178 files changed, 1255 insertions, 1000 deletions
diff --git a/Documentation/hwmon/coretemp b/Documentation/hwmon/coretemp
index fa8776ab9b1..84d46c0c71a 100644
--- a/Documentation/hwmon/coretemp
+++ b/Documentation/hwmon/coretemp
@@ -35,13 +35,6 @@ the Out-Of-Spec bit. Following table summarizes the exported sysfs files:
 All Sysfs entries are named with their core_id (represented here by 'X').
 tempX_input      - Core temperature (in millidegrees Celsius).
 tempX_max        - All cooling devices should be turned on (on Core2).
-                   Initialized with IA32_THERM_INTERRUPT. When the CPU
-                   temperature reaches this temperature, an interrupt is
-                   generated and tempX_max_alarm is set.
-tempX_max_hyst   - If the CPU temperature falls below than temperature,
-                   an interrupt is generated and tempX_max_alarm is reset.
-tempX_max_alarm  - Set if the temperature reaches or exceeds tempX_max.
-                   Reset if the temperature drops to or below tempX_max_hyst.
 tempX_crit       - Maximum junction temperature (in millidegrees Celsius).
 tempX_crit_alarm - Set when Out-of-spec bit is set, never clears.
                   Correct CPU operation is no longer guaranteed.
@@ -49,9 +42,10 @@ tempX_label	 - Contains string "Core X", where X is processor
                   number. For Package temp, this will be "Physical id Y",
                   where Y is the package number.
-The TjMax temperature is set to 85 degrees C if undocumented model specific
+On CPU models which support it, TjMax is read from a model-specific register.
-register (UMSR) 0xee has bit 30 set. If not the TjMax is 100 degrees C as
+On other models, it is set to an arbitrary value based on weak heuristics.
-(sometimes) documented in processor datasheet.
+If these heuristics don't work for you, you can pass the correct TjMax value
+as a module parameter (tjmax).
 Appendix A. Known TjMax lists (TBD):
 Some information comes from ark.intel.com
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 98c8d4229f0..cb7f3148035 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1042,7 +1042,7 @@ conf/interface/*:
        The functional behaviour for certain settings is different
        depending on whether local forwarding is enabled or not.
-accept_ra - BOOLEAN
+accept_ra - INTEGER
        Accept Router Advertisements; autoconfigure using them.
        It also determines whether or not to transmit Router
@@ -1111,7 +1111,7 @@ dad_transmits - INTEGER
        The amount of Duplicate Address Detection probes to send.
        Default: 1
-forwarding - BOOLEAN
+forwarding - INTEGER
        Configure interface-specific Host/Router behaviour.
        Note: It is recommended to have the same setting on all
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 58fd7414e6c..fe67b5c79f0 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -27,7 +27,7 @@ applying a filter to each packet that assigns it to one of a small number
 of logical flows. Packets for each flow are steered to a separate receive
 queue, which in turn can be processed by separate CPUs. This mechanism is
 generally known as “Receive-side Scaling” (RSS). The goal of RSS and
-the other scaling techniques to increase performance uniformly.
+the other scaling techniques is to increase performance uniformly.
 Multi-queue distribution can also be used for traffic prioritization, but
 that is not the focus of these techniques.
@@ -186,10 +186,10 @@ are steered using plain RPS. Multiple table entries may point to the
 same CPU. Indeed, with many flows and few CPUs, it is very likely that
 a single application thread handles flows with many different flow hashes.
-rps_sock_table is a global flow table that contains the *desired* CPU for
+rps_sock_flow_table is a global flow table that contains the *desired* CPU
-flows: the CPU that is currently processing the flow in userspace. Each
+for flows: the CPU that is currently processing the flow in userspace.
-table value is a CPU index that is updated during calls to recvmsg and
+Each table value is a CPU index that is updated during calls to recvmsg
-sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
+and sendmsg (specifically, inet_recvmsg(), inet_sendmsg(), inet_sendpage()
 and tcp_splice_read()).
 When the scheduler moves a thread to a new CPU while it has outstanding
@@ -243,7 +243,7 @@ configured. The number of entries in the global flow table is set through:
 The number of entries in the per-queue flow table are set through:
- /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+ /sys/class/net/<dev>/queues/rx-<n>/rps_flow_cnt
 == Suggested Configuration
diff --git a/Documentation/vm/transhuge.txt b/Documentation/vm/transhuge.txt
index 0924aaca330..29bdf62aac0 100644
--- a/Documentation/vm/transhuge.txt
+++ b/Documentation/vm/transhuge.txt
@@ -123,10 +123,11 @@ be automatically shutdown if it's set to "never".
 khugepaged runs usually at low frequency so while one may not want to
 invoke defrag algorithms synchronously during the page faults, it
 should be worth invoking defrag at least in khugepaged. However it's
-also possible to disable defrag in khugepaged:
+also possible to disable defrag in khugepaged by writing 0 or enable
+defrag in khugepaged by writing 1:
-echo yes >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 0 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
-echo no >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 1 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
 You can also control how many pages khugepaged should scan at each
 pass:
diff --git a/MAINTAINERS b/MAINTAINERS
index 65ca7eae627..aac56f9bf88 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -6382,7 +6382,6 @@ S:	Supported
 F:      arch/arm/mach-tegra
 TEHUTI ETHERNET DRIVER
-M:      Alexander Indenbaum <baum@tehutinetworks.net>
 M:      Andy Gospodarek <andy@greyhouse.net>
 L:      netdev@vger.kernel.org
 S:      Supported
diff --git a/Makefile b/Makefile
index 733dcba61f3..31f967c31e7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION = -rc9
 NAME = "Divemaster Edition"
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3269576dbfa..3146ed3f6ec 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1283,6 +1283,20 @@ config ARM_ERRATA_364296
          processor into full low interrupt latency mode. ARM11MPCore
          is not affected.
+config ARM_ERRATA_764369
+        bool "ARM errata: Data cache line maintenance operation by MVA may not succeed"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for erratum 764369
+          affecting Cortex-A9 MPCore with two or more processors (all
+          current revisions). Under certain timing circumstances, a data
+          cache line maintenance operation by MVA targeting an Inner
+          Shareable memory region may fail to proceed up to either the
+          Point of Coherency or to the Point of Unification of the
+          system. This workaround adds a DSB instruction before the
+          relevant cache maintenance functions and sets a specific bit
+          in the diagnostic control register of the SCU.
 endmenu
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
index 8c73900da9e..253cc86318b 100644
--- a/arch/arm/include/asm/futex.h
+++ b/arch/arm/include/asm/futex.h
@@ -25,17 +25,17 @@
 #ifdef CONFIG_SMP
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        smp_mb();                                               \
        __asm__ __volatile__(                                   \
-        "1:     ldrex   %1, [%2]\n"                             \
+        "1:     ldrex   %1, [%3]\n"                             \
        "       " insn "\n"                                     \
-        "2:     strex   %1, %0, [%2]\n"                         \
+        "2:     strex   %2, %0, [%3]\n"                         \
-        "       teq     %1, #0\n"                               \
+        "       teq     %2, #0\n"                               \
        "       bne     1b\n"                                   \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -73,14 +73,14 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
 #include <linux/preempt.h>
 #include <asm/domain.h>
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        __asm__ __volatile__(                                   \
-        "1:     " T(ldr) "      %1, [%2]\n"                     \
+        "1:     " T(ldr) "      %1, [%3]\n"                     \
        "       " insn "\n"                                     \
-        "2:     " T(str) "      %0, [%2]\n"                     \
+        "2:     " T(str) "      %0, [%3]\n"                     \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -117,7 +117,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        int cmp = (encoded_op >> 24) & 15;
        int oparg = (encoded_op << 8) >> 20;
        int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret;
+        int oldval = 0, ret, tmp;
        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                oparg = 1 << oparg;
@@ -129,19 +129,19 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        switch (op) {
        case FUTEX_OP_SET:
-                __futex_atomic_op("mov  %0, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("mov  %0, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op("add  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("add  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_OR:
-                __futex_atomic_op("orr  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("orr  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ANDN:
-                __futex_atomic_op("and  %0, %1, %3", ret, oldval, uaddr, ~oparg);
+                __futex_atomic_op("and  %0, %1, %4", ret, oldval, tmp, uaddr, ~oparg);
                break;
        case FUTEX_OP_XOR:
-                __futex_atomic_op("eor  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("eor  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        default:
                ret = -ENOSYS;
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 2c04ed5efeb..c60a2944f95 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -478,8 +478,8 @@
 /*
 * Unimplemented (or alternatively implemented) syscalls
 */
-#define __IGNORE_fadvise64_64           1
+#define __IGNORE_fadvise64_64
-#define __IGNORE_migrate_pages          1
+#define __IGNORE_migrate_pages
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_UNISTD_H */
diff --git a/arch/arm/kernel/smp_scu.c b/arch/arm/kernel/smp_scu.c
index 79ed5e7f204..7fcddb75c87 100644
--- a/arch/arm/kernel/smp_scu.c
+++ b/arch/arm/kernel/smp_scu.c
@@ -13,6 +13,7 @@
 #include <asm/smp_scu.h>
 #include <asm/cacheflush.h>
+#include <asm/cputype.h>
 #define SCU_CTRL                0x00
 #define SCU_CONFIG              0x04
@@ -37,6 +38,15 @@ void __init scu_enable(void __iomem *scu_base)
 {
        u32 scu_ctrl;
+#ifdef CONFIG_ARM_ERRATA_764369
+        /* Cortex-A9 only */
+        if ((read_cpuid(CPUID_ID) & 0xff0ffff0) == 0x410fc090) {
+                scu_ctrl = __raw_readl(scu_base + 0x30);
+                if (!(scu_ctrl & 1))
+                        __raw_writel(scu_ctrl | 0x1, scu_base + 0x30);
+        }
+#endif
        scu_ctrl = __raw_readl(scu_base + SCU_CTRL);
        /* already enabled? */
        if (scu_ctrl & 1)
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index bf977f8514f..4e66f62b8d4 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -23,8 +23,10 @@
 #if defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)
 #define ARM_EXIT_KEEP(x)        x
+#define ARM_EXIT_DISCARD(x)
 #else
 #define ARM_EXIT_KEEP(x)
+#define ARM_EXIT_DISCARD(x)     x
 #endif
 OUTPUT_ARCH(arm)
@@ -39,6 +41,11 @@ jiffies = jiffies_64 + 4;
 SECTIONS
 {
        /*
+         * XXX: The linker does not define how output sections are
+         * assigned to input sections when there are multiple statements
+         * matching the same input section name.  There is no documented
+         * order of matching.
+         *
         * unwind exit sections must be discarded before the rest of the
         * unwind sections get included.
         */
@@ -47,6 +54,9 @@ SECTIONS
                *(.ARM.extab.exit.text)
                ARM_CPU_DISCARD(*(.ARM.exidx.cpuexit.text))
                ARM_CPU_DISCARD(*(.ARM.extab.cpuexit.text))
+                ARM_EXIT_DISCARD(EXIT_TEXT)
+                ARM_EXIT_DISCARD(EXIT_DATA)
+                EXIT_CALL
 #ifndef CONFIG_HOTPLUG
                *(.ARM.exidx.devexit.text)
                *(.ARM.extab.devexit.text)
@@ -58,6 +68,8 @@ SECTIONS
 #ifndef CONFIG_SMP_ON_UP
                *(.alt.smp.init)
 #endif
+                *(.discard)
+                *(.discard.*)
        }
 #ifdef CONFIG_XIP_KERNEL
@@ -279,9 +291,6 @@ SECTIONS
        STABS_DEBUG
        .comment 0 : { *(.comment) }
-        /* Default discards */
-        DISCARDS
 }
 /*
diff --git a/arch/arm/mach-exynos4/clock.c b/arch/arm/mach-exynos4/clock.c
index 79d6cd0c8e7..86964d2e9e1 100644
--- a/arch/arm/mach-exynos4/clock.c
+++ b/arch/arm/mach-exynos4/clock.c
@@ -899,8 +899,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 28, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "exynos4-fimc.0",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 16),
                },
@@ -909,8 +908,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 16, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "exynos4-fimc.1",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 20),
                },
diff --git a/arch/arm/mach-s3c2443/clock.c b/arch/arm/mach-s3c2443/clock.c
index a1a7176675b..38058af4897 100644
--- a/arch/arm/mach-s3c2443/clock.c
+++ b/arch/arm/mach-s3c2443/clock.c
@@ -128,7 +128,7 @@ static int s3c2443_armclk_setrate(struct clk *clk, unsigned long rate)
                unsigned long clkcon0;
                clkcon0 = __raw_readl(S3C2443_CLKDIV0);
-                clkcon0 &= S3C2443_CLKDIV0_ARMDIV_MASK;
+                clkcon0 &= ~S3C2443_CLKDIV0_ARMDIV_MASK;
                clkcon0 |= val << S3C2443_CLKDIV0_ARMDIV_SHIFT;
                __raw_writel(clkcon0, S3C2443_CLKDIV0);
        }
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index 52a8e607bcc..f5f8fa89679 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -815,8 +815,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV3, .shift = 20, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "s5pv210-fimc.0",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 3),
                },
@@ -825,8 +824,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV1, .shift = 12, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "s5pv210-fimc.1",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 4),
                },
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 3b24bfa3b82..07c4bc8ea0a 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -174,6 +174,10 @@ ENTRY(v7_coherent_user_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r12, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
 USER(  mcr     p15, 0, r12, c7, c11, 1 )       @ clean D line to the point of unification
        add     r12, r12, r2
@@ -223,6 +227,10 @@ ENTRY(v7_flush_kern_dcache_area)
        add     r1, r0, r1
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D line / unified line
        add     r0, r0, r2
@@ -247,6 +255,10 @@ v7_dma_inv_range:
        sub     r3, r2, #1
        tst     r0, r3
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
        mcrne   p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        tst     r1, r3
@@ -270,6 +282,10 @@ v7_dma_clean_range:
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c10, 1          @ clean D / U line
        add     r0, r0, r2
@@ -288,6 +304,10 @@ ENTRY(v7_dma_flush_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        add     r0, r0, r2
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 0a0a1e7c20d..c3ff82f92d9 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -324,6 +324,8 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
        if (addr)
                *handle = pfn_to_dma(dev, page_to_pfn(page));
+        else
+                __dma_free_buffer(page, size);
        return addr;
 }
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index f71078ef6bb..f88216d2399 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -114,17 +114,18 @@ static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
 {
        static int used_gpioint_groups = 0;
        int group = chip->group;
-        struct s5p_gpioint_bank *bank = NULL;
+        struct s5p_gpioint_bank *b, *bank = NULL;
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
        if (used_gpioint_groups >= S5P_GPIOINT_GROUP_COUNT)
                return -ENOMEM;
-        list_for_each_entry(bank, &banks, list) {
+        list_for_each_entry(b, &banks, list) {
-                if (group >= bank->start &&
+                if (group >= b->start && group < b->start + b->nr_groups) {
-                    group < bank->start + bank->nr_groups)
+                        bank = b;
                        break;
+                }
        }
        if (!bank)
                return -EINVAL;
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index 5cc83851ad0..31a7d3a7ce2 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -561,6 +561,20 @@ static struct pci_ops u4_pcie_pci_ops =
        .write = u4_pcie_write_config,
 };
+static void __devinit pmac_pci_fixup_u4_of_node(struct pci_dev *dev)
+{
+        /* Apple's device-tree "hides" the root complex virtual P2P bridge
+         * on U4. However, Linux sees it, causing the PCI <-> OF matching
+         * code to fail to properly match devices below it. This works around
+         * it by setting the node of the bridge to point to the PHB node,
+         * which is not entirely correct but fixes the matching code and
+         * doesn't break anything else. It's also the simplest possible fix.
+         */
+        if (dev->dev.of_node == NULL)
+                dev->dev.of_node = pcibios_get_phb_of_node(dev->bus);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, 0x5b, pmac_pci_fixup_u4_of_node);
 #endif /* CONFIG_PPC64 */
 #ifdef CONFIG_PPC32
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 64b61bf72e9..547f1a6a35d 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -188,7 +188,8 @@ extern char elf_platform[];
 #define SET_PERSONALITY(ex)                                     \
 do {                                                            \
        if (personality(current->personality) != PER_LINUX32)   \
-                set_personality(PER_LINUX);                     \
+                set_personality(PER_LINUX |                     \
+                        (current->personality & ~PER_MASK));    \
        if ((ex).e_ident[EI_CLASS] == ELFCLASS32)               \
                set_thread_flag(TIF_31BIT);                     \
        else                                                    \
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 519eb5f187e..c0cb794bb36 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -658,12 +658,14 @@ static inline void pgste_set_pte(pte_t *ptep, pgste_t pgste)
 * struct gmap_struct - guest address space
 * @mm: pointer to the parent mm_struct
 * @table: pointer to the page directory
+ * @asce: address space control element for gmap page table
 * @crst_list: list of all crst tables used in the guest address space
 */
 struct gmap {
        struct list_head list;
        struct mm_struct *mm;
        unsigned long *table;
+        unsigned long asce;
        struct list_head crst_list;
 };
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 532fd432215..2b45591e158 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
 #include <linux/sched.h>
 #include <asm/vdso.h>
 #include <asm/sigp.h>
+#include <asm/pgtable.h>
 /*
 * Make sure that the compiler is new enough. We want a compiler that
@@ -126,6 +127,7 @@ int main(void)
        DEFINE(__LC_KERNEL_STACK, offsetof(struct _lowcore, kernel_stack));
        DEFINE(__LC_ASYNC_STACK, offsetof(struct _lowcore, async_stack));
        DEFINE(__LC_PANIC_STACK, offsetof(struct _lowcore, panic_stack));
+        DEFINE(__LC_USER_ASCE, offsetof(struct _lowcore, user_asce));
        DEFINE(__LC_INT_CLOCK, offsetof(struct _lowcore, int_clock));
        DEFINE(__LC_MCCK_CLOCK, offsetof(struct _lowcore, mcck_clock));
        DEFINE(__LC_MACHINE_FLAGS, offsetof(struct _lowcore, machine_flags));
@@ -151,6 +153,7 @@ int main(void)
        DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
        DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
        DEFINE(__LC_CMF_HPP, offsetof(struct _lowcore, cmf_hpp));
+        DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
 #endif /* CONFIG_32BIT */
        return 0;
 }
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 5f729d627ce..713da076053 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -1076,6 +1076,11 @@ sie_loop:
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
        tm      __TI_flags+7(%r14),_TIF_EXIT_SIE
        jnz     sie_exit
+        lg      %r14,__LC_GMAP                  # get gmap pointer
+        ltgr    %r14,%r14
+        jz      sie_gmap
+        lctlg   %c1,%c1,__GMAP_ASCE(%r14)       # load primary asce
+sie_gmap:
        lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
        SPP     __SF_EMPTY(%r15)                # set guest id
        sie     0(%r14)
@@ -1083,6 +1088,7 @@ sie_done:
        SPP     __LC_CMF_HPP                    # set host id
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
 sie_exit:
+        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
        ni      __TI_flags+6(%r14),255-(_TIF_SIE>>8)
        lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
        stmg    %r0,%r13,0(%r14)                # save guest gprs 0-13
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f17296e4fc8..dc2b580e27b 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -123,6 +123,7 @@ int kvm_dev_ioctl_check_extension(long ext)
        switch (ext) {
        case KVM_CAP_S390_PSW:
+        case KVM_CAP_S390_GMAP:
                r = 1;
                break;
        default:
@@ -263,10 +264,12 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        vcpu->arch.guest_fpregs.fpc &= FPC_VALID_MASK;
        restore_fp_regs(&vcpu->arch.guest_fpregs);
        restore_access_regs(vcpu->arch.guest_acrs);
+        gmap_enable(vcpu->arch.gmap);
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 {
+        gmap_disable(vcpu->arch.gmap);
        save_fp_regs(&vcpu->arch.guest_fpregs);
        save_access_regs(vcpu->arch.guest_acrs);
        restore_fp_regs(&vcpu->arch.host_fpregs);
@@ -461,7 +464,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        local_irq_disable();
        kvm_guest_enter();
        local_irq_enable();
-        gmap_enable(vcpu->arch.gmap);
        VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                   atomic_read(&vcpu->arch.sie_block->cpuflags));
        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
@@ -470,7 +472,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        }
        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                   vcpu->arch.sie_block->icptcode);
-        gmap_disable(vcpu->arch.gmap);
        local_irq_disable();
        kvm_guest_exit();
        local_irq_enable();
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 4d1f2bce87b..5d56c2b95b1 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -160,6 +160,8 @@ struct gmap *gmap_alloc(struct mm_struct *mm)
        table = (unsigned long *) page_to_phys(page);
        crst_table_init(table, _REGION1_ENTRY_EMPTY);
        gmap->table = table;
+        gmap->asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
+                     _ASCE_USER_BITS | __pa(table);
        list_add(&gmap->list, &mm->context.gmap_list);
        return gmap;
@@ -240,10 +242,6 @@ EXPORT_SYMBOL_GPL(gmap_free);
 */
 void gmap_enable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
-                                 _ASCE_USER_BITS | __pa(gmap->table);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = (unsigned long) gmap;
 }
 EXPORT_SYMBOL_GPL(gmap_enable);
@@ -254,10 +252,6 @@ EXPORT_SYMBOL_GPL(gmap_enable);
 */
 void gmap_disable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce =
-                gmap->mm->context.asce_bits | __pa(gmap->mm->pgd);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = 0UL;
 }
 EXPORT_SYMBOL_GPL(gmap_disable);
@@ -309,15 +303,15 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                /* Walk the guest addr space page table */
                table = gmap->table + (((to + off) >> 53) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 42) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 31) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 20) & 0x7ff);
@@ -325,6 +319,7 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                flush |= gmap_unlink_segment(gmap, table);
                *table = _SEGMENT_ENTRY_INV;
        }
+out:
        up_read(&gmap->mm->mmap_sem);
        if (flush)
                gmap_flush_tlb(gmap);
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index 55a17c6efeb..d06a2660175 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -43,6 +43,8 @@
 #define SUN4V_CHIP_NIAGARA1     0x01
 #define SUN4V_CHIP_NIAGARA2     0x02
 #define SUN4V_CHIP_NIAGARA3     0x03
+#define SUN4V_CHIP_NIAGARA4     0x04
+#define SUN4V_CHIP_NIAGARA5     0x05
 #define SUN4V_CHIP_UNKNOWN      0xff
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/include/asm/xor_64.h b/arch/sparc/include/asm/xor_64.h
index 9ed6ff679ab..ee8edc68423 100644
--- a/arch/sparc/include/asm/xor_64.h
+++ b/arch/sparc/include/asm/xor_64.h
@@ -66,6 +66,8 @@ static struct xor_block_template xor_block_niagara = {
        ((tlb_type == hypervisor && \
          (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 || \
           sun4v_chip_type == SUN4V_CHIP_NIAGARA2 || \
-           sun4v_chip_type == SUN4V_CHIP_NIAGARA3)) ? \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA3 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA4 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA5)) ? \
         &xor_block_niagara : \
         &xor_block_VIS)
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 9810fd88105..ba9b1cec4e6 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -481,6 +481,18 @@ static void __init sun4v_cpu_probe(void)
                sparc_pmu_type = "niagara3";
                break;
+        case SUN4V_CHIP_NIAGARA4:
+                sparc_cpu_type = "UltraSparc T4 (Niagara4)";
+                sparc_fpu_type = "UltraSparc T4 integrated FPU";
+                sparc_pmu_type = "niagara4";
+                break;
+        case SUN4V_CHIP_NIAGARA5:
+                sparc_cpu_type = "UltraSparc T5 (Niagara5)";
+                sparc_fpu_type = "UltraSparc T5 integrated FPU";
+                sparc_pmu_type = "niagara5";
+                break;
        default:
                printk(KERN_WARNING "CPU: Unknown sun4v cpu type [%s]\n",
                       prom_cpu_compatible);
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index 4197e8d62d4..9323eafccb9 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -325,6 +325,8 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
        case SUN4V_CHIP_NIAGARA1:
        case SUN4V_CHIP_NIAGARA2:
        case SUN4V_CHIP_NIAGARA3:
+        case SUN4V_CHIP_NIAGARA4:
+        case SUN4V_CHIP_NIAGARA5:
                rover_inc_table = niagara_iterate_method;
                break;
        default:
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 0eac1b2fc53..0d810c2f1d0 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -133,7 +133,7 @@ prom_sun4v_name:
 prom_niagara_prefix:
        .asciz  "SUNW,UltraSPARC-T"
 prom_sparc_prefix:
-        .asciz  "SPARC-T"
+        .asciz  "SPARC-"
        .align  4
 prom_root_compatible:
        .skip   64
@@ -396,7 +396,7 @@ sun4v_chip_type:
        or      %g1, %lo(prom_cpu_compatible), %g1
        sethi   %hi(prom_sparc_prefix), %g7
        or      %g7, %lo(prom_sparc_prefix), %g7
-        mov     7, %g3
+        mov     6, %g3
 90:     ldub    [%g7], %g2
        ldub    [%g1], %g4
        cmp     %g2, %g4
@@ -408,10 +408,23 @@ sun4v_chip_type:
        sethi   %hi(prom_cpu_compatible), %g1
        or      %g1, %lo(prom_cpu_compatible), %g1
-        ldub    [%g1 + 7], %g2
+        ldub    [%g1 + 6], %g2
+        cmp     %g2, 'T'
+        be,pt   %xcc, 70f
+         cmp    %g2, 'M'
+        bne,pn  %xcc, 4f
+         nop
+70:     ldub    [%g1 + 7], %g2
        cmp     %g2, '3'
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA3, %g4
+        cmp     %g2, '4'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA4, %g4
+        cmp     %g2, '5'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA5, %g4
        ba,pt   %xcc, 4f
         nop
@@ -545,6 +558,12 @@ niagara_tlb_fixup:
        cmp     %g1, SUN4V_CHIP_NIAGARA3
        be,pt   %xcc, niagara2_patch
         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA4
+        be,pt   %xcc, niagara2_patch
+         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA5
+        be,pt   %xcc, niagara2_patch
+         nop
        call    generic_patch_copyops
         nop
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index c8cc461ff75..f793742eec2 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -380,8 +380,7 @@ void flush_thread(void)
 #endif
        }
-        /* Now, this task is no longer a kernel thread. */
+        /* This task is no longer a kernel thread. */
-        current->thread.current_ds = USER_DS;
        if (current->thread.flags & SPARC_FLAG_KTHREAD) {
                current->thread.flags &= ~SPARC_FLAG_KTHREAD;
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index c158a95ec66..d959cd0a4aa 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -368,9 +368,6 @@ void flush_thread(void)
        /* Clear FPU register state. */
        t->fpsaved[0] = 0;
-        
-        if (get_thread_current_ds() != ASI_AIUS)
-                set_fs(USER_DS);
 }
 /* It's a bit more tricky when 64-bit tasks are involved... */
diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
index d26e1f6c717..3e3e2914c70 100644
--- a/arch/sparc/kernel/setup_32.c
+++ b/arch/sparc/kernel/setup_32.c
@@ -137,7 +137,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        default:
                printk("Unknown boot switch (-%c)\n", c);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 3c5bb784214..c965595aa7e 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -106,7 +106,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        case 'P':
                /* Force UltraSPARC-III P-Cache on. */
@@ -425,10 +425,14 @@ static void __init init_sparc64_elf_hwcap(void)
        else if (tlb_type == hypervisor) {
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 ||
                    sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_BLKINIT;
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_N2;
        }
@@ -452,11 +456,15 @@ static void __init init_sparc64_elf_hwcap(void)
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1)
                                cap |= AV_SPARC_ASI_BLK_INIT;
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
                                        AV_SPARC_ASI_BLK_INIT |
                                        AV_SPARC_POPC);
-                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
                                        AV_SPARC_FMAF);
                }
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 581531dbc8b..8e073d80213 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -511,6 +511,11 @@ static void __init read_obp_translations(void)
                for (i = 0; i < prom_trans_ents; i++)
                        prom_trans[i].data &= ~0x0003fe0000000000UL;
        }
+        /* Force execute bit on.  */
+        for (i = 0; i < prom_trans_ents; i++)
+                prom_trans[i].data |= (tlb_type == hypervisor ?
+                                       _PAGE_EXEC_4V : _PAGE_EXEC_4U);
 }
 static void __init hypervisor_tlb_lock(unsigned long vaddr,
diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index 3f2ad2640d8..ccdbc16b894 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -42,8 +42,11 @@ int mach_set_rtc_mmss(unsigned long nowtime)
 {
        int real_seconds, real_minutes, cmos_minutes;
        unsigned char save_control, save_freq_select;
+        unsigned long flags;
        int retval = 0;
+        spin_lock_irqsave(&rtc_lock, flags);
         /* tell the clock it's being set */
        save_control = CMOS_READ(RTC_CONTROL);
        CMOS_WRITE((save_control|RTC_SET), RTC_CONTROL);
@@ -93,12 +96,17 @@ int mach_set_rtc_mmss(unsigned long nowtime)
        CMOS_WRITE(save_control, RTC_CONTROL);
        CMOS_WRITE(save_freq_select, RTC_FREQ_SELECT);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        return retval;
 }
 unsigned long mach_get_cmos_time(void)
 {
        unsigned int status, year, mon, day, hour, min, sec, century = 0;
+        unsigned long flags;
+        spin_lock_irqsave(&rtc_lock, flags);
        /*
         * If UIP is clear, then we have >= 244 microseconds before
@@ -125,6 +133,8 @@ unsigned long mach_get_cmos_time(void)
        status = CMOS_READ(RTC_CONTROL);
        WARN_ON_ONCE(RTC_ALWAYS_BCD && (status & RTC_DM_BINARY));
+        spin_unlock_irqrestore(&rtc_lock, flags);
        if (RTC_ALWAYS_BCD || !(status & RTC_DM_BINARY)) {
                sec = bcd2bin(sec);
                min = bcd2bin(min);
@@ -169,24 +179,15 @@ EXPORT_SYMBOL(rtc_cmos_write);
 int update_persistent_clock(struct timespec now)
 {
-        unsigned long flags;
+        return x86_platform.set_wallclock(now.tv_sec);
-        int retval;
-        spin_lock_irqsave(&rtc_lock, flags);
-        retval = x86_platform.set_wallclock(now.tv_sec);
-        spin_unlock_irqrestore(&rtc_lock, flags);
-        return retval;
 }
 /* not static: needed by APM */
 void read_persistent_clock(struct timespec *ts)
 {
-        unsigned long retval, flags;
+        unsigned long retval;
-        spin_lock_irqsave(&rtc_lock, flags);
        retval = x86_platform.get_wallclock();
-        spin_unlock_irqrestore(&rtc_lock, flags);
        ts->tv_sec = retval;
        ts->tv_nsec = 0;
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 6f08bc940fa..8b4cc5f067d 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3603,7 +3603,7 @@ done_prefixes:
                break;
        case Src2CL:
                ctxt->src2.bytes = 1;
-                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0x8;
+                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0xff;
                break;
        case Src2ImmByte:
                rc = decode_imm(ctxt, &ctxt->src2, 1, true);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 1c5b69373a0..8e8da7960db 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -400,7 +400,8 @@ static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
        /* xchg acts as a barrier before the setting of the high bits */
        orig.spte_low = xchg(&ssptep->spte_low, sspte.spte_low);
-        orig.spte_high = ssptep->spte_high = sspte.spte_high;
+        orig.spte_high = ssptep->spte_high;
+        ssptep->spte_high = sspte.spte_high;
        count_spte_clear(sptep, spte);
        return orig.spte;
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 039d91315bc..404f21a3ff9 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -43,6 +43,17 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "ALiveSATA2-GLAN"),
                },
        },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=30552 */
+        /* 2006 AMD HT/VIA system with two host bridges */
+        {
+                .callback = set_use_crs,
+                .ident = "ASUS M2V-MX SE",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+                        DMI_MATCH(DMI_BOARD_NAME, "M2V-MX SE"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+                },
+        },
        {}
 };
diff --git a/arch/x86/platform/mrst/vrtc.c b/arch/x86/platform/mrst/vrtc.c
index 73d70d65e76..6d5dbcdd444 100644
--- a/arch/x86/platform/mrst/vrtc.c
+++ b/arch/x86/platform/mrst/vrtc.c
@@ -58,8 +58,11 @@ EXPORT_SYMBOL_GPL(vrtc_cmos_write);
 unsigned long vrtc_get_time(void)
 {
        u8 sec, min, hour, mday, mon;
+        unsigned long flags;
        u32 year;
+        spin_lock_irqsave(&rtc_lock, flags);
        while ((vrtc_cmos_read(RTC_FREQ_SELECT) & RTC_UIP))
                cpu_relax();
@@ -70,6 +73,8 @@ unsigned long vrtc_get_time(void)
        mon = vrtc_cmos_read(RTC_MONTH);
        year = vrtc_cmos_read(RTC_YEAR);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        /* vRTC YEAR reg contains the offset to 1960 */
        year += 1960;
@@ -83,8 +88,10 @@ unsigned long vrtc_get_time(void)
 int vrtc_set_mmss(unsigned long nowtime)
 {
        int real_sec, real_min;
+        unsigned long flags;
        int vrtc_min;
+        spin_lock_irqsave(&rtc_lock, flags);
        vrtc_min = vrtc_cmos_read(RTC_MINUTES);
        real_sec = nowtime % 60;
@@ -95,6 +102,8 @@ int vrtc_set_mmss(unsigned long nowtime)
        vrtc_cmos_write(real_sec, RTC_SECONDS);
        vrtc_cmos_write(real_min, RTC_MINUTES);
+        spin_unlock_irqrestore(&rtc_lock, flags);
        return 0;
 }
diff --git a/block/blk-core.c b/block/blk-core.c
index b2ed78afd9f..d34433ae791 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
 EXPORT_SYMBOL(blk_put_queue);
 /*
- * Note: If a driver supplied the queue lock, it should not zap that lock
+ * Note: If a driver supplied the queue lock, it is disconnected
- * unexpectedly as some queue cleanup components like elevator_exit() and
+ * by this function. The actual state of the lock doesn't matter
- * blk_throtl_exit() need queue lock.
+ * here as the request_queue isn't accessible after this point
+ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
 */
 void blk_cleanup_queue(struct request_queue *q)
 {
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
        queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
        mutex_unlock(&q->sysfs_lock);
-        if (q->elevator)
+        if (q->queue_lock != &q->__queue_lock)
-                elevator_exit(q->elevator);
+                q->queue_lock = &q->__queue_lock;
-        blk_throtl_exit(q);
        blk_put_queue(q);
 }
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index e681805cdb4..60fda88c57f 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -479,6 +479,11 @@ static void blk_release_queue(struct kobject *kobj)
        blk_sync_queue(q);
+        if (q->elevator)
+                elevator_exit(q->elevator);
+        blk_throtl_exit(q);
        if (rl->rq_pool)
                mempool_destroy(rl->rq_pool);
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index 2c18d584066..b97294e2d95 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -42,6 +42,22 @@ static struct pm_clk_data *__to_pcd(struct device *dev)
 }
 /**
+ * pm_clk_acquire - Acquire a device clock.
+ * @dev: Device whose clock is to be acquired.
+ * @ce: PM clock entry corresponding to the clock.
+ */
+static void pm_clk_acquire(struct device *dev, struct pm_clock_entry *ce)
+{
+        ce->clk = clk_get(dev, ce->con_id);
+        if (IS_ERR(ce->clk)) {
+                ce->status = PCE_STATUS_ERROR;
+        } else {
+                ce->status = PCE_STATUS_ACQUIRED;
+                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
+        }
+}
+/**
 * pm_clk_add - Start using a device clock for power management.
 * @dev: Device whose clock is going to be used for power management.
 * @con_id: Connection ID of the clock.
@@ -73,6 +89,8 @@ int pm_clk_add(struct device *dev, const char *con_id)
                }
        }
+        pm_clk_acquire(dev, ce);
        spin_lock_irq(&pcd->lock);
        list_add_tail(&ce->node, &pcd->clock_list);
        spin_unlock_irq(&pcd->lock);
@@ -82,17 +100,12 @@ int pm_clk_add(struct device *dev, const char *con_id)
 /**
 * __pm_clk_remove - Destroy PM clock entry.
 * @ce: PM clock entry to destroy.
- *
- * This routine must be called under the spinlock protecting the PM list of
- * clocks corresponding the the @ce's device.
 */
 static void __pm_clk_remove(struct pm_clock_entry *ce)
 {
        if (!ce)
                return;
-        list_del(&ce->node);
        if (ce->status < PCE_STATUS_ERROR) {
                if (ce->status == PCE_STATUS_ENABLED)
                        clk_disable(ce->clk);
@@ -126,18 +139,22 @@ void pm_clk_remove(struct device *dev, const char *con_id)
        spin_lock_irq(&pcd->lock);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (!con_id && !ce->con_id) {
+                if (!con_id && !ce->con_id)
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
+                else if (!con_id || !ce->con_id)
-                } else if (!con_id || !ce->con_id) {
                        continue;
-                } else if (!strcmp(con_id, ce->con_id)) {
+                else if (!strcmp(con_id, ce->con_id))
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
-                }
        }
        spin_unlock_irq(&pcd->lock);
+        return;
+ remove:
+        list_del(&ce->node);
+        spin_unlock_irq(&pcd->lock);
+        __pm_clk_remove(ce);
 }
 /**
@@ -175,20 +192,27 @@ void pm_clk_destroy(struct device *dev)
 {
        struct pm_clk_data *pcd = __to_pcd(dev);
        struct pm_clock_entry *ce, *c;
+        struct list_head list;
        if (!pcd)
                return;
        dev->power.subsys_data = NULL;
+        INIT_LIST_HEAD(&list);
        spin_lock_irq(&pcd->lock);
        list_for_each_entry_safe_reverse(ce, c, &pcd->clock_list, node)
-                __pm_clk_remove(ce);
+                list_move(&ce->node, &list);
        spin_unlock_irq(&pcd->lock);
        kfree(pcd);
+        list_for_each_entry_safe_reverse(ce, c, &list, node) {
+                list_del(&ce->node);
+                __pm_clk_remove(ce);
+        }
 }
 #endif /* CONFIG_PM */
@@ -196,23 +220,6 @@ void pm_clk_destroy(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 /**
- * pm_clk_acquire - Acquire a device clock.
- * @dev: Device whose clock is to be acquired.
- * @con_id: Connection ID of the clock.
- */
-static void pm_clk_acquire(struct device *dev,
-                                    struct pm_clock_entry *ce)
-{
-        ce->clk = clk_get(dev, ce->con_id);
-        if (IS_ERR(ce->clk)) {
-                ce->status = PCE_STATUS_ERROR;
-        } else {
-                ce->status = PCE_STATUS_ACQUIRED;
-                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
-        }
-}
-/**
 * pm_clk_suspend - Disable clocks in a device's PM clock list.
 * @dev: Device to disable the clocks for.
 */
@@ -230,9 +237,6 @@ int pm_clk_suspend(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry_reverse(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_disable(ce->clk);
                        ce->status = PCE_STATUS_ACQUIRED;
@@ -262,9 +266,6 @@ int pm_clk_resume(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_enable(ce->clk);
                        ce->status = PCE_STATUS_ENABLED;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f6595aba4f0..fa567f1158c 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -43,6 +43,7 @@ config TCG_NSC
 config TCG_ATMEL
        tristate "Atmel TPM Interface"
+        depends on PPC64 || HAS_IOPORT
        ---help---
          If you have a TPM security chip from Atmel say Yes and it 
          will be accessible from within Linux.  To compile this driver 
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index caf8012ef47..9ca5c021d0b 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
        u32 count, ordinal;
        unsigned long stop;
+        if (bufsiz > TPM_BUFSIZE)
+                bufsiz = TPM_BUFSIZE;
        count = be32_to_cpu(*((__be32 *) (buf + 2)));
        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
        if (count == 0)
@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
        struct tpm_chip *chip = file->private_data;
        ssize_t ret_size;
+        int rc;
        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;
                mutex_lock(&chip->buffer_mutex);
-                if (copy_to_user(buf, chip->data_buffer, ret_size))
+                rc = copy_to_user(buf, chip->data_buffer, ret_size);
+                memset(chip->data_buffer, 0, ret_size);
+                if (rc)
                        ret_size = -EFAULT;
                mutex_unlock(&chip->buffer_mutex);
        }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 82facc9104c..4d2464871ad 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
        if (pdev) {
                tpm_nsc_remove(&pdev->dev);
                platform_device_unregister(pdev);
-                kfree(pdev);
-                pdev = NULL;
        }
        platform_driver_unregister(&nsc_drv);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index ce045a8cf82..f07e4252b70 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -67,11 +67,11 @@ module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 MODULE_PARM_DESC(i915_enable_rc6,
                "Enable power-saving render C-state 6 (default: true)");
-unsigned int i915_enable_fbc __read_mostly = 1;
+unsigned int i915_enable_fbc __read_mostly = -1;
 module_param_named(i915_enable_fbc, i915_enable_fbc, int, 0600);
 MODULE_PARM_DESC(i915_enable_fbc,
                "Enable frame buffer compression for power savings "
-                "(default: false)");
+                "(default: -1 (use per-chip default))");
 unsigned int i915_lvds_downclock __read_mostly = 0;
 module_param_named(lvds_downclock, i915_lvds_downclock, int, 0400);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 56a8554d903..04411ad2e77 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1799,6 +1799,7 @@ static void intel_update_fbc(struct drm_device *dev)
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
        struct drm_i915_gem_object *obj;
+        int enable_fbc;
        DRM_DEBUG_KMS("\n");
@@ -1839,8 +1840,15 @@ static void intel_update_fbc(struct drm_device *dev)
        intel_fb = to_intel_framebuffer(fb);
        obj = intel_fb->obj;
-        if (!i915_enable_fbc) {
+        enable_fbc = i915_enable_fbc;
-                DRM_DEBUG_KMS("fbc disabled per module param (default off)\n");
+        if (enable_fbc < 0) {
+                DRM_DEBUG_KMS("fbc set to per-chip default\n");
+                enable_fbc = 1;
+                if (INTEL_INFO(dev)->gen <= 5)
+                        enable_fbc = 0;
+        }
+        if (!enable_fbc) {
+                DRM_DEBUG_KMS("fbc disabled per module param\n");
                dev_priv->no_fbc_reason = FBC_MODULE_PARAM;
                goto out_disable;
        }
@@ -4687,13 +4695,13 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                bpc = 6; /* min is 18bpp */
                break;
        case 24:
-                bpc = min((unsigned int)8, display_bpc);
+                bpc = 8;
                break;
        case 30:
-                bpc = min((unsigned int)10, display_bpc);
+                bpc = 10;
                break;
        case 48:
-                bpc = min((unsigned int)12, display_bpc);
+                bpc = 12;
                break;
        default:
                DRM_DEBUG("unsupported depth, assuming 24 bits\n");
@@ -4701,10 +4709,12 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                break;
        }
+        display_bpc = min(display_bpc, bpc);
        DRM_DEBUG_DRIVER("setting pipe bpc to %d (max display bpc %d)\n",
                         bpc, display_bpc);
-        *pipe_bpp = bpc * 3;
+        *pipe_bpp = display_bpc * 3;
        return display_bpc != bpc;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0b2ee9d3998..fe1099d8817 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -337,9 +337,6 @@ extern void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder,
                                           struct drm_connector *connector,
                                           struct intel_load_detect_pipe *old);
-extern struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB);
-extern int intel_sdvo_supports_hotplug(struct drm_connector *connector);
-extern void intel_sdvo_set_hotplug(struct drm_connector *connector, int enable);
 extern void intelfb_restore(void);
 extern void intel_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                    u16 blue, int regno);
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 30fe554d893..6348c499616 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -92,6 +92,11 @@ struct intel_sdvo {
        */
        uint16_t attached_output;
+        /*
+         * Hotplug activation bits for this device
+         */
+        uint8_t hotplug_active[2];
        /**
         * This is used to select the color range of RBG outputs in HDMI mode.
         * It is only valid when using TMDS encoding and 8 bit per color mode.
@@ -1208,74 +1213,20 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
        return true;
 }
-/* No use! */
+static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
-#if 0
-struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB)
-{
-        struct drm_connector *connector = NULL;
-        struct intel_sdvo *iout = NULL;
-        struct intel_sdvo *sdvo;
-        /* find the sdvo connector */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                iout = to_intel_sdvo(connector);
-                if (iout->type != INTEL_OUTPUT_SDVO)
-                        continue;
-                sdvo = iout->dev_priv;
-                if (sdvo->sdvo_reg == SDVOB && sdvoB)
-                        return connector;
-                if (sdvo->sdvo_reg == SDVOC && !sdvoB)
-                        return connector;
-        }
-        return NULL;
-}
-int intel_sdvo_supports_hotplug(struct drm_connector *connector)
 {
        u8 response[2];
-        u8 status;
-        struct intel_sdvo *intel_sdvo;
-        DRM_DEBUG_KMS("\n");
-        if (!connector)
-                return 0;
-        intel_sdvo = to_intel_sdvo(connector);
        return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
                                    &response, 2) && response[0];
 }
-void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
+static void intel_sdvo_enable_hotplug(struct intel_encoder *encoder)
 {
-        u8 response[2];
+        struct intel_sdvo *intel_sdvo = to_intel_sdvo(&encoder->base);
-        u8 status;
-        struct intel_sdvo *intel_sdvo = to_intel_sdvo(connector);
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
-        if (on) {
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
-                status = intel_sdvo_read_response(intel_sdvo, &response, 2);
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        } else {
-                response[0] = 0;
-                response[1] = 0;
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        }
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
+        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &intel_sdvo->hotplug_active, 2);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
 }
-#endif
 static bool
 intel_sdvo_multifunc_encoder(struct intel_sdvo *intel_sdvo)
@@ -2045,6 +1996,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
 {
        struct drm_encoder *encoder = &intel_sdvo->base.base;
        struct drm_connector *connector;
+        struct intel_encoder *intel_encoder = to_intel_encoder(encoder);
        struct intel_connector *intel_connector;
        struct intel_sdvo_connector *intel_sdvo_connector;
@@ -2062,7 +2014,17 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
        intel_connector = &intel_sdvo_connector->base;
        connector = &intel_connector->base;
-        connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
+        if (intel_sdvo_supports_hotplug(intel_sdvo) & (1 << device)) {
+                connector->polled = DRM_CONNECTOR_POLL_HPD;
+                intel_sdvo->hotplug_active[0] |= 1 << device;
+                /* Some SDVO devices have one-shot hotplug interrupts.
+                 * Ensure that they get re-enabled when an interrupt happens.
+                 */
+                intel_encoder->hot_plug = intel_sdvo_enable_hotplug;
+                intel_sdvo_enable_hotplug(intel_encoder);
+        }
+        else
+                connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
        encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
        connector->connector_type = DRM_MODE_CONNECTOR_DVID;
@@ -2569,6 +2531,14 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
        if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                goto err;
+        /* Set up hotplug command - note paranoia about contents of reply.
+         * We assume that the hardware is in a sane state, and only touch
+         * the bits we think we understand.
+         */
+        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
+                             &intel_sdvo->hotplug_active, 2);
+        intel_sdvo->hotplug_active[0] &= ~0x3;
        if (intel_sdvo_output_setup(intel_sdvo,
                                    intel_sdvo->caps.output_flags) != true) {
                DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 7ad43c6b1db..4da23889fea 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -115,6 +115,7 @@ static int radeon_dp_aux_native_write(struct radeon_connector *radeon_connector,
        u8 msg[20];
        int msg_bytes = send_bytes + 4;
        u8 ack;
+        unsigned retry;
        if (send_bytes > 16)
                return -1;
@@ -125,20 +126,20 @@ static int radeon_dp_aux_native_write(struct radeon_connector *radeon_connector,
        msg[3] = (msg_bytes << 4) | (send_bytes - 1);
        memcpy(&msg[4], send, send_bytes);
-        while (1) {
+        for (retry = 0; retry < 4; retry++) {
                ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus,
                                            msg, msg_bytes, NULL, 0, delay, &ack);
                if (ret < 0)
                        return ret;
                if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
-                        break;
+                        return send_bytes;
                else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
                        udelay(400);
                else
                        return -EIO;
        }
-        return send_bytes;
+        return -EIO;
 }
 static int radeon_dp_aux_native_read(struct radeon_connector *radeon_connector,
@@ -149,26 +150,29 @@ static int radeon_dp_aux_native_read(struct radeon_connector *radeon_connector,
        int msg_bytes = 4;
        u8 ack;
        int ret;
+        unsigned retry;
        msg[0] = address;
        msg[1] = address >> 8;
        msg[2] = AUX_NATIVE_READ << 4;
        msg[3] = (msg_bytes << 4) | (recv_bytes - 1);
-        while (1) {
+        for (retry = 0; retry < 4; retry++) {
                ret = radeon_process_aux_ch(dig_connector->dp_i2c_bus,
                                            msg, msg_bytes, recv, recv_bytes, delay, &ack);
-                if (ret == 0)
-                        return -EPROTO;
                if (ret < 0)
                        return ret;
                if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
                        return ret;
                else if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_DEFER)
                        udelay(400);
+                else if (ret == 0)
+                        return -EPROTO;
                else
                        return -EIO;
        }
+        return -EIO;
 }
 static void radeon_write_dpcd_reg(struct radeon_connector *radeon_connector,
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index e8a746712b5..c4ffa14fb2f 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1590,48 +1590,6 @@ static u32 evergreen_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void evergreen_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer_lo, tcp_chan_steer_hi, mc_shared_chremap, tmp;
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        case 2:
-        case 3:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        }
-        switch (rdev->family) {
-        case CHIP_HEMLOCK:
-        case CHIP_CYPRESS:
-        case CHIP_BARTS:
-                tcp_chan_steer_lo = 0x54763210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        case CHIP_JUNIPER:
-        case CHIP_REDWOOD:
-        case CHIP_CEDAR:
-        case CHIP_PALM:
-        case CHIP_SUMO:
-        case CHIP_SUMO2:
-        case CHIP_TURKS:
-        case CHIP_CAICOS:
-        default:
-                tcp_chan_steer_lo = 0x76543210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        }
-        WREG32(TCP_CHAN_STEER_LO, tcp_chan_steer_lo);
-        WREG32(TCP_CHAN_STEER_HI, tcp_chan_steer_hi);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static void evergreen_gpu_init(struct radeon_device *rdev)
 {
        u32 cc_rb_backend_disable = 0;
@@ -2078,8 +2036,6 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
        WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
        WREG32(HDP_ADDR_CONFIG, gb_addr_config);
-        evergreen_program_channel_remap(rdev);
        num_shader_engines = ((RREG32(GB_ADDR_CONFIG) & NUM_SHADER_ENGINES(3)) >> 12) + 1;
        grbm_gfx_index = INSTANCE_BROADCAST_WRITES;
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 99fbd793c08..8c79ca97753 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -569,36 +569,6 @@ static u32 cayman_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void cayman_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer_lo, tcp_chan_steer_hi, mc_shared_chremap, tmp;
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        case 2:
-        case 3:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        }
-        switch (rdev->family) {
-        case CHIP_CAYMAN:
-        default:
-                //tcp_chan_steer_lo = 0x54763210
-                tcp_chan_steer_lo = 0x76543210;
-                tcp_chan_steer_hi = 0x0000ba98;
-                break;
-        }
-        WREG32(TCP_CHAN_STEER_LO, tcp_chan_steer_lo);
-        WREG32(TCP_CHAN_STEER_HI, tcp_chan_steer_hi);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static u32 cayman_get_disable_mask_per_asic(struct radeon_device *rdev,
                                            u32 disable_mask_per_se,
                                            u32 max_disable_mask_per_se,
@@ -842,8 +812,6 @@ static void cayman_gpu_init(struct radeon_device *rdev)
        WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
        WREG32(HDP_ADDR_CONFIG, gb_addr_config);
-        cayman_program_channel_remap(rdev);
        /* primary versions */
        WREG32(CC_RB_BACKEND_DISABLE, cc_rb_backend_disable);
        WREG32(CC_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 5b1837b4aac..7fcdbbbf297 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
                radeon_ring_write(rdev, 0);
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
                radeon_ring_write(rdev, cur_pages | (stride_pixels << 16));
        }
        radeon_ring_write(rdev, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index c4b8741dbf5..bce63fd329d 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -68,11 +68,11 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
                int saved_dpms = connector->dpms;
-                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
+                /* Only turn off the display it it's physically disconnected */
-                    radeon_dp_needs_link_train(radeon_connector))
+                if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd))
-                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
-                else
                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+                else if (radeon_dp_needs_link_train(radeon_connector))
+                        drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON);
                connector->dpms = saved_dpms;
        }
 }
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 3189a7efb2e..fde25c0d65a 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -208,23 +208,25 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
        int xorigin = 0, yorigin = 0;
        int w = radeon_crtc->cursor_width;
-        if (x < 0)
-                xorigin = -x + 1;
-        if (y < 0)
-                yorigin = -y + 1;
-        if (xorigin >= CURSOR_WIDTH)
-                xorigin = CURSOR_WIDTH - 1;
-        if (yorigin >= CURSOR_HEIGHT)
-                yorigin = CURSOR_HEIGHT - 1;
        if (ASIC_IS_AVIVO(rdev)) {
-                int i = 0;
-                struct drm_crtc *crtc_p;
                /* avivo cursor are offset into the total surface */
                x += crtc->x;
                y += crtc->y;
-                DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+        }
+        DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
+        if (x < 0) {
+                xorigin = min(-x, CURSOR_WIDTH - 1);
+                x = 0;
+        }
+        if (y < 0) {
+                yorigin = min(-y, CURSOR_HEIGHT - 1);
+                y = 0;
+        }
+        if (ASIC_IS_AVIVO(rdev)) {
+                int i = 0;
+                struct drm_crtc *crtc_p;
                /* avivo cursor image can't end on 128 pixel boundary or
                 * go past the end of the frame if both crtcs are enabled
@@ -253,16 +255,12 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
        radeon_lock_cursor(crtc, true);
        if (ASIC_IS_DCE4(rdev)) {
-                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
+                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
-                       ((xorigin ? 0 : x) << 16) |
-                       (yorigin ? 0 : y));
                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
        } else if (ASIC_IS_AVIVO(rdev)) {
-                WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset,
+                WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset, (x << 16) | y);
-                             ((xorigin ? 0 : x) << 16) |
-                             (yorigin ? 0 : y));
                WREG32(AVIVO_D1CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
                WREG32(AVIVO_D1CUR_SIZE + radeon_crtc->crtc_offset,
                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
@@ -276,8 +274,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                        | yorigin));
                WREG32(RADEON_CUR_HORZ_VERT_POSN + radeon_crtc->crtc_offset,
                       (RADEON_CUR_LOCK
-                        | ((xorigin ? 0 : x) << 16)
+                        | (x << 16)
-                        | (yorigin ? 0 : y)));
+                        | y));
                /* offset is from DISP(2)_BASE_ADDRESS */
                WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
                                                                      (yorigin * 256)));
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 319d85d7e75..13690f3eb4a 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1507,7 +1507,14 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                switch (mode) {
                case DRM_MODE_DPMS_ON:
                        args.ucAction = ATOM_ENABLE;
-                        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                        /* workaround for DVOOutputControl on some RS690 systems */
+                        if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) {
+                                u32 reg = RREG32(RADEON_BIOS_3_SCRATCH);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE);
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg);
+                        } else
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                args.ucAction = ATOM_LCD_BLON;
                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 4720d000d44..b13c2eedc32 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -536,55 +536,6 @@ static u32 r700_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
        return backend_map;
 }
-static void rv770_program_channel_remap(struct radeon_device *rdev)
-{
-        u32 tcp_chan_steer, mc_shared_chremap, tmp;
-        bool force_no_swizzle;
-        switch (rdev->family) {
-        case CHIP_RV770:
-        case CHIP_RV730:
-                force_no_swizzle = false;
-                break;
-        case CHIP_RV710:
-        case CHIP_RV740:
-        default:
-                force_no_swizzle = true;
-                break;
-        }
-        tmp = RREG32(MC_SHARED_CHMAP);
-        switch ((tmp & NOOFCHAN_MASK) >> NOOFCHAN_SHIFT) {
-        case 0:
-        case 1:
-        default:
-                /* default mapping */
-                mc_shared_chremap = 0x00fac688;
-                break;
-        case 2:
-        case 3:
-                if (force_no_swizzle)
-                        mc_shared_chremap = 0x00fac688;
-                else
-                        mc_shared_chremap = 0x00bbc298;
-                break;
-        }
-        if (rdev->family == CHIP_RV740)
-                tcp_chan_steer = 0x00ef2a60;
-        else
-                tcp_chan_steer = 0x00fac688;
-        /* RV770 CE has special chremap setup */
-        if (rdev->pdev->device == 0x944e) {
-                tcp_chan_steer = 0x00b08b08;
-                mc_shared_chremap = 0x00b08b08;
-        }
-        WREG32(TCP_CHAN_STEER, tcp_chan_steer);
-        WREG32(MC_SHARED_CHREMAP, mc_shared_chremap);
-}
 static void rv770_gpu_init(struct radeon_device *rdev)
 {
        int i, j, num_qd_pipes;
@@ -785,8 +736,6 @@ static void rv770_gpu_init(struct radeon_device *rdev)
        WREG32(DCP_TILING_CONFIG, (gb_tiling_config & 0xffff));
        WREG32(HDP_TILING_CONFIG, (gb_tiling_config & 0xffff));
-        rv770_program_channel_remap(rdev);
        WREG32(CC_RB_BACKEND_DISABLE,      cc_rb_backend_disable);
        WREG32(CC_GC_SHADER_PIPE_CONFIG,   cc_gc_shader_pipe_config);
        WREG32(GC_USER_SHADER_PIPE_CONFIG, cc_gc_shader_pipe_config);
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 41125767613..93238378664 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,17 +36,25 @@
 #include <linux/cpu.h>
 #include <linux/pci.h>
 #include <linux/smp.h>
+#include <linux/moduleparam.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 #define DRVNAME "coretemp"
+/*
+ * force_tjmax only matters when TjMax can't be read from the CPU itself.
+ * When set, it replaces the driver's suboptimal heuristic.
+ */
+static int force_tjmax;
+module_param_named(tjmax, force_tjmax, int, 0444);
+MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES          16      /* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
-#define MAX_THRESH_ATTRS        3       /* Maximum no of Threshold attrs */
+#define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
-#define TOTAL_ATTRS             (MAX_CORE_ATTRS + MAX_THRESH_ATTRS)
 #define MAX_CORE_DATA           (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
 #ifdef CONFIG_SMP
@@ -69,8 +77,6 @@
 *              This value is passed as "id" field to rdmsr/wrmsr functions.
 * @status_reg: One of IA32_THERM_STATUS or IA32_PACKAGE_THERM_STATUS,
 *              from where the temperature values should be read.
- * @intrpt_reg: One of IA32_THERM_INTERRUPT or IA32_PACKAGE_THERM_INTERRUPT,
- *              from where the thresholds are read.
 * @attr_size:  Total number of pre-core attrs displayed in the sysfs.
 * @is_pkg_data: If this is 1, the temp_data holds pkgtemp data.
 *              Otherwise, temp_data holds coretemp data.
@@ -79,13 +85,11 @@
 struct temp_data {
        int temp;
        int ttarget;
-        int tmin;
        int tjmax;
        unsigned long last_updated;
        unsigned int cpu;
        u32 cpu_core_id;
        u32 status_reg;
-        u32 intrpt_reg;
        int attr_size;
        bool is_pkg_data;
        bool valid;
@@ -143,19 +147,6 @@ static ssize_t show_crit_alarm(struct device *dev,
        return sprintf(buf, "%d\n", (eax >> 5) & 1);
 }
-static ssize_t show_max_alarm(struct device *dev,
-                                struct device_attribute *devattr, char *buf)
-{
-        u32 eax, edx;
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        rdmsr_on_cpu(tdata->cpu, tdata->status_reg, &eax, &edx);
-        return sprintf(buf, "%d\n", !!(eax & THERM_STATUS_THRESHOLD1));
-}
 static ssize_t show_tjmax(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -174,83 +165,6 @@ static ssize_t show_ttarget(struct device *dev,
        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->ttarget);
 }
-static ssize_t store_ttarget(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD1 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD1) |
-                                (diff << THERM_SHIFT_THRESHOLD1);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->ttarget = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
-static ssize_t show_tmin(struct device *dev,
-                        struct device_attribute *devattr, char *buf)
-{
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->tmin);
-}
-static ssize_t store_tmin(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD0 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD0) |
-                                (diff << THERM_SHIFT_THRESHOLD0);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->tmin = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
 static ssize_t show_temp(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -374,7 +288,6 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 {
-        /* The 100C is default for both mobile and non mobile CPUs */
        int err;
        u32 eax, edx;
        u32 val;
@@ -385,7 +298,8 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         */
        err = rdmsr_safe_on_cpu(id, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
        if (err) {
-                dev_warn(dev, "Unable to read TjMax from CPU.\n");
+                if (c->x86_model > 0xe && c->x86_model != 0x1c)
+                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
                val = (eax >> 16) & 0xff;
                /*
@@ -393,11 +307,17 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                 * will be used
                 */
                if (val) {
-                        dev_info(dev, "TjMax is %d C.\n", val);
+                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
        }
+        if (force_tjmax) {
+                dev_notice(dev, "TjMax forced to %d degrees C by user\n",
+                           force_tjmax);
+                return force_tjmax * 1000;
+        }
        /*
         * An assumption is made for early CPUs and unreadable MSR.
         * NOTE: the calculated value may not be correct.
@@ -414,21 +334,6 @@ static void __devinit get_ucode_rev_on_cpu(void *edx)
        rdmsr(MSR_IA32_UCODE_REV, eax, *(u32 *)edx);
 }
-static int get_pkg_tjmax(unsigned int cpu, struct device *dev)
-{
-        int err;
-        u32 eax, edx, val;
-        err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
-        if (!err) {
-                val = (eax >> 16) & 0xff;
-                if (val)
-                        return val * 1000;
-        }
-        dev_warn(dev, "Unable to read Pkg-TjMax from CPU:%u\n", cpu);
-        return 100000; /* Default TjMax: 100 degree celsius */
-}
 static int create_name_attr(struct platform_data *pdata, struct device *dev)
 {
        sysfs_attr_init(&pdata->name_attr.attr);
@@ -442,19 +347,14 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                                int attr_no)
 {
        int err, i;
-        static ssize_t (*rd_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static ssize_t (*const rd_ptr[TOTAL_ATTRS]) (struct device *dev,
                        struct device_attribute *devattr, char *buf) = {
                        show_label, show_crit_alarm, show_temp, show_tjmax,
-                        show_max_alarm, show_ttarget, show_tmin };
+                        show_ttarget };
-        static ssize_t (*rw_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static const char *const names[TOTAL_ATTRS] = {
-                        struct device_attribute *devattr, const char *buf,
-                        size_t count) = { NULL, NULL, NULL, NULL, NULL,
-                                        store_ttarget, store_tmin };
-        static const char *names[TOTAL_ATTRS] = {
                                        "temp%d_label", "temp%d_crit_alarm",
                                        "temp%d_input", "temp%d_crit",
-                                        "temp%d_max_alarm", "temp%d_max",
+                                        "temp%d_max" };
-                                        "temp%d_max_hyst" };
        for (i = 0; i < tdata->attr_size; i++) {
                snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH, names[i],
@@ -462,10 +362,6 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                sysfs_attr_init(&tdata->sd_attrs[i].dev_attr.attr);
                tdata->sd_attrs[i].dev_attr.attr.name = tdata->attr_name[i];
                tdata->sd_attrs[i].dev_attr.attr.mode = S_IRUGO;
-                if (rw_ptr[i]) {
-                        tdata->sd_attrs[i].dev_attr.attr.mode |= S_IWUSR;
-                        tdata->sd_attrs[i].dev_attr.store = rw_ptr[i];
-                }
                tdata->sd_attrs[i].dev_attr.show = rd_ptr[i];
                tdata->sd_attrs[i].index = attr_no;
                err = device_create_file(dev, &tdata->sd_attrs[i].dev_attr);
@@ -481,9 +377,9 @@ exit_free:
 }
-static int __devinit chk_ucode_version(struct platform_device *pdev)
+static int __cpuinit chk_ucode_version(unsigned int cpu)
 {
-        struct cpuinfo_x86 *c = &cpu_data(pdev->id);
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
        int err;
        u32 edx;
@@ -494,17 +390,15 @@ static int __devinit chk_ucode_version(struct platform_device *pdev)
         */
        if (c->x86_model == 0xe && c->x86_mask < 0xc) {
                /* check for microcode update */
-                err = smp_call_function_single(pdev->id, get_ucode_rev_on_cpu,
+                err = smp_call_function_single(cpu, get_ucode_rev_on_cpu,
                                               &edx, 1);
                if (err) {
-                        dev_err(&pdev->dev,
+                        pr_err("Cannot determine microcode revision of "
-                                "Cannot determine microcode revision of "
+                               "CPU#%u (%d)!\n", cpu, err);
-                                "CPU#%u (%d)!\n", pdev->id, err);
                        return -ENODEV;
                } else if (edx < 0x39) {
-                        dev_err(&pdev->dev,
+                        pr_err("Errata AE18 not fixed, update BIOS or "
-                                "Errata AE18 not fixed, update BIOS or "
+                               "microcode of the CPU!\n");
-                                "microcode of the CPU!\n");
                        return -ENODEV;
                }
        }
@@ -538,8 +432,6 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        tdata->status_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_STATUS :
                                                        MSR_IA32_THERM_STATUS;
-        tdata->intrpt_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_INTERRUPT :
-                                                MSR_IA32_THERM_INTERRUPT;
        tdata->is_pkg_data = pkg_flag;
        tdata->cpu = cpu;
        tdata->cpu_core_id = TO_CORE_ID(cpu);
@@ -548,11 +440,11 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        return tdata;
 }
-static int create_core_data(struct platform_data *pdata,
+static int create_core_data(struct platform_device *pdev,
-                                struct platform_device *pdev,
                                unsigned int cpu, int pkg_flag)
 {
        struct temp_data *tdata;
+        struct platform_data *pdata = platform_get_drvdata(pdev);
        struct cpuinfo_x86 *c = &cpu_data(cpu);
        u32 eax, edx;
        int err, attr_no;
@@ -588,25 +480,21 @@ static int create_core_data(struct platform_data *pdata,
                goto exit_free;
        /* We can access status register. Get Critical Temperature */
-        if (pkg_flag)
+        tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
-                tdata->tjmax = get_pkg_tjmax(pdev->id, &pdev->dev);
-        else
-                tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
        /*
-         * Test if we can access the intrpt register. If so, increase the
+         * Read the still undocumented bits 8:15 of IA32_TEMPERATURE_TARGET.
-         * 'size' enough to have ttarget/tmin/max_alarm interfaces.
+         * The target temperature is available on older CPUs but not in this
-         * Initialize ttarget with bits 16:22 of MSR_IA32_THERM_INTERRUPT
+         * register. Atoms don't have the register at all.
         */
-        err = rdmsr_safe_on_cpu(cpu, tdata->intrpt_reg, &eax, &edx);
+        if (c->x86_model > 0xe && c->x86_model != 0x1c) {
-        if (!err) {
+                err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET,
-                tdata->attr_size += MAX_THRESH_ATTRS;
+                                        &eax, &edx);
-                tdata->tmin = tdata->tjmax -
+                if (!err) {
-                              ((eax & THERM_MASK_THRESHOLD0) >>
+                        tdata->ttarget
-                               THERM_SHIFT_THRESHOLD0) * 1000;
+                          = tdata->tjmax - ((eax >> 8) & 0xff) * 1000;
-                tdata->ttarget = tdata->tjmax -
+                        tdata->attr_size++;
-                                 ((eax & THERM_MASK_THRESHOLD1) >>
+                }
-                                  THERM_SHIFT_THRESHOLD1) * 1000;
        }
        pdata->core_data[attr_no] = tdata;
@@ -618,22 +506,20 @@ static int create_core_data(struct platform_data *pdata,
        return 0;
 exit_free:
+        pdata->core_data[attr_no] = NULL;
        kfree(tdata);
        return err;
 }
 static void coretemp_add_core(unsigned int cpu, int pkg_flag)
 {
-        struct platform_data *pdata;
        struct platform_device *pdev = coretemp_get_pdev(cpu);
        int err;
        if (!pdev)
                return;
-        pdata = platform_get_drvdata(pdev);
+        err = create_core_data(pdev, cpu, pkg_flag);
-        err = create_core_data(pdata, pdev, cpu, pkg_flag);
        if (err)
                dev_err(&pdev->dev, "Adding Core %u failed\n", cpu);
 }
@@ -657,11 +543,6 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
        struct platform_data *pdata;
        int err;
-        /* Check the microcode version of the CPU */
-        err = chk_ucode_version(pdev);
-        if (err)
-                return err;
        /* Initialize the per-package data structures */
        pdata = kzalloc(sizeof(struct platform_data), GFP_KERNEL);
        if (!pdata)
@@ -671,7 +552,7 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
        if (err)
                goto exit_free;
-        pdata->phys_proc_id = TO_PHYS_ID(pdev->id);
+        pdata->phys_proc_id = pdev->id;
        platform_set_drvdata(pdev, pdata);
        pdata->hwmon_dev = hwmon_device_register(&pdev->dev);
@@ -723,7 +604,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        mutex_lock(&pdev_list_mutex);
-        pdev = platform_device_alloc(DRVNAME, cpu);
+        pdev = platform_device_alloc(DRVNAME, TO_PHYS_ID(cpu));
        if (!pdev) {
                err = -ENOMEM;
                pr_err("Device allocation failed\n");
@@ -743,7 +624,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        }
        pdev_entry->pdev = pdev;
-        pdev_entry->phys_proc_id = TO_PHYS_ID(cpu);
+        pdev_entry->phys_proc_id = pdev->id;
        list_add_tail(&pdev_entry->list, &pdev_list);
        mutex_unlock(&pdev_list_mutex);
@@ -804,6 +685,10 @@ static void __cpuinit get_core_online(unsigned int cpu)
                return;
        if (!pdev) {
+                /* Check the microcode version of the CPU */
+                if (chk_ucode_version(cpu))
+                        return;
                /*
                 * Alright, we have DTS support.
                 * We are bringing the _first_ core in this pkg
diff --git a/drivers/hwmon/ds620.c b/drivers/hwmon/ds620.c
index 257957c69d9..4f7c3fc40a8 100644
--- a/drivers/hwmon/ds620.c
+++ b/drivers/hwmon/ds620.c
@@ -72,7 +72,7 @@ struct ds620_data {
        char valid;             /* !=0 if following fields are valid */
        unsigned long last_updated;     /* In jiffies */
-        u16 temp[3];            /* Register values, word */
+        s16 temp[3];            /* Register values, word */
 };
 /*
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 17cf1ab9552..8c2844e5691 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_client *client,
                          struct i2c_board_info *info);
 static int w83791d_remove(struct i2c_client *client);
-static int w83791d_read(struct i2c_client *client, u8 register);
+static int w83791d_read(struct i2c_client *client, u8 reg);
-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
 static struct w83791d_data *w83791d_update_device(struct device *dev);
 #ifdef DEBUG
diff --git a/drivers/ide/ide-disk.c b/drivers/ide/ide-disk.c
index 274798068a5..16f69be820c 100644
--- a/drivers/ide/ide-disk.c
+++ b/drivers/ide/ide-disk.c
@@ -435,7 +435,12 @@ static int idedisk_prep_fn(struct request_queue *q, struct request *rq)
        if (!(rq->cmd_flags & REQ_FLUSH))
                return BLKPREP_OK;
-        cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+        if (rq->special) {
+                cmd = rq->special;
+                memset(cmd, 0, sizeof(*cmd));
+        } else {
+                cmd = kzalloc(sizeof(*cmd), GFP_ATOMIC);
+        }
        /* FIXME: map struct ide_taskfile on rq->cmd[] */
        BUG_ON(cmd == NULL);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 17bf9d95463..6cd642aaa4d 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -287,7 +287,7 @@ void __free_ep(struct kref *kref)
        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
                cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
                dst_release(ep->dst);
-                l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+                l2t_release(ep->com.tdev, ep->l2t);
        }
        kfree(ep);
 }
@@ -1178,7 +1178,7 @@ static int act_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                release_tid(ep->com.tdev, GET_TID(rpl), NULL);
        cxgb3_free_atid(ep->com.tdev, ep->atid);
        dst_release(ep->dst);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        put_ep(&ep->com);
        return CPL_RET_BUF_DONE;
 }
@@ -1377,7 +1377,7 @@ static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        if (!child_ep) {
                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
                       __func__);
-                l2t_release(L2DATA(tdev), l2t);
+                l2t_release(tdev, l2t);
                dst_release(dst);
                goto reject;
        }
@@ -1956,7 +1956,7 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        if (!err)
                goto out;
-        l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
+        l2t_release(h->rdev.t3cdev_p, ep->l2t);
 fail4:
        dst_release(ep->dst);
 fail3:
@@ -2127,7 +2127,7 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
        PDBG("%s ep %p redirect to dst %p l2t %p\n", __func__, ep, new,
             l2t);
        dst_hold(new);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        ep->l2t = l2t;
        dst_release(old);
        ep->dst = new;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 0dc97ec15c2..9dea71849f4 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -1124,11 +1124,8 @@ void wacom_setup_input_capabilities(struct input_dev *input_dev,
                for (i = 0; i < 8; i++)
                        __set_bit(BTN_0 + i, input_dev->keybit);
-                if (wacom_wac->features.type != WACOM_21UX2) {
+                input_set_abs_params(input_dev, ABS_RX, 0, 4096, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RX, 0, 4096, 0, 0);
+                input_set_abs_params(input_dev, ABS_RY, 0, 4096, 0, 0);
-                        input_set_abs_params(input_dev, ABS_RY, 0, 4096, 0, 0);
-                }
                input_set_abs_params(input_dev, ABS_Z, -900, 899, 0, 0);
                __set_bit(INPUT_PROP_DIRECT, input_dev->propbit);
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 49da55c1528..8c2a000cf3f 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1698,6 +1698,8 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
        }
        ti->num_flush_requests = 1;
+        ti->discard_zeroes_data_unsupported = 1;
        return 0;
 bad:
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 89f73ca22cf..f84c08029b2 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -81,8 +81,10 @@ static int parse_features(struct dm_arg_set *as, struct flakey_c *fc,
                 * corrupt_bio_byte <Nth_byte> <direction> <value> <bio_flags>
                 */
                if (!strcasecmp(arg_name, "corrupt_bio_byte")) {
-                        if (!argc)
+                        if (!argc) {
                                ti->error = "Feature corrupt_bio_byte requires parameters";
+                                return -EINVAL;
+                        }
                        r = dm_read_arg(_args + 1, as, &fc->corrupt_bio_byte, &ti->error);
                        if (r)
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index a002dd85db1..86df8b2cf92 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -449,7 +449,7 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                                rs->ti->error = "write_mostly option is only valid for RAID1";
                                return -EINVAL;
                        }
-                        if (value > rs->md.raid_disks) {
+                        if (value >= rs->md.raid_disks) {
                                rs->ti->error = "Invalid write_mostly drive index given";
                                return -EINVAL;
                        }
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 986b8754bb0..bc04518e9d8 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1238,14 +1238,15 @@ static void dm_table_set_integrity(struct dm_table *t)
                return;
        template_disk = dm_table_get_integrity_disk(t, true);
-        if (!template_disk &&
+        if (template_disk)
-            blk_integrity_is_initialized(dm_disk(t->md))) {
+                blk_integrity_register(dm_disk(t->md),
+                                       blk_get_integrity(template_disk));
+        else if (blk_integrity_is_initialized(dm_disk(t->md)))
                DMWARN("%s: device no longer has a valid integrity profile",
                       dm_device_name(t->md));
-                return;
+        else
-        }
+                DMWARN("%s: unable to establish an integrity profile",
-        blk_integrity_register(dm_disk(t->md),
+                       dm_device_name(t->md));
-                               blk_get_integrity(template_disk));
 }
 static int device_flush_capable(struct dm_target *ti, struct dm_dev *dev,
@@ -1282,6 +1283,22 @@ static bool dm_table_supports_flush(struct dm_table *t, unsigned flush)
        return 0;
 }
+static bool dm_table_discard_zeroes_data(struct dm_table *t)
+{
+        struct dm_target *ti;
+        unsigned i = 0;
+        /* Ensure that all targets supports discard_zeroes_data. */
+        while (i < dm_table_get_num_targets(t)) {
+                ti = dm_table_get_target(t, i++);
+                if (ti->discard_zeroes_data_unsupported)
+                        return 0;
+        }
+        return 1;
+}
 void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
                               struct queue_limits *limits)
 {
@@ -1304,6 +1321,9 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q,
        }
        blk_queue_flush(q, flush);
+        if (!dm_table_discard_zeroes_data(t))
+                q->limits.discard_zeroes_data = 0;
        dm_table_set_integrity(t);
        /*
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5404b229582..5c95ccb5950 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -61,6 +61,11 @@
 static void autostart_arrays(int part);
 #endif
+/* pers_list is a list of registered personalities protected
+ * by pers_lock.
+ * pers_lock does extra service to protect accesses to
+ * mddev->thread when the mutex cannot be held.
+ */
 static LIST_HEAD(pers_list);
 static DEFINE_SPINLOCK(pers_lock);
@@ -739,7 +744,12 @@ static void mddev_unlock(mddev_t * mddev)
        } else
                mutex_unlock(&mddev->reconfig_mutex);
+        /* was we've dropped the mutex we need a spinlock to
+         * make sur the thread doesn't disappear
+         */
+        spin_lock(&pers_lock);
        md_wakeup_thread(mddev->thread);
+        spin_unlock(&pers_lock);
 }
 static mdk_rdev_t * find_rdev_nr(mddev_t *mddev, int nr)
@@ -6429,11 +6439,18 @@ mdk_thread_t *md_register_thread(void (*run) (mddev_t *), mddev_t *mddev,
        return thread;
 }
-void md_unregister_thread(mdk_thread_t *thread)
+void md_unregister_thread(mdk_thread_t **threadp)
 {
+        mdk_thread_t *thread = *threadp;
        if (!thread)
                return;
        dprintk("interrupting MD-thread pid %d\n", task_pid_nr(thread->tsk));
+        /* Locking ensures that mddev_unlock does not wake_up a
+         * non-existent thread
+         */
+        spin_lock(&pers_lock);
+        *threadp = NULL;
+        spin_unlock(&pers_lock);
        kthread_stop(thread->tsk);
        kfree(thread);
@@ -7340,8 +7357,7 @@ static void reap_sync_thread(mddev_t *mddev)
        mdk_rdev_t *rdev;
        /* resync has finished, collect result */
-        md_unregister_thread(mddev->sync_thread);
+        md_unregister_thread(&mddev->sync_thread);
-        mddev->sync_thread = NULL;
        if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery) &&
            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery)) {
                /* success...*/
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 1e586bb4452..0a309dc29b4 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -560,7 +560,7 @@ extern int register_md_personality(struct mdk_personality *p);
 extern int unregister_md_personality(struct mdk_personality *p);
 extern mdk_thread_t * md_register_thread(void (*run) (mddev_t *mddev),
                                mddev_t *mddev, const char *name);
-extern void md_unregister_thread(mdk_thread_t *thread);
+extern void md_unregister_thread(mdk_thread_t **threadp);
 extern void md_wakeup_thread(mdk_thread_t *thread);
 extern void md_check_recovery(mddev_t *mddev);
 extern void md_write_start(mddev_t *mddev, struct bio *bi);
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 3535c23af28..d5b5fb30017 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -514,8 +514,7 @@ static int multipath_stop (mddev_t *mddev)
 {
        multipath_conf_t *conf = mddev->private;
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
        mempool_destroy(conf->pool);
        kfree(conf->multipaths);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index f4622dd8fc5..d9587dffe53 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2562,8 +2562,7 @@ static int stop(mddev_t *mddev)
        raise_barrier(conf);
        lower_barrier(conf);
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (conf->r1bio_pool)
                mempool_destroy(conf->r1bio_pool);
        kfree(conf->mirrors);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index d7a8468ddea..0cd9672cf9c 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2955,7 +2955,7 @@ static int run(mddev_t *mddev)
        return 0;
 out_free_conf:
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
        if (conf->r10bio_pool)
                mempool_destroy(conf->r10bio_pool);
        safe_put_page(conf->tmppage);
@@ -2973,8 +2973,7 @@ static int stop(mddev_t *mddev)
        raise_barrier(conf, 0);
        lower_barrier(conf);
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
        if (conf->r10bio_pool)
                mempool_destroy(conf->r10bio_pool);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 43709fa6b6d..ac5e8b57e50 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -4941,8 +4941,7 @@ static int run(mddev_t *mddev)
        return 0;
 abort:
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (conf) {
                print_raid5_conf(conf);
                free_conf(conf);
@@ -4956,8 +4955,7 @@ static int stop(mddev_t *mddev)
 {
        raid5_conf_t *conf = mddev->private;
-        md_unregister_thread(mddev->thread);
+        md_unregister_thread(&mddev->thread);
-        mddev->thread = NULL;
        if (mddev->queue)
                mddev->queue->backing_dev_info.congested_fn = NULL;
        free_conf(conf);
diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
index b5ef3622244..b3a5ecdb33a 100644
--- a/drivers/media/video/omap/omap_vout.c
+++ b/drivers/media/video/omap/omap_vout.c
@@ -2194,19 +2194,6 @@ static int __init omap_vout_probe(struct platform_device *pdev)
                                        "'%s' Display already enabled\n",
                                        def_display->name);
                        }
-                        /* set the update mode */
-                        if (def_display->caps &
-                                        OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
-                                if (dssdrv->enable_te)
-                                        dssdrv->enable_te(def_display, 0);
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_MANUAL);
-                        } else {
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_AUTO);
-                        }
                }
        }
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 9d3459de04b..80796eb0c53 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -31,6 +31,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <media/v4l2-event.h>
 #include "isp.h"
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index d29f9c2d085..e4100b1f68d 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1961,7 +1961,7 @@ static int __uvc_resume(struct usb_interface *intf, int reset)
        list_for_each_entry(stream, &dev->streams, list) {
                if (stream->intf == intf)
-                        return uvc_video_resume(stream);
+                        return uvc_video_resume(stream, reset);
        }
        uvc_trace(UVC_TRACE_SUSPEND, "Resume: video streaming USB interface "
diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
index 48fea373c25..29e239911d0 100644
--- a/drivers/media/video/uvc/uvc_entity.c
+++ b/drivers/media/video/uvc/uvc_entity.c
@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
                if (remote == NULL)
                        return -EINVAL;
-                source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
+                source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
                       ? (remote->vdev ? &remote->vdev->entity : NULL)
                       : &remote->subdev.entity;
                if (source == NULL)
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 8244167c891..ffd1158628b 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1104,10 +1104,18 @@ int uvc_video_suspend(struct uvc_streaming *stream)
 * buffers, making sure userspace applications are notified of the problem
 * instead of waiting forever.
 */
-int uvc_video_resume(struct uvc_streaming *stream)
+int uvc_video_resume(struct uvc_streaming *stream, int reset)
 {
        int ret;
+        /* If the bus has been reset on resume, set the alternate setting to 0.
+         * This should be the default value, but some devices crash or otherwise
+         * misbehave if they don't receive a SET_INTERFACE request before any
+         * other video control request.
+         */
+        if (reset)
+                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
        stream->frozen = 0;
        ret = uvc_commit_video(stream, &stream->ctrl);
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index df32a43ca86..cbdd49bf8b6 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -638,7 +638,7 @@ extern void uvc_mc_cleanup_entity(struct uvc_entity *entity);
 /* Video */
 extern int uvc_video_init(struct uvc_streaming *stream);
 extern int uvc_video_suspend(struct uvc_streaming *stream);
-extern int uvc_video_resume(struct uvc_streaming *stream);
+extern int uvc_video_resume(struct uvc_streaming *stream, int reset);
 extern int uvc_video_enable(struct uvc_streaming *stream, int enable);
 extern int uvc_probe_video(struct uvc_streaming *stream,
                struct uvc_streaming_control *probe);
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 06f14008b34..d7215651772 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -173,6 +173,17 @@ static void v4l2_device_release(struct device *cd)
                media_device_unregister_entity(&vdev->entity);
 #endif
+        /* Do not call v4l2_device_put if there is no release callback set.
+         * Drivers that have no v4l2_device release callback might free the
+         * v4l2_dev instance in the video_device release callback below, so we
+         * must perform this check here.
+         *
+         * TODO: In the long run all drivers that use v4l2_device should use the
+         * v4l2_device release callback. This check will then be unnecessary.
+         */
+        if (v4l2_dev->release == NULL)
+                v4l2_dev = NULL;
        /* Release video_device and perform other
           cleanups as needed. */
        vdev->release(vdev);
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
index c72856c4143..e6a2c3b302d 100644
--- a/drivers/media/video/v4l2-device.c
+++ b/drivers/media/video/v4l2-device.c
@@ -38,6 +38,7 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
        mutex_init(&v4l2_dev->ioctl_lock);
        v4l2_prio_init(&v4l2_dev->prio);
        kref_init(&v4l2_dev->ref);
+        get_device(dev);
        v4l2_dev->dev = dev;
        if (dev == NULL) {
                /* If dev == NULL, then name must be filled in by the caller */
@@ -93,6 +94,7 @@ void v4l2_device_disconnect(struct v4l2_device *v4l2_dev)
        if (dev_get_drvdata(v4l2_dev->dev) == v4l2_dev)
                dev_set_drvdata(v4l2_dev->dev, NULL);
+        put_device(v4l2_dev->dev);
        v4l2_dev->dev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_device_disconnect);
diff --git a/drivers/mfd/jz4740-adc.c b/drivers/mfd/jz4740-adc.c
index 21131c7b0f1..563654c9b19 100644
--- a/drivers/mfd/jz4740-adc.c
+++ b/drivers/mfd/jz4740-adc.c
@@ -273,7 +273,7 @@ static int __devinit jz4740_adc_probe(struct platform_device *pdev)
        ct->regs.ack = JZ_REG_ADC_STATUS;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        irq_setup_generic_chip(gc, IRQ_MSK(5), 0, 0, IRQ_NOPROBE | IRQ_LEVEL);
diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
index b928bc14e97..8b51cd62d06 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -375,12 +375,14 @@ void lis3lv02d_poweron(struct lis3lv02d *lis3)
         *      both have been read. So the value read will always be correct.
         * Set BOOT bit to refresh factory tuning values.
         */
-        lis3->read(lis3, CTRL_REG2, &reg);
+        if (lis3->pdata) {
-        if (lis3->whoami ==  WAI_12B)
+                lis3->read(lis3, CTRL_REG2, &reg);
-                reg |= CTRL2_BDU | CTRL2_BOOT;
+                if (lis3->whoami ==  WAI_12B)
-        else
+                        reg |= CTRL2_BDU | CTRL2_BOOT;
-                reg |= CTRL2_BOOT_8B;
+                else
-        lis3->write(lis3, CTRL_REG2, reg);
+                        reg |= CTRL2_BOOT_8B;
+                lis3->write(lis3, CTRL_REG2, reg);
+        }
        /* LIS3 power on delay is quite long */
        msleep(lis3->pwron_delay / lis3lv02d_get_odr());
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index a047eb973e3..47b928ed08f 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2168,7 +2168,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->ad_work, ad_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 7f8b20a34ee..d4fbd2e6261 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1440,7 +1440,8 @@ void bond_alb_monitor(struct work_struct *work)
        }
 re_arm:
-        queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
+        if (!bond->kill_timers)
+                queue_delayed_work(bond->wq, &bond->alb_work, alb_delta_in_ticks);
 out:
        read_unlock(&bond->lock);
 }
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 1dcb07ce526..6191e633728 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -774,6 +774,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
        read_lock(&bond->lock);
+        if (bond->kill_timers)
+                goto out;
        /* rejoin all groups on bond device */
        __bond_resend_igmp_join_requests(bond->dev);
@@ -787,9 +790,9 @@ static void bond_resend_igmp_join_requests(struct bonding *bond)
                        __bond_resend_igmp_join_requests(vlan_dev);
        }
-        if (--bond->igmp_retrans > 0)
+        if ((--bond->igmp_retrans > 0) && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mcast_work, HZ/5);
+out:
        read_unlock(&bond->lock);
 }
@@ -2535,7 +2538,7 @@ void bond_mii_monitor(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.miimon)
+        if (bond->params.miimon && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->mii_work,
                                   msecs_to_jiffies(bond->params.miimon));
 out:
@@ -2883,7 +2886,7 @@ void bond_loadbalance_arp_mon(struct work_struct *work)
        }
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
@@ -3151,7 +3154,7 @@ void bond_activebackup_arp_mon(struct work_struct *work)
        bond_ab_arp_probe(bond);
 re_arm:
-        if (bond->params.arp_interval)
+        if (bond->params.arp_interval && !bond->kill_timers)
                queue_delayed_work(bond->wq, &bond->arp_work, delta_in_ticks);
 out:
        read_unlock(&bond->lock);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
index 0b9bd551580..51bd7485ab1 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_dcb.c
@@ -2123,6 +2123,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                        break;
                case DCB_CAP_ATTR_DCBX:
                        *cap = BNX2X_DCBX_CAPS;
+                        break;
                default:
                        rval = -EINVAL;
                        break;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 28bde1610ff..6486ab8c8fc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -4937,7 +4937,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        int igu_seg_id;
        int port = BP_PORT(bp);
        int func = BP_FUNC(bp);
-        int reg_offset;
+        int reg_offset, reg_offset_en5;
        u64 section;
        int index;
        struct hc_sp_status_block_data sp_sb_data;
@@ -4960,6 +4960,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                             MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+        reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
+                                 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
        for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                int sindex;
                /* take care of sig[0]..sig[4] */
@@ -4974,7 +4976,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
                         * and not 16 between the different groups
                         */
                        bp->attn_group[index].sig[4] = REG_RD(bp,
-                                        reg_offset + 0x10 + 0x4*index);
+                                        reg_offset_en5 + 0x4*index);
                else
                        bp->attn_group[index].sig[4] = 0;
        }
@@ -7619,8 +7621,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                u8 *mac_addr = bp->dev->dev_addr;
                u32 val;
+                u16 pmc;
                /* The mac address is written to entries 1-4 to
-                   preserve entry 0 which is used by the PMF */
+                 * preserve entry 0 which is used by the PMF
+                 */
                u8 entry = (BP_VN(bp) + 1)*8;
                val = (mac_addr[0] << 8) | mac_addr[1];
@@ -7630,6 +7635,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                      (mac_addr[4] << 8) | mac_addr[5];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
+                /* Enable the PME and clear the status */
+                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
+                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
                reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
        } else
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 750e8445dac..fc7bd0f23c0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -1384,6 +1384,18 @@
   Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_ENABLE4_PXP_0                               0xa108
 #define MISC_REG_AEU_ENABLE4_PXP_1                               0xa1a8
+/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0                        0xa688
+/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0                        0xa6b0
 /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
   128 bit vector */
 #define MISC_REG_AEU_GENERAL_ATTN_0                              0xa000
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c
index 805076c54f1..da5a5d9b8af 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_offload.c
@@ -1146,12 +1146,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
                if (te && te->ctx && te->client && te->client->redirect) {
                        update_tcb = te->client->redirect(te->ctx, old, new, e);
                        if (update_tcb) {
+                                rcu_read_lock();
                                l2t_hold(L2DATA(tdev), e);
+                                rcu_read_unlock();
                                set_l2t_ix(tdev, tid, e);
                        }
                }
        }
-        l2t_release(L2DATA(tdev), e);
+        l2t_release(tdev, e);
 }
 /*
@@ -1264,7 +1266,7 @@ int cxgb3_offload_activate(struct adapter *adapter)
                goto out_free;
        err = -ENOMEM;
-        L2DATA(dev) = t3_init_l2t(l2t_capacity);
+        RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
        if (!L2DATA(dev))
                goto out_free;
@@ -1298,16 +1300,24 @@ int cxgb3_offload_activate(struct adapter *adapter)
 out_free_l2t:
        t3_free_l2t(L2DATA(dev));
-        L2DATA(dev) = NULL;
+        rcu_assign_pointer(dev->l2opt, NULL);
 out_free:
        kfree(t);
        return err;
 }
+static void clean_l2_data(struct rcu_head *head)
+{
+        struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
+        t3_free_l2t(d);
+}
 void cxgb3_offload_deactivate(struct adapter *adapter)
 {
        struct t3cdev *tdev = &adapter->tdev;
        struct t3c_data *t = T3C_DATA(tdev);
+        struct l2t_data *d;
        remove_adapter(adapter);
        if (list_empty(&adapter_list))
@@ -1315,8 +1325,11 @@ void cxgb3_offload_deactivate(struct adapter *adapter)
        free_tid_maps(&t->tid_maps);
        T3C_DATA(tdev) = NULL;
-        t3_free_l2t(L2DATA(tdev));
+        rcu_read_lock();
-        L2DATA(tdev) = NULL;
+        d = L2DATA(tdev);
+        rcu_read_unlock();
+        rcu_assign_pointer(tdev->l2opt, NULL);
+        call_rcu(&d->rcu_head, clean_l2_data);
        if (t->nofail_skb)
                kfree_skb(t->nofail_skb);
        kfree(t);
diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.c b/drivers/net/ethernet/chelsio/cxgb3/l2t.c
index f452c400325..41540978a17 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.c
@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2t_entry *e, struct neighbour *neigh)
 struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
                             struct net_device *dev)
 {
-        struct l2t_entry *e;
+        struct l2t_entry *e = NULL;
-        struct l2t_data *d = L2DATA(cdev);
+        struct l2t_data *d;
+        int hash;
        u32 addr = *(u32 *) neigh->primary_key;
        int ifidx = neigh->dev->ifindex;
-        int hash = arp_hash(addr, ifidx, d);
        struct port_info *p = netdev_priv(dev);
        int smt_idx = p->port_id;
+        rcu_read_lock();
+        d = L2DATA(cdev);
+        if (!d)
+                goto done_rcu;
+        hash = arp_hash(addr, ifidx, d);
        write_lock_bh(&d->lock);
        for (e = d->l2tab[hash].first; e; e = e->next)
                if (e->addr == addr && e->ifindex == ifidx &&
@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
        }
 done:
        write_unlock_bh(&d->lock);
+done_rcu:
+        rcu_read_unlock();
        return e;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb3/l2t.h b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
index 7a12d52ed4f..c5f54796e2c 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/l2t.h
+++ b/drivers/net/ethernet/chelsio/cxgb3/l2t.h
@@ -76,6 +76,7 @@ struct l2t_data {
        atomic_t nfree;         /* number of free entries */
        rwlock_t lock;
        struct l2t_entry l2tab[0];
+        struct rcu_head rcu_head;       /* to handle rcu cleanup */
 };
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
@@ -99,7 +100,7 @@ static inline void set_arp_failure_handler(struct sk_buff *skb,
 /*
 * Getting to the L2 data from an offload device.
 */
-#define L2DATA(dev) ((dev)->l2opt)
+#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
 #define W_TCB_L2T_IX    0
 #define S_TCB_L2T_IX    7
@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev *dev, struct sk_buff *skb,
        return t3_l2t_send_slow(dev, skb, e);
 }
-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
+static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
 {
-        if (atomic_dec_and_test(&e->refcnt))
+        struct l2t_data *d;
+        rcu_read_lock();
+        d = L2DATA(t);
+        if (atomic_dec_and_test(&e->refcnt) && d)
                t3_l2e_free(d, e);
+        rcu_read_unlock();
 }
 static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
 {
-        if (atomic_add_return(1, &e->refcnt) == 1)      /* 0 -> 1 transition */
+        if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
                atomic_dec(&d->nfree);
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 40b395f932c..4c8f42afa3c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -3715,6 +3715,9 @@ static int __devinit init_one(struct pci_dev *pdev,
                setup_debugfs(adapter);
        }
+        /* PCIe EEH recovery on powerpc platforms needs fundamental reset */
+        pdev->needs_freset = 1;
        if (is_offload(adapter))
                attach_ulds(adapter);
diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
index 72b84de4875..4da972eaabb 100644
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -636,8 +636,8 @@ static int ibmveth_open(struct net_device *netdev)
                netdev_err(netdev, "unable to request irq 0x%x, rc %d\n",
                           netdev->irq, rc);
                do {
-                        rc = h_free_logical_lan(adapter->vdev->unit_address);
+                        lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
-                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+                } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
                goto err_out;
        }
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
index 5dc61b4ef3c..b89f3a684ae 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
@@ -1198,6 +1198,8 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                        iowrite32((int_en & ~PCH_GBE_INT_RX_FIFO_ERR),
                                  &hw->reg->INT_EN);
                        pch_gbe_stop_receive(adapter);
+                        int_st |= ioread32(&hw->reg->INT_ST);
+                        int_st = int_st & ioread32(&hw->reg->INT_EN);
                }
        if (int_st & PCH_GBE_INT_RX_DMA_ERR)
                adapter->stats.intr_rx_dma_err_count++;
@@ -1217,14 +1219,11 @@ static irqreturn_t pch_gbe_intr(int irq, void *data)
                        /* Set Pause packet */
                        pch_gbe_mac_set_pause_packet(hw);
                }
-                if ((int_en & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))
-                    == 0) {
-                        return IRQ_HANDLED;
-                }
        }
        /* When request status is Receive interruption */
-        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT))) {
+        if ((int_st & (PCH_GBE_INT_RX_DMA_CMPLT | PCH_GBE_INT_TX_CMPLT)) ||
+            (adapter->rx_stop_flag == true)) {
                if (likely(napi_schedule_prep(&adapter->napi))) {
                        /* Enable only Rx Descriptor empty */
                        atomic_inc(&adapter->irq_sem);
@@ -1384,7 +1383,7 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        struct sk_buff *skb;
        unsigned int i;
        unsigned int cleaned_count = 0;
-        bool cleaned = false;
+        bool cleaned = true;
        pr_debug("next_to_clean : %d\n", tx_ring->next_to_clean);
@@ -1395,7 +1394,6 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
        while ((tx_desc->gbec_status & DSC_INIT16) == 0x0000) {
                pr_debug("gbec_status:0x%04x\n", tx_desc->gbec_status);
-                cleaned = true;
                buffer_info = &tx_ring->buffer_info[i];
                skb = buffer_info->skb;
@@ -1438,8 +1436,10 @@ pch_gbe_clean_tx(struct pch_gbe_adapter *adapter,
                tx_desc = PCH_GBE_TX_DESC(*tx_ring, i);
                /* weight of a sort for tx, to avoid endless transmit cleanup */
-                if (cleaned_count++ == PCH_GBE_TX_WEIGHT)
+                if (cleaned_count++ == PCH_GBE_TX_WEIGHT) {
+                        cleaned = false;
                        break;
+                }
        }
        pr_debug("called pch_gbe_unmap_and_free_tx_resource() %d count\n",
                 cleaned_count);
@@ -2167,7 +2167,6 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
 {
        struct pch_gbe_adapter *adapter =
            container_of(napi, struct pch_gbe_adapter, napi);
-        struct net_device *netdev = adapter->netdev;
        int work_done = 0;
        bool poll_end_flag = false;
        bool cleaned = false;
@@ -2175,33 +2174,32 @@ static int pch_gbe_napi_poll(struct napi_struct *napi, int budget)
        pr_debug("budget : %d\n", budget);
-        /* Keep link state information with original netdev */
+        pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
-        if (!netif_carrier_ok(netdev)) {
+        cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
+        if (!cleaned)
+                work_done = budget;
+        /* If no Tx and not enough Rx work done,
+         * exit the polling mode
+         */
+        if (work_done < budget)
                poll_end_flag = true;
-        } else {
-                pch_gbe_clean_rx(adapter, adapter->rx_ring, &work_done, budget);
+        if (poll_end_flag) {
+                napi_complete(napi);
+                if (adapter->rx_stop_flag) {
+                        adapter->rx_stop_flag = false;
+                        pch_gbe_start_receive(&adapter->hw);
+                }
+                pch_gbe_irq_enable(adapter);
+        } else
                if (adapter->rx_stop_flag) {
                        adapter->rx_stop_flag = false;
                        pch_gbe_start_receive(&adapter->hw);
                        int_en = ioread32(&adapter->hw.reg->INT_EN);
                        iowrite32((int_en | PCH_GBE_INT_RX_FIFO_ERR),
-                                        &adapter->hw.reg->INT_EN);
+                                &adapter->hw.reg->INT_EN);
                }
-                cleaned = pch_gbe_clean_tx(adapter, adapter->tx_ring);
-                if (cleaned)
-                        work_done = budget;
-                /* If no Tx and not enough Rx work done,
-                 * exit the polling mode
-                 */
-                if ((work_done < budget) || !netif_running(netdev))
-                        poll_end_flag = true;
-        }
-        if (poll_end_flag) {
-                napi_complete(napi);
-                pch_gbe_irq_enable(adapter);
-        }
        pr_debug("poll_end_flag : %d  work_done : %d  budget : %d\n",
                 poll_end_flag, work_done, budget);
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index b100c90e850..24cf942e131 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -239,7 +239,7 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
                dest = macvlan_hash_lookup(port, eth->h_dest);
                if (dest && dest->mode == MACVLAN_MODE_BRIDGE) {
                        /* send to lowerdev first for its network taps */
-                        vlan->forward(vlan->lowerdev, skb);
+                        dev_forward_skb(vlan->lowerdev, skb);
                        return NET_XMIT_SUCCESS;
                }
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index be381c24c4b..c588a162050 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -686,7 +686,7 @@ static void decode_rxts(struct dp83640_private *dp83640,
        prune_rx_ts(dp83640);
        if (list_empty(&dp83640->rxpool)) {
-                pr_warning("dp83640: rx timestamp pool is empty\n");
+                pr_debug("dp83640: rx timestamp pool is empty\n");
                goto out;
        }
        rxts = list_first_entry(&dp83640->rxpool, struct rxts, list);
@@ -709,7 +709,7 @@ static void decode_txts(struct dp83640_private *dp83640,
        skb = skb_dequeue(&dp83640->tx_queue);
        if (!skb) {
-                pr_warning("dp83640: have timestamp but tx_queue empty\n");
+                pr_debug("dp83640: have timestamp but tx_queue empty\n");
                return;
        }
        ns = phy2txts(phy_txts);
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 0ca86f9ec4e..182562952c7 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref,
        xenvif_get(vif);
        rtnl_lock();
-        if (netif_running(vif->dev))
-                xenvif_up(vif);
        if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
                dev_set_mtu(vif->dev, ETH_DATA_LEN);
        netdev_update_features(vif->dev);
        netif_carrier_on(vif->dev);
+        if (netif_running(vif->dev))
+                xenvif_up(vif);
        rtnl_unlock();
        return 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 4e84fd4a431..e9651f0a881 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -77,7 +77,7 @@ unsigned long pci_cardbus_mem_size = DEFAULT_CARDBUS_MEM_SIZE;
 unsigned long pci_hotplug_io_size  = DEFAULT_HOTPLUG_IO_SIZE;
 unsigned long pci_hotplug_mem_size = DEFAULT_HOTPLUG_MEM_SIZE;
-enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_SAFE;
+enum pcie_bus_config_types pcie_bus_config = PCIE_BUS_TUNE_OFF;
 /*
 * The default CLS is used if arch didn't set CLS explicitly and not
@@ -3568,10 +3568,14 @@ static int __init pci_setup(char *str)
                                pci_hotplug_io_size = memparse(str + 9, &str);
                        } else if (!strncmp(str, "hpmemsize=", 10)) {
                                pci_hotplug_mem_size = memparse(str + 10, &str);
+                        } else if (!strncmp(str, "pcie_bus_tune_off", 17)) {
+                                pcie_bus_config = PCIE_BUS_TUNE_OFF;
                        } else if (!strncmp(str, "pcie_bus_safe", 13)) {
                                pcie_bus_config = PCIE_BUS_SAFE;
                        } else if (!strncmp(str, "pcie_bus_perf", 13)) {
                                pcie_bus_config = PCIE_BUS_PERFORMANCE;
+                        } else if (!strncmp(str, "pcie_bus_peer2peer", 18)) {
+                                pcie_bus_config = PCIE_BUS_PEER2PEER;
                        } else {
                                printk(KERN_ERR "PCI: Unknown option `%s'\n",
                                                str);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index f3f94a5c068..6ab6bd3df4b 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1458,12 +1458,24 @@ static int pcie_bus_configure_set(struct pci_dev *dev, void *data)
 */
 void pcie_bus_configure_settings(struct pci_bus *bus, u8 mpss)
 {
-        u8 smpss = mpss;
+        u8 smpss;
        if (!pci_is_pcie(bus->self))
                return;
+        if (pcie_bus_config == PCIE_BUS_TUNE_OFF)
+                return;
+        /* FIXME - Peer to peer DMA is possible, though the endpoint would need
+         * to be aware to the MPS of the destination.  To work around this,
+         * simply force the MPS of the entire system to the smallest possible.
+         */
+        if (pcie_bus_config == PCIE_BUS_PEER2PEER)
+                smpss = 0;
        if (pcie_bus_config == PCIE_BUS_SAFE) {
+                smpss = mpss;
                pcie_find_smpss(bus->self, &smpss);
                pci_walk_bus(bus, pcie_find_smpss, &smpss);
        }
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index cbde448f994..eb3140ee821 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -654,8 +654,8 @@ static struct io_subchannel_private console_priv;
 static int console_subchannel_in_use;
 /*
- * Use tpi to get a pending interrupt, call the interrupt handler and
+ * Use cio_tpi to get a pending interrupt and call the interrupt handler.
- * return a pointer to the subchannel structure.
+ * Return non-zero if an interrupt was processed, zero otherwise.
 */
 static int cio_tpi(void)
 {
@@ -667,6 +667,10 @@ static int cio_tpi(void)
        tpi_info = (struct tpi_info *)&S390_lowcore.subchannel_id;
        if (tpi(NULL) != 1)
                return 0;
+        if (tpi_info->adapter_IO) {
+                do_adapter_IO(tpi_info->isc);
+                return 1;
+        }
        irb = (struct irb *)&S390_lowcore.irb;
        /* Store interrupt response block to lowcore. */
        if (tsch(tpi_info->schid, irb) != 0)
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index b7bd5b0cc7a..3868ab2397c 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1800,10 +1800,12 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
        switch (retval) {
        case SCSI_MLQUEUE_HOST_BUSY:
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                break;
        case 1:
                tw_dev->state[request_id] = TW_S_COMPLETED;
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                SCpnt->result = (DID_ERROR << 16);
                done(SCpnt);
                retval = 0;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8d9dae89f06..3878b739508 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -837,6 +837,7 @@ config SCSI_ISCI
        # (temporary): known alpha quality driver
        depends on EXPERIMENTAL
        select SCSI_SAS_LIBSAS
+        select SCSI_SAS_HOST_SMP
        ---help---
          This driver supports the 6Gb/s SAS capabilities of the storage
          control unit found in the Intel(R) C600 series chipset.
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 3c08f5352b2..6153a66a8a3 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -88,7 +88,7 @@ obj-$(CONFIG_SCSI_QLOGIC_FAS)	+= qlogicfas408.o	qlogicfas.o
 obj-$(CONFIG_PCMCIA_QLOGIC)     += qlogicfas408.o
 obj-$(CONFIG_SCSI_QLOGIC_1280)  += qla1280.o 
 obj-$(CONFIG_SCSI_QLA_FC)       += qla2xxx/
-obj-$(CONFIG_SCSI_QLA_ISCSI)    += qla4xxx/
+obj-$(CONFIG_SCSI_QLA_ISCSI)    += libiscsi.o qla4xxx/
 obj-$(CONFIG_SCSI_LPFC)         += lpfc/
 obj-$(CONFIG_SCSI_BFA_FC)       += bfa/
 obj-$(CONFIG_SCSI_PAS16)        += pas16.o
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index e7d0d47b918..e5f2d7d9002 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1283,6 +1283,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced)
        kfree(aac->queues);
        aac->queues = NULL;
        free_irq(aac->pdev->irq, aac);
+        if (aac->msi)
+                pci_disable_msi(aac->pdev);
        kfree(aac->fsa_dev);
        aac->fsa_dev = NULL;
        quirks = aac_get_driver_ident(index)->quirks;
diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
index bd22041e278..f5864485033 100644
--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
@@ -913,7 +913,7 @@ static void l2t_put(struct cxgbi_sock *csk)
        struct t3cdev *t3dev = (struct t3cdev *)csk->cdev->lldev;
        if (csk->l2t) {
-                l2t_release(L2DATA(t3dev), csk->l2t);
+                l2t_release(t3dev, csk->l2t);
                csk->l2t = NULL;
                cxgbi_sock_put(csk);
        }
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index f84084bba2f..16ad97df5ba 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1721,7 +1721,7 @@ static int sas_find_bcast_dev(struct domain_device *dev,
        list_for_each_entry(ch, &ex->children, siblings) {
                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
                        res = sas_find_bcast_dev(ch, src_dev);
-                        if (src_dev)
+                        if (*src_dev)
                                return res;
                }
        }
@@ -1769,10 +1769,12 @@ static void sas_unregister_devs_sas_addr(struct domain_device *parent,
                sas_disable_routing(parent, phy->attached_sas_addr);
        }
        memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-        sas_port_delete_phy(phy->port, phy->phy);
+        if (phy->port) {
-        if (phy->port->num_phys == 0)
+                sas_port_delete_phy(phy->port, phy->phy);
-                sas_port_delete(phy->port);
+                if (phy->port->num_phys == 0)
-        phy->port = NULL;
+                        sas_port_delete(phy->port);
+                phy->port = NULL;
+        }
 }
 static int sas_discover_bfs_by_root_level(struct domain_device *root,
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 646fc5263d5..8a7591f035e 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1507,8 +1507,8 @@ qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
                        if (k != blocks_done) {
                                qla_printk(KERN_WARNING, sp->fcport->vha->hw,
-                                    "unexpected tag values tag:lba=%x:%lx)\n",
+                                    "unexpected tag values tag:lba=%x:%llx)\n",
-                                    e_ref_tag, lba_s);
+                                    e_ref_tag, (unsigned long long)lba_s);
                                return 1;
                        }
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4cace3f20c0..1e69527f1e4 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1328,10 +1328,9 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                        qla2x00_sp_compl(ha, sp);
                                } else {
                                        ctx = sp->ctx;
-                                        if (ctx->type == SRB_LOGIN_CMD ||
+                                        if (ctx->type == SRB_ELS_CMD_RPT ||
-                                            ctx->type == SRB_LOGOUT_CMD) {
+                                            ctx->type == SRB_ELS_CMD_HST ||
-                                                ctx->u.iocb_cmd->free(sp);
+                                            ctx->type == SRB_CT_CMD) {
-                                        } else {
                                                struct fc_bsg_job *bsg_job =
                                                    ctx->u.bsg_job;
                                                if (bsg_job->request->msgcode
@@ -1343,6 +1342,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res)
                                                kfree(sp->ctx);
                                                mempool_free(sp,
                                                        ha->srb_mempool);
+                                        } else {
+                                                ctx->u.iocb_cmd->free(sp);
                                        }
                                }
                        }
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index d2407558773..24cacff5778 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -825,6 +825,9 @@ static void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
 {
        struct device *dev = mspi->dev;
+        if (!(mspi->flags & SPI_CPM_MODE))
+                return;
        dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
        cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 8ac6542aedc..fa594d604ac 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -786,9 +786,11 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
                int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
                if (cs_gpio < 0)
                        cs_gpio = mxc_platform_info->chipselect[i];
+                spi_imx->chipselect[i] = cs_gpio;
                if (cs_gpio < 0)
                        continue;
-                spi_imx->chipselect[i] = cs_gpio;
                ret = gpio_request(spi_imx->chipselect[i], DRIVER_NAME);
                if (ret) {
                        while (i > 0) {
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index 1d23f383186..6a80749391d 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -50,6 +50,8 @@
 #define PCH_RX_THOLD            7
 #define PCH_RX_THOLD_MAX        15
+#define PCH_TX_THOLD            2
 #define PCH_MAX_BAUDRATE        5000000
 #define PCH_MAX_FIFO_DEPTH      16
@@ -58,6 +60,7 @@
 #define PCH_SLEEP_TIME          10
 #define SSN_LOW                 0x02U
+#define SSN_HIGH                0x03U
 #define SSN_NO_CONTROL          0x00U
 #define PCH_MAX_CS              0xFF
 #define PCI_DEVICE_ID_GE_SPI    0x8816
@@ -316,16 +319,19 @@ static void pch_spi_handler_sub(struct pch_spi_data *data, u32 reg_spsr_val,
        /* if transfer complete interrupt */
        if (reg_spsr_val & SPSR_FI_BIT) {
-                if (tx_index < bpw_len)
+                if ((tx_index == bpw_len) && (rx_index == tx_index)) {
+                        /* disable interrupts */
+                        pch_spi_setclr_reg(data->master, PCH_SPCR, 0, PCH_ALL);
+                        /* transfer is completed;
+                           inform pch_spi_process_messages */
+                        data->transfer_complete = true;
+                        data->transfer_active = false;
+                        wake_up(&data->wait);
+                } else {
                        dev_err(&data->master->dev,
                                "%s : Transfer is not completed", __func__);
-                /* disable interrupts */
+                }
-                pch_spi_setclr_reg(data->master, PCH_SPCR, 0, PCH_ALL);
-                /* transfer is completed;inform pch_spi_process_messages */
-                data->transfer_complete = true;
-                data->transfer_active = false;
-                wake_up(&data->wait);
        }
 }
@@ -348,16 +354,26 @@ static irqreturn_t pch_spi_handler(int irq, void *dev_id)
                        "%s returning due to suspend\n", __func__);
                return IRQ_NONE;
        }
-        if (data->use_dma)
-                return IRQ_NONE;
        io_remap_addr = data->io_remap_addr;
        spsr = io_remap_addr + PCH_SPSR;
        reg_spsr_val = ioread32(spsr);
-        if (reg_spsr_val & SPSR_ORF_BIT)
+        if (reg_spsr_val & SPSR_ORF_BIT) {
-                dev_err(&board_dat->pdev->dev, "%s Over run error", __func__);
+                dev_err(&board_dat->pdev->dev, "%s Over run error\n", __func__);
+                if (data->current_msg->complete != 0) {
+                        data->transfer_complete = true;
+                        data->current_msg->status = -EIO;
+                        data->current_msg->complete(data->current_msg->context);
+                        data->bcurrent_msg_processing = false;
+                        data->current_msg = NULL;
+                        data->cur_trans = NULL;
+                }
+        }
+        if (data->use_dma)
+                return IRQ_NONE;
        /* Check if the interrupt is for SPI device */
        if (reg_spsr_val & (SPSR_FI_BIT | SPSR_RFI_BIT)) {
@@ -756,10 +772,6 @@ static void pch_spi_set_ir(struct pch_spi_data *data)
        wait_event_interruptible(data->wait, data->transfer_complete);
-        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
-        dev_dbg(&data->master->dev,
-                "%s:no more control over SSN-writing 0 to SSNXCR.", __func__);
        /* clear all interrupts */
        pch_spi_writereg(data->master, PCH_SPSR,
                         pch_spi_readreg(data->master, PCH_SPSR));
@@ -815,10 +827,11 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw)
        }
 }
-static void pch_spi_start_transfer(struct pch_spi_data *data)
+static int pch_spi_start_transfer(struct pch_spi_data *data)
 {
        struct pch_spi_dma_ctrl *dma;
        unsigned long flags;
+        int rtn;
        dma = &data->dma;
@@ -833,19 +846,23 @@ static void pch_spi_start_transfer(struct pch_spi_data *data)
                                 initiating the transfer. */
        dev_dbg(&data->master->dev,
                "%s:waiting for transfer to get over\n", __func__);
-        wait_event_interruptible(data->wait, data->transfer_complete);
+        rtn = wait_event_interruptible_timeout(data->wait,
+                                               data->transfer_complete,
+                                               msecs_to_jiffies(2 * HZ));
        dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent,
                            DMA_FROM_DEVICE);
+        dma_sync_sg_for_cpu(&data->master->dev, dma->sg_tx_p, dma->nent,
+                            DMA_FROM_DEVICE);
+        memset(data->dma.tx_buf_virt, 0, PAGE_SIZE);
        async_tx_ack(dma->desc_rx);
        async_tx_ack(dma->desc_tx);
        kfree(dma->sg_tx_p);
        kfree(dma->sg_rx_p);
        spin_lock_irqsave(&data->lock, flags);
-        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
-        dev_dbg(&data->master->dev,
-                "%s:no more control over SSN-writing 0 to SSNXCR.", __func__);
        /* clear fifo threshold, disable interrupts, disable SPI transfer */
        pch_spi_setclr_reg(data->master, PCH_SPCR, 0,
@@ -858,6 +875,8 @@ static void pch_spi_start_transfer(struct pch_spi_data *data)
        pch_spi_clear_fifo(data->master);
        spin_unlock_irqrestore(&data->lock, flags);
+        return rtn;
 }
 static void pch_dma_rx_complete(void *arg)
@@ -1023,8 +1042,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        /* set receive fifo threshold and transmit fifo threshold */
        pch_spi_setclr_reg(data->master, PCH_SPCR,
                           ((size - 1) << SPCR_RFIC_FIELD) |
-                           ((PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE) <<
+                           (PCH_TX_THOLD << SPCR_TFIC_FIELD),
-                            SPCR_TFIC_FIELD),
                           MASK_RFIC_SPCR_BITS | MASK_TFIC_SPCR_BITS);
        spin_unlock_irqrestore(&data->lock, flags);
@@ -1035,13 +1053,20 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        /* offset, length setting */
        sg = dma->sg_rx_p;
        for (i = 0; i < num; i++, sg++) {
-                if (i == 0) {
+                if (i == (num - 2)) {
-                        sg->offset = 0;
+                        sg->offset = size * i;
+                        sg->offset = sg->offset * (*bpw / 8);
                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), rem,
                                    sg->offset);
                        sg_dma_len(sg) = rem;
+                } else if (i == (num - 1)) {
+                        sg->offset = size * (i - 1) + rem;
+                        sg->offset = sg->offset * (*bpw / 8);
+                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), size,
+                                    sg->offset);
+                        sg_dma_len(sg) = size;
                } else {
-                        sg->offset = rem + size * (i - 1);
+                        sg->offset = size * i;
                        sg->offset = sg->offset * (*bpw / 8);
                        sg_set_page(sg, virt_to_page(dma->rx_buf_virt), size,
                                    sg->offset);
@@ -1065,6 +1090,16 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
        dma->desc_rx = desc_rx;
        /* TX */
+        if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
+                num = data->bpw_len / PCH_DMA_TRANS_SIZE;
+                size = PCH_DMA_TRANS_SIZE;
+                rem = 16;
+        } else {
+                num = 1;
+                size = data->bpw_len;
+                rem = data->bpw_len;
+        }
        dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
        sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */
        /* offset, length setting */
@@ -1162,6 +1197,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
        if (data->use_dma)
                pch_spi_request_dma(data,
                                    data->current_msg->spi->bits_per_word);
+        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
        do {
                /* If we are already processing a message get the next
                transfer structure from the message otherwise retrieve
@@ -1184,7 +1220,8 @@ static void pch_spi_process_messages(struct work_struct *pwork)
                if (data->use_dma) {
                        pch_spi_handle_dma(data, &bpw);
-                        pch_spi_start_transfer(data);
+                        if (!pch_spi_start_transfer(data))
+                                goto out;
                        pch_spi_copy_rx_data_for_dma(data, bpw);
                } else {
                        pch_spi_set_tx(data, &bpw);
@@ -1222,6 +1259,8 @@ static void pch_spi_process_messages(struct work_struct *pwork)
        } while (data->cur_trans != NULL);
+out:
+        pch_spi_writereg(data->master, PCH_SSNXCR, SSN_HIGH);
        if (data->use_dma)
                pch_spi_release_dma(data);
 }
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index e0c2807b097..181fa8158a8 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -148,10 +148,10 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, bus);
-        /* Register all devices */
        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+        /* First identify all devices ... */
        for (i = 0; i < zorro_num_autocon; i++) {
                z = &zorro_autocon[i];
                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
@@ -172,6 +172,11 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
                dev_set_name(&z->dev, "%02x", i);
                z->dev.parent = &bus->dev;
                z->dev.bus = &zorro_bus_type;
+        }
+        /* ... then register them */
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
                error = device_register(&z->dev);
                if (error) {
                        dev_err(&bus->dev, "Error registering device %s\n",
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index a381cd22f51..e4e57d59edb 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1036,11 +1036,13 @@ out:
 * on error we return an unlocked page and the error value
 * on success we return a locked page and 0
 */
-static int prepare_uptodate_page(struct page *page, u64 pos)
+static int prepare_uptodate_page(struct page *page, u64 pos,
+                                 bool force_uptodate)
 {
        int ret = 0;
-        if ((pos & (PAGE_CACHE_SIZE - 1)) && !PageUptodate(page)) {
+        if (((pos & (PAGE_CACHE_SIZE - 1)) || force_uptodate) &&
+            !PageUptodate(page)) {
                ret = btrfs_readpage(NULL, page);
                if (ret)
                        return ret;
@@ -1061,7 +1063,7 @@ static int prepare_uptodate_page(struct page *page, u64 pos)
 static noinline int prepare_pages(struct btrfs_root *root, struct file *file,
                         struct page **pages, size_t num_pages,
                         loff_t pos, unsigned long first_index,
-                         size_t write_bytes)
+                         size_t write_bytes, bool force_uptodate)
 {
        struct extent_state *cached_state = NULL;
        int i;
@@ -1086,10 +1088,11 @@ again:
                }
                if (i == 0)
-                        err = prepare_uptodate_page(pages[i], pos);
+                        err = prepare_uptodate_page(pages[i], pos,
+                                                    force_uptodate);
                if (i == num_pages - 1)
                        err = prepare_uptodate_page(pages[i],
-                                                    pos + write_bytes);
+                                                    pos + write_bytes, false);
                if (err) {
                        page_cache_release(pages[i]);
                        faili = i - 1;
@@ -1158,6 +1161,7 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
        size_t num_written = 0;
        int nrptrs;
        int ret = 0;
+        bool force_page_uptodate = false;
        nrptrs = min((iov_iter_count(i) + PAGE_CACHE_SIZE - 1) /
                     PAGE_CACHE_SIZE, PAGE_CACHE_SIZE /
@@ -1200,7 +1204,8 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                 * contents of pages from loop to loop
                 */
                ret = prepare_pages(root, file, pages, num_pages,
-                                    pos, first_index, write_bytes);
+                                    pos, first_index, write_bytes,
+                                    force_page_uptodate);
                if (ret) {
                        btrfs_delalloc_release_space(inode,
                                        num_pages << PAGE_CACHE_SHIFT);
@@ -1217,12 +1222,15 @@ static noinline ssize_t __btrfs_buffered_write(struct file *file,
                if (copied < write_bytes)
                        nrptrs = 1;
-                if (copied == 0)
+                if (copied == 0) {
+                        force_page_uptodate = true;
                        dirty_pages = 0;
-                else
+                } else {
+                        force_page_uptodate = false;
                        dirty_pages = (copied + offset +
                                       PAGE_CACHE_SIZE - 1) >>
                                       PAGE_CACHE_SHIFT;
+                }
                /*
                 * If we had a short copy we need to release the excess delaloc
diff --git a/fs/namei.c b/fs/namei.c
index f4788365ea2..0b3138de2a3 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -721,12 +721,6 @@ static int follow_automount(struct path *path, unsigned flags,
        if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
                return -EREMOTE;
-        /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
-         * and this is the terminal part of the path.
-         */
-        if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
-                return -EISDIR; /* we actually want to stop here */
        /* We don't want to mount if someone's just doing a stat -
         * unless they're stat'ing a directory and appended a '/' to
         * the name.
@@ -739,7 +733,7 @@ static int follow_automount(struct path *path, unsigned flags,
         * of the daemon to instantiate them before they can be used.
         */
        if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                     LOOKUP_OPEN | LOOKUP_CREATE)) &&
+                     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
            path->dentry->d_inode)
                return -EISDIR;
diff --git a/fs/namespace.c b/fs/namespace.c
index 22bfe8273c6..b4febb29d3b 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1757,7 +1757,7 @@ static int do_loopback(struct path *path, char *old_name,
                return err;
        if (!old_name || !*old_name)
                return -EINVAL;
-        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
+        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
        if (err)
                return err;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 9b7dd7013b1..5b19b6aabe1 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2798,7 +2798,7 @@ static struct dentry *nfs_follow_remote_path(struct vfsmount *root_mnt,
                goto out_put_mnt_ns;
        ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, &path);
+                        export_path, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
        nfs_referral_loop_unprotect();
        put_mnt_ns(ns_private);
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b34bdb25490..10b6be3ca28 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
         * resolution (think about autofs) and thus deadlocks could arise.
         */
        if (cmds == Q_QUOTAON) {
-                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
                if (ret)
                        pathp = ERR_PTR(ret);
                else
diff --git a/fs/stat.c b/fs/stat.c
index ba5316ffac6..78a3aa83c7e 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -81,8 +81,6 @@ int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat,
        if (!(flag & AT_SYMLINK_NOFOLLOW))
                lookup_flags |= LOOKUP_FOLLOW;
-        if (flag & AT_NO_AUTOMOUNT)
-                lookup_flags |= LOOKUP_NO_AUTOMOUNT;
        if (flag & AT_EMPTY_PATH)
                lookup_flags |= LOOKUP_EMPTY;
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index 3fa1f3d90ce..99e3e50b5c5 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -197,6 +197,11 @@ struct dm_target {
         * whether or not its underlying devices have support.
         */
        unsigned discards_supported:1;
+        /*
+         * Set if this target does not return zeroes on discarded blocks.
+         */
+        unsigned discard_zeroes_data_unsupported:1;
 };
 /* Each target can link one of these into the table */
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index e807ad687a0..3ad553e8eae 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -80,6 +80,7 @@ extern void irq_domain_del(struct irq_domain *domain);
 #endif /* CONFIG_IRQ_DOMAIN */
 #if defined(CONFIG_IRQ_DOMAIN) && defined(CONFIG_OF_IRQ)
+extern struct irq_domain_ops irq_domain_simple_ops;
 extern void irq_domain_add_simple(struct device_node *controller, int irq_base);
 extern void irq_domain_generate_simple(const struct of_device_id *match,
                                        u64 phys_base, unsigned int irq_start);
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 2c366b52f50..aace6b8691a 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -553,6 +553,7 @@ struct kvm_ppc_pvinfo {
 #define KVM_CAP_SPAPR_TCE 63
 #define KVM_CAP_PPC_SMT 64
 #define KVM_CAP_PPC_RMA 65
+#define KVM_CAP_S390_GMAP 71
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/include/linux/namei.h b/include/linux/namei.h
index 76fe2c62ae7..409328d1cbb 100644
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -48,11 +48,12 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
 */
 #define LOOKUP_FOLLOW           0x0001
 #define LOOKUP_DIRECTORY        0x0002
+#define LOOKUP_AUTOMOUNT        0x0004
 #define LOOKUP_PARENT           0x0010
 #define LOOKUP_REVAL            0x0020
 #define LOOKUP_RCU              0x0040
-#define LOOKUP_NO_AUTOMOUNT     0x0080
 /*
 * Intent data
 */
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 581d2e2e5b0..f1b1ca1a09e 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -623,8 +623,9 @@ struct pci_driver {
 extern void pcie_bus_configure_settings(struct pci_bus *bus, u8 smpss);
 enum pcie_bus_config_types {
-        PCIE_BUS_PERFORMANCE,
+        PCIE_BUS_TUNE_OFF,
        PCIE_BUS_SAFE,
+        PCIE_BUS_PERFORMANCE,
        PCIE_BUS_PEER2PEER,
 };
diff --git a/include/linux/ptp_classify.h b/include/linux/ptp_classify.h
index e07e2742a86..1dc420ba213 100644
--- a/include/linux/ptp_classify.h
+++ b/include/linux/ptp_classify.h
@@ -51,6 +51,7 @@
 #define PTP_CLASS_V2_VLAN (PTP_CLASS_V2 | PTP_CLASS_VLAN)
 #define PTP_EV_PORT 319
+#define PTP_GEN_BIT 0x08 /* indicates general message, if set in message type */
 #define OFF_ETYPE       12
 #define OFF_IHL         14
@@ -116,14 +117,20 @@ static inline int ptp_filter_init(struct sock_filter *f, int len)
        {OP_OR,         0,   0, PTP_CLASS_IPV6          }, /*              */ \
        {OP_RETA,       0,   0, 0                       }, /*              */ \
 /*L3x*/ {OP_RETK,       0,   0, PTP_CLASS_NONE          }, /*              */ \
-/*L40*/ {OP_JEQ,        0,   6, ETH_P_8021Q             }, /* f goto L50   */ \
+/*L40*/ {OP_JEQ,        0,   9, ETH_P_8021Q             }, /* f goto L50   */ \
        {OP_LDH,        0,   0, OFF_ETYPE + 4           }, /*              */ \
-        {OP_JEQ,        0,   9, ETH_P_1588              }, /* f goto L60   */ \
+        {OP_JEQ,        0,  15, ETH_P_1588              }, /* f goto L60   */ \
+        {OP_LDB,        0,   0, ETH_HLEN + VLAN_HLEN    }, /*              */ \
+        {OP_AND,        0,   0, PTP_GEN_BIT             }, /*              */ \
+        {OP_JEQ,        0,  12, 0                       }, /* f goto L6x   */ \
        {OP_LDH,        0,   0, ETH_HLEN + VLAN_HLEN    }, /*              */ \
        {OP_AND,        0,   0, PTP_CLASS_VMASK         }, /*              */ \
        {OP_OR,         0,   0, PTP_CLASS_VLAN          }, /*              */ \
        {OP_RETA,       0,   0, 0                       }, /*              */ \
-/*L50*/ {OP_JEQ,        0,   4, ETH_P_1588              }, /* f goto L61   */ \
+/*L50*/ {OP_JEQ,        0,   7, ETH_P_1588              }, /* f goto L61   */ \
+        {OP_LDB,        0,   0, ETH_HLEN                }, /*              */ \
+        {OP_AND,        0,   0, PTP_GEN_BIT             }, /*              */ \
+        {OP_JEQ,        0,   4, 0                       }, /* f goto L6x   */ \
        {OP_LDH,        0,   0, ETH_HLEN                }, /*              */ \
        {OP_AND,        0,   0, PTP_CLASS_VMASK         }, /*              */ \
        {OP_OR,         0,   0, PTP_CLASS_L2            }, /*              */ \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ac2c0578e0..41d0237fd44 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1956,7 +1956,6 @@ static inline void disable_sched_clock_irqtime(void) {}
 extern unsigned long long
 task_sched_runtime(struct task_struct *task);
-extern unsigned long long thread_group_sched_runtime(struct task_struct *task);
 /* sched_exec is called by processes performing an exec */
 #ifdef CONFIG_SMP
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 6bca4cc0063..5f172703eb4 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -298,7 +298,7 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                __array(char, name, 32)
                __field(unsigned long, ino)
                __field(unsigned long, state)
-                __field(unsigned long, age)
+                __field(unsigned long, dirtied_when)
                __field(unsigned long, writeback_index)
                __field(long, nr_to_write)
                __field(unsigned long, wrote)
@@ -309,19 +309,19 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                        dev_name(inode->i_mapping->backing_dev_info->dev), 32);
                __entry->ino            = inode->i_ino;
                __entry->state          = inode->i_state;
-                __entry->age            = (jiffies - inode->dirtied_when) *
+                __entry->dirtied_when   = inode->dirtied_when;
-                                                                1000 / HZ;
                __entry->writeback_index = inode->i_mapping->writeback_index;
                __entry->nr_to_write    = nr_to_write;
                __entry->wrote          = nr_to_write - wbc->nr_to_write;
        ),
-        TP_printk("bdi %s: ino=%lu state=%s age=%lu "
+        TP_printk("bdi %s: ino=%lu state=%s dirtied_when=%lu age=%lu "
                  "index=%lu to_write=%ld wrote=%lu",
                  __entry->name,
                  __entry->ino,
                  show_inode_state(__entry->state),
-                  __entry->age,
+                  __entry->dirtied_when,
+                  (jiffies - __entry->dirtied_when) / HZ,
                  __entry->writeback_index,
                  __entry->nr_to_write,
                  __entry->wrote
diff --git a/init/main.c b/init/main.c
index 2a9b88aa5e7..03b408dff82 100644
--- a/init/main.c
+++ b/init/main.c
@@ -381,9 +381,6 @@ static noinline void __init_refok rest_init(void)
        preempt_enable_no_resched();
        schedule();
-        /* At this point, we can enable user mode helper functionality */
-        usermodehelper_enable();
        /* Call into cpu_idle with preempt disabled */
        preempt_disable();
        cpu_idle();
@@ -733,6 +730,7 @@ static void __init do_basic_setup(void)
        driver_init();
        init_irq_proc();
        do_ctors();
+        usermodehelper_enable();
        do_initcalls();
 }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index d5828da3fd3..b57a3776de4 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -29,7 +29,11 @@ void irq_domain_add(struct irq_domain *domain)
         */
        for (hwirq = 0; hwirq < domain->nr_irq; hwirq++) {
                d = irq_get_irq_data(irq_domain_to_irq(domain, hwirq));
-                if (d || d->domain) {
+                if (!d) {
+                        WARN(1, "error: assigning domain to non existant irq_desc");
+                        return;
+                }
+                if (d->domain) {
                        /* things are broken; just report, don't clean up */
                        WARN(1, "error: irq_desc already assigned to a domain");
                        return;
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 58f405b581e..c8008dd58ef 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -250,7 +250,7 @@ void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
        do {
                times->utime = cputime_add(times->utime, t->utime);
                times->stime = cputime_add(times->stime, t->stime);
-                times->sum_exec_runtime += t->se.sum_exec_runtime;
+                times->sum_exec_runtime += task_sched_runtime(t);
        } while_each_thread(tsk, t);
 out:
        rcu_read_unlock();
@@ -312,7 +312,8 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
                cpu->cpu = cputime.utime;
                break;
        case CPUCLOCK_SCHED:
-                cpu->sched = thread_group_sched_runtime(p);
+                thread_group_cputime(p, &cputime);
+                cpu->sched = cputime.sum_exec_runtime;
                break;
        }
        return 0;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 9de3ecfd20f..a70d2a5d8c7 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -744,20 +744,17 @@ int ptrace_request(struct task_struct *child, long request,
                        break;
                si = child->last_siginfo;
-                if (unlikely(!si || si->si_code >> 8 != PTRACE_EVENT_STOP))
+                if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
-                        break;
+                        child->jobctl |= JOBCTL_LISTENING;
+                        /*
-                child->jobctl |= JOBCTL_LISTENING;
+                         * If NOTIFY is set, it means event happened between
+                         * start of this trap and now.  Trigger re-trap.
-                /*
+                         */
-                 * If NOTIFY is set, it means event happened between start
+                        if (child->jobctl & JOBCTL_TRAP_NOTIFY)
-                 * of this trap and now.  Trigger re-trap immediately.
+                                signal_wake_up(child, true);
-                 */
+                        ret = 0;
-                if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+                }
-                        signal_wake_up(child, true);
                unlock_task_sighand(child, &flags);
-                ret = 0;
                break;
        case PTRACE_DETACH:      /* detach a process that was attached. */
diff --git a/kernel/resource.c b/kernel/resource.c
index 3b3cedc5259..c8dc249da5c 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -419,6 +419,9 @@ static int __find_resource(struct resource *root, struct resource *old,
                else
                        tmp.end = root->end;
+                if (tmp.end < tmp.start)
+                        goto next;
                resource_clip(&tmp, constraint->min, constraint->max);
                arch_remove_reservations(&tmp);
@@ -436,8 +439,10 @@ static int __find_resource(struct resource *root, struct resource *old,
                                return 0;
                        }
                }
-                if (!this)
+next:           if (!this || this->end == root->end)
                        break;
                if (this != old)
                        tmp.start = this->end + 1;
                this = this->sibling;
diff --git a/kernel/sched.c b/kernel/sched.c
index ec5f472bc5b..b50b0f0c9aa 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3725,30 +3725,6 @@ unsigned long long task_sched_runtime(struct task_struct *p)
 }
 /*
- * Return sum_exec_runtime for the thread group.
- * In case the task is currently running, return the sum plus current's
- * pending runtime that have not been accounted yet.
- *
- * Note that the thread group might have other running tasks as well,
- * so the return value not includes other pending runtime that other
- * running tasks might have.
- */
-unsigned long long thread_group_sched_runtime(struct task_struct *p)
-{
-        struct task_cputime totals;
-        unsigned long flags;
-        struct rq *rq;
-        u64 ns;
-        rq = task_rq_lock(p, &flags);
-        thread_group_cputime(p, &totals);
-        ns = totals.sum_exec_runtime + do_task_delta_exec(p, rq);
-        task_rq_unlock(rq, p, &flags);
-        return ns;
-}
-/*
 * Account user cpu time to a process.
 * @p: the process that the cpu time gets accounted to
 * @cputime: the cpu time spent in user space since the last update
@@ -4372,7 +4348,7 @@ static inline void sched_submit_work(struct task_struct *tsk)
                blk_schedule_flush_plug(tsk);
 }
-asmlinkage void schedule(void)
+asmlinkage void __sched schedule(void)
 {
        struct task_struct *tsk = current;
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 97540f0c9e4..af1177858be 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -1050,7 +1050,7 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
         */
        if (curr && unlikely(rt_task(curr)) &&
            (curr->rt.nr_cpus_allowed < 2 ||
-             curr->prio < p->prio) &&
+             curr->prio <= p->prio) &&
            (p->rt.nr_cpus_allowed > 1)) {
                int target = find_lowest_rq(p);
@@ -1581,7 +1581,7 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
            p->rt.nr_cpus_allowed > 1 &&
            rt_task(rq->curr) &&
            (rq->curr->rt.nr_cpus_allowed < 2 ||
-             rq->curr->prio < p->prio))
+             rq->curr->prio <= p->prio))
                push_rt_tasks(rq);
 }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index aceeabc2ca8..f9cc9572898 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -566,7 +566,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        struct orig_node *orig_node = NULL;
        int data_len = skb->len, ret;
        short vid = -1;
-        bool do_bcast = false;
+        bool do_bcast;
        if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
                goto dropped;
@@ -600,15 +600,15 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        orig_node = transtable_search(bat_priv, ethhdr->h_source,
                                      ethhdr->h_dest);
-        if (is_multicast_ether_addr(ethhdr->h_dest) ||
+        do_bcast = is_multicast_ether_addr(ethhdr->h_dest);
-                                (orig_node && orig_node->gw_flags)) {
+        if (do_bcast || (orig_node && orig_node->gw_flags)) {
                ret = gw_is_target(bat_priv, skb, orig_node);
                if (ret < 0)
                        goto dropped;
-                if (ret == 0)
+                if (ret)
-                        do_bcast = true;
+                        do_bcast = false;
        }
        /* ethernet packet should be broadcasted */
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 28325d15773..feb77ea7b58 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -91,7 +91,6 @@ static int br_dev_open(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        netif_carrier_off(dev);
        netdev_update_features(dev);
        netif_start_queue(dev);
        br_stp_enable_bridge(br);
@@ -108,8 +107,6 @@ static int br_dev_stop(struct net_device *dev)
 {
        struct net_bridge *br = netdev_priv(dev);
-        netif_carrier_off(dev);
        br_stp_disable_bridge(br);
        br_multicast_stop(br);
diff --git a/net/can/bcm.c b/net/can/bcm.c
index d6c8ae5b2e6..c84963d2dee 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -344,6 +344,18 @@ static void bcm_send_to_user(struct bcm_op *op, struct bcm_msg_head *head,
        }
 }
+static void bcm_tx_start_timer(struct bcm_op *op)
+{
+        if (op->kt_ival1.tv64 && op->count)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival1),
+                              HRTIMER_MODE_ABS);
+        else if (op->kt_ival2.tv64)
+                hrtimer_start(&op->timer,
+                              ktime_add(ktime_get(), op->kt_ival2),
+                              HRTIMER_MODE_ABS);
+}
 static void bcm_tx_timeout_tsklet(unsigned long data)
 {
        struct bcm_op *op = (struct bcm_op *)data;
@@ -365,26 +377,12 @@ static void bcm_tx_timeout_tsklet(unsigned long data)
                        bcm_send_to_user(op, &msg_head, NULL, 0);
                }
-        }
-        if (op->kt_ival1.tv64 && (op->count > 0)) {
-                /* send (next) frame */
                bcm_can_tx(op);
-                hrtimer_start(&op->timer,
-                              ktime_add(ktime_get(), op->kt_ival1),
-                              HRTIMER_MODE_ABS);
-        } else {
+        } else if (op->kt_ival2.tv64)
-                if (op->kt_ival2.tv64) {
+                bcm_can_tx(op);
-                        /* send (next) frame */
+        bcm_tx_start_timer(op);
-                        bcm_can_tx(op);
-                        hrtimer_start(&op->timer,
-                                      ktime_add(ktime_get(), op->kt_ival2),
-                                      HRTIMER_MODE_ABS);
-                }
-        }
 }
 /*
@@ -964,23 +962,20 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                        hrtimer_cancel(&op->timer);
        }
-        if ((op->flags & STARTTIMER) &&
+        if (op->flags & STARTTIMER) {
-            ((op->kt_ival1.tv64 && op->count) || op->kt_ival2.tv64)) {
+                hrtimer_cancel(&op->timer);
                /* spec: send can_frame when starting timer */
                op->flags |= TX_ANNOUNCE;
-                if (op->kt_ival1.tv64 && (op->count > 0)) {
-                        /* op->count-- is done in bcm_tx_timeout_handler */
-                        hrtimer_start(&op->timer, op->kt_ival1,
-                                      HRTIMER_MODE_REL);
-                } else
-                        hrtimer_start(&op->timer, op->kt_ival2,
-                                      HRTIMER_MODE_REL);
        }
-        if (op->flags & TX_ANNOUNCE)
+        if (op->flags & TX_ANNOUNCE) {
                bcm_can_tx(op);
+                if (op->count)
+                        op->count--;
+        }
+        if (op->flags & STARTTIMER)
+                bcm_tx_start_timer(op);
        return msg_head->nframes * CFSIZ + MHSIZ;
 }
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 132963abc26..2883ea01e68 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -232,6 +232,7 @@ void ceph_destroy_options(struct ceph_options *opt)
                ceph_crypto_key_destroy(opt->key);
                kfree(opt->key);
        }
+        kfree(opt->mon_addr);
        kfree(opt);
 }
 EXPORT_SYMBOL(ceph_destroy_options);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index c340e2e0765..9918e9eb276 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2307,6 +2307,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
        m->front_max = front_len;
        m->front_is_vmalloc = false;
        m->more_to_follow = false;
+        m->ack_stamp = 0;
        m->pool = NULL;
        /* middle */
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 16836a7df7a..88ad8a2501b 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -217,6 +217,7 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
        INIT_LIST_HEAD(&req->r_unsafe_item);
        INIT_LIST_HEAD(&req->r_linger_item);
        INIT_LIST_HEAD(&req->r_linger_osd);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
        req->r_flags = flags;
        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
@@ -816,13 +817,10 @@ static void __register_request(struct ceph_osd_client *osdc,
 {
        req->r_tid = ++osdc->last_tid;
        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
-        INIT_LIST_HEAD(&req->r_req_lru_item);
        dout("__register_request %p tid %lld\n", req, req->r_tid);
        __insert_request(osdc, req);
        ceph_osdc_get_request(req);
        osdc->num_requests++;
        if (osdc->num_requests == 1) {
                dout(" first request, scheduling timeout\n");
                __schedule_osd_timeout(osdc);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e97c3588c3e..fd863fe7693 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -339,6 +339,7 @@ static int __insert_pg_mapping(struct ceph_pg_mapping *new,
        struct ceph_pg_mapping *pg = NULL;
        int c;
+        dout("__insert_pg_mapping %llx %p\n", *(u64 *)&new->pgid, new);
        while (*p) {
                parent = *p;
                pg = rb_entry(parent, struct ceph_pg_mapping, node);
@@ -366,16 +367,33 @@ static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
        while (n) {
                pg = rb_entry(n, struct ceph_pg_mapping, node);
                c = pgid_cmp(pgid, pg->pgid);
-                if (c < 0)
+                if (c < 0) {
                        n = n->rb_left;
-                else if (c > 0)
+                } else if (c > 0) {
                        n = n->rb_right;
-                else
+                } else {
+                        dout("__lookup_pg_mapping %llx got %p\n",
+                             *(u64 *)&pgid, pg);
                        return pg;
+                }
        }
        return NULL;
 }
+static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
+{
+        struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
+        if (pg) {
+                dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
+                rb_erase(&pg->node, root);
+                kfree(pg);
+                return 0;
+        }
+        dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
+        return -ENOENT;
+}
 /*
 * rbtree of pg pool info
 */
@@ -711,7 +729,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        void *start = *p;
        int err = -EINVAL;
        u16 version;
-        struct rb_node *rbp;
        ceph_decode_16_safe(p, end, version, bad);
        if (version > CEPH_OSDMAP_INC_VERSION) {
@@ -861,7 +878,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        }
        /* new_pg_temp */
-        rbp = rb_first(&map->pg_temp);
        ceph_decode_32_safe(p, end, len, bad);
        while (len--) {
                struct ceph_pg_mapping *pg;
@@ -872,18 +888,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                ceph_decode_copy(p, &pgid, sizeof(pgid));
                pglen = ceph_decode_32(p);
-                /* remove any? */
-                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
-                                                node)->pgid, pgid) <= 0) {
-                        struct ceph_pg_mapping *cur =
-                                rb_entry(rbp, struct ceph_pg_mapping, node);
-                        rbp = rb_next(rbp);
-                        dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                        rb_erase(&cur->node, &map->pg_temp);
-                        kfree(cur);
-                }
                if (pglen) {
                        /* insert */
                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
@@ -903,17 +907,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                        }
                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
                             pglen);
+                } else {
+                        /* remove */
+                        __remove_pg_mapping(&map->pg_temp, pgid);
                }
        }
-        while (rbp) {
-                struct ceph_pg_mapping *cur =
-                        rb_entry(rbp, struct ceph_pg_mapping, node);
-                rbp = rb_next(rbp);
-                dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                rb_erase(&cur->node, &map->pg_temp);
-                kfree(cur);
-        }
        /* ignore the rest */
        *p = end;
@@ -1046,10 +1044,25 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        struct ceph_pg_mapping *pg;
        struct ceph_pg_pool_info *pool;
        int ruleno;
-        unsigned poolid, ps, pps;
+        unsigned poolid, ps, pps, t;
        int preferred;
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
        /* pg_temp? */
+        if (preferred >= 0)
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.lpg_num),
+                                    pool->lpgp_num_mask);
+        else
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
+                                    pool->pgp_num_mask);
+        pgid.ps = cpu_to_le16(t);
        pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
        if (pg) {
                *num = pg->len;
@@ -1057,18 +1070,6 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        }
        /* crush */
-        poolid = le32_to_cpu(pgid.pool);
-        ps = le16_to_cpu(pgid.ps);
-        preferred = (s16)le16_to_cpu(pgid.preferred);
-        /* don't forcefeed bad device ids to crush */
-        if (preferred >= osdmap->max_osd ||
-            preferred >= osdmap->crush->max_devices)
-                preferred = -1;
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
-        if (!pool)
-                return NULL;
        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
                                 pool->v.type, pool->v.size);
        if (ruleno < 0) {
@@ -1078,6 +1079,11 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
                return NULL;
        }
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
        if (preferred >= 0)
                pps = ceph_stable_mod(ps,
                                      le32_to_cpu(pool->v.lpgp_num),
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 143221ebeb7..81cae641c9a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1398,9 +1398,7 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
        BUG_ON(!pcount);
-        /* Tweak before seqno plays */
+        if (skb == tp->lost_skb_hint)
-        if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
-            !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
                tp->lost_cnt_hint += pcount;
        TCP_SKB_CB(prev)->end_seq += shifted;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index dd3fad9fb63..48da7cc41e2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -927,18 +927,21 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                        }
                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                md5sig = tp->md5sig_info;
+                if (md5sig->entries4 == 0 &&
+                    tcp_alloc_md5sig_pool(sk) == NULL) {
                        kfree(newkey);
                        return -ENOMEM;
                }
-                md5sig = tp->md5sig_info;
                if (md5sig->alloced4 == md5sig->entries4) {
                        keys = kmalloc((sizeof(*keys) *
                                        (md5sig->entries4 + 1)), GFP_ATOMIC);
                        if (!keys) {
                                kfree(newkey);
-                                tcp_free_md5sig_pool();
+                                if (md5sig->entries4 == 0)
+                                        tcp_free_md5sig_pool();
                                return -ENOMEM;
                        }
@@ -982,6 +985,7 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                kfree(tp->md5sig_info->keys4);
                                tp->md5sig_info->keys4 = NULL;
                                tp->md5sig_info->alloced4 = 0;
+                                tcp_free_md5sig_pool();
                        } else if (tp->md5sig_info->entries4 != i) {
                                /* Need to do some manipulation */
                                memmove(&tp->md5sig_info->keys4[i],
@@ -989,7 +993,6 @@ int tcp_v4_md5_do_del(struct sock *sk, __be32 addr)
                                        (tp->md5sig_info->entries4 - i) *
                                         sizeof(struct tcp4_md5sig_key));
                        }
-                        tcp_free_md5sig_pool();
                        return 0;
                }
        }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 705c8288628..def0538e241 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        dev->stats.tx_bytes += skb->len;
@@ -2052,8 +2054,10 @@ int ip6_mr_input(struct sk_buff *skb)
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1250f902067..fb545edef6e 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -244,7 +244,9 @@ static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
 {
        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
-        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
        return rt;
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 00797d85766..5357902c797 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -591,7 +591,8 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                        }
                        sk_nocaps_add(sk, NETIF_F_GSO_MASK);
                }
-                if (tcp_alloc_md5sig_pool(sk) == NULL) {
+                if (tp->md5sig_info->entries6 == 0 &&
+                        tcp_alloc_md5sig_pool(sk) == NULL) {
                        kfree(newkey);
                        return -ENOMEM;
                }
@@ -600,8 +601,9 @@ static int tcp_v6_md5_do_add(struct sock *sk, const struct in6_addr *peer,
                                       (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
                        if (!keys) {
-                                tcp_free_md5sig_pool();
                                kfree(newkey);
+                                if (tp->md5sig_info->entries6 == 0)
+                                        tcp_free_md5sig_pool();
                                return -ENOMEM;
                        }
@@ -647,6 +649,7 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                kfree(tp->md5sig_info->keys6);
                                tp->md5sig_info->keys6 = NULL;
                                tp->md5sig_info->alloced6 = 0;
+                                tcp_free_md5sig_pool();
                        } else {
                                /* shrink the database */
                                if (tp->md5sig_info->entries6 != i)
@@ -655,7 +658,6 @@ static int tcp_v6_md5_do_del(struct sock *sk, const struct in6_addr *peer)
                                                (tp->md5sig_info->entries6 - i)
                                                * sizeof (tp->md5sig_info->keys6[0]));
                        }
-                        tcp_free_md5sig_pool();
                        return 0;
                }
        }
@@ -1383,6 +1385,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
 #endif
+                newnp->ipv6_ac_list = NULL;
+                newnp->ipv6_fl_list = NULL;
                newnp->pktoptions  = NULL;
                newnp->opt         = NULL;
                newnp->mcast_oif   = inet6_iif(skb);
@@ -1447,6 +1451,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
           First: no IPv4 options.
         */
        newinet->inet_opt = NULL;
+        newnp->ipv6_ac_list = NULL;
        newnp->ipv6_fl_list = NULL;
        /* Clone RX bits */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index 2b771dc708a..5290ac353a5 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3679,7 +3679,7 @@ int __net_init ip_vs_control_net_init(struct net *net)
        int idx;
        struct netns_ipvs *ipvs = net_ipvs(net);
-        ipvs->rs_lock = __RW_LOCK_UNLOCKED(ipvs->rs_lock);
+        rwlock_init(&ipvs->rs_lock);
        /* Initialize rs_table */
        for (idx = 0; idx < IP_VS_RTAB_SIZE; idx++)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 25e68f56b4b..dac91abf4c0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1720,7 +1720,10 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
        return 0;
 drop_n_acct:
-        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+        spin_lock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops++;
+        atomic_inc(&sk->sk_drops);
+        spin_unlock(&sk->sk_receive_queue.lock);
 drop_n_restore:
        if (skb_head != skb->data && skb_shared(skb)) {
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index 8b77edbab27..4e1de171866 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -84,7 +84,8 @@ static int rds_iw_map_fastreg(struct rds_iw_mr_pool *pool,
 static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                        struct list_head *unmap_list,
-                        struct list_head *kill_list);
+                        struct list_head *kill_list,
+                        int *unpinned);
 static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
 static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
@@ -499,7 +500,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
        LIST_HEAD(unmap_list);
        LIST_HEAD(kill_list);
        unsigned long flags;
-        unsigned int nfreed = 0, ncleaned = 0, free_goal;
+        unsigned int nfreed = 0, ncleaned = 0, unpinned = 0, free_goal;
        int ret = 0;
        rds_iw_stats_inc(s_iw_rdma_mr_pool_flush);
@@ -524,7 +525,8 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
         * will be destroyed by the unmap function.
         */
        if (!list_empty(&unmap_list)) {
-                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list, &kill_list);
+                ncleaned = rds_iw_unmap_fastreg_list(pool, &unmap_list,
+                                                     &kill_list, &unpinned);
                /* If we've been asked to destroy all MRs, move those
                 * that were simply cleaned to the kill list */
                if (free_all)
@@ -548,6 +550,7 @@ static int rds_iw_flush_mr_pool(struct rds_iw_mr_pool *pool, int free_all)
                spin_unlock_irqrestore(&pool->list_lock, flags);
        }
+        atomic_sub(unpinned, &pool->free_pinned);
        atomic_sub(ncleaned, &pool->dirty_count);
        atomic_sub(nfreed, &pool->item_count);
@@ -828,7 +831,8 @@ static void rds_iw_free_fastreg(struct rds_iw_mr_pool *pool,
 static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                                struct list_head *unmap_list,
-                                struct list_head *kill_list)
+                                struct list_head *kill_list,
+                                int *unpinned)
 {
        struct rds_iw_mapping *mapping, *next;
        unsigned int ncleaned = 0;
@@ -855,6 +859,7 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
                spin_lock_irqsave(&pool->list_lock, flags);
                list_for_each_entry_safe(mapping, next, unmap_list, m_list) {
+                        *unpinned += mapping->m_sg.len;
                        list_move(&mapping->m_list, &laundered);
                        ncleaned++;
                }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 94fdcc7f103..552df27dcf5 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1349,14 +1349,16 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
                BUG();
        }
        xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
-        memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
-        xfrm_policy_put_afinfo(afinfo);
-        if (likely(xdst))
+        if (likely(xdst)) {
+                memset(&xdst->u.rt6.rt6i_table, 0,
+                        sizeof(*xdst) - sizeof(struct dst_entry));
                xdst->flo.ops = &xfrm_bundle_fc_ops;
-        else
+        } else
                xdst = ERR_PTR(-ENOBUFS);
+        xfrm_policy_put_afinfo(afinfo);
        return xdst;
 }
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index f9123f09e83..32b02d90670 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -68,6 +68,7 @@ MODULE_PARM_DESC(enable, "Enable FM801 soundcard.");
 module_param_array(tea575x_tuner, int, NULL, 0444);
 MODULE_PARM_DESC(tea575x_tuner, "TEA575x tuner access method (0 = auto, 1 = SF256-PCS, 2=SF256-PCP, 3=SF64-PCR, 8=disable, +16=tuner-only).");
+#define TUNER_DISABLED          (1<<3)
 #define TUNER_ONLY              (1<<4)
 #define TUNER_TYPE_MASK         (~TUNER_ONLY & 0xFFFF)
@@ -1150,7 +1151,8 @@ static int snd_fm801_free(struct fm801 *chip)
      __end_hw:
 #ifdef CONFIG_SND_FM801_TEA575X_BOOL
-        snd_tea575x_exit(&chip->tea);
+        if (!(chip->tea575x_tuner & TUNER_DISABLED))
+                snd_tea575x_exit(&chip->tea);
 #endif
        if (chip->irq >= 0)
                free_irq(chip->irq, chip);
@@ -1236,7 +1238,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
            (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
                if (snd_tea575x_init(&chip->tea)) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
                        return -ENODEV;
                }
        } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
@@ -1251,11 +1252,15 @@ static int __devinit snd_fm801_create(struct snd_card *card,
                }
                if (tea575x_tuner == 4) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
+                        chip->tea575x_tuner = TUNER_DISABLED;
-                        return -ENODEV;
                }
        }
-        strlcpy(chip->tea.card, snd_fm801_tea575x_gpios[(tea575x_tuner & TUNER_TYPE_MASK) - 1].name, sizeof(chip->tea.card));
+        if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
+                strlcpy(chip->tea.card,
+                        snd_fm801_tea575x_gpios[(tea575x_tuner &
+                                                 TUNER_TYPE_MASK) - 1].name,
+                        sizeof(chip->tea.card));
+        }
 #endif
        *rchip = chip;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index be6982289c0..e9a2a8795d1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1924,7 +1924,8 @@ static unsigned int azx_via_get_position(struct azx *chip,
 }
 static unsigned int azx_get_position(struct azx *chip,
-                                     struct azx_dev *azx_dev)
+                                     struct azx_dev *azx_dev,
+                                     bool with_check)
 {
        unsigned int pos;
        int stream = azx_dev->substream->stream;
@@ -1940,7 +1941,7 @@ static unsigned int azx_get_position(struct azx *chip,
        default:
                /* use the position buffer */
                pos = le32_to_cpu(*azx_dev->posbuf);
-                if (chip->position_fix[stream] == POS_FIX_AUTO) {
+                if (with_check && chip->position_fix[stream] == POS_FIX_AUTO) {
                        if (!pos || pos == (u32)-1) {
                                printk(KERN_WARNING
                                       "hda-intel: Invalid position buffer, "
@@ -1964,7 +1965,7 @@ static snd_pcm_uframes_t azx_pcm_pointer(struct snd_pcm_substream *substream)
        struct azx *chip = apcm->chip;
        struct azx_dev *azx_dev = get_azx_dev(substream);
        return bytes_to_frames(substream->runtime,
-                               azx_get_position(chip, azx_dev));
+                               azx_get_position(chip, azx_dev, false));
 }
 /*
@@ -1987,7 +1988,7 @@ static int azx_position_ok(struct azx *chip, struct azx_dev *azx_dev)
                return -1;      /* bogus (too early) interrupt */
        stream = azx_dev->substream->stream;
-        pos = azx_get_position(chip, azx_dev);
+        pos = azx_get_position(chip, azx_dev, true);
        if (WARN_ONCE(!azx_dev->period_bytes,
                      "hda-intel: zero azx_dev->period_bytes"))
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 0503c999e7d..7a73621a890 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -578,6 +578,10 @@ static void alc_line_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
+        /* check LO jack only when it's different from HP */
+        if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0])
+                return;
        spec->line_jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.line_out_pins),
                             spec->autocfg.line_out_pins);
@@ -1321,7 +1325,9 @@ do_sku:
         * 15   : 1 --> enable the function "Mute internal speaker
         *              when the external headphone out jack is plugged"
         */
-        if (!spec->autocfg.hp_pins[0]) {
+        if (!spec->autocfg.hp_pins[0] &&
+            !(spec->autocfg.line_out_pins[0] &&
+              spec->autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
                hda_nid_t nid;
                tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                if (tmp == 0)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 1b7c11432aa..987e3cf71a0 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -5630,6 +5630,7 @@ again:
        switch (codec->vendor_id) {
        case 0x111d76d1:
        case 0x111d76d9:
+        case 0x111d76df:
        case 0x111d76e5:
        case 0x111d7666:
        case 0x111d7667:
diff --git a/sound/soc/blackfin/bf5xx-ad73311.c b/sound/soc/blackfin/bf5xx-ad73311.c
index 732a247f252..b94eb7ef7d1 100644
--- a/sound/soc/blackfin/bf5xx-ad73311.c
+++ b/sound/soc/blackfin/bf5xx-ad73311.c
@@ -128,7 +128,7 @@ static int snd_ad73311_configure(void)
        return 0;
 }
-static int bf5xx_probe(struct platform_device *pdev)
+static int bf5xx_probe(struct snd_soc_card *card)
 {
        int err;
        if (gpio_request(GPIO_SE, "AD73311_SE")) {
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index 84f4ad56855..9801cd7cfcb 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -431,7 +431,8 @@ static int ssm2602_set_dai_fmt(struct snd_soc_dai *codec_dai,
 static int ssm2602_set_bias_level(struct snd_soc_codec *codec,
                                 enum snd_soc_bias_level level)
 {
-        u16 reg = snd_soc_read(codec, SSM2602_PWR) & 0xff7f;
+        u16 reg = snd_soc_read(codec, SSM2602_PWR);
+        reg &= ~(PWR_POWER_OFF | PWR_OSC_PDN);
        switch (level) {
        case SND_SOC_BIAS_ON:
diff --git a/sound/soc/codecs/wm8753.c b/sound/soc/codecs/wm8753.c
index ffa2ffe5ec1..aa091a0d818 100644
--- a/sound/soc/codecs/wm8753.c
+++ b/sound/soc/codecs/wm8753.c
@@ -1454,8 +1454,8 @@ static int wm8753_probe(struct snd_soc_codec *codec)
        /* set the update bits */
        snd_soc_update_bits(codec, WM8753_LDAC, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_RDAC, 0x0100, 0x0100);
-        snd_soc_update_bits(codec, WM8753_LDAC, 0x0100, 0x0100);
+        snd_soc_update_bits(codec, WM8753_LADC, 0x0100, 0x0100);
-        snd_soc_update_bits(codec, WM8753_RDAC, 0x0100, 0x0100);
+        snd_soc_update_bits(codec, WM8753_RADC, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_LOUT1V, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_ROUT1V, 0x0100, 0x0100);
        snd_soc_update_bits(codec, WM8753_LOUT2V, 0x0100, 0x0100);
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 1725550c293..d2c315fa1b9 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3479,31 +3479,6 @@ int wm8962_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack)
 }
 EXPORT_SYMBOL_GPL(wm8962_mic_detect);
-#ifdef CONFIG_PM
-static int wm8962_resume(struct snd_soc_codec *codec)
-{
-        u16 *reg_cache = codec->reg_cache;
-        int i;
-        /* Restore the registers */
-        for (i = 1; i < codec->driver->reg_cache_size; i++) {
-                switch (i) {
-                case WM8962_SOFTWARE_RESET:
-                        continue;
-                default:
-                        break;
-                }
-                if (reg_cache[i] != wm8962_reg[i])
-                        snd_soc_write(codec, i, reg_cache[i]);
-        }
-        return 0;
-}
-#else
-#define wm8962_resume NULL
-#endif
 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
 static int beep_rates[] = {
        500, 1000, 2000, 4000,
@@ -4015,7 +3990,6 @@ static int wm8962_remove(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
        .probe =        wm8962_probe,
        .remove =       wm8962_remove,
-        .resume =       wm8962_resume,
        .set_bias_level = wm8962_set_bias_level,
        .reg_cache_size = WM8962_MAX_REGISTER + 1,
        .reg_word_size = sizeof(u16),
diff --git a/sound/soc/omap/mcpdm.c b/sound/soc/omap/mcpdm.c
index 928f0370745..50e59194ad8 100644
--- a/sound/soc/omap/mcpdm.c
+++ b/sound/soc/omap/mcpdm.c
@@ -449,7 +449,7 @@ exit:
        return ret;
 }
-int __devexit omap_mcpdm_remove(struct platform_device *pdev)
+int omap_mcpdm_remove(struct platform_device *pdev)
 {
        struct omap_mcpdm *mcpdm_ptr = platform_get_drvdata(pdev);
diff --git a/sound/soc/omap/mcpdm.h b/sound/soc/omap/mcpdm.h
index df3e16fb51f..20c20a8649f 100644
--- a/sound/soc/omap/mcpdm.h
+++ b/sound/soc/omap/mcpdm.h
@@ -150,4 +150,4 @@ extern int omap_mcpdm_request(void);
 extern void omap_mcpdm_free(void);
 extern int omap_mcpdm_set_offset(int offset1, int offset2);
 int __devinit omap_mcpdm_probe(struct platform_device *pdev);
-int __devexit omap_mcpdm_remove(struct platform_device *pdev);
+int omap_mcpdm_remove(struct platform_device *pdev);
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index ebcc2d4d2b1..478d6077845 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -516,6 +516,12 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
        struct omap_mcbsp_reg_cfg *regs = &mcbsp_data->regs;
        int err = 0;
+        if (mcbsp_data->active)
+                if (freq == mcbsp_data->in_freq)
+                        return 0;
+                else
+                        return -EBUSY;
        /* The McBSP signal muxing functions are only available on McBSP1 */
        if (clk_id == OMAP_MCBSP_CLKR_SRC_CLKR ||
            clk_id == OMAP_MCBSP_CLKR_SRC_CLKX ||
diff --git a/sound/soc/pxa/zylonite.c b/sound/soc/pxa/zylonite.c
index b6445757fc5..2b8350b5223 100644
--- a/sound/soc/pxa/zylonite.c
+++ b/sound/soc/pxa/zylonite.c
@@ -196,20 +196,20 @@ static int zylonite_probe(struct snd_soc_card *card)
        if (clk_pout) {
                pout = clk_get(NULL, "CLK_POUT");
                if (IS_ERR(pout)) {
-                        dev_err(&pdev->dev, "Unable to obtain CLK_POUT: %ld\n",
+                        dev_err(card->dev, "Unable to obtain CLK_POUT: %ld\n",
                                PTR_ERR(pout));
                        return PTR_ERR(pout);
                }
                ret = clk_enable(pout);
                if (ret != 0) {
-                        dev_err(&pdev->dev, "Unable to enable CLK_POUT: %d\n",
+                        dev_err(card->dev, "Unable to enable CLK_POUT: %d\n",
                                ret);
                        clk_put(pout);
                        return ret;
                }
-                dev_dbg(&pdev->dev, "MCLK enabled at %luHz\n",
+                dev_dbg(card->dev, "MCLK enabled at %luHz\n",
                        clk_get_rate(pout));
        }
@@ -241,7 +241,7 @@ static int zylonite_resume_pre(struct snd_soc_card *card)
        if (clk_pout) {
                ret = clk_enable(pout);
                if (ret != 0)
-                        dev_err(&pdev->dev, "Unable to enable CLK_POUT: %d\n",
+                        dev_err(card->dev, "Unable to enable CLK_POUT: %d\n",
                                ret);
        }
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d2ef014af21..ef69f5a0270 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -30,6 +30,7 @@
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
 #include <linux/platform_device.h>
+#include <linux/ctype.h>
 #include <linux/slab.h>
 #include <sound/ac97_codec.h>
 #include <sound/core.h>
@@ -1434,9 +1435,20 @@ static void snd_soc_instantiate_card(struct snd_soc_card *card)
                 "%s", card->name);
        snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
                 "%s", card->long_name ? card->long_name : card->name);
-        if (card->driver_name)
+        snprintf(card->snd_card->driver, sizeof(card->snd_card->driver),
-                strlcpy(card->snd_card->driver, card->driver_name,
+                 "%s", card->driver_name ? card->driver_name : card->name);
-                        sizeof(card->snd_card->driver));
+        for (i = 0; i < ARRAY_SIZE(card->snd_card->driver); i++) {
+                switch (card->snd_card->driver[i]) {
+                case '_':
+                case '-':
+                case '\0':
+                        break;
+                default:
+                        if (!isalnum(card->snd_card->driver[i]))
+                                card->snd_card->driver[i] = '_';
+                        break;
+                }
+        }
        if (card->late_probe) {
                ret = card->late_probe(card);
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 781d9e61adf..d8f2bf40145 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -530,8 +530,11 @@ snd_usb_audio_probe(struct usb_device *dev,
        return chip;
 __error:
-        if (chip && !chip->num_interfaces)
+        if (chip) {
-                snd_card_free(chip->card);
+                if (!chip->num_interfaces)
+                        snd_card_free(chip->card);
+                chip->probing = 0;
+        }
        mutex_unlock(&register_mutex);
 __err_val:
        return NULL;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3b8f7b80376..e9d5c271db6 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -30,6 +30,8 @@ endif
 # Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
 #
 # Define NO_DWARF if you do not want debug-info analysis feature at all.
+#
+# Define WERROR=0 to disable treating any warnings as errors.
 $(OUTPUT)PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
        @$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
@@ -63,6 +65,11 @@ ifeq ($(ARCH),x86_64)
        endif
 endif
+# Treat warnings as errors unless directed not to
+ifneq ($(WERROR),0)
+        CFLAGS_WERROR := -Werror
+endif
 #
 # Include saner warnings here, which can catch bugs:
 #
@@ -95,7 +102,7 @@ ifndef PERF_DEBUG
  CFLAGS_OPTIMIZE = -O6
 endif
-CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_WERROR) $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS = $(LDFLAGS)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 6b0519f885e..f4c3fbee4ba 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -161,6 +161,7 @@ static void config_attr(struct perf_evsel *evsel, struct perf_evlist *evlist)
        struct perf_event_attr *attr = &evsel->attr;
        int track = !evsel->idx; /* only the first counter needs these */
+        attr->disabled          = 1;
        attr->inherit           = !no_inherit;
        attr->read_format       = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                  PERF_FORMAT_TOTAL_TIME_RUNNING |
@@ -671,6 +672,8 @@ static int __cmd_record(int argc, const char **argv)
                }
        }
+        perf_evlist__enable(evsel_list);
        /*
         * Let the child rip
         */
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 55f4c76f282..efe696f936e 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -561,7 +561,7 @@ static int test__basic_mmap(void)
                }
                err = perf_event__parse_sample(event, attr.sample_type, sample_size,
-                                               false, &sample);
+                                               false, &sample, false);
                if (err) {
                        pr_err("Can't parse sample, err = %d\n", err);
                        goto out_munmap;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index a43433f0830..d28013b7d61 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -191,7 +191,8 @@ static void __zero_source_counters(struct sym_entry *syme)
        symbol__annotate_zero_histograms(sym);
 }
-static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+static void record_precise_ip(struct sym_entry *syme, struct map *map,
+                              int counter, u64 ip)
 {
        struct annotation *notes;
        struct symbol *sym;
@@ -205,8 +206,8 @@ static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
        if (pthread_mutex_trylock(&notes->lock))
                return;
-        ip = syme->map->map_ip(syme->map, ip);
+        ip = map->map_ip(map, ip);
-        symbol__inc_addr_samples(sym, syme->map, counter, ip);
+        symbol__inc_addr_samples(sym, map, counter, ip);
        pthread_mutex_unlock(&notes->lock);
 }
@@ -810,7 +811,7 @@ static void perf_event__process_sample(const union perf_event *event,
                evsel = perf_evlist__id2evsel(top.evlist, sample->id);
                assert(evsel != NULL);
                syme->count[evsel->idx]++;
-                record_precise_ip(syme, evsel->idx, ip);
+                record_precise_ip(syme, al.map, evsel->idx, ip);
                pthread_mutex_lock(&top.active_symbols_lock);
                if (list_empty(&syme->node) || !syme->node.next) {
                        static bool first = true;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 3c1b8a63210..437f8ca679a 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -169,12 +169,17 @@ static int perf_event__synthesize_mmap_events(union perf_event *event,
                        continue;
                pbf += n + 3;
                if (*pbf == 'x') { /* vm_exec */
+                        char anonstr[] = "//anon\n";
                        char *execname = strchr(bf, '/');
                        /* Catch VDSO */
                        if (execname == NULL)
                                execname = strstr(bf, "[vdso]");
+                        /* Catch anonymous mmaps */
+                        if ((execname == NULL) && !strstr(bf, "["))
+                                execname = anonstr;
                        if (execname == NULL)
                                continue;
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 1d7f66488a8..357a85b8524 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -186,6 +186,6 @@ const char *perf_event__name(unsigned int id);
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *sample);
+                             struct perf_sample *sample, bool swapped);
 #endif /* __PERF_RECORD_H */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index c12bd476c6f..72e9f4886b6 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -113,6 +113,19 @@ void perf_evlist__disable(struct perf_evlist *evlist)
        }
 }
+void perf_evlist__enable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                }
+        }
+}
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
        int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index ce85ae9ae57..f3491500274 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,7 @@ int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 void perf_evlist__disable(struct perf_evlist *evlist);
+void perf_evlist__enable(struct perf_evlist *evlist);
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                         struct cpu_map *cpus,
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index a03a36b7908..e389815078d 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -7,6 +7,8 @@
 * Released under the GPL v2. (and only v2, not any later version)
 */
+#include <byteswap.h>
+#include "asm/bug.h"
 #include "evsel.h"
 #include "evlist.h"
 #include "util.h"
@@ -342,10 +344,20 @@ static bool sample_overlap(const union perf_event *event,
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *data)
+                             struct perf_sample *data, bool swapped)
 {
        const u64 *array;
+        /*
+         * used for cross-endian analysis. See git commit 65014ab3
+         * for why this goofiness is needed.
+         */
+        union {
+                u64 val64;
+                u32 val32[2];
+        } u;
        data->cpu = data->pid = data->tid = -1;
        data->stream_id = data->id = data->time = -1ULL;
@@ -366,9 +378,16 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
-                data->pid = p[0];
+                if (swapped) {
-                data->tid = p[1];
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+                data->pid = u.val32[0];
+                data->tid = u.val32[1];
                array++;
        }
@@ -395,8 +414,15 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                data->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+                data->cpu = u.val32[0];
                array++;
        }
@@ -423,18 +449,27 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_RAW) {
-                u32 *p = (u32 *)array;
+                const u64 *pdata;
+                u.val64 = *array;
+                if (WARN_ONCE(swapped,
+                              "Endianness of raw data not corrected!\n")) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
                if (sample_overlap(event, array, sizeof(u32)))
                        return -EFAULT;
-                data->raw_size = *p;
+                data->raw_size = u.val32[0];
-                p++;
+                pdata = (void *) array + sizeof(u32);
-                if (sample_overlap(event, p, data->raw_size))
+                if (sample_overlap(event, pdata, data->raw_size))
                        return -EFAULT;
-                data->raw_data = p;
+                data->raw_data = (void *) pdata;
        }
        return 0;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 555fc3864b9..5d732621a46 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -659,7 +659,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
                        ret = -ENOENT;
        }
-        if (ret == 0)
+        if (ret >= 0)
                ret = convert_variable(&vr_die, pf);
        if (ret < 0)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index cbc8f215d4b..7624324efad 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -803,7 +803,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                first = list_entry(evlist->entries.next, struct perf_evsel, node);
                err = perf_event__parse_sample(event, first->attr.sample_type,
                                               perf_evsel__sample_size(first),
-                                               sample_id_all, &pevent->sample);
+                                               sample_id_all, &pevent->sample, false);
                if (err)
                        return PyErr_Format(PyExc_OSError,
                                            "perf: can't parse sample, err=%d", err);
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 170601e67d6..974d0cbee5e 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -162,7 +162,8 @@ static inline int perf_session__parse_sample(struct perf_session *session,
 {
        return perf_event__parse_sample(event, session->sample_type,
                                        session->sample_size,
-                                        session->sample_id_all, sample);
+                                        session->sample_id_all, sample,
+                                        session->header.needs_swap);
 }
 struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 401e220566f..1ee8f1e40f1 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -151,11 +151,17 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 {
        u64 ip_l, ip_r;
+        if (!left->ms.sym && !right->ms.sym)
+                return right->level - left->level;
+        if (!left->ms.sym || !right->ms.sym)
+                return cmp_null(left->ms.sym, right->ms.sym);
        if (left->ms.sym == right->ms.sym)
                return 0;
-        ip_l = left->ms.sym ? left->ms.sym->start : left->ip;
+        ip_l = left->ms.sym->start;
-        ip_r = right->ms.sym ? right->ms.sym->start : right->ip;
+        ip_r = right->ms.sym->start;
        return (int64_t)(ip_r - ip_l);
 }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 469c0264ed2..40eeaf07725 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -74,16 +74,104 @@ static void dso__set_sorted_by_name(struct dso *dso, enum map_type type)
 bool symbol_type__is_a(char symbol_type, enum map_type map_type)
 {
+        symbol_type = toupper(symbol_type);
        switch (map_type) {
        case MAP__FUNCTION:
                return symbol_type == 'T' || symbol_type == 'W';
        case MAP__VARIABLE:
-                return symbol_type == 'D' || symbol_type == 'd';
+                return symbol_type == 'D';
        default:
                return false;
        }
 }
+static int prefix_underscores_count(const char *str)
+{
+        const char *tail = str;
+        while (*tail == '_')
+                tail++;
+        return tail - str;
+}
+#define SYMBOL_A 0
+#define SYMBOL_B 1
+static int choose_best_symbol(struct symbol *syma, struct symbol *symb)
+{
+        s64 a;
+        s64 b;
+        /* Prefer a symbol with non zero length */
+        a = syma->end - syma->start;
+        b = symb->end - symb->start;
+        if ((b == 0) && (a > 0))
+                return SYMBOL_A;
+        else if ((a == 0) && (b > 0))
+                return SYMBOL_B;
+        /* Prefer a non weak symbol over a weak one */
+        a = syma->binding == STB_WEAK;
+        b = symb->binding == STB_WEAK;
+        if (b && !a)
+                return SYMBOL_A;
+        if (a && !b)
+                return SYMBOL_B;
+        /* Prefer a global symbol over a non global one */
+        a = syma->binding == STB_GLOBAL;
+        b = symb->binding == STB_GLOBAL;
+        if (a && !b)
+                return SYMBOL_A;
+        if (b && !a)
+                return SYMBOL_B;
+        /* Prefer a symbol with less underscores */
+        a = prefix_underscores_count(syma->name);
+        b = prefix_underscores_count(symb->name);
+        if (b > a)
+                return SYMBOL_A;
+        else if (a > b)
+                return SYMBOL_B;
+        /* If all else fails, choose the symbol with the longest name */
+        if (strlen(syma->name) >= strlen(symb->name))
+                return SYMBOL_A;
+        else
+                return SYMBOL_B;
+}
+static void symbols__fixup_duplicate(struct rb_root *symbols)
+{
+        struct rb_node *nd;
+        struct symbol *curr, *next;
+        nd = rb_first(symbols);
+        while (nd) {
+                curr = rb_entry(nd, struct symbol, rb_node);
+again:
+                nd = rb_next(&curr->rb_node);
+                next = rb_entry(nd, struct symbol, rb_node);
+                if (!nd)
+                        break;
+                if (curr->start != next->start)
+                        continue;
+                if (choose_best_symbol(curr, next) == SYMBOL_A) {
+                        rb_erase(&next->rb_node, symbols);
+                        goto again;
+                } else {
+                        nd = rb_next(&curr->rb_node);
+                        rb_erase(&curr->rb_node, symbols);
+                }
+        }
+}
 static void symbols__fixup_end(struct rb_root *symbols)
 {
        struct rb_node *nd, *prevnd = rb_first(symbols);
@@ -438,18 +526,11 @@ int kallsyms__parse(const char *filename, void *arg,
        char *line = NULL;
        size_t n;
        int err = -1;
-        u64 prev_start = 0;
-        char prev_symbol_type = 0;
-        char *prev_symbol_name;
        FILE *file = fopen(filename, "r");
        if (file == NULL)
                goto out_failure;
-        prev_symbol_name = malloc(KSYM_NAME_LEN);
-        if (prev_symbol_name == NULL)
-                goto out_close;
        err = 0;
        while (!feof(file)) {
@@ -470,7 +551,7 @@ int kallsyms__parse(const char *filename, void *arg,
                if (len + 2 >= line_len)
                        continue;
-                symbol_type = toupper(line[len]);
+                symbol_type = line[len];
                len += 2;
                symbol_name = line + len;
                len = line_len - len;
@@ -480,24 +561,18 @@ int kallsyms__parse(const char *filename, void *arg,
                        break;
                }
-                if (prev_symbol_type) {
+                /*
-                        u64 end = start;
+                 * module symbols are not sorted so we add all
-                        if (end != prev_start)
+                 * symbols with zero length and rely on
-                                --end;
+                 * symbols__fixup_end() to fix it up.
-                        err = process_symbol(arg, prev_symbol_name,
+                 */
-                                             prev_symbol_type, prev_start, end);
+                err = process_symbol(arg, symbol_name,
-                        if (err)
+                                     symbol_type, start, start);
-                                break;
+                if (err)
-                }
+                        break;
-                memcpy(prev_symbol_name, symbol_name, len + 1);
-                prev_symbol_type = symbol_type;
-                prev_start = start;
        }
-        free(prev_symbol_name);
        free(line);
-out_close:
        fclose(file);
        return err;
@@ -703,6 +778,9 @@ int dso__load_kallsyms(struct dso *dso, const char *filename,
        if (dso__load_all_kallsyms(dso, filename, map) < 0)
                return -1;
+        symbols__fixup_duplicate(&dso->symbols[map->type]);
+        symbols__fixup_end(&dso->symbols[map->type]);
        if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
                dso->symtab_type = SYMTAB__GUEST_KALLSYMS;
        else
@@ -1092,8 +1170,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        if (dso->has_build_id) {
                u8 build_id[BUILD_ID_SIZE];
-                if (elf_read_build_id(elf, build_id,
+                if (elf_read_build_id(elf, build_id, BUILD_ID_SIZE) < 0)
-                                      BUILD_ID_SIZE) != BUILD_ID_SIZE)
                        goto out_elf_end;
                if (!dso__build_id_equal(dso, build_id))
@@ -1111,6 +1188,8 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        }
        opdsec = elf_section_by_name(elf, &ehdr, &opdshdr, ".opd", &opdidx);
+        if (opdshdr.sh_type != SHT_PROGBITS)
+                opdsec = NULL;
        if (opdsec)
                opddata = elf_rawdata(opdsec, NULL);
@@ -1276,6 +1355,7 @@ new_symbol:
         * For misannotated, zeroed, ASM function sizes.
         */
        if (nr > 0) {
+                symbols__fixup_duplicate(&dso->symbols[map->type]);
                symbols__fixup_end(&dso->symbols[map->type]);
                if (kmap) {
                        /*
@@ -1362,8 +1442,8 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
        ptr = data->d_buf;
        while (ptr < (data->d_buf + data->d_size)) {
                GElf_Nhdr *nhdr = ptr;
-                int namesz = NOTE_ALIGN(nhdr->n_namesz),
+                size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
-                    descsz = NOTE_ALIGN(nhdr->n_descsz);
+                       descsz = NOTE_ALIGN(nhdr->n_descsz);
                const char *name;
                ptr += sizeof(*nhdr);
@@ -1372,8 +1452,10 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
                if (nhdr->n_type == NT_GNU_BUILD_ID &&
                    nhdr->n_namesz == sizeof("GNU")) {
                        if (memcmp(name, "GNU", sizeof("GNU")) == 0) {
-                                memcpy(bf, ptr, BUILD_ID_SIZE);
+                                size_t sz = min(size, descsz);
-                                err = BUILD_ID_SIZE;
+                                memcpy(bf, ptr, sz);
+                                memset(bf + sz, 0, size - sz);
+                                err = descsz;
                                break;
                        }
                }
@@ -1425,7 +1507,7 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
        while (1) {
                char bf[BUFSIZ];
                GElf_Nhdr nhdr;
-                int namesz, descsz;
+                size_t namesz, descsz;
                if (read(fd, &nhdr, sizeof(nhdr)) != sizeof(nhdr))
                        break;
@@ -1434,15 +1516,16 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
                descsz = NOTE_ALIGN(nhdr.n_descsz);
                if (nhdr.n_type == NT_GNU_BUILD_ID &&
                    nhdr.n_namesz == sizeof("GNU")) {
-                        if (read(fd, bf, namesz) != namesz)
+                        if (read(fd, bf, namesz) != (ssize_t)namesz)
                                break;
                        if (memcmp(bf, "GNU", sizeof("GNU")) == 0) {
-                                if (read(fd, build_id,
+                                size_t sz = min(descsz, size);
-                                    BUILD_ID_SIZE) == BUILD_ID_SIZE) {
+                                if (read(fd, build_id, sz) == (ssize_t)sz) {
+                                        memset(build_id + sz, 0, size - sz);
                                        err = 0;
                                        break;
                                }
-                        } else if (read(fd, bf, descsz) != descsz)
+                        } else if (read(fd, bf, descsz) != (ssize_t)descsz)
                                break;
                } else {
                        int n = namesz + descsz;