdev->dev.parent, regulators,
+				 max8907_matches,
 				 ARRAY_SIZE(max8907_matches));
 	if (ret < 0) {
 		dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
diff --git a/trunk/drivers/regulator/max8997.c b/trunk/drivers/regulator/max8997.c
index 836908ce505e..02be7fcae32f 100644
--- a/trunk/drivers/regulator/max8997.c
+++ b/trunk/drivers/regulator/max8997.c
@@ -934,7 +934,7 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
+static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
 			struct max8997_platform_data *pdata,
 			struct device_node *pmic_np)
 {
@@ -944,7 +944,7 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
 		gpio = of_get_named_gpio(pmic_np,
 					"max8997,pmic-buck125-dvs-gpios", i);
 		if (!gpio_is_valid(gpio)) {
-			dev_err(&pdev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+			dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
 			return -EINVAL;
 		}
 		pdata->buck125_gpios[i] = gpio;
@@ -952,23 +952,22 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
 	return 0;
 }
 
-static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
+static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
 					struct max8997_platform_data *pdata)
 {
-	struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent);
 	struct device_node *pmic_np, *regulators_np, *reg_np;
 	struct max8997_regulator_data *rdata;
 	unsigned int i, dvs_voltage_nr = 1, ret;
 
 	pmic_np = iodev->dev->of_node;
 	if (!pmic_np) {
-		dev_err(&pdev->dev, "could not find pmic sub-node\n");
+		dev_err(iodev->dev, "could not find pmic sub-node\n");
 		return -ENODEV;
 	}
 
 	regulators_np = of_find_node_by_name(pmic_np, "regulators");
 	if (!regulators_np) {
-		dev_err(&pdev->dev, "could not find regulators sub-node\n");
+		dev_err(iodev->dev, "could not find regulators sub-node\n");
 		return -EINVAL;
 	}
 
@@ -977,10 +976,11 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
 	for_each_child_of_node(regulators_np, reg_np)
 		pdata->num_regulators++;
 
-	rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
+	rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
 				pdata->num_regulators, GFP_KERNEL);
 	if (!rdata) {
-		dev_err(&pdev->dev, "could not allocate memory for regulator data\n");
+		dev_err(iodev->dev, "could not allocate memory for "
+						"regulator data\n");
 		return -ENOMEM;
 	}
 
@@ -991,14 +991,14 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
 				break;
 
 		if (i == ARRAY_SIZE(regulators)) {
-			dev_warn(&pdev->dev, "don't know how to configure regulator %s\n",
-				 reg_np->name);
+			dev_warn(iodev->dev, "don't know how to configure "
+				"regulator %s\n", reg_np->name);
 			continue;
 		}
 
 		rdata->id = i;
-		rdata->initdata = of_get_regulator_init_data(&pdev->dev,
-							     reg_np);
+		rdata->initdata = of_get_regulator_init_data(
+						iodev->dev, reg_np);
 		rdata->reg_node = reg_np;
 		rdata++;
 	}
@@ -1014,7 +1014,7 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
 
 	if (pdata->buck1_gpiodvs || pdata->buck2_gpiodvs ||
 						pdata->buck5_gpiodvs) {
-		ret = max8997_pmic_dt_parse_dvs_gpio(pdev, pdata, pmic_np);
+		ret = max8997_pmic_dt_parse_dvs_gpio(iodev, pdata, pmic_np);
 		if (ret)
 			return -EINVAL;
 
@@ -1025,7 +1025,8 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
 		} else {
 			if (pdata->buck125_default_idx >= 8) {
 				pdata->buck125_default_idx = 0;
-				dev_info(&pdev->dev, "invalid value for default dvs index, using 0 instead\n");
+				dev_info(iodev->dev, "invalid value for "
+				"default dvs index, using 0 instead\n");
 			}
 		}
 
@@ -1039,28 +1040,28 @@ static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
 	if (of_property_read_u32_array(pmic_np,
 				"max8997,pmic-buck1-dvs-voltage",
 				pdata->buck1_voltage, dvs_voltage_nr)) {
-		dev_err(&pdev->dev, "buck1 voltages not specified\n");
+		dev_err(iodev->dev, "buck1 voltages not specified\n");
 		return -EINVAL;
 	}
 
 	if (of_property_read_u32_array(pmic_np,
 				"max8997,pmic-buck2-dvs-voltage",
 				pdata->buck2_voltage, dvs_voltage_nr)) {
-		dev_err(&pdev->dev, "buck2 voltages not specified\n");
+		dev_err(iodev->dev, "buck2 voltages not specified\n");
 		return -EINVAL;
 	}
 
 	if (of_property_read_u32_array(pmic_np,
 				"max8997,pmic-buck5-dvs-voltage",
 				pdata->buck5_voltage, dvs_voltage_nr)) {
-		dev_err(&pdev->dev, "buck5 voltages not specified\n");
+		dev_err(iodev->dev, "buck5 voltages not specified\n");
 		return -EINVAL;
 	}
 
 	return 0;
 }
 #else
-static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
+static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
 					struct max8997_platform_data *pdata)
 {
 	return 0;
@@ -1084,7 +1085,7 @@ static int max8997_pmic_probe(struct platform_device *pdev)
 	}
 
 	if (iodev->dev->of_node) {
-		ret = max8997_pmic_dt_parse_pdata(pdev, pdata);
+		ret = max8997_pmic_dt_parse_pdata(iodev, pdata);
 		if (ret)
 			return ret;
 	}
diff --git a/trunk/drivers/regulator/max8998.c b/trunk/drivers/regulator/max8998.c
index 1f0df4046b86..0a8dd1cbee6f 100644
--- a/trunk/drivers/regulator/max8998.c
+++ b/trunk/drivers/regulator/max8998.c
@@ -65,7 +65,7 @@ static const struct voltage_map_desc ldo9_voltage_map_desc = {
 	.min = 2800000,	.step = 100000,	.max = 3100000,
 };
 static const struct voltage_map_desc ldo10_voltage_map_desc = {
-	.min = 95000,	.step = 50000,	.max = 1300000,
+	.min = 950000,	.step = 50000,	.max = 1300000,
 };
 static const struct voltage_map_desc ldo1213_voltage_map_desc = {
 	.min = 800000,	.step = 100000,	.max = 3300000,
diff --git a/trunk/drivers/regulator/tps80031-regulator.c b/trunk/drivers/regulator/tps80031-regulator.c
index 9019d0e7ecb6..b15d711bc8c6 100644
--- a/trunk/drivers/regulator/tps80031-regulator.c
+++ b/trunk/drivers/regulator/tps80031-regulator.c
@@ -728,7 +728,7 @@ static int tps80031_regulator_probe(struct platform_device *pdev)
 			}
 		}
 		rdev = regulator_register(&ri->rinfo->desc, &config);
-		if (IS_ERR(rdev)) {
+		if (IS_ERR_OR_NULL(rdev)) {
 			dev_err(&pdev->dev,
 				"register regulator failed %s\n",
 					ri->rinfo->desc.name);
diff --git a/trunk/drivers/scsi/isci/init.c b/trunk/drivers/scsi/isci/init.c
index 2839baa82a5a..d73fdcfeb45a 100644
--- a/trunk/drivers/scsi/isci/init.c
+++ b/trunk/drivers/scsi/isci/init.c
@@ -633,7 +633,7 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		return -ENOMEM;
 	pci_set_drvdata(pdev, pci_info);
 
-	if (efi_enabled(EFI_RUNTIME_SERVICES))
+	if (efi_enabled)
 		orom = isci_get_efi_var(pdev);
 
 	if (!orom)
diff --git a/trunk/fs/gfs2/lock_dlm.c b/trunk/fs/gfs2/lock_dlm.c
index 9802de0f85e6..b906ed17a839 100644
--- a/trunk/fs/gfs2/lock_dlm.c
+++ b/trunk/fs/gfs2/lock_dlm.c
@@ -281,7 +281,6 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 {
 	struct gfs2_sbd *sdp = gl->gl_sbd;
 	struct lm_lockstruct *ls = &sdp->sd_lockstruct;
-	int lvb_needs_unlock = 0;
 	int error;
 
 	if (gl->gl_lksb.sb_lkid == 0) {
@@ -295,12 +294,8 @@ static void gdlm_put_lock(struct gfs2_glock *gl)
 	gfs2_update_request_times(gl);
 
 	/* don't want to skip dlm_unlock writing the lvb when lock is ex */
-
-	if (gl->gl_lksb.sb_lvbptr && (gl->gl_state == LM_ST_EXCLUSIVE))
-		lvb_needs_unlock = 1;
-
 	if (test_bit(SDF_SKIP_DLM_UNLOCK, &sdp->sd_flags) &&
-	    !lvb_needs_unlock) {
+	    gl->gl_lksb.sb_lvbptr && (gl->gl_state != LM_ST_EXCLUSIVE)) {
 		gfs2_glock_free(gl);
 		return;
 	}
diff --git a/trunk/fs/nfs/namespace.c b/trunk/fs/nfs/namespace.c
index fc8dc20fdeb9..dd057bc6b65b 100644
--- a/trunk/fs/nfs/namespace.c
+++ b/trunk/fs/nfs/namespace.c
@@ -177,31 +177,11 @@ struct vfsmount *nfs_d_automount(struct path *path)
 	return mnt;
 }
 
-static int
-nfs_namespace_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
-{
-	if (NFS_FH(dentry->d_inode)->size != 0)
-		return nfs_getattr(mnt, dentry, stat);
-	generic_fillattr(dentry->d_inode, stat);
-	return 0;
-}
-
-static int
-nfs_namespace_setattr(struct dentry *dentry, struct iattr *attr)
-{
-	if (NFS_FH(dentry->d_inode)->size != 0)
-		return nfs_setattr(dentry, attr);
-	return -EACCES;
-}
-
 const struct inode_operations nfs_mountpoint_inode_operations = {
 	.getattr	= nfs_getattr,
-	.setattr	= nfs_setattr,
 };
 
 const struct inode_operations nfs_referral_inode_operations = {
-	.getattr	= nfs_namespace_getattr,
-	.setattr	= nfs_namespace_setattr,
 };
 
 static void nfs_expire_automounts(struct work_struct *work)
diff --git a/trunk/fs/nfs/nfs4client.c b/trunk/fs/nfs/nfs4client.c
index 2e9779b58b7a..acc347268124 100644
--- a/trunk/fs/nfs/nfs4client.c
+++ b/trunk/fs/nfs/nfs4client.c
@@ -236,10 +236,11 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp,
 	error = nfs4_discover_server_trunking(clp, &old);
 	if (error < 0)
 		goto error;
-	nfs_put_client(clp);
 	if (clp != old) {
 		clp->cl_preserve_clid = true;
+		nfs_put_client(clp);
 		clp = old;
+		atomic_inc(&clp->cl_count);
 	}
 
 	return clp;
@@ -305,7 +306,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
 		.clientid	= new->cl_clientid,
 		.confirm	= new->cl_confirm,
 	};
-	int status = -NFS4ERR_STALE_CLIENTID;
+	int status;
 
 	spin_lock(&nn->nfs_client_lock);
 	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
@@ -331,33 +332,40 @@ int nfs40_walk_client_list(struct nfs_client *new,
 
 		if (prev)
 			nfs_put_client(prev);
-		prev = pos;
 
 		status = nfs4_proc_setclientid_confirm(pos, &clid, cred);
-		switch (status) {
-		case -NFS4ERR_STALE_CLIENTID:
-			break;
-		case 0:
+		if (status == 0) {
 			nfs4_swap_callback_idents(pos, new);
 
-			prev = NULL;
+			nfs_put_client(pos);
 			*result = pos;
 			dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
 				__func__, pos, atomic_read(&pos->cl_count));
-		default:
-			goto out;
+			return 0;
+		}
+		if (status != -NFS4ERR_STALE_CLIENTID) {
+			nfs_put_client(pos);
+			dprintk("NFS: <-- %s status = %d, no result\n",
+				__func__, status);
+			return status;
 		}
 
 		spin_lock(&nn->nfs_client_lock);
+		prev = pos;
 	}
-	spin_unlock(&nn->nfs_client_lock);
 
-	/* No match found. The server lost our clientid */
-out:
+	/*
+	 * No matching nfs_client found.  This should be impossible,
+	 * because the new nfs_client has already been added to
+	 * nfs_client_list by nfs_get_client().
+	 *
+	 * Don't BUG(), since the caller is holding a mutex.
+	 */
 	if (prev)
 		nfs_put_client(prev);
-	dprintk("NFS: <-- %s status = %d\n", __func__, status);
-	return status;
+	spin_unlock(&nn->nfs_client_lock);
+	pr_err("NFS: %s Error: no matching nfs_client found\n", __func__);
+	return -NFS4ERR_STALE_CLIENTID;
 }
 
 #ifdef CONFIG_NFS_V4_1
@@ -424,7 +432,7 @@ int nfs41_walk_client_list(struct nfs_client *new,
 {
 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
 	struct nfs_client *pos, *n, *prev = NULL;
-	int status = -NFS4ERR_STALE_CLIENTID;
+	int error;
 
 	spin_lock(&nn->nfs_client_lock);
 	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
@@ -440,17 +448,14 @@ int nfs41_walk_client_list(struct nfs_client *new,
 				nfs_put_client(prev);
 			prev = pos;
 
-			nfs4_schedule_lease_recovery(pos);
-			status = nfs_wait_client_init_complete(pos);
-			if (status < 0) {
+			error = nfs_wait_client_init_complete(pos);
+			if (error < 0) {
 				nfs_put_client(pos);
 				spin_lock(&nn->nfs_client_lock);
 				continue;
 			}
-			status = pos->cl_cons_state;
+
 			spin_lock(&nn->nfs_client_lock);
-			if (status < 0)
-				continue;
 		}
 
 		if (pos->rpc_ops != new->rpc_ops)
@@ -468,7 +473,6 @@ int nfs41_walk_client_list(struct nfs_client *new,
 		if (!nfs4_match_serverowners(pos, new))
 			continue;
 
-		atomic_inc(&pos->cl_count);
 		spin_unlock(&nn->nfs_client_lock);
 		dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
 			__func__, pos, atomic_read(&pos->cl_count));
@@ -477,10 +481,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
 		return 0;
 	}
 
-	/* No matching nfs_client found. */
+	/*
+	 * No matching nfs_client found.  This should be impossible,
+	 * because the new nfs_client has already been added to
+	 * nfs_client_list by nfs_get_client().
+	 *
+	 * Don't BUG(), since the caller is holding a mutex.
+	 */
 	spin_unlock(&nn->nfs_client_lock);
-	dprintk("NFS: <-- %s status = %d\n", __func__, status);
-	return status;
+	pr_err("NFS: %s Error: no matching nfs_client found\n", __func__);
+	return -NFS4ERR_STALE_CLIENTID;
 }
 #endif	/* CONFIG_NFS_V4_1 */
 
diff --git a/trunk/fs/nfs/nfs4state.c b/trunk/fs/nfs/nfs4state.c
index e61f68d5ef21..9448c579d41a 100644
--- a/trunk/fs/nfs/nfs4state.c
+++ b/trunk/fs/nfs/nfs4state.c
@@ -136,11 +136,16 @@ int nfs40_discover_server_trunking(struct nfs_client *clp,
 	clp->cl_confirm = clid.confirm;
 
 	status = nfs40_walk_client_list(clp, result, cred);
-	if (status == 0) {
+	switch (status) {
+	case -NFS4ERR_STALE_CLIENTID:
+		set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+	case 0:
 		/* Sustain the lease, even if it's empty.  If the clientid4
 		 * goes stale it's of no use for trunking discovery. */
 		nfs4_schedule_state_renewal(*result);
+		break;
 	}
+
 out:
 	return status;
 }
@@ -1858,7 +1863,6 @@ int nfs4_discover_server_trunking(struct nfs_client *clp,
 	case -ETIMEDOUT:
 	case -EAGAIN:
 		ssleep(1);
-	case -NFS4ERR_STALE_CLIENTID:
 		dprintk("NFS: %s after status %d, retrying\n",
 			__func__, status);
 		goto again;
@@ -2018,18 +2022,8 @@ static int nfs4_reset_session(struct nfs_client *clp)
 	nfs4_begin_drain_session(clp);
 	cred = nfs4_get_exchange_id_cred(clp);
 	status = nfs4_proc_destroy_session(clp->cl_session, cred);
-	switch (status) {
-	case 0:
-	case -NFS4ERR_BADSESSION:
-	case -NFS4ERR_DEADSESSION:
-		break;
-	case -NFS4ERR_BACK_CHAN_BUSY:
-	case -NFS4ERR_DELAY:
-		set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
-		status = 0;
-		ssleep(1);
-		goto out;
-	default:
+	if (status && status != -NFS4ERR_BADSESSION &&
+	    status != -NFS4ERR_DEADSESSION) {
 		status = nfs4_recovery_handle_error(clp, status);
 		goto out;
 	}
diff --git a/trunk/fs/nfs/super.c b/trunk/fs/nfs/super.c
index b056b1628722..2e7e8c878e5d 100644
--- a/trunk/fs/nfs/super.c
+++ b/trunk/fs/nfs/super.c
@@ -2589,23 +2589,27 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
 	struct nfs_server *server;
 	struct dentry *mntroot = ERR_PTR(-ENOMEM);
 	struct nfs_subversion *nfs_mod = NFS_SB(data->sb)->nfs_client->cl_nfs_mod;
+	int error;
 
-	dprintk("--> nfs_xdev_mount()\n");
+	dprintk("--> nfs_xdev_mount_common()\n");
 
 	mount_info.mntfh = mount_info.cloned->fh;
 
 	/* create a new volume representation */
 	server = nfs_mod->rpc_ops->clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
+	if (IS_ERR(server)) {
+		error = PTR_ERR(server);
+		goto out_err;
+	}
 
-	if (IS_ERR(server))
-		mntroot = ERR_CAST(server);
-	else
-		mntroot = nfs_fs_mount_common(server, flags,
-				dev_name, &mount_info, nfs_mod);
-
-	dprintk("<-- nfs_xdev_mount() = %ld\n",
-			IS_ERR(mntroot) ? PTR_ERR(mntroot) : 0L);
+	mntroot = nfs_fs_mount_common(server, flags, dev_name, &mount_info, nfs_mod);
+	dprintk("<-- nfs_xdev_mount_common() = 0\n");
+out:
 	return mntroot;
+
+out_err:
+	dprintk("<-- nfs_xdev_mount_common() = %d [error]\n", error);
+	goto out;
 }
 
 #if IS_ENABLED(CONFIG_NFS_V4)
diff --git a/trunk/fs/xfs/xfs_aops.c b/trunk/fs/xfs/xfs_aops.c
index 5f707e537171..4111a40ebe1a 100644
--- a/trunk/fs/xfs/xfs_aops.c
+++ b/trunk/fs/xfs/xfs_aops.c
@@ -86,11 +86,11 @@ xfs_destroy_ioend(
 	}
 
 	if (ioend->io_iocb) {
-		inode_dio_done(ioend->io_inode);
 		if (ioend->io_isasync) {
 			aio_complete(ioend->io_iocb, ioend->io_error ?
 					ioend->io_error : ioend->io_result, 0);
 		}
+		inode_dio_done(ioend->io_inode);
 	}
 
 	mempool_free(ioend, xfs_ioend_pool);
diff --git a/trunk/fs/xfs/xfs_bmap.c b/trunk/fs/xfs/xfs_bmap.c
index cdb2d3348583..0e92d12765d2 100644
--- a/trunk/fs/xfs/xfs_bmap.c
+++ b/trunk/fs/xfs/xfs_bmap.c
@@ -4680,6 +4680,9 @@ __xfs_bmapi_allocate(
 			return error;
 	}
 
+	if (bma->flags & XFS_BMAPI_STACK_SWITCH)
+		bma->stack_switch = 1;
+
 	error = xfs_bmap_alloc(bma);
 	if (error)
 		return error;
@@ -4953,9 +4956,6 @@ xfs_bmapi_write(
 	bma.flist = flist;
 	bma.firstblock = firstblock;
 
-	if (flags & XFS_BMAPI_STACK_SWITCH)
-		bma.stack_switch = 1;
-
 	while (bno < end && n < *nmap) {
 		inhole = eof || bma.got.br_startoff > bno;
 		wasdelay = !inhole && isnullstartblock(bma.got.br_startblock);
diff --git a/trunk/fs/xfs/xfs_buf.c b/trunk/fs/xfs/xfs_buf.c
index fbbb9eb92e32..56d1614760cf 100644
--- a/trunk/fs/xfs/xfs_buf.c
+++ b/trunk/fs/xfs/xfs_buf.c
@@ -487,7 +487,6 @@ _xfs_buf_find(
 	struct rb_node		*parent;
 	xfs_buf_t		*bp;
 	xfs_daddr_t		blkno = map[0].bm_bn;
-	xfs_daddr_t		eofs;
 	int			numblks = 0;
 	int			i;
 
@@ -499,23 +498,6 @@ _xfs_buf_find(
 	ASSERT(!(numbytes < (1 << btp->bt_sshift)));
 	ASSERT(!(BBTOB(blkno) & (xfs_off_t)btp->bt_smask));
 
-	/*
-	 * Corrupted block numbers can get through to here, unfortunately, so we
-	 * have to check that the buffer falls within the filesystem bounds.
-	 */
-	eofs = XFS_FSB_TO_BB(btp->bt_mount, btp->bt_mount->m_sb.sb_dblocks);
-	if (blkno >= eofs) {
-		/*
-		 * XXX (dgc): we should really be returning EFSCORRUPTED here,
-		 * but none of the higher level infrastructure supports
-		 * returning a specific error on buffer lookup failures.
-		 */
-		xfs_alert(btp->bt_mount,
-			  "%s: Block out of range: block 0x%llx, EOFS 0x%llx ",
-			  __func__, blkno, eofs);
-		return NULL;
-	}
-
 	/* get tree root */
 	pag = xfs_perag_get(btp->bt_mount,
 				xfs_daddr_to_agno(btp->bt_mount, blkno));
@@ -1505,8 +1487,6 @@ xfs_wait_buftarg(
 	while (!list_empty(&btp->bt_lru)) {
 		bp = list_first_entry(&btp->bt_lru, struct xfs_buf, b_lru);
 		if (atomic_read(&bp->b_hold) > 1) {
-			trace_xfs_buf_wait_buftarg(bp, _RET_IP_);
-			list_move_tail(&bp->b_lru, &btp->bt_lru);
 			spin_unlock(&btp->bt_lru_lock);
 			delay(100);
 			goto restart;
diff --git a/trunk/fs/xfs/xfs_buf_item.c b/trunk/fs/xfs/xfs_buf_item.c
index 3f9949fee391..77b09750e92c 100644
--- a/trunk/fs/xfs/xfs_buf_item.c
+++ b/trunk/fs/xfs/xfs_buf_item.c
@@ -652,10 +652,7 @@ xfs_buf_item_unlock(
 
 	/*
 	 * If the buf item isn't tracking any data, free it, otherwise drop the
-	 * reference we hold to it. If we are aborting the transaction, this may
-	 * be the only reference to the buf item, so we free it anyway
-	 * regardless of whether it is dirty or not. A dirty abort implies a
-	 * shutdown, anyway.
+	 * reference we hold to it.
 	 */
 	clean = 1;
 	for (i = 0; i < bip->bli_format_count; i++) {
@@ -667,12 +664,7 @@ xfs_buf_item_unlock(
 	}
 	if (clean)
 		xfs_buf_item_relse(bp);
-	else if (aborted) {
-		if (atomic_dec_and_test(&bip->bli_refcount)) {
-			ASSERT(XFS_FORCED_SHUTDOWN(lip->li_mountp));
-			xfs_buf_item_relse(bp);
-		}
-	} else
+	else
 		atomic_dec(&bip->bli_refcount);
 
 	if (!hold)
diff --git a/trunk/fs/xfs/xfs_dfrag.c b/trunk/fs/xfs/xfs_dfrag.c
index a8bd26b82ecb..d0e9c74d3d96 100644
--- a/trunk/fs/xfs/xfs_dfrag.c
+++ b/trunk/fs/xfs/xfs_dfrag.c
@@ -246,10 +246,10 @@ xfs_swap_extents(
 		goto out_unlock;
 	}
 
-	error = -filemap_write_and_wait(VFS_I(tip)->i_mapping);
+	error = -filemap_write_and_wait(VFS_I(ip)->i_mapping);
 	if (error)
 		goto out_unlock;
-	truncate_pagecache_range(VFS_I(tip), 0, -1);
+	truncate_pagecache_range(VFS_I(ip), 0, -1);
 
 	/* Verify O_DIRECT for ftmp */
 	if (VN_CACHED(VFS_I(tip)) != 0) {
diff --git a/trunk/fs/xfs/xfs_iomap.c b/trunk/fs/xfs/xfs_iomap.c
index 364818eef40e..add06b4e9a63 100644
--- a/trunk/fs/xfs/xfs_iomap.c
+++ b/trunk/fs/xfs/xfs_iomap.c
@@ -351,15 +351,6 @@ xfs_iomap_prealloc_size(
 		}
 		if (shift)
 			alloc_blocks >>= shift;
-
-		/*
-		 * If we are still trying to allocate more space than is
-		 * available, squash the prealloc hard. This can happen if we
-		 * have a large file on a small filesystem and the above
-		 * lowspace thresholds are smaller than MAXEXTLEN.
-		 */
-		while (alloc_blocks >= freesp)
-			alloc_blocks >>= 4;
 	}
 
 	if (alloc_blocks < mp->m_writeio_blocks)
diff --git a/trunk/fs/xfs/xfs_mount.c b/trunk/fs/xfs/xfs_mount.c
index 7d6df7c00c36..da508463ff10 100644
--- a/trunk/fs/xfs/xfs_mount.c
+++ b/trunk/fs/xfs/xfs_mount.c
@@ -658,7 +658,7 @@ xfs_sb_quiet_read_verify(
 		return;
 	}
 	/* quietly fail */
-	xfs_buf_ioerror(bp, EWRONGFS);
+	xfs_buf_ioerror(bp, EFSCORRUPTED);
 }
 
 static void
diff --git a/trunk/fs/xfs/xfs_trace.h b/trunk/fs/xfs/xfs_trace.h
index 16a812977eab..2e137d4a85ae 100644
--- a/trunk/fs/xfs/xfs_trace.h
+++ b/trunk/fs/xfs/xfs_trace.h
@@ -341,7 +341,6 @@ DEFINE_BUF_EVENT(xfs_buf_item_relse);
 DEFINE_BUF_EVENT(xfs_buf_item_iodone);
 DEFINE_BUF_EVENT(xfs_buf_item_iodone_async);
 DEFINE_BUF_EVENT(xfs_buf_error_relse);
-DEFINE_BUF_EVENT(xfs_buf_wait_buftarg);
 DEFINE_BUF_EVENT(xfs_trans_read_buf_io);
 DEFINE_BUF_EVENT(xfs_trans_read_buf_shut);
 
diff --git a/trunk/include/linux/efi.h b/trunk/include/linux/efi.h
index 7a9498ab3c2d..8b84916dc671 100644
--- a/trunk/include/linux/efi.h
+++ b/trunk/include/linux/efi.h
@@ -618,30 +618,18 @@ extern int __init efi_setup_pcdp_console(char *);
 #endif
 
 /*
- * We play games with efi_enabled so that the compiler will, if
- * possible, remove EFI-related code altogether.
+ * We play games with efi_enabled so that the compiler will, if possible, remove
+ * EFI-related code altogether.
  */
-#define EFI_BOOT		0	/* Were we booted from EFI? */
-#define EFI_SYSTEM_TABLES	1	/* Can we use EFI system tables? */
-#define EFI_CONFIG_TABLES	2	/* Can we use EFI config tables? */
-#define EFI_RUNTIME_SERVICES	3	/* Can we use runtime services? */
-#define EFI_MEMMAP		4	/* Can we use EFI memory map? */
-#define EFI_64BIT		5	/* Is the firmware 64-bit? */
-
 #ifdef CONFIG_EFI
 # ifdef CONFIG_X86
-extern int efi_enabled(int facility);
+   extern int efi_enabled;
+   extern bool efi_64bit;
 # else
-static inline int efi_enabled(int facility)
-{
-	return 1;
-}
+#  define efi_enabled 1
 # endif
 #else
-static inline int efi_enabled(int facility)
-{
-	return 0;
-}
+# define efi_enabled 0
 #endif
 
 /*
diff --git a/trunk/include/linux/mfd/abx500.h b/trunk/include/linux/mfd/abx500.h
index e53dcfeaee69..2138bd33021a 100644
--- a/trunk/include/linux/mfd/abx500.h
+++ b/trunk/include/linux/mfd/abx500.h
@@ -272,6 +272,8 @@ struct abx500_bm_data {
 	const struct abx500_fg_parameters *fg_params;
 };
 
+extern struct abx500_bm_data ab8500_bm_data;
+
 enum {
 	NTC_EXTERNAL = 0,
 	NTC_INTERNAL,
diff --git a/trunk/include/linux/mfd/abx500/ab8500-bm.h b/trunk/include/linux/mfd/abx500/ab8500-bm.h
index 9bd037df97d9..44310c98ee6e 100644
--- a/trunk/include/linux/mfd/abx500/ab8500-bm.h
+++ b/trunk/include/linux/mfd/abx500/ab8500-bm.h
@@ -422,10 +422,7 @@ struct ab8500_chargalg_platform_data {
 struct ab8500_btemp;
 struct ab8500_gpadc;
 struct ab8500_fg;
-
 #ifdef CONFIG_AB8500_BM
-extern struct abx500_bm_data ab8500_bm_data;
-
 void ab8500_fg_reinit(void);
 void ab8500_charger_usb_state_changed(u8 bm_usb_state, u16 mA);
 struct ab8500_btemp *ab8500_btemp_get(void);
@@ -437,7 +434,31 @@ int ab8500_fg_inst_curr_finalize(struct ab8500_fg *di, int *res);
 int ab8500_fg_inst_curr_done(struct ab8500_fg *di);
 
 #else
-static struct abx500_bm_data ab8500_bm_data;
+int ab8500_fg_inst_curr_done(struct ab8500_fg *di)
+{
+}
+static void ab8500_fg_reinit(void)
+{
+}
+static void ab8500_charger_usb_state_changed(u8 bm_usb_state, u16 mA)
+{
+}
+static struct ab8500_btemp *ab8500_btemp_get(void)
+{
+	return NULL;
+}
+static int ab8500_btemp_get_batctrl_temp(struct ab8500_btemp *btemp)
+{
+	return 0;
+}
+struct ab8500_fg *ab8500_fg_get(void)
+{
+	return NULL;
+}
+static int ab8500_fg_inst_curr_blocking(struct ab8500_fg *dev)
+{
+	return -ENODEV;
+}
 
 static inline int ab8500_fg_inst_curr_start(struct ab8500_fg *di)
 {
diff --git a/trunk/include/linux/mfd/da9052/da9052.h b/trunk/include/linux/mfd/da9052/da9052.h
index 786d02eb79d2..86dd93de6ff2 100644
--- a/trunk/include/linux/mfd/da9052/da9052.h
+++ b/trunk/include/linux/mfd/da9052/da9052.h
@@ -99,9 +99,6 @@ struct da9052 {
 	u8 chip_id;
 
 	int chip_irq;
-
-	/* SOC I/O transfer related fixes for DA9052/53 */
-	int (*fix_io) (struct da9052 *da9052, unsigned char reg);
 };
 
 /* ADC API */
@@ -116,87 +113,32 @@ static inline int da9052_reg_read(struct da9052 *da9052, unsigned char reg)
 	ret = regmap_read(da9052->regmap, reg, &val);
 	if (ret < 0)
 		return ret;
-
-	if (da9052->fix_io) {
-		ret = da9052->fix_io(da9052, reg);
-		if (ret < 0)
-			return ret;
-	}
-
 	return val;
 }
 
 static inline int da9052_reg_write(struct da9052 *da9052, unsigned char reg,
 				    unsigned char val)
 {
-	int ret;
-
-	ret = regmap_write(da9052->regmap, reg, val);
-	if (ret < 0)
-		return ret;
-
-	if (da9052->fix_io) {
-		ret = da9052->fix_io(da9052, reg);
-		if (ret < 0)
-			return ret;
-	}
-
-	return ret;
+	return regmap_write(da9052->regmap, reg, val);
 }
 
 static inline int da9052_group_read(struct da9052 *da9052, unsigned char reg,
 				     unsigned reg_cnt, unsigned char *val)
 {
-	int ret;
-
-	ret = regmap_bulk_read(da9052->regmap, reg, val, reg_cnt);
-	if (ret < 0)
-		return ret;
-
-	if (da9052->fix_io) {
-		ret = da9052->fix_io(da9052, reg);
-		if (ret < 0)
-			return ret;
-	}
-
-	return ret;
+	return regmap_bulk_read(da9052->regmap, reg, val, reg_cnt);
 }
 
 static inline int da9052_group_write(struct da9052 *da9052, unsigned char reg,
 				      unsigned reg_cnt, unsigned char *val)
 {
-	int ret;
-
-	ret = regmap_raw_write(da9052->regmap, reg, val, reg_cnt);
-	if (ret < 0)
-		return ret;
-
-	if (da9052->fix_io) {
-		ret = da9052->fix_io(da9052, reg);
-		if (ret < 0)
-			return ret;
-	}
-
-	return ret;
+	return regmap_raw_write(da9052->regmap, reg, val, reg_cnt);
 }
 
 static inline int da9052_reg_update(struct da9052 *da9052, unsigned char reg,
 				     unsigned char bit_mask,
 				     unsigned char reg_val)
 {
-	int ret;
-
-	ret = regmap_update_bits(da9052->regmap, reg, bit_mask, reg_val);
-	if (ret < 0)
-		return ret;
-
-	if (da9052->fix_io) {
-		ret = da9052->fix_io(da9052, reg);
-		if (ret < 0)
-			return ret;
-	}
-
-	return ret;
+	return regmap_update_bits(da9052->regmap, reg, bit_mask, reg_val);
 }
 
 int da9052_device_init(struct da9052 *da9052, u8 chip_id);
diff --git a/trunk/include/linux/mfd/da9052/reg.h b/trunk/include/linux/mfd/da9052/reg.h
index c4dd3a8add21..b97f7309d7f6 100644
--- a/trunk/include/linux/mfd/da9052/reg.h
+++ b/trunk/include/linux/mfd/da9052/reg.h
@@ -34,9 +34,6 @@
 #define DA9052_STATUS_C_REG		3
 #define DA9052_STATUS_D_REG		4
 
-/* PARK REGISTER */
-#define DA9052_PARK_REGISTER		DA9052_STATUS_D_REG
-
 /* EVENT REGISTERS */
 #define DA9052_EVENT_A_REG		5
 #define DA9052_EVENT_B_REG		6
diff --git a/trunk/include/linux/mfd/rtsx_common.h b/trunk/include/linux/mfd/rtsx_common.h
index 2b13970596f5..a8d393e3066b 100644
--- a/trunk/include/linux/mfd/rtsx_common.h
+++ b/trunk/include/linux/mfd/rtsx_common.h
@@ -38,9 +38,6 @@
 #define RTSX_SD_CARD			0
 #define RTSX_MS_CARD			1
 
-#define CLK_TO_DIV_N			0
-#define DIV_N_TO_CLK			1
-
 struct platform_device;
 
 struct rtsx_slot {
diff --git a/trunk/include/linux/mfd/rtsx_pci.h b/trunk/include/linux/mfd/rtsx_pci.h
index 4b117a3f54d4..060b721fcbfb 100644
--- a/trunk/include/linux/mfd/rtsx_pci.h
+++ b/trunk/include/linux/mfd/rtsx_pci.h
@@ -158,9 +158,10 @@
 #define SG_TRANS_DATA		(0x02 << 4)
 #define SG_LINK_DESC		(0x03 << 4)
 
-/* Output voltage */
-#define OUTPUT_3V3		0
-#define OUTPUT_1V8		1
+/* SD bank voltage */
+#define SD_IO_3V3		0
+#define SD_IO_1V8		1
+
 
 /* Card Clock Enable Register */
 #define SD_CLK_EN			0x04
@@ -200,20 +201,6 @@
 #define CHANGE_CLK			0x01
 
 /* LDO_CTL */
-#define BPP_ASIC_1V7			0x00
-#define BPP_ASIC_1V8			0x01
-#define BPP_ASIC_1V9			0x02
-#define BPP_ASIC_2V0			0x03
-#define BPP_ASIC_2V7			0x04
-#define BPP_ASIC_2V8			0x05
-#define BPP_ASIC_3V2			0x06
-#define BPP_ASIC_3V3			0x07
-#define BPP_REG_TUNED18			0x07
-#define BPP_TUNED18_SHIFT_8402		5
-#define BPP_TUNED18_SHIFT_8411		4
-#define BPP_PAD_MASK			0x04
-#define BPP_PAD_3V3			0x04
-#define BPP_PAD_1V8			0x00
 #define BPP_LDO_POWB			0x03
 #define BPP_LDO_ON			0x00
 #define BPP_LDO_SUSPEND			0x02
@@ -701,10 +688,7 @@ struct pcr_ops {
 	int		(*disable_auto_blink)(struct rtsx_pcr *pcr);
 	int		(*card_power_on)(struct rtsx_pcr *pcr, int card);
 	int		(*card_power_off)(struct rtsx_pcr *pcr, int card);
-	int		(*switch_output_voltage)(struct rtsx_pcr *pcr,
-						u8 voltage);
 	unsigned int	(*cd_deglitch)(struct rtsx_pcr *pcr);
-	int		(*conv_clk_and_div_n)(int clk, int dir);
 };
 
 enum PDEV_STAT  {PDEV_STAT_IDLE, PDEV_STAT_RUN};
@@ -799,7 +783,6 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
 		u8 ssc_depth, bool initial_mode, bool double_clk, bool vpclk);
 int rtsx_pci_card_power_on(struct rtsx_pcr *pcr, int card);
 int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card);
-int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage);
 unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr);
 void rtsx_pci_complete_unfinished_transfer(struct rtsx_pcr *pcr);
 
diff --git a/trunk/include/linux/security.h b/trunk/include/linux/security.h
index eee7478cda70..0f6afc657f77 100644
--- a/trunk/include/linux/security.h
+++ b/trunk/include/linux/security.h
@@ -989,29 +989,17 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *	tells the LSM to decrement the number of secmark labeling rules loaded
  * @req_classify_flow:
  *	Sets the flow's sid to the openreq sid.
- * @tun_dev_alloc_security:
- *	This hook allows a module to allocate a security structure for a TUN
- *	device.
- *	@security pointer to a security structure pointer.
- *	Returns a zero on success, negative values on failure.
- * @tun_dev_free_security:
- *	This hook allows a module to free the security structure for a TUN
- *	device.
- *	@security pointer to the TUN device's security structure
  * @tun_dev_create:
  *	Check permissions prior to creating a new TUN device.
- * @tun_dev_attach_queue:
- *	Check permissions prior to attaching to a TUN device queue.
- *	@security pointer to the TUN device's security structure.
+ * @tun_dev_post_create:
+ *	This hook allows a module to update or allocate a per-socket security
+ *	structure.
+ *	@sk contains the newly created sock structure.
  * @tun_dev_attach:
- *	This hook can be used by the module to update any security state
+ *	Check permissions prior to attaching to a persistent TUN device.  This
+ *	hook can also be used by the module to update any security state
  *	associated with the TUN device's sock structure.
  *	@sk contains the existing sock structure.
- *	@security pointer to the TUN device's security structure.
- * @tun_dev_open:
- *	This hook can be used by the module to update any security state
- *	associated with the TUN device's security structure.
- *	@security pointer to the TUN devices's security structure.
  *
  * Security hooks for XFRM operations.
  *
@@ -1632,12 +1620,9 @@ struct security_operations {
 	void (*secmark_refcount_inc) (void);
 	void (*secmark_refcount_dec) (void);
 	void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl);
-	int (*tun_dev_alloc_security) (void **security);
-	void (*tun_dev_free_security) (void *security);
-	int (*tun_dev_create) (void);
-	int (*tun_dev_attach_queue) (void *security);
-	int (*tun_dev_attach) (struct sock *sk, void *security);
-	int (*tun_dev_open) (void *security);
+	int (*tun_dev_create)(void);
+	void (*tun_dev_post_create)(struct sock *sk);
+	int (*tun_dev_attach)(struct sock *sk);
 #endif	/* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -2581,12 +2566,9 @@ void security_inet_conn_established(struct sock *sk,
 int security_secmark_relabel_packet(u32 secid);
 void security_secmark_refcount_inc(void);
 void security_secmark_refcount_dec(void);
-int security_tun_dev_alloc_security(void **security);
-void security_tun_dev_free_security(void *security);
 int security_tun_dev_create(void);
-int security_tun_dev_attach_queue(void *security);
-int security_tun_dev_attach(struct sock *sk, void *security);
-int security_tun_dev_open(void *security);
+void security_tun_dev_post_create(struct sock *sk);
+int security_tun_dev_attach(struct sock *sk);
 
 #else	/* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct sock *sock,
@@ -2751,31 +2733,16 @@ static inline void security_secmark_refcount_dec(void)
 {
 }
 
-static inline int security_tun_dev_alloc_security(void **security)
-{
-	return 0;
-}
-
-static inline void security_tun_dev_free_security(void *security)
-{
-}
-
 static inline int security_tun_dev_create(void)
 {
 	return 0;
 }
 
-static inline int security_tun_dev_attach_queue(void *security)
-{
-	return 0;
-}
-
-static inline int security_tun_dev_attach(struct sock *sk, void *security)
+static inline void security_tun_dev_post_create(struct sock *sk)
 {
-	return 0;
 }
 
-static inline int security_tun_dev_open(void *security)
+static inline int security_tun_dev_attach(struct sock *sk)
 {
 	return 0;
 }
diff --git a/trunk/include/linux/usb/usbnet.h b/trunk/include/linux/usb/usbnet.h
index 5de7a220e986..bd45eb7bedc8 100644
--- a/trunk/include/linux/usb/usbnet.h
+++ b/trunk/include/linux/usb/usbnet.h
@@ -100,7 +100,6 @@ struct driver_info {
 #define FLAG_LINK_INTR	0x0800		/* updates link (carrier) status */
 
 #define FLAG_POINTTOPOINT 0x1000	/* possibly use "usb%d" names */
-#define FLAG_NOARP	0x2000		/* device can't do ARP */
 
 /*
  * Indicates to usbnet, that USB driver accumulates multiple IP packets.
diff --git a/trunk/include/net/ip.h b/trunk/include/net/ip.h
index a68f838a132c..0707fb9551aa 100644
--- a/trunk/include/net/ip.h
+++ b/trunk/include/net/ip.h
@@ -143,8 +143,6 @@ static inline struct sk_buff *ip_finish_skb(struct sock *sk, struct flowi4 *fl4)
 extern int		ip4_datagram_connect(struct sock *sk, 
 					     struct sockaddr *uaddr, int addr_len);
 
-extern void ip4_datagram_release_cb(struct sock *sk);
-
 struct ip_reply_arg {
 	struct kvec iov[1];   
 	int	    flags;
diff --git a/trunk/include/net/netfilter/nf_conntrack_core.h b/trunk/include/net/netfilter/nf_conntrack_core.h
index e98aeb3da033..d8f5b9f52169 100644
--- a/trunk/include/net/netfilter/nf_conntrack_core.h
+++ b/trunk/include/net/netfilter/nf_conntrack_core.h
@@ -31,8 +31,6 @@ extern void nf_conntrack_cleanup(struct net *net);
 extern int nf_conntrack_proto_init(struct net *net);
 extern void nf_conntrack_proto_fini(struct net *net);
 
-extern void nf_conntrack_cleanup_end(void);
-
 extern bool
 nf_ct_get_tuple(const struct sk_buff *skb,
 		unsigned int nhoff,
diff --git a/trunk/init/main.c b/trunk/init/main.c
index cee4b5c66d81..92d728a32d51 100644
--- a/trunk/init/main.c
+++ b/trunk/init/main.c
@@ -604,7 +604,7 @@ asmlinkage void __init start_kernel(void)
 	pidmap_init();
 	anon_vma_init();
 #ifdef CONFIG_X86
-	if (efi_enabled(EFI_RUNTIME_SERVICES))
+	if (efi_enabled)
 		efi_enter_virtual_mode();
 #endif
 	thread_info_cache_init();
@@ -632,7 +632,7 @@ asmlinkage void __init start_kernel(void)
 	acpi_early_init(); /* before LAPIC and SMP init */
 	sfi_init_late();
 
-	if (efi_enabled(EFI_RUNTIME_SERVICES)) {
+	if (efi_enabled) {
 		efi_late_init();
 		efi_free_boot_services();
 	}
diff --git a/trunk/kernel/printk.c b/trunk/kernel/printk.c
index 267ce780abe8..357f714ddd49 100644
--- a/trunk/kernel/printk.c
+++ b/trunk/kernel/printk.c
@@ -87,6 +87,12 @@ static DEFINE_SEMAPHORE(console_sem);
 struct console *console_drivers;
 EXPORT_SYMBOL_GPL(console_drivers);
 
+#ifdef CONFIG_LOCKDEP
+static struct lockdep_map console_lock_dep_map = {
+	.name = "console_lock"
+};
+#endif
+
 /*
  * This is used for debugging the mess that is the VT code by
  * keeping track if we have the console semaphore held. It's
@@ -1918,6 +1924,7 @@ void console_lock(void)
 		return;
 	console_locked = 1;
 	console_may_schedule = 1;
+	mutex_acquire(&console_lock_dep_map, 0, 0, _RET_IP_);
 }
 EXPORT_SYMBOL(console_lock);
 
@@ -1939,6 +1946,7 @@ int console_trylock(void)
 	}
 	console_locked = 1;
 	console_may_schedule = 0;
+	mutex_acquire(&console_lock_dep_map, 0, 1, _RET_IP_);
 	return 1;
 }
 EXPORT_SYMBOL(console_trylock);
@@ -2099,6 +2107,7 @@ void console_unlock(void)
 		local_irq_restore(flags);
 	}
 	console_locked = 0;
+	mutex_release(&console_lock_dep_map, 1, _RET_IP_);
 
 	/* Release the exclusive_console once it is used */
 	if (unlikely(exclusive_console))
diff --git a/trunk/kernel/smp.c b/trunk/kernel/smp.c
index 69f38bd98b42..29dd40a9f2f4 100644
--- a/trunk/kernel/smp.c
+++ b/trunk/kernel/smp.c
@@ -33,7 +33,6 @@ struct call_function_data {
 	struct call_single_data	csd;
 	atomic_t		refs;
 	cpumask_var_t		cpumask;
-	cpumask_var_t		cpumask_ipi;
 };
 
 static DEFINE_PER_CPU_SHARED_ALIGNED(struct call_function_data, cfd_data);
@@ -57,9 +56,6 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 		if (!zalloc_cpumask_var_node(&cfd->cpumask, GFP_KERNEL,
 				cpu_to_node(cpu)))
 			return notifier_from_errno(-ENOMEM);
-		if (!zalloc_cpumask_var_node(&cfd->cpumask_ipi, GFP_KERNEL,
-				cpu_to_node(cpu)))
-			return notifier_from_errno(-ENOMEM);
 		break;
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -69,7 +65,6 @@ hotplug_cfd(struct notifier_block *nfb, unsigned long action, void *hcpu)
 	case CPU_DEAD:
 	case CPU_DEAD_FROZEN:
 		free_cpumask_var(cfd->cpumask);
-		free_cpumask_var(cfd->cpumask_ipi);
 		break;
 #endif
 	};
@@ -531,12 +526,6 @@ void smp_call_function_many(const struct cpumask *mask,
 		return;
 	}
 
-	/*
-	 * After we put an entry into the list, data->cpumask
-	 * may be cleared again when another CPU sends another IPI for
-	 * a SMP function call, so data->cpumask will be zero.
-	 */
-	cpumask_copy(data->cpumask_ipi, data->cpumask);
 	raw_spin_lock_irqsave(&call_function.lock, flags);
 	/*
 	 * Place entry at the _HEAD_ of the list, so that any cpu still
@@ -560,7 +549,7 @@ void smp_call_function_many(const struct cpumask *mask,
 	smp_mb();
 
 	/* Send a message to all CPUs in the map */
-	arch_send_call_function_ipi_mask(data->cpumask_ipi);
+	arch_send_call_function_ipi_mask(data->cpumask);
 
 	/* Optionally wait for the CPUs to complete */
 	if (wait)
diff --git a/trunk/net/batman-adv/distributed-arp-table.c b/trunk/net/batman-adv/distributed-arp-table.c
index 183f97a86bb2..8e1d89d2b1c1 100644
--- a/trunk/net/batman-adv/distributed-arp-table.c
+++ b/trunk/net/batman-adv/distributed-arp-table.c
@@ -738,7 +738,6 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
 	struct arphdr *arphdr;
 	struct ethhdr *ethhdr;
 	__be32 ip_src, ip_dst;
-	uint8_t *hw_src, *hw_dst;
 	uint16_t type = 0;
 
 	/* pull the ethernet header */
@@ -778,23 +777,9 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
 	ip_src = batadv_arp_ip_src(skb, hdr_size);
 	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
 	if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||
-	    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||
-	    ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||
-	    ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))
+	    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst))
 		goto out;
 
-	hw_src = batadv_arp_hw_src(skb, hdr_size);
-	if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))
-		goto out;
-
-	/* we don't care about the destination MAC address in ARP requests */
-	if (arphdr->ar_op != htons(ARPOP_REQUEST)) {
-		hw_dst = batadv_arp_hw_dst(skb, hdr_size);
-		if (is_zero_ether_addr(hw_dst) ||
-		    is_multicast_ether_addr(hw_dst))
-			goto out;
-	}
-
 	type = ntohs(arphdr->ar_op);
 out:
 	return type;
@@ -1027,8 +1012,6 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
 	 */
 	ret = !batadv_is_my_client(bat_priv, hw_dst);
 out:
-	if (ret)
-		kfree_skb(skb);
 	/* if ret == false -> packet has to be delivered to the interface */
 	return ret;
 }
diff --git a/trunk/net/bluetooth/hci_core.c b/trunk/net/bluetooth/hci_core.c
index 0f78e34220c9..596660d37c5e 100644
--- a/trunk/net/bluetooth/hci_core.c
+++ b/trunk/net/bluetooth/hci_core.c
@@ -2810,6 +2810,14 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
 	if (conn) {
 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
 
+		hci_dev_lock(hdev);
+		if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
+		    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
+			mgmt_device_connected(hdev, &conn->dst, conn->type,
+					      conn->dst_type, 0, NULL, 0,
+					      conn->dev_class);
+		hci_dev_unlock(hdev);
+
 		/* Send to upper protocol */
 		l2cap_recv_acldata(conn, skb, flags);
 		return;
diff --git a/trunk/net/bluetooth/hci_event.c b/trunk/net/bluetooth/hci_event.c
index 81b44481d0d9..705078a0cc39 100644
--- a/trunk/net/bluetooth/hci_event.c
+++ b/trunk/net/bluetooth/hci_event.c
@@ -2688,7 +2688,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 	if (ev->opcode != HCI_OP_NOP)
 		del_timer(&hdev->cmd_timer);
 
-	if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
+	if (ev->ncmd) {
 		atomic_set(&hdev->cmd_cnt, 1);
 		if (!skb_queue_empty(&hdev->cmd_q))
 			queue_work(hdev->workqueue, &hdev->cmd_work);
diff --git a/trunk/net/bluetooth/hidp/core.c b/trunk/net/bluetooth/hidp/core.c
index a7352ff3fd1e..b2bcbe2dc328 100644
--- a/trunk/net/bluetooth/hidp/core.c
+++ b/trunk/net/bluetooth/hidp/core.c
@@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
 	hid->version = req->version;
 	hid->country = req->country;
 
-	strncpy(hid->name, req->name, sizeof(req->name) - 1);
+	strncpy(hid->name, req->name, 128);
 
 	snprintf(hid->phys, sizeof(hid->phys), "%pMR",
 		 &bt_sk(session->ctrl_sock->sk)->src);
diff --git a/trunk/net/bluetooth/l2cap_core.c b/trunk/net/bluetooth/l2cap_core.c
index 22e658322845..2c78208d793e 100644
--- a/trunk/net/bluetooth/l2cap_core.c
+++ b/trunk/net/bluetooth/l2cap_core.c
@@ -3727,17 +3727,6 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
 static int l2cap_connect_req(struct l2cap_conn *conn,
 			     struct l2cap_cmd_hdr *cmd, u8 *data)
 {
-	struct hci_dev *hdev = conn->hcon->hdev;
-	struct hci_conn *hcon = conn->hcon;
-
-	hci_dev_lock(hdev);
-	if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
-	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
-		mgmt_device_connected(hdev, &hcon->dst, hcon->type,
-				      hcon->dst_type, 0, NULL, 0,
-				      hcon->dev_class);
-	hci_dev_unlock(hdev);
-
 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
 	return 0;
 }
diff --git a/trunk/net/bluetooth/sco.c b/trunk/net/bluetooth/sco.c
index 57f250c20e39..531a93d613d4 100644
--- a/trunk/net/bluetooth/sco.c
+++ b/trunk/net/bluetooth/sco.c
@@ -352,7 +352,7 @@ static void __sco_sock_close(struct sock *sk)
 
 	case BT_CONNECTED:
 	case BT_CONFIG:
-		if (sco_pi(sk)->conn->hcon) {
+		if (sco_pi(sk)->conn) {
 			sk->sk_state = BT_DISCONN;
 			sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
 			hci_conn_put(sco_pi(sk)->conn->hcon);
diff --git a/trunk/net/core/request_sock.c b/trunk/net/core/request_sock.c
index 4425148d2b51..c31d9e8668c3 100644
--- a/trunk/net/core/request_sock.c
+++ b/trunk/net/core/request_sock.c
@@ -186,6 +186,8 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
 	struct fastopen_queue *fastopenq =
 	    inet_csk(lsk)->icsk_accept_queue.fastopenq;
 
+	BUG_ON(!spin_is_locked(&sk->sk_lock.slock) && !sock_owned_by_user(sk));
+
 	tcp_sk(sk)->fastopen_rsk = NULL;
 	spin_lock_bh(&fastopenq->lock);
 	fastopenq->qlen--;
diff --git a/trunk/net/core/scm.c b/trunk/net/core/scm.c
index 905dcc6ad1e3..57fb1ee6649f 100644
--- a/trunk/net/core/scm.c
+++ b/trunk/net/core/scm.c
@@ -35,7 +35,6 @@
 #include <net/sock.h>
 #include <net/compat.h>
 #include <net/scm.h>
-#include <net/cls_cgroup.h>
 
 
 /*
@@ -303,10 +302,8 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
 		}
 		/* Bump the usage count and install the file. */
 		sock = sock_from_file(fp[i], &err);
-		if (sock) {
+		if (sock)
 			sock_update_netprioidx(sock->sk, current);
-			sock_update_classid(sock->sk, current);
-		}
 		fd_install(new_fd, get_file(fp[i]));
 	}
 
diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c
index a9a2ae3e2213..3ab989b0de42 100644
--- a/trunk/net/core/skbuff.c
+++ b/trunk/net/core/skbuff.c
@@ -1649,7 +1649,7 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
 
 static struct page *linear_to_page(struct page *page, unsigned int *len,
 				   unsigned int *offset,
-				   struct sock *sk)
+				   struct sk_buff *skb, struct sock *sk)
 {
 	struct page_frag *pfrag = sk_page_frag(sk);
 
@@ -1682,14 +1682,14 @@ static bool spd_can_coalesce(const struct splice_pipe_desc *spd,
 static bool spd_fill_page(struct splice_pipe_desc *spd,
 			  struct pipe_inode_info *pipe, struct page *page,
 			  unsigned int *len, unsigned int offset,
-			  bool linear,
+			  struct sk_buff *skb, bool linear,
 			  struct sock *sk)
 {
 	if (unlikely(spd->nr_pages == MAX_SKB_FRAGS))
 		return true;
 
 	if (linear) {
-		page = linear_to_page(page, len, &offset, sk);
+		page = linear_to_page(page, len, &offset, skb, sk);
 		if (!page)
 			return true;
 	}
@@ -1706,9 +1706,23 @@ static bool spd_fill_page(struct splice_pipe_desc *spd,
 	return false;
 }
 
+static inline void __segment_seek(struct page **page, unsigned int *poff,
+				  unsigned int *plen, unsigned int off)
+{
+	unsigned long n;
+
+	*poff += off;
+	n = *poff / PAGE_SIZE;
+	if (n)
+		*page = nth_page(*page, n);
+
+	*poff = *poff % PAGE_SIZE;
+	*plen -= off;
+}
+
 static bool __splice_segment(struct page *page, unsigned int poff,
 			     unsigned int plen, unsigned int *off,
-			     unsigned int *len,
+			     unsigned int *len, struct sk_buff *skb,
 			     struct splice_pipe_desc *spd, bool linear,
 			     struct sock *sk,
 			     struct pipe_inode_info *pipe)
@@ -1723,19 +1737,23 @@ static bool __splice_segment(struct page *page, unsigned int poff,
 	}
 
 	/* ignore any bits we already processed */
-	poff += *off;
-	plen -= *off;
-	*off = 0;
+	if (*off) {
+		__segment_seek(&page, &poff, &plen, *off);
+		*off = 0;
+	}
 
 	do {
 		unsigned int flen = min(*len, plen);
 
-		if (spd_fill_page(spd, pipe, page, &flen, poff,
-				  linear, sk))
+		/* the linear region may spread across several pages  */
+		flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
+
+		if (spd_fill_page(spd, pipe, page, &flen, poff, skb, linear, sk))
 			return true;
-		poff += flen;
-		plen -= flen;
+
+		__segment_seek(&page, &poff, &plen, flen);
 		*len -= flen;
+
 	} while (*len && plen);
 
 	return false;
@@ -1759,7 +1777,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
 	if (__splice_segment(virt_to_page(skb->data),
 			     (unsigned long) skb->data & (PAGE_SIZE - 1),
 			     skb_headlen(skb),
-			     offset, len, spd,
+			     offset, len, skb, spd,
 			     skb_head_is_locked(skb),
 			     sk, pipe))
 		return true;
@@ -1772,7 +1790,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
 
 		if (__splice_segment(skb_frag_page(f),
 				     f->page_offset, skb_frag_size(f),
-				     offset, len, spd, false, sk, pipe))
+				     offset, len, skb, spd, false, sk, pipe))
 			return true;
 	}
 
diff --git a/trunk/net/ipv4/ah4.c b/trunk/net/ipv4/ah4.c
index a69b4e4a02b5..a0d8392491c3 100644
--- a/trunk/net/ipv4/ah4.c
+++ b/trunk/net/ipv4/ah4.c
@@ -269,11 +269,7 @@ static void ah_input_done(struct crypto_async_request *base, int err)
 	skb->network_header += ah_hlen;
 	memcpy(skb_network_header(skb), work_iph, ihl);
 	__skb_pull(skb, ah_hlen + ihl);
-
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -ihl);
+	skb_set_transport_header(skb, -ihl);
 out:
 	kfree(AH_SKB_CB(skb)->tmp);
 	xfrm_input_resume(skb, err);
@@ -385,10 +381,7 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 	skb->network_header += ah_hlen;
 	memcpy(skb_network_header(skb), work_iph, ihl);
 	__skb_pull(skb, ah_hlen + ihl);
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -ihl);
+	skb_set_transport_header(skb, -ihl);
 
 	err = nexthdr;
 
@@ -420,12 +413,9 @@ static void ah4_err(struct sk_buff *skb, u32 info)
 	if (!x)
 		return;
 
-	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-		atomic_inc(&flow_cache_genid);
-		rt_genid_bump(net);
-
+	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
 		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);
-	} else
+	else
 		ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);
 	xfrm_state_put(x);
 }
diff --git a/trunk/net/ipv4/datagram.c b/trunk/net/ipv4/datagram.c
index b28e863fe0a7..424fafbc8cb0 100644
--- a/trunk/net/ipv4/datagram.c
+++ b/trunk/net/ipv4/datagram.c
@@ -85,28 +85,3 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
 	return err;
 }
 EXPORT_SYMBOL(ip4_datagram_connect);
-
-void ip4_datagram_release_cb(struct sock *sk)
-{
-	const struct inet_sock *inet = inet_sk(sk);
-	const struct ip_options_rcu *inet_opt;
-	__be32 daddr = inet->inet_daddr;
-	struct flowi4 fl4;
-	struct rtable *rt;
-
-	if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0))
-		return;
-
-	rcu_read_lock();
-	inet_opt = rcu_dereference(inet->inet_opt);
-	if (inet_opt && inet_opt->opt.srr)
-		daddr = inet_opt->opt.faddr;
-	rt = ip_route_output_ports(sock_net(sk), &fl4, sk, daddr,
-				   inet->inet_saddr, inet->inet_dport,
-				   inet->inet_sport, sk->sk_protocol,
-				   RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
-	if (!IS_ERR(rt))
-		__sk_dst_set(sk, &rt->dst);
-	rcu_read_unlock();
-}
-EXPORT_SYMBOL_GPL(ip4_datagram_release_cb);
diff --git a/trunk/net/ipv4/esp4.c b/trunk/net/ipv4/esp4.c
index 3b4f0cd2e63e..b61e9deb7c7e 100644
--- a/trunk/net/ipv4/esp4.c
+++ b/trunk/net/ipv4/esp4.c
@@ -346,10 +346,7 @@ static int esp_input_done2(struct sk_buff *skb, int err)
 
 	pskb_trim(skb, skb->len - alen - padlen - 2);
 	__skb_pull(skb, hlen);
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -ihl);
+	skb_set_transport_header(skb, -ihl);
 
 	err = nexthdr[1];
 
@@ -502,12 +499,9 @@ static void esp4_err(struct sk_buff *skb, u32 info)
 	if (!x)
 		return;
 
-	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-		atomic_inc(&flow_cache_genid);
-		rt_genid_bump(net);
-
+	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
 		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);
-	} else
+	else
 		ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);
 	xfrm_state_put(x);
 }
diff --git a/trunk/net/ipv4/ip_gre.c b/trunk/net/ipv4/ip_gre.c
index e81b1caf2ea2..303012adf9e6 100644
--- a/trunk/net/ipv4/ip_gre.c
+++ b/trunk/net/ipv4/ip_gre.c
@@ -963,12 +963,8 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
 			ptr--;
 		}
 		if (tunnel->parms.o_flags&GRE_CSUM) {
-			int offset = skb_transport_offset(skb);
-
 			*ptr = 0;
-			*(__sum16 *)ptr = csum_fold(skb_checksum(skb, offset,
-								 skb->len - offset,
-								 0));
+			*(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr));
 		}
 	}
 
diff --git a/trunk/net/ipv4/ipcomp.c b/trunk/net/ipv4/ipcomp.c
index 9a46daed2f3c..d3ab47e19a89 100644
--- a/trunk/net/ipv4/ipcomp.c
+++ b/trunk/net/ipv4/ipcomp.c
@@ -47,12 +47,9 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
 	if (!x)
 		return;
 
-	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
-		atomic_inc(&flow_cache_genid);
-		rt_genid_bump(net);
-
+	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
 		ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);
-	} else
+	else
 		ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);
 	xfrm_state_put(x);
 }
diff --git a/trunk/net/ipv4/ping.c b/trunk/net/ipv4/ping.c
index 6f9c07268cf6..8f3d05424a3e 100644
--- a/trunk/net/ipv4/ping.c
+++ b/trunk/net/ipv4/ping.c
@@ -738,7 +738,6 @@ struct proto ping_prot = {
 	.recvmsg =	ping_recvmsg,
 	.bind =		ping_bind,
 	.backlog_rcv =	ping_queue_rcv_skb,
-	.release_cb =	ip4_datagram_release_cb,
 	.hash =		ping_v4_hash,
 	.unhash =	ping_v4_unhash,
 	.get_port =	ping_v4_get_port,
diff --git a/trunk/net/ipv4/raw.c b/trunk/net/ipv4/raw.c
index 6f08991409c3..73d1e4df4bf6 100644
--- a/trunk/net/ipv4/raw.c
+++ b/trunk/net/ipv4/raw.c
@@ -894,7 +894,6 @@ struct proto raw_prot = {
 	.recvmsg	   = raw_recvmsg,
 	.bind		   = raw_bind,
 	.backlog_rcv	   = raw_rcv_skb,
-	.release_cb	   = ip4_datagram_release_cb,
 	.hash		   = raw_hash_sk,
 	.unhash		   = raw_unhash_sk,
 	.obj_size	   = sizeof(struct raw_sock),
diff --git a/trunk/net/ipv4/route.c b/trunk/net/ipv4/route.c
index a0fcc47fee73..844a9ef60dbd 100644
--- a/trunk/net/ipv4/route.c
+++ b/trunk/net/ipv4/route.c
@@ -912,9 +912,6 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
 	struct dst_entry *dst = &rt->dst;
 	struct fib_result res;
 
-	if (dst_metric_locked(dst, RTAX_MTU))
-		return;
-
 	if (dst->dev->mtu < mtu)
 		return;
 
@@ -965,7 +962,7 @@ void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
 }
 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
 
-static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
+void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
 {
 	const struct iphdr *iph = (const struct iphdr *) skb->data;
 	struct flowi4 fl4;
@@ -978,53 +975,6 @@ static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
 		ip_rt_put(rt);
 	}
 }
-
-void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
-{
-	const struct iphdr *iph = (const struct iphdr *) skb->data;
-	struct flowi4 fl4;
-	struct rtable *rt;
-	struct dst_entry *dst;
-	bool new = false;
-
-	bh_lock_sock(sk);
-	rt = (struct rtable *) __sk_dst_get(sk);
-
-	if (sock_owned_by_user(sk) || !rt) {
-		__ipv4_sk_update_pmtu(skb, sk, mtu);
-		goto out;
-	}
-
-	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
-
-	if (!__sk_dst_check(sk, 0)) {
-		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
-		if (IS_ERR(rt))
-			goto out;
-
-		new = true;
-	}
-
-	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
-
-	dst = dst_check(&rt->dst, 0);
-	if (!dst) {
-		if (new)
-			dst_release(&rt->dst);
-
-		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
-		if (IS_ERR(rt))
-			goto out;
-
-		new = true;
-	}
-
-	if (new)
-		__sk_dst_set(sk, &rt->dst);
-
-out:
-	bh_unlock_sock(sk);
-}
 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
 
 void ipv4_redirect(struct sk_buff *skb, struct net *net,
@@ -1170,7 +1120,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
 		mtu = dst_metric_raw(dst, RTAX_MTU);
 
-	if (mtu)
+	if (mtu && rt_is_output_route(rt))
 		return mtu;
 
 	mtu = dst->dev->mtu;
diff --git a/trunk/net/ipv4/tcp_ipv4.c b/trunk/net/ipv4/tcp_ipv4.c
index 70b09ef2463b..54139fa514e6 100644
--- a/trunk/net/ipv4/tcp_ipv4.c
+++ b/trunk/net/ipv4/tcp_ipv4.c
@@ -369,10 +369,11 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 	 * We do take care of PMTU discovery (RFC1191) special case :
 	 * we can receive locally generated ICMP messages while socket is held.
 	 */
-	if (sock_owned_by_user(sk)) {
-		if (!(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED))
-			NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
-	}
+	if (sock_owned_by_user(sk) &&
+	    type != ICMP_DEST_UNREACH &&
+	    code != ICMP_FRAG_NEEDED)
+		NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
+
 	if (sk->sk_state == TCP_CLOSE)
 		goto out;
 
diff --git a/trunk/net/ipv4/udp.c b/trunk/net/ipv4/udp.c
index 1f4d405eafba..79c8dbe59b54 100644
--- a/trunk/net/ipv4/udp.c
+++ b/trunk/net/ipv4/udp.c
@@ -1952,7 +1952,6 @@ struct proto udp_prot = {
 	.recvmsg	   = udp_recvmsg,
 	.sendpage	   = udp_sendpage,
 	.backlog_rcv	   = __udp_queue_rcv_skb,
-	.release_cb	   = ip4_datagram_release_cb,
 	.hash		   = udp_lib_hash,
 	.unhash		   = udp_lib_unhash,
 	.rehash		   = udp_v4_rehash,
diff --git a/trunk/net/ipv6/ah6.c b/trunk/net/ipv6/ah6.c
index 384233188ac1..ecc35b93314b 100644
--- a/trunk/net/ipv6/ah6.c
+++ b/trunk/net/ipv6/ah6.c
@@ -472,10 +472,7 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
 	skb->network_header += ah_hlen;
 	memcpy(skb_network_header(skb), work_iph, hdr_len);
 	__skb_pull(skb, ah_hlen + hdr_len);
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -hdr_len);
+	skb_set_transport_header(skb, -hdr_len);
 out:
 	kfree(AH_SKB_CB(skb)->tmp);
 	xfrm_input_resume(skb, err);
@@ -596,13 +593,9 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 
 	skb->network_header += ah_hlen;
 	memcpy(skb_network_header(skb), work_iph, hdr_len);
+	skb->transport_header = skb->network_header;
 	__skb_pull(skb, ah_hlen + hdr_len);
 
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -hdr_len);
-
 	err = nexthdr;
 
 out_free:
diff --git a/trunk/net/ipv6/esp6.c b/trunk/net/ipv6/esp6.c
index 40ffd72243a4..282f3723ee19 100644
--- a/trunk/net/ipv6/esp6.c
+++ b/trunk/net/ipv6/esp6.c
@@ -300,10 +300,7 @@ static int esp_input_done2(struct sk_buff *skb, int err)
 
 	pskb_trim(skb, skb->len - alen - padlen - 2);
 	__skb_pull(skb, hlen);
-	if (x->props.mode == XFRM_MODE_TUNNEL)
-		skb_reset_transport_header(skb);
-	else
-		skb_set_transport_header(skb, -hdr_len);
+	skb_set_transport_header(skb, -hdr_len);
 
 	err = nexthdr[1];
 
diff --git a/trunk/net/ipv6/icmp.c b/trunk/net/ipv6/icmp.c
index fff5bdd8b680..b4a9fd51dae7 100644
--- a/trunk/net/ipv6/icmp.c
+++ b/trunk/net/ipv6/icmp.c
@@ -81,22 +81,10 @@ static inline struct sock *icmpv6_sk(struct net *net)
 	return net->ipv6.icmp_sk[smp_processor_id()];
 }
 
-static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
-		       u8 type, u8 code, int offset, __be32 info)
-{
-	struct net *net = dev_net(skb->dev);
-
-	if (type == ICMPV6_PKT_TOOBIG)
-		ip6_update_pmtu(skb, net, info, 0, 0);
-	else if (type == NDISC_REDIRECT)
-		ip6_redirect(skb, net, 0, 0);
-}
-
 static int icmpv6_rcv(struct sk_buff *skb);
 
 static const struct inet6_protocol icmpv6_protocol = {
 	.handler	=	icmpv6_rcv,
-	.err_handler	=	icmpv6_err,
 	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
 
diff --git a/trunk/net/ipv6/ip6_output.c b/trunk/net/ipv6/ip6_output.c
index 0c7c03d50dc0..5552d13ae92f 100644
--- a/trunk/net/ipv6/ip6_output.c
+++ b/trunk/net/ipv6/ip6_output.c
@@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
 		if (dst_allfrag(rt->dst.path))
 			cork->flags |= IPCORK_ALLFRAG;
 		cork->length = 0;
-		exthdrlen = (opt ? opt->opt_flen : 0);
+		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
 		length += exthdrlen;
 		transhdrlen += exthdrlen;
-		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
+		dst_exthdrlen = rt->dst.header_len;
 	} else {
 		rt = (struct rt6_info *)cork->dst;
 		fl6 = &inet->cork.fl.u.ip6;
diff --git a/trunk/net/ipv6/ip6mr.c b/trunk/net/ipv6/ip6mr.c
index 8fd154e5f079..26dcdec9e3a5 100644
--- a/trunk/net/ipv6/ip6mr.c
+++ b/trunk/net/ipv6/ip6mr.c
@@ -1710,9 +1710,6 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
 			return -EINVAL;
 		if (get_user(v, (u32 __user *)optval))
 			return -EFAULT;
-		/* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
-		if (v != RT_TABLE_DEFAULT && v >= 100000000)
-			return -EINVAL;
 		if (sk == mrt->mroute6_sk)
 			return -EBUSY;
 
diff --git a/trunk/net/mac80211/cfg.c b/trunk/net/mac80211/cfg.c
index 516fbc96feff..47e0aca614b7 100644
--- a/trunk/net/mac80211/cfg.c
+++ b/trunk/net/mac80211/cfg.c
@@ -164,17 +164,7 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
 			sta = sta_info_get(sdata, mac_addr);
 		else
 			sta = sta_info_get_bss(sdata, mac_addr);
-		/*
-		 * The ASSOC test makes sure the driver is ready to
-		 * receive the key. When wpa_supplicant has roamed
-		 * using FT, it attempts to set the key before
-		 * association has completed, this rejects that attempt
-		 * so it will set the key again after assocation.
-		 *
-		 * TODO: accept the key if we have a station entry and
-		 *       add it to the device after the station.
-		 */
-		if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
+		if (!sta) {
 			ieee80211_key_free(sdata->local, key);
 			err = -ENOENT;
 			goto out_unlock;
diff --git a/trunk/net/mac80211/ieee80211_i.h b/trunk/net/mac80211/ieee80211_i.h
index 2ed065c09562..8563b9a5cac3 100644
--- a/trunk/net/mac80211/ieee80211_i.h
+++ b/trunk/net/mac80211/ieee80211_i.h
@@ -1358,8 +1358,10 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sched_scan_stopped_work(struct work_struct *work);
 
 /* off-channel helpers */
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
-void ieee80211_offchannel_return(struct ieee80211_local *local);
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+				    bool offchannel_ps_enable);
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+				 bool offchannel_ps_disable);
 void ieee80211_roc_setup(struct ieee80211_local *local);
 void ieee80211_start_next_roc(struct ieee80211_local *local);
 void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
diff --git a/trunk/net/mac80211/mesh_hwmp.c b/trunk/net/mac80211/mesh_hwmp.c
index 2659e428b80c..47aeee2d8db1 100644
--- a/trunk/net/mac80211/mesh_hwmp.c
+++ b/trunk/net/mac80211/mesh_hwmp.c
@@ -215,7 +215,6 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
 	skb->priority = 7;
 
 	info->control.vif = &sdata->vif;
-	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
 	ieee80211_set_qos_hdr(sdata, skb);
 }
 
@@ -247,13 +246,11 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
 		return -EAGAIN;
 
 	skb = dev_alloc_skb(local->tx_headroom +
-			    IEEE80211_ENCRYPT_HEADROOM +
-			    IEEE80211_ENCRYPT_TAILROOM +
 			    hdr_len +
 			    2 + 15 /* PERR IE */);
 	if (!skb)
 		return -1;
-	skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
+	skb_reserve(skb, local->tx_headroom);
 	mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
 	memset(mgmt, 0, hdr_len);
 	mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/trunk/net/mac80211/offchannel.c b/trunk/net/mac80211/offchannel.c
index a3ad4c3c80a3..a5379aea7d09 100644
--- a/trunk/net/mac80211/offchannel.c
+++ b/trunk/net/mac80211/offchannel.c
@@ -102,7 +102,8 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
 	ieee80211_sta_reset_conn_monitor(sdata);
 }
 
-void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
+void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
+				    bool offchannel_ps_enable)
 {
 	struct ieee80211_sub_if_data *sdata;
 
@@ -133,7 +134,8 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 
 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
 			netif_tx_stop_all_queues(sdata->dev);
-			if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+			if (offchannel_ps_enable &&
+			    (sdata->vif.type == NL80211_IFTYPE_STATION) &&
 			    sdata->u.mgd.associated)
 				ieee80211_offchannel_ps_enable(sdata);
 		}
@@ -141,7 +143,8 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
 	mutex_unlock(&local->iflist_mtx);
 }
 
-void ieee80211_offchannel_return(struct ieee80211_local *local)
+void ieee80211_offchannel_return(struct ieee80211_local *local,
+				 bool offchannel_ps_disable)
 {
 	struct ieee80211_sub_if_data *sdata;
 
@@ -160,9 +163,11 @@ void ieee80211_offchannel_return(struct ieee80211_local *local)
 			continue;
 
 		/* Tell AP we're back */
-		if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-		    sdata->u.mgd.associated)
-			ieee80211_offchannel_ps_disable(sdata);
+		if (offchannel_ps_disable &&
+		    sdata->vif.type == NL80211_IFTYPE_STATION) {
+			if (sdata->u.mgd.associated)
+				ieee80211_offchannel_ps_disable(sdata);
+		}
 
 		if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
 			/*
@@ -380,7 +385,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
 			local->tmp_channel = NULL;
 			ieee80211_hw_config(local, 0);
 
-			ieee80211_offchannel_return(local);
+			ieee80211_offchannel_return(local, true);
 		}
 
 		ieee80211_recalc_idle(local);
diff --git a/trunk/net/mac80211/scan.c b/trunk/net/mac80211/scan.c
index bf82e69d0601..d59fc6818b1c 100644
--- a/trunk/net/mac80211/scan.c
+++ b/trunk/net/mac80211/scan.c
@@ -292,7 +292,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
 	if (!was_hw_scan) {
 		ieee80211_configure_filter(local);
 		drv_sw_scan_complete(local);
-		ieee80211_offchannel_return(local);
+		ieee80211_offchannel_return(local, true);
 	}
 
 	ieee80211_recalc_idle(local);
@@ -341,7 +341,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
 	local->next_scan_state = SCAN_DECISION;
 	local->scan_channel_idx = 0;
 
-	ieee80211_offchannel_stop_vifs(local);
+	ieee80211_offchannel_stop_vifs(local, true);
 
 	ieee80211_configure_filter(local);
 
@@ -678,8 +678,12 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
 	local->scan_channel = NULL;
 	ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
-	/* disable PS */
-	ieee80211_offchannel_return(local);
+	/*
+	 * Re-enable vifs and beaconing.  Leave PS
+	 * in off-channel state..will put that back
+	 * on-channel at the end of scanning.
+	 */
+	ieee80211_offchannel_return(local, false);
 
 	*next_delay = HZ / 5;
 	/* afterwards, resume scan & go to next channel */
@@ -689,7 +693,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
 static void ieee80211_scan_state_resume(struct ieee80211_local *local,
 					unsigned long *next_delay)
 {
-	ieee80211_offchannel_stop_vifs(local);
+	/* PS already is in off-channel mode */
+	ieee80211_offchannel_stop_vifs(local, false);
 
 	if (local->ops->flush) {
 		drv_flush(local, false);
diff --git a/trunk/net/mac80211/tx.c b/trunk/net/mac80211/tx.c
index 467c1d1b66f2..e9eadc40c09c 100644
--- a/trunk/net/mac80211/tx.c
+++ b/trunk/net/mac80211/tx.c
@@ -1673,14 +1673,11 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
 			chanctx_conf =
 				rcu_dereference(tmp_sdata->vif.chanctx_conf);
 	}
-
-	if (chanctx_conf)
-		chan = chanctx_conf->def.chan;
-	else if (!local->use_chanctx)
-		chan = local->_oper_channel;
-	else
+	if (!chanctx_conf)
 		goto fail_rcu;
 
+	chan = chanctx_conf->def.chan;
+
 	/*
 	 * Frame injection is not allowed if beaconing is not allowed
 	 * or if we need radar detection. Beaconing is usually not allowed when
diff --git a/trunk/net/netfilter/nf_conntrack_core.c b/trunk/net/netfilter/nf_conntrack_core.c
index e4a0c4fb3a7c..016d95ead930 100644
--- a/trunk/net/netfilter/nf_conntrack_core.c
+++ b/trunk/net/netfilter/nf_conntrack_core.c
@@ -1376,12 +1376,11 @@ void nf_conntrack_cleanup(struct net *net)
 	synchronize_net();
 	nf_conntrack_proto_fini(net);
 	nf_conntrack_cleanup_net(net);
-}
 
-void nf_conntrack_cleanup_end(void)
-{
-	RCU_INIT_POINTER(nf_ct_destroy, NULL);
-	nf_conntrack_cleanup_init_net();
+	if (net_eq(net, &init_net)) {
+		RCU_INIT_POINTER(nf_ct_destroy, NULL);
+		nf_conntrack_cleanup_init_net();
+	}
 }
 
 void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
diff --git a/trunk/net/netfilter/nf_conntrack_standalone.c b/trunk/net/netfilter/nf_conntrack_standalone.c
index e7185c684816..363285d544a1 100644
--- a/trunk/net/netfilter/nf_conntrack_standalone.c
+++ b/trunk/net/netfilter/nf_conntrack_standalone.c
@@ -575,7 +575,6 @@ static int __init nf_conntrack_standalone_init(void)
 static void __exit nf_conntrack_standalone_fini(void)
 {
 	unregister_pernet_subsys(&nf_conntrack_net_ops);
-	nf_conntrack_cleanup_end();
 }
 
 module_init(nf_conntrack_standalone_init);
diff --git a/trunk/net/netfilter/x_tables.c b/trunk/net/netfilter/x_tables.c
index 7b3a9e5999c0..8d987c3573fd 100644
--- a/trunk/net/netfilter/x_tables.c
+++ b/trunk/net/netfilter/x_tables.c
@@ -345,27 +345,19 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target,
 }
 EXPORT_SYMBOL_GPL(xt_find_revision);
 
-static char *
-textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
+static char *textify_hooks(char *buf, size_t size, unsigned int mask)
 {
-	static const char *const inetbr_names[] = {
+	static const char *const names[] = {
 		"PREROUTING", "INPUT", "FORWARD",
 		"OUTPUT", "POSTROUTING", "BROUTING",
 	};
-	static const char *const arp_names[] = {
-		"INPUT", "FORWARD", "OUTPUT",
-	};
-	const char *const *names;
-	unsigned int i, max;
+	unsigned int i;
 	char *p = buf;
 	bool np = false;
 	int res;
 
-	names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names;
-	max   = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) :
-	                                   ARRAY_SIZE(inetbr_names);
 	*p = '\0';
-	for (i = 0; i < max; ++i) {
+	for (i = 0; i < ARRAY_SIZE(names); ++i) {
 		if (!(mask & (1 << i)))
 			continue;
 		res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
@@ -410,10 +402,8 @@ int xt_check_match(struct xt_mtchk_param *par,
 		pr_err("%s_tables: %s match: used from hooks %s, but only "
 		       "valid from %s\n",
 		       xt_prefix[par->family], par->match->name,
-		       textify_hooks(used, sizeof(used), par->hook_mask,
-		                     par->family),
-		       textify_hooks(allow, sizeof(allow), par->match->hooks,
-		                     par->family));
+		       textify_hooks(used, sizeof(used), par->hook_mask),
+		       textify_hooks(allow, sizeof(allow), par->match->hooks));
 		return -EINVAL;
 	}
 	if (par->match->proto && (par->match->proto != proto || inv_proto)) {
@@ -585,10 +575,8 @@ int xt_check_target(struct xt_tgchk_param *par,
 		pr_err("%s_tables: %s target: used from hooks %s, but only "
 		       "usable from %s\n",
 		       xt_prefix[par->family], par->target->name,
-		       textify_hooks(used, sizeof(used), par->hook_mask,
-		                     par->family),
-		       textify_hooks(allow, sizeof(allow), par->target->hooks,
-		                     par->family));
+		       textify_hooks(used, sizeof(used), par->hook_mask),
+		       textify_hooks(allow, sizeof(allow), par->target->hooks));
 		return -EINVAL;
 	}
 	if (par->target->proto && (par->target->proto != proto || inv_proto)) {
diff --git a/trunk/net/netfilter/xt_CT.c b/trunk/net/netfilter/xt_CT.c
index bde009ed8d3b..2a0843081840 100644
--- a/trunk/net/netfilter/xt_CT.c
+++ b/trunk/net/netfilter/xt_CT.c
@@ -109,7 +109,7 @@ static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
 	struct xt_ct_target_info *info = par->targinfo;
 	struct nf_conntrack_tuple t;
 	struct nf_conn *ct;
-	int ret = -EOPNOTSUPP;
+	int ret;
 
 	if (info->flags & ~XT_CT_NOTRACK)
 		return -EINVAL;
@@ -247,7 +247,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 	struct xt_ct_target_info_v1 *info = par->targinfo;
 	struct nf_conntrack_tuple t;
 	struct nf_conn *ct;
-	int ret = -EOPNOTSUPP;
+	int ret;
 
 	if (info->flags & ~XT_CT_NOTRACK)
 		return -EINVAL;
diff --git a/trunk/net/sctp/outqueue.c b/trunk/net/sctp/outqueue.c
index 9bcdbd02d777..379c81dee9d1 100644
--- a/trunk/net/sctp/outqueue.c
+++ b/trunk/net/sctp/outqueue.c
@@ -224,7 +224,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
 
 /* Free the outqueue structure and any related pending chunks.
  */
-static void __sctp_outq_teardown(struct sctp_outq *q)
+void sctp_outq_teardown(struct sctp_outq *q)
 {
 	struct sctp_transport *transport;
 	struct list_head *lchunk, *temp;
@@ -277,6 +277,8 @@ static void __sctp_outq_teardown(struct sctp_outq *q)
 		sctp_chunk_free(chunk);
 	}
 
+	q->error = 0;
+
 	/* Throw away any leftover control chunks. */
 	list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
 		list_del_init(&chunk->list);
@@ -284,17 +286,11 @@ static void __sctp_outq_teardown(struct sctp_outq *q)
 	}
 }
 
-void sctp_outq_teardown(struct sctp_outq *q)
-{
-	__sctp_outq_teardown(q);
-	sctp_outq_init(q->asoc, q);
-}
-
 /* Free the outqueue structure and any related pending chunks.  */
 void sctp_outq_free(struct sctp_outq *q)
 {
 	/* Throw away leftover chunks. */
-	__sctp_outq_teardown(q);
+	sctp_outq_teardown(q);
 
 	/* If we were kmalloc()'d, free the memory.  */
 	if (q->malloced)
diff --git a/trunk/net/sctp/sm_statefuns.c b/trunk/net/sctp/sm_statefuns.c
index 5131fcfedb03..618ec7e216ca 100644
--- a/trunk/net/sctp/sm_statefuns.c
+++ b/trunk/net/sctp/sm_statefuns.c
@@ -1779,10 +1779,8 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
 
 	/* Update the content of current association. */
 	sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
-	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
-	sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
-			SCTP_STATE(SCTP_STATE_ESTABLISHED));
 	sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
+	sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
 	return SCTP_DISPOSITION_CONSUME;
 
 nomem_ev:
diff --git a/trunk/net/sctp/sysctl.c b/trunk/net/sctp/sysctl.c
index bf3c6e8fc401..043889ac86c0 100644
--- a/trunk/net/sctp/sysctl.c
+++ b/trunk/net/sctp/sysctl.c
@@ -366,11 +366,7 @@ int sctp_sysctl_net_register(struct net *net)
 
 void sctp_sysctl_net_unregister(struct net *net)
 {
-	struct ctl_table *table;
-
-	table = net->sctp.sysctl_header->ctl_table_arg;
 	unregister_net_sysctl_table(net->sctp.sysctl_header);
-	kfree(table);
 }
 
 static struct ctl_table_header * sctp_sysctl_header;
diff --git a/trunk/net/sunrpc/sched.c b/trunk/net/sunrpc/sched.c
index fb20f25ddec9..bfa31714581f 100644
--- a/trunk/net/sunrpc/sched.c
+++ b/trunk/net/sunrpc/sched.c
@@ -98,25 +98,9 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task)
 	list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list);
 }
 
-static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue)
-{
-	struct list_head *q = &queue->tasks[queue->priority];
-	struct rpc_task *task;
-
-	if (!list_empty(q)) {
-		task = list_first_entry(q, struct rpc_task, u.tk_wait.list);
-		if (task->tk_owner == queue->owner)
-			list_move_tail(&task->u.tk_wait.list, q);
-	}
-}
-
 static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority)
 {
-	if (queue->priority != priority) {
-		/* Fairness: rotate the list when changing priority */
-		rpc_rotate_queue_owner(queue);
-		queue->priority = priority;
-	}
+	queue->priority = priority;
 }
 
 static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid)
diff --git a/trunk/net/xfrm/xfrm_policy.c b/trunk/net/xfrm/xfrm_policy.c
index 07c585756d2a..41eabc46f110 100644
--- a/trunk/net/xfrm/xfrm_policy.c
+++ b/trunk/net/xfrm/xfrm_policy.c
@@ -2656,7 +2656,7 @@ static void xfrm_policy_fini(struct net *net)
 		WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
 
 		htab = &net->xfrm.policy_bydst[dir];
-		sz = (htab->hmask + 1) * sizeof(struct hlist_head);
+		sz = (htab->hmask + 1);
 		WARN_ON(!hlist_empty(htab->table));
 		xfrm_hash_free(htab->table, sz);
 	}
diff --git a/trunk/net/xfrm/xfrm_replay.c b/trunk/net/xfrm/xfrm_replay.c
index 35754cc8a9e5..765f6fe951eb 100644
--- a/trunk/net/xfrm/xfrm_replay.c
+++ b/trunk/net/xfrm/xfrm_replay.c
@@ -242,13 +242,11 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
 	u32 diff;
 	struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
 	u32 seq = ntohl(net_seq);
-	u32 pos;
+	u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
 
 	if (!replay_esn->replay_window)
 		return;
 
-	pos = (replay_esn->seq - 1) % replay_esn->replay_window;
-
 	if (seq > replay_esn->seq) {
 		diff = seq - replay_esn->seq;
 
diff --git a/trunk/security/capability.c b/trunk/security/capability.c
index 579775088967..0fe5a026aef8 100644
--- a/trunk/security/capability.c
+++ b/trunk/security/capability.c
@@ -709,31 +709,16 @@ static void cap_req_classify_flow(const struct request_sock *req,
 {
 }
 
-static int cap_tun_dev_alloc_security(void **security)
-{
-	return 0;
-}
-
-static void cap_tun_dev_free_security(void *security)
-{
-}
-
 static int cap_tun_dev_create(void)
 {
 	return 0;
 }
 
-static int cap_tun_dev_attach_queue(void *security)
-{
-	return 0;
-}
-
-static int cap_tun_dev_attach(struct sock *sk, void *security)
+static void cap_tun_dev_post_create(struct sock *sk)
 {
-	return 0;
 }
 
-static int cap_tun_dev_open(void *security)
+static int cap_tun_dev_attach(struct sock *sk)
 {
 	return 0;
 }
@@ -1065,11 +1050,8 @@ void __init security_fixup_ops(struct security_operations *ops)
 	set_to_cap_if_null(ops, secmark_refcount_inc);
 	set_to_cap_if_null(ops, secmark_refcount_dec);
 	set_to_cap_if_null(ops, req_classify_flow);
-	set_to_cap_if_null(ops, tun_dev_alloc_security);
-	set_to_cap_if_null(ops, tun_dev_free_security);
 	set_to_cap_if_null(ops, tun_dev_create);
-	set_to_cap_if_null(ops, tun_dev_open);
-	set_to_cap_if_null(ops, tun_dev_attach_queue);
+	set_to_cap_if_null(ops, tun_dev_post_create);
 	set_to_cap_if_null(ops, tun_dev_attach);
 #endif	/* CONFIG_SECURITY_NETWORK */
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/trunk/security/security.c b/trunk/security/security.c
index 7b88c6aeaed4..daa97f4ac9d1 100644
--- a/trunk/security/security.c
+++ b/trunk/security/security.c
@@ -1254,42 +1254,24 @@ void security_secmark_refcount_dec(void)
 }
 EXPORT_SYMBOL(security_secmark_refcount_dec);
 
-int security_tun_dev_alloc_security(void **security)
-{
-	return security_ops->tun_dev_alloc_security(security);
-}
-EXPORT_SYMBOL(security_tun_dev_alloc_security);
-
-void security_tun_dev_free_security(void *security)
-{
-	security_ops->tun_dev_free_security(security);
-}
-EXPORT_SYMBOL(security_tun_dev_free_security);
-
 int security_tun_dev_create(void)
 {
 	return security_ops->tun_dev_create();
 }
 EXPORT_SYMBOL(security_tun_dev_create);
 
-int security_tun_dev_attach_queue(void *security)
+void security_tun_dev_post_create(struct sock *sk)
 {
-	return security_ops->tun_dev_attach_queue(security);
+	return security_ops->tun_dev_post_create(sk);
 }
-EXPORT_SYMBOL(security_tun_dev_attach_queue);
+EXPORT_SYMBOL(security_tun_dev_post_create);
 
-int security_tun_dev_attach(struct sock *sk, void *security)
+int security_tun_dev_attach(struct sock *sk)
 {
-	return security_ops->tun_dev_attach(sk, security);
+	return security_ops->tun_dev_attach(sk);
 }
 EXPORT_SYMBOL(security_tun_dev_attach);
 
-int security_tun_dev_open(void *security)
-{
-	return security_ops->tun_dev_open(security);
-}
-EXPORT_SYMBOL(security_tun_dev_open);
-
 #endif	/* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
diff --git a/trunk/security/selinux/hooks.c b/trunk/security/selinux/hooks.c
index ef26e9611ffb..61a53367d029 100644
--- a/trunk/security/selinux/hooks.c
+++ b/trunk/security/selinux/hooks.c
@@ -4399,24 +4399,6 @@ static void selinux_req_classify_flow(const struct request_sock *req,
 	fl->flowi_secid = req->secid;
 }
 
-static int selinux_tun_dev_alloc_security(void **security)
-{
-	struct tun_security_struct *tunsec;
-
-	tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
-	if (!tunsec)
-		return -ENOMEM;
-	tunsec->sid = current_sid();
-
-	*security = tunsec;
-	return 0;
-}
-
-static void selinux_tun_dev_free_security(void *security)
-{
-	kfree(security);
-}
-
 static int selinux_tun_dev_create(void)
 {
 	u32 sid = current_sid();
@@ -4432,17 +4414,8 @@ static int selinux_tun_dev_create(void)
 			    NULL);
 }
 
-static int selinux_tun_dev_attach_queue(void *security)
+static void selinux_tun_dev_post_create(struct sock *sk)
 {
-	struct tun_security_struct *tunsec = security;
-
-	return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
-			    TUN_SOCKET__ATTACH_QUEUE, NULL);
-}
-
-static int selinux_tun_dev_attach(struct sock *sk, void *security)
-{
-	struct tun_security_struct *tunsec = security;
 	struct sk_security_struct *sksec = sk->sk_security;
 
 	/* we don't currently perform any NetLabel based labeling here and it
@@ -4452,19 +4425,20 @@ static int selinux_tun_dev_attach(struct sock *sk, void *security)
 	 * cause confusion to the TUN user that had no idea network labeling
 	 * protocols were being used */
 
-	sksec->sid = tunsec->sid;
-	sksec->sclass = SECCLASS_TUN_SOCKET;
+	/* see the comments in selinux_tun_dev_create() about why we don't use
+	 * the sockcreate SID here */
 
-	return 0;
+	sksec->sid = current_sid();
+	sksec->sclass = SECCLASS_TUN_SOCKET;
 }
 
-static int selinux_tun_dev_open(void *security)
+static int selinux_tun_dev_attach(struct sock *sk)
 {
-	struct tun_security_struct *tunsec = security;
+	struct sk_security_struct *sksec = sk->sk_security;
 	u32 sid = current_sid();
 	int err;
 
-	err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
+	err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
 			   TUN_SOCKET__RELABELFROM, NULL);
 	if (err)
 		return err;
@@ -4472,7 +4446,8 @@ static int selinux_tun_dev_open(void *security)
 			   TUN_SOCKET__RELABELTO, NULL);
 	if (err)
 		return err;
-	tunsec->sid = sid;
+
+	sksec->sid = sid;
 
 	return 0;
 }
@@ -5667,12 +5642,9 @@ static struct security_operations selinux_ops = {
 	.secmark_refcount_inc =		selinux_secmark_refcount_inc,
 	.secmark_refcount_dec =		selinux_secmark_refcount_dec,
 	.req_classify_flow =		selinux_req_classify_flow,
-	.tun_dev_alloc_security =	selinux_tun_dev_alloc_security,
-	.tun_dev_free_security =	selinux_tun_dev_free_security,
 	.tun_dev_create =		selinux_tun_dev_create,
-	.tun_dev_attach_queue =		selinux_tun_dev_attach_queue,
+	.tun_dev_post_create = 		selinux_tun_dev_post_create,
 	.tun_dev_attach =		selinux_tun_dev_attach,
-	.tun_dev_open =			selinux_tun_dev_open,
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 	.xfrm_policy_alloc_security =	selinux_xfrm_policy_alloc,
diff --git a/trunk/security/selinux/include/classmap.h b/trunk/security/selinux/include/classmap.h
index 14d04e63b1f0..df2de54a958d 100644
--- a/trunk/security/selinux/include/classmap.h
+++ b/trunk/security/selinux/include/classmap.h
@@ -150,6 +150,6 @@ struct security_class_mapping secclass_map[] = {
 	    NULL } },
 	{ "kernel_service", { "use_as_override", "create_files_as", NULL } },
 	{ "tun_socket",
-	  { COMMON_SOCK_PERMS, "attach_queue", NULL } },
+	  { COMMON_SOCK_PERMS, NULL } },
 	{ NULL }
   };
diff --git a/trunk/security/selinux/include/objsec.h b/trunk/security/selinux/include/objsec.h
index aa47bcabb5f6..26c7eee1c309 100644
--- a/trunk/security/selinux/include/objsec.h
+++ b/trunk/security/selinux/include/objsec.h
@@ -110,10 +110,6 @@ struct sk_security_struct {
 	u16 sclass;			/* sock security class */
 };
 
-struct tun_security_struct {
-	u32 sid;			/* SID for the tun device sockets */
-};
-
 struct key_security_struct {
 	u32 sid;	/* SID of key */
 };
diff --git a/trunk/sound/pci/hda/hda_intel.c b/trunk/sound/pci/hda/hda_intel.c
index c78286f6e5d8..0b6aebacc56b 100644
--- a/trunk/sound/pci/hda/hda_intel.c
+++ b/trunk/sound/pci/hda/hda_intel.c
@@ -656,43 +656,29 @@ static char *driver_short_names[] = {
 #define get_azx_dev(substream) (substream->runtime->private_data)
 
 #ifdef CONFIG_X86
-static void __mark_pages_wc(struct azx *chip, struct snd_dma_buffer *dmab, bool on)
+static void __mark_pages_wc(struct azx *chip, void *addr, size_t size, bool on)
 {
-	int pages;
-
 	if (azx_snoop(chip))
 		return;
-	if (!dmab || !dmab->area || !dmab->bytes)
-		return;
-
-#ifdef CONFIG_SND_DMA_SGBUF
-	if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) {
-		struct snd_sg_buf *sgbuf = dmab->private_data;
+	if (addr && size) {
+		int pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 		if (on)
-			set_pages_array_wc(sgbuf->page_table, sgbuf->pages);
+			set_memory_wc((unsigned long)addr, pages);
 		else
-			set_pages_array_wb(sgbuf->page_table, sgbuf->pages);
-		return;
+			set_memory_wb((unsigned long)addr, pages);
 	}
-#endif
-
-	pages = (dmab->bytes + PAGE_SIZE - 1) >> PAGE_SHIFT;
-	if (on)
-		set_memory_wc((unsigned long)dmab->area, pages);
-	else
-		set_memory_wb((unsigned long)dmab->area, pages);
 }
 
 static inline void mark_pages_wc(struct azx *chip, struct snd_dma_buffer *buf,
 				 bool on)
 {
-	__mark_pages_wc(chip, buf, on);
+	__mark_pages_wc(chip, buf->area, buf->bytes, on);
 }
 static inline void mark_runtime_wc(struct azx *chip, struct azx_dev *azx_dev,
-				   struct snd_pcm_substream *substream, bool on)
+				   struct snd_pcm_runtime *runtime, bool on)
 {
 	if (azx_dev->wc_marked != on) {
-		__mark_pages_wc(chip, snd_pcm_get_dma_buf(substream), on);
+		__mark_pages_wc(chip, runtime->dma_area, runtime->dma_bytes, on);
 		azx_dev->wc_marked = on;
 	}
 }
@@ -703,7 +689,7 @@ static inline void mark_pages_wc(struct azx *chip, struct snd_dma_buffer *buf,
 {
 }
 static inline void mark_runtime_wc(struct azx *chip, struct azx_dev *azx_dev,
-				   struct snd_pcm_substream *substream, bool on)
+				   struct snd_pcm_runtime *runtime, bool on)
 {
 }
 #endif
@@ -1982,10 +1968,11 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
 {
 	struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
 	struct azx *chip = apcm->chip;
+	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct azx_dev *azx_dev = get_azx_dev(substream);
 	int ret;
 
-	mark_runtime_wc(chip, azx_dev, substream, false);
+	mark_runtime_wc(chip, azx_dev, runtime, false);
 	azx_dev->bufsize = 0;
 	azx_dev->period_bytes = 0;
 	azx_dev->format_val = 0;
@@ -1993,7 +1980,7 @@ static int azx_pcm_hw_params(struct snd_pcm_substream *substream,
 					params_buffer_bytes(hw_params));
 	if (ret < 0)
 		return ret;
-	mark_runtime_wc(chip, azx_dev, substream, true);
+	mark_runtime_wc(chip, azx_dev, runtime, true);
 	return ret;
 }
 
@@ -2002,6 +1989,7 @@ static int azx_pcm_hw_free(struct snd_pcm_substream *substream)
 	struct azx_pcm *apcm = snd_pcm_substream_chip(substream);
 	struct azx_dev *azx_dev = get_azx_dev(substream);
 	struct azx *chip = apcm->chip;
+	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct hda_pcm_stream *hinfo = apcm->hinfo[substream->stream];
 
 	/* reset BDL address */
@@ -2014,7 +2002,7 @@ static int azx_pcm_hw_free(struct snd_pcm_substream *substream)
 
 	snd_hda_codec_cleanup(apcm->codec, hinfo, substream);
 
-	mark_runtime_wc(chip, azx_dev, substream, false);
+	mark_runtime_wc(chip, azx_dev, runtime, false);
 	return snd_pcm_lib_free_pages(substream);
 }
 
@@ -3625,12 +3613,13 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
 	/* 5 Series/3400 */
 	{ PCI_DEVICE(0x8086, 0x3b56),
 	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH },
-	/* Poulsbo */
+	/* SCH */
 	{ PCI_DEVICE(0x8086, 0x811b),
-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
-	/* Oaktrail */
+	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
+	  AZX_DCAPS_BUFSIZE | AZX_DCAPS_POSFIX_LPIB }, /* Poulsbo */
 	{ PCI_DEVICE(0x8086, 0x080a),
-	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM },
+	  .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
+	  AZX_DCAPS_BUFSIZE | AZX_DCAPS_POSFIX_LPIB }, /* Oaktrail */
 	/* ICH */
 	{ PCI_DEVICE(0x8086, 0x2668),
 	  .driver_data = AZX_DRIVER_ICH | AZX_DCAPS_OLD_SSYNC |
diff --git a/trunk/sound/pci/hda/patch_realtek.c b/trunk/sound/pci/hda/patch_realtek.c
index 5faaad219a7f..cf3886171109 100644
--- a/trunk/sound/pci/hda/patch_realtek.c
+++ b/trunk/sound/pci/hda/patch_realtek.c
@@ -4694,7 +4694,6 @@ static const struct snd_pci_quirk alc880_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1584, 0x9077, "Uniwill P53", ALC880_FIXUP_VOL_KNOB),
 	SND_PCI_QUIRK(0x161f, 0x203d, "W810", ALC880_FIXUP_W810),
 	SND_PCI_QUIRK(0x161f, 0x205d, "Medion Rim 2150", ALC880_FIXUP_MEDION_RIM),
-	SND_PCI_QUIRK(0x1631, 0xe011, "PB 13201056", ALC880_FIXUP_6ST),
 	SND_PCI_QUIRK(0x1734, 0x107c, "FSC F1734", ALC880_FIXUP_F1734),
 	SND_PCI_QUIRK(0x1734, 0x1094, "FSC Amilo M1451G", ALC880_FIXUP_FUJITSU),
 	SND_PCI_QUIRK(0x1734, 0x10ac, "FSC AMILO Xi 1526", ALC880_FIXUP_F1734),
@@ -5709,7 +5708,6 @@ static const struct alc_model_fixup alc268_fixup_models[] = {
 };
 
 static const struct snd_pci_quirk alc268_fixup_tbl[] = {
-	SND_PCI_QUIRK(0x1025, 0x015b, "Acer AOA 150 (ZG5)", ALC268_FIXUP_INV_DMIC),
 	/* below is codec SSID since multiple Toshiba laptops have the
 	 * same PCI SSID 1179:ff00
 	 */
diff --git a/trunk/sound/soc/codecs/arizona.c b/trunk/sound/soc/codecs/arizona.c
index ef62c435848e..1d8bb5917594 100644
--- a/trunk/sound/soc/codecs/arizona.c
+++ b/trunk/sound/soc/codecs/arizona.c
@@ -685,7 +685,7 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
 	}
 	sr_val = i;
 
-	lrclk = rates[bclk] / params_rate(params);
+	lrclk = snd_soc_params_to_bclk(params) / params_rate(params);
 
 	arizona_aif_dbg(dai, "BCLK %dHz LRCLK %dHz\n",
 			rates[bclk], rates[bclk] / lrclk);
@@ -1082,9 +1082,6 @@ int arizona_init_fll(struct arizona *arizona, int id, int base, int lock_irq,
 			id, ret);
 	}
 
-	regmap_update_bits(arizona->regmap, fll->base + 1,
-			   ARIZONA_FLL1_FREERUN, 0);
-
 	return 0;
 }
 EXPORT_SYMBOL_GPL(arizona_init_fll);
diff --git a/trunk/sound/soc/codecs/wm2200.c b/trunk/sound/soc/codecs/wm2200.c
index d8c65f574658..e6cefe1ac677 100644
--- a/trunk/sound/soc/codecs/wm2200.c
+++ b/trunk/sound/soc/codecs/wm2200.c
@@ -1019,6 +1019,8 @@ static const char *wm2200_mixer_texts[] = {
 	"EQR",
 	"LHPF1",
 	"LHPF2",
+	"LHPF3",
+	"LHPF4",
 	"DSP1.1",
 	"DSP1.2",
 	"DSP1.3",
@@ -1051,6 +1053,7 @@ static int wm2200_mixer_values[] = {
 	0x25,
 	0x50,   /* EQ */
 	0x51,
+	0x52,
 	0x60,   /* LHPF1 */
 	0x61,   /* LHPF2 */
 	0x68,   /* DSP1 */
diff --git a/trunk/sound/soc/codecs/wm5102.c b/trunk/sound/soc/codecs/wm5102.c
index 1440b3f9b7bb..7a9048dad1cd 100644
--- a/trunk/sound/soc/codecs/wm5102.c
+++ b/trunk/sound/soc/codecs/wm5102.c
@@ -896,7 +896,8 @@ static const unsigned int wm5102_aec_loopback_values[] = {
 
 static const struct soc_enum wm5102_aec_loopback =
 	SOC_VALUE_ENUM_SINGLE(ARIZONA_DAC_AEC_CONTROL_1,
-			      ARIZONA_AEC_LOOPBACK_SRC_SHIFT, 0xf,
+			      ARIZONA_AEC_LOOPBACK_SRC_SHIFT,
+			      ARIZONA_AEC_LOOPBACK_SRC_MASK,
 			      ARRAY_SIZE(wm5102_aec_loopback_texts),
 			      wm5102_aec_loopback_texts,
 			      wm5102_aec_loopback_values);
diff --git a/trunk/sound/soc/codecs/wm5110.c b/trunk/sound/soc/codecs/wm5110.c
index 7a090968c4f7..ae80c8c28536 100644
--- a/trunk/sound/soc/codecs/wm5110.c
+++ b/trunk/sound/soc/codecs/wm5110.c
@@ -344,7 +344,8 @@ static const unsigned int wm5110_aec_loopback_values[] = {
 
 static const struct soc_enum wm5110_aec_loopback =
 	SOC_VALUE_ENUM_SINGLE(ARIZONA_DAC_AEC_CONTROL_1,
-			      ARIZONA_AEC_LOOPBACK_SRC_SHIFT, 0xf,
+			      ARIZONA_AEC_LOOPBACK_SRC_SHIFT,
+			      ARIZONA_AEC_LOOPBACK_SRC_MASK,
 			      ARRAY_SIZE(wm5110_aec_loopback_texts),
 			      wm5110_aec_loopback_texts,
 			      wm5110_aec_loopback_values);
diff --git a/trunk/sound/soc/codecs/wm_adsp.c b/trunk/sound/soc/codecs/wm_adsp.c
index b6b654837585..7b198c38f3ef 100644
--- a/trunk/sound/soc/codecs/wm_adsp.c
+++ b/trunk/sound/soc/codecs/wm_adsp.c
@@ -324,7 +324,7 @@ static int wm_adsp_load(struct wm_adsp *dsp)
 
 		if (reg) {
 			buf = kmemdup(region->data, le32_to_cpu(region->len),
-				      GFP_KERNEL | GFP_DMA);
+				      GFP_KERNEL);
 			if (!buf) {
 				adsp_err(dsp, "Out of memory\n");
 				return -ENOMEM;
@@ -396,7 +396,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
 	hdr = (void*)&firmware->data[0];
 	if (memcmp(hdr->magic, "WMDR", 4) != 0) {
 		adsp_err(dsp, "%s: invalid magic\n", file);
-		goto out_fw;
+		return -EINVAL;
 	}
 
 	adsp_dbg(dsp, "%s: v%d.%d.%d\n", file,
@@ -439,7 +439,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
 
 		if (reg) {
 			buf = kmemdup(blk->data, le32_to_cpu(blk->len),
-				      GFP_KERNEL | GFP_DMA);
+				      GFP_KERNEL);
 			if (!buf) {
 				adsp_err(dsp, "Out of memory\n");
 				return -ENOMEM;
diff --git a/trunk/sound/soc/fsl/Kconfig b/trunk/sound/soc/fsl/Kconfig
index a210c8d7b4bc..3b98159d9645 100644
--- a/trunk/sound/soc/fsl/Kconfig
+++ b/trunk/sound/soc/fsl/Kconfig
@@ -108,13 +108,18 @@ if SND_IMX_SOC
 config SND_SOC_IMX_SSI
 	tristate
 
-config SND_SOC_IMX_PCM_FIQ
+config SND_SOC_IMX_PCM
 	tristate
+
+config SND_SOC_IMX_PCM_FIQ
+	bool
 	select FIQ
+	select SND_SOC_IMX_PCM
 
 config SND_SOC_IMX_PCM_DMA
-	tristate
+	bool
 	select SND_SOC_DMAENGINE_PCM
+	select SND_SOC_IMX_PCM
 
 config SND_SOC_IMX_AUDMUX
 	tristate
diff --git a/trunk/sound/soc/fsl/Makefile b/trunk/sound/soc/fsl/Makefile
index ec1457915d7c..afd34794db53 100644
--- a/trunk/sound/soc/fsl/Makefile
+++ b/trunk/sound/soc/fsl/Makefile
@@ -41,10 +41,7 @@ endif
 obj-$(CONFIG_SND_SOC_IMX_SSI) += snd-soc-imx-ssi.o
 obj-$(CONFIG_SND_SOC_IMX_AUDMUX) += snd-soc-imx-audmux.o
 
-obj-$(CONFIG_SND_SOC_IMX_PCM_FIQ) += snd-soc-imx-pcm-fiq.o
-snd-soc-imx-pcm-fiq-y := imx-pcm-fiq.o imx-pcm.o
-obj-$(CONFIG_SND_SOC_IMX_PCM_DMA) += snd-soc-imx-pcm-dma.o
-snd-soc-imx-pcm-dma-y := imx-pcm-dma.o imx-pcm.o
+obj-$(CONFIG_SND_SOC_IMX_PCM) += snd-soc-imx-pcm.o
 
 # i.MX Machine Support
 snd-soc-eukrea-tlv320-objs := eukrea-tlv320.o
diff --git a/trunk/sound/soc/fsl/imx-pcm.c b/trunk/sound/soc/fsl/imx-pcm.c
index 0c9f188ddc68..d5cd9eff3b48 100644
--- a/trunk/sound/soc/fsl/imx-pcm.c
+++ b/trunk/sound/soc/fsl/imx-pcm.c
@@ -31,6 +31,7 @@ int snd_imx_pcm_mmap(struct snd_pcm_substream *substream,
 			runtime->dma_bytes);
 	return ret;
 }
+EXPORT_SYMBOL_GPL(snd_imx_pcm_mmap);
 
 static int imx_pcm_preallocate_dma_buffer(struct snd_pcm *pcm, int stream)
 {
@@ -79,6 +80,7 @@ int imx_pcm_new(struct snd_soc_pcm_runtime *rtd)
 out:
 	return ret;
 }
+EXPORT_SYMBOL_GPL(imx_pcm_new);
 
 void imx_pcm_free(struct snd_pcm *pcm)
 {
@@ -100,6 +102,7 @@ void imx_pcm_free(struct snd_pcm *pcm)
 		buf->area = NULL;
 	}
 }
+EXPORT_SYMBOL_GPL(imx_pcm_free);
 
 MODULE_DESCRIPTION("Freescale i.MX PCM driver");
 MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
diff --git a/trunk/sound/soc/soc-dapm.c b/trunk/sound/soc/soc-dapm.c
index 258acadb9e7d..1e36bc81e5af 100644
--- a/trunk/sound/soc/soc-dapm.c
+++ b/trunk/sound/soc/soc-dapm.c
@@ -1023,7 +1023,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
 
 	if (SND_SOC_DAPM_EVENT_ON(event)) {
 		if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
-			ret = regulator_allow_bypass(w->regulator, false);
+			ret = regulator_allow_bypass(w->regulator, true);
 			if (ret != 0)
 				dev_warn(w->dapm->dev,
 					 "ASoC: Failed to bypass %s: %d\n",
@@ -1033,7 +1033,7 @@ int dapm_regulator_event(struct snd_soc_dapm_widget *w,
 		return regulator_enable(w->regulator);
 	} else {
 		if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
-			ret = regulator_allow_bypass(w->regulator, true);
+			ret = regulator_allow_bypass(w->regulator, false);
 			if (ret != 0)
 				dev_warn(w->dapm->dev,
 					 "ASoC: Failed to unbypass %s: %d\n",
@@ -3039,14 +3039,6 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
 				w->name, ret);
 			return NULL;
 		}
-
-		if (w->invert & SND_SOC_DAPM_REGULATOR_BYPASS) {
-			ret = regulator_allow_bypass(w->regulator, true);
-			if (ret != 0)
-				dev_warn(w->dapm->dev,
-					 "ASoC: Failed to unbypass %s: %d\n",
-					 w->name, ret);
-		}
 		break;
 	case snd_soc_dapm_clock_supply:
 #ifdef CONFIG_CLKDEV_LOOKUP
diff --git a/trunk/sound/usb/mixer.c b/trunk/sound/usb/mixer.c
index e90daf8cdaa8..ed4d89c8b52a 100644
--- a/trunk/sound/usb/mixer.c
+++ b/trunk/sound/usb/mixer.c
@@ -1331,23 +1331,16 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
 		}
 		channels = (hdr->bLength - 7) / csize - 1;
 		bmaControls = hdr->bmaControls;
-		if (hdr->bLength < 7 + csize) {
-			snd_printk(KERN_ERR "usbaudio: unit %u: "
-				   "invalid UAC_FEATURE_UNIT descriptor\n",
-				   unitid);
-			return -EINVAL;
-		}
 	} else {
 		struct uac2_feature_unit_descriptor *ftr = _ftr;
 		csize = 4;
 		channels = (hdr->bLength - 6) / 4 - 1;
 		bmaControls = ftr->bmaControls;
-		if (hdr->bLength < 6 + csize) {
-			snd_printk(KERN_ERR "usbaudio: unit %u: "
-				   "invalid UAC_FEATURE_UNIT descriptor\n",
-				   unitid);
-			return -EINVAL;
-		}
+	}
+
+	if (hdr->bLength < 7 || !csize || hdr->bLength < 7 + csize) {
+		snd_printk(KERN_ERR "usbaudio: unit %u: invalid UAC_FEATURE_UNIT descriptor\n", unitid);
+		return -EINVAL;
 	}
 
 	/* parse the source unit */