300 files changed, 2070 insertions, 1530 deletions
diff --git a/Documentation/hwmon/coretemp b/Documentation/hwmon/coretemp
index fa8776ab9b18..84d46c0c71a3 100644
--- a/Documentation/hwmon/coretemp
+++ b/Documentation/hwmon/coretemp
@@ -35,13 +35,6 @@ the Out-Of-Spec bit. Following table summarizes the exported sysfs files:
 All Sysfs entries are named with their core_id (represented here by 'X').
 tempX_input      - Core temperature (in millidegrees Celsius).
 tempX_max        - All cooling devices should be turned on (on Core2).
-                   Initialized with IA32_THERM_INTERRUPT. When the CPU
-                   temperature reaches this temperature, an interrupt is
-                   generated and tempX_max_alarm is set.
-tempX_max_hyst   - If the CPU temperature falls below than temperature,
-                   an interrupt is generated and tempX_max_alarm is reset.
-tempX_max_alarm  - Set if the temperature reaches or exceeds tempX_max.
-                   Reset if the temperature drops to or below tempX_max_hyst.
 tempX_crit       - Maximum junction temperature (in millidegrees Celsius).
 tempX_crit_alarm - Set when Out-of-spec bit is set, never clears.
                   Correct CPU operation is no longer guaranteed.
@@ -49,9 +42,10 @@ tempX_label	 - Contains string "Core X", where X is processor
                   number. For Package temp, this will be "Physical id Y",
                   where Y is the package number.
-The TjMax temperature is set to 85 degrees C if undocumented model specific
+On CPU models which support it, TjMax is read from a model-specific register.
-register (UMSR) 0xee has bit 30 set. If not the TjMax is 100 degrees C as
+On other models, it is set to an arbitrary value based on weak heuristics.
-(sometimes) documented in processor datasheet.
+If these heuristics don't work for you, you can pass the correct TjMax value
+as a module parameter (tjmax).
 Appendix A. Known TjMax lists (TBD):
 Some information comes from ark.intel.com
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 854ed5ca7e3f..d6e6724446c8 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2706,10 +2706,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        functions are at fixed addresses, they make nice
                        targets for exploits that can control RIP.
-                        emulate     [default] Vsyscalls turn into traps and are
+                        emulate     Vsyscalls turn into traps and are emulated
-                                    emulated reasonably safely.
+                                    reasonably safely.
-                        native      Vsyscalls are native syscall instructions.
+                        native      [default] Vsyscalls are native syscall
+                                    instructions.
                                    This is a little bit faster than trapping
                                    and makes a few dynamic recompilers work
                                    better than they would in emulation mode.
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 81546990f41c..ca5cdcd0f0e3 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1042,7 +1042,7 @@ conf/interface/*:
        The functional behaviour for certain settings is different
        depending on whether local forwarding is enabled or not.
-accept_ra - BOOLEAN
+accept_ra - INTEGER
        Accept Router Advertisements; autoconfigure using them.
        Possible values are:
@@ -1106,7 +1106,7 @@ dad_transmits - INTEGER
        The amount of Duplicate Address Detection probes to send.
        Default: 1
-forwarding - BOOLEAN
+forwarding - INTEGER
        Configure interface-specific Host/Router behaviour.
        Note: It is recommended to have the same setting on all
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 58fd7414e6c0..fe67b5c79f0f 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -27,7 +27,7 @@ applying a filter to each packet that assigns it to one of a small number
 of logical flows. Packets for each flow are steered to a separate receive
 queue, which in turn can be processed by separate CPUs. This mechanism is
 generally known as “Receive-side Scaling” (RSS). The goal of RSS and
-the other scaling techniques to increase performance uniformly.
+the other scaling techniques is to increase performance uniformly.
 Multi-queue distribution can also be used for traffic prioritization, but
 that is not the focus of these techniques.
@@ -186,10 +186,10 @@ are steered using plain RPS. Multiple table entries may point to the
 same CPU. Indeed, with many flows and few CPUs, it is very likely that
 a single application thread handles flows with many different flow hashes.
-rps_sock_table is a global flow table that contains the *desired* CPU for
+rps_sock_flow_table is a global flow table that contains the *desired* CPU
-flows: the CPU that is currently processing the flow in userspace. Each
+for flows: the CPU that is currently processing the flow in userspace.
-table value is a CPU index that is updated during calls to recvmsg and
+Each table value is a CPU index that is updated during calls to recvmsg
-sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
+and sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
 and tcp_splice_read()).
 When the scheduler moves a thread to a new CPU while it has outstanding
@@ -243,7 +243,7 @@ configured. The number of entries in the global flow table is set through:
 The number of entries in the per-queue flow table are set through:
- /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+ /sys/class/net/<dev>/queues/rx-<n>/rps_flow_cnt
 == Suggested Configuration
diff --git a/Documentation/vm/transhuge.txt b/Documentation/vm/transhuge.txt
index 0924aaca3302..29bdf62aac09 100644
--- a/Documentation/vm/transhuge.txt
+++ b/Documentation/vm/transhuge.txt
@@ -123,10 +123,11 @@ be automatically shutdown if it's set to "never".
 khugepaged runs usually at low frequency so while one may not want to
 invoke defrag algorithms synchronously during the page faults, it
 should be worth invoking defrag at least in khugepaged. However it's
-also possible to disable defrag in khugepaged:
+also possible to disable defrag in khugepaged by writing 0 or enable
+defrag in khugepaged by writing 1:
-echo yes >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 0 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
-echo no >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 1 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
 You can also control how many pages khugepaged should scan at each
 pass:
diff --git a/MAINTAINERS b/MAINTAINERS
index ae8820e173a2..b3bc88d9c03a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2460,7 +2460,7 @@ S:	Supported
 F:      drivers/infiniband/hw/ehca/
 EHEA (IBM pSeries eHEA 10Gb ethernet adapter) DRIVER
-M:      Breno Leitao <leitao@linux.vnet.ibm.com>
+M:      Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
 L:      netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ehea/
@@ -6366,15 +6366,14 @@ F:	net/ipv4/tcp_lp.c
 TEGRA SUPPORT
 M:      Colin Cross <ccross@android.com>
-M:      Erik Gilling <konkers@android.com>
 M:      Olof Johansson <olof@lixom.net>
+M:      Stephen Warren <swarren@nvidia.com>
 L:      linux-tegra@vger.kernel.org
-T:      git git://android.git.kernel.org/kernel/tegra.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/olof/tegra.git
 S:      Supported
 F:      arch/arm/mach-tegra
 TEHUTI ETHERNET DRIVER
-M:      Alexander Indenbaum <baum@tehutinetworks.net>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 S:      Supported
diff --git a/Makefile b/Makefile
index 733dcba61f34..2652089bf541 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc10
 NAME = "Divemaster Edition"
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3269576dbfa8..3146ed3f6eca 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1283,6 +1283,20 @@ config ARM_ERRATA_364296
          processor into full low interrupt latency mode. ARM11MPCore
          is not affected.
+config ARM_ERRATA_764369
+        bool "ARM errata: Data cache line maintenance operation by MVA may not succeed"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for erratum 764369
+          affecting Cortex-A9 MPCore with two or more processors (all
+          current revisions). Under certain timing circumstances, a data
+          cache line maintenance operation by MVA targeting an Inner
+          Shareable memory region may fail to proceed up to either the
+          Point of Coherency or to the Point of Unification of the
+          system. This workaround adds a DSB instruction before the
+          relevant cache maintenance functions and sets a specific bit
+          in the diagnostic control register of the SCU.
 endmenu
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/common/vic.c b/arch/arm/common/vic.c
index 7aa4262ada7a..197f81c77351 100644
--- a/arch/arm/common/vic.c
+++ b/arch/arm/common/vic.c
@@ -259,7 +259,6 @@ static void __init vic_disable(void __iomem *base)
        writel(0, base + VIC_INT_SELECT);
        writel(0, base + VIC_INT_ENABLE);
        writel(~0, base + VIC_INT_ENABLE_CLEAR);
-        writel(0, base + VIC_IRQ_STATUS);
        writel(0, base + VIC_ITCR);
        writel(~0, base + VIC_INT_SOFT_CLEAR);
 }
diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
index 8c73900da9ed..253cc86318bf 100644
--- a/arch/arm/include/asm/futex.h
+++ b/arch/arm/include/asm/futex.h
@@ -25,17 +25,17 @@
 #ifdef CONFIG_SMP
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        smp_mb();                                               \
        __asm__ __volatile__(                                   \
-        "1:     ldrex   %1, [%2]\n"                             \
+        "1:     ldrex   %1, [%3]\n"                             \
        "       " insn "\n"                                     \
-        "2:     strex   %1, %0, [%2]\n"                         \
+        "2:     strex   %2, %0, [%3]\n"                         \
-        "       teq     %1, #0\n"                               \
+        "       teq     %2, #0\n"                               \
        "       bne     1b\n"                                   \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -73,14 +73,14 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
 #include <linux/preempt.h>
 #include <asm/domain.h>
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        __asm__ __volatile__(                                   \
-        "1:     " T(ldr) "      %1, [%2]\n"                     \
+        "1:     " T(ldr) "      %1, [%3]\n"                     \
        "       " insn "\n"                                     \
-        "2:     " T(str) "      %0, [%2]\n"                     \
+        "2:     " T(str) "      %0, [%3]\n"                     \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -117,7 +117,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        int cmp = (encoded_op >> 24) & 15;
        int oparg = (encoded_op << 8) >> 20;
        int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret;
+        int oldval = 0, ret, tmp;
        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                oparg = 1 << oparg;
@@ -129,19 +129,19 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        switch (op) {
        case FUTEX_OP_SET:
-                __futex_atomic_op("mov  %0, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("mov  %0, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op("add  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("add  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_OR:
-                __futex_atomic_op("orr  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("orr  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ANDN:
-                __futex_atomic_op("and  %0, %1, %3", ret, oldval, uaddr, ~oparg);
+                __futex_atomic_op("and  %0, %1, %4", ret, oldval, tmp, uaddr, ~oparg);
                break;
        case FUTEX_OP_XOR:
-                __futex_atomic_op("eor  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("eor  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        default:
                ret = -ENOSYS;
diff --git a/arch/arm/include/asm/localtimer.h b/arch/arm/include/asm/localtimer.h
index 080d74f8128d..ff66638ff54d 100644
--- a/arch/arm/include/asm/localtimer.h
+++ b/arch/arm/include/asm/localtimer.h
@@ -10,6 +10,8 @@
 #ifndef __ASM_ARM_LOCALTIMER_H
 #define __ASM_ARM_LOCALTIMER_H
+#include <linux/errno.h>
 struct clock_event_device;
 /*
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 2c04ed5efeb5..c60a2944f95b 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -478,8 +478,8 @@
 /*
 * Unimplemented (or alternatively implemented) syscalls
 */
-#define __IGNORE_fadvise64_64           1
+#define __IGNORE_fadvise64_64
-#define __IGNORE_migrate_pages          1
+#define __IGNORE_migrate_pages
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_UNISTD_H */
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 4c851834f68e..6be3e2e4d838 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -321,8 +321,8 @@ static const unsigned armv7_a9_perf_map[PERF_COUNT_HW_MAX] = {
        [PERF_COUNT_HW_CPU_CYCLES]          = ARMV7_PERFCTR_CPU_CYCLES,
        [PERF_COUNT_HW_INSTRUCTIONS]        =
                                        ARMV7_PERFCTR_INST_OUT_OF_RENAME_STAGE,
-        [PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_COHERENT_LINE_HIT,
+        [PERF_COUNT_HW_CACHE_REFERENCES]    = ARMV7_PERFCTR_DCACHE_ACCESS,
-        [PERF_COUNT_HW_CACHE_MISSES]        = ARMV7_PERFCTR_COHERENT_LINE_MISS,
+        [PERF_COUNT_HW_CACHE_MISSES]        = ARMV7_PERFCTR_DCACHE_REFILL,
        [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = ARMV7_PERFCTR_PC_WRITE,
        [PERF_COUNT_HW_BRANCH_MISSES]       = ARMV7_PERFCTR_PC_BRANCH_MIS_PRED,
        [PERF_COUNT_HW_BUS_CYCLES]          = ARMV7_PERFCTR_CLOCK_CYCLES,
diff --git a/arch/arm/kernel/smp_scu.c b/arch/arm/kernel/smp_scu.c
index 79ed5e7f204a..7fcddb75c877 100644
--- a/arch/arm/kernel/smp_scu.c
+++ b/arch/arm/kernel/smp_scu.c
@@ -13,6 +13,7 @@
 #include <asm/smp_scu.h>
 #include <asm/cacheflush.h>
+#include <asm/cputype.h>
 #define SCU_CTRL                0x00
 #define SCU_CONFIG              0x04
@@ -37,6 +38,15 @@ void __init scu_enable(void __iomem *scu_base)
 {
        u32 scu_ctrl;
+#ifdef CONFIG_ARM_ERRATA_764369
+        /* Cortex-A9 only */
+        if ((read_cpuid(CPUID_ID) & 0xff0ffff0) == 0x410fc090) {
+                scu_ctrl = __raw_readl(scu_base + 0x30);
+                if (!(scu_ctrl & 1))
+                        __raw_writel(scu_ctrl | 0x1, scu_base + 0x30);
+        }
+#endif
        scu_ctrl = __raw_readl(scu_base + SCU_CTRL);
        /* already enabled? */
        if (scu_ctrl & 1)
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index bf977f8514f6..4e66f62b8d41 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -23,8 +23,10 @@
 #if defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)
 #define ARM_EXIT_KEEP(x)        x
+#define ARM_EXIT_DISCARD(x)
 #else
 #define ARM_EXIT_KEEP(x)
+#define ARM_EXIT_DISCARD(x)     x
 #endif
 OUTPUT_ARCH(arm)
@@ -39,6 +41,11 @@ jiffies = jiffies_64 + 4;
 SECTIONS
 {
        /*
+         * XXX: The linker does not define how output sections are
+         * assigned to input sections when there are multiple statements
+         * matching the same input section name.  There is no documented
+         * order of matching.
+         *
         * unwind exit sections must be discarded before the rest of the
         * unwind sections get included.
         */
@@ -47,6 +54,9 @@ SECTIONS
                *(.ARM.extab.exit.text)
                ARM_CPU_DISCARD(*(.ARM.exidx.cpuexit.text))
                ARM_CPU_DISCARD(*(.ARM.extab.cpuexit.text))
+                ARM_EXIT_DISCARD(EXIT_TEXT)
+                ARM_EXIT_DISCARD(EXIT_DATA)
+                EXIT_CALL
 #ifndef CONFIG_HOTPLUG
                *(.ARM.exidx.devexit.text)
                *(.ARM.extab.devexit.text)
@@ -58,6 +68,8 @@ SECTIONS
 #ifndef CONFIG_SMP_ON_UP
                *(.alt.smp.init)
 #endif
+                *(.discard)
+                *(.discard.*)
        }
 #ifdef CONFIG_XIP_KERNEL
@@ -279,9 +291,6 @@ SECTIONS
        STABS_DEBUG
        .comment 0 : { *(.comment) }
-        /* Default discards */
-        DISCARDS
 }
 /*
diff --git a/arch/arm/mach-exynos4/clock.c b/arch/arm/mach-exynos4/clock.c
index 79d6cd0c8e7b..86964d2e9e1b 100644
--- a/arch/arm/mach-exynos4/clock.c
+++ b/arch/arm/mach-exynos4/clock.c
@@ -899,8 +899,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 28, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "exynos4-fimc.0",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 16),
                },
@@ -909,8 +908,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 16, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "exynos4-fimc.1",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 20),
                },
diff --git a/arch/arm/mach-omap2/board-2430sdp.c b/arch/arm/mach-omap2/board-2430sdp.c
index 2028464cf5b9..f79b7d2a8ed4 100644
--- a/arch/arm/mach-omap2/board-2430sdp.c
+++ b/arch/arm/mach-omap2/board-2430sdp.c
@@ -193,7 +193,8 @@ static int __init omap2430_i2c_init(void)
 {
        omap_register_i2c_bus(1, 100, sdp2430_i2c1_boardinfo,
                        ARRAY_SIZE(sdp2430_i2c1_boardinfo));
-        omap2_pmic_init("twl4030", &sdp2430_twldata);
+        omap_pmic_init(2, 100, "twl4030", INT_24XX_SYS_NIRQ,
+                        &sdp2430_twldata);
        return 0;
 }
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index a9b45c76e1d3..097a42d81e59 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -137,8 +137,7 @@ static void omap4_hsmmc1_before_set_reg(struct device *dev, int slot,
         */
        reg = omap4_ctrl_pad_readl(control_pbias_offset);
        reg &= ~(OMAP4_MMC1_PBIASLITE_PWRDNZ_MASK |
-                OMAP4_MMC1_PWRDNZ_MASK |
+                OMAP4_MMC1_PWRDNZ_MASK);
-                OMAP4_USBC1_ICUSB_PWRDNZ_MASK);
        omap4_ctrl_pad_writel(reg, control_pbias_offset);
 }
@@ -156,8 +155,7 @@ static void omap4_hsmmc1_after_set_reg(struct device *dev, int slot,
                else
                        reg |= OMAP4_MMC1_PBIASLITE_VMODE_MASK;
                reg |= (OMAP4_MMC1_PBIASLITE_PWRDNZ_MASK |
-                        OMAP4_MMC1_PWRDNZ_MASK |
+                        OMAP4_MMC1_PWRDNZ_MASK);
-                        OMAP4_USBC1_ICUSB_PWRDNZ_MASK);
                omap4_ctrl_pad_writel(reg, control_pbias_offset);
                timeout = jiffies + msecs_to_jiffies(5);
@@ -171,16 +169,14 @@ static void omap4_hsmmc1_after_set_reg(struct device *dev, int slot,
                if (reg & OMAP4_MMC1_PBIASLITE_VMODE_ERROR_MASK) {
                        pr_err("Pbias Voltage is not same as LDO\n");
                        /* Caution : On VMODE_ERROR Power Down MMC IO */
-                        reg &= ~(OMAP4_MMC1_PWRDNZ_MASK |
+                        reg &= ~(OMAP4_MMC1_PWRDNZ_MASK);
-                                OMAP4_USBC1_ICUSB_PWRDNZ_MASK);
                        omap4_ctrl_pad_writel(reg, control_pbias_offset);
                }
        } else {
                reg = omap4_ctrl_pad_readl(control_pbias_offset);
                reg |= (OMAP4_MMC1_PBIASLITE_PWRDNZ_MASK |
                        OMAP4_MMC1_PWRDNZ_MASK |
-                        OMAP4_MMC1_PBIASLITE_VMODE_MASK |
+                        OMAP4_MMC1_PBIASLITE_VMODE_MASK);
-                        OMAP4_USBC1_ICUSB_PWRDNZ_MASK);
                omap4_ctrl_pad_writel(reg, control_pbias_offset);
        }
 }
diff --git a/arch/arm/mach-omap2/usb-musb.c b/arch/arm/mach-omap2/usb-musb.c
index a65145b02a55..19e4dac62a8c 100644
--- a/arch/arm/mach-omap2/usb-musb.c
+++ b/arch/arm/mach-omap2/usb-musb.c
@@ -137,9 +137,6 @@ void __init usb_musb_init(struct omap_musb_board_data *musb_board_data)
        musb_plat.mode = board_data->mode;
        musb_plat.extvbus = board_data->extvbus;
-        if (cpu_is_omap44xx())
-                omap4430_phy_init(dev);
        if (cpu_is_omap3517() || cpu_is_omap3505()) {
                oh_name = "am35x_otg_hs";
                name = "musb-am35x";
diff --git a/arch/arm/mach-s3c2443/clock.c b/arch/arm/mach-s3c2443/clock.c
index a1a7176675b9..38058af48972 100644
--- a/arch/arm/mach-s3c2443/clock.c
+++ b/arch/arm/mach-s3c2443/clock.c
@@ -128,7 +128,7 @@ static int s3c2443_armclk_setrate(struct clk *clk, unsigned long rate)
                unsigned long clkcon0;
                clkcon0 = __raw_readl(S3C2443_CLKDIV0);
-                clkcon0 &= S3C2443_CLKDIV0_ARMDIV_MASK;
+                clkcon0 &= ~S3C2443_CLKDIV0_ARMDIV_MASK;
                clkcon0 |= val << S3C2443_CLKDIV0_ARMDIV_SHIFT;
                __raw_writel(clkcon0, S3C2443_CLKDIV0);
        }
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index 52a8e607bcc2..f5f8fa89679c 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -815,8 +815,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV3, .shift = 20, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "s5pv210-fimc.0",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 3),
                },
@@ -825,8 +824,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV1, .shift = 12, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "s5pv210-fimc.1",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 4),
                },
diff --git a/arch/arm/mach-tegra/cpu-tegra.c b/arch/arm/mach-tegra/cpu-tegra.c
index 0e1016a827ac..0e0fd4d889bd 100644
--- a/arch/arm/mach-tegra/cpu-tegra.c
+++ b/arch/arm/mach-tegra/cpu-tegra.c
@@ -32,7 +32,6 @@
 #include <asm/system.h>
-#include <mach/hardware.h>
 #include <mach/clk.h>
 /* Frequency table index must be sequential starting at 0 */
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 4210cb434dbc..a3e0c8692f0d 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -6,6 +6,7 @@ config UX500_SOC_COMMON
        select ARM_GIC
        select HAS_MTU
        select ARM_ERRATA_753970
+        select ARM_ERRATA_754322
 menu "Ux500 SoC"
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 3b24bfa3b828..07c4bc8ea0a4 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -174,6 +174,10 @@ ENTRY(v7_coherent_user_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r12, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
 USER(  mcr     p15, 0, r12, c7, c11, 1 )       @ clean D line to the point of unification
        add     r12, r12, r2
@@ -223,6 +227,10 @@ ENTRY(v7_flush_kern_dcache_area)
        add     r1, r0, r1
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D line / unified line
        add     r0, r0, r2
@@ -247,6 +255,10 @@ v7_dma_inv_range:
        sub     r3, r2, #1
        tst     r0, r3
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
        mcrne   p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        tst     r1, r3
@@ -270,6 +282,10 @@ v7_dma_clean_range:
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c10, 1          @ clean D / U line
        add     r0, r0, r2
@@ -288,6 +304,10 @@ ENTRY(v7_dma_flush_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        add     r0, r0, r2
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 0a0a1e7c20d2..c3ff82f92d9c 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -324,6 +324,8 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
        if (addr)
                *handle = pfn_to_dma(dev, page_to_pfn(page));
+        else
+                __dma_free_buffer(page, size);
        return addr;
 }
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index cc7e2d8be9aa..f8037ba338ac 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -496,6 +496,13 @@ static void __init free_unused_memmap(struct meminfo *mi)
                 */
                bank_start = min(bank_start,
                                 ALIGN(prev_bank_end, PAGES_PER_SECTION));
+#else
+                /*
+                 * Align down here since the VM subsystem insists that the
+                 * memmap entries are valid from the bank start aligned to
+                 * MAX_ORDER_NR_PAGES.
+                 */
+                bank_start = round_down(bank_start, MAX_ORDER_NR_PAGES);
 #endif
                /*
                 * If we had a previous bank, and there is a space
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index f71078ef6bb5..f88216d23991 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -114,17 +114,18 @@ static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
 {
        static int used_gpioint_groups = 0;
        int group = chip->group;
-        struct s5p_gpioint_bank *bank = NULL;
+        struct s5p_gpioint_bank *b, *bank = NULL;
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
        if (used_gpioint_groups >= S5P_GPIOINT_GROUP_COUNT)
                return -ENOMEM;
-        list_for_each_entry(bank, &banks, list) {
+        list_for_each_entry(b, &banks, list) {
-                if (group >= bank->start &&
+                if (group >= b->start && group < b->start + b->nr_groups) {
-                    group < bank->start + bank->nr_groups)
+                        bank = b;
                        break;
+                }
        }
        if (!bank)
                return -EINVAL;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 177cdaf83564..b122adc8bdbb 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -24,6 +24,7 @@ config MIPS
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
        select HAVE_ARCH_JUMP_LABEL
+        select IRQ_FORCED_THREADING
 menu "Machine selection"
@@ -722,6 +723,7 @@ config CAVIUM_OCTEON_SIMULATOR
        select SYS_SUPPORTS_HIGHMEM
        select SYS_SUPPORTS_HOTPLUG_CPU
        select SYS_HAS_CPU_CAVIUM_OCTEON
+        select HOLES_IN_ZONE
        help
          The Octeon simulator is software performance model of the Cavium
          Octeon Processor. It supports simulating Octeon processors on x86
@@ -744,6 +746,7 @@ config CAVIUM_OCTEON_REFERENCE_BOARD
        select ZONE_DMA32
        select USB_ARCH_HAS_OHCI
        select USB_ARCH_HAS_EHCI
+        select HOLES_IN_ZONE
        help
          This option supports all of the Octeon reference boards from Cavium
          Networks. It builds a kernel that dynamically determines the Octeon
@@ -973,6 +976,9 @@ config ISA_DMA_API
 config GENERIC_GPIO
        bool
+config HOLES_IN_ZONE
+        bool
 #
 # Endianess selection.  Sufficiently obscure so many users don't know what to
 # answer,so we try hard to limit the available choices.  Also the use of a
diff --git a/arch/mips/alchemy/common/platform.c b/arch/mips/alchemy/common/platform.c
index 3b2c18b14341..f72c48d4804c 100644
--- a/arch/mips/alchemy/common/platform.c
+++ b/arch/mips/alchemy/common/platform.c
@@ -492,7 +492,7 @@ static void __init alchemy_setup_macs(int ctype)
                memcpy(au1xxx_eth0_platform_data.mac, ethaddr, 6);
        ret = platform_device_register(&au1xxx_eth0_device);
-        if (!ret)
+        if (ret)
                printk(KERN_INFO "Alchemy: failed to register MAC0\n");
diff --git a/arch/mips/alchemy/common/power.c b/arch/mips/alchemy/common/power.c
index 647e518c90bc..b86324a42601 100644
--- a/arch/mips/alchemy/common/power.c
+++ b/arch/mips/alchemy/common/power.c
@@ -158,15 +158,21 @@ static void restore_core_regs(void)
 void au_sleep(void)
 {
-        int cpuid = alchemy_get_cputype();
+        save_core_regs();
-        if (cpuid != ALCHEMY_CPU_UNKNOWN) {
-                save_core_regs();
+        switch (alchemy_get_cputype()) {
-                if (cpuid <= ALCHEMY_CPU_AU1500)
+        case ALCHEMY_CPU_AU1000:
-                        alchemy_sleep_au1000();
+        case ALCHEMY_CPU_AU1500:
-                else if (cpuid <= ALCHEMY_CPU_AU1200)
+        case ALCHEMY_CPU_AU1100:
-                        alchemy_sleep_au1550();
+                alchemy_sleep_au1000();
-                restore_core_regs();
+                break;
+        case ALCHEMY_CPU_AU1550:
+        case ALCHEMY_CPU_AU1200:
+                alchemy_sleep_au1550();
+                break;
        }
+        restore_core_regs();
 }
 #endif  /* CONFIG_PM */
diff --git a/arch/mips/alchemy/devboards/bcsr.c b/arch/mips/alchemy/devboards/bcsr.c
index 596ad00e7f05..463d2c4d9441 100644
--- a/arch/mips/alchemy/devboards/bcsr.c
+++ b/arch/mips/alchemy/devboards/bcsr.c
@@ -89,8 +89,12 @@ static void bcsr_csc_handler(unsigned int irq, struct irq_desc *d)
 {
        unsigned short bisr = __raw_readw(bcsr_virt + BCSR_REG_INTSTAT);
+        disable_irq_nosync(irq);
        for ( ; bisr; bisr &= bisr - 1)
                generic_handle_irq(bcsr_csc_base + __ffs(bisr));
+        enable_irq(irq);
 }
 /* NOTE: both the enable and mask bits must be cleared, otherwise the
diff --git a/arch/mips/alchemy/devboards/db1200/setup.c b/arch/mips/alchemy/devboards/db1200/setup.c
index 1dac4f27d334..4a8980027ecf 100644
--- a/arch/mips/alchemy/devboards/db1200/setup.c
+++ b/arch/mips/alchemy/devboards/db1200/setup.c
@@ -23,13 +23,6 @@ void __init board_setup(void)
        unsigned long freq0, clksrc, div, pfc;
        unsigned short whoami;
-        /* Set Config[OD] (disable overlapping bus transaction):
-         * This gets rid of a _lot_ of spurious interrupts (especially
-         * wrt. IDE); but incurs ~10% performance hit in some
-         * cpu-bound applications.
-         */
-        set_c0_config(1 << 19);
        bcsr_init(DB1200_BCSR_PHYS_ADDR,
                  DB1200_BCSR_PHYS_ADDR + DB1200_BCSR_HEXLED_OFS);
diff --git a/arch/mips/ar7/irq.c b/arch/mips/ar7/irq.c
index 03db3daadbd8..88c4babfdb5d 100644
--- a/arch/mips/ar7/irq.c
+++ b/arch/mips/ar7/irq.c
@@ -98,7 +98,8 @@ static struct irq_chip ar7_sec_irq_type = {
 static struct irqaction ar7_cascade_action = {
        .handler = no_action,
-        .name = "AR7 cascade interrupt"
+        .name = "AR7 cascade interrupt",
+        .flags = IRQF_NO_THREAD,
 };
 static void __init ar7_irq_init(int base)
diff --git a/arch/mips/bcm63xx/irq.c b/arch/mips/bcm63xx/irq.c
index cea6021cb8d7..162e11b4ed75 100644
--- a/arch/mips/bcm63xx/irq.c
+++ b/arch/mips/bcm63xx/irq.c
@@ -222,6 +222,7 @@ static struct irq_chip bcm63xx_external_irq_chip = {
 static struct irqaction cpu_ip2_cascade_action = {
        .handler        = no_action,
        .name           = "cascade_ip2",
+        .flags          = IRQF_NO_THREAD,
 };
 void __init arch_init_irq(void)
diff --git a/arch/mips/cobalt/irq.c b/arch/mips/cobalt/irq.c
index cb9bf820fe53..965c777d3561 100644
--- a/arch/mips/cobalt/irq.c
+++ b/arch/mips/cobalt/irq.c
@@ -48,6 +48,7 @@ asmlinkage void plat_irq_dispatch(void)
 static struct irqaction cascade = {
        .handler        = no_action,
        .name           = "cascade",
+        .flags          = IRQF_NO_THREAD,
 };
 void __init arch_init_irq(void)
diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
index fa45e924be05..f7b7ba6d5c45 100644
--- a/arch/mips/dec/setup.c
+++ b/arch/mips/dec/setup.c
@@ -101,20 +101,24 @@ int cpu_fpu_mask = DEC_CPU_IRQ_MASK(DEC_CPU_INR_FPU);
 static struct irqaction ioirq = {
        .handler = no_action,
        .name = "cascade",
+        .flags = IRQF_NO_THREAD,
 };
 static struct irqaction fpuirq = {
        .handler = no_action,
        .name = "fpu",
+        .flags = IRQF_NO_THREAD,
 };
 static struct irqaction busirq = {
        .flags = IRQF_DISABLED,
        .name = "bus error",
+        .flags = IRQF_NO_THREAD,
 };
 static struct irqaction haltirq = {
        .handler = dec_intr_halt,
        .name = "halt",
+        .flags = IRQF_NO_THREAD,
 };
diff --git a/arch/mips/emma/markeins/irq.c b/arch/mips/emma/markeins/irq.c
index 3dbd7a5a6ad3..7798887a1288 100644
--- a/arch/mips/emma/markeins/irq.c
+++ b/arch/mips/emma/markeins/irq.c
@@ -169,7 +169,7 @@ void emma2rh_gpio_irq_init(void)
 static struct irqaction irq_cascade = {
           .handler = no_action,
-           .flags = 0,
+           .flags = IRQF_NO_THREAD,
           .name = "cascade",
           .dev_id = NULL,
           .next = NULL,
diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
index 0d5a42b5f47a..a58addb98cfd 100644
--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
@@ -54,7 +54,6 @@
 #define cpu_has_mips_r2_exec_hazard 0
 #define cpu_has_dsp             0
 #define cpu_has_mipsmt          0
-#define cpu_has_userlocal       0
 #define cpu_has_vint            0
 #define cpu_has_veic            0
 #define cpu_hwrena_impl_bits    0xc0000000
diff --git a/arch/mips/include/asm/mach-powertv/dma-coherence.h b/arch/mips/include/asm/mach-powertv/dma-coherence.h
index 62c094085947..35371641575d 100644
--- a/arch/mips/include/asm/mach-powertv/dma-coherence.h
+++ b/arch/mips/include/asm/mach-powertv/dma-coherence.h
@@ -13,7 +13,6 @@
 #define __ASM_MACH_POWERTV_DMA_COHERENCE_H
 #include <linux/sched.h>
-#include <linux/version.h>
 #include <linux/device.h>
 #include <asm/mach-powertv/asic.h>
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index b4ba2449444b..cb41af5f3406 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -195,9 +195,9 @@
                 * to cover the pipeline delay.
                 */
                .set    mips32
-                mfc0    v1, CP0_TCSTATUS
+                mfc0    k0, CP0_TCSTATUS
                .set    mips0
-                LONG_S  v1, PT_TCSTATUS(sp)
+                LONG_S  k0, PT_TCSTATUS(sp)
 #endif /* CONFIG_MIPS_MT_SMTC */
                LONG_S  $4, PT_R4(sp)
                LONG_S  $5, PT_R5(sp)
diff --git a/arch/mips/jz4740/gpio.c b/arch/mips/jz4740/gpio.c
index 73031f7fc827..4397972949fa 100644
--- a/arch/mips/jz4740/gpio.c
+++ b/arch/mips/jz4740/gpio.c
@@ -18,7 +18,7 @@
 #include <linux/init.h>
 #include <linux/spinlock.h>
-#include <linux/sysdev.h>
+#include <linux/syscore_ops.h>
 #include <linux/io.h>
 #include <linux/gpio.h>
 #include <linux/delay.h>
@@ -86,7 +86,6 @@ struct jz_gpio_chip {
        spinlock_t lock;
        struct gpio_chip gpio_chip;
-        struct sys_device sysdev;
 };
 static struct jz_gpio_chip jz4740_gpio_chips[];
@@ -459,49 +458,47 @@ static struct jz_gpio_chip jz4740_gpio_chips[] = {
        JZ4740_GPIO_CHIP(D),
 };
-static inline struct jz_gpio_chip *sysdev_to_chip(struct sys_device *dev)
+static void jz4740_gpio_suspend_chip(struct jz_gpio_chip *chip)
 {
-        return container_of(dev, struct jz_gpio_chip, sysdev);
+        chip->suspend_mask = readl(chip->base + JZ_REG_GPIO_MASK);
+        writel(~(chip->wakeup), chip->base + JZ_REG_GPIO_MASK_SET);
+        writel(chip->wakeup, chip->base + JZ_REG_GPIO_MASK_CLEAR);
 }
-static int jz4740_gpio_suspend(struct sys_device *dev, pm_message_t state)
+static int jz4740_gpio_suspend(void)
 {
-        struct jz_gpio_chip *chip = sysdev_to_chip(dev);
+        int i;
-        chip->suspend_mask = readl(chip->base + JZ_REG_GPIO_MASK);
+        for (i = 0; i < ARRAY_SIZE(jz4740_gpio_chips); i++)
-        writel(~(chip->wakeup), chip->base + JZ_REG_GPIO_MASK_SET);
+                jz4740_gpio_suspend_chip(&jz4740_gpio_chips[i]);
-        writel(chip->wakeup, chip->base + JZ_REG_GPIO_MASK_CLEAR);
        return 0;
 }
-static int jz4740_gpio_resume(struct sys_device *dev)
+static void jz4740_gpio_resume_chip(struct jz_gpio_chip *chip)
 {
-        struct jz_gpio_chip *chip = sysdev_to_chip(dev);
        uint32_t mask = chip->suspend_mask;
        writel(~mask, chip->base + JZ_REG_GPIO_MASK_CLEAR);
        writel(mask, chip->base + JZ_REG_GPIO_MASK_SET);
+}
-        return 0;
+static void jz4740_gpio_resume(void)
+{
+        int i;
+        for (i = ARRAY_SIZE(jz4740_gpio_chips) - 1; i >= 0 ; i--)
+                jz4740_gpio_resume_chip(&jz4740_gpio_chips[i]);
 }
-static struct sysdev_class jz4740_gpio_sysdev_class = {
+static struct syscore_ops jz4740_gpio_syscore_ops = {
-        .name = "gpio",
        .suspend = jz4740_gpio_suspend,
        .resume = jz4740_gpio_resume,
 };
-static int jz4740_gpio_chip_init(struct jz_gpio_chip *chip, unsigned int id)
+static void jz4740_gpio_chip_init(struct jz_gpio_chip *chip, unsigned int id)
 {
-        int ret, irq;
+        int irq;
-        chip->sysdev.id = id;
-        chip->sysdev.cls = &jz4740_gpio_sysdev_class;
-        ret = sysdev_register(&chip->sysdev);
-        if (ret)
-                return ret;
        spin_lock_init(&chip->lock);
@@ -519,22 +516,17 @@ static int jz4740_gpio_chip_init(struct jz_gpio_chip *chip, unsigned int id)
                irq_set_chip_and_handler(irq, &jz_gpio_irq_chip,
                                         handle_level_irq);
        }
-        return 0;
 }
 static int __init jz4740_gpio_init(void)
 {
        unsigned int i;
-        int ret;
-        ret = sysdev_class_register(&jz4740_gpio_sysdev_class);
-        if (ret)
-                return ret;
        for (i = 0; i < ARRAY_SIZE(jz4740_gpio_chips); ++i)
                jz4740_gpio_chip_init(&jz4740_gpio_chips[i], i);
+        register_syscore_ops(&jz4740_gpio_syscore_ops);
        printk(KERN_INFO "JZ4740 GPIO initialized\n");
        return 0;
diff --git a/arch/mips/kernel/ftrace.c b/arch/mips/kernel/ftrace.c
index feb8021a305f..6a2d758dd8e9 100644
--- a/arch/mips/kernel/ftrace.c
+++ b/arch/mips/kernel/ftrace.c
@@ -19,6 +19,26 @@
 #include <asm-generic/sections.h>
+#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
+#define MCOUNT_OFFSET_INSNS 5
+#else
+#define MCOUNT_OFFSET_INSNS 4
+#endif
+/*
+ * Check if the address is in kernel space
+ *
+ * Clone core_kernel_text() from kernel/extable.c, but doesn't call
+ * init_kernel_text() for Ftrace doesn't trace functions in init sections.
+ */
+static inline int in_kernel_space(unsigned long ip)
+{
+        if (ip >= (unsigned long)_stext &&
+            ip <= (unsigned long)_etext)
+                return 1;
+        return 0;
+}
 #ifdef CONFIG_DYNAMIC_FTRACE
 #define JAL 0x0c000000          /* jump & link: ip --> ra, jump to target */
@@ -54,20 +74,6 @@ static inline void ftrace_dyn_arch_init_insns(void)
 #endif
 }
-/*
- * Check if the address is in kernel space
- *
- * Clone core_kernel_text() from kernel/extable.c, but doesn't call
- * init_kernel_text() for Ftrace doesn't trace functions in init sections.
- */
-static inline int in_kernel_space(unsigned long ip)
-{
-        if (ip >= (unsigned long)_stext &&
-            ip <= (unsigned long)_etext)
-                return 1;
-        return 0;
-}
 static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 {
        int faulted;
@@ -112,11 +118,6 @@ static int ftrace_modify_code(unsigned long ip, unsigned int new_code)
 *                                  1: offset = 4 instructions
 */
-#if defined(KBUILD_MCOUNT_RA_ADDRESS) && defined(CONFIG_32BIT)
-#define MCOUNT_OFFSET_INSNS 5
-#else
-#define MCOUNT_OFFSET_INSNS 4
-#endif
 #define INSN_B_1F (0x10000000 | MCOUNT_OFFSET_INSNS)
 int ftrace_make_nop(struct module *mod,
diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
index 5c74eb797f08..32b397b646ee 100644
--- a/arch/mips/kernel/i8259.c
+++ b/arch/mips/kernel/i8259.c
@@ -229,7 +229,7 @@ static void i8259A_shutdown(void)
         */
        if (i8259A_auto_eoi >= 0) {
                outb(0xff, PIC_MASTER_IMR);     /* mask all of 8259A-1 */
-                outb(0xff, PIC_SLAVE_IMR);      /* mask all of 8259A-1 */
+                outb(0xff, PIC_SLAVE_IMR);      /* mask all of 8259A-2 */
        }
 }
@@ -295,6 +295,7 @@ static void init_8259A(int auto_eoi)
 static struct irqaction irq2 = {
        .handler = no_action,
        .name = "cascade",
+        .flags = IRQF_NO_THREAD,
 };
 static struct resource pic1_io_resource = {
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index 876a75cc376f..922a554cd108 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -349,3 +349,10 @@ SYSCALL_DEFINE6(32_fanotify_mark, int, fanotify_fd, unsigned int, flags,
        return sys_fanotify_mark(fanotify_fd, flags, merge_64(a3, a4),
                                 dfd, pathname);
 }
+SYSCALL_DEFINE6(32_futex, u32 __user *, uaddr, int, op, u32, val,
+                struct compat_timespec __user *, utime, u32 __user *, uaddr2,
+                u32, val3)
+{
+        return compat_sys_futex(uaddr, op, val, utime, uaddr2, val3);
+}
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index f9296e894e46..6de1f598346e 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -315,7 +315,7 @@ EXPORT(sysn32_call_table)
        PTR     sys_fremovexattr
        PTR     sys_tkill
        PTR     sys_ni_syscall
-        PTR     compat_sys_futex
+        PTR     sys_32_futex
        PTR     compat_sys_sched_setaffinity    /* 6195 */
        PTR     compat_sys_sched_getaffinity
        PTR     sys_cacheflush
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 4d7c9827706f..1d813169e453 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -441,7 +441,7 @@ sys_call_table:
        PTR     sys_fremovexattr                /* 4235 */
        PTR     sys_tkill
        PTR     sys_sendfile64
-        PTR     compat_sys_futex
+        PTR     sys_32_futex
        PTR     compat_sys_sched_setaffinity
        PTR     compat_sys_sched_getaffinity    /* 4240 */
        PTR     compat_sys_io_setup
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index dbbe0ce48d89..f8524003676a 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -8,6 +8,7 @@
 * Copyright (C) 1999, 2000 Silicon Graphics, Inc.
 */
 #include <linux/cache.h>
+#include <linux/irqflags.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/personality.h>
@@ -658,6 +659,8 @@ static void do_signal(struct pt_regs *regs)
 asmlinkage void do_notify_resume(struct pt_regs *regs, void *unused,
        __u32 thread_info_flags)
 {
+        local_irq_enable();
        /* deal with pending signal delivery */
        if (thread_info_flags & (_TIF_SIGPENDING | _TIF_RESTORE_SIGMASK))
                do_signal(regs);
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index b7517e3abc85..cbea618af0b4 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -14,6 +14,7 @@
 #include <linux/bug.h>
 #include <linux/compiler.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/module.h>
 #include <linux/sched.h>
@@ -364,21 +365,26 @@ static int regs_to_trapnr(struct pt_regs *regs)
        return (regs->cp0_cause >> 2) & 0x1f;
 }
-static DEFINE_SPINLOCK(die_lock);
+static DEFINE_RAW_SPINLOCK(die_lock);
 void __noreturn die(const char *str, struct pt_regs *regs)
 {
        static int die_counter;
        int sig = SIGSEGV;
 #ifdef CONFIG_MIPS_MT_SMTC
-        unsigned long dvpret = dvpe();
+        unsigned long dvpret;
 #endif /* CONFIG_MIPS_MT_SMTC */
+        oops_enter();
        if (notify_die(DIE_OOPS, str, regs, 0, regs_to_trapnr(regs), SIGSEGV) == NOTIFY_STOP)
                sig = 0;
        console_verbose();
-        spin_lock_irq(&die_lock);
+        raw_spin_lock_irq(&die_lock);
+#ifdef CONFIG_MIPS_MT_SMTC
+        dvpret = dvpe();
+#endif /* CONFIG_MIPS_MT_SMTC */
        bust_spinlocks(1);
 #ifdef CONFIG_MIPS_MT_SMTC
        mips_mt_regdump(dvpret);
@@ -387,7 +393,9 @@ void __noreturn die(const char *str, struct pt_regs *regs)
        printk("%s[#%d]:\n", str, ++die_counter);
        show_registers(regs);
        add_taint(TAINT_DIE);
-        spin_unlock_irq(&die_lock);
+        raw_spin_unlock_irq(&die_lock);
+        oops_exit();
        if (in_interrupt())
                panic("Fatal exception in interrupt");
diff --git a/arch/mips/kernel/vpe.c b/arch/mips/kernel/vpe.c
index 2cd50ad0d5c6..3efcb065f78a 100644
--- a/arch/mips/kernel/vpe.c
+++ b/arch/mips/kernel/vpe.c
@@ -192,7 +192,7 @@ static struct tc *get_tc(int index)
        }
        spin_unlock(&vpecontrol.tc_list_lock);
-        return NULL;
+        return res;
 }
 /* allocate a vpe and associate it with this minor (or index) */
diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c
index fc89795cafdb..f9737bb3c5ab 100644
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -123,11 +123,10 @@ void ltq_enable_irq(struct irq_data *d)
 static unsigned int ltq_startup_eiu_irq(struct irq_data *d)
 {
        int i;
-        int irq_nr = d->irq - INT_NUM_IRQ0;
        ltq_enable_irq(d);
        for (i = 0; i < MAX_EIU; i++) {
-                if (irq_nr == ltq_eiu_irq[i]) {
+                if (d->irq == ltq_eiu_irq[i]) {
                        /* low level - we should really handle set_type */
                        ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_C) |
                                (0x6 << (i * 4)), LTQ_EIU_EXIN_C);
@@ -147,11 +146,10 @@ static unsigned int ltq_startup_eiu_irq(struct irq_data *d)
 static void ltq_shutdown_eiu_irq(struct irq_data *d)
 {
        int i;
-        int irq_nr = d->irq - INT_NUM_IRQ0;
        ltq_disable_irq(d);
        for (i = 0; i < MAX_EIU; i++) {
-                if (irq_nr == ltq_eiu_irq[i]) {
+                if (d->irq == ltq_eiu_irq[i]) {
                        /* disable */
                        ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_INEN) & ~(1 << i),
                                LTQ_EIU_EXIN_INEN);
diff --git a/arch/mips/lantiq/xway/ebu.c b/arch/mips/lantiq/xway/ebu.c
index 66eb52fa50a1..033b3184c7a7 100644
--- a/arch/mips/lantiq/xway/ebu.c
+++ b/arch/mips/lantiq/xway/ebu.c
@@ -10,7 +10,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/ioport.h>
 #include <lantiq_soc.h>
diff --git a/arch/mips/lantiq/xway/pmu.c b/arch/mips/lantiq/xway/pmu.c
index 9d69f01e352b..39f0d2641cbf 100644
--- a/arch/mips/lantiq/xway/pmu.c
+++ b/arch/mips/lantiq/xway/pmu.c
@@ -8,7 +8,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/ioport.h>
 #include <lantiq_soc.h>
diff --git a/arch/mips/lasat/interrupt.c b/arch/mips/lasat/interrupt.c
index de4c165515d7..d608b6ef0edd 100644
--- a/arch/mips/lasat/interrupt.c
+++ b/arch/mips/lasat/interrupt.c
@@ -105,6 +105,7 @@ asmlinkage void plat_irq_dispatch(void)
 static struct irqaction cascade = {
        .handler        = no_action,
        .name           = "cascade",
+        .flags          = IRQF_NO_THREAD,
 };
 void __init arch_init_irq(void)
diff --git a/arch/mips/loongson/fuloong-2e/irq.c b/arch/mips/loongson/fuloong-2e/irq.c
index d61a04222b87..3cf1fef29f0e 100644
--- a/arch/mips/loongson/fuloong-2e/irq.c
+++ b/arch/mips/loongson/fuloong-2e/irq.c
@@ -42,6 +42,7 @@ asmlinkage void mach_irq_dispatch(unsigned int pending)
 static struct irqaction cascade_irqaction = {
        .handler = no_action,
        .name = "cascade",
+        .flags = IRQF_NO_THREAD,
 };
 void __init mach_init_irq(void)
diff --git a/arch/mips/loongson/lemote-2f/irq.c b/arch/mips/loongson/lemote-2f/irq.c
index 081db102bb98..14b081841b6b 100644
--- a/arch/mips/loongson/lemote-2f/irq.c
+++ b/arch/mips/loongson/lemote-2f/irq.c
@@ -96,12 +96,13 @@ static irqreturn_t ip6_action(int cpl, void *dev_id)
 struct irqaction ip6_irqaction = {
        .handler = ip6_action,
        .name = "cascade",
-        .flags = IRQF_SHARED,
+        .flags = IRQF_SHARED | IRQF_NO_THREAD,
 };
 struct irqaction cascade_irqaction = {
        .handler = no_action,
        .name = "cascade",
+        .flags = IRQF_NO_THREAD,
 };
 void __init mach_init_irq(void)
diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c
index 9ff5d0fac556..302d779d5b0d 100644
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -6,6 +6,7 @@
 * Copyright (C) 2011 Wind River Systems,
 *   written by Ralf Baechle <ralf@linux-mips.org>
 */
+#include <linux/compiler.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/mman.h>
@@ -15,12 +16,11 @@
 #include <linux/sched.h>
 unsigned long shm_align_mask = PAGE_SIZE - 1;   /* Sane caches */
 EXPORT_SYMBOL(shm_align_mask);
 /* gap between mmap and stack */
 #define MIN_GAP (128*1024*1024UL)
-#define MAX_GAP        ((TASK_SIZE)/6*5)
+#define MAX_GAP ((TASK_SIZE)/6*5)
 static int mmap_is_legacy(void)
 {
@@ -57,13 +57,13 @@ static inline unsigned long COLOUR_ALIGN_DOWN(unsigned long addr,
        return base - off;
 }
-#define COLOUR_ALIGN(addr,pgoff)                                \
+#define COLOUR_ALIGN(addr, pgoff)                               \
        ((((addr) + shm_align_mask) & ~shm_align_mask) +        \
         (((pgoff) << PAGE_SHIFT) & shm_align_mask))
 enum mmap_allocation_direction {UP, DOWN};
-static unsigned long arch_get_unmapped_area_foo(struct file *filp,
+static unsigned long arch_get_unmapped_area_common(struct file *filp,
        unsigned long addr0, unsigned long len, unsigned long pgoff,
        unsigned long flags, enum mmap_allocation_direction dir)
 {
@@ -103,16 +103,16 @@ static unsigned long arch_get_unmapped_area_foo(struct file *filp,
                vma = find_vma(mm, addr);
                if (TASK_SIZE - len >= addr &&
-                   (!vma || addr + len <= vma->vm_start))
+                    (!vma || addr + len <= vma->vm_start))
                        return addr;
        }
        if (dir == UP) {
                addr = mm->mmap_base;
-                        if (do_color_align)
+                if (do_color_align)
-                                addr = COLOUR_ALIGN(addr, pgoff);
+                        addr = COLOUR_ALIGN(addr, pgoff);
-                        else
+                else
-                                addr = PAGE_ALIGN(addr);
+                        addr = PAGE_ALIGN(addr);
                for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
                        /* At this point:  (!vma || addr < vma->vm_end). */
@@ -131,28 +131,30 @@ static unsigned long arch_get_unmapped_area_foo(struct file *filp,
                        mm->free_area_cache = mm->mmap_base;
                }
-                /* either no address requested or can't fit in requested address hole */
+                /*
+                 * either no address requested, or the mapping can't fit into
+                 * the requested address hole
+                 */
                addr = mm->free_area_cache;
-                        if (do_color_align) {
+                if (do_color_align) {
-                                unsigned long base =
+                        unsigned long base =
-                                        COLOUR_ALIGN_DOWN(addr - len, pgoff);
+                                COLOUR_ALIGN_DOWN(addr - len, pgoff);
                        addr = base + len;
-                 }
+                }
                /* make sure it can fit in the remaining address space */
                if (likely(addr > len)) {
                        vma = find_vma(mm, addr - len);
                        if (!vma || addr <= vma->vm_start) {
-                                /* remember the address as a hint for next time */
+                                /* cache the address as a hint for next time */
-                                return mm->free_area_cache = addr-len;
+                                return mm->free_area_cache = addr - len;
                        }
                }
                if (unlikely(mm->mmap_base < len))
                        goto bottomup;
-                addr = mm->mmap_base-len;
+                addr = mm->mmap_base - len;
                if (do_color_align)
                        addr = COLOUR_ALIGN_DOWN(addr, pgoff);
@@ -163,8 +165,8 @@ static unsigned long arch_get_unmapped_area_foo(struct file *filp,
                         * return with success:
                         */
                        vma = find_vma(mm, addr);
-                        if (likely(!vma || addr+len <= vma->vm_start)) {
+                        if (likely(!vma || addr + len <= vma->vm_start)) {
-                                /* remember the address as a hint for next time */
+                                /* cache the address as a hint for next time */
                                return mm->free_area_cache = addr;
                        }
@@ -173,7 +175,7 @@ static unsigned long arch_get_unmapped_area_foo(struct file *filp,
                                mm->cached_hole_size = vma->vm_start - addr;
                        /* try just below the current vma->vm_start */
-                        addr = vma->vm_start-len;
+                        addr = vma->vm_start - len;
                        if (do_color_align)
                                addr = COLOUR_ALIGN_DOWN(addr, pgoff);
                } while (likely(len < vma->vm_start));
@@ -201,7 +203,7 @@ bottomup:
 unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr0,
        unsigned long len, unsigned long pgoff, unsigned long flags)
 {
-        return arch_get_unmapped_area_foo(filp,
+        return arch_get_unmapped_area_common(filp,
                        addr0, len, pgoff, flags, UP);
 }
@@ -213,7 +215,7 @@ unsigned long arch_get_unmapped_area_topdown(struct file *filp,
        unsigned long addr0, unsigned long len, unsigned long pgoff,
        unsigned long flags)
 {
-        return arch_get_unmapped_area_foo(filp,
+        return arch_get_unmapped_area_common(filp,
                        addr0, len, pgoff, flags, DOWN);
 }
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index b6e1cff50667..e06370f58ef3 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -1759,14 +1759,13 @@ static void __cpuinit build_r3000_tlb_modify_handler(void)
        u32 *p = handle_tlbm;
        struct uasm_label *l = labels;
        struct uasm_reloc *r = relocs;
-        struct work_registers wr;
        memset(handle_tlbm, 0, sizeof(handle_tlbm));
        memset(labels, 0, sizeof(labels));
        memset(relocs, 0, sizeof(relocs));
        build_r3000_tlbchange_handler_head(&p, K0, K1);
-        build_pte_modifiable(&p, &r, wr.r1, wr.r2,  wr.r3, label_nopage_tlbm);
+        build_pte_modifiable(&p, &r, K0, K1,  -1, label_nopage_tlbm);
        uasm_i_nop(&p); /* load delay */
        build_make_write(&p, &r, K0, K1);
        build_r3000_pte_reload_tlbwi(&p, K0, K1);
@@ -1963,7 +1962,8 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
                        uasm_i_andi(&p, wr.r3, wr.r3, 2);
                        uasm_il_beqz(&p, &r, wr.r3, label_tlbl_goaround2);
                }
+                if (PM_DEFAULT_MASK == 0)
+                        uasm_i_nop(&p);
                /*
                 * We clobbered C0_PAGEMASK, restore it.  On the other branch
                 * it is restored in build_huge_tlb_write_entry.
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 1d36c511a7a5..d53ff91b277c 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -350,12 +350,14 @@ unsigned int plat_ipi_resched_int_xlate(unsigned int cpu)
 static struct irqaction i8259irq = {
        .handler = no_action,
-        .name = "XT-PIC cascade"
+        .name = "XT-PIC cascade",
+        .flags = IRQF_NO_THREAD,
 };
 static struct irqaction corehi_irqaction = {
        .handler = no_action,
-        .name = "CoreHi"
+        .name = "CoreHi",
+        .flags = IRQF_NO_THREAD,
 };
 static msc_irqmap_t __initdata msc_irqmap[] = {
diff --git a/arch/mips/netlogic/xlr/Makefile b/arch/mips/netlogic/xlr/Makefile
index 9bd3f731f62e..2dca585dd2f7 100644
--- a/arch/mips/netlogic/xlr/Makefile
+++ b/arch/mips/netlogic/xlr/Makefile
@@ -2,4 +2,4 @@ obj-y				+= setup.o platform.o irq.o setup.o time.o
 obj-$(CONFIG_SMP)               += smp.o smpboot.o
 obj-$(CONFIG_EARLY_PRINTK)      += xlr_console.o
-EXTRA_CFLAGS                    += -Werror
+ccflags-y                       += -Werror
diff --git a/arch/mips/pci/pci-lantiq.c b/arch/mips/pci/pci-lantiq.c
index 603d7493e966..8656388b34bd 100644
--- a/arch/mips/pci/pci-lantiq.c
+++ b/arch/mips/pci/pci-lantiq.c
@@ -171,8 +171,13 @@ static int __devinit ltq_pci_startup(struct ltq_pci_data *conf)
        u32 temp_buffer;
        /* set clock to 33Mhz */
-        ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) & ~0xf00000, LTQ_CGU_IFCCR);
+        if (ltq_is_ar9()) {
-        ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) | 0x800000, LTQ_CGU_IFCCR);
+                ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) & ~0x1f00000, LTQ_CGU_IFCCR);
+                ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) | 0xe00000, LTQ_CGU_IFCCR);
+        } else {
+                ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) & ~0xf00000, LTQ_CGU_IFCCR);
+                ltq_cgu_w32(ltq_cgu_r32(LTQ_CGU_IFCCR) | 0x800000, LTQ_CGU_IFCCR);
+        }
        /* external or internal clock ? */
        if (conf->clock) {
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index 764362ce5e40..5f3a69cebad1 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -215,7 +215,7 @@ static int __init rc32434_pci_init(void)
        rc32434_pcibridge_init();
        io_map_base = ioremap(rc32434_res_pci_io1.start,
-                              resource_size(&rcrc32434_res_pci_io1));
+                              resource_size(&rc32434_res_pci_io1));
        if (!io_map_base)
                return -ENOMEM;
diff --git a/arch/mips/pmc-sierra/msp71xx/msp_irq.c b/arch/mips/pmc-sierra/msp71xx/msp_irq.c
index 4531c4a514bc..d3c3d81757a5 100644
--- a/arch/mips/pmc-sierra/msp71xx/msp_irq.c
+++ b/arch/mips/pmc-sierra/msp71xx/msp_irq.c
@@ -108,12 +108,14 @@ asmlinkage void plat_irq_dispatch(struct pt_regs *regs)
 static struct irqaction cic_cascade_msp = {
        .handler = no_action,
-        .name    = "MSP CIC cascade"
+        .name    = "MSP CIC cascade",
+        .flags   = IRQF_NO_THREAD,
 };
 static struct irqaction per_cascade_msp = {
        .handler = no_action,
-        .name    = "MSP PER cascade"
+        .name    = "MSP PER cascade",
+        .flags   = IRQF_NO_THREAD,
 };
 void __init arch_init_irq(void)
diff --git a/arch/mips/pnx8550/common/int.c b/arch/mips/pnx8550/common/int.c
index 6b93c81779c1..1ebe22bdadc8 100644
--- a/arch/mips/pnx8550/common/int.c
+++ b/arch/mips/pnx8550/common/int.c
@@ -167,7 +167,7 @@ static struct irq_chip level_irq_type = {
 static struct irqaction gic_action = {
        .handler =      no_action,
-        .flags =        IRQF_DISABLED,
+        .flags =        IRQF_DISABLED | IRQF_NO_THREAD,
        .name =         "GIC",
 };
diff --git a/arch/mips/sgi-ip22/ip22-int.c b/arch/mips/sgi-ip22/ip22-int.c
index b4d08e4d2ea9..f72c336ea27b 100644
--- a/arch/mips/sgi-ip22/ip22-int.c
+++ b/arch/mips/sgi-ip22/ip22-int.c
@@ -155,32 +155,32 @@ static void __irq_entry indy_buserror_irq(void)
 static struct irqaction local0_cascade = {
        .handler        = no_action,
-        .flags          = IRQF_DISABLED,
+        .flags          = IRQF_DISABLED | IRQF_NO_THREAD,
        .name           = "local0 cascade",
 };
 static struct irqaction local1_cascade = {
        .handler        = no_action,
-        .flags          = IRQF_DISABLED,
+        .flags          = IRQF_DISABLED | IRQF_NO_THREAD,
        .name           = "local1 cascade",
 };
 static struct irqaction buserr = {
        .handler        = no_action,
-        .flags          = IRQF_DISABLED,
+        .flags          = IRQF_DISABLED | IRQF_NO_THREAD,
        .name           = "Bus Error",
 };
 static struct irqaction map0_cascade = {
        .handler        = no_action,
-        .flags          = IRQF_DISABLED,
+        .flags          = IRQF_DISABLED | IRQF_NO_THREAD,
        .name           = "mapable0 cascade",
 };
 #ifdef USE_LIO3_IRQ
 static struct irqaction map1_cascade = {
        .handler        = no_action,
-        .flags          = IRQF_DISABLED,
+        .flags          = IRQF_DISABLED | IRQF_NO_THREAD,
        .name           = "mapable1 cascade",
 };
 #define SGI_INTERRUPTS  SGINT_END
diff --git a/arch/mips/sni/rm200.c b/arch/mips/sni/rm200.c
index a7e5a6d917b1..3ab5b5d25b0a 100644
--- a/arch/mips/sni/rm200.c
+++ b/arch/mips/sni/rm200.c
@@ -359,6 +359,7 @@ void sni_rm200_init_8259A(void)
 static struct irqaction sni_rm200_irq2 = {
        .handler = no_action,
        .name = "cascade",
+        .flags = IRQF_NO_THREAD,
 };
 static struct resource sni_rm200_pic1_resource = {
diff --git a/arch/mips/vr41xx/common/irq.c b/arch/mips/vr41xx/common/irq.c
index 70a3b85f3757..fad2bef432cd 100644
--- a/arch/mips/vr41xx/common/irq.c
+++ b/arch/mips/vr41xx/common/irq.c
@@ -34,6 +34,7 @@ static irq_cascade_t irq_cascade[NR_IRQS] __cacheline_aligned;
 static struct irqaction cascade_irqaction = {
        .handler        = no_action,
        .name           = "cascade",
+        .flags          = IRQF_NO_THREAD,
 };
 int cascade_irq(unsigned int irq, int (*get_irq)(unsigned int))
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index 5cc83851ad06..31a7d3a7ce25 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -561,6 +561,20 @@ static struct pci_ops u4_pcie_pci_ops =
        .write = u4_pcie_write_config,
 };
+static void __devinit pmac_pci_fixup_u4_of_node(struct pci_dev *dev)
+{
+        /* Apple's device-tree "hides" the root complex virtual P2P bridge
+         * on U4. However, Linux sees it, causing the PCI <-> OF matching
+         * code to fail to properly match devices below it. This works around
+         * it by setting the node of the bridge to point to the PHB node,
+         * which is not entirely correct but fixes the matching code and
+         * doesn't break anything else. It's also the simplest possible fix.
+         */
+        if (dev->dev.of_node == NULL)
+                dev->dev.of_node = pcibios_get_phb_of_node(dev->bus);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, 0x5b, pmac_pci_fixup_u4_of_node);
 #endif /* CONFIG_PPC64 */
 #ifdef CONFIG_PPC32
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 64b61bf72e93..547f1a6a35d4 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -188,7 +188,8 @@ extern char elf_platform[];
 #define SET_PERSONALITY(ex)                                     \
 do {                                                            \
        if (personality(current->personality) != PER_LINUX32)   \
-                set_personality(PER_LINUX);                     \
+                set_personality(PER_LINUX |                     \
+                        (current->personality & ~PER_MASK));    \
        if ((ex).e_ident[EI_CLASS] == ELFCLASS32)               \
                set_thread_flag(TIF_31BIT);                     \
        else                                                    \
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 519eb5f187ef..c0cb794bb365 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -658,12 +658,14 @@ static inline void pgste_set_pte(pte_t *ptep, pgste_t pgste)
 * struct gmap_struct - guest address space
 * @mm: pointer to the parent mm_struct
 * @table: pointer to the page directory
+ * @asce: address space control element for gmap page table
 * @crst_list: list of all crst tables used in the guest address space
 */
 struct gmap {
        struct list_head list;
        struct mm_struct *mm;
        unsigned long *table;
+        unsigned long asce;
        struct list_head crst_list;
 };
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 532fd4322156..2b45591e1582 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
 #include <linux/sched.h>
 #include <asm/vdso.h>
 #include <asm/sigp.h>
+#include <asm/pgtable.h>
 /*
 * Make sure that the compiler is new enough. We want a compiler that
@@ -126,6 +127,7 @@ int main(void)
        DEFINE(__LC_KERNEL_STACK, offsetof(struct _lowcore, kernel_stack));
        DEFINE(__LC_ASYNC_STACK, offsetof(struct _lowcore, async_stack));
        DEFINE(__LC_PANIC_STACK, offsetof(struct _lowcore, panic_stack));
+        DEFINE(__LC_USER_ASCE, offsetof(struct _lowcore, user_asce));
        DEFINE(__LC_INT_CLOCK, offsetof(struct _lowcore, int_clock));
        DEFINE(__LC_MCCK_CLOCK, offsetof(struct _lowcore, mcck_clock));
        DEFINE(__LC_MACHINE_FLAGS, offsetof(struct _lowcore, machine_flags));
@@ -151,6 +153,7 @@ int main(void)
        DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
        DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
        DEFINE(__LC_CMF_HPP, offsetof(struct _lowcore, cmf_hpp));
+        DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
 #endif /* CONFIG_32BIT */
        return 0;
 }
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 5f729d627cef..713da0760538 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -1076,6 +1076,11 @@ sie_loop:
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
        tm      __TI_flags+7(%r14),_TIF_EXIT_SIE
        jnz     sie_exit
+        lg      %r14,__LC_GMAP                  # get gmap pointer
+        ltgr    %r14,%r14
+        jz      sie_gmap
+        lctlg   %c1,%c1,__GMAP_ASCE(%r14)       # load primary asce
+sie_gmap:
        lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
        SPP     __SF_EMPTY(%r15)                # set guest id
        sie     0(%r14)
@@ -1083,6 +1088,7 @@ sie_done:
        SPP     __LC_CMF_HPP                    # set host id
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
 sie_exit:
+        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
        ni      __TI_flags+6(%r14),255-(_TIF_SIE>>8)
        lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
        stmg    %r0,%r13,0(%r14)                # save guest gprs 0-13
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f17296e4fc89..dc2b580e27bc 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -123,6 +123,7 @@ int kvm_dev_ioctl_check_extension(long ext)
        switch (ext) {
        case KVM_CAP_S390_PSW:
+        case KVM_CAP_S390_GMAP:
                r = 1;
                break;
        default:
@@ -263,10 +264,12 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        vcpu->arch.guest_fpregs.fpc &= FPC_VALID_MASK;
        restore_fp_regs(&vcpu->arch.guest_fpregs);
        restore_access_regs(vcpu->arch.guest_acrs);
+        gmap_enable(vcpu->arch.gmap);
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 {
+        gmap_disable(vcpu->arch.gmap);
        save_fp_regs(&vcpu->arch.guest_fpregs);
        save_access_regs(vcpu->arch.guest_acrs);
        restore_fp_regs(&vcpu->arch.host_fpregs);
@@ -461,7 +464,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        local_irq_disable();
        kvm_guest_enter();
        local_irq_enable();
-        gmap_enable(vcpu->arch.gmap);
        VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                   atomic_read(&vcpu->arch.sie_block->cpuflags));
        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
@@ -470,7 +472,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        }
        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                   vcpu->arch.sie_block->icptcode);
-        gmap_disable(vcpu->arch.gmap);
        local_irq_disable();
        kvm_guest_exit();
        local_irq_enable();
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 4d1f2bce87b3..5d56c2b95b14 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -160,6 +160,8 @@ struct gmap *gmap_alloc(struct mm_struct *mm)
        table = (unsigned long *) page_to_phys(page);
        crst_table_init(table, _REGION1_ENTRY_EMPTY);
        gmap->table = table;
+        gmap->asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
+                     _ASCE_USER_BITS | __pa(table);
        list_add(&gmap->list, &mm->context.gmap_list);
        return gmap;
@@ -240,10 +242,6 @@ EXPORT_SYMBOL_GPL(gmap_free);
 */
 void gmap_enable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
-                                 _ASCE_USER_BITS | __pa(gmap->table);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = (unsigned long) gmap;
 }
 EXPORT_SYMBOL_GPL(gmap_enable);
@@ -254,10 +252,6 @@ EXPORT_SYMBOL_GPL(gmap_enable);
 */
 void gmap_disable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce =
-                gmap->mm->context.asce_bits | __pa(gmap->mm->pgd);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = 0UL;
 }
 EXPORT_SYMBOL_GPL(gmap_disable);
@@ -309,15 +303,15 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                /* Walk the guest addr space page table */
                table = gmap->table + (((to + off) >> 53) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 42) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 31) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 20) & 0x7ff);
@@ -325,6 +319,7 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                flush |= gmap_unlink_segment(gmap, table);
                *table = _SEGMENT_ENTRY_INV;
        }
+out:
        up_read(&gmap->mm->mmap_sem);
        if (flush)
                gmap_flush_tlb(gmap);
diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
index 1407c07bdade..f6ae2b2b6870 100644
--- a/arch/sparc/include/asm/pgtsrmmu.h
+++ b/arch/sparc/include/asm/pgtsrmmu.h
@@ -280,7 +280,7 @@ static inline unsigned long srmmu_hwprobe(unsigned long vaddr)
        return retval;
 }
 #else
-#define srmmu_hwprobe(addr) (srmmu_swprobe(addr, 0) & SRMMU_PTE_PMASK)
+#define srmmu_hwprobe(addr) srmmu_swprobe(addr, 0)
 #endif
 static inline int
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index 55a17c6efeb8..d06a26601753 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -43,6 +43,8 @@
 #define SUN4V_CHIP_NIAGARA1     0x01
 #define SUN4V_CHIP_NIAGARA2     0x02
 #define SUN4V_CHIP_NIAGARA3     0x03
+#define SUN4V_CHIP_NIAGARA4     0x04
+#define SUN4V_CHIP_NIAGARA5     0x05
 #define SUN4V_CHIP_UNKNOWN      0xff
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/include/asm/xor_64.h b/arch/sparc/include/asm/xor_64.h
index 9ed6ff679ab7..ee8edc68423e 100644
--- a/arch/sparc/include/asm/xor_64.h
+++ b/arch/sparc/include/asm/xor_64.h
@@ -66,6 +66,8 @@ static struct xor_block_template xor_block_niagara = {
        ((tlb_type == hypervisor && \
          (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 || \
           sun4v_chip_type == SUN4V_CHIP_NIAGARA2 || \
-           sun4v_chip_type == SUN4V_CHIP_NIAGARA3)) ? \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA3 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA4 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA5)) ? \
         &xor_block_niagara : \
         &xor_block_VIS)
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 9810fd881058..ba9b1cec4e6b 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -481,6 +481,18 @@ static void __init sun4v_cpu_probe(void)
                sparc_pmu_type = "niagara3";
                break;
+        case SUN4V_CHIP_NIAGARA4:
+                sparc_cpu_type = "UltraSparc T4 (Niagara4)";
+                sparc_fpu_type = "UltraSparc T4 integrated FPU";
+                sparc_pmu_type = "niagara4";
+                break;
+        case SUN4V_CHIP_NIAGARA5:
+                sparc_cpu_type = "UltraSparc T5 (Niagara5)";
+                sparc_fpu_type = "UltraSparc T5 integrated FPU";
+                sparc_pmu_type = "niagara5";
+                break;
        default:
                printk(KERN_WARNING "CPU: Unknown sun4v cpu type [%s]\n",
                       prom_cpu_compatible);
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index 4197e8d62d4c..9323eafccb93 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -325,6 +325,8 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
        case SUN4V_CHIP_NIAGARA1:
        case SUN4V_CHIP_NIAGARA2:
        case SUN4V_CHIP_NIAGARA3:
+        case SUN4V_CHIP_NIAGARA4:
+        case SUN4V_CHIP_NIAGARA5:
                rover_inc_table = niagara_iterate_method;
                break;
        default:
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 0eac1b2fc53d..0d810c2f1d00 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -133,7 +133,7 @@ prom_sun4v_name:
 prom_niagara_prefix:
        .asciz  "SUNW,UltraSPARC-T"
 prom_sparc_prefix:
-        .asciz  "SPARC-T"
+        .asciz  "SPARC-"
        .align  4
 prom_root_compatible:
        .skip   64
@@ -396,7 +396,7 @@ sun4v_chip_type:
        or      %g1, %lo(prom_cpu_compatible), %g1
        sethi   %hi(prom_sparc_prefix), %g7
        or      %g7, %lo(prom_sparc_prefix), %g7
-        mov     7, %g3
+        mov     6, %g3
 90:     ldub    [%g7], %g2
        ldub    [%g1], %g4
        cmp     %g2, %g4
@@ -408,10 +408,23 @@ sun4v_chip_type:
        sethi   %hi(prom_cpu_compatible), %g1
        or      %g1, %lo(prom_cpu_compatible), %g1
-        ldub    [%g1 + 7], %g2
+        ldub    [%g1 + 6], %g2
+        cmp     %g2, 'T'
+        be,pt   %xcc, 70f
+         cmp    %g2, 'M'
+        bne,pn  %xcc, 4f
+         nop
+70:     ldub    [%g1 + 7], %g2
        cmp     %g2, '3'
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA3, %g4
+        cmp     %g2, '4'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA4, %g4
+        cmp     %g2, '5'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA5, %g4
        ba,pt   %xcc, 4f
         nop
@@ -545,6 +558,12 @@ niagara_tlb_fixup:
        cmp     %g1, SUN4V_CHIP_NIAGARA3
        be,pt   %xcc, niagara2_patch
         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA4
+        be,pt   %xcc, niagara2_patch
+         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA5
+        be,pt   %xcc, niagara2_patch
+         nop
        call    generic_patch_copyops
         nop
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index 1e94f946570e..8aa0d4408586 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -230,7 +230,8 @@ static void pci_parse_of_addrs(struct platform_device *op,
                        res = &dev->resource[(i - PCI_BASE_ADDRESS_0) >> 2];
                } else if (i == dev->rom_base_reg) {
                        res = &dev->resource[PCI_ROM_RESOURCE];
-                        flags |= IORESOURCE_READONLY | IORESOURCE_CACHEABLE;
+                        flags |= IORESOURCE_READONLY | IORESOURCE_CACHEABLE
+                              | IORESOURCE_SIZEALIGN;
                } else {
                        printk(KERN_ERR "PCI: bad cfg reg num 0x%x\n", i);
                        continue;
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index c8cc461ff75f..f793742eec2b 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -380,8 +380,7 @@ void flush_thread(void)
 #endif
        }
-        /* Now, this task is no longer a kernel thread. */
+        /* This task is no longer a kernel thread. */
-        current->thread.current_ds = USER_DS;
        if (current->thread.flags & SPARC_FLAG_KTHREAD) {
                current->thread.flags &= ~SPARC_FLAG_KTHREAD;
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index c158a95ec664..d959cd0a4aa4 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -368,9 +368,6 @@ void flush_thread(void)
        /* Clear FPU register state. */
        t->fpsaved[0] = 0;
-        
-        if (get_thread_current_ds() != ASI_AIUS)
-                set_fs(USER_DS);
 }
 /* It's a bit more tricky when 64-bit tasks are involved... */
diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
index d26e1f6c717a..3e3e2914c70b 100644
--- a/arch/sparc/kernel/setup_32.c
+++ b/arch/sparc/kernel/setup_32.c
@@ -137,7 +137,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        default:
                printk("Unknown boot switch (-%c)\n", c);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 3c5bb784214f..c965595aa7e9 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -106,7 +106,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        case 'P':
                /* Force UltraSPARC-III P-Cache on. */
@@ -425,10 +425,14 @@ static void __init init_sparc64_elf_hwcap(void)
        else if (tlb_type == hypervisor) {
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 ||
                    sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_BLKINIT;
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_N2;
        }
@@ -452,11 +456,15 @@ static void __init init_sparc64_elf_hwcap(void)
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1)
                                cap |= AV_SPARC_ASI_BLK_INIT;
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
                                        AV_SPARC_ASI_BLK_INIT |
                                        AV_SPARC_POPC);
-                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
                                        AV_SPARC_FMAF);
                }
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index 1ba95aff5d59..2caa556db86d 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -273,10 +273,7 @@ void do_sigreturn32(struct pt_regs *regs)
                case 1: set.sig[0] = seta[0] + (((long)seta[1]) << 32);
        }
        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
        return;
 segv:
@@ -377,10 +374,7 @@ asmlinkage void do_rt_sigreturn32(struct pt_regs *regs)
                case 1: set.sig[0] = seta.sig[0] + (((long)seta.sig[1]) << 32);
        }
        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
        return;
 segv:
        force_sig(SIGSEGV, current);
@@ -782,6 +776,7 @@ static inline int handle_signal32(unsigned long signr, struct k_sigaction *ka,
                                  siginfo_t *info,
                                  sigset_t *oldset, struct pt_regs *regs)
 {
+        sigset_t blocked;
        int err;
        if (ka->sa.sa_flags & SA_SIGINFO)
@@ -792,12 +787,10 @@ static inline int handle_signal32(unsigned long signr, struct k_sigaction *ka,
        if (err)
                return err;
-        spin_lock_irq(&current->sighand->siglock);
+        sigorsets(&blocked, &current->blocked, &ka->sa.sa_mask);
-        sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
        if (!(ka->sa.sa_flags & SA_NOMASK))
-                sigaddset(&current->blocked,signr);
+                sigaddset(&blocked, signr);
-        recalc_sigpending();
+        set_current_blocked(&blocked);
-        spin_unlock_irq(&current->sighand->siglock);
        tracehook_signal_handler(signr, info, ka, regs, 0);
@@ -881,7 +874,7 @@ void do_signal32(sigset_t *oldset, struct pt_regs * regs,
         */
        if (current_thread_info()->status & TS_RESTORE_SIGMASK) {
                current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
-                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+                set_current_blocked(&current->saved_sigmask);
        }
 }
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 04ede8f04add..8ce247ac04cc 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -62,12 +62,13 @@ struct rt_signal_frame {
 static int _sigpause_common(old_sigset_t set)
 {
-        set &= _BLOCKABLE;
+        sigset_t blocked;
-        spin_lock_irq(&current->sighand->siglock);
        current->saved_sigmask = current->blocked;
-        siginitset(&current->blocked, set);
-        recalc_sigpending();
+        set &= _BLOCKABLE;
-        spin_unlock_irq(&current->sighand->siglock);
+        siginitset(&blocked, set);
+        set_current_blocked(&blocked);
        current->state = TASK_INTERRUPTIBLE;
        schedule();
@@ -139,10 +140,7 @@ asmlinkage void do_sigreturn(struct pt_regs *regs)
                goto segv_and_exit;
        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
        return;
 segv_and_exit:
@@ -209,10 +207,7 @@ asmlinkage void do_rt_sigreturn(struct pt_regs *regs)
        }
        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
        return;
 segv:
        force_sig(SIGSEGV, current);
@@ -470,6 +465,7 @@ static inline int
 handle_signal(unsigned long signr, struct k_sigaction *ka,
              siginfo_t *info, sigset_t *oldset, struct pt_regs *regs)
 {
+        sigset_t blocked;
        int err;
        if (ka->sa.sa_flags & SA_SIGINFO)
@@ -480,12 +476,10 @@ handle_signal(unsigned long signr, struct k_sigaction *ka,
        if (err)
                return err;
-        spin_lock_irq(&current->sighand->siglock);
+        sigorsets(&blocked, &current->blocked, &ka->sa.sa_mask);
-        sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
        if (!(ka->sa.sa_flags & SA_NOMASK))
-                sigaddset(&current->blocked, signr);
+                sigaddset(&blocked, signr);
-        recalc_sigpending();
+        set_current_blocked(&blocked);
-        spin_unlock_irq(&current->sighand->siglock);
        tracehook_signal_handler(signr, info, ka, regs, 0);
@@ -581,7 +575,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
         */
        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
                clear_thread_flag(TIF_RESTORE_SIGMASK);
-                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+                set_current_blocked(&current->saved_sigmask);
        }
 }
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 47509df3b893..a2b81598d905 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -70,10 +70,7 @@ asmlinkage void sparc64_set_context(struct pt_regs *regs)
                                goto do_sigsegv;
                }
                sigdelsetmask(&set, ~_BLOCKABLE);
-                spin_lock_irq(&current->sighand->siglock);
+                set_current_blocked(&set);
-                current->blocked = set;
-                recalc_sigpending();
-                spin_unlock_irq(&current->sighand->siglock);
        }
        if (test_thread_flag(TIF_32BIT)) {
                pc &= 0xffffffff;
@@ -242,12 +239,13 @@ struct rt_signal_frame {
 static long _sigpause_common(old_sigset_t set)
 {
-        set &= _BLOCKABLE;
+        sigset_t blocked;
-        spin_lock_irq(&current->sighand->siglock);
        current->saved_sigmask = current->blocked;
-        siginitset(&current->blocked, set);
-        recalc_sigpending();
+        set &= _BLOCKABLE;
-        spin_unlock_irq(&current->sighand->siglock);
+        siginitset(&blocked, set);
+        set_current_blocked(&blocked);
        current->state = TASK_INTERRUPTIBLE;
        schedule();
@@ -327,10 +325,7 @@ void do_rt_sigreturn(struct pt_regs *regs)
        pt_regs_clear_syscall(regs);
        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
        return;
 segv:
        force_sig(SIGSEGV, current);
@@ -484,18 +479,17 @@ static inline int handle_signal(unsigned long signr, struct k_sigaction *ka,
                                siginfo_t *info,
                                sigset_t *oldset, struct pt_regs *regs)
 {
+        sigset_t blocked;
        int err;
        err = setup_rt_frame(ka, regs, signr, oldset,
                             (ka->sa.sa_flags & SA_SIGINFO) ? info : NULL);
        if (err)
                return err;
-        spin_lock_irq(&current->sighand->siglock);
+        sigorsets(&blocked, &current->blocked, &ka->sa.sa_mask);
-        sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
        if (!(ka->sa.sa_flags & SA_NOMASK))
-                sigaddset(&current->blocked,signr);
+                sigaddset(&blocked, signr);
-        recalc_sigpending();
+        set_current_blocked(&blocked);
-        spin_unlock_irq(&current->sighand->siglock);
        tracehook_signal_handler(signr, info, ka, regs, 0);
@@ -601,7 +595,7 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
         */
        if (current_thread_info()->status & TS_RESTORE_SIGMASK) {
                current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
-                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+                set_current_blocked(&current->saved_sigmask);
        }
 }
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 581531dbc8b5..8e073d802139 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -511,6 +511,11 @@ static void __init read_obp_translations(void)
                for (i = 0; i < prom_trans_ents; i++)
                        prom_trans[i].data &= ~0x0003fe0000000000UL;
        }
+        /* Force execute bit on.  */
+        for (i = 0; i < prom_trans_ents; i++)
+                prom_trans[i].data |= (tlb_type == hypervisor ?
+                                       _PAGE_EXEC_4V : _PAGE_EXEC_4U);
 }
 static void __init hypervisor_tlb_lock(unsigned long vaddr,
diff --git a/arch/sparc/mm/leon_mm.c b/arch/sparc/mm/leon_mm.c
index e485a6804998..13c2169822a8 100644
--- a/arch/sparc/mm/leon_mm.c
+++ b/arch/sparc/mm/leon_mm.c
@@ -162,7 +162,7 @@ ready:
                printk(KERN_INFO "swprobe: padde %x\n", paddr_calc);
        if (paddr)
                *paddr = paddr_calc;
-        return paddrbase;
+        return pte;
 }
 void leon_flush_icache_all(void)
diff --git a/arch/tile/kernel/intvec_32.S b/arch/tile/kernel/intvec_32.S
index fc94607f0bd5..aecc8ed5f39b 100644
--- a/arch/tile/kernel/intvec_32.S
+++ b/arch/tile/kernel/intvec_32.S
@@ -21,7 +21,7 @@
 #include <asm/ptrace.h>
 #include <asm/thread_info.h>
 #include <asm/irqflags.h>
-#include <linux/atomic.h>
+#include <asm/atomic_32.h>
 #include <asm/asm-offsets.h>
 #include <hv/hypervisor.h>
 #include <arch/abi.h>
diff --git a/arch/tile/lib/atomic_asm_32.S b/arch/tile/lib/atomic_asm_32.S
index 1f75a2a56101..30638042691d 100644
--- a/arch/tile/lib/atomic_asm_32.S
+++ b/arch/tile/lib/atomic_asm_32.S
@@ -70,7 +70,7 @@
 */
 #include <linux/linkage.h>
-#include <linux/atomic.h>
+#include <asm/atomic_32.h>
 #include <asm/page.h>
 #include <asm/processor.h>
diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index 3f2ad2640d85..ccdbc16b8941 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -42,8 +42,11 @@ int mach_set_rtc_mmss(unsigned long nowtime)
 {
        int real_seconds, real_minutes, cmos_minutes;
        unsigned char save_control, save_freq_select;
+        unsigned long flags;
        int retval = 0;
+        spin_lock_irqsave(&rtc_lock, flags);
         /* tell the clock it's being set */
        save_control = CMOS_READ(RTC_CONTROL);
        CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL);
@@ -93,12 +96,17 @@ int mach_set_rtc_mmss(unsigned long nowtime)
        CMOS_WRITE(save_control, RTC_CONTROL);
        CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        return retval;
 }
 unsigned long mach_get_cmos_time(void)
 {
        unsigned int status, year, mon, day, hour, min, sec, century = 0;
+        unsigned long flags;
+        spin_lock_irqsave(&rtc_lock, flags);
        /*
         * If UIP is clear, then we have >= 244 microseconds before
@@ -125,6 +133,8 @@ unsigned long mach_get_cmos_time(void)
        status = CMOS_READ(RTC_CONTROL);
        WARN_ON_ONCE(RTC_ALWAYS_BCD && (status & RTC_DM_BINARY));
+        spin_unlock_irqrestore(&rtc_lock, flags);
        if (RTC_ALWAYS_BCD || !(status & RTC_DM_BINARY)) {
                sec = bcd2bin(sec);
                min = bcd2bin(min);
@@ -169,24 +179,15 @@ EXPORT_SYMBOL(rtc_cmos_write);
 int update_persistent_clock(struct timespec now)
 {
-        unsigned long flags;
+        return x86_platform.set_wallclock(now.tv_sec);
-        int retval;
-        spin_lock_irqsave(&rtc_lock, flags);
-        retval = x86_platform.set_wallclock(now.tv_sec);
-        spin_unlock_irqrestore(&rtc_lock, flags);
-        return retval;
 }
 /* not static: needed by APM */
 void read_persistent_clock(struct timespec *ts)
 {
-        unsigned long retval, flags;
+        unsigned long retval;
-        spin_lock_irqsave(&rtc_lock, flags);
        retval = x86_platform.get_wallclock();
-        spin_unlock_irqrestore(&rtc_lock, flags);
        ts->tv_sec = retval;
        ts->tv_nsec = 0;
diff --git a/arch/x86/kernel/vsyscall_64.c b/arch/x86/kernel/vsyscall_64.c
index 18ae83dd1cd7..b56c65de384d 100644
--- a/arch/x86/kernel/vsyscall_64.c
+++ b/arch/x86/kernel/vsyscall_64.c
@@ -56,7 +56,7 @@ DEFINE_VVAR(struct vsyscall_gtod_data, vsyscall_gtod_data) =
        .lock = __SEQLOCK_UNLOCKED(__vsyscall_gtod_data.lock),
 };
-static enum { EMULATE, NATIVE, NONE } vsyscall_mode = EMULATE;
+static enum { EMULATE, NATIVE, NONE } vsyscall_mode = NATIVE;
 static int __init vsyscall_setup(char *str)
 {
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 6f08bc940fa8..8b4cc5f067de 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3603,7 +3603,7 @@ done_prefixes:
                break;
        case Src2CL:
                ctxt->src2.bytes = 1;
-                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0x8;
+                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0xff;
                break;
        case Src2ImmByte:
                rc = decode_imm(ctxt, &ctxt->src2, 1, true);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 1c5b69373a00..8e8da7960dbe 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -400,7 +400,8 @@ static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
        /* xchg acts as a barrier before the setting of the high bits */
        orig.spte_low = xchg(&ssptep->spte_low, sspte.spte_low);
-        orig.spte_high = ssptep->spte_high = sspte.spte_high;
+        orig.spte_high = ssptep->spte_high;
+        ssptep->spte_high = sspte.spte_high;
        count_spte_clear(sptep, spte);
        return orig.spte;
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 039d91315bc5..404f21a3ff9e 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -43,6 +43,17 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"),
                },
        },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=30552 */
+        /* 2006 AMD HT/VIA system with two host bridges */
+        {
+                .callback = set_use_crs,
+                .ident = "ASUS M2V-MX SE",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "M2V-MX SE"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+                },
+        },
        {}
 };
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index 58425adc22c6..fe73276e026b 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -678,38 +678,40 @@ static int __init sfi_parse_devs(struct sfi_table_header *table)
        pentry = (struct sfi_device_table_entry *)sb->pentry;
        for (i = 0; i < num; i++, pentry++) {
-                if (pentry->irq != (u8)0xff) { /* native RTE case */
+                int irq = pentry->irq;
+                if (irq != (u8)0xff) { /* native RTE case */
                        /* these SPI2 devices are not exposed to system as PCI
                         * devices, but they have separate RTE entry in IOAPIC
                         * so we have to enable them one by one here
                         */
-                        ioapic = mp_find_ioapic(pentry->irq);
+                        ioapic = mp_find_ioapic(irq);
                        irq_attr.ioapic = ioapic;
-                        irq_attr.ioapic_pin = pentry->irq;
+                        irq_attr.ioapic_pin = irq;
                        irq_attr.trigger = 1;
                        irq_attr.polarity = 1;
-                        io_apic_set_pci_routing(NULL, pentry->irq, &irq_attr);
+                        io_apic_set_pci_routing(NULL, irq, &irq_attr);
                } else
-                        pentry->irq = 0; /* No irq */
+                        irq = 0; /* No irq */
                switch (pentry->type) {
                case SFI_DEV_TYPE_IPC:
                        /* ID as IRQ is a hack that will go away */
-                        pdev = platform_device_alloc(pentry->name, pentry->irq);
+                        pdev = platform_device_alloc(pentry->name, irq);
                        if (pdev == NULL) {
                                pr_err("out of memory for SFI platform device '%s'.\n",
                                                        pentry->name);
                                continue;
                        }
-                        install_irq_resource(pdev, pentry->irq);
+                        install_irq_resource(pdev, irq);
                        pr_debug("info[%2d]: IPC bus, name = %16.16s, "
-                                "irq = 0x%2x\n", i, pentry->name, pentry->irq);
+                                "irq = 0x%2x\n", i, pentry->name, irq);
                        sfi_handle_ipc_dev(pdev);
                        break;
                case SFI_DEV_TYPE_SPI:
                        memset(&spi_info, 0, sizeof(spi_info));
                        strncpy(spi_info.modalias, pentry->name, SFI_NAME_LEN);
-                        spi_info.irq = pentry->irq;
+                        spi_info.irq = irq;
                        spi_info.bus_num = pentry->host_num;
                        spi_info.chip_select = pentry->addr;
                        spi_info.max_speed_hz = pentry->max_freq;
@@ -726,7 +728,7 @@ static int __init sfi_parse_devs(struct sfi_table_header *table)
                        memset(&i2c_info, 0, sizeof(i2c_info));
                        bus = pentry->host_num;
                        strncpy(i2c_info.type, pentry->name, SFI_NAME_LEN);
-                        i2c_info.irq = pentry->irq;
+                        i2c_info.irq = irq;
                        i2c_info.addr = pentry->addr;
                        pr_debug("info[%2d]: I2C bus = %d, name = %16.16s, "
                                "irq = 0x%2x, addr = 0x%x\n", i, bus,
diff --git a/arch/x86/platform/mrst/vrtc.c b/arch/x86/platform/mrst/vrtc.c
index 73d70d65e76e..6d5dbcdd444a 100644
--- a/arch/x86/platform/mrst/vrtc.c
+++ b/arch/x86/platform/mrst/vrtc.c
@@ -58,8 +58,11 @@ EXPORT_SYMBOL_GPL(vrtc_cmos_write);
 unsigned long vrtc_get_time(void)
 {
        u8 sec, min, hour, mday, mon;
+        unsigned long flags;
        u32 year;
+        spin_lock_irqsave(&rtc_lock, flags);
        while ((vrtc_cmos_read(RTC_FREQ_SELECT) & RTC_UIP))
                cpu_relax();
@@ -70,6 +73,8 @@ unsigned long vrtc_get_time(void)
        mon = vrtc_cmos_read(RTC_MONTH);
        year = vrtc_cmos_read(RTC_YEAR);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        /* vRTC YEAR reg contains the offset to 1960 */
        year += 1960;
@@ -83,8 +88,10 @@ unsigned long vrtc_get_time(void)
 int vrtc_set_mmss(unsigned long nowtime)
 {
        int real_sec, real_min;
+        unsigned long flags;
        int vrtc_min;
+        spin_lock_irqsave(&rtc_lock, flags);
        vrtc_min = vrtc_cmos_read(RTC_MINUTES);
        real_sec = nowtime % 60;
@@ -95,6 +102,8 @@ int vrtc_set_mmss(unsigned long nowtime)
        vrtc_cmos_write(real_sec, RTC_SECONDS);
        vrtc_cmos_write(real_min, RTC_MINUTES);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        return 0;
 }
diff --git a/block/blk-core.c b/block/blk-core.c
index b2ed78afd9f0..d34433ae7917 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
 EXPORT_SYMBOL(blk_put_queue);
 /*
- * Note: If a driver supplied the queue lock, it should not zap that lock
+ * Note: If a driver supplied the queue lock, it is disconnected
- * unexpectedly as some queue cleanup components like elevator_exit() and
+ * by this function. The actual state of the lock doesn't matter
- * blk_throtl_exit() need queue lock.
+ * here as the request_queue isn't accessible after this point
+ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
 */
 void blk_cleanup_queue(struct request_queue *q)
 {
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
        queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
        mutex_unlock(&q->sysfs_lock);
-        if (q->elevator)
+        if (q->queue_lock != &q->__queue_lock)
-                elevator_exit(q->elevator);
+                q->queue_lock = &q->__queue_lock;
-        blk_throtl_exit(q);
        blk_put_queue(q);
 }
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index e681805cdb47..60fda88c57f0 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -479,6 +479,11 @@ static void blk_release_queue(struct kobject *kobj)
        blk_sync_queue(q);
+        if (q->elevator)
+                elevator_exit(q->elevator);
+        blk_throtl_exit(q);
        if (rl->rq_pool)
                mempool_destroy(rl->rq_pool);
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index 2c18d584066d..b97294e2d95b 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -42,6 +42,22 @@ static struct pm_clk_data *__to_pcd(struct device *dev)
 }
 /**
+ * pm_clk_acquire - Acquire a device clock.
+ * @dev: Device whose clock is to be acquired.
+ * @ce: PM clock entry corresponding to the clock.
+ */
+static void pm_clk_acquire(struct device *dev, struct pm_clock_entry *ce)
+{
+        ce->clk = clk_get(dev, ce->con_id);
+        if (IS_ERR(ce->clk)) {
+                ce->status = PCE_STATUS_ERROR;
+        } else {
+                ce->status = PCE_STATUS_ACQUIRED;
+                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
+        }
+}
+/**
 * pm_clk_add - Start using a device clock for power management.
 * @dev: Device whose clock is going to be used for power management.
 * @con_id: Connection ID of the clock.
@@ -73,6 +89,8 @@ int pm_clk_add(struct device *dev, const char *con_id)
                }
        }
+        pm_clk_acquire(dev, ce);
        spin_lock_irq(&pcd->lock);
        list_add_tail(&ce->node, &pcd->clock_list);
        spin_unlock_irq(&pcd->lock);
@@ -82,17 +100,12 @@ int pm_clk_add(struct device *dev, const char *con_id)
 /**
 * __pm_clk_remove - Destroy PM clock entry.
 * @ce: PM clock entry to destroy.
- *
- * This routine must be called under the spinlock protecting the PM list of
- * clocks corresponding the the @ce's device.
 */
 static void __pm_clk_remove(struct pm_clock_entry *ce)
 {
        if (!ce)
                return;
-        list_del(&ce->node);
        if (ce->status < PCE_STATUS_ERROR) {
                if (ce->status == PCE_STATUS_ENABLED)
                        clk_disable(ce->clk);
@@ -126,18 +139,22 @@ void pm_clk_remove(struct device *dev, const char *con_id)
        spin_lock_irq(&pcd->lock);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (!con_id && !ce->con_id) {
+                if (!con_id && !ce->con_id)
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
+                else if (!con_id || !ce->con_id)
-                } else if (!con_id || !ce->con_id) {
                        continue;
-                } else if (!strcmp(con_id, ce->con_id)) {
+                else if (!strcmp(con_id, ce->con_id))
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
-                }
        }
        spin_unlock_irq(&pcd->lock);
+        return;
+ remove:
+        list_del(&ce->node);
+        spin_unlock_irq(&pcd->lock);
+        __pm_clk_remove(ce);
 }
 /**
@@ -175,20 +192,27 @@ void pm_clk_destroy(struct device *dev)
 {
        struct pm_clk_data *pcd = __to_pcd(dev);
        struct pm_clock_entry *ce, *c;
+        struct list_head list;
        if (!pcd)
                return;
        dev->power.subsys_data = NULL;
+        INIT_LIST_HEAD(&list);
        spin_lock_irq(&pcd->lock);
        list_for_each_entry_safe_reverse(ce, c, &pcd->clock_list, node)
-                __pm_clk_remove(ce);
+                list_move(&ce->node, &list);
        spin_unlock_irq(&pcd->lock);
        kfree(pcd);
+        list_for_each_entry_safe_reverse(ce, c, &list, node) {
+                list_del(&ce->node);
+                __pm_clk_remove(ce);
+        }
 }
 #endif /* CONFIG_PM */
@@ -196,23 +220,6 @@ void pm_clk_destroy(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 /**
- * pm_clk_acquire - Acquire a device clock.
- * @dev: Device whose clock is to be acquired.
- * @con_id: Connection ID of the clock.
- */
-static void pm_clk_acquire(struct device *dev,
-                                    struct pm_clock_entry *ce)
-{
-        ce->clk = clk_get(dev, ce->con_id);
-        if (IS_ERR(ce->clk)) {
-                ce->status = PCE_STATUS_ERROR;
-        } else {
-                ce->status = PCE_STATUS_ACQUIRED;
-                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
-        }
-}
-/**
 * pm_clk_suspend - Disable clocks in a device's PM clock list.
 * @dev: Device to disable the clocks for.
 */
@@ -230,9 +237,6 @@ int pm_clk_suspend(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry_reverse(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_disable(ce->clk);
                        ce->status = PCE_STATUS_ACQUIRED;
@@ -262,9 +266,6 @@ int pm_clk_resume(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_enable(ce->clk);
                        ce->status = PCE_STATUS_ENABLED;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f6595aba4f0f..fa567f1158c2 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -43,6 +43,7 @@ config TCG_NSC
 config TCG_ATMEL
        tristate "Atmel TPM Interface"
+        depends on PPC64 || HAS_IOPORT
        ---help---
          If you have a TPM security chip from Atmel say Yes and it 
          will be accessible from within Linux.  To compile this driver 
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index caf8012ef47c..9ca5c021d0b6 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
        u32 count, ordinal;
        unsigned long stop;
+        if (bufsiz > TPM_BUFSIZE)
+                bufsiz = TPM_BUFSIZE;
        count = be32_to_cpu(*((__be32 *) (buf + 2)));
        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
        if (count == 0)
@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
        struct tpm_chip *chip = file->private_data;
        ssize_t ret_size;
+        int rc;
        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;
                mutex_lock(&chip->buffer_mutex);
-                if (copy_to_user(buf, chip->data_buffer, ret_size))
+                rc = copy_to_user(buf, chip->data_buffer, ret_size);
+                memset(chip->data_buffer, 0, ret_size);
+                if (rc)
                        ret_size = -EFAULT;
                mutex_unlock(&chip->buffer_mutex);
        }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 82facc9104c7..4d2464871ada 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
        if (pdev) {
                tpm_nsc_remove(&pdev->dev);
                platform_device_unregister(pdev);
-                kfree(pdev);
-                pdev = NULL;
        }
        platform_driver_unregister(&nsc_drv);
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 0599854e2217..118ec12d2d5f 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -34,8 +34,8 @@ struct gpio_bank {
        u16 irq;
        u16 virtual_irq_start;
        int method;
-#if defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP2PLUS)
        u32 suspend_wakeup;
+#if defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP2PLUS)
        u32 saved_wakeup;
 #endif
        u32 non_wakeup_gpios;
diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c
index c43b8ff626a7..0550dcb85814 100644
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -577,6 +577,7 @@ pca953x_get_alt_pdata(struct i2c_client *client, int *gpio_base, int *invert)
 void
 pca953x_get_alt_pdata(struct i2c_client *client, int *gpio_base, int *invert)
 {
+        *gpio_base = -1;
 }
 #endif
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index ce045a8cf82c..f07e4252b708 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -67,11 +67,11 @@ module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 MODULE_PARM_DESC(i915_enable_rc6,
                "Enable power-saving render C-state 6 (default: true)");
-unsigned int i915_enable_fbc __read_mostly = 1;
+unsigned int i915_enable_fbc __read_mostly = -1;
 module_param_named(i915_enable_fbc, i915_enable_fbc, int, 0600);
 MODULE_PARM_DESC(i915_enable_fbc,
                "Enable frame buffer compression for power savings "
-                "(default: false)");
+                "(default: -1 (use per-chip default))");
 unsigned int i915_lvds_downclock __read_mostly = 0;
 module_param_named(lvds_downclock, i915_lvds_downclock, int, 0400);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 56a8554d9039..04411ad2e779 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1799,6 +1799,7 @@ static void intel_update_fbc(struct drm_device *dev)
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
        struct drm_i915_gem_object *obj;
+        int enable_fbc;
        DRM_DEBUG_KMS("\n");
@@ -1839,8 +1840,15 @@ static void intel_update_fbc(struct drm_device *dev)
        intel_fb = to_intel_framebuffer(fb);
        obj = intel_fb->obj;
-        if (!i915_enable_fbc) {
+        enable_fbc = i915_enable_fbc;
-                DRM_DEBUG_KMS("fbc disabled per module param (default off)\n");
+        if (enable_fbc < 0) {
+                DRM_DEBUG_KMS("fbc set to per-chip default\n");
+                enable_fbc = 1;
+                if (INTEL_INFO(dev)->gen <= 5)
+                        enable_fbc = 0;
+        }
+        if (!enable_fbc) {
+                DRM_DEBUG_KMS("fbc disabled per module param\n");
                dev_priv->no_fbc_reason = FBC_MODULE_PARAM;
                goto out_disable;
        }
@@ -4687,13 +4695,13 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                bpc = 6; /* min is 18bpp */
                break;
        case 24:
-                bpc = min((unsigned int)8, display_bpc);
+                bpc = 8;
                break;
        case 30:
-                bpc = min((unsigned int)10, display_bpc);
+                bpc = 10;
                break;
        case 48:
-                bpc = min((unsigned int)12, display_bpc);
+                bpc = 12;
                break;
        default:
                DRM_DEBUG("unsupported depth, assuming 24 bits\n");
@@ -4701,10 +4709,12 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                break;
        }
+        display_bpc = min(display_bpc, bpc);
        DRM_DEBUG_DRIVER("setting pipe bpc to %d (max display bpc %d)\n",
                         bpc, display_bpc);
-        *pipe_bpp = bpc * 3;
+        *pipe_bpp = display_bpc * 3;
        return display_bpc != bpc;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0b2ee9d39980..fe1099d8817e 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -337,9 +337,6 @@ extern void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder,
                                           struct drm_connector *connector,
                                           struct intel_load_detect_pipe *old);
-extern struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB);
-extern int intel_sdvo_supports_hotplug(struct drm_connector *connector);
-extern void intel_sdvo_set_hotplug(struct drm_connector *connector, int enable);
 extern void intelfb_restore(void);
 extern void intel_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                    u16 blue, int regno);
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 30fe554d8936..6348c499616f 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -92,6 +92,11 @@ struct intel_sdvo {
        */
        uint16_t attached_output;
+        /*
+         * Hotplug activation bits for this device
+         */
+        uint8_t hotplug_active[2];
        /**
         * This is used to select the color range of RBG outputs in HDMI mode.
         * It is only valid when using TMDS encoding and 8 bit per color mode.
@@ -1208,74 +1213,20 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
        return true;
 }
-/* No use! */
+static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
-#if 0
-struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB)
-{
-        struct drm_connector *connector = NULL;
-        struct intel_sdvo *iout = NULL;
-        struct intel_sdvo *sdvo;
-        /* find the sdvo connector */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                iout = to_intel_sdvo(connector);
-                if (iout->type != INTEL_OUTPUT_SDVO)
-                        continue;
-                sdvo = iout->dev_priv;
-                if (sdvo->sdvo_reg == SDVOB && sdvoB)
-                        return connector;
-                if (sdvo->sdvo_reg == SDVOC && !sdvoB)
-                        return connector;
-        }
-        return NULL;
-}
-int intel_sdvo_supports_hotplug(struct drm_connector *connector)
 {
        u8 response[2];
-        u8 status;
-        struct intel_sdvo *intel_sdvo;
-        DRM_DEBUG_KMS("\n");
-        if (!connector)
-                return 0;
-        intel_sdvo = to_intel_sdvo(connector);
        return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
                                    &response, 2) && response[0];
 }
-void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
+static void intel_sdvo_enable_hotplug(struct intel_encoder *encoder)
 {
-        u8 response[2];
+        struct intel_sdvo *intel_sdvo = to_intel_sdvo(&encoder->base);
-        u8 status;
-        struct intel_sdvo *intel_sdvo = to_intel_sdvo(connector);
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
-        if (on) {
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
-                status = intel_sdvo_read_response(intel_sdvo, &response, 2);
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        } else {
-                response[0] = 0;
-                response[1] = 0;
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        }
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
+        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &intel_sdvo->hotplug_active, 2);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
 }
-#endif
 static bool
 intel_sdvo_multifunc_encoder(struct intel_sdvo *intel_sdvo)
@@ -2045,6 +1996,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
 {
        struct drm_encoder *encoder = &intel_sdvo->base.base;
        struct drm_connector *connector;
+        struct intel_encoder *intel_encoder = to_intel_encoder(encoder);
        struct intel_connector *intel_connector;
        struct intel_sdvo_connector *intel_sdvo_connector;
@@ -2062,7 +2014,17 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
        intel_connector = &intel_sdvo_connector->base;
        connector = &intel_connector->base;
-        connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
+        if (intel_sdvo_supports_hotplug(intel_sdvo) & (1 << device)) {
+                connector->polled = DRM_CONNECTOR_POLL_HPD;
+                intel_sdvo->hotplug_active[0] |= 1 << device;
+                /* Some SDVO devices have one-shot hotplug interrupts.
+                 * Ensure that they get re-enabled when an interrupt happens.
+                 */
+                intel_encoder->hot_plug = intel_sdvo_enable_hotplug;
+                intel_sdvo_enable_hotplug(intel_encoder);
+        }
+        else
+                connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
        encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
        connector->connector_type = DRM_MODE_CONNECTOR_DVID;
@@ -2569,6 +2531,14 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
        if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                goto err;
+        /* Set up hotplug command - note paranoia about contents of reply.
+         * We assume that the hardware is in a sane state, and only touch
+         * the bits we think we understand.
+         */
+        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
+                             &intel_sdvo->hotplug_active, 2);
+        intel_sdvo->hotplug_active[0] &= ~0x3;
        if (intel_sdvo_output_setup(intel_sdvo,
                                    intel_sdvo->caps.output_flags) != true) {
                DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e88c64417a8a..14cc88aaf3a7 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -277,7 +277,12 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
        case ATOM_ARG_FB:
                idx = U8(*ptr);
                (*ptr)++;
-                val = gctx->scratch[((gctx->fb_base + idx) / 4)];
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                        val = 0;
+                } else
+                        val = gctx->scratch[(gctx->fb_base / 4) + idx];
                if (print)
                        DEBUG("FB[0x%02X]", idx);
                break;
@@ -531,7 +536,11 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
        case ATOM_ARG_FB:
                idx = U8(*ptr);
                (*ptr)++;
-                gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                } else
+                        gctx->scratch[(gctx->fb_base / 4) + idx] = val;
                DEBUG("FB[0x%02X]", idx);
                break;
        case ATOM_ARG_PLL:
@@ -1370,11 +1379,13 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
                usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
        }
+        ctx->scratch_size_bytes = 0;
        if (usage_bytes == 0)
                usage_bytes = 20 * 1024;
        /* allocate some scratch memory */
        ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
        if (!ctx->scratch)
                return -ENOMEM;
+        ctx->scratch_size_bytes = usage_bytes;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index a589a55b223e..93cfe2086ba0 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -137,6 +137,7 @@ struct atom_context {
        int cs_equal, cs_above;
        int io_mode;
        uint32_t *scratch;
+        int scratch_size_bytes;
 };
 extern int atom_debug;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c742944d3805..a515b2a09d85 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -466,7 +466,7 @@ static void atombios_crtc_program_ss(struct drm_crtc *crtc,
                        return;
                }
                args.v2.ucEnable = enable;
-                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK))
+                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK) || ASIC_IS_DCE41(rdev))
                        args.v2.ucEnable = ATOM_DISABLE;
        } else if (ASIC_IS_DCE3(rdev)) {
                args.v1.usSpreadSpectrumPercentage = cpu_to_le16(ss->percentage);
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 7ad43c6b1db7..79e8ebc05307 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -115,6 +115,7 @@ static int radeon_dp_aux_native_write(struct radeon_connector *radeon_connector,
        u8 msg[20];
        int msg_bytes = send_bytes + 4;
        u8 ack;
+        unsigned retry;
        if (send_bytes > 16)
                return -1;
@@ -125,20 +126,22 @@ static int radeon_dp_aux_native_write(struct radeon_connector *radeon_connector,
        msg[3] = (msg_bytes << 4) | (send_bytes - 1);
        memcpy(&msg[4], send, send_bytes);
-        while (1) {
+        for (retry = 0; retry < 4; retry++) {
                ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus,
                                            msg, msg_bytes, NULL, 0, delay, &ack);
-                if (ret < 0)
+                if (ret == -EBUSY)
+                        continue;
+                else if (ret < 0)
                        return ret;
                if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
-                        break;
+                        return send_bytes;
                else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
                        udelay(400);
                else
                        return -EIO;
        }
-        return send_bytes;
+        return -EIO;
 }
 static int radeon_dp_aux_native_read(struct radeon_connector *radeon_connector,
@@ -149,26 +152,31 @@ static int radeon_dp_aux_native_read(struct radeon_connector *radeon_connector,
        int msg_bytes = 4;
        u8 ack;
        int ret;
+        unsigned retry;
        msg[0] = address;
        msg[1] = address >> 8;
        msg[2] = AUX_NATIVE_READ << 4;
        msg[3] = (msg_bytes << 4) | (recv_bytes - 1);
-        while (1) {
+        for (retry = 0; retry < 4; retry++) {
                ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus,
                                            msg, msg_bytes, recv, recv_bytes, delay, &ack);
-                if (ret == 0)
+                if (ret == -EBUSY)
-                        return -EPROTO;
+                        continue;
-                if (ret < 0)
+                else if (ret < 0)
                        return ret;
                if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
                        return ret;
                else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
                        udelay(400);
+                else if (ret == 0)
+                        return -EPROTO;
                else
                        return -EIO;
        }
+        return -EIO;
 }
 static void radeon_write_dpcd_reg(struct radeon_connector *radeon_connector,
@@ -232,7 +240,9 @@ int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
        for (retry = 0; retry < 4; retry++) {
                ret = radeon_process_aux_ch(auxch,
                                            msg, msg_bytes, reply, reply_bytes, 0, &ack);
-                if (ret < 0) {
+                if (ret == -EBUSY)
+                        continue;
+                else if (ret < 0) {
                        DRM_DEBUG_KMS("aux_ch failed %d\n", ret);
                        return ret;
                }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index e8a746712b5b..c4ffa14fb2f4 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1590,48 +1590,6 @@ static u32 evergreen_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void evergreen_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer_lo, tcp_chan_steer_hi, mc_shared_chremap, tmp;
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        case 2:
-        case 3:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        }
-        switch (rdev->family) {
-        case CHIP_HEMLOCK:
-        case CHIP_CYPRESS:
-        case CHIP_BARTS:
-                tcp_chan_steer_lo = 0x54763210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        case CHIP_JUNIPER:
-        case CHIP_REDWOOD:
-        case CHIP_CEDAR:
-        case CHIP_PALM:
-        case CHIP_SUMO:
-        case CHIP_SUMO2:
-        case CHIP_TURKS:
-        case CHIP_CAICOS:
-        default:
-                tcp_chan_steer_lo = 0x76543210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        }
-        WREG32(TCP_CHAN_STEER_LO, tcp_chan_steer_lo);
-        WREG32(TCP_CHAN_STEER_HI, tcp_chan_steer_hi);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static void evergreen_gpu_init(struct radeon_device *rdev)
 {
        u32 cc_rb_backend_disable = 0;
@@ -2078,8 +2036,6 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
        WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
        WREG32(HDP_ADDR_CONFIG, gb_addr_config);
-        evergreen_program_channel_remap(rdev);
        num_shader_engines = ((RREG32(GB_ADDR_CONFIG) & NUM_SHADER_ENGINES(3)) >> 12) + 1;
        grbm_gfx_index = INSTANCE_BROADCAST_WRITES;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 99fbd793c08c..8c79ca97753d 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -569,36 +569,6 @@ static u32 cayman_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void cayman_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer_lo, tcp_chan_steer_hi, mc_shared_chremap, tmp;
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        case 2:
-        case 3:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        }
-        switch (rdev->family) {
-        case CHIP_CAYMAN:
-        default:
-                //tcp_chan_steer_lo = 0x54763210
-                tcp_chan_steer_lo = 0x76543210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        }
-        WREG32(TCP_CHAN_STEER_LO, tcp_chan_steer_lo);
-        WREG32(TCP_CHAN_STEER_HI, tcp_chan_steer_hi);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static u32 cayman_get_disable_mask_per_asic(struct radeon_device *rdev,
                                            u32 disable_mask_per_se,
                                            u32 max_disable_mask_per_se,
@@ -842,8 +812,6 @@ static void cayman_gpu_init(struct radeon_device *rdev)
        WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
        WREG32(HDP_ADDR_CONFIG, gb_addr_config);
-        cayman_program_channel_remap(rdev);
        /* primary versions */
        WREG32(CC_RB_BACKEND_DISABLE, cc_rb_backend_disable);
        WREG32(CC_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 5b1837b4aacf..7fcdbbbf2979 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
                radeon_ring_write(rdev, 0);
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
                radeon_ring_write(rdev, cur_pages | (stride_pixels << 16));
        }
        radeon_ring_write(rdev, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index c4b8741dbf58..449c3d8c6836 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -68,11 +68,11 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
                int saved_dpms = connector->dpms;
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                /* Only turn off the display it it's physically disconnected */
-                    radeon_dp_needs_link_train(radeon_connector))
+                if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
-                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                else
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                else if (radeon_dp_needs_link_train(radeon_connector))
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                connector->dpms = saved_dpms;
        }
 }
@@ -1303,23 +1303,14 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                /* get the DPCD from the bridge */
                radeon_dp_getdpcd(radeon_connector);
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
+                if (encoder) {
-                        ret = connector_status_connected;
+                        /* setup ddc on the bridge */
-                else {
+                        radeon_atom_ext_encoder_setup_ddc(encoder);
-                        /* need to setup ddc on the bridge */
-                        if (encoder)
-                                radeon_atom_ext_encoder_setup_ddc(encoder);
                        if (radeon_ddc_probe(radeon_connector,
-                                             radeon_connector->requires_extended_probe))
+                                             radeon_connector->requires_extended_probe)) /* try DDC */
                                ret = connector_status_connected;
-                }
+                        else if (radeon_connector->dac_load_detect) { /* try load detection */
+                                struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
-                if ((ret == connector_status_disconnected) &&
-                    radeon_connector->dac_load_detect) {
-                        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
-                        struct drm_encoder_helper_funcs *encoder_funcs;
-                        if (encoder) {
-                                encoder_funcs = encoder->helper_private;
                                ret = encoder_funcs->detect(encoder, connector);
                        }
                }
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 3189a7efb2e9..fde25c0d65a0 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -208,23 +208,25 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
        int xorigin = 0, yorigin = 0;
        int w = radeon_crtc->cursor_width;
-        if (x < 0)
-                xorigin = -x + 1;
-        if (y < 0)
-                yorigin = -y + 1;
-        if (xorigin >= CURSOR_WIDTH)
-                xorigin = CURSOR_WIDTH - 1;
-        if (yorigin >= CURSOR_HEIGHT)
-                yorigin = CURSOR_HEIGHT - 1;
        if (ASIC_IS_AVIVO(rdev)) {
-                int i = 0;
-                struct drm_crtc *crtc_p;
                /* avivo cursor are offset into the total surface */
                x += crtc->x;
                y += crtc->y;
-                DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+        }
+        DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+        if (x < 0) {
+                xorigin = min(-x, CURSOR_WIDTH - 1);
+                x = 0;
+        }
+        if (y < 0) {
+                yorigin = min(-y, CURSOR_HEIGHT - 1);
+                y = 0;
+        }
+        if (ASIC_IS_AVIVO(rdev)) {
+                int i = 0;
+                struct drm_crtc *crtc_p;
                /* avivo cursor image can't end on 128 pixel boundary or
                 * go past the end of the frame if both crtcs are enabled
@@ -253,16 +255,12 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
        radeon_lock_cursor(crtc, true);
        if (ASIC_IS_DCE4(rdev)) {
-                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
+                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
-                       ((xorigin ? 0 : x) << 16) |
-                       (yorigin ? 0 : y));
                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
        } else if (ASIC_IS_AVIVO(rdev)) {
-                WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset,
+                WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
-                             ((xorigin ? 0 : x) << 16) |
-                             (yorigin ? 0 : y));
                WREG32(AVIVO_D1CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
                WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
@@ -276,8 +274,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                        | yorigin));
                WREG32(RADEON_CUR_HORZ_VERT_POSN + radeon_crtc->crtc_offset,
                       (RADEON_CUR_LOCK
-                        | ((xorigin ? 0 : x) << 16)
+                        | (x << 16)
-                        | (yorigin ? 0 : y)));
+                        | y));
                /* offset is from DISP(2)_BASE_ADDRESS */
                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
                                                                      (yorigin * 256)));
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 319d85d7e759..eb3f6dc6df83 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1507,7 +1507,14 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                switch (mode) {
                case DRM_MODE_DPMS_ON:
                        args.ucAction = ATOM_ENABLE;
-                        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                        /* workaround for DVOOutputControl on some RS690 systems */
+                        if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) {
+                                u32 reg = RREG32(RADEON_BIOS_3_SCRATCH);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE);
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg);
+                        } else
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                args.ucAction = ATOM_LCD_BLON;
                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
@@ -1631,7 +1638,17 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                        break;
                case 2:
                        args.v2.ucCRTC = radeon_crtc->crtc_id;
-                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        if (radeon_encoder_is_dp_bridge(encoder)) {
+                                struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+                                if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
+                                else if (connector->connector_type == DRM_MODE_CONNECTOR_VGA)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
+                                else
+                                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        } else
+                                args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
@@ -1748,9 +1765,17 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
        /* DCE4/5 */
        if (ASIC_IS_DCE4(rdev)) {
                dig = radeon_encoder->enc_priv;
-                if (ASIC_IS_DCE41(rdev))
+                if (ASIC_IS_DCE41(rdev)) {
-                        return radeon_crtc->crtc_id;
+                        /* ontario follows DCE4 */
-                else {
+                        if (rdev->family == CHIP_PALM) {
+                                if (dig->linkb)
+                                        return 1;
+                                else
+                                        return 0;
+                        } else
+                                /* llano follows DCE3.2 */
+                                return radeon_crtc->crtc_id;
+                } else {
                        switch (radeon_encoder->encoder_id) {
                        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                                if (dig->linkb)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 4720d000d440..b13c2eedc321 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -536,55 +536,6 @@ static u32 r700_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void rv770_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer, mc_shared_chremap, tmp;
-        bool force_no_swizzle;
-        switch (rdev->family) {
-        case CHIP_RV770:
-        case CHIP_RV730:
-                force_no_swizzle = false;
-                break;
-        case CHIP_RV710:
-        case CHIP_RV740:
-        default:
-                force_no_swizzle = true;
-                break;
-        }
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        case 2:
-        case 3:
-                if (force_no_swizzle)
-                        mc_shared_chremap = 0x00fac688;
-                else
-                        mc_shared_chremap = 0x00bbc298;
-                break;
-        }
-        if (rdev->family == CHIP_RV740)
-                tcp_chan_steer = 0x00ef2a60;
-        else
-                tcp_chan_steer = 0x00fac688;
-        /* RV770 CE has special chremap setup */
-        if (rdev->pdev->device == 0x944e) {
-                tcp_chan_steer = 0x00b08b08;
-                mc_shared_chremap = 0x00b08b08;
-        }
-        WREG32(TCP_CHAN_STEER, tcp_chan_steer);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static void rv770_gpu_init(struct radeon_device *rdev)
 {
        int i, j, num_qd_pipes;
@@ -785,8 +736,6 @@ static void rv770_gpu_init(struct radeon_device *rdev)
        WREG32(DCP_TILING_CONFIG, (gb_tiling_config & 0xffff));
        WREG32(HDP_TILING_CONFIG, (gb_tiling_config & 0xffff));
-        rv770_program_channel_remap(rdev);
        WREG32(CC_RB_BACKEND_DISABLE,      cc_rb_backend_disable);
        WREG32(CC_GC_SHADER_PIPE_CONFIG,   cc_gc_shader_pipe_config);
        WREG32(GC_USER_SHADER_PIPE_CONFIG, cc_gc_shader_pipe_config);
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ae3c6f5dd2b7..082fcaea583f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -321,7 +321,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
        struct ttm_mem_type_manager *man = &bdev->man[new_mem->mem_type];
        struct ttm_tt *ttm = bo->ttm;
        struct ttm_mem_reg *old_mem = &bo->mem;
-        struct ttm_mem_reg old_copy;
+        struct ttm_mem_reg old_copy = *old_mem;
        void *old_iomap;
        void *new_iomap;
        int ret;
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 411257676133..932383786642 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,17 +36,25 @@
 #include <linux/cpu.h>
 #include <linux/pci.h>
 #include <linux/smp.h>
+#include <linux/moduleparam.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 #define DRVNAME "coretemp"
+/*
+ * force_tjmax only matters when TjMax can't be read from the CPU itself.
+ * When set, it replaces the driver's suboptimal heuristic.
+ */
+static int force_tjmax;
+module_param_named(tjmax, force_tjmax, int, 0444);
+MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES          16      /* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
-#define MAX_THRESH_ATTRS        3       /* Maximum no of Threshold attrs */
+#define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
-#define TOTAL_ATTRS             (MAX_CORE_ATTRS + MAX_THRESH_ATTRS)
 #define MAX_CORE_DATA           (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
 #ifdef CONFIG_SMP
@@ -69,8 +77,6 @@
 *              This value is passed as "id" field to rdmsr/wrmsr functions.
 * @status_reg: One of IA32_THERM_STATUS or IA32_PACKAGE_THERM_STATUS,
 *              from where the temperature values should be read.
- * @intrpt_reg: One of IA32_THERM_INTERRUPT or IA32_PACKAGE_THERM_INTERRUPT,
- *              from where the thresholds are read.
 * @attr_size:  Total number of pre-core attrs displayed in the sysfs.
 * @is_pkg_data: If this is 1, the temp_data holds pkgtemp data.
 *              Otherwise, temp_data holds coretemp data.
@@ -79,13 +85,11 @@
 struct temp_data {
        int temp;
        int ttarget;
-        int tmin;
        int tjmax;
        unsigned long last_updated;
        unsigned int cpu;
        u32 cpu_core_id;
        u32 status_reg;
-        u32 intrpt_reg;
        int attr_size;
        bool is_pkg_data;
        bool valid;
@@ -143,19 +147,6 @@ static ssize_t show_crit_alarm(struct device *dev,
        return sprintf(buf, "%d\n", (eax >> 5) & 1);
 }
-static ssize_t show_max_alarm(struct device *dev,
-                                struct device_attribute *devattr, char *buf)
-{
-        u32 eax, edx;
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        rdmsr_on_cpu(tdata->cpu, tdata->status_reg, &eax, &edx);
-        return sprintf(buf, "%d\n", !!(eax & THERM_STATUS_THRESHOLD1));
-}
 static ssize_t show_tjmax(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -174,83 +165,6 @@ static ssize_t show_ttarget(struct device *dev,
        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->ttarget);
 }
-static ssize_t store_ttarget(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD1 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD1) |
-                                (diff << THERM_SHIFT_THRESHOLD1);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->ttarget = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
-static ssize_t show_tmin(struct device *dev,
-                        struct device_attribute *devattr, char *buf)
-{
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->tmin);
-}
-static ssize_t store_tmin(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD0 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD0) |
-                                (diff << THERM_SHIFT_THRESHOLD0);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->tmin = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
 static ssize_t show_temp(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -374,7 +288,6 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 {
-        /* The 100C is default for both mobile and non mobile CPUs */
        int err;
        u32 eax, edx;
        u32 val;
@@ -385,7 +298,8 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         */
        err = rdmsr_safe_on_cpu(id, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
        if (err) {
-                dev_warn(dev, "Unable to read TjMax from CPU.\n");
+                if (c->x86_model > 0xe && c->x86_model != 0x1c)
+                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
                val = (eax >> 16) & 0xff;
                /*
@@ -393,11 +307,17 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                 * will be used
                 */
                if (val) {
-                        dev_info(dev, "TjMax is %d C.\n", val);
+                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
        }
+        if (force_tjmax) {
+                dev_notice(dev, "TjMax forced to %d degrees C by user\n",
+                           force_tjmax);
+                return force_tjmax * 1000;
+        }
        /*
         * An assumption is made for early CPUs and unreadable MSR.
         * NOTE: the calculated value may not be correct.
@@ -414,21 +334,6 @@ static void __devinit get_ucode_rev_on_cpu(void *edx)
        rdmsr(MSR_IA32_UCODE_REV, eax, *(u32 *)edx);
 }
-static int get_pkg_tjmax(unsigned int cpu, struct device *dev)
-{
-        int err;
-        u32 eax, edx, val;
-        err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
-        if (!err) {
-                val = (eax >> 16) & 0xff;
-                if (val)
-                        return val * 1000;
-        }
-        dev_warn(dev, "Unable to read Pkg-TjMax from CPU:%u\n", cpu);
-        return 100000; /* Default TjMax: 100 degree celsius */
-}
 static int create_name_attr(struct platform_data *pdata, struct device *dev)
 {
        sysfs_attr_init(&pdata->name_attr.attr);
@@ -442,19 +347,14 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                                int attr_no)
 {
        int err, i;
-        static ssize_t (*rd_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static ssize_t (*const rd_ptr[TOTAL_ATTRS]) (struct device *dev,
                        struct device_attribute *devattr, char *buf) = {
                        show_label, show_crit_alarm, show_temp, show_tjmax,
-                        show_max_alarm, show_ttarget, show_tmin };
+                        show_ttarget };
-        static ssize_t (*rw_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static const char *const names[TOTAL_ATTRS] = {
-                        struct device_attribute *devattr, const char *buf,
-                        size_t count) = { NULL, NULL, NULL, NULL, NULL,
-                                        store_ttarget, store_tmin };
-        static const char *names[TOTAL_ATTRS] = {
                                        "temp%d_label", "temp%d_crit_alarm",
                                        "temp%d_input", "temp%d_crit",
-                                        "temp%d_max_alarm", "temp%d_max",
+                                        "temp%d_max" };
-                                        "temp%d_max_hyst" };
        for (i = 0; i < tdata->attr_size; i++) {
                snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH, names[i],
@@ -462,10 +362,6 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                sysfs_attr_init(&tdata->sd_attrs[i].dev_attr.attr);
                tdata->sd_attrs[i].dev_attr.attr.name = tdata->attr_name[i];
                tdata->sd_attrs[i].dev_attr.attr.mode = S_IRUGO;
-                if (rw_ptr[i]) {
-                        tdata->sd_attrs[i].dev_attr.attr.mode |= S_IWUSR;
-                        tdata->sd_attrs[i].dev_attr.store = rw_ptr[i];
-                }
                tdata->sd_attrs[i].dev_attr.show = rd_ptr[i];
                tdata->sd_attrs[i].index = attr_no;
                err = device_create_file(dev, &tdata->sd_attrs[i].dev_attr);
@@ -481,9 +377,9 @@ exit_free:
 }
-static int __devinit chk_ucode_version(struct platform_device *pdev)
+static int __cpuinit chk_ucode_version(unsigned int cpu)
 {
-        struct cpuinfo_x86 *c = &cpu_data(pdev->id);
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
        int err;
        u32 edx;
@@ -494,17 +390,15 @@ static int __devinit chk_ucode_version(struct platform_device *pdev)
         */
        if (c->x86_model == 0xe && c->x86_mask < 0xc) {
                /* check for microcode update */
-                err = smp_call_function_single(pdev->id, get_ucode_rev_on_cpu,
+                err = smp_call_function_single(cpu, get_ucode_rev_on_cpu,
                                               &edx, 1);
                if (err) {
-                        dev_err(&pdev->dev,
+                        pr_err("Cannot determine microcode revision of "
-                                "Cannot determine microcode revision of "
+                               "CPU#%u (%d)!\n", cpu, err);
-                                "CPU#%u (%d)!\n", pdev->id, err);
                        return -ENODEV;
                } else if (edx < 0x39) {
-                        dev_err(&pdev->dev,
+                        pr_err("Errata AE18 not fixed, update BIOS or "
-                                "Errata AE18 not fixed, update BIOS or "
+                               "microcode of the CPU!\n");
-                                "microcode of the CPU!\n");
                        return -ENODEV;
                }
        }
@@ -538,8 +432,6 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        tdata->status_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_STATUS :
                                                        MSR_IA32_THERM_STATUS;
-        tdata->intrpt_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_INTERRUPT :
-                                                MSR_IA32_THERM_INTERRUPT;
        tdata->is_pkg_data = pkg_flag;
        tdata->cpu = cpu;
        tdata->cpu_core_id = TO_CORE_ID(cpu);
@@ -548,11 +440,11 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        return tdata;
 }
-static int create_core_data(struct platform_data *pdata,
+static int create_core_data(struct platform_device *pdev,
-                                struct platform_device *pdev,
                                unsigned int cpu, int pkg_flag)
 {
        struct temp_data *tdata;
+        struct platform_data *pdata = platform_get_drvdata(pdev);
        struct cpuinfo_x86 *c = &cpu_data(cpu);
        u32 eax, edx;
        int err, attr_no;
@@ -588,25 +480,21 @@ static int create_core_data(struct platform_data *pdata,
                goto exit_free;
        /* We can access status register. Get Critical Temperature */
-        if (pkg_flag)
+        tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
-                tdata->tjmax = get_pkg_tjmax(pdev->id, &pdev->dev);
-        else
-                tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
        /*
-         * Test if we can access the intrpt register. If so, increase the
+         * Read the still undocumented bits 8:15 of IA32_TEMPERATURE_TARGET.
-         * 'size' enough to have ttarget/tmin/max_alarm interfaces.
+         * The target temperature is available on older CPUs but not in this
-         * Initialize ttarget with bits 16:22 of MSR_IA32_THERM_INTERRUPT
+         * register. Atoms don't have the register at all.
         */
-        err = rdmsr_safe_on_cpu(cpu, tdata->intrpt_reg, &eax, &edx);
+        if (c->x86_model > 0xe && c->x86_model != 0x1c) {
-        if (!err) {
+                err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET,
-                tdata->attr_size += MAX_THRESH_ATTRS;
+                                        &eax, &edx);
-                tdata->tmin = tdata->tjmax -
+                if (!err) {
-                              ((eax & THERM_MASK_THRESHOLD0) >>
+                        tdata->ttarget
-                               THERM_SHIFT_THRESHOLD0) * 1000;
+                          = tdata->tjmax - ((eax >> 8) & 0xff) * 1000;
-                tdata->ttarget = tdata->tjmax -
+                        tdata->attr_size++;
-                                 ((eax & THERM_MASK_THRESHOLD1) >>
+                }
-                                  THERM_SHIFT_THRESHOLD1) * 1000;
        }
        pdata->core_data[attr_no] = tdata;
@@ -618,22 +506,20 @@ static int create_core_data(struct platform_data *pdata,
        return 0;
 exit_free:
+        pdata->core_data[attr_no] = NULL;
        kfree(tdata);
        return err;
 }
 static void coretemp_add_core(unsigned int cpu, int pkg_flag)
 {
-        struct platform_data *pdata;
        struct platform_device *pdev = coretemp_get_pdev(cpu);
        int err;
        if (!pdev)
                return;
-        pdata = platform_get_drvdata(pdev);
+        err = create_core_data(pdev, cpu, pkg_flag);
-        err = create_core_data(pdata, pdev, cpu, pkg_flag);
        if (err)
                dev_err(&pdev->dev, "Adding Core %u failed\n", cpu);
 }
@@ -657,11 +543,6 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
        struct platform_data *pdata;
        int err;
-        /* Check the microcode version of the CPU */
-        err = chk_ucode_version(pdev);
-        if (err)
-                return err;
        /* Initialize the per-package data structures */
        pdata = kzalloc(sizeof(struct platform_data), GFP_KERNEL);
        if (!pdata)
@@ -671,7 +552,7 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
        if (err)
                goto exit_free;
-        pdata->phys_proc_id = TO_PHYS_ID(pdev->id);
+        pdata->phys_proc_id = pdev->id;
        platform_set_drvdata(pdev, pdata);
        pdata->hwmon_dev = hwmon_device_register(&pdev->dev);
@@ -723,7 +604,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        mutex_lock(&pdev_list_mutex);
-        pdev = platform_device_alloc(DRVNAME, cpu);
+        pdev = platform_device_alloc(DRVNAME, TO_PHYS_ID(cpu));
        if (!pdev) {
                err = -ENOMEM;
                pr_err("Device allocation failed\n");
@@ -743,7 +624,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        }
        pdev_entry->pdev = pdev;
-        pdev_entry->phys_proc_id = TO_PHYS_ID(cpu);
+        pdev_entry->phys_proc_id = pdev->id;
        list_add_tail(&pdev_entry->list, &pdev_list);
        mutex_unlock(&pdev_list_mutex);
@@ -804,6 +685,10 @@ static void __cpuinit get_core_online(unsigned int cpu)
                return;
        if (!pdev) {
+                /* Check the microcode version of the CPU */
+                if (chk_ucode_version(cpu))
+                        return;
                /*
                 * Alright, we have DTS support.
                 * We are bringing the _first_ core in this pkg
diff --git a/drivers/hwmon/ds620.c b/drivers/hwmon/ds620.c
index 257957c69d92..4f7c3fc40a89 100644
--- a/drivers/hwmon/ds620.c
+++ b/drivers/hwmon/ds620.c
@@ -72,7 +72,7 @@ struct ds620_data {
        char valid;             /* !=0 if following fields are valid */
        unsigned long last_updated;     /* In jiffies */
-        u16 temp[3];            /* Register values, word */
+        s16 temp[3];            /* Register values, word */
 };
 /*
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index f2b377c56a3a..7b0260dc76fb 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -1715,7 +1715,8 @@ static void w83627ehf_device_remove_files(struct device *dev)
 }
 /* Get the monitoring functions started */
-static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
+static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data,
+                                                   enum kinds kind)
 {
        int i;
        u8 tmp, diode;
@@ -1746,10 +1747,16 @@ static inline void __devinit w83627ehf_init_device(struct w83627ehf_data *data)
                w83627ehf_write_value(data, W83627EHF_REG_VBAT, tmp | 0x01);
        /* Get thermal sensor types */
-        diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
+        switch (kind) {
+        case w83627ehf:
+                diode = w83627ehf_read_value(data, W83627EHF_REG_DIODE);
+                break;
+        default:
+                diode = 0x70;
+        }
        for (i = 0; i < 3; i++) {
                if ((tmp & (0x02 << i)))
-                        data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 2;
+                        data->temp_type[i] = (diode & (0x10 << i)) ? 1 : 3;
                else
                        data->temp_type[i] = 4; /* thermistor */
        }
@@ -2016,7 +2023,7 @@ static int __devinit w83627ehf_probe(struct platform_device *pdev)
        }
        /* Initialize the chip */
-        w83627ehf_init_device(data);
+        w83627ehf_init_device(data, sio_data->kind);
        data->vrm = vid_which_vrm();
        superio_enter(sio_data->sioreg);
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 17cf1ab95521..8c2844e5691c 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_client *client,
                          struct i2c_board_info *info);
 static int w83791d_remove(struct i2c_client *client);
-static int w83791d_read(struct i2c_client *client, u8 register);
+static int w83791d_read(struct i2c_client *client, u8 reg);
-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
 static struct w83791d_data *w83791d_update_device(struct device *dev);
 #ifdef DEBUG
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index 9827c5e686cb..811dbbd9306c 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -327,7 +327,7 @@ config BLK_DEV_OPTI621
        select BLK_DEV_IDEPCI
        help
          This is a driver for the OPTi 82C621 EIDE controller.
-          Please read the comments at the top of <file:drivers/ide/pci/opti621.c>.
+          Please read the comments at the top of <file:drivers/ide/opti621.c>.
 config BLK_DEV_RZ1000
        tristate "RZ1000 chipset bugfix/support"
@@ -365,7 +365,7 @@ config BLK_DEV_ALI15X3
          normal dual channel support.
          Please read the comments at the top of
-          <file:drivers/ide/pci/alim15x3.c>.
+          <file:drivers/ide/alim15x3.c>.
          If unsure, say N.
@@ -528,7 +528,7 @@ config BLK_DEV_NS87415
          This driver adds detection and support for the NS87415 chip
          (used mainly on SPARC64 and PA-RISC machines).
-          Please read the comments at the top of <file:drivers/ide/pci/ns87415.c>.
+          Please read the comments at the top of <file:drivers/ide/ns87415.c>.
 config BLK_DEV_PDC202XX_OLD
        tristate "PROMISE PDC202{46|62|65|67} support"
@@ -547,7 +547,7 @@ config BLK_DEV_PDC202XX_OLD
          for more than one card.
          Please read the comments at the top of
-          <file:drivers/ide/pci/pdc202xx_old.c>.
+          <file:drivers/ide/pdc202xx_old.c>.
          If unsure, say N.
@@ -593,7 +593,7 @@ config BLK_DEV_SIS5513
          ATA100: SiS635, SiS645, SiS650, SiS730, SiS735, SiS740,
          SiS745, SiS750
-          Please read the comments at the top of <file:drivers/ide/pci/sis5513.c>.
+          Please read the comments at the top of <file:drivers/ide/sis5513.c>.
 config BLK_DEV_SL82C105
        tristate "Winbond SL82c105 support"
@@ -616,7 +616,7 @@ config BLK_DEV_SLC90E66
          look-a-like to the PIIX4 it should be a nice addition.
          Please read the comments at the top of
-          <file:drivers/ide/pci/slc90e66.c>.
+          <file:drivers/ide/slc90e66.c>.
 config BLK_DEV_TRM290
        tristate "Tekram TRM290 chipset support"
@@ -625,7 +625,7 @@ config BLK_DEV_TRM290
          This driver adds support for bus master DMA transfers
          using the Tekram TRM290 PCI IDE chip. Volunteers are
          needed for further tweaking and development.
-          Please read the comments at the top of <file:drivers/ide/pci/trm290.c>.
+          Please read the comments at the top of <file:drivers/ide/trm290.c>.
 config BLK_DEV_VIA82CXXX
        tristate "VIA82CXXX chipset support"
@@ -836,7 +836,7 @@ config BLK_DEV_ALI14XX
          of the ALI M1439/1443/1445/1487/1489 chipsets, and permits faster
          I/O speeds to be set as well.
          See the files <file:Documentation/ide/ide.txt> and
-          <file:drivers/ide/legacy/ali14xx.c> for more info.
+          <file:drivers/ide/ali14xx.c> for more info.
 config BLK_DEV_DTC2278
        tristate "DTC-2278 support"
@@ -847,7 +847,7 @@ config BLK_DEV_DTC2278
          boot parameter. It enables support for the secondary IDE interface
          of the DTC-2278 card, and permits faster I/O speeds to be set as
          well. See the <file:Documentation/ide/ide.txt> and
-          <file:drivers/ide/legacy/dtc2278.c> files for more info.
+          <file:drivers/ide/dtc2278.c> files for more info.
 config BLK_DEV_HT6560B
        tristate "Holtek HT6560B support"
@@ -858,7 +858,7 @@ config BLK_DEV_HT6560B
          boot parameter. It enables support for the secondary IDE interface
          of the Holtek card, and permits faster I/O speeds to be set as well.
          See the <file:Documentation/ide/ide.txt> and
-          <file:drivers/ide/legacy/ht6560b.c> files for more info.
+          <file:drivers/ide/ht6560b.c> files for more info.
 config BLK_DEV_QD65XX
        tristate "QDI QD65xx support"
@@ -867,7 +867,7 @@ config BLK_DEV_QD65XX
        help
          This driver is enabled at runtime using the "qd65xx.probe" kernel
          boot parameter.  It permits faster I/O speeds to be set.  See the
-          <file:Documentation/ide/ide.txt> and <file:drivers/ide/legacy/qd65xx.c>
+          <file:Documentation/ide/ide.txt> and <file:drivers/ide/qd65xx.c>
          for more info.
 config BLK_DEV_UMC8672
@@ -879,7 +879,7 @@ config BLK_DEV_UMC8672
          boot parameter. It enables support for the secondary IDE interface
          of the UMC-8672, and permits faster I/O speeds to be set as well.
          See the files <file:Documentation/ide/ide.txt> and
-          <file:drivers/ide/legacy/umc8672.c> for more info.
+          <file:drivers/ide/umc8672.c> for more info.
 endif
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 274798068a54..16f69be820c7 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -435,7 +435,12 @@ static int idedisk_prep_fn(struct request_queue *q, struct request *rq)
        if (!(rq->cmd_flags & REQ_FLUSH))
                return BLKPREP_OK;
-        cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+        if (rq->special) {
+                cmd = rq->special;
+                memset(cmd, 0, sizeof(*cmd));
+        } else {
+                cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+        }
        /* FIXME: map struct ide_taskfile on rq->cmd[] */
        BUG_ON(cmd == NULL);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 17bf9d95463c..6cd642aaa4de 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -287,7 +287,7 @@ void __free_ep(struct kref *kref)
        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
                cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
                dst_release(ep->dst);
-                l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+                l2t_release(ep->com.tdev, ep->l2t);
        }
        kfree(ep);
 }
@@ -1178,7 +1178,7 @@ static int act_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                release_tid(ep->com.tdev, GET_TID(rpl), NULL);
        cxgb3_free_atid(ep->com.tdev, ep->atid);
        dst_release(ep->dst);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        put_ep(&ep->com);
        return CPL_RET_BUF_DONE;
 }
@@ -1377,7 +1377,7 @@ static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        if (!child_ep) {
                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
                       __func__);
-                l2t_release(L2DATA(tdev), l2t);
+                l2t_release(tdev, l2t);
                dst_release(dst);
                goto reject;
        }
@@ -1956,7 +1956,7 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        if (!err)
                goto out;
-        l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
+        l2t_release(h->rdev.t3cdev_p, ep->l2t);
 fail4:
        dst_release(ep->dst);
 fail3:
@@ -2127,7 +2127,7 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
        PDBG("%s ep %p redirect to dst %p l2t %p\n", __func__, ep, new,
             l2t);
        dst_hold(new);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        ep->l2t = l2t;
        dst_release(old);
        ep->dst = new;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 0dc97ec15c28..9dea71849f40 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1124,11 +1124,8 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                for (i = 0; i < 8; i++)
                        __set_bit(BTN_0 + i, input_dev->keybit);
-                if (wacom_wac->features.type != WACOM_21UX2) {
+                input_set_abs_params(input_dev, ABS_RX, 0, 4096, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RX, 0, 4096, 0, 0);
+                input_set_abs_params(input_dev, ABS_RY, 0, 4096, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RY, 0, 4096, 0, 0);
-                }
                input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 49da55c1528a..8c2a000cf3f5 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1698,6 +1698,8 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        }
        ti->num_flush_requests = 1;
+        ti->discard_zeroes_data_unsupported = 1;
        return 0;
 bad:
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 89f73ca22cfa..f84c08029b21 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -81,8 +81,10 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc,
                 * corrupt_bio_byte <Nth_byte> <direction> <value> <bio_flags>
                 */
                if (!strcasecmp(arg_name, "corrupt_bio_byte")) {
-                        if (!argc)
+                        if (!argc) {
                                ti->error = "Feature corrupt_bio_byte requires parameters";
+                                return -EINVAL;
+                        }
                        r = dm_read_arg(_args + 1, as, &fc->corrupt_bio_byte, &ti->error);
                        if (r)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index a002dd85db1e..86df8b2cf927 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -449,7 +449,7 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                                rs->ti->error = "write_mostly option is only valid for RAID1";
                                return -EINVAL;
                        }
-                        if (value > rs->md.raid_disks) {
+                        if (value >= rs->md.raid_disks) {
                                rs->ti->error = "Invalid write_mostly drive index given";
                                return -EINVAL;
                        }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 986b8754bb08..bc04518e9d8b 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1238,14 +1238,15 @@ static void dm_table_set_integrity(struct dm_table *t)
                return;
        template_disk = dm_table_get_integrity_disk(t, true);
-        if (!template_disk &&
+        if (template_disk)
-            blk_integrity_is_initialized(dm_disk(t->md))) {
+                blk_integrity_register(dm_disk(t->md),
+                                       blk_get_integrity(template_disk));
+        else if (blk_integrity_is_initialized(dm_disk(t->md)))
                DMWARN("%s: device no longer has a valid integrity profile",
                       dm_device_name(t->md));
-                return;
+        else
-        }
+                DMWARN("%s: unable to establish an integrity profile",
-        blk_integrity_register(dm_disk(t->md),
+                       dm_device_name(t->md));
-                               blk_get_integrity(template_disk));
 }
 static int device_flush_capable(struct dm_target *ti, struct dm_dev *dev,
@@ -1282,6 +1283,22 @@ static bool dm_table_supports_flush(struct dm_table *t, unsigned flush)
        return 0;
 }
+static bool dm_table_discard_zeroes_data(struct dm_table *t)
+{
+        struct dm_target *ti;
+        unsigned i = 0;
+        /* Ensure that all targets supports discard_zeroes_data. */
+        while (i < dm_table_get_num_targets(t)) {
+                ti = dm_table_get_target(t, i++);
+                if (ti->discard_zeroes_data_unsupported)
+                        return 0;
+        }
+        return 1;
+}
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
                               struct queue_limits *limits)
 {
@@ -1304,6 +1321,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
        }
        blk_queue_flush(q, flush);
+        if (!dm_table_discard_zeroes_data(t))
+                q->limits.discard_zeroes_data = 0;
        dm_table_set_integrity(t);
        /*
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5404b2295820..5c95ccb59500 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -61,6 +61,11 @@
 static void autostart_arrays(int part);
 #endif
+/* pers_list is a list of registered personalities protected
+ * by pers_lock.
+ * pers_lock does extra service to protect accesses to
+ * mddev->thread when the mutex cannot be held.
+ */
 static LIST_HEAD(pers_list);
 static DEFINE_SPINLOCK(pers_lock);
@@ -739,7 +744,12 @@ static void mddev_unlock(mddev_t * mddev)
        } else
                mutex_unlock(&mddev->reconfig_mutex);
+        /* was we've dropped the mutex we need a spinlock to
+         * make sur the thread doesn't disappear
+         */
+        spin_lock(&pers_lock);
        md_wakeup_thread(mddev->thread);
+        spin_unlock(&pers_lock);
 }
 static mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
@@ -6429,11 +6439,18 @@ mdk_thread_t *md_register_thread(void (*run) (mddev_t *), mddev_t *mddev,
        return thread;
 }
-void md_unregister_thread(mdk_thread_t *thread)
+void md_unregister_thread(mdk_thread_t **threadp)
 {
+        mdk_thread_t *thread = *threadp;
        if (!thread)
                return;
        dprintk("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
+        /* Locking ensures that mddev_unlock does not wake_up a
+         * non-existent thread
+         */
+        spin_lock(&pers_lock);
+        *threadp = NULL;
+        spin_unlock(&pers_lock);
        kthread_stop(thread->tsk);
        kfree(thread);
@@ -7340,8 +7357,7 @@ static void reap_sync_thread(mddev_t *mddev)
        mdk_rdev_t *rdev;
        /* resync has finished, collect result */
-        md_unregister_thread(mddev->sync_thread);
+        md_unregister_thread(&mddev->sync_thread);
-        mddev->sync_thread = NULL;
        if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                /* success...*/
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 1e586bb4452e..0a309dc29b45 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -560,7 +560,7 @@ extern int register_md_personality(struct mdk_personality *p);
 extern int unregister_md_personality(struct mdk_personality *p);
 extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
                                mddev_t *mddev, const char *name);
-extern void md_unregister_thread(mdk_thread_t *thread);
+extern void md_unregister_thread(mdk_thread_t **threadp);
 extern void md_wakeup_thread(mdk_thread_t *thread);
 extern void md_check_recovery(mddev_t *mddev);
 extern void md_write_start(mddev_t *mddev, struct bio *bi);
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 3535c23af288..d5b5fb300171 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -514,8 +514,7 @@ static int multipath_stop (mddev_t *mddev)
 {
        multipath_conf_t *conf = mddev->private;
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
        mempool_destroy(conf->pool);
        kfree(conf->multipaths);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f4622dd8fc59..d9587dffe533 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2562,8 +2562,7 @@ static int stop(mddev_t *mddev)
        raise_barrier(conf);
        lower_barrier(conf);
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (conf->r1bio_pool)
                mempool_destroy(conf->r1bio_pool);
        kfree(conf->mirrors);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index d7a8468ddeab..0cd9672cf9cb 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2955,7 +2955,7 @@ static int run(mddev_t *mddev)
        return 0;
 out_free_conf:
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
        if (conf->r10bio_pool)
                mempool_destroy(conf->r10bio_pool);
        safe_put_page(conf->tmppage);
@@ -2973,8 +2973,7 @@ static int stop(mddev_t *mddev)
        raise_barrier(conf, 0);
        lower_barrier(conf);
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
        if (conf->r10bio_pool)
                mempool_destroy(conf->r10bio_pool);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 43709fa6b6df..ac5e8b57e50f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4941,8 +4941,7 @@ static int run(mddev_t *mddev)
        return 0;
 abort:
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (conf) {
                print_raid5_conf(conf);
                free_conf(conf);
@@ -4956,8 +4955,7 @@ static int stop(mddev_t *mddev)
 {
        raid5_conf_t *conf = mddev->private;
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (mddev->queue)
                mddev->queue->backing_dev_info.congested_fn = NULL;
        free_conf(conf);
diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
index b5ef36222440..b3a5ecdb33ac 100644
--- a/drivers/media/video/omap/omap_vout.c
+++ b/drivers/media/video/omap/omap_vout.c
@@ -2194,19 +2194,6 @@ static int __init omap_vout_probe(struct platform_device *pdev)
                                        "'%s' Display already enabled\n",
                                        def_display->name);
                        }
-                        /* set the update mode */
-                        if (def_display->caps &
-                                        OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
-                                if (dssdrv->enable_te)
-                                        dssdrv->enable_te(def_display, 0);
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_MANUAL);
-                        } else {
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_AUTO);
-                        }
                }
        }
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 9d3459de04b2..80796eb0c53e 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -31,6 +31,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <media/v4l2-event.h>
 #include "isp.h"
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index d29f9c2d0854..e4100b1f68df 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1961,7 +1961,7 @@ static int __uvc_resume(struct usb_interface *intf, int reset)
        list_for_each_entry(stream, &dev->streams, list) {
                if (stream->intf == intf)
-                        return uvc_video_resume(stream);
+                        return uvc_video_resume(stream, reset);
        }
        uvc_trace(UVC_TRACE_SUSPEND, "Resume: video streaming USB interface "
diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
index 48fea373c25a..29e239911d0e 100644
--- a/drivers/media/video/uvc/uvc_entity.c
+++ b/drivers/media/video/uvc/uvc_entity.c
@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
                if (remote == NULL)
                        return -EINVAL;
-                source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
+                source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
                       ? (remote->vdev ? &remote->vdev->entity : NULL)
                       : &remote->subdev.entity;
                if (source == NULL)
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 8244167c8915..ffd1158628b6 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1104,10 +1104,18 @@ int uvc_video_suspend(struct uvc_streaming *stream)
 * buffers, making sure userspace applications are notified of the problem
 * instead of waiting forever.
 */
-int uvc_video_resume(struct uvc_streaming *stream)
+int uvc_video_resume(struct uvc_streaming *stream, int reset)
 {
        int ret;
+        /* If the bus has been reset on resume, set the alternate setting to 0.
+         * This should be the default value, but some devices crash or otherwise
+         * misbehave if they don't receive a SET_INTERFACE request before any
+         * other video control request.
+         */
+        if (reset)
+                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
        stream->frozen = 0;
        ret = uvc_commit_video(stream, &stream->ctrl);
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index df32a43ca86a..cbdd49bf8b67 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -638,7 +638,7 @@ extern void uvc_mc_cleanup_entity(struct uvc_entity *entity);
 /* Video */
 extern int uvc_video_init(struct uvc_streaming *stream);
 extern int uvc_video_suspend(struct uvc_streaming *stream);
-extern int uvc_video_resume(struct uvc_streaming *stream);
+extern int uvc_video_resume(struct uvc_streaming *stream, int reset);
 extern int uvc_video_enable(struct uvc_streaming *stream, int enable);
 extern int uvc_probe_video(struct uvc_streaming *stream,
                struct uvc_streaming_control *probe);
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 06f14008b346..a5c9ed128b97 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -173,6 +173,17 @@ static void v4l2_device_release(struct device *cd)
                media_device_unregister_entity(&vdev->entity);
 #endif
+        /* Do not call v4l2_device_put if there is no release callback set.
+         * Drivers that have no v4l2_device release callback might free the
+         * v4l2_dev instance in the video_device release callback below, so we
+         * must perform this check here.
+         *
+         * TODO: In the long run all drivers that use v4l2_device should use the
+         * v4l2_device release callback. This check will then be unnecessary.
+         */
+        if (v4l2_dev && v4l2_dev->release == NULL)
+                v4l2_dev = NULL;
        /* Release video_device and perform other
           cleanups as needed. */
        vdev->release(vdev);
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
index c72856c41434..e6a2c3b302d4 100644
--- a/drivers/media/video/v4l2-device.c
+++ b/drivers/media/video/v4l2-device.c
@@ -38,6 +38,7 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
        mutex_init(&v4l2_dev->ioctl_lock);
        v4l2_prio_init(&v4l2_dev->prio);
        kref_init(&v4l2_dev->ref);
+        get_device(dev);
        v4l2_dev->dev = dev;
        if (dev == NULL) {
                /* If dev == NULL, then name must be filled in by the caller */
@@ -93,6 +94,7 @@ void v4l2_device_disconnect(struct v4l2_device *v4l2_dev)
        if (dev_get_drvdata(v4l2_dev->dev) == v4l2_dev)
                dev_set_drvdata(v4l2_dev->dev, NULL);
+        put_device(v4l2_dev->dev);
        v4l2_dev->dev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_device_disconnect);
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 21131c7b0f1e..563654c9b19e 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -273,7 +273,7 @@ static int __devinit jz4740_adc_probe(struct platform_device *pdev)
        ct->regs.ack = JZ_REG_ADC_STATUS;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        irq_setup_generic_chip(gc, IRQ_MSK(5), 0, 0, IRQ_NOPROBE | IRQ_LEVEL);
diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
index b928bc14e97b..8b51cd62d067 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -375,12 +375,14 @@ void lis3lv02d_poweron(struct lis3lv02d *lis3)
         *      both have been read. So the value read will always be correct.
         * Set BOOT bit to refresh factory tuning values.
         */
-        lis3->read(lis3, CTRL_REG2, &reg);
+        if (lis3->pdata) {
-        if (lis3->whoami ==  WAI_12B)
+                lis3->read(lis3, CTRL_REG2, &reg);
-                reg |= CTRL2_BDU | CTRL2_BOOT;
+                if (lis3->whoami ==  WAI_12B)
-        else
+                        reg |= CTRL2_BDU | CTRL2_BOOT;
-                reg |= CTRL2_BOOT_8B;
+                else
-        lis3->write(lis3, CTRL_REG2, reg);
+                        reg |= CTRL2_BOOT_8B;
+                lis3->write(lis3, CTRL_REG2, reg);
+        }
        /* LIS3 power on delay is quite long */
        msleep(lis3->pwron_delay / lis3lv02d_get_odr());
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index e46df5331c55..9a7eb3b36cf3 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -239,13 +239,19 @@ void bnx2x_int_disable(struct bnx2x *bp);
 *  FUNC_N_CLID_X = N * NUM_SPECIAL_CLIENTS + FUNC_0_CLID_X
 *
 */
-/* iSCSI L2 */
+enum {
-#define BNX2X_ISCSI_ETH_CL_ID_IDX       1
+        BNX2X_ISCSI_ETH_CL_ID_IDX,
-#define BNX2X_ISCSI_ETH_CID             49
+        BNX2X_FCOE_ETH_CL_ID_IDX,
+        BNX2X_MAX_CNIC_ETH_CL_ID_IDX,
+};
-/* FCoE L2 */
+#define BNX2X_CNIC_START_ETH_CID        48
-#define BNX2X_FCOE_ETH_CL_ID_IDX        2
+enum {
-#define BNX2X_FCOE_ETH_CID              50
+        /* iSCSI L2 */
+        BNX2X_ISCSI_ETH_CID = BNX2X_CNIC_START_ETH_CID,
+        /* FCoE L2 */
+        BNX2X_FCOE_ETH_CID,
+};
 /** Additional rings budgeting */
 #ifdef BCM_CNIC
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index 223bfeebc597..2dc1199239d0 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -1297,7 +1297,7 @@ static inline void bnx2x_init_txdata(struct bnx2x *bp,
 static inline u8 bnx2x_cnic_eth_cl_id(struct bnx2x *bp, u8 cl_idx)
 {
        return bp->cnic_base_cl_id + cl_idx +
-                (bp->pf_num >> 1) * NON_ETH_CONTEXT_USE;
+                (bp->pf_num >> 1) * BNX2X_MAX_CNIC_ETH_CL_ID_IDX;
 }
 static inline u8 bnx2x_cnic_fw_sb_id(struct bnx2x *bp)
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a1e004a82f7a..0b4acf67e0c6 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -2120,6 +2120,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                        break;
                case DCB_CAP_ATTR_DCBX:
                        *cap = BNX2X_DCBX_CAPS;
+                        break;
                default:
                        rval = -EINVAL;
                        break;
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index c027e9341a1a..15f800085bb2 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -4943,7 +4943,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        int igu_seg_id;
        int port = BP_PORT(bp);
        int func = BP_FUNC(bp);
-        int reg_offset;
+        int reg_offset, reg_offset_en5;
        u64 section;
        int index;
        struct hc_sp_status_block_data sp_sb_data;
@@ -4966,6 +4966,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                             MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+        reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
+                                 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
        for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                int sindex;
                /* take care of sig[0]..sig[4] */
@@ -4980,7 +4982,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
                         * and not 16 between the different groups
                         */
                        bp->attn_group[index].sig[4] = REG_RD(bp,
-                                        reg_offset + 0x10 + 0x4*index);
+                                        reg_offset_en5 + 0x4*index);
                else
                        bp->attn_group[index].sig[4] = 0;
        }
@@ -7625,8 +7627,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                u8 *mac_addr = bp->dev->dev_addr;
                u32 val;
+                u16 pmc;
                /* The mac address is written to entries 1-4 to
-                   preserve entry 0 which is used by the PMF */
+                 * preserve entry 0 which is used by the PMF
+                 */
                u8 entry = (BP_VN(bp) + 1)*8;
                val = (mac_addr[0] << 8) | mac_addr[1];
@@ -7636,6 +7641,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                      (mac_addr[4] << 8) | mac_addr[5];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
+                /* Enable the PME and clear the status */
+                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
+                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
                reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
        } else
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 750e8445dac4..fc7bd0f23c0b 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1384,6 +1384,18 @@
   Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_ENABLE4_PXP_0                               0xa108
 #define MISC_REG_AEU_ENABLE4_PXP_1                               0xa1a8
+/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0                        0xa688
+/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0                        0xa6b0
 /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
   128 bit vector */
 #define MISC_REG_AEU_GENERAL_ATTN_0                              0xa000
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index a047eb973e3b..47b928ed08f8 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2168,7 +2168,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 7f8b20a34ee3..d4fbd2e62616 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1440,7 +1440,8 @@ void bond_alb_monitor(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 43f2ea541088..de3d351ccb6b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -777,6 +777,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
        read_lock(&bond->lock);
+        if (bond->kill_timers)
+                goto out;
        /* rejoin all groups on bond device */
        __bond_resend_igmp_join_requests(bond->dev);
@@ -790,9 +793,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
                        __bond_resend_igmp_join_requests(vlan_dev);
        }
-        if (--bond->igmp_retrans > 0)
+        if ((--bond->igmp_retrans > 0) && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mcast_work, HZ/5);
+out:
        read_unlock(&bond->lock);
 }
@@ -1432,6 +1435,8 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
        struct sk_buff *skb = *pskb;
        struct slave *slave;
        struct bonding *bond;
+        void (*recv_probe)(struct sk_buff *, struct bonding *,
+                                struct slave *);
        skb = skb_share_check(skb, GFP_ATOMIC);
        if (unlikely(!skb))
@@ -1445,11 +1450,12 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
        if (bond->params.arp_interval)
                slave->dev->last_rx = jiffies;
-        if (bond->recv_probe) {
+        recv_probe = ACCESS_ONCE(bond->recv_probe);
+        if (recv_probe) {
                struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
                if (likely(nskb)) {
-                        bond->recv_probe(nskb, bond, slave);
+                        recv_probe(nskb, bond, slave);
                        dev_kfree_skb(nskb);
                }
        }
@@ -2538,7 +2544,7 @@ void bond_mii_monitor(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.miimon)
+        if (bond->params.miimon && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mii_work,
                                   msecs_to_jiffies(bond->params.miimon));
 out:
@@ -2886,7 +2892,7 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
@@ -3154,7 +3160,7 @@ void bond_activebackup_arp_mon(struct work_struct *work)
        bond_ab_arp_probe(bond);
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
diff --git a/drivers/net/can/mscan/mscan.c b/drivers/net/can/mscan/mscan.c
index 92feac68b66e..4cc6f44c2ba2 100644
--- a/drivers/net/can/mscan/mscan.c
+++ b/drivers/net/can/mscan/mscan.c
@@ -261,11 +261,13 @@ static netdev_tx_t mscan_start_xmit(struct sk_buff *skb, struct net_device *dev)
                void __iomem *data = &regs->tx.dsr1_0;
                u16 *payload = (u16 *)frame->data;
-                /* It is safe to write into dsr[dlc+1] */
+                for (i = 0; i < frame->can_dlc / 2; i++) {
-                for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
                        out_be16(data, *payload++);
                        data += 2 + _MSCAN_RESERVED_DSR_SIZE;
                }
+                /* write remaining byte if necessary */
+                if (frame->can_dlc & 1)
+                        out_8(data, frame->data[frame->can_dlc - 1]);
        }
        out_8(&regs->tx.dlr, frame->can_dlc);
@@ -330,10 +332,13 @@ static void mscan_get_rx_frame(struct net_device *dev, struct can_frame *frame)
                void __iomem *data = &regs->rx.dsr1_0;
                u16 *payload = (u16 *)frame->data;
-                for (i = 0; i < (frame->can_dlc + 1) / 2; i++) {
+                for (i = 0; i < frame->can_dlc / 2; i++) {
                        *payload++ = in_be16(data);
                        data += 2 + _MSCAN_RESERVED_DSR_SIZE;
                }
+                /* read remaining byte if necessary */
+                if (frame->can_dlc & 1)
+                        frame->data[frame->can_dlc - 1] = in_8(data);
        }
        out_8(&regs->canrflg, MSCAN_RXF);
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index 805076c54f1b..da5a5d9b8aff 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -1146,12 +1146,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
                if (te && te->ctx && te->client && te->client->redirect) {
                        update_tcb = te->client->redirect(te->ctx, old, new, e);
                        if (update_tcb) {
+                                rcu_read_lock();
                                l2t_hold(L2DATA(tdev), e);
+                                rcu_read_unlock();
                                set_l2t_ix(tdev, tid, e);
                        }
                }
        }
-        l2t_release(L2DATA(tdev), e);
+        l2t_release(tdev, e);
 }
 /*
@@ -1264,7 +1266,7 @@ int cxgb3_offload_activate(struct adapter *adapter)
                goto out_free;
        err = -ENOMEM;
-        L2DATA(dev) = t3_init_l2t(l2t_capacity);
+        RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
        if (!L2DATA(dev))
                goto out_free;
@@ -1298,16 +1300,24 @@ int cxgb3_offload_activate(struct adapter *adapter)
 out_free_l2t:
        t3_free_l2t(L2DATA(dev));
-        L2DATA(dev) = NULL;
+        rcu_assign_pointer(dev->l2opt, NULL);
 out_free:
        kfree(t);
        return err;
 }
+static void clean_l2_data(struct rcu_head *head)
+{
+        struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
+        t3_free_l2t(d);
+}
 void cxgb3_offload_deactivate(struct adapter *adapter)
 {
        struct t3cdev *tdev = &adapter->tdev;
        struct t3c_data *t = T3C_DATA(tdev);
+        struct l2t_data *d;
        remove_adapter(adapter);
        if (list_empty(&adapter_list))
@@ -1315,8 +1325,11 @@ void cxgb3_offload_deactivate(struct adapter *adapter)
        free_tid_maps(&t->tid_maps);
        T3C_DATA(tdev) = NULL;
-        t3_free_l2t(L2DATA(tdev));
+        rcu_read_lock();
-        L2DATA(tdev) = NULL;
+        d = L2DATA(tdev);
+        rcu_read_unlock();
+        rcu_assign_pointer(tdev->l2opt, NULL);
+        call_rcu(&d->rcu_head, clean_l2_data);
        if (t->nofail_skb)
                kfree_skb(t->nofail_skb);
        kfree(t);
diff --git a/drivers/net/cxgb3/l2t.c b/drivers/net/cxgb3/l2t.c
index f452c4003253..41540978a173 100644
--- a/drivers/net/cxgb3/l2t.c
+++ b/drivers/net/cxgb3/l2t.c
@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2t_entry *e, struct neighbour *neigh)
 struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
                             struct net_device *dev)
 {
-        struct l2t_entry *e;
+        struct l2t_entry *e = NULL;
-        struct l2t_data *d = L2DATA(cdev);
+        struct l2t_data *d;
+        int hash;
        u32 addr = *(u32 *) neigh->primary_key;
        int ifidx = neigh->dev->ifindex;
-        int hash = arp_hash(addr, ifidx, d);
        struct port_info *p = netdev_priv(dev);
        int smt_idx = p->port_id;
+        rcu_read_lock();
+        d = L2DATA(cdev);
+        if (!d)
+                goto done_rcu;
+        hash = arp_hash(addr, ifidx, d);
        write_lock_bh(&d->lock);
        for (e = d->l2tab[hash].first; e; e = e->next)
                if (e->addr == addr && e->ifindex == ifidx &&
@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
        }
 done:
        write_unlock_bh(&d->lock);
+done_rcu:
+        rcu_read_unlock();
        return e;
 }
diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
index 7a12d52ed4fc..c5f54796e2cb 100644
--- a/drivers/net/cxgb3/l2t.h
+++ b/drivers/net/cxgb3/l2t.h
@@ -76,6 +76,7 @@ struct l2t_data {
        atomic_t nfree;         /* number of free entries */
        rwlock_t lock;
        struct l2t_entry l2tab[0];
+        struct rcu_head rcu_head;       /* to handle rcu cleanup */
 };
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
@@ -99,7 +100,7 @@ static inline void set_arp_failure_handler(struct sk_buff *skb,
 /*
 * Getting to the L2 data from an offload device.
 */
-#define L2DATA(dev) ((dev)->l2opt)
+#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
 #define W_TCB_L2T_IX    0
 #define S_TCB_L2T_IX    7
@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev *dev, struct sk_buff *skb,
        return t3_l2t_send_slow(dev, skb, e);
 }
-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
+static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
 {
-        if (atomic_dec_and_test(&e->refcnt))
+        struct l2t_data *d;
+        rcu_read_lock();
+        d = L2DATA(t);
+        if (atomic_dec_and_test(&e->refcnt) && d)
                t3_l2e_free(d, e);
+        rcu_read_unlock();
 }
 static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
 {
-        if (atomic_add_return(1, &e->refcnt) == 1)      /* 0 -> 1 transition */
+        if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
                atomic_dec(&d->nfree);
 }
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index c9957b7f17b5..b4efa292fd6f 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -3712,6 +3712,9 @@ static int __devinit init_one(struct pci_dev *pdev,
                setup_debugfs(adapter);
        }
+        /* PCIe EEH recovery on powerpc platforms needs fundamental reset */
+        pdev->needs_freset = 1;
        if (is_offload(adapter))
                attach_ulds(adapter);
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 8dd5fccef725..d393f1e764ed 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -636,8 +636,8 @@ static int ibmveth_open(struct net_device *netdev)
                netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
                           netdev->irq, rc);
                do {
-                        rc = h_free_logical_lan(adapter->vdev->unit_address);
+                        lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
-                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+                } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
                goto err_out;
        }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 05172c39a0ce..376e3e94bae0 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -239,7 +239,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
                dest = macvlan_hash_lookup(port, eth->h_dest);
                if (dest && dest->mode == MACVLAN_MODE_BRIDGE) {
                        /* send to lowerdev first for its network taps */
-                        vlan->forward(vlan->lowerdev, skb);
+                        dev_forward_skb(vlan->lowerdev, skb);
                        return NET_XMIT_SUCCESS;
                }
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 6e03de034ac7..f76ab6bf3096 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -172,7 +172,7 @@ int mlx4_en_activate_tx_ring(struct mlx4_en_priv *priv,
        memset(ring->buf, 0, ring->buf_size);
        ring->qp_state = MLX4_QP_STATE_RST;
-        ring->doorbell_qpn = swab32(ring->qp.qpn << 8);
+        ring->doorbell_qpn = ring->qp.qpn << 8;
        mlx4_en_fill_qp_context(priv, ring->size, ring->stride, 1, 0, ring->qpn,
                                ring->cqn, &ring->context);
@@ -791,7 +791,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                skb_orphan(skb);
        if (ring->bf_enabled && desc_size <= MAX_BF && !bounce && !vlan_tag) {
-                *(u32 *) (&tx_desc->ctrl.vlan_tag) |= ring->doorbell_qpn;
+                *(__be32 *) (&tx_desc->ctrl.vlan_tag) |= cpu_to_be32(ring->doorbell_qpn);
                op_own |= htonl((bf_index & 0xffff) << 8);
                /* Ensure new descirptor hits memory
                * before setting ownership of this descriptor to HW */
@@ -812,7 +812,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                wmb();
                tx_desc->ctrl.owner_opcode = op_own;
                wmb();
-                writel(ring->doorbell_qpn, ring->bf.uar->map + MLX4_SEND_DOORBELL);
+                iowrite32be(ring->doorbell_qpn, ring->bf.uar->map + MLX4_SEND_DOORBELL);
        }
        /* Poll CQ here */
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index ed2a3977c6e7..e8882023576b 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -307,6 +307,11 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                return err;
        if (enabled < 0 || enabled > 1)
                return -EINVAL;
+        if (enabled == nt->enabled) {
+                printk(KERN_INFO "netconsole: network logging has already %s\n",
+                                nt->enabled ? "started" : "stopped");
+                return -EINVAL;
+        }
        if (enabled) {  /* 1 */
diff --git a/drivers/net/pch_gbe/pch_gbe_main.c b/drivers/net/pch_gbe/pch_gbe_main.c
index 567ff10889be..b8b4ba27b0e7 100644
--- a/drivers/net/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/pch_gbe/pch_gbe_main.c
@@ -1199,6 +1199,8 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
                                  &hw->reg->INT_EN);
                        pch_gbe_stop_receive(adapter);
+                        int_st |= ioread32(&hw->reg->INT_ST);
+                        int_st = int_st & ioread32(&hw->reg->INT_EN);
                }
        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
                adapter->stats.intr_rx_dma_err_count++;
@@ -1218,14 +1220,11 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                        /* Set Pause packet */
                        pch_gbe_mac_set_pause_packet(hw);
                }
-                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
-                    == 0) {
-                        return IRQ_HANDLED;
-                }
        }
        /* When request status is Receive interruption */
-        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT)) ||
+            (adapter->rx_stop_flag == true)) {
                if (likely(napi_schedule_prep(&adapter->napi))) {
                        /* Enable only Rx Descriptor empty */
                        atomic_inc(&adapter->irq_sem);
@@ -1385,7 +1384,7 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        struct sk_buff *skb;
        unsigned int i;
        unsigned int cleaned_count = 0;
-        bool cleaned = false;
+        bool cleaned = true;
        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
@@ -1396,7 +1395,6 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
                pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
-                cleaned = true;
                buffer_info = &tx_ring->buffer_info[i];
                skb = buffer_info->skb;
@@ -1439,8 +1437,10 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
                /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT) {
+                        cleaned = false;
                        break;
+                }
        }
        pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
                 cleaned_count);
@@ -2168,7 +2168,6 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
 {
        struct pch_gbe_adapter *adapter =
            container_of(napi, struct pch_gbe_adapter, napi);
-        struct net_device *netdev = adapter->netdev;
        int work_done = 0;
        bool poll_end_flag = false;
        bool cleaned = false;
@@ -2176,33 +2175,32 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        pr_debug("budget : %d\n", budget);
-        /* Keep link state information with original netdev */
+        pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
-        if (!netif_carrier_ok(netdev)) {
+        cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
+        if (!cleaned)
+                work_done = budget;
+        /* If no Tx and not enough Rx work done,
+         * exit the polling mode
+         */
+        if (work_done < budget)
                poll_end_flag = true;
-        } else {
-                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+        if (poll_end_flag) {
+                napi_complete(napi);
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                }
+                pch_gbe_irq_enable(adapter);
+        } else
                if (adapter->rx_stop_flag) {
                        adapter->rx_stop_flag = false;
                        pch_gbe_start_receive(&adapter->hw);
                        int_en = ioread32(&adapter->hw.reg->INT_EN);
                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
-                                        &adapter->hw.reg->INT_EN);
+                                &adapter->hw.reg->INT_EN);
                }
-                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
-                if (cleaned)
-                        work_done = budget;
-                /* If no Tx and not enough Rx work done,
-                 * exit the polling mode
-                 */
-                if ((work_done < budget) || !netif_running(netdev))
-                        poll_end_flag = true;
-        }
-        if (poll_end_flag) {
-                napi_complete(napi);
-                pch_gbe_irq_enable(adapter);
-        }
        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                 poll_end_flag, work_done, budget);
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index cb6e0b486b1e..edd7304773eb 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -589,7 +589,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
        prune_rx_ts(dp83640);
        if (list_empty(&dp83640->rxpool)) {
-                pr_warning("dp83640: rx timestamp pool is empty\n");
+                pr_debug("dp83640: rx timestamp pool is empty\n");
                goto out;
        }
        rxts = list_first_entry(&dp83640->rxpool, struct rxts, list);
@@ -612,7 +612,7 @@ static void decode_txts(struct dp83640_private *dp83640,
        skb = skb_dequeue(&dp83640->tx_queue);
        if (!skb) {
-                pr_warning("dp83640: have timestamp but tx_queue empty\n");
+                pr_debug("dp83640: have timestamp but tx_queue empty\n");
                return;
        }
        ns = phy2txts(phy_txts);
diff --git a/drivers/net/pptp.c b/drivers/net/pptp.c
index eae542a7e987..89f829f5f725 100644
--- a/drivers/net/pptp.c
+++ b/drivers/net/pptp.c
@@ -285,8 +285,10 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
        ip_send_check(iph);
        ip_local_out(skb);
+        return 1;
 tx_error:
+        kfree_skb(skb);
        return 1;
 }
@@ -305,11 +307,18 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
        }
        header = (struct pptp_gre_header *)(skb->data);
+        headersize  = sizeof(*header);
        /* test if acknowledgement present */
        if (PPTP_GRE_IS_A(header->ver)) {
-                __u32 ack = (PPTP_GRE_IS_S(header->flags)) ?
+                __u32 ack;
-                                header->ack : header->seq; /* ack in different place if S = 0 */
+                if (!pskb_may_pull(skb, headersize))
+                        goto drop;
+                header = (struct pptp_gre_header *)(skb->data);
+                /* ack in different place if S = 0 */
+                ack = PPTP_GRE_IS_S(header->flags) ? header->ack : header->seq;
                ack = ntohl(ack);
@@ -318,21 +327,18 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
                /* also handle sequence number wrap-around  */
                if (WRAPPED(ack, opt->ack_recv))
                        opt->ack_recv = ack;
+        } else {
+                headersize -= sizeof(header->ack);
        }
        /* test if payload present */
        if (!PPTP_GRE_IS_S(header->flags))
                goto drop;
-        headersize  = sizeof(*header);
        payload_len = ntohs(header->payload_len);
        seq         = ntohl(header->seq);
-        /* no ack present? */
-        if (!PPTP_GRE_IS_A(header->ver))
-                headersize -= sizeof(header->ack);
        /* check for incomplete packet (length smaller than expected) */
-        if (skb->len - headersize < payload_len)
+        if (!pskb_may_pull(skb, headersize + payload_len))
                goto drop;
        payload = skb->data + headersize;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index c23667017922..6d657cabb951 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2859,7 +2859,7 @@ static void rtl8168e_2_hw_phy_config(struct rtl8169_private *tp)
        rtl_writephy(tp, 0x1f, 0x0004);
        rtl_writephy(tp, 0x1f, 0x0007);
        rtl_writephy(tp, 0x1e, 0x0020);
-        rtl_w1w0_phy(tp, 0x06, 0x0000, 0x0100);
+        rtl_w1w0_phy(tp, 0x15, 0x0000, 0x0100);
        rtl_writephy(tp, 0x1f, 0x0002);
        rtl_writephy(tp, 0x1f, 0x0000);
        rtl_writephy(tp, 0x0d, 0x0007);
@@ -3316,6 +3316,37 @@ static void __devinit rtl_init_mdio_ops(struct rtl8169_private *tp)
        }
 }
+static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_29:
+        case RTL_GIGA_MAC_VER_30:
+        case RTL_GIGA_MAC_VER_32:
+        case RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_34:
+                RTL_W32(RxConfig, RTL_R32(RxConfig) |
+                        AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
+                break;
+        default:
+                break;
+        }
+}
+static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+{
+        if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
+                return false;
+        rtl_writephy(tp, 0x1f, 0x0000);
+        rtl_writephy(tp, MII_BMCR, 0x0000);
+        rtl_wol_suspend_quirk(tp);
+        return true;
+}
 static void r810x_phy_power_down(struct rtl8169_private *tp)
 {
        rtl_writephy(tp, 0x1f, 0x0000);
@@ -3330,18 +3361,8 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
-        void __iomem *ioaddr = tp->mmio_addr;
+        if (rtl_wol_pll_power_down(tp))
-        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
-                rtl_writephy(tp, 0x1f, 0x0000);
-                rtl_writephy(tp, MII_BMCR, 0x0000);
-                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_30)
-                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
-                                AcceptMulticast | AcceptMyPhys);
                return;
-        }
        r810x_phy_power_down(tp);
 }
@@ -3430,17 +3451,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
            tp->mac_version == RTL_GIGA_MAC_VER_33)
                rtl_ephy_write(ioaddr, 0x19, 0xff64);
-        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
+        if (rtl_wol_pll_power_down(tp))
-                rtl_writephy(tp, 0x1f, 0x0000);
-                rtl_writephy(tp, MII_BMCR, 0x0000);
-                if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_34)
-                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
-                                AcceptMulticast | AcceptMyPhys);
                return;
-        }
        r8168_phy_power_down(tp);
@@ -5788,11 +5800,30 @@ static const struct dev_pm_ops rtl8169_pm_ops = {
 #endif /* !CONFIG_PM */
+static void rtl_wol_shutdown_quirk(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        /* WoL fails with 8168b when the receiver is disabled. */
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_11:
+        case RTL_GIGA_MAC_VER_12:
+        case RTL_GIGA_MAC_VER_17:
+                pci_clear_master(tp->pci_dev);
+                RTL_W8(ChipCmd, CmdRxEnb);
+                /* PCI commit */
+                RTL_R8(ChipCmd);
+                break;
+        default:
+                break;
+        }
+}
 static void rtl_shutdown(struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
        struct rtl8169_private *tp = netdev_priv(dev);
-        void __iomem *ioaddr = tp->mmio_addr;
        rtl8169_net_suspend(dev);
@@ -5806,16 +5837,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
        spin_unlock_irq(&tp->lock);
        if (system_state == SYSTEM_POWER_OFF) {
-                /* WoL fails with 8168b when the receiver is disabled. */
+                if (__rtl8169_get_wol(tp) & WAKE_ANY) {
-                if ((tp->mac_version == RTL_GIGA_MAC_VER_11 ||
+                        rtl_wol_suspend_quirk(tp);
-                     tp->mac_version == RTL_GIGA_MAC_VER_12 ||
+                        rtl_wol_shutdown_quirk(tp);
-                     tp->mac_version == RTL_GIGA_MAC_VER_17) &&
-                    (tp->features & RTL_FEATURE_WOL)) {
-                        pci_clear_master(pdev);
-                        RTL_W8(ChipCmd, CmdRxEnb);
-                        /* PCI commit */
-                        RTL_R8(ChipCmd);
                }
                pci_wake_from_d3(pdev, true);
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index b9016a30cdc5..c90ddb61cc56 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -26,6 +26,7 @@
 *   LAN9215, LAN9216, LAN9217, LAN9218
 *   LAN9210, LAN9211
 *   LAN9220, LAN9221
+ *   LAN89218
 *
 */
@@ -1983,6 +1984,7 @@ static int __devinit smsc911x_init(struct net_device *dev)
        case 0x01170000:
        case 0x01160000:
        case 0x01150000:
+        case 0x218A0000:
                /* LAN911[5678] family */
                pdata->generation = pdata->idrev & 0x0000FFFF;
                break;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 4a1374df6084..c11a2b8327f3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -15577,7 +15577,7 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
                cancel_work_sync(&tp->reset_task);
-                if (!tg3_flag(tp, USE_PHYLIB)) {
+                if (tg3_flag(tp, USE_PHYLIB)) {
                        tg3_phy_fini(tp);
                        tg3_mdio_fini(tp);
                }
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 2339728a7306..3e69c631ebb4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -1514,7 +1514,7 @@ static const u32 ar9300_2p2_mac_core[][2] = {
        {0x00008258, 0x00000000},
        {0x0000825c, 0x40000000},
        {0x00008260, 0x00080922},
-        {0x00008264, 0x9bc00010},
+        {0x00008264, 0x9d400010},
        {0x00008268, 0xffffffff},
        {0x0000826c, 0x0000ffff},
        {0x00008270, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 9a4850154fb2..4c21f8cbdeb5 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -205,14 +205,22 @@ static void ath_rx_remove_buffer(struct ath_softc *sc,
 static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
        struct ath_buf *bf;
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
        list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                if (bf->bf_mpdu)
+                if (bf->bf_mpdu) {
+                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
+                                        common->rx_bufsize,
+                                        DMA_BIDIRECTIONAL);
                        dev_kfree_skb_any(bf->bf_mpdu);
+                        bf->bf_buf_addr = 0;
+                        bf->bf_mpdu = NULL;
+                }
        }
        INIT_LIST_HEAD(&sc->rx.rxbuf);
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 35cd2537e7fd..e5971fe9d169 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -937,7 +937,7 @@ void iwl_legacy_irq_handle_error(struct iwl_priv *priv)
                                        &priv->contexts[IWL_RXON_CTX_BSS]);
 #endif
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /* Keep the restart process from trying to send host
         * commands by clearing the INIT status bit */
@@ -1746,7 +1746,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external)
        /* Set the FW error flag -- cleared on iwl_down */
        set_bit(STATUS_FW_ERROR, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /*
         * Keep the restart process from trying to send host
         * commands by clearing the INIT status bit
diff --git a/drivers/net/wireless/iwlegacy/iwl-hcmd.c b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
index 62b4b09122cb..ce1fc9feb61f 100644
--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
@@ -167,7 +167,7 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                goto out;
        }
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        !test_bit(STATUS_HCMD_ACTIVE, &priv->status),
                        HOST_COMPLETE_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-tx.c b/drivers/net/wireless/iwlegacy/iwl-tx.c
index 4fff995c6f3e..ef9e268bf8a0 100644
--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
@@ -625,6 +625,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        cmd = txq->cmd[cmd_index];
        meta = &txq->meta[cmd_index];
+        txq->time_stamp = jiffies;
        pci_unmap_single(priv->pci_dev,
                         dma_unmap_addr(meta, mapping),
                         dma_unmap_len(meta, len),
@@ -645,7 +647,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                               iwl_legacy_get_cmd_string(cmd->hdr.cmd));
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        /* Mark as unmapped */
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 795826a014ed..66ee15629a76 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -841,7 +841,7 @@ static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                                test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -2269,7 +2269,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
        iwl3945_reg_txpower_periodic(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        return;
@@ -2300,7 +2300,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2853,7 +2853,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 14334668034e..aa0c2539761e 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -576,7 +576,7 @@ static void iwl4965_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                        test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -926,7 +926,7 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_FH_TX;
                /* Wake up uCode load routine, now that load is complete */
                priv->ucode_write_complete = 1;
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        if (inta & ~handled) {
@@ -1795,7 +1795,7 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
        iwl4965_rf_kill_ct_config(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        iwl_legacy_power_update_mode(priv, true);
        IWL_DEBUG_INFO(priv, "Updated power mode\n");
@@ -1828,7 +1828,7 @@ static void __iwl4965_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2266,7 +2266,7 @@ int iwl4965_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd6937e97055..77e528f5db88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -405,31 +405,33 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
        mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-        /* mac80211 will only ask for one band at a time */
-        priv->scan_request = req;
-        priv->scan_vif = vif;
        /*
         * If an internal scan is in progress, just set
         * up the scan_request as per above.
         */
        if (priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
+                IWL_DEBUG_SCAN(priv,
+                               "SCAN request during internal scan - defer\n");
+                priv->scan_request = req;
+                priv->scan_vif = vif;
                ret = 0;
-        } else
+        } else {
+                priv->scan_request = req;
+                priv->scan_vif = vif;
+                /*
+                 * mac80211 will only ask for one band at a time
+                 * so using channels[0] here is ok
+                 */
                ret = iwl_scan_initiate(priv, vif, IWL_SCAN_NORMAL,
                                        req->channels[0]->band);
+                if (ret) {
+                        priv->scan_request = NULL;
+                        priv->scan_vif = NULL;
+                }
+        }
        IWL_DEBUG_MAC80211(priv, "leave\n");
-out_unlock:
        mutex_unlock(&priv->mutex);
        return ret;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 8b1cef0ffde6..4bf3cf457ef0 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -863,6 +863,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
        u8 tid = 0;
        u16 seq_number = 0;
+        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
        if (ieee80211_is_auth(fc)) {
                RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, ("MAC80211_LINKING\n"));
                rtl_ips_nic_on(hw);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 0ca86f9ec4ed..182562952c79 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        xenvif_get(vif);
        rtnl_lock();
-        if (netif_running(vif->dev))
-                xenvif_up(vif);
        if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                dev_set_mtu(vif->dev, ETH_DATA_LEN);
        netdev_update_features(vif->dev);
        netif_carrier_on(vif->dev);
+        if (netif_running(vif->dev))
+                xenvif_up(vif);
        rtnl_unlock();
        return 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 4e84fd4a4312..e9651f0a8817 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE;
+enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_TUNE_OFF;
 /*
 * The default CLS is used if arch didn't set CLS explicitly and not
@@ -3568,10 +3568,14 @@ static int __init pci_setup(char *str)
                                pci_hotplug_io_size = memparse(str + 9, &str);
                        } else if (!strncmp(str, "hpmemsize=", 10)) {
                                pci_hotplug_mem_size = memparse(str + 10, &str);
+                        } else if (!strncmp(str, "pcie_bus_tune_off", 17)) {
+                                pcie_bus_config = PCIE_BUS_TUNE_OFF;
                        } else if (!strncmp(str, "pcie_bus_safe", 13)) {
                                pcie_bus_config = PCIE_BUS_SAFE;
                        } else if (!strncmp(str, "pcie_bus_perf", 13)) {
                                pcie_bus_config = PCIE_BUS_PERFORMANCE;
+                        } else if (!strncmp(str, "pcie_bus_peer2peer", 18)) {
+                                pcie_bus_config = PCIE_BUS_PEER2PEER;
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index f3f94a5c068f..6ab6bd3df4b2 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1458,12 +1458,24 @@ static int pcie_bus_configure_set(struct pci_dev *dev, void *data)
 */
 void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
 {
-        u8 smpss = mpss;
+        u8 smpss;
        if (!pci_is_pcie(bus->self))
                return;
+        if (pcie_bus_config == PCIE_BUS_TUNE_OFF)
+                return;
+        /* FIXME - Peer to peer DMA is possible, though the endpoint would need
+         * to be aware to the MPS of the destination.  To work around this,
+         * simply force the MPS of the entire system to the smallest possible.
+         */
+        if (pcie_bus_config == PCIE_BUS_PEER2PEER)
+                smpss = 0;
        if (pcie_bus_config == PCIE_BUS_SAFE) {
+                smpss = mpss;
                pcie_find_smpss(bus->self, &smpss);
                pci_walk_bus(bus, pcie_find_smpss, &smpss);
        }
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index cbde448f9947..eb3140ee821e 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -654,8 +654,8 @@ static struct io_subchannel_private console_priv;
 static int console_subchannel_in_use;
 /*
- * Use tpi to get a pending interrupt, call the interrupt handler and
+ * Use cio_tpi to get a pending interrupt and call the interrupt handler.
- * return a pointer to the subchannel structure.
+ * Return non-zero if an interrupt was processed, zero otherwise.
 */
 static int cio_tpi(void)
 {
@@ -667,6 +667,10 @@ static int cio_tpi(void)
        tpi_info = (struct tpi_info *)&S390_lowcore.subchannel_id;
        if (tpi(NULL) != 1)
                return 0;
+        if (tpi_info->adapter_IO) {
+                do_adapter_IO(tpi_info->isc);
+                return 1;
+        }
        irb = (struct irb *)&S390_lowcore.irb;
        /* Store interrupt response block to lowcore. */
        if (tsch(tpi_info->schid, irb) != 0)
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index b7bd5b0cc7aa..3868ab2397c6 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1800,10 +1800,12 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
        switch (retval) {
        case SCSI_MLQUEUE_HOST_BUSY:
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                break;
        case 1:
                tw_dev->state[request_id] = TW_S_COMPLETED;
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                SCpnt->result = (DID_ERROR << 16);
                done(SCpnt);
                retval = 0;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8d9dae89f065..3878b7395081 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -837,6 +837,7 @@ config SCSI_ISCI
        # (temporary): known alpha quality driver
        depends on EXPERIMENTAL
        select SCSI_SAS_LIBSAS
+        select SCSI_SAS_HOST_SMP
        ---help---
          This driver supports the 6Gb/s SAS capabilities of the storage
          control unit found in the Intel(R) C600 series chipset.
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 3c08f5352b2d..6153a66a8a31 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -88,7 +88,7 @@ obj-$(CONFIG_SCSI_QLOGIC_FAS)	+= qlogicfas408.o	qlogicfas.o
 obj-$(CONFIG_PCMCIA_QLOGIC)     += qlogicfas408.o
 obj-$(CONFIG_SCSI_QLOGIC_1280)  += qla1280.o 
 obj-$(CONFIG_SCSI_QLA_FC)       += qla2xxx/
-obj-$(CONFIG_SCSI_QLA_ISCSI)    += qla4xxx/
+obj-$(CONFIG_SCSI_QLA_ISCSI)    += libiscsi.o qla4xxx/
 obj-$(CONFIG_SCSI_LPFC)         += lpfc/
 obj-$(CONFIG_SCSI_BFA_FC)       += bfa/
 obj-$(CONFIG_SCSI_PAS16)        += pas16.o
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index e7d0d47b9185..e5f2d7d9002e 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1283,6 +1283,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced)
        kfree(aac->queues);
        aac->queues = NULL;
        free_irq(aac->pdev->irq, aac);
+        if (aac->msi)
+                pci_disable_msi(aac->pdev);
        kfree(aac->fsa_dev);
        aac->fsa_dev = NULL;
        quirks = aac_get_driver_ident(index)->quirks;
diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
index bd22041e2789..f58644850333 100644
--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
@@ -913,7 +913,7 @@ static void l2t_put(struct cxgbi_sock *csk)
        struct t3cdev *t3dev = (struct t3cdev *)csk->cdev->lldev;
        if (csk->l2t) {
-                l2t_release(L2DATA(t3dev), csk->l2t);
+                l2t_release(t3dev, csk->l2t);
                csk->l2t = NULL;
                cxgbi_sock_put(csk);
        }
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index f84084bba2f0..16ad97df5ba6 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1721,7 +1721,7 @@ static int sas_find_bcast_dev(struct domain_device *dev,
        list_for_each_entry(ch, &ex->children, siblings) {
                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
                        res = sas_find_bcast_dev(ch, src_dev);
-                        if (src_dev)
+                        if (*src_dev)
                                return res;
                }
        }
@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent,
                sas_disable_routing(parent, phy->attached_sas_addr);
        }
        memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-        sas_port_delete_phy(phy->port, phy->phy);
+        if (phy->port) {
-        if (phy->port->num_phys == 0)
+                sas_port_delete_phy(phy->port, phy->phy);
-                sas_port_delete(phy->port);
+                if (phy->port->num_phys == 0)
-        phy->port = NULL;
+                        sas_port_delete(phy->port);
+                phy->port = NULL;
+        }
 }
 static int sas_discover_bfs_by_root_level(struct domain_device *root,
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 646fc5263d50..8a7591f035e6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1507,8 +1507,8 @@ qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
                        if (k != blocks_done) {
                                qla_printk(KERN_WARNING, sp->fcport->vha->hw,
-                                    "unexpected tag values tag:lba=%x:%lx)\n",
+                                    "unexpected tag values tag:lba=%x:%llx)\n",
-                                    e_ref_tag, lba_s);
+                                    e_ref_tag, (unsigned long long)lba_s);
                                return 1;
                        }
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4cace3f20c04..1e69527f1e4e 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1328,10 +1328,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                        qla2x00_sp_compl(ha, sp);
                                } else {
                                        ctx = sp->ctx;
-                                        if (ctx->type == SRB_LOGIN_CMD ||
+                                        if (ctx->type == SRB_ELS_CMD_RPT ||
-                                            ctx->type == SRB_LOGOUT_CMD) {
+                                            ctx->type == SRB_ELS_CMD_HST ||
-                                                ctx->u.iocb_cmd->free(sp);
+                                            ctx->type == SRB_CT_CMD) {
-                                        } else {
                                                struct fc_bsg_job *bsg_job =
                                                    ctx->u.bsg_job;
                                                if (bsg_job->request->msgcode
@@ -1343,6 +1342,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                                kfree(sp->ctx);
                                                mempool_free(sp,
                                                        ha->srb_mempool);
+                                        } else {
+                                                ctx->u.iocb_cmd->free(sp);
                                        }
                                }
                        }
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index d2407558773f..24cacff57786 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -825,6 +825,9 @@ static void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
 {
        struct device *dev = mspi->dev;
+        if (!(mspi->flags & SPI_CPM_MODE))
+                return;
        dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
        cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 8ac6542aedcd..fa594d604aca 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -786,9 +786,11 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
                int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
                if (cs_gpio < 0)
                        cs_gpio = mxc_platform_info->chipselect[i];
+                spi_imx->chipselect[i] = cs_gpio;
                if (cs_gpio < 0)
                        continue;
-                spi_imx->chipselect[i] = cs_gpio;
                ret = gpio_request(spi_imx->chipselect[i], DRIVER_NAME);
                if (ret) {
                        while (i > 0) {
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 1d23f3831866..6a80749391db 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -50,6 +50,8 @@
 #define PCH_RX_THOLD            7
 #define PCH_RX_THOLD_MAX        15
+#define PCH_TX_THOLD            2
 #define PCH_MAX_BAUDRATE        5000000
 #define PCH_MAX_FIFO_DEPTH      16
@@ -58,6 +60,7 @@
 #define PCH_SLEEP_TIME          10
 #define SSN_LOW                 0x02U
+#define SSN_HIGH                0x03U
 #define SSN_NO_CONTROL          0x00U
 #define PCH_MAX_CS              0xFF
 #define PCI_DEVICE_ID_GE_SPI    0x8816
@@ -316,16 +319,19 @@ static void pch_spi_handler_sub(struct pch_spi_data *data, u32 reg_spsr_val,
        /* if transfer complete interrupt */
        if (reg_spsr_val & SPSR_FI_BIT) {
-                if (tx_index < bpw_len)
+                if ((tx_index == bpw_len) && (rx_index == tx_index)) {
+                        /* disable interrupts */
+                        pch_spi_setclr_reg(data->master, PCH_SPCR, 0, PCH_ALL);
+                        /* transfer is completed;
+                           inform pch_spi_process_messages */
+                        data->transfer_complete = true;
+                        data->transfer_active = false;
+                        wake_up(&data->wait);
+                } else {
                        dev_err(&data->master->dev,
                                "%s : Transfer is not completed", __func__);
-                /* disable interrupts */
+                }
-                pch_spi_setclr_reg(data->master, PCH_SPCR, 0, PCH_ALL);
-                /* transfer is completed;inform pch_spi_process_messages */
-                data->transfer_complete = true;
-                data->transfer_active = false;
-                wake_up(&data->wait);
        }
 }
@@ -348,16 +354,26 @@ static irqreturn_t pch_spi_handler(int irq, void *dev_id)
                        "%s returning due to suspend\n", __func__);
                return IRQ_NONE;
        }
-        if (data->use_dma)
-                return IRQ_NONE;
        io_remap_addr = data->io_remap_addr;
        spsr = io_remap_addr + PCH_SPSR;
        reg_spsr_val = ioread32(spsr);
-        if (reg_spsr_val & SPSR_ORF_BIT)
+        if (reg_spsr_val & SPSR_ORF_BIT) {
-                dev_err(&board_dat->pdev->dev, "%s Over run error", __func__);
+                dev_err(&board_dat->pdev->dev, "%s Over run error\n", __func__);
+                if (data->current_msg->complete != 0) {
+                        data->transfer_complete = true;
+                        data->current_msg->status = -EIO;
+                        data->current_msg->complete(data->current_msg->context);
+                        data->bcurrent_msg_processing = false;
+                        data->current_msg = NULL;
+                        data->cur_trans = NULL;
+                }
+        }
+        if (data->use_dma)
+                return IRQ_NONE;
        /* Check if the interrupt is for SPI device */
        if (reg_spsr_val & (SPSR_FI_BIT | SPSR_RFI_BIT)) {
@@ -756,10 +772,6 @@ static void pch_spi_set_ir(struct pch_spi_data *data)
        wait_event_interruptible(data->wait, data->transfer_complete);
-        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
-        dev_dbg(&data->master->dev,
-                "%s:no more control over SSN-writing 0 to SSNXCR.", __func__);
        /* clear all interrupts */
        pch_spi_writereg(data->master, PCH_SPSR,
                         pch_spi_readreg(data->master, PCH_SPSR));
@@ -815,10 +827,11 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw)
        }
 }
-static void pch_spi_start_transfer(struct pch_spi_data *data)
+static int pch_spi_start_transfer(struct pch_spi_data *data)
 {
        struct pch_spi_dma_ctrl *dma;
        unsigned long flags;
+        int rtn;
        dma = &data->dma;
@@ -833,19 +846,23 @@ static void pch_spi_start_transfer(struct pch_spi_data *data)
                                 initiating the transfer. */
        dev_dbg(&data->master->dev,
                "%s:waiting for transfer to get over\n", __func__);
-        wait_event_interruptible(data->wait, data->transfer_complete);
+        rtn = wait_event_interruptible_timeout(data->wait,
+                                               data->transfer_complete,
+                                               msecs_to_jiffies(2 * HZ));
        dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent,
                            DMA_FROM_DEVICE);
+        dma_sync_sg_for_cpu(&data->master->dev, dma->sg_tx_p, dma->nent,
+                            DMA_FROM_DEVICE);
+        memset(data->dma.tx_buf_virt, 0, PAGE_SIZE);
        async_tx_ack(dma->desc_rx);
        async_tx_ack(dma->desc_tx);
        kfree(dma->sg_tx_p);
        kfree(dma->sg_rx_p);
        spin_lock_irqsave(&data->lock, flags);
-        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
-        dev_dbg(&data->master->dev,
-                "%s:no more control over SSN-writing 0 to SSNXCR.", __func__);
        /* clear fifo threshold, disable interrupts, disable SPI transfer */
        pch_spi_setclr_reg(data->master, PCH_SPCR, 0,
@@ -858,6 +875,8 @@ static void pch_spi_start_transfer(struct pch_spi_data *data)
        pch_spi_clear_fifo(data->master);
        spin_unlock_irqrestore(&data->lock, flags);
+        return rtn;
 }
 static void pch_dma_rx_complete(void *arg)
@@ -1023,8 +1042,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        /* set receive fifo threshold and transmit fifo threshold */
        pch_spi_setclr_reg(data->master, PCH_SPCR,
                           ((size - 1) << SPCR_RFIC_FIELD) |
-                           ((PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE) <<
+                           (PCH_TX_THOLD << SPCR_TFIC_FIELD),
-                            SPCR_TFIC_FIELD),
                           MASK_RFIC_SPCR_BITS | MASK_TFIC_SPCR_BITS);
        spin_unlock_irqrestore(&data->lock, flags);
@@ -1035,13 +1053,20 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        /* offset, length setting */
        sg = dma->sg_rx_p;
        for (i = 0; i < num; i++, sg++) {
-                if (i == 0) {
+                if (i == (num - 2)) {
-                        sg->offset = 0;
+                        sg->offset = size * i;
+                        sg->offset = sg->offset * (*bpw / 8);
                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), rem,
                                    sg->offset);
                        sg_dma_len(sg) = rem;
+                } else if (i == (num - 1)) {
+                        sg->offset = size * (i - 1) + rem;
+                        sg->offset = sg->offset * (*bpw / 8);
+                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), size,
+                                    sg->offset);
+                        sg_dma_len(sg) = size;
                } else {
-                        sg->offset = rem + size * (i - 1);
+                        sg->offset = size * i;
                        sg->offset = sg->offset * (*bpw / 8);
                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), size,
                                    sg->offset);
@@ -1065,6 +1090,16 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        dma->desc_rx = desc_rx;
        /* TX */
+        if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+                num = data->bpw_len / PCH_DMA_TRANS_SIZE;
+                size = PCH_DMA_TRANS_SIZE;
+                rem = 16;
+        } else {
+                num = 1;
+                size = data->bpw_len;
+                rem = data->bpw_len;
+        }
        dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
        sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
        /* offset, length setting */
@@ -1162,6 +1197,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
        if (data->use_dma)
                pch_spi_request_dma(data,
                                    data->current_msg->spi->bits_per_word);
+        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
        do {
                /* If we are already processing a message get the next
                transfer structure from the message otherwise retrieve
@@ -1184,7 +1220,8 @@ static void pch_spi_process_messages(struct work_struct *pwork)
                if (data->use_dma) {
                        pch_spi_handle_dma(data, &bpw);
-                        pch_spi_start_transfer(data);
+                        if (!pch_spi_start_transfer(data))
+                                goto out;
                        pch_spi_copy_rx_data_for_dma(data, bpw);
                } else {
                        pch_spi_set_tx(data, &bpw);
@@ -1222,6 +1259,8 @@ static void pch_spi_process_messages(struct work_struct *pwork)
        } while (data->cur_trans != NULL);
+out:
+        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_HIGH);
        if (data->use_dma)
                pch_spi_release_dma(data);
 }
diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index 1a7c19ae766f..8b307b428791 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -411,7 +411,8 @@ static int cvm_oct_napi_poll(struct napi_struct *napi, int budget)
                                skb->protocol = eth_type_trans(skb, dev);
                                skb->dev = dev;
-                                if (unlikely(work->word2.s.not_IP || work->word2.s.IP_exc || work->word2.s.L4_error))
+                                if (unlikely(work->word2.s.not_IP || work->word2.s.IP_exc ||
+                                        work->word2.s.L4_error || !work->word2.s.tcp_or_udp))
                                        skb->ip_summed = CHECKSUM_NONE;
                                else
                                        skb->ip_summed = CHECKSUM_UNNECESSARY;
diff --git a/drivers/tty/serial/lantiq.c b/drivers/tty/serial/lantiq.c
index 58cf279ed879..bc95f52cad8b 100644
--- a/drivers/tty/serial/lantiq.c
+++ b/drivers/tty/serial/lantiq.c
@@ -478,8 +478,10 @@ lqasc_set_termios(struct uart_port *port,
        spin_unlock_irqrestore(&ltq_asc_lock, flags);
        /* Don't rewrite B0 */
-        if (tty_termios_baud_rate(new))
+        if (tty_termios_baud_rate(new))
                tty_termios_encode_baud_rate(new, baud, baud);
+        uart_update_timeout(port, cflag, baud);
 }
 static const char*
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index e0c2807b0970..181fa8158a8b 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -148,10 +148,10 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, bus);
-        /* Register all devices */
        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+        /* First identify all devices ... */
        for (i = 0; i < zorro_num_autocon; i++) {
                z = &zorro_autocon[i];
                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
@@ -172,6 +172,11 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
                dev_set_name(&z->dev, "%02x", i);
                z->dev.parent = &bus->dev;
                z->dev.bus = &zorro_bus_type;
+        }
+        /* ... then register them */
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
                error = device_register(&z->dev);
                if (error) {
                        dev_err(&bus->dev, "Error registering device %s\n",
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a381cd22f518..e4e57d59edb7 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1036,11 +1036,13 @@ out:
 * on error we return an unlocked page and the error value
 * on success we return a locked page and 0
 */
-static int prepare_uptodate_page(struct page *page, u64 pos)
+static int prepare_uptodate_page(struct page *page, u64 pos,
+                                 bool force_uptodate)
 {
        int ret = 0;
-        if ((pos & (PAGE_CACHE_SIZE - 1)) && !PageUptodate(page)) {
+        if (((pos & (PAGE_CACHE_SIZE - 1)) || force_uptodate) &&
+            !PageUptodate(page)) {
                ret = btrfs_readpage(NULL, page);
                if (ret)
                        return ret;
@@ -1061,7 +1063,7 @@ static int prepare_uptodate_page(struct page *page, u64 pos)
 static noinline int prepare_pages(struct btrfs_root *root, struct file *file,
                         struct page **pages, size_t num_pages,
                         loff_t pos, unsigned long first_index,
-                         size_t write_bytes)
+                         size_t write_bytes, bool force_uptodate)
 {
        struct extent_state *cached_state = NULL;
        int i;
@@ -1086,10 +1088,11 @@ again:
                }
                if (i == 0)
-                        err = prepare_uptodate_page(pages[i], pos);
+                        err = prepare_uptodate_page(pages[i], pos,
+                                                    force_uptodate);
                if (i == num_pages - 1)
                        err = prepare_uptodate_page(pages[i],
-                                                    pos + write_bytes);
+                                                    pos + write_bytes, false);
                if (err) {
                        page_cache_release(pages[i]);
                        faili = i - 1;
@@ -1158,6 +1161,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
        size_t num_written = 0;
        int nrptrs;
        int ret = 0;
+        bool force_page_uptodate = false;
        nrptrs = min((iov_iter_count(i) + PAGE_CACHE_SIZE - 1) /
                     PAGE_CACHE_SIZE, PAGE_CACHE_SIZE /
@@ -1200,7 +1204,8 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                 * contents of pages from loop to loop
                 */
                ret = prepare_pages(root, file, pages, num_pages,
-                                    pos, first_index, write_bytes);
+                                    pos, first_index, write_bytes,
+                                    force_page_uptodate);
                if (ret) {
                        btrfs_delalloc_release_space(inode,
                                        num_pages << PAGE_CACHE_SHIFT);
@@ -1217,12 +1222,15 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                if (copied < write_bytes)
                        nrptrs = 1;
-                if (copied == 0)
+                if (copied == 0) {
+                        force_page_uptodate = true;
                        dirty_pages = 0;
-                else
+                } else {
+                        force_page_uptodate = false;
                        dirty_pages = (copied + offset +
                                       PAGE_CACHE_SIZE - 1) >>
                                       PAGE_CACHE_SHIFT;
+                }
                /*
                 * If we had a short copy we need to release the excess delaloc
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 538f65a79ec5..dae5dfe41ba5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1047,7 +1047,16 @@ int btrfs_defrag_file(struct inode *inode, struct file *file,
        if (!max_to_defrag)
                max_to_defrag = last_index - 1;
-        while (i <= last_index && defrag_count < max_to_defrag) {
+        /*
+         * make writeback starts from i, so the defrag range can be
+         * written sequentially.
+         */
+        if (i < inode->i_mapping->writeback_index)
+                inode->i_mapping->writeback_index = i;
+        while (i <= last_index && defrag_count < max_to_defrag &&
+               (i < (i_size_read(inode) + PAGE_CACHE_SIZE - 1) >>
+                PAGE_CACHE_SHIFT)) {
                /*
                 * make sure we stop running if someone unmounts
                 * the FS
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f4af4cc37500..71beb0201970 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2018,7 +2018,7 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
                warned_on_ntlm = true;
                cERROR(1, "default security mechanism requested.  The default "
                        "security mechanism will be upgraded from ntlm to "
-                        "ntlmv2 in kernel release 3.1");
+                        "ntlmv2 in kernel release 3.2");
        }
        ses->overrideSecFlg = volume_info->secFlg;
diff --git a/fs/namei.c b/fs/namei.c
index f4788365ea22..0b3138de2a3b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -721,12 +721,6 @@ static int follow_automount(struct path *path, unsigned flags,
        if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
                return -EREMOTE;
-        /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
-         * and this is the terminal part of the path.
-         */
-        if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
-                return -EISDIR; /* we actually want to stop here */
        /* We don't want to mount if someone's just doing a stat -
         * unless they're stat'ing a directory and appended a '/' to
         * the name.
@@ -739,7 +733,7 @@ static int follow_automount(struct path *path, unsigned flags,
         * of the daemon to instantiate them before they can be used.
         */
        if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                     LOOKUP_OPEN | LOOKUP_CREATE)) &&
+                     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
            path->dentry->d_inode)
                return -EISDIR;
diff --git a/fs/namespace.c b/fs/namespace.c
index 22bfe8273c68..b4febb29d3bb 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1757,7 +1757,7 @@ static int do_loopback(struct path *path, char *old_name,
                return err;
        if (!old_name || !*old_name)
                return -EINVAL;
-        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
+        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
        if (err)
                return err;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 9b7dd7013b15..5b19b6aabe18 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2798,7 +2798,7 @@ static struct dentry *nfs_follow_remote_path(struct vfsmount *root_mnt,
                goto out_put_mnt_ns;
        ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, &path);
+                        export_path, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
        nfs_referral_loop_unprotect();
        put_mnt_ns(ns_private);
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b34bdb25490c..10b6be3ca280 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
         * resolution (think about autofs) and thus deadlocks could arise.
         */
        if (cmds == Q_QUOTAON) {
-                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
                if (ret)
                        pathp = ERR_PTR(ret);
                else
diff --git a/fs/stat.c b/fs/stat.c
index ba5316ffac61..78a3aa83c7ea 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -81,8 +81,6 @@ int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat,
        if (!(flag & AT_SYMLINK_NOFOLLOW))
                lookup_flags |= LOOKUP_FOLLOW;
-        if (flag & AT_NO_AUTOMOUNT)
-                lookup_flags |= LOOKUP_NO_AUTOMOUNT;
        if (flag & AT_EMPTY_PATH)
                lookup_flags |= LOOKUP_EMPTY;
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index cac2ecfa6746..ef43fce519a1 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -629,7 +629,7 @@ xfs_buf_item_push(
 * the xfsbufd to get this buffer written. We have to unlock the buffer
 * to allow the xfsbufd to write it, too.
 */
-STATIC void
+STATIC bool
 xfs_buf_item_pushbuf(
        struct xfs_log_item     *lip)
 {
@@ -643,6 +643,7 @@ xfs_buf_item_pushbuf(
        xfs_buf_delwri_promote(bp);
        xfs_buf_relse(bp);
+        return true;
 }
 STATIC void
diff --git a/fs/xfs/xfs_dquot_item.c b/fs/xfs/xfs_dquot_item.c
index 9e0e2fa3f2c8..bb3f71d236d2 100644
--- a/fs/xfs/xfs_dquot_item.c
+++ b/fs/xfs/xfs_dquot_item.c
@@ -183,13 +183,14 @@ xfs_qm_dqunpin_wait(
 * search the buffer cache can be a time consuming thing, and AIL lock is a
 * spinlock.
 */
-STATIC void
+STATIC bool
 xfs_qm_dquot_logitem_pushbuf(
        struct xfs_log_item     *lip)
 {
        struct xfs_dq_logitem   *qlip = DQUOT_ITEM(lip);
        struct xfs_dquot        *dqp = qlip->qli_dquot;
        struct xfs_buf          *bp;
+        bool                    ret = true;
        ASSERT(XFS_DQ_IS_LOCKED(dqp));
@@ -201,17 +202,20 @@ xfs_qm_dquot_logitem_pushbuf(
        if (completion_done(&dqp->q_flush) ||
            !(lip->li_flags & XFS_LI_IN_AIL)) {
                xfs_dqunlock(dqp);
-                return;
+                return true;
        }
        bp = xfs_incore(dqp->q_mount->m_ddev_targp, qlip->qli_format.qlf_blkno,
                        dqp->q_mount->m_quotainfo->qi_dqchunklen, XBF_TRYLOCK);
        xfs_dqunlock(dqp);
        if (!bp)
-                return;
+                return true;
        if (XFS_BUF_ISDELAYWRITE(bp))
                xfs_buf_delwri_promote(bp);
+        if (xfs_buf_ispinned(bp))
+                ret = false;
        xfs_buf_relse(bp);
+        return ret;
 }
 /*
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index 588406dc6a35..836ad80d4f2b 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -708,13 +708,14 @@ xfs_inode_item_committed(
 * marked delayed write. If that's the case, we'll promote it and that will
 * allow the caller to write the buffer by triggering the xfsbufd to run.
 */
-STATIC void
+STATIC bool
 xfs_inode_item_pushbuf(
        struct xfs_log_item     *lip)
 {
        struct xfs_inode_log_item *iip = INODE_ITEM(lip);
        struct xfs_inode        *ip = iip->ili_inode;
        struct xfs_buf          *bp;
+        bool                    ret = true;
        ASSERT(xfs_isilocked(ip, XFS_ILOCK_SHARED));
@@ -725,7 +726,7 @@ xfs_inode_item_pushbuf(
        if (completion_done(&ip->i_flush) ||
            !(lip->li_flags & XFS_LI_IN_AIL)) {
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
-                return;
+                return true;
        }
        bp = xfs_incore(ip->i_mount->m_ddev_targp, iip->ili_format.ilf_blkno,
@@ -733,10 +734,13 @@ xfs_inode_item_pushbuf(
        xfs_iunlock(ip, XFS_ILOCK_SHARED);
        if (!bp)
-                return;
+                return true;
        if (XFS_BUF_ISDELAYWRITE(bp))
                xfs_buf_delwri_promote(bp);
+        if (xfs_buf_ispinned(bp))
+                ret = false;
        xfs_buf_relse(bp);
+        return ret;
 }
 /*
diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h
index 1e8a45e74c3e..828662f70d64 100644
--- a/fs/xfs/xfs_linux.h
+++ b/fs/xfs/xfs_linux.h
@@ -68,6 +68,8 @@
 #include <linux/ctype.h>
 #include <linux/writeback.h>
 #include <linux/capability.h>
+#include <linux/kthread.h>
+#include <linux/freezer.h>
 #include <linux/list_sort.h>
 #include <asm/page.h>
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index 2366c54cc4fa..5cf06b85fd9d 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1652,24 +1652,13 @@ xfs_init_workqueues(void)
         */
        xfs_syncd_wq = alloc_workqueue("xfssyncd", WQ_CPU_INTENSIVE, 8);
        if (!xfs_syncd_wq)
-                goto out;
+                return -ENOMEM;
-        xfs_ail_wq = alloc_workqueue("xfsail", WQ_CPU_INTENSIVE, 8);
-        if (!xfs_ail_wq)
-                goto out_destroy_syncd;
        return 0;
-out_destroy_syncd:
-        destroy_workqueue(xfs_syncd_wq);
-out:
-        return -ENOMEM;
 }
 STATIC void
 xfs_destroy_workqueues(void)
 {
-        destroy_workqueue(xfs_ail_wq);
        destroy_workqueue(xfs_syncd_wq);
 }
diff --git a/fs/xfs/xfs_trans.h b/fs/xfs/xfs_trans.h
index 06a9759b6352..53597f4db9b5 100644
--- a/fs/xfs/xfs_trans.h
+++ b/fs/xfs/xfs_trans.h
@@ -350,7 +350,7 @@ typedef struct xfs_item_ops {
        void (*iop_unlock)(xfs_log_item_t *);
        xfs_lsn_t (*iop_committed)(xfs_log_item_t *, xfs_lsn_t);
        void (*iop_push)(xfs_log_item_t *);
-        void (*iop_pushbuf)(xfs_log_item_t *);
+        bool (*iop_pushbuf)(xfs_log_item_t *);
        void (*iop_committing)(xfs_log_item_t *, xfs_lsn_t);
 } xfs_item_ops_t;
diff --git a/fs/xfs/xfs_trans_ail.c b/fs/xfs/xfs_trans_ail.c
index c15aa29fa169..3a1e7ca54c2d 100644
--- a/fs/xfs/xfs_trans_ail.c
+++ b/fs/xfs/xfs_trans_ail.c
@@ -28,8 +28,6 @@
 #include "xfs_trans_priv.h"
 #include "xfs_error.h"
-struct workqueue_struct *xfs_ail_wq;    /* AIL workqueue */
 #ifdef DEBUG
 /*
 * Check that the list is sorted as it should be.
@@ -356,16 +354,10 @@ xfs_ail_delete(
        xfs_trans_ail_cursor_clear(ailp, lip);
 }
-/*
+static long
- * xfs_ail_worker does the work of pushing on the AIL. It will requeue itself
+xfsaild_push(
- * to run at a later time if there is more work to do to complete the push.
+        struct xfs_ail          *ailp)
- */
-STATIC void
-xfs_ail_worker(
-        struct work_struct      *work)
 {
-        struct xfs_ail          *ailp = container_of(to_delayed_work(work),
-                                        struct xfs_ail, xa_work);
        xfs_mount_t             *mp = ailp->xa_mount;
        struct xfs_ail_cursor   cur;
        xfs_log_item_t          *lip;
@@ -427,8 +419,13 @@ xfs_ail_worker(
                case XFS_ITEM_PUSHBUF:
                        XFS_STATS_INC(xs_push_ail_pushbuf);
-                        IOP_PUSHBUF(lip);
-                        ailp->xa_last_pushed_lsn = lsn;
+                        if (!IOP_PUSHBUF(lip)) {
+                                stuck++;
+                                flush_log = 1;
+                        } else {
+                                ailp->xa_last_pushed_lsn = lsn;
+                        }
                        push_xfsbufd = 1;
                        break;
@@ -440,7 +437,6 @@ xfs_ail_worker(
                case XFS_ITEM_LOCKED:
                        XFS_STATS_INC(xs_push_ail_locked);
-                        ailp->xa_last_pushed_lsn = lsn;
                        stuck++;
                        break;
@@ -501,20 +497,6 @@ out_done:
                /* We're past our target or empty, so idle */
                ailp->xa_last_pushed_lsn = 0;
-                /*
-                 * We clear the XFS_AIL_PUSHING_BIT first before checking
-                 * whether the target has changed. If the target has changed,
-                 * this pushes the requeue race directly onto the result of the
-                 * atomic test/set bit, so we are guaranteed that either the
-                 * the pusher that changed the target or ourselves will requeue
-                 * the work (but not both).
-                 */
-                clear_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags);
-                smp_rmb();
-                if (XFS_LSN_CMP(ailp->xa_target, target) == 0 ||
-                    test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
-                        return;
                tout = 50;
        } else if (XFS_LSN_CMP(lsn, target) >= 0) {
                /*
@@ -537,9 +519,30 @@ out_done:
                tout = 20;
        }
-        /* There is more to do, requeue us.  */
+        return tout;
-        queue_delayed_work(xfs_syncd_wq, &ailp->xa_work,
+}
-                                        msecs_to_jiffies(tout));
+static int
+xfsaild(
+        void            *data)
+{
+        struct xfs_ail  *ailp = data;
+        long            tout = 0;       /* milliseconds */
+        while (!kthread_should_stop()) {
+                if (tout && tout <= 20)
+                        __set_current_state(TASK_KILLABLE);
+                else
+                        __set_current_state(TASK_INTERRUPTIBLE);
+                schedule_timeout(tout ?
+                                 msecs_to_jiffies(tout) : MAX_SCHEDULE_TIMEOUT);
+                try_to_freeze();
+                tout = xfsaild_push(ailp);
+        }
+        return 0;
 }
 /*
@@ -574,8 +577,9 @@ xfs_ail_push(
         */
        smp_wmb();
        xfs_trans_ail_copy_lsn(ailp, &ailp->xa_target, &threshold_lsn);
-        if (!test_and_set_bit(XFS_AIL_PUSHING_BIT, &ailp->xa_flags))
+        smp_wmb();
-                queue_delayed_work(xfs_syncd_wq, &ailp->xa_work, 0);
+        wake_up_process(ailp->xa_task);
 }
 /*
@@ -813,9 +817,18 @@ xfs_trans_ail_init(
        INIT_LIST_HEAD(&ailp->xa_ail);
        INIT_LIST_HEAD(&ailp->xa_cursors);
        spin_lock_init(&ailp->xa_lock);
-        INIT_DELAYED_WORK(&ailp->xa_work, xfs_ail_worker);
+        ailp->xa_task = kthread_run(xfsaild, ailp, "xfsaild/%s",
+                        ailp->xa_mount->m_fsname);
+        if (IS_ERR(ailp->xa_task))
+                goto out_free_ailp;
        mp->m_ail = ailp;
        return 0;
+out_free_ailp:
+        kmem_free(ailp);
+        return ENOMEM;
 }
 void
@@ -824,6 +837,6 @@ xfs_trans_ail_destroy(
 {
        struct xfs_ail  *ailp = mp->m_ail;
-        cancel_delayed_work_sync(&ailp->xa_work);
+        kthread_stop(ailp->xa_task);
        kmem_free(ailp);
 }
diff --git a/fs/xfs/xfs_trans_priv.h b/fs/xfs/xfs_trans_priv.h
index 212946b97239..22750b5e4a8f 100644
--- a/fs/xfs/xfs_trans_priv.h
+++ b/fs/xfs/xfs_trans_priv.h
@@ -64,23 +64,17 @@ struct xfs_ail_cursor {
 */
 struct xfs_ail {
        struct xfs_mount        *xa_mount;
+        struct task_struct      *xa_task;
        struct list_head        xa_ail;
        xfs_lsn_t               xa_target;
        struct list_head        xa_cursors;
        spinlock_t              xa_lock;
-        struct delayed_work     xa_work;
        xfs_lsn_t               xa_last_pushed_lsn;
-        unsigned long           xa_flags;
 };
-#define XFS_AIL_PUSHING_BIT     0
 /*
 * From xfs_trans_ail.c
 */
-extern struct workqueue_struct  *xfs_ail_wq;    /* AIL workqueue */
 void    xfs_trans_ail_update_bulk(struct xfs_ail *ailp,
                                struct xfs_ail_cursor *cur,
                                struct xfs_log_item **log_items, int nr_items,
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 3fa1f3d90ce0..99e3e50b5c57 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -197,6 +197,11 @@ struct dm_target {
         * whether or not its underlying devices have support.
         */
        unsigned discards_supported:1;
+        /*
+         * Set if this target does not return zeroes on discarded blocks.
+         */
+        unsigned discard_zeroes_data_unsupported:1;
 };
 /* Each target can link one of these into the table */
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index e807ad687a07..3ad553e8eae2 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -80,6 +80,7 @@ extern void irq_domain_del(struct irq_domain *domain);
 #endif /* CONFIG_IRQ_DOMAIN */
 #if defined(CONFIG_IRQ_DOMAIN) && defined(CONFIG_OF_IRQ)
+extern struct irq_domain_ops irq_domain_simple_ops;
 extern void irq_domain_add_simple(struct device_node *controller, int irq_base);
 extern void irq_domain_generate_simple(const struct of_device_id *match,
                                        u64 phys_base, unsigned int irq_start);
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 2c366b52f505..aace6b8691a2 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -553,6 +553,7 @@ struct kvm_ppc_pvinfo {
 #define KVM_CAP_SPAPR_TCE 63
 #define KVM_CAP_PPC_SMT 64
 #define KVM_CAP_PPC_RMA 65
+#define KVM_CAP_S390_GMAP 71
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/include/linux/namei.h b/include/linux/namei.h
index 76fe2c62ae71..409328d1cbbb 100644
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -48,11 +48,12 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
 */
 #define LOOKUP_FOLLOW           0x0001
 #define LOOKUP_DIRECTORY        0x0002
+#define LOOKUP_AUTOMOUNT        0x0004
 #define LOOKUP_PARENT           0x0010
 #define LOOKUP_REVAL            0x0020
 #define LOOKUP_RCU              0x0040
-#define LOOKUP_NO_AUTOMOUNT     0x0080
 /*
 * Intent data
 */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 8c230cbcbb48..9fc01226055b 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -621,8 +621,9 @@ struct pci_driver {
 extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
 enum pcie_bus_config_types {
-        PCIE_BUS_PERFORMANCE,
+        PCIE_BUS_TUNE_OFF,
        PCIE_BUS_SAFE,
+        PCIE_BUS_PERFORMANCE,
        PCIE_BUS_PEER2PEER,
 };
diff --git a/include/linux/ptp_classify.h b/include/linux/ptp_classify.h
index e07e2742a865..1dc420ba213a 100644
--- a/include/linux/ptp_classify.h
+++ b/include/linux/ptp_classify.h
@@ -51,6 +51,7 @@
 #define PTP_CLASS_V2_VLAN (PTP_CLASS_V2 | PTP_CLASS_VLAN)
 #define PTP_EV_PORT 319
+#define PTP_GEN_BIT 0x08 /* indicates general message, if set in message type */
 #define OFF_ETYPE       12
 #define OFF_IHL         14
@@ -116,14 +117,20 @@ static inline int ptp_filter_init(struct sock_filter *f, int len)
        {OP_OR,         0,   0, PTP_CLASS_IPV6          }, /*              */ \
        {OP_RETA,       0,   0, 0                       }, /*              */ \
 /*L3x*/ {OP_RETK,       0,   0, PTP_CLASS_NONE          }, /*              */ \
-/*L40*/ {OP_JEQ,        0,   6, ETH_P_8021Q             }, /* f goto L50   */ \
+/*L40*/ {OP_JEQ,        0,   9, ETH_P_8021Q             }, /* f goto L50   */ \
        {OP_LDH,        0,   0, OFF_ETYPE + 4           }, /*              */ \
-        {OP_JEQ,        0,   9, ETH_P_1588              }, /* f goto L60   */ \
+        {OP_JEQ,        0,  15, ETH_P_1588              }, /* f goto L60   */ \
+        {OP_LDB,        0,   0, ETH_HLEN + VLAN_HLEN    }, /*              */ \
+        {OP_AND,        0,   0, PTP_GEN_BIT             }, /*              */ \
+        {OP_JEQ,        0,  12, 0                       }, /* f goto L6x   */ \
        {OP_LDH,        0,   0, ETH_HLEN + VLAN_HLEN    }, /*              */ \
        {OP_AND,        0,   0, PTP_CLASS_VMASK         }, /*              */ \
        {OP_OR,         0,   0, PTP_CLASS_VLAN          }, /*              */ \
        {OP_RETA,       0,   0, 0                       }, /*              */ \
-/*L50*/ {OP_JEQ,        0,   4, ETH_P_1588              }, /* f goto L61   */ \
+/*L50*/ {OP_JEQ,        0,   7, ETH_P_1588              }, /* f goto L61   */ \
+        {OP_LDB,        0,   0, ETH_HLEN                }, /*              */ \
+        {OP_AND,        0,   0, PTP_GEN_BIT             }, /*              */ \
+        {OP_JEQ,        0,   4, 0                       }, /* f goto L6x   */ \
        {OP_LDH,        0,   0, ETH_HLEN                }, /*              */ \
        {OP_AND,        0,   0, PTP_CLASS_VMASK         }, /*              */ \
        {OP_OR,         0,   0, PTP_CLASS_L2            }, /*              */ \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ac2c0578e0f..41d0237fd449 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1956,7 +1956,6 @@ static inline void disable_sched_clock_irqtime(void) {}
 extern unsigned long long
 task_sched_runtime(struct task_struct *task);
-extern unsigned long long thread_group_sched_runtime(struct task_struct *task);
 /* sched_exec is called by processes performing an exec */
 #ifdef CONFIG_SMP
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 1aaf915656f3..8fa4430f99c1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -900,6 +900,7 @@ struct netns_ipvs {
        volatile int            sync_state;
        volatile int            master_syncid;
        volatile int            backup_syncid;
+        struct mutex            sync_mutex;
        /* multicast interface name */
        char                    master_mcast_ifn[IP_VS_IFNAME_MAXLEN];
        char                    backup_mcast_ifn[IP_VS_IFNAME_MAXLEN];
diff --git a/include/net/udplite.h b/include/net/udplite.h
index 673a024c6b2a..5f097ca7d5c5 100644
--- a/include/net/udplite.h
+++ b/include/net/udplite.h
@@ -66,40 +66,34 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh)
        return 0;
 }
-static inline int udplite_sender_cscov(struct udp_sock *up, struct udphdr *uh)
+/* Slow-path computation of checksum. Socket is locked. */
+static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
 {
+        const struct udp_sock *up = udp_sk(skb->sk);
        int cscov = up->len;
+        __wsum csum = 0;
-        /*
+        if (up->pcflag & UDPLITE_SEND_CC) {
-         * Sender has set `partial coverage' option on UDP-Lite socket
+                /*
-         */
+                 * Sender has set `partial coverage' option on UDP-Lite socket.
-        if (up->pcflag & UDPLITE_SEND_CC)    {
+                 * The special case "up->pcslen == 0" signifies full coverage.
+                 */
                if (up->pcslen < up->len) {
-                /* up->pcslen == 0 means that full coverage is required,
+                        if (0 < up->pcslen)
-                 * partial coverage only if  0 < up->pcslen < up->len */
+                                cscov = up->pcslen;
-                        if (0 < up->pcslen) {
+                        udp_hdr(skb)->len = htons(up->pcslen);
-                               cscov = up->pcslen;
-                        }
-                        uh->len = htons(up->pcslen);
                }
-        /*
+                /*
-         * NOTE: Causes for the error case  `up->pcslen > up->len':
+                 * NOTE: Causes for the error case  `up->pcslen > up->len':
-         *        (i)  Application error (will not be penalized).
+                 *        (i)  Application error (will not be penalized).
-         *       (ii)  Payload too big for send buffer: data is split
+                 *       (ii)  Payload too big for send buffer: data is split
-         *             into several packets, each with its own header.
+                 *             into several packets, each with its own header.
-         *             In this case (e.g. last segment), coverage may
+                 *             In this case (e.g. last segment), coverage may
-         *             exceed packet length.
+                 *             exceed packet length.
-         *       Since packets with coverage length > packet length are
+                 *       Since packets with coverage length > packet length are
-         *       illegal, we fall back to the defaults here.
+                 *       illegal, we fall back to the defaults here.
-         */
+                 */
        }
-        return cscov;
-}
-static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
-{
-        int cscov = udplite_sender_cscov(udp_sk(sk), udp_hdr(skb));
-        __wsum csum = 0;
        skb->ip_summed = CHECKSUM_NONE;     /* no HW support for checksumming */
@@ -115,16 +109,21 @@ static inline __wsum udplite_csum_outgoing(struct sock *sk, struct sk_buff *skb)
        return csum;
 }
+/* Fast-path computation of checksum. Socket may not be locked. */
 static inline __wsum udplite_csum(struct sk_buff *skb)
 {
-        struct sock *sk = skb->sk;
+        const struct udp_sock *up = udp_sk(skb->sk);
-        int cscov = udplite_sender_cscov(udp_sk(sk), udp_hdr(skb));
        const int off = skb_transport_offset(skb);
-        const int len = skb->len - off;
+        int len = skb->len - off;
+        if ((up->pcflag & UDPLITE_SEND_CC) && up->pcslen < len) {
+                if (0 < up->pcslen)
+                        len = up->pcslen;
+                udp_hdr(skb)->len = htons(up->pcslen);
+        }
        skb->ip_summed = CHECKSUM_NONE;     /* no HW support for checksumming */
-        return skb_checksum(skb, off, min(cscov, len), 0);
+        return skb_checksum(skb, off, len, 0);
 }
 extern void     udplite4_register(void);
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 6bca4cc0063c..5f172703eb4f 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -298,7 +298,7 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                __array(char, name, 32)
                __field(unsigned long, ino)
                __field(unsigned long, state)
-                __field(unsigned long, age)
+                __field(unsigned long, dirtied_when)
                __field(unsigned long, writeback_index)
                __field(long, nr_to_write)
                __field(unsigned long, wrote)
@@ -309,19 +309,19 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                        dev_name(inode->i_mapping->backing_dev_info->dev), 32);
                __entry->ino            = inode->i_ino;
                __entry->state          = inode->i_state;
-                __entry->age            = (jiffies - inode->dirtied_when) *
+                __entry->dirtied_when   = inode->dirtied_when;
-                                                                1000 / HZ;
                __entry->writeback_index = inode->i_mapping->writeback_index;
                __entry->nr_to_write    = nr_to_write;
                __entry->wrote          = nr_to_write - wbc->nr_to_write;
        ),
-        TP_printk("bdi %s: ino=%lu state=%s age=%lu "
+        TP_printk("bdi %s: ino=%lu state=%s dirtied_when=%lu age=%lu "
                  "index=%lu to_write=%ld wrote=%lu",
                  __entry->name,
                  __entry->ino,
                  show_inode_state(__entry->state),
-                  __entry->age,
+                  __entry->dirtied_when,
+                  (jiffies - __entry->dirtied_when) / HZ,
                  __entry->writeback_index,
                  __entry->nr_to_write,
                  __entry->wrote
diff --git a/init/main.c b/init/main.c
index 2a9b88aa5e76..03b408dff825 100644
--- a/init/main.c
+++ b/init/main.c
@@ -381,9 +381,6 @@ static noinline void __init_refok rest_init(void)
        preempt_enable_no_resched();
        schedule();
-        /* At this point, we can enable user mode helper functionality */
-        usermodehelper_enable();
        /* Call into cpu_idle with preempt disabled */
        preempt_disable();
        cpu_idle();
@@ -733,6 +730,7 @@ static void __init do_basic_setup(void)
        driver_init();
        init_irq_proc();
        do_ctors();
+        usermodehelper_enable();
        do_initcalls();
 }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index d5828da3fd38..b57a3776de44 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -29,7 +29,11 @@ void irq_domain_add(struct irq_domain *domain)
         */
        for (hwirq = 0; hwirq < domain->nr_irq; hwirq++) {
                d = irq_get_irq_data(irq_domain_to_irq(domain, hwirq));
-                if (d || d->domain) {
+                if (!d) {
+                        WARN(1, "error: assigning domain to non existant irq_desc");
+                        return;
+                }
+                if (d->domain) {
                        /* things are broken; just report, don't clean up */
                        WARN(1, "error: irq_desc already assigned to a domain");
                        return;
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 58f405b581e7..640ded8f5c48 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -250,7 +250,7 @@ void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
        do {
                times->utime = cputime_add(times->utime, t->utime);
                times->stime = cputime_add(times->stime, t->stime);
-                times->sum_exec_runtime += t->se.sum_exec_runtime;
+                times->sum_exec_runtime += task_sched_runtime(t);
        } while_each_thread(tsk, t);
 out:
        rcu_read_unlock();
@@ -274,9 +274,7 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
        struct task_cputime sum;
        unsigned long flags;
-        spin_lock_irqsave(&cputimer->lock, flags);
        if (!cputimer->running) {
-                cputimer->running = 1;
                /*
                 * The POSIX timer interface allows for absolute time expiry
                 * values through the TIMER_ABSTIME flag, therefore we have
@@ -284,8 +282,11 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
                 * it.
                 */
                thread_group_cputime(tsk, &sum);
+                spin_lock_irqsave(&cputimer->lock, flags);
+                cputimer->running = 1;
                update_gt_cputime(&cputimer->cputime, &sum);
-        }
+        } else
+                spin_lock_irqsave(&cputimer->lock, flags);
        *times = cputimer->cputime;
        spin_unlock_irqrestore(&cputimer->lock, flags);
 }
@@ -312,7 +313,8 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
                cpu->cpu = cputime.utime;
                break;
        case CPUCLOCK_SCHED:
-                cpu->sched = thread_group_sched_runtime(p);
+                thread_group_cputime(p, &cputime);
+                cpu->sched = cputime.sum_exec_runtime;
                break;
        }
        return 0;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 9de3ecfd20f9..a70d2a5d8c7b 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -744,20 +744,17 @@ int ptrace_request(struct task_struct *child, long request,
                        break;
                si = child->last_siginfo;
-                if (unlikely(!si || si->si_code >> 8 != PTRACE_EVENT_STOP))
+                if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
-                        break;
+                        child->jobctl |= JOBCTL_LISTENING;
+                        /*
-                child->jobctl |= JOBCTL_LISTENING;
+                         * If NOTIFY is set, it means event happened between
+                         * start of this trap and now.  Trigger re-trap.
-                /*
+                         */
-                 * If NOTIFY is set, it means event happened between start
+                        if (child->jobctl & JOBCTL_TRAP_NOTIFY)
-                 * of this trap and now.  Trigger re-trap immediately.
+                                signal_wake_up(child, true);
-                 */
+                        ret = 0;
-                if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+                }
-                        signal_wake_up(child, true);
                unlock_task_sighand(child, &flags);
-                ret = 0;
                break;
        case PTRACE_DETACH:      /* detach a process that was attached. */
diff --git a/kernel/resource.c b/kernel/resource.c
index 3b3cedc52592..c8dc249da5ce 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -419,6 +419,9 @@ static int __find_resource(struct resource *root, struct resource *old,
                else
                        tmp.end = root->end;
+                if (tmp.end < tmp.start)
+                        goto next;
                resource_clip(&tmp, constraint->min, constraint->max);
                arch_remove_reservations(&tmp);
@@ -436,8 +439,10 @@ static int __find_resource(struct resource *root, struct resource *old,
                                return 0;
                        }
                }
-                if (!this)
+next:           if (!this || this->end == root->end)
                        break;
                if (this != old)
                        tmp.start = this->end + 1;
                this = this->sibling;
diff --git a/kernel/sched.c b/kernel/sched.c
index ec5f472bc5b9..b50b0f0c9aa9 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3725,30 +3725,6 @@ unsigned long long task_sched_runtime(struct task_struct *p)
 }
 /*
- * Return sum_exec_runtime for the thread group.
- * In case the task is currently running, return the sum plus current's
- * pending runtime that have not been accounted yet.
- *
- * Note that the thread group might have other running tasks as well,
- * so the return value not includes other pending runtime that other
- * running tasks might have.
- */
-unsigned long long thread_group_sched_runtime(struct task_struct *p)
-{
-        struct task_cputime totals;
-        unsigned long flags;
-        struct rq *rq;
-        u64 ns;
-        rq = task_rq_lock(p, &flags);
-        thread_group_cputime(p, &totals);
-        ns = totals.sum_exec_runtime + do_task_delta_exec(p, rq);
-        task_rq_unlock(rq, p, &flags);
-        return ns;
-}
-/*
 * Account user cpu time to a process.
 * @p: the process that the cpu time gets accounted to
 * @cputime: the cpu time spent in user space since the last update
@@ -4372,7 +4348,7 @@ static inline void sched_submit_work(struct task_struct *tsk)
                blk_schedule_flush_plug(tsk);
 }
-asmlinkage void schedule(void)
+asmlinkage void __sched schedule(void)
 {
        struct task_struct *tsk = current;
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 97540f0c9e47..af1177858be3 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -1050,7 +1050,7 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
         */
        if (curr && unlikely(rt_task(curr)) &&
            (curr->rt.nr_cpus_allowed < 2 ||
-             curr->prio < p->prio) &&
+             curr->prio <= p->prio) &&
            (p->rt.nr_cpus_allowed > 1)) {
                int target = find_lowest_rq(p);
@@ -1581,7 +1581,7 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
            p->rt.nr_cpus_allowed > 1 &&
            rt_task(rq->curr) &&
            (rq->curr->rt.nr_cpus_allowed < 2 ||
-             rq->curr->prio < p->prio))
+             rq->curr->prio <= p->prio))
                push_rt_tasks(rq);
 }
diff --git a/kernel/sys.c b/kernel/sys.c
index 18ee1d2f6474..1dbbe695a5ef 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1172,7 +1172,7 @@ DECLARE_RWSEM(uts_sem);
 static int override_release(char __user *release, int len)
 {
        int ret = 0;
-        char buf[len];
+        char buf[65];
        if (current->personality & UNAME26) {
                char *rest = UTS_RELEASE;
diff --git a/mm/migrate.c b/mm/migrate.c
index 666e4e677414..14d0a6a632f6 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -120,10 +120,10 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
                ptep = pte_offset_map(pmd, addr);
-                if (!is_swap_pte(*ptep)) {
+                /*
-                        pte_unmap(ptep);
+                 * Peek to check is_swap_pte() before taking ptlock?  No, we
-                        goto out;
+                 * can race mremap's move_ptes(), which skips anon_vma lock.
-                }
+                 */
                ptl = pte_lockptr(mm, pmd);
        }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 3e2f91ffa4e2..05dd35114a27 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -565,7 +565,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        struct orig_node *orig_node = NULL;
        int data_len = skb->len, ret;
        short vid = -1;
-        bool do_bcast = false;
+        bool do_bcast;
        if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
                goto dropped;
@@ -598,15 +598,15 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        tt_local_add(soft_iface, ethhdr->h_source);
        orig_node = transtable_search(bat_priv, ethhdr->h_dest);
-        if (is_multicast_ether_addr(ethhdr->h_dest) ||
+        do_bcast = is_multicast_ether_addr(ethhdr->h_dest);
-                                (orig_node && orig_node->gw_flags)) {
+        if (do_bcast || (orig_node && orig_node->gw_flags)) {
                ret = gw_is_target(bat_priv, skb, orig_node);
                if (ret < 0)
                        goto dropped;
-                if (ret == 0)
+                if (ret)
-                        do_bcast = true;
+                        do_bcast = false;
        }
        /* ethernet packet should be broadcasted */
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 61f1f623091d..e8292369cdcf 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -26,6 +26,8 @@
 /* Bluetooth L2CAP sockets. */
+#include <linux/security.h>
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 #include <net/bluetooth/l2cap.h>
@@ -933,6 +935,8 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                chan->force_reliable = pchan->force_reliable;
                chan->flushable = pchan->flushable;
                chan->force_active = pchan->force_active;
+                security_sk_clone(parent, sk);
        } else {
                switch (sk->sk_type) {
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 482722bbc7a0..5417f6127323 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -42,6 +42,7 @@
 #include <linux/device.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/security.h>
 #include <net/sock.h>
 #include <asm/system.h>
@@ -264,6 +265,8 @@ static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
                pi->sec_level = rfcomm_pi(parent)->sec_level;
                pi->role_switch = rfcomm_pi(parent)->role_switch;
+                security_sk_clone(parent, sk);
        } else {
                pi->dlc->defer_setup = 0;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 8270f05e3f1f..a324b009e34b 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -41,6 +41,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/list.h>
+#include <linux/security.h>
 #include <net/sock.h>
 #include <asm/system.h>
@@ -403,8 +404,10 @@ static void sco_sock_init(struct sock *sk, struct sock *parent)
 {
        BT_DBG("sk %p", sk);
-        if (parent)
+        if (parent) {
                sk->sk_type = parent->sk_type;
+                security_sk_clone(parent, sk);
+        }
 }
 static struct proto sco_proto = {
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 32b8f9f7f79e..ff3ed6086ce1 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -91,7 +91,6 @@ static int br_dev_open(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        netif_carrier_off(dev);
        netdev_update_features(dev);
        netif_start_queue(dev);
        br_stp_enable_bridge(br);
@@ -108,8 +107,6 @@ static int br_dev_stop(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        netif_carrier_off(dev);
        br_stp_disable_bridge(br);
        br_multicast_stop(br);
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index e73815456adf..1d420f64ff27 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -161,9 +161,10 @@ static void del_nbp(struct net_bridge_port *p)
        call_rcu(&p->rcu, destroy_nbp_rcu);
 }
-/* called with RTNL */
+/* Delete bridge device */
-static void del_br(struct net_bridge *br, struct list_head *head)
+void br_dev_delete(struct net_device *dev, struct list_head *head)
 {
+        struct net_bridge *br = netdev_priv(dev);
        struct net_bridge_port *p, *n;
        list_for_each_entry_safe(p, n, &br->port_list, list) {
@@ -268,7 +269,7 @@ int br_del_bridge(struct net *net, const char *name)
        }
        else
-                del_br(netdev_priv(dev), NULL);
+                br_dev_delete(dev, NULL);
        rtnl_unlock();
        return ret;
@@ -449,7 +450,7 @@ void __net_exit br_net_exit(struct net *net)
        rtnl_lock();
        for_each_netdev(net, dev)
                if (dev->priv_flags & IFF_EBRIDGE)
-                        del_br(netdev_priv(dev), &list);
+                        br_dev_delete(dev, &list);
        unregister_netdevice_many(&list);
        rtnl_unlock();
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 5b1ed1ba9aa7..e5f9ece3c9a0 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -210,6 +210,7 @@ static struct rtnl_link_ops br_link_ops __read_mostly = {
        .priv_size      = sizeof(struct net_bridge),
        .setup          = br_dev_setup,
        .validate       = br_validate,
+        .dellink        = br_dev_delete,
 };
 int __init br_netlink_init(void)
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 78cc364997d9..857a021deea9 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -294,6 +294,7 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 /* br_device.c */
 extern void br_dev_setup(struct net_device *dev);
+extern void br_dev_delete(struct net_device *dev, struct list_head *list);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                               struct net_device *dev);
 #ifdef CONFIG_NET_POLL_CONTROLLER
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d6c8ae5b2e6a..c84963d2dee6 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -344,6 +344,18 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
        }
 }
+static void bcm_tx_start_timer(struct bcm_op *op)
+{
+        if (op->kt_ival1.tv64 && op->count)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
+        else if (op->kt_ival2.tv64)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival2),
+                              HRTIMER_MODE_ABS);
+}
 static void bcm_tx_timeout_tsklet(unsigned long data)
 {
        struct bcm_op *op = (struct bcm_op *)data;
@@ -365,26 +377,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
                        bcm_send_to_user(op, &msg_head, NULL, 0);
                }
-        }
-        if (op->kt_ival1.tv64 && (op->count > 0)) {
-                /* send (next) frame */
                bcm_can_tx(op);
-                hrtimer_start(&op->timer,
-                              ktime_add(ktime_get(), op->kt_ival1),
-                              HRTIMER_MODE_ABS);
-        } else {
+        } else if (op->kt_ival2.tv64)
-                if (op->kt_ival2.tv64) {
+                bcm_can_tx(op);
-                        /* send (next) frame */
+        bcm_tx_start_timer(op);
-                        bcm_can_tx(op);
-                        hrtimer_start(&op->timer,
-                                      ktime_add(ktime_get(), op->kt_ival2),
-                                      HRTIMER_MODE_ABS);
-                }
-        }
 }
 /*
@@ -964,23 +962,20 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                        hrtimer_cancel(&op->timer);
        }
-        if ((op->flags & STARTTIMER) &&
+        if (op->flags & STARTTIMER) {
-            ((op->kt_ival1.tv64 && op->count) || op->kt_ival2.tv64)) {
+                hrtimer_cancel(&op->timer);
                /* spec: send can_frame when starting timer */
                op->flags |= TX_ANNOUNCE;
-                if (op->kt_ival1.tv64 && (op->count > 0)) {
-                        /* op->count-- is done in bcm_tx_timeout_handler */
-                        hrtimer_start(&op->timer, op->kt_ival1,
-                                      HRTIMER_MODE_REL);
-                } else
-                        hrtimer_start(&op->timer, op->kt_ival2,
-                                      HRTIMER_MODE_REL);
        }
-        if (op->flags & TX_ANNOUNCE)
+        if (op->flags & TX_ANNOUNCE) {
                bcm_can_tx(op);
+                if (op->count)
+                        op->count--;
+        }
+        if (op->flags & STARTTIMER)
+                bcm_tx_start_timer(op);
        return msg_head->nframes * CFSIZ + MHSIZ;
 }
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 132963abc266..2883ea01e680 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -232,6 +232,7 @@ void ceph_destroy_options(struct ceph_options *opt)
                ceph_crypto_key_destroy(opt->key);
                kfree(opt->key);
        }
+        kfree(opt->mon_addr);
        kfree(opt);
 }
 EXPORT_SYMBOL(ceph_destroy_options);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index c340e2e0765b..9918e9eb276e 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2307,6 +2307,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
        m->front_max = front_len;
        m->front_is_vmalloc = false;
        m->more_to_follow = false;
+        m->ack_stamp = 0;
        m->pool = NULL;
        /* middle */
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 16836a7df7a6..88ad8a2501b5 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -217,6 +217,7 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
        INIT_LIST_HEAD(&req->r_unsafe_item);
        INIT_LIST_HEAD(&req->r_linger_item);
        INIT_LIST_HEAD(&req->r_linger_osd);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
        req->r_flags = flags;
        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
@@ -816,13 +817,10 @@ static void __register_request(struct ceph_osd_client *osdc,
 {
        req->r_tid = ++osdc->last_tid;
        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
-        INIT_LIST_HEAD(&req->r_req_lru_item);
        dout("__register_request %p tid %lld\n", req, req->r_tid);
        __insert_request(osdc, req);
        ceph_osdc_get_request(req);
        osdc->num_requests++;
        if (osdc->num_requests == 1) {
                dout(" first request, scheduling timeout\n");
                __schedule_osd_timeout(osdc);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e97c3588c3ec..fd863fe76934 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -339,6 +339,7 @@ static int __insert_pg_mapping(struct ceph_pg_mapping *new,
        struct ceph_pg_mapping *pg = NULL;
        int c;
+        dout("__insert_pg_mapping %llx %p\n", *(u64 *)&new->pgid, new);
        while (*p) {
                parent = *p;
                pg = rb_entry(parent, struct ceph_pg_mapping, node);
@@ -366,16 +367,33 @@ static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
        while (n) {
                pg = rb_entry(n, struct ceph_pg_mapping, node);
                c = pgid_cmp(pgid, pg->pgid);
-                if (c < 0)
+                if (c < 0) {
                        n = n->rb_left;
-                else if (c > 0)
+                } else if (c > 0) {
                        n = n->rb_right;
-                else
+                } else {
+                        dout("__lookup_pg_mapping %llx got %p\n",
+                             *(u64 *)&pgid, pg);
                        return pg;
+                }
        }
        return NULL;
 }
+static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
+{
+        struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
+        if (pg) {
+                dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
+                rb_erase(&pg->node, root);
+                kfree(pg);
+                return 0;
+        }
+        dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
+        return -ENOENT;
+}
 /*
 * rbtree of pg pool info
 */
@@ -711,7 +729,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        void *start = *p;
        int err = -EINVAL;
        u16 version;
-        struct rb_node *rbp;
        ceph_decode_16_safe(p, end, version, bad);
        if (version > CEPH_OSDMAP_INC_VERSION) {
@@ -861,7 +878,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        }
        /* new_pg_temp */
-        rbp = rb_first(&map->pg_temp);
        ceph_decode_32_safe(p, end, len, bad);
        while (len--) {
                struct ceph_pg_mapping *pg;
@@ -872,18 +888,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                ceph_decode_copy(p, &pgid, sizeof(pgid));
                pglen = ceph_decode_32(p);
-                /* remove any? */
-                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
-                                                node)->pgid, pgid) <= 0) {
-                        struct ceph_pg_mapping *cur =
-                                rb_entry(rbp, struct ceph_pg_mapping, node);
-                        rbp = rb_next(rbp);
-                        dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                        rb_erase(&cur->node, &map->pg_temp);
-                        kfree(cur);
-                }
                if (pglen) {
                        /* insert */
                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
@@ -903,17 +907,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                        }
                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
                             pglen);
+                } else {
+                        /* remove */
+                        __remove_pg_mapping(&map->pg_temp, pgid);
                }
        }
-        while (rbp) {
-                struct ceph_pg_mapping *cur =
-                        rb_entry(rbp, struct ceph_pg_mapping, node);
-                rbp = rb_next(rbp);
-                dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                rb_erase(&cur->node, &map->pg_temp);
-                kfree(cur);
-        }
        /* ignore the rest */
        *p = end;
@@ -1046,10 +1044,25 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        struct ceph_pg_mapping *pg;
        struct ceph_pg_pool_info *pool;
        int ruleno;
-        unsigned poolid, ps, pps;
+        unsigned poolid, ps, pps, t;
        int preferred;
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
        /* pg_temp? */
+        if (preferred >= 0)
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.lpg_num),
+                                    pool->lpgp_num_mask);
+        else
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
+                                    pool->pgp_num_mask);
+        pgid.ps = cpu_to_le16(t);
        pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
        if (pg) {
                *num = pg->len;
@@ -1057,18 +1070,6 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        }
        /* crush */
-        poolid = le32_to_cpu(pgid.pool);
-        ps = le16_to_cpu(pgid.ps);
-        preferred = (s16)le16_to_cpu(pgid.preferred);
-        /* don't forcefeed bad device ids to crush */
-        if (preferred >= osdmap->max_osd ||
-            preferred >= osdmap->crush->max_devices)
-                preferred = -1;
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
-        if (!pool)
-                return NULL;
        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
                                 pool->v.type, pool->v.size);
        if (ruleno < 0) {
@@ -1078,6 +1079,11 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
                return NULL;
        }
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
        if (preferred >= 0)
                pps = ceph_stable_mod(ps,
                                      le32_to_cpu(pool->v.lpgp_num),
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 3231b468bb72..27071ee2a4e1 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -475,8 +475,11 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                list_del_rcu(&rule->list);
-                if (rule->action == FR_ACT_GOTO)
+                if (rule->action == FR_ACT_GOTO) {
                        ops->nr_goto_rules--;
+                        if (rtnl_dereference(rule->ctarget) == NULL)
+                                ops->unresolved_rules--;
+                }
                /*
                 * Check if this rule is a target to any of them. If so,
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 21fab3edb92c..d73aab3fbfc0 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1389,9 +1389,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
        BUG_ON(!pcount);
-        /* Tweak before seqno plays */
+        if (skb == tp->lost_skb_hint)
-        if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
-            !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
                tp->lost_cnt_hint += pcount;
        TCP_SKB_CB(prev)->end_seq += shifted;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c34f01513945..7963e03f1068 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -927,18 +927,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                        }
                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                        kfree(newkey);
                        return -ENOMEM;
                }
-                md5sig = tp->md5sig_info;
                if (md5sig->alloced4 == md5sig->entries4) {
                        keys = kmalloc((sizeof(*keys) *
                                        (md5sig->entries4 + 1)), GFP_ATOMIC);
                        if (!keys) {
                                kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                return -ENOMEM;
                        }
@@ -982,6 +985,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                kfree(tp->md5sig_info->keys4);
                                tp->md5sig_info->keys4 = NULL;
                                tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                        } else if (tp->md5sig_info->entries4 != i) {
                                /* Need to do some manipulation */
                                memmove(&tp->md5sig_info->keys4[i],
@@ -989,7 +993,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                        (tp->md5sig_info->entries4 - i) *
                                         sizeof(struct tcp4_md5sig_key));
                        }
-                        tcp_free_md5sig_pool();
                        return 0;
                }
        }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d2fe4e06b472..0ce3d06dce60 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -328,6 +328,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
                struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
                const int rto = (icsk->icsk_rto << 2) - (icsk->icsk_rto >> 1);
+                tw->tw_transparent      = inet_sk(sk)->transparent;
                tw->tw_rcv_wscale       = tp->rx_opt.rcv_wscale;
                tcptw->tw_rcv_nxt       = tp->rcv_nxt;
                tcptw->tw_snd_nxt       = tp->snd_nxt;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3b5669a2582d..d27c797f9f05 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -875,6 +875,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
                skb_reset_transport_header(skb);
                __skb_push(skb, skb_gro_offset(skb));
+                ops = rcu_dereference(inet6_protos[proto]);
                if (!ops || !ops->gro_receive)
                        goto out_unlock;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 705c82886281..def0538e2413 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        dev->stats.tx_bytes += skb->len;
@@ -2052,8 +2054,10 @@ int ip6_mr_input(struct sk_buff *skb)
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1250f9020670..fb545edef6ea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -244,7 +244,9 @@ static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
 {
        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
-        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
        return rt;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3c9fa618b69d..7b8fc5794352 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -591,7 +591,8 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                        }
                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                if (tp->md5sig_info->entries6 == 0 &&
+                        tcp_alloc_md5sig_pool(sk) == NULL) {
                        kfree(newkey);
                        return -ENOMEM;
                }
@@ -600,8 +601,9 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                                       (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
                        if (!keys) {
-                                tcp_free_md5sig_pool();
                                kfree(newkey);
+                                if (tp->md5sig_info->entries6 == 0)
+                                        tcp_free_md5sig_pool();
                                return -ENOMEM;
                        }
@@ -647,6 +649,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                kfree(tp->md5sig_info->keys6);
                                tp->md5sig_info->keys6 = NULL;
                                tp->md5sig_info->alloced6 = 0;
+                                tcp_free_md5sig_pool();
                        } else {
                                /* shrink the database */
                                if (tp->md5sig_info->entries6 != i)
@@ -655,7 +658,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                                (tp->md5sig_info->entries6 - i)
                                                * sizeof (tp->md5sig_info->keys6[0]));
                        }
-                        tcp_free_md5sig_pool();
                        return 0;
                }
        }
@@ -1383,6 +1385,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                newnp->pktoptions  = NULL;
                newnp->opt         = NULL;
                newnp->mcast_oif   = inet6_iif(skb);
@@ -1447,6 +1451,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
           First: no IPv4 options.
         */
        newinet->inet_opt = NULL;
+        newnp->ipv6_ac_list = NULL;
        newnp->ipv6_fl_list = NULL;
        /* Clone RX bits */
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ad4ac2601a56..34b2ddeacb67 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1045,8 +1045,10 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
        headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                uhlen + hdr_len;
        old_headroom = skb_headroom(skb);
-        if (skb_cow_head(skb, headroom))
+        if (skb_cow_head(skb, headroom)) {
+                dev_kfree_skb(skb);
                goto abort;
+        }
        new_headroom = skb_headroom(skb);
        skb_orphan(skb);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 2b771dc708a3..e3be48bf4dcd 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2283,6 +2283,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
        struct ip_vs_service *svc;
        struct ip_vs_dest_user *udest_compat;
        struct ip_vs_dest_user_kern udest;
+        struct netns_ipvs *ipvs = net_ipvs(net);
        if (!capable(CAP_NET_ADMIN))
                return -EPERM;
@@ -2303,6 +2304,24 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
        /* increase the module use count */
        ip_vs_use_count_inc();
+        /* Handle daemons since they have another lock */
+        if (cmd == IP_VS_SO_SET_STARTDAEMON ||
+            cmd == IP_VS_SO_SET_STOPDAEMON) {
+                struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
+                if (mutex_lock_interruptible(&ipvs->sync_mutex)) {
+                        ret = -ERESTARTSYS;
+                        goto out_dec;
+                }
+                if (cmd == IP_VS_SO_SET_STARTDAEMON)
+                        ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
+                                                dm->syncid);
+                else
+                        ret = stop_sync_thread(net, dm->state);
+                mutex_unlock(&ipvs->sync_mutex);
+                goto out_dec;
+        }
        if (mutex_lock_interruptible(&__ip_vs_mutex)) {
                ret = -ERESTARTSYS;
                goto out_dec;
@@ -2316,15 +2335,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                /* Set timeout values for (tcp tcpfin udp) */
                ret = ip_vs_set_timeout(net, (struct ip_vs_timeout_user *)arg);
                goto out_unlock;
-        } else if (cmd == IP_VS_SO_SET_STARTDAEMON) {
-                struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
-                ret = start_sync_thread(net, dm->state, dm->mcast_ifn,
-                                        dm->syncid);
-                goto out_unlock;
-        } else if (cmd == IP_VS_SO_SET_STOPDAEMON) {
-                struct ip_vs_daemon_user *dm = (struct ip_vs_daemon_user *)arg;
-                ret = stop_sync_thread(net, dm->state);
-                goto out_unlock;
        }
        usvc_compat = (struct ip_vs_service_user *)arg;
@@ -2584,6 +2594,33 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        if (copy_from_user(arg, user, copylen) != 0)
                return -EFAULT;
+        /*
+         * Handle daemons first since it has its own locking
+         */
+        if (cmd == IP_VS_SO_GET_DAEMON) {
+                struct ip_vs_daemon_user d[2];
+                memset(&d, 0, sizeof(d));
+                if (mutex_lock_interruptible(&ipvs->sync_mutex))
+                        return -ERESTARTSYS;
+                if (ipvs->sync_state & IP_VS_STATE_MASTER) {
+                        d[0].state = IP_VS_STATE_MASTER;
+                        strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
+                                sizeof(d[0].mcast_ifn));
+                        d[0].syncid = ipvs->master_syncid;
+                }
+                if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
+                        d[1].state = IP_VS_STATE_BACKUP;
+                        strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
+                                sizeof(d[1].mcast_ifn));
+                        d[1].syncid = ipvs->backup_syncid;
+                }
+                if (copy_to_user(user, &d, sizeof(d)) != 0)
+                        ret = -EFAULT;
+                mutex_unlock(&ipvs->sync_mutex);
+                return ret;
+        }
        if (mutex_lock_interruptible(&__ip_vs_mutex))
                return -ERESTARTSYS;
@@ -2681,28 +2718,6 @@ do_ip_vs_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        }
        break;
-        case IP_VS_SO_GET_DAEMON:
-        {
-                struct ip_vs_daemon_user d[2];
-                memset(&d, 0, sizeof(d));
-                if (ipvs->sync_state & IP_VS_STATE_MASTER) {
-                        d[0].state = IP_VS_STATE_MASTER;
-                        strlcpy(d[0].mcast_ifn, ipvs->master_mcast_ifn,
-                                sizeof(d[0].mcast_ifn));
-                        d[0].syncid = ipvs->master_syncid;
-                }
-                if (ipvs->sync_state & IP_VS_STATE_BACKUP) {
-                        d[1].state = IP_VS_STATE_BACKUP;
-                        strlcpy(d[1].mcast_ifn, ipvs->backup_mcast_ifn,
-                                sizeof(d[1].mcast_ifn));
-                        d[1].syncid = ipvs->backup_syncid;
-                }
-                if (copy_to_user(user, &d, sizeof(d)) != 0)
-                        ret = -EFAULT;
-        }
-        break;
        default:
                ret = -EINVAL;
        }
@@ -3205,7 +3220,7 @@ static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
        struct net *net = skb_sknet(skb);
        struct netns_ipvs *ipvs = net_ipvs(net);
-        mutex_lock(&__ip_vs_mutex);
+        mutex_lock(&ipvs->sync_mutex);
        if ((ipvs->sync_state & IP_VS_STATE_MASTER) && !cb->args[0]) {
                if (ip_vs_genl_dump_daemon(skb, IP_VS_STATE_MASTER,
                                           ipvs->master_mcast_ifn,
@@ -3225,7 +3240,7 @@ static int ip_vs_genl_dump_daemons(struct sk_buff *skb,
        }
 nla_put_failure:
-        mutex_unlock(&__ip_vs_mutex);
+        mutex_unlock(&ipvs->sync_mutex);
        return skb->len;
 }
@@ -3271,13 +3286,9 @@ static int ip_vs_genl_set_config(struct net *net, struct nlattr **attrs)
        return ip_vs_set_timeout(net, &t);
 }
-static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
+static int ip_vs_genl_set_daemon(struct sk_buff *skb, struct genl_info *info)
 {
-        struct ip_vs_service *svc = NULL;
-        struct ip_vs_service_user_kern usvc;
-        struct ip_vs_dest_user_kern udest;
        int ret = 0, cmd;
-        int need_full_svc = 0, need_full_dest = 0;
        struct net *net;
        struct netns_ipvs *ipvs;
@@ -3285,19 +3296,10 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
        ipvs = net_ipvs(net);
        cmd = info->genlhdr->cmd;
-        mutex_lock(&__ip_vs_mutex);
+        if (cmd == IPVS_CMD_NEW_DAEMON || cmd == IPVS_CMD_DEL_DAEMON) {
-        if (cmd == IPVS_CMD_FLUSH) {
-                ret = ip_vs_flush(net);
-                goto out;
-        } else if (cmd == IPVS_CMD_SET_CONFIG) {
-                ret = ip_vs_genl_set_config(net, info->attrs);
-                goto out;
-        } else if (cmd == IPVS_CMD_NEW_DAEMON ||
-                   cmd == IPVS_CMD_DEL_DAEMON) {
                struct nlattr *daemon_attrs[IPVS_DAEMON_ATTR_MAX + 1];
+                mutex_lock(&ipvs->sync_mutex);
                if (!info->attrs[IPVS_CMD_ATTR_DAEMON] ||
                    nla_parse_nested(daemon_attrs, IPVS_DAEMON_ATTR_MAX,
                                     info->attrs[IPVS_CMD_ATTR_DAEMON],
@@ -3310,6 +3312,33 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
                        ret = ip_vs_genl_new_daemon(net, daemon_attrs);
                else
                        ret = ip_vs_genl_del_daemon(net, daemon_attrs);
+out:
+                mutex_unlock(&ipvs->sync_mutex);
+        }
+        return ret;
+}
+static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
+{
+        struct ip_vs_service *svc = NULL;
+        struct ip_vs_service_user_kern usvc;
+        struct ip_vs_dest_user_kern udest;
+        int ret = 0, cmd;
+        int need_full_svc = 0, need_full_dest = 0;
+        struct net *net;
+        struct netns_ipvs *ipvs;
+        net = skb_sknet(skb);
+        ipvs = net_ipvs(net);
+        cmd = info->genlhdr->cmd;
+        mutex_lock(&__ip_vs_mutex);
+        if (cmd == IPVS_CMD_FLUSH) {
+                ret = ip_vs_flush(net);
+                goto out;
+        } else if (cmd == IPVS_CMD_SET_CONFIG) {
+                ret = ip_vs_genl_set_config(net, info->attrs);
                goto out;
        } else if (cmd == IPVS_CMD_ZERO &&
                   !info->attrs[IPVS_CMD_ATTR_SERVICE]) {
@@ -3536,13 +3565,13 @@ static struct genl_ops ip_vs_genl_ops[] __read_mostly = {
                .cmd    = IPVS_CMD_NEW_DAEMON,
                .flags  = GENL_ADMIN_PERM,
                .policy = ip_vs_cmd_policy,
-                .doit   = ip_vs_genl_set_cmd,
+                .doit   = ip_vs_genl_set_daemon,
        },
        {
                .cmd    = IPVS_CMD_DEL_DAEMON,
                .flags  = GENL_ADMIN_PERM,
                .policy = ip_vs_cmd_policy,
-                .doit   = ip_vs_genl_set_cmd,
+                .doit   = ip_vs_genl_set_daemon,
        },
        {
                .cmd    = IPVS_CMD_GET_DAEMON,
@@ -3679,7 +3708,7 @@ int __net_init ip_vs_control_net_init(struct net *net)
        int idx;
        struct netns_ipvs *ipvs = net_ipvs(net);
-        ipvs->rs_lock = __RW_LOCK_UNLOCKED(ipvs->rs_lock);
+        rwlock_init(&ipvs->rs_lock);
        /* Initialize rs_table */
        for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 7ee7215b8ba0..3cdd479f9b5d 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -61,6 +61,7 @@
 #define SYNC_PROTO_VER  1               /* Protocol version in header */
+static struct lock_class_key __ipvs_sync_key;
 /*
 *      IPVS sync connection entry
 *      Version 0, i.e. original version.
@@ -1545,6 +1546,7 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
        IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %Zd bytes\n",
                  sizeof(struct ip_vs_sync_conn_v0));
        if (state == IP_VS_STATE_MASTER) {
                if (ipvs->master_thread)
                        return -EEXIST;
@@ -1667,6 +1669,7 @@ int __net_init ip_vs_sync_net_init(struct net *net)
 {
        struct netns_ipvs *ipvs = net_ipvs(net);
+        __mutex_init(&ipvs->sync_mutex, "ipvs->sync_mutex", &__ipvs_sync_key);
        INIT_LIST_HEAD(&ipvs->sync_queue);
        spin_lock_init(&ipvs->sync_lock);
        spin_lock_init(&ipvs->sync_buff_lock);
@@ -1680,7 +1683,9 @@ int __net_init ip_vs_sync_net_init(struct net *net)
 void ip_vs_sync_net_cleanup(struct net *net)
 {
        int retc;
+        struct netns_ipvs *ipvs = net_ipvs(net);
+        mutex_lock(&ipvs->sync_mutex);
        retc = stop_sync_thread(net, IP_VS_STATE_MASTER);
        if (retc && retc != -ESRCH)
                pr_err("Failed to stop Master Daemon\n");
@@ -1688,4 +1693,5 @@ void ip_vs_sync_net_cleanup(struct net *net)
        retc = stop_sync_thread(net, IP_VS_STATE_BACKUP);
        if (retc && retc != -ESRCH)
                pr_err("Failed to stop Backup Daemon\n");
+        mutex_unlock(&ipvs->sync_mutex);
 }
diff --git a/net/netfilter/nf_conntrack_proto_gre.c b/net/netfilter/nf_conntrack_proto_gre.c
index cf616e55ca41..d69facdd9a7a 100644
--- a/net/netfilter/nf_conntrack_proto_gre.c
+++ b/net/netfilter/nf_conntrack_proto_gre.c
@@ -241,8 +241,8 @@ static int gre_packet(struct nf_conn *ct,
                nf_ct_refresh_acct(ct, ctinfo, skb,
                                   ct->proto.gre.stream_timeout);
                /* Also, more likely to be important, and not a probe. */
-                set_bit(IPS_ASSURED_BIT, &ct->status);
+                if (!test_and_set_bit(IPS_ASSURED_BIT, &ct->status))
-                nf_conntrack_event_cache(IPCT_ASSURED, ct);
+                        nf_conntrack_event_cache(IPCT_ASSURED, ct);
        } else
                nf_ct_refresh_acct(ct, ctinfo, skb,
                                   ct->proto.gre.timeout);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index c698cec0a445..fabb4fafa281 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -961,7 +961,10 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
        return 0;
 drop_n_acct:
-        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+        spin_lock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops++;
+        atomic_inc(&sk->sk_drops);
+        spin_unlock(&sk->sk_receive_queue.lock);
 drop_n_restore:
        if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 8b77edbab272..4e1de171866c 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -84,7 +84,8 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                        struct list_head *unmap_list,
-                        struct list_head *kill_list);
+                        struct list_head *kill_list,
+                        int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
@@ -499,7 +500,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
        LIST_HEAD(unmap_list);
        LIST_HEAD(kill_list);
        unsigned long flags;
-        unsigned int nfreed = 0, ncleaned = 0, free_goal;
+        unsigned int nfreed = 0, ncleaned = 0, unpinned = 0, free_goal;
        int ret = 0;
        rds_iw_stats_inc(s_iw_rdma_mr_pool_flush);
@@ -524,7 +525,8 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
         * will be destroyed by the unmap function.
         */
        if (!list_empty(&unmap_list)) {
-                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list, &kill_list);
+                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list,
+                                                     &kill_list, &unpinned);
                /* If we've been asked to destroy all MRs, move those
                 * that were simply cleaned to the kill list */
                if (free_all)
@@ -548,6 +550,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
                spin_unlock_irqrestore(&pool->list_lock, flags);
        }
+        atomic_sub(unpinned, &pool->free_pinned);
        atomic_sub(ncleaned, &pool->dirty_count);
        atomic_sub(nfreed, &pool->item_count);
@@ -828,7 +831,8 @@ static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool,
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                                struct list_head *unmap_list,
-                                struct list_head *kill_list)
+                                struct list_head *kill_list,
+                                int *unpinned)
 {
        struct rds_iw_mapping *mapping, *next;
        unsigned int ncleaned = 0;
@@ -855,6 +859,7 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                spin_lock_irqsave(&pool->list_lock, flags);
                list_for_each_entry_safe(mapping, next, unmap_list, m_list) {
+                        *unpinned += mapping->m_sg.len;
                        list_move(&mapping->m_list, &laundered);
                        ncleaned++;
                }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e83e7fee3bc0..ea40d540a990 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4113,9 +4113,12 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                if (len % sizeof(u32))
                        return -EINVAL;
+                if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+                        return -EINVAL;
                memcpy(settings->akm_suites, data, len);
-                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                for (i = 0; i < settings->n_akm_suites; i++)
                        if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
                                return -EINVAL;
        }
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index d30615419b4d..5f03e4ea65bf 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -91,7 +91,7 @@ int x25_parse_address_block(struct sk_buff *skb,
        int needed;
        int rc;
-        if (skb->len < 1) {
+        if (!pskb_may_pull(skb, 1)) {
                /* packet has no address block */
                rc = 0;
                goto empty;
@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb,
        len = *skb->data;
        needed = 1 + (len >> 4) + (len & 0x0f);
-        if (skb->len < needed) {
+        if (!pskb_may_pull(skb, needed)) {
                /* packet is too short to hold the addresses it claims
                   to hold */
                rc = -1;
@@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
                         * Found a listening socket, now check the incoming
                         * call user data vs this sockets call user data
                         */
-                        if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
+                        if (x25_sk(s)->cudmatchlength > 0 &&
+                                skb->len >= x25_sk(s)->cudmatchlength) {
                                if((memcmp(x25_sk(s)->calluserdata.cuddata,
                                        skb->data,
                                        x25_sk(s)->cudmatchlength)) == 0) {
@@ -951,14 +952,27 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         *
         *      Facilities length is mandatory in call request packets
         */
-        if (skb->len < 1)
+        if (!pskb_may_pull(skb, 1))
                goto out_clear_request;
        len = skb->data[0] + 1;
-        if (skb->len < len)
+        if (!pskb_may_pull(skb, len))
                goto out_clear_request;
        skb_pull(skb,len);
        /*
+         *      Ensure that the amount of call user data is valid.
+         */
+        if (skb->len > X25_MAX_CUD_LEN)
+                goto out_clear_request;
+        /*
+         *      Get all the call user data so it can be used in
+         *      x25_find_listener and skb_copy_from_linear_data up ahead.
+         */
+        if (!pskb_may_pull(skb, skb->len))
+                goto out_clear_request;
+        /*
         *      Find a listener for the particular address/cud pair.
         */
        sk = x25_find_listener(&source_addr,skb);
@@ -1166,6 +1180,9 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         *      byte of the user data is the logical value of the Q Bit.
         */
        if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
+                if (!pskb_may_pull(skb, 1))
+                        goto out_kfree_skb;
                qbit = skb->data[0];
                skb_pull(skb, 1);
        }
@@ -1244,7 +1261,9 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
        struct x25_sock *x25 = x25_sk(sk);
        struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)msg->msg_name;
        size_t copied;
-        int qbit;
+        int qbit, header_len = x25->neighbour->extended ?
+                X25_EXT_MIN_LEN : X25_STD_MIN_LEN;
        struct sk_buff *skb;
        unsigned char *asmptr;
        int rc = -ENOTCONN;
@@ -1265,6 +1284,9 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
                skb = skb_dequeue(&x25->interrupt_in_queue);
+                if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
+                        goto out_free_dgram;
                skb_pull(skb, X25_STD_MIN_LEN);
                /*
@@ -1285,10 +1307,12 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
                if (!skb)
                        goto out;
+                if (!pskb_may_pull(skb, header_len))
+                        goto out_free_dgram;
                qbit = (skb->data[0] & X25_Q_BIT) == X25_Q_BIT;
-                skb_pull(skb, x25->neighbour->extended ?
+                skb_pull(skb, header_len);
-                                X25_EXT_MIN_LEN : X25_STD_MIN_LEN);
                if (test_bit(X25_Q_BIT_FLAG, &x25->flags)) {
                        asmptr  = skb_push(skb, 1);
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index e547ca1578c3..fa2b41888bd9 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -32,6 +32,9 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
        unsigned short frametype;
        unsigned int lci;
+        if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
+                return 0;
        frametype = skb->data[2];
        lci = ((skb->data[0] << 8) & 0xF00) + ((skb->data[1] << 0) & 0x0FF);
@@ -115,6 +118,9 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
                goto drop;
        }
+        if (!pskb_may_pull(skb, 1))
+                return 0;
        switch (skb->data[0]) {
        case X25_IFACE_DATA:
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index f77e4e75f914..36384a1fa9f2 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -44,7 +44,7 @@
 int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
 {
-        unsigned char *p = skb->data;
+        unsigned char *p;
        unsigned int len;
        *vc_fac_mask = 0;
@@ -60,14 +60,16 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
        memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
        memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
-        if (skb->len < 1)
+        if (!pskb_may_pull(skb, 1))
                return 0;
-        len = *p++;
+        len = skb->data[0];
-        if (len >= skb->len)
+        if (!pskb_may_pull(skb, 1 + len))
                return -1;
+        p = skb->data + 1;
        while (len > 0) {
                switch (*p & X25_FAC_CLASS_MASK) {
                case X25_FAC_CLASS_A:
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 0b073b51b183..a49cd4ec551a 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -107,6 +107,8 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                /*
                 *      Parse the data in the frame.
                 */
+                if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
+                        goto out_clear;
                skb_pull(skb, X25_STD_MIN_LEN);
                len = x25_parse_address_block(skb, &source_addr,
@@ -127,9 +129,11 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                 *      Copy any Call User Data.
                 */
                if (skb->len > 0) {
-                        skb_copy_from_linear_data(skb,
+                        if (skb->len > X25_MAX_CUD_LEN)
-                                                  x25->calluserdata.cuddata,
+                                goto out_clear;
-                                                  skb->len);
+                        skb_copy_bits(skb, 0, x25->calluserdata.cuddata,
+                                skb->len);
                        x25->calluserdata.cudlength = skb->len;
                }
                if (!sock_flag(sk, SOCK_DEAD))
@@ -137,6 +141,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                break;
        }
        case X25_CLEAR_REQUEST:
+                if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
+                        goto out_clear;
                x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
                x25_disconnect(sk, ECONNREFUSED, skb->data[3], skb->data[4]);
                break;
@@ -164,6 +171,9 @@ static int x25_state2_machine(struct sock *sk, struct sk_buff *skb, int frametyp
        switch (frametype) {
                case X25_CLEAR_REQUEST:
+                        if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
+                                goto out_clear;
                        x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
                        x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
                        break;
@@ -177,6 +187,11 @@ static int x25_state2_machine(struct sock *sk, struct sk_buff *skb, int frametyp
        }
        return 0;
+out_clear:
+        x25_write_internal(sk, X25_CLEAR_REQUEST);
+        x25_start_t23timer(sk);
+        return 0;
 }
 /*
@@ -206,6 +221,9 @@ static int x25_state3_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                        break;
                case X25_CLEAR_REQUEST:
+                        if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
+                                goto out_clear;
                        x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
                        x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
                        break;
@@ -304,6 +322,12 @@ static int x25_state3_machine(struct sock *sk, struct sk_buff *skb, int frametyp
        }
        return queued;
+out_clear:
+        x25_write_internal(sk, X25_CLEAR_REQUEST);
+        x25->state = X25_STATE_2;
+        x25_start_t23timer(sk);
+        return 0;
 }
 /*
@@ -313,13 +337,13 @@ static int x25_state3_machine(struct sock *sk, struct sk_buff *skb, int frametyp
 */
 static int x25_state4_machine(struct sock *sk, struct sk_buff *skb, int frametype)
 {
+        struct x25_sock *x25 = x25_sk(sk);
        switch (frametype) {
                case X25_RESET_REQUEST:
                        x25_write_internal(sk, X25_RESET_CONFIRMATION);
                case X25_RESET_CONFIRMATION: {
-                        struct x25_sock *x25 = x25_sk(sk);
                        x25_stop_timer(sk);
                        x25->condition = 0x00;
                        x25->va        = 0;
@@ -331,6 +355,9 @@ static int x25_state4_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                        break;
                }
                case X25_CLEAR_REQUEST:
+                        if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 2))
+                                goto out_clear;
                        x25_write_internal(sk, X25_CLEAR_CONFIRMATION);
                        x25_disconnect(sk, 0, skb->data[3], skb->data[4]);
                        break;
@@ -340,6 +367,12 @@ static int x25_state4_machine(struct sock *sk, struct sk_buff *skb, int frametyp
        }
        return 0;
+out_clear:
+        x25_write_internal(sk, X25_CLEAR_REQUEST);
+        x25->state = X25_STATE_2;
+        x25_start_t23timer(sk);
+        return 0;
 }
 /* Higher level upcall for a LAPB frame */
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 037958ff8eed..4acacf3c6617 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -90,6 +90,9 @@ void x25_link_control(struct sk_buff *skb, struct x25_neigh *nb,
                break;
        case X25_DIAGNOSTIC:
+                if (!pskb_may_pull(skb, X25_STD_MIN_LEN + 4))
+                        break;
                printk(KERN_WARNING "x25: diagnostic #%d - %02X %02X %02X\n",
                       skb->data[3], skb->data[4],
                       skb->data[5], skb->data[6]);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 24a342ebc7f5..5170d52bfd96 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -269,7 +269,11 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
               int *d, int *m)
 {
        struct x25_sock *x25 = x25_sk(sk);
-        unsigned char *frame = skb->data;
+        unsigned char *frame;
+        if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
+                return X25_ILLEGAL;
+        frame = skb->data;
        *ns = *nr = *q = *d = *m = 0;
@@ -294,6 +298,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
                if (frame[2] == X25_RR  ||
                    frame[2] == X25_RNR ||
                    frame[2] == X25_REJ) {
+                        if (!pskb_may_pull(skb, X25_EXT_MIN_LEN))
+                                return X25_ILLEGAL;
+                        frame = skb->data;
                        *nr = (frame[3] >> 1) & 0x7F;
                        return frame[2];
                }
@@ -308,6 +316,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
        if (x25->neighbour->extended) {
                if ((frame[2] & 0x01) == X25_DATA) {
+                        if (!pskb_may_pull(skb, X25_EXT_MIN_LEN))
+                                return X25_ILLEGAL;
+                        frame = skb->data;
                        *q  = (frame[0] & X25_Q_BIT) == X25_Q_BIT;
                        *d  = (frame[0] & X25_D_BIT) == X25_D_BIT;
                        *m  = (frame[3] & X25_EXT_M_BIT) == X25_EXT_M_BIT;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 94fdcc7f1030..552df27dcf53 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1349,14 +1349,16 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
                BUG();
        }
        xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
-        memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
-        xfrm_policy_put_afinfo(afinfo);
-        if (likely(xdst))
+        if (likely(xdst)) {
+                memset(&xdst->u.rt6.rt6i_table, 0,
+                        sizeof(*xdst) - sizeof(struct dst_entry));
                xdst->flo.ops = &xfrm_bundle_fc_ops;
-        else
+        } else
                xdst = ERR_PTR(-ENOBUFS);
+        xfrm_policy_put_afinfo(afinfo);
        return xdst;
 }
diff --git a/security/security.c b/security/security.c
index 0e4fccfef12c..d9e153390926 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1097,6 +1097,7 @@ void security_sk_clone(const struct sock *sk, struct sock *newsk)
 {
        security_ops->sk_clone_security(sk, newsk);
 }
+EXPORT_SYMBOL(security_sk_clone);
 void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
 {
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index f9123f09e83e..32b02d906703 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -68,6 +68,7 @@ MODULE_PARM_DESC(enable, "Enable FM801 soundcard.");
 module_param_array(tea575x_tuner, int, NULL, 0444);
 MODULE_PARM_DESC(tea575x_tuner, "TEA575x tuner access method (0 = auto, 1 = SF256-PCS, 2=SF256-PCP, 3=SF64-PCR, 8=disable, +16=tuner-only).");
+#define TUNER_DISABLED          (1<<3)
 #define TUNER_ONLY              (1<<4)
 #define TUNER_TYPE_MASK         (~TUNER_ONLY & 0xFFFF)
@@ -1150,7 +1151,8 @@ static int snd_fm801_free(struct fm801 *chip)
      __end_hw:
 #ifdef CONFIG_SND_FM801_TEA575X_BOOL
-        snd_tea575x_exit(&chip->tea);
+        if (!(chip->tea575x_tuner & TUNER_DISABLED))
+                snd_tea575x_exit(&chip->tea);
 #endif
        if (chip->irq >= 0)
                free_irq(chip->irq, chip);
@@ -1236,7 +1238,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
            (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
                if (snd_tea575x_init(&chip->tea)) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
                        return -ENODEV;
                }
        } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
@@ -1251,11 +1252,15 @@ static int __devinit snd_fm801_create(struct snd_card *card,
                }
                if (tea575x_tuner == 4) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
+                        chip->tea575x_tuner = TUNER_DISABLED;
-                        return -ENODEV;
                }
        }
-        strlcpy(chip->tea.card, snd_fm801_tea575x_gpios[(tea575x_tuner & TUNER_TYPE_MASK) - 1].name, sizeof(chip->tea.card));
+        if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
+                strlcpy(chip->tea.card,
+                        snd_fm801_tea575x_gpios[(tea575x_tuner &
+                                                 TUNER_TYPE_MASK) - 1].name,
+                        sizeof(chip->tea.card));
+        }
 #endif
        *rchip = chip;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index be6982289c0d..191284a1c0ae 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1924,7 +1924,8 @@ static unsigned int azx_via_get_position(struct azx *chip,
 }
 static unsigned int azx_get_position(struct azx *chip,
-                                     struct azx_dev *azx_dev)
+                                     struct azx_dev *azx_dev,
+                                     bool with_check)
 {
        unsigned int pos;
        int stream = azx_dev->substream->stream;
@@ -1940,7 +1941,7 @@ static unsigned int azx_get_position(struct azx *chip,
        default:
                /* use the position buffer */
                pos = le32_to_cpu(*azx_dev->posbuf);
-                if (chip->position_fix[stream] == POS_FIX_AUTO) {
+                if (with_check && chip->position_fix[stream] == POS_FIX_AUTO) {
                        if (!pos || pos == (u32)-1) {
                                printk(KERN_WARNING
                                       "hda-intel: Invalid position buffer, "
@@ -1964,7 +1965,7 @@ static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
        struct azx *chip = apcm->chip;
        struct azx_dev *azx_dev = get_azx_dev(substream);
        return bytes_to_frames(substream->runtime,
-                               azx_get_position(chip, azx_dev));
+                               azx_get_position(chip, azx_dev, false));
 }
 /*
@@ -1987,7 +1988,7 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
                return -1;      /* bogus (too early) interrupt */
        stream = azx_dev->substream->stream;
-        pos = azx_get_position(chip, azx_dev);
+        pos = azx_get_position(chip, azx_dev, true);
        if (WARN_ONCE(!azx_dev->period_bytes,
                      "hda-intel: zero azx_dev->period_bytes"))
@@ -2369,6 +2370,7 @@ static int azx_dev_free(struct snd_device *device)
 static struct snd_pci_quirk position_fix_list[] __devinitdata = {
        SND_PCI_QUIRK(0x1028, 0x01cc, "Dell D820", POS_FIX_LPIB),
        SND_PCI_QUIRK(0x1028, 0x01de, "Dell Precision 390", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1028, 0x02c6, "Dell Inspiron 1010", POS_FIX_LPIB),
        SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
        SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
        SND_PCI_QUIRK(0x1043, 0x81b3, "ASUS", POS_FIX_LPIB),
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 7696d05b9356..76752d8ea733 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3110,6 +3110,7 @@ static const struct snd_pci_quirk cxt5066_cfg_tbl[] = {
        SND_PCI_QUIRK(0x17aa, 0x21c5, "Thinkpad Edge 13", CXT5066_THINKPAD),
        SND_PCI_QUIRK(0x17aa, 0x21c6, "Thinkpad Edge 13", CXT5066_ASUS),
        SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo Thinkpad", CXT5066_THINKPAD),
+        SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520 & W520", CXT5066_AUTO),
        SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT5066_THINKPAD),
        SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT5066_THINKPAD),
        SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo U350", CXT5066_ASUS),
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0503c999e7d3..7a73621a8909 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -578,6 +578,10 @@ static void alc_line_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
+        /* check LO jack only when it's different from HP */
+        if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0])
+                return;
        spec->line_jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.line_out_pins),
                             spec->autocfg.line_out_pins);
@@ -1321,7 +1325,9 @@ do_sku:
         * 15   : 1 --> enable the function "Mute internal speaker
         *              when the external headphone out jack is plugged"
         */
-        if (!spec->autocfg.hp_pins[0]) {
+        if (!spec->autocfg.hp_pins[0] &&
+            !(spec->autocfg.line_out_pins[0] &&
+              spec->autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
                hda_nid_t nid;
                tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                if (tmp == 0)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 1b7c11432aa7..987e3cf71a0b 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -5630,6 +5630,7 @@ again:
        switch (codec->vendor_id) {
        case 0x111d76d1:
        case 0x111d76d9:
+        case 0x111d76df:
        case 0x111d76e5:
        case 0x111d7666:
        case 0x111d7667:
diff --git a/sound/soc/blackfin/bf5xx-ad73311.c b/sound/soc/blackfin/bf5xx-ad73311.c
index 732a247f2527..b94eb7ef7d16 100644
--- a/sound/soc/blackfin/bf5xx-ad73311.c
+++ b/sound/soc/blackfin/bf5xx-ad73311.c
@@ -128,7 +128,7 @@ static int snd_ad73311_configure(void)
        return 0;
 }
-static int bf5xx_probe(struct platform_device *pdev)
+static int bf5xx_probe(struct snd_soc_card *card)
 {
        int err;
        if (gpio_request(GPIO_SE, "AD73311_SE")) {
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index 84f4ad568556..9801cd7cfcb5 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -431,7 +431,8 @@ static int ssm2602_set_dai_fmt(struct snd_soc_dai *codec_dai,
 static int ssm2602_set_bias_level(struct snd_soc_codec *codec,
                                 enum snd_soc_bias_level level)
 {
-        u16 reg = snd_soc_read(codec, SSM2602_PWR) & 0xff7f;
+        u16 reg = snd_soc_read(codec, SSM2602_PWR);
+        reg &= ~(PWR_POWER_OFF | PWR_OSC_PDN);
        switch (level) {
        case SND_SOC_BIAS_ON:
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index ffa2ffe5ec11..aa091a0d8187 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -1454,8 +1454,8 @@ static int wm8753_probe(struct snd_soc_codec *codec)
        /* set the update bits */
        snd_soc_update_bits(codec, WM8753_LDAC, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_RDAC, 0x0100, 0x0100);
-        snd_soc_update_bits(codec, WM8753_LDAC, 0x0100, 0x0100);
+        snd_soc_update_bits(codec, WM8753_LADC, 0x0100, 0x0100);
-        snd_soc_update_bits(codec, WM8753_RDAC, 0x0100, 0x0100);
+        snd_soc_update_bits(codec, WM8753_RADC, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_LOUT1V, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_ROUT1V, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_LOUT2V, 0x0100, 0x0100);
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 1725550c293e..d2c315fa1b9b 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3479,31 +3479,6 @@ int wm8962_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack)
 }
 EXPORT_SYMBOL_GPL(wm8962_mic_detect);
-#ifdef CONFIG_PM
-static int wm8962_resume(struct snd_soc_codec *codec)
-{
-        u16 *reg_cache = codec->reg_cache;
-        int i;
-        /* Restore the registers */
-        for (i = 1; i < codec->driver->reg_cache_size; i++) {
-                switch (i) {
-                case WM8962_SOFTWARE_RESET:
-                        continue;
-                default:
-                        break;
-                }
-                if (reg_cache[i] != wm8962_reg[i])
-                        snd_soc_write(codec, i, reg_cache[i]);
-        }
-        return 0;
-}
-#else
-#define wm8962_resume NULL
-#endif
 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
 static int beep_rates[] = {
        500, 1000, 2000, 4000,
@@ -4015,7 +3990,6 @@ static int wm8962_remove(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
        .probe =        wm8962_probe,
        .remove =       wm8962_remove,
-        .resume =       wm8962_resume,
        .set_bias_level = wm8962_set_bias_level,
        .reg_cache_size = WM8962_MAX_REGISTER + 1,
        .reg_word_size = sizeof(u16),
diff --git a/sound/soc/omap/mcpdm.c b/sound/soc/omap/mcpdm.c
index 928f03707451..50e59194ad81 100644
--- a/sound/soc/omap/mcpdm.c
+++ b/sound/soc/omap/mcpdm.c
@@ -449,7 +449,7 @@ exit:
        return ret;
 }
-int __devexit omap_mcpdm_remove(struct platform_device *pdev)
+int omap_mcpdm_remove(struct platform_device *pdev)
 {
        struct omap_mcpdm *mcpdm_ptr = platform_get_drvdata(pdev);
diff --git a/sound/soc/omap/mcpdm.h b/sound/soc/omap/mcpdm.h
index df3e16fb51f3..20c20a8649fe 100644
--- a/sound/soc/omap/mcpdm.h
+++ b/sound/soc/omap/mcpdm.h
@@ -150,4 +150,4 @@ extern int omap_mcpdm_request(void);
 extern void omap_mcpdm_free(void);
 extern int omap_mcpdm_set_offset(int offset1, int offset2);
 int __devinit omap_mcpdm_probe(struct platform_device *pdev);
-int __devexit omap_mcpdm_remove(struct platform_device *pdev);
+int omap_mcpdm_remove(struct platform_device *pdev);
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index ebcc2d4d2b18..478d60778453 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -516,6 +516,12 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
        struct omap_mcbsp_reg_cfg *regs = &mcbsp_data->regs;
        int err = 0;
+        if (mcbsp_data->active)
+                if (freq == mcbsp_data->in_freq)
+                        return 0;
+                else
+                        return -EBUSY;
        /* The McBSP signal muxing functions are only available on McBSP1 */
        if (clk_id == OMAP_MCBSP_CLKR_SRC_CLKR ||
            clk_id == OMAP_MCBSP_CLKR_SRC_CLKX ||
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index b6445757fc54..2b8350b52232 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -196,20 +196,20 @@ static int zylonite_probe(struct snd_soc_card *card)
        if (clk_pout) {
                pout = clk_get(NULL, "CLK_POUT");
                if (IS_ERR(pout)) {
-                        dev_err(&pdev->dev, "Unable to obtain CLK_POUT: %ld\n",
+                        dev_err(card->dev, "Unable to obtain CLK_POUT: %ld\n",
                                PTR_ERR(pout));
                        return PTR_ERR(pout);
                }
                ret = clk_enable(pout);
                if (ret != 0) {
-                        dev_err(&pdev->dev, "Unable to enable CLK_POUT: %d\n",
+                        dev_err(card->dev, "Unable to enable CLK_POUT: %d\n",
                                ret);
                        clk_put(pout);
                        return ret;
                }
-                dev_dbg(&pdev->dev, "MCLK enabled at %luHz\n",
+                dev_dbg(card->dev, "MCLK enabled at %luHz\n",
                        clk_get_rate(pout));
        }
@@ -241,7 +241,7 @@ static int zylonite_resume_pre(struct snd_soc_card *card)
        if (clk_pout) {
                ret = clk_enable(pout);
                if (ret != 0)
-                        dev_err(&pdev->dev, "Unable to enable CLK_POUT: %d\n",
+                        dev_err(card->dev, "Unable to enable CLK_POUT: %d\n",
                                ret);
        }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d2ef014af215..ef69f5a02709 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -30,6 +30,7 @@
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
 #include <linux/platform_device.h>
+#include <linux/ctype.h>
 #include <linux/slab.h>
 #include <sound/ac97_codec.h>
 #include <sound/core.h>
@@ -1434,9 +1435,20 @@ static void snd_soc_instantiate_card(struct snd_soc_card *card)
                 "%s", card->name);
        snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
                 "%s", card->long_name ? card->long_name : card->name);
-        if (card->driver_name)
+        snprintf(card->snd_card->driver, sizeof(card->snd_card->driver),
-                strlcpy(card->snd_card->driver, card->driver_name,
+                 "%s", card->driver_name ? card->driver_name : card->name);
-                        sizeof(card->snd_card->driver));
+        for (i = 0; i < ARRAY_SIZE(card->snd_card->driver); i++) {
+                switch (card->snd_card->driver[i]) {
+                case '_':
+                case '-':
+                case '\0':
+                        break;
+                default:
+                        if (!isalnum(card->snd_card->driver[i]))
+                                card->snd_card->driver[i] = '_';
+                        break;
+                }
+        }
        if (card->late_probe) {
                ret = card->late_probe(card);
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 781d9e61adfb..d8f2bf401458 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -530,8 +530,11 @@ snd_usb_audio_probe(struct usb_device *dev,
        return chip;
 __error:
-        if (chip && !chip->num_interfaces)
+        if (chip) {
-                snd_card_free(chip->card);
+                if (!chip->num_interfaces)
+                        snd_card_free(chip->card);
+                chip->probing = 0;
+        }
        mutex_unlock(&register_mutex);
 __err_val:
        return NULL;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3b8f7b80376b..e9d5c271db69 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -30,6 +30,8 @@ endif
 # Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
 #
 # Define NO_DWARF if you do not want debug-info analysis feature at all.
+#
+# Define WERROR=0 to disable treating any warnings as errors.
 $(OUTPUT)PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
        @$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
@@ -63,6 +65,11 @@ ifeq ($(ARCH),x86_64)
        endif
 endif
+# Treat warnings as errors unless directed not to
+ifneq ($(WERROR),0)
+        CFLAGS_WERROR := -Werror
+endif
 #
 # Include saner warnings here, which can catch bugs:
 #
@@ -95,7 +102,7 @@ ifndef PERF_DEBUG
  CFLAGS_OPTIMIZE = -O6
 endif
-CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_WERROR) $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS = $(LDFLAGS)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 6b0519f885e4..f4c3fbee4bad 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -161,6 +161,7 @@ static void config_attr(struct perf_evsel *evsel, struct perf_evlist *evlist)
        struct perf_event_attr *attr = &evsel->attr;
        int track = !evsel->idx; /* only the first counter needs these */
+        attr->disabled          = 1;
        attr->inherit           = !no_inherit;
        attr->read_format       = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                  PERF_FORMAT_TOTAL_TIME_RUNNING |
@@ -671,6 +672,8 @@ static int __cmd_record(int argc, const char **argv)
                }
        }
+        perf_evlist__enable(evsel_list);
        /*
         * Let the child rip
         */
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 55f4c76f2821..efe696f936e2 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -561,7 +561,7 @@ static int test__basic_mmap(void)
                }
                err = perf_event__parse_sample(event, attr.sample_type, sample_size,
-                                               false, &sample);
+                                               false, &sample, false);
                if (err) {
                        pr_err("Can't parse sample, err = %d\n", err);
                        goto out_munmap;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index a43433f08300..d28013b7d61c 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -191,7 +191,8 @@ static void __zero_source_counters(struct sym_entry *syme)
        symbol__annotate_zero_histograms(sym);
 }
-static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+static void record_precise_ip(struct sym_entry *syme, struct map *map,
+                              int counter, u64 ip)
 {
        struct annotation *notes;
        struct symbol *sym;
@@ -205,8 +206,8 @@ static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
        if (pthread_mutex_trylock(&notes->lock))
                return;
-        ip = syme->map->map_ip(syme->map, ip);
+        ip = map->map_ip(map, ip);
-        symbol__inc_addr_samples(sym, syme->map, counter, ip);
+        symbol__inc_addr_samples(sym, map, counter, ip);
        pthread_mutex_unlock(&notes->lock);
 }
@@ -810,7 +811,7 @@ static void perf_event__process_sample(const union perf_event *event,
                evsel = perf_evlist__id2evsel(top.evlist, sample->id);
                assert(evsel != NULL);
                syme->count[evsel->idx]++;
-                record_precise_ip(syme, evsel->idx, ip);
+                record_precise_ip(syme, al.map, evsel->idx, ip);
                pthread_mutex_lock(&top.active_symbols_lock);
                if (list_empty(&syme->node) || !syme->node.next) {
                        static bool first = true;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 3c1b8a632101..437f8ca679a0 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -169,12 +169,17 @@ static int perf_event__synthesize_mmap_events(union perf_event *event,
                        continue;
                pbf += n + 3;
                if (*pbf == 'x') { /* vm_exec */
+                        char anonstr[] = "//anon\n";
                        char *execname = strchr(bf, '/');
                        /* Catch VDSO */
                        if (execname == NULL)
                                execname = strstr(bf, "[vdso]");
+                        /* Catch anonymous mmaps */
+                        if ((execname == NULL) && !strstr(bf, "["))
+                                execname = anonstr;
                        if (execname == NULL)
                                continue;
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 1d7f66488a88..357a85b85248 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -186,6 +186,6 @@ const char *perf_event__name(unsigned int id);
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *sample);
+                             struct perf_sample *sample, bool swapped);
 #endif /* __PERF_RECORD_H */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index c12bd476c6f7..72e9f4886b6d 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -113,6 +113,19 @@ void perf_evlist__disable(struct perf_evlist *evlist)
        }
 }
+void perf_evlist__enable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                }
+        }
+}
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
        int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index ce85ae9ae57a..f34915002745 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,7 @@ int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 void perf_evlist__disable(struct perf_evlist *evlist);
+void perf_evlist__enable(struct perf_evlist *evlist);
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                         struct cpu_map *cpus,
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index a03a36b7908a..e389815078d3 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -7,6 +7,8 @@
 * Released under the GPL v2. (and only v2, not any later version)
 */
+#include <byteswap.h>
+#include "asm/bug.h"
 #include "evsel.h"
 #include "evlist.h"
 #include "util.h"
@@ -342,10 +344,20 @@ static bool sample_overlap(const union perf_event *event,
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *data)
+                             struct perf_sample *data, bool swapped)
 {
        const u64 *array;
+        /*
+         * used for cross-endian analysis. See git commit 65014ab3
+         * for why this goofiness is needed.
+         */
+        union {
+                u64 val64;
+                u32 val32[2];
+        } u;
        data->cpu = data->pid = data->tid = -1;
        data->stream_id = data->id = data->time = -1ULL;
@@ -366,9 +378,16 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
-                data->pid = p[0];
+                if (swapped) {
-                data->tid = p[1];
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+                data->pid = u.val32[0];
+                data->tid = u.val32[1];
                array++;
        }
@@ -395,8 +414,15 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                data->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+                data->cpu = u.val32[0];
                array++;
        }
@@ -423,18 +449,27 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_RAW) {
-                u32 *p = (u32 *)array;
+                const u64 *pdata;
+                u.val64 = *array;
+                if (WARN_ONCE(swapped,
+                              "Endianness of raw data not corrected!\n")) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
                if (sample_overlap(event, array, sizeof(u32)))
                        return -EFAULT;
-                data->raw_size = *p;
+                data->raw_size = u.val32[0];
-                p++;
+                pdata = (void *) array + sizeof(u32);
-                if (sample_overlap(event, p, data->raw_size))
+                if (sample_overlap(event, pdata, data->raw_size))
                        return -EFAULT;
-                data->raw_data = p;
+                data->raw_data = (void *) pdata;
        }
        return 0;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 555fc3864b90..5d732621a462 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -659,7 +659,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
                        ret = -ENOENT;
        }
-        if (ret == 0)
+        if (ret >= 0)
                ret = convert_variable(&vr_die, pf);
        if (ret < 0)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index cbc8f215d4b7..7624324efad4 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -803,7 +803,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                first = list_entry(evlist->entries.next, struct perf_evsel, node);
                err = perf_event__parse_sample(event, first->attr.sample_type,
                                               perf_evsel__sample_size(first),
-                                               sample_id_all, &pevent->sample);
+                                               sample_id_all, &pevent->sample, false);
                if (err)
                        return PyErr_Format(PyExc_OSError,
                                            "perf: can't parse sample, err=%d", err);
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 170601e67d6b..974d0cbee5e9 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -162,7 +162,8 @@ static inline int perf_session__parse_sample(struct perf_session *session,
 {
        return perf_event__parse_sample(event, session->sample_type,
                                        session->sample_size,
-                                        session->sample_id_all, sample);
+                                        session->sample_id_all, sample,
+                                        session->header.needs_swap);
 }
 struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 401e220566fd..1ee8f1e40f18 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -151,11 +151,17 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 {
        u64 ip_l, ip_r;
+        if (!left->ms.sym && !right->ms.sym)
+                return right->level - left->level;
+        if (!left->ms.sym || !right->ms.sym)
+                return cmp_null(left->ms.sym, right->ms.sym);
        if (left->ms.sym == right->ms.sym)
                return 0;
-        ip_l = left->ms.sym ? left->ms.sym->start : left->ip;
+        ip_l = left->ms.sym->start;
-        ip_r = right->ms.sym ? right->ms.sym->start : right->ip;
+        ip_r = right->ms.sym->start;
        return (int64_t)(ip_r - ip_l);
 }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 469c0264ed29..40eeaf07725b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -74,16 +74,104 @@ static void dso__set_sorted_by_name(struct dso *dso, enum map_type type)
 bool symbol_type__is_a(char symbol_type, enum map_type map_type)
 {
+        symbol_type = toupper(symbol_type);
        switch (map_type) {
        case MAP__FUNCTION:
                return symbol_type == 'T' || symbol_type == 'W';
        case MAP__VARIABLE:
-                return symbol_type == 'D' || symbol_type == 'd';
+                return symbol_type == 'D';
        default:
                return false;
        }
 }
+static int prefix_underscores_count(const char *str)
+{
+        const char *tail = str;
+        while (*tail == '_')
+                tail++;
+        return tail - str;
+}
+#define SYMBOL_A 0
+#define SYMBOL_B 1
+static int choose_best_symbol(struct symbol *syma, struct symbol *symb)
+{
+        s64 a;
+        s64 b;
+        /* Prefer a symbol with non zero length */
+        a = syma->end - syma->start;
+        b = symb->end - symb->start;
+        if ((b == 0) && (a > 0))
+                return SYMBOL_A;
+        else if ((a == 0) && (b > 0))
+                return SYMBOL_B;
+        /* Prefer a non weak symbol over a weak one */
+        a = syma->binding == STB_WEAK;
+        b = symb->binding == STB_WEAK;
+        if (b && !a)
+                return SYMBOL_A;
+        if (a && !b)
+                return SYMBOL_B;
+        /* Prefer a global symbol over a non global one */
+        a = syma->binding == STB_GLOBAL;
+        b = symb->binding == STB_GLOBAL;
+        if (a && !b)
+                return SYMBOL_A;
+        if (b && !a)
+                return SYMBOL_B;
+        /* Prefer a symbol with less underscores */
+        a = prefix_underscores_count(syma->name);
+        b = prefix_underscores_count(symb->name);
+        if (b > a)
+                return SYMBOL_A;
+        else if (a > b)
+                return SYMBOL_B;
+        /* If all else fails, choose the symbol with the longest name */
+        if (strlen(syma->name) >= strlen(symb->name))
+                return SYMBOL_A;
+        else
+                return SYMBOL_B;
+}
+static void symbols__fixup_duplicate(struct rb_root *symbols)
+{
+        struct rb_node *nd;
+        struct symbol *curr, *next;
+        nd = rb_first(symbols);
+        while (nd) {
+                curr = rb_entry(nd, struct symbol, rb_node);
+again:
+                nd = rb_next(&curr->rb_node);
+                next = rb_entry(nd, struct symbol, rb_node);
+                if (!nd)
+                        break;
+                if (curr->start != next->start)
+                        continue;
+                if (choose_best_symbol(curr, next) == SYMBOL_A) {
+                        rb_erase(&next->rb_node, symbols);
+                        goto again;
+                } else {
+                        nd = rb_next(&curr->rb_node);
+                        rb_erase(&curr->rb_node, symbols);
+                }
+        }
+}
 static void symbols__fixup_end(struct rb_root *symbols)
 {
        struct rb_node *nd, *prevnd = rb_first(symbols);
@@ -438,18 +526,11 @@ int kallsyms__parse(const char *filename, void *arg,
        char *line = NULL;
        size_t n;
        int err = -1;
-        u64 prev_start = 0;
-        char prev_symbol_type = 0;
-        char *prev_symbol_name;
        FILE *file = fopen(filename, "r");
        if (file == NULL)
                goto out_failure;
-        prev_symbol_name = malloc(KSYM_NAME_LEN);
-        if (prev_symbol_name == NULL)
-                goto out_close;
        err = 0;
        while (!feof(file)) {
@@ -470,7 +551,7 @@ int kallsyms__parse(const char *filename, void *arg,
                if (len + 2 >= line_len)
                        continue;
-                symbol_type = toupper(line[len]);
+                symbol_type = line[len];
                len += 2;
                symbol_name = line + len;
                len = line_len - len;
@@ -480,24 +561,18 @@ int kallsyms__parse(const char *filename, void *arg,
                        break;
                }
-                if (prev_symbol_type) {
+                /*
-                        u64 end = start;
+                 * module symbols are not sorted so we add all
-                        if (end != prev_start)
+                 * symbols with zero length and rely on
-                                --end;
+                 * symbols__fixup_end() to fix it up.
-                        err = process_symbol(arg, prev_symbol_name,
+                 */
-                                             prev_symbol_type, prev_start, end);
+                err = process_symbol(arg, symbol_name,
-                        if (err)
+                                     symbol_type, start, start);
-                                break;
+                if (err)
-                }
+                        break;
-                memcpy(prev_symbol_name, symbol_name, len + 1);
-                prev_symbol_type = symbol_type;
-                prev_start = start;
        }
-        free(prev_symbol_name);
        free(line);
-out_close:
        fclose(file);
        return err;
@@ -703,6 +778,9 @@ int dso__load_kallsyms(struct dso *dso, const char *filename,
        if (dso__load_all_kallsyms(dso, filename, map) < 0)
                return -1;
+        symbols__fixup_duplicate(&dso->symbols[map->type]);
+        symbols__fixup_end(&dso->symbols[map->type]);
        if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
                dso->symtab_type = SYMTAB__GUEST_KALLSYMS;
        else
@@ -1092,8 +1170,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        if (dso->has_build_id) {
                u8 build_id[BUILD_ID_SIZE];
-                if (elf_read_build_id(elf, build_id,
+                if (elf_read_build_id(elf, build_id, BUILD_ID_SIZE) < 0)
-                                      BUILD_ID_SIZE) != BUILD_ID_SIZE)
                        goto out_elf_end;
                if (!dso__build_id_equal(dso, build_id))
@@ -1111,6 +1188,8 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        }
        opdsec = elf_section_by_name(elf, &ehdr, &opdshdr, ".opd", &opdidx);
+        if (opdshdr.sh_type != SHT_PROGBITS)
+                opdsec = NULL;
        if (opdsec)
                opddata = elf_rawdata(opdsec, NULL);
@@ -1276,6 +1355,7 @@ new_symbol:
         * For misannotated, zeroed, ASM function sizes.
         */
        if (nr > 0) {
+                symbols__fixup_duplicate(&dso->symbols[map->type]);
                symbols__fixup_end(&dso->symbols[map->type]);
                if (kmap) {
                        /*
@@ -1362,8 +1442,8 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
        ptr = data->d_buf;
        while (ptr < (data->d_buf + data->d_size)) {
                GElf_Nhdr *nhdr = ptr;
-                int namesz = NOTE_ALIGN(nhdr->n_namesz),
+                size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
-                    descsz = NOTE_ALIGN(nhdr->n_descsz);
+                       descsz = NOTE_ALIGN(nhdr->n_descsz);
                const char *name;
                ptr += sizeof(*nhdr);
@@ -1372,8 +1452,10 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
                if (nhdr->n_type == NT_GNU_BUILD_ID &&
                    nhdr->n_namesz == sizeof("GNU")) {
                        if (memcmp(name, "GNU", sizeof("GNU")) == 0) {
-                                memcpy(bf, ptr, BUILD_ID_SIZE);
+                                size_t sz = min(size, descsz);
-                                err = BUILD_ID_SIZE;
+                                memcpy(bf, ptr, sz);
+                                memset(bf + sz, 0, size - sz);
+                                err = descsz;
                                break;
                        }
                }
@@ -1425,7 +1507,7 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
        while (1) {
                char bf[BUFSIZ];
                GElf_Nhdr nhdr;
-                int namesz, descsz;
+                size_t namesz, descsz;
                if (read(fd, &nhdr, sizeof(nhdr)) != sizeof(nhdr))
                        break;
@@ -1434,15 +1516,16 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
                descsz = NOTE_ALIGN(nhdr.n_descsz);
                if (nhdr.n_type == NT_GNU_BUILD_ID &&
                    nhdr.n_namesz == sizeof("GNU")) {
-                        if (read(fd, bf, namesz) != namesz)
+                        if (read(fd, bf, namesz) != (ssize_t)namesz)
                                break;
                        if (memcmp(bf, "GNU", sizeof("GNU")) == 0) {
-                                if (read(fd, build_id,
+                                size_t sz = min(descsz, size);
-                                    BUILD_ID_SIZE) == BUILD_ID_SIZE) {
+                                if (read(fd, build_id, sz) == (ssize_t)sz) {
+                                        memset(build_id + sz, 0, size - sz);
                                        err = 0;
                                        break;
                                }
-                        } else if (read(fd, bf, descsz) != descsz)
+                        } else if (read(fd, bf, descsz) != (ssize_t)descsz)
                                break;
                } else {
                        int n = namesz + descsz;