188 files changed, 1215 insertions, 714 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 033d4e69b43b..d99fd9c0ec0e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2211,6 +2211,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
                         default: off.
 
+        printk.always_kmsg_dump=
+                        Trigger kmsg_dump for cases other than kernel oops or
+                        panics
+                        Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
+                        default: disabled
+
         printk.time=    Show timing data prefixed to each printk message line
                         Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 0a96e80d4515..b087b3bca290 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1310,7 +1310,7 @@ F:	drivers/atm/
 F:      include/linux/atm*
 
 ATMEL AT91 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.atmel.com/products/AT91/
 W:      http://www.at91.com/
@@ -1318,7 +1318,7 @@ S:	Maintained
 F:      drivers/mmc/host/at91_mci.c
 
 ATMEL AT91 / AT32 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 S:      Maintained
 F:      drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
@@ -7271,7 +7271,7 @@ WATCHDOG DEVICE DRIVERS
 M:      Wim Van Sebroeck <wim@iguana.be>
 L:      linux-watchdog@vger.kernel.org
 W:      http://www.linux-watchdog.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog.git
+T:      git git://www.linux-watchdog.org/linux-watchdog.git
 S:      Maintained
 F:      Documentation/watchdog/
 F:      drivers/watchdog/
diff --git a/Makefile b/Makefile
index b61a9638b6fc..66d13c917bc7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/futex.h b/arch/alpha/include/asm/futex.h
index e8a761aee088..f939794363ac 100644
--- a/arch/alpha/include/asm/futex.h
+++ b/arch/alpha/include/asm/futex.h
@@ -108,7 +108,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
         "       lda     $31,3b-2b(%0)\n"
         "       .previous\n"
         :       "+r"(ret), "=&r"(prev), "=&r"(cmp)
-        :       "r"(uaddr), "r"((long)oldval), "r"(newval)
+        :       "r"(uaddr), "r"((long)(int)oldval), "r"(newval)
         :       "memory");
 
         *uval = prev;
diff --git a/arch/arm/mach-lpc32xx/include/mach/irqs.h b/arch/arm/mach-lpc32xx/include/mach/irqs.h
index 2667f52e3b04..9e3b90df32e1 100644
--- a/arch/arm/mach-lpc32xx/include/mach/irqs.h
+++ b/arch/arm/mach-lpc32xx/include/mach/irqs.h
@@ -61,7 +61,7 @@
  */
 #define IRQ_LPC32XX_JTAG_COMM_TX        LPC32XX_SIC1_IRQ(1)
 #define IRQ_LPC32XX_JTAG_COMM_RX        LPC32XX_SIC1_IRQ(2)
-#define IRQ_LPC32XX_GPI_11              LPC32XX_SIC1_IRQ(4)
+#define IRQ_LPC32XX_GPI_28              LPC32XX_SIC1_IRQ(4)
 #define IRQ_LPC32XX_TS_P                LPC32XX_SIC1_IRQ(6)
 #define IRQ_LPC32XX_TS_IRQ              LPC32XX_SIC1_IRQ(7)
 #define IRQ_LPC32XX_TS_AUX              LPC32XX_SIC1_IRQ(8)
diff --git a/arch/arm/mach-lpc32xx/irq.c b/arch/arm/mach-lpc32xx/irq.c
index 4eae566dfdc7..c74de01ab5b6 100644
--- a/arch/arm/mach-lpc32xx/irq.c
+++ b/arch/arm/mach-lpc32xx/irq.c
@@ -118,6 +118,10 @@ static const struct lpc32xx_event_info lpc32xx_events[NR_IRQS] = {
                 .event_group = &lpc32xx_event_pin_regs,
                 .mask = LPC32XX_CLKPWR_EXTSRC_GPI_06_BIT,
         },
+        [IRQ_LPC32XX_GPI_28] = {
+                .event_group = &lpc32xx_event_pin_regs,
+                .mask = LPC32XX_CLKPWR_EXTSRC_GPI_28_BIT,
+        },
         [IRQ_LPC32XX_GPIO_00] = {
                 .event_group = &lpc32xx_event_int_regs,
                 .mask = LPC32XX_CLKPWR_INTSRC_GPIO_00_BIT,
@@ -305,9 +309,18 @@ static int lpc32xx_irq_wake(struct irq_data *d, unsigned int state)
 
                 if (state)
                         eventreg |= lpc32xx_events[d->irq].mask;
-                else
+                else {
                         eventreg &= ~lpc32xx_events[d->irq].mask;
 
+                        /*
+                         * When disabling the wakeup, clear the latched
+                         * event
+                         */
+                        __raw_writel(lpc32xx_events[d->irq].mask,
+                                lpc32xx_events[d->irq].
+                                event_group->rawstat_reg);
+                }
+
                 __raw_writel(eventreg,
                         lpc32xx_events[d->irq].event_group->enab_reg);
 
@@ -380,13 +393,15 @@ void __init lpc32xx_init_irq(void)
 
         /* Setup SIC1 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
 
         /* Setup SIC2 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
 
         /* Configure supported IRQ's */
         for (i = 0; i < NR_IRQS; i++) {
diff --git a/arch/arm/mach-lpc32xx/serial.c b/arch/arm/mach-lpc32xx/serial.c
index 429cfdbb2b3d..f2735281616a 100644
--- a/arch/arm/mach-lpc32xx/serial.c
+++ b/arch/arm/mach-lpc32xx/serial.c
@@ -88,6 +88,7 @@ struct uartinit {
         char *uart_ck_name;
         u32 ck_mode_mask;
         void __iomem *pdiv_clk_reg;
+        resource_size_t mapbase;
 };
 
 static struct uartinit uartinit_data[] __initdata = {
@@ -97,6 +98,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 5),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART5_CLK_CTRL,
+                .mapbase = LPC32XX_UART5_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART3_SELECT
@@ -105,6 +107,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 3),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART3_CLK_CTRL,
+                .mapbase = LPC32XX_UART3_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART4_SELECT
@@ -113,6 +116,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 4),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART4_CLK_CTRL,
+                .mapbase = LPC32XX_UART4_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART6_SELECT
@@ -121,6 +125,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 6),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART6_CLK_CTRL,
+                .mapbase = LPC32XX_UART6_BASE,
         },
 #endif
 };
@@ -165,11 +170,24 @@ void __init lpc32xx_serial_init(void)
 
                 /* pre-UART clock divider set to 1 */
                 __raw_writel(0x0101, uartinit_data[i].pdiv_clk_reg);
+
+                /*
+                 * Force a flush of the RX FIFOs to work around a
+                 * HW bug
+                 */
+                puart = uartinit_data[i].mapbase;
+                __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
+                __raw_writel(0x00, LPC32XX_UART_DLL_FIFO(puart));
+                j = LPC32XX_SUART_FIFO_SIZE;
+                while (j--)
+                        tmp = __raw_readl(
+                                LPC32XX_UART_DLL_FIFO(puart));
+                __raw_writel(0, LPC32XX_UART_IIR_FCR(puart));
         }
 
         /* This needs to be done after all UART clocks are setup */
         __raw_writel(clkmodes, LPC32XX_UARTCTL_CLKMODE);
-        for (i = 0; i < ARRAY_SIZE(uartinit_data) - 1; i++) {
+        for (i = 0; i < ARRAY_SIZE(uartinit_data); i++) {
                 /* Force a flush of the RX FIFOs to work around a HW bug */
                 puart = serial_std_platform_data[i].mapbase;
                 __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
diff --git a/arch/arm/mach-mmp/aspenite.c b/arch/arm/mach-mmp/aspenite.c
index 17cb76060125..3588a5584153 100644
--- a/arch/arm/mach-mmp/aspenite.c
+++ b/arch/arm/mach-mmp/aspenite.c
@@ -17,7 +17,6 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/nand.h>
 #include <linux/interrupt.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 7bc17eaa12eb..ada1213982b4 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -24,7 +24,6 @@
 #include <mach/dma.h>
 #include <mach/devices.h>
 #include <mach/mfp.h>
-#include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <mach/pxa168.h>
 
diff --git a/arch/arm/mach-mmp/tavorevb.c b/arch/arm/mach-mmp/tavorevb.c
index 8e3b5af04a57..bc97170125bf 100644
--- a/arch/arm/mach-mmp/tavorevb.c
+++ b/arch/arm/mach-mmp/tavorevb.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/smc91x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index 309369ea6978..be2002f42dea 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -416,13 +416,13 @@ static void __init innovator_init(void)
 #ifdef CONFIG_ARCH_OMAP15XX
         if (cpu_is_omap1510()) {
                 omap1_usb_init(&innovator1510_usb_config);
-                innovator_config[1].data = &innovator1510_lcd_config;
+                innovator_config[0].data = &innovator1510_lcd_config;
         }
 #endif
 #ifdef CONFIG_ARCH_OMAP16XX
         if (cpu_is_omap1610()) {
                 omap1_usb_init(&h2_usb_config);
-                innovator_config[1].data = &innovator1610_lcd_config;
+                innovator_config[0].data = &innovator1610_lcd_config;
         }
 #endif
         omap_board_config = innovator_config;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index d965da45160e..e20c8ab80b0e 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -364,8 +364,8 @@ config OMAP3_SDRC_AC_TIMING
           going on could result in system crashes;
 
 config OMAP4_ERRATA_I688
-        bool "OMAP4 errata: Async Bridge Corruption (BROKEN)"
-        depends on ARCH_OMAP4 && BROKEN
+        bool "OMAP4 errata: Async Bridge Corruption"
+        depends on ARCH_OMAP4
         select ARCH_HAS_BARRIERS
         help
           If a data is stalled inside asynchronous bridge because of back
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index 42a4d11fad23..672262717601 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -371,7 +371,11 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
         else
                 *openp = 0;
 
+#ifdef CONFIG_MMC_OMAP
         omap_mmc_notify_cover_event(mmc_device, index, *openp);
+#else
+        pr_warn("MMC: notify cover event not available\n");
+#endif
 }
 
 static int n8x0_mmc_late_init(struct device *dev)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index c775bead1497..c877236a8442 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -381,7 +381,7 @@ static int omap3evm_twl_gpio_setup(struct device *dev,
         gpio_request_one(gpio + 7, GPIOF_OUT_INIT_LOW, "EN_DVI");
 
         /* TWL4030_GPIO_MAX + 1 == ledB (out, active low LED) */
-        gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
+        gpio_leds[0].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
         platform_device_register(&leds_gpio);
 
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index febffde2ff10..7e9338e8d684 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -132,6 +132,7 @@ void omap3_map_io(void);
 void am33xx_map_io(void);
 void omap4_map_io(void);
 void ti81xx_map_io(void);
+void omap_barriers_init(void);
 
 /**
  * omap_test_timeout - busy-loop, testing a condition
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index cfdbb86bc84e..72e018b9b260 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -65,7 +65,6 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
         struct timespec ts_preidle, ts_postidle, ts_idle;
         u32 cpu1_state;
         int idle_time;
-        int new_state_idx;
         int cpu_id = smp_processor_id();
 
         /* Used to keep track of the total time in idle */
@@ -84,8 +83,8 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
          */
         cpu1_state = pwrdm_read_pwrst(cpu1_pd);
         if (cpu1_state != PWRDM_POWER_OFF) {
-                new_state_idx = drv->safe_state_index;
-                cx = cpuidle_get_statedata(&dev->states_usage[new_state_idx]);
+                index = drv->safe_state_index;
+                cx = cpuidle_get_statedata(&dev->states_usage[index]);
         }
 
         if (index > 0)
diff --git a/arch/arm/mach-omap2/gpmc-smsc911x.c b/arch/arm/mach-omap2/gpmc-smsc911x.c
index 997033129d26..bbb870c04a5e 100644
--- a/arch/arm/mach-omap2/gpmc-smsc911x.c
+++ b/arch/arm/mach-omap2/gpmc-smsc911x.c
@@ -19,6 +19,8 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 
 #include <plat/board.h>
 #include <plat/gpmc.h>
@@ -42,6 +44,50 @@ static struct smsc911x_platform_config gpmc_smsc911x_config = {
         .flags          = SMSC911X_USE_16BIT,
 };
 
+static struct regulator_consumer_supply gpmc_smsc911x_supply[] = {
+        REGULATOR_SUPPLY("vddvario", "smsc911x.0"),
+        REGULATOR_SUPPLY("vdd33a", "smsc911x.0"),
+};
+
+/* Generic regulator definition to satisfy smsc911x */
+static struct regulator_init_data gpmc_smsc911x_reg_init_data = {
+        .constraints = {
+                .min_uV                 = 3300000,
+                .max_uV                 = 3300000,
+                .valid_modes_mask       = REGULATOR_MODE_NORMAL
+                                        | REGULATOR_MODE_STANDBY,
+                .valid_ops_mask         = REGULATOR_CHANGE_MODE
+                                        | REGULATOR_CHANGE_STATUS,
+        },
+        .num_consumer_supplies  = ARRAY_SIZE(gpmc_smsc911x_supply),
+        .consumer_supplies      = gpmc_smsc911x_supply,
+};
+
+static struct fixed_voltage_config gpmc_smsc911x_fixed_reg_data = {
+        .supply_name            = "gpmc_smsc911x",
+        .microvolts             = 3300000,
+        .gpio                   = -EINVAL,
+        .startup_delay          = 0,
+        .enable_high            = 0,
+        .enabled_at_boot        = 1,
+        .init_data              = &gpmc_smsc911x_reg_init_data,
+};
+
+/*
+ * Platform device id of 42 is a temporary fix to avoid conflicts
+ * with other reg-fixed-voltage devices. The real fix should
+ * involve the driver core providing a way of dynamically
+ * assigning a unique id on registration for platform devices
+ * in the same name space.
+ */
+static struct platform_device gpmc_smsc911x_regulator = {
+        .name           = "reg-fixed-voltage",
+        .id             = 42,
+        .dev = {
+                .platform_data  = &gpmc_smsc911x_fixed_reg_data,
+        },
+};
+
 /*
  * Initialize smsc911x device connected to the GPMC. Note that we
  * assume that pin multiplexing is done in the board-*.c file,
@@ -55,6 +101,12 @@ void __init gpmc_smsc911x_init(struct omap_smsc911x_platform_data *board_data)
 
         gpmc_cfg = board_data;
 
+        ret = platform_device_register(&gpmc_smsc911x_regulator);
+        if (ret < 0) {
+                pr_err("Unable to register smsc911x regulators: %d\n", ret);
+                return;
+        }
+
         if (gpmc_cs_request(gpmc_cfg->cs, SZ_16M, &cs_mem_base) < 0) {
                 pr_err("Failed to request GPMC mem region\n");
                 return;
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index b40c28895298..19dd1657245c 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -428,6 +428,7 @@ static int omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
         return 0;
 }
 
+static int omap_hsmmc_done;
 #define MAX_OMAP_MMC_HWMOD_NAME_LEN             16
 
 void omap_init_hsmmc(struct omap2_hsmmc_info *hsmmcinfo, int ctrl_nr)
@@ -491,6 +492,11 @@ void omap2_hsmmc_init(struct omap2_hsmmc_info *controllers)
 {
         u32 reg;
 
+        if (omap_hsmmc_done)
+                return;
+
+        omap_hsmmc_done = 1;
+
         if (!cpu_is_omap44xx()) {
                 if (cpu_is_omap2430()) {
                         control_pbias_offset = OMAP243X_CONTROL_PBIAS_LITE;
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index eb50c29fb644..fb11b44fbdec 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -307,6 +307,7 @@ void __init omapam33xx_map_common_io(void)
 void __init omap44xx_map_common_io(void)
 {
         iotable_init(omap44xx_io_desc, ARRAY_SIZE(omap44xx_io_desc));
+        omap_barriers_init();
 }
 #endif
 
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index 609ea2ded7e3..2cc1aa004b94 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -281,8 +281,16 @@ static struct omap_mbox mbox_iva_info = {
         .ops    = &omap2_mbox_ops,
         .priv   = &omap2_mbox_iva_priv,
 };
+#endif
 
-struct omap_mbox *omap2_mboxes[] = { &mbox_dsp_info, &mbox_iva_info, NULL };
+#ifdef CONFIG_ARCH_OMAP2
+struct omap_mbox *omap2_mboxes[] = {
+        &mbox_dsp_info,
+#ifdef CONFIG_SOC_OMAP2420
+        &mbox_iva_info,
+#endif
+        NULL
+};
 #endif
 
 #if defined(CONFIG_ARCH_OMAP4)
@@ -412,7 +420,8 @@ static void __exit omap2_mbox_exit(void)
         platform_driver_unregister(&omap2_mbox_driver);
 }
 
-module_init(omap2_mbox_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap2_mbox_init);
 module_exit(omap2_mbox_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fb8bc9fa43b1..611a0e3d54ca 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -218,7 +218,7 @@ static int _omap_mux_get_by_name(struct omap_mux_partition *partition,
         return -ENODEV;
 }
 
-static int __init
+static int
 omap_mux_get_by_name(const char *muxname,
                         struct omap_mux_partition **found_partition,
                         struct omap_mux **found_mux)
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 40a8fbc07e4b..ebc595091312 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -24,6 +24,7 @@
 
 #include <plat/irqs.h>
 #include <plat/sram.h>
+#include <plat/omap-secure.h>
 
 #include <mach/hardware.h>
 #include <mach/omap-wakeupgen.h>
@@ -43,6 +44,9 @@ static void __iomem *sar_ram_base;
 
 void __iomem *dram_sync, *sram_sync;
 
+static phys_addr_t paddr;
+static u32 size;
+
 void omap_bus_sync(void)
 {
         if (dram_sync && sram_sync) {
@@ -52,18 +56,20 @@ void omap_bus_sync(void)
         }
 }
 
-static int __init omap_barriers_init(void)
+/* Steal one page physical memory for barrier implementation */
+int __init omap_barrier_reserve_memblock(void)
 {
-        struct map_desc dram_io_desc[1];
-        phys_addr_t paddr;
-        u32 size;
-
-        if (!cpu_is_omap44xx())
-                return -ENODEV;
 
         size = ALIGN(PAGE_SIZE, SZ_1M);
         paddr = arm_memblock_steal(size, SZ_1M);
 
+        return 0;
+}
+
+void __init omap_barriers_init(void)
+{
+        struct map_desc dram_io_desc[1];
+
         dram_io_desc[0].virtual = OMAP4_DRAM_BARRIER_VA;
         dram_io_desc[0].pfn = __phys_to_pfn(paddr);
         dram_io_desc[0].length = size;
@@ -75,9 +81,10 @@ static int __init omap_barriers_init(void)
         pr_info("OMAP4: Map 0x%08llx to 0x%08lx for dram barrier\n",
                 (long long) paddr, dram_io_desc[0].virtual);
 
-        return 0;
 }
-core_initcall(omap_barriers_init);
+#else
+void __init omap_barriers_init(void)
+{}
 #endif
 
 void __init gic_init_irq(void)
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 1881fe915149..5a65dd04aa38 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -174,14 +174,17 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
         freq = clk->rate;
         clk_put(clk);
 
+        rcu_read_lock();
         opp = opp_find_freq_ceil(dev, &freq);
         if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 pr_err("%s: unable to find boot up OPP for vdd_%s\n",
                         __func__, vdd_name);
                 goto exit;
         }
 
         bootup_volt = opp_get_voltage(opp);
+        rcu_read_unlock();
         if (!bootup_volt) {
                 pr_err("%s: unable to find voltage corresponding "
                         "to the bootup OPP for vdd_%s\n", __func__, vdd_name);
diff --git a/arch/arm/mach-omap2/usb-host.c b/arch/arm/mach-omap2/usb-host.c
index 771dc781b746..f51348dafafd 100644
--- a/arch/arm/mach-omap2/usb-host.c
+++ b/arch/arm/mach-omap2/usb-host.c
@@ -486,7 +486,7 @@ static void setup_4430ohci_io_mux(const enum usbhs_omap_port_mode *port_mode)
 void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
 {
         struct omap_hwmod       *oh[2];
-        struct omap_device      *od;
+        struct platform_device  *pdev;
         int                     bus_id = -1;
         int                     i;
 
@@ -522,11 +522,11 @@ void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
                 return;
         }
 
-        od = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
+        pdev = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
                                 (void *)&usbhs_data, sizeof(usbhs_data),
                                 omap_uhhtll_latency,
                                 ARRAY_SIZE(omap_uhhtll_latency), false);
-        if (IS_ERR(od)) {
+        if (IS_ERR(pdev)) {
                 pr_err("Could not build hwmod devices %s,%s\n",
                         USBHS_UHH_HWMODNAME, USBHS_TLL_HWMODNAME);
                 return;
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index fb9b62dcf4ca..208eef1c0485 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -45,6 +45,7 @@
 #include <mach/hx4700.h>
 #include <mach/irda.h>
 
+#include <sound/ak4641.h>
 #include <video/platform_lcd.h>
 #include <video/w100fb.h>
 
@@ -765,6 +766,28 @@ static struct i2c_board_info __initdata pi2c_board_info[] = {
 };
 
 /*
+ * Asahi Kasei AK4641 on I2C
+ */
+
+static struct ak4641_platform_data ak4641_info = {
+        .gpio_power = GPIO27_HX4700_CODEC_ON,
+        .gpio_npdn  = GPIO109_HX4700_CODEC_nPDN,
+};
+
+static struct i2c_board_info i2c_board_info[] __initdata = {
+        {
+                I2C_BOARD_INFO("ak4641", 0x12),
+                .platform_data = &ak4641_info,
+        },
+};
+
+static struct platform_device audio = {
+        .name   = "hx4700-audio",
+        .id     = -1,
+};
+
+
+/*
  * PCMCIA
  */
 
@@ -790,6 +813,7 @@ static struct platform_device *devices[] __initdata = {
         &gpio_vbus,
         &power_supply,
         &strataflash,
+        &audio,
         &pcmcia,
 };
 
@@ -827,6 +851,7 @@ static void __init hx4700_init(void)
         pxa_set_ficp_info(&ficp_info);
         pxa27x_set_i2c_power_info(NULL);
         pxa_set_i2c_info(NULL);
+        i2c_register_board_info(0, ARRAY_AND_SIZE(i2c_board_info));
         i2c_register_board_info(1, ARRAY_AND_SIZE(pi2c_board_info));
         pxa2xx_set_spi_info(2, &pxa_ssp2_master_info);
         spi_register_board_info(ARRAY_AND_SIZE(tsc2046_board_info));
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 91e4f6c03766..00d6eacab8e4 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -25,7 +25,6 @@
 #include <linux/suspend.h>
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <asm/suspend.h>
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index aed6cbcf3866..c1673b3441d4 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/i2c/pxa-i2c.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <mach/hardware.h>
diff --git a/arch/arm/mach-pxa/saarb.c b/arch/arm/mach-pxa/saarb.c
index febc809ed5a6..5aded5e6148f 100644
--- a/arch/arm/mach-pxa/saarb.c
+++ b/arch/arm/mach-pxa/saarb.c
@@ -15,7 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <linux/mfd/88pm860x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
index 8d5168d253a9..30989baf7f2a 100644
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -168,6 +168,7 @@ struct battery_thresh sharpsl_battery_levels_noac[] = {
 #define MAXCTRL_SEL_SH   4
 #define MAXCTRL_STR      (1u << 7)
 
+extern int max1111_read_channel(int);
 /*
  * Read MAX1111 ADC
  */
@@ -177,8 +178,6 @@ int sharpsl_pm_pxa_read_max1111(int channel)
         if (machine_is_tosa())
             return 0;
 
-        extern int max1111_read_channel(int);
-
         /* max1111 accepts channels from 0-3, however,
          * it is encoded from 0-7 here in the code.
          */
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 34cbdac51525..438f02fe122a 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -172,10 +172,9 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
 static unsigned long spitz_charger_wakeup(void)
 {
         unsigned long ret;
-        ret = (!gpio_get_value(SPITZ_GPIO_KEY_INT)
+        ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
                 << GPIO_bit(SPITZ_GPIO_KEY_INT))
-                | (!gpio_get_value(SPITZ_GPIO_SYNC)
-                << GPIO_bit(SPITZ_GPIO_SYNC));
+                | gpio_get_value(SPITZ_GPIO_SYNC));
         return ret;
 }
 
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index 06383b51e655..4de7d1e79e73 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -69,6 +69,7 @@ void __init omap_reserve(void)
         omap_vram_reserve_sdram_memblock();
         omap_dsp_reserve_sdram_memblock();
         omap_secure_ram_reserve_memblock();
+        omap_barrier_reserve_memblock();
 }
 
 void __init omap_init_consistent_dma_size(void)
diff --git a/arch/arm/plat-omap/include/plat/omap-secure.h b/arch/arm/plat-omap/include/plat/omap-secure.h
index 3047ff923a63..8c7994ce9869 100644
--- a/arch/arm/plat-omap/include/plat/omap-secure.h
+++ b/arch/arm/plat-omap/include/plat/omap-secure.h
@@ -10,4 +10,10 @@ static inline void omap_secure_ram_reserve_memblock(void)
 { }
 #endif
 
+#ifdef CONFIG_OMAP4_ERRATA_I688
+extern int omap_barrier_reserve_memblock(void);
+#else
+static inline void omap_barrier_reserve_memblock(void)
+{ }
+#endif
 #endif /* __OMAP_SECURE_H__ */
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 7da4d0081487..a7193ae13a5d 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -146,7 +146,7 @@ static int __init alchemy_time_init(unsigned int m2int)
         cd->shift = 32;
         cd->mult = div_sc(32768, NSEC_PER_SEC, cd->shift);
         cd->max_delta_ns = clockevent_delta2ns(0xffffffff, cd);
-        cd->min_delta_ns = clockevent_delta2ns(8, cd);  /* ~0.25ms */
+        cd->min_delta_ns = clockevent_delta2ns(9, cd);  /* ~0.28ms */
         clockevents_register_device(cd);
         setup_irq(m2int, &au1x_rtcmatch2_irqaction);
 
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index 24f546985b69..e21507052066 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -96,7 +96,7 @@ void __init ath79_register_wmac(u8 *cal_data)
 {
         if (soc_is_ar913x())
                 ar913x_wmac_setup();
-        if (soc_is_ar933x())
+        else if (soc_is_ar933x())
                 ar933x_wmac_setup();
         else
                 BUG();
diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
index 4479fd669ac1..28c6b276c216 100644
--- a/arch/mips/configs/nlm_xlp_defconfig
+++ b/arch/mips/configs/nlm_xlp_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_SECCOMP is not set
 CONFIG_USE_OF=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_CGROUPS=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlp"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_LZMA=y
diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
index 7c68666fdd64..d0b857d98c91 100644
--- a/arch/mips/configs/nlm_xlr_defconfig
+++ b/arch/mips/configs/nlm_xlr_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_KEXEC=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_NAMESPACES=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlr"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
diff --git a/arch/mips/configs/powertv_defconfig b/arch/mips/configs/powertv_defconfig
index 3b0b6e8c8533..7fda0ce5f692 100644
--- a/arch/mips/configs/powertv_defconfig
+++ b/arch/mips/configs/powertv_defconfig
@@ -6,7 +6,7 @@ CONFIG_HZ_1000=y
 CONFIG_PREEMPT=y
 # CONFIG_SECCOMP is not set
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
diff --git a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
index 556e1be20bf6..fb9975c74c57 100644
--- a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
+++ b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
@@ -11,6 +11,9 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 
+struct gpio;
+struct gpio_chip;
+
 /* with the current GPIC design, up to 128 GPIOs are possible.
  * The only implementation so far is in the Au1300, which has 75 externally
  * available GPIOs.
@@ -203,7 +206,22 @@ static inline int gpio_request(unsigned int gpio, const char *label)
         return 0;
 }
 
-static inline void gpio_free(unsigned int gpio)
+static inline int gpio_request_one(unsigned gpio,
+                                        unsigned long flags, const char *label)
+{
+        return 0;
+}
+
+static inline int gpio_request_array(struct gpio *array, size_t num)
+{
+        return 0;
+}
+
+static inline void gpio_free(unsigned gpio)
+{
+}
+
+static inline void gpio_free_array(struct gpio *array, size_t num)
 {
 }
 
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index d41790928c64..da9bd7d270d1 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -39,9 +39,6 @@
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #else /* !CONFIG_HUGETLB_PAGE */
-# ifndef BUILD_BUG
-#  define BUILD_BUG() do { extern void __build_bug(void); __build_bug(); } while (0)
-# endif
 #define HPAGE_SHIFT     ({BUILD_BUG(); 0; })
 #define HPAGE_SIZE      ({BUILD_BUG(); 0; })
 #define HPAGE_MASK      ({BUILD_BUG(); 0; })
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 58fe71afd879..d5e950ab8527 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -8,7 +8,6 @@
  * SMP support for BMIPS
  */
 
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cc4a3f120f54..d79ae5437b58 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1135,7 +1135,7 @@ asmlinkage void do_mt(struct pt_regs *regs)
                 printk(KERN_DEBUG "YIELD Scheduler Exception\n");
                 break;
         case 5:
-                printk(KERN_DEBUG "Gating Storage Schedulier Exception\n");
+                printk(KERN_DEBUG "Gating Storage Scheduler Exception\n");
                 break;
         default:
                 printk(KERN_DEBUG "*** UNKNOWN THREAD EXCEPTION %d ***\n",
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index a81176f44c74..924da5eb7031 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -69,7 +69,6 @@ SECTIONS
         RODATA
 
         /* writeable */
-        _sdata = .;                             /* Start of data section */
         .data : {       /* Data */
                 . = . + DATAOFFSET;             /* for CONFIG_MAPPED_KERNEL */
 
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 937cf3368164..69ebd586d7ff 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -42,6 +42,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         const int field = sizeof(unsigned long) * 2;
         siginfo_t info;
         int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                                                 (write ? FAULT_FLAG_WRITE : 0);
 
 #if 0
         printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
@@ -91,6 +93,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         if (in_atomic() || !mm)
                 goto bad_area_nosemaphore;
 
+retry:
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (!vma)
@@ -144,7 +147,11 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.
          */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
@@ -153,12 +160,27 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
-                tsk->maj_flt++;
-        } else {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
-                tsk->min_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR) {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
+                                                  regs, address);
+                        tsk->maj_flt++;
+                } else {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                                  regs, address);
+                        tsk->min_flt++;
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /*
+                         * No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
         }
 
         up_read(&mm->mmap_sem);
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index aec2b111d35b..15521505ebe8 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -279,7 +279,6 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
         /* Propagate hose info into the subordinate devices.  */
 
-        struct list_head *ln;
         struct pci_dev *dev = bus->self;
 
         if (pci_probe_only && dev &&
@@ -288,9 +287,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
                 pcibios_fixup_device_resources(dev, bus);
         }
 
-        for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
-                dev = pci_dev_b(ln);
-
+        list_for_each_entry(dev, &bus->devices, bus_list) {
                 if ((dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
                         pcibios_fixup_device_resources(dev, bus);
         }
diff --git a/arch/mips/pmc-sierra/yosemite/ht-irq.c b/arch/mips/pmc-sierra/yosemite/ht-irq.c
index 86b98e98fb4f..62ead6601c69 100644
--- a/arch/mips/pmc-sierra/yosemite/ht-irq.c
+++ b/arch/mips/pmc-sierra/yosemite/ht-irq.c
@@ -35,16 +35,6 @@
  */
 void __init titan_ht_pcibios_fixup_bus(struct pci_bus *bus)
 {
-        struct pci_bus *current_bus = bus;
-        struct pci_dev *devices;
-        struct list_head *devices_link;
-
-        list_for_each(devices_link, &(current_bus->devices)) {
-                devices = pci_dev_b(devices_link);
-                if (devices == NULL)
-                        continue;
-        }
-
         /*
          * PLX and SPKT related changes go here
          */
diff --git a/arch/mips/txx9/generic/7segled.c b/arch/mips/txx9/generic/7segled.c
index 8e93b2122524..4642f56e70e5 100644
--- a/arch/mips/txx9/generic/7segled.c
+++ b/arch/mips/txx9/generic/7segled.c
@@ -102,7 +102,7 @@ static int __init tx_7segled_init_sysfs(void)
                         break;
                 }
                 dev->id = i;
-                dev->dev = &tx_7segled_subsys;
+                dev->bus = &tx_7segled_subsys;
                 error = device_register(dev);
                 if (!error) {
                         device_create_file(dev, &dev_attr_ascii);
diff --git a/arch/openrisc/include/asm/ptrace.h b/arch/openrisc/include/asm/ptrace.h
index 054537c5f9c9..e612ce4512c7 100644
--- a/arch/openrisc/include/asm/ptrace.h
+++ b/arch/openrisc/include/asm/ptrace.h
@@ -77,7 +77,6 @@ struct pt_regs {
         long  syscallno;        /* Syscall number (used by strace) */
         long dummy;             /* Cheap alignment fix */
 };
-#endif /* __ASSEMBLY__ */
 
 /* TODO: Rename this to REDZONE because that's what it is */
 #define STACK_FRAME_OVERHEAD  128  /* size of minimum stack frame */
@@ -87,6 +86,13 @@ struct pt_regs {
 #define user_stack_pointer(regs)        ((unsigned long)(regs)->sp)
 #define profile_pc(regs)                instruction_pointer(regs)
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->gpr[11];
+}
+
+#endif /* __ASSEMBLY__ */
+
 /*
  * Offsets used by 'ptrace' system call interface.
  */
diff --git a/arch/openrisc/kernel/init_task.c b/arch/openrisc/kernel/init_task.c
index 45744a384927..ca534082d5f3 100644
--- a/arch/openrisc/kernel/init_task.c
+++ b/arch/openrisc/kernel/init_task.c
@@ -17,6 +17,7 @@
 
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/export.h>
 
 static struct signal_struct init_signals = INIT_SIGNALS(init_signals);
 static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
index 59b302338331..4bfead220956 100644
--- a/arch/openrisc/kernel/irq.c
+++ b/arch/openrisc/kernel/irq.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/kernel_stat.h>
+#include <linux/export.h>
 
 #include <linux/irqflags.h>
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 656b94beab89..7259047d5f9d 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -188,11 +188,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                  */
                 ret = -1L;
 
-        /* Are these regs right??? */
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->syscallno,
-                                    regs->gpr[3], regs->gpr[4],
-                                    regs->gpr[5], regs->gpr[6]);
+        audit_syscall_entry(audit_arch(), regs->syscallno,
+                            regs->gpr[3], regs->gpr[4],
+                            regs->gpr[5], regs->gpr[6]);
 
         return ret ? : regs->syscallno;
 }
@@ -201,9 +199,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->gpr[11]),
-                                   regs->gpr[11]);
+        audit_syscall_exit(regs);
 
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 55cca1dac431..19ab7b2ea1cd 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -31,7 +31,11 @@ ifdef CONFIG_64BIT
 UTS_MACHINE     := parisc64
 CHECKFLAGS      += -D__LP64__=1 -m64
 WIDTH           := 64
+
+# FIXME: if no default set, should really try to locate dynamically
+ifeq ($(CROSS_COMPILE),)
 CROSS_COMPILE   := hppa64-linux-gnu-
+endif
 else # 32-bit
 WIDTH           :=
 endif
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index d1727584230a..6d99a5fcc090 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -227,6 +227,9 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
+config KEYS_COMPAT
+        def_bool y if COMPAT && KEYS
+
 config AUDIT_ARCH
         def_bool y
 
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 39f8fd4438fc..c383ce440d99 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
-#include <linux/crash_dump.h>
 #include <linux/bootmem.h>
 #include <linux/elf.h>
 #include <asm/ipl.h>
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 5d633019d8f3..50236610de83 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -223,16 +223,38 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 #ifdef CONFIG_MEMORY_HOTPLUG
 int arch_add_memory(int nid, u64 start, u64 size)
 {
-        struct pglist_data *pgdat;
+        unsigned long zone_start_pfn, zone_end_pfn, nr_pages;
+        unsigned long start_pfn = PFN_DOWN(start);
+        unsigned long size_pages = PFN_DOWN(size);
         struct zone *zone;
         int rc;
 
-        pgdat = NODE_DATA(nid);
-        zone = pgdat->node_zones + ZONE_MOVABLE;
         rc = vmem_add_mapping(start, size);
         if (rc)
                 return rc;
-        rc = __add_pages(nid, zone, PFN_DOWN(start), PFN_DOWN(size));
+        for_each_zone(zone) {
+                if (zone_idx(zone) != ZONE_MOVABLE) {
+                        /* Add range within existing zone limits */
+                        zone_start_pfn = zone->zone_start_pfn;
+                        zone_end_pfn = zone->zone_start_pfn +
+                                       zone->spanned_pages;
+                } else {
+                        /* Add remaining range to ZONE_MOVABLE */
+                        zone_start_pfn = start_pfn;
+                        zone_end_pfn = start_pfn + size_pages;
+                }
+                if (start_pfn < zone_start_pfn || start_pfn >= zone_end_pfn)
+                        continue;
+                nr_pages = (start_pfn + size_pages > zone_end_pfn) ?
+                           zone_end_pfn - start_pfn : size_pages;
+                rc = __add_pages(nid, zone, start_pfn, nr_pages);
+                if (rc)
+                        break;
+                start_pfn += nr_pages;
+                size_pages -= nr_pages;
+                if (!size_pages)
+                        break;
+        }
         if (rc)
                 vmem_remove_mapping(start, size);
         return rc;
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index fd843877e841..39e49091f648 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -315,6 +315,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         current->mm->free_area_cache = TASK_UNMAPPED_BASE;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -410,13 +417,6 @@ beyond_if:
 
         set_brk(current->mm->start_brk, current->mm->brk);
 
-        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) {
-                /* Someone check-me: is this error path enough? */
-                send_sig(SIGKILL, current, 0);
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
         /* start thread */
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index a312e76063a7..49a5cb55429b 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -60,6 +60,16 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                         DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
                 },
         },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=42619 */
+        {
+                .callback = set_use_crs,
+                .ident = "MSI MS-7253",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-7253"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                },
+        },
 
         /* Now for the blacklist.. */
 
@@ -282,9 +292,6 @@ static void add_resources(struct pci_root_info *info)
         int i;
         struct resource *res, *root, *conflict;
 
-        if (!pci_use_crs)
-                return;
-
         coalesce_windows(info, IORESOURCE_MEM);
         coalesce_windows(info, IORESOURCE_IO);
 
@@ -336,8 +343,13 @@ get_current_resources(struct acpi_device *device, int busnum,
         acpi_walk_resources(device->handle, METHOD_NAME__CRS, setup_resource,
                                 &info);
 
-        add_resources(&info);
-        return;
+        if (pci_use_crs) {
+                add_resources(&info);
+
+                return;
+        }
+
+        kfree(info.name);
 
 name_alloc_fail:
         kfree(info.res);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9baf11e86362..744f078f4dd8 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3832,7 +3832,7 @@ static int __floppy_read_block_0(struct block_device *bdev)
         bio.bi_size = size;
         bio.bi_bdev = bdev;
         bio.bi_sector = 0;
-        bio.bi_flags = BIO_QUIET;
+        bio.bi_flags = (1 << BIO_QUIET);
         init_completion(&complete);
         bio.bi_private = &complete;
         bio.bi_end_io = floppy_rb0_complete;
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 597235a2f8f9..0d40cf66b3cc 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -714,6 +714,7 @@ static int mv_hash_final(struct ahash_request *req)
 {
         struct mv_req_hash_ctx *ctx = ahash_request_ctx(req);
 
+        ahash_request_set_crypt(req, NULL, req->result, 0);
         mv_update_hash_req_ctx(ctx, 1, 0);
         return mv_handle_req(&req->base);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index d620b0784257..618bd4d87d28 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
 
+#include <drm/exynos_drm.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
@@ -44,8 +45,9 @@ struct exynos_drm_connector {
 /* convert exynos_video_timings to drm_display_mode */
 static inline void
 convert_to_display_mode(struct drm_display_mode *mode,
-                        struct fb_videomode *timing)
+                        struct exynos_drm_panel_info *panel)
 {
+        struct fb_videomode *timing = &panel->timing;
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         mode->clock = timing->pixclock / 1000;
@@ -60,6 +62,8 @@ convert_to_display_mode(struct drm_display_mode *mode,
         mode->vsync_start = mode->vdisplay + timing->upper_margin;
         mode->vsync_end = mode->vsync_start + timing->vsync_len;
         mode->vtotal = mode->vsync_end + timing->lower_margin;
+        mode->width_mm = panel->width_mm;
+        mode->height_mm = panel->height_mm;
 
         if (timing->vmode & FB_VMODE_INTERLACED)
                 mode->flags |= DRM_MODE_FLAG_INTERLACE;
@@ -148,16 +152,18 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 connector->display_info.raw_edid = edid;
         } else {
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                struct fb_videomode *timing;
+                struct exynos_drm_panel_info *panel;
 
-                if (display_ops->get_timing)
-                        timing = display_ops->get_timing(manager->dev);
+                if (display_ops->get_panel)
+                        panel = display_ops->get_panel(manager->dev);
                 else {
                         drm_mode_destroy(connector->dev, mode);
                         return 0;
                 }
 
-                convert_to_display_mode(mode, timing);
+                convert_to_display_mode(mode, panel);
+                connector->display_info.width_mm = mode->width_mm;
+                connector->display_info.height_mm = mode->height_mm;
 
                 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
                 drm_mode_set_name(mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index e685e1e33055..13540de90bfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -136,7 +136,7 @@ struct exynos_drm_overlay {
  * @type: one of EXYNOS_DISPLAY_TYPE_LCD and HDMI.
  * @is_connected: check for that display is connected or not.
  * @get_edid: get edid modes from display driver.
- * @get_timing: get timing object from display driver.
+ * @get_panel: get panel object from display driver.
  * @check_timing: check if timing is valid or not.
  * @power_on: display device on or off.
  */
@@ -145,7 +145,7 @@ struct exynos_drm_display_ops {
         bool (*is_connected)(struct device *dev);
         int (*get_edid)(struct device *dev, struct drm_connector *connector,
                                 u8 *edid, int len);
-        void *(*get_timing)(struct device *dev);
+        void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 0dbb32bb18a3..360adf2bba04 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -89,7 +89,7 @@ struct fimd_context {
         bool                            suspended;
         struct mutex                    lock;
 
-        struct fb_videomode             *timing;
+        struct exynos_drm_panel_info *panel;
 };
 
 static bool fimd_display_is_connected(struct device *dev)
@@ -101,13 +101,13 @@ static bool fimd_display_is_connected(struct device *dev)
         return true;
 }
 
-static void *fimd_get_timing(struct device *dev)
+static void *fimd_get_panel(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        return ctx->timing;
+        return ctx->panel;
 }
 
 static int fimd_check_timing(struct device *dev, void *timing)
@@ -131,7 +131,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
 static struct exynos_drm_display_ops fimd_display_ops = {
         .type = EXYNOS_DISPLAY_TYPE_LCD,
         .is_connected = fimd_display_is_connected,
-        .get_timing = fimd_get_timing,
+        .get_panel = fimd_get_panel,
         .check_timing = fimd_check_timing,
         .power_on = fimd_display_power_on,
 };
@@ -193,7 +193,8 @@ static void fimd_apply(struct device *subdrv_dev)
 static void fimd_commit(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
-        struct fb_videomode *timing = ctx->timing;
+        struct exynos_drm_panel_info *panel = ctx->panel;
+        struct fb_videomode *timing = &panel->timing;
         u32 val;
 
         if (ctx->suspended)
@@ -786,7 +787,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         struct fimd_context *ctx;
         struct exynos_drm_subdrv *subdrv;
         struct exynos_drm_fimd_pdata *pdata;
-        struct fb_videomode *timing;
+        struct exynos_drm_panel_info *panel;
         struct resource *res;
         int win;
         int ret = -EINVAL;
@@ -799,9 +800,9 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        timing = &pdata->timing;
-        if (!timing) {
-                dev_err(dev, "timing is null.\n");
+        panel = &pdata->panel;
+        if (!panel) {
+                dev_err(dev, "panel is null.\n");
                 return -EINVAL;
         }
 
@@ -863,16 +864,16 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_req_irq;
         }
 
-        ctx->clkdiv = fimd_calc_clkdiv(ctx, timing);
+        ctx->clkdiv = fimd_calc_clkdiv(ctx, &panel->timing);
         ctx->vidcon0 = pdata->vidcon0;
         ctx->vidcon1 = pdata->vidcon1;
         ctx->default_win = pdata->default_win;
-        ctx->timing = timing;
+        ctx->panel = panel;
 
-        timing->pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
+        panel->timing.pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
 
         DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
-                        timing->pixclock, ctx->clkdiv);
+                        panel->timing.pixclock, ctx->clkdiv);
 
         subdrv = &ctx->subdrv;
 
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 4a5b099c3bc5..53404af2e748 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,6 +321,8 @@ static int cdv_chip_setup(struct drm_device *dev)
         cdv_get_core_freq(dev);
         gma_intel_opregion_init(dev);
         psb_intel_init_bios(dev);
+        REG_WRITE(PORT_HOTPLUG_EN, 0);
+        REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
         return 0;
 }
 
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 830dfdd6bf15..be616735ec91 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,7 +247,6 @@ static struct fb_ops psbfb_roll_ops = {
         .fb_imageblit = cfb_imageblit,
         .fb_pan_display = psbfb_pan,
         .fb_mmap = psbfb_mmap,
-        .fb_sync = psbfb_sync,
         .fb_ioctl = psbfb_ioctl,
 };
 
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 5d5330f667f1..aff194fbe9f3 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -446,10 +446,9 @@ int psb_gtt_init(struct drm_device *dev, int resume)
         pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
         gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
                                                                 >> PAGE_SHIFT;
-        /* Some CDV firmware doesn't report this currently. In which case the
-           system has 64 gtt pages */
+        /* CDV doesn't report this. In which case the system has 64 gtt pages */
         if (pg->gtt_start == 0 || gtt_pages == 0) {
-                dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
                 gtt_pages = 64;
                 pg->gtt_start = dev_priv->pge_ctl;
         }
@@ -461,10 +460,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 
         if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
                 static struct resource fudge;   /* Preferably peppermint */
-                /* This can occur on CDV SDV systems. Fudge it in this case.
+                /* This can occur on CDV systems. Fudge it in this case.
                    We really don't care what imaginary space is being allocated
                    at this point */
-                dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
                 pg->gatt_start = 0x40000000;
                 pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
                 /* This is a little confusing but in fact the GTT is providing
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f425b23e3803..f851db7be2cc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4680,8 +4680,17 @@ sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
 
         crtc = intel_get_crtc_for_plane(dev, plane);
         clock = crtc->mode.clock;
+        if (!clock) {
+                *sprite_wm = 0;
+                return false;
+        }
 
         line_time_us = (sprite_width * 1000) / clock;
+        if (!line_time_us) {
+                *sprite_wm = 0;
+                return false;
+        }
+
         line_count = (latency_ns / line_time_us + 1000) / 1000;
         line_size = sprite_width * pixel_size;
 
@@ -6175,7 +6184,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
         int i;
 
         /* The clocks have to be on to load the palette. */
-        if (!crtc->enabled)
+        if (!crtc->enabled || !intel_crtc->active)
                 return;
 
         /* use legacy palette for Ironlake */
@@ -6561,7 +6570,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
         mode_cmd.height = mode->vdisplay;
         mode_cmd.pitches[0] = intel_framebuffer_pitch_for_width(mode_cmd.width,
                                                                 bpp);
-        mode_cmd.pixel_format = 0;
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
 
         return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
@@ -8185,7 +8194,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
 
         if (intel_enable_rc6(dev_priv->dev))
                 rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        (IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0;
+                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
 
         I915_WRITE(GEN6_RC_CONTROL,
                    rc6_mask |
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 1ab842c6032e..536191540b03 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -301,7 +301,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
 
         I915_WRITE_CTL(ring,
                         ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
-                        | RING_REPORT_64K | RING_VALID);
+                        | RING_VALID);
 
         /* If the head is still not zero, the ring is dead */
         if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
@@ -1132,18 +1132,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
         struct drm_device *dev = ring->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long end;
-        u32 head;
-
-        /* If the reported head position has wrapped or hasn't advanced,
-         * fallback to the slow and accurate path.
-         */
-        head = intel_read_status_page(ring, 4);
-        if (head > ring->head) {
-                ring->head = head;
-                ring->space = ring_space(ring);
-                if (ring->space >= n)
-                        return 0;
-        }
 
         trace_i915_ring_wait_begin(ring);
         if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 38ce5d0427e3..387fcc9f03ef 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1304,6 +1304,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
         h0 = G_038004_TEX_HEIGHT(word1) + 1;
         d0 = G_038004_TEX_DEPTH(word1);
         nfaces = 1;
+        array = 0;
         switch (G_038000_DIM(word0)) {
         case V_038000_SQ_TEX_DIM_1D:
         case V_038000_SQ_TEX_DIM_2D:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e7cb3ab09243..8b3d8ed52ff6 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1117,13 +1117,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
             (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                 struct drm_display_mode *mode;
 
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_ON);
-                ret = radeon_ddc_get_modes(radeon_connector);
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_ON);
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                } else {
+                        /* need to setup ddc on the bridge */
+                        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
+                            ENCODER_OBJECT_ID_NONE) {
+                                if (encoder)
+                                        radeon_atom_ext_encoder_setup_ddc(encoder);
+                        }
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                }
 
                 if (ret > 0) {
                         if (encoder) {
@@ -1134,7 +1144,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                         return ret;
                 }
 
-                encoder = radeon_best_single_encoder(connector);
                 if (!encoder)
                         return 0;
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae..c58a036233fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        list_del(&bo_va->bo_list);
         mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
         mutex_unlock(&vm->mutex);
+        list_del(&bo_va->bo_list);
 
         kfree(bo_va);
         return 0;
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b8574cddd953..63552e30d0c3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -59,6 +59,9 @@
 #define USB_VENDOR_ID_AIRCABLE          0x16CA
 #define USB_DEVICE_ID_AIRCABLE1         0x1502
 
+#define USB_VENDOR_ID_AIREN             0x1a2c
+#define USB_DEVICE_ID_AIREN_SLIMPLUS    0x0002
+
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
 
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+        /*
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                 dbg_hid("Ignoring out-of-range value %x\n", value);
                 return;
         }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index c831af937481..57d4e1e1df48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -54,6 +54,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
 
+        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 6bab2001ef3b..6aa5a9fad879 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -178,6 +178,16 @@ static inline void f75375_write16(struct i2c_client *client, u8 reg,
         i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
 }
 
+static void f75375_write_pwm(struct i2c_client *client, int nr)
+{
+        struct f75375_data *data = i2c_get_clientdata(client);
+        if (data->kind == f75387)
+                f75375_write16(client, F75375_REG_FAN_EXP(nr), data->pwm[nr]);
+        else
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                              data->pwm[nr]);
+}
+
 static struct f75375_data *f75375_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -254,6 +264,36 @@ static inline u16 rpm_to_reg(int rpm)
         return 1500000 / rpm;
 }
 
+static bool duty_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        case 2: /* Auto, speed mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        default:
+                BUG();
+        }
+}
+
+static bool auto_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        case 2: /* Auto, speed mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        default:
+                BUG();
+        }
+}
+
 static ssize_t set_fan_min(struct device *dev, struct device_attribute *attr,
                 const char *buf, size_t count)
 {
@@ -287,6 +327,11 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+        if (data->kind == f75387 && duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->fan_target[nr] = rpm_to_reg(val);
         f75375_write16(client, F75375_REG_FAN_EXP(nr), data->fan_target[nr]);
@@ -307,9 +352,13 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]) ||
+            !duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->pwm[nr] = SENSORS_LIMIT(val, 0, 255);
-        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr), data->pwm[nr]);
+        f75375_write_pwm(client, nr);
         mutex_unlock(&data->update_lock);
         return count;
 }
@@ -327,11 +376,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
         struct f75375_data *data = i2c_get_clientdata(client);
         u8 fanmode;
 
-        if (val < 0 || val > 3)
+        if (val < 0 || val > 4)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
         if (data->kind == f75387) {
+                /* For now, deny dangerous toggling of duty mode */
+                if (duty_mode_enabled(data->pwm_enable[nr]) !=
+                                duty_mode_enabled(val))
+                        return -EOPNOTSUPP;
                 /* clear each fanX_mode bit before setting them properly */
                 fanmode &= ~(1 << F75387_FAN_DUTY_MODE(nr));
                 fanmode &= ~(1 << F75387_FAN_MANU_MODE(nr));
@@ -345,12 +398,14 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode  |= (1 << F75387_FAN_DUTY_MODE(nr));
                         break;
-                case 2: /* AUTOMATIC*/
-                        fanmode  |=  (1 << F75387_FAN_DUTY_MODE(nr));
+                case 2: /* Automatic, speed mode */
                         break;
                 case 3: /* fan speed */
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         break;
+                case 4: /* Automatic, pwm */
+                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
+                        break;
                 }
         } else {
                 /* clear each fanX_mode bit before setting them properly */
@@ -368,14 +423,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         break;
                 case 3: /* fan speed */
                         break;
+                case 4: /* Automatic pwm */
+                        return -EINVAL;
                 }
         }
 
         f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
         data->pwm_enable[nr] = val;
         if (val == 0)
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         return 0;
 }
 
@@ -726,14 +782,17 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 
                                 manu = ((mode >> F75387_FAN_MANU_MODE(nr)) & 1);
                                 duty = ((mode >> F75387_FAN_DUTY_MODE(nr)) & 1);
-                                if (manu && duty)
-                                        /* speed */
+                                if (!manu && duty)
+                                        /* auto, pwm */
+                                        data->pwm_enable[nr] = 4;
+                                else if (manu && !duty)
+                                        /* manual, speed */
                                         data->pwm_enable[nr] = 3;
-                                else if (!manu && duty)
-                                        /* automatic */
+                                else if (!manu && !duty)
+                                        /* automatic, speed */
                                         data->pwm_enable[nr] = 2;
                                 else
-                                        /* manual */
+                                        /* manual, pwm */
                                         data->pwm_enable[nr] = 1;
                         } else {
                                 if (!(conf & (1 << F75375_FAN_CTRL_LINEAR(nr))))
@@ -758,9 +817,11 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
         set_pwm_enable_direct(client, 0, f75375s_pdata->pwm_enable[0]);
         set_pwm_enable_direct(client, 1, f75375s_pdata->pwm_enable[1]);
         for (nr = 0; nr < 2; nr++) {
+                if (auto_mode_enabled(f75375s_pdata->pwm_enable[nr]) ||
+                    !duty_mode_enabled(f75375s_pdata->pwm_enable[nr]))
+                        continue;
                 data->pwm[nr] = SENSORS_LIMIT(f75375s_pdata->pwm[nr], 0, 255);
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                        data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         }
 
 }
@@ -787,7 +848,7 @@ static int f75375_probe(struct i2c_client *client,
         if (err)
                 goto exit_free;
 
-        if (data->kind == f75375) {
+        if (data->kind != f75373) {
                 err = sysfs_chmod_file(&client->dev.kobj,
                         &sensor_dev_attr_pwm1_mode.dev_attr.attr,
                         S_IRUGO | S_IWUSR);
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 7e78f7c87857..3d471d56bf15 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -72,6 +72,7 @@
 
 #define MXS_I2C_QUEUESTAT       (0x70)
 #define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
+#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
 
 #define MXS_I2C_QUEUECMD        (0x80)
 
@@ -219,14 +220,14 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         int ret;
         int flags;
 
-        init_completion(&i2c->cmd_complete);
-
         dev_dbg(i2c->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
                 msg->addr, msg->len, msg->flags, stop);
 
         if (msg->len == 0)
                 return -EINVAL;
 
+        init_completion(&i2c->cmd_complete);
+
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
         if (msg->flags & I2C_M_RD)
@@ -286,6 +287,7 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
         struct mxs_i2c_dev *i2c = dev_id;
         u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
+        bool is_last_cmd;
 
         if (!stat)
                 return IRQ_NONE;
@@ -300,9 +302,14 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
         else
                 i2c->cmd_err = 0;
 
-        complete(&i2c->cmd_complete);
+        is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
+                MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
+
+        if (is_last_cmd || i2c->cmd_err)
+                complete(&i2c->cmd_complete);
 
         writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 288da5c1499d..103dbd92e256 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -44,7 +44,8 @@ static ssize_t debug_read_ver(struct file *file, char __user *userbuf,
 static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes;
 
@@ -67,7 +68,8 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes, rest;
 
@@ -97,7 +99,8 @@ static ssize_t debug_write_pagetable(struct file *file,
         struct iotlb_entry e;
         struct cr_regs cr;
         int err;
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char buf[MAXCOLUMN], *p = buf;
 
         count = min(count, sizeof(buf));
@@ -184,7 +187,8 @@ out:
 static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         size_t bytes;
 
@@ -212,7 +216,8 @@ static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         struct iovm_struct *tmp;
         int uninitialized_var(i);
@@ -254,7 +259,7 @@ static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         char *p, *buf;
         struct iovm_struct *area;
         ssize_t bytes;
@@ -268,8 +273,8 @@ static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
 
         mutex_lock(&iommu_debug_lock);
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 bytes = -EINVAL;
                 goto err_out;
         }
@@ -287,7 +292,7 @@ err_out:
 static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         struct iovm_struct *area;
         char *p, *buf;
 
@@ -305,8 +310,8 @@ static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                 goto err_out;
         }
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 count = -EINVAL;
                 goto err_out;
         }
@@ -350,7 +355,7 @@ DEBUG_FOPS(mem);
         {                                                               \
                 struct dentry *dent;                                    \
                 dent = debugfs_create_file(#attr, mode, parent,         \
-                                           obj, &debug_##attr##_fops);  \
+                                           dev, &debug_##attr##_fops);  \
                 if (!dent)                                              \
                         return -ENOMEM;                                 \
         }
@@ -362,20 +367,29 @@ static int iommu_debug_register(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_iommu *obj = platform_get_drvdata(pdev);
+        struct omap_iommu_arch_data *arch_data;
         struct dentry *d, *parent;
 
         if (!obj || !obj->dev)
                 return -EINVAL;
 
+        arch_data = kzalloc(sizeof(*arch_data), GFP_KERNEL);
+        if (!arch_data)
+                return -ENOMEM;
+
+        arch_data->iommu_dev = obj;
+
+        dev->archdata.iommu = arch_data;
+
         d = debugfs_create_dir(obj->name, iommu_debug_root);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
         parent = d;
 
         d = debugfs_create_u8("nr_tlb_entries", 400, parent,
                               (u8 *)&obj->nr_tlb_entries);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
 
         DEBUG_ADD_FILE_RO(ver);
         DEBUG_ADD_FILE_RO(regs);
@@ -385,6 +399,22 @@ static int iommu_debug_register(struct device *dev, void *data)
         DEBUG_ADD_FILE(mem);
 
         return 0;
+
+nomem:
+        kfree(arch_data);
+        return -ENOMEM;
+}
+
+static int iommu_debug_unregister(struct device *dev, void *data)
+{
+        if (!dev->archdata.iommu)
+                return 0;
+
+        kfree(dev->archdata.iommu);
+
+        dev->archdata.iommu = NULL;
+
+        return 0;
 }
 
 static int __init iommu_debug_init(void)
@@ -411,6 +441,7 @@ module_init(iommu_debug_init)
 static void __exit iommu_debugfs_exit(void)
 {
         debugfs_remove_recursive(iommu_debug_root);
+        omap_foreach_iommu_device(NULL, iommu_debug_unregister);
 }
 module_exit(iommu_debugfs_exit)
 
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index d8edd979d01b..6899dcd02dfa 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1223,7 +1223,8 @@ static int __init omap_iommu_init(void)
 
         return platform_driver_register(&omap_iommu_driver);
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a368db2431a5..a0b225eb4ac4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -624,7 +624,7 @@ int md_raid1_congested(struct mddev *mddev, int bits)
                 return 1;
 
         rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks * 2; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags)) {
                         struct request_queue *q = bdev_get_queue(rdev->bdev);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6e8aa213f0d5..58c44d6453a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -67,6 +67,7 @@ static int max_queued_requests = 1024;
 
 static void allow_barrier(struct r10conf *conf);
 static void lower_barrier(struct r10conf *conf);
+static int enough(struct r10conf *conf, int ignore);
 
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -347,6 +348,19 @@ static void raid10_end_read_request(struct bio *bio, int error)
                  * wait for the 'master' bio.
                  */
                 set_bit(R10BIO_Uptodate, &r10_bio->state);
+        } else {
+                /* If all other devices that store this block have
+                 * failed, we want to return the error upwards rather
+                 * than fail the last device.  Here we redefine
+                 * "uptodate" to mean "Don't want to retry"
+                 */
+                unsigned long flags;
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (!enough(conf, rdev->raid_disk))
+                        uptodate = 1;
+                spin_unlock_irqrestore(&conf->device_lock, flags);
+        }
+        if (uptodate) {
                 raid_end_bio_io(r10_bio);
                 rdev_dec_pending(rdev, conf->mddev);
         } else {
@@ -2052,6 +2066,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        "md/raid10:%s: %s: Failing raid device\n",
                        mdname(mddev), b);
                 md_error(mddev, conf->mirrors[d].rdev);
+                r10_bio->devs[r10_bio->read_slot].bio = IO_BLOCKED;
                 return;
         }
 
@@ -2105,8 +2120,11 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                                     rdev,
                                     r10_bio->devs[r10_bio->read_slot].addr
                                     + sect,
-                                    s, 0))
+                                    s, 0)) {
                                 md_error(mddev, rdev);
+                                r10_bio->devs[r10_bio->read_slot].bio
+                                        = IO_BLOCKED;
+                        }
                         break;
                 }
 
@@ -2299,17 +2317,20 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
          * This is all done synchronously while the array is
          * frozen.
          */
+        bio = r10_bio->devs[slot].bio;
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r10_bio->devs[slot].bio = NULL;
+
         if (mddev->ro == 0) {
                 freeze_array(conf);
                 fix_read_error(conf, mddev, r10_bio);
                 unfreeze_array(conf);
-        }
+        } else
+                r10_bio->devs[slot].bio = IO_BLOCKED;
+
         rdev_dec_pending(rdev, mddev);
 
-        bio = r10_bio->devs[slot].bio;
-        bdevname(bio->bi_bdev, b);
-        r10_bio->devs[slot].bio =
-                mddev->ro ? IO_BLOCKED : NULL;
 read_more:
         rdev = read_balance(conf, r10_bio, &max_sectors);
         if (rdev == NULL) {
@@ -2318,13 +2339,10 @@ read_more:
                        mdname(mddev), b,
                        (unsigned long long)r10_bio->sector);
                 raid_end_bio_io(r10_bio);
-                bio_put(bio);
                 return;
         }
 
         do_sync = (r10_bio->master_bio->bi_rw & REQ_SYNC);
-        if (bio)
-                bio_put(bio);
         slot = r10_bio->read_slot;
         printk_ratelimited(
                 KERN_ERR
@@ -2360,7 +2378,6 @@ read_more:
                         mbio->bi_phys_segments++;
                 spin_unlock_irq(&conf->device_lock);
                 generic_make_request(bio);
-                bio = NULL;
 
                 r10_bio = mempool_alloc(conf->r10bio_pool,
                                         GFP_NOIO);
@@ -3243,7 +3260,6 @@ static int run(struct mddev *mddev)
                         disk->rdev = rdev;
                 }
 
-                disk->rdev = rdev;
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 53e2a80f42fa..d295941c9a3d 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -956,11 +956,12 @@ int __devinit ab8500_init(struct ab8500 *ab8500)
         return ret;
 
 out_freeirq:
-        if (ab8500->irq_base) {
+        if (ab8500->irq_base)
                 free_irq(ab8500->irq, ab8500);
 out_removeirq:
+        if (ab8500->irq_base)
                 ab8500_irq_remove(ab8500);
-        }
+
         return ret;
 }
 
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0f5922812bff..411f523d4878 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -123,7 +123,7 @@ static int mfd_add_device(struct device *parent, int id,
                 }
 
                 if (!cell->ignore_resource_conflicts) {
-                        ret = acpi_check_resource_conflict(res);
+                        ret = acpi_check_resource_conflict(&res[r]);
                         if (ret)
                                 goto fail_res;
                 }
diff --git a/drivers/mfd/s5m-core.c b/drivers/mfd/s5m-core.c
index e075c113eec6..caadabeed8e9 100644
--- a/drivers/mfd/s5m-core.c
+++ b/drivers/mfd/s5m-core.c
@@ -105,7 +105,7 @@ static int s5m87xx_i2c_probe(struct i2c_client *i2c,
         s5m87xx->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(s5m87xx->rtc, s5m87xx);
 
-        if (pdata->cfg_pmic_irq)
+        if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
         s5m_irq_init(s5m87xx);
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 01cf5012a08f..4392f6bca156 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -168,7 +168,7 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
 
         tps65910_gpio_init(tps65910, pmic_plat_data->gpio_base);
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 5fec23a9ac03..74fd8cb5f372 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -151,7 +151,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
         ret = tps65912_irq_init(tps65912, init_data->irq, init_data);
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
index 8a1fafd0bf7d..9fd01bf63c51 100644
--- a/drivers/mfd/wm8350-irq.c
+++ b/drivers/mfd/wm8350-irq.c
@@ -496,7 +496,6 @@ int wm8350_irq_init(struct wm8350 *wm8350, int irq,
 
         mutex_init(&wm8350->irq_lock);
         wm8350->chip_irq = irq;
-        wm8350->irq_base = pdata->irq_base;
 
         if (pdata && pdata->irq_base > 0)
                 irq_base = pdata->irq_base;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index f117e7fb9321..a04b3c108c8c 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -256,6 +256,20 @@ static int wm8994_suspend(struct device *dev)
                 break;
         }
 
+        switch (wm8994->type) {
+        case WM1811:
+                ret = wm8994_reg_read(wm8994, WM8994_ANTIPOP_2);
+                if (ret < 0) {
+                        dev_err(dev, "Failed to read jackdet: %d\n", ret);
+                } else if (ret & WM1811_JACKDET_MODE_MASK) {
+                        dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
+
         /* Disable LDO pulldowns while the device is suspended if we
          * don't know that something will be driving them. */
         if (!wm8994->ldo_ena_always_driven)
diff --git a/drivers/mfd/wm8994-regmap.c b/drivers/mfd/wm8994-regmap.c
index c598ae69b8ff..bc0c5096539a 100644
--- a/drivers/mfd/wm8994-regmap.c
+++ b/drivers/mfd/wm8994-regmap.c
@@ -806,6 +806,7 @@ static bool wm1811_readable_register(struct device *dev, unsigned int reg)
         case WM8994_DC_SERVO_2:
         case WM8994_DC_SERVO_READBACK:
         case WM8994_DC_SERVO_4:
+        case WM8994_DC_SERVO_4E:
         case WM8994_ANALOGUE_HP_1:
         case WM8958_MIC_DETECT_1:
         case WM8958_MIC_DETECT_2:
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 19fc7c1cb428..f428d86bfc10 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -984,9 +984,9 @@ static int __init c2port_init(void)
                 " - (C) 2007 Rodolfo Giometti\n");
 
         c2port_class = class_create(THIS_MODULE, "c2port");
-        if (!c2port_class) {
+        if (IS_ERR(c2port_class)) {
                 printk(KERN_ERR "c2port: failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(c2port_class);
         }
         c2port_class->dev_attrs = c2port_attrs;
 
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 690255c7d4dc..132378b89d76 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2068,6 +2068,9 @@ static int mmc_rescan_try_freq(struct mmc_host *host, unsigned freq)
          */
         mmc_hw_reset_for_init(host);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * sdio_reset sends CMD52 to reset card.  Since we do not know
          * if the card is being re-initialized, just send it.  CMD52
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 30055f2b0d44..c3704e293a7b 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -238,10 +238,10 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         /* Hold MCI clock for 8 cycles by default */
         host->clk_delay = 8;
         /*
-         * Default clock gating delay is 200ms.
+         * Default clock gating delay is 0ms to avoid wasting power.
          * This value can be tuned by writing into sysfs entry.
          */
-        host->clkgate_delay = 200;
+        host->clkgate_delay = 0;
         host->clk_gated = false;
         INIT_DELAYED_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a48066344fa8..2b9ed1401dc4 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -816,6 +816,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
         if (!mmc_host_is_spi(host))
                 mmc_set_bus_mode(host, MMC_BUSMODE_OPENDRAIN);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * Since we're changing the OCR value, we seem to
          * need to tell some cards to go back to the idle
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 5017f9354ce2..c272c6868ecf 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -911,6 +911,9 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr,
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         err = mmc_sd_get_cid(host, ocr, cid, &rocr);
         if (err)
                 return err;
@@ -1156,11 +1159,6 @@ int mmc_attach_sd(struct mmc_host *host)
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
-        /* Make sure we are at 3.3V signalling voltage */
-        err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, false);
-        if (err)
-                return err;
-
         /* Disable preset value enable if already set since last time */
         if (host->ops->enable_preset_value) {
                 mmc_host_clk_hold(host);
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 12cde6ee17f5..2c7c83f832d2 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -585,6 +585,9 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
          * Inform the card of the voltage
          */
         if (!powered_resume) {
+                /* The initialization should be done at 3.3 V I/O voltage. */
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
                 err = mmc_send_io_op_cond(host, host->ocr, &ocr);
                 if (err)
                         goto err;
@@ -996,6 +999,11 @@ static int mmc_sdio_power_restore(struct mmc_host *host)
          * With these steps taken, mmc_select_voltage() is also required to
          * restore the correct voltage setting of the card.
          */
+
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        if (!mmc_card_keep_power(host))
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         sdio_reset(host);
         mmc_go_idle(host);
         mmc_send_if_cond(host, host->ocr_avail);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 6985cdb0bb26..e4449a54ae8f 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1948,12 +1948,12 @@ static bool atmci_filter(struct dma_chan *chan, void *slave)
         }
 }
 
-static void atmci_configure_dma(struct atmel_mci *host)
+static bool atmci_configure_dma(struct atmel_mci *host)
 {
         struct mci_platform_data        *pdata;
 
         if (host == NULL)
-                return;
+                return false;
 
         pdata = host->pdev->dev.platform_data;
 
@@ -1970,12 +1970,15 @@ static void atmci_configure_dma(struct atmel_mci *host)
                 host->dma.chan =
                         dma_request_channel(mask, atmci_filter, pdata->dma_slave);
         }
-        if (!host->dma.chan)
-                dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
-        else
+        if (!host->dma.chan) {
+                dev_warn(&host->pdev->dev, "no DMA channel available\n");
+                return false;
+        } else {
                 dev_info(&host->pdev->dev,
                                         "Using %s for DMA transfers\n",
                                         dma_chan_name(host->dma.chan));
+                return true;
+        }
 }
 
 static inline unsigned int atmci_get_version(struct atmel_mci *host)
@@ -2085,8 +2088,7 @@ static int __init atmci_probe(struct platform_device *pdev)
 
         /* Get MCI capabilities and set operations according to it */
         atmci_get_cap(host);
-        if (host->caps.has_dma) {
-                dev_info(&pdev->dev, "using DMA\n");
+        if (host->caps.has_dma && atmci_configure_dma(host)) {
                 host->prepare_data = &atmci_prepare_data_dma;
                 host->submit_data = &atmci_submit_data_dma;
                 host->stop_transfer = &atmci_stop_transfer_dma;
@@ -2096,15 +2098,12 @@ static int __init atmci_probe(struct platform_device *pdev)
                 host->submit_data = &atmci_submit_data_pdc;
                 host->stop_transfer = &atmci_stop_transfer_pdc;
         } else {
-                dev_info(&pdev->dev, "no DMA, no PDC\n");
+                dev_info(&pdev->dev, "using PIO\n");
                 host->prepare_data = &atmci_prepare_data;
                 host->submit_data = &atmci_submit_data;
                 host->stop_transfer = &atmci_stop_transfer;
         }
 
-        if (host->caps.has_dma)
-                atmci_configure_dma(host);
-
         platform_set_drvdata(pdev, host);
 
         /* We need at least one slot to succeed */
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 0d955ffaf44e..11e589cd8233 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1271,12 +1271,13 @@ static int __devinit mmci_probe(struct amba_device *dev,
         /*
          * Block size can be up to 2048 bytes, but must be a power of two.
          */
-        mmc->max_blk_size = 2048;
+        mmc->max_blk_size = 1 << 11;
 
         /*
-         * No limit on the number of blocks transferred.
+         * Limit the number of blocks transferred so that we don't overflow
+         * the maximum request size.
          */
-        mmc->max_blk_count = mmc->max_req_size;
+        mmc->max_blk_count = mmc->max_req_size >> 11;
 
         spin_lock_init(&host->lock);
 
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d601e41af282..0be4e2013632 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -269,8 +269,9 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
                 imx_data->scratchpad = val;
                 return;
         case SDHCI_COMMAND:
-                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION)
-                        && (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
+                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION ||
+                     host->cmd->opcode == MMC_SET_BLOCK_COUNT) &&
+                    (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
                         val |= SDHCI_CMD_ABORTCMD;
 
                 if (is_imx6q_usdhc(imx_data)) {
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a1f2e0fed78b..423d0235a878 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7886,10 +7886,8 @@ static int tg3_chip_reset(struct tg3 *tp)
         return 0;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
-                                                 struct rtnl_link_stats64 *);
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
-                                                struct tg3_ethtool_stats *);
+static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
+static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
 
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7910,7 +7908,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
 
         if (tp->hw_stats) {
                 /* Save the stats across chip resets... */
-                tg3_get_stats64(tp->dev, &tp->net_stats_prev),
+                tg3_get_nstats(tp, &tp->net_stats_prev),
                 tg3_get_estats(tp, &tp->estats_prev);
 
                 /* And make sure the next sample is new data */
@@ -9847,7 +9845,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
        return ((u64)val->high << 32) | ((u64)val->low);
 }
 
-static u64 calc_crc_errors(struct tg3 *tp)
+static u64 tg3_calc_crc_errors(struct tg3 *tp)
 {
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
@@ -9856,14 +9854,12 @@ static u64 calc_crc_errors(struct tg3 *tp)
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
                 u32 val;
 
-                spin_lock_bh(&tp->lock);
                 if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
                         tg3_writephy(tp, MII_TG3_TEST1,
                                      val | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
                 } else
                         val = 0;
-                spin_unlock_bh(&tp->lock);
 
                 tp->phy_crc_errors += val;
 
@@ -9877,14 +9873,13 @@ static u64 calc_crc_errors(struct tg3 *tp)
         estats->member =        old_estats->member + \
                                 get_stat64(&hw_stats->member)
 
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
-                                               struct tg3_ethtool_stats *estats)
+static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
 {
         struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
         if (!hw_stats)
-                return old_estats;
+                return;
 
         ESTAT_ADD(rx_octets);
         ESTAT_ADD(rx_fragments);
@@ -9963,20 +9958,13 @@ static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
         ESTAT_ADD(nic_tx_threshold_hit);
 
         ESTAT_ADD(mbuf_lwm_thresh_hit);
-
-        return estats;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
-                                                 struct rtnl_link_stats64 *stats)
+static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 {
-        struct tg3 *tp = netdev_priv(dev);
         struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
-        if (!hw_stats)
-                return old_stats;
-
         stats->rx_packets = old_stats->rx_packets +
                 get_stat64(&hw_stats->rx_ucast_packets) +
                 get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10019,15 +10007,13 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
                 get_stat64(&hw_stats->tx_carrier_sense_errors);
 
         stats->rx_crc_errors = old_stats->rx_crc_errors +
-                calc_crc_errors(tp);
+                tg3_calc_crc_errors(tp);
 
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
         stats->rx_dropped = tp->rx_dropped;
         stats->tx_dropped = tp->tx_dropped;
-
-        return stats;
 }
 
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15409,6 +15395,21 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
         }
 }
 
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
+{
+        struct tg3 *tp = netdev_priv(dev);
+
+        if (!tp->hw_stats)
+                return &tp->net_stats_prev;
+
+        spin_lock_bh(&tp->lock);
+        tg3_get_nstats(tp, stats);
+        spin_unlock_bh(&tp->lock);
+
+        return stats;
+}
+
 static const struct net_device_ops tg3_netdev_ops = {
         .ndo_open               = tg3_open,
         .ndo_stop               = tg3_close,
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index ee93a2087fe6..c52295cd05ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
         u32 rx_coalesce_usecs;
         u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-        u32 num_vfs;
+        u16 num_vfs;
 #endif
         struct enic_port_profile *pp;
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ab3f67f980d8..0e4edd3b6bee 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
         if (pos) {
                 pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-                        (u16 *)&enic->num_vfs);
+                        &enic->num_vfs);
                 if (enic->num_vfs) {
                         err = pci_enable_sriov(pdev, enic->num_vfs);
                         if (err) {
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 9cb5f912e489..29e23bec809c 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                         pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                         hw->phy.autoneg_advertised = opt.def;
                 } else {
-                        hw->phy.autoneg_advertised = AutoNeg;
-                        pch_gbe_validate_option(
-                                (int *)(&hw->phy.autoneg_advertised),
-                                &opt, adapter);
+                        int tmp = AutoNeg;
+
+                        pch_gbe_validate_option(&tmp, &opt, adapter);
+                        hw->phy.autoneg_advertised = tmp;
                 }
         }
 
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                          .p = fc_list } }
                 };
-                hw->mac.fc = FlowControl;
-                pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                                &opt, adapter);
+                int tmp = FlowControl;
+
+                pch_gbe_validate_option(&tmp, &opt, adapter);
+                hw->mac.fc = tmp;
         }
 
         pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index b97132d9dff0..8f29feb35548 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 
 config NET_PACKET_ENGINE
         bool "Packet Engine devices"
+        default y
         depends on PCI
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 7931531c3a40..e61560e16385 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,7 +3017,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 (void __iomem *)port_regs;
         u32 delay = 10;
         int status = 0;
-        unsigned long hw_flags = 0;
 
         if (ql_mii_setup(qdev))
                 return -1;
@@ -3228,9 +3227,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                 if (value & PORT_STATUS_IC)
                         break;
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+                spin_unlock_irq(&qdev->hw_lock);
                 msleep(500);
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+                spin_lock_irq(&qdev->hw_lock);
         } while (--delay);
 
         if (delay == 0) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a0c800b50ad..1adf17757cea 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.enable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.disable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3dcd3857a36c..756c0f5565a5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                         ctx->l4_hdr_size = ((struct tcphdr *)
                                            skb_transport_header(skb))->doff * 4;
                                 else if (iph->protocol == IPPROTO_UDP)
-                                        /*
-                                         * Use tcp header size so that bytes to
-                                         * be copied are more than required by
-                                         * the device.
-                                         */
                                         ctx->l4_hdr_size =
-                                                        sizeof(struct tcphdr);
+                                                        sizeof(struct udphdr);
                                 else
                                         ctx->l4_hdr_size = 0;
                         } else {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ed54797db191..fc46a81ad538 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index f901a17f76ba..86a891f93fc9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
         ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
         ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
 
         return 0;
@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
         ATH_FREE_BANK(ah->analogBank6Data);
         ATH_FREE_BANK(ah->analogBank6TPCData);
         ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
         ATH_FREE_BANK(ah->bank6Temp);
 
 #undef ATH_FREE_BANK
@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         if (ah->eep_ops->set_addac)
                 ah->eep_ops->set_addac(ah, chan);
 
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
-
+        REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
         REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
 
         ENABLE_REGWRITE_BUFFER(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 11f192a1ceb7..d190411ac8f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
                                ARRAY_SIZE(ar5416Addac), 2);
         }
+
+        /* iniAddac needs to be modified for these chips */
+        if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
+                struct ar5416IniArray *addac = &ah->iniAddac;
+                u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
+                u32 *data;
+
+                data = kmalloc(size, GFP_KERNEL);
+                if (!data)
+                        return;
+
+                memcpy(data, addac->ia_array, size);
+                addac->ia_array = data;
+
+                if (!AR_SREV_5416_22_OR_LATER(ah)) {
+                        /* override CLKDRV value */
+                        INI_RA(addac, 31,1) = 0;
+                }
+        }
 }
 
 /* Support for Japan ch.14 (2484) spread */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6a29004a71b0..c8261d4fc780 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,7 +940,6 @@ struct ath_hw {
         u32 *analogBank6Data;
         u32 *analogBank6TPCData;
         u32 *analogBank7Data;
-        u32 *addac5416_21;
         u32 *bank6Temp;
 
         u8 txpower_limit;
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 90911eec0cf5..30b58870b1b6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,17 +1051,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                 }
                 /* either retransmit or send bar if ack not recd */
                 if (!ack_recd) {
-                        struct ieee80211_tx_rate *txrate =
-                            tx_info->status.rates;
-                        if (retry && (txrate[0].count < (int)retry_limit)) {
+                        if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 ini->txretry[index]++;
                                 ini->tx_in_transit--;
                                 /*
                                  * Use high prededence for retransmit to
                                  * give some punch
                                  */
-                                /* brcms_c_txq_enq(wlc, scb, p,
-                                 * BRCMS_PRIO_TO_PREC(tid)); */
                                 brcms_c_txq_enq(wlc, scb, p,
                                                 BRCMS_PRIO_TO_HI_PREC(tid));
                         } else {
@@ -1074,9 +1070,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                     IEEE80211_TX_STAT_AMPDU_NO_BACK;
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
-                                wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
-                                        "transit %d\n", "AMPDU status", seq,
-                                        ini->tx_in_transit);
+                                BCMMSG(wiphy,
+                                       "BA Timeout, seq %d, in_transit %d\n",
+                                       seq, ini->tx_in_transit);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 7353826095f1..e483cfa8d14e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,6 +1187,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         unsigned long flags;
         struct iwl_addsta_cmd sta_cmd;
         u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
+        __le16 key_flags;
 
         /* if station isn't there, neither is the key */
         if (sta_id == IWL_INVALID_STATION)
@@ -1212,7 +1213,14 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 IWL_ERR(priv, "offset %d not used in uCode key table.\n",
                         keyconf->hw_key_idx);
 
-        sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
+                     STA_KEY_FLG_INVALID;
+
+        if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        sta_cmd.key.key_flags = key_flags;
         sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..d2a1ea98d0f2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1220,7 +1220,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                 cancel_work_sync(&rt2x00dev->rxdone_work);
                 cancel_work_sync(&rt2x00dev->txdone_work);
         }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
 
         /*
          * Free the tx status fifo.
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index a9c46cc2db37..8c33491b21fe 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -1,3 +1,5 @@
+#include <linux/prefetch.h>
+
 /**
  * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
  * @ioc: The I/O Controller.
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index a87e2728b2c3..64d433ec4fc6 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -328,21 +328,15 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        if (ret) {
-                while (--i >= 0)
-                        soc_pcmcia_remove_one(&sinfo->skt[i]);
-                kfree(sinfo);
-                clk_put(clk);
-        } else {
-                pxa2xx_configure_sockets(&dev->dev);
-                dev_set_drvdata(&dev->dev, sinfo);
-        }
+        pxa2xx_configure_sockets(&dev->dev);
+        dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
 
 err1:
         while (--i >= 0)
                 soc_pcmcia_remove_one(&sinfo->skt[i]);
+        clk_put(clk);
         kfree(sinfo);
 err0:
         return ret;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2baadd21b7a6..98fbe62694d4 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -369,9 +369,9 @@ static int __init pps_init(void)
         int err;
 
         pps_class = class_create(THIS_MODULE, "pps");
-        if (!pps_class) {
+        if (IS_ERR(pps_class)) {
                 pr_err("failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(pps_class);
         }
         pps_class->dev_attrs = pps_attrs;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 691b1ab1a3d0..30d2072f480b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
          */
         mport = priv->mport;
 
-        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
-        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
 
         while (wr_ptr != rd_ptr) {
                 idb_entry = (u64 *)(priv->idb_base +
                                         (TSI721_IDB_ENTRY_SIZE * rd_ptr));
                 rd_ptr++;
+                rd_ptr %= IDB_QSIZE;
                 idb.msg = *idb_entry;
                 *idb_entry = 0;
 
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index df33530cec4a..28b81ae4cf7f 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -196,7 +196,7 @@ static const unsigned int LDO12_suspend_table[] = {
 };
 
 static const unsigned int LDO13_table[] = {
-        1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0, 0,
+        1200000, 1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0,
 };
 
 static const unsigned int LDO13_suspend_table[] = {
@@ -389,10 +389,10 @@ static struct pm8607_regulator_info pm8607_regulator_info[] = {
         PM8607_LDO( 7,         LDO7, 0, 3, SUPPLIES_EN12, 1),
         PM8607_LDO( 8,         LDO8, 0, 3, SUPPLIES_EN12, 2),
         PM8607_LDO( 9,         LDO9, 0, 3, SUPPLIES_EN12, 3),
-        PM8607_LDO(10,        LDO10, 0, 3, SUPPLIES_EN12, 4),
+        PM8607_LDO(10,        LDO10, 0, 4, SUPPLIES_EN12, 4),
         PM8607_LDO(12,        LDO12, 0, 4, SUPPLIES_EN12, 5),
         PM8607_LDO(13, VIBRATOR_SET, 1, 3,  VIBRATOR_SET, 0),
-        PM8607_LDO(14,        LDO14, 0, 4, SUPPLIES_EN12, 6),
+        PM8607_LDO(14,        LDO14, 0, 3, SUPPLIES_EN12, 6),
 };
 
 static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 9beba49c3c5b..2853c2a6f10f 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -125,6 +125,13 @@ static int __devinit r9701_probe(struct spi_device *spi)
         unsigned char tmp;
         int res;
 
+        tmp = R100CNT;
+        res = read_regs(&spi->dev, &tmp, 1);
+        if (res || tmp != 0x20) {
+                dev_err(&spi->dev, "cannot read RTC register\n");
+                return -ENODEV;
+        }
+
         rtc = rtc_device_register("r9701",
                                 &spi->dev, &r9701_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc))
@@ -132,13 +139,6 @@ static int __devinit r9701_probe(struct spi_device *spi)
 
         dev_set_drvdata(&spi->dev, rtc);
 
-        tmp = R100CNT;
-        res = read_regs(&spi->dev, &tmp, 1);
-        if (res || tmp != 0x20) {
-                rtc_device_unregister(rtc);
-                return res;
-        }
-
         return 0;
 }
 
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index b31a8e3841d7..d4ed9eb52657 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -69,10 +69,10 @@
 #ifndef SCSI_OSD_MAJOR
 #  define SCSI_OSD_MAJOR 260
 #endif
-#define SCSI_OSD_MAX_MINOR 64
+#define SCSI_OSD_MAX_MINOR MINORMASK
 
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.2.0";
+static const char *osd_version_string = "open-osd 0.2.1";
 
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 0cb39ff21171..f8fb2d691c0a 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -408,7 +408,7 @@ int sd_dif_prepare(struct request *rq, sector_t hw_sector, unsigned int sector_s
                         kunmap_atomic(sdt, KM_USER0);
                 }
 
-                bio->bi_flags |= BIO_MAPPED_INTEGRITY;
+                bio->bi_flags |= (1 << BIO_MAPPED_INTEGRITY);
         }
 
         return 0;
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b3d17416d86a..830cd62d8492 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -365,7 +365,7 @@ config PPC_EPAPR_HV_BYTECHAN
 
 config PPC_EARLY_DEBUG_EHV_BC
         bool "Early console (udbg) support for ePAPR hypervisors"
-        depends on PPC_EPAPR_HV_BYTECHAN
+        depends on PPC_EPAPR_HV_BYTECHAN=y
         help
           Select this option to enable early console (a.k.a. "udbg") support
           via an ePAPR byte channel.  You also need to choose the byte channel
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index c26a82e83f6e..b556a72264d1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -239,7 +239,7 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 }
 
-static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
+static void ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 {
         struct usb_hcd *hcd = ehci_to_hcd(ehci);
         struct fsl_usb2_platform_data *pdata;
@@ -299,19 +299,12 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 #endif
                 out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
         }
-
-        if (!(in_be32(non_ehci + FSL_SOC_USB_CTRL) & CTRL_PHY_CLK_VALID)) {
-                printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_fsl_reinit(struct ehci_hcd *ehci)
 {
-        if (ehci_fsl_usb_setup(ehci))
-                return -ENODEV;
+        ehci_fsl_usb_setup(ehci);
         ehci_port_power(ehci, 0);
 
         return 0;
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index bdf43e2adc51..491806221165 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -45,6 +45,5 @@
 #define FSL_SOC_USB_PRICTRL     0x40c   /* NOTE: big-endian */
 #define FSL_SOC_USB_SICTRL      0x410   /* NOTE: big-endian */
 #define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
-#define CTRL_PHY_CLK_VALID      (1 << 17)
 #define SNOOP_SIZE_2GB          0x1e
 #endif                          /* _EHCI_FSL_H */
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
index 74d29b552901..408a9927be92 100644
--- a/drivers/video/omap2/displays/Kconfig
+++ b/drivers/video/omap2/displays/Kconfig
@@ -12,7 +12,7 @@ config PANEL_GENERIC_DPI
 
 config PANEL_DVI
         tristate "DVI output"
-        depends on OMAP2_DSS_DPI
+        depends on OMAP2_DSS_DPI && I2C
         help
           Driver for external monitors, connected via DVI. The driver uses i2c
           to read EDID information from the monitor.
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/omap2/dss/apply.c
index 052dc874cd3d..87b3e25294cf 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -1276,6 +1276,9 @@ int dss_ovl_enable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for overlay to be enabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
@@ -1313,6 +1316,9 @@ int dss_ovl_disable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for the overlay to be disabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index d7aa3b056529..a36b934b2db4 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -165,9 +165,25 @@ static int hdmi_runtime_get(void)
 
         DSSDBG("hdmi_runtime_get\n");
 
+        /*
+         * HACK: Add dss_runtime_get() to ensure DSS clock domain is enabled.
+         * This should be removed later.
+         */
+        r = dss_runtime_get();
+        if (r < 0)
+                goto err_get_dss;
+
         r = pm_runtime_get_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
-        return r < 0 ? r : 0;
+        if (r < 0)
+                goto err_get_hdmi;
+
+        return 0;
+
+err_get_hdmi:
+        dss_runtime_put();
+err_get_dss:
+        return r;
 }
 
 static void hdmi_runtime_put(void)
@@ -178,6 +194,12 @@ static void hdmi_runtime_put(void)
 
         r = pm_runtime_put_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
+
+        /*
+         * HACK: This is added to complement the dss_runtime_get() call in
+         * hdmi_runtime_get(). This should be removed later.
+         */
+        dss_runtime_put();
 }
 
 int hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
index 2d72334ca3da..6847a478b459 100644
--- a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
+++ b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
@@ -479,14 +479,7 @@ int ti_hdmi_4xxx_read_edid(struct hdmi_ip_data *ip_data,
 
 bool ti_hdmi_4xxx_detect(struct hdmi_ip_data *ip_data)
 {
-        int r;
-
-        void __iomem *base = hdmi_core_sys_base(ip_data);
-
-        /* HPD */
-        r = REG_GET(base, HDMI_CORE_SYS_SYS_STAT, 1, 1);
-
-        return r == 1;
+        return gpio_get_value(ip_data->hpd_gpio);
 }
 
 static void hdmi_core_init(struct hdmi_core_video_config *video_cfg,
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index d5aaca9cfa7e..8497727d66de 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -1810,7 +1810,11 @@ static void hw_init(void)
                 break;
         }
 
+        /* magic required on VX900 for correct modesetting on IGA1 */
+        via_write_reg_mask(VIACR, 0x45, 0x00, 0x01);
+
         /* probably this should go to the scaling code one day */
+        via_write_reg_mask(VIACR, 0xFD, 0, 0x80); /* VX900 hw scale on IGA2 */
         viafb_write_regx(scaling_parameters, ARRAY_SIZE(scaling_parameters));
 
         /* Fill VPIT Parameters */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 95aeedf198f8..958e5129c601 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -367,29 +367,45 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 #ifdef CONFIG_PM
 static int virtballoon_freeze(struct virtio_device *vdev)
 {
+        struct virtio_balloon *vb = vdev->priv;
+
         /*
          * The kthread is already frozen by the PM core before this
          * function is called.
          */
 
+        while (vb->num_pages)
+                leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
+
         /* Ensure we don't get any more requests from the host */
         vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
         return 0;
 }
 
+static int restore_common(struct virtio_device *vdev)
+{
+        struct virtio_balloon *vb = vdev->priv;
+        int ret;
+
+        ret = init_vqs(vdev->priv);
+        if (ret)
+                return ret;
+
+        fill_balloon(vb, towards_target(vb));
+        update_balloon_size(vb);
+        return 0;
+}
+
 static int virtballoon_thaw(struct virtio_device *vdev)
 {
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 
 static int virtballoon_restore(struct virtio_device *vdev)
 {
         struct virtio_balloon *vb = vdev->priv;
-        struct page *page, *page2;
-
-        /* We're starting from a clean slate */
-        vb->num_pages = 0;
 
         /*
          * If a request wasn't complete at the time of freezing, this
@@ -397,12 +413,7 @@ static int virtballoon_restore(struct virtio_device *vdev)
          */
         vb->need_stats_update = 0;
 
-        /* We don't have these pages in the balloon anymore! */
-        list_for_each_entry_safe(page, page2, &vb->pages, lru) {
-                list_del(&page->lru);
-                totalram_pages++;
-        }
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 #endif
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 877b107f77a7..df9e8f0e327d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1098,7 +1098,7 @@ config BOOKE_WDT_DEFAULT_TIMEOUT
           For Freescale Book-E processors, this is a number between 0 and 63.
           For other Book-E processors, this is a number between 0 and 3.
 
-          The value can be overidden by the wdt_period command-line parameter.
+          The value can be overridden by the wdt_period command-line parameter.
 
 # PPC64 Architecture
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 337265b47305..7c0fdfca2646 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -198,9 +198,13 @@ static long booke_wdt_ioctl(struct file *file,
                 booke_wdt_period = tmp;
 #endif
                 booke_wdt_set();
-                return 0;
+                /* Fall */
         case WDIOC_GETTIMEOUT:
+#ifdef  CONFIG_FSL_BOOKE
+                return put_user(period_to_sec(booke_wdt_period), p);
+#else
                 return put_user(booke_wdt_period, p);
+#endif
         default:
                 return -ENOTTY;
         }
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8464ea1c36a1..3c166d3f4e55 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,7 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
 
         cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
 
-        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
+        set_memory_x((unsigned long)bios32_map, 2);
         asminline_call(&cmn_regs, bios32_entrypoint);
 
         if (cmn_regs.u1.ral != 0) {
@@ -250,7 +250,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                         cru_rom_addr =
                                 ioremap(cru_physical_address, cru_length);
                         if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
+                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
+                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
                                 retval = 0;
                         }
                 }
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 8e210aafdfd0..dfae030a7ef2 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 printk(KERN_INFO MODULE_NAME
-                        "failed to get memory region resouce\n");
+                        "failed to get memory region resource\n");
                 return -ENOENT;
         }
 
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 4bc3744e14e4..404172f02c9b 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -312,18 +312,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
         dev = &pdev->dev;
         wdt_dev = &pdev->dev;
 
-        /* get the memory region for the watchdog timer */
-
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 dev_err(dev, "no memory resource specified\n");
                 return -ENOENT;
         }
 
+        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (wdt_irq == NULL) {
+                dev_err(dev, "no irq resource specified\n");
+                ret = -ENOENT;
+                goto err;
+        }
+
+        /* get the memory region for the watchdog timer */
+
         size = resource_size(wdt_mem);
         if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
                 dev_err(dev, "failed to get memory region\n");
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         wdt_base = ioremap(wdt_mem->start, size);
@@ -335,29 +343,17 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         DBG("probe: mapped wdt_base=%p\n", wdt_base);
 
-        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (wdt_irq == NULL) {
-                dev_err(dev, "no irq resource specified\n");
-                ret = -ENOENT;
-                goto err_map;
-        }
-
-        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
-        if (ret != 0) {
-                dev_err(dev, "failed to install irq (%d)\n", ret);
-                goto err_map;
-        }
-
         wdt_clock = clk_get(&pdev->dev, "watchdog");
         if (IS_ERR(wdt_clock)) {
                 dev_err(dev, "failed to find watchdog clock source\n");
                 ret = PTR_ERR(wdt_clock);
-                goto err_irq;
+                goto err_map;
         }
 
         clk_enable(wdt_clock);
 
-        if (s3c2410wdt_cpufreq_register() < 0) {
+        ret = s3c2410wdt_cpufreq_register();
+        if (ret < 0) {
                 printk(KERN_ERR PFX "failed to register cpufreq\n");
                 goto err_clk;
         }
@@ -378,12 +374,18 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
                                                         "cannot start\n");
         }
 
+        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
+        if (ret != 0) {
+                dev_err(dev, "failed to install irq (%d)\n", ret);
+                goto err_cpufreq;
+        }
+
         watchdog_set_nowayout(&s3c2410_wdd, nowayout);
 
         ret = watchdog_register_device(&s3c2410_wdd);
         if (ret) {
                 dev_err(dev, "cannot register watchdog (%d)\n", ret);
-                goto err_cpufreq;
+                goto err_irq;
         }
 
         if (tmr_atboot && started == 0) {
@@ -408,23 +410,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         return 0;
 
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
+
  err_cpufreq:
         s3c2410wdt_cpufreq_deregister();
 
  err_clk:
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
-
- err_irq:
-        free_irq(wdt_irq->start, pdev);
+        wdt_clock = NULL;
 
  err_map:
         iounmap(wdt_base);
 
  err_req:
         release_mem_region(wdt_mem->start, size);
-        wdt_mem = NULL;
 
+ err:
+        wdt_irq = NULL;
+        wdt_mem = NULL;
         return ret;
 }
 
@@ -432,18 +437,18 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
         watchdog_unregister_device(&s3c2410_wdd);
 
+        free_irq(wdt_irq->start, dev);
+
         s3c2410wdt_cpufreq_deregister();
 
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
         wdt_clock = NULL;
 
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
-
         iounmap(wdt_base);
 
         release_mem_region(wdt_mem->start, resource_size(wdt_mem));
+        wdt_irq = NULL;
         wdt_mem = NULL;
         return 0;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 969beb0e2231..67e4b9047cc9 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -490,6 +490,8 @@ static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
                 kmem_cache_free(kiocb_cachep, req);
                 ctx->reqs_active--;
         }
+        if (unlikely(!ctx->reqs_active && ctx->dead))
+                wake_up_all(&ctx->wait);
         spin_unlock_irq(&ctx->ctx_lock);
 }
 
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index a6395bdb26ae..1ff94054d35a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -259,6 +259,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         current->mm->free_area_cache = current->mm->mmap_base;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -352,13 +359,6 @@ beyond_if:
                 return retval;
         }
 
-        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) { 
-                /* Someone check-me: is this error path enough? */ 
-                send_sig(SIGKILL, current, 0); 
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bcb884e2d613..07d096c49920 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1421,7 +1421,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
         for (i = 1; i < view->n; ++i) {
                 const struct user_regset *regset = &view->regsets[i];
                 do_thread_regset_writeback(t->task, regset);
-                if (regset->core_note_type &&
+                if (regset->core_note_type && regset->get &&
                     (!regset->active || regset->active(t->task, regset))) {
                         int ret;
                         size_t size = regset->n * regset->size;
diff --git a/fs/dcache.c b/fs/dcache.c
index fe19ac13f75f..bcbdb33fcc20 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -104,7 +104,7 @@ static unsigned int d_hash_shift __read_mostly;
 
 static struct hlist_bl_head *dentry_hashtable __read_mostly;
 
-static inline struct hlist_bl_head *d_hash(struct dentry *parent,
+static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
                                         unsigned long hash)
 {
         hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
@@ -137,6 +137,26 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
 }
 #endif
 
+/*
+ * Compare 2 name strings, return 0 if they match, otherwise non-zero.
+ * The strings are both count bytes long, and count is non-zero.
+ */
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
+        if (scount != tcount)
+                return 1;
+
+        do {
+                if (*cs != *ct)
+                        return 1;
+                cs++;
+                ct++;
+                tcount--;
+        } while (tcount);
+        return 0;
+}
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
@@ -1717,8 +1737,9 @@ EXPORT_SYMBOL(d_add_ci);
  * child is looked up. Thus, an interlocking stepping of sequence lock checks
  * is formed, giving integrity down the path walk.
  */
-struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
-                                unsigned *seq, struct inode **inode)
+struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
+                                unsigned *seqp, struct inode **inode)
 {
         unsigned int len = name->len;
         unsigned int hash = name->hash;
@@ -1748,6 +1769,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
          * See Documentation/filesystems/path-lookup.txt for more details.
          */
         hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
+                unsigned seq;
                 struct inode *i;
                 const char *tname;
                 int tlen;
@@ -1756,7 +1778,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
                         continue;
 
 seqretry:
-                *seq = read_seqcount_begin(&dentry->d_seq);
+                seq = read_seqcount_begin(&dentry->d_seq);
                 if (dentry->d_parent != parent)
                         continue;
                 if (d_unhashed(dentry))
@@ -1771,7 +1793,7 @@ seqretry:
                  * edge of memory when walking. If we could load this
                  * atomically some other way, we could drop this check.
                  */
-                if (read_seqcount_retry(&dentry->d_seq, *seq))
+                if (read_seqcount_retry(&dentry->d_seq, seq))
                         goto seqretry;
                 if (unlikely(parent->d_flags & DCACHE_OP_COMPARE)) {
                         if (parent->d_op->d_compare(parent, *inode,
@@ -1788,6 +1810,7 @@ seqretry:
                  * order to do anything useful with the returned dentry
                  * anyway.
                  */
+                *seqp = seq;
                 *inode = i;
                 return dentry;
         }
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 349209dc6a91..3a06f4043df4 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -429,7 +429,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 goto memdup;
         } else if (count < MIN_MSG_PKT_SIZE || count > MAX_MSG_PKT_SIZE) {
                 printk(KERN_WARNING "%s: Acceptable packet size range is "
-                       "[%d-%lu], but amount of data written is [%zu].",
+                       "[%d-%zu], but amount of data written is [%zu].",
                        __func__, MIN_MSG_PKT_SIZE, MAX_MSG_PKT_SIZE, count);
                 return -EINVAL;
         }
diff --git a/fs/exec.c b/fs/exec.c
index 92ce83a11e90..153dee14fe55 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1915,7 +1915,6 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        struct completion *vfork_done;
         int core_waiters = -EBUSY;
 
         init_completion(&core_state->startup);
@@ -1927,22 +1926,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
         up_write(&mm->mmap_sem);
 
-        if (unlikely(core_waiters < 0))
-                goto fail;
-
-        /*
-         * Make sure nobody is waiting for us to release the VM,
-         * otherwise we can deadlock when we wait on each other
-         */
-        vfork_done = tsk->vfork_done;
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
-
-        if (core_waiters)
+        if (core_waiters > 0)
                 wait_for_completion(&core_state->startup);
-fail:
+
         return core_waiters;
 }
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 376816fcd040..351a3e797789 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -167,14 +167,19 @@ void gfs2_glock_add_to_lru(struct gfs2_glock *gl)
         spin_unlock(&lru_lock);
 }
 
-static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+static void __gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 {
-        spin_lock(&lru_lock);
         if (!list_empty(&gl->gl_lru)) {
                 list_del_init(&gl->gl_lru);
                 atomic_dec(&lru_count);
                 clear_bit(GLF_LRU, &gl->gl_flags);
         }
+}
+
+static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+{
+        spin_lock(&lru_lock);
+        __gfs2_glock_remove_from_lru(gl);
         spin_unlock(&lru_lock);
 }
 
@@ -217,11 +222,12 @@ void gfs2_glock_put(struct gfs2_glock *gl)
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct address_space *mapping = gfs2_glock2aspace(gl);
 
-        if (atomic_dec_and_test(&gl->gl_ref)) {
+        if (atomic_dec_and_lock(&gl->gl_ref, &lru_lock)) {
+                __gfs2_glock_remove_from_lru(gl);
+                spin_unlock(&lru_lock);
                 spin_lock_bucket(gl->gl_hash);
                 hlist_bl_del_rcu(&gl->gl_list);
                 spin_unlock_bucket(gl->gl_hash);
-                gfs2_glock_remove_from_lru(gl);
                 GLOCK_BUG_ON(gl, !list_empty(&gl->gl_holders));
                 GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
                 trace_gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index a7d611b93f0f..56987460cdae 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -391,10 +391,6 @@ static int alloc_dinode(struct gfs2_inode *dip, u64 *no_addr, u64 *generation)
         int error;
         int dblocks = 1;
 
-        error = gfs2_rindex_update(sdp);
-        if (error)
-                fs_warn(sdp, "rindex update returns %d\n", error);
-
         error = gfs2_inplace_reserve(dip, RES_DINODE);
         if (error)
                 goto out;
@@ -1043,6 +1039,7 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
         rgd = gfs2_blk2rgrpd(sdp, ip->i_no_addr);
         if (!rgd)
                 goto out_inodes;
+
         gfs2_holder_init(rgd->rd_gl, LM_ST_EXCLUSIVE, 0, ghs + 2);
 
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 6aacf3f230a2..24f609c9ef91 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -800,6 +800,11 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo)
                 fs_err(sdp, "can't get quota file inode: %d\n", error);
                 goto fail_rindex;
         }
+
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                goto fail_qinode;
+
         return 0;
 
 fail_qinode:
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 981bfa32121a..49ada95209d0 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -683,16 +683,21 @@ int gfs2_rindex_update(struct gfs2_sbd *sdp)
         struct gfs2_glock *gl = ip->i_gl;
         struct gfs2_holder ri_gh;
         int error = 0;
+        int unlock_required = 0;
 
         /* Read new copy from disk if we don't have the latest */
         if (!sdp->sd_rindex_uptodate) {
                 mutex_lock(&sdp->sd_rindex_mutex);
-                error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
-                if (error)
-                        return error;
+                if (!gfs2_glock_is_locked_by_me(gl)) {
+                        error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
+                        if (error)
+                                return error;
+                        unlock_required = 1;
+                }
                 if (!sdp->sd_rindex_uptodate)
                         error = gfs2_ri_update(ip);
-                gfs2_glock_dq_uninit(&ri_gh);
+                if (unlock_required)
+                        gfs2_glock_dq_uninit(&ri_gh);
                 mutex_unlock(&sdp->sd_rindex_mutex);
         }
 
diff --git a/fs/namei.c b/fs/namei.c
index a780ea515c47..e2ba62820a0f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1374,6 +1374,34 @@ static inline int can_lookup(struct inode *inode)
         return 1;
 }
 
+unsigned int full_name_hash(const unsigned char *name, unsigned int len)
+{
+        unsigned long hash = init_name_hash();
+        while (len--)
+                hash = partial_name_hash(*name++, hash);
+        return end_name_hash(hash);
+}
+EXPORT_SYMBOL(full_name_hash);
+
+/*
+ * We know there's a real path component here of at least
+ * one character.
+ */
+static inline unsigned long hash_name(const char *name, unsigned int *hashp)
+{
+        unsigned long hash = init_name_hash();
+        unsigned long len = 0, c;
+
+        c = (unsigned char)*name;
+        do {
+                len++;
+                hash = partial_name_hash(c, hash);
+                c = (unsigned char)name[len];
+        } while (c && c != '/');
+        *hashp = end_name_hash(hash);
+        return len;
+}
+
 /*
  * Name resolution.
  * This is the basic name resolution function, turning a pathname into
@@ -1394,31 +1422,22 @@ static int link_path_walk(const char *name, struct nameidata *nd)
 
         /* At this point we know we have a real path component. */
         for(;;) {
-                unsigned long hash;
                 struct qstr this;
-                unsigned int c;
+                long len;
                 int type;
 
                 err = may_lookup(nd);
                 if (err)
                         break;
 
+                len = hash_name(name, &this.hash);
                 this.name = name;
-                c = *(const unsigned char *)name;
-
-                hash = init_name_hash();
-                do {
-                        name++;
-                        hash = partial_name_hash(c, hash);
-                        c = *(const unsigned char *)name;
-                } while (c && (c != '/'));
-                this.len = name - (const char *) this.name;
-                this.hash = end_name_hash(hash);
+                this.len = len;
 
                 type = LAST_NORM;
-                if (this.name[0] == '.') switch (this.len) {
+                if (name[0] == '.') switch (len) {
                         case 2:
-                                if (this.name[1] == '.') {
+                                if (name[1] == '.') {
                                         type = LAST_DOTDOT;
                                         nd->flags |= LOOKUP_JUMPED;
                                 }
@@ -1437,12 +1456,18 @@ static int link_path_walk(const char *name, struct nameidata *nd)
                         }
                 }
 
-                /* remove trailing slashes? */
-                if (!c)
+                if (!name[len])
                         goto last_component;
-                while (*++name == '/');
-                if (!*name)
+                /*
+                 * If it wasn't NUL, we know it was '/'. Skip that
+                 * slash, and continue until no more slashes.
+                 */
+                do {
+                        len++;
+                } while (unlikely(name[len] == '/'));
+                if (!name[len])
                         goto last_component;
+                name += len;
 
                 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
                 if (err < 0)
@@ -1775,24 +1800,21 @@ static struct dentry *lookup_hash(struct nameidata *nd)
 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 {
         struct qstr this;
-        unsigned long hash;
         unsigned int c;
 
         WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
 
         this.name = name;
         this.len = len;
+        this.hash = full_name_hash(name, len);
         if (!len)
                 return ERR_PTR(-EACCES);
 
-        hash = init_name_hash();
         while (len--) {
                 c = *(const unsigned char *)name++;
                 if (c == '/' || c == '\0')
                         return ERR_PTR(-EACCES);
-                hash = partial_name_hash(c, hash);
         }
-        this.hash = end_name_hash(hash);
         /*
          * See if the low-level filesystem might want
          * to use its own hash..
diff --git a/include/asm-generic/iomap.h b/include/asm-generic/iomap.h
index 8a3d4fde2604..6afd7d6a9899 100644
--- a/include/asm-generic/iomap.h
+++ b/include/asm-generic/iomap.h
@@ -70,7 +70,7 @@ extern void ioport_unmap(void __iomem *);
 /* Destroy a virtual mapping cookie for a PCI BAR (memory or IO) */
 struct pci_dev;
 extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
-#else
+#elif defined(CONFIG_GENERIC_IOMAP)
 struct pci_dev;
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 { }
diff --git a/include/asm-generic/pci_iomap.h b/include/asm-generic/pci_iomap.h
index e58fcf891370..ce37349860fe 100644
--- a/include/asm-generic/pci_iomap.h
+++ b/include/asm-generic/pci_iomap.h
@@ -25,7 +25,7 @@ extern void __iomem *__pci_ioport_map(struct pci_dev *dev, unsigned long port,
 #define __pci_ioport_map(dev, port, nr) ioport_map((port), (nr))
 #endif
 
-#else
+#elif defined(CONFIG_GENERIC_PCI_IOMAP)
 static inline void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
         return NULL;
diff --git a/include/drm/Kbuild b/include/drm/Kbuild
index a5c0e10fd47d..1e38a19d68f6 100644
--- a/include/drm/Kbuild
+++ b/include/drm/Kbuild
@@ -2,6 +2,7 @@ header-y += drm.h
 header-y += drm_fourcc.h
 header-y += drm_mode.h
 header-y += drm_sarea.h
+header-y += exynos_drm.h
 header-y += i810_drm.h
 header-y += i915_drm.h
 header-y += mga_drm.h
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 5e120f1c5cd9..1ed3aae893a5 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -97,15 +97,30 @@ struct drm_exynos_plane_set_zpos {
 #define DRM_IOCTL_EXYNOS_PLANE_SET_ZPOS DRM_IOWR(DRM_COMMAND_BASE + \
                 DRM_EXYNOS_PLANE_SET_ZPOS, struct drm_exynos_plane_set_zpos)
 
+#ifdef __KERNEL__
+
 /**
- * Platform Specific Structure for DRM based FIMD.
+ * A structure for lcd panel information.
  *
  * @timing: default video mode for initializing
+ * @width_mm: physical size of lcd width.
+ * @height_mm: physical size of lcd height.
+ */
+struct exynos_drm_panel_info {
+        struct fb_videomode timing;
+        u32 width_mm;
+        u32 height_mm;
+};
+
+/**
+ * Platform Specific Structure for DRM based FIMD.
+ *
+ * @panel: default panel info for initializing
  * @default_win: default window layer number to be used for UI.
  * @bpp: default bit per pixel.
  */
 struct exynos_drm_fimd_pdata {
-        struct fb_videomode             timing;
+        struct exynos_drm_panel_info panel;
         u32                             vidcon0;
         u32                             vidcon1;
         unsigned int                    default_win;
@@ -139,4 +154,5 @@ struct exynos_drm_hdmi_pdata {
         unsigned int                    bpp;
 };
 
-#endif
+#endif  /* __KERNEL__ */
+#endif  /* _EXYNOS_DRM_H_ */
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d64a55b23afd..ff5f5256d175 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -47,27 +47,6 @@ struct dentry_stat_t {
 };
 extern struct dentry_stat_t dentry_stat;
 
-/*
- * Compare 2 name strings, return 0 if they match, otherwise non-zero.
- * The strings are both count bytes long, and count is non-zero.
- */
-static inline int dentry_cmp(const unsigned char *cs, size_t scount,
-                                const unsigned char *ct, size_t tcount)
-{
-        int ret;
-        if (scount != tcount)
-                return 1;
-        do {
-                ret = (*cs != *ct);
-                if (ret)
-                        break;
-                cs++;
-                ct++;
-                tcount--;
-        } while (tcount);
-        return ret;
-}
-
 /* Name hashing routines. Initial hash value */
 /* Hash courtesy of the R5 hash in reiserfs modulo sign bits */
 #define init_name_hash()                0
@@ -89,14 +68,7 @@ static inline unsigned long end_name_hash(unsigned long hash)
 }
 
 /* Compute the hash for a name string. */
-static inline unsigned int
-full_name_hash(const unsigned char *name, unsigned int len)
-{
-        unsigned long hash = init_name_hash();
-        while (len--)
-                hash = partial_name_hash(*name++, hash);
-        return end_name_hash(hash);
-}
+extern unsigned int full_name_hash(const unsigned char *, unsigned int);
 
 /*
  * Try to keep struct dentry aligned on 64 byte cachelines (this will
@@ -309,7 +281,8 @@ extern struct dentry *d_ancestor(struct dentry *, struct dentry *);
 extern struct dentry *d_lookup(struct dentry *, struct qstr *);
 extern struct dentry *d_hash_and_lookup(struct dentry *, struct qstr *);
 extern struct dentry *__d_lookup(struct dentry *, struct qstr *);
-extern struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
+extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
                                 unsigned *seq, struct inode **inode);
 
 /**
diff --git a/include/linux/kmsg_dump.h b/include/linux/kmsg_dump.h
index fee66317e071..35f7237ec972 100644
--- a/include/linux/kmsg_dump.h
+++ b/include/linux/kmsg_dump.h
@@ -15,13 +15,18 @@
 #include <linux/errno.h>
 #include <linux/list.h>
 
+/*
+ * Keep this list arranged in rough order of priority. Anything listed after
+ * KMSG_DUMP_OOPS will not be logged by default unless printk.always_kmsg_dump
+ * is passed to the kernel.
+ */
 enum kmsg_dump_reason {
-        KMSG_DUMP_OOPS,
         KMSG_DUMP_PANIC,
+        KMSG_DUMP_OOPS,
+        KMSG_DUMP_EMERG,
         KMSG_DUMP_RESTART,
         KMSG_DUMP_HALT,
         KMSG_DUMP_POWEROFF,
-        KMSG_DUMP_EMERG,
 };
 
 /**
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 4d34356fe644..b80de520670b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -129,7 +129,6 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                         struct page *newpage);
 
-extern void mem_cgroup_reset_owner(struct page *page);
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern int do_swap_account;
 #endif
@@ -392,10 +391,6 @@ static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
                                 struct page *newpage)
 {
 }
-
-static inline void mem_cgroup_reset_owner(struct page *page)
-{
-}
 #endif /* CONFIG_CGROUP_MEM_CONT */
 
 #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 32cd1f67462e..21638ae14e07 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -348,9 +348,9 @@ do {									\
 #define _this_cpu_generic_to_op(pcp, val, op)                           \
 do {                                                                    \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         *__this_cpu_ptr(&(pcp)) op val;                                 \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
 } while (0)
 
 #ifndef this_cpu_write
@@ -449,10 +449,10 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         __this_cpu_add(pcp, val);                                       \
         ret__ = __this_cpu_read(pcp);                                   \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -479,10 +479,10 @@ do {									\
 #define _this_cpu_generic_xchg(pcp, nval)                               \
 ({      typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         __this_cpu_write(pcp, nval);                                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -507,11 +507,11 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         if (ret__ == (oval))                                            \
                 __this_cpu_write(pcp, nval);                            \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -544,10 +544,10 @@ do {									\
 ({                                                                      \
         int ret__;                                                      \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_generic_cmpxchg_double(pcp1, pcp2,           \
                         oval1, oval2, nval1, nval2);                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -718,12 +718,13 @@ do {									\
 # ifndef __this_cpu_add_return_8
 #  define __this_cpu_add_return_8(pcp, val)     __this_cpu_generic_add_return(pcp, val)
 # endif
-# define __this_cpu_add_return(pcp, val)        __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
+# define __this_cpu_add_return(pcp, val)        \
+        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
 
-#define __this_cpu_sub_return(pcp, val) this_cpu_add_return(pcp, -(val))
-#define __this_cpu_inc_return(pcp)      this_cpu_add_return(pcp, 1)
-#define __this_cpu_dec_return(pcp)      this_cpu_add_return(pcp, -1)
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
+#define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
+#define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
 
 #define __this_cpu_generic_xchg(pcp, nval)                              \
 ({      typeof(pcp) ret__;                                              \
diff --git a/include/linux/regset.h b/include/linux/regset.h
index 8abee6556223..686f37327a49 100644
--- a/include/linux/regset.h
+++ b/include/linux/regset.h
@@ -335,8 +335,11 @@ static inline int copy_regset_to_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->get)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_WRITE, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->get(target, regset, offset, size, NULL, data);
 }
@@ -358,8 +361,11 @@ static inline int copy_regset_from_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->set)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_READ, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->set(target, regset, offset, size, NULL, data);
 }
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7d379a6bfd88..0657368bd78f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1777,7 +1777,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 /*
  * Per process flags
  */
-#define PF_STARTING     0x00000002      /* being created */
 #define PF_EXITING      0x00000004      /* getting shut down */
 #define PF_EXITPIDONE   0x00000008      /* pi exit done on shut down */
 #define PF_VCPU         0x00000010      /* I'm a virtual CPU */
@@ -2371,7 +2370,7 @@ static inline int thread_group_empty(struct task_struct *p)
  * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring
  * subscriptions and synchronises with wait4().  Also used in procfs.  Also
  * pins the final release of task.io_context.  Also protects ->cpuset and
- * ->cgroup.subsys[].
+ * ->cgroup.subsys[]. And ->vfork_done.
  *
  * Nests both inside and outside of read_lock(&tasklist_lock).
  * It must not be nested with write_lock_irq(&tasklist_lock),
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 46a85c9e1f25..3c7ffdb40dc6 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -412,7 +412,8 @@ struct tcp_sock {
 
         struct tcp_sack_block recv_sack_cache[4];
 
-        struct sk_buff *highest_sack;   /* highest skb with SACK received
+        struct sk_buff *highest_sack;   /* skb just after the highest
+                                         * skb with SACKed bit set
                                          * (validity guaranteed only if
                                          * sacked_out > 0)
                                          */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 42c29bfbcee3..2d80c291fffb 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1364,8 +1364,9 @@ static inline void tcp_push_pending_frames(struct sock *sk)
         }
 }
 
-/* Start sequence of the highest skb with SACKed bit, valid only if
- * sacked > 0 or when the caller has ensured validity by itself.
+/* Start sequence of the skb just after the highest skb with SACKed
+ * bit, valid only if sacked_out > 0 or when the caller has ensured
+ * validity by itself.
  */
 static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
 {
diff --git a/kernel/fork.c b/kernel/fork.c
index e2cd3e2a5ae8..26a7a6707fa7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -668,6 +668,38 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
         return mm;
 }
 
+static void complete_vfork_done(struct task_struct *tsk)
+{
+        struct completion *vfork;
+
+        task_lock(tsk);
+        vfork = tsk->vfork_done;
+        if (likely(vfork)) {
+                tsk->vfork_done = NULL;
+                complete(vfork);
+        }
+        task_unlock(tsk);
+}
+
+static int wait_for_vfork_done(struct task_struct *child,
+                                struct completion *vfork)
+{
+        int killed;
+
+        freezer_do_not_count();
+        killed = wait_for_completion_killable(vfork);
+        freezer_count();
+
+        if (killed) {
+                task_lock(child);
+                child->vfork_done = NULL;
+                task_unlock(child);
+        }
+
+        put_task_struct(child);
+        return killed;
+}
+
 /* Please note the differences between mmput and mm_release.
  * mmput is called whenever we stop holding onto a mm_struct,
  * error success whatever.
@@ -683,8 +715,6 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  */
 void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
-        struct completion *vfork_done = tsk->vfork_done;
-
         /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
         if (unlikely(tsk->robust_list)) {
@@ -704,17 +734,15 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         /* Get rid of any cached register state */
         deactivate_mm(tsk, mm);
 
-        /* notify parent sleeping on vfork() */
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
+        if (tsk->vfork_done)
+                complete_vfork_done(tsk);
 
         /*
          * If we're exiting normally, clear a user-space tid field if
          * requested.  We leave this alone when dying by signal, to leave
          * the value intact in a core dump, and to save the unnecessary
-         * trouble otherwise.  Userland only wants this done for a sys_exit.
+         * trouble, say, a killed vfork parent shouldn't touch this mm.
+         * Userland only wants this done for a sys_exit.
          */
         if (tsk->clear_child_tid) {
                 if (!(tsk->flags & PF_SIGNALED) &&
@@ -1018,7 +1046,6 @@ static void copy_flags(unsigned long clone_flags, struct task_struct *p)
 
         new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
         new_flags |= PF_FORKNOEXEC;
-        new_flags |= PF_STARTING;
         p->flags = new_flags;
 }
 
@@ -1548,16 +1575,9 @@ long do_fork(unsigned long clone_flags,
                 if (clone_flags & CLONE_VFORK) {
                         p->vfork_done = &vfork;
                         init_completion(&vfork);
+                        get_task_struct(p);
                 }
 
-                /*
-                 * We set PF_STARTING at creation in case tracing wants to
-                 * use this to distinguish a fully live task from one that
-                 * hasn't finished SIGSTOP raising yet.  Now we clear it
-                 * and set the child going.
-                 */
-                p->flags &= ~PF_STARTING;
-
                 wake_up_new_task(p);
 
                 /* forking complete and child started to run, tell ptracer */
@@ -1565,10 +1585,8 @@ long do_fork(unsigned long clone_flags,
                         ptrace_event(trace, nr);
 
                 if (clone_flags & CLONE_VFORK) {
-                        freezer_do_not_count();
-                        wait_for_completion(&vfork);
-                        freezer_count();
-                        ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
+                        if (!wait_for_vfork_done(p, &vfork))
+                                ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
                 }
         } else {
                 nr = PTR_ERR(p);
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 2e48ec0c2e91..c21449f85a2a 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -119,15 +119,20 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
  * For preemptible RCU it is sufficient to call rcu_read_unlock in order
  * to exit the grace period. For classic RCU, a reschedule is required.
  */
-static void rcu_lock_break(struct task_struct *g, struct task_struct *t)
+static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
 {
+        bool can_cont;
+
         get_task_struct(g);
         get_task_struct(t);
         rcu_read_unlock();
         cond_resched();
         rcu_read_lock();
+        can_cont = pid_alive(g) && pid_alive(t);
         put_task_struct(t);
         put_task_struct(g);
+
+        return can_cont;
 }
 
 /*
@@ -154,9 +159,7 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
                         goto unlock;
                 if (!--batch_count) {
                         batch_count = HUNG_TASK_BATCHING;
-                        rcu_lock_break(g, t);
-                        /* Exit if t or g was unhashed during refresh. */
-                        if (t->state == TASK_DEAD || g->state == TASK_DEAD)
+                        if (!rcu_lock_break(g, t))
                                 goto unlock;
                 }
                 /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9788c0ec6f43..c62b8546cc90 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1334,8 +1334,10 @@ int __kprobes register_kprobe(struct kprobe *p)
         if (!kernel_text_address((unsigned long) p->addr) ||
             in_kprobes_functions((unsigned long) p->addr) ||
             ftrace_text_reserved(p->addr, p->addr) ||
-            jump_label_text_reserved(p->addr, p->addr))
-                goto fail_with_jump_label;
+            jump_label_text_reserved(p->addr, p->addr)) {
+                ret = -EINVAL;
+                goto cannot_probe;
+        }
 
         /* User can pass only KPROBE_FLAG_DISABLED to register_kprobe */
         p->flags &= KPROBE_FLAG_DISABLED;
@@ -1352,7 +1354,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                  * its code to prohibit unexpected unloading.
                  */
                 if (unlikely(!try_module_get(probed_mod)))
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
 
                 /*
                  * If the module freed .init.text, we couldn't insert
@@ -1361,7 +1363,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                 if (within_module_init((unsigned long)p->addr, probed_mod) &&
                     probed_mod->state != MODULE_STATE_COMING) {
                         module_put(probed_mod);
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
                 }
                 /* ret will be updated by following code */
         }
@@ -1409,7 +1411,7 @@ out:
 
         return ret;
 
-fail_with_jump_label:
+cannot_probe:
         preempt_enable();
         jump_label_unlock();
         return ret;
diff --git a/kernel/printk.c b/kernel/printk.c
index 13c0a1143f49..32690a0b7a18 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -702,6 +702,9 @@ static bool printk_time = 0;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
 
+static bool always_kmsg_dump;
+module_param_named(always_kmsg_dump, always_kmsg_dump, bool, S_IRUGO | S_IWUSR);
+
 /* Check if we have any console registered that can be called early in boot. */
 static int have_callable_console(void)
 {
@@ -1732,6 +1735,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
         unsigned long l1, l2;
         unsigned long flags;
 
+        if ((reason > KMSG_DUMP_OOPS) && !always_kmsg_dump)
+                return;
+
         /* Theoretically, the log could move on after we do this, but
            there's not a lot we can do about that. The new messages
            will overwrite the start of what we dump. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b342f57879e6..33a0676ea744 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6728,7 +6728,7 @@ int __init sched_create_sysfs_power_savings_entries(struct device *dev)
 static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
                              void *hcpu)
 {
-        switch (action & ~CPU_TASKS_FROZEN) {
+        switch (action) {
         case CPU_ONLINE:
         case CPU_DOWN_FAILED:
                 cpuset_update_active_cpus();
@@ -6741,7 +6741,7 @@ static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
 static int cpuset_cpu_inactive(struct notifier_block *nfb, unsigned long action,
                                void *hcpu)
 {
-        switch (action & ~CPU_TASKS_FROZEN) {
+        switch (action) {
         case CPU_DOWN_PREPARE:
                 cpuset_update_active_cpus();
                 return NOTIFY_OK;
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 77cb245f8e7b..0ab9ae8057f0 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -818,17 +818,9 @@ static int __init fixup_activate(void *addr, enum debug_obj_state state)
                 if (obj->static_init == 1) {
                         debug_object_init(obj, &descr_type_test);
                         debug_object_activate(obj, &descr_type_test);
-                        /*
-                         * Real code should return 0 here ! This is
-                         * not a fixup of some bad behaviour. We
-                         * merily call the debug_init function to keep
-                         * track of the object.
-                         */
-                        return 1;
-                } else {
-                        /* Real code needs to emit a warning here */
+                        return 0;
                 }
-                return 0;
+                return 1;
 
         case ODEBUG_STATE_ACTIVE:
                 debug_object_deactivate(obj, &descr_type_test);
@@ -967,7 +959,7 @@ static void __init debug_objects_selftest(void)
 
         obj.static_init = 1;
         debug_object_activate(&obj, &descr_type_test);
-        if (check_results(&obj, ODEBUG_STATE_ACTIVE, ++fixups, warnings))
+        if (check_results(&obj, ODEBUG_STATE_ACTIVE, fixups, warnings))
                 goto out;
         debug_object_init(&obj, &descr_type_test);
         if (check_results(&obj, ODEBUG_STATE_INIT, ++fixups, ++warnings))
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 91d3efb25d15..8f7fc394f636 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
                 set_pmd_at(mm, haddr, pmd, entry);
                 prepare_pmd_huge_pte(pgtable, mm);
                 add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                mm->nr_ptes++;
                 spin_unlock(&mm->page_table_lock);
         }
 
@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         pmd = pmd_mkold(pmd_wrprotect(pmd));
         set_pmd_at(dst_mm, addr, dst_pmd, pmd);
         prepare_pmd_huge_pte(pgtable, dst_mm);
+        dst_mm->nr_ptes++;
 
         ret = 0;
 out_unlock:
@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
         }
         kfree(pages);
 
-        mm->nr_ptes++;
         smp_wmb(); /* make pte visible before pmd */
         pmd_populate(mm, pmd, pgtable);
         page_remove_rmap(page);
@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                         VM_BUG_ON(page_mapcount(page) < 0);
                         add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
                         VM_BUG_ON(!PageHead(page));
+                        tlb->mm->nr_ptes--;
                         spin_unlock(&tlb->mm->page_table_lock);
                         tlb_remove_page(tlb, page);
                         pte_free(tlb->mm, pgtable);
@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
                         pte_unmap(pte);
                 }
 
-                mm->nr_ptes++;
                 smp_wmb(); /* make pte visible before pmd */
                 /*
                  * Up to this point the pmd is present and huge and
@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         set_pmd_at(mm, address, pmd, _pmd);
         update_mmu_cache(vma, address, _pmd);
         prepare_pmd_huge_pte(pgtable, mm);
-        mm->nr_ptes--;
         spin_unlock(&mm->page_table_lock);
 
 #ifndef CONFIG_NUMA
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5f34bd8dda34..a876871f6be5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                         set_page_dirty(page);
                 list_add(&page->lru, &page_list);
         }
-        spin_unlock(&mm->page_table_lock);
         flush_tlb_range(vma, start, end);
+        spin_unlock(&mm->page_table_lock);
         mmu_notifier_invalidate_range_end(mm, start, end);
         list_for_each_entry_safe(page, tmp, &page_list, lru) {
                 page_remove_rmap(page);
diff --git a/mm/ksm.c b/mm/ksm.c
index 1925ffbfb27f..310544a379ae 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -28,7 +28,6 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/memcontrol.h>
 #include <linux/rbtree.h>
 #include <linux/memory.h>
 #include <linux/mmu_notifier.h>
@@ -1572,16 +1571,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
 
         new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
         if (new_page) {
-                /*
-                 * The memcg-specific accounting when moving
-                 * pages around the LRU lists relies on the
-                 * page's owner (memcg) to be valid.  Usually,
-                 * pages are assigned to a new owner before
-                 * being put on the LRU list, but since this
-                 * is not the case here, the stale owner from
-                 * a previous allocation cycle must be reset.
-                 */
-                mem_cgroup_reset_owner(new_page);
                 copy_user_highpage(new_page, page, address, vma);
 
                 SetPageDirty(new_page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 77b5f227e1d8..99f285599501 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -99,9 +99,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
         phys_addr_t this_start, this_end, cand;
         u64 i;
 
-        /* align @size to avoid excessive fragmentation on reserved array */
-        size = round_up(size, align);
-
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
                 end = memblock.current_limit;
@@ -731,6 +728,9 @@ static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
 {
         phys_addr_t found;
 
+        /* align @size to avoid excessive fragmentation on reserved array */
+        size = round_up(size, align);
+
         found = memblock_find_in_range_node(0, max_addr, size, align, nid);
         if (found && !memblock_reserve(found, size))
                 return found;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 228d6461c12a..5585dc3d3646 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1042,6 +1042,19 @@ struct lruvec *mem_cgroup_lru_add_list(struct zone *zone, struct page *page,
 
         pc = lookup_page_cgroup(page);
         memcg = pc->mem_cgroup;
+
+        /*
+         * Surreptitiously switch any uncharged page to root:
+         * an uncharged page off lru does nothing to secure
+         * its former mem_cgroup from sudden removal.
+         *
+         * Our caller holds lru_lock, and PageCgroupUsed is updated
+         * under page_cgroup lock: between them, they make all uses
+         * of pc->mem_cgroup safe.
+         */
+        if (!PageCgroupUsed(pc) && memcg != root_mem_cgroup)
+                pc->mem_cgroup = memcg = root_mem_cgroup;
+
         mz = page_cgroup_zoneinfo(memcg, page);
         /* compound_order() is stabilized through lru_lock */
         MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
@@ -2408,8 +2421,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                        struct page *page,
                                        unsigned int nr_pages,
                                        struct page_cgroup *pc,
-                                       enum charge_type ctype)
+                                       enum charge_type ctype,
+                                       bool lrucare)
 {
+        struct zone *uninitialized_var(zone);
+        bool was_on_lru = false;
+
         lock_page_cgroup(pc);
         if (unlikely(PageCgroupUsed(pc))) {
                 unlock_page_cgroup(pc);
@@ -2420,6 +2437,21 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
          * we don't need page_cgroup_lock about tail pages, becase they are not
          * accessed by any other context at this point.
          */
+
+        /*
+         * In some cases, SwapCache and FUSE(splice_buf->radixtree), the page
+         * may already be on some other mem_cgroup's LRU.  Take care of it.
+         */
+        if (lrucare) {
+                zone = page_zone(page);
+                spin_lock_irq(&zone->lru_lock);
+                if (PageLRU(page)) {
+                        ClearPageLRU(page);
+                        del_page_from_lru_list(zone, page, page_lru(page));
+                        was_on_lru = true;
+                }
+        }
+
         pc->mem_cgroup = memcg;
         /*
          * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2443,9 +2475,18 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                 break;
         }
 
+        if (lrucare) {
+                if (was_on_lru) {
+                        VM_BUG_ON(PageLRU(page));
+                        SetPageLRU(page);
+                        add_page_to_lru_list(zone, page, page_lru(page));
+                }
+                spin_unlock_irq(&zone->lru_lock);
+        }
+
         mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), nr_pages);
         unlock_page_cgroup(pc);
-        WARN_ON_ONCE(PageLRU(page));
+
         /*
          * "charge_statistics" updated event counter. Then, check it.
          * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
@@ -2643,7 +2684,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
         if (ret == -ENOMEM)
                 return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
         return 0;
 }
 
@@ -2663,35 +2704,6 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr,
                                         enum charge_type ctype);
 
-static void
-__mem_cgroup_commit_charge_lrucare(struct page *page, struct mem_cgroup *memcg,
-                                        enum charge_type ctype)
-{
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        struct zone *zone = page_zone(page);
-        unsigned long flags;
-        bool removed = false;
-
-        /*
-         * In some case, SwapCache, FUSE(splice_buf->radixtree), the page
-         * is already on LRU. It means the page may on some other page_cgroup's
-         * LRU. Take care of it.
-         */
-        spin_lock_irqsave(&zone->lru_lock, flags);
-        if (PageLRU(page)) {
-                del_page_from_lru_list(zone, page, page_lru(page));
-                ClearPageLRU(page);
-                removed = true;
-        }
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
-        if (removed) {
-                add_page_to_lru_list(zone, page, page_lru(page));
-                SetPageLRU(page);
-        }
-        spin_unlock_irqrestore(&zone->lru_lock, flags);
-        return;
-}
-
 int mem_cgroup_cache_charge(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask)
 {
@@ -2769,13 +2781,16 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                         enum charge_type ctype)
 {
+        struct page_cgroup *pc;
+
         if (mem_cgroup_disabled())
                 return;
         if (!memcg)
                 return;
         cgroup_exclude_rmdir(&memcg->css);
 
-        __mem_cgroup_commit_charge_lrucare(page, memcg, ctype);
+        pc = lookup_page_cgroup(page);
+        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
@@ -3027,23 +3042,6 @@ void mem_cgroup_uncharge_end(void)
         batch->memcg = NULL;
 }
 
-/*
- * A function for resetting pc->mem_cgroup for newly allocated pages.
- * This function should be called if the newpage will be added to LRU
- * before start accounting.
- */
-void mem_cgroup_reset_owner(struct page *newpage)
-{
-        struct page_cgroup *pc;
-
-        if (mem_cgroup_disabled())
-                return;
-
-        pc = lookup_page_cgroup(newpage);
-        VM_BUG_ON(PageCgroupUsed(pc));
-        pc->mem_cgroup = root_mem_cgroup;
-}
-
 #ifdef CONFIG_SWAP
 /*
  * called after __delete_from_swap_cache() and drop "page" account.
@@ -3248,7 +3246,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
         return ret;
 }
 
@@ -3332,7 +3330,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
          * the newpage may be on LRU(or pagevec for LRU) already. We lock
          * LRU while we overwrite pc->mem_cgroup.
          */
-        __mem_cgroup_commit_charge_lrucare(newpage, memcg, type);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
 }
 
 #ifdef CONFIG_DEBUG_VM
@@ -5077,7 +5075,7 @@ static struct page *mc_handle_present_pte(struct vm_area_struct *vma,
                 return NULL;
         if (PageAnon(page)) {
                 /* we don't move shared anon */
-                if (!move_anon() || page_mapcount(page) > 2)
+                if (!move_anon() || page_mapcount(page) > 1)
                         return NULL;
         } else if (!move_file())
                 /* we ignore mapcount for file pages */
diff --git a/mm/migrate.c b/mm/migrate.c
index df141f60289e..1503b6b54ecb 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -839,8 +839,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         if (!newpage)
                 return -ENOMEM;
 
-        mem_cgroup_reset_owner(newpage);
-
         if (page_count(page) == 1) {
                 /* page was freed from under us. So we are done. */
                 goto out;
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f758c7f4c81..22e1a0b2f70c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1293,6 +1293,8 @@ munmap_back:
                 pgoff = vma->vm_pgoff;
                 vm_flags = vma->vm_flags;
         } else if (vm_flags & VM_SHARED) {
+                if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
+                        goto free_vma;
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 12a48a88c0d8..405d331804c3 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -184,8 +184,7 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
                                    page_end - page_start);
         }
 
-        for (i = page_start; i < page_end; i++)
-                __clear_bit(i, populated);
+        bitmap_clear(populated, page_start, page_end - page_start);
 }
 
 /**
diff --git a/mm/swap.c b/mm/swap.c
index fff1ff7fb9ad..14380e9fbe33 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -652,7 +652,7 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct zone* zone,
                        struct page *page, struct page *page_tail)
 {
-        int active;
+        int uninitialized_var(active);
         enum lru_list lru;
         const int file = 0;
 
@@ -672,7 +672,6 @@ void lru_add_page_tail(struct zone* zone,
                         active = 0;
                         lru = LRU_INACTIVE_ANON;
                 }
-                update_page_reclaim_stat(zone, page_tail, file, active);
         } else {
                 SetPageUnevictable(page_tail);
                 lru = LRU_UNEVICTABLE;
@@ -693,6 +692,9 @@ void lru_add_page_tail(struct zone* zone,
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
+
+        if (!PageUnevictable(page))
+                update_page_reclaim_stat(zone, page_tail, file, active);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -710,8 +712,8 @@ static void __pagevec_lru_add_fn(struct page *page, void *arg)
         SetPageLRU(page);
         if (active)
                 SetPageActive(page);
-        update_page_reclaim_stat(zone, page, file, active);
         add_page_to_lru_list(zone, page, lru);
+        update_page_reclaim_stat(zone, page, file, active);
 }
 
 /*
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 470038a91873..ea6b32d61873 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -300,16 +300,6 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                         new_page = alloc_page_vma(gfp_mask, vma, addr);
                         if (!new_page)
                                 break;          /* Out of memory */
-                        /*
-                         * The memcg-specific accounting when moving
-                         * pages around the LRU lists relies on the
-                         * page's owner (memcg) to be valid.  Usually,
-                         * pages are assigned to a new owner before
-                         * being put on the LRU list, but since this
-                         * is not the case here, the stale owner from
-                         * a previous allocation cycle must be reset.
-                         */
-                        mem_cgroup_reset_owner(new_page);
                 }
 
                 /*
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 568d5bf17534..702a1ae9220b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                           &ip6h->saddr);
+        if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                               &ip6h->saddr)) {
+                kfree_skb(skb);
+                return NULL;
+        }
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index dd147d78a588..6751ed4e0c07 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -17,9 +17,9 @@
 #include "br_private_stp.h"
 
 /* since time values in bpdu are in jiffies and then scaled (1/256)
- * before sending, make sure that is at least one.
+ * before sending, make sure that is at least one STP tick.
  */
-#define MESSAGE_AGE_INCR        ((HZ < 256) ? 1 : (HZ/256))
+#define MESSAGE_AGE_INCR        ((HZ / 256) + 1)
 
 static const char *const br_port_state_names[] = {
         [BR_STATE_DISABLED] = "disabled",
@@ -186,7 +186,7 @@ static void br_record_config_information(struct net_bridge_port *p,
         p->designated_cost = bpdu->root_path_cost;
         p->designated_bridge = bpdu->bridge_id;
         p->designated_port = bpdu->port_id;
-        p->designated_age = jiffies + bpdu->message_age;
+        p->designated_age = jiffies - bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
                   + (p->br->max_age - bpdu->message_age));
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5864cc491369..8aa4ad0e06af 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1893,10 +1893,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
 
         switch (compat_mwt) {
         case EBT_COMPAT_MATCH:
-                match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (match == NULL)
-                        return -ENOENT;
+                match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(match))
                         return PTR_ERR(match);
 
@@ -1915,10 +1912,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
                 break;
         case EBT_COMPAT_WATCHER: /* fallthrough */
         case EBT_COMPAT_TARGET:
-                wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (wt == NULL)
-                        return -ENOENT;
+                wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(wt))
                         return PTR_ERR(wt);
                 off = xt_compat_target_offset(wt);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 606a6e8f3671..f965dce6f20f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1060,11 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
-        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
-                    ifla_policy);
+        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
 
-        if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
 
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
@@ -1900,10 +1901,11 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
         u32 ext_filter_mask = 0;
         u16 min_ifinfo_dump_size = 0;
 
-        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
-
-        if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
 
         if (!ext_filter_mask)
                 return NLMSG_GOODSIZE;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53c8ce4046b2..d9b83d198c3d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1403,8 +1403,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         BUG_ON(!pcount);
 
-        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
-        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
+        /* Adjust counters and hints for the newly sacked sequence
+         * range but discard the return value since prev is already
+         * marked. We must tag the range first because the seq
+         * advancement below implicitly advances
+         * tcp_highest_sack_seq() when skb is highest_sack.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
+
+        if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1430,12 +1438,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* Adjust counters and hints for the newly sacked sequence range but
-         * discard the return value since prev is already marked.
-         */
-        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                        start_seq, end_seq, dup_sack, pcount);
-
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
 
@@ -2567,6 +2569,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 
                 if (cnt > packets) {
                         if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01a21c2f6ab3..8e2137bd87e2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1332,6 +1332,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 hw_roc = true;
 
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
                 if (sdata->old_idle == sdata->vif.bss_conf.idle)
                         continue;
                 if (!ieee80211_sdata_running(sdata))
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index ad64f4d5271a..f9b8e819ca63 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -344,7 +344,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 info->control.rates[i].idx = -1;
                 info->control.rates[i].flags = 0;
-                info->control.rates[i].count = 1;
+                info->control.rates[i].count = 0;
         }
 
         if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 95ffa6a9db6e..496f14c1a731 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2684,10 +2684,9 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
                 err = snd_opl3_hwdep_new(opl3, 0, 1, NULL);
                 if (err < 0)
                         goto out_err;
+                opl3->private_data = chip;
         }
 
-        opl3->private_data = chip;
-
         sprintf(card->longname, "%s at 0x%lx, irq %i",
                 card->shortname, chip->ctrl_io, chip->irq);
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index c2c65f63bf06..684307372d73 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1759,7 +1759,11 @@ static void put_vol_mute(struct hda_codec *codec, struct hda_amp_info *info,
         parm = ch ? AC_AMP_SET_RIGHT : AC_AMP_SET_LEFT;
         parm |= direction == HDA_OUTPUT ? AC_AMP_SET_OUTPUT : AC_AMP_SET_INPUT;
         parm |= index << AC_AMP_SET_INDEX_SHIFT;
-        parm |= val;
+        if ((val & HDA_AMP_MUTE) && !(info->amp_caps & AC_AMPCAP_MUTE) &&
+            (info->amp_caps & AC_AMPCAP_MIN_MUTE))
+                ; /* set the zero value as a fake mute */
+        else
+                parm |= val;
         snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm);
         info->vol[ch] = val;
 }
@@ -2026,7 +2030,7 @@ int snd_hda_mixer_amp_tlv(struct snd_kcontrol *kcontrol, int op_flag,
         val1 = -((caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT);
         val1 += ofs;
         val1 = ((int)val1) * ((int)val2);
-        if (min_mute)
+        if (min_mute || (caps & AC_AMPCAP_MIN_MUTE))
                 val2 |= TLV_DB_SCALE_MUTE;
         if (put_user(SNDRV_CTL_TLVT_DB_SCALE, _tlv))
                 return -EFAULT;
@@ -5114,7 +5118,7 @@ static int fill_audio_out_name(struct hda_codec *codec, hda_nid_t nid,
         const char *pfx = "", *sfx = "";
 
         /* handle as a speaker if it's a fixed line-out */
-        if (!strcmp(name, "Line-Out") && attr == INPUT_PIN_ATTR_INT)
+        if (!strcmp(name, "Line Out") && attr == INPUT_PIN_ATTR_INT)
                 name = "Speaker";
         /* check the location */
         switch (attr) {
@@ -5173,7 +5177,7 @@ int snd_hda_get_pin_label(struct hda_codec *codec, hda_nid_t nid,
 
         switch (get_defcfg_device(def_conf)) {
         case AC_JACK_LINE_OUT:
-                return fill_audio_out_name(codec, nid, cfg, "Line-Out",
+                return fill_audio_out_name(codec, nid, cfg, "Line Out",
                                            label, maxlen, indexp);
         case AC_JACK_SPEAKER:
                 return fill_audio_out_name(codec, nid, cfg, "Speaker",
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index e9f71dc0d464..f0f1943a4b2c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -298,6 +298,9 @@ enum {
 #define AC_AMPCAP_MUTE                  (1<<31)    /* mute capable */
 #define AC_AMPCAP_MUTE_SHIFT            31
 
+/* driver-specific amp-caps: using bits 24-30 */
+#define AC_AMPCAP_MIN_MUTE              (1 << 30) /* min-volume = mute */
+
 /* Connection list */
 #define AC_CLIST_LENGTH                 (0x7f<<0)
 #define AC_CLIST_LONG                   (1<<7)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bc5a993d1146..c83ccdba1e5a 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -609,7 +609,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 "Front Speaker", "Surround Speaker", "Bass Speaker"
         };
         static const char * const line_outs[] = {
-                "Front Line-Out", "Surround Line-Out", "Bass Line-Out"
+                "Front Line Out", "Surround Line Out", "Bass Line Out"
         };
 
         fix_volume_caps(codec, dac);
@@ -635,7 +635,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 if (num_ctls > 1)
                         name = line_outs[idx];
                 else
-                        name = "Line-Out";
+                        name = "Line Out";
                 break;
         }
 
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a7a5733aa4d2..d29d6d377904 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3482,7 +3482,7 @@ static int cx_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -4079,7 +4079,8 @@ static int cx_auto_add_volume_idx(struct hda_codec *codec, const char *basename,
                 err = snd_hda_ctl_add(codec, nid, kctl);
                 if (err < 0)
                         return err;
-                if (!(query_amp_caps(codec, nid, hda_dir) & AC_AMPCAP_MUTE))
+                if (!(query_amp_caps(codec, nid, hda_dir) &
+                      (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)))
                         break;
         }
         return 0;
@@ -4379,6 +4380,22 @@ static const struct snd_pci_quirk cxt_fixups[] = {
         {}
 };
 
+/* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+ * can be created (bko#42825)
+ */
+static void add_cx5051_fake_mutes(struct hda_codec *codec)
+{
+        static hda_nid_t out_nids[] = {
+                0x10, 0x11, 0
+        };
+        hda_nid_t *p;
+
+        for (p = out_nids; *p; p++)
+                snd_hda_override_amp_caps(codec, *p, HDA_OUTPUT,
+                                          AC_AMPCAP_MIN_MUTE |
+                                          query_amp_caps(codec, *p, HDA_OUTPUT));
+}
+
 static int patch_conexant_auto(struct hda_codec *codec)
 {
         struct conexant_spec *spec;
@@ -4397,6 +4414,9 @@ static int patch_conexant_auto(struct hda_codec *codec)
         case 0x14f15045:
                 spec->single_adc_amp = 1;
                 break;
+        case 0x14f15051:
+                add_cx5051_fake_mutes(codec);
+                break;
         }
 
         apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3647baa9bfed..f286bb8fda13 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -802,7 +802,7 @@ static int alc_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -1856,7 +1856,7 @@ static const char * const alc_slave_vols[] = {
         "Headphone Playback Volume",
         "Speaker Playback Volume",
         "Mono Playback Volume",
-        "Line-Out Playback Volume",
+        "Line Out Playback Volume",
         "CLFE Playback Volume",
         "Bass Speaker Playback Volume",
         "PCM Playback Volume",
@@ -1873,7 +1873,7 @@ static const char * const alc_slave_sws[] = {
         "Speaker Playback Switch",
         "Mono Playback Switch",
         "IEC958 Playback Switch",
-        "Line-Out Playback Switch",
+        "Line Out Playback Switch",
         "CLFE Playback Switch",
         "Bass Speaker Playback Switch",
         "PCM Playback Switch",
@@ -3797,7 +3797,7 @@ static void alc_auto_init_input_src(struct hda_codec *codec)
         else
                 nums = spec->num_adc_nids;
         for (c = 0; c < nums; c++)
-                alc_mux_select(codec, 0, spec->cur_mux[c], true);
+                alc_mux_select(codec, c, spec->cur_mux[c], true);
 }
 
 /* add mic boosts if needed */
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6345df131a00..9dbb5735d778 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4629,7 +4629,7 @@ static void stac92xx_hp_detect(struct hda_codec *codec)
                 unsigned int val = AC_PINCTL_OUT_EN | AC_PINCTL_HP_EN;
                 if (no_hp_sensing(spec, i))
                         continue;
-                if (presence)
+                if (1 /*presence*/)
                         stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
 #if 0 /* FIXME */
 /* Resetting the pinctl like below may lead to (a sort of) regressions
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 01d1f749cf02..b6adbed6e506 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -112,7 +112,7 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
                 break;
         case SND_SOC_DAIFMT_DSP_A:
                 /* data on rising edge of bclk, frame high 1clk before data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TEFS;
+                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0 | SSI_STCR_TEFS;
                 break;
         }
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1f55ded4047f..1315663c1c09 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3068,9 +3068,13 @@ static void soc_dapm_shutdown_codec(struct snd_soc_dapm_context *dapm)
          * standby.
          */
         if (powerdown) {
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_PREPARE);
+                if (dapm->bias_level == SND_SOC_BIAS_ON)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_PREPARE);
                 dapm_seq_run(dapm, &down_list, 0, false);
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_STANDBY);
+                if (dapm->bias_level == SND_SOC_BIAS_PREPARE)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_STANDBY);
         }
 }
 
@@ -3083,7 +3087,9 @@ void snd_soc_dapm_shutdown(struct snd_soc_card *card)
 
         list_for_each_entry(codec, &card->codec_dev_list, list) {
                 soc_dapm_shutdown_codec(&codec->dapm);
-                snd_soc_dapm_set_bias_level(&codec->dapm, SND_SOC_BIAS_OFF);
+                if (codec->dapm.bias_level == SND_SOC_BIAS_STANDBY)
+                        snd_soc_dapm_set_bias_level(&codec->dapm,
+                                                    SND_SOC_BIAS_OFF);
         }
 }
 
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 62a134dc421a..9507c4b251a8 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -3244,9 +3244,11 @@ sub make_min_config {
         $in_bisect = 1;
 
         my $failed = 0;
-        build "oldconfig";
-        start_monitor_and_boot or $failed = 1;
-        end_monitor;
+        build "oldconfig" or $failed = 1;
+        if (!$failed) {
+                start_monitor_and_boot or $failed = 1;
+                end_monitor;
+        }
 
         $in_bisect = 0;