190 files changed, 2300 insertions, 1067 deletions
diff --git a/Documentation/devicetree/bindings/spi/mxs-spi.txt b/Documentation/devicetree/bindings/spi/mxs-spi.txt
new file mode 100644
index 000000000000..e2e13957c2a4
--- /dev/null
+++ b/Documentation/devicetree/bindings/spi/mxs-spi.txt
@@ -0,0 +1,22 @@
+* Freescale MX233/MX28 SSP/SPI
+Required properties:
+- compatible: Should be "fsl,<soc>-spi", where soc is "imx23" or "imx28"
+- reg: Offset and length of the register set for the device
+- interrupts: Should contain SSP interrupts (error irq first, dma irq second)
+- fsl,ssp-dma-channel: APBX DMA channel for the SSP
+Optional properties:
+- clock-frequency : Input clock frequency to the SPI block in Hz.
+                    Default is 160000000 Hz.
+Example:
+ssp0: ssp@80010000 {
+        #address-cells = <1>;
+        #size-cells = <0>;
+        compatible = "fsl,imx28-spi";
+        reg = <0x80010000 0x2000>;
+        interrupts = <96 82>;
+        fsl,ssp-dma-channel = <0>;
+};
diff --git a/MAINTAINERS b/MAINTAINERS
index 53cc13c82cb1..b17587d9412f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3666,11 +3666,12 @@ F:	Documentation/networking/README.ipw2200
 F:      drivers/net/wireless/ipw2x00/
 INTEL(R) TRUSTED EXECUTION TECHNOLOGY (TXT)
-M:      Joseph Cihula <joseph.cihula@intel.com>
+M:      Richard L Maliszewski <richard.l.maliszewski@intel.com>
+M:      Gang Wei <gang.wei@intel.com>
 M:      Shane Wang <shane.wang@intel.com>
 L:      tboot-devel@lists.sourceforge.net
 W:      http://tboot.sourceforge.net
-T:      Mercurial http://www.bughost.org/repos.hg/tboot.hg
+T:      hg http://tboot.hg.sourceforge.net:8000/hgroot/tboot/tboot
 S:      Supported
 F:      Documentation/intel_txt.txt
 F:      include/linux/tboot.h
diff --git a/Makefile b/Makefile
index ae6928cc59d3..a3c11d589681 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 3
 PATCHLEVEL = 6
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
-NAME = Saber-toothed Squirrel
+NAME = Terrified Chipmunk
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 81769c1341fa..bc67cbff3944 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -653,6 +653,7 @@ __armv7_mmu_cache_on:
                mcrne   p15, 0, r0, c8, c7, 0   @ flush I,D TLBs
 #endif
                mrc     p15, 0, r0, c1, c0, 0   @ read control reg
+                bic     r0, r0, #1 << 28        @ clear SCTLR.TRE
                orr     r0, r0, #0x5000         @ I-cache enable, RR cache replacement
                orr     r0, r0, #0x003c         @ write buffer
 #ifdef CONFIG_MMU
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index 66389c1c6f62..7c95f76398de 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -104,6 +104,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioB: gpio@fffff600 {
@@ -113,6 +114,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioC: gpio@fffff800 {
@@ -122,6 +124,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        dbgu: serial@fffff200 {
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index b460d6ce9eb5..195019b7ca0e 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -95,6 +95,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioB: gpio@fffff400 {
@@ -104,6 +105,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioC: gpio@fffff600 {
@@ -113,6 +115,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioD: gpio@fffff800 {
@@ -122,6 +125,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioE: gpio@fffffa00 {
@@ -131,6 +135,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        dbgu: serial@ffffee00 {
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index bafa8806fc17..63751b1e744b 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -113,6 +113,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioB: gpio@fffff400 {
@@ -122,6 +123,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioC: gpio@fffff600 {
@@ -131,6 +133,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioD: gpio@fffff800 {
@@ -140,6 +143,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioE: gpio@fffffa00 {
@@ -149,6 +153,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        dbgu: serial@ffffee00 {
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index bfac0dfc332c..ef9336ae9614 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -107,6 +107,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioB: gpio@fffff600 {
@@ -116,6 +117,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioC: gpio@fffff800 {
@@ -125,6 +127,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioD: gpio@fffffa00 {
@@ -134,6 +137,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        dbgu: serial@fffff200 {
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 4a18c393b136..8a387a8d61b7 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -115,6 +115,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioB: gpio@fffff600 {
@@ -124,6 +125,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioC: gpio@fffff800 {
@@ -133,6 +135,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        pioD: gpio@fffffa00 {
@@ -142,6 +145,7 @@
                                #gpio-cells = <2>;
                                gpio-controller;
                                interrupt-controller;
+                                #interrupt-cells = <2>;
                        };
                        dbgu: serial@fffff200 {
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 0cab47d4a83f..2fde5fd1acce 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -404,6 +404,7 @@
 #define __NR_setns                      (__NR_SYSCALL_BASE+375)
 #define __NR_process_vm_readv           (__NR_SYSCALL_BASE+376)
 #define __NR_process_vm_writev          (__NR_SYSCALL_BASE+377)
+                                        /* 378 for kcmp */
 /*
 * The following SWIs are ARM private.
@@ -483,6 +484,7 @@
 */
 #define __IGNORE_fadvise64_64
 #define __IGNORE_migrate_pages
+#define __IGNORE_kcmp
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_UNISTD_H */
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index 463ff4a0ec8a..e337879595e5 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -387,6 +387,7 @@
 /* 375 */       CALL(sys_setns)
                CALL(sys_process_vm_readv)
                CALL(sys_process_vm_writev)
+                CALL(sys_ni_syscall)    /* reserved for sys_kcmp */
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index fef42b21cecb..e1f906989bb8 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -11,7 +11,6 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/clk.h>
-#include <linux/cpufreq.h>
 #include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/err.h>
@@ -96,7 +95,52 @@ static void twd_timer_stop(struct clock_event_device *clk)
        disable_percpu_irq(clk->irq);
 }
-#ifdef CONFIG_CPU_FREQ
+#ifdef CONFIG_COMMON_CLK
+/*
+ * Updates clockevent frequency when the cpu frequency changes.
+ * Called on the cpu that is changing frequency with interrupts disabled.
+ */
+static void twd_update_frequency(void *new_rate)
+{
+        twd_timer_rate = *((unsigned long *) new_rate);
+        clockevents_update_freq(*__this_cpu_ptr(twd_evt), twd_timer_rate);
+}
+static int twd_rate_change(struct notifier_block *nb,
+        unsigned long flags, void *data)
+{
+        struct clk_notifier_data *cnd = data;
+        /*
+         * The twd clock events must be reprogrammed to account for the new
+         * frequency.  The timer is local to a cpu, so cross-call to the
+         * changing cpu.
+         */
+        if (flags == POST_RATE_CHANGE)
+                smp_call_function(twd_update_frequency,
+                                  (void *)&cnd->new_rate, 1);
+        return NOTIFY_OK;
+}
+static struct notifier_block twd_clk_nb = {
+        .notifier_call = twd_rate_change,
+};
+static int twd_clk_init(void)
+{
+        if (twd_evt && *__this_cpu_ptr(twd_evt) && !IS_ERR(twd_clk))
+                return clk_notifier_register(twd_clk, &twd_clk_nb);
+        return 0;
+}
+core_initcall(twd_clk_init);
+#elif defined (CONFIG_CPU_FREQ)
+#include <linux/cpufreq.h>
 /*
 * Updates clockevent frequency when the cpu frequency changes.
diff --git a/arch/arm/mach-imx/clk-imx25.c b/arch/arm/mach-imx/clk-imx25.c
index 4431a62fff5b..d20d4795f4ea 100644
--- a/arch/arm/mach-imx/clk-imx25.c
+++ b/arch/arm/mach-imx/clk-imx25.c
@@ -241,6 +241,6 @@ int __init mx25_clocks_init(void)
        clk_register_clkdev(clk[sdma_ahb], "ahb", "imx35-sdma");
        clk_register_clkdev(clk[iim_ipg], "iim", NULL);
-        mxc_timer_init(MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
+        mxc_timer_init(MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), MX25_INT_GPT1);
        return 0;
 }
diff --git a/arch/arm/mach-imx/mach-armadillo5x0.c b/arch/arm/mach-imx/mach-armadillo5x0.c
index 2c6ab3273f9e..5985ed1b8c98 100644
--- a/arch/arm/mach-imx/mach-armadillo5x0.c
+++ b/arch/arm/mach-imx/mach-armadillo5x0.c
@@ -526,7 +526,8 @@ static void __init armadillo5x0_init(void)
        imx31_add_mxc_nand(&armadillo5x0_nand_board_info);
        /* set NAND page size to 2k if not configured via boot mode pins */
-        __raw_writel(__raw_readl(MXC_CCM_RCSR) | (1 << 30), MXC_CCM_RCSR);
+        __raw_writel(__raw_readl(mx3_ccm_base + MXC_CCM_RCSR) |
+                                        (1 << 30), mx3_ccm_base + MXC_CCM_RCSR);
        /* RTC */
        /* Get RTC IRQ and register the chip */
diff --git a/arch/arm/mach-shmobile/board-kzm9g.c b/arch/arm/mach-shmobile/board-kzm9g.c
index 53b7ea92c32c..3b8a0171c3cb 100644
--- a/arch/arm/mach-shmobile/board-kzm9g.c
+++ b/arch/arm/mach-shmobile/board-kzm9g.c
@@ -346,11 +346,11 @@ static struct resource sh_mmcif_resources[] = {
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = gic_spi(141),
+                .start  = gic_spi(140),
                .flags  = IORESOURCE_IRQ,
        },
        [2] = {
-                .start  = gic_spi(140),
+                .start  = gic_spi(141),
                .flags  = IORESOURCE_IRQ,
        },
 };
diff --git a/arch/arm/plat-mxc/include/mach/mx25.h b/arch/arm/plat-mxc/include/mach/mx25.h
index 627d94f1b010..ec466400a200 100644
--- a/arch/arm/plat-mxc/include/mach/mx25.h
+++ b/arch/arm/plat-mxc/include/mach/mx25.h
@@ -98,6 +98,7 @@
 #define MX25_INT_UART1          (NR_IRQS_LEGACY + 45)
 #define MX25_INT_GPIO2          (NR_IRQS_LEGACY + 51)
 #define MX25_INT_GPIO1          (NR_IRQS_LEGACY + 52)
+#define MX25_INT_GPT1           (NR_IRQS_LEGACY + 54)
 #define MX25_INT_FEC            (NR_IRQS_LEGACY + 57)
 #define MX25_DMA_REQ_SSI2_RX1   22
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 65c5eca475e7..d1116e2dfbea 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -144,6 +144,7 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
 int clk_set_rate(struct clk *clk, unsigned long rate)
 {
+        unsigned long flags;
        int ret;
        if (IS_ERR(clk))
@@ -159,9 +160,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
        if (clk->ops == NULL || clk->ops->set_rate == NULL)
                return -EINVAL;
-        spin_lock(&clocks_lock);
+        spin_lock_irqsave(&clocks_lock, flags);
        ret = (clk->ops->set_rate)(clk, rate);
-        spin_unlock(&clocks_lock);
+        spin_unlock_irqrestore(&clocks_lock, flags);
        return ret;
 }
@@ -173,17 +174,18 @@ struct clk *clk_get_parent(struct clk *clk)
 int clk_set_parent(struct clk *clk, struct clk *parent)
 {
+        unsigned long flags;
        int ret = 0;
        if (IS_ERR(clk))
                return -EINVAL;
-        spin_lock(&clocks_lock);
+        spin_lock_irqsave(&clocks_lock, flags);
        if (clk->ops && clk->ops->set_parent)
                ret = (clk->ops->set_parent)(clk, parent);
-        spin_unlock(&clocks_lock);
+        spin_unlock_irqrestore(&clocks_lock, flags);
        return ret;
 }
diff --git a/arch/m68k/platform/coldfire/clk.c b/arch/m68k/platform/coldfire/clk.c
index 75f9ee967ea7..9cd13b4ce42b 100644
--- a/arch/m68k/platform/coldfire/clk.c
+++ b/arch/m68k/platform/coldfire/clk.c
@@ -146,9 +146,3 @@ struct clk_ops clk_ops1 = {
 };
 #endif /* MCFPM_PPMCR1 */
 #endif /* MCFPM_PPMCR0 */
-struct clk *devm_clk_get(struct device *dev, const char *id)
-{
-        return NULL;
-}
-EXPORT_SYMBOL(devm_clk_get);
diff --git a/arch/mips/kernel/smp-cmp.c b/arch/mips/kernel/smp-cmp.c
index e7e03ecf5495..afc379ca3753 100644
--- a/arch/mips/kernel/smp-cmp.c
+++ b/arch/mips/kernel/smp-cmp.c
@@ -102,7 +102,7 @@ static void cmp_init_secondary(void)
        c->vpe_id = (read_c0_tcbind() >> TCBIND_CURVPE_SHIFT) & TCBIND_CURVPE;
 #endif
 #ifdef CONFIG_MIPS_MT_SMTC
-        c->tc_id  = (read_c0_tcbind() >> TCBIND_CURTC_SHIFT) & TCBIND_CURTC;
+        c->tc_id  = (read_c0_tcbind() & TCBIND_CURTC) >> TCBIND_CURTC_SHIFT;
 #endif
 }
diff --git a/arch/mips/mm/gup.c b/arch/mips/mm/gup.c
index 33aadbcf170b..dcfd573871c1 100644
--- a/arch/mips/mm/gup.c
+++ b/arch/mips/mm/gup.c
@@ -152,6 +152,8 @@ static int gup_huge_pud(pud_t pud, unsigned long addr, unsigned long end,
        do {
                VM_BUG_ON(compound_head(page) != head);
                pages[*nr] = page;
+                if (PageTail(page))
+                        get_huge_page_tail(page);
                (*nr)++;
                page++;
                refs++;
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 7b13a4caeea4..fea823f18479 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -273,16 +273,19 @@ asmlinkage void plat_irq_dispatch(void)
        unsigned int pending = read_c0_cause() & read_c0_status() & ST0_IM;
        int irq;
+        if (unlikely(!pending)) {
+                spurious_interrupt();
+                return;
+        }
        irq = irq_ffs(pending);
        if (irq == MIPSCPU_INT_I8259A)
                malta_hw0_irqdispatch();
        else if (gic_present && ((1 << irq) & ipi_map[smp_processor_id()]))
                malta_ipi_irqdispatch();
-        else if (irq >= 0)
-                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
        else
-                spurious_interrupt();
+                do_IRQ(MIPS_CPU_IRQ_BASE + irq);
 }
 #ifdef CONFIG_MIPS_MT_SMP
diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c
index 4c35301720e7..80562b81f0f2 100644
--- a/arch/mips/mti-malta/malta-platform.c
+++ b/arch/mips/mti-malta/malta-platform.c
@@ -138,11 +138,6 @@ static int __init malta_add_devices(void)
        if (err)
                return err;
-        /*
-         * Set RTC to BCD mode to support current alarm code.
-         */
-        CMOS_WRITE(CMOS_READ(RTC_CONTROL) & ~RTC_DM_BINARY, RTC_CONTROL);
        return 0;
 }
diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h
index 799ed0f1643d..2d6e6e380564 100644
--- a/arch/s390/include/asm/hugetlb.h
+++ b/arch/s390/include/asm/hugetlb.h
@@ -66,16 +66,6 @@ static inline pte_t huge_ptep_get(pte_t *ptep)
        return pte;
 }
-static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
-                                            unsigned long addr, pte_t *ptep)
-{
-        pte_t pte = huge_ptep_get(ptep);
-        mm->context.flush_mm = 1;
-        pmd_clear((pmd_t *) ptep);
-        return pte;
-}
 static inline void __pmd_csp(pmd_t *pmdp)
 {
        register unsigned long reg2 asm("2") = pmd_val(*pmdp);
@@ -117,6 +107,15 @@ static inline void huge_ptep_invalidate(struct mm_struct *mm,
                __pmd_csp(pmdp);
 }
+static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+                                            unsigned long addr, pte_t *ptep)
+{
+        pte_t pte = huge_ptep_get(ptep);
+        huge_ptep_invalidate(mm, addr, ptep);
+        return pte;
+}
 #define huge_ptep_set_access_flags(__vma, __addr, __ptep, __entry, __dirty) \
 ({                                                                          \
        int __changed = !pte_same(huge_ptep_get(__ptep), __entry);          \
@@ -131,10 +130,7 @@ static inline void huge_ptep_invalidate(struct mm_struct *mm,
 ({                                                                      \
        pte_t __pte = huge_ptep_get(__ptep);                            \
        if (pte_write(__pte)) {                                         \
-                (__mm)->context.flush_mm = 1;                           \
+                huge_ptep_invalidate(__mm, __addr, __ptep);             \
-                if (atomic_read(&(__mm)->context.attach_count) > 1 ||   \
-                    (__mm) != current->active_mm)                       \
-                        huge_ptep_invalidate(__mm, __addr, __ptep);     \
                set_huge_pte_at(__mm, __addr, __ptep,                   \
                                huge_pte_wrprotect(__pte));             \
        }                                                               \
diff --git a/arch/s390/include/asm/tlbflush.h b/arch/s390/include/asm/tlbflush.h
index 9fde315f3a7c..1d8fe2b17ef6 100644
--- a/arch/s390/include/asm/tlbflush.h
+++ b/arch/s390/include/asm/tlbflush.h
@@ -90,12 +90,10 @@ static inline void __tlb_flush_mm(struct mm_struct * mm)
 static inline void __tlb_flush_mm_cond(struct mm_struct * mm)
 {
-        spin_lock(&mm->page_table_lock);
        if (mm->context.flush_mm) {
                __tlb_flush_mm(mm);
                mm->context.flush_mm = 0;
        }
-        spin_unlock(&mm->page_table_lock);
 }
 /*
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index f86c81e13c37..40b57693de38 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -974,11 +974,13 @@ static void __init setup_hwcaps(void)
        if (MACHINE_HAS_HPAGE)
                elf_hwcap |= HWCAP_S390_HPAGE;
+#if defined(CONFIG_64BIT)
        /*
         * 64-bit register support for 31-bit processes
         * HWCAP_S390_HIGH_GPRS is bit 9.
         */
        elf_hwcap |= HWCAP_S390_HIGH_GPRS;
+#endif
        get_cpu_id(&cpu_id);
        switch (cpu_id.machine) {
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index 60ee2b883797..2d37bb861faf 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -2,69 +2,82 @@
 *  User access functions based on page table walks for enhanced
 *  system layout without hardware support.
 *
- *    Copyright IBM Corp. 2006
+ *    Copyright IBM Corp. 2006, 2012
 *    Author(s): Gerald Schaefer (gerald.schaefer@de.ibm.com)
 */
 #include <linux/errno.h>
 #include <linux/hardirq.h>
 #include <linux/mm.h>
+#include <linux/hugetlb.h>
 #include <asm/uaccess.h>
 #include <asm/futex.h>
 #include "uaccess.h"
-static inline pte_t *follow_table(struct mm_struct *mm, unsigned long addr)
+/*
+ * Returns kernel address for user virtual address. If the returned address is
+ * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occured and the address
+ * contains the (negative) exception code.
+ */
+static __always_inline unsigned long follow_table(struct mm_struct *mm,
+                                                  unsigned long addr, int write)
 {
        pgd_t *pgd;
        pud_t *pud;
        pmd_t *pmd;
+        pte_t *ptep;
        pgd = pgd_offset(mm, addr);
        if (pgd_none(*pgd) || unlikely(pgd_bad(*pgd)))
-                return (pte_t *) 0x3a;
+                return -0x3aUL;
        pud = pud_offset(pgd, addr);
        if (pud_none(*pud) || unlikely(pud_bad(*pud)))
-                return (pte_t *) 0x3b;
+                return -0x3bUL;
        pmd = pmd_offset(pud, addr);
-        if (pmd_none(*pmd) || unlikely(pmd_bad(*pmd)))
+        if (pmd_none(*pmd))
-                return (pte_t *) 0x10;
+                return -0x10UL;
+        if (pmd_huge(*pmd)) {
+                if (write && (pmd_val(*pmd) & _SEGMENT_ENTRY_RO))
+                        return -0x04UL;
+                return (pmd_val(*pmd) & HPAGE_MASK) + (addr & ~HPAGE_MASK);
+        }
+        if (unlikely(pmd_bad(*pmd)))
+                return -0x10UL;
+        ptep = pte_offset_map(pmd, addr);
+        if (!pte_present(*ptep))
+                return -0x11UL;
+        if (write && !pte_write(*ptep))
+                return -0x04UL;
-        return pte_offset_map(pmd, addr);
+        return (pte_val(*ptep) & PAGE_MASK) + (addr & ~PAGE_MASK);
 }
 static __always_inline size_t __user_copy_pt(unsigned long uaddr, void *kptr,
                                             size_t n, int write_user)
 {
        struct mm_struct *mm = current->mm;
-        unsigned long offset, pfn, done, size;
+        unsigned long offset, done, size, kaddr;
-        pte_t *pte;
        void *from, *to;
        done = 0;
 retry:
        spin_lock(&mm->page_table_lock);
        do {
-                pte = follow_table(mm, uaddr);
+                kaddr = follow_table(mm, uaddr, write_user);
-                if ((unsigned long) pte < 0x1000)
+                if (IS_ERR_VALUE(kaddr))
                        goto fault;
-                if (!pte_present(*pte)) {
-                        pte = (pte_t *) 0x11;
-                        goto fault;
-                } else if (write_user && !pte_write(*pte)) {
-                        pte = (pte_t *) 0x04;
-                        goto fault;
-                }
-                pfn = pte_pfn(*pte);
+                offset = uaddr & ~PAGE_MASK;
-                offset = uaddr & (PAGE_SIZE - 1);
                size = min(n - done, PAGE_SIZE - offset);
                if (write_user) {
-                        to = (void *)((pfn << PAGE_SHIFT) + offset);
+                        to = (void *) kaddr;
                        from = kptr + done;
                } else {
-                        from = (void *)((pfn << PAGE_SHIFT) + offset);
+                        from = (void *) kaddr;
                        to = kptr + done;
                }
                memcpy(to, from, size);
@@ -75,7 +88,7 @@ retry:
        return n - done;
 fault:
        spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, (unsigned long) pte, write_user))
+        if (__handle_fault(uaddr, -kaddr, write_user))
                return n - done;
        goto retry;
 }
@@ -84,27 +97,22 @@ fault:
 * Do DAT for user address by page table walk, return kernel address.
 * This function needs to be called with current->mm->page_table_lock held.
 */
-static __always_inline unsigned long __dat_user_addr(unsigned long uaddr)
+static __always_inline unsigned long __dat_user_addr(unsigned long uaddr,
+                                                     int write)
 {
        struct mm_struct *mm = current->mm;
-        unsigned long pfn;
+        unsigned long kaddr;
-        pte_t *pte;
        int rc;
 retry:
-        pte = follow_table(mm, uaddr);
+        kaddr = follow_table(mm, uaddr, write);
-        if ((unsigned long) pte < 0x1000)
+        if (IS_ERR_VALUE(kaddr))
-                goto fault;
-        if (!pte_present(*pte)) {
-                pte = (pte_t *) 0x11;
                goto fault;
-        }
-        pfn = pte_pfn(*pte);
+        return kaddr;
-        return (pfn << PAGE_SHIFT) + (uaddr & (PAGE_SIZE - 1));
 fault:
        spin_unlock(&mm->page_table_lock);
-        rc = __handle_fault(uaddr, (unsigned long) pte, 0);
+        rc = __handle_fault(uaddr, -kaddr, write);
        spin_lock(&mm->page_table_lock);
        if (!rc)
                goto retry;
@@ -159,11 +167,9 @@ static size_t clear_user_pt(size_t n, void __user *to)
 static size_t strnlen_user_pt(size_t count, const char __user *src)
 {
-        char *addr;
        unsigned long uaddr = (unsigned long) src;
        struct mm_struct *mm = current->mm;
-        unsigned long offset, pfn, done, len;
+        unsigned long offset, done, len, kaddr;
-        pte_t *pte;
        size_t len_str;
        if (segment_eq(get_fs(), KERNEL_DS))
@@ -172,19 +178,13 @@ static size_t strnlen_user_pt(size_t count, const char __user *src)
 retry:
        spin_lock(&mm->page_table_lock);
        do {
-                pte = follow_table(mm, uaddr);
+                kaddr = follow_table(mm, uaddr, 0);
-                if ((unsigned long) pte < 0x1000)
+                if (IS_ERR_VALUE(kaddr))
-                        goto fault;
-                if (!pte_present(*pte)) {
-                        pte = (pte_t *) 0x11;
                        goto fault;
-                }
-                pfn = pte_pfn(*pte);
+                offset = uaddr & ~PAGE_MASK;
-                offset = uaddr & (PAGE_SIZE-1);
-                addr = (char *)(pfn << PAGE_SHIFT) + offset;
                len = min(count - done, PAGE_SIZE - offset);
-                len_str = strnlen(addr, len);
+                len_str = strnlen((char *) kaddr, len);
                done += len_str;
                uaddr += len_str;
        } while ((len_str == len) && (done < count));
@@ -192,7 +192,7 @@ retry:
        return done + 1;
 fault:
        spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, (unsigned long) pte, 0))
+        if (__handle_fault(uaddr, -kaddr, 0))
                return 0;
        goto retry;
 }
@@ -225,11 +225,10 @@ static size_t copy_in_user_pt(size_t n, void __user *to,
                              const void __user *from)
 {
        struct mm_struct *mm = current->mm;
-        unsigned long offset_from, offset_to, offset_max, pfn_from, pfn_to,
+        unsigned long offset_max, uaddr, done, size, error_code;
-                      uaddr, done, size, error_code;
        unsigned long uaddr_from = (unsigned long) from;
        unsigned long uaddr_to = (unsigned long) to;
-        pte_t *pte_from, *pte_to;
+        unsigned long kaddr_to, kaddr_from;
        int write_user;
        if (segment_eq(get_fs(), KERNEL_DS)) {
@@ -242,38 +241,23 @@ retry:
        do {
                write_user = 0;
                uaddr = uaddr_from;
-                pte_from = follow_table(mm, uaddr_from);
+                kaddr_from = follow_table(mm, uaddr_from, 0);
-                error_code = (unsigned long) pte_from;
+                error_code = kaddr_from;
-                if (error_code < 0x1000)
+                if (IS_ERR_VALUE(error_code))
-                        goto fault;
-                if (!pte_present(*pte_from)) {
-                        error_code = 0x11;
                        goto fault;
-                }
                write_user = 1;
                uaddr = uaddr_to;
-                pte_to = follow_table(mm, uaddr_to);
+                kaddr_to = follow_table(mm, uaddr_to, 1);
-                error_code = (unsigned long) pte_to;
+                error_code = (unsigned long) kaddr_to;
-                if (error_code < 0x1000)
+                if (IS_ERR_VALUE(error_code))
-                        goto fault;
-                if (!pte_present(*pte_to)) {
-                        error_code = 0x11;
                        goto fault;
-                } else if (!pte_write(*pte_to)) {
-                        error_code = 0x04;
-                        goto fault;
-                }
-                pfn_from = pte_pfn(*pte_from);
+                offset_max = max(uaddr_from & ~PAGE_MASK,
-                pfn_to = pte_pfn(*pte_to);
+                                 uaddr_to & ~PAGE_MASK);
-                offset_from = uaddr_from & (PAGE_SIZE-1);
-                offset_to = uaddr_from & (PAGE_SIZE-1);
-                offset_max = max(offset_from, offset_to);
                size = min(n - done, PAGE_SIZE - offset_max);
-                memcpy((void *)(pfn_to << PAGE_SHIFT) + offset_to,
+                memcpy((void *) kaddr_to, (void *) kaddr_from, size);
-                       (void *)(pfn_from << PAGE_SHIFT) + offset_from, size);
                done += size;
                uaddr_from += size;
                uaddr_to += size;
@@ -282,7 +266,7 @@ retry:
        return n - done;
 fault:
        spin_unlock(&mm->page_table_lock);
-        if (__handle_fault(uaddr, error_code, write_user))
+        if (__handle_fault(uaddr, -error_code, write_user))
                return n - done;
        goto retry;
 }
@@ -341,7 +325,7 @@ int futex_atomic_op_pt(int op, u32 __user *uaddr, int oparg, int *old)
                return __futex_atomic_op_pt(op, uaddr, oparg, old);
        spin_lock(&current->mm->page_table_lock);
        uaddr = (u32 __force __user *)
-                __dat_user_addr((__force unsigned long) uaddr);
+                __dat_user_addr((__force unsigned long) uaddr, 1);
        if (!uaddr) {
                spin_unlock(&current->mm->page_table_lock);
                return -EFAULT;
@@ -378,7 +362,7 @@ int futex_atomic_cmpxchg_pt(u32 *uval, u32 __user *uaddr,
                return __futex_atomic_cmpxchg_pt(uval, uaddr, oldval, newval);
        spin_lock(&current->mm->page_table_lock);
        uaddr = (u32 __force __user *)
-                __dat_user_addr((__force unsigned long) uaddr);
+                __dat_user_addr((__force unsigned long) uaddr, 1);
        if (!uaddr) {
                spin_unlock(&current->mm->page_table_lock);
                return -EFAULT;
diff --git a/arch/sh/kernel/cpu/sh5/entry.S b/arch/sh/kernel/cpu/sh5/entry.S
index b7cf6a547f11..7e605b95592a 100644
--- a/arch/sh/kernel/cpu/sh5/entry.S
+++ b/arch/sh/kernel/cpu/sh5/entry.S
@@ -933,7 +933,7 @@ ret_with_reschedule:
        pta     restore_all, tr1
-        movi    _TIF_SIGPENDING, r8
+        movi    (_TIF_SIGPENDING|_TIF_NOTIFY_RESUME), r8
        and     r8, r7, r8
        pta     work_notifysig, tr0
        bne     r8, ZERO, tr0
diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index f67601cb3f1f..b96489d8b27d 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -139,7 +139,7 @@ work_pending:
        ! r8: current_thread_info
        ! t:  result of "tst    #_TIF_NEED_RESCHED, r0"
        bf/s    work_resched
-         tst    #_TIF_SIGPENDING, r0
+         tst    #(_TIF_SIGPENDING | _TIF_NOTIFY_RESUME), r0
 work_notifysig:
        bt/s    __restore_all
         mov    r15, r4
diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
index 15e0a1693976..f1ddc0d23679 100644
--- a/arch/sparc/kernel/module.c
+++ b/arch/sparc/kernel/module.c
@@ -48,9 +48,7 @@ void *module_alloc(unsigned long size)
                return NULL;
        ret = module_map(size);
-        if (!ret)
+        if (ret)
-                ret = ERR_PTR(-ENOMEM);
-        else
                memset(ret, 0, size);
        return ret;
@@ -116,6 +114,10 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                v = sym->st_value + rel[i].r_addend;
                switch (ELF_R_TYPE(rel[i].r_info) & 0xff) {
+                case R_SPARC_DISP32:
+                        v -= (Elf_Addr) location;
+                        *loc32 = v;
+                        break;
 #ifdef CONFIG_SPARC64
                case R_SPARC_64:
                        location[0] = v >> 56;
@@ -128,11 +130,6 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
                        location[7] = v >>  0;
                        break;
-                case R_SPARC_DISP32:
-                        v -= (Elf_Addr) location;
-                        *loc32 = v;
-                        break;
                case R_SPARC_WDISP19:
                        v -= (Elf_Addr) location;
                        *loc32 = (*loc32 & ~0x7ffff) |
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 8ec3a1aa4abd..50a1d1f9b6d3 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -746,10 +746,10 @@ config SWIOTLB
        def_bool y if X86_64
        ---help---
          Support for software bounce buffers used on x86-64 systems
-          which don't have a hardware IOMMU (e.g. the current generation
+          which don't have a hardware IOMMU. Using this PCI devices
-          of Intel's x86-64 CPUs). Using this PCI devices which can only
+          which can only access 32-bits of memory can be used on systems
-          access 32-bits of memory can be used on systems with more than
+          with more than 3 GB of memory.
-          3 GB of memory. If unsure, say Y.
+          If unsure, say Y.
 config IOMMU_HELPER
        def_bool (CALGARY_IOMMU || GART_IOMMU || SWIOTLB || AMD_IOMMU)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 682e9c210baa..474ca35b1bce 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -142,7 +142,7 @@ KBUILD_CFLAGS += $(call cc-option,-mno-avx,)
 KBUILD_CFLAGS += $(mflags-y)
 KBUILD_AFLAGS += $(mflags-y)
-archscripts:
+archscripts: scripts_basic
        $(Q)$(MAKE) $(build)=arch/x86/tools relocs
 ###
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 93971e841dd5..472b9b783019 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -51,7 +51,8 @@ extern unsigned long set_phys_range_identity(unsigned long pfn_s,
 extern int m2p_add_override(unsigned long mfn, struct page *page,
                            struct gnttab_map_grant_ref *kmap_op);
-extern int m2p_remove_override(struct page *page, bool clear_pte);
+extern int m2p_remove_override(struct page *page,
+                                struct gnttab_map_grant_ref *kmap_op);
 extern struct page *m2p_find_override(unsigned long mfn);
 extern unsigned long m2p_find_override_pfn(unsigned long mfn, unsigned long pfn);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6605a81ba339..8b6defe7eefc 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -586,6 +586,8 @@ extern struct event_constraint intel_westmere_pebs_event_constraints[];
 extern struct event_constraint intel_snb_pebs_event_constraints[];
+extern struct event_constraint intel_ivb_pebs_event_constraints[];
 struct event_constraint *intel_pebs_constraints(struct perf_event *event);
 void intel_pmu_pebs_enable(struct perf_event *event);
diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
index 7bfb5bec8630..eebd5ffe1bba 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -209,6 +209,15 @@ static int perf_ibs_precise_event(struct perf_event *event, u64 *config)
        return -EOPNOTSUPP;
 }
+static const struct perf_event_attr ibs_notsupp = {
+        .exclude_user   = 1,
+        .exclude_kernel = 1,
+        .exclude_hv     = 1,
+        .exclude_idle   = 1,
+        .exclude_host   = 1,
+        .exclude_guest  = 1,
+};
 static int perf_ibs_init(struct perf_event *event)
 {
        struct hw_perf_event *hwc = &event->hw;
@@ -229,6 +238,9 @@ static int perf_ibs_init(struct perf_event *event)
        if (event->pmu != &perf_ibs->pmu)
                return -ENOENT;
+        if (perf_flags(&event->attr) & perf_flags(&ibs_notsupp))
+                return -EINVAL;
        if (config & ~perf_ibs->config_mask)
                return -EINVAL;
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 0d3d63afa76a..6bca492b8547 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -2048,7 +2048,6 @@ __init int intel_pmu_init(void)
        case 42: /* SandyBridge */
        case 45: /* SandyBridge, "Romely-EP" */
                x86_add_quirk(intel_sandybridge_quirk);
-        case 58: /* IvyBridge */
                memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                       sizeof(hw_cache_event_ids));
                memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs,
@@ -2073,6 +2072,29 @@ __init int intel_pmu_init(void)
                pr_cont("SandyBridge events, ");
                break;
+        case 58: /* IvyBridge */
+                memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
+                       sizeof(hw_cache_event_ids));
+                memcpy(hw_cache_extra_regs, snb_hw_cache_extra_regs,
+                       sizeof(hw_cache_extra_regs));
+                intel_pmu_lbr_init_snb();
+                x86_pmu.event_constraints = intel_snb_event_constraints;
+                x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
+                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+                x86_pmu.extra_regs = intel_snb_extra_regs;
+                /* all extra regs are per-cpu when HT is on */
+                x86_pmu.er_flags |= ERF_HAS_RSP_1;
+                x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+                /* UOPS_ISSUED.ANY,c=1,i=1 to count stall cycles */
+                intel_perfmon_event_map[PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] =
+                        X86_CONFIG(.event=0x0e, .umask=0x01, .inv=1, .cmask=1);
+                pr_cont("IvyBridge events, ");
+                break;
        default:
                switch (x86_pmu.version) {
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index e38d97bf4259..826054a4f2ee 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -407,6 +407,20 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
        EVENT_CONSTRAINT_END
 };
+struct event_constraint intel_ivb_pebs_event_constraints[] = {
+        INTEL_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */
+        INTEL_UEVENT_CONSTRAINT(0x01c2, 0xf), /* UOPS_RETIRED.ALL */
+        INTEL_UEVENT_CONSTRAINT(0x02c2, 0xf), /* UOPS_RETIRED.RETIRE_SLOTS */
+        INTEL_EVENT_CONSTRAINT(0xc4, 0xf),    /* BR_INST_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xc5, 0xf),    /* BR_MISP_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xcd, 0x8),    /* MEM_TRANS_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
+        INTEL_EVENT_CONSTRAINT(0xd3, 0xf),    /* MEM_LOAD_UOPS_LLC_MISS_RETIRED.* */
+        EVENT_CONSTRAINT_END
+};
 struct event_constraint *intel_pebs_constraints(struct perf_event *event)
 {
        struct event_constraint *c;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
index 0a5571080e74..38e4894165b9 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -661,6 +661,11 @@ static void snb_uncore_msr_init_box(struct intel_uncore_box *box)
        }
 }
+static struct uncore_event_desc snb_uncore_events[] = {
+        INTEL_UNCORE_EVENT_DESC(clockticks, "event=0xff,umask=0x00"),
+        { /* end: all zeroes */ },
+};
 static struct attribute *snb_uncore_formats_attr[] = {
        &format_attr_event.attr,
        &format_attr_umask.attr,
@@ -704,6 +709,7 @@ static struct intel_uncore_type snb_uncore_cbox = {
        .constraints    = snb_uncore_cbox_constraints,
        .ops            = &snb_uncore_msr_ops,
        .format_group   = &snb_uncore_format_group,
+        .event_descs    = snb_uncore_events,
 };
 static struct intel_uncore_type *snb_msr_uncores[] = {
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index e0e6990723e9..ab1f6a93b527 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -319,7 +319,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
 */
 int devmem_is_allowed(unsigned long pagenr)
 {
-        if (pagenr <= 256)
+        if (pagenr < 256)
                return 1;
        if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
                return 0;
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 9642d4a38602..1fbe75a95f15 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1452,6 +1452,10 @@ asmlinkage void __init xen_start_kernel(void)
                pci_request_acs();
                xen_acpi_sleep_register();
+                /* Avoid searching for BIOS MP tables */
+                x86_init.mpparse.find_smp_config = x86_init_noop;
+                x86_init.mpparse.get_smp_config = x86_init_uint_noop;
        }
 #ifdef CONFIG_PCI
        /* PCI BIOS service won't work from a PV guest. */
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index 76ba0e97e530..72213da605f5 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -828,9 +828,6 @@ int m2p_add_override(unsigned long mfn, struct page *page,
                        xen_mc_issue(PARAVIRT_LAZY_MMU);
                }
-                /* let's use dev_bus_addr to record the old mfn instead */
-                kmap_op->dev_bus_addr = page->index;
-                page->index = (unsigned long) kmap_op;
        }
        spin_lock_irqsave(&m2p_override_lock, flags);
        list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
@@ -857,7 +854,8 @@ int m2p_add_override(unsigned long mfn, struct page *page,
        return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
-int m2p_remove_override(struct page *page, bool clear_pte)
+int m2p_remove_override(struct page *page,
+                struct gnttab_map_grant_ref *kmap_op)
 {
        unsigned long flags;
        unsigned long mfn;
@@ -887,10 +885,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
        WARN_ON(!PagePrivate(page));
        ClearPagePrivate(page);
-        if (clear_pte) {
+        set_phys_to_machine(pfn, page->index);
-                struct gnttab_map_grant_ref *map_op =
+        if (kmap_op != NULL) {
-                        (struct gnttab_map_grant_ref *) page->index;
-                set_phys_to_machine(pfn, map_op->dev_bus_addr);
                if (!PageHighMem(page)) {
                        struct multicall_space mcs;
                        struct gnttab_unmap_grant_ref *unmap_op;
@@ -902,13 +898,13 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                         * issued. In this case handle is going to -1 because
                         * it hasn't been modified yet.
                         */
-                        if (map_op->handle == -1)
+                        if (kmap_op->handle == -1)
                                xen_mc_flush();
                        /*
-                         * Now if map_op->handle is negative it means that the
+                         * Now if kmap_op->handle is negative it means that the
                         * hypercall actually returned an error.
                         */
-                        if (map_op->handle == GNTST_general_error) {
+                        if (kmap_op->handle == GNTST_general_error) {
                                printk(KERN_WARNING "m2p_remove_override: "
                                                "pfn %lx mfn %lx, failed to modify kernel mappings",
                                                pfn, mfn);
@@ -918,8 +914,8 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                        mcs = xen_mc_entry(
                                        sizeof(struct gnttab_unmap_grant_ref));
                        unmap_op = mcs.args;
-                        unmap_op->host_addr = map_op->host_addr;
+                        unmap_op->host_addr = kmap_op->host_addr;
-                        unmap_op->handle = map_op->handle;
+                        unmap_op->handle = kmap_op->handle;
                        unmap_op->dev_bus_addr = 0;
                        MULTI_grant_table_op(mcs.mc,
@@ -930,10 +926,9 @@ int m2p_remove_override(struct page *page, bool clear_pte)
                        set_pte_at(&init_mm, address, ptep,
                                        pfn_pte(pfn, PAGE_KERNEL));
                        __flush_tlb_single(address);
-                        map_op->host_addr = 0;
+                        kmap_op->host_addr = 0;
                }
-        } else
+        }
-                set_phys_to_machine(pfn, page->index);
        /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
         * somewhere in this domain, even before being added to the
diff --git a/block/blk-core.c b/block/blk-core.c
index 4b4dbdfbca89..ee3cb3a5e278 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2254,9 +2254,11 @@ bool blk_update_request(struct request *req, int error, unsigned int nr_bytes)
                        error_type = "I/O";
                        break;
                }
-                printk(KERN_ERR "end_request: %s error, dev %s, sector %llu\n",
+                printk_ratelimited(KERN_ERR "end_request: %s error, dev %s, sector %llu\n",
-                       error_type, req->rq_disk ? req->rq_disk->disk_name : "?",
+                                   error_type, req->rq_disk ?
-                       (unsigned long long)blk_rq_pos(req));
+                                   req->rq_disk->disk_name : "?",
+                                   (unsigned long long)blk_rq_pos(req));
        }
        blk_account_io_completion(req, nr_bytes);
diff --git a/block/ioctl.c b/block/ioctl.c
index 4476e0e85d16..4a85096f5410 100644
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -41,7 +41,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user
                            sizeof(long long) > sizeof(long)) {
                                long pstart = start, plength = length;
                                if (pstart != start || plength != length
-                                    || pstart < 0 || plength < 0)
+                                    || pstart < 0 || plength < 0 || partno > 65535)
                                        return -EINVAL;
                        }
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index de0435e63b02..887f68f6d79a 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -35,6 +35,7 @@ new_skb(ulong len)
                skb_reset_mac_header(skb);
                skb_reset_network_header(skb);
                skb->protocol = __constant_htons(ETH_P_AOE);
+                skb_checksum_none_assert(skb);
        }
        return skb;
 }
diff --git a/drivers/block/cciss_scsi.c b/drivers/block/cciss_scsi.c
index 38aa6dda6b81..da3311129a0c 100644
--- a/drivers/block/cciss_scsi.c
+++ b/drivers/block/cciss_scsi.c
@@ -795,6 +795,7 @@ static void complete_scsi_command(CommandList_struct *c, int timeout,
                                }
                        break;
                        case CMD_PROTOCOL_ERR:
+                                cmd->result = DID_ERROR << 16;
                                dev_warn(&h->pdev->dev,
                                        "%p has protocol error\n", c);
                        break;
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index a8fddeb3d638..f946d31d6917 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -1148,11 +1148,15 @@ static bool mtip_pause_ncq(struct mtip_port *port,
        reply = port->rxfis + RX_FIS_D2H_REG;
        task_file_data = readl(port->mmio+PORT_TFDATA);
-        if ((task_file_data & 1) || (fis->command == ATA_CMD_SEC_ERASE_UNIT))
+        if (fis->command == ATA_CMD_SEC_ERASE_UNIT)
+                clear_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
+        if ((task_file_data & 1))
                return false;
        if (fis->command == ATA_CMD_SEC_ERASE_PREP) {
                set_bit(MTIP_PF_SE_ACTIVE_BIT, &port->flags);
+                set_bit(MTIP_DDF_SEC_LOCK_BIT, &port->dd->dd_flag);
                port->ic_pause_timer = jiffies;
                return true;
        } else if ((fis->command == ATA_CMD_DOWNLOAD_MICRO) &&
@@ -1900,7 +1904,7 @@ static int exec_drive_command(struct mtip_port *port, u8 *command,
        int rv = 0, xfer_sz = command[3];
        if (xfer_sz) {
-                if (user_buffer)
+                if (!user_buffer)
                        return -EFAULT;
                buf = dmam_alloc_coherent(&port->dd->pdev->dev,
@@ -2043,7 +2047,7 @@ static void mtip_set_timeout(struct host_to_dev_fis *fis, unsigned int *timeout)
                *timeout = 240000; /* 4 minutes */
                break;
        case ATA_CMD_STANDBYNOW1:
-                *timeout = 10000;  /* 10 seconds */
+                *timeout = 120000;  /* 2 minutes */
                break;
        case 0xF7:
        case 0xFA:
@@ -2588,9 +2592,6 @@ static ssize_t mtip_hw_read_registers(struct file *f, char __user *ubuf,
        if (!len || size)
                return 0;
-        if (size < 0)
-                return -EINVAL;
        size += sprintf(&buf[size], "H/ S ACTive      : [ 0x");
        for (n = dd->slot_groups-1; n >= 0; n--)
@@ -2660,9 +2661,6 @@ static ssize_t mtip_hw_read_flags(struct file *f, char __user *ubuf,
        if (!len || size)
                return 0;
-        if (size < 0)
-                return -EINVAL;
        size += sprintf(&buf[size], "Flag-port : [ %08lX ]\n",
                                                        dd->port->flags);
        size += sprintf(&buf[size], "Flag-dd   : [ %08lX ]\n",
@@ -3214,8 +3212,8 @@ static int mtip_hw_init(struct driver_data *dd)
                                "Unable to check write protect progress\n");
        else
                dev_info(&dd->pdev->dev,
-                                "Write protect progress: %d%% (%d blocks)\n",
+                                "Write protect progress: %u%% (%u blocks)\n",
-                                attr242.cur, attr242.data);
+                                attr242.cur, le32_to_cpu(attr242.data));
        return rv;
 out3:
@@ -3619,6 +3617,10 @@ static void mtip_make_request(struct request_queue *queue, struct bio *bio)
                        bio_endio(bio, -ENODATA);
                        return;
                }
+                if (unlikely(test_bit(MTIP_DDF_SEC_LOCK_BIT, &dd->dd_flag))) {
+                        bio_endio(bio, -ENODATA);
+                        return;
+                }
        }
        if (unlikely(!bio_has_data(bio))) {
@@ -4168,7 +4170,13 @@ static void mtip_pci_shutdown(struct pci_dev *pdev)
 /* Table of device ids supported by this driver. */
 static DEFINE_PCI_DEVICE_TABLE(mtip_pci_tbl) = {
-        {  PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P320S_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P325M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420H_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P420M_DEVICE_ID) },
+        { PCI_DEVICE(PCI_VENDOR_ID_MICRON, P425M_DEVICE_ID) },
        { 0 }
 };
@@ -4199,12 +4207,12 @@ static int __init mtip_init(void)
 {
        int error;
-        printk(KERN_INFO MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
+        pr_info(MTIP_DRV_NAME " Version " MTIP_DRV_VERSION "\n");
        /* Allocate a major block device number to use with this driver. */
        error = register_blkdev(0, MTIP_DRV_NAME);
        if (error <= 0) {
-                printk(KERN_ERR "Unable to register block device (%d)\n",
+                pr_err("Unable to register block device (%d)\n",
                error);
                return -EBUSY;
        }
@@ -4213,7 +4221,7 @@ static int __init mtip_init(void)
        if (!dfs_parent) {
                dfs_parent = debugfs_create_dir("rssd", NULL);
                if (IS_ERR_OR_NULL(dfs_parent)) {
-                        printk(KERN_WARNING "Error creating debugfs parent\n");
+                        pr_warn("Error creating debugfs parent\n");
                        dfs_parent = NULL;
                }
        }
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index f51fc23d17bb..18627a1d04c5 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -76,7 +76,13 @@
 /* Micron Vendor ID & P320x SSD Device ID */
 #define PCI_VENDOR_ID_MICRON    0x1344
-#define P320_DEVICE_ID          0x5150
+#define P320H_DEVICE_ID         0x5150
+#define P320M_DEVICE_ID         0x5151
+#define P320S_DEVICE_ID         0x5152
+#define P325M_DEVICE_ID         0x5153
+#define P420H_DEVICE_ID         0x5160
+#define P420M_DEVICE_ID         0x5161
+#define P425M_DEVICE_ID         0x5163
 /* Driver name and version strings */
 #define MTIP_DRV_NAME           "mtip32xx"
@@ -131,10 +137,12 @@ enum {
        MTIP_PF_SVC_THD_STOP_BIT    = 8,
        /* below are bit numbers in 'dd_flag' defined in driver_data */
+        MTIP_DDF_SEC_LOCK_BIT       = 0,
        MTIP_DDF_REMOVE_PENDING_BIT = 1,
        MTIP_DDF_OVER_TEMP_BIT      = 2,
        MTIP_DDF_WRITE_PROTECT_BIT  = 3,
        MTIP_DDF_STOP_IO      = ((1 << MTIP_DDF_REMOVE_PENDING_BIT) | \
+                                (1 << MTIP_DDF_SEC_LOCK_BIT) | \
                                (1 << MTIP_DDF_OVER_TEMP_BIT) | \
                                (1 << MTIP_DDF_WRITE_PROTECT_BIT)),
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index d07c9f7fded6..0c03411c59eb 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -449,6 +449,14 @@ static void nbd_clear_que(struct nbd_device *nbd)
                req->errors++;
                nbd_end_request(req);
        }
+        while (!list_empty(&nbd->waiting_queue)) {
+                req = list_entry(nbd->waiting_queue.next, struct request,
+                                 queuelist);
+                list_del_init(&req->queuelist);
+                req->errors++;
+                nbd_end_request(req);
+        }
 }
@@ -598,6 +606,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
                nbd->file = NULL;
                nbd_clear_que(nbd);
                BUG_ON(!list_empty(&nbd->queue_head));
+                BUG_ON(!list_empty(&nbd->waiting_queue));
                if (file)
                        fput(file);
                return 0;
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 73f196ca713f..c6decb901e5e 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -337,7 +337,7 @@ static void xen_blkbk_unmap(struct pending_req *req)
                invcount++;
        }
-        ret = gnttab_unmap_refs(unmap, pages, invcount, false);
+        ret = gnttab_unmap_refs(unmap, NULL, pages, invcount);
        BUG_ON(ret);
 }
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 5869ea387054..72ce247a0e8d 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -1,4 +1,5 @@
 # common clock types
+obj-$(CONFIG_HAVE_CLK)          += clk-devres.o
 obj-$(CONFIG_CLKDEV_LOOKUP)     += clkdev.o
 obj-$(CONFIG_COMMON_CLK)        += clk.o clk-fixed-rate.o clk-gate.o \
                                   clk-mux.o clk-divider.o clk-fixed-factor.o
diff --git a/drivers/clk/clk-devres.c b/drivers/clk/clk-devres.c
new file mode 100644
index 000000000000..8f571548870f
--- /dev/null
+++ b/drivers/clk/clk-devres.c
@@ -0,0 +1,55 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/export.h>
+#include <linux/gfp.h>
+static void devm_clk_release(struct device *dev, void *res)
+{
+        clk_put(*(struct clk **)res);
+}
+struct clk *devm_clk_get(struct device *dev, const char *id)
+{
+        struct clk **ptr, *clk;
+        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return ERR_PTR(-ENOMEM);
+        clk = clk_get(dev, id);
+        if (!IS_ERR(clk)) {
+                *ptr = clk;
+                devres_add(dev, ptr);
+        } else {
+                devres_free(ptr);
+        }
+        return clk;
+}
+EXPORT_SYMBOL(devm_clk_get);
+static int devm_clk_match(struct device *dev, void *res, void *data)
+{
+        struct clk **c = res;
+        if (!c || !*c) {
+                WARN_ON(!c || !*c);
+                return 0;
+        }
+        return *c == data;
+}
+void devm_clk_put(struct device *dev, struct clk *clk)
+{
+        int ret;
+        ret = devres_release(dev, devm_clk_release, devm_clk_match, clk);
+        WARN_ON(ret);
+}
+EXPORT_SYMBOL(devm_clk_put);
diff --git a/drivers/clk/clkdev.c b/drivers/clk/clkdev.c
index d423c9bdd71a..442a31363873 100644
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -171,51 +171,6 @@ void clk_put(struct clk *clk)
 }
 EXPORT_SYMBOL(clk_put);
-static void devm_clk_release(struct device *dev, void *res)
-{
-        clk_put(*(struct clk **)res);
-}
-struct clk *devm_clk_get(struct device *dev, const char *id)
-{
-        struct clk **ptr, *clk;
-        ptr = devres_alloc(devm_clk_release, sizeof(*ptr), GFP_KERNEL);
-        if (!ptr)
-                return ERR_PTR(-ENOMEM);
-        clk = clk_get(dev, id);
-        if (!IS_ERR(clk)) {
-                *ptr = clk;
-                devres_add(dev, ptr);
-        } else {
-                devres_free(ptr);
-        }
-        return clk;
-}
-EXPORT_SYMBOL(devm_clk_get);
-static int devm_clk_match(struct device *dev, void *res, void *data)
-{
-        struct clk **c = res;
-        if (!c || !*c) {
-                WARN_ON(!c || !*c);
-                return 0;
-        }
-        return *c == data;
-}
-void devm_clk_put(struct device *dev, struct clk *clk)
-{
-        int ret;
-        ret = devres_destroy(dev, devm_clk_release, devm_clk_match, clk);
-        WARN_ON(ret);
-}
-EXPORT_SYMBOL(devm_clk_put);
 void clkdev_add(struct clk_lookup *cl)
 {
        mutex_lock(&clocks_mutex);
diff --git a/drivers/clk/mxs/Makefile b/drivers/clk/mxs/Makefile
index 7bedeec08524..a6a22237e860 100644
--- a/drivers/clk/mxs/Makefile
+++ b/drivers/clk/mxs/Makefile
@@ -2,7 +2,7 @@
 # Makefile for mxs specific clk
 #
-obj-y += clk.o clk-pll.o clk-ref.o clk-div.o clk-frac.o
+obj-y += clk.o clk-pll.o clk-ref.o clk-div.o clk-frac.o clk-ssp.o
 obj-$(CONFIG_SOC_IMX23) += clk-imx23.o
 obj-$(CONFIG_SOC_IMX28) += clk-imx28.o
diff --git a/drivers/clk/mxs/clk-ssp.c b/drivers/clk/mxs/clk-ssp.c
new file mode 100644
index 000000000000..af7bdbf9ebd7
--- /dev/null
+++ b/drivers/clk/mxs/clk-ssp.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright 2012 DENX Software Engineering, GmbH
+ *
+ * Pulled from code:
+ * Portions copyright (C) 2003 Russell King, PXA MMCI Driver
+ * Portions copyright (C) 2004-2005 Pierre Ossman, W83L51xD SD/MMC driver
+ *
+ * Copyright 2008 Embedded Alley Solutions, Inc.
+ * Copyright 2009-2011 Freescale Semiconductor, Inc.
+ *
+ * The code contained herein is licensed under the GNU General Public
+ * License. You may obtain a copy of the GNU General Public License
+ * Version 2 or later at the following locations:
+ *
+ * http://www.opensource.org/licenses/gpl-license.html
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/clk.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/io.h>
+#include <linux/spi/mxs-spi.h>
+void mxs_ssp_set_clk_rate(struct mxs_ssp *ssp, unsigned int rate)
+{
+        unsigned int ssp_clk, ssp_sck;
+        u32 clock_divide, clock_rate;
+        u32 val;
+        ssp_clk = clk_get_rate(ssp->clk);
+        for (clock_divide = 2; clock_divide <= 254; clock_divide += 2) {
+                clock_rate = DIV_ROUND_UP(ssp_clk, rate * clock_divide);
+                clock_rate = (clock_rate > 0) ? clock_rate - 1 : 0;
+                if (clock_rate <= 255)
+                        break;
+        }
+        if (clock_divide > 254) {
+                dev_err(ssp->dev,
+                        "%s: cannot set clock to %d\n", __func__, rate);
+                return;
+        }
+        ssp_sck = ssp_clk / clock_divide / (1 + clock_rate);
+        val = readl(ssp->base + HW_SSP_TIMING(ssp));
+        val &= ~(BM_SSP_TIMING_CLOCK_DIVIDE | BM_SSP_TIMING_CLOCK_RATE);
+        val |= BF_SSP(clock_divide, TIMING_CLOCK_DIVIDE);
+        val |= BF_SSP(clock_rate, TIMING_CLOCK_RATE);
+        writel(val, ssp->base + HW_SSP_TIMING(ssp));
+        ssp->clk_rate = ssp_sck;
+        dev_dbg(ssp->dev,
+                "%s: clock_divide %d, clock_rate %d, ssp_clk %d, rate_actual %d, rate_requested %d\n",
+                __func__, clock_divide, clock_rate, ssp_clk, ssp_sck, rate);
+}
+EXPORT_SYMBOL_GPL(mxs_ssp_set_clk_rate);
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index c0e816468e30..1a40935c85fd 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -35,7 +35,6 @@
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/cpumask.h>
-#include <linux/sched.h>        /* for current / set_cpus_allowed() */
 #include <linux/io.h>
 #include <linux/delay.h>
@@ -1139,16 +1138,23 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,
        return res;
 }
-/* Driver entry point to switch to the target frequency */
+struct powernowk8_target_arg {
-static int powernowk8_target(struct cpufreq_policy *pol,
+        struct cpufreq_policy           *pol;
-                unsigned targfreq, unsigned relation)
+        unsigned                        targfreq;
+        unsigned                        relation;
+};
+static long powernowk8_target_fn(void *arg)
 {
-        cpumask_var_t oldmask;
+        struct powernowk8_target_arg *pta = arg;
+        struct cpufreq_policy *pol = pta->pol;
+        unsigned targfreq = pta->targfreq;
+        unsigned relation = pta->relation;
        struct powernow_k8_data *data = per_cpu(powernow_data, pol->cpu);
        u32 checkfid;
        u32 checkvid;
        unsigned int newstate;
-        int ret = -EIO;
+        int ret;
        if (!data)
                return -EINVAL;
@@ -1156,29 +1162,16 @@ static int powernowk8_target(struct cpufreq_policy *pol,
        checkfid = data->currfid;
        checkvid = data->currvid;
-        /* only run on specific CPU from here on. */
-        /* This is poor form: use a workqueue or smp_call_function_single */
-        if (!alloc_cpumask_var(&oldmask, GFP_KERNEL))
-                return -ENOMEM;
-        cpumask_copy(oldmask, tsk_cpus_allowed(current));
-        set_cpus_allowed_ptr(current, cpumask_of(pol->cpu));
-        if (smp_processor_id() != pol->cpu) {
-                printk(KERN_ERR PFX "limiting to cpu %u failed\n", pol->cpu);
-                goto err_out;
-        }
        if (pending_bit_stuck()) {
                printk(KERN_ERR PFX "failing targ, change pending bit set\n");
-                goto err_out;
+                return -EIO;
        }
        pr_debug("targ: cpu %d, %d kHz, min %d, max %d, relation %d\n",
                pol->cpu, targfreq, pol->min, pol->max, relation);
        if (query_current_values_with_pending_wait(data))
-                goto err_out;
+                return -EIO;
        if (cpu_family != CPU_HW_PSTATE) {
                pr_debug("targ: curr fid 0x%x, vid 0x%x\n",
@@ -1196,7 +1189,7 @@ static int powernowk8_target(struct cpufreq_policy *pol,
        if (cpufreq_frequency_table_target(pol, data->powernow_table,
                                targfreq, relation, &newstate))
-                goto err_out;
+                return -EIO;
        mutex_lock(&fidvid_mutex);
@@ -1209,9 +1202,8 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                ret = transition_frequency_fidvid(data, newstate);
        if (ret) {
                printk(KERN_ERR PFX "transition frequency failed\n");
-                ret = 1;
                mutex_unlock(&fidvid_mutex);
-                goto err_out;
+                return 1;
        }
        mutex_unlock(&fidvid_mutex);
@@ -1220,12 +1212,25 @@ static int powernowk8_target(struct cpufreq_policy *pol,
                                data->powernow_table[newstate].index);
        else
                pol->cur = find_khz_freq_from_fid(data->currfid);
-        ret = 0;
-err_out:
+        return 0;
-        set_cpus_allowed_ptr(current, oldmask);
+}
-        free_cpumask_var(oldmask);
-        return ret;
+/* Driver entry point to switch to the target frequency */
+static int powernowk8_target(struct cpufreq_policy *pol,
+                unsigned targfreq, unsigned relation)
+{
+        struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq,
+                                             .relation = relation };
+        /*
+         * Must run on @pol->cpu.  cpufreq core is responsible for ensuring
+         * that we're bound to the current CPU and pol->cpu stays online.
+         */
+        if (smp_processor_id() == pol->cpu)
+                return powernowk8_target_fn(&pta);
+        else
+                return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta);
 }
 /* Driver entry point to verify the policy and range of frequencies */
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 3934fcc4e00b..7ab6e26664a7 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -661,7 +661,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                        flags);
        if (unlikely(!atslave || !sg_len)) {
-                dev_dbg(chan2dev(chan), "prep_dma_memcpy: length is zero!\n");
+                dev_dbg(chan2dev(chan), "prep_slave_sg: sg length is zero!\n");
                return NULL;
        }
@@ -689,6 +689,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                        mem = sg_dma_address(sg);
                        len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                        mem_width = 2;
                        if (unlikely(mem & 3 || len & 3))
                                mem_width = 0;
@@ -724,6 +729,11 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
                        mem = sg_dma_address(sg);
                        len = sg_dma_len(sg);
+                        if (unlikely(!len)) {
+                                dev_dbg(chan2dev(chan),
+                                        "prep_slave_sg: sg(%d) data length is zero\n", i);
+                                goto err;
+                        }
                        mem_width = 2;
                        if (unlikely(mem & 3 || len & 3))
                                mem_width = 0;
@@ -757,6 +767,7 @@ atc_prep_slave_sg(struct dma_chan *chan, struct scatterlist *sgl,
 err_desc_get:
        dev_err(chan2dev(chan), "not enough descriptors available\n");
+err:
        atc_desc_put(atchan, first);
        return NULL;
 }
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index e4feba6b03c0..f5843bc80baa 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1567,17 +1567,19 @@ static int pl330_submit_req(void *ch_id, struct pl330_req *r)
                goto xfer_exit;
        }
-        /* Prefer Secure Channel */
-        if (!_manager_ns(thrd))
-                r->cfg->nonsecure = 0;
-        else
-                r->cfg->nonsecure = 1;
        /* Use last settings, if not provided */
-        if (r->cfg)
+        if (r->cfg) {
+                /* Prefer Secure Channel */
+                if (!_manager_ns(thrd))
+                        r->cfg->nonsecure = 0;
+                else
+                        r->cfg->nonsecure = 1;
                ccr = _prepare_ccr(r->cfg);
-        else
+        } else {
                ccr = readl(regs + CC(thrd->id));
+        }
        /* If this req doesn't have valid xfer settings */
        if (!_is_valid(ccr)) {
@@ -2928,6 +2930,11 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
                num_chan = max_t(int, pi->pcfg.num_peri, pi->pcfg.num_chan);
        pdmac->peripherals = kzalloc(num_chan * sizeof(*pch), GFP_KERNEL);
+        if (!pdmac->peripherals) {
+                ret = -ENOMEM;
+                dev_err(&adev->dev, "unable to allocate pdmac->peripherals\n");
+                goto probe_err5;
+        }
        for (i = 0; i < num_chan; i++) {
                pch = &pdmac->peripherals[i];
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 616d90bcb3a4..d5dc9da7f99f 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -199,6 +199,36 @@ void *edac_align_ptr(void **p, unsigned size, int n_elems)
        return (void *)(((unsigned long)ptr) + align - r);
 }
+static void _edac_mc_free(struct mem_ctl_info *mci)
+{
+        int i, chn, row;
+        struct csrow_info *csr;
+        const unsigned int tot_dimms = mci->tot_dimms;
+        const unsigned int tot_channels = mci->num_cschannel;
+        const unsigned int tot_csrows = mci->nr_csrows;
+        if (mci->dimms) {
+                for (i = 0; i < tot_dimms; i++)
+                        kfree(mci->dimms[i]);
+                kfree(mci->dimms);
+        }
+        if (mci->csrows) {
+                for (row = 0; row < tot_csrows; row++) {
+                        csr = mci->csrows[row];
+                        if (csr) {
+                                if (csr->channels) {
+                                        for (chn = 0; chn < tot_channels; chn++)
+                                                kfree(csr->channels[chn]);
+                                        kfree(csr->channels);
+                                }
+                                kfree(csr);
+                        }
+                }
+                kfree(mci->csrows);
+        }
+        kfree(mci);
+}
 /**
 * edac_mc_alloc: Allocate and partially fill a struct mem_ctl_info structure
 * @mc_num:             Memory controller number
@@ -413,24 +443,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
        return mci;
 error:
-        if (mci->dimms) {
+        _edac_mc_free(mci);
-                for (i = 0; i < tot_dimms; i++)
-                        kfree(mci->dimms[i]);
-                kfree(mci->dimms);
-        }
-        if (mci->csrows) {
-                for (chn = 0; chn < tot_channels; chn++) {
-                        csr = mci->csrows[chn];
-                        if (csr) {
-                                for (chn = 0; chn < tot_channels; chn++)
-                                        kfree(csr->channels[chn]);
-                                kfree(csr);
-                        }
-                        kfree(mci->csrows[i]);
-                }
-                kfree(mci->csrows);
-        }
-        kfree(mci);
        return NULL;
 }
@@ -445,6 +458,14 @@ void edac_mc_free(struct mem_ctl_info *mci)
 {
        edac_dbg(1, "\n");
+        /* If we're not yet registered with sysfs free only what was allocated
+         * in edac_mc_alloc().
+         */
+        if (!device_is_registered(&mci->dev)) {
+                _edac_mc_free(mci);
+                return;
+        }
        /* the mci instance is freed here, when the sysfs object is dropped */
        edac_unregister_sysfs(mci);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 489e2b162b27..274d25de521e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3242,7 +3242,8 @@ i915_gem_object_pin(struct drm_i915_gem_object *obj,
 {
        int ret;
-        BUG_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT);
+        if (WARN_ON(obj->pin_count == DRM_I915_GEM_OBJECT_MAX_PIN_COUNT))
+                return -EBUSY;
        if (obj->gtt_space != NULL) {
                if ((alignment && obj->gtt_offset & (alignment - 1)) ||
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bc2ad348e5d8..c040aee1341c 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4191,12 +4191,6 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
        POSTING_READ(DPLL(pipe));
        udelay(150);
-        I915_WRITE(DPLL(pipe), dpll);
-        /* Wait for the clocks to stabilize. */
-        POSTING_READ(DPLL(pipe));
-        udelay(150);
        /* The LVDS pin pair needs to be on before the DPLLs are enabled.
         * This is an exception to the general rule that mode_set doesn't turn
         * things on.
@@ -4204,6 +4198,12 @@ static void i8xx_update_pll(struct drm_crtc *crtc,
        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
                intel_update_lvds(crtc, clock, adjusted_mode);
+        I915_WRITE(DPLL(pipe), dpll);
+        /* Wait for the clocks to stabilize. */
+        POSTING_READ(DPLL(pipe));
+        udelay(150);
        /* The pixel multiplier can only be updated once the
         * DPLL is enabled and the clocks are stable.
         *
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 98f602427eb8..12dc3308ab8c 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -609,7 +609,7 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
        u32 temp;
        u32 enable_bits = SDVO_ENABLE;
-        if (intel_hdmi->has_audio)
+        if (intel_hdmi->has_audio || mode != DRM_MODE_DPMS_ON)
                enable_bits |= SDVO_AUDIO_ENABLE;
        temp = I915_READ(intel_hdmi->sdvox_reg);
diff --git a/drivers/gpu/drm/nouveau/nv50_gpio.c b/drivers/gpu/drm/nouveau/nv50_gpio.c
index f03490534893..c399d510b27a 100644
--- a/drivers/gpu/drm/nouveau/nv50_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv50_gpio.c
@@ -22,6 +22,7 @@
 * Authors: Ben Skeggs
 */
+#include <linux/dmi.h>
 #include "drmP.h"
 #include "nouveau_drv.h"
 #include "nouveau_hw.h"
@@ -110,13 +111,25 @@ nv50_gpio_isr(struct drm_device *dev)
                nv_wr32(dev, 0xe074, intr1);
 }
+static struct dmi_system_id gpio_reset_ids[] = {
+        {
+                .ident = "Apple Macbook 10,1",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro10,1"),
+                }
+        },
+        { }
+};
 int
 nv50_gpio_init(struct drm_device *dev)
 {
        struct drm_nouveau_private *dev_priv = dev->dev_private;
        /* initialise gpios and routing to vbios defaults */
-        nouveau_gpio_reset(dev);
+        if (dmi_check_system(gpio_reset_ids))
+                nouveau_gpio_reset(dev);
        /* disable, and ack any pending gpio interrupts */
        nv_wr32(dev, 0xe050, 0x00000000);
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index e721e3087b99..2817101fb167 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1479,98 +1479,14 @@ static void radeon_legacy_atom_fixup(struct drm_crtc *crtc)
        }
 }
-/**
- * radeon_get_pll_use_mask - look up a mask of which pplls are in use
- *
- * @crtc: drm crtc
- *
- * Returns the mask of which PPLLs (Pixel PLLs) are in use.
- */
-static u32 radeon_get_pll_use_mask(struct drm_crtc *crtc)
-{
-        struct drm_device *dev = crtc->dev;
-        struct drm_crtc *test_crtc;
-        struct radeon_crtc *radeon_test_crtc;
-        u32 pll_in_use = 0;
-        list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc == test_crtc)
-                        continue;
-                radeon_test_crtc = to_radeon_crtc(test_crtc);
-                if (radeon_test_crtc->pll_id != ATOM_PPLL_INVALID)
-                        pll_in_use |= (1 << radeon_test_crtc->pll_id);
-        }
-        return pll_in_use;
-}
-/**
- * radeon_get_shared_dp_ppll - return the PPLL used by another crtc for DP
- *
- * @crtc: drm crtc
- *
- * Returns the PPLL (Pixel PLL) used by another crtc/encoder which is
- * also in DP mode.  For DP, a single PPLL can be used for all DP
- * crtcs/encoders.
- */
-static int radeon_get_shared_dp_ppll(struct drm_crtc *crtc)
-{
-        struct drm_device *dev = crtc->dev;
-        struct drm_encoder *test_encoder;
-        struct radeon_crtc *radeon_test_crtc;
-        list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
-                if (test_encoder->crtc && (test_encoder->crtc != crtc)) {
-                        if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
-                                /* for DP use the same PLL for all */
-                                radeon_test_crtc = to_radeon_crtc(test_encoder->crtc);
-                                if (radeon_test_crtc->pll_id != ATOM_PPLL_INVALID)
-                                        return radeon_test_crtc->pll_id;
-                        }
-                }
-        }
-        return ATOM_PPLL_INVALID;
-}
-/**
- * radeon_atom_pick_pll - Allocate a PPLL for use by the crtc.
- *
- * @crtc: drm crtc
- *
- * Returns the PPLL (Pixel PLL) to be used by the crtc.  For DP monitors
- * a single PPLL can be used for all DP crtcs/encoders.  For non-DP
- * monitors a dedicated PPLL must be used.  If a particular board has
- * an external DP PLL, return ATOM_PPLL_INVALID to skip PLL programming
- * as there is no need to program the PLL itself.  If we are not able to
- * allocate a PLL, return ATOM_PPLL_INVALID to skip PLL programming to
- * avoid messing up an existing monitor.
- *
- * Asic specific PLL information
- *
- * DCE 6.1
- * - PPLL2 is only available to UNIPHYA (both DP and non-DP)
- * - PPLL0, PPLL1 are available for UNIPHYB/C/D/E/F (both DP and non-DP)
- *
- * DCE 6.0
- * - PPLL0 is available to all UNIPHY (DP only)
- * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
- *
- * DCE 5.0
- * - DCPLL is available to all UNIPHY (DP only)
- * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
- *
- * DCE 3.0/4.0/4.1
- * - PPLL1, PPLL2 are available for all UNIPHY (both DP and non-DP) and DAC
- *
- */
 static int radeon_atom_pick_pll(struct drm_crtc *crtc)
 {
        struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
        struct drm_device *dev = crtc->dev;
        struct radeon_device *rdev = dev->dev_private;
        struct drm_encoder *test_encoder;
-        u32 pll_in_use;
+        struct drm_crtc *test_crtc;
-        int pll;
+        uint32_t pll_in_use = 0;
        if (ASIC_IS_DCE61(rdev)) {
                list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
@@ -1582,40 +1498,32 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                if ((test_radeon_encoder->encoder_id ==
                                     ENCODER_OBJECT_ID_INTERNAL_UNIPHY) &&
-                                    (dig->linkb == false))
+                                    (dig->linkb == false)) /* UNIPHY A uses PPLL2 */
-                                        /* UNIPHY A uses PPLL2 */
                                        return ATOM_PPLL2;
-                                else if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
-                                        /* UNIPHY B/C/D/E/F */
-                                        if (rdev->clock.dp_extclk)
-                                                /* skip PPLL programming if using ext clock */
-                                                return ATOM_PPLL_INVALID;
-                                        else {
-                                                /* use the same PPLL for all DP monitors */
-                                                pll = radeon_get_shared_dp_ppll(crtc);
-                                                if (pll != ATOM_PPLL_INVALID)
-                                                        return pll;
-                                        }
-                                }
-                                break;
                        }
                }
                /* UNIPHY B/C/D/E/F */
-                pll_in_use = radeon_get_pll_use_mask(crtc);
+                list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
-                if (!(pll_in_use & (1 << ATOM_PPLL0)))
+                        struct radeon_crtc *radeon_test_crtc;
+                        if (crtc == test_crtc)
+                                continue;
+                        radeon_test_crtc = to_radeon_crtc(test_crtc);
+                        if ((radeon_test_crtc->pll_id == ATOM_PPLL0) ||
+                            (radeon_test_crtc->pll_id == ATOM_PPLL1))
+                                pll_in_use |= (1 << radeon_test_crtc->pll_id);
+                }
+                if (!(pll_in_use & 4))
                        return ATOM_PPLL0;
-                if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                return ATOM_PPLL1;
-                        return ATOM_PPLL1;
-                DRM_ERROR("unable to allocate a PPLL\n");
-                return ATOM_PPLL_INVALID;
        } else if (ASIC_IS_DCE4(rdev)) {
                list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
                        if (test_encoder->crtc && (test_encoder->crtc == crtc)) {
                                /* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock,
                                 * depending on the asic:
                                 * DCE4: PPLL or ext clock
-                                 * DCE5: PPLL, DCPLL, or ext clock
+                                 * DCE5: DCPLL or ext clock
-                                 * DCE6: PPLL, PPLL0, or ext clock
                                 *
                                 * Setting ATOM_PPLL_INVALID will cause SetPixelClock to skip
                                 * PPLL/DCPLL programming and only program the DP DTO for the
@@ -1623,34 +1531,31 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
                                 */
                                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
                                        if (rdev->clock.dp_extclk)
-                                                /* skip PPLL programming if using ext clock */
                                                return ATOM_PPLL_INVALID;
                                        else if (ASIC_IS_DCE6(rdev))
-                                                /* use PPLL0 for all DP */
                                                return ATOM_PPLL0;
                                        else if (ASIC_IS_DCE5(rdev))
-                                                /* use DCPLL for all DP */
                                                return ATOM_DCPLL;
-                                        else {
-                                                /* use the same PPLL for all DP monitors */
-                                                pll = radeon_get_shared_dp_ppll(crtc);
-                                                if (pll != ATOM_PPLL_INVALID)
-                                                        return pll;
-                                        }
                                }
-                                break;
                        }
                }
-                /* all other cases */
-                pll_in_use = radeon_get_pll_use_mask(crtc);
+                /* otherwise, pick one of the plls */
-                if (!(pll_in_use & (1 << ATOM_PPLL2)))
+                list_for_each_entry(test_crtc, &dev->mode_config.crtc_list, head) {
-                        return ATOM_PPLL2;
+                        struct radeon_crtc *radeon_test_crtc;
-                if (!(pll_in_use & (1 << ATOM_PPLL1)))
+                        if (crtc == test_crtc)
+                                continue;
+                        radeon_test_crtc = to_radeon_crtc(test_crtc);
+                        if ((radeon_test_crtc->pll_id >= ATOM_PPLL1) &&
+                            (radeon_test_crtc->pll_id <= ATOM_PPLL2))
+                                pll_in_use |= (1 << radeon_test_crtc->pll_id);
+                }
+                if (!(pll_in_use & 1))
                        return ATOM_PPLL1;
-                DRM_ERROR("unable to allocate a PPLL\n");
+                return ATOM_PPLL2;
-                return ATOM_PPLL_INVALID;
        } else
-                /* use PPLL1 or PPLL2 */
                return radeon_crtc->crtc_id;
 }
@@ -1792,7 +1697,7 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
                break;
        }
 done:
-        radeon_crtc->pll_id = ATOM_PPLL_INVALID;
+        radeon_crtc->pll_id = -1;
 }
 static const struct drm_crtc_helper_funcs atombios_helper_funcs = {
@@ -1841,6 +1746,6 @@ void radeon_atombios_init_crtc(struct drm_device *dev,
                else
                        radeon_crtc->crtc_offset = 0;
        }
-        radeon_crtc->pll_id = ATOM_PPLL_INVALID;
+        radeon_crtc->pll_id = -1;
        drm_crtc_helper_add(&radeon_crtc->base, &atombios_helper_funcs);
 }
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 8acb34fd3fd5..8d7e33a0b243 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1182,7 +1182,8 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
        ring->ready = true;
        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
-        if (radeon_ring_supports_scratch_reg(rdev, ring)) {
+        if (!ring->rptr_save_reg /* not resuming from suspend */
+            && radeon_ring_supports_scratch_reg(rdev, ring)) {
                r = radeon_scratch_get(rdev, &ring->rptr_save_reg);
                if (r) {
                        DRM_ERROR("failed to get scratch reg for rptr save (%d).\n", r);
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index 77d2df04c97b..60c4e1e85913 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -519,6 +519,8 @@ static void tpkbd_remove_tp(struct hid_device *hdev)
        led_classdev_unregister(&data_pointer->led_mute);
        hid_set_drvdata(hdev, NULL);
+        kfree(data_pointer->led_micmute.name);
+        kfree(data_pointer->led_mute.name);
        kfree(data_pointer);
 }
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 4d524b5f52f5..9500f2f3f8fe 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -193,6 +193,7 @@ static struct hid_ll_driver logi_dj_ll_driver;
 static int logi_dj_output_hidraw_report(struct hid_device *hid, u8 * buf,
                                        size_t count,
                                        unsigned char report_type);
+static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev);
 static void logi_dj_recv_destroy_djhid_device(struct dj_receiver_dev *djrcv_dev,
                                                struct dj_report *dj_report)
@@ -233,6 +234,7 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
        if (dj_report->report_params[DEVICE_PAIRED_PARAM_SPFUNCTION] &
            SPFUNCTION_DEVICE_LIST_EMPTY) {
                dbg_hid("%s: device list is empty\n", __func__);
+                djrcv_dev->querying_devices = false;
                return;
        }
@@ -243,6 +245,12 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
                return;
        }
+        if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+                /* The device is already known. No need to reallocate it. */
+                dbg_hid("%s: device is already known\n", __func__);
+                return;
+        }
        dj_hiddev = hid_allocate_device();
        if (IS_ERR(dj_hiddev)) {
                dev_err(&djrcv_hdev->dev, "%s: hid_allocate_device failed\n",
@@ -306,6 +314,7 @@ static void delayedwork_callback(struct work_struct *work)
        struct dj_report dj_report;
        unsigned long flags;
        int count;
+        int retval;
        dbg_hid("%s\n", __func__);
@@ -338,6 +347,25 @@ static void delayedwork_callback(struct work_struct *work)
                logi_dj_recv_destroy_djhid_device(djrcv_dev, &dj_report);
                break;
        default:
+        /* A normal report (i. e. not belonging to a pair/unpair notification)
+         * arriving here, means that the report arrived but we did not have a
+         * paired dj_device associated to the report's device_index, this
+         * means that the original "device paired" notification corresponding
+         * to this dj_device never arrived to this driver. The reason is that
+         * hid-core discards all packets coming from a device while probe() is
+         * executing. */
+        if (!djrcv_dev->paired_dj_devices[dj_report.device_index]) {
+                /* ok, we don't know the device, just re-ask the
+                 * receiver for the list of connected devices. */
+                retval = logi_dj_recv_query_paired_devices(djrcv_dev);
+                if (!retval) {
+                        /* everything went fine, so just leave */
+                        break;
+                }
+                dev_err(&djrcv_dev->hdev->dev,
+                        "%s:logi_dj_recv_query_paired_devices "
+                        "error:%d\n", __func__, retval);
+                }
                dbg_hid("%s: unexpected report type\n", __func__);
        }
 }
@@ -368,6 +396,12 @@ static void logi_dj_recv_forward_null_report(struct dj_receiver_dev *djrcv_dev,
        if (!djdev) {
                dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                        " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                return;
        }
@@ -398,6 +432,12 @@ static void logi_dj_recv_forward_report(struct dj_receiver_dev *djrcv_dev,
        if (dj_device == NULL) {
                dbg_hid("djrcv_dev->paired_dj_devices[dj_report->device_index]"
                        " is NULL, index %d\n", dj_report->device_index);
+                kfifo_in(&djrcv_dev->notif_fifo, dj_report, sizeof(struct dj_report));
+                if (schedule_work(&djrcv_dev->work) == 0) {
+                        dbg_hid("%s: did not schedule the work item, was already "
+                        "queued\n", __func__);
+                }
                return;
        }
@@ -439,6 +479,10 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        struct dj_report *dj_report;
        int retval;
+        /* no need to protect djrcv_dev->querying_devices */
+        if (djrcv_dev->querying_devices)
+                return 0;
        dj_report = kzalloc(sizeof(struct dj_report), GFP_KERNEL);
        if (!dj_report)
                return -ENOMEM;
@@ -450,6 +494,7 @@ static int logi_dj_recv_query_paired_devices(struct dj_receiver_dev *djrcv_dev)
        return retval;
 }
 static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
                                          unsigned timeout)
 {
diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
index fd28a5e0ca3b..4a4000340ce1 100644
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -101,6 +101,7 @@ struct dj_receiver_dev {
        struct work_struct work;
        struct kfifo notif_fifo;
        spinlock_t lock;
+        bool querying_devices;
 };
 struct dj_device {
diff --git a/drivers/hwmon/ad7314.c b/drivers/hwmon/ad7314.c
index cfec802cf9ca..f915eb1c29f7 100644
--- a/drivers/hwmon/ad7314.c
+++ b/drivers/hwmon/ad7314.c
@@ -87,10 +87,18 @@ static ssize_t ad7314_show_temperature(struct device *dev,
        }
 }
+static ssize_t ad7314_show_name(struct device *dev,
+                                struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
+static DEVICE_ATTR(name, S_IRUGO, ad7314_show_name, NULL);
 static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO,
                          ad7314_show_temperature, NULL, 0);
 static struct attribute *ad7314_attributes[] = {
+        &dev_attr_name.attr,
        &sensor_dev_attr_temp1_input.dev_attr.attr,
        NULL,
 };
diff --git a/drivers/hwmon/ads7871.c b/drivers/hwmon/ads7871.c
index e65c6e45d36b..7bf4ce3d405e 100644
--- a/drivers/hwmon/ads7871.c
+++ b/drivers/hwmon/ads7871.c
@@ -139,6 +139,12 @@ static ssize_t show_voltage(struct device *dev,
        }
 }
+static ssize_t ads7871_show_name(struct device *dev,
+                                 struct device_attribute *devattr, char *buf)
+{
+        return sprintf(buf, "%s\n", to_spi_device(dev)->modalias);
+}
 static SENSOR_DEVICE_ATTR(in0_input, S_IRUGO, show_voltage, NULL, 0);
 static SENSOR_DEVICE_ATTR(in1_input, S_IRUGO, show_voltage, NULL, 1);
 static SENSOR_DEVICE_ATTR(in2_input, S_IRUGO, show_voltage, NULL, 2);
@@ -148,6 +154,8 @@ static SENSOR_DEVICE_ATTR(in5_input, S_IRUGO, show_voltage, NULL, 5);
 static SENSOR_DEVICE_ATTR(in6_input, S_IRUGO, show_voltage, NULL, 6);
 static SENSOR_DEVICE_ATTR(in7_input, S_IRUGO, show_voltage, NULL, 7);
+static DEVICE_ATTR(name, S_IRUGO, ads7871_show_name, NULL);
 static struct attribute *ads7871_attributes[] = {
        &sensor_dev_attr_in0_input.dev_attr.attr,
        &sensor_dev_attr_in1_input.dev_attr.attr,
@@ -157,6 +165,7 @@ static struct attribute *ads7871_attributes[] = {
        &sensor_dev_attr_in5_input.dev_attr.attr,
        &sensor_dev_attr_in6_input.dev_attr.attr,
        &sensor_dev_attr_in7_input.dev_attr.attr,
+        &dev_attr_name.attr,
        NULL
 };
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 282708860517..8f3f6f2c45fd 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -53,10 +53,10 @@
 #define APPLESMC_MAX_DATA_LENGTH 32
-/* wait up to 32 ms for a status change. */
+/* wait up to 128 ms for a status change. */
 #define APPLESMC_MIN_WAIT       0x0010
 #define APPLESMC_RETRY_WAIT     0x0100
-#define APPLESMC_MAX_WAIT       0x8000
+#define APPLESMC_MAX_WAIT       0x20000
 #define APPLESMC_READ_CMD       0x10
 #define APPLESMC_WRITE_CMD      0x11
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 0fa356fe82cc..984a3f13923b 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -815,17 +815,20 @@ static int __init coretemp_init(void)
        if (err)
                goto exit;
+        get_online_cpus();
        for_each_online_cpu(i)
                get_core_online(i);
 #ifndef CONFIG_HOTPLUG_CPU
        if (list_empty(&pdev_list)) {
+                put_online_cpus();
                err = -ENODEV;
                goto exit_driver_unreg;
        }
 #endif
        register_hotcpu_notifier(&coretemp_cpu_notifier);
+        put_online_cpus();
        return 0;
 #ifndef CONFIG_HOTPLUG_CPU
@@ -840,6 +843,7 @@ static void __exit coretemp_exit(void)
 {
        struct pdev_entry *p, *n;
+        get_online_cpus();
        unregister_hotcpu_notifier(&coretemp_cpu_notifier);
        mutex_lock(&pdev_list_mutex);
        list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -848,6 +852,7 @@ static void __exit coretemp_exit(void)
                kfree(p);
        }
        mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
        platform_driver_unregister(&coretemp_driver);
 }
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index 2764b78a784b..af69073b3fe8 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -129,12 +129,12 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
 * counter saturations resulting in bogus power readings.
 * We correct this value ourselves to cope with older BIOSes.
 */
-static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
+static const struct pci_device_id affected_device[] = {
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
        { 0 }
 };
-static void __devinit tweak_runavg_range(struct pci_dev *pdev)
+static void tweak_runavg_range(struct pci_dev *pdev)
 {
        u32 val;
@@ -158,6 +158,16 @@ static void __devinit tweak_runavg_range(struct pci_dev *pdev)
                REG_TDP_RUNNING_AVERAGE, val);
 }
+#ifdef CONFIG_PM
+static int fam15h_power_resume(struct pci_dev *pdev)
+{
+        tweak_runavg_range(pdev);
+        return 0;
+}
+#else
+#define fam15h_power_resume NULL
+#endif
 static void __devinit fam15h_power_init_data(struct pci_dev *f4,
                                             struct fam15h_power_data *data)
 {
@@ -256,6 +266,7 @@ static struct pci_driver fam15h_power_driver = {
        .id_table = fam15h_power_id_table,
        .probe = fam15h_power_probe,
        .remove = __devexit_p(fam15h_power_remove),
+        .resume = fam15h_power_resume,
 };
 module_pci_driver(fam15h_power_driver);
diff --git a/drivers/hwmon/via-cputemp.c b/drivers/hwmon/via-cputemp.c
index ee4ebc198a94..2e56c6ce9fb6 100644
--- a/drivers/hwmon/via-cputemp.c
+++ b/drivers/hwmon/via-cputemp.c
@@ -328,6 +328,7 @@ static int __init via_cputemp_init(void)
        if (err)
                goto exit;
+        get_online_cpus();
        for_each_online_cpu(i) {
                struct cpuinfo_x86 *c = &cpu_data(i);
@@ -347,12 +348,14 @@ static int __init via_cputemp_init(void)
 #ifndef CONFIG_HOTPLUG_CPU
        if (list_empty(&pdev_list)) {
+                put_online_cpus();
                err = -ENODEV;
                goto exit_driver_unreg;
        }
 #endif
        register_hotcpu_notifier(&via_cputemp_cpu_notifier);
+        put_online_cpus();
        return 0;
 #ifndef CONFIG_HOTPLUG_CPU
@@ -367,6 +370,7 @@ static void __exit via_cputemp_exit(void)
 {
        struct pdev_entry *p, *n;
+        get_online_cpus();
        unregister_hotcpu_notifier(&via_cputemp_cpu_notifier);
        mutex_lock(&pdev_list_mutex);
        list_for_each_entry_safe(p, n, &pdev_list, list) {
@@ -375,6 +379,7 @@ static void __exit via_cputemp_exit(void)
                kfree(p);
        }
        mutex_unlock(&pdev_list_mutex);
+        put_online_cpus();
        platform_driver_unregister(&via_cputemp_driver);
 }
diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
index 1201a15784c3..db713c0dfba4 100644
--- a/drivers/hwspinlock/hwspinlock_core.c
+++ b/drivers/hwspinlock/hwspinlock_core.c
@@ -552,7 +552,7 @@ EXPORT_SYMBOL_GPL(hwspin_lock_request_specific);
 */
 int hwspin_lock_free(struct hwspinlock *hwlock)
 {
-        struct device *dev = hwlock->bank->dev;
+        struct device *dev;
        struct hwspinlock *tmp;
        int ret;
@@ -561,6 +561,7 @@ int hwspin_lock_free(struct hwspinlock *hwlock)
                return -EINVAL;
        }
+        dev = hwlock->bank->dev;
        mutex_lock(&hwspinlock_tree_lock);
        /* make sure the hwspinlock is used */
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 51f42061dae9..6cfd4d8fd0bd 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1361,11 +1361,11 @@ static int abort_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
        struct tid_info *t = dev->rdev.lldi.tids;
        ep = lookup_tid(t, tid);
-        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
        if (!ep) {
                printk(KERN_WARNING MOD "Abort rpl to freed endpoint\n");
                return 0;
        }
+        PDBG("%s ep %p tid %u\n", __func__, ep, ep->hwtid);
        mutex_lock(&ep->com.mutex);
        switch (ep->com.state) {
        case ABORTING:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index cb5b7f7d4d38..b29a4246ef41 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -2219,7 +2219,6 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
        u32 wqe_idx;
        if (!qp->wqe_wr_id_tbl[tail].signaled) {
-                expand = true;  /* CQE cannot be consumed yet */
                *polled = false;    /* WC cannot be consumed yet */
        } else {
                ibwc->status = IB_WC_SUCCESS;
@@ -2227,10 +2226,11 @@ static bool ocrdma_poll_success_scqe(struct ocrdma_qp *qp,
                ibwc->qp = &qp->ibqp;
                ocrdma_update_wc(qp, ibwc, tail);
                *polled = true;
-                wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
-                if (tail != wqe_idx)
-                        expand = true; /* Coalesced CQE can't be consumed yet */
        }
+        wqe_idx = le32_to_cpu(cqe->wq.wqeidx) & OCRDMA_CQE_WQEIDX_MASK;
+        if (tail != wqe_idx)
+                expand = true; /* Coalesced CQE can't be consumed yet */
        ocrdma_hwq_inc_tail(&qp->sq);
        return expand;
 }
diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
index 19f1e6c45fb6..ccb119143d20 100644
--- a/drivers/infiniband/hw/qib/qib_mad.c
+++ b/drivers/infiniband/hw/qib/qib_mad.c
@@ -471,9 +471,10 @@ static int subn_get_portinfo(struct ib_smp *smp, struct ib_device *ibdev,
                if (port_num != port) {
                        ibp = to_iport(ibdev, port_num);
                        ret = check_mkey(ibp, smp, 0);
-                        if (ret)
+                        if (ret) {
                                ret = IB_MAD_RESULT_FAILURE;
                                goto bail;
+                        }
                }
        }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index ca43901ed861..0af216d21f87 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -262,7 +262,10 @@ struct ipoib_ethtool_st {
        u16     max_coalesced_frames;
 };
+struct ipoib_neigh_table;
 struct ipoib_neigh_hash {
+        struct ipoib_neigh_table       *ntbl;
        struct ipoib_neigh __rcu      **buckets;
        struct rcu_head                 rcu;
        u32                             mask;
@@ -271,9 +274,9 @@ struct ipoib_neigh_hash {
 struct ipoib_neigh_table {
        struct ipoib_neigh_hash __rcu  *htbl;
-        rwlock_t                        rwlock;
        atomic_t                        entries;
        struct completion               flushed;
+        struct completion               deleted;
 };
 /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 3e2085a3ee47..1e19b5ae7c47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -546,15 +546,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr,
        struct ipoib_neigh *neigh;
        unsigned long flags;
+        spin_lock_irqsave(&priv->lock, flags);
        neigh = ipoib_neigh_alloc(daddr, dev);
        if (!neigh) {
+                spin_unlock_irqrestore(&priv->lock, flags);
                ++dev->stats.tx_dropped;
                dev_kfree_skb_any(skb);
                return;
        }
-        spin_lock_irqsave(&priv->lock, flags);
        path = __path_find(dev, daddr + 4);
        if (!path) {
                path = path_rec_create(dev, daddr + 4);
@@ -863,10 +863,10 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
        if (test_bit(IPOIB_STOP_NEIGH_GC, &priv->flags))
                return;
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
        htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
        if (!htbl)
                goto out_unlock;
@@ -883,16 +883,14 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
                struct ipoib_neigh __rcu **np = &htbl->buckets[i];
                while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                        /* was the neigh idle for two GC periods */
                        if (time_after(neigh_obsolete, neigh->alive)) {
                                rcu_assign_pointer(*np,
                                                   rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                /* remove from path/mc list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                        } else {
                                np = &neigh->hnext;
@@ -902,7 +900,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
        }
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 static void ipoib_reap_neigh(struct work_struct *work)
@@ -947,10 +945,8 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
        struct ipoib_neigh *neigh;
        u32 hash_val;
-        write_lock_bh(&ntbl->rwlock);
        htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
        if (!htbl) {
                neigh = NULL;
                goto out_unlock;
@@ -961,10 +957,10 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
         */
        hash_val = ipoib_addr_hash(htbl, daddr);
        for (neigh = rcu_dereference_protected(htbl->buckets[hash_val],
-                                               lockdep_is_held(&ntbl->rwlock));
+                                               lockdep_is_held(&priv->lock));
             neigh != NULL;
             neigh = rcu_dereference_protected(neigh->hnext,
-                                               lockdep_is_held(&ntbl->rwlock))) {
+                                               lockdep_is_held(&priv->lock))) {
                if (memcmp(daddr, neigh->daddr, INFINIBAND_ALEN) == 0) {
                        /* found, take one ref on behalf of the caller */
                        if (!atomic_inc_not_zero(&neigh->refcnt)) {
@@ -987,12 +983,11 @@ struct ipoib_neigh *ipoib_neigh_alloc(u8 *daddr,
        /* put in hash */
        rcu_assign_pointer(neigh->hnext,
                           rcu_dereference_protected(htbl->buckets[hash_val],
-                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                     lockdep_is_held(&priv->lock)));
        rcu_assign_pointer(htbl->buckets[hash_val], neigh);
        atomic_inc(&ntbl->entries);
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
        return neigh;
 }
@@ -1040,35 +1035,29 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
        struct ipoib_neigh *n;
        u32 hash_val;
-        write_lock_bh(&ntbl->rwlock);
        htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
        if (!htbl)
-                goto out_unlock;
+                return;
        hash_val = ipoib_addr_hash(htbl, neigh->daddr);
        np = &htbl->buckets[hash_val];
        for (n = rcu_dereference_protected(*np,
-                                            lockdep_is_held(&ntbl->rwlock));
+                                            lockdep_is_held(&priv->lock));
             n != NULL;
             n = rcu_dereference_protected(*np,
-                                        lockdep_is_held(&ntbl->rwlock))) {
+                                        lockdep_is_held(&priv->lock))) {
                if (n == neigh) {
                        /* found */
                        rcu_assign_pointer(*np,
                                           rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                        call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
-                        goto out_unlock;
+                        return;
                } else {
                        np = &n->hnext;
                }
        }
-out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
 }
 static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
@@ -1080,7 +1069,6 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
        clear_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
        ntbl->htbl = NULL;
-        rwlock_init(&ntbl->rwlock);
        htbl = kzalloc(sizeof(*htbl), GFP_KERNEL);
        if (!htbl)
                return -ENOMEM;
@@ -1095,6 +1083,7 @@ static int ipoib_neigh_hash_init(struct ipoib_dev_priv *priv)
        htbl->mask = (size - 1);
        htbl->buckets = buckets;
        ntbl->htbl = htbl;
+        htbl->ntbl = ntbl;
        atomic_set(&ntbl->entries, 0);
        /* start garbage collection */
@@ -1111,9 +1100,11 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
                                                    struct ipoib_neigh_hash,
                                                    rcu);
        struct ipoib_neigh __rcu **buckets = htbl->buckets;
+        struct ipoib_neigh_table *ntbl = htbl->ntbl;
        kfree(buckets);
        kfree(htbl);
+        complete(&ntbl->deleted);
 }
 void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
@@ -1125,10 +1116,10 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
        int i;
        /* remove all neigh connected to a given path or mcast */
-        write_lock_bh(&ntbl->rwlock);
+        spin_lock_irqsave(&priv->lock, flags);
        htbl = rcu_dereference_protected(ntbl->htbl,
-                                         lockdep_is_held(&ntbl->rwlock));
+                                         lockdep_is_held(&priv->lock));
        if (!htbl)
                goto out_unlock;
@@ -1138,16 +1129,14 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                struct ipoib_neigh __rcu **np = &htbl->buckets[i];
                while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                                          lockdep_is_held(&priv->lock))) != NULL) {
                        /* delete neighs belong to this parent */
                        if (!memcmp(gid, neigh->daddr + 4, sizeof (union ib_gid))) {
                                rcu_assign_pointer(*np,
                                                   rcu_dereference_protected(neigh->hnext,
-                                                                             lockdep_is_held(&ntbl->rwlock)));
+                                                                             lockdep_is_held(&priv->lock)));
                                /* remove from parent list */
-                                spin_lock_irqsave(&priv->lock, flags);
                                list_del(&neigh->list);
-                                spin_unlock_irqrestore(&priv->lock, flags);
                                call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                        } else {
                                np = &neigh->hnext;
@@ -1156,7 +1145,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
                }
        }
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
 }
 static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
@@ -1164,37 +1153,44 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
        struct ipoib_neigh_table *ntbl = &priv->ntbl;
        struct ipoib_neigh_hash *htbl;
        unsigned long flags;
-        int i;
+        int i, wait_flushed = 0;
-        write_lock_bh(&ntbl->rwlock);
+        init_completion(&priv->ntbl.flushed);
+        spin_lock_irqsave(&priv->lock, flags);
        htbl = rcu_dereference_protected(ntbl->htbl,
-                                        lockdep_is_held(&ntbl->rwlock));
+                                        lockdep_is_held(&priv->lock));
        if (!htbl)
                goto out_unlock;
+        wait_flushed = atomic_read(&priv->ntbl.entries);
+        if (!wait_flushed)
+                goto free_htbl;
        for (i = 0; i < htbl->size; i++) {
                struct ipoib_neigh *neigh;
                struct ipoib_neigh __rcu **np = &htbl->buckets[i];
                while ((neigh = rcu_dereference_protected(*np,
-                                                          lockdep_is_held(&ntbl->rwlock))) != NULL) {
+                                       lockdep_is_held(&priv->lock))) != NULL) {
                        rcu_assign_pointer(*np,
                                           rcu_dereference_protected(neigh->hnext,
-                                                                     lockdep_is_held(&ntbl->rwlock)));
+                                                                     lockdep_is_held(&priv->lock)));
                        /* remove from path/mc list */
-                        spin_lock_irqsave(&priv->lock, flags);
                        list_del(&neigh->list);
-                        spin_unlock_irqrestore(&priv->lock, flags);
                        call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
                }
        }
+free_htbl:
        rcu_assign_pointer(ntbl->htbl, NULL);
        call_rcu(&htbl->rcu, neigh_hash_free_rcu);
 out_unlock:
-        write_unlock_bh(&ntbl->rwlock);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        if (wait_flushed)
+                wait_for_completion(&priv->ntbl.flushed);
 }
 static void ipoib_neigh_hash_uninit(struct net_device *dev)
@@ -1203,7 +1199,7 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
        int stopped;
        ipoib_dbg(priv, "ipoib_neigh_hash_uninit\n");
-        init_completion(&priv->ntbl.flushed);
+        init_completion(&priv->ntbl.deleted);
        set_bit(IPOIB_NEIGH_TBL_FLUSH, &priv->flags);
        /* Stop GC if called at init fail need to cancel work */
@@ -1211,10 +1207,9 @@ static void ipoib_neigh_hash_uninit(struct net_device *dev)
        if (!stopped)
                cancel_delayed_work(&priv->neigh_reap_task);
-        if (atomic_read(&priv->ntbl.entries)) {
+        ipoib_flush_neighs(priv);
-                ipoib_flush_neighs(priv);
-                wait_for_completion(&priv->ntbl.flushed);
+        wait_for_completion(&priv->ntbl.deleted);
-        }
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 13f4aa7593c8..75367249f447 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -707,9 +707,7 @@ out:
                neigh = ipoib_neigh_get(dev, daddr);
                spin_lock_irqsave(&priv->lock, flags);
                if (!neigh) {
-                        spin_unlock_irqrestore(&priv->lock, flags);
                        neigh = ipoib_neigh_alloc(daddr, dev);
-                        spin_lock_irqsave(&priv->lock, flags);
                        if (neigh) {
                                kref_get(&mcast->ah->ref);
                                neigh->ah       = mcast->ah;
diff --git a/drivers/input/keyboard/imx_keypad.c b/drivers/input/keyboard/imx_keypad.c
index ce68e361558c..cdc252612c0b 100644
--- a/drivers/input/keyboard/imx_keypad.c
+++ b/drivers/input/keyboard/imx_keypad.c
@@ -516,9 +516,9 @@ static int __devinit imx_keypad_probe(struct platform_device *pdev)
        input_set_drvdata(input_dev, keypad);
        /* Ensure that the keypad will stay dormant until opened */
-        clk_enable(keypad->clk);
+        clk_prepare_enable(keypad->clk);
        imx_keypad_inhibit(keypad);
-        clk_disable(keypad->clk);
+        clk_disable_unprepare(keypad->clk);
        error = request_irq(irq, imx_keypad_irq_handler, 0,
                            pdev->name, keypad);
diff --git a/drivers/input/misc/ab8500-ponkey.c b/drivers/input/misc/ab8500-ponkey.c
index f06231b7cab1..84ec691c05aa 100644
--- a/drivers/input/misc/ab8500-ponkey.c
+++ b/drivers/input/misc/ab8500-ponkey.c
@@ -74,8 +74,8 @@ static int __devinit ab8500_ponkey_probe(struct platform_device *pdev)
        ponkey->idev = input;
        ponkey->ab8500 = ab8500;
-        ponkey->irq_dbf = ab8500_irq_get_virq(ab8500, irq_dbf);
+        ponkey->irq_dbf = irq_dbf;
-        ponkey->irq_dbr = ab8500_irq_get_virq(ab8500, irq_dbr);
+        ponkey->irq_dbr = irq_dbr;
        input->name = "AB8500 POn(PowerOn) Key";
        input->dev.parent = &pdev->dev;
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 3f5649f19082..a261d8576919 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -721,6 +721,17 @@ static psmouse_ret_t fsp_process_byte(struct psmouse *psmouse)
        switch (psmouse->packet[0] >> FSP_PKT_TYPE_SHIFT) {
        case FSP_PKT_TYPE_ABS:
+                if ((packet[0] == 0x48 || packet[0] == 0x49) &&
+                    packet[1] == 0 && packet[2] == 0) {
+                        /*
+                         * Ignore coordinate noise when finger leaving the
+                         * surface, otherwise cursor may jump to upper-left
+                         * corner.
+                         */
+                        packet[3] &= 0xf0;
+                }
                abs_x = GET_ABS_X(packet);
                abs_y = GET_ABS_Y(packet);
diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c
index 2ffd110bd5bc..2e77246c2e5a 100644
--- a/drivers/input/serio/ambakmi.c
+++ b/drivers/input/serio/ambakmi.c
@@ -72,7 +72,7 @@ static int amba_kmi_open(struct serio *io)
        unsigned int divisor;
        int ret;
-        ret = clk_enable(kmi->clk);
+        ret = clk_prepare_enable(kmi->clk);
        if (ret)
                goto out;
@@ -92,7 +92,7 @@ static int amba_kmi_open(struct serio *io)
        return 0;
 clk_disable:
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
 out:
        return ret;
 }
@@ -104,7 +104,7 @@ static void amba_kmi_close(struct serio *io)
        writeb(0, KMICR);
        free_irq(kmi->irq, kmi);
-        clk_disable(kmi->clk);
+        clk_disable_unprepare(kmi->clk);
 }
 static int __devinit amba_kmi_probe(struct amba_device *dev,
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index 6918773ce024..d6cc77a53c7e 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -335,6 +335,12 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
        },
        {
                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
                        DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
                },
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index b06a5e3a665e..64957770b522 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -566,9 +566,12 @@ static ssize_t edt_ft5x06_debugfs_raw_data_read(struct file *file,
        }
        read = min_t(size_t, count, tsdata->raw_bufsize - *off);
-        error = copy_to_user(buf, tsdata->raw_buffer + *off, read);
+        if (copy_to_user(buf, tsdata->raw_buffer + *off, read)) {
-        if (!error)
+                error = -EFAULT;
-                *off += read;
+                goto out;
+        }
+        *off += read;
 out:
        mutex_unlock(&tsdata->mutex);
        return error ?: read;
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index e32709e0dd65..721fdb3597ca 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -304,6 +304,45 @@ static int e2i_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 #define EGALAX_PKT_TYPE_REPT            0x80
 #define EGALAX_PKT_TYPE_DIAG            0x0A
+static int egalax_init(struct usbtouch_usb *usbtouch)
+{
+        int ret, i;
+        unsigned char *buf;
+        struct usb_device *udev = interface_to_usbdev(usbtouch->interface);
+        /*
+         * An eGalax diagnostic packet kicks the device into using the right
+         * protocol.  We send a "check active" packet.  The response will be
+         * read later and ignored.
+         */
+        buf = kmalloc(3, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        buf[0] = EGALAX_PKT_TYPE_DIAG;
+        buf[1] = 1;     /* length */
+        buf[2] = 'A';   /* command - check active */
+        for (i = 0; i < 3; i++) {
+                ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                      0,
+                                      USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                      0, 0, buf, 3,
+                                      USB_CTRL_SET_TIMEOUT);
+                if (ret >= 0) {
+                        ret = 0;
+                        break;
+                }
+                if (ret != -EPIPE)
+                        break;
+        }
+        kfree(buf);
+        return ret;
+}
 static int egalax_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
        if ((pkt[0] & EGALAX_PKT_TYPE_MASK) != EGALAX_PKT_TYPE_REPT)
@@ -1056,6 +1095,7 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
                .process_pkt    = usbtouch_process_multi,
                .get_pkt_len    = egalax_get_pkt_len,
                .read_data      = egalax_read_data,
+                .init           = egalax_init,
        },
 #endif
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3f6203a4c7ea..308e87b417e0 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -7619,6 +7619,8 @@ static int remove_and_add_spares(struct mddev *mddev)
                        }
                }
        }
+        if (removed)
+                set_bit(MD_CHANGE_DEVS, &mddev->flags);
        return spares;
 }
@@ -7632,9 +7634,11 @@ static void reap_sync_thread(struct mddev *mddev)
            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                /* success...*/
                /* activate any spares */
-                if (mddev->pers->spare_active(mddev))
+                if (mddev->pers->spare_active(mddev)) {
                        sysfs_notify(&mddev->kobj, NULL,
                                     "degraded");
+                        set_bit(MD_CHANGE_DEVS, &mddev->flags);
+                }
        }
        if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) &&
            mddev->pers->finish_reshape)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index adda94df5eb2..7031b865b3a0 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -393,6 +393,8 @@ static int calc_degraded(struct r5conf *conf)
        degraded = 0;
        for (i = 0; i < conf->previous_raid_disks; i++) {
                struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                if (!rdev || test_bit(Faulty, &rdev->flags))
                        degraded++;
                else if (test_bit(In_sync, &rdev->flags))
@@ -417,6 +419,8 @@ static int calc_degraded(struct r5conf *conf)
        degraded2 = 0;
        for (i = 0; i < conf->raid_disks; i++) {
                struct md_rdev *rdev = rcu_dereference(conf->disks[i].rdev);
+                if (rdev && test_bit(Faulty, &rdev->flags))
+                        rdev = rcu_dereference(conf->disks[i].replacement);
                if (!rdev || test_bit(Faulty, &rdev->flags))
                        degraded2++;
                else if (test_bit(In_sync, &rdev->flags))
@@ -4192,7 +4196,7 @@ static void make_request(struct mddev *mddev, struct bio * bi)
                        finish_wait(&conf->wait_for_overlap, &w);
                        set_bit(STRIPE_HANDLE, &sh->state);
                        clear_bit(STRIPE_DELAYED, &sh->state);
-                        if ((bi->bi_rw & REQ_NOIDLE) &&
+                        if ((bi->bi_rw & REQ_SYNC) &&
                            !test_and_set_bit(STRIPE_PREREAD_ACTIVE, &sh->state))
                                atomic_inc(&conf->preread_active_stripes);
                        release_stripe_plug(mddev, sh);
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index ad3fcea1269e..bb4c2bf04d09 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -41,91 +41,13 @@
 #include <linux/gpio.h>
 #include <linux/regulator/consumer.h>
 #include <linux/module.h>
-#include <linux/fsl/mxs-dma.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/stmp_device.h>
 #include <linux/mmc/mxs-mmc.h>
+#include <linux/spi/mxs-spi.h>
 #define DRIVER_NAME     "mxs-mmc"
-/* card detect polling timeout */
-#define MXS_MMC_DETECT_TIMEOUT                  (HZ/2)
-#define ssp_is_old(host)        ((host)->devid == IMX23_MMC)
-/* SSP registers */
-#define HW_SSP_CTRL0                            0x000
-#define  BM_SSP_CTRL0_RUN                       (1 << 29)
-#define  BM_SSP_CTRL0_SDIO_IRQ_CHECK            (1 << 28)
-#define  BM_SSP_CTRL0_IGNORE_CRC                (1 << 26)
-#define  BM_SSP_CTRL0_READ                      (1 << 25)
-#define  BM_SSP_CTRL0_DATA_XFER                 (1 << 24)
-#define  BP_SSP_CTRL0_BUS_WIDTH                 (22)
-#define  BM_SSP_CTRL0_BUS_WIDTH                 (0x3 << 22)
-#define  BM_SSP_CTRL0_WAIT_FOR_IRQ              (1 << 21)
-#define  BM_SSP_CTRL0_LONG_RESP                 (1 << 19)
-#define  BM_SSP_CTRL0_GET_RESP                  (1 << 17)
-#define  BM_SSP_CTRL0_ENABLE                    (1 << 16)
-#define  BP_SSP_CTRL0_XFER_COUNT                (0)
-#define  BM_SSP_CTRL0_XFER_COUNT                (0xffff)
-#define HW_SSP_CMD0                             0x010
-#define  BM_SSP_CMD0_DBL_DATA_RATE_EN           (1 << 25)
-#define  BM_SSP_CMD0_SLOW_CLKING_EN             (1 << 22)
-#define  BM_SSP_CMD0_CONT_CLKING_EN             (1 << 21)
-#define  BM_SSP_CMD0_APPEND_8CYC                (1 << 20)
-#define  BP_SSP_CMD0_BLOCK_SIZE                 (16)
-#define  BM_SSP_CMD0_BLOCK_SIZE                 (0xf << 16)
-#define  BP_SSP_CMD0_BLOCK_COUNT                (8)
-#define  BM_SSP_CMD0_BLOCK_COUNT                (0xff << 8)
-#define  BP_SSP_CMD0_CMD                        (0)
-#define  BM_SSP_CMD0_CMD                        (0xff)
-#define HW_SSP_CMD1                             0x020
-#define HW_SSP_XFER_SIZE                        0x030
-#define HW_SSP_BLOCK_SIZE                       0x040
-#define  BP_SSP_BLOCK_SIZE_BLOCK_COUNT          (4)
-#define  BM_SSP_BLOCK_SIZE_BLOCK_COUNT          (0xffffff << 4)
-#define  BP_SSP_BLOCK_SIZE_BLOCK_SIZE           (0)
-#define  BM_SSP_BLOCK_SIZE_BLOCK_SIZE           (0xf)
-#define HW_SSP_TIMING(h)                        (ssp_is_old(h) ? 0x050 : 0x070)
-#define  BP_SSP_TIMING_TIMEOUT                  (16)
-#define  BM_SSP_TIMING_TIMEOUT                  (0xffff << 16)
-#define  BP_SSP_TIMING_CLOCK_DIVIDE             (8)
-#define  BM_SSP_TIMING_CLOCK_DIVIDE             (0xff << 8)
-#define  BP_SSP_TIMING_CLOCK_RATE               (0)
-#define  BM_SSP_TIMING_CLOCK_RATE               (0xff)
-#define HW_SSP_CTRL1(h)                         (ssp_is_old(h) ? 0x060 : 0x080)
-#define  BM_SSP_CTRL1_SDIO_IRQ                  (1 << 31)
-#define  BM_SSP_CTRL1_SDIO_IRQ_EN               (1 << 30)
-#define  BM_SSP_CTRL1_RESP_ERR_IRQ              (1 << 29)
-#define  BM_SSP_CTRL1_RESP_ERR_IRQ_EN           (1 << 28)
-#define  BM_SSP_CTRL1_RESP_TIMEOUT_IRQ          (1 << 27)
-#define  BM_SSP_CTRL1_RESP_TIMEOUT_IRQ_EN       (1 << 26)
-#define  BM_SSP_CTRL1_DATA_TIMEOUT_IRQ          (1 << 25)
-#define  BM_SSP_CTRL1_DATA_TIMEOUT_IRQ_EN       (1 << 24)
-#define  BM_SSP_CTRL1_DATA_CRC_IRQ              (1 << 23)
-#define  BM_SSP_CTRL1_DATA_CRC_IRQ_EN           (1 << 22)
-#define  BM_SSP_CTRL1_FIFO_UNDERRUN_IRQ         (1 << 21)
-#define  BM_SSP_CTRL1_FIFO_UNDERRUN_IRQ_EN      (1 << 20)
-#define  BM_SSP_CTRL1_RECV_TIMEOUT_IRQ          (1 << 17)
-#define  BM_SSP_CTRL1_RECV_TIMEOUT_IRQ_EN       (1 << 16)
-#define  BM_SSP_CTRL1_FIFO_OVERRUN_IRQ          (1 << 15)
-#define  BM_SSP_CTRL1_FIFO_OVERRUN_IRQ_EN       (1 << 14)
-#define  BM_SSP_CTRL1_DMA_ENABLE                (1 << 13)
-#define  BM_SSP_CTRL1_POLARITY                  (1 << 9)
-#define  BP_SSP_CTRL1_WORD_LENGTH               (4)
-#define  BM_SSP_CTRL1_WORD_LENGTH               (0xf << 4)
-#define  BP_SSP_CTRL1_SSP_MODE                  (0)
-#define  BM_SSP_CTRL1_SSP_MODE                  (0xf)
-#define HW_SSP_SDRESP0(h)                       (ssp_is_old(h) ? 0x080 : 0x0a0)
-#define HW_SSP_SDRESP1(h)                       (ssp_is_old(h) ? 0x090 : 0x0b0)
-#define HW_SSP_SDRESP2(h)                       (ssp_is_old(h) ? 0x0a0 : 0x0c0)
-#define HW_SSP_SDRESP3(h)                       (ssp_is_old(h) ? 0x0b0 : 0x0d0)
-#define HW_SSP_STATUS(h)                        (ssp_is_old(h) ? 0x0c0 : 0x100)
-#define  BM_SSP_STATUS_CARD_DETECT              (1 << 28)
-#define  BM_SSP_STATUS_SDIO_IRQ                 (1 << 17)
-#define BF_SSP(value, field)    (((value) << BP_SSP_##field) & BM_SSP_##field)
 #define MXS_MMC_IRQ_BITS        (BM_SSP_CTRL1_SDIO_IRQ          | \
                                 BM_SSP_CTRL1_RESP_ERR_IRQ      | \
                                 BM_SSP_CTRL1_RESP_TIMEOUT_IRQ  | \
@@ -135,31 +57,17 @@
                                 BM_SSP_CTRL1_RECV_TIMEOUT_IRQ  | \
                                 BM_SSP_CTRL1_FIFO_OVERRUN_IRQ)
-#define SSP_PIO_NUM     3
+/* card detect polling timeout */
+#define MXS_MMC_DETECT_TIMEOUT                  (HZ/2)
-enum mxs_mmc_id {
-        IMX23_MMC,
-        IMX28_MMC,
-};
 struct mxs_mmc_host {
+        struct mxs_ssp                  ssp;
        struct mmc_host                 *mmc;
        struct mmc_request              *mrq;
        struct mmc_command              *cmd;
        struct mmc_data                 *data;
-        void __iomem                    *base;
-        int                             dma_channel;
-        struct clk                      *clk;
-        unsigned int                    clk_rate;
-        struct dma_chan                 *dmach;
-        struct mxs_dma_data             dma_data;
-        unsigned int                    dma_dir;
-        enum dma_transfer_direction     slave_dirn;
-        u32                             ssp_pio_words[SSP_PIO_NUM];
-        enum mxs_mmc_id                 devid;
        unsigned char                   bus_width;
        spinlock_t                      lock;
        int                             sdio_irq_en;
@@ -186,16 +94,18 @@ static int mxs_mmc_get_ro(struct mmc_host *mmc)
 static int mxs_mmc_get_cd(struct mmc_host *mmc)
 {
        struct mxs_mmc_host *host = mmc_priv(mmc);
+        struct mxs_ssp *ssp = &host->ssp;
-        return !(readl(host->base + HW_SSP_STATUS(host)) &
+        return !(readl(ssp->base + HW_SSP_STATUS(ssp)) &
                 BM_SSP_STATUS_CARD_DETECT);
 }
 static void mxs_mmc_reset(struct mxs_mmc_host *host)
 {
+        struct mxs_ssp *ssp = &host->ssp;
        u32 ctrl0, ctrl1;
-        stmp_reset_block(host->base);
+        stmp_reset_block(ssp->base);
        ctrl0 = BM_SSP_CTRL0_IGNORE_CRC;
        ctrl1 = BF_SSP(0x3, CTRL1_SSP_MODE) |
@@ -211,15 +121,15 @@ static void mxs_mmc_reset(struct mxs_mmc_host *host)
        writel(BF_SSP(0xffff, TIMING_TIMEOUT) |
               BF_SSP(2, TIMING_CLOCK_DIVIDE) |
               BF_SSP(0, TIMING_CLOCK_RATE),
-               host->base + HW_SSP_TIMING(host));
+               ssp->base + HW_SSP_TIMING(ssp));
        if (host->sdio_irq_en) {
                ctrl0 |= BM_SSP_CTRL0_SDIO_IRQ_CHECK;
                ctrl1 |= BM_SSP_CTRL1_SDIO_IRQ_EN;
        }
-        writel(ctrl0, host->base + HW_SSP_CTRL0);
+        writel(ctrl0, ssp->base + HW_SSP_CTRL0);
-        writel(ctrl1, host->base + HW_SSP_CTRL1(host));
+        writel(ctrl1, ssp->base + HW_SSP_CTRL1(ssp));
 }
 static void mxs_mmc_start_cmd(struct mxs_mmc_host *host,
@@ -230,21 +140,22 @@ static void mxs_mmc_request_done(struct mxs_mmc_host *host)
        struct mmc_command *cmd = host->cmd;
        struct mmc_data *data = host->data;
        struct mmc_request *mrq = host->mrq;
+        struct mxs_ssp *ssp = &host->ssp;
        if (mmc_resp_type(cmd) & MMC_RSP_PRESENT) {
                if (mmc_resp_type(cmd) & MMC_RSP_136) {
-                        cmd->resp[3] = readl(host->base + HW_SSP_SDRESP0(host));
+                        cmd->resp[3] = readl(ssp->base + HW_SSP_SDRESP0(ssp));
-                        cmd->resp[2] = readl(host->base + HW_SSP_SDRESP1(host));
+                        cmd->resp[2] = readl(ssp->base + HW_SSP_SDRESP1(ssp));
-                        cmd->resp[1] = readl(host->base + HW_SSP_SDRESP2(host));
+                        cmd->resp[1] = readl(ssp->base + HW_SSP_SDRESP2(ssp));
-                        cmd->resp[0] = readl(host->base + HW_SSP_SDRESP3(host));
+                        cmd->resp[0] = readl(ssp->base + HW_SSP_SDRESP3(ssp));
                } else {
-                        cmd->resp[0] = readl(host->base + HW_SSP_SDRESP0(host));
+                        cmd->resp[0] = readl(ssp->base + HW_SSP_SDRESP0(ssp));
                }
        }
        if (data) {
                dma_unmap_sg(mmc_dev(host->mmc), data->sg,
-                             data->sg_len, host->dma_dir);
+                             data->sg_len, ssp->dma_dir);
                /*
                 * If there was an error on any block, we mark all
                 * data blocks as being in error.
@@ -277,13 +188,14 @@ static irqreturn_t mxs_mmc_irq_handler(int irq, void *dev_id)
        struct mxs_mmc_host *host = dev_id;
        struct mmc_command *cmd = host->cmd;
        struct mmc_data *data = host->data;
+        struct mxs_ssp *ssp = &host->ssp;
        u32 stat;
        spin_lock(&host->lock);
-        stat = readl(host->base + HW_SSP_CTRL1(host));
+        stat = readl(ssp->base + HW_SSP_CTRL1(ssp));
        writel(stat & MXS_MMC_IRQ_BITS,
-               host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
+               ssp->base + HW_SSP_CTRL1(ssp) + STMP_OFFSET_REG_CLR);
        spin_unlock(&host->lock);
@@ -312,6 +224,7 @@ static irqreturn_t mxs_mmc_irq_handler(int irq, void *dev_id)
 static struct dma_async_tx_descriptor *mxs_mmc_prep_dma(
        struct mxs_mmc_host *host, unsigned long flags)
 {
+        struct mxs_ssp *ssp = &host->ssp;
        struct dma_async_tx_descriptor *desc;
        struct mmc_data *data = host->data;
        struct scatterlist * sgl;
@@ -320,24 +233,24 @@ static struct dma_async_tx_descriptor *mxs_mmc_prep_dma(
        if (data) {
                /* data */
                dma_map_sg(mmc_dev(host->mmc), data->sg,
-                           data->sg_len, host->dma_dir);
+                           data->sg_len, ssp->dma_dir);
                sgl = data->sg;
                sg_len = data->sg_len;
        } else {
                /* pio */
-                sgl = (struct scatterlist *) host->ssp_pio_words;
+                sgl = (struct scatterlist *) ssp->ssp_pio_words;
                sg_len = SSP_PIO_NUM;
        }
-        desc = dmaengine_prep_slave_sg(host->dmach,
+        desc = dmaengine_prep_slave_sg(ssp->dmach,
-                                sgl, sg_len, host->slave_dirn, flags);
+                                sgl, sg_len, ssp->slave_dirn, flags);
        if (desc) {
                desc->callback = mxs_mmc_dma_irq_callback;
                desc->callback_param = host;
        } else {
                if (data)
                        dma_unmap_sg(mmc_dev(host->mmc), data->sg,
-                                     data->sg_len, host->dma_dir);
+                                     data->sg_len, ssp->dma_dir);
        }
        return desc;
@@ -345,6 +258,7 @@ static struct dma_async_tx_descriptor *mxs_mmc_prep_dma(
 static void mxs_mmc_bc(struct mxs_mmc_host *host)
 {
+        struct mxs_ssp *ssp = &host->ssp;
        struct mmc_command *cmd = host->cmd;
        struct dma_async_tx_descriptor *desc;
        u32 ctrl0, cmd0, cmd1;
@@ -358,17 +272,17 @@ static void mxs_mmc_bc(struct mxs_mmc_host *host)
                cmd0 |= BM_SSP_CMD0_CONT_CLKING_EN | BM_SSP_CMD0_SLOW_CLKING_EN;
        }
-        host->ssp_pio_words[0] = ctrl0;
+        ssp->ssp_pio_words[0] = ctrl0;
-        host->ssp_pio_words[1] = cmd0;
+        ssp->ssp_pio_words[1] = cmd0;
-        host->ssp_pio_words[2] = cmd1;
+        ssp->ssp_pio_words[2] = cmd1;
-        host->dma_dir = DMA_NONE;
+        ssp->dma_dir = DMA_NONE;
-        host->slave_dirn = DMA_TRANS_NONE;
+        ssp->slave_dirn = DMA_TRANS_NONE;
        desc = mxs_mmc_prep_dma(host, DMA_CTRL_ACK);
        if (!desc)
                goto out;
        dmaengine_submit(desc);
-        dma_async_issue_pending(host->dmach);
+        dma_async_issue_pending(ssp->dmach);
        return;
 out:
@@ -378,6 +292,7 @@ out:
 static void mxs_mmc_ac(struct mxs_mmc_host *host)
 {
+        struct mxs_ssp *ssp = &host->ssp;
        struct mmc_command *cmd = host->cmd;
        struct dma_async_tx_descriptor *desc;
        u32 ignore_crc, get_resp, long_resp;
@@ -399,17 +314,17 @@ static void mxs_mmc_ac(struct mxs_mmc_host *host)
                cmd0 |= BM_SSP_CMD0_CONT_CLKING_EN | BM_SSP_CMD0_SLOW_CLKING_EN;
        }
-        host->ssp_pio_words[0] = ctrl0;
+        ssp->ssp_pio_words[0] = ctrl0;
-        host->ssp_pio_words[1] = cmd0;
+        ssp->ssp_pio_words[1] = cmd0;
-        host->ssp_pio_words[2] = cmd1;
+        ssp->ssp_pio_words[2] = cmd1;
-        host->dma_dir = DMA_NONE;
+        ssp->dma_dir = DMA_NONE;
-        host->slave_dirn = DMA_TRANS_NONE;
+        ssp->slave_dirn = DMA_TRANS_NONE;
        desc = mxs_mmc_prep_dma(host, DMA_CTRL_ACK);
        if (!desc)
                goto out;
        dmaengine_submit(desc);
-        dma_async_issue_pending(host->dmach);
+        dma_async_issue_pending(ssp->dmach);
        return;
 out:
@@ -447,6 +362,8 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
        unsigned int data_size = 0, log2_blksz;
        unsigned int blocks = data->blocks;
+        struct mxs_ssp *ssp = &host->ssp;
        u32 ignore_crc, get_resp, long_resp, read;
        u32 ctrl0, cmd0, cmd1, val;
@@ -489,15 +406,15 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
                blocks = 1;
        /* xfer count, block size and count need to be set differently */
-        if (ssp_is_old(host)) {
+        if (ssp_is_old(ssp)) {
                ctrl0 |= BF_SSP(data_size, CTRL0_XFER_COUNT);
                cmd0 |= BF_SSP(log2_blksz, CMD0_BLOCK_SIZE) |
                        BF_SSP(blocks - 1, CMD0_BLOCK_COUNT);
        } else {
-                writel(data_size, host->base + HW_SSP_XFER_SIZE);
+                writel(data_size, ssp->base + HW_SSP_XFER_SIZE);
                writel(BF_SSP(log2_blksz, BLOCK_SIZE_BLOCK_SIZE) |
                       BF_SSP(blocks - 1, BLOCK_SIZE_BLOCK_COUNT),
-                       host->base + HW_SSP_BLOCK_SIZE);
+                       ssp->base + HW_SSP_BLOCK_SIZE);
        }
        if ((cmd->opcode == MMC_STOP_TRANSMISSION) ||
@@ -512,18 +429,18 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
        }
        /* set the timeout count */
-        timeout = mxs_ns_to_ssp_ticks(host->clk_rate, data->timeout_ns);
+        timeout = mxs_ns_to_ssp_ticks(ssp->clk_rate, data->timeout_ns);
-        val = readl(host->base + HW_SSP_TIMING(host));
+        val = readl(ssp->base + HW_SSP_TIMING(ssp));
        val &= ~(BM_SSP_TIMING_TIMEOUT);
        val |= BF_SSP(timeout, TIMING_TIMEOUT);
-        writel(val, host->base + HW_SSP_TIMING(host));
+        writel(val, ssp->base + HW_SSP_TIMING(ssp));
        /* pio */
-        host->ssp_pio_words[0] = ctrl0;
+        ssp->ssp_pio_words[0] = ctrl0;
-        host->ssp_pio_words[1] = cmd0;
+        ssp->ssp_pio_words[1] = cmd0;
-        host->ssp_pio_words[2] = cmd1;
+        ssp->ssp_pio_words[2] = cmd1;
-        host->dma_dir = DMA_NONE;
+        ssp->dma_dir = DMA_NONE;
-        host->slave_dirn = DMA_TRANS_NONE;
+        ssp->slave_dirn = DMA_TRANS_NONE;
        desc = mxs_mmc_prep_dma(host, 0);
        if (!desc)
                goto out;
@@ -531,14 +448,14 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
        /* append data sg */
        WARN_ON(host->data != NULL);
        host->data = data;
-        host->dma_dir = dma_data_dir;
+        ssp->dma_dir = dma_data_dir;
-        host->slave_dirn = slave_dirn;
+        ssp->slave_dirn = slave_dirn;
        desc = mxs_mmc_prep_dma(host, DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
        if (!desc)
                goto out;
        dmaengine_submit(desc);
-        dma_async_issue_pending(host->dmach);
+        dma_async_issue_pending(ssp->dmach);
        return;
 out:
        dev_warn(mmc_dev(host->mmc),
@@ -579,42 +496,6 @@ static void mxs_mmc_request(struct mmc_host *mmc, struct mmc_request *mrq)
        mxs_mmc_start_cmd(host, mrq->cmd);
 }
-static void mxs_mmc_set_clk_rate(struct mxs_mmc_host *host, unsigned int rate)
-{
-        unsigned int ssp_clk, ssp_sck;
-        u32 clock_divide, clock_rate;
-        u32 val;
-        ssp_clk = clk_get_rate(host->clk);
-        for (clock_divide = 2; clock_divide <= 254; clock_divide += 2) {
-                clock_rate = DIV_ROUND_UP(ssp_clk, rate * clock_divide);
-                clock_rate = (clock_rate > 0) ? clock_rate - 1 : 0;
-                if (clock_rate <= 255)
-                        break;
-        }
-        if (clock_divide > 254) {
-                dev_err(mmc_dev(host->mmc),
-                        "%s: cannot set clock to %d\n", __func__, rate);
-                return;
-        }
-        ssp_sck = ssp_clk / clock_divide / (1 + clock_rate);
-        val = readl(host->base + HW_SSP_TIMING(host));
-        val &= ~(BM_SSP_TIMING_CLOCK_DIVIDE | BM_SSP_TIMING_CLOCK_RATE);
-        val |= BF_SSP(clock_divide, TIMING_CLOCK_DIVIDE);
-        val |= BF_SSP(clock_rate, TIMING_CLOCK_RATE);
-        writel(val, host->base + HW_SSP_TIMING(host));
-        host->clk_rate = ssp_sck;
-        dev_dbg(mmc_dev(host->mmc),
-                "%s: clock_divide %d, clock_rate %d, ssp_clk %d, rate_actual %d, rate_requested %d\n",
-                __func__, clock_divide, clock_rate, ssp_clk, ssp_sck, rate);
-}
 static void mxs_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
        struct mxs_mmc_host *host = mmc_priv(mmc);
@@ -627,12 +508,13 @@ static void mxs_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                host->bus_width = 0;
        if (ios->clock)
-                mxs_mmc_set_clk_rate(host, ios->clock);
+                mxs_ssp_set_clk_rate(&host->ssp, ios->clock);
 }
 static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
 {
        struct mxs_mmc_host *host = mmc_priv(mmc);
+        struct mxs_ssp *ssp = &host->ssp;
        unsigned long flags;
        spin_lock_irqsave(&host->lock, flags);
@@ -641,19 +523,19 @@ static void mxs_mmc_enable_sdio_irq(struct mmc_host *mmc, int enable)
        if (enable) {
                writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
-                       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+                       ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
                writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
                       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_SET);
        } else {
                writel(BM_SSP_CTRL0_SDIO_IRQ_CHECK,
-                       host->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+                       ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
                writel(BM_SSP_CTRL1_SDIO_IRQ_EN,
-                       host->base + HW_SSP_CTRL1(host) + STMP_OFFSET_REG_CLR);
+                       ssp->base + HW_SSP_CTRL1(ssp) + STMP_OFFSET_REG_CLR);
        }
        spin_unlock_irqrestore(&host->lock, flags);
-        if (enable && readl(host->base + HW_SSP_STATUS(host)) &
+        if (enable && readl(ssp->base + HW_SSP_STATUS(ssp)) &
                        BM_SSP_STATUS_SDIO_IRQ)
                mmc_signal_sdio_irq(host->mmc);
@@ -670,34 +552,35 @@ static const struct mmc_host_ops mxs_mmc_ops = {
 static bool mxs_mmc_dma_filter(struct dma_chan *chan, void *param)
 {
        struct mxs_mmc_host *host = param;
+        struct mxs_ssp *ssp = &host->ssp;
        if (!mxs_dma_is_apbh(chan))
                return false;
-        if (chan->chan_id != host->dma_channel)
+        if (chan->chan_id != ssp->dma_channel)
                return false;
-        chan->private = &host->dma_data;
+        chan->private = &ssp->dma_data;
        return true;
 }
-static struct platform_device_id mxs_mmc_ids[] = {
+static struct platform_device_id mxs_ssp_ids[] = {
        {
                .name = "imx23-mmc",
-                .driver_data = IMX23_MMC,
+                .driver_data = IMX23_SSP,
        }, {
                .name = "imx28-mmc",
-                .driver_data = IMX28_MMC,
+                .driver_data = IMX28_SSP,
        }, {
                /* sentinel */
        }
 };
-MODULE_DEVICE_TABLE(platform, mxs_mmc_ids);
+MODULE_DEVICE_TABLE(platform, mxs_ssp_ids);
 static const struct of_device_id mxs_mmc_dt_ids[] = {
-        { .compatible = "fsl,imx23-mmc", .data = (void *) IMX23_MMC, },
+        { .compatible = "fsl,imx23-mmc", .data = (void *) IMX23_SSP, },
-        { .compatible = "fsl,imx28-mmc", .data = (void *) IMX28_MMC, },
+        { .compatible = "fsl,imx28-mmc", .data = (void *) IMX28_SSP, },
        { /* sentinel */ }
 };
 MODULE_DEVICE_TABLE(of, mxs_mmc_dt_ids);
@@ -716,6 +599,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
        dma_cap_mask_t mask;
        struct regulator *reg_vmmc;
        enum of_gpio_flags flags;
+        struct mxs_ssp *ssp;
        iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        dmares = platform_get_resource(pdev, IORESOURCE_DMA, 0);
@@ -729,28 +613,30 @@ static int mxs_mmc_probe(struct platform_device *pdev)
                return -ENOMEM;
        host = mmc_priv(mmc);
-        host->base = devm_request_and_ioremap(&pdev->dev, iores);
+        ssp = &host->ssp;
-        if (!host->base) {
+        ssp->dev = &pdev->dev;
+        ssp->base = devm_request_and_ioremap(&pdev->dev, iores);
+        if (!ssp->base) {
                ret = -EADDRNOTAVAIL;
                goto out_mmc_free;
        }
        if (np) {
-                host->devid = (enum mxs_mmc_id) of_id->data;
+                ssp->devid = (enum mxs_ssp_id) of_id->data;
                /*
                 * TODO: This is a temporary solution and should be changed
                 * to use generic DMA binding later when the helpers get in.
                 */
                ret = of_property_read_u32(np, "fsl,ssp-dma-channel",
-                                           &host->dma_channel);
+                                           &ssp->dma_channel);
                if (ret) {
                        dev_err(mmc_dev(host->mmc),
                                "failed to get dma channel\n");
                        goto out_mmc_free;
                }
        } else {
-                host->devid = pdev->id_entry->driver_data;
+                ssp->devid = pdev->id_entry->driver_data;
-                host->dma_channel = dmares->start;
+                ssp->dma_channel = dmares->start;
        }
        host->mmc = mmc;
@@ -772,20 +658,20 @@ static int mxs_mmc_probe(struct platform_device *pdev)
                goto out_mmc_free;
        }
-        host->clk = clk_get(&pdev->dev, NULL);
+        ssp->clk = clk_get(&pdev->dev, NULL);
-        if (IS_ERR(host->clk)) {
+        if (IS_ERR(ssp->clk)) {
-                ret = PTR_ERR(host->clk);
+                ret = PTR_ERR(ssp->clk);
                goto out_mmc_free;
        }
-        clk_prepare_enable(host->clk);
+        clk_prepare_enable(ssp->clk);
        mxs_mmc_reset(host);
        dma_cap_zero(mask);
        dma_cap_set(DMA_SLAVE, mask);
-        host->dma_data.chan_irq = irq_dma;
+        ssp->dma_data.chan_irq = irq_dma;
-        host->dmach = dma_request_channel(mask, mxs_mmc_dma_filter, host);
+        ssp->dmach = dma_request_channel(mask, mxs_mmc_dma_filter, host);
-        if (!host->dmach) {
+        if (!ssp->dmach) {
                dev_err(mmc_dev(host->mmc),
                        "%s: failed to request dma\n", __func__);
                goto out_clk_put;
@@ -822,9 +708,9 @@ static int mxs_mmc_probe(struct platform_device *pdev)
        mmc->max_segs = 52;
        mmc->max_blk_size = 1 << 0xf;
-        mmc->max_blk_count = (ssp_is_old(host)) ? 0xff : 0xffffff;
+        mmc->max_blk_count = (ssp_is_old(ssp)) ? 0xff : 0xffffff;
-        mmc->max_req_size = (ssp_is_old(host)) ? 0xffff : 0xffffffff;
+        mmc->max_req_size = (ssp_is_old(ssp)) ? 0xffff : 0xffffffff;
-        mmc->max_seg_size = dma_get_max_seg_size(host->dmach->device->dev);
+        mmc->max_seg_size = dma_get_max_seg_size(ssp->dmach->device->dev);
        platform_set_drvdata(pdev, mmc);
@@ -844,11 +730,11 @@ static int mxs_mmc_probe(struct platform_device *pdev)
        return 0;
 out_free_dma:
-        if (host->dmach)
+        if (ssp->dmach)
-                dma_release_channel(host->dmach);
+                dma_release_channel(ssp->dmach);
 out_clk_put:
-        clk_disable_unprepare(host->clk);
+        clk_disable_unprepare(ssp->clk);
-        clk_put(host->clk);
+        clk_put(ssp->clk);
 out_mmc_free:
        mmc_free_host(mmc);
        return ret;
@@ -858,16 +744,17 @@ static int mxs_mmc_remove(struct platform_device *pdev)
 {
        struct mmc_host *mmc = platform_get_drvdata(pdev);
        struct mxs_mmc_host *host = mmc_priv(mmc);
+        struct mxs_ssp *ssp = &host->ssp;
        mmc_remove_host(mmc);
        platform_set_drvdata(pdev, NULL);
-        if (host->dmach)
+        if (ssp->dmach)
-                dma_release_channel(host->dmach);
+                dma_release_channel(ssp->dmach);
-        clk_disable_unprepare(host->clk);
+        clk_disable_unprepare(ssp->clk);
-        clk_put(host->clk);
+        clk_put(ssp->clk);
        mmc_free_host(mmc);
@@ -879,11 +766,12 @@ static int mxs_mmc_suspend(struct device *dev)
 {
        struct mmc_host *mmc = dev_get_drvdata(dev);
        struct mxs_mmc_host *host = mmc_priv(mmc);
+        struct mxs_ssp *ssp = &host->ssp;
        int ret = 0;
        ret = mmc_suspend_host(mmc);
-        clk_disable_unprepare(host->clk);
+        clk_disable_unprepare(ssp->clk);
        return ret;
 }
@@ -892,9 +780,10 @@ static int mxs_mmc_resume(struct device *dev)
 {
        struct mmc_host *mmc = dev_get_drvdata(dev);
        struct mxs_mmc_host *host = mmc_priv(mmc);
+        struct mxs_ssp *ssp = &host->ssp;
        int ret = 0;
-        clk_prepare_enable(host->clk);
+        clk_prepare_enable(ssp->clk);
        ret = mmc_resume_host(mmc);
@@ -910,7 +799,7 @@ static const struct dev_pm_ops mxs_mmc_pm_ops = {
 static struct platform_driver mxs_mmc_driver = {
        .probe          = mxs_mmc_probe,
        .remove         = mxs_mmc_remove,
-        .id_table       = mxs_mmc_ids,
+        .id_table       = mxs_ssp_ids,
        .driver         = {
                .name   = DRIVER_NAME,
                .owner  = THIS_MODULE,
diff --git a/drivers/net/can/janz-ican3.c b/drivers/net/can/janz-ican3.c
index 98ee43819911..7edadee487ba 100644
--- a/drivers/net/can/janz-ican3.c
+++ b/drivers/net/can/janz-ican3.c
@@ -1391,7 +1391,6 @@ static irqreturn_t ican3_irq(int irq, void *dev_id)
 */
 static int ican3_reset_module(struct ican3_dev *mod)
 {
-        u8 val = 1 << mod->num;
        unsigned long start;
        u8 runold, runnew;
@@ -1405,8 +1404,7 @@ static int ican3_reset_module(struct ican3_dev *mod)
        runold = ioread8(mod->dpm + TARGET_RUNNING);
        /* reset the module */
-        iowrite8(val, &mod->ctrl->reset_assert);
+        iowrite8(0x00, &mod->dpmctrl->hwreset);
-        iowrite8(val, &mod->ctrl->reset_deassert);
        /* wait until the module has finished resetting and is running */
        start = jiffies;
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index 527dbcf95335..9ded21e79db5 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -984,12 +984,12 @@ static int __devexit ti_hecc_remove(struct platform_device *pdev)
        struct net_device *ndev = platform_get_drvdata(pdev);
        struct ti_hecc_priv *priv = netdev_priv(ndev);
+        unregister_candev(ndev);
        clk_disable(priv->clk);
        clk_put(priv->clk);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        iounmap(priv->base);
        release_mem_region(res->start, resource_size(res));
-        unregister_candev(ndev);
        free_candev(ndev);
        platform_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index af20c6ee2cd9..e8e97a7d1d06 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -662,14 +662,16 @@ void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
                                 struct bnx2x_fastpath *fp,
                                 struct bnx2x_eth_q_stats *qstats)
 {
-        /* Do nothing if no IP/L4 csum validation was done */
+        /* Do nothing if no L4 csum validation was done.
+         * We do not check whether IP csum was validated. For IPv4 we assume
+         * that if the card got as far as validating the L4 csum, it also
+         * validated the IP csum. IPv6 has no IP csum.
+         */
        if (cqe->fast_path_cqe.status_flags &
-            (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
+            ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG)
-             ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
                return;
-        /* If both IP/L4 validation were done, check if an error was found. */
+        /* If L4 validation was done, check if an error was found. */
        if (cqe->fast_path_cqe.type_error_flags &
            (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 211753e01f81..0875ecfe3372 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9831,12 +9831,13 @@ static void __devinit bnx2x_get_igu_cam_info(struct bnx2x *bp)
        }
 #ifdef CONFIG_PCI_MSI
-        /*
+        /* Due to new PF resource allocation by MFW T7.4 and above, it's
-         * It's expected that number of CAM entries for this functions is equal
+         * optional that number of CAM entries will not be equal to the value
-         * to the number evaluated based on the MSI-X table size. We want a
+         * advertised in PCI.
-         * harsh warning if these values are different!
+         * Driver should use the minimal value of both as the actual status
+         * block count
         */
-        WARN_ON(bp->igu_sb_cnt != igu_sb_cnt);
+        bp->igu_sb_cnt = min_t(int, bp->igu_sb_cnt, igu_sb_cnt);
 #endif
        if (igu_sb_cnt == 0)
diff --git a/drivers/net/ethernet/cadence/at91_ether.c b/drivers/net/ethernet/cadence/at91_ether.c
index 77884191a8c6..4e980a7886fb 100644
--- a/drivers/net/ethernet/cadence/at91_ether.c
+++ b/drivers/net/ethernet/cadence/at91_ether.c
@@ -1086,7 +1086,7 @@ static int __init at91ether_probe(struct platform_device *pdev)
        /* Clock */
        lp->ether_clk = clk_get(&pdev->dev, "ether_clk");
        if (IS_ERR(lp->ether_clk)) {
-                res = -ENODEV;
+                res = PTR_ERR(lp->ether_clk);
                goto err_ioumap;
        }
        clk_enable(lp->ether_clk);
diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c
index 8971921cc1c8..ab6762caa957 100644
--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c
+++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c
@@ -1773,6 +1773,7 @@ static int gfar_get_nfc(struct net_device *dev, struct ethtool_rxnfc *cmd,
 }
 int gfar_phc_index = -1;
+EXPORT_SYMBOL(gfar_phc_index);
 static int gfar_get_ts_info(struct net_device *dev,
                            struct ethtool_ts_info *info)
diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
index c08e5d40fecb..0daa66b8eca0 100644
--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
+++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
@@ -515,7 +515,7 @@ static int gianfar_ptp_probe(struct platform_device *dev)
                err = PTR_ERR(etsects->clock);
                goto no_clock;
        }
-        gfar_phc_clock = ptp_clock_index(etsects->clock);
+        gfar_phc_index = ptp_clock_index(etsects->clock);
        dev_set_drvdata(&dev->dev, etsects);
@@ -539,7 +539,7 @@ static int gianfar_ptp_remove(struct platform_device *dev)
        gfar_write(&etsects->regs->tmr_temask, 0);
        gfar_write(&etsects->regs->tmr_ctrl,   0);
-        gfar_phc_clock = -1;
+        gfar_phc_index = -1;
        ptp_clock_unregister(etsects->clock);
        iounmap(etsects->regs);
        release_resource(etsects->rsrc);
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 3bfbb8df8989..bde337ee1a34 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -3149,6 +3149,17 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                return NETDEV_TX_OK;
        }
+        /* On PCI/PCI-X HW, if packet size is less than ETH_ZLEN,
+         * packets may get corrupted during padding by HW.
+         * To WA this issue, pad all small packets manually.
+         */
+        if (skb->len < ETH_ZLEN) {
+                if (skb_pad(skb, ETH_ZLEN - skb->len))
+                        return NETDEV_TX_OK;
+                skb->len = ETH_ZLEN;
+                skb_set_tail_pointer(skb, ETH_ZLEN);
+        }
        mss = skb_shinfo(skb)->gso_size;
        /* The controller does a simple calculation to
         * make sure there is enough room in the FIFO before
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c
index daf417923661..31d02649be41 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.c
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c
@@ -227,9 +227,10 @@ int mlx4_UNMAP_ICM_AUX(struct mlx4_dev *dev)
                        MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 }
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
+        u32 i = (obj & (table->num_obj - 1)) /
+                        (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
        int ret = 0;
        mutex_lock(&table->mutex);
@@ -262,16 +263,18 @@ out:
        return ret;
 }
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj)
 {
-        int i;
+        u32 i;
+        u64 offset;
        i = (obj & (table->num_obj - 1)) / (MLX4_TABLE_CHUNK_SIZE / table->obj_size);
        mutex_lock(&table->mutex);
        if (--table->icm[i]->refcount == 0) {
-                mlx4_UNMAP_ICM(dev, table->virt + i * MLX4_TABLE_CHUNK_SIZE,
+                offset = (u64) i * MLX4_TABLE_CHUNK_SIZE;
+                mlx4_UNMAP_ICM(dev, table->virt + offset,
                               MLX4_TABLE_CHUNK_SIZE / MLX4_ICM_PAGE_SIZE);
                mlx4_free_icm(dev, table->icm[i], table->coherent);
                table->icm[i] = NULL;
@@ -280,9 +283,11 @@ void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj)
        mutex_unlock(&table->mutex);
 }
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle)
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj,
+                        dma_addr_t *dma_handle)
 {
-        int idx, offset, dma_offset, i;
+        int offset, dma_offset, i;
+        u64 idx;
        struct mlx4_icm_chunk *chunk;
        struct mlx4_icm *icm;
        struct page *page = NULL;
@@ -292,7 +297,7 @@ void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_han
        mutex_lock(&table->mutex);
-        idx = (obj & (table->num_obj - 1)) * table->obj_size;
+        idx = (u64) (obj & (table->num_obj - 1)) * table->obj_size;
        icm = table->icm[idx / MLX4_TABLE_CHUNK_SIZE];
        dma_offset = offset = idx % MLX4_TABLE_CHUNK_SIZE;
@@ -326,10 +331,11 @@ out:
 }
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end)
+                         u32 start, u32 end)
 {
        int inc = MLX4_TABLE_CHUNK_SIZE / table->obj_size;
-        int i, err;
+        int err;
+        u32 i;
        for (i = start; i <= end; i += inc) {
                err = mlx4_table_get(dev, table, i);
@@ -349,9 +355,9 @@ fail:
 }
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end)
+                          u32 start, u32 end)
 {
-        int i;
+        u32 i;
        for (i = start; i <= end; i += MLX4_TABLE_CHUNK_SIZE / table->obj_size)
                mlx4_table_put(dev, table, i);
diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.h b/drivers/net/ethernet/mellanox/mlx4/icm.h
index a67744f53506..dee67fa39107 100644
--- a/drivers/net/ethernet/mellanox/mlx4/icm.h
+++ b/drivers/net/ethernet/mellanox/mlx4/icm.h
@@ -71,17 +71,17 @@ struct mlx4_icm *mlx4_alloc_icm(struct mlx4_dev *dev, int npages,
                                gfp_t gfp_mask, int coherent);
 void mlx4_free_icm(struct mlx4_dev *dev, struct mlx4_icm *icm, int coherent);
-int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
+int mlx4_table_get(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
-void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, int obj);
+void mlx4_table_put(struct mlx4_dev *dev, struct mlx4_icm_table *table, u32 obj);
 int mlx4_table_get_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                         int start, int end);
+                         u32 start, u32 end);
 void mlx4_table_put_range(struct mlx4_dev *dev, struct mlx4_icm_table *table,
-                          int start, int end);
+                          u32 start, u32 end);
 int mlx4_init_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table,
                        u64 virt, int obj_size, u32 nobj, int reserved,
                        int use_lowmem, int use_coherent);
 void mlx4_cleanup_icm_table(struct mlx4_dev *dev, struct mlx4_icm_table *table);
-void *mlx4_table_find(struct mlx4_icm_table *table, int obj, dma_addr_t *dma_handle);
+void *mlx4_table_find(struct mlx4_icm_table *table, u32 obj, dma_addr_t *dma_handle);
 static inline void mlx4_icm_first(struct mlx4_icm *icm,
                                  struct mlx4_icm_iter *iter)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 342b3a79bd0f..a77c558d8f40 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1378,6 +1378,10 @@ static void netxen_mask_aer_correctable(struct netxen_adapter *adapter)
        struct pci_dev *root = pdev->bus->self;
        u32 aer_pos;
+        /* root bus? */
+        if (!root)
+                return;
        if (adapter->ahw.board_type != NETXEN_BRDTYPE_P3_4_GB_MM &&
                adapter->ahw.board_type != NETXEN_BRDTYPE_P3_10G_TP)
                return;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index c136162e6473..3be88331d17a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1066,7 +1066,7 @@ static int stmmac_open(struct net_device *dev)
        } else
                priv->tm->enable = 1;
 #endif
-        clk_enable(priv->stmmac_clk);
+        clk_prepare_enable(priv->stmmac_clk);
        stmmac_check_ether_addr(priv);
@@ -1188,7 +1188,7 @@ open_error:
        if (priv->phydev)
                phy_disconnect(priv->phydev);
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
        return ret;
 }
@@ -1246,7 +1246,7 @@ static int stmmac_release(struct net_device *dev)
 #ifdef CONFIG_STMMAC_DEBUG_FS
        stmmac_exit_fs();
 #endif
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
        return 0;
 }
@@ -2178,7 +2178,7 @@ int stmmac_suspend(struct net_device *ndev)
        else {
                stmmac_set_mac(priv->ioaddr, false);
                /* Disable clock in case of PWM is off */
-                clk_disable(priv->stmmac_clk);
+                clk_disable_unprepare(priv->stmmac_clk);
        }
        spin_unlock_irqrestore(&priv->lock, flags);
        return 0;
@@ -2203,7 +2203,7 @@ int stmmac_resume(struct net_device *ndev)
                priv->hw->mac->pmt(priv->ioaddr, 0);
        else
                /* enable the clk prevously disabled */
-                clk_enable(priv->stmmac_clk);
+                clk_prepare_enable(priv->stmmac_clk);
        netif_device_attach(ndev);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
index 2a0e1abde7e7..4ccd4e2977b7 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_timer.c
@@ -97,19 +97,19 @@ static struct clk *timer_clock;
 static void stmmac_tmu_start(unsigned int new_freq)
 {
        clk_set_rate(timer_clock, new_freq);
-        clk_enable(timer_clock);
+        clk_prepare_enable(timer_clock);
 }
 static void stmmac_tmu_stop(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
 }
 int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 {
        timer_clock = clk_get(NULL, TMU_CHANNEL);
-        if (timer_clock == NULL)
+        if (IS_ERR(timer_clock))
                return -1;
        if (tmu2_register_user(stmmac_timer_handler, (void *)dev) < 0) {
@@ -126,7 +126,7 @@ int stmmac_open_ext_timer(struct net_device *dev, struct stmmac_timer *tm)
 int stmmac_close_ext_timer(void)
 {
-        clk_disable(timer_clock);
+        clk_disable_unprepare(timer_clock);
        tmu2_unregister_user();
        clk_put(timer_clock);
        return 0;
diff --git a/drivers/net/irda/sh_sir.c b/drivers/net/irda/sh_sir.c
index 256eddf1f75a..795109425568 100644
--- a/drivers/net/irda/sh_sir.c
+++ b/drivers/net/irda/sh_sir.c
@@ -280,7 +280,7 @@ static int sh_sir_set_baudrate(struct sh_sir_self *self, u32 baudrate)
        }
        clk = clk_get(NULL, "irda_clk");
-        if (!clk) {
+        if (IS_ERR(clk)) {
                dev_err(dev, "can not get irda_clk\n");
                return -EIO;
        }
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 4fd48df6b989..32e31c5c5dc6 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -962,6 +962,10 @@ static const struct usb_device_id	products [] = {
        USB_DEVICE (0x2001, 0x3c05),
        .driver_info = (unsigned long) &ax88772_info,
 }, {
+       // DLink DUB-E100 H/W Ver C1
+       USB_DEVICE (0x2001, 0x1a02),
+       .driver_info = (unsigned long) &ax88772_info,
+}, {
        // Linksys USB1000
        USB_DEVICE (0x1737, 0x0039),
        .driver_info = (unsigned long) &ax88178_info,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b1ba68f1a049..3543c9e57824 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -366,16 +366,20 @@ static const struct usb_device_id products[] = {
        },
        /* 2. Combined interface devices matching on class+protocol */
+        {       /* Huawei E367 and possibly others in "Windows mode" */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 7),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
        {       /* Huawei E392, E398 and possibly others in "Windows mode" */
                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                .driver_info        = (unsigned long)&qmi_wwan_shared,
        },
-        {       /* Pantech UML290 */
+        {       /* Pantech UML290, P4200 and more */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                .driver_info        = (unsigned long)&qmi_wwan_shared,
        },
        {       /* Pantech UML290 - newer firmware */
-                USB_DEVICE_AND_INTERFACE_INFO(0x106c, 0x3718, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
+                USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf1, 0xff),
                .driver_info        = (unsigned long)&qmi_wwan_shared,
        },
@@ -383,6 +387,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x0055, 1)},    /* ZTE (Vodafone) K3520-Z */
        {QMI_FIXED_INTF(0x19d2, 0x0063, 4)},    /* ZTE (Vodafone) K3565-Z */
        {QMI_FIXED_INTF(0x19d2, 0x0104, 4)},    /* ZTE (Vodafone) K4505-Z */
+        {QMI_FIXED_INTF(0x19d2, 0x0157, 5)},    /* ZTE MF683 */
        {QMI_FIXED_INTF(0x19d2, 0x0167, 4)},    /* ZTE MF820D */
        {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
        {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 2588848f4a82..d066f2516e47 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -2982,6 +2982,10 @@ static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
        case EEP_RX_MASK:
                return pBase->txrxMask & 0xf;
        case EEP_PAPRD:
+                if (AR_SREV_9462(ah))
+                        return false;
+                if (!ah->config.enable_paprd);
+                        return false;
                return !!(pBase->featureEnable & BIT(5));
        case EEP_CHAIN_MASK_REDUCE:
                return (pBase->miscConfiguration >> 0x3) & 0x1;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 68b643c8943c..c8ef30127adb 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -1577,6 +1577,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                            sc->debug.debugfs_phy, sc, &fops_tx_chainmask);
        debugfs_create_file("disable_ani", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, sc, &fops_disable_ani);
+        debugfs_create_bool("paprd", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
+                            &sc->sc_ah->config.enable_paprd);
        debugfs_create_file("regidx", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                            sc, &fops_regidx);
        debugfs_create_file("regval", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 48af40151d23..4faf0a395876 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -2497,10 +2497,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                pCap->rx_status_len = sizeof(struct ar9003_rxs);
                pCap->tx_desc_len = sizeof(struct ar9003_txc);
                pCap->txs_len = sizeof(struct ar9003_txs);
-                if (!ah->config.paprd_disable &&
-                    ah->eep_ops->get_eeprom(ah, EEP_PAPRD) &&
-                    !AR_SREV_9462(ah))
-                        pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
        } else {
                pCap->tx_desc_len = sizeof(struct ath_desc);
                if (AR_SREV_9280_20(ah))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6599a75f01fe..de6968fc64f4 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -236,7 +236,6 @@ enum ath9k_hw_caps {
        ATH9K_HW_CAP_LDPC                       = BIT(6),
        ATH9K_HW_CAP_FASTCLOCK                  = BIT(7),
        ATH9K_HW_CAP_SGI_20                     = BIT(8),
-        ATH9K_HW_CAP_PAPRD                      = BIT(9),
        ATH9K_HW_CAP_ANT_DIV_COMB               = BIT(10),
        ATH9K_HW_CAP_2GHZ                       = BIT(11),
        ATH9K_HW_CAP_5GHZ                       = BIT(12),
@@ -287,12 +286,12 @@ struct ath9k_ops_config {
        u8 pcie_clock_req;
        u32 pcie_waen;
        u8 analog_shiftreg;
-        u8 paprd_disable;
        u32 ofdm_trig_low;
        u32 ofdm_trig_high;
        u32 cck_trig_high;
        u32 cck_trig_low;
        u32 enable_ani;
+        u32 enable_paprd;
        int serialize_regmode;
        bool rx_intr_mitigation;
        bool tx_intr_mitigation;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 825a29cc9313..7b88b9c39ccd 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -423,7 +423,7 @@ set_timer:
                cal_interval = min(cal_interval, (u32)short_cal_interval);
        mod_timer(&common->ani.timer, jiffies + msecs_to_jiffies(cal_interval));
-        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_PAPRD) && ah->caldata) {
+        if (ah->eep_ops->get_eeprom(ah, EEP_PAPRD) && ah->caldata) {
                if (!ah->caldata->paprd_done)
                        ieee80211_queue_work(sc->hw, &sc->paprd_work);
                else if (!ah->paprd_table_write_done)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 49765d34b4e0..7c4ee72f9d56 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -638,6 +638,8 @@ static int brcmf_sdio_pd_probe(struct platform_device *pdev)
                oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
                                       GFP_KERNEL);
+                if (!oobirq_entry)
+                        return -ENOMEM;
                oobirq_entry->irq = res->start;
                oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
                list_add_tail(&oobirq_entry->list, &oobirq_lh);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 2621dd3d7dcd..6f70953f0bad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -764,8 +764,11 @@ static void brcmf_c_arp_offload_set(struct brcmf_pub *drvr, int arp_mode)
 {
        char iovbuf[32];
        int retcode;
+        __le32 arp_mode_le;
-        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode, 4, iovbuf, sizeof(iovbuf));
+        arp_mode_le = cpu_to_le32(arp_mode);
+        brcmf_c_mkiovar("arp_ol", (char *)&arp_mode_le, 4, iovbuf,
+                        sizeof(iovbuf));
        retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                   iovbuf, sizeof(iovbuf));
        retcode = retcode >= 0 ? 0 : retcode;
@@ -781,8 +784,11 @@ static void brcmf_c_arp_offload_enable(struct brcmf_pub *drvr, int arp_enable)
 {
        char iovbuf[32];
        int retcode;
+        __le32 arp_enable_le;
-        brcmf_c_mkiovar("arpoe", (char *)&arp_enable, 4,
+        arp_enable_le = cpu_to_le32(arp_enable);
+        brcmf_c_mkiovar("arpoe", (char *)&arp_enable_le, 4,
                        iovbuf, sizeof(iovbuf));
        retcode = brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR,
                                   iovbuf, sizeof(iovbuf));
@@ -800,10 +806,10 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
        char iovbuf[BRCMF_EVENTING_MASK_LEN + 12];      /*  Room for
                                 "event_msgs" + '\0' + bitvec  */
        char buf[128], *ptr;
-        u32 roaming = 1;
+        __le32 roaming_le = cpu_to_le32(1);
-        uint bcn_timeout = 3;
+        __le32 bcn_timeout_le = cpu_to_le32(3);
-        int scan_assoc_time = 40;
+        __le32 scan_assoc_time_le = cpu_to_le32(40);
-        int scan_unassoc_time = 40;
+        __le32 scan_unassoc_time_le = cpu_to_le32(40);
        int i;
        struct brcmf_bus_dcmd *cmdlst;
        struct list_head *cur, *q;
@@ -829,14 +835,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
        /* Setup timeout if Beacons are lost and roam is off to report
                 link down */
-        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout, 4, iovbuf,
+        brcmf_c_mkiovar("bcn_timeout", (char *)&bcn_timeout_le, 4, iovbuf,
                    sizeof(iovbuf));
        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                  sizeof(iovbuf));
        /* Enable/Disable build-in roaming to allowed ext supplicant to take
                 of romaing */
-        brcmf_c_mkiovar("roam_off", (char *)&roaming, 4,
+        brcmf_c_mkiovar("roam_off", (char *)&roaming_le, 4,
                      iovbuf, sizeof(iovbuf));
        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_VAR, iovbuf,
                                  sizeof(iovbuf));
@@ -848,9 +854,9 @@ int brcmf_c_preinit_dcmds(struct brcmf_pub *drvr)
                                  sizeof(iovbuf));
        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_CHANNEL_TIME,
-                         (char *)&scan_assoc_time, sizeof(scan_assoc_time));
+                 (char *)&scan_assoc_time_le, sizeof(scan_assoc_time_le));
        brcmf_proto_cdc_set_dcmd(drvr, 0, BRCMF_C_SET_SCAN_UNASSOC_TIME,
-                         (char *)&scan_unassoc_time, sizeof(scan_unassoc_time));
+                 (char *)&scan_unassoc_time_le, sizeof(scan_unassoc_time_le));
        /* Set and enable ARP offload feature */
        brcmf_c_arp_offload_set(drvr, BRCMF_ARPOL_MODE);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index c36e92312443..50b5553b6964 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -500,8 +500,10 @@ static void wl_iscan_prep(struct brcmf_scan_params_le *params_le,
        params_le->active_time = cpu_to_le32(-1);
        params_le->passive_time = cpu_to_le32(-1);
        params_le->home_time = cpu_to_le32(-1);
-        if (ssid && ssid->SSID_len)
+        if (ssid && ssid->SSID_len) {
-                memcpy(&params_le->ssid_le, ssid, sizeof(struct brcmf_ssid));
+                params_le->ssid_le.SSID_len = cpu_to_le32(ssid->SSID_len);
+                memcpy(&params_le->ssid_le.SSID, ssid->SSID, ssid->SSID_len);
+        }
 }
 static s32
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index 7ed7d7577024..64a48f06d68b 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -77,7 +77,7 @@
                                         NL80211_RRF_NO_IBSS)
 static const struct ieee80211_regdomain brcms_regdom_x2 = {
-        .n_reg_rules = 7,
+        .n_reg_rules = 6,
        .alpha2 = "X2",
        .reg_rules = {
                BRCM_2GHZ_2412_2462,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 04c3aef8a4f6..2925094b2d91 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -117,6 +117,7 @@
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_92C_BITMASK                BIT(0)
+#define CHIP_UNKNOWN                    BIT(7)
 #define CHIP_92C_1T2R                   0x03
 #define CHIP_92C                        0x01
 #define CHIP_88C                        0x00
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index bd0da7ef290b..dd4bb0950a57 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -994,8 +994,16 @@ static enum version_8192c _rtl92ce_read_chip_version(struct ieee80211_hw *hw)
                version = (value32 & TYPE_ID) ? VERSION_A_CHIP_92C :
                           VERSION_A_CHIP_88C;
        } else {
-                version = (value32 & TYPE_ID) ? VERSION_B_CHIP_92C :
+                version = (enum version_8192c) (CHIP_VER_B |
-                           VERSION_B_CHIP_88C;
+                                ((value32 & TYPE_ID) ? CHIP_92C_BITMASK : 0) |
+                                ((value32 & VENDOR_ID) ? CHIP_VENDOR_UMC : 0));
+                if ((!IS_CHIP_VENDOR_UMC(version)) && (value32 &
+                     CHIP_VER_RTL_MASK)) {
+                        version = (enum version_8192c)(version |
+                                   ((((value32 & CHIP_VER_RTL_MASK) == BIT(12))
+                                   ? CHIP_VENDOR_UMC_B_CUT : CHIP_UNKNOWN) |
+                                   CHIP_VENDOR_UMC));
+                }
        }
        switch (version) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index 3aa927f8b9b9..7d8f96405f42 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -162,10 +162,12 @@ int rtl92c_init_sw_vars(struct ieee80211_hw *hw)
        /* request fw */
        if (IS_VENDOR_UMC_A_CUT(rtlhal->version) &&
-            !IS_92C_SERIAL(rtlhal->version))
+            !IS_92C_SERIAL(rtlhal->version)) {
                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU.bin";
-        else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version))
+        } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlhal->version)) {
                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cfwU_B.bin";
+                pr_info("****** This B_CUT device may not work with kernels 3.6 and earlier\n");
+        }
        rtlpriv->max_fw_size = 0x4000;
        pr_info("Using firmware %s\n", rtlpriv->cfg->fw_name);
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 590cfafc7c17..1859f71372e2 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -1008,8 +1008,8 @@ static int rpmsg_probe(struct virtio_device *vdev)
        return 0;
 free_coherent:
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE, bufs_va,
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
-                                        vrp->bufs_dma);
+                                        bufs_va, vrp->bufs_dma);
 vqs_del:
        vdev->config->del_vqs(vrp->vdev);
 free_vrp:
@@ -1043,7 +1043,7 @@ static void __devexit rpmsg_remove(struct virtio_device *vdev)
        vdev->config->del_vqs(vrp->vdev);
-        dma_free_coherent(vdev->dev.parent, RPMSG_TOTAL_BUF_SPACE,
+        dma_free_coherent(vdev->dev.parent->parent, RPMSG_TOTAL_BUF_SPACE,
                                        vrp->rbufs, vrp->bufs_dma);
        kfree(vrp);
diff --git a/drivers/rtc/rtc-twl.c b/drivers/rtc/rtc-twl.c
index c5d06fe83bba..9277d945bf48 100644
--- a/drivers/rtc/rtc-twl.c
+++ b/drivers/rtc/rtc-twl.c
@@ -495,6 +495,11 @@ static int __devinit twl_rtc_probe(struct platform_device *pdev)
        if (ret < 0)
                goto out1;
+        /* ensure interrupts are disabled, bootloaders can be strange */
+        ret = twl_rtc_write_u8(0, REG_RTC_INTERRUPTS_REG);
+        if (ret < 0)
+                dev_warn(&pdev->dev, "unable to disable interrupt\n");
        /* init cached IRQ enable bits */
        ret = twl_rtc_read_u8(&rtc_irq_bits, REG_RTC_INTERRUPTS_REG);
        if (ret < 0)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 15370a2c5ff0..0595c763dafd 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -534,11 +534,11 @@ static void dasd_change_state(struct dasd_device *device)
        if (rc)
                device->target = device->state;
-        if (device->state == device->target)
-                wake_up(&dasd_init_waitq);
        /* let user-space know that the device status changed */
        kobject_uevent(&device->cdev->dev.kobj, KOBJ_CHANGE);
+        if (device->state == device->target)
+                wake_up(&dasd_init_waitq);
 }
 /*
@@ -2157,6 +2157,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                    test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
                    (!dasd_eer_enabled(device))) {
                        cqr->status = DASD_CQR_FAILED;
+                        cqr->intrc = -EAGAIN;
                        continue;
                }
                /* Don't try to start requests if device is stopped */
@@ -3270,6 +3271,16 @@ void dasd_generic_path_event(struct ccw_device *cdev, int *path_event)
                        dasd_schedule_device_bh(device);
                }
                if (path_event[chp] & PE_PATHGROUP_ESTABLISHED) {
+                        if (!(device->path_data.opm & eventlpm) &&
+                            !(device->path_data.tbvpm & eventlpm)) {
+                                /*
+                                 * we can not establish a pathgroup on an
+                                 * unavailable path, so trigger a path
+                                 * verification first
+                                 */
+                                device->path_data.tbvpm |= eventlpm;
+                                dasd_schedule_device_bh(device);
+                        }
                        DBF_DEV_EVENT(DBF_WARNING, device, "%s",
                                      "Pathgroup re-established\n");
                        if (device->discipline->kick_validate)
diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
index 157defe5e069..6b556995bb33 100644
--- a/drivers/s390/block/dasd_alias.c
+++ b/drivers/s390/block/dasd_alias.c
@@ -384,6 +384,29 @@ static void _remove_device_from_lcu(struct alias_lcu *lcu,
                group->next = NULL;
 };
+static int
+suborder_not_supported(struct dasd_ccw_req *cqr)
+{
+        char *sense;
+        char reason;
+        char msg_format;
+        char msg_no;
+        sense = dasd_get_sense(&cqr->irb);
+        if (!sense)
+                return 0;
+        reason = sense[0];
+        msg_format = (sense[7] & 0xF0);
+        msg_no = (sense[7] & 0x0F);
+        /* command reject, Format 0 MSG 4 - invalid parameter */
+        if ((reason == 0x80) && (msg_format == 0x00) && (msg_no == 0x04))
+                return 1;
+        return 0;
+}
 static int read_unit_address_configuration(struct dasd_device *device,
                                           struct alias_lcu *lcu)
 {
@@ -435,6 +458,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
        do {
                rc = dasd_sleep_on(cqr);
+                if (rc && suborder_not_supported(cqr))
+                        return -EOPNOTSUPP;
        } while (rc && (cqr->retries > 0));
        if (rc) {
                spin_lock_irqsave(&lcu->lock, flags);
@@ -521,7 +546,7 @@ static void lcu_update_work(struct work_struct *work)
         * processing the data
         */
        spin_lock_irqsave(&lcu->lock, flags);
-        if (rc || (lcu->flags & NEED_UAC_UPDATE)) {
+        if ((rc && (rc != -EOPNOTSUPP)) || (lcu->flags & NEED_UAC_UPDATE)) {
                DBF_DEV_EVENT(DBF_WARNING, device, "could not update"
                            " alias data in lcu (rc = %d), retry later", rc);
                schedule_delayed_work(&lcu->ruac_data.dwork, 30*HZ);
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 2fb2b9ea97ec..c48c72abbefc 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -1507,7 +1507,8 @@ static struct dasd_ccw_req *dasd_eckd_build_psf_ssc(struct dasd_device *device,
 * call might change behaviour of DASD devices.
 */
 static int
-dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
+dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav,
+                  unsigned long flags)
 {
        struct dasd_ccw_req *cqr;
        int rc;
@@ -1516,10 +1517,19 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
        if (IS_ERR(cqr))
                return PTR_ERR(cqr);
+        /*
+         * set flags e.g. turn on failfast, to prevent blocking
+         * the calling function should handle failed requests
+         */
+        cqr->flags |= flags;
        rc = dasd_sleep_on(cqr);
        if (!rc)
                /* trigger CIO to reprobe devices */
                css_schedule_reprobe();
+        else if (cqr->intrc == -EAGAIN)
+                rc = -EAGAIN;
        dasd_sfree_request(cqr, cqr->memdev);
        return rc;
 }
@@ -1527,7 +1537,8 @@ dasd_eckd_psf_ssc(struct dasd_device *device, int enable_pav)
 /*
 * Valide storage server of current device.
 */
-static void dasd_eckd_validate_server(struct dasd_device *device)
+static int dasd_eckd_validate_server(struct dasd_device *device,
+                                     unsigned long flags)
 {
        int rc;
        struct dasd_eckd_private *private;
@@ -1536,17 +1547,18 @@ static void dasd_eckd_validate_server(struct dasd_device *device)
        private = (struct dasd_eckd_private *) device->private;
        if (private->uid.type == UA_BASE_PAV_ALIAS ||
            private->uid.type == UA_HYPER_PAV_ALIAS)
-                return;
+                return 0;
        if (dasd_nopav || MACHINE_IS_VM)
                enable_pav = 0;
        else
                enable_pav = 1;
-        rc = dasd_eckd_psf_ssc(device, enable_pav);
+        rc = dasd_eckd_psf_ssc(device, enable_pav, flags);
        /* may be requested feature is not available on server,
         * therefore just report error and go ahead */
        DBF_EVENT_DEVID(DBF_WARNING, device->cdev, "PSF-SSC for SSID %04x "
                        "returned rc=%d", private->uid.ssid, rc);
+        return rc;
 }
 /*
@@ -1556,7 +1568,13 @@ static void dasd_eckd_do_validate_server(struct work_struct *work)
 {
        struct dasd_device *device = container_of(work, struct dasd_device,
                                                  kick_validate);
-        dasd_eckd_validate_server(device);
+        if (dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST)
+            == -EAGAIN) {
+                /* schedule worker again if failed */
+                schedule_work(&device->kick_validate);
+                return;
+        }
        dasd_put_device(device);
 }
@@ -1685,7 +1703,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
        if (rc)
                goto out_err2;
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, 0);
        /* device may report different configuration data after LCU setup */
        rc = dasd_eckd_read_conf(device);
@@ -4153,7 +4171,7 @@ static int dasd_eckd_restore_device(struct dasd_device *device)
        rc = dasd_alias_make_device_known_to_lcu(device);
        if (rc)
                return rc;
-        dasd_eckd_validate_server(device);
+        dasd_eckd_validate_server(device, DASD_CQR_FLAGS_FAILFAST);
        /* RE-Read Configuration Data */
        rc = dasd_eckd_read_conf(device);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index ed25c8740a9c..fc916f5d7314 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -1426,6 +1426,8 @@ static enum io_sch_action sch_get_action(struct subchannel *sch)
                return IO_SCH_REPROBE;
        if (cdev->online)
                return IO_SCH_VERIFY;
+        if (cdev->private->state == DEV_STATE_NOT_OPER)
+                return IO_SCH_UNREG_ATTACH;
        return IO_SCH_NOP;
 }
@@ -1519,11 +1521,14 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)
                        goto out;
                break;
        case IO_SCH_UNREG_ATTACH:
+                spin_lock_irqsave(sch->lock, flags);
                if (cdev->private->flags.resuming) {
                        /* Device will be handled later. */
                        rc = 0;
-                        goto out;
+                        goto out_unlock;
                }
+                sch_set_cdev(sch, NULL);
+                spin_unlock_irqrestore(sch->lock, flags);
                /* Unregister ccw device. */
                ccw_device_unregister(cdev);
                break;
diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
index 33d6630529de..91eec60252ee 100644
--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
+++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
@@ -1264,6 +1264,9 @@ int bnx2i_send_fw_iscsi_init_msg(struct bnx2i_hba *hba)
        int rc = 0;
        u64 mask64;
+        memset(&iscsi_init, 0x00, sizeof(struct iscsi_kwqe_init1));
+        memset(&iscsi_init2, 0x00, sizeof(struct iscsi_kwqe_init2));
        bnx2i_adjust_qp_size(hba);
        iscsi_init.flags =
diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 796482badf13..2b4261cb7742 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -1315,8 +1315,9 @@ static void complete_scsi_command(struct CommandList *cp)
        }
                break;
        case CMD_PROTOCOL_ERR:
+                cmd->result = DID_ERROR << 16;
                dev_warn(&h->pdev->dev, "cp %p has "
-                        "protocol error \n", cp);
+                        "protocol error\n", cp);
                break;
        case CMD_HARDWARE_ERR:
                cmd->result = DID_ERROR << 16;
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index b25757d1e91b..9d5a56c4b332 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1209,6 +1209,13 @@ _base_check_enable_msix(struct MPT2SAS_ADAPTER *ioc)
        u16 message_control;
+        /* Check whether controller SAS2008 B0 controller,
+           if it is SAS2008 B0 controller use IO-APIC instead of MSIX */
+        if (ioc->pdev->device == MPI2_MFGPAGE_DEVID_SAS2008 &&
+            ioc->pdev->revision == 0x01) {
+                return -EINVAL;
+        }
        base = pci_find_capability(ioc->pdev, PCI_CAP_ID_MSIX);
        if (!base) {
                dfailprintk(ioc, printk(MPT2SAS_INFO_FMT "msix not "
diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
index c7030fbee79c..3e79a2f00042 100644
--- a/drivers/scsi/virtio_scsi.c
+++ b/drivers/scsi/virtio_scsi.c
@@ -331,7 +331,7 @@ static void virtscsi_map_sgl(struct scatterlist *sg, unsigned int *p_idx,
        int i;
        for_each_sg(table->sgl, sg_elem, table->nents, i)
-                sg_set_buf(&sg[idx++], sg_virt(sg_elem), sg_elem->length);
+                sg[idx++] = *sg_elem;
        *p_idx = idx;
 }
diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c
index 32c26d795ed0..8f32a1323a79 100644
--- a/drivers/sh/intc/core.c
+++ b/drivers/sh/intc/core.c
@@ -355,7 +355,7 @@ int __init register_intc_controller(struct intc_desc *desc)
                        if (unlikely(res)) {
                                if (res == -EEXIST) {
                                        res = irq_domain_associate(d->domain,
-                                                                   irq, irq);
+                                                                   irq2, irq2);
                                        if (unlikely(res)) {
                                                pr_err("domain association "
                                                       "failure\n");
diff --git a/drivers/sh/pfc/pinctrl.c b/drivers/sh/pfc/pinctrl.c
index 2804eaae804e..a3ac39b79192 100644
--- a/drivers/sh/pfc/pinctrl.c
+++ b/drivers/sh/pfc/pinctrl.c
@@ -211,7 +211,8 @@ static int sh_pfc_gpio_request_enable(struct pinctrl_dev *pctldev,
                break;
        default:
                pr_err("Unsupported mux type (%d), bailing...\n", pinmux_type);
-                return -ENOTSUPP;
+                ret = -ENOTSUPP;
+                goto err;
        }
        ret = 0;
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 920bb4d22d40..63a79437aca1 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -370,6 +370,13 @@ config SPI_STMP3XXX
        help
          SPI driver for Freescale STMP37xx/378x SoC SSP interface
+config SPI_MXS
+        tristate "Freescale MXS SPI controller"
+        depends on ARCH_MXS
+        select STMP_DEVICE
+        help
+          SPI driver for Freescale MXS devices.
 config SPI_TEGRA
        tristate "Nvidia Tegra SPI controller"
        depends on ARCH_TEGRA && (TEGRA_SYSTEM_DMA || TEGRA20_APB_DMA)
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index 7559c984db77..938705644bb6 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -36,6 +36,7 @@ obj-$(CONFIG_SPI_LM70_LLP)		+= spi-lm70llp.o
 obj-$(CONFIG_SPI_MPC512x_PSC)           += spi-mpc512x-psc.o
 obj-$(CONFIG_SPI_MPC52xx_PSC)           += spi-mpc52xx-psc.o
 obj-$(CONFIG_SPI_MPC52xx)               += spi-mpc52xx.o
+obj-$(CONFIG_SPI_MXS)                   += spi-mxs.o
 obj-$(CONFIG_SPI_NUC900)                += spi-nuc900.o
 obj-$(CONFIG_SPI_OC_TINY)               += spi-oc-tiny.o
 obj-$(CONFIG_SPI_OMAP_UWIRE)            += spi-omap-uwire.o
diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c
new file mode 100644
index 000000000000..edf1360ab09e
--- /dev/null
+++ b/drivers/spi/spi-mxs.c
@@ -0,0 +1,674 @@
+/*
+ * Freescale MXS SPI master driver
+ *
+ * Copyright 2012 DENX Software Engineering, GmbH.
+ * Copyright 2012 Freescale Semiconductor, Inc.
+ * Copyright 2008 Embedded Alley Solutions, Inc All Rights Reserved.
+ *
+ * Rework and transition to new API by:
+ * Marek Vasut <marex@denx.de>
+ *
+ * Based on previous attempt by:
+ * Fabio Estevam <fabio.estevam@freescale.com>
+ *
+ * Based on code from U-Boot bootloader by:
+ * Marek Vasut <marex@denx.de>
+ *
+ * Based on spi-stmp.c, which is:
+ * Author: Dmitry Pervushin <dimka@embeddedalley.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/dma-mapping.h>
+#include <linux/dmaengine.h>
+#include <linux/highmem.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/completion.h>
+#include <linux/gpio.h>
+#include <linux/regulator/consumer.h>
+#include <linux/module.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/stmp_device.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/mxs-spi.h>
+#define DRIVER_NAME             "mxs-spi"
+/* Use 10S timeout for very long transfers, it should suffice. */
+#define SSP_TIMEOUT             10000
+#define SG_MAXLEN               0xff00
+struct mxs_spi {
+        struct mxs_ssp          ssp;
+        struct completion       c;
+};
+static int mxs_spi_setup_transfer(struct spi_device *dev,
+                                struct spi_transfer *t)
+{
+        struct mxs_spi *spi = spi_master_get_devdata(dev->master);
+        struct mxs_ssp *ssp = &spi->ssp;
+        uint8_t bits_per_word;
+        uint32_t hz = 0;
+        bits_per_word = dev->bits_per_word;
+        if (t && t->bits_per_word)
+                bits_per_word = t->bits_per_word;
+        if (bits_per_word != 8) {
+                dev_err(&dev->dev, "%s, unsupported bits_per_word=%d\n",
+                                        __func__, bits_per_word);
+                return -EINVAL;
+        }
+        hz = dev->max_speed_hz;
+        if (t && t->speed_hz)
+                hz = min(hz, t->speed_hz);
+        if (hz == 0) {
+                dev_err(&dev->dev, "Cannot continue with zero clock\n");
+                return -EINVAL;
+        }
+        mxs_ssp_set_clk_rate(ssp, hz);
+        writel(BF_SSP_CTRL1_SSP_MODE(BV_SSP_CTRL1_SSP_MODE__SPI) |
+                     BF_SSP_CTRL1_WORD_LENGTH
+                     (BV_SSP_CTRL1_WORD_LENGTH__EIGHT_BITS) |
+                     ((dev->mode & SPI_CPOL) ? BM_SSP_CTRL1_POLARITY : 0) |
+                     ((dev->mode & SPI_CPHA) ? BM_SSP_CTRL1_PHASE : 0),
+                     ssp->base + HW_SSP_CTRL1(ssp));
+        writel(0x0, ssp->base + HW_SSP_CMD0);
+        writel(0x0, ssp->base + HW_SSP_CMD1);
+        return 0;
+}
+static int mxs_spi_setup(struct spi_device *dev)
+{
+        int err = 0;
+        if (!dev->bits_per_word)
+                dev->bits_per_word = 8;
+        if (dev->mode & ~(SPI_CPOL | SPI_CPHA))
+                return -EINVAL;
+        err = mxs_spi_setup_transfer(dev, NULL);
+        if (err) {
+                dev_err(&dev->dev,
+                        "Failed to setup transfer, error = %d\n", err);
+        }
+        return err;
+}
+static uint32_t mxs_spi_cs_to_reg(unsigned cs)
+{
+        uint32_t select = 0;
+        /*
+         * i.MX28 Datasheet: 17.10.1: HW_SSP_CTRL0
+         *
+         * The bits BM_SSP_CTRL0_WAIT_FOR_CMD and BM_SSP_CTRL0_WAIT_FOR_IRQ
+         * in HW_SSP_CTRL0 register do have multiple usage, please refer to
+         * the datasheet for further details. In SPI mode, they are used to
+         * toggle the chip-select lines (nCS pins).
+         */
+        if (cs & 1)
+                select |= BM_SSP_CTRL0_WAIT_FOR_CMD;
+        if (cs & 2)
+                select |= BM_SSP_CTRL0_WAIT_FOR_IRQ;
+        return select;
+}
+static void mxs_spi_set_cs(struct mxs_spi *spi, unsigned cs)
+{
+        const uint32_t mask =
+                BM_SSP_CTRL0_WAIT_FOR_CMD | BM_SSP_CTRL0_WAIT_FOR_IRQ;
+        uint32_t select;
+        struct mxs_ssp *ssp = &spi->ssp;
+        writel(mask, ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+        select = mxs_spi_cs_to_reg(cs);
+        writel(select, ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+}
+static inline void mxs_spi_enable(struct mxs_spi *spi)
+{
+        struct mxs_ssp *ssp = &spi->ssp;
+        writel(BM_SSP_CTRL0_LOCK_CS,
+                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+        writel(BM_SSP_CTRL0_IGNORE_CRC,
+                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+}
+static inline void mxs_spi_disable(struct mxs_spi *spi)
+{
+        struct mxs_ssp *ssp = &spi->ssp;
+        writel(BM_SSP_CTRL0_LOCK_CS,
+                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+        writel(BM_SSP_CTRL0_IGNORE_CRC,
+                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+}
+static int mxs_ssp_wait(struct mxs_spi *spi, int offset, int mask, bool set)
+{
+        const unsigned long timeout = jiffies + msecs_to_jiffies(SSP_TIMEOUT);
+        struct mxs_ssp *ssp = &spi->ssp;
+        uint32_t reg;
+        do {
+                reg = readl_relaxed(ssp->base + offset);
+                if (!set)
+                        reg = ~reg;
+                reg &= mask;
+                if (reg == mask)
+                        return 0;
+        } while (time_before(jiffies, timeout));
+        return -ETIMEDOUT;
+}
+static void mxs_ssp_dma_irq_callback(void *param)
+{
+        struct mxs_spi *spi = param;
+        complete(&spi->c);
+}
+static irqreturn_t mxs_ssp_irq_handler(int irq, void *dev_id)
+{
+        struct mxs_ssp *ssp = dev_id;
+        dev_err(ssp->dev, "%s[%i] CTRL1=%08x STATUS=%08x\n",
+                __func__, __LINE__,
+                readl(ssp->base + HW_SSP_CTRL1(ssp)),
+                readl(ssp->base + HW_SSP_STATUS(ssp)));
+        return IRQ_HANDLED;
+}
+static int mxs_spi_txrx_dma(struct mxs_spi *spi, int cs,
+                            unsigned char *buf, int len,
+                            int *first, int *last, int write)
+{
+        struct mxs_ssp *ssp = &spi->ssp;
+        struct dma_async_tx_descriptor *desc = NULL;
+        const bool vmalloced_buf = is_vmalloc_addr(buf);
+        const int desc_len = vmalloced_buf ? PAGE_SIZE : SG_MAXLEN;
+        const int sgs = DIV_ROUND_UP(len, desc_len);
+        int sg_count;
+        int min, ret;
+        uint32_t ctrl0;
+        struct page *vm_page;
+        void *sg_buf;
+        struct {
+                uint32_t                pio[4];
+                struct scatterlist      sg;
+        } *dma_xfer;
+        if (!len)
+                return -EINVAL;
+        dma_xfer = kzalloc(sizeof(*dma_xfer) * sgs, GFP_KERNEL);
+        if (!dma_xfer)
+                return -ENOMEM;
+        INIT_COMPLETION(spi->c);
+        ctrl0 = readl(ssp->base + HW_SSP_CTRL0);
+        ctrl0 |= BM_SSP_CTRL0_DATA_XFER | mxs_spi_cs_to_reg(cs);
+        if (*first)
+                ctrl0 |= BM_SSP_CTRL0_LOCK_CS;
+        if (!write)
+                ctrl0 |= BM_SSP_CTRL0_READ;
+        /* Queue the DMA data transfer. */
+        for (sg_count = 0; sg_count < sgs; sg_count++) {
+                min = min(len, desc_len);
+                /* Prepare the transfer descriptor. */
+                if ((sg_count + 1 == sgs) && *last)
+                        ctrl0 |= BM_SSP_CTRL0_IGNORE_CRC;
+                if (ssp->devid == IMX23_SSP)
+                        ctrl0 |= min;
+                dma_xfer[sg_count].pio[0] = ctrl0;
+                dma_xfer[sg_count].pio[3] = min;
+                if (vmalloced_buf) {
+                        vm_page = vmalloc_to_page(buf);
+                        if (!vm_page) {
+                                ret = -ENOMEM;
+                                goto err_vmalloc;
+                        }
+                        sg_buf = page_address(vm_page) +
+                                ((size_t)buf & ~PAGE_MASK);
+                } else {
+                        sg_buf = buf;
+                }
+                sg_init_one(&dma_xfer[sg_count].sg, sg_buf, min);
+                ret = dma_map_sg(ssp->dev, &dma_xfer[sg_count].sg, 1,
+                        write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+                len -= min;
+                buf += min;
+                /* Queue the PIO register write transfer. */
+                desc = dmaengine_prep_slave_sg(ssp->dmach,
+                                (struct scatterlist *)dma_xfer[sg_count].pio,
+                                (ssp->devid == IMX23_SSP) ? 1 : 4,
+                                DMA_TRANS_NONE,
+                                sg_count ? DMA_PREP_INTERRUPT : 0);
+                if (!desc) {
+                        dev_err(ssp->dev,
+                                "Failed to get PIO reg. write descriptor.\n");
+                        ret = -EINVAL;
+                        goto err_mapped;
+                }
+                desc = dmaengine_prep_slave_sg(ssp->dmach,
+                                &dma_xfer[sg_count].sg, 1,
+                                write ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM,
+                                DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
+                if (!desc) {
+                        dev_err(ssp->dev,
+                                "Failed to get DMA data write descriptor.\n");
+                        ret = -EINVAL;
+                        goto err_mapped;
+                }
+        }
+        /*
+         * The last descriptor must have this callback,
+         * to finish the DMA transaction.
+         */
+        desc->callback = mxs_ssp_dma_irq_callback;
+        desc->callback_param = spi;
+        /* Start the transfer. */
+        dmaengine_submit(desc);
+        dma_async_issue_pending(ssp->dmach);
+        ret = wait_for_completion_timeout(&spi->c,
+                                msecs_to_jiffies(SSP_TIMEOUT));
+        if (!ret) {
+                dev_err(ssp->dev, "DMA transfer timeout\n");
+                ret = -ETIMEDOUT;
+                goto err_vmalloc;
+        }
+        ret = 0;
+err_vmalloc:
+        while (--sg_count >= 0) {
+err_mapped:
+                dma_unmap_sg(ssp->dev, &dma_xfer[sg_count].sg, 1,
+                        write ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
+        }
+        kfree(dma_xfer);
+        return ret;
+}
+static int mxs_spi_txrx_pio(struct mxs_spi *spi, int cs,
+                            unsigned char *buf, int len,
+                            int *first, int *last, int write)
+{
+        struct mxs_ssp *ssp = &spi->ssp;
+        if (*first)
+                mxs_spi_enable(spi);
+        mxs_spi_set_cs(spi, cs);
+        while (len--) {
+                if (*last && len == 0)
+                        mxs_spi_disable(spi);
+                if (ssp->devid == IMX23_SSP) {
+                        writel(BM_SSP_CTRL0_XFER_COUNT,
+                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+                        writel(1,
+                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+                } else {
+                        writel(1, ssp->base + HW_SSP_XFER_SIZE);
+                }
+                if (write)
+                        writel(BM_SSP_CTRL0_READ,
+                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_CLR);
+                else
+                        writel(BM_SSP_CTRL0_READ,
+                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+                writel(BM_SSP_CTRL0_RUN,
+                                ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+                if (mxs_ssp_wait(spi, HW_SSP_CTRL0, BM_SSP_CTRL0_RUN, 1))
+                        return -ETIMEDOUT;
+                if (write)
+                        writel(*buf, ssp->base + HW_SSP_DATA(ssp));
+                writel(BM_SSP_CTRL0_DATA_XFER,
+                             ssp->base + HW_SSP_CTRL0 + STMP_OFFSET_REG_SET);
+                if (!write) {
+                        if (mxs_ssp_wait(spi, HW_SSP_STATUS(ssp),
+                                                BM_SSP_STATUS_FIFO_EMPTY, 0))
+                                return -ETIMEDOUT;
+                        *buf = (readl(ssp->base + HW_SSP_DATA(ssp)) & 0xff);
+                }
+                if (mxs_ssp_wait(spi, HW_SSP_CTRL0, BM_SSP_CTRL0_RUN, 0))
+                        return -ETIMEDOUT;
+                buf++;
+        }
+        if (len <= 0)
+                return 0;
+        return -ETIMEDOUT;
+}
+static int mxs_spi_transfer_one(struct spi_master *master,
+                                struct spi_message *m)
+{
+        struct mxs_spi *spi = spi_master_get_devdata(master);
+        struct mxs_ssp *ssp = &spi->ssp;
+        int first, last;
+        struct spi_transfer *t, *tmp_t;
+        int status = 0;
+        int cs;
+        first = last = 0;
+        cs = m->spi->chip_select;
+        list_for_each_entry_safe(t, tmp_t, &m->transfers, transfer_list) {
+                status = mxs_spi_setup_transfer(m->spi, t);
+                if (status)
+                        break;
+                if (&t->transfer_list == m->transfers.next)
+                        first = 1;
+                if (&t->transfer_list == m->transfers.prev)
+                        last = 1;
+                if ((t->rx_buf && t->tx_buf) || (t->rx_dma && t->tx_dma)) {
+                        dev_err(ssp->dev,
+                                "Cannot send and receive simultaneously\n");
+                        status = -EINVAL;
+                        break;
+                }
+                /*
+                 * Small blocks can be transfered via PIO.
+                 * Measured by empiric means:
+                 *
+                 * dd if=/dev/mtdblock0 of=/dev/null bs=1024k count=1
+                 *
+                 * DMA only: 2.164808 seconds, 473.0KB/s
+                 * Combined: 1.676276 seconds, 610.9KB/s
+                 */
+                if (t->len < 32) {
+                        writel(BM_SSP_CTRL1_DMA_ENABLE,
+                                ssp->base + HW_SSP_CTRL1(ssp) +
+                                STMP_OFFSET_REG_CLR);
+                        if (t->tx_buf)
+                                status = mxs_spi_txrx_pio(spi, cs,
+                                                (void *)t->tx_buf,
+                                                t->len, &first, &last, 1);
+                        if (t->rx_buf)
+                                status = mxs_spi_txrx_pio(spi, cs,
+                                                t->rx_buf, t->len,
+                                                &first, &last, 0);
+                } else {
+                        writel(BM_SSP_CTRL1_DMA_ENABLE,
+                                ssp->base + HW_SSP_CTRL1(ssp) +
+                                STMP_OFFSET_REG_SET);
+                        if (t->tx_buf)
+                                status = mxs_spi_txrx_dma(spi, cs,
+                                                (void *)t->tx_buf, t->len,
+                                                &first, &last, 1);
+                        if (t->rx_buf)
+                                status = mxs_spi_txrx_dma(spi, cs,
+                                                t->rx_buf, t->len,
+                                                &first, &last, 0);
+                }
+                if (status) {
+                        stmp_reset_block(ssp->base);
+                        break;
+                }
+                m->actual_length += t->len;
+                first = last = 0;
+        }
+        m->status = 0;
+        spi_finalize_current_message(master);
+        return status;
+}
+static bool mxs_ssp_dma_filter(struct dma_chan *chan, void *param)
+{
+        struct mxs_ssp *ssp = param;
+        if (!mxs_dma_is_apbh(chan))
+                return false;
+        if (chan->chan_id != ssp->dma_channel)
+                return false;
+        chan->private = &ssp->dma_data;
+        return true;
+}
+static const struct of_device_id mxs_spi_dt_ids[] = {
+        { .compatible = "fsl,imx23-spi", .data = (void *) IMX23_SSP, },
+        { .compatible = "fsl,imx28-spi", .data = (void *) IMX28_SSP, },
+        { /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, mxs_spi_dt_ids);
+static int __devinit mxs_spi_probe(struct platform_device *pdev)
+{
+        const struct of_device_id *of_id =
+                        of_match_device(mxs_spi_dt_ids, &pdev->dev);
+        struct device_node *np = pdev->dev.of_node;
+        struct spi_master *master;
+        struct mxs_spi *spi;
+        struct mxs_ssp *ssp;
+        struct resource *iores, *dmares;
+        struct pinctrl *pinctrl;
+        struct clk *clk;
+        void __iomem *base;
+        int devid, dma_channel, clk_freq;
+        int ret = 0, irq_err, irq_dma;
+        dma_cap_mask_t mask;
+        /*
+         * Default clock speed for the SPI core. 160MHz seems to
+         * work reasonably well with most SPI flashes, so use this
+         * as a default. Override with "clock-frequency" DT prop.
+         */
+        const int clk_freq_default = 160000000;
+        iores = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq_err = platform_get_irq(pdev, 0);
+        irq_dma = platform_get_irq(pdev, 1);
+        if (!iores || irq_err < 0 || irq_dma < 0)
+                return -EINVAL;
+        base = devm_request_and_ioremap(&pdev->dev, iores);
+        if (!base)
+                return -EADDRNOTAVAIL;
+        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+        if (IS_ERR(pinctrl))
+                return PTR_ERR(pinctrl);
+        clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(clk))
+                return PTR_ERR(clk);
+        if (np) {
+                devid = (enum mxs_ssp_id) of_id->data;
+                /*
+                 * TODO: This is a temporary solution and should be changed
+                 * to use generic DMA binding later when the helpers get in.
+                 */
+                ret = of_property_read_u32(np, "fsl,ssp-dma-channel",
+                                           &dma_channel);
+                if (ret) {
+                        dev_err(&pdev->dev,
+                                "Failed to get DMA channel\n");
+                        return -EINVAL;
+                }
+                ret = of_property_read_u32(np, "clock-frequency",
+                                           &clk_freq);
+                if (ret)
+                        clk_freq = clk_freq_default;
+        } else {
+                dmares = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+                if (!dmares)
+                        return -EINVAL;
+                devid = pdev->id_entry->driver_data;
+                dma_channel = dmares->start;
+                clk_freq = clk_freq_default;
+        }
+        master = spi_alloc_master(&pdev->dev, sizeof(*spi));
+        if (!master)
+                return -ENOMEM;
+        master->transfer_one_message = mxs_spi_transfer_one;
+        master->setup = mxs_spi_setup;
+        master->mode_bits = SPI_CPOL | SPI_CPHA;
+        master->num_chipselect = 3;
+        master->dev.of_node = np;
+        master->flags = SPI_MASTER_HALF_DUPLEX;
+        spi = spi_master_get_devdata(master);
+        ssp = &spi->ssp;
+        ssp->dev = &pdev->dev;
+        ssp->clk = clk;
+        ssp->base = base;
+        ssp->devid = devid;
+        ssp->dma_channel = dma_channel;
+        init_completion(&spi->c);
+        ret = devm_request_irq(&pdev->dev, irq_err, mxs_ssp_irq_handler, 0,
+                               DRIVER_NAME, ssp);
+        if (ret)
+                goto out_master_free;
+        dma_cap_zero(mask);
+        dma_cap_set(DMA_SLAVE, mask);
+        ssp->dma_data.chan_irq = irq_dma;
+        ssp->dmach = dma_request_channel(mask, mxs_ssp_dma_filter, ssp);
+        if (!ssp->dmach) {
+                dev_err(ssp->dev, "Failed to request DMA\n");
+                goto out_master_free;
+        }
+        clk_prepare_enable(ssp->clk);
+        clk_set_rate(ssp->clk, clk_freq);
+        ssp->clk_rate = clk_get_rate(ssp->clk) / 1000;
+        stmp_reset_block(ssp->base);
+        platform_set_drvdata(pdev, master);
+        ret = spi_register_master(master);
+        if (ret) {
+                dev_err(&pdev->dev, "Cannot register SPI master, %d\n", ret);
+                goto out_free_dma;
+        }
+        return 0;
+out_free_dma:
+        dma_release_channel(ssp->dmach);
+        clk_disable_unprepare(ssp->clk);
+out_master_free:
+        spi_master_put(master);
+        return ret;
+}
+static int __devexit mxs_spi_remove(struct platform_device *pdev)
+{
+        struct spi_master *master;
+        struct mxs_spi *spi;
+        struct mxs_ssp *ssp;
+        master = spi_master_get(platform_get_drvdata(pdev));
+        spi = spi_master_get_devdata(master);
+        ssp = &spi->ssp;
+        spi_unregister_master(master);
+        dma_release_channel(ssp->dmach);
+        clk_disable_unprepare(ssp->clk);
+        spi_master_put(master);
+        return 0;
+}
+static struct platform_driver mxs_spi_driver = {
+        .probe  = mxs_spi_probe,
+        .remove = __devexit_p(mxs_spi_remove),
+        .driver = {
+                .name   = DRIVER_NAME,
+                .owner  = THIS_MODULE,
+                .of_match_table = mxs_spi_dt_ids,
+        },
+};
+module_platform_driver(mxs_spi_driver);
+MODULE_AUTHOR("Marek Vasut <marex@denx.de>");
+MODULE_DESCRIPTION("MXS SPI master driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:mxs-spi");
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 1eff743ec497..ae60406ea8a1 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -814,6 +814,9 @@ static int __devinit hpwdt_init_one(struct pci_dev *dev,
        hpwdt_timer_reg = pci_mem_addr + 0x70;
        hpwdt_timer_con = pci_mem_addr + 0x72;
+        /* Make sure that timer is disabled until /dev/watchdog is opened */
+        hpwdt_stop();
        /* Make sure that we have a valid soft_margin */
        if (hpwdt_change_timer(soft_margin))
                hpwdt_change_timer(DEFAULT_MARGIN);
diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 6aa46a90ff02..3796434991fa 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -128,11 +128,12 @@ EXPORT_SYMBOL_GPL(watchdog_register_device);
 void watchdog_unregister_device(struct watchdog_device *wdd)
 {
        int ret;
-        int devno = wdd->cdev.dev;
+        int devno;
        if (wdd == NULL)
                return;
+        devno = wdd->cdev.dev;
        ret = watchdog_dev_unregister(wdd);
        if (ret)
                pr_err("error unregistering /dev/watchdog (err=%d)\n", ret);
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 1ffd03bf8e10..7f1241608489 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -314,8 +314,9 @@ static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
                }
        }
-        err = gnttab_unmap_refs(map->unmap_ops + offset, map->pages + offset,
+        err = gnttab_unmap_refs(map->unmap_ops + offset,
-                                pages, true);
+                        use_ptemod ? map->kmap_ops + offset : NULL, map->pages + offset,
+                        pages);
        if (err)
                return err;
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 0bfc1ef11259..006726688baf 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -870,7 +870,8 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
 EXPORT_SYMBOL_GPL(gnttab_map_refs);
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-                      struct page **pages, unsigned int count, bool clear_pte)
+                      struct gnttab_map_grant_ref *kmap_ops,
+                      struct page **pages, unsigned int count)
 {
        int i, ret;
        bool lazy = false;
@@ -888,7 +889,8 @@ int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
        }
        for (i = 0; i < count; i++) {
-                ret = m2p_remove_override(pages[i], clear_pte);
+                ret = m2p_remove_override(pages[i], kmap_ops ?
+                                       &kmap_ops[i] : NULL);
                if (ret)
                        return ret;
        }
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 7dab9c04ad52..53cf2aabce87 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -328,7 +328,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
        }
 ctoUTF16_out:
-        return i;
+        return j;
 }
 #ifdef CONFIG_CIFS_SMB2
diff --git a/fs/dcache.c b/fs/dcache.c
index 8086636bf796..16521a9f2038 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -389,7 +389,7 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
         * Inform try_to_ascend() that we are no longer attached to the
         * dentry tree
         */
-        dentry->d_flags |= DCACHE_DISCONNECTED;
+        dentry->d_flags |= DCACHE_DENTRY_KILLED;
        if (parent)
                spin_unlock(&parent->d_lock);
        dentry_iput(dentry);
@@ -1048,7 +1048,7 @@ static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq
         * or deletion
         */
        if (new != old->d_parent ||
-                 (old->d_flags & DCACHE_DISCONNECTED) ||
+                 (old->d_flags & DCACHE_DENTRY_KILLED) ||
                 (!locked && read_seqretry(&rename_lock, seq))) {
                spin_unlock(&new->d_lock);
                new = NULL;
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 2340f6978d6e..c5ca6ae5a30c 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -526,73 +526,51 @@ struct array_data {
        u32 elements;
 };
-static int u32_array_open(struct inode *inode, struct file *file)
+static size_t u32_format_array(char *buf, size_t bufsize,
-{
+                               u32 *array, int array_size)
-        file->private_data = NULL;
-        return nonseekable_open(inode, file);
-}
-static size_t format_array(char *buf, size_t bufsize, const char *fmt,
-                           u32 *array, u32 array_size)
 {
        size_t ret = 0;
-        u32 i;
-        for (i = 0; i < array_size; i++) {
+        while (--array_size >= 0) {
                size_t len;
+                char term = array_size ? ' ' : '\n';
-                len = snprintf(buf, bufsize, fmt, array[i]);
+                len = snprintf(buf, bufsize, "%u%c", *array++, term);
-                len++;  /* ' ' or '\n' */
                ret += len;
-                if (buf) {
+                buf += len;
-                        buf += len;
+                bufsize -= len;
-                        bufsize -= len;
-                        buf[-1] = (i == array_size-1) ? '\n' : ' ';
-                }
        }
-        ret++;          /* \0 */
-        if (buf)
-                *buf = '\0';
        return ret;
 }
-static char *format_array_alloc(const char *fmt, u32 *array,
+static int u32_array_open(struct inode *inode, struct file *file)
-                                                u32 array_size)
 {
-        size_t len = format_array(NULL, 0, fmt, array, array_size);
+        struct array_data *data = inode->i_private;
-        char *ret;
+        int size, elements = data->elements;
+        char *buf;
-        ret = kmalloc(len, GFP_KERNEL);
-        if (ret == NULL)
+        /*
-                return NULL;
+         * Max size:
+         *  - 10 digits + ' '/'\n' = 11 bytes per number
+         *  - terminating NUL character
+         */
+        size = elements*11;
+        buf = kmalloc(size+1, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        buf[size] = 0;
+        file->private_data = buf;
+        u32_format_array(buf, size, data->array, data->elements);
-        format_array(ret, len, fmt, array, array_size);
+        return nonseekable_open(inode, file);
-        return ret;
 }
 static ssize_t u32_array_read(struct file *file, char __user *buf, size_t len,
                              loff_t *ppos)
 {
-        struct inode *inode = file->f_path.dentry->d_inode;
+        size_t size = strlen(file->private_data);
-        struct array_data *data = inode->i_private;
-        size_t size;
-        if (*ppos == 0) {
-                if (file->private_data) {
-                        kfree(file->private_data);
-                        file->private_data = NULL;
-                }
-                file->private_data = format_array_alloc("%u", data->array,
-                                                              data->elements);
-        }
-        size = 0;
-        if (file->private_data)
-                size = strlen(file->private_data);
        return simple_read_from_buffer(buf, len, ppos,
                                        file->private_data, size);
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index dfafeb2b05a0..eb7cc91b7258 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -462,9 +462,6 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
        err = ERR_PTR(-ENOMEM);
        inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
-        if (h)
-                sysctl_head_finish(h);
        if (!inode)
                goto out;
@@ -473,6 +470,8 @@ static struct dentry *proc_sys_lookup(struct inode *dir, struct dentry *dentry,
        d_add(dentry, inode);
 out:
+        if (h)
+                sysctl_head_finish(h);
        sysctl_head_finish(head);
        return err;
 }
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index d7a9dd735e1e..933b7930b863 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -96,6 +96,7 @@ xfs_buf_lru_add(
                atomic_inc(&bp->b_hold);
                list_add_tail(&bp->b_lru, &btp->bt_lru);
                btp->bt_lru_nr++;
+                bp->b_lru_flags &= ~_XBF_LRU_DISPOSE;
        }
        spin_unlock(&btp->bt_lru_lock);
 }
@@ -154,7 +155,8 @@ xfs_buf_stale(
                struct xfs_buftarg *btp = bp->b_target;
                spin_lock(&btp->bt_lru_lock);
-                if (!list_empty(&bp->b_lru)) {
+                if (!list_empty(&bp->b_lru) &&
+                    !(bp->b_lru_flags & _XBF_LRU_DISPOSE)) {
                        list_del_init(&bp->b_lru);
                        btp->bt_lru_nr--;
                        atomic_dec(&bp->b_hold);
@@ -1501,6 +1503,7 @@ xfs_buftarg_shrink(
                 */
                list_move(&bp->b_lru, &dispose);
                btp->bt_lru_nr--;
+                bp->b_lru_flags |= _XBF_LRU_DISPOSE;
        }
        spin_unlock(&btp->bt_lru_lock);
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index d03b73b9604e..7c0b6a0a1557 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -38,27 +38,28 @@ typedef enum {
        XBRW_ZERO = 3,                  /* Zero target memory */
 } xfs_buf_rw_t;
-#define XBF_READ        (1 << 0) /* buffer intended for reading from device */
+#define XBF_READ         (1 << 0) /* buffer intended for reading from device */
-#define XBF_WRITE       (1 << 1) /* buffer intended for writing to device */
+#define XBF_WRITE        (1 << 1) /* buffer intended for writing to device */
-#define XBF_READ_AHEAD  (1 << 2) /* asynchronous read-ahead */
+#define XBF_READ_AHEAD   (1 << 2) /* asynchronous read-ahead */
-#define XBF_ASYNC       (1 << 4) /* initiator will not wait for completion */
+#define XBF_ASYNC        (1 << 4) /* initiator will not wait for completion */
-#define XBF_DONE        (1 << 5) /* all pages in the buffer uptodate */
+#define XBF_DONE         (1 << 5) /* all pages in the buffer uptodate */
-#define XBF_STALE       (1 << 6) /* buffer has been staled, do not find it */
+#define XBF_STALE        (1 << 6) /* buffer has been staled, do not find it */
 /* I/O hints for the BIO layer */
-#define XBF_SYNCIO      (1 << 10)/* treat this buffer as synchronous I/O */
+#define XBF_SYNCIO       (1 << 10)/* treat this buffer as synchronous I/O */
-#define XBF_FUA         (1 << 11)/* force cache write through mode */
+#define XBF_FUA          (1 << 11)/* force cache write through mode */
-#define XBF_FLUSH       (1 << 12)/* flush the disk cache before a write */
+#define XBF_FLUSH        (1 << 12)/* flush the disk cache before a write */
 /* flags used only as arguments to access routines */
-#define XBF_TRYLOCK     (1 << 16)/* lock requested, but do not wait */
+#define XBF_TRYLOCK      (1 << 16)/* lock requested, but do not wait */
-#define XBF_UNMAPPED    (1 << 17)/* do not map the buffer */
+#define XBF_UNMAPPED     (1 << 17)/* do not map the buffer */
 /* flags used only internally */
-#define _XBF_PAGES      (1 << 20)/* backed by refcounted pages */
+#define _XBF_PAGES       (1 << 20)/* backed by refcounted pages */
-#define _XBF_KMEM       (1 << 21)/* backed by heap memory */
+#define _XBF_KMEM        (1 << 21)/* backed by heap memory */
-#define _XBF_DELWRI_Q   (1 << 22)/* buffer on a delwri queue */
+#define _XBF_DELWRI_Q    (1 << 22)/* buffer on a delwri queue */
-#define _XBF_COMPOUND   (1 << 23)/* compound buffer */
+#define _XBF_COMPOUND    (1 << 23)/* compound buffer */
+#define _XBF_LRU_DISPOSE (1 << 24)/* buffer being discarded */
 typedef unsigned int xfs_buf_flags_t;
@@ -72,12 +73,13 @@ typedef unsigned int xfs_buf_flags_t;
        { XBF_SYNCIO,           "SYNCIO" }, \
        { XBF_FUA,              "FUA" }, \
        { XBF_FLUSH,            "FLUSH" }, \
-        { XBF_TRYLOCK,          "TRYLOCK" },    /* should never be set */\
+        { XBF_TRYLOCK,          "TRYLOCK" },    /* should never be set */\
        { XBF_UNMAPPED,         "UNMAPPED" },   /* ditto */\
        { _XBF_PAGES,           "PAGES" }, \
        { _XBF_KMEM,            "KMEM" }, \
        { _XBF_DELWRI_Q,        "DELWRI_Q" }, \
-        { _XBF_COMPOUND,        "COMPOUND" }
+        { _XBF_COMPOUND,        "COMPOUND" }, \
+        { _XBF_LRU_DISPOSE,     "LRU_DISPOSE" }
 typedef struct xfs_buftarg {
        dev_t                   bt_dev;
@@ -124,7 +126,12 @@ typedef struct xfs_buf {
        xfs_buf_flags_t         b_flags;        /* status flags */
        struct semaphore        b_sema;         /* semaphore for lockables */
+        /*
+         * concurrent access to b_lru and b_lru_flags are protected by
+         * bt_lru_lock and not by b_sema
+         */
        struct list_head        b_lru;          /* lru list */
+        xfs_buf_flags_t         b_lru_flags;    /* internal lru status flags */
        wait_queue_head_t       b_waiters;      /* unpin waiters */
        struct list_head        b_list;
        struct xfs_perag        *b_pag;         /* contains rbtree root */
diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
index bdaf4cb9f4a2..19e2380fb867 100644
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -919,6 +919,7 @@ xfs_fs_put_super(
        struct xfs_mount        *mp = XFS_M(sb);
        xfs_filestream_unmount(mp);
+        cancel_delayed_work_sync(&mp->m_sync_work);
        xfs_unmountfs(mp);
        xfs_syncd_stop(mp);
        xfs_freesb(mp);
diff --git a/include/linux/compiler-gcc4.h b/include/linux/compiler-gcc4.h
index 2f4079175afb..934bc34d5f99 100644
--- a/include/linux/compiler-gcc4.h
+++ b/include/linux/compiler-gcc4.h
@@ -49,6 +49,13 @@
 #endif
 #endif
+#if __GNUC_MINOR__ >= 6
+/*
+ * Tell the optimizer that something else uses this function or variable.
+ */
+#define __visible __attribute__((externally_visible))
+#endif
 #if __GNUC_MINOR__ > 0
 #define __compiletime_object_size(obj) __builtin_object_size(obj, 0)
 #endif
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 923d093c9cea..f430e4162f41 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -278,6 +278,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 # define __section(S) __attribute__ ((__section__(#S)))
 #endif
+#ifndef __visible
+#define __visible
+#endif
 /* Are two types/vars the same type (ignoring qualifiers)? */
 #ifndef __same_type
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index caa34e50537e..59200795482e 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -206,6 +206,8 @@ struct dentry_operations {
 #define DCACHE_MANAGED_DENTRY \
        (DCACHE_MOUNTED|DCACHE_NEED_AUTOMOUNT|DCACHE_MANAGE_TRANSIT)
+#define DCACHE_DENTRY_KILLED    0x100000
 extern seqlock_t rename_lock;
 static inline int dname_external(struct dentry *dentry)
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 594b419b7d20..2451f1f7a1d9 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -91,7 +91,7 @@
 {                                                       \
        typeof(x) __x = x;                              \
        typeof(divisor) __d = divisor;                  \
-        (((typeof(x))-1) >= 0 || (__x) >= 0) ?          \
+        (((typeof(x))-1) > 0 || (__x) > 0) ?            \
                (((__x) + ((__d) / 2)) / (__d)) :       \
                (((__x) - ((__d) / 2)) / (__d));        \
 }                                                       \
diff --git a/include/linux/memory.h b/include/linux/memory.h
index 1ac7f6e405f9..ff9a9f8e0ed9 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -19,7 +19,7 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
-#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
+#define MIN_MEMORY_BLOCK_SIZE     (1UL << SECTION_SIZE_BITS)
 struct memory_block {
        unsigned long start_section_nr;
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 33ed9d605f91..bdb41612bfec 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -274,6 +274,8 @@ struct perf_event_attr {
        __u64   branch_sample_type; /* enum branch_sample_type */
 };
+#define perf_flags(attr)        (*(&(attr)->read_format + 1))
 /*
 * Ioctls that can be done on a perf event fd:
 */
diff --git a/include/linux/spi/mxs-spi.h b/include/linux/spi/mxs-spi.h
new file mode 100644
index 000000000000..61ae1306db23
--- /dev/null
+++ b/include/linux/spi/mxs-spi.h
@@ -0,0 +1,150 @@
+/*
+ * include/linux/spi/mxs-spi.h
+ *
+ * Freescale i.MX233/i.MX28 SPI controller register definition
+ *
+ * Copyright 2008 Embedded Alley Solutions, Inc.
+ * Copyright 2009-2011 Freescale Semiconductor, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+#ifndef __LINUX_SPI_MXS_SPI_H__
+#define __LINUX_SPI_MXS_SPI_H__
+#include <linux/fsl/mxs-dma.h>
+#define ssp_is_old(host)        ((host)->devid == IMX23_SSP)
+/* SSP registers */
+#define HW_SSP_CTRL0                            0x000
+#define  BM_SSP_CTRL0_RUN                       (1 << 29)
+#define  BM_SSP_CTRL0_SDIO_IRQ_CHECK            (1 << 28)
+#define  BM_SSP_CTRL0_LOCK_CS                   (1 << 27)
+#define  BM_SSP_CTRL0_IGNORE_CRC                (1 << 26)
+#define  BM_SSP_CTRL0_READ                      (1 << 25)
+#define  BM_SSP_CTRL0_DATA_XFER                 (1 << 24)
+#define  BP_SSP_CTRL0_BUS_WIDTH                 22
+#define  BM_SSP_CTRL0_BUS_WIDTH                 (0x3 << 22)
+#define  BM_SSP_CTRL0_WAIT_FOR_IRQ              (1 << 21)
+#define  BM_SSP_CTRL0_WAIT_FOR_CMD              (1 << 20)
+#define  BM_SSP_CTRL0_LONG_RESP                 (1 << 19)
+#define  BM_SSP_CTRL0_GET_RESP                  (1 << 17)
+#define  BM_SSP_CTRL0_ENABLE                    (1 << 16)
+#define  BP_SSP_CTRL0_XFER_COUNT                0
+#define  BM_SSP_CTRL0_XFER_COUNT                0xffff
+#define HW_SSP_CMD0                             0x010
+#define  BM_SSP_CMD0_DBL_DATA_RATE_EN           (1 << 25)
+#define  BM_SSP_CMD0_SLOW_CLKING_EN             (1 << 22)
+#define  BM_SSP_CMD0_CONT_CLKING_EN             (1 << 21)
+#define  BM_SSP_CMD0_APPEND_8CYC                (1 << 20)
+#define  BP_SSP_CMD0_BLOCK_SIZE                 16
+#define  BM_SSP_CMD0_BLOCK_SIZE                 (0xf << 16)
+#define  BP_SSP_CMD0_BLOCK_COUNT                8
+#define  BM_SSP_CMD0_BLOCK_COUNT                (0xff << 8)
+#define  BP_SSP_CMD0_CMD                        0
+#define  BM_SSP_CMD0_CMD                        0xff
+#define HW_SSP_CMD1                             0x020
+#define HW_SSP_XFER_SIZE                        0x030
+#define HW_SSP_BLOCK_SIZE                       0x040
+#define  BP_SSP_BLOCK_SIZE_BLOCK_COUNT          4
+#define  BM_SSP_BLOCK_SIZE_BLOCK_COUNT          (0xffffff << 4)
+#define  BP_SSP_BLOCK_SIZE_BLOCK_SIZE           0
+#define  BM_SSP_BLOCK_SIZE_BLOCK_SIZE           0xf
+#define HW_SSP_TIMING(h)                        (ssp_is_old(h) ? 0x050 : 0x070)
+#define  BP_SSP_TIMING_TIMEOUT                  16
+#define  BM_SSP_TIMING_TIMEOUT                  (0xffff << 16)
+#define  BP_SSP_TIMING_CLOCK_DIVIDE             8
+#define  BM_SSP_TIMING_CLOCK_DIVIDE             (0xff << 8)
+#define  BF_SSP_TIMING_CLOCK_DIVIDE(v)          \
+                        (((v) << 8) & BM_SSP_TIMING_CLOCK_DIVIDE)
+#define  BP_SSP_TIMING_CLOCK_RATE               0
+#define  BM_SSP_TIMING_CLOCK_RATE               0xff
+#define BF_SSP_TIMING_CLOCK_RATE(v)             \
+                        (((v) << 0) & BM_SSP_TIMING_CLOCK_RATE)
+#define HW_SSP_CTRL1(h)                         (ssp_is_old(h) ? 0x060 : 0x080)
+#define  BM_SSP_CTRL1_SDIO_IRQ                  (1 << 31)
+#define  BM_SSP_CTRL1_SDIO_IRQ_EN               (1 << 30)
+#define  BM_SSP_CTRL1_RESP_ERR_IRQ              (1 << 29)
+#define  BM_SSP_CTRL1_RESP_ERR_IRQ_EN           (1 << 28)
+#define  BM_SSP_CTRL1_RESP_TIMEOUT_IRQ          (1 << 27)
+#define  BM_SSP_CTRL1_RESP_TIMEOUT_IRQ_EN       (1 << 26)
+#define  BM_SSP_CTRL1_DATA_TIMEOUT_IRQ          (1 << 25)
+#define  BM_SSP_CTRL1_DATA_TIMEOUT_IRQ_EN       (1 << 24)
+#define  BM_SSP_CTRL1_DATA_CRC_IRQ              (1 << 23)
+#define  BM_SSP_CTRL1_DATA_CRC_IRQ_EN           (1 << 22)
+#define  BM_SSP_CTRL1_FIFO_UNDERRUN_IRQ         (1 << 21)
+#define  BM_SSP_CTRL1_FIFO_UNDERRUN_IRQ_EN      (1 << 20)
+#define  BM_SSP_CTRL1_RECV_TIMEOUT_IRQ          (1 << 17)
+#define  BM_SSP_CTRL1_RECV_TIMEOUT_IRQ_EN       (1 << 16)
+#define  BM_SSP_CTRL1_FIFO_OVERRUN_IRQ          (1 << 15)
+#define  BM_SSP_CTRL1_FIFO_OVERRUN_IRQ_EN       (1 << 14)
+#define  BM_SSP_CTRL1_DMA_ENABLE                (1 << 13)
+#define  BM_SSP_CTRL1_PHASE                     (1 << 10)
+#define  BM_SSP_CTRL1_POLARITY                  (1 << 9)
+#define  BP_SSP_CTRL1_WORD_LENGTH               4
+#define  BM_SSP_CTRL1_WORD_LENGTH               (0xf << 4)
+#define  BF_SSP_CTRL1_WORD_LENGTH(v)            \
+                        (((v) << 4) & BM_SSP_CTRL1_WORD_LENGTH)
+#define  BV_SSP_CTRL1_WORD_LENGTH__FOUR_BITS    0x3
+#define  BV_SSP_CTRL1_WORD_LENGTH__EIGHT_BITS   0x7
+#define  BV_SSP_CTRL1_WORD_LENGTH__SIXTEEN_BITS 0xF
+#define  BP_SSP_CTRL1_SSP_MODE                  0
+#define  BM_SSP_CTRL1_SSP_MODE                  0xf
+#define  BF_SSP_CTRL1_SSP_MODE(v)               \
+                        (((v) << 0) & BM_SSP_CTRL1_SSP_MODE)
+#define  BV_SSP_CTRL1_SSP_MODE__SPI             0x0
+#define  BV_SSP_CTRL1_SSP_MODE__SSI             0x1
+#define  BV_SSP_CTRL1_SSP_MODE__SD_MMC          0x3
+#define  BV_SSP_CTRL1_SSP_MODE__MS              0x4
+#define HW_SSP_DATA(h)                          (ssp_is_old(h) ? 0x070 : 0x090)
+#define HW_SSP_SDRESP0(h)                       (ssp_is_old(h) ? 0x080 : 0x0a0)
+#define HW_SSP_SDRESP1(h)                       (ssp_is_old(h) ? 0x090 : 0x0b0)
+#define HW_SSP_SDRESP2(h)                       (ssp_is_old(h) ? 0x0a0 : 0x0c0)
+#define HW_SSP_SDRESP3(h)                       (ssp_is_old(h) ? 0x0b0 : 0x0d0)
+#define HW_SSP_STATUS(h)                        (ssp_is_old(h) ? 0x0c0 : 0x100)
+#define  BM_SSP_STATUS_CARD_DETECT              (1 << 28)
+#define  BM_SSP_STATUS_SDIO_IRQ                 (1 << 17)
+#define  BM_SSP_STATUS_FIFO_EMPTY               (1 << 5)
+#define BF_SSP(value, field)    (((value) << BP_SSP_##field) & BM_SSP_##field)
+#define SSP_PIO_NUM     3
+enum mxs_ssp_id {
+        IMX23_SSP,
+        IMX28_SSP,
+};
+struct mxs_ssp {
+        struct device                   *dev;
+        void __iomem                    *base;
+        struct clk                      *clk;
+        unsigned int                    clk_rate;
+        enum mxs_ssp_id                 devid;
+        int                             dma_channel;
+        struct dma_chan                 *dmach;
+        struct mxs_dma_data             dma_data;
+        unsigned int                    dma_dir;
+        enum dma_transfer_direction     slave_dirn;
+        u32                             ssp_pio_words[SSP_PIO_NUM];
+};
+void mxs_ssp_set_clk_rate(struct mxs_ssp *ssp, unsigned int rate);
+#endif  /* __LINUX_SPI_MXS_SPI_H__ */
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 22e61fdf75a2..28e493b5b94c 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -84,6 +84,8 @@ struct xfrm_replay_state {
        __u32   bitmap;
 };
+#define XFRMA_REPLAY_ESN_MAX    4096
 struct xfrm_replay_state_esn {
        unsigned int    bmp_len;
        __u32           oseq;
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 0fedbd8d747a..9fc7114159e8 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -111,9 +111,8 @@ struct rt6_info {
        struct inet6_dev                *rt6i_idev;
        unsigned long                   _rt6i_peer;
-#ifdef CONFIG_XFRM
+        u32                             rt6i_genid;
-        u32                             rt6i_flow_cache_genid;
-#endif
        /* more non-fragment space at head required */
        unsigned short                  rt6i_nfheader_len;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index ae1cd6c9ba52..fd87963a0ea5 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -102,6 +102,7 @@ struct net {
 #endif
        struct netns_ipvs       *ipvs;
        struct sock             *diag_nlsk;
+        atomic_t                rt_genid;
 };
@@ -300,5 +301,14 @@ static inline void unregister_net_sysctl_table(struct ctl_table_header *header)
 }
 #endif
+static inline int rt_genid(struct net *net)
+{
+        return atomic_read(&net->rt_genid);
+}
+static inline void rt_genid_bump(struct net *net)
+{
+        atomic_inc(&net->rt_genid);
+}
 #endif /* __NET_NET_NAMESPACE_H */
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 1474dd65c66f..eb24dbccd81e 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -65,7 +65,6 @@ struct netns_ipv4 {
        unsigned int sysctl_ping_group_range[2];
        long sysctl_tcp_mem[3];
-        atomic_t rt_genid;
        atomic_t dev_addr_genid;
 #ifdef CONFIG_IP_MROUTE
diff --git a/include/net/route.h b/include/net/route.h
index 776a27f1ab78..da22243d2760 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -108,7 +108,7 @@ extern struct ip_rt_acct __percpu *ip_rt_acct;
 struct in_device;
 extern int              ip_rt_init(void);
-extern void             rt_cache_flush(struct net *net, int how);
+extern void             rt_cache_flush(struct net *net);
 extern void             rt_flush_dev(struct net_device *dev);
 extern struct rtable *__ip_route_output_key(struct net *, struct flowi4 *flp);
 extern struct rtable *ip_route_output_flow(struct net *, struct flowi4 *flp,
diff --git a/include/net/sock.h b/include/net/sock.h
index 72132aef53fc..adb7da20b5a1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1332,7 +1332,7 @@ static inline bool sk_wmem_schedule(struct sock *sk, int size)
 }
 static inline bool
-sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, unsigned int size)
+sk_rmem_schedule(struct sock *sk, struct sk_buff *skb, int size)
 {
        if (!sk_has_account(sk))
                return true;
diff --git a/include/trace/events/kmem.h b/include/trace/events/kmem.h
index 5f889f16b0c8..08fa27244da7 100644
--- a/include/trace/events/kmem.h
+++ b/include/trace/events/kmem.h
@@ -214,7 +214,7 @@ TRACE_EVENT(mm_page_alloc,
        TP_printk("page=%p pfn=%lu order=%d migratetype=%d gfp_flags=%s",
                __entry->page,
-                page_to_pfn(__entry->page),
+                __entry->page ? page_to_pfn(__entry->page) : 0,
                __entry->order,
                __entry->migratetype,
                show_gfp_flags(__entry->gfp_flags))
@@ -240,7 +240,7 @@ DECLARE_EVENT_CLASS(mm_page,
        TP_printk("page=%p pfn=%lu order=%u migratetype=%d percpu_refill=%d",
                __entry->page,
-                page_to_pfn(__entry->page),
+                __entry->page ? page_to_pfn(__entry->page) : 0,
                __entry->order,
                __entry->migratetype,
                __entry->order == 0)
diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index 11e27c3af3cb..f19fff8650e9 100644
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -187,6 +187,7 @@ int gnttab_map_refs(struct gnttab_map_grant_ref *map_ops,
                    struct gnttab_map_grant_ref *kmap_ops,
                    struct page **pages, unsigned int count);
 int gnttab_unmap_refs(struct gnttab_unmap_grant_ref *unmap_ops,
-                      struct page **pages, unsigned int count, bool clear_pte);
+                      struct gnttab_map_grant_ref *kunmap_ops,
+                      struct page **pages, unsigned int count);
 #endif /* __ASM_GNTTAB_H__ */
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index b3c7fd554250..6144bab8fd8e 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -232,15 +232,19 @@ static int pid_ns_ctl_handler(struct ctl_table *table, int write,
         */
        tmp.data = &current->nsproxy->pid_ns->last_pid;
-        return proc_dointvec(&tmp, write, buffer, lenp, ppos);
+        return proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
 }
+extern int pid_max;
+static int zero = 0;
 static struct ctl_table pid_ns_ctl_table[] = {
        {
                .procname = "ns_last_pid",
                .maxlen = sizeof(int),
                .mode = 0666, /* permissions are checked in the handler */
                .proc_handler = pid_ns_ctl_handler,
+                .extra1 = &zero,
+                .extra2 = &pid_max,
        },
        { }
 };
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 34e5eac81424..d3b91e75cecd 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -303,10 +303,11 @@ void getnstimeofday(struct timespec *ts)
                seq = read_seqbegin(&tk->lock);
                ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsecs = timekeeping_get_ns(tk);
        } while (read_seqretry(&tk->lock, seq));
+        ts->tv_nsec = 0;
        timespec_add_ns(ts, nsecs);
 }
 EXPORT_SYMBOL(getnstimeofday);
@@ -345,6 +346,7 @@ void ktime_get_ts(struct timespec *ts)
 {
        struct timekeeper *tk = &timekeeper;
        struct timespec tomono;
+        s64 nsec;
        unsigned int seq;
        WARN_ON(timekeeping_suspended);
@@ -352,13 +354,14 @@ void ktime_get_ts(struct timespec *ts)
        do {
                seq = read_seqbegin(&tk->lock);
                ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsec = timekeeping_get_ns(tk);
                tomono = tk->wall_to_monotonic;
        } while (read_seqretry(&tk->lock, seq));
-        set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec,
+        ts->tv_sec += tomono.tv_sec;
-                                ts->tv_nsec + tomono.tv_nsec);
+        ts->tv_nsec = 0;
+        timespec_add_ns(ts, nsec + tomono.tv_nsec);
 }
 EXPORT_SYMBOL_GPL(ktime_get_ts);
@@ -1244,6 +1247,7 @@ void get_monotonic_boottime(struct timespec *ts)
 {
        struct timekeeper *tk = &timekeeper;
        struct timespec tomono, sleep;
+        s64 nsec;
        unsigned int seq;
        WARN_ON(timekeeping_suspended);
@@ -1251,14 +1255,15 @@ void get_monotonic_boottime(struct timespec *ts)
        do {
                seq = read_seqbegin(&tk->lock);
                ts->tv_sec = tk->xtime_sec;
-                ts->tv_nsec = timekeeping_get_ns(tk);
+                nsec = timekeeping_get_ns(tk);
                tomono = tk->wall_to_monotonic;
                sleep = tk->total_sleep_time;
        } while (read_seqretry(&tk->lock, seq));
-        set_normalized_timespec(ts, ts->tv_sec + tomono.tv_sec + sleep.tv_sec,
+        ts->tv_sec += tomono.tv_sec + sleep.tv_sec;
-                        ts->tv_nsec + tomono.tv_nsec + sleep.tv_nsec);
+        ts->tv_nsec = 0;
+        timespec_add_ns(ts, nsec + tomono.tv_nsec + sleep.tv_nsec);
 }
 EXPORT_SYMBOL_GPL(get_monotonic_boottime);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1e1373bcb3e3..3c5a79e2134c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1349,8 +1349,16 @@ static void busy_worker_rebind_fn(struct work_struct *work)
        struct worker *worker = container_of(work, struct worker, rebind_work);
        struct global_cwq *gcwq = worker->pool->gcwq;
-        if (worker_maybe_bind_and_lock(worker))
+        worker_maybe_bind_and_lock(worker);
-                worker_clr_flags(worker, WORKER_REBIND);
+        /*
+         * %WORKER_REBIND must be cleared even if the above binding failed;
+         * otherwise, we may confuse the next CPU_UP cycle or oops / get
+         * stuck by calling idle_worker_rebind() prematurely.  If CPU went
+         * down again inbetween, %WORKER_UNBOUND would be set, so clearing
+         * %WORKER_REBIND is always safe.
+         */
+        worker_clr_flags(worker, WORKER_REBIND);
        spin_unlock_irq(&gcwq->lock);
 }
@@ -3568,18 +3576,17 @@ static int __devinit workqueue_cpu_down_callback(struct notifier_block *nfb,
 #ifdef CONFIG_SMP
 struct work_for_cpu {
-        struct completion completion;
+        struct work_struct work;
        long (*fn)(void *);
        void *arg;
        long ret;
 };
-static int do_work_for_cpu(void *_wfc)
+static void work_for_cpu_fn(struct work_struct *work)
 {
-        struct work_for_cpu *wfc = _wfc;
+        struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
        wfc->ret = wfc->fn(wfc->arg);
-        complete(&wfc->completion);
-        return 0;
 }
 /**
@@ -3594,19 +3601,11 @@ static int do_work_for_cpu(void *_wfc)
 */
 long work_on_cpu(unsigned int cpu, long (*fn)(void *), void *arg)
 {
-        struct task_struct *sub_thread;
+        struct work_for_cpu wfc = { .fn = fn, .arg = arg };
-        struct work_for_cpu wfc = {
-                .completion = COMPLETION_INITIALIZER_ONSTACK(wfc.completion),
-                .fn = fn,
-                .arg = arg,
-        };
-        sub_thread = kthread_create(do_work_for_cpu, &wfc, "work_for_cpu");
+        INIT_WORK_ONSTACK(&wfc.work, work_for_cpu_fn);
-        if (IS_ERR(sub_thread))
+        schedule_work_on(cpu, &wfc.work);
-                return PTR_ERR(sub_thread);
+        flush_work(&wfc.work);
-        kthread_bind(sub_thread, cpu);
-        wake_up_process(sub_thread);
-        wait_for_completion(&wfc.completion);
        return wfc.ret;
 }
 EXPORT_SYMBOL_GPL(work_on_cpu);
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 3ad25f9d1fc1..6a5b90d0cfd7 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -126,9 +126,6 @@ static void register_page_bootmem_info_section(unsigned long start_pfn)
        struct mem_section *ms;
        struct page *page, *memmap;
-        if (!pfn_valid(start_pfn))
-                return;
        section_nr = pfn_to_section_nr(start_pfn);
        ms = __nr_to_section(section_nr);
@@ -187,9 +184,16 @@ void register_page_bootmem_info_node(struct pglist_data *pgdat)
        end_pfn = pfn + pgdat->node_spanned_pages;
        /* register_section info */
-        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION)
+        for (; pfn < end_pfn; pfn += PAGES_PER_SECTION) {
-                register_page_bootmem_info_section(pfn);
+                /*
+                 * Some platforms can assign the same pfn to multiple nodes - on
+                 * node0 as well as nodeN.  To avoid registering a pfn against
+                 * multiple nodes we check that this pfn does not already
+                 * reside in some other node.
+                 */
+                if (pfn_valid(pfn) && (pfn_to_nid(pfn) == node))
+                        register_page_bootmem_info_section(pfn);
+        }
 }
 #endif /* !CONFIG_SPARSEMEM_VMEMMAP */
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c66fb875104a..c13ea7538891 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -584,7 +584,7 @@ static inline void __free_one_page(struct page *page,
                combined_idx = buddy_idx & page_idx;
                higher_page = page + (combined_idx - page_idx);
                buddy_idx = __find_buddy_index(combined_idx, order + 1);
-                higher_buddy = page + (buddy_idx - combined_idx);
+                higher_buddy = higher_page + (buddy_idx - combined_idx);
                if (page_is_buddy(higher_page, higher_buddy, order + 1)) {
                        list_add_tail(&page->lru,
                                &zone->free_area[order].free_list[migratetype]);
diff --git a/mm/slab.c b/mm/slab.c
index 811af03a14ef..c6854759bcf1 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -983,7 +983,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                }
                /* The caller cannot use PFMEMALLOC objects, find another one */
-                for (i = 1; i < ac->avail; i++) {
+                for (i = 0; i < ac->avail; i++) {
                        /* If a !PFMEMALLOC object is found, swap them */
                        if (!is_obj_pfmemalloc(ac->entry[i])) {
                                objp = ac->entry[i];
@@ -1000,7 +1000,7 @@ static void *__ac_get_obj(struct kmem_cache *cachep, struct array_cache *ac,
                l3 = cachep->nodelists[numa_mem_id()];
                if (!list_empty(&l3->slabs_free) && force_refill) {
                        struct slab *slabp = virt_to_slab(objp);
-                        ClearPageSlabPfmemalloc(virt_to_page(slabp->s_mem));
+                        ClearPageSlabPfmemalloc(virt_to_head_page(slabp->s_mem));
                        clear_obj_pfmemalloc(&objp);
                        recheck_pfmemalloc_active(cachep, ac);
                        return objp;
@@ -1032,7 +1032,7 @@ static void *__ac_put_obj(struct kmem_cache *cachep, struct array_cache *ac,
 {
        if (unlikely(pfmemalloc_active)) {
                /* Some pfmemalloc slabs exist, check if this is one */
-                struct page *page = virt_to_page(objp);
+                struct page *page = virt_to_head_page(objp);
                if (PageSlabPfmemalloc(page))
                        set_obj_pfmemalloc(&objp);
        }
diff --git a/mm/slub.c b/mm/slub.c
index 8f78e2577031..2fdd96f9e998 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1524,12 +1524,13 @@ static inline void *acquire_slab(struct kmem_cache *s,
 }
 static int put_cpu_partial(struct kmem_cache *s, struct page *page, int drain);
+static inline bool pfmemalloc_match(struct page *page, gfp_t gfpflags);
 /*
 * Try to allocate a partial slab from a specific node.
 */
-static void *get_partial_node(struct kmem_cache *s,
+static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
-                struct kmem_cache_node *n, struct kmem_cache_cpu *c)
+                                struct kmem_cache_cpu *c, gfp_t flags)
 {
        struct page *page, *page2;
        void *object = NULL;
@@ -1545,9 +1546,13 @@ static void *get_partial_node(struct kmem_cache *s,
        spin_lock(&n->list_lock);
        list_for_each_entry_safe(page, page2, &n->partial, lru) {
-                void *t = acquire_slab(s, n, page, object == NULL);
+                void *t;
                int available;
+                if (!pfmemalloc_match(page, flags))
+                        continue;
+                t = acquire_slab(s, n, page, object == NULL);
                if (!t)
                        break;
@@ -1614,7 +1619,7 @@ static void *get_any_partial(struct kmem_cache *s, gfp_t flags,
                        if (n && cpuset_zone_allowed_hardwall(zone, flags) &&
                                        n->nr_partial > s->min_partial) {
-                                object = get_partial_node(s, n, c);
+                                object = get_partial_node(s, n, c, flags);
                                if (object) {
                                        /*
                                         * Return the object even if
@@ -1643,7 +1648,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node,
        void *object;
        int searchnode = (node == NUMA_NO_NODE) ? numa_node_id() : node;
-        object = get_partial_node(s, get_node(s, searchnode), c);
+        object = get_partial_node(s, get_node(s, searchnode), c, flags);
        if (object || node != NUMA_NO_NODE)
                return object;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8d01243d9560..99b434b674c0 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -3102,6 +3102,7 @@ int kswapd_run(int nid)
                /* failure at boot is fatal */
                BUG_ON(system_state == SYSTEM_BOOTING);
                printk("Failed to start kswapd on node %d\n",nid);
+                pgdat->kswapd = NULL;
                ret = -1;
        }
        return ret;
diff --git a/net/batman-adv/bitarray.h b/net/batman-adv/bitarray.h
index a081ce1c0514..cebaae7e148b 100644
--- a/net/batman-adv/bitarray.h
+++ b/net/batman-adv/bitarray.h
@@ -20,8 +20,8 @@
 #ifndef _NET_BATMAN_ADV_BITARRAY_H_
 #define _NET_BATMAN_ADV_BITARRAY_H_
-/* returns true if the corresponding bit in the given seq_bits indicates true
+/* Returns 1 if the corresponding bit in the given seq_bits indicates true
- * and curr_seqno is within range of last_seqno
+ * and curr_seqno is within range of last_seqno. Otherwise returns 0.
 */
 static inline int batadv_test_bit(const unsigned long *seq_bits,
                                  uint32_t last_seqno, uint32_t curr_seqno)
@@ -32,7 +32,7 @@ static inline int batadv_test_bit(const unsigned long *seq_bits,
        if (diff < 0 || diff >= BATADV_TQ_LOCAL_WINDOW_SIZE)
                return 0;
        else
-                return  test_bit(diff, seq_bits);
+                return test_bit(diff, seq_bits) != 0;
 }
 /* turn corresponding bit on, so we can remember that we got the packet */
diff --git a/net/bluetooth/bnep/sock.c b/net/bluetooth/bnep/sock.c
index 5e5f5b410e0b..1eaacf10d19d 100644
--- a/net/bluetooth/bnep/sock.c
+++ b/net/bluetooth/bnep/sock.c
@@ -58,7 +58,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        switch (cmd) {
        case BNEPCONNADD:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&ca, argp, sizeof(ca)))
                        return -EFAULT;
@@ -84,7 +84,7 @@ static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        case BNEPCONNDEL:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&cd, argp, sizeof(cd)))
                        return -EFAULT;
diff --git a/net/bluetooth/cmtp/sock.c b/net/bluetooth/cmtp/sock.c
index 311668d14571..32dc83dcb6b2 100644
--- a/net/bluetooth/cmtp/sock.c
+++ b/net/bluetooth/cmtp/sock.c
@@ -72,7 +72,7 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        switch (cmd) {
        case CMTPCONNADD:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&ca, argp, sizeof(ca)))
                        return -EFAULT;
@@ -97,7 +97,7 @@ static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        case CMTPCONNDEL:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&cd, argp, sizeof(cd)))
                        return -EFAULT;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 19fdac78e555..d5ace1eda3ed 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -490,7 +490,7 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
        switch (cmd) {
        case HCISETRAW:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
                        return -EPERM;
@@ -510,12 +510,12 @@ static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
        case HCIBLOCKADDR:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_sock_blacklist_add(hdev, (void __user *) arg);
        case HCIUNBLOCKADDR:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_sock_blacklist_del(hdev, (void __user *) arg);
        default:
@@ -546,22 +546,22 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
        case HCIDEVUP:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_dev_open(arg);
        case HCIDEVDOWN:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_dev_close(arg);
        case HCIDEVRESET:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_dev_reset(arg);
        case HCIDEVRESTAT:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_dev_reset_stat(arg);
        case HCISETSCAN:
@@ -573,7 +573,7 @@ static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
        case HCISETACLMTU:
        case HCISETSCOMTU:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                return hci_dev_cmd(cmd, argp);
        case HCIINQUIRY:
diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
index 18b3f6892a36..b24fb3bd8625 100644
--- a/net/bluetooth/hidp/sock.c
+++ b/net/bluetooth/hidp/sock.c
@@ -56,7 +56,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        switch (cmd) {
        case HIDPCONNADD:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&ca, argp, sizeof(ca)))
                        return -EFAULT;
@@ -91,7 +91,7 @@ static int hidp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long
        case HIDPCONNDEL:
                if (!capable(CAP_NET_ADMIN))
-                        return -EACCES;
+                        return -EPERM;
                if (copy_from_user(&cd, argp, sizeof(cd)))
                        return -EFAULT;
diff --git a/net/core/dev.c b/net/core/dev.c
index d7fe32c946c1..89e33a5d4d93 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2134,7 +2134,8 @@ static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
 static netdev_features_t harmonize_features(struct sk_buff *skb,
        __be16 protocol, netdev_features_t features)
 {
-        if (!can_checksum_protocol(features, protocol)) {
+        if (skb->ip_summed != CHECKSUM_NONE &&
+            !can_checksum_protocol(features, protocol)) {
                features &= ~NETIF_F_ALL_CSUM;
                features &= ~NETIF_F_SG;
        } else if (illegal_highdma(skb->dev, skb)) {
@@ -3322,7 +3323,7 @@ ncls:
        if (pt_prev) {
                if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
-                        ret = -ENOMEM;
+                        goto drop;
                else
                        ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
        } else {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index fe00d1208167..e33ebae519c8 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3502,7 +3502,9 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
        if (!skb_cloned(from))
                skb_shinfo(from)->nr_frags = 0;
-        /* if the skb is cloned this does nothing since we set nr_frags to 0 */
+        /* if the skb is not cloned this does nothing
+         * since we set nr_frags to 0.
+         */
        for (i = 0; i < skb_shinfo(from)->nr_frags; i++)
                skb_frag_ref(from, i);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 77e87aff419a..47800459e4cb 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1225,7 +1225,7 @@ static int arp_netdev_event(struct notifier_block *this, unsigned long event,
        switch (event) {
        case NETDEV_CHANGEADDR:
                neigh_changeaddr(&arp_tbl, dev);
-                rt_cache_flush(dev_net(dev), 0);
+                rt_cache_flush(dev_net(dev));
                break;
        default:
                break;
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 44bf82e3aef7..e12fad773852 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -725,7 +725,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
                break;
        case SIOCSIFFLAGS:
-                ret = -EACCES;
+                ret = -EPERM;
                if (!capable(CAP_NET_ADMIN))
                        goto out;
                break;
@@ -733,7 +733,7 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
        case SIOCSIFBRDADDR:    /* Set the broadcast address */
        case SIOCSIFDSTADDR:    /* Set the destination address */
        case SIOCSIFNETMASK:    /* Set the netmask for the interface */
-                ret = -EACCES;
+                ret = -EPERM;
                if (!capable(CAP_NET_ADMIN))
                        goto out;
                ret = -EINVAL;
@@ -1503,7 +1503,7 @@ static int devinet_conf_proc(ctl_table *ctl, int write,
                if (i == IPV4_DEVCONF_ACCEPT_LOCAL - 1 ||
                    i == IPV4_DEVCONF_ROUTE_LOCALNET - 1)
                        if ((new_value == 0) && (old_value != 0))
-                                rt_cache_flush(net, 0);
+                                rt_cache_flush(net);
        }
        return ret;
@@ -1537,7 +1537,7 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
                                dev_disable_lro(idev->dev);
                        }
                        rtnl_unlock();
-                        rt_cache_flush(net, 0);
+                        rt_cache_flush(net);
                }
        }
@@ -1554,7 +1554,7 @@ static int ipv4_doint_and_flush(ctl_table *ctl, int write,
        struct net *net = ctl->extra2;
        if (write && *valp != val)
-                rt_cache_flush(net, 0);
+                rt_cache_flush(net);
        return ret;
 }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index c43ae3fba792..8e2b475da9fa 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -148,7 +148,7 @@ static void fib_flush(struct net *net)
        }
        if (flushed)
-                rt_cache_flush(net, -1);
+                rt_cache_flush(net);
 }
 /*
@@ -999,11 +999,11 @@ static void nl_fib_lookup_exit(struct net *net)
        net->ipv4.fibnl = NULL;
 }
-static void fib_disable_ip(struct net_device *dev, int force, int delay)
+static void fib_disable_ip(struct net_device *dev, int force)
 {
        if (fib_sync_down_dev(dev, force))
                fib_flush(dev_net(dev));
-        rt_cache_flush(dev_net(dev), delay);
+        rt_cache_flush(dev_net(dev));
        arp_ifdown(dev);
 }
@@ -1020,7 +1020,7 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                fib_sync_up(dev);
 #endif
                atomic_inc(&net->ipv4.dev_addr_genid);
-                rt_cache_flush(dev_net(dev), -1);
+                rt_cache_flush(dev_net(dev));
                break;
        case NETDEV_DOWN:
                fib_del_ifaddr(ifa, NULL);
@@ -1029,9 +1029,9 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
                        /* Last address was deleted from this interface.
                         * Disable IP.
                         */
-                        fib_disable_ip(dev, 1, 0);
+                        fib_disable_ip(dev, 1);
                } else {
-                        rt_cache_flush(dev_net(dev), -1);
+                        rt_cache_flush(dev_net(dev));
                }
                break;
        }
@@ -1045,7 +1045,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
        struct net *net = dev_net(dev);
        if (event == NETDEV_UNREGISTER) {
-                fib_disable_ip(dev, 2, -1);
+                fib_disable_ip(dev, 2);
                rt_flush_dev(dev);
                return NOTIFY_DONE;
        }
@@ -1062,14 +1062,14 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
                fib_sync_up(dev);
 #endif
                atomic_inc(&net->ipv4.dev_addr_genid);
-                rt_cache_flush(dev_net(dev), -1);
+                rt_cache_flush(dev_net(dev));
                break;
        case NETDEV_DOWN:
-                fib_disable_ip(dev, 0, 0);
+                fib_disable_ip(dev, 0);
                break;
        case NETDEV_CHANGEMTU:
        case NETDEV_CHANGE:
-                rt_cache_flush(dev_net(dev), 0);
+                rt_cache_flush(dev_net(dev));
                break;
        case NETDEV_UNREGISTER_BATCH:
                break;
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index a83d74e498d2..274309d3aded 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -259,7 +259,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
 {
-        rt_cache_flush(ops->fro_net, -1);
+        rt_cache_flush(ops->fro_net);
 }
 static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 57bd978483e1..d1b93595b4a7 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1286,7 +1286,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
                        fib_release_info(fi_drop);
                        if (state & FA_S_ACCESSED)
-                                rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+                                rt_cache_flush(cfg->fc_nlinfo.nl_net);
                        rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen,
                                tb->tb_id, &cfg->fc_nlinfo, NLM_F_REPLACE);
@@ -1333,7 +1333,7 @@ int fib_table_insert(struct fib_table *tb, struct fib_config *cfg)
        list_add_tail_rcu(&new_fa->fa_list,
                          (fa ? &fa->fa_list : fa_head));
-        rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+        rt_cache_flush(cfg->fc_nlinfo.nl_net);
        rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id,
                  &cfg->fc_nlinfo, 0);
 succeeded:
@@ -1708,7 +1708,7 @@ int fib_table_delete(struct fib_table *tb, struct fib_config *cfg)
                trie_leaf_remove(t, l);
        if (fa->fa_state & FA_S_ACCESSED)
-                rt_cache_flush(cfg->fc_nlinfo.nl_net, -1);
+                rt_cache_flush(cfg->fc_nlinfo.nl_net);
        fib_release_info(fa->fa_info);
        alias_free_mem_rcu(fa);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 82cf2a722b23..fd9af60397b5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -202,11 +202,6 @@ EXPORT_SYMBOL(ip_tos2prio);
 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
 #define RT_CACHE_STAT_INC(field) __this_cpu_inc(rt_cache_stat.field)
-static inline int rt_genid(struct net *net)
-{
-        return atomic_read(&net->ipv4.rt_genid);
-}
 #ifdef CONFIG_PROC_FS
 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
 {
@@ -447,27 +442,9 @@ static inline bool rt_is_expired(const struct rtable *rth)
        return rth->rt_genid != rt_genid(dev_net(rth->dst.dev));
 }
-/*
+void rt_cache_flush(struct net *net)
- * Perturbation of rt_genid by a small quantity [1..256]
- * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
- * many times (2^24) without giving recent rt_genid.
- * Jenkins hash is strong enough that litle changes of rt_genid are OK.
- */
-static void rt_cache_invalidate(struct net *net)
 {
-        unsigned char shuffle;
+        rt_genid_bump(net);
-        get_random_bytes(&shuffle, sizeof(shuffle));
-        atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-}
-/*
- * delay < 0  : invalidate cache (fast : entries will be deleted later)
- * delay >= 0 : invalidate & flush cache (can be long)
- */
-void rt_cache_flush(struct net *net, int delay)
-{
-        rt_cache_invalidate(net);
 }
 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
@@ -2345,7 +2322,7 @@ int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
 void ip_rt_multicast_event(struct in_device *in_dev)
 {
-        rt_cache_flush(dev_net(in_dev->dev), 0);
+        rt_cache_flush(dev_net(in_dev->dev));
 }
 #ifdef CONFIG_SYSCTL
@@ -2354,16 +2331,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
                                        size_t *lenp, loff_t *ppos)
 {
        if (write) {
-                int flush_delay;
+                rt_cache_flush((struct net *)__ctl->extra1);
-                ctl_table ctl;
-                struct net *net;
-                memcpy(&ctl, __ctl, sizeof(ctl));
-                ctl.data = &flush_delay;
-                proc_dointvec(&ctl, write, buffer, lenp, ppos);
-                net = (struct net *)__ctl->extra1;
-                rt_cache_flush(net, flush_delay);
                return 0;
        }
@@ -2533,8 +2501,7 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
 static __net_init int rt_genid_init(struct net *net)
 {
-        get_random_bytes(&net->ipv4.rt_genid,
+        atomic_set(&net->rt_genid, 0);
-                         sizeof(net->ipv4.rt_genid));
        get_random_bytes(&net->ipv4.dev_addr_genid,
                         sizeof(net->ipv4.dev_addr_genid));
        return 0;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 2109ff4a1daf..5f6419341821 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1762,8 +1762,14 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                }
 #ifdef CONFIG_NET_DMA
-                if (tp->ucopy.dma_chan)
+                if (tp->ucopy.dma_chan) {
-                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                        if (tp->rcv_wnd == 0 &&
+                            !skb_queue_empty(&sk->sk_async_wait_queue)) {
+                                tcp_service_net_dma(sk, true);
+                                tcp_cleanup_rbuf(sk, copied);
+                        } else
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+                }
 #endif
                if (copied >= target) {
                        /* Do not sleep, just process backlog. */
@@ -2325,10 +2331,17 @@ static int tcp_repair_options_est(struct tcp_sock *tp,
                        tp->rx_opt.mss_clamp = opt.opt_val;
                        break;
                case TCPOPT_WINDOW:
-                        if (opt.opt_val > 14)
+                        {
-                                return -EFBIG;
+                                u16 snd_wscale = opt.opt_val & 0xFFFF;
+                                u16 rcv_wscale = opt.opt_val >> 16;
+                                if (snd_wscale > 14 || rcv_wscale > 14)
+                                        return -EFBIG;
-                        tp->rx_opt.snd_wscale = opt.opt_val;
+                                tp->rx_opt.snd_wscale = snd_wscale;
+                                tp->rx_opt.rcv_wscale = rcv_wscale;
+                                tp->rx_opt.wscale_ok = 1;
+                        }
                        break;
                case TCPOPT_SACK_PERM:
                        if (opt.opt_val != 0)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6e38c6c23caa..d377f4854cb8 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4661,7 +4661,7 @@ queue_and_out:
                if (eaten > 0)
                        kfree_skb_partial(skb, fragstolen);
-                else if (!sock_flag(sk, SOCK_DEAD))
+                if (!sock_flag(sk, SOCK_DEAD))
                        sk->sk_data_ready(sk, 0);
                return;
        }
@@ -5556,8 +5556,7 @@ no_ack:
 #endif
                        if (eaten)
                                kfree_skb_partial(skb, fragstolen);
-                        else
+                        sk->sk_data_ready(sk, 0);
-                                sk->sk_data_ready(sk, 0);
                        return 0;
                }
        }
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 0251a6005be8..c4f934176cab 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -175,33 +175,12 @@ void __inet6_csk_dst_store(struct sock *sk, struct dst_entry *dst,
                           const struct in6_addr *saddr)
 {
        __ip6_dst_store(sk, dst, daddr, saddr);
-#ifdef CONFIG_XFRM
-        {
-                struct rt6_info *rt = (struct rt6_info  *)dst;
-                rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
-        }
-#endif
 }
 static inline
 struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
 {
-        struct dst_entry *dst;
+        return __sk_dst_check(sk, cookie);
-        dst = __sk_dst_check(sk, cookie);
-#ifdef CONFIG_XFRM
-        if (dst) {
-                struct rt6_info *rt = (struct rt6_info *)dst;
-                if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        __sk_dst_reset(sk);
-                        dst = NULL;
-                }
-        }
-#endif
-        return dst;
 }
 static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 13690d650c3e..286acfc21250 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -819,6 +819,10 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
                                        offsetof(struct rt6_info, rt6i_src),
                                        allow_create, replace_required);
+                        if (IS_ERR(sn)) {
+                                err = PTR_ERR(sn);
+                                sn = NULL;
+                        }
                        if (!sn) {
                                /* If it is failed, discard just allocated
                                   root, and then (in st_failure) stale node
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8e80fd279100..854e4018d205 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -226,7 +226,7 @@ static struct rt6_info ip6_null_entry_template = {
        .dst = {
                .__refcnt       = ATOMIC_INIT(1),
                .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                .error          = -ENETUNREACH,
                .input          = ip6_pkt_discard,
                .output         = ip6_pkt_discard_out,
@@ -246,7 +246,7 @@ static struct rt6_info ip6_prohibit_entry_template = {
        .dst = {
                .__refcnt       = ATOMIC_INIT(1),
                .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                .error          = -EACCES,
                .input          = ip6_pkt_prohibit,
                .output         = ip6_pkt_prohibit_out,
@@ -261,7 +261,7 @@ static struct rt6_info ip6_blk_hole_entry_template = {
        .dst = {
                .__refcnt       = ATOMIC_INIT(1),
                .__use          = 1,
-                .obsolete       = -1,
+                .obsolete       = DST_OBSOLETE_FORCE_CHK,
                .error          = -EINVAL,
                .input          = dst_discard,
                .output         = dst_discard,
@@ -281,13 +281,14 @@ static inline struct rt6_info *ip6_dst_alloc(struct net *net,
                                             struct fib6_table *table)
 {
        struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
-                                        0, DST_OBSOLETE_NONE, flags);
+                                        0, DST_OBSOLETE_FORCE_CHK, flags);
        if (rt) {
                struct dst_entry *dst = &rt->dst;
                memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
                rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
+                rt->rt6i_genid = rt_genid(net);
        }
        return rt;
 }
@@ -1031,6 +1032,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
        rt = (struct rt6_info *) dst;
+        /* All IPV6 dsts are created with ->obsolete set to the value
+         * DST_OBSOLETE_FORCE_CHK which forces validation calls down
+         * into this function always.
+         */
+        if (rt->rt6i_genid != rt_genid(dev_net(rt->dst.dev)))
+                return NULL;
        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
                if (rt->rt6i_peer_genid != rt6_peer_genid()) {
                        if (!rt6_has_peer(rt))
@@ -1397,8 +1405,6 @@ int ip6_route_add(struct fib6_config *cfg)
                goto out;
        }
-        rt->dst.obsolete = -1;
        if (cfg->fc_flags & RTF_EXPIRES)
                rt6_set_expires(rt, jiffies +
                                clock_t_to_jiffies(cfg->fc_expires));
@@ -2080,7 +2086,6 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
        rt->dst.input = ip6_input;
        rt->dst.output = ip6_output;
        rt->rt6i_idev = idev;
-        rt->dst.obsolete = -1;
        rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
        if (anycast)
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 1b9024ee963c..7261eb81974f 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -601,7 +601,7 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                if (!capable(CAP_NET_BIND_SERVICE)) {
                        dev_put(dev);
                        release_sock(sk);
-                        return -EACCES;
+                        return -EPERM;
                }
                nr->user_addr   = addr->fsa_digipeater[0];
                nr->source_addr = addr->fsa_ax25.sax25_call;
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e4723d31fdd5..211a21217045 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -865,7 +865,10 @@ static void qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
                if (mask) {
                        struct qfq_group *next = qfq_ffs(q, mask);
                        if (qfq_gt(roundedF, next->F)) {
-                                cl->S = next->F;
+                                if (qfq_gt(limit, next->F))
+                                        cl->S = next->F;
+                                else /* preserve timestamp correctness */
+                                        cl->S = limit;
                                return;
                        }
                }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 5a2aa17e4d3c..387848e90078 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -585,6 +585,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
        xfrm_pol_hold(policy);
        net->xfrm.policy_count[dir]++;
        atomic_inc(&flow_cache_genid);
+        rt_genid_bump(net);
        if (delpol)
                __xfrm_policy_unlink(delpol, dir);
        policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
@@ -1763,7 +1764,7 @@ static struct dst_entry *make_blackhole(struct net *net, u16 family,
        if (!afinfo) {
                dst_release(dst_orig);
-                ret = ERR_PTR(-EINVAL);
+                return ERR_PTR(-EINVAL);
        } else {
                ret = afinfo->blackhole_route(net, dst_orig);
        }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index e75d8e47f35c..289f4bf18ff0 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -123,9 +123,21 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
                                struct nlattr **attrs)
 {
        struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
+        struct xfrm_replay_state_esn *rs;
-        if ((p->flags & XFRM_STATE_ESN) && !rt)
+        if (p->flags & XFRM_STATE_ESN) {
-                return -EINVAL;
+                if (!rt)
+                        return -EINVAL;
+                rs = nla_data(rt);
+                if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8)
+                        return -EINVAL;
+                if (nla_len(rt) < xfrm_replay_state_esn_len(rs) &&
+                    nla_len(rt) != sizeof(*rs))
+                        return -EINVAL;
+        }
        if (!rt)
                return 0;
@@ -370,14 +382,15 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es
                                         struct nlattr *rp)
 {
        struct xfrm_replay_state_esn *up;
+        int ulen;
        if (!replay_esn || !rp)
                return 0;
        up = nla_data(rp);
+        ulen = xfrm_replay_state_esn_len(up);
-        if (xfrm_replay_state_esn_len(replay_esn) !=
+        if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
-                        xfrm_replay_state_esn_len(up))
                return -EINVAL;
        return 0;
@@ -388,22 +401,28 @@ static int xfrm_alloc_replay_state_esn(struct xfrm_replay_state_esn **replay_esn
                                       struct nlattr *rta)
 {
        struct xfrm_replay_state_esn *p, *pp, *up;
+        int klen, ulen;
        if (!rta)
                return 0;
        up = nla_data(rta);
+        klen = xfrm_replay_state_esn_len(up);
+        ulen = nla_len(rta) >= klen ? klen : sizeof(*up);
-        p = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
+        p = kzalloc(klen, GFP_KERNEL);
        if (!p)
                return -ENOMEM;
-        pp = kmemdup(up, xfrm_replay_state_esn_len(up), GFP_KERNEL);
+        pp = kzalloc(klen, GFP_KERNEL);
        if (!pp) {
                kfree(p);
                return -ENOMEM;
        }
+        memcpy(p, up, ulen);
+        memcpy(pp, up, ulen);
        *replay_esn = p;
        *preplay_esn = pp;
@@ -442,10 +461,11 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
 * somehow made shareable and move it to xfrm_state.c - JHS
 *
 */
-static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs)
+static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,
+                                  int update_esn)
 {
        struct nlattr *rp = attrs[XFRMA_REPLAY_VAL];
-        struct nlattr *re = attrs[XFRMA_REPLAY_ESN_VAL];
+        struct nlattr *re = update_esn ? attrs[XFRMA_REPLAY_ESN_VAL] : NULL;
        struct nlattr *lt = attrs[XFRMA_LTIME_VAL];
        struct nlattr *et = attrs[XFRMA_ETIMER_THRESH];
        struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH];
@@ -555,7 +575,7 @@ static struct xfrm_state *xfrm_state_construct(struct net *net,
                goto error;
        /* override default values from above */
-        xfrm_update_ae_params(x, attrs);
+        xfrm_update_ae_params(x, attrs, 0);
        return x;
@@ -689,6 +709,7 @@ out:
 static void copy_to_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
 {
+        memset(p, 0, sizeof(*p));
        memcpy(&p->id, &x->id, sizeof(p->id));
        memcpy(&p->sel, &x->sel, sizeof(p->sel));
        memcpy(&p->lft, &x->lft, sizeof(p->lft));
@@ -742,7 +763,7 @@ static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
                return -EMSGSIZE;
        algo = nla_data(nla);
-        strcpy(algo->alg_name, auth->alg_name);
+        strncpy(algo->alg_name, auth->alg_name, sizeof(algo->alg_name));
        memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
        algo->alg_key_len = auth->alg_key_len;
@@ -878,6 +899,7 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
 {
        struct xfrm_dump_info info;
        struct sk_buff *skb;
+        int err;
        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
        if (!skb)
@@ -888,9 +910,10 @@ static struct sk_buff *xfrm_state_netlink(struct sk_buff *in_skb,
        info.nlmsg_seq = seq;
        info.nlmsg_flags = 0;
-        if (dump_one_state(x, 0, &info)) {
+        err = dump_one_state(x, 0, &info);
+        if (err) {
                kfree_skb(skb);
-                return NULL;
+                return ERR_PTR(err);
        }
        return skb;
@@ -1317,6 +1340,7 @@ static void copy_from_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy
 static void copy_to_user_policy(struct xfrm_policy *xp, struct xfrm_userpolicy_info *p, int dir)
 {
+        memset(p, 0, sizeof(*p));
        memcpy(&p->sel, &xp->selector, sizeof(p->sel));
        memcpy(&p->lft, &xp->lft, sizeof(p->lft));
        memcpy(&p->curlft, &xp->curlft, sizeof(p->curlft));
@@ -1421,6 +1445,7 @@ static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
                struct xfrm_user_tmpl *up = &vec[i];
                struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
+                memset(up, 0, sizeof(*up));
                memcpy(&up->id, &kp->id, sizeof(up->id));
                up->family = kp->encap_family;
                memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
@@ -1546,6 +1571,7 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
 {
        struct xfrm_dump_info info;
        struct sk_buff *skb;
+        int err;
        skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
        if (!skb)
@@ -1556,9 +1582,10 @@ static struct sk_buff *xfrm_policy_netlink(struct sk_buff *in_skb,
        info.nlmsg_seq = seq;
        info.nlmsg_flags = 0;
-        if (dump_one_policy(xp, dir, 0, &info) < 0) {
+        err = dump_one_policy(xp, dir, 0, &info);
+        if (err) {
                kfree_skb(skb);
-                return NULL;
+                return ERR_PTR(err);
        }
        return skb;
@@ -1822,7 +1849,7 @@ static int xfrm_new_ae(struct sk_buff *skb, struct nlmsghdr *nlh,
                goto out;
        spin_lock_bh(&x->lock);
-        xfrm_update_ae_params(x, attrs);
+        xfrm_update_ae_params(x, attrs, 1);
        spin_unlock_bh(&x->lock);
        c.event = nlh->nlmsg_type;
diff --git a/scripts/Makefile.fwinst b/scripts/Makefile.fwinst
index c3f69ae275d1..4d908d16c035 100644
--- a/scripts/Makefile.fwinst
+++ b/scripts/Makefile.fwinst
@@ -27,7 +27,7 @@ endif
 installed-mod-fw := $(addprefix $(INSTALL_FW_PATH)/,$(mod-fw))
 installed-fw := $(addprefix $(INSTALL_FW_PATH)/,$(fw-shipped-all))
-installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/.
+installed-fw-dirs := $(sort $(dir $(installed-fw))) $(INSTALL_FW_PATH)/./
 # Workaround for make < 3.81, where .SECONDEXPANSION doesn't work.
 PHONY += $(INSTALL_FW_PATH)/$$(%) install-all-dirs
@@ -42,7 +42,7 @@ quiet_cmd_install = INSTALL $(subst $(srctree)/,,$@)
 $(installed-fw-dirs):
        $(call cmd,mkdir)
-$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $$(dir $(INSTALL_FW_PATH)/%)
+$(installed-fw): $(INSTALL_FW_PATH)/%: $(obj)/% | $(INSTALL_FW_PATH)/$$(dir %)
        $(call cmd,install)
 PHONY +=  __fw_install __fw_modinst FORCE
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index c220f314709c..65f67cb0aefb 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -51,6 +51,7 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
 static inline void selinux_xfrm_notify_policyload(void)
 {
        atomic_inc(&flow_cache_genid);
+        rt_genid_bump(&init_net);
 }
 #else
 static inline int selinux_xfrm_enabled(void)