Merge branch 'drm-fixes' of /home/airlied/kernel/linux-2.6 into drm-core-next

Conflicts:
	drivers/gpu/drm/i915/intel_fb.c
	drivers/gpu/drm/radeon/r600_blit_kms.c
	drivers/gpu/drm/ttm/ttm_bo.c

422 files changed, 3202 insertions, 1721 deletions

diff --git a/CREDITS b/CREDITS
index 72b487869788..41d8e63d5165 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3554,12 +3554,12 @@ E: cvance@nai.com
 D: portions of the Linux Security Module (LSM) framework and security modules
 
 N: Petr Vandrovec
-E: vandrove@vc.cvut.cz
+E: petr@vandrovec.name
 D: Small contributions to ncpfs
 D: Matrox framebuffer driver
-S: Chudenicka 8
-S: 10200 Prague 10, Hostivar
-S: Czech Republic
+S: 21513 Conradia Ct
+S: Cupertino, CA 95014
+S: USA
 
 N: Thibaut Varene
 E: T-Bone@parisc-linux.org
diff --git a/Documentation/networking/e1000.txt b/Documentation/networking/e1000.txt
index 2df71861e578..d9271e74e488 100644
--- a/Documentation/networking/e1000.txt
+++ b/Documentation/networking/e1000.txt
@@ -1,82 +1,35 @@
 Linux* Base Driver for the Intel(R) PRO/1000 Family of Adapters
 ===============================================================
 
-September 26, 2006
-
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 
 Contents
 ========
 
-- In This Release
 - Identifying Your Adapter
-- Building and Installation
 - Command Line Parameters
 - Speed and Duplex Configuration
 - Additional Configurations
-- Known Issues
 - Support
 
-
-In This Release
-===============
-
-This file describes the Linux* Base Driver for the Intel(R) PRO/1000 Family
-of Adapters.  This driver includes support for Itanium(R)2-based systems.
-
-For questions related to hardware requirements, refer to the documentation
-supplied with your Intel PRO/1000 adapter. All hardware requirements listed
-apply to use with Linux.
-
-The following features are now available in supported kernels:
- - Native VLANs
- - Channel Bonding (teaming)
- - SNMP
-
-Channel Bonding documentation can be found in the Linux kernel source:
-/Documentation/networking/bonding.txt
-
-The driver information previously displayed in the /proc filesystem is not
-supported in this release.  Alternatively, you can use ethtool (version 1.6
-or later), lspci, and ifconfig to obtain the same information.
-
-Instructions on updating ethtool can be found in the section "Additional
-Configurations" later in this document.
-
-NOTE: The Intel(R) 82562v 10/100 Network Connection only provides 10/100
-support.
-
-
 Identifying Your Adapter
 ========================
 
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
 
-    http://support.intel.com/support/network/adapter/pro100/21397.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 
 For the latest Intel network drivers for Linux, refer to the following
 website.  In the search field, enter your adapter name or type, or use the
 networking link on the left to search for your adapter:
 
-    http://downloadfinder.intel.com/scripts-df/support_intel.asp
-
+    http://support.intel.com/support/go/network/adapter/home.htm
 
 Command Line Parameters
 =======================
 
-If the driver is built as a module, the  following optional parameters
-are used by entering them on the command line with the modprobe command
-using this syntax:
-
-     modprobe e1000 [<option>=<VAL1>,<VAL2>,...]
-
-For example, with two PRO/1000 PCI adapters, entering:
-
-     modprobe e1000 TxDescriptors=80,128
-
-loads the e1000 driver with 80 TX descriptors for the first adapter and
-128 TX descriptors for the second adapter.
-
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
 
@@ -89,10 +42,6 @@ NOTES:  For more information about the AutoNeg, Duplex, and Speed
         parameters, see the application note at:
         http://www.intel.com/design/network/applnots/ap450.htm
 
-        A descriptor describes a data buffer and attributes related to
-        the data buffer.  This information is accessed by the hardware.
-
-
 AutoNeg
 -------
 (Supported only on adapters with copper connections)
@@ -106,7 +55,6 @@ Duplex parameters must not be specified.
 NOTE:  Refer to the Speed and Duplex section of this readme for more
        information on the AutoNeg parameter.
 
-
 Duplex
 ------
 (Supported only on adapters with copper connections)
@@ -119,7 +67,6 @@ set to auto-negotiate, the board auto-detects the correct duplex.  If the
 link partner is forced (either full or half), Duplex defaults to half-
 duplex.
 
-
 FlowControl
 -----------
 Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
@@ -128,16 +75,16 @@ Default Value: Reads flow control settings from the EEPROM
 This parameter controls the automatic generation(Tx) and response(Rx)
 to Ethernet PAUSE frames.
 
-
 InterruptThrottleRate
 ---------------------
 (not supported on Intel(R) 82542, 82543 or 82544-based adapters)
-Valid Range:   0,1,3,100-100000 (0=off, 1=dynamic, 3=dynamic conservative)
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
 Default Value: 3
 
 The driver can limit the amount of interrupts per second that the adapter
-will generate for incoming packets. It does this by writing a value to the 
-adapter that is based on the maximum amount of interrupts that the adapter 
+will generate for incoming packets. It does this by writing a value to the
+adapter that is based on the maximum amount of interrupts that the adapter
 will generate per second.
 
 Setting InterruptThrottleRate to a value greater or equal to 100
@@ -146,37 +93,43 @@ per second, even if more packets have come in. This reduces interrupt
 load on the system and can lower CPU utilization under heavy load,
 but will increase latency as packets are not processed as quickly.
 
-The default behaviour of the driver previously assumed a static 
-InterruptThrottleRate value of 8000, providing a good fallback value for 
-all traffic types,but lacking in small packet performance and latency. 
-The hardware can handle many more small packets per second however, and 
+The default behaviour of the driver previously assumed a static
+InterruptThrottleRate value of 8000, providing a good fallback value for
+all traffic types,but lacking in small packet performance and latency.
+The hardware can handle many more small packets per second however, and
 for this reason an adaptive interrupt moderation algorithm was implemented.
 
 Since 7.3.x, the driver has two adaptive modes (setting 1 or 3) in which
-it dynamically adjusts the InterruptThrottleRate value based on the traffic 
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
 that it receives. After determining the type of incoming traffic in the last
-timeframe, it will adjust the InterruptThrottleRate to an appropriate value 
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
 for that traffic.
 
 The algorithm classifies the incoming traffic every interval into
-classes.  Once the class is determined, the InterruptThrottleRate value is 
-adjusted to suit that traffic type the best. There are three classes defined: 
+classes.  Once the class is determined, the InterruptThrottleRate value is
+adjusted to suit that traffic type the best. There are three classes defined:
 "Bulk traffic", for large amounts of packets of normal size; "Low latency",
 for small amounts of traffic and/or a significant percentage of small
-packets; and "Lowest latency", for almost completely small packets or 
+packets; and "Lowest latency", for almost completely small packets or
 minimal traffic.
 
-In dynamic conservative mode, the InterruptThrottleRate value is set to 4000 
-for traffic that falls in class "Bulk traffic". If traffic falls in the "Low 
-latency" or "Lowest latency" class, the InterruptThrottleRate is increased 
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
 stepwise to 20000. This default mode is suitable for most applications.
 
 For situations where low latency is vital such as cluster or
 grid computing, the algorithm can reduce latency even more when
 InterruptThrottleRate is set to mode 1. In this mode, which operates
-the same as mode 3, the InterruptThrottleRate will be increased stepwise to 
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
 70000 for traffic in class "Lowest latency".
 
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal, the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
+
 Setting InterruptThrottleRate to 0 turns off any interrupt moderation
 and may improve small packet latency, but is generally not suitable
 for bulk throughput traffic.
@@ -212,8 +165,6 @@ NOTE:  When e1000 is loaded with default settings and multiple adapters
        be platform-specific.  If CPU utilization is not a concern, use
        RX_POLLING (NAPI) and default driver settings.
 
-
-
 RxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -225,15 +176,14 @@ by the driver.  Increasing this value allows the driver to buffer more
 incoming packets, at the expense of increased system memory utilization.
 
 Each descriptor is 16 bytes.  A receive buffer is also allocated for each
-descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending 
+descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending
 on the MTU setting. The maximum MTU size is 16110.
 
-NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo 
-       Frames.  Depending on the available system resources, the request 
-       for a higher number of receive descriptors may be denied.  In this 
+NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo
+       Frames.  Depending on the available system resources, the request
+       for a higher number of receive descriptors may be denied.  In this
        case, use a lower number.
 
-
 RxIntDelay
 ----------
 Valid Range:   0-65535 (0=off)
@@ -254,7 +204,6 @@ CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
           restoring the network connection.  To eliminate the potential
           for the hang ensure that RxIntDelay is set to 0.
 
-
 RxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -268,7 +217,6 @@ packet is received within the set amount of time.  Proper tuning,
 along with RxIntDelay, may improve traffic throughput in specific network
 conditions.
 
-
 Speed
 -----
 (This parameter is supported only on adapters with copper connections.)
@@ -280,7 +228,6 @@ Speed forces the line speed to the specified value in megabits per second
 partner is set to auto-negotiate, the board will auto-detect the correct
 speed.  Duplex should also be set when Speed is set to either 10 or 100.
 
-
 TxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -295,6 +242,36 @@ NOTE:  Depending on the available system resources, the request for a
        higher number of transmit descriptors may be denied.  In this case,
        use a lower number.
 
+TxDescriptorStep
+----------------
+Valid Range:    1 (use every Tx Descriptor)
+                4 (use every 4th Tx Descriptor)
+
+Default Value:  1 (use every Tx Descriptor)
+
+On certain non-Intel architectures, it has been observed that intense TX
+traffic bursts of short packets may result in an improper descriptor
+writeback. If this occurs, the driver will report a "TX Timeout" and reset
+the adapter, after which the transmit flow will restart, though data may
+have stalled for as much as 10 seconds before it resumes.
+
+The improper writeback does not occur on the first descriptor in a system
+memory cache-line, which is typically 32 bytes, or 4 descriptors long.
+
+Setting TxDescriptorStep to a value of 4 will ensure that all TX descriptors
+are aligned to the start of a system memory cache line, and so this problem
+will not occur.
+
+NOTES: Setting TxDescriptorStep to 4 effectively reduces the number of
+       TxDescriptors available for transmits to 1/4 of the normal allocation.
+       This has a possible negative performance impact, which may be
+       compensated for by allocating more descriptors using the TxDescriptors
+       module parameter.
+
+       There are other conditions which may result in "TX Timeout", which will
+       not be resolved by the use of the TxDescriptorStep parameter. As the
+       issue addressed by this parameter has never been observed on Intel
+       Architecture platforms, it should not be used on Intel platforms.
 
 TxIntDelay
 ----------
@@ -307,7 +284,6 @@ efficiency if properly tuned for specific network traffic.  If the
 system is reporting dropped transmits, this value may be set too high
 causing the driver to run out of available transmit descriptors.
 
-
 TxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -330,6 +306,35 @@ Default Value: 1
 A value of '1' indicates that the driver should enable IP checksum
 offload for received packets (both UDP and TCP) to the adapter hardware.
 
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+Usage: insmod e1000.ko copybreak=128
+
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000/parameters/copybreak
+
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+
+Allows PHY to turn off in lower power states. The user can turn off
+this parameter in supported chipsets.
+
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
 
 Speed and Duplex Configuration
 ==============================
@@ -385,40 +390,9 @@ If the link partner is forced to a specific speed and duplex, then this
 parameter should not be used.  Instead, use the Speed and Duplex parameters
 previously mentioned to force the adapter to the same speed and duplex.
 
-
 Additional Configurations
 =========================
 
-  Configuring the Driver on Different Distributions
-  -------------------------------------------------
-  Configuring a network driver to load properly when the system is started
-  is distribution dependent.  Typically, the configuration process involves
-  adding an alias line to /etc/modules.conf or /etc/modprobe.conf as well
-  as editing other system startup scripts and/or configuration files.  Many
-  popular Linux distributions ship with tools to make these changes for you.
-  To learn the proper way to configure a network device for your system,
-  refer to your distribution documentation.  If during this process you are
-  asked for the driver or module name, the name for the Linux Base Driver
-  for the Intel(R) PRO/1000 Family of Adapters is e1000.
-
-  As an example, if you install the e1000 driver for two PRO/1000 adapters
-  (eth0 and eth1) and set the speed and duplex to 10full and 100half, add
-  the following to modules.conf or or modprobe.conf:
-
-       alias eth0 e1000
-       alias eth1 e1000
-       options e1000 Speed=10,100 Duplex=2,1
-
-  Viewing Link Messages
-  ---------------------
-  Link messages will not be displayed to the console if the distribution is
-  restricting system messages.  In order to see network driver link messages
-  on your console, set dmesg to eight by entering the following:
-
-       dmesg -n 8
-
-  NOTE: This setting is not saved across reboots.
-
   Jumbo Frames
   ------------
   Jumbo Frames support is enabled by changing the MTU to a value larger than
@@ -437,9 +411,11 @@ Additional Configurations
    setting in a different location.
 
   Notes:
-
-  - To enable Jumbo Frames, increase the MTU size on the interface beyond
-    1500.
+  Degradation in throughput performance may be observed in some Jumbo frames
+  environments. If this is observed, increasing the application's socket buffer
+  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
+  See the specific application manual and /usr/src/linux*/Documentation/
+  networking/ip-sysctl.txt for more details.
 
   - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
     with the maximum Jumbo Frames size of 16128.
@@ -447,40 +423,11 @@ Additional Configurations
   - Using Jumbo Frames at 10 or 100 Mbps may result in poor performance or
     loss of link.
 
-  - Some Intel gigabit adapters that support Jumbo Frames have a frame size
-    limit of 9238 bytes, with a corresponding MTU size limit of 9216 bytes.
-    The adapters with this limitation are based on the Intel(R) 82571EB,
-    82572EI, 82573L and 80003ES2LAN controller.  These correspond to the
-    following product names:
-     Intel(R) PRO/1000 PT Server Adapter
-     Intel(R) PRO/1000 PT Desktop Adapter
-     Intel(R) PRO/1000 PT Network Connection
-     Intel(R) PRO/1000 PT Dual Port Server Adapter
-     Intel(R) PRO/1000 PT Dual Port Network Connection
-     Intel(R) PRO/1000 PF Server Adapter
-     Intel(R) PRO/1000 PF Network Connection
-     Intel(R) PRO/1000 PF Dual Port Server Adapter
-     Intel(R) PRO/1000 PB Server Connection
-     Intel(R) PRO/1000 PL Network Connection
-     Intel(R) PRO/1000 EB Network Connection with I/O Acceleration
-     Intel(R) PRO/1000 EB Backplane Connection with I/O Acceleration
-     Intel(R) PRO/1000 PT Quad Port Server Adapter
-
   - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
     support Jumbo Frames. These correspond to the following product names:
      Intel(R) PRO/1000 Gigabit Server Adapter
      Intel(R) PRO/1000 PM Network Connection
 
-  - The following adapters do not support Jumbo Frames:
-     Intel(R) 82562V 10/100 Network Connection
-     Intel(R) 82566DM Gigabit Network Connection
-     Intel(R) 82566DC Gigabit Network Connection
-     Intel(R) 82566MM Gigabit Network Connection
-     Intel(R) 82566MC Gigabit Network Connection
-     Intel(R) 82562GT 10/100 Network Connection
-     Intel(R) 82562G 10/100 Network Connection
-
-
   Ethtool
   -------
   The driver utilizes the ethtool interface for driver configuration and
@@ -490,142 +437,14 @@ Additional Configurations
   The latest release of ethtool can be found from
   http://sourceforge.net/projects/gkernel.
 
-  NOTE: Ethtool 1.6 only supports a limited set of ethtool options.  Support
-  for a more complete ethtool feature set can be enabled by upgrading
-  ethtool to ethtool-1.8.1.
-
   Enabling Wake on LAN* (WoL)
   ---------------------------
-  WoL is configured through the Ethtool* utility.  Ethtool is included with
-  all versions of Red Hat after Red Hat 7.2.  For other Linux distributions,
-  download and install Ethtool from the following website:
-  http://sourceforge.net/projects/gkernel.
-
-  For instructions on enabling WoL with Ethtool, refer to the website listed
-  above.
+  WoL is configured through the Ethtool* utility.
 
   WoL will be enabled on the system during the next shut down or reboot.
   For this driver version, in order to enable WoL, the e1000 driver must be
   loaded when shutting down or rebooting the system.
 
-  Wake On LAN is only supported on port A for the following devices:
-  Intel(R) PRO/1000 PT Dual Port Network Connection
-  Intel(R) PRO/1000 PT Dual Port Server Connection
-  Intel(R) PRO/1000 PT Dual Port Server Adapter
-  Intel(R) PRO/1000 PF Dual Port Server Adapter
-  Intel(R) PRO/1000 PT Quad Port Server Adapter
-
-  NAPI
-  ----
-  NAPI (Rx polling mode) is enabled in the e1000 driver.
-
-  See www.cyberus.ca/~hadi/usenix-paper.tgz for more information on NAPI.
-
-
-Known Issues
-============
-
-Dropped Receive Packets on Half-duplex 10/100 Networks
-------------------------------------------------------
-If you have an Intel PCI Express adapter running at 10mbps or 100mbps, half-
-duplex, you may observe occasional dropped receive packets.  There are no
-workarounds for this problem in this network configuration.  The network must
-be updated to operate in full-duplex, and/or 1000mbps only.
-
-Jumbo Frames System Requirement
--------------------------------
-Memory allocation failures have been observed on Linux systems with 64 MB
-of RAM or less that are running Jumbo Frames.  If you are using Jumbo
-Frames, your system may require more than the advertised minimum
-requirement of 64 MB of system memory.
-
-Performance Degradation with Jumbo Frames
------------------------------------------
-Degradation in throughput performance may be observed in some Jumbo frames
-environments.  If this is observed, increasing the application's socket
-buffer size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values
-may help.  See the specific application manual and
-/usr/src/linux*/Documentation/
-networking/ip-sysctl.txt for more details.
-
-Jumbo Frames on Foundry BigIron 8000 switch
--------------------------------------------
-There is a known issue using Jumbo frames when connected to a Foundry
-BigIron 8000 switch.  This is a 3rd party limitation.  If you experience
-loss of packets, lower the MTU size.
-
-Allocating Rx Buffers when Using Jumbo Frames 
----------------------------------------------
-Allocating Rx buffers when using Jumbo Frames on 2.6.x kernels may fail if 
-the available memory is heavily fragmented. This issue may be seen with PCI-X 
-adapters or with packet split disabled. This can be reduced or eliminated 
-by changing the amount of available memory for receive buffer allocation, by
-increasing /proc/sys/vm/min_free_kbytes. 
-
-Multiple Interfaces on Same Ethernet Broadcast Network
-------------------------------------------------------
-Due to the default ARP behavior on Linux, it is not possible to have
-one system on two IP networks in the same Ethernet broadcast domain
-(non-partitioned switch) behave as expected.  All Ethernet interfaces
-will respond to IP traffic for any IP address assigned to the system.
-This results in unbalanced receive traffic.
-
-If you have multiple interfaces in a server, either turn on ARP
-filtering by entering:
-
-    echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
-(this only works if your kernel's version is higher than 2.4.5),
-
-NOTE: This setting is not saved across reboots.  The configuration
-change can be made permanent by adding the line:
-    net.ipv4.conf.all.arp_filter = 1
-to the file /etc/sysctl.conf
-
-      or,
-
-install the interfaces in separate broadcast domains (either in
-different switches or in a switch partitioned to VLANs).
-
-82541/82547 can't link or are slow to link with some link partners
------------------------------------------------------------------
-There is a known compatibility issue with 82541/82547 and some
-low-end switches where the link will not be established, or will
-be slow to establish.  In particular, these switches are known to
-be incompatible with 82541/82547:
-
-    Planex FXG-08TE
-    I-O Data ETG-SH8
-
-To workaround this issue, the driver can be compiled with an override
-of the PHY's master/slave setting.  Forcing master or forcing slave
-mode will improve time-to-link.
-
-    # make CFLAGS_EXTRA=-DE1000_MASTER_SLAVE=<n>
-
-Where <n> is:
-
-    0 = Hardware default
-    1 = Master mode
-    2 = Slave mode
-    3 = Auto master/slave
-
-Disable rx flow control with ethtool
-------------------------------------
-In order to disable receive flow control using ethtool, you must turn
-off auto-negotiation on the same command line.
-
-For example:
-
-   ethtool -A eth? autoneg off rx off
-
-Unplugging network cable while ethtool -p is running
-----------------------------------------------------
-In kernel versions 2.5.50 and later (including 2.6 kernel), unplugging
-the network cable while ethtool -p is running will cause the system to
-become unresponsive to keyboard commands, except for control-alt-delete.
-Restarting the system appears to be the only remedy.
-
-
 Support
 =======
 
diff --git a/Documentation/networking/e1000e.txt b/Documentation/networking/e1000e.txt
new file mode 100644
index 000000000000..6aa048badf32
--- /dev/null
+++ b/Documentation/networking/e1000e.txt
@@ -0,0 +1,302 @@
+Linux* Driver for Intel(R) Network Connection
+===============================================================
+
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
+
+Contents
+========
+
+- Identifying Your Adapter
+- Command Line Parameters
+- Additional Configurations
+- Support
+
+Identifying Your Adapter
+========================
+
+The e1000e driver supports all PCI Express Intel(R) Gigabit Network
+Connections, except those that are 82575, 82576 and 82580-based*.
+
+* NOTE: The Intel(R) PRO/1000 P Dual Port Server Adapter is supported by
+  the e1000 driver, not the e1000e driver due to the 82546 part being used
+  behind a PCI Express bridge.
+
+For more information on how to identify your adapter, go to the Adapter &
+Driver ID Guide at:
+
+    http://support.intel.com/support/go/network/adapter/idguide.htm
+
+For the latest Intel network drivers for Linux, refer to the following
+website.  In the search field, enter your adapter name or type, or use the
+networking link on the left to search for your adapter:
+
+    http://support.intel.com/support/go/network/adapter/home.htm
+
+Command Line Parameters
+=======================
+
+The default value for each parameter is generally the recommended setting,
+unless otherwise noted.
+
+NOTES:  For more information about the InterruptThrottleRate,
+        RxIntDelay, TxIntDelay, RxAbsIntDelay, and TxAbsIntDelay
+        parameters, see the application note at:
+        http://www.intel.com/design/network/applnots/ap450.htm
+
+InterruptThrottleRate
+---------------------
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
+Default Value: 3
+
+The driver can limit the amount of interrupts per second that the adapter
+will generate for incoming packets. It does this by writing a value to the
+adapter that is based on the maximum amount of interrupts that the adapter
+will generate per second.
+
+Setting InterruptThrottleRate to a value greater or equal to 100
+will program the adapter to send out a maximum of that many interrupts
+per second, even if more packets have come in. This reduces interrupt
+load on the system and can lower CPU utilization under heavy load,
+but will increase latency as packets are not processed as quickly.
+
+The driver has two adaptive modes (setting 1 or 3) in which
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
+that it receives. After determining the type of incoming traffic in the last
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
+for that traffic.
+
+The algorithm classifies the incoming traffic every interval into
+classes.  Once the class is determined, the InterruptThrottleRate value is
+adjusted to suit that traffic type the best. There are three classes defined:
+"Bulk traffic", for large amounts of packets of normal size; "Low latency",
+for small amounts of traffic and/or a significant percentage of small
+packets; and "Lowest latency", for almost completely small packets or
+minimal traffic.
+
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
+stepwise to 20000. This default mode is suitable for most applications.
+
+For situations where low latency is vital such as cluster or
+grid computing, the algorithm can reduce latency even more when
+InterruptThrottleRate is set to mode 1. In this mode, which operates
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
+70000 for traffic in class "Lowest latency".
+
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
+
+Setting InterruptThrottleRate to 0 turns off any interrupt moderation
+and may improve small packet latency, but is generally not suitable
+for bulk throughput traffic.
+
+NOTE:  InterruptThrottleRate takes precedence over the TxAbsIntDelay and
+       RxAbsIntDelay parameters.  In other words, minimizing the receive
+       and/or transmit absolute delays does not force the controller to
+       generate more interrupts than what the Interrupt Throttle Rate
+       allows.
+
+NOTE:  When e1000e is loaded with default settings and multiple adapters
+       are in use simultaneously, the CPU utilization may increase non-
+       linearly.  In order to limit the CPU utilization without impacting
+       the overall throughput, we recommend that you load the driver as
+       follows:
+
+           modprobe e1000e InterruptThrottleRate=3000,3000,3000
+
+       This sets the InterruptThrottleRate to 3000 interrupts/sec for
+       the first, second, and third instances of the driver.  The range
+       of 2000 to 3000 interrupts per second works on a majority of
+       systems and is a good starting point, but the optimal value will
+       be platform-specific.  If CPU utilization is not a concern, use
+       RX_POLLING (NAPI) and default driver settings.
+
+RxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 0
+
+This value delays the generation of receive interrupts in units of 1.024
+microseconds.  Receive interrupt reduction can improve CPU efficiency if
+properly tuned for specific network traffic.  Increasing this value adds
+extra latency to frame reception and can end up decreasing the throughput
+of TCP traffic.  If the system is reporting dropped receives, this value
+may be set too high, causing the driver to run out of available receive
+descriptors.
+
+CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
+          hang (stop transmitting) under certain network conditions.  If
+          this occurs a NETDEV WATCHDOG message is logged in the system
+          event log.  In addition, the controller is automatically reset,
+          restoring the network connection.  To eliminate the potential
+          for the hang ensure that RxIntDelay is set to 0.
+
+RxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+
+This value, in units of 1.024 microseconds, limits the delay in which a
+receive interrupt is generated.  Useful only if RxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is received within the set amount of time.  Proper tuning,
+along with RxIntDelay, may improve traffic throughput in specific network
+conditions.
+
+TxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+
+This value delays the generation of transmit interrupts in units of
+1.024 microseconds.  Transmit interrupt reduction can improve CPU
+efficiency if properly tuned for specific network traffic.  If the
+system is reporting dropped transmits, this value may be set too high
+causing the driver to run out of available transmit descriptors.
+
+TxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 32
+
+This value, in units of 1.024 microseconds, limits the delay in which a
+transmit interrupt is generated.  Useful only if TxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is sent on the wire within the set amount of time.  Proper tuning,
+along with TxIntDelay, may improve traffic throughput in specific
+network conditions.
+
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000e/parameters/copybreak
+
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+
+Allows PHY to turn off in lower power states. The user can set this parameter
+in supported chipsets.
+
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
+
+IntMode
+-------
+Valid Range: 0-2 (0=legacy, 1=MSI, 2=MSI-X)
+Default Value: 2
+
+Allows changing the interrupt mode at module load time, without requiring a
+recompile. If the driver load fails to enable a specific interrupt mode, the
+driver will try other interrupt modes, from least to most compatible.  The
+interrupt order is MSI-X, MSI, Legacy.  If specifying MSI (IntMode=1)
+interrupts, only MSI and Legacy will be attempted.
+
+CrcStripping
+------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+
+Strip the CRC from received packets before sending up the network stack.  If
+you have a machine with a BMC enabled but cannot receive IPMI traffic after
+loading or enabling the driver, try disabling this feature.
+
+WriteProtectNVM
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+
+Set the hardware to ignore all write/erase cycles to the GbE region in the
+ICHx NVM (non-volatile memory).  This feature can be disabled by the
+WriteProtectNVM module parameter (enabled by default) only after a hardware
+reset, but the machine must be power cycled before trying to enable writes.
+
+Note: the kernel boot option iomem=relaxed may need to be set if the kernel
+config option CONFIG_STRICT_DEVMEM=y, if the root user wants to write the
+NVM from user space via ethtool.
+
+Additional Configurations
+=========================
+
+  Jumbo Frames
+  ------------
+  Jumbo Frames support is enabled by changing the MTU to a value larger than
+  the default of 1500.  Use the ifconfig command to increase the MTU size.
+  For example:
+
+       ifconfig eth<x> mtu 9000 up
+
+  This setting is not saved across reboots.
+
+  Notes:
+
+  - The maximum MTU setting for Jumbo Frames is 9216.  This value coincides
+    with the maximum Jumbo Frames size of 9234 bytes.
+
+  - Using Jumbo Frames at 10 or 100 Mbps is not supported and may result in
+    poor performance or loss of link.
+
+  - Some adapters limit Jumbo Frames sized packets to a maximum of
+    4096 bytes and some adapters do not support Jumbo Frames.
+
+
+  Ethtool
+  -------
+  The driver utilizes the ethtool interface for driver configuration and
+  diagnostics, as well as displaying statistical information.  We
+  strongly recommend downloading the latest version of Ethtool at:
+
+  http://sourceforge.net/projects/gkernel.
+
+  Speed and Duplex
+  ----------------
+  Speed and Duplex are configured through the Ethtool* utility. For
+  instructions,  refer to the Ethtool man page.
+
+  Enabling Wake on LAN* (WoL)
+  ---------------------------
+  WoL is configured through the Ethtool* utility. For instructions on
+  enabling WoL with Ethtool, refer to the Ethtool man page.
+
+  WoL will be enabled on the system during the next shut down or reboot.
+  For this driver version, in order to enable WoL, the e1000e driver must be
+  loaded when shutting down or rebooting the system.
+
+  In most cases Wake On LAN is only supported on port A for multiple port
+  adapters. To verify if a port supports Wake on LAN run ethtool eth<X>.
+
+
+Support
+=======
+
+For general information, go to the Intel support website at:
+
+    www.intel.com/support/
+
+or the Intel Wired Networking project hosted by Sourceforge at:
+
+    http://sourceforge.net/projects/e1000
+
+If an issue is identified with the released source code on the supported
+kernel with a supported adapter, email the specific information related
+to the issue to e1000-devel@lists.sf.net
diff --git a/Documentation/networking/ixgbevf.txt b/Documentation/networking/ixgbevf.txt
index 19015de6725f..21dd5d15b6b4 100755..100644
--- a/Documentation/networking/ixgbevf.txt
+++ b/Documentation/networking/ixgbevf.txt
@@ -1,19 +1,16 @@
 Linux* Base Driver for Intel(R) Network Connection
 ==================================================
 
-November 24, 2009
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 
 Contents
 ========
 
-- In This Release
 - Identifying Your Adapter
 - Known Issues/Troubleshooting
 - Support
 
-In This Release
-===============
-
 This file describes the ixgbevf Linux* Base Driver for Intel Network
 Connection.
 
@@ -33,7 +30,7 @@ Identifying Your Adapter
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
 
-    http://support.intel.com/support/network/sb/CS-008441.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 
 Known Issues/Troubleshooting
 ============================
@@ -57,34 +54,3 @@ or the Intel Wired Networking project hosted by Sourceforge at:
 If an issue is identified with the released source code on the supported
 kernel with a supported adapter, email the specific information related
 to the issue to e1000-devel@lists.sf.net
-
-License
-=======
-
-Intel 10 Gigabit Linux driver.
-Copyright(c) 1999 - 2009 Intel Corporation.
-
-This program is free software; you can redistribute it and/or modify it
-under the terms and conditions of the GNU General Public License,
-version 2, as published by the Free Software Foundation.
-
-This program is distributed in the hope it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details.
-
-You should have received a copy of the GNU General Public License along with
-this program; if not, write to the Free Software Foundation, Inc.,
-51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-
-The full GNU General Public License is included in this distribution in
-the file called "COPYING".
-
-Trademarks
-==========
-
-Intel, Itanium, and Pentium are trademarks or registered trademarks of
-Intel Corporation or its subsidiaries in the United States and other
-countries.
-
-* Other names and brands may be claimed as the property of others.
diff --git a/Documentation/vm/page-types.c b/Documentation/vm/page-types.c
index ccd951fa94ee..cc96ee2666f2 100644
--- a/Documentation/vm/page-types.c
+++ b/Documentation/vm/page-types.c
@@ -478,7 +478,7 @@ static void prepare_hwpoison_fd(void)
         }
 
         if (opt_unpoison && !hwpoison_forget_fd) {
-                sprintf(buf, "%s/renew-pfn", hwpoison_debug_fs);
+                sprintf(buf, "%s/unpoison-pfn", hwpoison_debug_fs);
                 hwpoison_forget_fd = checked_open(buf, O_WRONLY);
         }
 }
diff --git a/MAINTAINERS b/MAINTAINERS
index 5e1169df8c1f..7c4f879e42aa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -962,6 +962,23 @@ W:	http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/mach-s3c6410/
 
+ARM/S5P ARM ARCHITECTURES
+M:      Kukjin Kim <kgene.kim@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-s5p*/
+
+ARM/SAMSUNG S5P SERIES FIMC SUPPORT
+M:      Kyungmin Park <kyungmin.park@samsung.com>
+M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org
+L:      linux-media@vger.kernel.org
+S:      Maintained
+F:      arch/arm/plat-s5p/dev-fimc*
+F:      arch/arm/plat-samsung/include/plat/*fimc*
+F:      drivers/media/video/s5p-fimc/
+
 ARM/SHMOBILE ARM ARCHITECTURE
 M:      Paul Mundt <lethal@linux-sh.org>
 M:      Magnus Damm <magnus.damm@gmail.com>
@@ -2537,7 +2554,7 @@ S:	Supported
 F:      drivers/scsi/gdt*
 
 GENERIC GPIO I2C DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Haavard Skinnemoen <hskinnemoen@gmail.com>
 S:      Supported
 F:      drivers/i2c/busses/i2c-gpio.c
 F:      include/linux/i2c-gpio.h
@@ -3065,16 +3082,27 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ixp2000/
 
-INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe)
+INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe/ixgbevf)
 M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
 M:      Jesse Brandeburg <jesse.brandeburg@intel.com>
 M:      Bruce Allan <bruce.w.allan@intel.com>
-M:      Alex Duyck <alexander.h.duyck@intel.com>
+M:      Carolyn Wyborny <carolyn.wyborny@intel.com>
+M:      Don Skidmore <donald.c.skidmore@intel.com>
+M:      Greg Rose <gregory.v.rose@intel.com>
 M:      PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>
+M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://e1000.sourceforge.net/
 S:      Supported
+F:      Documentation/networking/e100.txt
+F:      Documentation/networking/e1000.txt
+F:      Documentation/networking/e1000e.txt
+F:      Documentation/networking/igb.txt
+F:      Documentation/networking/igbvf.txt
+F:      Documentation/networking/ixgb.txt
+F:      Documentation/networking/ixgbe.txt
+F:      Documentation/networking/ixgbevf.txt
 F:      drivers/net/e100.c
 F:      drivers/net/e1000/
 F:      drivers/net/e1000e/
@@ -3082,6 +3110,7 @@ F:	drivers/net/igb/
 F:      drivers/net/igbvf/
 F:      drivers/net/ixgb/
 F:      drivers/net/ixgbe/
+F:      drivers/net/ixgbevf/
 
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
 L:      linux-wireless@vger.kernel.org
@@ -3790,9 +3819,8 @@ W:	http://www.syskonnect.com
 S:      Supported
 
 MATROX FRAMEBUFFER DRIVER
-M:      Petr Vandrovec <vandrove@vc.cvut.cz>
 L:      linux-fbdev@vger.kernel.org
-S:      Maintained
+S:      Orphan
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
 
@@ -3934,8 +3962,10 @@ S:	Supported
 F:      drivers/mfd/
 
 MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND SDIO SUBSYSTEM
-S:      Orphan
+M:      Chris Ball <cjb@laptop.org>
 L:      linux-mmc@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc.git
+S:      Maintained
 F:      drivers/mmc/
 F:      include/linux/mmc/
 
@@ -3977,8 +4007,8 @@ S:	Maintained
 F:      drivers/net/natsemi.c
 
 NCP FILESYSTEM
-M:      Petr Vandrovec <vandrove@vc.cvut.cz>
-S:      Maintained
+M:      Petr Vandrovec <petr@vandrovec.name>
+S:      Odd Fixes
 F:      fs/ncpfs/
 
 NCR DUAL 700 SCSI DRIVER (MICROCHANNEL)
@@ -5009,6 +5039,12 @@ F:	drivers/media/common/saa7146*
 F:      drivers/media/video/*7146*
 F:      include/media/*7146*
 
+SAMSUNG AUDIO (ASoC) DRIVERS
+M:      Jassi Brar <jassi.brar@samsung.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Supported
+F:      sound/soc/s3c24xx
+
 TLG2300 VIDEO4LINUX-2 DRIVER
 M:      Huang Shijie <shijie8@gmail.com>
 M:      Kang Yong <kangyong@telegent.com>
@@ -5106,8 +5142,10 @@ S:	Maintained
 F:      drivers/mmc/host/sdricoh_cs.c
 
 SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) DRIVER
-S:      Orphan
+M:      Chris Ball <cjb@laptop.org>
 L:      linux-mmc@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc.git
+S:      Maintained
 F:      drivers/mmc/host/sdhci.*
 
 SECURE DIGITAL HOST CONTROLLER INTERFACE, OPEN FIRMWARE BINDINGS (SDHCI-OF)
@@ -6449,8 +6487,10 @@ F:	include/linux/wm97xx.h
 WOLFSON MICROELECTRONICS DRIVERS
 M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
 M:      Ian Lartey <ian@opensource.wolfsonmicro.com>
+M:      Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
+T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
-W:      http://opensource.wolfsonmicro.com/node/8
+W:      http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
 S:      Supported
 F:      Documentation/hwmon/wm83??
 F:      drivers/leds/leds-wm83*.c
diff --git a/Makefile b/Makefile
index 3133a5772eeb..7583116e5d9a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 36
-EXTRAVERSION = -rc5
-NAME = Sheep on Meth
+EXTRAVERSION = -rc8
+NAME = Flesh-Eating Bats with Fangs
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
index d1273c1a1364..6d159cee5f2f 100644
--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -915,15 +915,6 @@ sys_execve:
 .end sys_execve
 
         .align  4
-        .globl  osf_sigprocmask
-        .ent    osf_sigprocmask
-osf_sigprocmask:
-        .prologue 0
-        mov     $sp, $18
-        jmp     $31, sys_osf_sigprocmask
-.end osf_sigprocmask
-
-        .align  4
         .globl  alpha_ni_syscall
         .ent    alpha_ni_syscall
 alpha_ni_syscall:
diff --git a/arch/alpha/kernel/signal.c b/arch/alpha/kernel/signal.c
index 0f6b51ae865a..6f7feb5db271 100644
--- a/arch/alpha/kernel/signal.c
+++ b/arch/alpha/kernel/signal.c
@@ -41,46 +41,20 @@ static void do_signal(struct pt_regs *, struct switch_stack *,
 /*
  * The OSF/1 sigprocmask calling sequence is different from the
  * C sigprocmask() sequence..
- *
- * how:
- * 1 - SIG_BLOCK
- * 2 - SIG_UNBLOCK
- * 3 - SIG_SETMASK
- *
- * We change the range to -1 .. 1 in order to let gcc easily
- * use the conditional move instructions.
- *
- * Note that we don't need to acquire the kernel lock for SMP
- * operation, as all of this is local to this thread.
  */
-SYSCALL_DEFINE3(osf_sigprocmask, int, how, unsigned long, newmask,
-                struct pt_regs *, regs)
+SYSCALL_DEFINE2(osf_sigprocmask, int, how, unsigned long, newmask)
 {
-        unsigned long oldmask = -EINVAL;
-
-        if ((unsigned long)how-1 <= 2) {
-                long sign = how-2;              /* -1 .. 1 */
-                unsigned long block, unblock;
-
-                newmask &= _BLOCKABLE;
-                spin_lock_irq(&current->sighand->siglock);
-                oldmask = current->blocked.sig[0];
-
-                unblock = oldmask & ~newmask;
-                block = oldmask | newmask;
-                if (!sign)
-                        block = unblock;
-                if (sign <= 0)
-                        newmask = block;
-                if (_NSIG_WORDS > 1 && sign > 0)
-                        sigemptyset(&current->blocked);
-                current->blocked.sig[0] = newmask;
-                recalc_sigpending();
-                spin_unlock_irq(&current->sighand->siglock);
-
-                regs->r0 = 0;           /* special no error return */
+        sigset_t oldmask;
+        sigset_t mask;
+        unsigned long res;
+
+        siginitset(&mask, newmask & _BLOCKABLE);
+        res = sigprocmask(how, &mask, &oldmask);
+        if (!res) {
+                force_successful_syscall_return();
+                res = oldmask.sig[0];
         }
-        return oldmask;
+        return res;
 }
 
 SYSCALL_DEFINE3(osf_sigaction, int, sig,
@@ -94,9 +68,9 @@ SYSCALL_DEFINE3(osf_sigaction, int, sig,
                 old_sigset_t mask;
                 if (!access_ok(VERIFY_READ, act, sizeof(*act)) ||
                     __get_user(new_ka.sa.sa_handler, &act->sa_handler) ||
-                    __get_user(new_ka.sa.sa_flags, &act->sa_flags))
+                    __get_user(new_ka.sa.sa_flags, &act->sa_flags) ||
+                    __get_user(mask, &act->sa_mask))
                         return -EFAULT;
-                __get_user(mask, &act->sa_mask);
                 siginitset(&new_ka.sa.sa_mask, mask);
                 new_ka.ka_restorer = NULL;
         }
@@ -106,9 +80,9 @@ SYSCALL_DEFINE3(osf_sigaction, int, sig,
         if (!ret && oact) {
                 if (!access_ok(VERIFY_WRITE, oact, sizeof(*oact)) ||
                     __put_user(old_ka.sa.sa_handler, &oact->sa_handler) ||
-                    __put_user(old_ka.sa.sa_flags, &oact->sa_flags))
+                    __put_user(old_ka.sa.sa_flags, &oact->sa_flags) ||
+                    __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask))
                         return -EFAULT;
-                __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
         }
 
         return ret;
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index ce594ef533cc..a6a1de9db16f 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -58,7 +58,7 @@ sys_call_table:
         .quad sys_open                          /* 45 */
         .quad alpha_ni_syscall
         .quad sys_getxgid
-        .quad osf_sigprocmask
+        .quad sys_osf_sigprocmask
         .quad alpha_ni_syscall
         .quad alpha_ni_syscall                  /* 50 */
         .quad sys_acct
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 553b7cf17bfb..9c26ba7244fb 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -271,7 +271,6 @@ config ARCH_AT91
         bool "Atmel AT91"
         select ARCH_REQUIRE_GPIOLIB
         select HAVE_CLK
-        select ARCH_USES_GETTIMEOFFSET
         help
           This enables support for systems based on the Atmel AT91RM9200,
           AT91SAM9 and AT91CAP9 processors.
@@ -1051,6 +1050,32 @@ config ARM_ERRATA_460075
           ACTLR register. Note that setting specific bits in the ACTLR register
           may not be available in non-secure mode.
 
+config ARM_ERRATA_742230
+        bool "ARM errata: DMB operation may be faulty"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for the 742230 Cortex-A9
+          (r1p0..r2p2) erratum. Under rare circumstances, a DMB instruction
+          between two write operations may not ensure the correct visibility
+          ordering of the two writes. This workaround sets a specific bit in
+          the diagnostic register of the Cortex-A9 which causes the DMB
+          instruction to behave as a DSB, ensuring the correct behaviour of
+          the two writes.
+
+config ARM_ERRATA_742231
+        bool "ARM errata: Incorrect hazard handling in the SCU may lead to data corruption"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for the 742231 Cortex-A9
+          (r2p0..r2p2) erratum. Under certain conditions, specific to the
+          Cortex-A9 MPCore micro-architecture, two CPUs working in SMP mode,
+          accessing some data located in the same cache line, may get corrupted
+          data due to bad handling of the address hazard when the line gets
+          replaced from one of the CPUs at the same time as another CPU is
+          accessing it. This workaround sets specific bits in the diagnostic
+          register of the Cortex-A9 which reduces the linefill issuing
+          capabilities of the processor.
+
 config PL310_ERRATA_588369
         bool "Clean & Invalidate maintenance operations do not invalidate clean lines"
         depends on CACHE_L2X0 && ARCH_OMAP4
@@ -1076,6 +1101,20 @@ config ARM_ERRATA_720789
           invalidated are not, resulting in an incoherency in the system page
           tables. The workaround changes the TLB flushing routines to invalidate
           entries regardless of the ASID.
+
+config ARM_ERRATA_743622
+        bool "ARM errata: Faulty hazard checking in the Store Buffer may lead to data corruption"
+        depends on CPU_V7
+        help
+          This option enables the workaround for the 743622 Cortex-A9
+          (r2p0..r2p2) erratum. Under very rare conditions, a faulty
+          optimisation in the Cortex-A9 Store Buffer may lead to data
+          corruption. This workaround sets a specific bit in the diagnostic
+          register of the Cortex-A9 which disables the Store Buffer
+          optimisation, preventing the defect from occurring. This has no
+          visible impact on the overall performance or power consumption of the
+          processor.
+
 endmenu
 
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/boot/compressed/Makefile b/arch/arm/boot/compressed/Makefile
index b23f6bc46cfa..65a7c1c588a9 100644
--- a/arch/arm/boot/compressed/Makefile
+++ b/arch/arm/boot/compressed/Makefile
@@ -116,5 +116,5 @@ CFLAGS_font.o := -Dstatic=
 $(obj)/font.c: $(FONTC)
         $(call cmd,shipped)
 
-$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/arm/boot/Makefile .config
+$(obj)/vmlinux.lds: $(obj)/vmlinux.lds.in arch/arm/boot/Makefile $(KCONFIG_CONFIG)
         @sed "$(SEDFLAGS)" < $< > $@
diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
index ab68cf1ef80f..e90b167ea848 100644
--- a/arch/arm/include/asm/pgtable.h
+++ b/arch/arm/include/asm/pgtable.h
@@ -317,6 +317,10 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
 #ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
 #define pgprot_dmacoherent(prot) \
         __pgprot_modify(prot, L_PTE_MT_MASK|L_PTE_EXEC, L_PTE_MT_BUFFERABLE)
+#define __HAVE_PHYS_MEM_ACCESS_PROT
+struct file;
+extern pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+                                     unsigned long size, pgprot_t vma_prot);
 #else
 #define pgprot_dmacoherent(prot) \
         __pgprot_modify(prot, L_PTE_MT_MASK|L_PTE_EXEC, L_PTE_MT_UNCACHED)
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 1b560825e1cf..7885722bdf4e 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -48,6 +48,8 @@ work_pending:
         beq     no_work_pending
         mov     r0, sp                          @ 'regs'
         mov     r2, why                         @ 'syscall'
+        tst     r1, #_TIF_SIGPENDING            @ delivering a signal?
+        movne   why, #0                         @ prevent further restarts
         bl      do_notify_resume
         b       ret_slow_syscall                @ Check work again
 
diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
index 8bccbfa693ff..2c1f0050c9c4 100644
--- a/arch/arm/kernel/kprobes-decode.c
+++ b/arch/arm/kernel/kprobes-decode.c
@@ -1162,11 +1162,12 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
         /*
          * MSR   : cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx
-         * Undef : cccc 0011 0x00 xxxx xxxx xxxx xxxx xxxx
+         * Undef : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx
          * ALU op with S bit and Rd == 15 :
          *         cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx
          */
-        if ((insn & 0x0f900000) == 0x03200000 ||        /* MSR & Undef */
+        if ((insn & 0x0fb00000) == 0x03200000 ||        /* MSR */
+            (insn & 0x0ff00000) == 0x03400000 ||        /* Undef */
             (insn & 0x0e10f000) == 0x0210f000)          /* ALU s-bit, R15  */
                 return INSN_REJECTED;
 
@@ -1177,7 +1178,7 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
          * *S (bit 20) updates condition codes
          * ADC/SBC/RSC reads the C flag
          */
-        insn &= 0xfff00fff;     /* Rn = r0, Rd = r0 */
+        insn &= 0xffff0fff;     /* Rd = r0 */
         asi->insn[0] = insn;
         asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                         emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index 5e71ccd5e7d3..1276babf84d5 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -426,7 +426,7 @@ static struct i2c_gpio_platform_data pdata_i2c0 = {
         .sda_is_open_drain      = 1,
         .scl_pin                = AT91_PIN_PA21,
         .scl_is_open_drain      = 1,
-        .udelay                 = 2,            /* ~100 kHz */
+        .udelay                 = 5,            /* ~100 kHz */
 };
 
 static struct platform_device at91sam9g45_twi0_device = {
@@ -440,7 +440,7 @@ static struct i2c_gpio_platform_data pdata_i2c1 = {
         .sda_is_open_drain      = 1,
         .scl_pin                = AT91_PIN_PB11,
         .scl_is_open_drain      = 1,
-        .udelay                 = 2,            /* ~100 kHz */
+        .udelay                 = 5,            /* ~100 kHz */
 };
 
 static struct platform_device at91sam9g45_twi1_device = {
diff --git a/arch/arm/mach-at91/include/mach/system.h b/arch/arm/mach-at91/include/mach/system.h
index c80e090b3670..ee8db152592e 100644
--- a/arch/arm/mach-at91/include/mach/system.h
+++ b/arch/arm/mach-at91/include/mach/system.h
@@ -28,17 +28,16 @@
 
 static inline void arch_idle(void)
 {
-#ifndef CONFIG_DEBUG_KERNEL
         /*
          * Disable the processor clock.  The processor will be automatically
          * re-enabled by an interrupt or by a reset.
          */
         at91_sys_write(AT91_PMC_SCDR, AT91_PMC_PCK);
-#else
+#ifndef CONFIG_CPU_ARM920T
         /*
          * Set the processor (CP15) into 'Wait for Interrupt' mode.
-         * Unlike disabling the processor clock via the PMC (above)
-         *  this allows the processor to be woken via JTAG.
+         * Post-RM9200 processors need this in conjunction with the above
+         * to save power when idle.
          */
         cpu_do_idle();
 #endif
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index 3d996b659ff4..9be261beae7d 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -769,8 +769,7 @@ static struct map_desc dm355_io_desc[] = {
                 .virtual        = SRAM_VIRT,
                 .pfn            = __phys_to_pfn(0x00010000),
                 .length         = SZ_32K,
-                /* MT_MEMORY_NONCACHED requires supersection alignment */
-                .type           = MT_DEVICE,
+                .type           = MT_MEMORY_NONCACHED,
         },
 };
 
diff --git a/arch/arm/mach-davinci/dm365.c b/arch/arm/mach-davinci/dm365.c
index 6b6f4c643709..7781e35daec3 100644
--- a/arch/arm/mach-davinci/dm365.c
+++ b/arch/arm/mach-davinci/dm365.c
@@ -969,8 +969,7 @@ static struct map_desc dm365_io_desc[] = {
                 .virtual        = SRAM_VIRT,
                 .pfn            = __phys_to_pfn(0x00010000),
                 .length         = SZ_32K,
-                /* MT_MEMORY_NONCACHED requires supersection alignment */
-                .type           = MT_DEVICE,
+                .type           = MT_MEMORY_NONCACHED,
         },
 };
 
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 40fec315c99a..5e5b0a7831fb 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -653,8 +653,7 @@ static struct map_desc dm644x_io_desc[] = {
                 .virtual        = SRAM_VIRT,
                 .pfn            = __phys_to_pfn(0x00008000),
                 .length         = SZ_16K,
-                /* MT_MEMORY_NONCACHED requires supersection alignment */
-                .type           = MT_DEVICE,
+                .type           = MT_MEMORY_NONCACHED,
         },
 };
 
diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c
index e4a3df1872ac..26e8a9c7f50b 100644
--- a/arch/arm/mach-davinci/dm646x.c
+++ b/arch/arm/mach-davinci/dm646x.c
@@ -737,8 +737,7 @@ static struct map_desc dm646x_io_desc[] = {
                 .virtual        = SRAM_VIRT,
                 .pfn            = __phys_to_pfn(0x00010000),
                 .length         = SZ_32K,
-                /* MT_MEMORY_NONCACHED requires supersection alignment */
-                .type           = MT_DEVICE,
+                .type           = MT_MEMORY_NONCACHED,
         },
 };
 
diff --git a/arch/arm/mach-dove/include/mach/io.h b/arch/arm/mach-dove/include/mach/io.h
index 3b3e4721ce2e..eb4936ff90ad 100644
--- a/arch/arm/mach-dove/include/mach/io.h
+++ b/arch/arm/mach-dove/include/mach/io.h
@@ -13,8 +13,8 @@
 
 #define IO_SPACE_LIMIT          0xffffffff
 
-#define __io(a)  ((void __iomem *)(((a) - DOVE_PCIE0_IO_PHYS_BASE) +\
-                                   DOVE_PCIE0_IO_VIRT_BASE))
-#define __mem_pci(a)            (a)
+#define __io(a)         ((void __iomem *)(((a) - DOVE_PCIE0_IO_BUS_BASE) + \
+                                                 DOVE_PCIE0_IO_VIRT_BASE))
+#define __mem_pci(a)    (a)
 
 #endif
diff --git a/arch/arm/mach-ep93xx/dma-m2p.c b/arch/arm/mach-ep93xx/dma-m2p.c
index 8904ca4e2e24..a696d354b1f8 100644
--- a/arch/arm/mach-ep93xx/dma-m2p.c
+++ b/arch/arm/mach-ep93xx/dma-m2p.c
@@ -276,7 +276,7 @@ static void channel_disable(struct m2p_channel *ch)
         v &= ~(M2P_CONTROL_STALL_IRQ_EN | M2P_CONTROL_NFB_IRQ_EN);
         m2p_set_control(ch, v);
 
-        while (m2p_channel_state(ch) == STATE_ON)
+        while (m2p_channel_state(ch) >= STATE_ON)
                 cpu_relax();
 
         m2p_set_control(ch, 0x0);
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index c5c0369bb481..2f7e2728970d 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -122,6 +122,7 @@ config MACH_CPUIMX27
         select IMX_HAVE_PLATFORM_IMX_I2C
         select IMX_HAVE_PLATFORM_IMX_UART
         select IMX_HAVE_PLATFORM_MXC_NAND
+        select MXC_ULPI if USB_ULPI
         help
           Include support for Eukrea CPUIMX27 platform. This includes
           specific configurations for the module and its peripherals.
diff --git a/arch/arm/mach-imx/mach-cpuimx27.c b/arch/arm/mach-imx/mach-cpuimx27.c
index 339150ab0ea5..6830afd1d2ba 100644
--- a/arch/arm/mach-imx/mach-cpuimx27.c
+++ b/arch/arm/mach-imx/mach-cpuimx27.c
@@ -259,7 +259,7 @@ static void __init eukrea_cpuimx27_init(void)
         i2c_register_board_info(0, eukrea_cpuimx27_i2c_devices,
                                 ARRAY_SIZE(eukrea_cpuimx27_i2c_devices));
 
-        imx27_add_i2c_imx1(&cpuimx27_i2c1_data);
+        imx27_add_i2c_imx0(&cpuimx27_i2c1_data);
 
         platform_add_devices(platform_devices, ARRAY_SIZE(platform_devices));
 
diff --git a/arch/arm/mach-kirkwood/include/mach/kirkwood.h b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
index 93fc2ec95e76..6e924b398919 100644
--- a/arch/arm/mach-kirkwood/include/mach/kirkwood.h
+++ b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
@@ -38,7 +38,7 @@
 
 #define KIRKWOOD_PCIE1_IO_PHYS_BASE     0xf3000000
 #define KIRKWOOD_PCIE1_IO_VIRT_BASE     0xfef00000
-#define KIRKWOOD_PCIE1_IO_BUS_BASE      0x00000000
+#define KIRKWOOD_PCIE1_IO_BUS_BASE      0x00100000
 #define KIRKWOOD_PCIE1_IO_SIZE          SZ_1M
 
 #define KIRKWOOD_PCIE_IO_PHYS_BASE      0xf2000000
diff --git a/arch/arm/mach-kirkwood/pcie.c b/arch/arm/mach-kirkwood/pcie.c
index 55e7f00836b7..513ad3102d7c 100644
--- a/arch/arm/mach-kirkwood/pcie.c
+++ b/arch/arm/mach-kirkwood/pcie.c
@@ -117,7 +117,7 @@ static void __init pcie0_ioresources_init(struct pcie_port *pp)
          * IORESOURCE_IO
          */
         pp->res[0].name = "PCIe 0 I/O Space";
-        pp->res[0].start = KIRKWOOD_PCIE_IO_PHYS_BASE;
+        pp->res[0].start = KIRKWOOD_PCIE_IO_BUS_BASE;
         pp->res[0].end = pp->res[0].start + KIRKWOOD_PCIE_IO_SIZE - 1;
         pp->res[0].flags = IORESOURCE_IO;
 
@@ -139,7 +139,7 @@ static void __init pcie1_ioresources_init(struct pcie_port *pp)
          * IORESOURCE_IO
          */
         pp->res[0].name = "PCIe 1 I/O Space";
-        pp->res[0].start = KIRKWOOD_PCIE1_IO_PHYS_BASE;
+        pp->res[0].start = KIRKWOOD_PCIE1_IO_BUS_BASE;
         pp->res[0].end = pp->res[0].start + KIRKWOOD_PCIE1_IO_SIZE - 1;
         pp->res[0].flags = IORESOURCE_IO;
 
diff --git a/arch/arm/mach-mmp/include/mach/system.h b/arch/arm/mach-mmp/include/mach/system.h
index 4f5b0e0ce6cf..1a8a25edb1b4 100644
--- a/arch/arm/mach-mmp/include/mach/system.h
+++ b/arch/arm/mach-mmp/include/mach/system.h
@@ -9,6 +9,8 @@
 #ifndef __ASM_MACH_SYSTEM_H
 #define __ASM_MACH_SYSTEM_H
 
+#include <mach/cputype.h>
+
 static inline void arch_idle(void)
 {
         cpu_do_idle();
@@ -16,6 +18,9 @@ static inline void arch_idle(void)
 
 static inline void arch_reset(char mode, const char *cmd)
 {
-        cpu_reset(0);
+        if (cpu_is_pxa168())
+                cpu_reset(0xffff0000);
+        else
+                cpu_reset(0);
 }
 #endif /* __ASM_MACH_SYSTEM_H */
diff --git a/arch/arm/mach-pxa/cpufreq-pxa2xx.c b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
index 50d5939a78f1..58093d9e07be 100644
--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
@@ -312,8 +312,7 @@ static int pxa_set_target(struct cpufreq_policy *policy,
         freqs.cpu = policy->cpu;
 
         if (freq_debug)
-                pr_debug(KERN_INFO "Changing CPU frequency to %d Mhz, "
-                         "(SDRAM %d Mhz)\n",
+                pr_debug("Changing CPU frequency to %d Mhz, (SDRAM %d Mhz)\n",
                          freqs.new / 1000, (pxa_freq_settings[idx].div2) ?
                          (new_freq_mem / 2000) : (new_freq_mem / 1000));
 
diff --git a/arch/arm/mach-pxa/include/mach/hardware.h b/arch/arm/mach-pxa/include/mach/hardware.h
index 428cc7bda9a4..814f1458a06a 100644
--- a/arch/arm/mach-pxa/include/mach/hardware.h
+++ b/arch/arm/mach-pxa/include/mach/hardware.h
@@ -264,23 +264,35 @@
  * <= 0x2 for pxa21x/pxa25x/pxa26x/pxa27x
  * == 0x3 for pxa300/pxa310/pxa320
  */
+#if defined(CONFIG_PXA25x) || defined(CONFIG_PXA27x)
 #define __cpu_is_pxa2xx(id)                             \
         ({                                              \
                 unsigned int _id = (id) >> 13 & 0x7;    \
                 _id <= 0x2;                             \
          })
+#else
+#define __cpu_is_pxa2xx(id)     (0)
+#endif
 
+#ifdef CONFIG_PXA3xx
 #define __cpu_is_pxa3xx(id)                             \
         ({                                              \
                 unsigned int _id = (id) >> 13 & 0x7;    \
                 _id == 0x3;                             \
          })
+#else
+#define __cpu_is_pxa3xx(id)     (0)
+#endif
 
+#if defined(CONFIG_CPU_PXA930) || defined(CONFIG_CPU_PXA935)
 #define __cpu_is_pxa93x(id)                             \
         ({                                              \
                 unsigned int _id = (id) >> 4 & 0xfff;   \
                 _id == 0x683 || _id == 0x693;           \
          })
+#else
+#define __cpu_is_pxa93x(id)     (0)
+#endif
 
 #define cpu_is_pxa2xx()                                 \
         ({                                              \
diff --git a/arch/arm/mach-pxa/palm27x.c b/arch/arm/mach-pxa/palm27x.c
index 77ad6d34ab5b..405b92a29793 100644
--- a/arch/arm/mach-pxa/palm27x.c
+++ b/arch/arm/mach-pxa/palm27x.c
@@ -469,9 +469,13 @@ static struct i2c_board_info __initdata palm27x_pi2c_board_info[] = {
         },
 };
 
+static struct i2c_pxa_platform_data palm27x_i2c_power_info = {
+        .use_pio        = 1,
+};
+
 void __init palm27x_pmic_init(void)
 {
         i2c_register_board_info(1, ARRAY_AND_SIZE(palm27x_pi2c_board_info));
-        pxa27x_set_i2c_power_info(NULL);
+        pxa27x_set_i2c_power_info(&palm27x_i2c_power_info);
 }
 #endif
diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
index c9b747cedea8..37d6173bbb66 100644
--- a/arch/arm/mach-pxa/vpac270.c
+++ b/arch/arm/mach-pxa/vpac270.c
@@ -240,6 +240,7 @@ static void __init vpac270_onenand_init(void) {}
 #if defined(CONFIG_MMC_PXA) || defined(CONFIG_MMC_PXA_MODULE)
 static struct pxamci_platform_data vpac270_mci_platform_data = {
         .ocr_mask               = MMC_VDD_32_33 | MMC_VDD_33_34,
+        .gpio_power             = -1,
         .gpio_card_detect       = GPIO53_VPAC270_SD_DETECT_N,
         .gpio_card_ro           = GPIO52_VPAC270_SD_READONLY,
         .detect_delay_ms        = 200,
diff --git a/arch/arm/mach-s5p6440/cpu.c b/arch/arm/mach-s5p6440/cpu.c
index 526f33adb31d..ec592e866054 100644
--- a/arch/arm/mach-s5p6440/cpu.c
+++ b/arch/arm/mach-s5p6440/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5p6442/cpu.c b/arch/arm/mach-s5p6442/cpu.c
index a48fb553fd01..70ac681af72b 100644
--- a/arch/arm/mach-s5p6442/cpu.c
+++ b/arch/arm/mach-s5p6442/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5pc100/cpu.c b/arch/arm/mach-s5pc100/cpu.c
index 251c92ac5b22..cd1afbce83e2 100644
--- a/arch/arm/mach-s5pc100/cpu.c
+++ b/arch/arm/mach-s5pc100/cpu.c
@@ -21,6 +21,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index cfecd70657cb..d562670e1b0b 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -173,11 +173,6 @@ static int s5pv210_clk_ip3_ctrl(struct clk *clk, int enable)
         return s5p_gatectrl(S5P_CLKGATE_IP3, clk, enable);
 }
 
-static int s5pv210_clk_ip4_ctrl(struct clk *clk, int enable)
-{
-        return s5p_gatectrl(S5P_CLKGATE_IP4, clk, enable);
-}
-
 static int s5pv210_clk_mask0_ctrl(struct clk *clk, int enable)
 {
         return s5p_gatectrl(S5P_CLK_SRC_MASK0, clk, enable);
diff --git a/arch/arm/mach-s5pv210/cpu.c b/arch/arm/mach-s5pv210/cpu.c
index 77f456c91ad3..245b82b53df4 100644
--- a/arch/arm/mach-s5pv210/cpu.c
+++ b/arch/arm/mach-s5pv210/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/io.h>
 #include <linux/sysdev.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-u300/include/mach/gpio.h b/arch/arm/mach-u300/include/mach/gpio.h
index 7b1fc984abb6..d5a71abcbaea 100644
--- a/arch/arm/mach-u300/include/mach/gpio.h
+++ b/arch/arm/mach-u300/include/mach/gpio.h
@@ -273,6 +273,9 @@ extern void gpio_pullup(unsigned gpio, int value);
 extern int gpio_get_value(unsigned gpio);
 extern void gpio_set_value(unsigned gpio, int value);
 
+#define gpio_get_value_cansleep gpio_get_value
+#define gpio_set_value_cansleep gpio_set_value
+
 /* wrappers to sleep-enable the previous two functions */
 static inline unsigned gpio_to_irq(unsigned gpio)
 {
diff --git a/arch/arm/mach-vexpress/ct-ca9x4.c b/arch/arm/mach-vexpress/ct-ca9x4.c
index 577df6cccb08..71fb17349520 100644
--- a/arch/arm/mach-vexpress/ct-ca9x4.c
+++ b/arch/arm/mach-vexpress/ct-ca9x4.c
@@ -68,7 +68,7 @@ static void __init ct_ca9x4_init_irq(void)
 }
 
 #if 0
-static void ct_ca9x4_timer_init(void)
+static void __init ct_ca9x4_timer_init(void)
 {
         writel(0, MMIO_P2V(CT_CA9X4_TIMER0) + TIMER_CTRL);
         writel(0, MMIO_P2V(CT_CA9X4_TIMER1) + TIMER_CTRL);
@@ -222,12 +222,18 @@ static struct platform_device pmu_device = {
         .resource       = pmu_resources,
 };
 
-static void ct_ca9x4_init(void)
+static void __init ct_ca9x4_init(void)
 {
         int i;
 
 #ifdef CONFIG_CACHE_L2X0
-        l2x0_init(MMIO_P2V(CT_CA9X4_L2CC), 0x00000000, 0xfe0fffff);
+        void __iomem *l2x0_base = MMIO_P2V(CT_CA9X4_L2CC);
+
+        /* set RAM latencies to 1 cycle for this core tile. */
+        writel(0, l2x0_base + L2X0_TAG_LATENCY_CTRL);
+        writel(0, l2x0_base + L2X0_DATA_LATENCY_CTRL);
+
+        l2x0_init(l2x0_base, 0x00400000, 0xfe0fffff);
 #endif
 
         clkdev_add_table(lookups, ARRAY_SIZE(lookups));
diff --git a/arch/arm/mach-vexpress/v2m.c b/arch/arm/mach-vexpress/v2m.c
index 817f0ad38a0b..7eaa232180a5 100644
--- a/arch/arm/mach-vexpress/v2m.c
+++ b/arch/arm/mach-vexpress/v2m.c
@@ -48,7 +48,7 @@ void __init v2m_map_io(struct map_desc *tile, size_t num)
 }
 
 
-static void v2m_timer_init(void)
+static void __init v2m_timer_init(void)
 {
         writel(0, MMIO_P2V(V2M_TIMER0) + TIMER_CTRL);
         writel(0, MMIO_P2V(V2M_TIMER1) + TIMER_CTRL);
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index d073b64ae87e..724ba3bce72c 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -885,8 +885,23 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 
         if (ai_usermode & UM_SIGNAL)
                 force_sig(SIGBUS, current);
-        else
-                set_cr(cr_no_alignment);
+        else {
+                /*
+                 * We're about to disable the alignment trap and return to
+                 * user space.  But if an interrupt occurs before actually
+                 * reaching user space, then the IRQ vector entry code will
+                 * notice that we were still in kernel space and therefore
+                 * the alignment trap won't be re-enabled in that case as it
+                 * is presumed to be always on from kernel space.
+                 * Let's prevent that race by disabling interrupts here (they
+                 * are disabled on the way back to user space anyway in
+                 * entry-common.S) and disable the alignment trap only if
+                 * there is no work pending for this thread.
+                 */
+                raw_local_irq_disable();
+                if (!(current_thread_info()->flags & _TIF_WORK_MASK))
+                        set_cr(cr_no_alignment);
+        }
 
         return 0;
 }
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index ab506272b2d3..17e7b0b57e49 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -204,8 +204,12 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned long pfn,
         /*
          * Don't allow RAM to be mapped - this causes problems with ARMv6+
          */
-        if (WARN_ON(pfn_valid(pfn)))
-                return NULL;
+        if (pfn_valid(pfn)) {
+                printk(KERN_WARNING "BUG: Your driver calls ioremap() on system memory.  This leads\n"
+                       KERN_WARNING "to architecturally unpredictable behaviour on ARMv6+, and ioremap()\n"
+                       KERN_WARNING "will fail in the next kernel release.  Please fix your driver.\n");
+                WARN_ON(1);
+        }
 
         type = get_mem_type(mtype);
         if (!type)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 6e1c4f6a2b3f..e8ed9dc461fe 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -15,6 +15,7 @@
 #include <linux/nodemask.h>
 #include <linux/memblock.h>
 #include <linux/sort.h>
+#include <linux/fs.h>
 
 #include <asm/cputype.h>
 #include <asm/sections.h>
@@ -246,6 +247,9 @@ static struct mem_type mem_types[] = {
                 .domain    = DOMAIN_USER,
         },
         [MT_MEMORY] = {
+                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
+                                L_PTE_WRITE | L_PTE_EXEC,
+                .prot_l1   = PMD_TYPE_TABLE,
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                 .domain    = DOMAIN_KERNEL,
         },
@@ -254,6 +258,9 @@ static struct mem_type mem_types[] = {
                 .domain    = DOMAIN_KERNEL,
         },
         [MT_MEMORY_NONCACHED] = {
+                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
+                                L_PTE_WRITE | L_PTE_EXEC | L_PTE_MT_BUFFERABLE,
+                .prot_l1   = PMD_TYPE_TABLE,
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                 .domain    = DOMAIN_KERNEL,
         },
@@ -411,9 +418,12 @@ static void __init build_mem_type_table(void)
          * Enable CPU-specific coherency if supported.
          * (Only available on XSC3 at the moment.)
          */
-        if (arch_is_coherent() && cpu_is_xsc3())
+        if (arch_is_coherent() && cpu_is_xsc3()) {
                 mem_types[MT_MEMORY].prot_sect |= PMD_SECT_S;
-
+                mem_types[MT_MEMORY].prot_pte |= L_PTE_SHARED;
+                mem_types[MT_MEMORY_NONCACHED].prot_sect |= PMD_SECT_S;
+                mem_types[MT_MEMORY_NONCACHED].prot_pte |= L_PTE_SHARED;
+        }
         /*
          * ARMv6 and above have extended page tables.
          */
@@ -438,7 +448,9 @@ static void __init build_mem_type_table(void)
                 mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_S;
                 mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_SHARED;
                 mem_types[MT_MEMORY].prot_sect |= PMD_SECT_S;
+                mem_types[MT_MEMORY].prot_pte |= L_PTE_SHARED;
                 mem_types[MT_MEMORY_NONCACHED].prot_sect |= PMD_SECT_S;
+                mem_types[MT_MEMORY_NONCACHED].prot_pte |= L_PTE_SHARED;
 #endif
         }
 
@@ -475,6 +487,8 @@ static void __init build_mem_type_table(void)
         mem_types[MT_LOW_VECTORS].prot_l1 |= ecc_mask;
         mem_types[MT_HIGH_VECTORS].prot_l1 |= ecc_mask;
         mem_types[MT_MEMORY].prot_sect |= ecc_mask | cp->pmd;
+        mem_types[MT_MEMORY].prot_pte |= kern_pgprot;
+        mem_types[MT_MEMORY_NONCACHED].prot_sect |= ecc_mask;
         mem_types[MT_ROM].prot_sect |= cp->pmd;
 
         switch (cp->pmd) {
@@ -498,6 +512,19 @@ static void __init build_mem_type_table(void)
         }
 }
 
+#ifdef CONFIG_ARM_DMA_MEM_BUFFERABLE
+pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+                              unsigned long size, pgprot_t vma_prot)
+{
+        if (!pfn_valid(pfn))
+                return pgprot_noncached(vma_prot);
+        else if (file->f_flags & O_SYNC)
+                return pgprot_writecombine(vma_prot);
+        return vma_prot;
+}
+EXPORT_SYMBOL(phys_mem_access_prot);
+#endif
+
 #define vectors_base()  (vectors_high() ? 0xffff0000 : 0)
 
 static void __init *early_alloc(unsigned long sz)
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 6a8506d99ee9..197f21bed5e9 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -186,13 +186,14 @@ cpu_v7_name:
  *      It is assumed that:
  *      - cache type register is implemented
  */
-__v7_setup:
+__v7_ca9mp_setup:
 #ifdef CONFIG_SMP
         mrc     p15, 0, r0, c1, c0, 1
         tst     r0, #(1 << 6)                   @ SMP/nAMP mode enabled?
         orreq   r0, r0, #(1 << 6) | (1 << 0)    @ Enable SMP/nAMP mode and
         mcreq   p15, 0, r0, c1, c0, 1           @ TLB ops broadcasting
 #endif
+__v7_setup:
         adr     r12, __v7_setup_stack           @ the local stack
         stmia   r12, {r0-r5, r7, r9, r11, lr}
         bl      v7_flush_dcache_all
@@ -201,11 +202,16 @@ __v7_setup:
         mrc     p15, 0, r0, c0, c0, 0           @ read main ID register
         and     r10, r0, #0xff000000            @ ARM?
         teq     r10, #0x41000000
-        bne     2f
+        bne     3f
         and     r5, r0, #0x00f00000             @ variant
         and     r6, r0, #0x0000000f             @ revision
-        orr     r0, r6, r5, lsr #20-4           @ combine variant and revision
+        orr     r6, r6, r5, lsr #20-4           @ combine variant and revision
+        ubfx    r0, r0, #4, #12                 @ primary part number
 
+        /* Cortex-A8 Errata */
+        ldr     r10, =0x00000c08                @ Cortex-A8 primary part number
+        teq     r0, r10
+        bne     2f
 #ifdef CONFIG_ARM_ERRATA_430973
         teq     r5, #0x00100000                 @ only present in r1p*
         mrceq   p15, 0, r10, c1, c0, 1          @ read aux control register
@@ -213,21 +219,50 @@ __v7_setup:
         mcreq   p15, 0, r10, c1, c0, 1          @ write aux control register
 #endif
 #ifdef CONFIG_ARM_ERRATA_458693
-        teq     r0, #0x20                       @ only present in r2p0
+        teq     r6, #0x20                       @ only present in r2p0
         mrceq   p15, 0, r10, c1, c0, 1          @ read aux control register
         orreq   r10, r10, #(1 << 5)             @ set L1NEON to 1
         orreq   r10, r10, #(1 << 9)             @ set PLDNOP to 1
         mcreq   p15, 0, r10, c1, c0, 1          @ write aux control register
 #endif
 #ifdef CONFIG_ARM_ERRATA_460075
-        teq     r0, #0x20                       @ only present in r2p0
+        teq     r6, #0x20                       @ only present in r2p0
         mrceq   p15, 1, r10, c9, c0, 2          @ read L2 cache aux ctrl register
         tsteq   r10, #1 << 22
         orreq   r10, r10, #(1 << 22)            @ set the Write Allocate disable bit
         mcreq   p15, 1, r10, c9, c0, 2          @ write the L2 cache aux ctrl register
 #endif
+        b       3f
 
-2:      mov     r10, #0
+        /* Cortex-A9 Errata */
+2:      ldr     r10, =0x00000c09                @ Cortex-A9 primary part number
+        teq     r0, r10
+        bne     3f
+#ifdef CONFIG_ARM_ERRATA_742230
+        cmp     r6, #0x22                       @ only present up to r2p2
+        mrcle   p15, 0, r10, c15, c0, 1         @ read diagnostic register
+        orrle   r10, r10, #1 << 4               @ set bit #4
+        mcrle   p15, 0, r10, c15, c0, 1         @ write diagnostic register
+#endif
+#ifdef CONFIG_ARM_ERRATA_742231
+        teq     r6, #0x20                       @ present in r2p0
+        teqne   r6, #0x21                       @ present in r2p1
+        teqne   r6, #0x22                       @ present in r2p2
+        mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
+        orreq   r10, r10, #1 << 12              @ set bit #12
+        orreq   r10, r10, #1 << 22              @ set bit #22
+        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
+#endif
+#ifdef CONFIG_ARM_ERRATA_743622
+        teq     r6, #0x20                       @ present in r2p0
+        teqne   r6, #0x21                       @ present in r2p1
+        teqne   r6, #0x22                       @ present in r2p2
+        mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
+        orreq   r10, r10, #1 << 6               @ set bit #6
+        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
+#endif
+
+3:      mov     r10, #0
 #ifdef HARVARD_CACHE
         mcr     p15, 0, r10, c7, c5, 0          @ I+BTB cache invalidate
 #endif
@@ -323,6 +358,29 @@ cpu_elf_name:
 
         .section ".proc.info.init", #alloc, #execinstr
 
+        .type   __v7_ca9mp_proc_info, #object
+__v7_ca9mp_proc_info:
+        .long   0x410fc090              @ Required ID value
+        .long   0xff0ffff0              @ Mask for ID
+        .long   PMD_TYPE_SECT | \
+                PMD_SECT_AP_WRITE | \
+                PMD_SECT_AP_READ | \
+                PMD_FLAGS
+        .long   PMD_TYPE_SECT | \
+                PMD_SECT_XN | \
+                PMD_SECT_AP_WRITE | \
+                PMD_SECT_AP_READ
+        b       __v7_ca9mp_setup
+        .long   cpu_arch_name
+        .long   cpu_elf_name
+        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_TLS
+        .long   cpu_v7_name
+        .long   v7_processor_functions
+        .long   v7wbi_tlb_fns
+        .long   v6_user_fns
+        .long   v7_cache_fns
+        .size   __v7_ca9mp_proc_info, . - __v7_ca9mp_proc_info
+
         /*
          * Match any ARMv7 processor core.
          */
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 0691176899ff..72e09eb642dd 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -102,6 +102,7 @@ static int op_create_counter(int cpu, int event)
         if (IS_ERR(pevent)) {
                 ret = PTR_ERR(pevent);
         } else if (pevent->state != PERF_EVENT_STATE_ACTIVE) {
+                perf_event_release_kernel(pevent);
                 pr_warning("oprofile: failed to enable event %d "
                                 "on CPU %d\n", event, cpu);
                 ret = -EBUSY;
@@ -365,6 +366,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         ret = init_driverfs();
         if (ret) {
                 kfree(counter_config);
+                counter_config = NULL;
                 return ret;
         }
 
@@ -402,7 +404,6 @@ void oprofile_arch_exit(void)
         struct perf_event *event;
 
         if (*perf_events) {
-                exit_driverfs();
                 for_each_possible_cpu(cpu) {
                         for (id = 0; id < perf_num_counters; ++id) {
                                 event = perf_events[cpu][id];
@@ -413,8 +414,10 @@ void oprofile_arch_exit(void)
                 }
         }
 
-        if (counter_config)
+        if (counter_config) {
                 kfree(counter_config);
+                exit_driverfs();
+        }
 }
 #else
 int __init oprofile_arch_init(struct oprofile_operations *ops)
diff --git a/arch/arm/plat-nomadik/timer.c b/arch/arm/plat-nomadik/timer.c
index ea3ca86c5283..aedf9c1d645e 100644
--- a/arch/arm/plat-nomadik/timer.c
+++ b/arch/arm/plat-nomadik/timer.c
@@ -1,5 +1,5 @@
 /*
- *  linux/arch/arm/mach-nomadik/timer.c
+ *  linux/arch/arm/plat-nomadik/timer.c
  *
  * Copyright (C) 2008 STMicroelectronics
  * Copyright (C) 2010 Alessandro Rubini
@@ -75,7 +75,7 @@ static void nmdk_clkevt_mode(enum clock_event_mode mode,
                 cr = readl(mtu_base + MTU_CR(1));
                 writel(0, mtu_base + MTU_LR(1));
                 writel(cr | MTU_CRn_ENA, mtu_base + MTU_CR(1));
-                writel(0x2, mtu_base + MTU_IMSC);
+                writel(1 << 1, mtu_base + MTU_IMSC);
                 break;
         case CLOCK_EVT_MODE_SHUTDOWN:
         case CLOCK_EVT_MODE_UNUSED:
@@ -131,25 +131,23 @@ void __init nmdk_timer_init(void)
 {
         unsigned long rate;
         struct clk *clk0;
-        struct clk *clk1;
-        u32 cr;
+        u32 cr = MTU_CRn_32BITS;
 
         clk0 = clk_get_sys("mtu0", NULL);
         BUG_ON(IS_ERR(clk0));
 
-        clk1 = clk_get_sys("mtu1", NULL);
-        BUG_ON(IS_ERR(clk1));
-
         clk_enable(clk0);
-        clk_enable(clk1);
 
         /*
-         * Tick rate is 2.4MHz for Nomadik and 110MHz for ux500:
-         * use a divide-by-16 counter if it's more than 16MHz
+         * Tick rate is 2.4MHz for Nomadik and 2.4Mhz, 100MHz or 133 MHz
+         * for ux500.
+         * Use a divide-by-16 counter if the tick rate is more than 32MHz.
+         * At 32 MHz, the timer (with 32 bit counter) can be programmed
+         * to wake-up at a max 127s a head in time. Dividing a 2.4 MHz timer
+         * with 16 gives too low timer resolution.
          */
-        cr = MTU_CRn_32BITS;;
         rate = clk_get_rate(clk0);
-        if (rate > 16 << 20) {
+        if (rate > 32000000) {
                 rate /= 16;
                 cr |= MTU_CRn_PRESCALE_16;
         } else {
@@ -170,15 +168,8 @@ void __init nmdk_timer_init(void)
                 pr_err("timer: failed to initialize clock source %s\n",
                        nmdk_clksrc.name);
 
-        /* Timer 1 is used for events, fix according to rate */
-        cr = MTU_CRn_32BITS;
-        rate = clk_get_rate(clk1);
-        if (rate > 16 << 20) {
-                rate /= 16;
-                cr |= MTU_CRn_PRESCALE_16;
-        } else {
-                cr |= MTU_CRn_PRESCALE_1;
-        }
+        /* Timer 1 is used for events */
+
         clockevents_calc_mult_shift(&nmdk_clkevt, rate, MTU_MIN_RANGE);
 
         writel(cr | MTU_CRn_ONESHOT, mtu_base + MTU_CR(1)); /* off, currently */
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index e39a417a368d..a92cb499313f 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -33,7 +33,7 @@ config OMAP_DEBUG_DEVICES
 config OMAP_DEBUG_LEDS
         bool
         depends on OMAP_DEBUG_DEVICES
-        default y if LEDS
+        default y if LEDS_CLASS
 
 config OMAP_RESET_CLOCKS
         bool "Reset unused clocks during boot"
diff --git a/arch/arm/plat-omap/iommu.c b/arch/arm/plat-omap/iommu.c
index a202a2ce6e3d..6cd151b31bc5 100644
--- a/arch/arm/plat-omap/iommu.c
+++ b/arch/arm/plat-omap/iommu.c
@@ -320,6 +320,7 @@ void flush_iotlb_page(struct iommu *obj, u32 da)
                 if ((start <= da) && (da < start + bytes)) {
                         dev_dbg(obj->dev, "%s: %08x<=%08x(%x)\n",
                                 __func__, start, da, bytes);
+                        iotlb_load_cr(obj, &cr);
                         iommu_write_reg(obj, 1, MMU_FLUSH_ENTRY);
                 }
         }
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index e31496e35b0f..0c8612fd8312 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -156,7 +156,7 @@ static irqreturn_t omap_mcbsp_rx_irq_handler(int irq, void *dev_id)
                 /* Writing zero to RSYNC_ERR clears the IRQ */
                 MCBSP_WRITE(mcbsp_rx, SPCR1, MCBSP_READ_CACHE(mcbsp_rx, SPCR1));
         } else {
-                complete(&mcbsp_rx->tx_irq_completion);
+                complete(&mcbsp_rx->rx_irq_completion);
         }
 
         return IRQ_HANDLED;
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index 226b2e858d6c..10b3b4c63372 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -220,20 +220,7 @@ void __init omap_map_sram(void)
         if (omap_sram_size == 0)
                 return;
 
-        if (cpu_is_omap24xx()) {
-                omap_sram_io_desc[0].virtual = OMAP2_SRAM_VA;
-
-                base = OMAP2_SRAM_PA;
-                base = ROUND_DOWN(base, PAGE_SIZE);
-                omap_sram_io_desc[0].pfn = __phys_to_pfn(base);
-        }
-
         if (cpu_is_omap34xx()) {
-                omap_sram_io_desc[0].virtual = OMAP3_SRAM_VA;
-                base = OMAP3_SRAM_PA;
-                base = ROUND_DOWN(base, PAGE_SIZE);
-                omap_sram_io_desc[0].pfn = __phys_to_pfn(base);
-
                 /*
                  * SRAM must be marked as non-cached on OMAP3 since the
                  * CORE DPLL M2 divider change code (in SRAM) runs with the
@@ -244,13 +231,11 @@ void __init omap_map_sram(void)
                 omap_sram_io_desc[0].type = MT_MEMORY_NONCACHED;
         }
 
-        if (cpu_is_omap44xx()) {
-                omap_sram_io_desc[0].virtual = OMAP4_SRAM_VA;
-                base = OMAP4_SRAM_PA;
-                base = ROUND_DOWN(base, PAGE_SIZE);
-                omap_sram_io_desc[0].pfn = __phys_to_pfn(base);
-        }
-        omap_sram_io_desc[0].length = 1024 * 1024;      /* Use section desc */
+        omap_sram_io_desc[0].virtual = omap_sram_base;
+        base = omap_sram_start;
+        base = ROUND_DOWN(base, PAGE_SIZE);
+        omap_sram_io_desc[0].pfn = __phys_to_pfn(base);
+        omap_sram_io_desc[0].length = ROUND_DOWN(omap_sram_size, PAGE_SIZE);
         iotable_init(omap_sram_io_desc, ARRAY_SIZE(omap_sram_io_desc));
 
         printk(KERN_INFO "SRAM: Mapped pa 0x%08lx to va 0x%08lx size: 0x%lx\n",
diff --git a/arch/arm/plat-samsung/adc.c b/arch/arm/plat-samsung/adc.c
index 04d9521ddc9f..e8f2be2d67f2 100644
--- a/arch/arm/plat-samsung/adc.c
+++ b/arch/arm/plat-samsung/adc.c
@@ -435,7 +435,6 @@ static int s3c_adc_suspend(struct platform_device *pdev, pm_message_t state)
 static int s3c_adc_resume(struct platform_device *pdev)
 {
         struct adc_device *adc = platform_get_drvdata(pdev);
-        unsigned long flags;
 
         clk_enable(adc->clk);
         enable_irq(adc->irq);
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 90a20512d68d..e8d20b0bc50e 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -48,6 +48,9 @@
 #include <plat/clock.h>
 #include <plat/cpu.h>
 
+#include <linux/serial_core.h>
+#include <plat/regs-serial.h> /* for s3c24xx_uart_devs */
+
 /* clock information */
 
 static LIST_HEAD(clocks);
@@ -65,6 +68,28 @@ static int clk_null_enable(struct clk *clk, int enable)
         return 0;
 }
 
+static int dev_is_s3c_uart(struct device *dev)
+{
+        struct platform_device **pdev = s3c24xx_uart_devs;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(s3c24xx_uart_devs); i++, pdev++)
+                if (*pdev && dev == &(*pdev)->dev)
+                        return 1;
+        return 0;
+}
+
+/*
+ * Serial drivers call get_clock() very early, before platform bus
+ * has been set up, this requires a special check to let them get
+ * a proper clock
+ */
+
+static int dev_is_platform_device(struct device *dev)
+{
+        return dev->bus == &platform_bus_type ||
+               (dev->bus == NULL && dev_is_s3c_uart(dev));
+}
+
 /* Clock API calls */
 
 struct clk *clk_get(struct device *dev, const char *id)
@@ -73,7 +98,7 @@ struct clk *clk_get(struct device *dev, const char *id)
         struct clk *clk = ERR_PTR(-ENOENT);
         int idno;
 
-        if (dev == NULL || dev->bus != &platform_bus_type)
+        if (dev == NULL || !dev_is_platform_device(dev))
                 idno = -1;
         else
                 idno = to_platform_device(dev)->id;
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index 98f94d041d9c..a727f54d64d6 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -314,10 +314,9 @@ int module_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
         vfree(module->arch.syminfo);
         module->arch.syminfo = NULL;
 
-        return module_bug_finalize(hdr, sechdrs, module);
+        return 0;
 }
 
 void module_arch_cleanup(struct module *module)
 {
-        module_bug_cleanup(module);
 }
diff --git a/arch/h8300/kernel/module.c b/arch/h8300/kernel/module.c
index 0865e291c20d..db4953dc4e1b 100644
--- a/arch/h8300/kernel/module.c
+++ b/arch/h8300/kernel/module.c
@@ -112,10 +112,9 @@ int module_finalize(const Elf_Ehdr *hdr,
                     const Elf_Shdr *sechdrs,
                     struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/m32r/include/asm/elf.h b/arch/m32r/include/asm/elf.h
index 2f85412ef730..b8da7d0574d2 100644
--- a/arch/m32r/include/asm/elf.h
+++ b/arch/m32r/include/asm/elf.h
@@ -82,9 +82,9 @@ typedef elf_fpreg_t elf_fpregset_t;
  * These are used to set parameters in the core dumps.
  */
 #define ELF_CLASS       ELFCLASS32
-#if defined(__LITTLE_ENDIAN)
+#if defined(__LITTLE_ENDIAN__)
 #define ELF_DATA        ELFDATA2LSB
-#elif defined(__BIG_ENDIAN)
+#elif defined(__BIG_ENDIAN__)
 #define ELF_DATA        ELFDATA2MSB
 #else
 #error no endian defined
diff --git a/arch/m32r/kernel/.gitignore b/arch/m32r/kernel/.gitignore
new file mode 100644
index 000000000000..c5f676c3c224
--- /dev/null
+++ b/arch/m32r/kernel/.gitignore
@@ -0,0 +1 @@
+vmlinux.lds
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 7bbe38645ed5..a08697f0886d 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -28,6 +28,8 @@
 
 #define DEBUG_SIG 0
 
+#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
+
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                 unsigned long r2, unsigned long r3, unsigned long r4,
@@ -254,7 +256,7 @@ give_sigsegv:
 static int prev_insn(struct pt_regs *regs)
 {
         u16 inst;
-        if (get_user(&inst, (u16 __user *)(regs->bpc - 2)))
+        if (get_user(inst, (u16 __user *)(regs->bpc - 2)))
                 return -EFAULT;
         if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
                 regs->bpc -= 2;
diff --git a/arch/m68k/mac/macboing.c b/arch/m68k/mac/macboing.c
index 8f0640847ad2..05285d08e547 100644
--- a/arch/m68k/mac/macboing.c
+++ b/arch/m68k/mac/macboing.c
@@ -162,7 +162,7 @@ static void mac_init_asc( void )
 void mac_mksound( unsigned int freq, unsigned int length )
 {
         __u32 cfreq = ( freq << 5 ) / 468;
-        __u32 flags;
+        unsigned long flags;
         int i;
 
         if ( mac_special_bell == NULL )
@@ -224,7 +224,7 @@ static void mac_nosound( unsigned long ignored )
  */
 static void mac_quadra_start_bell( unsigned int freq, unsigned int length, unsigned int volume )
 {
-        __u32 flags;
+        unsigned long flags;
 
         /* if the bell is already ringing, ring longer */
         if ( mac_bell_duration > 0 )
@@ -271,7 +271,7 @@ static void mac_quadra_start_bell( unsigned int freq, unsigned int length, unsig
 static void mac_quadra_ring_bell( unsigned long ignored )
 {
         int     i, count = mac_asc_samplespersec / HZ;
-        __u32 flags;
+        unsigned long flags;
 
         /*
          * we neither want a sound buffer overflow nor underflow, so we need to match
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 3ad59dde4852..5526faabfc21 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -13,6 +13,7 @@ config MIPS
         select HAVE_KPROBES
         select HAVE_KRETPROBES
         select RTC_LIB if !MACH_LOONGSON
+        select GENERIC_ATOMIC64 if !64BIT
 
 mainmenu "Linux/MIPS Kernel Configuration"
 
@@ -1646,8 +1647,16 @@ config MIPS_MT_SMP
         select SYS_SUPPORTS_SMP
         select SMP_UP
         help
-          This is a kernel model which is also known a VSMP or lately
-          has been marketesed into SMVP.
+          This is a kernel model which is known a VSMP but lately has been
+          marketesed into SMVP.
+          Virtual SMP uses the processor's VPEs  to implement virtual
+          processors. In currently available configuration of the 34K processor
+          this allows for a dual processor. Both processors will share the same
+          primary caches; each will obtain the half of the TLB for it's own
+          exclusive use. For a layman this model can be described as similar to
+          what Intel calls Hyperthreading.
+
+          For further information see http://www.linux-mips.org/wiki/34K#VSMP
 
 config MIPS_MT_SMTC
         bool "SMTC: Use all TCs on all VPEs for SMP"
@@ -1664,6 +1673,14 @@ config MIPS_MT_SMTC
         help
           This is a kernel model which is known a SMTC or lately has been
           marketesed into SMVP.
+          is presenting the available TC's of the core as processors to Linux.
+          On currently available 34K processors this means a Linux system will
+          see up to 5 processors. The implementation of the SMTC kernel differs
+          significantly from VSMP and cannot efficiently coexist in the same
+          kernel binary so the choice between VSMP and SMTC is a compile time
+          decision.
+
+          For further information see http://www.linux-mips.org/wiki/34K#SMTC
 
 endchoice
 
diff --git a/arch/mips/alchemy/common/prom.c b/arch/mips/alchemy/common/prom.c
index c29511b11d44..534021059629 100644
--- a/arch/mips/alchemy/common/prom.c
+++ b/arch/mips/alchemy/common/prom.c
@@ -43,7 +43,7 @@ int prom_argc;
 char **prom_argv;
 char **prom_envp;
 
-void prom_init_cmdline(void)
+void __init prom_init_cmdline(void)
 {
         int i;
 
@@ -104,7 +104,7 @@ static inline void str2eaddr(unsigned char *ea, unsigned char *str)
         }
 }
 
-int prom_get_ethernet_addr(char *ethernet_addr)
+int __init prom_get_ethernet_addr(char *ethernet_addr)
 {
         char *ethaddr_str;
 
@@ -123,7 +123,6 @@ int prom_get_ethernet_addr(char *ethernet_addr)
 
         return 0;
 }
-EXPORT_SYMBOL(prom_get_ethernet_addr);
 
 void __init prom_free_prom_memory(void)
 {
diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index ed9bb709c9a3..5fd7f7a58b7e 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -59,7 +59,7 @@ $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
 hostprogs-y := calc_vmlinuz_load_addr
 
 VMLINUZ_LOAD_ADDRESS = $(shell $(obj)/calc_vmlinuz_load_addr \
-                $(objtree)/$(KBUILD_IMAGE) $(VMLINUX_LOAD_ADDRESS))
+                $(obj)/vmlinux.bin $(VMLINUX_LOAD_ADDRESS))
 
 vmlinuzobjs-y += $(obj)/piggy.o
 
diff --git a/arch/mips/cavium-octeon/Kconfig b/arch/mips/cavium-octeon/Kconfig
index 094c17e38e16..47323ca452dc 100644
--- a/arch/mips/cavium-octeon/Kconfig
+++ b/arch/mips/cavium-octeon/Kconfig
@@ -83,3 +83,7 @@ config ARCH_SPARSEMEM_ENABLE
         def_bool y
         select SPARSEMEM_STATIC
         depends on CPU_CAVIUM_OCTEON
+
+config CAVIUM_OCTEON_HELPER
+        def_bool y
+        depends on OCTEON_ETHERNET || PCI
diff --git a/arch/mips/cavium-octeon/cpu.c b/arch/mips/cavium-octeon/cpu.c
index c664c8cc2b42..a5b427909b5c 100644
--- a/arch/mips/cavium-octeon/cpu.c
+++ b/arch/mips/cavium-octeon/cpu.c
@@ -41,7 +41,7 @@ static int cnmips_cu2_call(struct notifier_block *nfb, unsigned long action,
         return NOTIFY_OK;               /* Let default notifier send signals */
 }
 
-static int cnmips_cu2_setup(void)
+static int __init cnmips_cu2_setup(void)
 {
         return cu2_notifier(cnmips_cu2_call, 0);
 }
diff --git a/arch/mips/cavium-octeon/executive/Makefile b/arch/mips/cavium-octeon/executive/Makefile
index 2fd66db6939e..7f41c5be2190 100644
--- a/arch/mips/cavium-octeon/executive/Makefile
+++ b/arch/mips/cavium-octeon/executive/Makefile
@@ -11,4 +11,4 @@
 
 obj-y += cvmx-bootmem.o cvmx-l2c.o cvmx-sysinfo.o octeon-model.o
 
-obj-$(CONFIG_PCI) += cvmx-helper-errata.o cvmx-helper-jtag.o
+obj-$(CONFIG_CAVIUM_OCTEON_HELPER) += cvmx-helper-errata.o cvmx-helper-jtag.o
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index c63c56bfd184..47d87da379f9 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -782,6 +782,10 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
  */
 #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
 
+#else /* !CONFIG_64BIT */
+
+#include <asm-generic/atomic64.h>
+
 #endif /* CONFIG_64BIT */
 
 /*
diff --git a/arch/mips/include/asm/cop2.h b/arch/mips/include/asm/cop2.h
index 2cb2f0c2c4f8..3532e2c5f098 100644
--- a/arch/mips/include/asm/cop2.h
+++ b/arch/mips/include/asm/cop2.h
@@ -24,7 +24,7 @@ extern int cu2_notifier_call_chain(unsigned long val, void *v);
 
 #define cu2_notifier(fn, pri)                                           \
 ({                                                                      \
-        static struct notifier_block fn##_nb __cpuinitdata = {          \
+        static struct notifier_block fn##_nb = {                        \
                 .notifier_call = fn,                                    \
                 .priority = pri                                         \
         };                                                              \
diff --git a/arch/mips/include/asm/gic.h b/arch/mips/include/asm/gic.h
index 9b9436a4d816..86548da650e7 100644
--- a/arch/mips/include/asm/gic.h
+++ b/arch/mips/include/asm/gic.h
@@ -321,6 +321,7 @@ struct gic_intrmask_regs {
  */
 struct gic_intr_map {
         unsigned int cpunum;    /* Directed to this CPU */
+#define GIC_UNUSED              0xdead                  /* Dummy data */
         unsigned int pin;       /* Directed to this Pin */
         unsigned int polarity;  /* Polarity : +/-       */
         unsigned int trigtype;  /* Trigger  : Edge/Levl */
diff --git a/arch/mips/include/asm/mach-tx49xx/kmalloc.h b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
index b74caf65482b..ff9a8b86cb93 100644
--- a/arch/mips/include/asm/mach-tx49xx/kmalloc.h
+++ b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
@@ -1,6 +1,6 @@
 #ifndef __ASM_MACH_TX49XX_KMALLOC_H
 #define __ASM_MACH_TX49XX_KMALLOC_H
 
-#define ARCH_KMALLOC_MINALIGN   L1_CACHE_BYTES
+#define ARCH_DMA_MINALIGN L1_CACHE_BYTES
 
 #endif /* __ASM_MACH_TX49XX_KMALLOC_H */
diff --git a/arch/mips/include/asm/mips-boards/maltaint.h b/arch/mips/include/asm/mips-boards/maltaint.h
index cea872fc6f5c..d11aa02a956a 100644
--- a/arch/mips/include/asm/mips-boards/maltaint.h
+++ b/arch/mips/include/asm/mips-boards/maltaint.h
@@ -88,9 +88,6 @@
 
 #define GIC_EXT_INTR(x)         x
 
-/* Dummy data */
-#define X                       0xdead
-
 /* External Interrupts used for IPI */
 #define GIC_IPI_EXT_INTR_RESCHED_VPE0   16
 #define GIC_IPI_EXT_INTR_CALLFNC_VPE0   17
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index a16beafcea91..e59cd1ac09c2 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -150,6 +150,20 @@ typedef struct { unsigned long pgprot; } pgprot_t;
     ((unsigned long)(x) - PAGE_OFFSET + PHYS_OFFSET)
 #endif
 #define __va(x)         ((void *)((unsigned long)(x) + PAGE_OFFSET - PHYS_OFFSET))
+
+/*
+ * RELOC_HIDE was originally added by 6007b903dfe5f1d13e0c711ac2894bdd4a61b1ad
+ * (lmo) rsp. 8431fd094d625b94d364fe393076ccef88e6ce18 (kernel.org).  The
+ * discussion can be found in lkml posting
+ * <a2ebde260608230500o3407b108hc03debb9da6e62c@mail.gmail.com> which is
+ * archived at http://lists.linuxcoding.com/kernel/2006-q3/msg17360.html
+ *
+ * It is unclear if the misscompilations mentioned in
+ * http://lkml.org/lkml/2010/8/8/138 also affect MIPS so we keep this one
+ * until GCC 3.x has been retired before we can apply
+ * https://patchwork.linux-mips.org/patch/1541/
+ */
+
 #define __pa_symbol(x)  __pa(RELOC_HIDE((unsigned long)(x), 0))
 
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
diff --git a/arch/mips/include/asm/siginfo.h b/arch/mips/include/asm/siginfo.h
index 96e28f18dad1..1ca64b4d33d9 100644
--- a/arch/mips/include/asm/siginfo.h
+++ b/arch/mips/include/asm/siginfo.h
@@ -88,6 +88,7 @@ typedef struct siginfo {
 #ifdef __ARCH_SI_TRAPNO
                         int _trapno;    /* TRAP # which caused the signal */
 #endif
+                        short _addr_lsb;
                 } _sigfault;
 
                 /* SIGPOLL, SIGXFSZ (To do ...)  */
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 2376f2e06e47..70df9c0d3c5b 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -146,7 +146,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_LOAD_WATCH         (1<<TIF_LOAD_WATCH)
 
 /* work to do on interrupt/exception return */
-#define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
+#define _TIF_WORK_MASK          (0x0000ffef &                           \
+                                        ~(_TIF_SECCOMP | _TIF_SYSCALL_AUDIT))
 /* work to do on any return to u-space */
 #define _TIF_ALLWORK_MASK       (0x8000ffff & ~_TIF_SECCOMP)
 
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index baa318a59c97..550725b881d5 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -356,16 +356,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 333)
 #define __NR_accept4                    (__NR_Linux + 334)
 #define __NR_recvmmsg                   (__NR_Linux + 335)
+#define __NR_fanotify_init              (__NR_Linux + 336)
+#define __NR_fanotify_mark              (__NR_Linux + 337)
+#define __NR_prlimit64                  (__NR_Linux + 338)
 
 /*
  * Offset of the last Linux o32 flavoured syscall
  */
-#define __NR_Linux_syscalls             335
+#define __NR_Linux_syscalls             338
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         335
+#define __NR_O32_Linux_syscalls         338
 
 #if _MIPS_SIM == _MIPS_SIM_ABI64
 
@@ -668,16 +671,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 292)
 #define __NR_accept4                    (__NR_Linux + 293)
 #define __NR_recvmmsg                   (__NR_Linux + 294)
+#define __NR_fanotify_init              (__NR_Linux + 295)
+#define __NR_fanotify_mark              (__NR_Linux + 296)
+#define __NR_prlimit64                  (__NR_Linux + 297)
 
 /*
  * Offset of the last Linux 64-bit flavoured syscall
  */
-#define __NR_Linux_syscalls             294
+#define __NR_Linux_syscalls             297
 
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          294
+#define __NR_64_Linux_syscalls          297
 
 #if _MIPS_SIM == _MIPS_SIM_NABI32
 
@@ -985,16 +991,19 @@
 #define __NR_accept4                    (__NR_Linux + 297)
 #define __NR_recvmmsg                   (__NR_Linux + 298)
 #define __NR_getdents64                 (__NR_Linux + 299)
+#define __NR_fanotify_init              (__NR_Linux + 300)
+#define __NR_fanotify_mark              (__NR_Linux + 301)
+#define __NR_prlimit64                  (__NR_Linux + 302)
 
 /*
  * Offset of the last N32 flavoured syscall
  */
-#define __NR_Linux_syscalls             299
+#define __NR_Linux_syscalls             302
 
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         299
+#define __NR_N32_Linux_syscalls         302
 
 #ifdef __KERNEL__
 
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index b181f2f0ea8e..82ba9f62f49e 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -7,7 +7,6 @@
 #include <asm/io.h>
 #include <asm/gic.h>
 #include <asm/gcmpregs.h>
-#include <asm/mips-boards/maltaint.h>
 #include <asm/irq.h>
 #include <linux/hardirq.h>
 #include <asm-generic/bitops/find.h>
@@ -131,7 +130,7 @@ static int gic_set_affinity(unsigned int irq, const struct cpumask *cpumask)
         int             i;
 
         irq -= _irqbase;
-        pr_debug(KERN_DEBUG "%s(%d) called\n", __func__, irq);
+        pr_debug("%s(%d) called\n", __func__, irq);
         cpumask_and(&tmp, cpumask, cpu_online_mask);
         if (cpus_empty(tmp))
                 return -1;
@@ -222,7 +221,7 @@ static void __init gic_basic_init(int numintrs, int numvpes,
         /* Setup specifics */
         for (i = 0; i < mapsize; i++) {
                 cpu = intrmap[i].cpunum;
-                if (cpu == X)
+                if (cpu == GIC_UNUSED)
                         continue;
                 if (cpu == 0 && i != 0 && intrmap[i].flags == 0)
                         continue;
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 1f4e2fa64140..f4546e97c60d 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -283,7 +283,7 @@ static int kgdb_mips_notify(struct notifier_block *self, unsigned long cmd,
         struct pt_regs *regs = args->regs;
         int trap = (regs->cp0_cause & 0x7c) >> 2;
 
-        /* Userpace events, ignore. */
+        /* Userspace events, ignore. */
         if (user_mode(regs))
                 return NOTIFY_DONE;
 
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 80e2ba694bab..29811f043399 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -251,7 +251,7 @@ void sp_work_handle_request(void)
                 memset(&tz, 0, sizeof(tz));
                 if ((ret.retval = sp_syscall(__NR_gettimeofday, (int)&tv,
                                              (int)&tz, 0, 0)) == 0)
-                ret.retval = tv.tv_sec;
+                        ret.retval = tv.tv_sec;
                 break;
 
         case MTSP_SYSCALL_EXIT:
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index c2dab140dc98..6343b4a5b835 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -341,3 +341,10 @@ asmlinkage long sys32_lookup_dcookie(u32 a0, u32 a1, char __user *buf,
 {
         return sys_lookup_dcookie(merge_64(a0, a1), buf, len);
 }
+
+SYSCALL_DEFINE6(32_fanotify_mark, int, fanotify_fd, unsigned int, flags,
+                u64, a3, u64, a4, int, dfd, const char  __user *, pathname)
+{
+        return sys_fanotify_mark(fanotify_fd, flags, merge_64(a3, a4),
+                                 dfd, pathname);
+}
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 17202bbe843f..584415eef8c9 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -583,7 +583,10 @@ einval:	li	v0, -ENOSYS
         sys     sys_rt_tgsigqueueinfo   4
         sys     sys_perf_event_open     5
         sys     sys_accept4             4
-        sys     sys_recvmmsg            5
+        sys     sys_recvmmsg            5       /* 4335 */
+        sys     sys_fanotify_init       2
+        sys     sys_fanotify_mark       6
+        sys     sys_prlimit64           4
         .endm
 
         /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index a8a6c596eb04..5573f8e4e326 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -416,9 +416,12 @@ sys_call_table:
         PTR     sys_pipe2
         PTR     sys_inotify_init1
         PTR     sys_preadv
-        PTR     sys_pwritev                     /* 5390 */
+        PTR     sys_pwritev                     /* 5290 */
         PTR     sys_rt_tgsigqueueinfo
         PTR     sys_perf_event_open
         PTR     sys_accept4
-        PTR     sys_recvmmsg
+        PTR     sys_recvmmsg
+        PTR     sys_fanotify_init               /* 5295 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index a3d66137731a..1e38ec97672e 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -419,5 +419,8 @@ EXPORT(sysn32_call_table)
         PTR     sys_perf_event_open
         PTR     sys_accept4
         PTR     compat_sys_recvmmsg
-        PTR     sys_getdents
+        PTR     sys_getdents64
+        PTR     sys_fanotify_init               /* 6300 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
         .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 813689ef2384..171979fc98e5 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -538,5 +538,8 @@ sys_call_table:
         PTR     compat_sys_rt_tgsigqueueinfo
         PTR     sys_perf_event_open
         PTR     sys_accept4
-        PTR     compat_sys_recvmmsg
+        PTR     compat_sys_recvmmsg             /* 4335 */
+        PTR     sys_fanotify_init
+        PTR     sys_32_fanotify_mark
+        PTR     sys_prlimit64
         .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 7ba890860d98..469d4019f795 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -44,27 +44,39 @@ static inline int cpu_is_noncoherent_r10000(struct device *dev)
 
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
 {
+        gfp_t dma_flag;
+
         /* ignore region specifiers */
         gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
 
-#ifdef CONFIG_ZONE_DMA
+#ifdef CONFIG_ISA
         if (dev == NULL)
-                gfp |= __GFP_DMA;
-        else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
-                gfp |= __GFP_DMA;
+                dma_flag = __GFP_DMA;
         else
 #endif
-#ifdef CONFIG_ZONE_DMA32
+#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
              if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-                gfp |= __GFP_DMA32;
+                        dma_flag = __GFP_DMA;
+        else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                        dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA;
         else
 #endif
-                ;
+                dma_flag = 0;
 
         /* Don't invoke OOM killer */
         gfp |= __GFP_NORETRY;
 
-        return gfp;
+        return gfp | dma_flag;
 }
 
 void *dma_alloc_noncoherent(struct device *dev, size_t size,
diff --git a/arch/mips/mm/sc-rm7k.c b/arch/mips/mm/sc-rm7k.c
index 1ef75cd80a0d..274af3be1442 100644
--- a/arch/mips/mm/sc-rm7k.c
+++ b/arch/mips/mm/sc-rm7k.c
@@ -30,7 +30,7 @@
 #define tc_lsize        32
 
 extern unsigned long icache_way_size, dcache_way_size;
-unsigned long tcache_size;
+static unsigned long tcache_size;
 
 #include <asm/r4kcache.h>
 
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 15949b0be811..b79b24afe3a2 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -385,6 +385,8 @@ static int __initdata msc_nr_eicirqs = ARRAY_SIZE(msc_eicirqmap);
  */
 
 #define GIC_CPU_NMI GIC_MAP_TO_NMI_MSK
+#define X GIC_UNUSED
+
 static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
         { X, X,            X,           X,              0 },
         { X, X,            X,           X,              0 },
@@ -404,6 +406,7 @@ static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
         { X, X,            X,           X,              0 },
         /* The remainder of this table is initialised by fill_ipi_map */
 };
+#undef X
 
 /*
  * GCMP needs to be detected before any SMP initialisation
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index 71f7d27b0d4c..f31218e17d3c 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -118,7 +118,7 @@ static int __init rc32434_pcibridge_init(void)
         if (!((pcicvalue == PCIM_H_EA) ||
               (pcicvalue == PCIM_H_IA_FIX) ||
               (pcicvalue == PCIM_H_IA_RR))) {
-                pr_err(KERN_ERR "PCI init error!!!\n");
+                pr_err("PCI init error!!!\n");
                 /* Not in Host Mode, return ERROR */
                 return -1;
         }
diff --git a/arch/mips/pnx8550/common/reset.c b/arch/mips/pnx8550/common/reset.c
index fadd8744a6bc..e7a12ff304b9 100644
--- a/arch/mips/pnx8550/common/reset.c
+++ b/arch/mips/pnx8550/common/reset.c
@@ -22,29 +22,19 @@
  */
 #include <linux/kernel.h>
 
+#include <asm/processor.h>
 #include <asm/reboot.h>
 #include <glb.h>
 
 void pnx8550_machine_restart(char *command)
 {
-        char head[] = "************* Machine restart *************";
-        char foot[] = "*******************************************";
-
-        printk("\n\n");
-        printk("%s\n", head);
-        if (command != NULL)
-                printk("* %s\n", command);
-        printk("%s\n", foot);
-
         PNX8550_RST_CTL = PNX8550_RST_DO_SW_RST;
 }
 
 void pnx8550_machine_halt(void)
 {
-        printk("*** Machine halt. (Not implemented) ***\n");
-}
-
-void pnx8550_machine_power_off(void)
-{
-        printk("*** Machine power off.  (Not implemented) ***\n");
+        while (1) {
+                if (cpu_wait)
+                        cpu_wait();
+        }
 }
diff --git a/arch/mips/pnx8550/common/setup.c b/arch/mips/pnx8550/common/setup.c
index 64246c9c875c..43cb3945fdbf 100644
--- a/arch/mips/pnx8550/common/setup.c
+++ b/arch/mips/pnx8550/common/setup.c
@@ -44,7 +44,6 @@
 extern void __init board_setup(void);
 extern void pnx8550_machine_restart(char *);
 extern void pnx8550_machine_halt(void);
-extern void pnx8550_machine_power_off(void);
 extern struct resource ioport_resource;
 extern struct resource iomem_resource;
 extern char *prom_getcmdline(void);
@@ -100,7 +99,7 @@ void __init plat_mem_setup(void)
 
         _machine_restart = pnx8550_machine_restart;
         _machine_halt = pnx8550_machine_halt;
-        pm_power_off = pnx8550_machine_power_off;
+        pm_power_off = pnx8550_machine_halt;
 
         /* Clear the Global 2 Register, PCI Inta Output Enable Registers
            Bit 1:Enable DAC Powerdown
diff --git a/arch/mn10300/Kconfig.debug b/arch/mn10300/Kconfig.debug
index ff80e86b9bd2..ce83c74b3fd7 100644
--- a/arch/mn10300/Kconfig.debug
+++ b/arch/mn10300/Kconfig.debug
@@ -101,7 +101,7 @@ config GDBSTUB_DEBUG_BREAKPOINT
 
 choice
         prompt "GDB stub port"
-        default GDBSTUB_TTYSM0
+        default GDBSTUB_ON_TTYSM0
         depends on GDBSTUB
         help
           Select the serial port used for GDB-stub.
diff --git a/arch/mn10300/kernel/module.c b/arch/mn10300/kernel/module.c
index 6aea7fd76993..196a111e2e29 100644
--- a/arch/mn10300/kernel/module.c
+++ b/arch/mn10300/kernel/module.c
@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                     const Elf_Shdr *sechdrs,
                     struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 
 /*
@@ -214,5 +214,4 @@ int module_finalize(const Elf_Ehdr *hdr,
  */
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/mn10300/kernel/signal.c b/arch/mn10300/kernel/signal.c
index 717db14c2cc3..d4de05ab7864 100644
--- a/arch/mn10300/kernel/signal.c
+++ b/arch/mn10300/kernel/signal.c
@@ -65,10 +65,10 @@ asmlinkage long sys_sigaction(int sig,
                 old_sigset_t mask;
                 if (verify_area(VERIFY_READ, act, sizeof(*act)) ||
                     __get_user(new_ka.sa.sa_handler, &act->sa_handler) ||
-                    __get_user(new_ka.sa.sa_restorer, &act->sa_restorer))
+                    __get_user(new_ka.sa.sa_restorer, &act->sa_restorer) ||
+                    __get_user(new_ka.sa.sa_flags, &act->sa_flags) ||
+                    __get_user(mask, &act->sa_mask))
                         return -EFAULT;
-                __get_user(new_ka.sa.sa_flags, &act->sa_flags);
-                __get_user(mask, &act->sa_mask);
                 siginitset(&new_ka.sa.sa_mask, mask);
         }
 
@@ -77,10 +77,10 @@ asmlinkage long sys_sigaction(int sig,
         if (!ret && oact) {
                 if (verify_area(VERIFY_WRITE, oact, sizeof(*oact)) ||
                     __put_user(old_ka.sa.sa_handler, &oact->sa_handler) ||
-                    __put_user(old_ka.sa.sa_restorer, &oact->sa_restorer))
+                    __put_user(old_ka.sa.sa_restorer, &oact->sa_restorer) ||
+                    __put_user(old_ka.sa.sa_flags, &oact->sa_flags) ||
+                    __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask))
                         return -EFAULT;
-                __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
-                __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
         }
 
         return ret;
@@ -102,6 +102,9 @@ static int restore_sigcontext(struct pt_regs *regs,
 {
         unsigned int err = 0;
 
+        /* Always make any pending restarted system calls return -EINTR */
+        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+
         if (is_using_fpu(current))
                 fpu_kill_state(current);
 
@@ -330,8 +333,6 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
         regs->d0 = sig;
         regs->d1 = (unsigned long) &frame->sc;
 
-        set_fs(USER_DS);
-
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
                 ptrace_notify(SIGTRAP);
@@ -345,7 +346,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set,
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 }
 
@@ -413,8 +414,6 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         regs->d0 = sig;
         regs->d1 = (long) &frame->info;
 
-        set_fs(USER_DS);
-
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
                 ptrace_notify(SIGTRAP);
@@ -428,10 +427,16 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 }
 
+static inline void stepback(struct pt_regs *regs)
+{
+        regs->pc -= 2;
+        regs->orig_d0 = -1;
+}
+
 /*
  * handle the actual delivery of a signal to userspace
  */
@@ -459,7 +464,7 @@ static int handle_signal(int sig,
                         /* fallthrough */
                 case -ERESTARTNOINTR:
                         regs->d0 = regs->orig_d0;
-                        regs->pc -= 2;
+                        stepback(regs);
                 }
         }
 
@@ -527,12 +532,12 @@ static void do_signal(struct pt_regs *regs)
                 case -ERESTARTSYS:
                 case -ERESTARTNOINTR:
                         regs->d0 = regs->orig_d0;
-                        regs->pc -= 2;
+                        stepback(regs);
                         break;
 
                 case -ERESTART_RESTARTBLOCK:
                         regs->d0 = __NR_restart_syscall;
-                        regs->pc -= 2;
+                        stepback(regs);
                         break;
                 }
         }
diff --git a/arch/mn10300/mm/Makefile b/arch/mn10300/mm/Makefile
index 28b9d983db0c..1557277fbc5c 100644
--- a/arch/mn10300/mm/Makefile
+++ b/arch/mn10300/mm/Makefile
@@ -2,13 +2,11 @@
 # Makefile for the MN10300-specific memory management code
 #
 
+cacheflush-y    := cache.o cache-mn10300.o
+cacheflush-$(CONFIG_MN10300_CACHE_WBACK) += cache-flush-mn10300.o
+
+cacheflush-$(CONFIG_MN10300_CACHE_DISABLED) := cache-disabled.o
+
 obj-y := \
         init.o fault.o pgtable.o extable.o tlb-mn10300.o mmu-context.o \
-        misalignment.o dma-alloc.o
-
-ifneq ($(CONFIG_MN10300_CACHE_DISABLED),y)
-obj-y   += cache.o cache-mn10300.o
-ifeq ($(CONFIG_MN10300_CACHE_WBACK),y)
-obj-y   += cache-flush-mn10300.o
-endif
-endif
+        misalignment.o dma-alloc.o $(cacheflush-y)
diff --git a/arch/mn10300/mm/cache-disabled.c b/arch/mn10300/mm/cache-disabled.c
new file mode 100644
index 000000000000..f669ea42aba6
--- /dev/null
+++ b/arch/mn10300/mm/cache-disabled.c
@@ -0,0 +1,21 @@
+/* Handle the cache being disabled
+ *
+ * Copyright (C) 2010 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public Licence
+ * as published by the Free Software Foundation; either version
+ * 2 of the Licence, or (at your option) any later version.
+ */
+#include <linux/mm.h>
+
+/*
+ * allow userspace to flush the instruction cache
+ */
+asmlinkage long sys_cacheflush(unsigned long start, unsigned long end)
+{
+        if (end < start)
+                return -EINVAL;
+        return 0;
+}
diff --git a/arch/mn10300/mm/cache.c b/arch/mn10300/mm/cache.c
index 1b76719ec1c3..9261217e8d2c 100644
--- a/arch/mn10300/mm/cache.c
+++ b/arch/mn10300/mm/cache.c
@@ -54,13 +54,30 @@ EXPORT_SYMBOL(flush_icache_page);
 void flush_icache_range(unsigned long start, unsigned long end)
 {
 #ifdef CONFIG_MN10300_CACHE_WBACK
-        unsigned long addr, size, off;
+        unsigned long addr, size, base, off;
         struct page *page;
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *ppte, pte;
 
+        if (end > 0x80000000UL) {
+                /* addresses above 0xa0000000 do not go through the cache */
+                if (end > 0xa0000000UL) {
+                        end = 0xa0000000UL;
+                        if (start >= end)
+                                return;
+                }
+
+                /* kernel addresses between 0x80000000 and 0x9fffffff do not
+                 * require page tables, so we just map such addresses directly */
+                base = (start >= 0x80000000UL) ? start : 0x80000000UL;
+                mn10300_dcache_flush_range(base, end);
+                if (base == start)
+                        goto invalidate;
+                end = base;
+        }
+
         for (; start < end; start += size) {
                 /* work out how much of the page to flush */
                 off = start & (PAGE_SIZE - 1);
@@ -104,6 +121,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
         }
 #endif
 
+invalidate:
         mn10300_icache_inv();
 }
 EXPORT_SYMBOL(flush_icache_range);
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 159a2b81e90c..6e81bb596e5b 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -941,11 +941,10 @@ int module_finalize(const Elf_Ehdr *hdr,
         nsyms = newptr - (Elf_Sym *)symhdr->sh_addr;
         DEBUGP("NEW num_symtab %lu\n", nsyms);
         symhdr->sh_size = nsyms * sizeof(Elf_Sym);
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
         deregister_unwind_table(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
index 477c663e0140..49cee9df225b 100644
--- a/arch/powerpc/kernel/module.c
+++ b/arch/powerpc/kernel/module.c
@@ -63,11 +63,6 @@ int module_finalize(const Elf_Ehdr *hdr,
                 const Elf_Shdr *sechdrs, struct module *me)
 {
         const Elf_Shdr *sect;
-        int err;
-
-        err = module_bug_finalize(hdr, sechdrs, me);
-        if (err)
-                return err;
 
         /* Apply feature fixups */
         sect = find_section(hdr, sechdrs, "__ftr_fixup");
@@ -101,5 +96,4 @@ int module_finalize(const Elf_Ehdr *hdr,
 
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/platforms/512x/clock.c b/arch/powerpc/platforms/512x/clock.c
index 5b243bd3eb3b..3dc2a8d262b8 100644
--- a/arch/powerpc/platforms/512x/clock.c
+++ b/arch/powerpc/platforms/512x/clock.c
@@ -57,7 +57,7 @@ static struct clk *mpc5121_clk_get(struct device *dev, const char *id)
         int id_match = 0;
 
         if (dev == NULL || id == NULL)
-                return NULL;
+                return clk;
 
         mutex_lock(&clocks_mutex);
         list_for_each_entry(p, &clocks, node) {
diff --git a/arch/powerpc/platforms/52xx/efika.c b/arch/powerpc/platforms/52xx/efika.c
index 45c0cb9b67e6..18c104820198 100644
--- a/arch/powerpc/platforms/52xx/efika.c
+++ b/arch/powerpc/platforms/52xx/efika.c
@@ -99,7 +99,7 @@ static void __init efika_pcisetup(void)
         if (bus_range == NULL || len < 2 * sizeof(int)) {
                 printk(KERN_WARNING EFIKA_PLATFORM_NAME
                        ": Can't get bus-range for %s\n", pcictrl->full_name);
-                return;
+                goto out_put;
         }
 
         if (bus_range[1] == bus_range[0])
@@ -111,12 +111,12 @@ static void __init efika_pcisetup(void)
         printk(" controlled by %s\n", pcictrl->full_name);
         printk("\n");
 
-        hose = pcibios_alloc_controller(of_node_get(pcictrl));
+        hose = pcibios_alloc_controller(pcictrl);
         if (!hose) {
                 printk(KERN_WARNING EFIKA_PLATFORM_NAME
                        ": Can't allocate PCI controller structure for %s\n",
                        pcictrl->full_name);
-                return;
+                goto out_put;
         }
 
         hose->first_busno = bus_range[0];
@@ -124,6 +124,9 @@ static void __init efika_pcisetup(void)
         hose->ops = &rtas_pci_ops;
 
         pci_process_bridge_OF_ranges(hose, pcictrl, 0);
+        return;
+out_put:
+        of_node_put(pcictrl);
 }
 
 #else
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 6e905314ad5d..41f3a7eda1de 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -325,12 +325,16 @@ int mpc5200_psc_ac97_gpio_reset(int psc_number)
         clrbits32(&simple_gpio->simple_dvo, sync | out);
         clrbits8(&wkup_gpio->wkup_dvo, reset);
 
-        /* wait at lease 1 us */
-        udelay(2);
+        /* wait for 1 us */
+        udelay(1);
 
         /* Deassert reset */
         setbits8(&wkup_gpio->wkup_dvo, reset);
 
+        /* wait at least 200ns */
+        /* 7 ~= (200ns * timebase) / ns2sec */
+        __delay(7);
+
         /* Restore pin-muxing */
         out_be32(&simple_gpio->port_config, mux);
 
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 22cfd634c355..f7167ee4604c 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -407,10 +407,9 @@ int module_finalize(const Elf_Ehdr *hdr,
 {
         vfree(me->arch.syminfo);
         me->arch.syminfo = NULL;
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/sh/kernel/module.c b/arch/sh/kernel/module.c
index 43adddfe4c04..ae0be697a89e 100644
--- a/arch/sh/kernel/module.c
+++ b/arch/sh/kernel/module.c
@@ -149,13 +149,11 @@ int module_finalize(const Elf_Ehdr *hdr,
         int ret = 0;
 
         ret |= module_dwarf_finalize(hdr, sechdrs, me);
-        ret |= module_bug_finalize(hdr, sechdrs, me);
 
         return ret;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
         module_dwarf_cleanup(mod);
 }
diff --git a/arch/um/drivers/hostaudio_kern.c b/arch/um/drivers/hostaudio_kern.c
index 0c46e398cd8f..63c740a85b4c 100644
--- a/arch/um/drivers/hostaudio_kern.c
+++ b/arch/um/drivers/hostaudio_kern.c
@@ -40,6 +40,11 @@ static char *mixer = HOSTAUDIO_DEV_MIXER;
 "    This is used to specify the host mixer device to the hostaudio driver.\n"\
 "    The default is \"" HOSTAUDIO_DEV_MIXER "\".\n\n"
 
+module_param(dsp, charp, 0644);
+MODULE_PARM_DESC(dsp, DSP_HELP);
+module_param(mixer, charp, 0644);
+MODULE_PARM_DESC(mixer, MIXER_HELP);
+
 #ifndef MODULE
 static int set_dsp(char *name, int *add)
 {
@@ -56,15 +61,6 @@ static int set_mixer(char *name, int *add)
 }
 
 __uml_setup("mixer=", set_mixer, "mixer=<mixer device>\n" MIXER_HELP);
-
-#else /*MODULE*/
-
-module_param(dsp, charp, 0644);
-MODULE_PARM_DESC(dsp, DSP_HELP);
-
-module_param(mixer, charp, 0644);
-MODULE_PARM_DESC(mixer, MIXER_HELP);
-
 #endif
 
 /* /dev/dsp file operations */
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 2ab233ba32c1..47d0c37897d5 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -255,18 +255,6 @@ static void uml_net_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
-static int uml_net_set_mac(struct net_device *dev, void *addr)
-{
-        struct uml_net_private *lp = netdev_priv(dev);
-        struct sockaddr *hwaddr = addr;
-
-        spin_lock_irq(&lp->lock);
-        eth_mac_addr(dev, hwaddr->sa_data);
-        spin_unlock_irq(&lp->lock);
-
-        return 0;
-}
-
 static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
 {
         dev->mtu = new_mtu;
@@ -373,7 +361,7 @@ static const struct net_device_ops uml_netdev_ops = {
         .ndo_start_xmit         = uml_net_start_xmit,
         .ndo_set_multicast_list = uml_net_set_multicast_list,
         .ndo_tx_timeout         = uml_net_tx_timeout,
-        .ndo_set_mac_address    = uml_net_set_mac,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = uml_net_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
 };
@@ -472,7 +460,8 @@ static void eth_configure(int n, void *init, char *mac,
             ((*transport->user->init)(&lp->user, dev) != 0))
                 goto out_unregister;
 
-        eth_mac_addr(dev, device->mac);
+        /* don't use eth_mac_addr, it will not work here */
+        memcpy(dev->dev_addr, device->mac, ETH_ALEN);
         dev->mtu = transport->user->mtu;
         dev->netdev_ops = &uml_netdev_ops;
         dev->ethtool_ops = &uml_net_ethtool_ops;
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 1bcd208c459f..9734994cba1e 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -163,6 +163,7 @@ struct ubd {
         struct scatterlist sg[MAX_SG];
         struct request *request;
         int start_sg, end_sg;
+        sector_t rq_pos;
 };
 
 #define DEFAULT_COW { \
@@ -187,6 +188,7 @@ struct ubd {
         .request =              NULL, \
         .start_sg =             0, \
         .end_sg =               0, \
+        .rq_pos =               0, \
 }
 
 /* Protected by ubd_lock */
@@ -1228,7 +1230,6 @@ static void do_ubd_request(struct request_queue *q)
 {
         struct io_thread_req *io_req;
         struct request *req;
-        sector_t sector;
         int n;
 
         while(1){
@@ -1239,12 +1240,12 @@ static void do_ubd_request(struct request_queue *q)
                                 return;
 
                         dev->request = req;
+                        dev->rq_pos = blk_rq_pos(req);
                         dev->start_sg = 0;
                         dev->end_sg = blk_rq_map_sg(q, req, dev->sg);
                 }
 
                 req = dev->request;
-                sector = blk_rq_pos(req);
                 while(dev->start_sg < dev->end_sg){
                         struct scatterlist *sg = &dev->sg[dev->start_sg];
 
@@ -1256,10 +1257,9 @@ static void do_ubd_request(struct request_queue *q)
                                 return;
                         }
                         prepare_request(req, io_req,
-                                        (unsigned long long)sector << 9,
+                                        (unsigned long long)dev->rq_pos << 9,
                                         sg->offset, sg->length, sg_page(sg));
 
-                        sector += sg->length >> 9;
                         n = os_write_file(thread_fd, &io_req,
                                           sizeof(struct io_thread_req *));
                         if(n != sizeof(struct io_thread_req *)){
@@ -1272,6 +1272,7 @@ static void do_ubd_request(struct request_queue *q)
                                 return;
                         }
 
+                        dev->rq_pos += sg->length >> 9;
                         dev->start_sg++;
                 }
                 dev->end_sg = 0;
diff --git a/arch/x86/boot/early_serial_console.c b/arch/x86/boot/early_serial_console.c
index 030f4b93e255..5df2869c874b 100644
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -58,7 +58,19 @@ static void parse_earlyprintk(void)
                 if (arg[pos] == ',')
                         pos++;
 
-                if (!strncmp(arg, "ttyS", 4)) {
+                /*
+                 * make sure we have
+                 *      "serial,0x3f8,115200"
+                 *      "serial,ttyS0,115200"
+                 *      "ttyS0,115200"
+                 */
+                if (pos == 7 && !strncmp(arg + pos, "0x", 2)) {
+                        port = simple_strtoull(arg + pos, &e, 16);
+                        if (port == 0 || arg + pos == e)
+                                port = DEFAULT_SERIAL_PORT;
+                        else
+                                pos = e - arg;
+                } else if (!strncmp(arg + pos, "ttyS", 4)) {
                         static const int bases[] = { 0x3f8, 0x2f8 };
                         int idx = 0;
 
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index 0350311906ae..2d93bdbc9ac0 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -34,7 +34,7 @@
 #include <asm/ia32.h>
 
 #undef WARN_OLD
-#undef CORE_DUMP /* probably broken */
+#undef CORE_DUMP /* definitely broken */
 
 static int load_aout_binary(struct linux_binprm *, struct pt_regs *regs);
 static int load_aout_library(struct file *);
@@ -131,21 +131,15 @@ static void set_brk(unsigned long start, unsigned long end)
  * macros to write out all the necessary info.
  */
 
-static int dump_write(struct file *file, const void *addr, int nr)
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
+#include <linux/coredump.h>
 
 #define DUMP_WRITE(addr, nr)                         \
         if (!dump_write(file, (void *)(addr), (nr))) \
                 goto end_coredump;
 
-#define DUMP_SEEK(offset)                                               \
-        if (file->f_op->llseek) {                                       \
-                if (file->f_op->llseek(file, (offset), 0) != (offset))  \
-                        goto end_coredump;                              \
-        } else                                                          \
-                file->f_pos = (offset)
+#define DUMP_SEEK(offset)               \
+        if (!dump_seek(file, offset))   \
+                goto end_coredump;
 
 #define START_DATA()    (u.u_tsize << PAGE_SHIFT)
 #define START_STACK(u)  (u.start_stack)
@@ -217,12 +211,6 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
                 dump_size = dump.u_ssize << PAGE_SHIFT;
                 DUMP_WRITE(dump_start, dump_size);
         }
-        /*
-         * Finally dump the task struct.  Not be used by gdb, but
-         * could be useful
-         */
-        set_fs(KERNEL_DS);
-        DUMP_WRITE(current, sizeof(*current));
 end_coredump:
         set_fs(fs);
         return has_dumped;
diff --git a/arch/x86/include/asm/amd_iommu_proto.h b/arch/x86/include/asm/amd_iommu_proto.h
index d2544f1d705d..cb030374b90a 100644
--- a/arch/x86/include/asm/amd_iommu_proto.h
+++ b/arch/x86/include/asm/amd_iommu_proto.h
@@ -38,4 +38,10 @@ static inline void amd_iommu_stats_init(void) { }
 
 #endif /* !CONFIG_AMD_IOMMU_STATS */
 
+static inline bool is_rd890_iommu(struct pci_dev *pdev)
+{
+        return (pdev->vendor == PCI_VENDOR_ID_ATI) &&
+               (pdev->device == PCI_DEVICE_ID_RD890_IOMMU);
+}
+
 #endif /* _ASM_X86_AMD_IOMMU_PROTO_H  */
diff --git a/arch/x86/include/asm/amd_iommu_types.h b/arch/x86/include/asm/amd_iommu_types.h
index 7014e88bc779..08616180deaf 100644
--- a/arch/x86/include/asm/amd_iommu_types.h
+++ b/arch/x86/include/asm/amd_iommu_types.h
@@ -368,6 +368,9 @@ struct amd_iommu {
         /* capabilities of that IOMMU read from ACPI */
         u32 cap;
 
+        /* flags read from acpi table */
+        u8 acpi_flags;
+
         /*
          * Capability pointer. There could be more than one IOMMU per PCI
          * device function if there are more than one AMD IOMMU capability
@@ -411,6 +414,15 @@ struct amd_iommu {
 
         /* default dma_ops domain for that IOMMU */
         struct dma_ops_domain *default_dom;
+
+        /*
+         * This array is required to work around a potential BIOS bug.
+         * The BIOS may miss to restore parts of the PCI configuration
+         * space when the system resumes from S3. The result is that the
+         * IOMMU does not execute commands anymore which leads to system
+         * failure.
+         */
+        u32 cache_cfg[4];
 };
 
 /*
diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
index 545776efeb16..bafd80defa43 100644
--- a/arch/x86/include/asm/bitops.h
+++ b/arch/x86/include/asm/bitops.h
@@ -309,7 +309,7 @@ static inline int test_and_change_bit(int nr, volatile unsigned long *addr)
 static __always_inline int constant_test_bit(unsigned int nr, const volatile unsigned long *addr)
 {
         return ((1UL << (nr % BITS_PER_LONG)) &
-                (((unsigned long *)addr)[nr / BITS_PER_LONG])) != 0;
+                (addr[nr / BITS_PER_LONG])) != 0;
 }
 
 static inline int variable_test_bit(int nr, volatile const unsigned long *addr)
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 0925676266bd..fedf32a8c3ec 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -11,6 +11,8 @@ ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_tsc.o = -pg
 CFLAGS_REMOVE_rtc.o = -pg
 CFLAGS_REMOVE_paravirt-spinlocks.o = -pg
+CFLAGS_REMOVE_pvclock.o = -pg
+CFLAGS_REMOVE_kvmclock.o = -pg
 CFLAGS_REMOVE_ftrace.o = -pg
 CFLAGS_REMOVE_early_printk.o = -pg
 endif
diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index fb7a5f052e2b..fb16f17e59be 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -61,7 +61,7 @@ struct cstate_entry {
                 unsigned int ecx;
         } states[ACPI_PROCESSOR_MAX_POWER];
 };
-static struct cstate_entry *cpu_cstate_entry;   /* per CPU ptr */
+static struct cstate_entry __percpu *cpu_cstate_entry;  /* per CPU ptr */
 
 static short mwait_supported[ACPI_PROCESSOR_MAX_POWER];
 
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index fa044e1e30a2..679b6450382b 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -1953,6 +1953,7 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
                            size_t size,
                            int dir)
 {
+        dma_addr_t flush_addr;
         dma_addr_t i, start;
         unsigned int pages;
 
@@ -1960,6 +1961,7 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
             (dma_addr + size > dma_dom->aperture_size))
                 return;
 
+        flush_addr = dma_addr;
         pages = iommu_num_pages(dma_addr, size, PAGE_SIZE);
         dma_addr &= PAGE_MASK;
         start = dma_addr;
@@ -1974,7 +1976,7 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
         dma_ops_free_addresses(dma_dom, dma_addr, pages);
 
         if (amd_iommu_unmap_flush || dma_dom->need_flush) {
-                iommu_flush_pages(&dma_dom->domain, dma_addr, size);
+                iommu_flush_pages(&dma_dom->domain, flush_addr, size);
                 dma_dom->need_flush = false;
         }
 }
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index 3cc63e2b8dd4..5a170cbbbed8 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -632,6 +632,13 @@ static void __init init_iommu_from_pci(struct amd_iommu *iommu)
         iommu->last_device = calc_devid(MMIO_GET_BUS(range),
                                         MMIO_GET_LD(range));
         iommu->evt_msi_num = MMIO_MSI_NUM(misc);
+
+        if (is_rd890_iommu(iommu->dev)) {
+                pci_read_config_dword(iommu->dev, 0xf0, &iommu->cache_cfg[0]);
+                pci_read_config_dword(iommu->dev, 0xf4, &iommu->cache_cfg[1]);
+                pci_read_config_dword(iommu->dev, 0xf8, &iommu->cache_cfg[2]);
+                pci_read_config_dword(iommu->dev, 0xfc, &iommu->cache_cfg[3]);
+        }
 }
 
 /*
@@ -649,29 +656,9 @@ static void __init init_iommu_from_acpi(struct amd_iommu *iommu,
         struct ivhd_entry *e;
 
         /*
-         * First set the recommended feature enable bits from ACPI
-         * into the IOMMU control registers
+         * First save the recommended feature enable bits from ACPI
          */
-        h->flags & IVHD_FLAG_HT_TUN_EN_MASK ?
-                iommu_feature_enable(iommu, CONTROL_HT_TUN_EN) :
-                iommu_feature_disable(iommu, CONTROL_HT_TUN_EN);
-
-        h->flags & IVHD_FLAG_PASSPW_EN_MASK ?
-                iommu_feature_enable(iommu, CONTROL_PASSPW_EN) :
-                iommu_feature_disable(iommu, CONTROL_PASSPW_EN);
-
-        h->flags & IVHD_FLAG_RESPASSPW_EN_MASK ?
-                iommu_feature_enable(iommu, CONTROL_RESPASSPW_EN) :
-                iommu_feature_disable(iommu, CONTROL_RESPASSPW_EN);
-
-        h->flags & IVHD_FLAG_ISOC_EN_MASK ?
-                iommu_feature_enable(iommu, CONTROL_ISOC_EN) :
-                iommu_feature_disable(iommu, CONTROL_ISOC_EN);
-
-        /*
-         * make IOMMU memory accesses cache coherent
-         */
-        iommu_feature_enable(iommu, CONTROL_COHERENT_EN);
+        iommu->acpi_flags = h->flags;
 
         /*
          * Done. Now parse the device entries
@@ -1116,6 +1103,40 @@ static void init_device_table(void)
         }
 }
 
+static void iommu_init_flags(struct amd_iommu *iommu)
+{
+        iommu->acpi_flags & IVHD_FLAG_HT_TUN_EN_MASK ?
+                iommu_feature_enable(iommu, CONTROL_HT_TUN_EN) :
+                iommu_feature_disable(iommu, CONTROL_HT_TUN_EN);
+
+        iommu->acpi_flags & IVHD_FLAG_PASSPW_EN_MASK ?
+                iommu_feature_enable(iommu, CONTROL_PASSPW_EN) :
+                iommu_feature_disable(iommu, CONTROL_PASSPW_EN);
+
+        iommu->acpi_flags & IVHD_FLAG_RESPASSPW_EN_MASK ?
+                iommu_feature_enable(iommu, CONTROL_RESPASSPW_EN) :
+                iommu_feature_disable(iommu, CONTROL_RESPASSPW_EN);
+
+        iommu->acpi_flags & IVHD_FLAG_ISOC_EN_MASK ?
+                iommu_feature_enable(iommu, CONTROL_ISOC_EN) :
+                iommu_feature_disable(iommu, CONTROL_ISOC_EN);
+
+        /*
+         * make IOMMU memory accesses cache coherent
+         */
+        iommu_feature_enable(iommu, CONTROL_COHERENT_EN);
+}
+
+static void iommu_apply_quirks(struct amd_iommu *iommu)
+{
+        if (is_rd890_iommu(iommu->dev)) {
+                pci_write_config_dword(iommu->dev, 0xf0, iommu->cache_cfg[0]);
+                pci_write_config_dword(iommu->dev, 0xf4, iommu->cache_cfg[1]);
+                pci_write_config_dword(iommu->dev, 0xf8, iommu->cache_cfg[2]);
+                pci_write_config_dword(iommu->dev, 0xfc, iommu->cache_cfg[3]);
+        }
+}
+
 /*
  * This function finally enables all IOMMUs found in the system after
  * they have been initialized
@@ -1126,6 +1147,8 @@ static void enable_iommus(void)
 
         for_each_iommu(iommu) {
                 iommu_disable(iommu);
+                iommu_apply_quirks(iommu);
+                iommu_init_flags(iommu);
                 iommu_set_device_table(iommu);
                 iommu_enable_command_buffer(iommu);
                 iommu_enable_event_buffer(iommu);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index f1efebaf5510..5c5b8f3dddb5 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,
 
         old_cfg = old_desc->chip_data;
 
-        memcpy(cfg, old_cfg, sizeof(struct irq_cfg));
+        cfg->vector = old_cfg->vector;
+        cfg->move_in_progress = old_cfg->move_in_progress;
+        cpumask_copy(cfg->domain, old_cfg->domain);
+        cpumask_copy(cfg->old_domain, old_cfg->old_domain);
 
         init_copy_irq_2_pin(old_cfg, cfg, node);
 }
 
-static void free_irq_cfg(struct irq_cfg *old_cfg)
+static void free_irq_cfg(struct irq_cfg *cfg)
 {
-        kfree(old_cfg);
+        free_cpumask_var(cfg->domain);
+        free_cpumask_var(cfg->old_domain);
+        kfree(cfg);
 }
 
 void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 490dac63c2d2..f2f9ac7da25c 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -545,7 +545,7 @@ void __cpuinit cpu_detect(struct cpuinfo_x86 *c)
         }
 }
 
-static void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
+void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
 {
         u32 tfms, xlvl;
         u32 ebx;
diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
index 3624e8a0f71b..f668bb1f7d43 100644
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -33,5 +33,6 @@ extern const struct cpu_dev *const __x86_cpu_dev_start[],
                             *const __x86_cpu_dev_end[];
 
 extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
+extern void get_cpu_cap(struct cpuinfo_x86 *c);
 
 #endif
diff --git a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
index 994230d4dc4e..4f6f679f2799 100644
--- a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
@@ -368,16 +368,22 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
                 return -ENODEV;
 
         out_obj = output.pointer;
-        if (out_obj->type != ACPI_TYPE_BUFFER)
-                return -ENODEV;
+        if (out_obj->type != ACPI_TYPE_BUFFER) {
+                ret = -ENODEV;
+                goto out_free;
+        }
 
         errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
-        if (errors)
-                return -ENODEV;
+        if (errors) {
+                ret = -ENODEV;
+                goto out_free;
+        }
 
         supported = *((u32 *)(out_obj->buffer.pointer + 4));
-        if (!(supported & 0x1))
-                return -ENODEV;
+        if (!(supported & 0x1)) {
+                ret = -ENODEV;
+                goto out_free;
+        }
 
 out_free:
         kfree(output.pointer);
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 85f69cdeae10..b4389441efbb 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -39,6 +39,7 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
                         misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
                         wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
                         c->cpuid_level = cpuid_eax(0);
+                        get_cpu_cap(c);
                 }
         }
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 5e975298fa81..39aaee5c1ab2 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -141,6 +141,7 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
                                 address = (low & MASK_BLKPTR_LO) >> 21;
                                 if (!address)
                                         break;
+
                                 address += MCG_XBLK_ADDR;
                         } else
                                 ++address;
@@ -148,12 +149,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
                         if (rdmsr_safe(address, &low, &high))
                                 break;
 
-                        if (!(high & MASK_VALID_HI)) {
-                                if (block)
-                                        continue;
-                                else
-                                        break;
-                        }
+                        if (!(high & MASK_VALID_HI))
+                                continue;
 
                         if (!(high & MASK_CNTP_HI)  ||
                              (high & MASK_LOCKED_HI))
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d9368eeda309..169d8804a9f8 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -216,7 +216,7 @@ static __cpuinit int thermal_throttle_add_dev(struct sys_device *sys_dev,
                 err = sysfs_add_file_to_group(&sys_dev->kobj,
                                               &attr_core_power_limit_count.attr,
                                               thermal_attr_group.name);
-        if (cpu_has(c, X86_FEATURE_PTS))
+        if (cpu_has(c, X86_FEATURE_PTS)) {
                 err = sysfs_add_file_to_group(&sys_dev->kobj,
                                               &attr_package_throttle_count.attr,
                                               thermal_attr_group.name);
@@ -224,6 +224,7 @@ static __cpuinit int thermal_throttle_add_dev(struct sys_device *sys_dev,
                         err = sysfs_add_file_to_group(&sys_dev->kobj,
                                         &attr_package_power_limit_count.attr,
                                         thermal_attr_group.name);
+        }
 
         return err;
 }
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 3efdf2870a35..03a5b0385ad6 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -102,6 +102,7 @@ struct cpu_hw_events {
          */
         struct perf_event       *events[X86_PMC_IDX_MAX]; /* in counter order */
         unsigned long           active_mask[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
+        unsigned long           running[BITS_TO_LONGS(X86_PMC_IDX_MAX)];
         int                     enabled;
 
         int                     n_events;
@@ -1010,6 +1011,7 @@ static int x86_pmu_start(struct perf_event *event)
         x86_perf_event_set_period(event);
         cpuc->events[idx] = event;
         __set_bit(idx, cpuc->active_mask);
+        __set_bit(idx, cpuc->running);
         x86_pmu.enable(event);
         perf_event_update_userpage(event);
 
@@ -1141,8 +1143,16 @@ static int x86_pmu_handle_irq(struct pt_regs *regs)
         cpuc = &__get_cpu_var(cpu_hw_events);
 
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
-                if (!test_bit(idx, cpuc->active_mask))
+                if (!test_bit(idx, cpuc->active_mask)) {
+                        /*
+                         * Though we deactivated the counter some cpus
+                         * might still deliver spurious interrupts still
+                         * in flight. Catch them:
+                         */
+                        if (__test_and_clear_bit(idx, cpuc->running))
+                                handled++;
                         continue;
+                }
 
                 event = cpuc->events[idx];
                 hwc = &event->hw;
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index b560db3305be..249015173992 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -660,8 +660,12 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
         for (idx = 0; idx < x86_pmu.num_counters; idx++) {
                 int overflow;
 
-                if (!test_bit(idx, cpuc->active_mask))
+                if (!test_bit(idx, cpuc->active_mask)) {
+                        /* catch in-flight IRQs */
+                        if (__test_and_clear_bit(idx, cpuc->running))
+                                handled++;
                         continue;
+                }
 
                 event = cpuc->events[idx];
                 hwc = &event->hw;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 410fdb3f1939..7494999141b3 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -506,7 +506,7 @@ static int hpet_assign_irq(struct hpet_dev *dev)
 {
         unsigned int irq;
 
-        irq = create_irq();
+        irq = create_irq_nr(0, -1);
         if (!irq)
                 return -EINVAL;
 
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index e0bc186d7501..1c355c550960 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -239,11 +239,10 @@ int module_finalize(const Elf_Ehdr *hdr,
                 apply_paravirt(pseg, pseg + para->sh_size);
         }
 
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
         alternatives_smp_module_del(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index bc5b9b8d4a33..81ed28cb36e6 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -766,7 +766,6 @@ static void init_vmcb(struct vcpu_svm *svm)
 
         control->iopm_base_pa = iopm_base;
         control->msrpm_base_pa = __pa(svm->msrpm);
-        control->tsc_offset = 0;
         control->int_ctl = V_INTR_MASKING_MASK;
 
         init_seg(&save->es);
@@ -902,6 +901,7 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
         svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
         svm->asid_generation = 0;
         init_vmcb(svm);
+        svm->vmcb->control.tsc_offset = 0-native_read_tsc();
 
         err = fx_init(&svm->vcpu);
         if (err)
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index f9897f7a9ef1..9c0d0d399c30 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -420,9 +420,11 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
                 return -1;
         }
 
-        for_each_node_mask(i, nodes_parsed)
-                e820_register_active_regions(i, nodes[i].start >> PAGE_SHIFT,
-                                                nodes[i].end >> PAGE_SHIFT);
+        for (i = 0; i < num_node_memblks; i++)
+                e820_register_active_regions(memblk_nodeid[i],
+                                node_memblk_range[i].start >> PAGE_SHIFT,
+                                node_memblk_range[i].end >> PAGE_SHIFT);
+
         /* for out of order entries in SRAT */
         sort_node_map();
         if (!nodes_cover_memory(nodes)) {
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 009b819f48d0..f1575c9a2572 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -674,6 +674,7 @@ static int __init ppro_init(char **cpu_type)
         case 0x0f:
         case 0x16:
         case 0x17:
+        case 0x1d:
                 *cpu_type = "i386/core_2";
                 break;
         case 0x1a:
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 1a5353a753fc..b2bb5aa3b054 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -489,8 +489,9 @@ static void xen_hvm_setup_cpu_clockevents(void)
 __init void xen_hvm_init_time_ops(void)
 {
         /* vector callback is needed otherwise we cannot receive interrupts
-         * on cpu > 0 */
-        if (!xen_have_vector_callback && num_present_cpus() > 1)
+         * on cpu > 0 and at this point we don't know how many cpus are
+         * available */
+        if (!xen_have_vector_callback)
                 return;
         if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
                 printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
diff --git a/block/elevator.c b/block/elevator.c
index 205b09a5bd9e..4e11559aa2b0 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -938,6 +938,7 @@ int elv_register_queue(struct request_queue *q)
                         }
                 }
                 kobject_uevent(&e->kobj, KOBJ_ADD);
+                e->registered = 1;
         }
         return error;
 }
@@ -947,6 +948,7 @@ static void __elv_unregister_queue(struct elevator_queue *e)
 {
         kobject_uevent(&e->kobj, KOBJ_REMOVE);
         kobject_del(&e->kobj);
+        e->registered = 0;
 }
 
 void elv_unregister_queue(struct request_queue *q)
@@ -1042,11 +1044,13 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
 
         spin_unlock_irq(q->queue_lock);
 
-        __elv_unregister_queue(old_elevator);
+        if (old_elevator->registered) {
+                __elv_unregister_queue(old_elevator);
 
-        err = elv_register_queue(q);
-        if (err)
-                goto fail_register;
+                err = elv_register_queue(q);
+                if (err)
+                        goto fail_register;
+        }
 
         /*
          * finally exit old elevator and turn off BYPASS.
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index b811f2173f6f..88681aca88c5 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -105,7 +105,7 @@ config ACPI_EC_DEBUGFS
 
           Be aware that using this interface can confuse your Embedded
           Controller in a way that a normal reboot is not enough. You then
-          have to power of your system, and remove the laptop battery for
+          have to power off your system, and remove the laptop battery for
           some seconds.
           An Embedded Controller typically is available on laptops and reads
           sensor values like battery state and temperature.
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index b76848c80be3..6b115f6c4313 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -382,31 +382,32 @@ static void acpi_pad_remove_sysfs(struct acpi_device *device)
         device_remove_file(&device->dev, &dev_attr_rrtime);
 }
 
-/* Query firmware how many CPUs should be idle */
-static int acpi_pad_pur(acpi_handle handle, int *num_cpus)
+/*
+ * Query firmware how many CPUs should be idle
+ * return -1 on failure
+ */
+static int acpi_pad_pur(acpi_handle handle)
 {
         struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
         union acpi_object *package;
-        int rev, num, ret = -EINVAL;
+        int num = -1;
 
         if (ACPI_FAILURE(acpi_evaluate_object(handle, "_PUR", NULL, &buffer)))
-                return -EINVAL;
+                return num;
 
         if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
+                return num;
 
         package = buffer.pointer;
-        if (package->type != ACPI_TYPE_PACKAGE || package->package.count != 2)
-                goto out;
-        rev = package->package.elements[0].integer.value;
-        num = package->package.elements[1].integer.value;
-        if (rev != 1 || num < 0)
-                goto out;
-        *num_cpus = num;
-        ret = 0;
-out:
+
+        if (package->type == ACPI_TYPE_PACKAGE &&
+                package->package.count == 2 &&
+                package->package.elements[0].integer.value == 1) /* rev 1 */
+
+                num = package->package.elements[1].integer.value;
+
         kfree(buffer.pointer);
-        return ret;
+        return num;
 }
 
 /* Notify firmware how many CPUs are idle */
@@ -433,7 +434,8 @@ static void acpi_pad_handle_notify(acpi_handle handle)
         uint32_t idle_cpus;
 
         mutex_lock(&isolated_cpus_lock);
-        if (acpi_pad_pur(handle, &num_cpus)) {
+        num_cpus = acpi_pad_pur(handle);
+        if (num_cpus < 0) {
                 mutex_unlock(&isolated_cpus_lock);
                 return;
         }
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index df85b53a674f..7dad9160f209 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -854,6 +854,7 @@ struct acpi_bit_register_info {
         ACPI_BITMASK_POWER_BUTTON_STATUS   | \
         ACPI_BITMASK_SLEEP_BUTTON_STATUS   | \
         ACPI_BITMASK_RT_CLOCK_STATUS       | \
+        ACPI_BITMASK_PCIEXP_WAKE_DISABLE   | \
         ACPI_BITMASK_WAKE_STATUS)
 
 #define ACPI_BITMASK_TIMER_ENABLE               0x0001
diff --git a/drivers/acpi/acpica/exutils.c b/drivers/acpi/acpica/exutils.c
index 74c24d517f81..4093522eed45 100644
--- a/drivers/acpi/acpica/exutils.c
+++ b/drivers/acpi/acpica/exutils.c
@@ -109,7 +109,7 @@ void acpi_ex_enter_interpreter(void)
  *
  * DESCRIPTION: Reacquire the interpreter execution region from within the
  *              interpreter code. Failure to enter the interpreter region is a
- *              fatal system error. Used in  conjuction with
+ *              fatal system error. Used in  conjunction with
  *              relinquish_interpreter
  *
  ******************************************************************************/
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 22cfcfbd9fff..491191e6cf69 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -149,7 +149,7 @@ acpi_rs_move_data(void *destination, void *source, u16 item_count, u8 move_type)
 
                         /*
                          * 16-, 32-, and 64-bit cases must use the move macros that perform
-                         * endian conversion and/or accomodate hardware that cannot perform
+                         * endian conversion and/or accommodate hardware that cannot perform
                          * misaligned memory transfers
                          */
                 case ACPI_RSC_MOVE16:
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 907e350f1c7d..fca34ccfd294 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -34,6 +34,6 @@ config ACPI_APEI_ERST_DEBUG
         depends on ACPI_APEI
         help
           ERST is a way provided by APEI to save and retrieve hardware
-          error infomation to and from a persistent store. Enable this
+          error information to and from a persistent store. Enable this
           if you want to debugging and testing the ERST kernel support
           and firmware implementation.
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 73fd0c7487c1..4a904a4bf05f 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -445,11 +445,15 @@ EXPORT_SYMBOL_GPL(apei_resources_sub);
 int apei_resources_request(struct apei_resources *resources,
                            const char *desc)
 {
-        struct apei_res *res, *res_bak;
+        struct apei_res *res, *res_bak = NULL;
         struct resource *r;
+        int rc;
 
-        apei_resources_sub(resources, &apei_resources_all);
+        rc = apei_resources_sub(resources, &apei_resources_all);
+        if (rc)
+                return rc;
 
+        rc = -EINVAL;
         list_for_each_entry(res, &resources->iomem, list) {
                 r = request_mem_region(res->start, res->end - res->start,
                                        desc);
@@ -475,7 +479,11 @@ int apei_resources_request(struct apei_resources *resources,
                 }
         }
 
-        apei_resources_merge(&apei_resources_all, resources);
+        rc = apei_resources_merge(&apei_resources_all, resources);
+        if (rc) {
+                pr_err(APEI_PFX "Fail to merge resources!\n");
+                goto err_unmap_ioport;
+        }
 
         return 0;
 err_unmap_ioport:
@@ -491,12 +499,13 @@ err_unmap_iomem:
                         break;
                 release_mem_region(res->start, res->end - res->start);
         }
-        return -EINVAL;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(apei_resources_request);
 
 void apei_resources_release(struct apei_resources *resources)
 {
+        int rc;
         struct apei_res *res;
 
         list_for_each_entry(res, &resources->iomem, list)
@@ -504,7 +513,9 @@ void apei_resources_release(struct apei_resources *resources)
         list_for_each_entry(res, &resources->ioport, list)
                 release_region(res->start, res->end - res->start);
 
-        apei_resources_sub(&apei_resources_all, resources);
+        rc = apei_resources_sub(&apei_resources_all, resources);
+        if (rc)
+                pr_err(APEI_PFX "Fail to sub resources!\n");
 }
 EXPORT_SYMBOL_GPL(apei_resources_release);
 
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index 465c885938ee..cf29df69380b 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -426,7 +426,9 @@ DEFINE_SIMPLE_ATTRIBUTE(error_inject_fops, NULL,
 
 static int einj_check_table(struct acpi_table_einj *einj_tab)
 {
-        if (einj_tab->header_length != sizeof(struct acpi_table_einj))
+        if ((einj_tab->header_length !=
+             (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header)))
+            && (einj_tab->header_length != sizeof(struct acpi_table_einj)))
                 return -EINVAL;
         if (einj_tab->header.length < sizeof(struct acpi_table_einj))
                 return -EINVAL;
diff --git a/drivers/acpi/apei/erst-dbg.c b/drivers/acpi/apei/erst-dbg.c
index 5281ddda2777..da1228a9a544 100644
--- a/drivers/acpi/apei/erst-dbg.c
+++ b/drivers/acpi/apei/erst-dbg.c
@@ -2,7 +2,7 @@
  * APEI Error Record Serialization Table debug support
  *
  * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store. This file provide the
+ * information to and from a persistent store. This file provide the
  * debugging/testing support for ERST kernel support and firmware
  * implementation.
  *
@@ -111,11 +111,13 @@ retry:
                 goto out;
         }
         if (len > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                 rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(len, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                p = kmalloc(len, GFP_KERNEL);
+                if (!p)
                         goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                 erst_dbg_buf_len = len;
                 goto retry;
         }
@@ -150,11 +152,13 @@ static ssize_t erst_dbg_write(struct file *filp, const char __user *ubuf,
         if (mutex_lock_interruptible(&erst_dbg_mutex))
                 return -EINTR;
         if (usize > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                 rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(usize, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                p = kmalloc(usize, GFP_KERNEL);
+                if (!p)
                         goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                 erst_dbg_buf_len = usize;
         }
         rc = copy_from_user(erst_dbg_buf, ubuf, usize);
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 18645f4e83cd..1211c03149e8 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -2,7 +2,7 @@
  * APEI Error Record Serialization Table support
  *
  * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store.
+ * information to and from a persistent store.
  *
  * For more information about ERST, please refer to ACPI Specification
  * version 4.0, section 17.4.
@@ -266,13 +266,30 @@ static int erst_exec_move_data(struct apei_exec_context *ctx,
 {
         int rc;
         u64 offset;
+        void *src, *dst;
+
+        /* ioremap does not work in interrupt context */
+        if (in_interrupt()) {
+                pr_warning(ERST_PFX
+                           "MOVE_DATA can not be used in interrupt context");
+                return -EBUSY;
+        }
 
         rc = __apei_exec_read_register(entry, &offset);
         if (rc)
                 return rc;
-        memmove((void *)ctx->dst_base + offset,
-                (void *)ctx->src_base + offset,
-                ctx->var2);
+
+        src = ioremap(ctx->src_base + offset, ctx->var2);
+        if (!src)
+                return -ENOMEM;
+        dst = ioremap(ctx->dst_base + offset, ctx->var2);
+        if (!dst)
+                return -ENOMEM;
+
+        memmove(dst, src, ctx->var2);
+
+        iounmap(src);
+        iounmap(dst);
 
         return 0;
 }
@@ -750,7 +767,9 @@ __setup("erst_disable", setup_erst_disable);
 
 static int erst_check_table(struct acpi_table_erst *erst_tab)
 {
-        if (erst_tab->header_length != sizeof(struct acpi_table_erst))
+        if ((erst_tab->header_length !=
+             (sizeof(struct acpi_table_erst) - sizeof(erst_tab->header)))
+            && (erst_tab->header_length != sizeof(struct acpi_table_einj)))
                 return -EINVAL;
         if (erst_tab->header.length < sizeof(struct acpi_table_erst))
                 return -EINVAL;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 385a6059714a..0d505e59214d 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -302,7 +302,7 @@ static int __devinit ghes_probe(struct platform_device *ghes_dev)
         struct ghes *ghes = NULL;
         int rc = -EINVAL;
 
-        generic = ghes_dev->dev.platform_data;
+        generic = *(struct acpi_hest_generic **)ghes_dev->dev.platform_data;
         if (!generic->enabled)
                 return -ENODEV;
 
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 343168d18266..1a3508a7fe03 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -137,20 +137,23 @@ static int hest_parse_ghes_count(struct acpi_hest_header *hest_hdr, void *data)
 
 static int hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
-        struct acpi_hest_generic *generic;
         struct platform_device *ghes_dev;
         struct ghes_arr *ghes_arr = data;
         int rc;
 
         if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                 return 0;
-        generic = (struct acpi_hest_generic *)hest_hdr;
-        if (!generic->enabled)
+
+        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                 return 0;
         ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
         if (!ghes_dev)
                 return -ENOMEM;
-        ghes_dev->dev.platform_data = generic;
+
+        rc = platform_device_add_data(ghes_dev, &hest_hdr, sizeof(void *));
+        if (rc)
+                goto err;
+
         rc = platform_device_add(ghes_dev);
         if (rc)
                 goto err;
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 8f8bd736d4ff..542e53903891 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -142,7 +142,7 @@ static void __iomem *acpi_pre_map(phys_addr_t paddr,
         list_add_tail_rcu(&map->list, &acpi_iomaps);
         spin_unlock_irqrestore(&acpi_iomaps_lock, flags);
 
-        return vaddr + (paddr - pg_off);
+        return map->vaddr + (paddr - map->paddr);
 err_unmap:
         iounmap(vaddr);
         return NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index dc58402b0a17..98417201e9ce 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -273,7 +273,6 @@ static enum power_supply_property energy_battery_props[] = {
         POWER_SUPPLY_PROP_CYCLE_COUNT,
         POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
         POWER_SUPPLY_PROP_VOLTAGE_NOW,
-        POWER_SUPPLY_PROP_CURRENT_NOW,
         POWER_SUPPLY_PROP_POWER_NOW,
         POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN,
         POWER_SUPPLY_PROP_ENERGY_FULL,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 2bb28b9d91c4..af308d03f492 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -183,6 +183,8 @@ static int __init dmi_disable_osi_vista(const struct dmi_system_id *d)
 {
         printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
         acpi_osi_setup("!Windows 2006");
+        acpi_osi_setup("!Windows 2006 SP1");
+        acpi_osi_setup("!Windows 2006 SP2");
         return 0;
 }
 static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
@@ -202,6 +204,23 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        /*
+         * There have a NVIF method in MSI GX723 DSDT need call by Nvidia
+         * driver (e.g. nouveau) when user press brightness hotkey.
+         * Currently, nouveau driver didn't do the job and it causes there
+         * have a infinite while loop in DSDT when user press hotkey.
+         * We add MSI GX723's dmi information to this table for workaround
+         * this issue.
+         * Will remove MSI GX723 from the table after nouveau grows support.
+         */
+        .callback = dmi_disable_osi_vista,
+        .ident = "MSI GX723",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "GX723"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_vista,
         .ident = "Sony VGN-NS10J_S",
         .matches = {
@@ -226,6 +245,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba Satellite L355",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_win7,
         .ident = "ASUS K50IJ",
         .matches = {
@@ -233,6 +260,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                      DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba P305D",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c221ab535d5..310e3b9749cb 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -55,7 +55,7 @@ EXPORT_SYMBOL(acpi_root_dir);
 static int set_power_nocheck(const struct dmi_system_id *id)
 {
         printk(KERN_NOTICE PREFIX "%s detected - "
-                "disable power check in power transistion\n", id->ident);
+                "disable power check in power transition\n", id->ident);
         acpi_power_nocheck = 1;
         return 0;
 }
@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
 
 static struct dmi_system_id dsdt_dmi_table[] __initdata = {
         /*
-         * Insyde BIOS on some TOSHIBA machines corrupt the DSDT.
+         * Invoke DSDT corruption work-around on all Toshiba Satellite.
          * https://bugzilla.kernel.org/show_bug.cgi?id=14679
          */
         {
          .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite A505",
+         .ident = "TOSHIBA Satellite",
          .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"),
-                },
-        },
-        {
-         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite L505D",
-         .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
                 },
         },
         {}
@@ -1027,7 +1019,7 @@ static int __init acpi_init(void)
 
         /*
          * If the laptop falls into the DMI check table, the power state check
-         * will be disabled in the course of device power transistion.
+         * will be disabled in the course of device power transition.
          */
         dmi_check_system(power_nocheck_dmi_table);
 
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 8a3b840c0bb2..d94d2953c974 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -369,7 +369,9 @@ static void __exit acpi_fan_exit(void)
 
         acpi_bus_unregister_driver(&acpi_fan_driver);
 
+#ifdef CONFIG_ACPI_PROCFS
         remove_proc_entry(ACPI_FAN_CLASS, acpi_root_dir);
+#endif
 
         return;
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index e9699aaed109..bec561c14beb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -29,12 +29,6 @@ static int set_no_mwait(const struct dmi_system_id *id)
 
 static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
         {
-        set_no_mwait, "IFL91 board", {
-        DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
-        DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
-        DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
-        {
         set_no_mwait, "Extensa 5220", {
         DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
         DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
@@ -352,4 +346,5 @@ void __init acpi_early_processor_set_pdc(void)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             early_init_pdc, NULL, NULL, NULL);
+        acpi_get_devices("ACPI0007", early_init_pdc, NULL, NULL);
 }
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 156021892389..347eb21b2353 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -850,7 +850,7 @@ static int __init acpi_processor_init(void)
                 printk(KERN_DEBUG "ACPI: %s registered with cpuidle\n",
                         acpi_idle_driver.name);
         } else {
-                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s",
+                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s\n",
                         cpuidle_get_driver()->name);
         }
 
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index ba1bd263d903..3a73a93596e8 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -447,8 +447,8 @@ int acpi_processor_notify_smm(struct module *calling_module)
         if (!try_module_get(calling_module))
                 return -EINVAL;
 
-        /* is_done is set to negative if an error occured,
-         * and to postitive if _no_ error occured, but SMM
+        /* is_done is set to negative if an error occurred,
+         * and to postitive if _no_ error occurred, but SMM
          * was already notified. This avoids double notification
          * which might lead to unexpected results...
          */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index cf82989ae756..4754ff6e70e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -363,6 +363,12 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
         return 0;
 }
 
+static int __init init_nvs_nosave(const struct dmi_system_id *d)
+{
+        acpi_nvs_nosave();
+        return 0;
+}
+
 static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
         {
         .callback = init_old_suspend_ordering,
@@ -397,6 +403,22 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                 DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                 },
         },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-SR11M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Everex StepNote Series",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
+                },
+        },
         {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 68e2e4582fa2..f8588f81048a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -100,7 +100,7 @@ static const struct acpi_dlevel acpi_debug_levels[] = {
         ACPI_DEBUG_INIT(ACPI_LV_EVENTS),
 };
 
-static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
+static int param_get_debug_layer(char *buffer, const struct kernel_param *kp)
 {
         int result = 0;
         int i;
@@ -128,7 +128,7 @@ static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
         return result;
 }
 
-static int param_get_debug_level(char *buffer, struct kernel_param *kp)
+static int param_get_debug_level(char *buffer, const struct kernel_param *kp)
 {
         int result = 0;
         int i;
@@ -149,10 +149,18 @@ static int param_get_debug_level(char *buffer, struct kernel_param *kp)
         return result;
 }
 
-module_param_call(debug_layer, param_set_uint, param_get_debug_layer,
-                  &acpi_dbg_layer, 0644);
-module_param_call(debug_level, param_set_uint, param_get_debug_level,
-                  &acpi_dbg_level, 0644);
+static struct kernel_param_ops param_ops_debug_layer = {
+        .set = param_set_uint,
+        .get = param_get_debug_layer,
+};
+
+static struct kernel_param_ops param_ops_debug_level = {
+        .set = param_set_uint,
+        .get = param_get_debug_level,
+};
+
+module_param_cb(debug_layer, &param_ops_debug_layer, &acpi_dbg_layer, 0644);
+module_param_cb(debug_level, &param_ops_debug_level, &acpi_dbg_level, 0644);
 
 static char trace_method_name[6];
 module_param_string(trace_method_name, trace_method_name, 6, 0644);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index c5fef01b3c95..b83676126598 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -59,8 +59,8 @@ acpi_backlight_cap_match(acpi_handle handle, u32 level, void *context,
                                   "support\n"));
                 *cap |= ACPI_VIDEO_BACKLIGHT;
                 if (ACPI_FAILURE(acpi_get_handle(handle, "_BQC", &h_dummy)))
-                        printk(KERN_WARNING FW_BUG PREFIX "ACPI brightness "
-                                        "control misses _BQC function\n");
+                        printk(KERN_WARNING FW_BUG PREFIX "No _BQC method, "
+                                "cannot determine initial brightness\n");
                 /* We have backlight support, no need to scan further */
                 return AE_CTRL_TERMINATE;
         }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ff1c945fba98..99d0e5a51148 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -90,6 +90,10 @@ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg);
 static int ahci_pci_device_resume(struct pci_dev *pdev);
 #endif
 
+static struct scsi_host_template ahci_sht = {
+        AHCI_SHT("ahci"),
+};
+
 static struct ata_port_operations ahci_vt8251_ops = {
         .inherits               = &ahci_ops,
         .hardreset              = ahci_vt8251_hardreset,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 474427b6f99f..e5fdeebf9ef0 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -298,7 +298,17 @@ struct ahci_host_priv {
 
 extern int ahci_ignore_sss;
 
-extern struct scsi_host_template ahci_sht;
+extern struct device_attribute *ahci_shost_attrs[];
+extern struct device_attribute *ahci_sdev_attrs[];
+
+#define AHCI_SHT(drv_name)                                              \
+        ATA_NCQ_SHT(drv_name),                                          \
+        .can_queue              = AHCI_MAX_CMDS - 1,                    \
+        .sg_tablesize           = AHCI_MAX_SG,                          \
+        .dma_boundary           = AHCI_DMA_BOUNDARY,                    \
+        .shost_attrs            = ahci_shost_attrs,                     \
+        .sdev_attrs             = ahci_sdev_attrs
+
 extern struct ata_port_operations ahci_ops;
 
 void ahci_save_initial_config(struct device *dev,
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 4e97f33cca44..84b643270e7a 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -23,6 +23,10 @@
 #include <linux/ahci_platform.h>
 #include "ahci.h"
 
+static struct scsi_host_template ahci_platform_sht = {
+        AHCI_SHT("ahci_platform"),
+};
+
 static int __init ahci_probe(struct platform_device *pdev)
 {
         struct device *dev = &pdev->dev;
@@ -145,7 +149,7 @@ static int __init ahci_probe(struct platform_device *pdev)
         ahci_print_info(host, "platform");
 
         rc = ata_host_activate(host, irq, ahci_interrupt, IRQF_SHARED,
-                               &ahci_sht);
+                               &ahci_platform_sht);
         if (rc)
                 goto err0;
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 68dc6785472f..8eea309ea212 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -121,7 +121,7 @@ static DEVICE_ATTR(ahci_port_cmd, S_IRUGO, ahci_show_port_cmd, NULL);
 static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
                    ahci_read_em_buffer, ahci_store_em_buffer);
 
-static struct device_attribute *ahci_shost_attrs[] = {
+struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_link_power_management_policy,
         &dev_attr_em_message_type,
         &dev_attr_em_message,
@@ -132,22 +132,14 @@ static struct device_attribute *ahci_shost_attrs[] = {
         &dev_attr_em_buffer,
         NULL
 };
+EXPORT_SYMBOL_GPL(ahci_shost_attrs);
 
-static struct device_attribute *ahci_sdev_attrs[] = {
+struct device_attribute *ahci_sdev_attrs[] = {
         &dev_attr_sw_activity,
         &dev_attr_unload_heads,
         NULL
 };
-
-struct scsi_host_template ahci_sht = {
-        ATA_NCQ_SHT("ahci"),
-        .can_queue              = AHCI_MAX_CMDS - 1,
-        .sg_tablesize           = AHCI_MAX_SG,
-        .dma_boundary           = AHCI_DMA_BOUNDARY,
-        .shost_attrs            = ahci_shost_attrs,
-        .sdev_attrs             = ahci_sdev_attrs,
-};
-EXPORT_SYMBOL_GPL(ahci_sht);
+EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
 
 struct ata_port_operations ahci_ops = {
         .inherits               = &sata_pmp_port_ops,
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ee9ddeb53417..8cb0347dec28 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3156,7 +3156,6 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
 {  
         struct atm_dev *dev;  
         IADEV *iadev;  
-        unsigned long flags;
         int ret;
 
         iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
@@ -3188,19 +3187,14 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
         ia_dev[iadev_count] = iadev;
         _ia_dev[iadev_count] = dev;
         iadev_count++;
-        spin_lock_init(&iadev->misc_lock);
-        /* First fixes first. I don't want to think about this now. */
-        spin_lock_irqsave(&iadev->misc_lock, flags); 
         if (ia_init(dev) || ia_start(dev)) {  
                 IF_INIT(printk("IA register failed!\n");)
                 iadev_count--;
                 ia_dev[iadev_count] = NULL;
                 _ia_dev[iadev_count] = NULL;
-                spin_unlock_irqrestore(&iadev->misc_lock, flags); 
                 ret = -EINVAL;
                 goto err_out_deregister_dev;
         }
-        spin_unlock_irqrestore(&iadev->misc_lock, flags); 
         IF_EVENT(printk("iadev_count = %d\n", iadev_count);)
 
         iadev->next_board = ia_boards;  
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index b2cd20f549cb..077735e0e04b 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -1022,7 +1022,7 @@ typedef struct iadev_t {
         struct dle_q rx_dle_q;  
         struct free_desc_q *rx_free_desc_qhead;  
         struct sk_buff_head rx_dma_q;  
-        spinlock_t rx_lock, misc_lock;
+        spinlock_t rx_lock;
         struct atm_vcc **rx_open;       /* list of all open VCs */  
         u16 num_rx_desc, rx_buf_sz, rxing;
         u32 rx_pkt_ram, rx_tmp_cnt;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index f916ddf63938..f46138ab38b6 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
         struct solos_card *card = atmdev->dev_data;
         struct sk_buff *skb;
+        unsigned int len;
 
         spin_lock(&card->cli_queue_lock);
         skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         if(skb == NULL)
                 return sprintf(buf, "No data.\n");
 
-        memcpy(buf, skb->data, skb->len);
-        dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+        len = skb->len;
+        memcpy(buf, skb->data, len);
+        dev_dbg(&card->dev->dev, "len: %d\n", len);
 
         kfree_skb(skb);
-        return skb->len;
+        return len;
 }
 
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index b1cbeb59bb76..37a2bb595076 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2369,7 +2369,7 @@ static void pkt_release_dev(struct pktcdvd_device *pd, int flush)
         pkt_shrink_pktlist(pd);
 }
 
-static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
+static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor)
 {
         if (dev_minor >= MAX_WRITERS)
                 return NULL;
diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
index e9da874d0419..03688c2da319 100644
--- a/drivers/block/ps3disk.c
+++ b/drivers/block/ps3disk.c
@@ -113,7 +113,7 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,
                         memcpy(buf, dev->bounce_buf+offset, size);
                 offset += size;
                 flush_kernel_dcache_page(bvec->bv_page);
-                bvec_kunmap_irq(bvec, &flags);
+                bvec_kunmap_irq(buf, &flags);
                 i++;
         }
 }
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2aafafca2b13..1101e251a629 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -202,6 +202,7 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         struct virtio_blk *vblk = disk->private_data;
         struct request *req;
         struct bio *bio;
+        int err;
 
         bio = bio_map_kern(vblk->disk->queue, id_str, VIRTIO_BLK_ID_BYTES,
                            GFP_KERNEL);
@@ -215,7 +216,10 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         }
 
         req->cmd_type = REQ_TYPE_SPECIAL;
-        return blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        err = blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        blk_put_request(req);
+
+        return err;
 }
 
 static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index c2408bbe9c2e..f508690eb958 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -80,7 +80,7 @@
  * Limiting Performance Impact
  * ---------------------------
  * C states, especially those with large exit latencies, can have a real
- * noticable impact on workloads, which is not acceptable for most sysadmins,
+ * noticeable impact on workloads, which is not acceptable for most sysadmins,
  * and in addition, less performance has a power price of its own.
  *
  * As a general rule of thumb, menu assumes that the following heuristic
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 216f9d383b5b..effd140fc042 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -879,7 +879,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_issue_pending = ioat2_issue_pending;
         dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
         dma->device_free_chan_resources = ioat2_free_chan_resources;
-        dma->device_tx_status = ioat_tx_status;
+        dma->device_tx_status = ioat_dma_tx_status;
 
         err = ioat_probe(device);
         if (err)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 86c5ae9fde34..411d5bf50fc4 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -162,7 +162,7 @@ static int mv_is_err_intr(u32 intr_cause)
 
 static void mv_xor_device_clear_eoc_cause(struct mv_xor_chan *chan)
 {
-        u32 val = (1 << (1 + (chan->idx * 16)));
+        u32 val = ~(1 << (chan->idx * 16));
         dev_dbg(chan->device->common.dev, "%s, val 0x%08x\n", __func__, val);
         __raw_writel(val, XOR_INTR_CAUSE(chan));
 }
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index fb64cf36ba61..eb6b54dbb806 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -580,7 +580,6 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
 
         sh_chan = to_sh_chan(chan);
         param = chan->private;
-        slave_addr = param->config->addr;
 
         /* Someone calling slave DMA on a public channel? */
         if (!param || !sg_len) {
@@ -589,6 +588,8 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
                 return NULL;
         }
 
+        slave_addr = param->config->addr;
+
         /*
          * if (param != NULL), this is a successfully requested slave channel,
          * therefore param->config != NULL too.
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 3630308e7b81..6b21e25f7a84 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -339,6 +339,9 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
 {
         int status;
 
+        if (mci->op_state != OP_RUNNING_POLL)
+                return;
+
         status = cancel_delayed_work(&mci->work);
         if (status == 0) {
                 debugf0("%s() not canceled, flush the queue\n",
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index e0187d16dd7c..0fd5b85a0f75 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1140,6 +1140,7 @@ static struct mcidev_sysfs_attribute i7core_udimm_counters_attrs[] = {
         ATTR_COUNTER(0),
         ATTR_COUNTER(1),
         ATTR_COUNTER(2),
+        { .attr = { .name = NULL } }
 };
 
 static struct mcidev_sysfs_group i7core_udimm_counters = {
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 726c3736082f..251987307ebe 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2063,6 +2063,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->mchdev_lock = &mchdev_lock;
         spin_unlock(&mchdev_lock);
 
+        /* XXX Prevent module unload due to memory corruption bugs. */
+        __module_get(THIS_MODULE);
+
         return 0;
 
 out_workqueue_free:
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index b937ccfa7bec..521622b9be7a 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -225,8 +225,8 @@ static void intel_fbdev_destroy(struct drm_device *dev,
 
         drm_framebuffer_cleanup(&ifb->base);
         if (ifb->obj) {
-                drm_gem_object_handle_unreference_unlocked(ifb->obj);
-                drm_gem_object_unreference_unlocked(ifb->obj);
+                drm_gem_object_unreference(ifb->obj);
+                ifb->obj = NULL;
         }
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index c5afd146aeb2..02a4d1fd4845 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -358,7 +358,6 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
 
         if (nouveau_fb->nvbo) {
                 nouveau_bo_unmap(nouveau_fb->nvbo);
-                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                 drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                 nouveau_fb->nvbo = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index d670839cb34d..2cc59f8c658b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -80,7 +80,6 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
         mutex_lock(&dev->struct_mutex);
         nouveau_bo_unpin(chan->notifier_bo);
         mutex_unlock(&dev->struct_mutex);
-        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
         drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
         drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index aee61ae24402..77ebcbc1b6e3 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1148,7 +1148,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
 
                 WREG32(RCU_IND_INDEX, 0x203);
                 efuse_straps_3 = RREG32(RCU_IND_DATA);
-                efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
+                efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
 
                 switch(efuse_box_bit_127_124) {
                 case 0x0:
@@ -1418,6 +1418,7 @@ int evergreen_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
@@ -1531,7 +1532,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 7712c055b3e8..6112ac99ccd7 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -981,6 +981,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                 return r;
         }
         rdev->cp.ready = true;
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -998,6 +999,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
         /* Disable ring */
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->cp.ready = false;
         WREG32(RADEON_CP_CSQ_MODE, 0);
         WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2247,6 +2249,7 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
         /* FIXME we don't use the second aperture yet when we could use it */
         if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                 rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
         if (rdev->flags & RADEON_IS_IGP) {
                 uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7c5f855a43e6..83ba9644dcb9 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1248,6 +1248,7 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
         if (rdev->flags & RADEON_IS_IGP) {
@@ -1917,6 +1918,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
  */
 void r600_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
         WREG32(SCRATCH_UMSK, 0);
 }
@@ -2861,7 +2863,7 @@ static void r600_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(DxMODE_INT_MASK, 0);
         if (ASIC_IS_DCE3(rdev)) {
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 39d566dbabfa..8362974ef41a 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -545,6 +545,7 @@ done:
                 dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                 return r;
         }
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -552,6 +553,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
         int r;
 
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         if (rdev->r600_blit.shader_obj == NULL)
                 return;
         /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 2edd52ece226..73f600d39ad4 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -343,6 +343,7 @@ struct radeon_mc {
          * about vram size near mc fb location */
         u64                     mc_vram_size;
         u64                     visible_vram_size;
+        u64                     active_vram_size;
         u64                     gtt_size;
         u64                     gtt_start;
         u64                     gtt_end;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 2b44cbcb031b..04cac7ec9039 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1613,39 +1613,39 @@ radeon_atombios_get_tv_info(struct radeon_device *rdev)
                 switch (tv_info->ucTV_BootUpDefaultStandard) {
                 case ATOM_TV_NTSC:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Default TV standard: NTSC\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                         break;
                 case ATOM_TV_NTSCJ:
                         tv_std = TV_STD_NTSC_J;
-                        DRM_INFO("Default TV standard: NTSC-J\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                         break;
                 case ATOM_TV_PAL:
                         tv_std = TV_STD_PAL;
-                        DRM_INFO("Default TV standard: PAL\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL\n");
                         break;
                 case ATOM_TV_PALM:
                         tv_std = TV_STD_PAL_M;
-                        DRM_INFO("Default TV standard: PAL-M\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                         break;
                 case ATOM_TV_PALN:
                         tv_std = TV_STD_PAL_N;
-                        DRM_INFO("Default TV standard: PAL-N\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-N\n");
                         break;
                 case ATOM_TV_PALCN:
                         tv_std = TV_STD_PAL_CN;
-                        DRM_INFO("Default TV standard: PAL-CN\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-CN\n");
                         break;
                 case ATOM_TV_PAL60:
                         tv_std = TV_STD_PAL_60;
-                        DRM_INFO("Default TV standard: PAL-60\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                         break;
                 case ATOM_TV_SECAM:
                         tv_std = TV_STD_SECAM;
-                        DRM_INFO("Default TV standard: SECAM\n");
+                        DRM_DEBUG_KMS("Default TV standard: SECAM\n");
                         break;
                 default:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+                        DRM_DEBUG_KMS("Unknown TV standard; defaulting to NTSC\n");
                         break;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index a04b7a6ad95f..7b7ea269549c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -913,47 +913,47 @@ radeon_combios_get_tv_info(struct radeon_device *rdev)
                         switch (RBIOS8(tv_info + 7) & 0xf) {
                         case 1:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO("Default TV standard: NTSC\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                                 break;
                         case 2:
                                 tv_std = TV_STD_PAL;
-                                DRM_INFO("Default TV standard: PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL\n");
                                 break;
                         case 3:
                                 tv_std = TV_STD_PAL_M;
-                                DRM_INFO("Default TV standard: PAL-M\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                                 break;
                         case 4:
                                 tv_std = TV_STD_PAL_60;
-                                DRM_INFO("Default TV standard: PAL-60\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                                 break;
                         case 5:
                                 tv_std = TV_STD_NTSC_J;
-                                DRM_INFO("Default TV standard: NTSC-J\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                                 break;
                         case 6:
                                 tv_std = TV_STD_SCART_PAL;
-                                DRM_INFO("Default TV standard: SCART-PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: SCART-PAL\n");
                                 break;
                         default:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO
+                                DRM_DEBUG_KMS
                                     ("Unknown TV standard; defaulting to NTSC\n");
                                 break;
                         }
 
                         switch ((RBIOS8(tv_info + 9) >> 2) & 0x3) {
                         case 0:
-                                DRM_INFO("29.498928713 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("29.498928713 MHz TV ref clk\n");
                                 break;
                         case 1:
-                                DRM_INFO("28.636360000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("28.636360000 MHz TV ref clk\n");
                                 break;
                         case 2:
-                                DRM_INFO("14.318180000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("14.318180000 MHz TV ref clk\n");
                                 break;
                         case 3:
-                                DRM_INFO("27.000000000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("27.000000000 MHz TV ref clk\n");
                                 break;
                         default:
                                 break;
@@ -1324,7 +1324,7 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
 
         if (tmds_info) {
                 ver = RBIOS8(tmds_info);
-                DRM_INFO("DFP table revision: %d\n", ver);
+                DRM_DEBUG_KMS("DFP table revision: %d\n", ver);
                 if (ver == 3) {
                         n = RBIOS8(tmds_info + 5) + 1;
                         if (n > 4)
@@ -1408,7 +1408,7 @@ bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder
                 offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
                 if (offset) {
                         ver = RBIOS8(offset);
-                        DRM_INFO("External TMDS Table revision: %d\n", ver);
+                        DRM_DEBUG_KMS("External TMDS Table revision: %d\n", ver);
                         tmds->slave_addr = RBIOS8(offset + 4 + 2);
                         tmds->slave_addr >>= 1; /* 7 bit addressing */
                         gpio = RBIOS8(offset + 4 + 3);
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 4a8102512db5..017ac54920fb 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -206,6 +206,7 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
         struct radeon_device *rdev = crtc->dev->dev_private;
         int xorigin = 0, yorigin = 0;
+        int w = radeon_crtc->cursor_width;
 
         if (x < 0)
                 xorigin = -x + 1;
@@ -216,22 +217,7 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
         if (yorigin >= CURSOR_HEIGHT)
                 yorigin = CURSOR_HEIGHT - 1;
 
-        radeon_lock_cursor(crtc, true);
-        if (ASIC_IS_DCE4(rdev)) {
-                /* cursors are offset into the total surface */
-                x += crtc->x;
-                y += crtc->y;
-                DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
-
-                /* XXX: check if evergreen has the same issues as avivo chips */
-                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
-                       ((xorigin ? 0 : x) << 16) |
-                       (yorigin ? 0 : y));
-                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
-                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
-                       ((radeon_crtc->cursor_width - 1) << 16) | (radeon_crtc->cursor_height - 1));
-        } else if (ASIC_IS_AVIVO(rdev)) {
-                int w = radeon_crtc->cursor_width;
+        if (ASIC_IS_AVIVO(rdev)) {
                 int i = 0;
                 struct drm_crtc *crtc_p;
 
@@ -263,7 +249,17 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                         if (w <= 0)
                                 w = 1;
                 }
+        }
 
+        radeon_lock_cursor(crtc, true);
+        if (ASIC_IS_DCE4(rdev)) {
+                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
+                       ((xorigin ? 0 : x) << 16) |
+                       (yorigin ? 0 : y));
+                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
+                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
+                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
+        } else if (ASIC_IS_AVIVO(rdev)) {
                 WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset,
                              ((xorigin ? 0 : x) << 16) |
                              (yorigin ? 0 : y));
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index bc61c5adb56d..efa211898fe6 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -99,7 +99,6 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
                 radeon_bo_unpin(rbo);
                 radeon_bo_unreserve(rbo);
         }
-        drm_gem_object_handle_unreference(gobj);
         drm_gem_object_unreference_unlocked(gobj);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index c26106066ec2..d7ab91416410 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -69,7 +69,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
         u32 c = 0;
 
         rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = 0;
+        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
         rbo->placement.placement = rbo->placements;
         rbo->placement.busy_placement = rbo->placements;
         if (domain & RADEON_GEM_DOMAIN_VRAM)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 353998dc2c03..3481bc7f6f58 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -124,11 +124,8 @@ static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
         int r;
 
         r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
-        if (unlikely(r != 0)) {
-                if (r != -ERESTARTSYS)
-                        dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
+        if (unlikely(r != 0))
                 return r;
-        }
         spin_lock(&bo->tbo.lock);
         if (mem_type)
                 *mem_type = bo->tbo.mem.mem_type;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 8d8359a5d459..b091a1f6fa4e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -693,6 +693,7 @@ void rs600_mc_init(struct radeon_device *rdev)
         rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
         rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         base = RREG32_MC(R_000004_MC_FB_LOCATION);
         base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 70ed66ef1ca8..0137d3e3728d 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,6 +157,7 @@ void rs690_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index ff1cc58920c0..ab83f688263a 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -267,6 +267,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
  */
 void r700_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
         WREG32(SCRATCH_UMSK, 0);
 }
@@ -993,6 +994,7 @@ int rv770_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index af7b57a47fbc..1e9bb2156dcf 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -439,6 +439,42 @@ out_err:
 }
 
 /**
+ * Call bo::reserved and with the lru lock held.
+ * Will release GPU memory type usage on destruction.
+ * This is the place to put in driver specific hooks.
+ * Will release the bo::reserved lock and the
+ * lru lock on exit.
+ */
+
+static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
+{
+        struct ttm_bo_global *glob = bo->glob;
+
+        if (bo->ttm) {
+
+                /**
+                 * Release the lru_lock, since we don't want to have
+                 * an atomic requirement on ttm_tt[unbind|destroy].
+                 */
+
+                spin_unlock(&glob->lru_lock);
+                ttm_tt_unbind(bo->ttm);
+                ttm_tt_destroy(bo->ttm);
+                bo->ttm = NULL;
+                spin_lock(&glob->lru_lock);
+        }
+
+        if (bo->mem.mm_node) {
+                ttm_bo_mem_put(bo, &bo->mem);
+        }
+
+        atomic_set(&bo->reserved, 0);
+        wake_up_all(&bo->event_queue);
+        spin_unlock(&glob->lru_lock);
+}
+
+
+/**
  * If bo idle, remove from delayed- and lru lists, and unref.
  * If not idle, and already on delayed list, do nothing.
  * If not idle, and not on delayed list, put on delayed list,
@@ -453,6 +489,7 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
         int ret;
 
         spin_lock(&bo->lock);
+retry:
         (void) ttm_bo_wait(bo, false, false, !remove_all);
 
         if (!bo->sync_obj) {
@@ -461,28 +498,52 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                 spin_unlock(&bo->lock);
 
                 spin_lock(&glob->lru_lock);
-                put_count = ttm_bo_del_from_lru(bo);
+                ret = ttm_bo_reserve_locked(bo, false, !remove_all, false, 0);
+
+                /**
+                 * Someone else has the object reserved. Bail and retry.
+                 */
+
+                if (unlikely(ret == -EBUSY)) {
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        goto requeue;
+                }
+
+                /**
+                 * We can re-check for sync object without taking
+                 * the bo::lock since setting the sync object requires
+                 * also bo::reserved. A busy object at this point may
+                 * be caused by another thread starting an accelerated
+                 * eviction.
+                 */
+
+                if (unlikely(bo->sync_obj)) {
+                        atomic_set(&bo->reserved, 0);
+                        wake_up_all(&bo->event_queue);
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        if (remove_all)
+                                goto retry;
+                        else
+                                goto requeue;
+                }
 
-                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
-                BUG_ON(ret);
-                if (bo->ttm)
-                        ttm_tt_unbind(bo->ttm);
+                put_count = ttm_bo_del_from_lru(bo);
 
                 if (!list_empty(&bo->ddestroy)) {
                         list_del_init(&bo->ddestroy);
                         ++put_count;
                 }
-                spin_unlock(&glob->lru_lock);
-                ttm_bo_mem_put(bo, &bo->mem);
 
-                atomic_set(&bo->reserved, 0);
+                ttm_bo_cleanup_memtype_use(bo);
 
                 while (put_count--)
                         kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
                 return 0;
         }
-
+requeue:
         spin_lock(&glob->lru_lock);
         if (list_empty(&bo->ddestroy)) {
                 void *sync_obj = bo->sync_obj;
diff --git a/drivers/hid/hid-cando.c b/drivers/hid/hid-cando.c
index 4267a6fdc277..5925bdcd417d 100644
--- a/drivers/hid/hid-cando.c
+++ b/drivers/hid/hid-cando.c
@@ -237,6 +237,8 @@ static const struct hid_device_id cando_devices[] = {
                         USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
                         USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+                USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, cando_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3f7292486024..a0dea3d1296e 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1292,6 +1292,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 765a4f53eb5c..c5ae5f1545bd 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -134,6 +134,7 @@
 #define USB_VENDOR_ID_CANDO             0x2087
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
 
 #define USB_VENDOR_ID_CH                0x068e
 #define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
@@ -503,6 +504,7 @@
 
 #define USB_VENDOR_ID_TURBOX            0x062a
 #define USB_DEVICE_ID_TURBOX_KEYBOARD   0x0201
+#define USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART 0x7100
 
 #define USB_VENDOR_ID_TWINHAN           0x6253
 #define USB_DEVICE_ID_TWINHAN_IR_REMOTE 0x0100
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 47d70c523d93..a3866b5c0c43 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -109,6 +109,12 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t
         int ret = 0;
 
         mutex_lock(&minors_lock);
+
+        if (!hidraw_table[minor]) {
+                ret = -ENODEV;
+                goto out;
+        }
+
         dev = hidraw_table[minor]->hid;
 
         if (!dev->hid_output_raw_report) {
@@ -244,6 +250,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
         mutex_lock(&minors_lock);
         dev = hidraw_table[minor];
+        if (!dev) {
+                ret = -ENODEV;
+                goto out;
+        }
 
         switch (cmd) {
                 case HIDIOCGRDESCSIZE:
@@ -317,6 +327,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
                 ret = -ENOTTY;
         }
+out:
         mutex_unlock(&minors_lock);
         return ret;
 }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 70da3181c8a0..f0260c699adb 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -36,6 +36,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index baa842a80b4b..a23b17a78ace 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,6 +36,7 @@
 #include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
+#include <asm/smp.h>
 
 #define DRVNAME "coretemp"
 
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..75afb3b0e076 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline void superio_enter(int base);
+static inline int superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
 
@@ -861,11 +861,20 @@ static int superio_inw(int base, int reg)
         return val;
 }
 
-static inline void superio_enter(int base)
+static inline int superio_enter(int base)
 {
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                base);
+                return -EBUSY;
+        }
+
         /* according to the datasheet the key must be send twice! */
         outb(SIO_UNLOCK_KEY, base);
         outb(SIO_UNLOCK_KEY, base);
+
+        return 0;
 }
 
 static inline void superio_select(int base, int ld)
@@ -877,6 +886,7 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
         outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
 }
 
 static inline int fan_from_reg(u16 reg)
@@ -2175,21 +2185,15 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
         struct f71882fg_sio_data *sio_data)
 {
-        int err = -ENODEV;
         u16 devid;
-
-        /* Don't step on other drivers' I/O space by accident */
-        if (!request_region(sioaddr, 2, DRVNAME)) {
-                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-                                (int)sioaddr);
-                return -EBUSY;
-        }
-
-        superio_enter(sioaddr);
+        int err = superio_enter(sioaddr);
+        if (err)
+                return err;
 
         devid = superio_inw(sioaddr, SIO_REG_MANID);
         if (devid != SIO_FINTEK_ID) {
                 pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
                 goto exit;
         }
 
@@ -2213,6 +2217,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
         default:
                 printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
                        (unsigned int)devid);
+                err = -ENODEV;
                 goto exit;
         }
 
@@ -2223,12 +2228,14 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 
         if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
                 printk(KERN_WARNING DRVNAME ": Device not activated\n");
+                err = -ENODEV;
                 goto exit;
         }
 
         *address = superio_inw(sioaddr, SIO_REG_ADDR);
         if (*address == 0) {
                 printk(KERN_WARNING DRVNAME ": Base address not set\n");
+                err = -ENODEV;
                 goto exit;
         }
         *address &= ~(REGION_LENGTH - 1);       /* Ignore 3 LSB */
@@ -2239,7 +2246,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
                 (int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
         superio_exit(sioaddr);
-        release_region(sioaddr, 2);
         return err;
 }
 
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f7bd2613cecc..f2de3be35df3 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -677,6 +677,11 @@ static int __devinit cpm_i2c_probe(struct platform_device *ofdev,
         dev_dbg(&ofdev->dev, "hw routines for %s registered.\n",
                 cpm->adap.name);
 
+        /*
+         * register OF I2C devices
+         */
+        of_i2c_register_devices(&cpm->adap);
+
         return 0;
 out_shut:
         cpm_i2c_shutdown(cpm);
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 2222c87876b9..b8feac5f2ef4 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -357,9 +357,6 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
 
         dev->terminate = 0;
 
-        /* write the data into mode register */
-        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
-
         /*
          * First byte should be set here, not after interrupt,
          * because transmit-data-ready interrupt can come before
@@ -371,6 +368,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
                 dev->buf_len--;
         }
 
+        /* write the data into mode register; start transmitting */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
+
         r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                       dev->adapter.timeout);
         if (r == 0) {
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 43ca32fddde2..89eedf45d30e 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -761,6 +761,9 @@ static int __devinit iic_probe(struct platform_device *ofdev,
         dev_info(&ofdev->dev, "using %s mode\n",
                  dev->fast_mode ? "fast (400 kHz)" : "standard (100 kHz)");
 
+        /* Now register all the child nodes */
+        of_i2c_register_devices(adap);
+
         return 0;
 
 error_cleanup:
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a1c419a716af..b74e6dc6886c 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -632,6 +632,7 @@ static int __devinit fsl_i2c_probe(struct platform_device *op,
                 dev_err(i2c->dev, "failed to add adapter\n");
                 goto fail_add;
         }
+        of_i2c_register_devices(&i2c->adap);
 
         return result;
 
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index 0e9f85d0a835..56dbe54e8811 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -218,7 +218,7 @@ static int octeon_i2c_wait(struct octeon_i2c *i2c)
                 return result;
         } else if (result == 0) {
                 dev_dbg(i2c->dev, "%s: timeout\n", __func__);
-                result = -ETIMEDOUT;
+                return -ETIMEDOUT;
         }
 
         return 0;
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index bbd77603a417..29933f87d8fa 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -71,8 +71,8 @@ static int pca_isa_readbyte(void *pd, int reg)
 
 static int pca_isa_waitforcompletion(void *pd)
 {
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (irq > -1) {
                 ret = wait_event_timeout(pca_wait,
@@ -81,11 +81,15 @@ static int pca_isa_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + pca_isa_ops.timeout;
-                while (((pca_isa_readbyte(pd, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (pca_isa_readbyte(pd, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
+
         return ret > 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index ef5c78487eb7..5f6d7f89e225 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -80,8 +80,8 @@ static void i2c_pca_pf_writebyte32(void *pd, int reg, int val)
 static int i2c_pca_pf_waitforcompletion(void *pd)
 {
         struct i2c_pca_pf_data *i2c = pd;
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (i2c->irq) {
                 ret = wait_event_timeout(i2c->wait,
@@ -90,10 +90,13 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + i2c->adap.timeout;
-                while (((i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
 
         return ret > 0;
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 72902e0bbfa7..bf831bf81587 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -662,8 +662,8 @@ static int s3c24xx_i2c_clockrate(struct s3c24xx_i2c *i2c, unsigned int *got)
                 unsigned long sda_delay;
 
                 if (pdata->sda_delay) {
-                        sda_delay = (freq / 1000) * pdata->sda_delay;
-                        sda_delay /= 1000000;
+                        sda_delay = clkin * pdata->sda_delay;
+                        sda_delay = DIV_ROUND_UP(sda_delay, 1000000);
                         sda_delay = DIV_ROUND_UP(sda_delay, 5);
                         if (sda_delay > 3)
                                 sda_delay = 3;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 6649176de940..bea4c5021d26 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
-#include <linux/of_i2c.h>
 #include <linux/of_device.h>
 #include <linux/completion.h>
 #include <linux/hardirq.h>
@@ -197,11 +196,12 @@ static int i2c_device_pm_suspend(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->suspend ? pm->suspend(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->suspend ? pm->suspend(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
@@ -216,12 +216,6 @@ static int i2c_device_pm_resume(struct device *dev)
         else
                 ret = i2c_legacy_resume(dev);
 
-        if (!ret) {
-                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
-                pm_runtime_enable(dev);
-        }
-
         return ret;
 }
 
@@ -229,11 +223,12 @@ static int i2c_device_pm_freeze(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->freeze ? pm->freeze(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->freeze ? pm->freeze(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
@@ -242,11 +237,12 @@ static int i2c_device_pm_thaw(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->thaw ? pm->thaw(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->thaw ? pm->thaw(dev) : 0;
+        }
 
         return i2c_legacy_resume(dev);
 }
@@ -255,11 +251,12 @@ static int i2c_device_pm_poweroff(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->poweroff ? pm->poweroff(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->poweroff ? pm->poweroff(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
@@ -876,9 +873,6 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
         if (adap->nr < __i2c_first_dynamic_bus_num)
                 i2c_scan_static_board_info(adap);
 
-        /* Register devices from the device tree */
-        of_i2c_register_devices(adap);
-
         /* Notify drivers */
         mutex_lock(&core_lock);
         bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a10152bb1427..c37ef64d1465 100755..100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -83,7 +83,7 @@ static unsigned int mwait_substates;
 /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
 static unsigned int lapic_timer_reliable_states;
 
-static struct cpuidle_device *intel_idle_cpuidle_devices;
+static struct cpuidle_device __percpu *intel_idle_cpuidle_devices;
 static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 
 static struct cpuidle_state *cpuidle_state_table;
@@ -108,7 +108,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "NHM-C3",
                 .desc = "MWAIT 0x10",
                 .driver_data = (void *) 0x10,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 20,
                 .power_usage = 500,
                 .target_residency = 80,
@@ -117,7 +117,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "NHM-C6",
                 .desc = "MWAIT 0x20",
                 .driver_data = (void *) 0x20,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 200,
                 .power_usage = 350,
                 .target_residency = 800,
@@ -149,7 +149,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                 .name = "ATM-C4",
                 .desc = "MWAIT 0x30",
                 .driver_data = (void *) 0x30,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                 .exit_latency = 100,
                 .power_usage = 250,
                 .target_residency = 400,
@@ -157,13 +157,13 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
         { /* MWAIT C5 */ },
         { /* MWAIT C6 */
                 .name = "ATM-C6",
-                .desc = "MWAIT 0x40",
-                .driver_data = (void *) 0x40,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
-                .exit_latency = 200,
+                .desc = "MWAIT 0x52",
+                .driver_data = (void *) 0x52,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
+                .exit_latency = 140,
                 .power_usage = 150,
-                .target_residency = 800,
-                .enter = NULL },        /* disabled */
+                .target_residency = 560,
+                .enter = &intel_idle },
 };
 
 /**
@@ -185,6 +185,16 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state)
 
         local_irq_disable();
 
+        /*
+         * If the state flag indicates that the TLB will be flushed or if this
+         * is the deepest c-state supported, do a voluntary leave mm to avoid
+         * costly and mostly unnecessary wakeups for flushing the user TLB's
+         * associated with the active mm.
+         */
+        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED ||
+            (&dev->states[dev->state_count - 1] == state))
+                leave_mm(cpu);
+
         if (!(lapic_timer_reliable_states & (1 << (cstate))))
                 clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
 
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index d88077a21994..13c88871dc3b 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -463,7 +463,8 @@ static int send_connect(struct iwch_ep *ep)
             V_MSS_IDX(mtu_idx) |
             V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
         opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
         skb->priority = CPL_PRIORITY_SETUP;
         set_arp_failure_handler(skb, act_open_req_arp_failure);
 
@@ -1280,7 +1281,8 @@ static void accept_cr(struct iwch_ep *ep, __be32 peer_ip, struct sk_buff *skb)
             V_MSS_IDX(mtu_idx) |
             V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
         opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
 
         rpl = cplhdr(skb);
         rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index d85bd8a7967d..22239e988498 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -483,6 +483,9 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
 
         memcpy(joydev->abspam, abspam, len);
 
+        for (i = 0; i < joydev->nabs; i++)
+                joydev->absmap[joydev->abspam[i]] = i;
+
  out:
         kfree(abspam);
         return retval;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 0d4266a533a5..360698553eb5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -404,6 +404,13 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                 retval = uinput_validate_absbits(dev);
                 if (retval < 0)
                         goto exit;
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        input_mt_create_slots(dev, nslot);
+                        input_set_events_per_packet(dev, 6 * nslot);
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
         }
 
         udev->state = UIST_SETUP_COMPLETE;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 42ba3691d908..b35876ee6908 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -103,27 +103,26 @@ static void wacom_sys_irq(struct urb *urb)
 static int wacom_open(struct input_dev *dev)
 {
         struct wacom *wacom = input_get_drvdata(dev);
+        int retval = 0;
 
-        mutex_lock(&wacom->lock);
-
-        wacom->irq->dev = wacom->usbdev;
-
-        if (usb_autopm_get_interface(wacom->intf) < 0) {
-                mutex_unlock(&wacom->lock);
+        if (usb_autopm_get_interface(wacom->intf) < 0)
                 return -EIO;
-        }
+
+        mutex_lock(&wacom->lock);
 
         if (usb_submit_urb(wacom->irq, GFP_KERNEL)) {
-                usb_autopm_put_interface(wacom->intf);
-                mutex_unlock(&wacom->lock);
-                return -EIO;
+                retval = -EIO;
+                goto out;
         }
 
         wacom->open = true;
         wacom->intf->needs_remote_wakeup = 1;
 
+out:
         mutex_unlock(&wacom->lock);
-        return 0;
+        if (retval)
+                usb_autopm_put_interface(wacom->intf);
+        return retval;
 }
 
 static void wacom_close(struct input_dev *dev)
@@ -135,6 +134,8 @@ static void wacom_close(struct input_dev *dev)
         wacom->open = false;
         wacom->intf->needs_remote_wakeup = 0;
         mutex_unlock(&wacom->lock);
+
+        usb_autopm_put_interface(wacom->intf);
 }
 
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 6e29badb969e..47fd7a041c52 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -442,8 +442,10 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
         /* general pen packet */
         if ((data[1] & 0xb8) == 0xa0) {
                 t = (data[6] << 2) | ((data[7] >> 6) & 3);
-                if (features->type >= INTUOS4S && features->type <= INTUOS4L)
+                if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
+                    features->type == WACOM_21UX2) {
                         t = (t << 1) | (data[1] & 1);
+                }
                 input_report_abs(input, ABS_PRESSURE, t);
                 input_report_abs(input, ABS_TILT_X,
                                 ((data[7] << 1) & 0x7e) | (data[8] >> 7));
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                         }
                         else if(callid>=0x0000 && callid<=0x7FFF)
                         {
+                                int len;
+
                                 pr_debug("%s: Got Incoming Call\n",
                                                 sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-                                strcpy(setup.eazmsn,
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
+                                                sizeof(setup.phone));
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                 setup.si1 = 7;
                                 setup.si2 = 0;
                                 setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                  * Handle a GetMyNumber Rsp
                  */
                 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                         continue;
                 }
                         
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index 74dce4ba0262..350eb34f049c 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -81,7 +81,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
         int cmd_level;
         int slow_level;
 
-        read_lock(&led_dat->rw_lock);
+        read_lock_irq(&led_dat->rw_lock);
 
         cmd_level = gpio_get_value(led_dat->cmd);
         slow_level = gpio_get_value(led_dat->slow);
@@ -95,7 +95,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
                 }
         }
 
-        read_unlock(&led_dat->rw_lock);
+        read_unlock_irq(&led_dat->rw_lock);
 
         return ret;
 }
@@ -104,8 +104,9 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                              enum ns2_led_modes mode)
 {
         int i;
+        unsigned long flags;
 
-        write_lock(&led_dat->rw_lock);
+        write_lock_irqsave(&led_dat->rw_lock, flags);
 
         for (i = 0; i < ARRAY_SIZE(ns2_led_modval); i++) {
                 if (mode == ns2_led_modval[i].mode) {
@@ -116,7 +117,7 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                 }
         }
 
-        write_unlock(&led_dat->rw_lock);
+        write_unlock_irqrestore(&led_dat->rw_lock, flags);
 }
 
 static void ns2_led_set(struct led_classdev *led_cdev,
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed4900ade93a..e4fb58db5454 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1000,10 +1000,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 page = bitmap->sb_page;
                                 offset = sizeof(bitmap_super_t);
                                 if (!file)
-                                        read_sb_page(bitmap->mddev,
-                                                     bitmap->mddev->bitmap_info.offset,
-                                                     page,
-                                                     index, count);
+                                        page = read_sb_page(
+                                                bitmap->mddev,
+                                                bitmap->mddev->bitmap_info.offset,
+                                                page,
+                                                index, count);
                         } else if (file) {
                                 page = read_page(file, index, bitmap, count);
                                 offset = 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ad83a4dcadc3..0b830bbe1d8b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1839,7 +1839,9 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
 
                 /* take from bio_init */
                 bio->bi_next = NULL;
+                bio->bi_flags &= ~(BIO_POOL_MASK-1);
                 bio->bi_flags |= 1 << BIO_UPTODATE;
+                bio->bi_comp_cpu = -1;
                 bio->bi_rw = READ;
                 bio->bi_vcnt = 0;
                 bio->bi_idx = 0;
@@ -1912,7 +1914,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                 break;
                         BUG_ON(sync_blocks < (PAGE_SIZE>>9));
-                        if (len > (sync_blocks<<9))
+                        if ((len >> 9) > sync_blocks)
                                 len = sync_blocks<<9;
                 }
 
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index 7e82a9df726b..7961d59f5cac 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -319,7 +319,7 @@ static void ir_timer_keyup(unsigned long cookie)
          * a keyup event might follow immediately after the keydown.
          */
         spin_lock_irqsave(&ir->keylock, flags);
-        if (time_is_after_eq_jiffies(ir->keyup_jiffies))
+        if (time_is_before_eq_jiffies(ir->keyup_jiffies))
                 ir_keyup(ir);
         spin_unlock_irqrestore(&ir->keylock, flags);
 }
@@ -510,6 +510,13 @@ int __ir_input_register(struct input_dev *input_dev,
                    (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_IR_RAW) ?
                         " in raw mode" : "");
 
+        /*
+         * Default delay of 250ms is too short for some protocols, expecially
+         * since the timeout is currently set to 250ms. Increase it to 500ms,
+         * to avoid wrong repetition of the keycodes.
+         */
+        input_dev->rep[REP_DELAY] = 500;
+
         return 0;
 
 out_event:
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c
index 77b5946413c0..e63f757d5d72 100644
--- a/drivers/media/IR/ir-lirc-codec.c
+++ b/drivers/media/IR/ir-lirc-codec.c
@@ -267,7 +267,7 @@ static int ir_lirc_register(struct input_dev *input_dev)
                         features |= LIRC_CAN_SET_SEND_CARRIER;
 
                 if (ir_dev->props->s_tx_duty_cycle)
-                        features |= LIRC_CAN_SET_REC_DUTY_CYCLE;
+                        features |= LIRC_CAN_SET_SEND_DUTY_CYCLE;
         }
 
         if (ir_dev->props->s_rx_carrier_range)
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccfa..8e0e1b1f8c87 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
                         "rc%u",  (unsigned int)ir->devno);
 
         if (IS_ERR(ir->raw->thread)) {
+                int ret = PTR_ERR(ir->raw->thread);
+
                 kfree(ir->raw);
                 ir->raw = NULL;
-                return PTR_ERR(ir->raw->thread);
+                return ret;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index 96dafc425c8e..46d42467f9b4 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d,
         char *tmp = buf;
         int i;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 enabled = ir_dev->rc_tab.ir_type;
                 allowed = ir_dev->props->allowed_protos;
-        } else {
+        } else if (ir_dev->raw) {
                 enabled = ir_dev->raw->enabled_protocols;
                 allowed = ir_raw_get_allowed_protocols();
-        }
+        } else
+                return sprintf(tmp, "[builtin]\n");
 
         IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                    (long long)allowed,
@@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d,
         int rc, i, count = 0;
         unsigned long flags;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                 type = ir_dev->rc_tab.ir_type;
-        else
+        else if (ir_dev->raw)
                 type = ir_dev->raw->enabled_protocols;
+        else {
+                IR_dprintk(1, "Protocol switching not supported\n");
+                return -EINVAL;
+        }
 
         while ((tmp = strsep((char **) &data, " \n")) != NULL) {
                 if (!*tmp)
@@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d,
                 }
         }
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 spin_lock_irqsave(&ir_dev->rc_tab.lock, flags);
                 ir_dev->rc_tab.ir_type = type;
                 spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);
diff --git a/drivers/media/IR/keymaps/rc-rc6-mce.c b/drivers/media/IR/keymaps/rc-rc6-mce.c
index 64264f7f838f..39557ad401b6 100644
--- a/drivers/media/IR/keymaps/rc-rc6-mce.c
+++ b/drivers/media/IR/keymaps/rc-rc6-mce.c
@@ -19,6 +19,7 @@ static struct ir_scancode rc6_mce[] = {
 
         { 0x800f0416, KEY_PLAY },
         { 0x800f0418, KEY_PAUSE },
+        { 0x800f046e, KEY_PLAYPAUSE },
         { 0x800f0419, KEY_STOP },
         { 0x800f0417, KEY_RECORD },
 
@@ -37,6 +38,8 @@ static struct ir_scancode rc6_mce[] = {
         { 0x800f0411, KEY_VOLUMEDOWN },
         { 0x800f0412, KEY_CHANNELUP },
         { 0x800f0413, KEY_CHANNELDOWN },
+        { 0x800f043a, KEY_BRIGHTNESSUP },
+        { 0x800f0480, KEY_BRIGHTNESSDOWN },
 
         { 0x800f0401, KEY_NUMERIC_1 },
         { 0x800f0402, KEY_NUMERIC_2 },
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
index ac6bb2c01a48..bc620e10ef77 100644
--- a/drivers/media/IR/mceusb.c
+++ b/drivers/media/IR/mceusb.c
@@ -120,6 +120,10 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
         /* Philips eHome Infrared Transceiver */
         { USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
         /* Realtek MCE IR Receiver */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
         /* SMK/Toshiba G83C0004D410 */
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index fe818348b8a3..48397f103d32 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -673,9 +673,6 @@ static int dib0700_probe(struct usb_interface *intf,
                         else
                                 dev->props.rc.core.bulk_mode = false;
 
-                        /* Need a higher delay, to avoid wrong repeat */
-                        dev->rc_input_dev->rep[REP_DELAY] = 500;
-
                         dib0700_rc_setup(dev);
 
                         return 0;
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index f634d2e784b2..e06acd1fecb6 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -940,6 +940,58 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
         return adap->fe == NULL ? -ENODEV : 0;
 }
 
+/* STK7770P */
+static struct dib7000p_config dib7770p_dib7000p_config = {
+        .output_mpeg2_in_188_bytes = 1,
+
+        .agc_config_count = 1,
+        .agc = &dib7070_agc_config,
+        .bw  = &dib7070_bw_config_12_mhz,
+        .tuner_is_baseband = 1,
+        .spur_protect = 1,
+
+        .gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
+        .gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
+        .gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
+
+        .hostbus_diversity = 1,
+        .enable_current_mirror = 1,
+        .disable_sample_and_hold = 0,
+};
+
+static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+{
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+        else
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+
+        dib0700_ctrl_clock(adap->dev, 72, 1);
+
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+
+        if (dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
+                                     &dib7770p_dib7000p_config) != 0) {
+                err("%s: dib7000p_i2c_enumeration failed.  Cannot continue\n",
+                    __func__);
+                return -ENODEV;
+        }
+
+        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
+                &dib7770p_dib7000p_config);
+        return adap->fe == NULL ? -ENODEV : 0;
+}
+
 /* DIB807x generic */
 static struct dibx000_agc_config dib807x_agc_config[2] = {
         {
@@ -1781,7 +1833,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_XXS_2) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
-        { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x000, 0x3f00) },
         { USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
 /* 65 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV73ESE) },
         { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV282E) },
@@ -2406,7 +2458,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                                 .pid_filter_count = 32,
                                 .pid_filter       = stk70x0p_pid_filter,
                                 .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
-                                .frontend_attach  = stk7070p_frontend_attach,
+                                .frontend_attach  = stk7770p_frontend_attach,
                                 .tuner_attach     = dib7770p_tuner_attach,
 
                                 DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c
index 6b22ec64ab0c..f896337b4535 100644
--- a/drivers/media/dvb/dvb-usb/opera1.c
+++ b/drivers/media/dvb/dvb-usb/opera1.c
@@ -483,9 +483,7 @@ static int opera1_xilinx_load_firmware(struct usb_device *dev,
                 }
         }
         kfree(p);
-        if (fw) {
-                release_firmware(fw);
-        }
+        release_firmware(fw);
         return ret;
 }
 
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 2e28b973dfd3..3aed0d433921 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -260,6 +260,9 @@ static void dib7000p_set_adc_state(struct dib7000p_state *state, enum dibx000_ad
 
 //      dprintk( "908: %x, 909: %x\n", reg_908, reg_909);
 
+        reg_909 |= (state->cfg.disable_sample_and_hold & 1) << 4;
+        reg_908 |= (state->cfg.enable_current_mirror & 1) << 7;
+
         dib7000p_write_word(state, 908, reg_908);
         dib7000p_write_word(state, 909, reg_909);
 }
@@ -778,7 +781,10 @@ static void dib7000p_set_channel(struct dib7000p_state *state, struct dvb_fronte
                 default:
                 case GUARD_INTERVAL_1_32: value *= 1; break;
         }
-        state->div_sync_wait = (value * 3) / 2 + 32; // add 50% SFN margin + compensate for one DVSY-fifo TODO
+        if (state->cfg.diversity_delay == 0)
+                state->div_sync_wait = (value * 3) / 2 + 48; // add 50% SFN margin + compensate for one DVSY-fifo
+        else
+                state->div_sync_wait = (value * 3) / 2 + state->cfg.diversity_delay; // add 50% SFN margin + compensate for one DVSY-fifo
 
         /* deactive the possibility of diversity reception if extended interleaver */
         state->div_force_off = !1 && ch->u.ofdm.transmission_mode != TRANSMISSION_MODE_8K;
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 805dd13a97ee..da17345bf5bd 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -33,6 +33,11 @@ struct dib7000p_config {
         int (*agc_control) (struct dvb_frontend *, u8 before);
 
         u8 output_mode;
+        u8 disable_sample_and_hold : 1;
+
+        u8 enable_current_mirror : 1;
+        u8 diversity_delay;
+
 };
 
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index d93468cd3a85..ff3b0fa901b3 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1098,33 +1098,26 @@ EXPORT_SYMBOL_GPL(smscore_onresponse);
  *
  * @return pointer to descriptor on success, NULL on error.
  */
-struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+
+struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
 {
         struct smscore_buffer_t *cb = NULL;
         unsigned long flags;
 
-        DEFINE_WAIT(wait);
-
         spin_lock_irqsave(&coredev->bufferslock, flags);
-
-        /* This function must return a valid buffer, since the buffer list is
-         * finite, we check that there is an available buffer, if not, we wait
-         * until such buffer become available.
-         */
-
-        prepare_to_wait(&coredev->buffer_mng_waitq, &wait, TASK_INTERRUPTIBLE);
-        if (list_empty(&coredev->buffers)) {
-                spin_unlock_irqrestore(&coredev->bufferslock, flags);
-                schedule();
-                spin_lock_irqsave(&coredev->bufferslock, flags);
+        if (!list_empty(&coredev->buffers)) {
+                cb = (struct smscore_buffer_t *) coredev->buffers.next;
+                list_del(&cb->entry);
         }
+        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        return cb;
+}
 
-        finish_wait(&coredev->buffer_mng_waitq, &wait);
-
-        cb = (struct smscore_buffer_t *) coredev->buffers.next;
-        list_del(&cb->entry);
+struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+{
+        struct smscore_buffer_t *cb = NULL;
 
-        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        wait_event(coredev->buffer_mng_waitq, (cb = get_entry(coredev)));
 
         return cb;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 67a4ec8768a6..4ce541a5eb47 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -395,7 +395,7 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
         radio->registers[POWERCFG] = POWERCFG_ENABLE;
         if (si470x_set_register(radio, POWERCFG) < 0) {
                 retval = -EIO;
-                goto err_all;
+                goto err_video;
         }
         msleep(110);
 
diff --git a/drivers/media/video/cx231xx/Makefile b/drivers/media/video/cx231xx/Makefile
index 755dd0ce65ff..6f2b57384488 100644
--- a/drivers/media/video/cx231xx/Makefile
+++ b/drivers/media/video/cx231xx/Makefile
@@ -11,4 +11,5 @@ EXTRA_CFLAGS += -Idrivers/media/video
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-usb
 
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 6bdc0ef18119..f2a4900014bc 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-chip-ident.h>
 
 #include <media/cx25840.h>
+#include "dvb-usb-ids.h"
 #include "xc5000.h"
 
 #include "cx231xx.h"
@@ -175,6 +176,8 @@ struct usb_device_id cx231xx_id_table[] = {
          .driver_info = CX231XX_BOARD_CNXT_RDE_250},
         {USB_DEVICE(0x0572, 0x58A1),
          .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+        {USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x4000,0x4fff),
+         .driver_info = CX231XX_BOARD_UNKNOWN},
         {},
 };
 
@@ -226,14 +229,16 @@ void cx231xx_pre_card_setup(struct cx231xx *dev)
                      dev->board.name, dev->model);
 
         /* set the direction for GPIO pins */
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
+        if (dev->board.tuner_gpio) {
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
 
-        /* request some modules if any required */
+                /* request some modules if any required */
 
-        /* reset the Tuner */
-        cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+                /* reset the Tuner */
+                cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+        }
 
         /* set the mode to Analog mode initially */
         cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 86ca8c2359dd..f5a3e74c3c7c 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1996,7 +1996,7 @@ static int cx25840_probe(struct i2c_client *client,
 
                 state->volume = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_VOLUME,
-                        0, 65335, 65535 / 100, default_volume);
+                        0, 65535, 65535 / 100, default_volume);
                 state->mute = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_MUTE,
                         0, 1, 1, 0);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 99dbae117591..0fa85cbefbb1 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -17,7 +17,7 @@ config VIDEO_CX88
 
 config VIDEO_CX88_ALSA
         tristate "Conexant 2388x DMA audio support"
-        depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        depends on VIDEO_CX88 && SND
         select SND_PCM
         ---help---
           This is a video4linux driver for direct (DMA) audio on
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index b9846106913e..78abc1c1f9d5 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                 usb_rcvintpipe(dev, ep->bEndpointAddress),
                 buffer, buffer_len,
                 int_irq, (void *)gspca_dev, interval);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
         gspca_dev->int_urb = urb;
         ret = usb_submit_urb(urb, GFP_KERNEL);
         if (ret < 0) {
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 83a718f0f3f9..9052d5702556 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2357,8 +2357,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                             (data[33] << 10);
                 avg_lum >>= 9;
                 atomic_set(&sd->avg_lum, avg_lum);
-                gspca_frame_add(gspca_dev, LAST_PACKET,
-                                data, len);
+                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
                 return;
         }
         if (gspca_dev->last_packet_type == LAST_PACKET) {
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index be03a712731c..f0316d02f09f 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -466,6 +466,8 @@ static int ivtvfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long ar
                         struct fb_vblank vblank;
                         u32 trace;
 
+                        memset(&vblank, 0, sizeof(struct fb_vblank));
+
                         vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT |
                                         FB_VBLANK_HAVE_VSYNC;
                         trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16;
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 4525335f9bd4..a7210d981388 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -239,7 +239,7 @@ static int device_process(struct m2mtest_ctx *ctx,
                 return -EFAULT;
         }
 
-        if (in_buf->vb.size < out_buf->vb.size) {
+        if (in_buf->vb.size > out_buf->vb.size) {
                 v4l2_err(&dev->v4l2_dev, "Output buffer is too small\n");
                 return -EINVAL;
         }
@@ -1014,6 +1014,7 @@ static int m2mtest_remove(struct platform_device *pdev)
         v4l2_m2m_release(dev->m2m_dev);
         del_timer_sync(&dev->timer);
         video_unregister_device(dev->vfd);
+        video_device_release(dev->vfd);
         v4l2_device_unregister(&dev->v4l2_dev);
         kfree(dev);
 
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 758a4db27d65..c71af4e0e517 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -447,6 +447,9 @@ static int mt9m111_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
         dev_dbg(&client->dev, "%s left=%d, top=%d, width=%d, height=%d\n",
                 __func__, rect.left, rect.top, rect.width, rect.height);
 
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         ret = mt9m111_make_rect(client, &rect);
         if (!ret)
                 mt9m111->rect = rect;
@@ -466,12 +469,14 @@ static int mt9m111_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 
 static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 {
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         a->bounds.left                  = MT9M111_MIN_DARK_COLS;
         a->bounds.top                   = MT9M111_MIN_DARK_ROWS;
         a->bounds.width                 = MT9M111_MAX_WIDTH;
         a->bounds.height                = MT9M111_MAX_HEIGHT;
         a->defrect                      = a->bounds;
-        a->type                         = V4L2_BUF_TYPE_VIDEO_CAPTURE;
         a->pixelaspect.numerator        = 1;
         a->pixelaspect.denominator      = 1;
 
@@ -487,6 +492,7 @@ static int mt9m111_g_fmt(struct v4l2_subdev *sd,
         mf->width       = mt9m111->rect.width;
         mf->height      = mt9m111->rect.height;
         mf->code        = mt9m111->fmt->code;
+        mf->colorspace  = mt9m111->fmt->colorspace;
         mf->field       = V4L2_FIELD_NONE;
 
         return 0;
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index e7cd23cd6394..b48473c7896b 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -402,9 +402,6 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd,
                 if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
                         return -EINVAL;
                 break;
-        case 0:
-                /* No format change, only geometry */
-                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 66ff174151b5..b6ea67221d1d 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -378,6 +378,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         spin_lock_irqsave(&pcdev->lock, flags);
 
+        if (*fb_active == NULL)
+                goto out;
+
         vb = &(*fb_active)->vb;
         dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                 vb, vb->baddr, vb->bsize);
@@ -402,6 +405,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         *fb_active = buf;
 
+out:
         spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
index 1b992b847198..55ea914c7fcd 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
@@ -513,7 +513,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bool) {
                         ret = parse_token(ptr,len,valptr,boolNames,
                                           ARRAY_SIZE(boolNames));
@@ -522,7 +522,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         } else if (ret == 0) {
                                 *valptr = (*valptr & 1) ? !0 : 0;
                         }
-                        if (maskptr) *maskptr = 1;
+                        *maskptr = 1;
                 } else if (cptr->info->type == pvr2_ctl_enum) {
                         ret = parse_token(
                                 ptr,len,valptr,
@@ -531,7 +531,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bitmask) {
                         ret = parse_tlist(
                                 ptr,len,maskptr,valptr,
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index b151c7be8a50..6961c55baf9b 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -393,6 +393,37 @@ static void fimc_set_yuv_order(struct fimc_ctx *ctx)
         dbg("ctx->out_order_1p= %d", ctx->out_order_1p);
 }
 
+static void fimc_prepare_dma_offset(struct fimc_ctx *ctx, struct fimc_frame *f)
+{
+        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
+
+        f->dma_offset.y_h = f->offs_h;
+        if (!variant->pix_hoff)
+                f->dma_offset.y_h *= (f->fmt->depth >> 3);
+
+        f->dma_offset.y_v = f->offs_v;
+
+        f->dma_offset.cb_h = f->offs_h;
+        f->dma_offset.cb_v = f->offs_v;
+
+        f->dma_offset.cr_h = f->offs_h;
+        f->dma_offset.cr_v = f->offs_v;
+
+        if (!variant->pix_hoff) {
+                if (f->fmt->planes_cnt == 3) {
+                        f->dma_offset.cb_h >>= 1;
+                        f->dma_offset.cr_h >>= 1;
+                }
+                if (f->fmt->color == S5P_FIMC_YCBCR420) {
+                        f->dma_offset.cb_v >>= 1;
+                        f->dma_offset.cr_v >>= 1;
+                }
+        }
+
+        dbg("in_offset: color= %d, y_h= %d, y_v= %d",
+            f->fmt->color, f->dma_offset.y_h, f->dma_offset.y_v);
+}
+
 /**
  * fimc_prepare_config - check dimensions, operation and color mode
  *                       and pre-calculate offset and the scaling coefficients.
@@ -406,7 +437,6 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
 {
         struct fimc_frame *s_frame, *d_frame;
         struct fimc_vid_buffer *buf = NULL;
-        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
         int ret = 0;
 
         s_frame = &ctx->s_frame;
@@ -419,61 +449,16 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
                         swap(d_frame->width, d_frame->height);
                 }
 
-                /* Prepare the output offset ratios for scaler. */
-                d_frame->dma_offset.y_h = d_frame->offs_h;
-                if (!variant->pix_hoff)
-                        d_frame->dma_offset.y_h *= (d_frame->fmt->depth >> 3);
-
-                d_frame->dma_offset.y_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cb_h = d_frame->offs_h;
-                d_frame->dma_offset.cb_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cr_h = d_frame->offs_h;
-                d_frame->dma_offset.cr_v = d_frame->offs_v;
+                /* Prepare the DMA offset ratios for scaler. */
+                fimc_prepare_dma_offset(ctx, &ctx->s_frame);
+                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
 
-                if (!variant->pix_hoff && d_frame->fmt->planes_cnt == 3) {
-                        d_frame->dma_offset.cb_h >>= 1;
-                        d_frame->dma_offset.cb_v >>= 1;
-                        d_frame->dma_offset.cr_h >>= 1;
-                        d_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("out offset: color= %d, y_h= %d, y_v= %d",
-                        d_frame->fmt->color,
-                        d_frame->dma_offset.y_h, d_frame->dma_offset.y_v);
-
-                /* Prepare the input offset ratios for scaler. */
-                s_frame->dma_offset.y_h = s_frame->offs_h;
-                if (!variant->pix_hoff)
-                        s_frame->dma_offset.y_h *= (s_frame->fmt->depth >> 3);
-                s_frame->dma_offset.y_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cb_h = s_frame->offs_h;
-                s_frame->dma_offset.cb_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cr_h = s_frame->offs_h;
-                s_frame->dma_offset.cr_v = s_frame->offs_v;
-
-                if (!variant->pix_hoff && s_frame->fmt->planes_cnt == 3) {
-                        s_frame->dma_offset.cb_h >>= 1;
-                        s_frame->dma_offset.cb_v >>= 1;
-                        s_frame->dma_offset.cr_h >>= 1;
-                        s_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("in offset: color= %d, y_h= %d, y_v= %d",
-                        s_frame->fmt->color, s_frame->dma_offset.y_h,
-                        s_frame->dma_offset.y_v);
-
-                fimc_set_yuv_order(ctx);
-
-                /* Check against the scaler ratio. */
                 if (s_frame->height > (SCALER_MAX_VRATIO * d_frame->height) ||
                     s_frame->width > (SCALER_MAX_HRATIO * d_frame->width)) {
                         err("out of scaler range");
                         return -EINVAL;
                 }
+                fimc_set_yuv_order(ctx);
         }
 
         /* Input DMA mode is not allowed when the scaler is disabled. */
@@ -822,7 +807,8 @@ static int fimc_m2m_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
         } else {
                 v4l2_err(&ctx->fimc_dev->m2m.v4l2_dev,
                          "Wrong buffer/video queue type (%d)\n", f->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto s_fmt_out;
         }
 
         pix = &f->fmt.pix;
@@ -1414,8 +1400,10 @@ static int fimc_probe(struct platform_device *pdev)
         }
 
         fimc->work_queue = create_workqueue(dev_name(&fimc->pdev->dev));
-        if (!fimc->work_queue)
+        if (!fimc->work_queue) {
+                ret = -ENOMEM;
                 goto err_irq;
+        }
 
         ret = fimc_register_m2m_device(fimc);
         if (ret)
@@ -1492,6 +1480,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
 };
 
 static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
+        .pix_hoff       = 1,
         .has_inp_rot    = 1,
         .has_out_rot    = 1,
         .min_inp_pixsize = 16,
@@ -1506,6 +1495,7 @@ static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
 };
 
 static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
+        .pix_hoff        = 1,
         .min_inp_pixsize = 16,
         .min_out_pixsize = 32,
 
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index ec697fcd406e..bb8d83d8ddaf 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4323,13 +4323,13 @@ struct saa7134_board saa7134_boards[] = {
         },
         [SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM] = {
                 /*       Beholder Intl. Ltd. 2008      */
-                /*Dmitry Belimov <d.belimov@gmail.com> */
-                .name           = "Beholder BeholdTV Columbus TVFM",
+                /* Dmitry Belimov <d.belimov@gmail.com> */
+                .name           = "Beholder BeholdTV Columbus TV/FM",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_ALPS_TSBE5_PAL,
-                .radio_type     = UNSET,
-                .tuner_addr     = ADDR_UNSET,
-                .radio_addr     = ADDR_UNSET,
+                .radio_type     = TUNER_TEA5767,
+                .tuner_addr     = 0xc2 >> 1,
+                .radio_addr     = 0xc0 >> 1,
                 .tda9887_conf   = TDA9887_PRESENT,
                 .gpiomask       = 0x000A8004,
                 .inputs         = {{
diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c
index 5713f3a4b76c..ddd25d32723d 100644
--- a/drivers/media/video/saa7164/saa7164-buffer.c
+++ b/drivers/media/video/saa7164/saa7164-buffer.c
@@ -136,10 +136,11 @@ ret:
 int saa7164_buffer_dealloc(struct saa7164_tsport *port,
         struct saa7164_buffer *buf)
 {
-        struct saa7164_dev *dev = port->dev;
+        struct saa7164_dev *dev;
 
-        if ((buf == 0) || (port == 0))
+        if (!buf || !port)
                 return SAA_ERR_BAD_PARAMETER;
+        dev = port->dev;
 
         dprintk(DBGLVL_BUF, "%s() deallocating buffer @ 0x%p\n", __func__, buf);
 
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8bdd940f32e6..2ac85d8984f0 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -486,6 +486,12 @@ static int uvc_parse_format(struct uvc_device *dev,
                             max(frame->dwFrameInterval[0],
                                 frame->dwDefaultFrameInterval));
 
+                if (dev->quirks & UVC_QUIRK_RESTRICT_FRAME_RATE) {
+                        frame->bFrameIntervalType = 1;
+                        frame->dwFrameInterval[0] =
+                                frame->dwDefaultFrameInterval;
+                }
+
                 uvc_trace(UVC_TRACE_DESCR, "- %ux%u (%u.%u fps)\n",
                         frame->wWidth, frame->wHeight,
                         10000000/frame->dwDefaultFrameInterval,
@@ -2026,6 +2032,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceClass      = USB_CLASS_VENDOR_SPEC,
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0 },
+        /* Chicony CNF7129 (Asus EEE 100HE) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x04f2,
+          .idProduct            = 0xb071,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_RESTRICT_FRAME_RATE },
         /* Alcor Micro AU3820 (Future Boy PC USB Webcam) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2091,6 +2106,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                 | UVC_QUIRK_PROBE_DEF },
+        /* IMC Networks (Medion Akoya) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x13d3,
+          .idProduct            = 0x5103,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
         /* Syntek (HP Spartan) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bdacf3beabf5..892e0e51916c 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -182,6 +182,7 @@ struct uvc_xu_control {
 #define UVC_QUIRK_IGNORE_SELECTOR_UNIT  0x00000020
 #define UVC_QUIRK_FIX_BANDWIDTH         0x00000080
 #define UVC_QUIRK_PROBE_DEF             0x00000100
+#define UVC_QUIRK_RESTRICT_FRAME_RATE   0x00000200
 
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED         0x00000001
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 372b87efcd05..6ff9e4bac3ea 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -393,8 +393,10 @@ void videobuf_dma_contig_free(struct videobuf_queue *q,
         }
 
         /* read() method */
-        dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
-        mem->vaddr = NULL;
+        if (mem->vaddr) {
+                dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+                mem->vaddr = NULL;
+        }
 }
 EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
 
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 06f9a9c2a39a..2ad0bc252b0e 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -94,7 +94,7 @@ err:
  * must free the memory.
  */
 static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
-                                                int nr_pages, int offset)
+                                        int nr_pages, int offset, size_t size)
 {
         struct scatterlist *sglist;
         int i;
@@ -110,12 +110,14 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
                 /* DMA to highmem pages might not work */
                 goto highmem;
         sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
+        size -= PAGE_SIZE - offset;
         for (i = 1; i < nr_pages; i++) {
                 if (NULL == pages[i])
                         goto nopage;
                 if (PageHighMem(pages[i]))
                         goto highmem;
-                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
+                sg_set_page(&sglist[i], pages[i], min(PAGE_SIZE, size), 0);
+                size -= min(PAGE_SIZE, size);
         }
         return sglist;
 
@@ -170,7 +172,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
 
         first = (data          & PAGE_MASK) >> PAGE_SHIFT;
         last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
-        dma->offset   = data & ~PAGE_MASK;
+        dma->offset = data & ~PAGE_MASK;
+        dma->size = size;
         dma->nr_pages = last-first+1;
         dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
         if (NULL == dma->pages)
@@ -252,7 +255,7 @@ int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
 
         if (dma->pages) {
                 dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
-                                                   dma->offset);
+                                                   dma->offset, dma->size);
         }
         if (dma->vaddr) {
                 dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 04028a9ee082..428377a5a6f5 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -429,24 +429,25 @@ static void max8925_irq_sync_unlock(unsigned int irq)
         irq_tsc = cache_tsc;
         for (i = 0; i < ARRAY_SIZE(max8925_irqs); i++) {
                 irq_data = &max8925_irqs[i];
+                /* 1 -- disable, 0 -- enable */
                 switch (irq_data->mask_reg) {
                 case MAX8925_CHG_IRQ1_MASK:
-                        irq_chg[0] &= irq_data->enable;
+                        irq_chg[0] &= ~irq_data->enable;
                         break;
                 case MAX8925_CHG_IRQ2_MASK:
-                        irq_chg[1] &= irq_data->enable;
+                        irq_chg[1] &= ~irq_data->enable;
                         break;
                 case MAX8925_ON_OFF_IRQ1_MASK:
-                        irq_on[0] &= irq_data->enable;
+                        irq_on[0] &= ~irq_data->enable;
                         break;
                 case MAX8925_ON_OFF_IRQ2_MASK:
-                        irq_on[1] &= irq_data->enable;
+                        irq_on[1] &= ~irq_data->enable;
                         break;
                 case MAX8925_RTC_IRQ_MASK:
-                        irq_rtc &= irq_data->enable;
+                        irq_rtc &= ~irq_data->enable;
                         break;
                 case MAX8925_TSC_IRQ_MASK:
-                        irq_tsc &= irq_data->enable;
+                        irq_tsc &= ~irq_data->enable;
                         break;
                 default:
                         dev_err(chip->dev, "wrong IRQ\n");
diff --git a/drivers/mfd/wm831x-irq.c b/drivers/mfd/wm831x-irq.c
index 7dabe4dbd373..294183b6260b 100644
--- a/drivers/mfd/wm831x-irq.c
+++ b/drivers/mfd/wm831x-irq.c
@@ -394,8 +394,13 @@ static int wm831x_irq_set_type(unsigned int irq, unsigned int type)
 
         irq = irq - wm831x->irq_base;
 
-        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11)
-                return -EINVAL;
+        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11) {
+                /* Ignore internal-only IRQs */
+                if (irq >= 0 && irq < WM831X_NUM_IRQS)
+                        return 0;
+                else
+                        return -EINVAL;
+        }
 
         switch (type) {
         case IRQ_TYPE_EDGE_BOTH:
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 714c6b487313..d5f3a3fd2319 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -190,7 +190,6 @@ static int __devexit bh1780_remove(struct i2c_client *client)
 
         ddata = i2c_get_clientdata(client);
         sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        i2c_set_clientdata(client, NULL);
         kfree(ddata);
 
         return 0;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 5db49b124ffa..09eee6df0653 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1631,6 +1631,19 @@ int mmc_suspend_host(struct mmc_host *host)
         if (host->bus_ops && !host->bus_dead) {
                 if (host->bus_ops->suspend)
                         err = host->bus_ops->suspend(host);
+                if (err == -ENOSYS || !host->bus_ops->resume) {
+                        /*
+                         * We simply "remove" the card in this case.
+                         * It will be redetected on resume.
+                         */
+                        if (host->bus_ops->remove)
+                                host->bus_ops->remove(host);
+                        mmc_claim_host(host);
+                        mmc_detach_bus(host);
+                        mmc_release_host(host);
+                        host->pm_flags = 0;
+                        err = 0;
+                }
         }
         mmc_bus_put(host);
 
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 71ad4163b95e..aacb862ecc8a 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -241,8 +241,10 @@ static struct sdhci_ops sdhci_s3c_ops = {
 static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
 {
         struct sdhci_host *host = platform_get_drvdata(dev);
+        unsigned long flags;
+
         if (host) {
-                spin_lock(&host->lock);
+                spin_lock_irqsave(&host->lock, flags);
                 if (state) {
                         dev_dbg(&dev->dev, "card inserted.\n");
                         host->flags &= ~SDHCI_DEVICE_DEAD;
@@ -253,7 +255,7 @@ static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
                         host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
                 }
                 tasklet_schedule(&host->card_tasklet);
-                spin_unlock(&host->lock);
+                spin_unlock_irqrestore(&host->lock, flags);
         }
 }
 
@@ -481,8 +483,10 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
         sdhci_remove_host(host, 1);
 
         for (ptr = 0; ptr < 3; ptr++) {
-                clk_disable(sc->clk_bus[ptr]);
-                clk_put(sc->clk_bus[ptr]);
+                if (sc->clk_bus[ptr]) {
+                        clk_disable(sc->clk_bus[ptr]);
+                        clk_put(sc->clk_bus[ptr]);
+                }
         }
         clk_disable(sc->clk_io);
         clk_put(sc->clk_io);
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 133d51528f8d..513e0a76a4a7 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -413,7 +413,7 @@ static inline int omap_nand_dma_transfer(struct mtd_info *mtd, void *addr,
                 prefetch_status = gpmc_read_status(GPMC_PREFETCH_COUNT);
         } while (prefetch_status);
         /* disable and stop the PFPW engine */
-        gpmc_prefetch_reset();
+        gpmc_prefetch_reset(info->gpmc_cs);
 
         dma_unmap_single(&info->pdev->dev, dma_addr, len, dir);
         return 0;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index fa42103b2874..179871d9e71f 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2942,6 +2942,9 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct vortex_private *vp = netdev_priv(dev);
 
+        if (!VORTEX_PCI(vp))
+                return;
+
         wol->supported = WAKE_MAGIC;
 
         wol->wolopts = 0;
@@ -2952,6 +2955,10 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct vortex_private *vp = netdev_priv(dev);
+
+        if (!VORTEX_PCI(vp))
+                return -EOPNOTSUPP;
+
         if (wol->wolopts & ~WAKE_MAGIC)
                 return -EINVAL;
 
@@ -3201,6 +3208,9 @@ static void acpi_set_WOL(struct net_device *dev)
                         return;
                 }
 
+                if (VORTEX_PCI(vp)->current_state < PCI_D3hot)
+                        return;
+
                 /* Change the power state to D3; RxEnable doesn't take effect. */
                 pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
         }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..5db667c0b371 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 
 config MV643XX_ETH
         tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
         select INET_LRO
         select PHYLIB
         help
@@ -2803,7 +2803,7 @@ config NIU
 
 config PASEMI_MAC
         tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
         select PHYLIB
         select INET_LRO
         help
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 63b9ba0cc67e..c73be2848319 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -1251,6 +1251,12 @@ static void atl1_free_ring_resources(struct atl1_adapter *adapter)
 
         rrd_ring->desc = NULL;
         rrd_ring->dma = 0;
+
+        adapter->cmb.dma = 0;
+        adapter->cmb.cmb = NULL;
+
+        adapter->smb.dma = 0;
+        adapter->smb.smb = NULL;
 }
 
 static void atl1_setup_mac_ctrl(struct atl1_adapter *adapter)
@@ -2847,10 +2853,11 @@ static int atl1_resume(struct pci_dev *pdev)
         pci_enable_wake(pdev, PCI_D3cold, 0);
 
         atl1_reset_hw(&adapter->hw);
-        adapter->cmb.cmb->int_stats = 0;
 
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
+                adapter->cmb.cmb->int_stats = 0;
                 atl1_up(adapter);
+        }
         netif_device_attach(netdev);
 
         return 0;
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1e620e287ae0..efeffdf9e5fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2170,8 +2170,6 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
         dev->irq = sdev->irq;
         SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
 
-        netif_carrier_off(dev);
-
         err = ssb_bus_powerup(sdev->bus, 0);
         if (err) {
                 dev_err(sdev->dev,
@@ -2213,6 +2211,8 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
                 goto err_out_powerdown;
         }
 
+        netif_carrier_off(dev);
+
         ssb_set_drvdata(sdev, dev);
 
         /* Chip reset provides power to the b44 MAC & PCI cores, which
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                 res = dev_alloc_name(bond_dev, "bond%d");
                 if (res < 0)
                         goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
         }
 
         res = register_netdevice(bond_dev);
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 66ed08f726fb..ba302a5c2c30 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -57,6 +57,7 @@ enum e1e_registers {
         E1000_SCTL     = 0x00024, /* SerDes Control - RW */
         E1000_FCAL     = 0x00028, /* Flow Control Address Low - RW */
         E1000_FCAH     = 0x0002C, /* Flow Control Address High -RW */
+        E1000_FEXTNVM4 = 0x00024, /* Future Extended NVM 4 - RW */
         E1000_FEXTNVM  = 0x00028, /* Future Extended NVM - RW */
         E1000_FCT      = 0x00030, /* Flow Control Type - RW */
         E1000_VET      = 0x00038, /* VLAN Ether Type - RW */
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 63930d12711c..57b5435599ab 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -105,6 +105,10 @@
 #define E1000_FEXTNVM_SW_CONFIG         1
 #define E1000_FEXTNVM_SW_CONFIG_ICH8M (1 << 27) /* Bit redefined for ICH8M :/ */
 
+#define E1000_FEXTNVM4_BEACON_DURATION_MASK    0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_8USEC   0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_16USEC  0x3
+
 #define PCIE_ICH8_SNOOP_ALL             PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES           7
@@ -125,6 +129,7 @@
 
 /* SMBus Address Phy Register */
 #define HV_SMB_ADDR            PHY_REG(768, 26)
+#define HV_SMB_ADDR_MASK       0x007F
 #define HV_SMB_ADDR_PEC_EN     0x0200
 #define HV_SMB_ADDR_VALID      0x0080
 
@@ -237,6 +242,8 @@ static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
 static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_ich8lan(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_pchlan(struct e1000_hw *hw);
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw);
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate);
 
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -272,7 +279,7 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 {
         struct e1000_phy_info *phy = &hw->phy;
-        u32 ctrl;
+        u32 ctrl, fwsm;
         s32 ret_val = 0;
 
         phy->addr                     = 1;
@@ -294,7 +301,8 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
          * disabled, then toggle the LANPHYPC Value bit to force
          * the interconnect to PCIe mode.
          */
-        if (!(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+        fwsm = er32(FWSM);
+        if (!(fwsm & E1000_ICH_FWSM_FW_VALID)) {
                 ctrl = er32(CTRL);
                 ctrl |=  E1000_CTRL_LANPHYPC_OVERRIDE;
                 ctrl &= ~E1000_CTRL_LANPHYPC_VALUE;
@@ -303,6 +311,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
                 ctrl &= ~E1000_CTRL_LANPHYPC_OVERRIDE;
                 ew32(CTRL, ctrl);
                 msleep(50);
+
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if (hw->mac.type == e1000_pch2lan)
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
         }
 
         /*
@@ -315,6 +330,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
         if (ret_val)
                 goto out;
 
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan)  &&
+            !(fwsm & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
+
         phy->id = e1000_phy_unknown;
         ret_val = e1000e_get_phy_id(hw);
         if (ret_val)
@@ -561,13 +583,10 @@ static s32 e1000_init_mac_params_ich8lan(struct e1000_adapter *adapter)
         if (mac->type == e1000_ich8lan)
                 e1000e_set_kmrn_lock_loss_workaround_ich8lan(hw, true);
 
-        /* Disable PHY configuration by hardware, config by software */
-        if (mac->type == e1000_pch2lan) {
-                u32 extcnf_ctrl = er32(EXTCNF_CTRL);
-
-                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
-                ew32(EXTCNF_CTRL, extcnf_ctrl);
-        }
+        /* Gate automatic PHY configuration by hardware on managed 82579 */
+        if ((mac->type == e1000_pch2lan) &&
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
 
         return 0;
 }
@@ -652,6 +671,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                         goto out;
         }
 
+        if (hw->mac.type == e1000_pch2lan) {
+                ret_val = e1000_k1_workaround_lv(hw);
+                if (ret_val)
+                        goto out;
+        }
+
         /*
          * Check if there was DownShift, must be checked
          * immediately after link-up
@@ -895,6 +920,34 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
 }
 
 /**
+ *  e1000_write_smbus_addr - Write SMBus address to PHY needed during Sx states
+ *  @hw: pointer to the HW structure
+ *
+ *  Assumes semaphore already acquired.
+ *
+ **/
+static s32 e1000_write_smbus_addr(struct e1000_hw *hw)
+{
+        u16 phy_data;
+        u32 strap = er32(STRAP);
+        s32 ret_val = 0;
+
+        strap &= E1000_STRAP_SMBUS_ADDRESS_MASK;
+
+        ret_val = e1000_read_phy_reg_hv_locked(hw, HV_SMB_ADDR, &phy_data);
+        if (ret_val)
+                goto out;
+
+        phy_data &= ~HV_SMB_ADDR_MASK;
+        phy_data |= (strap >> E1000_STRAP_SMBUS_ADDRESS_SHIFT);
+        phy_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
+        ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR, phy_data);
+
+out:
+        return ret_val;
+}
+
+/**
  *  e1000_sw_lcd_config_ich8lan - SW-based LCD Configuration
  *  @hw:   pointer to the HW structure
  *
@@ -903,7 +956,6 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
  **/
 static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
 {
-        struct e1000_adapter *adapter = hw->adapter;
         struct e1000_phy_info *phy = &hw->phy;
         u32 i, data, cnf_size, cnf_base_addr, sw_cfg_mask;
         s32 ret_val = 0;
@@ -921,7 +973,8 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
                 if (phy->type != e1000_phy_igp_3)
                         return ret_val;
 
-                if (adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) {
+                if ((hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) ||
+                    (hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_C)) {
                         sw_cfg_mask = E1000_FEXTNVM_SW_CONFIG;
                         break;
                 }
@@ -961,21 +1014,16 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
         cnf_base_addr = data & E1000_EXTCNF_CTRL_EXT_CNF_POINTER_MASK;
         cnf_base_addr >>= E1000_EXTCNF_CTRL_EXT_CNF_POINTER_SHIFT;
 
-        if (!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
-            ((hw->mac.type == e1000_pchlan) ||
-             (hw->mac.type == e1000_pch2lan))) {
+        if ((!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
+            (hw->mac.type == e1000_pchlan)) ||
+             (hw->mac.type == e1000_pch2lan)) {
                 /*
                  * HW configures the SMBus address and LEDs when the
                  * OEM and LCD Write Enable bits are set in the NVM.
                  * When both NVM bits are cleared, SW will configure
                  * them instead.
                  */
-                data = er32(STRAP);
-                data &= E1000_STRAP_SMBUS_ADDRESS_MASK;
-                reg_data = data >> E1000_STRAP_SMBUS_ADDRESS_SHIFT;
-                reg_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
-                ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR,
-                                                        reg_data);
+                ret_val = e1000_write_smbus_addr(hw);
                 if (ret_val)
                         goto out;
 
@@ -1440,10 +1488,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
 
                 /* Enable jumbo frame workaround in the PHY */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                 e1e_rphy(hw, PHY_REG(769, 23), &data);
                 data &= ~(0x7F << 5);
                 data |= (0x37 << 5);
@@ -1452,7 +1496,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
                 e1e_rphy(hw, PHY_REG(769, 16), &data);
                 data &= ~(1 << 13);
-                data |= (1 << 12);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                 if (ret_val)
                         goto out;
@@ -1477,7 +1520,7 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
 
                 mac_reg = er32(RCTL);
                 mac_reg &= ~E1000_RCTL_SECRC;
-                ew32(FFLT_DBG, mac_reg);
+                ew32(RCTL, mac_reg);
 
                 ret_val = e1000e_read_kmrn_reg(hw,
                                                 E1000_KMRNCTRLSTA_CTRL_OFFSET,
@@ -1503,17 +1546,12 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                         goto out;
 
                 /* Write PHY register values back to h/w defaults */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                 e1e_rphy(hw, PHY_REG(769, 23), &data);
                 data &= ~(0x7F << 5);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 23), data);
                 if (ret_val)
                         goto out;
                 e1e_rphy(hw, PHY_REG(769, 16), &data);
-                data &= ~(1 << 12);
                 data |= (1 << 13);
                 ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                 if (ret_val)
@@ -1559,6 +1597,69 @@ out:
 }
 
 /**
+ *  e1000_k1_gig_workaround_lv - K1 Si workaround
+ *  @hw:   pointer to the HW structure
+ *
+ *  Workaround to set the K1 beacon duration for 82579 parts
+ **/
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
+{
+        s32 ret_val = 0;
+        u16 status_reg = 0;
+        u32 mac_reg;
+
+        if (hw->mac.type != e1000_pch2lan)
+                goto out;
+
+        /* Set K1 beacon duration based on 1Gbps speed or otherwise */
+        ret_val = e1e_rphy(hw, HV_M_STATUS, &status_reg);
+        if (ret_val)
+                goto out;
+
+        if ((status_reg & (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE))
+            == (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE)) {
+                mac_reg = er32(FEXTNVM4);
+                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
+
+                if (status_reg & HV_M_STATUS_SPEED_1000)
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
+                else
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
+
+                ew32(FEXTNVM4, mac_reg);
+        }
+
+out:
+        return ret_val;
+}
+
+/**
+ *  e1000_gate_hw_phy_config_ich8lan - disable PHY config via hardware
+ *  @hw:   pointer to the HW structure
+ *  @gate: boolean set to true to gate, false to ungate
+ *
+ *  Gate/ungate the automatic PHY configuration via hardware; perform
+ *  the configuration via software instead.
+ **/
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate)
+{
+        u32 extcnf_ctrl;
+
+        if (hw->mac.type != e1000_pch2lan)
+                return;
+
+        extcnf_ctrl = er32(EXTCNF_CTRL);
+
+        if (gate)
+                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+        else
+                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        return;
+}
+
+/**
  *  e1000_lan_init_done_ich8lan - Check for PHY config completion
  *  @hw: pointer to the HW structure
  *
@@ -1602,6 +1703,9 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
         if (e1000_check_reset_block(hw))
                 goto out;
 
+        /* Allow time for h/w to get to quiescent state after reset */
+        msleep(10);
+
         /* Perform any necessary post-reset workarounds */
         switch (hw->mac.type) {
         case e1000_pchlan:
@@ -1630,6 +1734,13 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
         /* Configure the LCD with the OEM bits in NVM */
         ret_val = e1000_oem_bits_config_ich8lan(hw, true);
 
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
+
 out:
         return ret_val;
 }
@@ -1646,6 +1757,11 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
 {
         s32 ret_val = 0;
 
+        /* Gate automatic PHY configuration by hardware on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
+
         ret_val = e1000e_phy_hw_reset_generic(hw);
         if (ret_val)
                 goto out;
@@ -2910,6 +3026,14 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
                  * external PHY is reset.
                  */
                 ctrl |= E1000_CTRL_PHY_RST;
+
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if ((hw->mac.type == e1000_pch2lan) &&
+                    !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
         }
         ret_val = e1000_acquire_swflag_ich8lan(hw);
         e_dbg("Issuing a global reset to ich8lan\n");
@@ -3460,13 +3584,20 @@ void e1000e_gig_downshift_workaround_ich8lan(struct e1000_hw *hw)
 void e1000e_disable_gig_wol_ich8lan(struct e1000_hw *hw)
 {
         u32 phy_ctrl;
+        s32 ret_val;
 
         phy_ctrl = er32(PHY_CTRL);
         phy_ctrl |= E1000_PHY_CTRL_D0A_LPLU | E1000_PHY_CTRL_GBE_DISABLE;
         ew32(PHY_CTRL, phy_ctrl);
 
-        if (hw->mac.type >= e1000_pchlan)
-                e1000_phy_hw_reset_ich8lan(hw);
+        if (hw->mac.type >= e1000_pchlan) {
+                e1000_oem_bits_config_ich8lan(hw, true);
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return;
+                e1000_write_smbus_addr(hw);
+                hw->phy.ops.release(hw);
+        }
 }
 
 /**
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 2b8ef44bd2b1..e561d15c3eb1 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2704,6 +2704,16 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
         u32 psrctl = 0;
         u32 pages = 0;
 
+        /* Workaround Si errata on 82579 - configure jumbo frame flow */
+        if (hw->mac.type == e1000_pch2lan) {
+                s32 ret_val;
+
+                if (adapter->netdev->mtu > ETH_DATA_LEN)
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
+                else
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
+        }
+
         /* Program MC offset vector base */
         rctl = er32(RCTL);
         rctl &= ~(3 << E1000_RCTL_MO_SHIFT);
@@ -2744,16 +2754,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
                 e1e_wphy(hw, 22, phy_data);
         }
 
-        /* Workaround Si errata on 82579 - configure jumbo frame flow */
-        if (hw->mac.type == e1000_pch2lan) {
-                s32 ret_val;
-
-                if (rctl & E1000_RCTL_LPE)
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
-                else
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
-        }
-
         /* Setup buffer sizes */
         rctl &= ~E1000_RCTL_SZ_4096;
         rctl |= E1000_RCTL_BSEX;
@@ -4833,6 +4833,15 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* Jumbo frame workaround on 82579 requires CRC be stripped */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            !(adapter->flags2 & FLAG2_CRC_STRIPPING) &&
+            (new_mtu > ETH_DATA_LEN)) {
+                e_err("Jumbo Frames not supported on 82579 when CRC "
+                      "stripping is disabled.\n");
+                return -EINVAL;
+        }
+
         /* 82573 Errata 17 */
         if (((adapter->hw.mac.type == e1000_82573) ||
              (adapter->hw.mac.type == e1000_82574)) &&
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a333b42111b8..6372610ed240 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -533,8 +533,15 @@ static inline void ehea_fill_skb(struct net_device *dev,
         int length = cqe->num_bytes_transfered - 4;     /*remove CRC */
 
         skb_put(skb, length);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
         skb->protocol = eth_type_trans(skb, dev);
+
+        /* The packet was not an IPV4 packet so a complemented checksum was
+           calculated. The value is found in the Internet Checksum field. */
+        if (cqe->status & EHEA_CQE_BLIND_CKSUM) {
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum = csum_unfold(~cqe->inet_checksum_value);
+        } else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
 static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
index f608a6c54af5..38104734a3be 100644
--- a/drivers/net/ehea/ehea_qmr.h
+++ b/drivers/net/ehea/ehea_qmr.h
@@ -150,6 +150,7 @@ struct ehea_rwqe {
 #define EHEA_CQE_TYPE_RQ           0x60
 #define EHEA_CQE_STAT_ERR_MASK     0x700F
 #define EHEA_CQE_STAT_FAT_ERR_MASK 0xF
+#define EHEA_CQE_BLIND_CKSUM       0x8000
 #define EHEA_CQE_STAT_ERR_TCP      0x4000
 #define EHEA_CQE_STAT_ERR_IP       0x2000
 #define EHEA_CQE_STAT_ERR_CRC      0x1000
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 768b840aeb6b..cce32d43175f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -678,24 +678,37 @@ static int fec_enet_mii_probe(struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         struct phy_device *phy_dev = NULL;
-        int ret;
+        char mdio_bus_id[MII_BUS_ID_SIZE];
+        char phy_name[MII_BUS_ID_SIZE + 3];
+        int phy_id;
 
         fep->phy_dev = NULL;
 
-        /* find the first phy */
-        phy_dev = phy_find_first(fep->mii_bus);
-        if (!phy_dev) {
-                printk(KERN_ERR "%s: no PHY found\n", dev->name);
-                return -ENODEV;
+        /* check for attached phy */
+        for (phy_id = 0; (phy_id < PHY_MAX_ADDR); phy_id++) {
+                if ((fep->mii_bus->phy_mask & (1 << phy_id)))
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id] == NULL)
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id]->phy_id == 0)
+                        continue;
+                strncpy(mdio_bus_id, fep->mii_bus->id, MII_BUS_ID_SIZE);
+                break;
         }
 
-        /* attach the mac to the phy */
-        ret = phy_connect_direct(dev, phy_dev,
-                             &fec_enet_adjust_link, 0,
-                             PHY_INTERFACE_MODE_MII);
-        if (ret) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return ret;
+        if (phy_id >= PHY_MAX_ADDR) {
+                printk(KERN_INFO "%s: no PHY, assuming direct connection "
+                        "to switch\n", dev->name);
+                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE);
+                phy_id = 0;
+        }
+
+        snprintf(phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        phy_dev = phy_connect(dev, phy_name, &fec_enet_adjust_link, 0,
+                PHY_INTERFACE_MODE_MII);
+        if (IS_ERR(phy_dev)) {
+                printk(KERN_ERR "%s: could not attach to PHY\n", dev->name);
+                return PTR_ERR(phy_dev);
         }
 
         /* mask with MAC supported features */
@@ -738,7 +751,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         fep->mii_bus->read = fec_enet_mdio_read;
         fep->mii_bus->write = fec_enet_mdio_write;
         fep->mii_bus->reset = fec_enet_mdio_reset;
-        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id);
+        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id + 1);
         fep->mii_bus->priv = fep;
         fep->mii_bus->parent = &pdev->dev;
 
@@ -1311,6 +1324,9 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_mii_init;
 
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(ndev);
+
         ret = register_netdev(ndev);
         if (ret)
                 goto failed_register;
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index 3506fd6ad726..519e19e23955 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -2928,7 +2928,7 @@ static int __devinit emac_probe(struct platform_device *ofdev,
         if (dev->emac_irq != NO_IRQ)
                 irq_dispose_mapping(dev->emac_irq);
  err_free:
-        kfree(ndev);
+        free_netdev(ndev);
  err_gone:
         /* if we were on the bootlist, remove us as we won't show up and
          * wake up all waiters to notify them in case they were waiting
@@ -2971,7 +2971,7 @@ static int __devexit emac_remove(struct platform_device *ofdev)
         if (dev->emac_irq != NO_IRQ)
                 irq_dispose_mapping(dev->emac_irq);
 
-        kfree(dev->ndev);
+        free_netdev(dev->ndev);
 
         return 0;
 }
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index cabae7bb1fc6..b075a35b85d4 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -1540,7 +1540,6 @@ netxen_process_rcv(struct netxen_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
         skb->protocol = eth_type_trans(skb, netdev);
 
         napi_gro_receive(&sds_ring->napi, skb);
@@ -1602,8 +1601,6 @@ netxen_process_lro(struct netxen_adapter *adapter,
 
         skb_put(skb, lro_length + data_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
-
         skb_pull(skb, l2_hdr_offset);
         skb->protocol = eth_type_trans(skb, netdev);
 
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 75ba744b173c..2c7cf0b64811 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -1316,7 +1316,7 @@ qlcnic_alloc_rx_skb(struct qlcnic_adapter *adapter,
                 return -ENOMEM;
         }
 
-        skb_reserve(skb, 2);
+        skb_reserve(skb, NET_IP_ALIGN);
 
         dma = pci_map_single(pdev, skb->data,
                         rds_ring->dma_size, PCI_DMA_FROMDEVICE);
@@ -1404,7 +1404,6 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
         skb->protocol = eth_type_trans(skb, netdev);
 
         napi_gro_receive(&sds_ring->napi, skb);
@@ -1466,8 +1465,6 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
 
         skb_put(skb, lro_length + data_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
-
         skb_pull(skb, l2_hdr_offset);
         skb->protocol = eth_type_trans(skb, netdev);
 
@@ -1700,8 +1697,6 @@ qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
         if (pkt_offset)
                 skb_pull(skb, pkt_offset);
 
-        skb->truesize = skb->len + sizeof(struct sk_buff);
-
         if (!qlcnic_check_loopback_buff(skb->data))
                 adapter->diag_cnt++;
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index a0da4a17b025..992db2fa136e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1212,7 +1212,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
                 return;
 
-        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
+        counters = dma_alloc_coherent(&tp->pci_dev->dev, sizeof(*counters),
+                                      &paddr, GFP_KERNEL);
         if (!counters)
                 return;
 
@@ -1233,7 +1234,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
+        dma_free_coherent(&tp->pci_dev->dev, sizeof(*counters), counters,
+                          paddr);
 }
 
 static void rtl8169_get_ethtool_stats(struct net_device *dev,
@@ -3292,15 +3294,15 @@ static int rtl8169_open(struct net_device *dev)
 
         /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
-         * pci_alloc_consistent provides more.
+         * dma_alloc_coherent provides more.
          */
-        tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
-                                               &tp->TxPhyAddr);
+        tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES,
+                                             &tp->TxPhyAddr, GFP_KERNEL);
         if (!tp->TxDescArray)
                 goto err_pm_runtime_put;
 
-        tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
-                                               &tp->RxPhyAddr);
+        tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES,
+                                             &tp->RxPhyAddr, GFP_KERNEL);
         if (!tp->RxDescArray)
                 goto err_free_tx_0;
 
@@ -3334,12 +3336,12 @@ out:
 err_release_ring_2:
         rtl8169_rx_clear(tp);
 err_free_rx_1:
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
         tp->RxDescArray = NULL;
 err_free_tx_0:
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
 err_pm_runtime_put:
         pm_runtime_put_noidle(&pdev->dev);
@@ -3975,7 +3977,7 @@ static void rtl8169_free_rx_skb(struct rtl8169_private *tp,
 {
         struct pci_dev *pdev = tp->pci_dev;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
                          PCI_DMA_FROMDEVICE);
         dev_kfree_skb(*sk_buff);
         *sk_buff = NULL;
@@ -4000,7 +4002,7 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
 static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
                                             struct net_device *dev,
                                             struct RxDesc *desc, int rx_buf_sz,
-                                            unsigned int align)
+                                            unsigned int align, gfp_t gfp)
 {
         struct sk_buff *skb;
         dma_addr_t mapping;
@@ -4008,13 +4010,13 @@ static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
 
         pad = align ? align : NET_IP_ALIGN;
 
-        skb = netdev_alloc_skb(dev, rx_buf_sz + pad);
+        skb = __netdev_alloc_skb(dev, rx_buf_sz + pad, gfp);
         if (!skb)
                 goto err_out;
 
         skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad);
 
-        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
+        mapping = dma_map_single(&pdev->dev, skb->data, rx_buf_sz,
                                  PCI_DMA_FROMDEVICE);
 
         rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
@@ -4039,7 +4041,7 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp)
 }
 
 static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
-                           u32 start, u32 end)
+                           u32 start, u32 end, gfp_t gfp)
 {
         u32 cur;
 
@@ -4054,7 +4056,7 @@ static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
 
                 skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev,
                                            tp->RxDescArray + i,
-                                           tp->rx_buf_sz, tp->align);
+                                           tp->rx_buf_sz, tp->align, gfp);
                 if (!skb)
                         break;
 
@@ -4082,7 +4084,7 @@ static int rtl8169_init_ring(struct net_device *dev)
         memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info));
         memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
 
-        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
+        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC, GFP_KERNEL) != NUM_RX_DESC)
                 goto err_out;
 
         rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
@@ -4099,7 +4101,8 @@ static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb,
 {
         unsigned int len = tx_skb->len;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), len,
+                         PCI_DMA_TODEVICE);
         desc->opts1 = 0x00;
         desc->opts2 = 0x00;
         desc->addr = 0x00;
@@ -4243,7 +4246,8 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
                 txd = tp->TxDescArray + entry;
                 len = frag->size;
                 addr = ((void *) page_address(frag->page)) + frag->page_offset;
-                mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE);
+                mapping = dma_map_single(&tp->pci_dev->dev, addr, len,
+                                         PCI_DMA_TODEVICE);
 
                 /* anti gcc 2.95.3 bugware (sic) */
                 status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC));
@@ -4313,7 +4317,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
                 tp->tx_skb[entry].skb = skb;
         }
 
-        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
+        mapping = dma_map_single(&tp->pci_dev->dev, skb->data, len,
+                                 PCI_DMA_TODEVICE);
 
         tp->tx_skb[entry].len = len;
         txd->addr = cpu_to_le64(mapping);
@@ -4477,8 +4482,8 @@ static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
         if (!skb)
                 goto out;
 
-        pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size,
-                                    PCI_DMA_FROMDEVICE);
+        dma_sync_single_for_cpu(&tp->pci_dev->dev, addr, pkt_size,
+                                PCI_DMA_FROMDEVICE);
         skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size);
         *sk_buff = skb;
         done = true;
@@ -4549,11 +4554,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         rtl8169_rx_csum(skb, desc);
 
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
-                                pci_dma_sync_single_for_device(pdev, addr,
+                                dma_sync_single_for_device(&pdev->dev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
                                 rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
                         } else {
-                                pci_unmap_single(pdev, addr, tp->rx_buf_sz,
+                                dma_unmap_single(&pdev->dev, addr, tp->rx_buf_sz,
                                                  PCI_DMA_FROMDEVICE);
                                 tp->Rx_skbuff[entry] = NULL;
                         }
@@ -4583,7 +4588,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
         count = cur_rx - tp->cur_rx;
         tp->cur_rx = cur_rx;
 
-        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
+        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx, GFP_ATOMIC);
         if (!delta && count)
                 netif_info(tp, intr, dev, "no Rx buffer allocated\n");
         tp->dirty_rx += delta;
@@ -4769,10 +4774,10 @@ static int rtl8169_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
         tp->RxDescArray = NULL;
 
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 07eb884ff982..44150f2f7bfd 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -384,7 +384,7 @@ static void rionet_remove(struct rio_dev *rdev)
         free_pages((unsigned long)rionet_active, rdev->net->hport->sys_size ?
                                         __ilog2(sizeof(void *)) + 4 : 0);
         unregister_netdev(ndev);
-        kfree(ndev);
+        free_netdev(ndev);
 
         list_for_each_entry_safe(peer, tmp, &rionet_peers, node) {
                 list_del(&peer->node);
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index cc4bd8c65f8b..9265315baa0b 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -804,7 +804,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
 err_out_free_page:
         free_page((unsigned long) sp->srings);
 err_out_free_dev:
-        kfree(dev);
+        free_netdev(dev);
 
 err_out:
         return err;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
         netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
 
+static int only_32bit_dma;
+
 static int __devinit skge_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                 using_dac = 1;
                 err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
         } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
         .shutdown =     skge_shutdown,
 };
 
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
+
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
         skge_debug_init();
         return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 0909ae934ad0..8150ba154116 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -58,6 +58,7 @@
 
 MODULE_LICENSE("GPL");
 MODULE_VERSION(SMSC_DRV_VERSION);
+MODULE_ALIAS("platform:smsc911x");
 
 #if USE_DEBUG > 0
 static int debug = 16;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc3af78a869f..1ec4b9e0239a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4666,7 +4666,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                                        desc_idx, *post_ptr);
                 drop_it_no_recycle:
                         /* Other statistics kept track of by card. */
-                        tp->net_stats.rx_dropped++;
+                        tp->rx_dropped++;
                         goto next_pkt;
                 }
 
@@ -4726,7 +4726,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 if (len > (tp->dev->mtu + ETH_HLEN) &&
                     skb->protocol != htons(ETH_P_8021Q)) {
                         dev_kfree_skb(skb);
-                        goto next_pkt;
+                        goto drop_it_no_recycle;
                 }
 
                 if (desc->type_flags & RXD_FLAG_VLAN &&
@@ -9240,6 +9240,8 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
+        stats->rx_dropped = tp->rx_dropped;
+
         return stats;
 }
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..be7ff138a7f9 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2759,7 +2759,7 @@ struct tg3 {
 
 
         /* begin "everything else" cacheline(s) section */
-        struct rtnl_link_stats64        net_stats;
+        unsigned long                   rx_dropped;
         struct rtnl_link_stats64        net_stats_prev;
         struct tg3_ethtool_stats        estats;
         struct tg3_ethtool_stats        estats_prev;
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 5efa57757a2c..6888e3d41462 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -243,6 +243,7 @@ enum {
         NWayState               = (1 << 14) | (1 << 13) | (1 << 12),
         NWayRestart             = (1 << 12),
         NonselPortActive        = (1 << 9),
+        SelPortActive           = (1 << 8),
         LinkFailStatus          = (1 << 2),
         NetCxnErr               = (1 << 1),
 };
@@ -363,7 +364,9 @@ static u16 t21040_csr15[] = { 0, 0, 0x0006, 0x0000, 0x0000, };
 
 /* 21041 transceiver register settings: TP AUTO, BNC, AUI, TP, TP FD*/
 static u16 t21041_csr13[] = { 0xEF01, 0xEF09, 0xEF09, 0xEF01, 0xEF09, };
-static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x6F3F, 0x6F3D, };
+static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
+/* If on-chip autonegotiation is broken, use half-duplex (FF3F) instead */
+static u16 t21041_csr14_brk[] = { 0xFF3F, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
 static u16 t21041_csr15[] = { 0x0008, 0x0006, 0x000E, 0x0008, 0x0008, };
 
 
@@ -1064,6 +1067,9 @@ static void de21041_media_timer (unsigned long data)
         unsigned int carrier;
         unsigned long flags;
 
+        /* clear port active bits */
+        dw32(SIAStatus, NonselPortActive | SelPortActive);
+
         carrier = (status & NetCxnErr) ? 0 : 1;
 
         if (carrier) {
@@ -1158,14 +1164,29 @@ no_link_yet:
 static void de_media_interrupt (struct de_private *de, u32 status)
 {
         if (status & LinkPass) {
+                /* Ignore if current media is AUI or BNC and we can't use TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC) &&
+                    (de->media_lock ||
+                     !de_ok_to_advertise(de, DE_MEDIA_TP_AUTO)))
+                        return;
+                /* If current media is not TP, change it to TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC)) {
+                        de->media_type = DE_MEDIA_TP_AUTO;
+                        de_stop_rxtx(de);
+                        de_set_media(de);
+                        de_start_rxtx(de);
+                }
                 de_link_up(de);
                 mod_timer(&de->media_timer, jiffies + DE_TIMER_LINK);
                 return;
         }
 
         BUG_ON(!(status & LinkFail));
-
-        if (netif_carrier_ok(de->dev)) {
+        /* Mark the link as down only if current media is TP */
+        if (netif_carrier_ok(de->dev) && de->media_type != DE_MEDIA_AUI &&
+            de->media_type != DE_MEDIA_BNC) {
                 de_link_down(de);
                 mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
         }
@@ -1229,6 +1250,7 @@ static void de_adapter_sleep (struct de_private *de)
         if (de->de21040)
                 return;
 
+        dw32(CSR13, 0); /* Reset phy */
         pci_read_config_dword(de->pdev, PCIPM, &pmctl);
         pmctl |= PM_Sleep;
         pci_write_config_dword(de->pdev, PCIPM, pmctl);
@@ -1574,12 +1596,15 @@ static int __de_set_settings(struct de_private *de, struct ethtool_cmd *ecmd)
                 return 0; /* nothing to change */
 
         de_link_down(de);
+        mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
         de_stop_rxtx(de);
 
         de->media_type = new_media;
         de->media_lock = media_lock;
         de->media_advertise = ecmd->advertising;
         de_set_media(de);
+        if (netif_running(de->dev))
+                de_start_rxtx(de);
 
         return 0;
 }
@@ -1911,8 +1936,14 @@ fill_defaults:
         for (i = 0; i < DE_MAX_MEDIA; i++) {
                 if (de->media[i].csr13 == 0xffff)
                         de->media[i].csr13 = t21041_csr13[i];
-                if (de->media[i].csr14 == 0xffff)
-                        de->media[i].csr14 = t21041_csr14[i];
+                if (de->media[i].csr14 == 0xffff) {
+                        /* autonegotiation is broken at least on some chip
+                           revisions - rev. 0x21 works, 0x11 does not */
+                        if (de->pdev->revision < 0x20)
+                                de->media[i].csr14 = t21041_csr14_brk[i];
+                        else
+                                de->media[i].csr14 = t21041_csr14[i];
+                }
                 if (de->media[i].csr15 == 0xffff)
                         de->media[i].csr15 = t21041_csr15[i];
         }
@@ -2158,6 +2189,8 @@ static int de_resume (struct pci_dev *pdev)
                 dev_err(&dev->dev, "pci_enable_device failed in resume\n");
                 goto out;
         }
+        pci_set_master(pdev);
+        de_init_rings(de);
         de_init_hw(de);
 out_attach:
         netif_device_attach(dev);
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 8cc9e319f435..1737d1488b35 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         int i, result;
         struct device *dev = i2400m_dev(i2400m);
         const struct i2400m_msg_hdr *msg_hdr;
-        size_t pl_itr, pl_size, skb_len;
+        size_t pl_itr, pl_size;
         unsigned long flags;
-        unsigned num_pls, single_last;
+        unsigned num_pls, single_last, skb_len;
 
         skb_len = skb->len;
-        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
                   i2400m, skb, skb_len);
         result = -EIO;
         msg_hdr = (void *) skb->data;
-        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
         if (result < 0)
                 goto error_msg_hdr_check;
         result = -EIO;
@@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
                 num_pls * sizeof(msg_hdr->pld[0]);
         pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
-        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+        if (pl_itr > skb_len) { /* got all the payload descriptors? */
                 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
                         "%u payload descriptors (%zu each, total %zu)\n",
-                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                        skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
                 goto error_pl_descr_short;
         }
         /* Walk each payload payload--check we really got it */
@@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
                 /* work around old gcc warnings */
                 pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
                 result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
-                                                  pl_itr, skb->len);
+                                                  pl_itr, skb_len);
                 if (result < 0)
                         goto error_pl_descr_check;
                 single_last = num_pls == 1 || i == num_pls - 1;
@@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         if (i < i2400m->rx_pl_min)
                 i2400m->rx_pl_min = i;
         i2400m->rx_num++;
-        i2400m->rx_size_acc += skb->len;
-        if (skb->len < i2400m->rx_size_min)
-                i2400m->rx_size_min = skb->len;
-        if (skb->len > i2400m->rx_size_max)
-                i2400m->rx_size_max = skb->len;
+        i2400m->rx_size_acc += skb_len;
+        if (skb_len < i2400m->rx_size_min)
+                i2400m->rx_size_min = skb_len;
+        if (skb_len > i2400m->rx_size_max)
+                i2400m->rx_size_max = skb_len;
         spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 error_pl_descr_check:
 error_pl_descr_short:
 error_msg_hdr_check:
-        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+        d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
                 i2400m, skb, skb_len, result);
         return result;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..a3d95cca8f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -543,7 +543,7 @@ static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
         if (conf_is_ht40(conf))
                 return clockrate * 2;
 
-        return clockrate * 2;
+        return clockrate;
 }
 
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 9dd9e64c2b0b..8fd00a6e5120 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         clear_bit(STATUS_SCAN_HW, &priv->status);
         clear_bit(STATUS_SCANNING, &priv->status);
         /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 07dbc2796448..e23c4060a0f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2613,6 +2613,11 @@ int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return -EINVAL;
 
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_INFO(priv, "scan in progress.\n");
+                return -EINVAL;
+        }
+
         if (mode >= IWL_MAX_FORCE_RESET) {
                 IWL_DEBUG_INFO(priv, "invalid reset request.\n");
                 return -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 59a308b02f95..d31661c1ce77 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         clear_bit(STATUS_SCANNING, &priv->status);
 
         /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 5ac2aa783f58..4789f8e8bf7a 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -3757,6 +3757,33 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
 
+#define GGC 0x52
+#define GGC_MEMORY_SIZE_MASK    (0xf << 8)
+#define GGC_MEMORY_SIZE_NONE    (0x0 << 8)
+#define GGC_MEMORY_SIZE_1M      (0x1 << 8)
+#define GGC_MEMORY_SIZE_2M      (0x3 << 8)
+#define GGC_MEMORY_VT_ENABLED   (0x8 << 8)
+#define GGC_MEMORY_SIZE_2M_VT   (0x9 << 8)
+#define GGC_MEMORY_SIZE_3M_VT   (0xa << 8)
+#define GGC_MEMORY_SIZE_4M_VT   (0xb << 8)
+
+static void __devinit quirk_calpella_no_shadow_gtt(struct pci_dev *dev)
+{
+        unsigned short ggc;
+
+        if (pci_read_config_word(dev, GGC, &ggc))
+                return;
+
+        if (!(ggc & GGC_MEMORY_VT_ENABLED)) {
+                printk(KERN_INFO "DMAR: BIOS has allocated no shadow GTT; disabling IOMMU for graphics\n");
+                dmar_map_gfx = 0;
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0040, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0062, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x006a, quirk_calpella_no_shadow_gtt);
+
 /* On Tylersburg chipsets, some BIOSes have been known to enable the
    ISOCH DMAR unit for the Azalia sound device, but not give it any
    TLB entries, which causes it to deadlock. Check for that.  We do
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index ce6a3666b3d9..553d8ee55c1c 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -608,7 +608,7 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
  * the VF BAR size multiplied by the number of VFs.  The alignment
  * is just the VF BAR size.
  */
-int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
 {
         struct resource tmp;
         enum pci_bar_type type;
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 7754a678ab15..6beb11b617a9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -264,7 +264,8 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                 enum pci_bar_type *type);
-extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
+extern resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev,
+                                                    int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
 
@@ -320,7 +321,7 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
 
-static inline int pci_resource_alignment(struct pci_dev *dev,
+static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
                                          struct resource *res)
 {
 #ifdef CONFIG_PCI_IOV
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 89ed181cd90c..857ae01734a6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -163,6 +163,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,	PCI_DEVICE_ID_NEC_CBUS_2,	quirk_isa_d
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_3,       quirk_isa_dma_hangs);
 
 /*
+ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
+ * for some HT machines to use C4 w/o hanging.
+ */
+static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev)
+{
+        u32 pmbase;
+        u16 pm1a;
+
+        pci_read_config_dword(dev, 0x40, &pmbase);
+        pmbase = pmbase & 0xff80;
+        pm1a = inw(pmbase);
+
+        if (pm1a & 0x10) {
+                dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n");
+                outw(0x10, pmbase);
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
+
+/*
  *      Chipsets where PCI->PCI transfers vanish or hang
  */
 static void __devinit quirk_nopcipci(struct pci_dev *dev)
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index a5c176598d95..9ba4dade69a4 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -595,7 +595,13 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         if (c->io[1].end) {
                 ret = alloc_io_space(s, &c->io[1], p_dev->io_lines);
                 if (ret) {
+                        struct resource tmp = c->io[0];
+                        /* release the previously allocated resource */
                         release_io_space(s, &c->io[0]);
+                        /* but preserve the settings, for they worked... */
+                        c->io[0].end = resource_size(&tmp);
+                        c->io[0].start = tmp.start;
+                        c->io[0].flags = tmp.flags;
                         goto out;
                 }
         } else
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index b8a869af0f44..deef6656ab7b 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -646,7 +646,7 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
         if (!pci_resource_start(dev, 0)) {
                 dev_warn(&dev->dev, "refusing to load the driver as the "
                         "io_base is NULL.\n");
-                goto err_out_free_mem;
+                goto err_out_disable;
         }
 
         dev_info(&dev->dev, "Cirrus PD6729 PCI to PCMCIA Bridge at 0x%llx "
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 9024480a8228..c44a5e8b8b82 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -51,7 +51,6 @@
  * TODO:
  *   - handle CPU hotplug
  *   - provide turbo enable/disable api
- *   - make sure we can write turbo enable/disable reg based on MISC_EN
  *
  * Related documents:
  *   - CDI 403777, 403778 - Auburndale EDS vol 1 & 2
@@ -230,7 +229,7 @@
 #define THM_TC2         0xac
 #define THM_DTV         0xb0
 #define THM_ITV         0xd8
-#define   ITV_ME_SEQNO_MASK 0x000f0000 /* ME should update every ~200ms */
+#define   ITV_ME_SEQNO_MASK 0x00ff0000 /* ME should update every ~200ms */
 #define   ITV_ME_SEQNO_SHIFT (16)
 #define   ITV_MCH_TEMP_MASK 0x0000ff00
 #define   ITV_MCH_TEMP_SHIFT (8)
@@ -325,6 +324,7 @@ struct ips_driver {
         bool gpu_preferred;
         bool poll_turbo_status;
         bool second_cpu;
+        bool turbo_toggle_allowed;
         struct ips_mcp_limits *limits;
 
         /* Optional MCH interfaces for if i915 is in use */
@@ -415,7 +415,7 @@ static void ips_cpu_lower(struct ips_driver *ips)
         new_limit = cur_limit - 8; /* 1W decrease */
 
         /* Clamp to SKU TDP limit */
-        if (((new_limit * 10) / 8) < (ips->orig_turbo_limit & TURBO_TDP_MASK))
+        if (new_limit  < (ips->orig_turbo_limit & TURBO_TDP_MASK))
                 new_limit = ips->orig_turbo_limit & TURBO_TDP_MASK;
 
         thm_writew(THM_MPCPC, (new_limit * 10) / 8);
@@ -461,7 +461,8 @@ static void ips_enable_cpu_turbo(struct ips_driver *ips)
         if (ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_enable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_enable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = true;
 }
@@ -498,7 +499,8 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
         if (!ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_disable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_disable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = false;
 }
@@ -598,17 +600,29 @@ static bool mcp_exceeded(struct ips_driver *ips)
 {
         unsigned long flags;
         bool ret = false;
+        u32 temp_limit;
+        u32 avg_power;
+        const char *msg = "MCP limit exceeded: ";
 
         spin_lock_irqsave(&ips->turbo_status_lock, flags);
-        if (ips->mcp_avg_temp > (ips->mcp_temp_limit * 100))
-                ret = true;
-        if (ips->cpu_avg_power + ips->mch_avg_power > ips->mcp_power_limit)
+
+        temp_limit = ips->mcp_temp_limit * 100;
+        if (ips->mcp_avg_temp > temp_limit) {
+                dev_info(&ips->dev->dev,
+                        "%sAvg temp %u, limit %u\n", msg, ips->mcp_avg_temp,
+                        temp_limit);
                 ret = true;
-        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
+        }
 
-        if (ret)
+        avg_power = ips->cpu_avg_power + ips->mch_avg_power;
+        if (avg_power > ips->mcp_power_limit) {
                 dev_info(&ips->dev->dev,
-                         "MCP power or thermal limit exceeded\n");
+                        "%sAvg power %u, limit %u\n", msg, avg_power,
+                        ips->mcp_power_limit);
+                ret = true;
+        }
+
+        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
 
         return ret;
 }
@@ -663,6 +677,27 @@ static bool mch_exceeded(struct ips_driver *ips)
 }
 
 /**
+ * verify_limits - verify BIOS provided limits
+ * @ips: IPS structure
+ *
+ * BIOS can optionally provide non-default limits for power and temp.  Check
+ * them here and use the defaults if the BIOS values are not provided or
+ * are otherwise unusable.
+ */
+static void verify_limits(struct ips_driver *ips)
+{
+        if (ips->mcp_power_limit < ips->limits->mcp_power_limit ||
+            ips->mcp_power_limit > 35000)
+                ips->mcp_power_limit = ips->limits->mcp_power_limit;
+
+        if (ips->mcp_temp_limit < ips->limits->core_temp_limit ||
+            ips->mcp_temp_limit < ips->limits->mch_temp_limit ||
+            ips->mcp_temp_limit > 150)
+                ips->mcp_temp_limit = min(ips->limits->core_temp_limit,
+                                          ips->limits->mch_temp_limit);
+}
+
+/**
  * update_turbo_limits - get various limits & settings from regs
  * @ips: IPS driver struct
  *
@@ -680,12 +715,21 @@ static void update_turbo_limits(struct ips_driver *ips)
         u32 hts = thm_readl(THM_HTS);
 
         ips->cpu_turbo_enabled = !(hts & HTS_PCTD_DIS);
-        ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+        /* 
+         * Disable turbo for now, until we can figure out why the power figures
+         * are wrong
+         */
+        ips->cpu_turbo_enabled = false;
+
+        if (ips->gpu_busy)
+                ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+
         ips->core_power_limit = thm_readw(THM_MPCPC);
         ips->mch_power_limit = thm_readw(THM_MMGPC);
         ips->mcp_temp_limit = thm_readw(THM_PTL);
         ips->mcp_power_limit = thm_readw(THM_MPPC);
 
+        verify_limits(ips);
         /* Ignore BIOS CPU vs GPU pref */
 }
 
@@ -858,7 +902,7 @@ static u32 get_cpu_power(struct ips_driver *ips, u32 *last, int period)
         ret = (ret * 1000) / 65535;
         *last = val;
 
-        return ret;
+        return 0;
 }
 
 static const u16 temp_decay_factor = 2;
@@ -940,7 +984,6 @@ static int ips_monitor(void *data)
                 kfree(mch_samples);
                 kfree(cpu_samples);
                 kfree(mchp_samples);
-                kthread_stop(ips->adjust);
                 return -ENOMEM;
         }
 
@@ -948,7 +991,7 @@ static int ips_monitor(void *data)
                 ITV_ME_SEQNO_SHIFT;
         seqno_timestamp = get_jiffies_64();
 
-        old_cpu_power = thm_readl(THM_CEC) / 65535;
+        old_cpu_power = thm_readl(THM_CEC);
         schedule_timeout_interruptible(msecs_to_jiffies(IPS_SAMPLE_PERIOD));
 
         /* Collect an initial average */
@@ -1150,11 +1193,18 @@ static irqreturn_t ips_irq_handler(int irq, void *arg)
                                 STS_GPL_SHIFT;
                         /* ignore EC CPU vs GPU pref */
                         ips->cpu_turbo_enabled = !(sts & STS_PCTD_DIS);
-                        ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
+                        /* 
+                         * Disable turbo for now, until we can figure
+                         * out why the power figures are wrong
+                         */
+                        ips->cpu_turbo_enabled = false;
+                        if (ips->gpu_busy)
+                                ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
                         ips->mcp_temp_limit = (sts & STS_PTL_MASK) >>
                                 STS_PTL_SHIFT;
                         ips->mcp_power_limit = (tc1 & STS_PPL_MASK) >>
                                 STS_PPL_SHIFT;
+                        verify_limits(ips);
                         spin_unlock(&ips->turbo_status_lock);
 
                         thm_writeb(THM_SEC, SEC_ACK);
@@ -1333,8 +1383,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
          * turbo manually or we'll get an illegal MSR access, even though
          * turbo will still be available.
          */
-        if (!(misc_en & IA32_MISC_TURBO_EN))
-                ; /* add turbo MSR write allowed flag if necessary */
+        if (misc_en & IA32_MISC_TURBO_EN)
+                ips->turbo_toggle_allowed = true;
+        else
+                ips->turbo_toggle_allowed = false;
 
         if (strstr(boot_cpu_data.x86_model_id, "CPU       M"))
                 limits = &ips_sv_limits;
@@ -1351,9 +1403,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
         tdp = turbo_power & TURBO_TDP_MASK;
 
         /* Sanity check TDP against CPU */
-        if (limits->mcp_power_limit != (tdp / 8) * 1000) {
-                dev_warn(&ips->dev->dev, "Warning: CPU TDP doesn't match expected value (found %d, expected %d)\n",
-                         tdp / 8, limits->mcp_power_limit / 1000);
+        if (limits->core_power_limit != (tdp / 8) * 1000) {
+                dev_info(&ips->dev->dev, "CPU TDP doesn't match expected value (found %d, expected %d)\n",
+                         tdp / 8, limits->core_power_limit / 1000);
+                limits->core_power_limit = (tdp / 8) * 1000;
         }
 
 out:
@@ -1390,7 +1443,7 @@ static bool ips_get_i915_syms(struct ips_driver *ips)
         return true;
 
 out_put_busy:
-        symbol_put(i915_gpu_turbo_disable);
+        symbol_put(i915_gpu_busy);
 out_put_lower:
         symbol_put(i915_gpu_lower);
 out_put_raise:
@@ -1532,22 +1585,27 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         /* Save turbo limits & ratios */
         rdmsrl(TURBO_POWER_CURRENT_LIMIT, ips->orig_turbo_limit);
 
-        ips_enable_cpu_turbo(ips);
-        ips->cpu_turbo_enabled = true;
+        ips_disable_cpu_turbo(ips);
+        ips->cpu_turbo_enabled = false;
 
-        /* Set up the work queue and monitor/adjust threads */
-        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
-        if (IS_ERR(ips->monitor)) {
+        /* Create thermal adjust thread */
+        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
+        if (IS_ERR(ips->adjust)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal monitor thread, aborting\n");
+                        "failed to create thermal adjust thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_free_irq;
+
         }
 
-        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
-        if (IS_ERR(ips->adjust)) {
+        /*
+         * Set up the work queue and monitor thread. The monitor thread
+         * will wake up ips_adjust thread.
+         */
+        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        if (IS_ERR(ips->monitor)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal adjust thread, aborting\n");
+                        "failed to create thermal monitor thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_thread_cleanup;
         }
@@ -1566,7 +1624,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         return ret;
 
 error_thread_cleanup:
-        kthread_stop(ips->monitor);
+        kthread_stop(ips->adjust);
 error_free_irq:
         free_irq(ips->dev->irq, ips);
 error_unmap:
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index df1fb53c09d2..a4be41614eeb 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -256,7 +256,6 @@ static int __devexit ad5398_remove(struct i2c_client *client)
 
         regulator_unregister(chip->rdev);
         kfree(chip);
-        i2c_set_clientdata(client, NULL);
 
         return 0;
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 422a709d271d..cc8b337b9119 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
             constraints->min_uA != constraints->max_uA) {
                 ret = _regulator_get_current_limit(rdev);
                 if (ret > 0)
-                        count += sprintf(buf + count, "at %d uA ", ret / 1000);
+                        count += sprintf(buf + count, "at %d mA ", ret / 1000);
         }
 
         if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,8 +2302,10 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
         dev_set_name(&rdev->dev, "regulator.%d",
                      atomic_inc_return(&regulator_no) - 1);
         ret = device_register(&rdev->dev);
-        if (ret != 0)
+        if (ret != 0) {
+                put_device(&rdev->dev);
                 goto clean;
+        }
 
         dev_set_drvdata(&rdev->dev, rdev);
 
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index d61ecb885a8c..b8cc6389a541 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -191,8 +191,6 @@ static int __devexit isl6271a_remove(struct i2c_client *i2c)
         struct isl_pmic *pmic = i2c_get_clientdata(i2c);
         int i;
 
-        i2c_set_clientdata(i2c, NULL);
-
         for (i = 0; i < 3; i++)
                 regulator_unregister(pmic->rdev[i]);
 
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 4520ace3f7e7..6b60a9c0366b 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
                 /* set external clock frequency */
                 info->extclk_freq = pdata->extclk_freq;
                 max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-                                 info->extclk_freq);
+                                 info->extclk_freq << 6);
         }
 
         if (pdata->ramp_timing) {
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 9daed8db83d3..9de8516e3531 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -268,7 +268,6 @@ out_irq:
                 free_irq(client->irq, client);
 
 out_free:
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return ret;
 }
@@ -287,7 +286,6 @@ static int __devexit ds3232_remove(struct i2c_client *client)
         }
 
         rtc_device_unregister(ds3232->rtc);
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return 0;
 }
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 6edf20b62de5..2c7d2d9be4d0 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1154,7 +1154,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                                 dev_fsm, dev_fsm_len, GFP_KERNEL);
         if (priv->fsm == NULL) {
                 CTCMY_DBF_DEV(SETUP, dev, "init_fsm error");
-                kfree(dev);
+                free_netdev(dev);
                 return NULL;
         }
         fsm_newstate(priv->fsm, DEV_STATE_STOPPED);
@@ -1165,7 +1165,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                 grp = ctcmpc_init_mpc_group(priv);
                 if (grp == NULL) {
                         MPC_DBF_DEV(SETUP, dev, "init_mpc_group error");
-                        kfree(dev);
+                        free_netdev(dev);
                         return NULL;
                 }
                 tasklet_init(&grp->mpc_tasklet2,
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index 324c385a653d..5dff45c76d32 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
+#include <linux/slab.h>
 #include <linux/serial_reg.h>
 #include <linux/circ_buf.h>
 #include <linux/delay.h>
diff --git a/drivers/serial/mrst_max3110.c b/drivers/serial/mrst_max3110.c
index f6ad1ecbff79..51c15f58e01e 100644
--- a/drivers/serial/mrst_max3110.c
+++ b/drivers/serial/mrst_max3110.c
@@ -29,6 +29,7 @@
 
 #include <linux/module.h>
 #include <linux/ioport.h>
+#include <linux/irq.h>
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 0bcf4c1601a2..b5a78a1f4421 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -86,6 +87,10 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
         const struct spi_device *spi = to_spi_device(dev);
         const struct spi_driver *sdrv = to_spi_driver(drv);
 
+        /* Attempt an OF style match */
+        if (of_driver_match_device(dev, drv))
+                return 1;
+
         if (sdrv->id_table)
                 return !!spi_match_id(sdrv->id_table, spi);
 
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index e24a63498acb..63e51b011d50 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
         spi_gpio->bitbang.master = spi_master_get(master);
         spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
 
-        if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
+        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
                 spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
                 spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
                 spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index d31b57f7baaf..1dd86b835cd8 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
 
         xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
 
-        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        if (mspi->rx_dma == mspi->dma_dummy_rx)
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
+        else
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
         out_be16(&rx_bd->cbd_datlen, 0);
         out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
 
-        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        if (mspi->tx_dma == mspi->dma_dummy_tx)
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
+        else
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
         out_be16(&tx_bd->cbd_datlen, xfer_len);
         out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
                                  BD_SC_LAST);
diff --git a/drivers/staging/tm6000/Kconfig b/drivers/staging/tm6000/Kconfig
index c725356cc346..de7ebb99d8f6 100644
--- a/drivers/staging/tm6000/Kconfig
+++ b/drivers/staging/tm6000/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_TM6000
         tristate "TV Master TM5600/6000/6010 driver"
-        depends on VIDEO_DEV && I2C && INPUT && USB && EXPERIMENTAL
+        depends on VIDEO_DEV && I2C && INPUT && IR_CORE && USB && EXPERIMENTAL
         select VIDEO_TUNER
         select MEDIA_TUNER_XC2028
         select MEDIA_TUNER_XC5000
diff --git a/drivers/staging/tm6000/tm6000-input.c b/drivers/staging/tm6000/tm6000-input.c
index 32f7a0af6938..54f7667cc706 100644
--- a/drivers/staging/tm6000/tm6000-input.c
+++ b/drivers/staging/tm6000/tm6000-input.c
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(enable_ir, "enable ir (default is enable");
         }
 
 struct tm6000_ir_poll_result {
-        u8 rc_data[4];
+        u16 rc_data;
 };
 
 struct tm6000_IR {
@@ -60,9 +60,9 @@ struct tm6000_IR {
         int                     polling;
         struct delayed_work     work;
         u8                      wait:1;
+        u8                      key:1;
         struct urb              *int_urb;
         u8                      *urb_data;
-        u8                      key:1;
 
         int (*get_key) (struct tm6000_IR *, struct tm6000_ir_poll_result *);
 
@@ -122,13 +122,14 @@ static void tm6000_ir_urb_received(struct urb *urb)
 
         if (urb->status != 0)
                 printk(KERN_INFO "not ready\n");
-        else if (urb->actual_length > 0)
+        else if (urb->actual_length > 0) {
                 memcpy(ir->urb_data, urb->transfer_buffer, urb->actual_length);
 
-        dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
-        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
+                dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
+                        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
 
-        ir->key = 1;
+                ir->key = 1;
+        }
 
         rc = usb_submit_urb(urb, GFP_ATOMIC);
 }
@@ -140,30 +141,47 @@ static int default_polling_getkey(struct tm6000_IR *ir,
         int rc;
         u8 buf[2];
 
-        if (ir->wait && !&dev->int_in) {
-                poll_result->rc_data[0] = 0xff;
+        if (ir->wait && !&dev->int_in)
                 return 0;
-        }
 
         if (&dev->int_in) {
-                poll_result->rc_data[0] = ir->urb_data[0];
-                poll_result->rc_data[1] = ir->urb_data[1];
+                if (ir->ir.ir_type == IR_TYPE_RC5)
+                        poll_result->rc_data = ir->urb_data[0];
+                else
+                        poll_result->rc_data = ir->urb_data[0] | ir->urb_data[1] << 8;
         } else {
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 0);
                 msleep(10);
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 1);
                 msleep(10);
 
-                rc = tm6000_read_write_usb(dev, USB_DIR_IN | USB_TYPE_VENDOR |
-                 USB_RECIP_DEVICE, REQ_02_GET_IR_CODE, 0, 0, buf, 1);
+                if (ir->ir.ir_type == IR_TYPE_RC5) {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 1);
 
-                msleep(10);
+                        msleep(10);
 
-                dprintk("read data=%02x\n", buf[0]);
-                if (rc < 0)
-                        return rc;
+                        dprintk("read data=%02x\n", buf[0]);
+                        if (rc < 0)
+                                return rc;
 
-                poll_result->rc_data[0] = buf[0];
+                        poll_result->rc_data = buf[0];
+                } else {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 2);
+
+                        msleep(10);
+
+                        dprintk("read data=%04x\n", buf[0] | buf[1] << 8);
+                        if (rc < 0)
+                                return rc;
+
+                        poll_result->rc_data = buf[0] | buf[1] << 8;
+                }
+                if ((poll_result->rc_data & 0x00ff) != 0xff)
+                        ir->key = 1;
         }
         return 0;
 }
@@ -180,12 +198,11 @@ static void tm6000_ir_handle_key(struct tm6000_IR *ir)
                 return;
         }
 
-        dprintk("ir->get_key result data=%02x %02x\n",
-                poll_result.rc_data[0], poll_result.rc_data[1]);
+        dprintk("ir->get_key result data=%04x\n", poll_result.rc_data);
 
-        if (poll_result.rc_data[0] != 0xff && ir->key == 1) {
+        if (ir->key) {
                 ir_input_keydown(ir->input->input_dev, &ir->ir,
-                        poll_result.rc_data[0] | poll_result.rc_data[1] << 8);
+                                (u32)poll_result.rc_data);
 
                 ir_input_nokey(ir->input->input_dev, &ir->ir);
                 ir->key = 0;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 29e850a7a2f9..7c8008225ee3 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -243,7 +243,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
         int r, nlogs = 0;
 
         while (datalen > 0) {
-                if (unlikely(headcount >= VHOST_NET_MAX_SG)) {
+                if (unlikely(seg >= VHOST_NET_MAX_SG)) {
                         r = -ENOBUFS;
                         goto err;
                 }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c579dcc9200c..dd3d6f7406f8 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -858,11 +858,12 @@ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                 if (r < 0)
                         return r;
                 len -= l;
-                if (!len)
+                if (!len) {
+                        if (vq->log_ctx)
+                                eventfd_signal(vq->log_ctx, 1);
                         return 0;
+                }
         }
-        if (vq->log_ctx)
-                eventfd_signal(vq->log_ctx, 1);
         /* Length written exceeds what we have stored. This is a bug. */
         BUG();
         return 0;
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index 5d786bd3e304..a31a77ff6f3d 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -298,8 +298,8 @@ static void set_dma_control0(struct pxa168fb_info *fbi)
          * Set bit to enable graphics DMA.
          */
         x = readl(fbi->reg_base + LCD_SPU_DMA_CTRL0);
-        x |= fbi->active ? 0x00000100 : 0;
-        fbi->active = 0;
+        x &= ~CFG_GRA_ENA_MASK;
+        x |= fbi->active ? CFG_GRA_ENA(1) : CFG_GRA_ENA(0);
 
         /*
          * If we are in a pseudo-color mode, we need to enable
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 29bac5118877..d409495876f1 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -755,7 +755,10 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
         int ret = 0;
 
-        blocking_notifier_chain_register(&xenstore_chain, nb);
+        if (xenstored_ready > 0)
+                ret = nb->notifier_call(nb, 0, NULL);
+        else
+                blocking_notifier_chain_register(&xenstore_chain, nb);
 
         return ret;
 }
@@ -769,7 +772,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 
 void xenbus_probe(struct work_struct *unused)
 {
-        BUG_ON((xenstored_ready <= 0));
+        xenstored_ready = 1;
 
         /* Enumerate devices in xenstore and watch for changes. */
         xenbus_probe_devices(&xenbus_frontend);
@@ -835,8 +838,8 @@ static int __init xenbus_init(void)
                         xen_store_evtchn = xen_start_info->store_evtchn;
                         xen_store_mfn = xen_start_info->store_mfn;
                         xen_store_interface = mfn_to_virt(xen_store_mfn);
+                        xenstored_ready = 1;
                 }
-                xenstored_ready = 1;
         }
 
         /* Initialize the interface to xenstore. */
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index f96eff04e11a..a6395bdb26ae 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -134,10 +134,6 @@ static int aout_core_dump(struct coredump_params *cprm)
                 if (!dump_write(file, dump_start, dump_size))
                         goto end_coredump;
         }
-/* Finally dump the task struct.  Not be used by gdb, but could be useful */
-        set_fs(KERNEL_DS);
-        if (!dump_write(file, current, sizeof(*current)))
-                goto end_coredump;
 end_coredump:
         set_fs(fs);
         return has_dumped;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 73c153092f72..5e9da996a151 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2283,7 +2283,8 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
 {
         struct ceph_inode_info *ci = ceph_inode(inode);
         int mds = session->s_mds;
-        int seq = le32_to_cpu(grant->seq);
+        unsigned seq = le32_to_cpu(grant->seq);
+        unsigned issue_seq = le32_to_cpu(grant->issue_seq);
         int newcaps = le32_to_cpu(grant->caps);
         int issued, implemented, used, wanted, dirty;
         u64 size = le64_to_cpu(grant->size);
@@ -2295,8 +2296,8 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
         int revoked_rdcache = 0;
         int queue_invalidate = 0;
 
-        dout("handle_cap_grant inode %p cap %p mds%d seq %d %s\n",
-             inode, cap, mds, seq, ceph_cap_string(newcaps));
+        dout("handle_cap_grant inode %p cap %p mds%d seq %u/%u %s\n",
+             inode, cap, mds, seq, issue_seq, ceph_cap_string(newcaps));
         dout(" size %llu max_size %llu, i_size %llu\n", size, max_size,
                 inode->i_size);
 
@@ -2392,6 +2393,7 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
         }
 
         cap->seq = seq;
+        cap->issue_seq = issue_seq;
 
         /* file layout may have changed */
         ci->i_layout = grant->layout;
@@ -2774,15 +2776,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                 if (op == CEPH_CAP_OP_IMPORT)
                         __queue_cap_release(session, vino.ino, cap_id,
                                             mseq, seq);
-
-                /*
-                 * send any full release message to try to move things
-                 * along for the mds (who clearly thinks we still have this
-                 * cap).
-                 */
-                ceph_add_cap_releases(mdsc, session);
-                ceph_send_cap_releases(mdsc, session);
-                goto done;
+                goto flush_cap_releases;
         }
 
         /* these will work even if we don't have a cap yet */
@@ -2810,7 +2804,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                 dout(" no cap on %p ino %llx.%llx from mds%d\n",
                      inode, ceph_ino(inode), ceph_snap(inode), mds);
                 spin_unlock(&inode->i_lock);
-                goto done;
+                goto flush_cap_releases;
         }
 
         /* note that each of these drops i_lock for us */
@@ -2834,6 +2828,17 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                        ceph_cap_op_name(op));
         }
 
+        goto done;
+
+flush_cap_releases:
+        /*
+         * send any full release message to try to move things
+         * along for the mds (who clearly thinks we still have this
+         * cap).
+         */
+        ceph_add_cap_releases(mdsc, session);
+        ceph_send_cap_releases(mdsc, session);
+
 done:
         mutex_unlock(&session->s_mutex);
 done_unlocked:
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 4480cb1c63e7..e38423e82f2e 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -42,32 +42,37 @@ struct ceph_nfs_confh {
 static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len,
                           int connectable)
 {
+        int type;
         struct ceph_nfs_fh *fh = (void *)rawfh;
         struct ceph_nfs_confh *cfh = (void *)rawfh;
         struct dentry *parent = dentry->d_parent;
         struct inode *inode = dentry->d_inode;
-        int type;
+        int connected_handle_length = sizeof(*cfh)/4;
+        int handle_length = sizeof(*fh)/4;
 
         /* don't re-export snaps */
         if (ceph_snap(inode) != CEPH_NOSNAP)
                 return -EINVAL;
 
-        if (*max_len >= sizeof(*cfh)) {
+        if (*max_len >= connected_handle_length) {
                 dout("encode_fh %p connectable\n", dentry);
                 cfh->ino = ceph_ino(dentry->d_inode);
                 cfh->parent_ino = ceph_ino(parent->d_inode);
                 cfh->parent_name_hash = parent->d_name.hash;
-                *max_len = sizeof(*cfh);
+                *max_len = connected_handle_length;
                 type = 2;
-        } else if (*max_len > sizeof(*fh)) {
-                if (connectable)
-                        return -ENOSPC;
+        } else if (*max_len >= handle_length) {
+                if (connectable) {
+                        *max_len = connected_handle_length;
+                        return 255;
+                }
                 dout("encode_fh %p\n", dentry);
                 fh->ino = ceph_ino(dentry->d_inode);
-                *max_len = sizeof(*fh);
+                *max_len = handle_length;
                 type = 1;
         } else {
-                return -ENOSPC;
+                *max_len = handle_length;
+                return 255;
         }
         return type;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 8c044a4f0457..66e4da6dba22 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -697,7 +697,7 @@ more:
                          * start_request so that a tid has been assigned.
                          */
                         spin_lock(&ci->i_unsafe_lock);
-                        list_add(&ci->i_unsafe_writes, &req->r_unsafe_item);
+                        list_add(&req->r_unsafe_item, &ci->i_unsafe_writes);
                         spin_unlock(&ci->i_unsafe_lock);
                         ceph_get_cap_refs(ci, CEPH_CAP_FILE_WR);
                 }
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index dfced1dacbcd..3b5571b8ce22 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -549,7 +549,7 @@ static void __unregister_request(struct ceph_osd_client *osdc,
  */
 static void __cancel_request(struct ceph_osd_request *req)
 {
-        if (req->r_sent) {
+        if (req->r_sent && req->r_osd) {
                 ceph_con_revoke(&req->r_osd->o_con, req->r_request);
                 req->r_sent = 0;
         }
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index c65c3419dd37..7e83b356cc9e 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -232,7 +232,7 @@ static int
 small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                 void **request_buf)
 {
-        int rc = 0;
+        int rc;
 
         rc = cifs_reconnect_tcon(tcon, smb_command);
         if (rc)
@@ -250,7 +250,7 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
         if (tcon != NULL)
                 cifs_stats_inc(&tcon->num_smbs_sent);
 
-        return rc;
+        return 0;
 }
 
 int
@@ -281,16 +281,9 @@ small_smb_init_no_tc(const int smb_command, const int wct,
 
 /* If the return code is zero, this function must fill in request_buf pointer */
 static int
-smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
-         void **request_buf /* returned */ ,
-         void **response_buf /* returned */ )
+__smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
+                        void **request_buf, void **response_buf)
 {
-        int rc = 0;
-
-        rc = cifs_reconnect_tcon(tcon, smb_command);
-        if (rc)
-                return rc;
-
         *request_buf = cifs_buf_get();
         if (*request_buf == NULL) {
                 /* BB should we add a retry in here if not a writepage? */
@@ -309,7 +302,31 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
         if (tcon != NULL)
                 cifs_stats_inc(&tcon->num_smbs_sent);
 
-        return rc;
+        return 0;
+}
+
+/* If the return code is zero, this function must fill in request_buf pointer */
+static int
+smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
+         void **request_buf, void **response_buf)
+{
+        int rc;
+
+        rc = cifs_reconnect_tcon(tcon, smb_command);
+        if (rc)
+                return rc;
+
+        return __smb_init(smb_command, wct, tcon, request_buf, response_buf);
+}
+
+static int
+smb_init_no_reconnect(int smb_command, int wct, struct cifsTconInfo *tcon,
+                        void **request_buf, void **response_buf)
+{
+        if (tcon->ses->need_reconnect || tcon->need_reconnect)
+                return -EHOSTDOWN;
+
+        return __smb_init(smb_command, wct, tcon, request_buf, response_buf);
 }
 
 static int validate_t2(struct smb_t2_rsp *pSMB)
@@ -4534,8 +4551,8 @@ CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon)
 
         cFYI(1, "In QFSUnixInfo");
 QFSUnixRetry:
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
+        rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, tcon,
+                                   (void **) &pSMB, (void **) &pSMBr);
         if (rc)
                 return rc;
 
@@ -4604,8 +4621,8 @@ CIFSSMBSetFSUnixInfo(const int xid, struct cifsTconInfo *tcon, __u64 cap)
         cFYI(1, "In SETFSUnixInfo");
 SETFSUnixRetry:
         /* BB switch to small buf init to save memory */
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
-                      (void **) &pSMBr);
+        rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, tcon,
+                                        (void **) &pSMB, (void **) &pSMBr);
         if (rc)
                 return rc;
 
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 93f77d438d3c..53cce8cc2224 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -801,6 +801,8 @@ retry_iget5_locked:
                         inode->i_flags |= S_NOATIME | S_NOCMTIME;
                 if (inode->i_state & I_NEW) {
                         inode->i_ino = hash;
+                        if (S_ISREG(inode->i_mode))
+                                inode->i_data.backing_dev_info = sb->s_bdi;
 #ifdef CONFIG_CIFS_FSCACHE
                         /* initialize per-inode cache cookie pointer */
                         CIFS_I(inode)->fscache = NULL;
diff --git a/fs/exec.c b/fs/exec.c
index 828dd2461d6b..6d2b6f936858 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -2014,3 +2014,43 @@ fail_creds:
 fail:
         return;
 }
+
+/*
+ * Core dumping helper functions.  These are the only things you should
+ * do on a core-file: use only these functions to write out all the
+ * necessary info.
+ */
+int dump_write(struct file *file, const void *addr, int nr)
+{
+        return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
+}
+EXPORT_SYMBOL(dump_write);
+
+int dump_seek(struct file *file, loff_t off)
+{
+        int ret = 1;
+
+        if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
+                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
+                        return 0;
+        } else {
+                char *buf = (char *)get_zeroed_page(GFP_KERNEL);
+
+                if (!buf)
+                        return 0;
+                while (off > 0) {
+                        unsigned long n = off;
+
+                        if (n > PAGE_SIZE)
+                                n = PAGE_SIZE;
+                        if (!dump_write(file, buf, n)) {
+                                ret = 0;
+                                break;
+                        }
+                        off -= n;
+                }
+                free_page((unsigned long)buf);
+        }
+        return ret;
+}
+EXPORT_SYMBOL(dump_seek);
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index eb7368ebd8cd..3eadd97324b1 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -54,6 +54,9 @@ struct page_collect {
         unsigned nr_pages;
         unsigned long length;
         loff_t pg_first; /* keep 64bit also in 32-arches */
+        bool read_4_write; /* This means two things: that the read is sync
+                            * And the pages should not be unlocked.
+                            */
 };
 
 static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
@@ -71,6 +74,7 @@ static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
         pcol->nr_pages = 0;
         pcol->length = 0;
         pcol->pg_first = -1;
+        pcol->read_4_write = false;
 }
 
 static void _pcol_reset(struct page_collect *pcol)
@@ -347,7 +351,8 @@ static int readpage_strip(void *data, struct page *page)
                 if (PageError(page))
                         ClearPageError(page);
 
-                unlock_page(page);
+                if (!pcol->read_4_write)
+                        unlock_page(page);
                 EXOFS_DBGMSG("readpage_strip(0x%lx, 0x%lx) empty page,"
                              " splitting\n", inode->i_ino, page->index);
 
@@ -428,6 +433,7 @@ static int _readpage(struct page *page, bool is_sync)
         /* readpage_strip might call read_exec(,is_sync==false) at several
          * places but not if we have a single page.
          */
+        pcol.read_4_write = is_sync;
         ret = readpage_strip(&pcol, page);
         if (ret) {
                 EXOFS_ERR("_readpage => %d\n", ret);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 5581122bd2c0..ab38fef1c9a1 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -72,22 +72,11 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 static inline struct backing_dev_info *inode_to_bdi(struct inode *inode)
 {
         struct super_block *sb = inode->i_sb;
-        struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
 
-        /*
-         * For inodes on standard filesystems, we use superblock's bdi. For
-         * inodes on virtual filesystems, we want to use inode mapping's bdi
-         * because they can possibly point to something useful (think about
-         * block_dev filesystem).
-         */
-        if (sb->s_bdi && sb->s_bdi != &noop_backing_dev_info) {
-                /* Some device inodes could play dirty tricks. Catch them... */
-                WARN(bdi != sb->s_bdi && bdi_cap_writeback_dirty(bdi),
-                        "Dirtiable inode bdi %s != sb bdi %s\n",
-                        bdi->name, sb->s_bdi->name);
-                return sb->s_bdi;
-        }
-        return bdi;
+        if (strcmp(sb->s_type->name, "bdev") == 0)
+                return inode->i_mapping->backing_dev_info;
+
+        return sb->s_bdi;
 }
 
 static void bdi_queue_work(struct backing_dev_info *bdi,
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index d367af1514ef..cde755cca564 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1354,7 +1354,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
         loff_t file_size;
         unsigned int num;
         unsigned int offset;
-        size_t total_len;
+        size_t total_len = 0;
 
         req = fuse_get_req(fc);
         if (IS_ERR(req))
diff --git a/fs/nfsd/nfsfh.h b/fs/nfsd/nfsfh.h
index cdfb8c6a4206..c16f8d8331b5 100644
--- a/fs/nfsd/nfsfh.h
+++ b/fs/nfsd/nfsfh.h
@@ -196,8 +196,6 @@ fh_lock(struct svc_fh *fhp)
 static inline void
 fh_unlock(struct svc_fh *fhp)
 {
-        BUG_ON(!fhp->fh_dentry);
-
         if (fhp->fh_locked) {
                 fill_post_wcc(fhp);
                 mutex_unlock(&fhp->fh_dentry->d_inode->i_mutex);
diff --git a/fs/notify/Kconfig b/fs/notify/Kconfig
index 22c629eedd82..b388443c3a09 100644
--- a/fs/notify/Kconfig
+++ b/fs/notify/Kconfig
@@ -3,4 +3,4 @@ config FSNOTIFY
 
 source "fs/notify/dnotify/Kconfig"
 source "fs/notify/inotify/Kconfig"
-source "fs/notify/fanotify/Kconfig"
+#source "fs/notify/fanotify/Kconfig"
diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
index 32499d213fc4..9975457c981f 100644
--- a/fs/ocfs2/symlink.c
+++ b/fs/ocfs2/symlink.c
@@ -128,7 +128,7 @@ static void *ocfs2_fast_follow_link(struct dentry *dentry,
         }
 
         /* Fast symlinks can't be large */
-        len = strlen(target);
+        len = strnlen(target, ocfs2_fast_symlink_chars(inode->i_sb));
         link = kzalloc(len + 1, GFP_NOFS);
         if (!link) {
                 status = -ENOMEM;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index a1c43e7c8a7b..8e4addaa5424 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2675,7 +2675,7 @@ static const struct pid_entry tgid_base_stuff[] = {
         INF("auxv",       S_IRUSR, proc_pid_auxv),
         ONE("status",     S_IRUGO, proc_pid_status),
         ONE("personality", S_IRUSR, proc_pid_personality),
-        INF("limits",     S_IRUSR, proc_pid_limits),
+        INF("limits",     S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
@@ -3011,7 +3011,7 @@ static const struct pid_entry tid_base_stuff[] = {
         INF("auxv",      S_IRUSR, proc_pid_auxv),
         ONE("status",    S_IRUGO, proc_pid_status),
         ONE("personality", S_IRUSR, proc_pid_personality),
-        INF("limits",    S_IRUSR, proc_pid_limits),
+        INF("limits",    S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
         REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index f53505de0712..5cbb81e134ac 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -170,6 +170,7 @@ int reiserfs_prepare_write(struct file *f, struct page *page,
 int reiserfs_unpack(struct inode *inode, struct file *filp)
 {
         int retval = 0;
+        int depth;
         int index;
         struct page *page;
         struct address_space *mapping;
@@ -188,8 +189,8 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
         /* we need to make sure nobody is changing the file size beneath
          ** us
          */
-        mutex_lock(&inode->i_mutex);
-        reiserfs_write_lock(inode->i_sb);
+        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
 
         write_from = inode->i_size & (blocksize - 1);
         /* if we are on a block boundary, we are already unpacked.  */
@@ -224,6 +225,6 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
 
       out:
         mutex_unlock(&inode->i_mutex);
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
         return retval;
 }
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index d59c4a65d492..81976ffed7d6 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -668,14 +668,11 @@ xfs_inode_set_reclaim_tag(
         xfs_perag_put(pag);
 }
 
-void
-__xfs_inode_clear_reclaim_tag(
-        xfs_mount_t     *mp,
+STATIC void
+__xfs_inode_clear_reclaim(
         xfs_perag_t     *pag,
         xfs_inode_t     *ip)
 {
-        radix_tree_tag_clear(&pag->pag_ici_root,
-                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
         pag->pag_ici_reclaimable--;
         if (!pag->pag_ici_reclaimable) {
                 /* clear the reclaim tag from the perag radix tree */
@@ -689,6 +686,17 @@ __xfs_inode_clear_reclaim_tag(
         }
 }
 
+void
+__xfs_inode_clear_reclaim_tag(
+        xfs_mount_t     *mp,
+        xfs_perag_t     *pag,
+        xfs_inode_t     *ip)
+{
+        radix_tree_tag_clear(&pag->pag_ici_root,
+                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
+        __xfs_inode_clear_reclaim(pag, ip);
+}
+
 /*
  * Inodes in different states need to be treated differently, and the return
  * value of xfs_iflush is not sufficient to get this right. The following table
@@ -838,6 +846,7 @@ reclaim:
         if (!radix_tree_delete(&pag->pag_ici_root,
                                 XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino)))
                 ASSERT(0);
+        __xfs_inode_clear_reclaim(pag, ip);
         write_unlock(&pag->pag_ici_lock);
 
         /*
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index ed575fb4b495..7e206fc1fa36 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -405,9 +405,15 @@ xlog_cil_push(
         new_ctx = kmem_zalloc(sizeof(*new_ctx), KM_SLEEP|KM_NOFS);
         new_ctx->ticket = xlog_cil_ticket_alloc(log);
 
-        /* lock out transaction commit, but don't block on background push */
+        /*
+         * Lock out transaction commit, but don't block for background pushes
+         * unless we are well over the CIL space limit. See the definition of
+         * XLOG_CIL_HARD_SPACE_LIMIT() for the full explanation of the logic
+         * used here.
+         */
         if (!down_write_trylock(&cil->xc_ctx_lock)) {
-                if (!push_seq)
+                if (!push_seq &&
+                    cil->xc_ctx->space_used < XLOG_CIL_HARD_SPACE_LIMIT(log))
                         goto out_free_ticket;
                 down_write(&cil->xc_ctx_lock);
         }
@@ -422,7 +428,7 @@ xlog_cil_push(
                 goto out_skip;
 
         /* check for a previously pushed seqeunce */
-        if (push_seq < cil->xc_ctx->sequence)
+        if (push_seq && push_seq < cil->xc_ctx->sequence)
                 goto out_skip;
 
         /*
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index ced52b98b322..edcdfe01617f 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -426,13 +426,13 @@ struct xfs_cil {
 };
 
 /*
- * The amount of log space we should the CIL to aggregate is difficult to size.
- * Whatever we chose we have to make we can get a reservation for the log space
- * effectively, that it is large enough to capture sufficient relogging to
- * reduce log buffer IO significantly, but it is not too large for the log or
- * induces too much latency when writing out through the iclogs. We track both
- * space consumed and the number of vectors in the checkpoint context, so we
- * need to decide which to use for limiting.
+ * The amount of log space we allow the CIL to aggregate is difficult to size.
+ * Whatever we choose, we have to make sure we can get a reservation for the
+ * log space effectively, that it is large enough to capture sufficient
+ * relogging to reduce log buffer IO significantly, but it is not too large for
+ * the log or induces too much latency when writing out through the iclogs. We
+ * track both space consumed and the number of vectors in the checkpoint
+ * context, so we need to decide which to use for limiting.
  *
  * Every log buffer we write out during a push needs a header reserved, which
  * is at least one sector and more for v2 logs. Hence we need a reservation of
@@ -459,16 +459,21 @@ struct xfs_cil {
  * checkpoint transaction ticket is specific to the checkpoint context, rather
  * than the CIL itself.
  *
- * With dynamic reservations, we can basically make up arbitrary limits for the
- * checkpoint size so long as they don't violate any other size rules.  Hence
- * the initial maximum size for the checkpoint transaction will be set to a
- * quarter of the log or 8MB, which ever is smaller. 8MB is an arbitrary limit
- * right now based on the latency of writing out a large amount of data through
- * the circular iclog buffers.
+ * With dynamic reservations, we can effectively make up arbitrary limits for
+ * the checkpoint size so long as they don't violate any other size rules.
+ * Recovery imposes a rule that no transaction exceed half the log, so we are
+ * limited by that.  Furthermore, the log transaction reservation subsystem
+ * tries to keep 25% of the log free, so we need to keep below that limit or we
+ * risk running out of free log space to start any new transactions.
+ *
+ * In order to keep background CIL push efficient, we will set a lower
+ * threshold at which background pushing is attempted without blocking current
+ * transaction commits.  A separate, higher bound defines when CIL pushes are
+ * enforced to ensure we stay within our maximum checkpoint size bounds.
+ * threshold, yet give us plenty of space for aggregation on large logs.
  */
-
-#define XLOG_CIL_SPACE_LIMIT(log)       \
-        (min((log->l_logsize >> 2), (8 * 1024 * 1024)))
+#define XLOG_CIL_SPACE_LIMIT(log)       (log->l_logsize >> 3)
+#define XLOG_CIL_HARD_SPACE_LIMIT(log)  (3 * (log->l_logsize >> 4))
 
 /*
  * The reservation head lsn is not made up of a cycle number and block number.
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index c0786d446a00..984cdc62e30b 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -55,7 +55,7 @@
 extern u8 acpi_gbl_permanent_mmap;
 
 /*
- * Globals that are publically available, allowing for
+ * Globals that are publicly available, allowing for
  * run time configuration
  */
 extern u32 acpi_dbg_level;
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 49b43c23636a..5afa5b52063e 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -247,9 +247,11 @@ struct ttm_buffer_object {
 
         atomic_t reserved;
 
-
         /**
          * Members protected by the bo::lock
+         * In addition, setting sync_obj to anything else
+         * than NULL requires bo::reserved to be held. This allows for
+         * checking NULL while reserved but not holding bo::lock.
          */
 
         void *sync_obj_arg;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 626b629429ff..4e8ea8c8ec1e 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -118,7 +118,6 @@ header-y += eventpoll.h
 header-y += ext2_fs.h
 header-y += fadvise.h
 header-y += falloc.h
-header-y += fanotify.h
 header-y += fb.h
 header-y += fcntl.h
 header-y += fd.h
diff --git a/include/linux/coredump.h b/include/linux/coredump.h
index 8ba66a9d9022..ba4b85a6d9b8 100644
--- a/include/linux/coredump.h
+++ b/include/linux/coredump.h
@@ -9,37 +9,7 @@
  * These are the only things you should do on a core-file: use only these
  * functions to write out all the necessary info.
  */
-static inline int dump_write(struct file *file, const void *addr, int nr)
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
-
-static inline int dump_seek(struct file *file, loff_t off)
-{
-        int ret = 1;
-
-        if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
-                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
-                        return 0;
-        } else {
-                char *buf = (char *)get_zeroed_page(GFP_KERNEL);
-
-                if (!buf)
-                        return 0;
-                while (off > 0) {
-                        unsigned long n = off;
-
-                        if (n > PAGE_SIZE)
-                                n = PAGE_SIZE;
-                        if (!dump_write(file, buf, n)) {
-                                ret = 0;
-                                break;
-                        }
-                        off -= n;
-                }
-                free_page((unsigned long)buf);
-        }
-        return ret;
-}
+extern int dump_write(struct file *file, const void *addr, int nr);
+extern int dump_seek(struct file *file, loff_t off);
 
 #endif /* _LINUX_COREDUMP_H */
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 36ca9721a0c2..1be416bbbb82 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -53,6 +53,7 @@ struct cpuidle_state {
 #define CPUIDLE_FLAG_BALANCED   (0x40) /* medium latency, moderate savings */
 #define CPUIDLE_FLAG_DEEP       (0x80) /* high latency, large savings */
 #define CPUIDLE_FLAG_IGNORE     (0x100) /* ignore during this idle period */
+#define CPUIDLE_FLAG_TLB_FLUSHED (0x200) /* tlb will be flushed */
 
 #define CPUIDLE_DRIVER_FLAGS_MASK (0xFFFF0000)
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index c61d4ca27bcc..e2106495cc11 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -548,7 +548,7 @@ static inline bool dma_dev_has_pq_continue(struct dma_device *dma)
         return (dma->max_pq & DMA_HAS_PQ_CONTINUE) == DMA_HAS_PQ_CONTINUE;
 }
 
-static unsigned short dma_dev_to_maxpq(struct dma_device *dma)
+static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
 {
         return dma->max_pq & ~DMA_HAS_PQ_CONTINUE;
 }
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 926b50322a46..4fd978e7eb83 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -93,6 +93,7 @@ struct elevator_queue
         struct elevator_type *elevator_type;
         struct mutex sysfs_lock;
         struct hlist_head *hash;
+        unsigned int registered:1;
 };
 
 /*
diff --git a/include/linux/module.h b/include/linux/module.h
index 8a6b9fdc7ffa..aace066bad8f 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -686,17 +686,16 @@ extern int module_sysfs_initialized;
 
 
 #ifdef CONFIG_GENERIC_BUG
-int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
                          struct module *);
 void module_bug_cleanup(struct module *);
 
 #else   /* !CONFIG_GENERIC_BUG */
 
-static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
+static inline void module_bug_finalize(const Elf_Ehdr *hdr,
                                         const Elf_Shdr *sechdrs,
                                         struct module *mod)
 {
-        return 0;
 }
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif  /* CONFIG_GENERIC_BUG */
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 59d066936ab9..123566912d73 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -27,8 +27,6 @@
 
 #define MAX_LINKS 32            
 
-struct net;
-
 struct sockaddr_nl {
         sa_family_t     nl_family;      /* AF_NETLINK   */
         unsigned short  nl_pad;         /* zero         */
@@ -151,6 +149,8 @@ struct nlattr {
 #include <linux/capability.h>
 #include <linux/skbuff.h>
 
+struct net;
+
 static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb)
 {
         return (struct nlmsghdr *)skb->data;
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index 10d33309e9a6..570fddeb0388 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -393,6 +393,9 @@
 #define PCI_DEVICE_ID_VLSI_82C147       0x0105
 #define PCI_DEVICE_ID_VLSI_VAS96011     0x0702
 
+/* AMD RD890 Chipset */
+#define PCI_DEVICE_ID_RD890_IOMMU       0x5a23
+
 #define PCI_VENDOR_ID_ADL               0x1005
 #define PCI_DEVICE_ID_ADL_2301          0x2301
 
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 9fbc54a2585d..83af1f8d8b74 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -454,7 +454,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
  * Makes rcu_dereference_check() do the dirty work.
  */
 #define rcu_dereference_bh(p) \
-                rcu_dereference_check(p, rcu_read_lock_bh_held())
+                rcu_dereference_check(p, rcu_read_lock_bh_held() || irqs_disabled())
 
 /**
  * rcu_dereference_sched - fetch RCU-protected pointer, checking for RCU-sched
diff --git a/include/linux/socket.h b/include/linux/socket.h
index a2fada9becb6..a8f56e1ec760 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -322,7 +322,7 @@ extern int csum_partial_copy_fromiovecend(unsigned char *kdata,
                                           int offset, 
                                           unsigned int len, __wsum *csump);
 
-extern int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
+extern long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode);
 extern int memcpy_toiovec(struct iovec *v, unsigned char *kdata, int len);
 extern int memcpy_toiovecend(const struct iovec *v, unsigned char *kdata,
                              int offset, int len);
diff --git a/include/linux/types.h b/include/linux/types.h
index 01a082f56ef4..357dbc19606f 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -121,7 +121,15 @@ typedef		__u64		u_int64_t;
 typedef         __s64           int64_t;
 #endif
 
-/* this is a special 64bit data type that is 8-byte aligned */
+/*
+ * aligned_u64 should be used in defining kernel<->userspace ABIs to avoid
+ * common 32/64-bit compat problems.
+ * 64-bit values align to 4-byte boundaries on x86_32 (and possibly other
+ * architectures) and to 8-byte boundaries on 64-bit architetures.  The new
+ * aligned_64 type enforces 8-byte alignment so that structs containing
+ * aligned_64 values have the same alignment on 32-bit and 64-bit architectures.
+ * No conversions are necessary between 32-bit user-space and a 64-bit kernel.
+ */
 #define aligned_u64 __u64 __attribute__((aligned(8)))
 #define aligned_be64 __be64 __attribute__((aligned(8)))
 #define aligned_le64 __le64 __attribute__((aligned(8)))
@@ -178,6 +186,11 @@ typedef __u64 __bitwise __be64;
 typedef __u16 __bitwise __sum16;
 typedef __u32 __bitwise __wsum;
 
+/* this is a special 64bit data type that is 8-byte aligned */
+#define __aligned_u64 __u64 __attribute__((aligned(8)))
+#define __aligned_be64 __be64 __attribute__((aligned(8)))
+#define __aligned_le64 __le64 __attribute__((aligned(8)))
+
 #ifdef __KERNEL__
 typedef unsigned __bitwise__ gfp_t;
 typedef unsigned __bitwise__ fmode_t;
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 0836ccc57121..3efc9f3f43a0 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -614,6 +614,7 @@ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
                 (wait)->private = current;                              \
                 (wait)->func = autoremove_wake_function;                \
                 INIT_LIST_HEAD(&(wait)->task_list);                     \
+                (wait)->flags = 0;                                      \
         } while (0)
 
 /**
diff --git a/include/media/videobuf-dma-sg.h b/include/media/videobuf-dma-sg.h
index 97e07f46a0fa..aa4ebb42a565 100644
--- a/include/media/videobuf-dma-sg.h
+++ b/include/media/videobuf-dma-sg.h
@@ -48,6 +48,7 @@ struct videobuf_dmabuf {
 
         /* for userland buffer */
         int                 offset;
+        size_t              size;
         struct page         **pages;
 
         /* for kernel buffers */
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 45375b41a2a0..4d40c4d0230b 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -121,6 +121,7 @@ static inline int addrconf_finite_timeout(unsigned long timeout)
  *      IPv6 Address Label subsystem (addrlabel.c)
  */
 extern int                      ipv6_addr_label_init(void);
+extern void                     ipv6_addr_label_cleanup(void);
 extern void                     ipv6_addr_label_rtnl_register(void);
 extern u32                      ipv6_addr_label(struct net *net,
                                                 const struct in6_addr *addr,
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 27a902d9b3a9..30fce0128dd7 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -161,12 +161,30 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long l
 {
         struct sk_buff *skb;
 
+        release_sock(sk);
         if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
                 skb_reserve(skb, BT_SKB_RESERVE);
                 bt_cb(skb)->incoming  = 0;
         }
+        lock_sock(sk);
+
+        if (!skb && *err)
+                return NULL;
+
+        *err = sock_error(sk);
+        if (*err)
+                goto out;
+
+        if (sk->sk_shutdown) {
+                *err = -ECONNRESET;
+                goto out;
+        }
 
         return skb;
+
+out:
+        kfree_skb(skb);
+        return NULL;
 }
 
 int bt_err(__u16 code);
diff --git a/include/net/dst.h b/include/net/dst.h
index 81d1413a8701..02386505033d 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -242,6 +242,7 @@ static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
         dev->stats.rx_packets++;
         dev->stats.rx_bytes += skb->len;
         skb->rxhash = 0;
+        skb_set_queue_mapping(skb, 0);
         skb_dst_drop(skb);
         nf_reset(skb);
 }
diff --git a/include/net/route.h b/include/net/route.h
index bd732d62e1c3..7e5e73bfa4de 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -199,6 +199,8 @@ static inline int ip_route_newports(struct rtable **rp, u8 protocol,
                 fl.fl_ip_sport = sport;
                 fl.fl_ip_dport = dport;
                 fl.proto = protocol;
+                if (inet_sk(sk)->transparent)
+                        fl.flags |= FLOWI_FLAG_ANYSRC;
                 ip_rt_put(*rp);
                 *rp = NULL;
                 security_sk_classify_flow(sk, &fl);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index fc8f36dd0f5c..4f53532d4c2f 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -298,8 +298,8 @@ struct xfrm_state_afinfo {
         const struct xfrm_type  *type_map[IPPROTO_MAX];
         struct xfrm_mode        *mode_map[XFRM_MODE_MAX];
         int                     (*init_flags)(struct xfrm_state *x);
-        void                    (*init_tempsel)(struct xfrm_state *x, struct flowi *fl,
-                                                struct xfrm_tmpl *tmpl,
+        void                    (*init_tempsel)(struct xfrm_selector *sel, struct flowi *fl);
+        void                    (*init_temprop)(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
                                                 xfrm_address_t *daddr, xfrm_address_t *saddr);
         int                     (*tmpl_sort)(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n);
         int                     (*state_sort)(struct xfrm_state **dst, struct xfrm_state **src, int n);
diff --git a/ipc/sem.c b/ipc/sem.c
index 40a8f462a822..0e0d49bbb867 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -743,6 +743,8 @@ static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in,
             {
                 struct semid_ds out;
 
+                memset(&out, 0, sizeof(out));
+
                 ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm);
 
                 out.sem_otime   = in->sem_otime;
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 1decafbb6b1a..72206cf5c6cf 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -931,6 +931,7 @@ static inline int
 remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
 {
         if (hrtimer_is_queued(timer)) {
+                unsigned long state;
                 int reprogram;
 
                 /*
@@ -944,8 +945,13 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
                 debug_deactivate(timer);
                 timer_stats_hrtimer_clear_start_info(timer);
                 reprogram = base->cpu_base == &__get_cpu_var(hrtimer_bases);
-                __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE,
-                                 reprogram);
+                /*
+                 * We must preserve the CALLBACK state flag here,
+                 * otherwise we could move the timer base in
+                 * switch_hrtimer_base.
+                 */
+                state = timer->state & HRTIMER_STATE_CALLBACK;
+                __remove_hrtimer(timer, base, state, reprogram);
                 return 1;
         }
         return 0;
@@ -1231,6 +1237,9 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now)
                 BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
                 enqueue_hrtimer(timer, base);
         }
+
+        WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));
+
         timer->state &= ~HRTIMER_STATE_CALLBACK;
 }
 
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 6b5580c57644..01a0700e873f 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -365,8 +365,6 @@ static unsigned int setup_sgl(struct __kfifo *fifo, struct scatterlist *sgl,
         n = setup_sgl_buf(sgl, fifo->data + off, nents, l);
         n += setup_sgl_buf(sgl + n, fifo->data, nents - n, len - l);
 
-        if (n)
-                sg_mark_end(sgl + n - 1);
         return n;
 }
 
diff --git a/kernel/module.c b/kernel/module.c
index d0b5f8db11b4..ccd641991842 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1537,6 +1537,7 @@ static int __unlink_module(void *_mod)
 {
         struct module *mod = _mod;
         list_del(&mod->list);
+        module_bug_cleanup(mod);
         return 0;
 }
 
@@ -2625,6 +2626,7 @@ static struct module *load_module(void __user *umod,
         if (err < 0)
                 goto ddebug;
 
+        module_bug_finalize(info.hdr, info.sechdrs, mod);
         list_add_rcu(&mod->list, &modules);
         mutex_unlock(&module_mutex);
 
@@ -2650,6 +2652,8 @@ static struct module *load_module(void __user *umod,
         mutex_lock(&module_mutex);
         /* Unlink carefully: kallsyms could be walking list. */
         list_del_rcu(&mod->list);
+        module_bug_cleanup(mod);
+
  ddebug:
         if (!mod->taints)
                 dynamic_debug_remove(info.debug);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index db5b56064687..b98bed3d8182 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -2202,15 +2202,13 @@ static void perf_event_for_each(struct perf_event *event,
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
 {
         struct perf_event_context *ctx = event->ctx;
-        unsigned long size;
         int ret = 0;
         u64 value;
 
         if (!event->attr.sample_period)
                 return -EINVAL;
 
-        size = copy_from_user(&value, arg, sizeof(value));
-        if (size != sizeof(value))
+        if (copy_from_user(&value, arg, sizeof(value)))
                 return -EFAULT;
 
         if (!value)
diff --git a/kernel/signal.c b/kernel/signal.c
index bded65187780..919562c3d6b7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2215,6 +2215,14 @@ int copy_siginfo_to_user(siginfo_t __user *to, siginfo_t *from)
 #ifdef __ARCH_SI_TRAPNO
                 err |= __put_user(from->si_trapno, &to->si_trapno);
 #endif
+#ifdef BUS_MCEERR_AO
+                /* 
+                 * Other callers might not initialize the si_lsb field,
+                 * so check explicitely for the right codes here.
+                 */
+                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
+                        err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+#endif
                 break;
         case __SI_CHLD:
                 err |= __put_user(from->si_pid, &to->si_pid);
diff --git a/kernel/smp.c b/kernel/smp.c
index 75c970c715d3..ed6aacfcb7ef 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -365,9 +365,10 @@ call:
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 
 /**
- * __smp_call_function_single(): Run a function on another CPU
+ * __smp_call_function_single(): Run a function on a specific CPU
  * @cpu: The CPU to run on.
  * @data: Pre-allocated and setup data structure
+ * @wait: If true, wait until function has completed on specified CPU.
  *
  * Like smp_call_function_single(), but allow caller to pass in a
  * pre-allocated data structure. Useful for embedding @data inside
@@ -376,8 +377,10 @@ EXPORT_SYMBOL_GPL(smp_call_function_any);
 void __smp_call_function_single(int cpu, struct call_single_data *data,
                                 int wait)
 {
-        csd_lock(data);
+        unsigned int this_cpu;
+        unsigned long flags;
 
+        this_cpu = get_cpu();
         /*
          * Can deadlock when called with interrupts disabled.
          * We allow cpu's that are not yet online though, as no one else can
@@ -387,7 +390,15 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
         WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
                      && !oops_in_progress);
 
-        generic_exec_single(cpu, data, wait);
+        if (cpu == this_cpu) {
+                local_irq_save(flags);
+                data->func(data->info);
+                local_irq_restore(flags);
+        } else {
+                csd_lock(data);
+                generic_exec_single(cpu, data, wait);
+        }
+        put_cpu();
 }
 
 /**
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index f88552c6d227..3a45c224770f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2485,7 +2485,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                 kbuf[left] = 0;
         }
 
-        for (; left && vleft--; i++, min++, max++, first=0) {
+        for (; left && vleft--; i++, first = 0) {
                 unsigned long val;
 
                 if (write) {
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index 04cdcf72c827..10b90d8a03c4 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -143,15 +143,6 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                                 if (!table->maxlen)
                                         set_fail(&fail, table, "No maxlen");
                         }
-                        if ((table->proc_handler == proc_doulongvec_minmax) ||
-                            (table->proc_handler == proc_doulongvec_ms_jiffies_minmax)) {
-                                if (table->maxlen > sizeof (unsigned long)) {
-                                        if (!table->extra1)
-                                                set_fail(&fail, table, "No min");
-                                        if (!table->extra2)
-                                                set_fail(&fail, table, "No max");
-                                }
-                        }
 #ifdef CONFIG_PROC_SYSCTL
                         if (table->procname && !table->proc_handler)
                                 set_fail(&fail, table, "No proc_handler");
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 492197e2f86c..bca96377fd4e 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -405,7 +405,7 @@ static inline int test_time_stamp(u64 delta)
 #define BUF_MAX_DATA_SIZE (BUF_PAGE_SIZE - (sizeof(u32) * 2))
 
 /* Max number of timestamps that can fit on a page */
-#define RB_TIMESTAMPS_PER_PAGE  (BUF_PAGE_SIZE / RB_LEN_TIME_STAMP)
+#define RB_TIMESTAMPS_PER_PAGE  (BUF_PAGE_SIZE / RB_LEN_TIME_EXTEND)
 
 int ring_buffer_print_page_header(struct trace_seq *s)
 {
diff --git a/lib/bug.c b/lib/bug.c
index 7cdfad88128f..19552096d16b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -72,8 +72,8 @@ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
         return NULL;
 }
 
-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-                        struct module *mod)
+void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+                         struct module *mod)
 {
         char *secstrings;
         unsigned int i;
@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
          * could potentially lead to deadlock and thus be counter-productive.
          */
         list_add(&mod->bug_list, &module_bug_list);
-
-        return 0;
 }
 
 void module_bug_cleanup(struct module *mod)
diff --git a/lib/list_sort.c b/lib/list_sort.c
index 4b5cb794c38b..a7616fa3162e 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -70,7 +70,7 @@ static void merge_and_restore_back_links(void *priv,
                  * element comparison is needed, so the client's cmp()
                  * routine can invoke cond_resched() periodically.
                  */
-                (*cmp)(priv, tail, tail);
+                (*cmp)(priv, tail->next, tail->next);
 
                 tail->next->prev = tail;
                 tail = tail->next;
diff --git a/mm/ksm.c b/mm/ksm.c
index b1873cf03ed9..65ab5c7067d9 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -712,7 +712,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
         if (!ptep)
                 goto out;
 
-        if (pte_write(*ptep)) {
+        if (pte_write(*ptep) || pte_dirty(*ptep)) {
                 pte_t entry;
 
                 swapped = PageSwapCache(page);
@@ -735,7 +735,9 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                         set_pte_at(mm, addr, ptep, entry);
                         goto out_unlock;
                 }
-                entry = pte_wrprotect(entry);
+                if (pte_dirty(entry))
+                        set_page_dirty(page);
+                entry = pte_mkclean(pte_wrprotect(entry));
                 set_pte_at_notify(mm, addr, ptep, entry);
         }
         *orig_pte = *ptep;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3eed583895a6..9be3cf8a5da4 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3587,9 +3587,13 @@ unlock:
 
 static void mem_cgroup_threshold(struct mem_cgroup *memcg)
 {
-        __mem_cgroup_threshold(memcg, false);
-        if (do_swap_account)
-                __mem_cgroup_threshold(memcg, true);
+        while (memcg) {
+                __mem_cgroup_threshold(memcg, false);
+                if (do_swap_account)
+                        __mem_cgroup_threshold(memcg, true);
+
+                memcg = parent_mem_cgroup(memcg);
+        }
 }
 
 static int compare_thresholds(const void *a, const void *b)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 9c26eeca1342..757f6b0accfe 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -183,7 +183,7 @@ EXPORT_SYMBOL_GPL(hwpoison_filter);
  * signal.
  */
 static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
-                        unsigned long pfn)
+                        unsigned long pfn, struct page *page)
 {
         struct siginfo si;
         int ret;
@@ -198,7 +198,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
 #ifdef __ARCH_SI_TRAPNO
         si.si_trapno = trapno;
 #endif
-        si.si_addr_lsb = PAGE_SHIFT;
+        si.si_addr_lsb = compound_order(compound_head(page)) + PAGE_SHIFT;
         /*
          * Don't use force here, it's convenient if the signal
          * can be temporarily blocked.
@@ -235,7 +235,7 @@ void shake_page(struct page *p, int access)
                 int nr;
                 do {
                         nr = shrink_slab(1000, GFP_KERNEL, 1000);
-                        if (page_count(p) == 0)
+                        if (page_count(p) == 1)
                                 break;
                 } while (nr > 10);
         }
@@ -327,7 +327,7 @@ static void add_to_kill(struct task_struct *tsk, struct page *p,
  * wrong earlier.
  */
 static void kill_procs_ao(struct list_head *to_kill, int doit, int trapno,
-                          int fail, unsigned long pfn)
+                          int fail, struct page *page, unsigned long pfn)
 {
         struct to_kill *tk, *next;
 
@@ -352,7 +352,7 @@ static void kill_procs_ao(struct list_head *to_kill, int doit, int trapno,
                          * process anyways.
                          */
                         else if (kill_proc_ao(tk->tsk, tk->addr, trapno,
-                                              pfn) < 0)
+                                              pfn, page) < 0)
                                 printk(KERN_ERR
                 "MCE %#lx: Cannot send advisory machine check signal to %s:%d\n",
                                         pfn, tk->tsk->comm, tk->tsk->pid);
@@ -928,7 +928,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
          * any accesses to the poisoned memory.
          */
         kill_procs_ao(&tokill, !!PageDirty(hpage), trapno,
-                      ret != SWAP_SUCCESS, pfn);
+                      ret != SWAP_SUCCESS, p, pfn);
 
         return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a8cfa9cc6e86..f12ad1836abe 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5182,9 +5182,9 @@ void *__init alloc_large_system_hash(const char *tablename,
         if (!table)
                 panic("Failed to allocate %s hash table\n", tablename);
 
-        printk(KERN_INFO "%s hash table entries: %d (order: %d, %lu bytes)\n",
+        printk(KERN_INFO "%s hash table entries: %ld (order: %d, %lu bytes)\n",
                tablename,
-               (1U << log2qty),
+               (1UL << log2qty),
                ilog2(size) - PAGE_SHIFT,
                size);
 
diff --git a/mm/rmap.c b/mm/rmap.c
index 9d2ba01bd4f9..92e6757f196e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -381,7 +381,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
         if (PageAnon(page)) {
-                if (vma->anon_vma->root != page_anon_vma(page)->root)
+                struct anon_vma *page__anon_vma = page_anon_vma(page);
+                /*
+                 * Note: swapoff's unuse_vma() is more efficient with this
+                 * check, and needs it to match anon_vma when KSM is active.
+                 */
+                if (!vma->anon_vma || !page__anon_vma ||
+                    vma->anon_vma->root != page__anon_vma->root)
                         return -EFAULT;
         } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                 if (!vma->vm_file ||
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 01ddb0472f86..0eb96f7e44be 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
 
         if (vlan_dev)
                 skb->dev = vlan_dev;
-        else if (vlan_id)
-                goto drop;
+        else if (vlan_id) {
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
 
         return (polling ? netif_receive_skb(skb) : netif_rx(skb));
 
@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 
         if (vlan_dev)
                 skb->dev = vlan_dev;
-        else if (vlan_id)
-                goto drop;
+        else if (vlan_id) {
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
 
         for (p = napi->gro_list; p; p = p->next) {
                 NAPI_GRO_CB(p)->same_flow =
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 0ea20c30466c..17c5ba7551a5 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -426,8 +426,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
 
         /* Allocate an fcall for the reply */
         rpl_context = kmalloc(sizeof *rpl_context, GFP_KERNEL);
-        if (!rpl_context)
+        if (!rpl_context) {
+                err = -ENOMEM;
                 goto err_close;
+        }
 
         /*
          * If the request has a buffer, steal it, otherwise
@@ -445,8 +447,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         }
         rpl_context->rc = req->rc;
         if (!rpl_context->rc) {
-                kfree(rpl_context);
-                goto err_close;
+                err = -ENOMEM;
+                goto err_free2;
         }
 
         /*
@@ -458,11 +460,8 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
          */
         if (atomic_inc_return(&rdma->rq_count) <= rdma->rq_depth) {
                 err = post_recv(client, rpl_context);
-                if (err) {
-                        kfree(rpl_context->rc);
-                        kfree(rpl_context);
-                        goto err_close;
-                }
+                if (err)
+                        goto err_free1;
         } else
                 atomic_dec(&rdma->rq_count);
 
@@ -471,8 +470,10 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
 
         /* Post the request */
         c = kmalloc(sizeof *c, GFP_KERNEL);
-        if (!c)
-                goto err_close;
+        if (!c) {
+                err = -ENOMEM;
+                goto err_free1;
+        }
         c->req = req;
 
         c->busa = ib_dma_map_single(rdma->cm_id->device,
@@ -499,9 +500,15 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)
         return ib_post_send(rdma->qp, &wr, &bad_wr);
 
  error:
+        kfree(c);
+        kfree(rpl_context->rc);
+        kfree(rpl_context);
         P9_DPRINTK(P9_DEBUG_ERROR, "EIO\n");
         return -EIO;
-
+ err_free1:
+        kfree(rpl_context->rc);
+ err_free2:
+        kfree(rpl_context);
  err_close:
         spin_lock_irqsave(&rdma->req_lock, flags);
         if (rdma->state < P9_RDMA_CLOSING) {
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index dcfbe99ff81c..b88515936e4b 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -329,7 +329,8 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
 
         mutex_lock(&virtio_9p_lock);
         list_for_each_entry(chan, &virtio_chan_list, chan_list) {
-                if (!strncmp(devname, chan->tag, chan->tag_len)) {
+                if (!strncmp(devname, chan->tag, chan->tag_len) &&
+                    strlen(devname) == chan->tag_len) {
                         if (!chan->inuse) {
                                 chan->inuse = true;
                                 found = 1;
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 651babdfab38..ad2b232a2055 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -399,12 +399,6 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
                         unregister_netdev(net_dev);
                         free_netdev(net_dev);
                 }
-                read_lock_irq(&devs_lock);
-                if (list_empty(&br2684_devs)) {
-                        /* last br2684 device */
-                        unregister_atmdevice_notifier(&atm_dev_notifier);
-                }
-                read_unlock_irq(&devs_lock);
                 return;
         }
 
@@ -675,7 +669,6 @@ static int br2684_create(void __user *arg)
 
         if (list_empty(&br2684_devs)) {
                 /* 1st br2684 device */
-                register_atmdevice_notifier(&atm_dev_notifier);
                 brdev->number = 1;
         } else
                 brdev->number = BRPRIV(list_entry_brdev(br2684_devs.prev))->number + 1;
@@ -815,6 +808,7 @@ static int __init br2684_init(void)
                 return -ENOMEM;
 #endif
         register_atm_ioctl(&br2684_ioctl_ops);
+        register_atmdevice_notifier(&atm_dev_notifier);
         return 0;
 }
 
@@ -830,9 +824,7 @@ static void __exit br2684_exit(void)
 #endif
 
 
-        /* if not already empty */
-        if (!list_empty(&br2684_devs))
-                unregister_atmdevice_notifier(&atm_dev_notifier);
+        unregister_atmdevice_notifier(&atm_dev_notifier);
 
         while (!list_empty(&br2684_devs)) {
                 net_dev = list_entry_brdev(br2684_devs.next);
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 622b471e14e0..74bcc662c3dd 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
         eg->packets_rcvd++;
         mpc->eg_ops->put(eg);
 
-        memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
+        memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
         netif_rx(new_skb);
 }
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index fadf26b4ed7c..0b54b7dd8401 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1441,33 +1441,23 @@ static inline void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
 
 static void l2cap_streaming_send(struct sock *sk)
 {
-        struct sk_buff *skb, *tx_skb;
+        struct sk_buff *skb;
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         u16 control, fcs;
 
-        while ((skb = sk->sk_send_head)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
-
-                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
+        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
+                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
                 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
-                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
 
                 if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
-                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
                 }
 
-                l2cap_do_send(sk, tx_skb);
+                l2cap_do_send(sk, skb);
 
                 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
-                else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
-
-                skb = skb_dequeue(TX_QUEUE(sk));
-                kfree_skb(skb);
         }
 }
 
@@ -1960,6 +1950,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
 
         switch (optname) {
         case L2CAP_OPTIONS:
+                if (sk->sk_state == BT_CONNECTED) {
+                        err = -EINVAL;
+                        break;
+                }
+
                 opts.imtu     = l2cap_pi(sk)->imtu;
                 opts.omtu     = l2cap_pi(sk)->omtu;
                 opts.flush_to = l2cap_pi(sk)->flush_to;
@@ -2771,10 +2766,10 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                 case L2CAP_CONF_MTU:
                         if (val < L2CAP_DEFAULT_MIN_MTU) {
                                 *result = L2CAP_CONF_UNACCEPT;
-                                pi->omtu = L2CAP_DEFAULT_MIN_MTU;
+                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
                         } else
-                                pi->omtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                                pi->imtu = val;
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
                         break;
 
                 case L2CAP_CONF_FLUSH_TO:
@@ -3071,6 +3066,17 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
         return 0;
 }
 
+static inline void set_default_fcs(struct l2cap_pinfo *pi)
+{
+        /* FCS is enabled only in ERTM or streaming mode, if one or both
+         * sides request it.
+         */
+        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
+                pi->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                pi->fcs = L2CAP_FCS_CRC16;
+}
+
 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
@@ -3088,14 +3094,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         if (!sk)
                 return -ENOENT;
 
-        if (sk->sk_state != BT_CONFIG) {
-                struct l2cap_cmd_rej rej;
-
-                rej.reason = cpu_to_le16(0x0002);
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
-                                sizeof(rej), &rej);
+        if (sk->sk_state == BT_DISCONN)
                 goto unlock;
-        }
 
         /* Reject if config buffer is too small. */
         len = cmd_len - sizeof(*req);
@@ -3135,9 +3135,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                 goto unlock;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
 
@@ -3225,9 +3223,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
+                set_default_fcs(l2cap_pi(sk));
 
                 sk->sk_state = BT_CONNECTED;
                 l2cap_pi(sk)->next_tx_seq = 0;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 44a623275951..194b3a04cfd3 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -82,11 +82,14 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 {
         struct sock *sk = d->owner, *parent;
+        unsigned long flags;
+
         if (!sk)
                 return;
 
         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
 
+        local_irq_save(flags);
         bh_lock_sock(sk);
 
         if (err)
@@ -108,6 +111,7 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
         }
 
         bh_unlock_sock(sk);
+        local_irq_restore(flags);
 
         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
                 /* We have to drop DLC lock here, otherwise
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 8ce904786116..4bf28f25f368 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -827,6 +827,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
         long timeo;
         int err;
         int ifindex, headroom, tailroom;
+        unsigned int mtu;
         struct net_device *dev;
 
         lock_sock(sk);
@@ -896,15 +897,23 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
                 cf_sk->sk.sk_state = CAIF_DISCONNECTED;
                 goto out;
         }
-        dev = dev_get_by_index(sock_net(sk), ifindex);
+
+        err = -ENODEV;
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                goto out;
+        }
         cf_sk->headroom = LL_RESERVED_SPACE_EXTRA(dev, headroom);
+        mtu = dev->mtu;
+        rcu_read_unlock();
+
         cf_sk->tailroom = tailroom;
-        cf_sk->maxframe = dev->mtu - (headroom + tailroom);
-        dev_put(dev);
+        cf_sk->maxframe = mtu - (headroom + tailroom);
         if (cf_sk->maxframe < 1) {
-                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%d)\n",
-                        __func__, dev->mtu);
-                err = -ENODEV;
+                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%u)\n",
+                           __func__, mtu);
                 goto out;
         }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 7a85367b3c2f..8451ab481095 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -348,7 +348,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
         if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                 if (info.rule_cnt > 0) {
                         if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
-                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
                                                    GFP_USER);
                         if (!rule_buf)
                                 return -ENOMEM;
@@ -397,7 +397,7 @@ static noinline_for_stack int ethtool_get_rxfh_indir(struct net_device *dev,
             (KMALLOC_MAX_SIZE - sizeof(*indir)) / sizeof(*indir->ring_index))
                 return -ENOMEM;
         full_size = sizeof(*indir) + sizeof(*indir->ring_index) * table_size;
-        indir = kmalloc(full_size, GFP_USER);
+        indir = kzalloc(full_size, GFP_USER);
         if (!indir)
                 return -ENOMEM;
 
@@ -538,7 +538,7 @@ static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
 
         gstrings.len = ret;
 
-        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        data = kzalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
         if (!data)
                 return -ENOMEM;
 
@@ -775,7 +775,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = kmalloc(reglen, GFP_USER);
+        regbuf = kzalloc(reglen, GFP_USER);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 1cd98df412df..e6b133b77ccb 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -35,9 +35,10 @@
  *      in any case.
  */
 
-int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
+long verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address, int mode)
 {
-        int size, err, ct;
+        int size, ct;
+        long err;
 
         if (m->msg_namelen) {
                 if (mode == VERIFY_READ) {
diff --git a/net/core/sock.c b/net/core/sock.c
index b05b9b6ddb87..ef30e9d286e7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1351,9 +1351,9 @@ int sock_i_uid(struct sock *sk)
 {
         int uid;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         uid = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_uid : 0;
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         return uid;
 }
 EXPORT_SYMBOL(sock_i_uid);
@@ -1362,9 +1362,9 @@ unsigned long sock_i_ino(struct sock *sk)
 {
         unsigned long ino;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         ino = sk->sk_socket ? SOCK_INODE(sk->sk_socket)->i_ino : 0;
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         return ino;
 }
 EXPORT_SYMBOL(sock_i_ino);
diff --git a/net/core/stream.c b/net/core/stream.c
index d959e0f41528..f5df85dcd20b 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -141,10 +141,10 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                 sk->sk_write_pending++;
-                sk_wait_event(sk, &current_timeo, !sk->sk_err &&
-                                                  !(sk->sk_shutdown & SEND_SHUTDOWN) &&
-                                                  sk_stream_memory_free(sk) &&
-                                                  vm_wait);
+                sk_wait_event(sk, &current_timeo, sk->sk_err ||
+                                                  (sk->sk_shutdown & SEND_SHUTDOWN) ||
+                                                  (sk_stream_memory_free(sk) &&
+                                                  !vm_wait));
                 sk->sk_write_pending--;
 
                 if (vm_wait) {
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 571f8950ed06..7cd7760144f7 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -217,6 +217,7 @@ config NET_IPIP
 
 config NET_IPGRE
         tristate "IP: GRE tunnels over IP"
+        depends on IPV6 || IPV6=n
         help
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
@@ -412,7 +413,7 @@ config INET_XFRM_MODE_BEET
           If unsure, say Y.
 
 config INET_LRO
-        bool "Large Receive Offload (ipv4/tcp)"
+        tristate "Large Receive Offload (ipv4/tcp)"
         default y
         ---help---
           Support for Large Receive Offload (ipv4/tcp).
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fdcacd36ce7..2a4bb76f2132 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -834,7 +834,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
         int                     mark = 0;
 
 
-        if (len == 8 || IGMP_V2_SEEN(in_dev)) {
+        if (len == 8) {
                 if (ih->code == 0) {
                         /* Alas, old v1 router presents here. */
 
@@ -856,6 +856,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                 igmpv3_clear_delrec(in_dev);
         } else if (len < 12) {
                 return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
         } else { /* v3 */
                 if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                         return;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 945b20a5ad50..35c93e8b6a46 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -45,7 +45,7 @@
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
 
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/ipv6.h>
 #include <net/ip6_fib.h>
 #include <net/ip6_route.h>
@@ -699,7 +699,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         if ((dst = rt->rt_gateway) == 0)
                                 goto tx_error_icmp;
                 }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6)) {
                         struct in6_addr *addr6;
                         int addr_type;
@@ -774,7 +774,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         goto tx_error;
                 }
         }
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         else if (skb->protocol == htons(ETH_P_IPV6)) {
                 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
 
@@ -850,7 +850,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         if ((iph->ttl = tiph->ttl) == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
                         iph->ttl = old_iph->ttl;
-#ifdef CONFIG_IPV6
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
                 else if (skb->protocol == htons(ETH_P_IPV6))
                         iph->ttl = ((struct ipv6hdr *)old_iph)->hop_limit;
 #endif
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 04b69896df5f..7649d7750075 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -488,9 +488,8 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
          * we can switch to copy when see the first bad fragment.
          */
         if (skb_has_frags(skb)) {
-                struct sk_buff *frag;
+                struct sk_buff *frag, *frag2;
                 int first_len = skb_pagelen(skb);
-                int truesizes = 0;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -503,18 +502,18 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
                             skb_headroom(frag) < hlen)
-                            goto slow_path;
+                                goto slow_path_clean;
 
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
-                                goto slow_path;
+                                goto slow_path_clean;
 
                         BUG_ON(frag->sk);
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
                         }
-                        truesizes += frag->truesize;
+                        skb->truesize -= frag->truesize;
                 }
 
                 /* Everything is OK. Generate! */
@@ -524,7 +523,6 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 frag = skb_shinfo(skb)->frag_list;
                 skb_frag_list_init(skb);
                 skb->data_len = first_len - skb_headlen(skb);
-                skb->truesize -= truesizes;
                 skb->len = first_len;
                 iph->tot_len = htons(first_len);
                 iph->frag_off = htons(IP_MF);
@@ -576,6 +574,15 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                 }
                 IP_INC_STATS(dev_net(dev), IPSTATS_MIB_FRAGFAILS);
                 return err;
+
+slow_path_clean:
+                skb_walk_frags(skb, frag2) {
+                        if (frag2 == frag)
+                                break;
+                        frag2->sk = NULL;
+                        frag2->destructor = NULL;
+                        skb->truesize += frag2->truesize;
+                }
         }
 
 slow_path:
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index b254dafaf429..43eec80c0e7c 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -112,6 +112,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         /* ip_route_me_harder expects skb->dst to be set */
         skb_dst_set_noref(nskb, skb_dst(oldskb));
 
+        nskb->protocol = htons(ETH_P_IP);
         if (ip_route_me_harder(nskb, addr_type))
                 goto free_nskb;
 
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index eab8de32f200..f3a9b42b16c6 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -66,9 +66,11 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           const struct net_device *out,
                                           int (*okfn)(struct sk_buff *))
 {
+        struct sock *sk = skb->sk;
         struct inet_sock *inet = inet_sk(skb->sk);
 
-        if (inet && inet->nodefrag)
+        if (sk && (sk->sk_family == PF_INET) &&
+            inet->nodefrag)
                 return NF_ACCEPT;
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
index 1679e2c0963d..ee5f419d0a56 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
@@ -893,13 +893,15 @@ static void fast_csum(__sum16 *csum,
         unsigned char s[4];
 
         if (offset & 1) {
-                s[0] = s[2] = 0;
+                s[0] = ~0;
                 s[1] = ~*optr;
+                s[2] = 0;
                 s[3] = *nptr;
         } else {
-                s[1] = s[3] = 0;
                 s[0] = ~*optr;
+                s[1] = ~0;
                 s[2] = *nptr;
+                s[3] = 0;
         }
 
         *csum = csum_fold(csum_partial(s, 4, ~csum_unfold(*csum)));
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6298f75d5e93..ac6559cb54f9 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1231,7 +1231,7 @@ restart:
                         }
 
                         if (net_ratelimit())
-                                printk(KERN_WARNING "Neighbour table overflow.\n");
+                                printk(KERN_WARNING "ipv4: Neighbour table overflow.\n");
                         rt_drop(rt);
                         return -ENOBUFS;
                 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 3fb1428e526e..f115ea68a4ef 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -386,8 +386,6 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
          */
 
         mask = 0;
-        if (sk->sk_err)
-                mask = POLLERR;
 
         /*
          * POLLHUP is certainly not done right. But poll() doesn't
@@ -457,6 +455,11 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_data & TCP_URG_VALID)
                         mask |= POLLPRI;
         }
+        /* This barrier is coupled with smp_wmb() in tcp_reset() */
+        smp_rmb();
+        if (sk->sk_err)
+                mask |= POLLERR;
+
         return mask;
 }
 EXPORT_SYMBOL(tcp_poll);
@@ -940,7 +943,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         sg = sk->sk_route_caps & NETIF_F_SG;
 
         while (--iovlen >= 0) {
-                int seglen = iov->iov_len;
+                size_t seglen = iov->iov_len;
                 unsigned char __user *from = iov->iov_base;
 
                 iov++;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e663b78a2ef6..b55f60f6fcbe 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2545,7 +2545,8 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
                         cnt += tcp_skb_pcount(skb);
 
                 if (cnt > packets) {
-                        if (tcp_is_sack(tp) || (oldcnt >= packets))
+                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (oldcnt >= packets))
                                 break;
 
                         mss = skb_shinfo(skb)->gso_size;
@@ -4048,6 +4049,8 @@ static void tcp_reset(struct sock *sk)
         default:
                 sk->sk_err = ECONNRESET;
         }
+        /* This barrier is coupled with smp_rmb() in tcp_poll() */
+        smp_wmb();
 
         if (!sock_flag(sk, SOCK_DEAD))
                 sk->sk_error_report(sk);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c35b469e851c..74c54b30600f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 
 /* This function calculates a "timeout" which is equivalent to the timeout of a
  * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN.
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
  */
 static bool retransmits_timed_out(struct sock *sk,
-                                  unsigned int boundary)
+                                  unsigned int boundary,
+                                  bool syn_set)
 {
         unsigned int timeout, linear_backoff_thresh;
         unsigned int start_ts;
+        unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
 
         if (!inet_csk(sk)->icsk_retransmits)
                 return false;
@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk,
         else
                 start_ts = tcp_sk(sk)->retrans_stamp;
 
-        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
 
         if (boundary <= linear_backoff_thresh)
-                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+                timeout = ((2 << boundary) - 1) * rto_base;
         else
-                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
                           (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
 
         return (tcp_time_stamp - start_ts) >= timeout;
@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int retry_until;
-        bool do_reset;
+        bool do_reset, syn_set = 0;
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
                         dst_negative_advice(sk);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+                syn_set = 1;
         } else {
-                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk)
 
                         retry_until = tcp_orphan_retries(sk, alive);
                         do_reset = alive ||
-                                   !retransmits_timed_out(sk, retry_until);
+                                   !retransmits_timed_out(sk, retry_until, 0);
 
                         if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (retransmits_timed_out(sk, retry_until)) {
+        if (retransmits_timed_out(sk, retry_until, syn_set)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -436,7 +440,7 @@ out_reset_timer:
                 icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
         }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
                 __sk_dst_reset(sk);
 
 out:;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 869078d4eeb9..a580349f0b8a 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -61,7 +61,7 @@ static int xfrm4_get_saddr(struct net *net,
 
 static int xfrm4_get_tos(struct flowi *fl)
 {
-        return fl->fl4_tos;
+        return IPTOS_RT_MASK & fl->fl4_tos; /* Strip ECN bits */
 }
 
 static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
diff --git a/net/ipv4/xfrm4_state.c b/net/ipv4/xfrm4_state.c
index 1ef1366a0a03..47947624eccc 100644
--- a/net/ipv4/xfrm4_state.c
+++ b/net/ipv4/xfrm4_state.c
@@ -21,21 +21,25 @@ static int xfrm4_init_flags(struct xfrm_state *x)
 }
 
 static void
-__xfrm4_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm4_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+{
+        sel->daddr.a4 = fl->fl4_dst;
+        sel->saddr.a4 = fl->fl4_src;
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET;
+        sel->prefixlen_d = 32;
+        sel->prefixlen_s = 32;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm4_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        x->sel.daddr.a4 = fl->fl4_dst;
-        x->sel.saddr.a4 = fl->fl4_src;
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET;
-        x->sel.prefixlen_d = 32;
-        x->sel.prefixlen_s = 32;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
         x->id = tmpl->id;
         if (x->id.daddr.a4 == 0)
                 x->id.daddr.a4 = daddr->a4;
@@ -70,6 +74,7 @@ static struct xfrm_state_afinfo xfrm4_state_afinfo = {
         .owner                  = THIS_MODULE,
         .init_flags             = xfrm4_init_flags,
         .init_tempsel           = __xfrm4_init_tempsel,
+        .init_temprop           = xfrm4_init_temprop,
         .output                 = xfrm4_output,
         .extract_input          = xfrm4_extract_input,
         .extract_output         = xfrm4_extract_output,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ab70a3fbcafa..324fac3b6c16 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4637,10 +4637,12 @@ int __init addrconf_init(void)
         if (err < 0) {
                 printk(KERN_CRIT "IPv6 Addrconf:"
                        " cannot initialize default policy table: %d.\n", err);
-                return err;
+                goto out;
         }
 
-        register_pernet_subsys(&addrconf_ops);
+        err = register_pernet_subsys(&addrconf_ops);
+        if (err < 0)
+                goto out_addrlabel;
 
         /* The addrconf netdev notifier requires that loopback_dev
          * has it's ipv6 private information allocated and setup
@@ -4692,7 +4694,9 @@ errout:
         unregister_netdevice_notifier(&ipv6_dev_notf);
 errlo:
         unregister_pernet_subsys(&addrconf_ops);
-
+out_addrlabel:
+        ipv6_addr_label_cleanup();
+out:
         return err;
 }
 
@@ -4703,6 +4707,7 @@ void addrconf_cleanup(void)
 
         unregister_netdevice_notifier(&ipv6_dev_notf);
         unregister_pernet_subsys(&addrconf_ops);
+        ipv6_addr_label_cleanup();
 
         rtnl_lock();
 
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index f0e774cea386..8175f802651b 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -393,6 +393,11 @@ int __init ipv6_addr_label_init(void)
         return register_pernet_subsys(&ipv6_addr_label_ops);
 }
 
+void ipv6_addr_label_cleanup(void)
+{
+        unregister_pernet_subsys(&ipv6_addr_label_ops);
+}
+
 static const struct nla_policy ifal_policy[IFAL_MAX+1] = {
         [IFAL_ADDRESS]          = { .len = sizeof(struct in6_addr), },
         [IFAL_LABEL]            = { .len = sizeof(u32), },
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d40b330c0ee6..980912ed7a38 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -639,7 +639,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
         if (skb_has_frags(skb)) {
                 int first_len = skb_pagelen(skb);
-                int truesizes = 0;
+                struct sk_buff *frag2;
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
@@ -651,18 +651,18 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         if (frag->len > mtu ||
                             ((frag->len & 7) && frag->next) ||
                             skb_headroom(frag) < hlen)
-                            goto slow_path;
+                                goto slow_path_clean;
 
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
-                                goto slow_path;
+                                goto slow_path_clean;
 
                         BUG_ON(frag->sk);
                         if (skb->sk) {
                                 frag->sk = skb->sk;
                                 frag->destructor = sock_wfree;
-                                truesizes += frag->truesize;
                         }
+                        skb->truesize -= frag->truesize;
                 }
 
                 err = 0;
@@ -693,7 +693,6 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 first_len = skb_pagelen(skb);
                 skb->data_len = first_len - skb_headlen(skb);
-                skb->truesize -= truesizes;
                 skb->len = first_len;
                 ipv6_hdr(skb)->payload_len = htons(first_len -
                                                    sizeof(struct ipv6hdr));
@@ -756,6 +755,15 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                               IPSTATS_MIB_FRAGFAILS);
                 dst_release(&rt->dst);
                 return err;
+
+slow_path_clean:
+                skb_walk_frags(skb, frag2) {
+                        if (frag2 == frag)
+                                break;
+                        frag2->sk = NULL;
+                        frag2->destructor = NULL;
+                        skb->truesize += frag2->truesize;
+                }
         }
 
 slow_path:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d126365ac046..a275c6e1e25c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -670,7 +670,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, struct in6_addr *dad
 
                         if (net_ratelimit())
                                 printk(KERN_WARNING
-                                       "Neighbour table overflow.\n");
+                                       "ipv6: Neighbour table overflow.\n");
                         dst_free(&rt->dst);
                         return NULL;
                 }
@@ -1556,14 +1556,13 @@ out:
  *      i.e. Path MTU discovery
  */
 
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
-                        struct net_device *dev, u32 pmtu)
+static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
+                             struct net *net, u32 pmtu, int ifindex)
 {
         struct rt6_info *rt, *nrt;
-        struct net *net = dev_net(dev);
         int allfrag = 0;
 
-        rt = rt6_lookup(net, daddr, saddr, dev->ifindex, 0);
+        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
         if (rt == NULL)
                 return;
 
@@ -1631,6 +1630,27 @@ out:
         dst_release(&rt->dst);
 }
 
+void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+                        struct net_device *dev, u32 pmtu)
+{
+        struct net *net = dev_net(dev);
+
+        /*
+         * RFC 1981 states that a node "MUST reduce the size of the packets it
+         * is sending along the path" that caused the Packet Too Big message.
+         * Since it's not possible in the general case to determine which
+         * interface was used to send the original packet, we update the MTU
+         * on the interface that will be used to send future packets. We also
+         * update the MTU on the interface that received the Packet Too Big in
+         * case the original packet was forced out that interface with
+         * SO_BINDTODEVICE or similar. This is the next best thing to the
+         * correct behaviour, which would be to update the MTU on all
+         * interfaces.
+         */
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, 0);
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, dev->ifindex);
+}
+
 /*
  *      Misc support functions
  */
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index f417b77fa0e1..a67575d472a3 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -20,23 +20,27 @@
 #include <net/addrconf.h>
 
 static void
-__xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                     struct xfrm_tmpl *tmpl,
-                     xfrm_address_t *daddr, xfrm_address_t *saddr)
+__xfrm6_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
 {
         /* Initialize temporary selector matching only
          * to current session. */
-        ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
-        ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
-        x->sel.dport = xfrm_flowi_dport(fl);
-        x->sel.dport_mask = htons(0xffff);
-        x->sel.sport = xfrm_flowi_sport(fl);
-        x->sel.sport_mask = htons(0xffff);
-        x->sel.family = AF_INET6;
-        x->sel.prefixlen_d = 128;
-        x->sel.prefixlen_s = 128;
-        x->sel.proto = fl->proto;
-        x->sel.ifindex = fl->oif;
+        ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl->fl6_dst);
+        ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl->fl6_src);
+        sel->dport = xfrm_flowi_dport(fl);
+        sel->dport_mask = htons(0xffff);
+        sel->sport = xfrm_flowi_sport(fl);
+        sel->sport_mask = htons(0xffff);
+        sel->family = AF_INET6;
+        sel->prefixlen_d = 128;
+        sel->prefixlen_s = 128;
+        sel->proto = fl->proto;
+        sel->ifindex = fl->oif;
+}
+
+static void
+xfrm6_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
+                   xfrm_address_t *daddr, xfrm_address_t *saddr)
+{
         x->id = tmpl->id;
         if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
                 memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
@@ -168,6 +172,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .eth_proto              = htons(ETH_P_IPV6),
         .owner                  = THIS_MODULE,
         .init_tempsel           = __xfrm6_init_tempsel,
+        .init_temprop           = xfrm6_init_temprop,
         .tmpl_sort              = __xfrm6_tmpl_sort,
         .state_sort             = __xfrm6_state_sort,
         .output                 = xfrm6_output,
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c893f236acea..8f23401832b7 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -175,6 +175,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
 
         set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
 
+        del_timer_sync(&tid_tx->addba_resp_timer);
+
         /*
          * After this packets are no longer handed right through
          * to the driver but are put onto tid_tx->pending instead,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa0f37e4afe4..28624282c5f3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         struct net_device *prev_dev = NULL;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
-
         if (skb_headroom(skb) < sizeof(*rthdr) &&
             pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                 goto out_free_skb;
@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
         } else
                 goto out_free_skb;
 
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
         return;
 
  out_free_skb:
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 10caec5ea8fa..34da67995d94 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -377,7 +377,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                 skb2 = skb_clone(skb, GFP_ATOMIC);
                                 if (skb2) {
                                         skb2->dev = prev_dev;
-                                        netif_receive_skb(skb2);
+                                        netif_rx(skb2);
                                 }
                         }
 
@@ -386,7 +386,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
         if (prev_dev) {
                 skb->dev = prev_dev;
-                netif_receive_skb(skb);
+                netif_rx(skb);
                 skb = NULL;
         }
         rcu_read_unlock();
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 7dcf7a404190..8d9e4c949b96 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -48,15 +48,17 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
 {
         unsigned int off, len;
         struct nf_ct_ext_type *t;
+        size_t alloc_size;
 
         rcu_read_lock();
         t = rcu_dereference(nf_ct_ext_types[id]);
         BUG_ON(t == NULL);
         off = ALIGN(sizeof(struct nf_ct_ext), t->align);
         len = off + t->len;
+        alloc_size = t->alloc_size;
         rcu_read_unlock();
 
-        *ext = kzalloc(t->alloc_size, gfp);
+        *ext = kzalloc(alloc_size, gfp);
         if (!*ext)
                 return NULL;
 
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 53d892210a04..f64de9544866 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1376,7 +1376,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
         unsigned int msglen, origlen;
         const char *dptr, *end;
         s16 diff, tdiff = 0;
-        int ret;
+        int ret = NF_ACCEPT;
         typeof(nf_nat_sip_seq_adjust_hook) nf_nat_sip_seq_adjust;
 
         if (ctinfo != IP_CT_ESTABLISHED &&
diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c
index 5490fc37c92d..daab8c4a903c 100644
--- a/net/netfilter/nf_tproxy_core.c
+++ b/net/netfilter/nf_tproxy_core.c
@@ -70,7 +70,11 @@ nf_tproxy_destructor(struct sk_buff *skb)
 int
 nf_tproxy_assign_sock(struct sk_buff *skb, struct sock *sk)
 {
-        if (inet_sk(sk)->transparent) {
+        bool transparent = (sk->sk_state == TCP_TIME_WAIT) ?
+                                inet_twsk(sk)->tw_transparent :
+                                inet_sk(sk)->transparent;
+
+        if (transparent) {
                 skb_orphan(skb);
                 skb->sk = sk;
                 skb->destructor = nf_tproxy_destructor;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b2a3ae6cad78..15003021f4f0 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk)
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
         struct pep_sock *pn = pep_sk(sk);
-        struct pnpipehdr *hdr = pnp_hdr(skb);
+        struct pnpipehdr *hdr;
         int wake = 0;
 
         if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
                 return -EINVAL;
 
+        hdr = pnp_hdr(skb);
         if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
                 LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
                                 (unsigned)hdr->data[0]);
diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index c397524c039c..c519939e8da9 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -43,7 +43,7 @@ void rds_tcp_state_change(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) {
                 state_change = sk->sk_state_change;
@@ -68,7 +68,7 @@ void rds_tcp_state_change(struct sock *sk)
                         break;
         }
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         state_change(sk);
 }
 
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index 975183fe6950..27844f231d10 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -114,7 +114,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("listen data ready sk %p\n", sk);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         ready = sk->sk_user_data;
         if (ready == NULL) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -131,7 +131,7 @@ void rds_tcp_listen_data_ready(struct sock *sk, int bytes)
                 queue_work(rds_wq, &rds_tcp_listen_work);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index 1aba6878fa5d..e43797404102 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -324,7 +324,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
 
         rdsdebug("data ready sk %p bytes %d\n", sk, bytes);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -338,7 +338,7 @@ void rds_tcp_data_ready(struct sock *sk, int bytes)
         if (rds_tcp_read_sock(conn, GFP_ATOMIC, KM_SOFTIRQ0) == -ENOMEM)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk, bytes);
 }
 
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index a28b895ff0d1..2f012a07d94d 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -224,7 +224,7 @@ void rds_tcp_write_space(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (conn == NULL) {
                 write_space = sk->sk_write_space;
@@ -244,7 +244,7 @@ void rds_tcp_write_space(struct sock *sk)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 
         /*
          * write_space is only called when data leaves tcp's send queue if
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8e45e76a95f5..d952e7eac188 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -679,7 +679,7 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                 return -EINVAL;
 
-        if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+        if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
         if ((dev = rose_dev_get(&addr->srose_addr)) == NULL) {
@@ -739,7 +739,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
         if (addr_len == sizeof(struct sockaddr_rose) && addr->srose_ndigis > 1)
                 return -EINVAL;
 
-        if (addr->srose_ndigis > ROSE_MAX_DIGIS)
+        if ((unsigned int) addr->srose_ndigis > ROSE_MAX_DIGIS)
                 return -EINVAL;
 
         /* Source + Destination digis should not exceed ROSE_MAX_DIGIS */
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 7416a5c73b2a..b0c2a82178af 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -137,7 +137,7 @@ next_knode:
                         int toff = off + key->off + (off2 & key->offmask);
                         __be32 *data, _data;
 
-                        if (skb_headroom(skb) + toff < 0)
+                        if (skb_headroom(skb) + toff > INT_MAX)
                                 goto out;
 
                         data = skb_header_pointer(skb, toff, 4, &_data);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 86366390038a..ddbbf7c81fa1 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -543,16 +543,20 @@ struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
                 id = ntohs(hmacs->hmac_ids[i]);
 
                 /* Check the id is in the supported range */
-                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                if (id > SCTP_AUTH_HMAC_ID_MAX) {
+                        id = 0;
                         continue;
+                }
 
                 /* See is we support the id.  Supported IDs have name and
                  * length fields set, so that we can allocated and use
                  * them.  We can safely just check for name, for without the
                  * name, we can't allocate the TFM.
                  */
-                if (!sctp_hmac_list[id].hmac_name)
+                if (!sctp_hmac_list[id].hmac_name) {
+                        id = 0;
                         continue;
+                }
 
                 break;
         }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ca44917872d2..fbb70770ad05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        kfree(kaddrs);
+                        return -EINVAL;
+                }
+
                 sa_addr = (struct sockaddr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa_family);
 
@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
         /* Walk through the addrs buffer and count the number of addresses. */
         addr_buf = kaddrs;
         while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
+
                 sa_addr = (union sctp_addr *)addr_buf;
                 af = sctp_get_af_specific(sa_addr->sa.sa_family);
-                port = ntohs(sa_addr->v4.sin_port);
 
                 /* If the address family is not supported or if this address
                  * causes the address buffer to overflow return EINVAL.
@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
                         goto out_free;
                 }
 
+                port = ntohs(sa_addr->v4.sin_port);
+
                 /* Save current address so we can work with it */
                 memcpy(&to, sa_addr, af->sockaddr_len);
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index b6309db56226..fe9306bf10cc 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -800,7 +800,7 @@ static void xs_udp_data_ready(struct sock *sk, int len)
         u32 _xid;
         __be32 *xp;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         dprintk("RPC:       xs_udp_data_ready...\n");
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
@@ -852,7 +852,7 @@ static void xs_udp_data_ready(struct sock *sk, int len)
  dropit:
         skb_free_datagram(sk, skb);
  out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static inline void xs_tcp_read_fraghdr(struct rpc_xprt *xprt, struct xdr_skb_reader *desc)
@@ -1229,7 +1229,7 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
 
         dprintk("RPC:       xs_tcp_data_ready...\n");
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         if (xprt->shutdown)
@@ -1248,7 +1248,7 @@ static void xs_tcp_data_ready(struct sock *sk, int bytes)
                 read = tcp_read_sock(sk, &rd_desc, xs_tcp_data_recv);
         } while (read > 0);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /*
@@ -1301,7 +1301,7 @@ static void xs_tcp_state_change(struct sock *sk)
 {
         struct rpc_xprt *xprt;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       xs_tcp_state_change client %p...\n", xprt);
@@ -1313,7 +1313,7 @@ static void xs_tcp_state_change(struct sock *sk)
 
         switch (sk->sk_state) {
         case TCP_ESTABLISHED:
-                spin_lock_bh(&xprt->transport_lock);
+                spin_lock(&xprt->transport_lock);
                 if (!xprt_test_and_set_connected(xprt)) {
                         struct sock_xprt *transport = container_of(xprt,
                                         struct sock_xprt, xprt);
@@ -1327,7 +1327,7 @@ static void xs_tcp_state_change(struct sock *sk)
 
                         xprt_wake_pending_tasks(xprt, -EAGAIN);
                 }
-                spin_unlock_bh(&xprt->transport_lock);
+                spin_unlock(&xprt->transport_lock);
                 break;
         case TCP_FIN_WAIT1:
                 /* The client initiated a shutdown of the socket */
@@ -1365,7 +1365,7 @@ static void xs_tcp_state_change(struct sock *sk)
                 xs_sock_mark_closed(xprt);
         }
  out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /**
@@ -1376,7 +1376,7 @@ static void xs_error_report(struct sock *sk)
 {
         struct rpc_xprt *xprt;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         if (!(xprt = xprt_from_sock(sk)))
                 goto out;
         dprintk("RPC:       %s client %p...\n"
@@ -1384,7 +1384,7 @@ static void xs_error_report(struct sock *sk)
                         __func__, xprt, sk->sk_err);
         xprt_wake_pending_tasks(xprt, -EAGAIN);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static void xs_write_space(struct sock *sk)
@@ -1416,13 +1416,13 @@ static void xs_write_space(struct sock *sk)
  */
 static void xs_udp_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
 
         /* from net/core/sock.c:sock_def_write_space */
         if (sock_writeable(sk))
                 xs_write_space(sk);
 
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 /**
@@ -1437,13 +1437,13 @@ static void xs_udp_write_space(struct sock *sk)
  */
 static void xs_tcp_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
 
         /* from net/core/stream.c:sk_stream_write_space */
         if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk))
                 xs_write_space(sk);
 
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 }
 
 static void xs_udp_do_set_buffer_size(struct rpc_xprt *xprt)
diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c
index 3feb28e41c53..674d426a9d24 100644
--- a/net/wireless/wext-priv.c
+++ b/net/wireless/wext-priv.c
@@ -152,7 +152,7 @@ static int ioctl_private_iw_point(struct iw_point *iwp, unsigned int cmd,
         } else if (!iwp->pointer)
                 return -EFAULT;
 
-        extra = kmalloc(extra_size, GFP_KERNEL);
+        extra = kzalloc(extra_size, GFP_KERNEL);
         if (!extra)
                 return -ENOMEM;
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 2b3ed7ad4933..cbab6e1a8c9c 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1175,9 +1175,8 @@ xfrm_tmpl_resolve_one(struct xfrm_policy *policy, struct flowi *fl,
                     tmpl->mode == XFRM_MODE_BEET) {
                         remote = &tmpl->id.daddr;
                         local = &tmpl->saddr;
-                        family = tmpl->encap_family;
-                        if (xfrm_addr_any(local, family)) {
-                                error = xfrm_get_saddr(net, &tmp, remote, family);
+                        if (xfrm_addr_any(local, tmpl->encap_family)) {
+                                error = xfrm_get_saddr(net, &tmp, remote, tmpl->encap_family);
                                 if (error)
                                         goto fail;
                                 local = &tmp;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5208b12fbfb4..eb96ce52f178 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -656,15 +656,23 @@ void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si)
 EXPORT_SYMBOL(xfrm_sad_getinfo);
 
 static int
-xfrm_init_tempsel(struct xfrm_state *x, struct flowi *fl,
-                  struct xfrm_tmpl *tmpl,
-                  xfrm_address_t *daddr, xfrm_address_t *saddr,
-                  unsigned short family)
+xfrm_init_tempstate(struct xfrm_state *x, struct flowi *fl,
+                    struct xfrm_tmpl *tmpl,
+                    xfrm_address_t *daddr, xfrm_address_t *saddr,
+                    unsigned short family)
 {
         struct xfrm_state_afinfo *afinfo = xfrm_state_get_afinfo(family);
         if (!afinfo)
                 return -1;
-        afinfo->init_tempsel(x, fl, tmpl, daddr, saddr);
+        afinfo->init_tempsel(&x->sel, fl);
+
+        if (family != tmpl->encap_family) {
+                xfrm_state_put_afinfo(afinfo);
+                afinfo = xfrm_state_get_afinfo(tmpl->encap_family);
+                if (!afinfo)
+                        return -1;
+        }
+        afinfo->init_temprop(x, tmpl, daddr, saddr);
         xfrm_state_put_afinfo(afinfo);
         return 0;
 }
@@ -790,37 +798,38 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
         int error = 0;
         struct xfrm_state *best = NULL;
         u32 mark = pol->mark.v & pol->mark.m;
+        unsigned short encap_family = tmpl->encap_family;
 
         to_put = NULL;
 
         spin_lock_bh(&xfrm_state_lock);
-        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, family);
+        h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family);
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
-                if (x->props.family == family &&
+                if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
-                    xfrm_state_addr_check(x, daddr, saddr, family) &&
+                    xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
                     tmpl->mode == x->props.mode &&
                     tmpl->id.proto == x->id.proto &&
                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                        xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr,
                                            &best, &acquire_in_progress, &error);
         }
         if (best)
                 goto found;
 
-        h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
+        h_wildcard = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, encap_family);
         hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h_wildcard, bydst) {
-                if (x->props.family == family &&
+                if (x->props.family == encap_family &&
                     x->props.reqid == tmpl->reqid &&
                     (mark & x->mark.m) == x->mark.v &&
                     !(x->props.flags & XFRM_STATE_WILDRECV) &&
-                    xfrm_state_addr_check(x, daddr, saddr, family) &&
+                    xfrm_state_addr_check(x, daddr, saddr, encap_family) &&
                     tmpl->mode == x->props.mode &&
                     tmpl->id.proto == x->id.proto &&
                     (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
-                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                        xfrm_state_look_at(pol, x, fl, encap_family, daddr, saddr,
                                            &best, &acquire_in_progress, &error);
         }
 
@@ -829,7 +838,7 @@ found:
         if (!x && !error && !acquire_in_progress) {
                 if (tmpl->id.spi &&
                     (x0 = __xfrm_state_lookup(net, mark, daddr, tmpl->id.spi,
-                                              tmpl->id.proto, family)) != NULL) {
+                                              tmpl->id.proto, encap_family)) != NULL) {
                         to_put = x0;
                         error = -EEXIST;
                         goto out;
@@ -839,9 +848,9 @@ found:
                         error = -ENOMEM;
                         goto out;
                 }
-                /* Initialize temporary selector matching only
+                /* Initialize temporary state matching only
                  * to current session. */
-                xfrm_init_tempsel(x, fl, tmpl, daddr, saddr, family);
+                xfrm_init_tempstate(x, fl, tmpl, daddr, saddr, family);
                 memcpy(&x->mark, &pol->mark, sizeof(x->mark));
 
                 error = security_xfrm_state_alloc_acquire(x, pol->security, fl->secid);
@@ -856,10 +865,10 @@ found:
                         x->km.state = XFRM_STATE_ACQ;
                         list_add(&x->km.all, &net->xfrm.state_all);
                         hlist_add_head(&x->bydst, net->xfrm.state_bydst+h);
-                        h = xfrm_src_hash(net, daddr, saddr, family);
+                        h = xfrm_src_hash(net, daddr, saddr, encap_family);
                         hlist_add_head(&x->bysrc, net->xfrm.state_bysrc+h);
                         if (x->id.spi) {
-                                h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, family);
+                                h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, encap_family);
                                 hlist_add_head(&x->byspi, net->xfrm.state_byspi+h);
                         }
                         x->lft.hard_add_expires_seconds = net->xfrm.sysctl_acq_expires;
diff --git a/samples/kfifo/dma-example.c b/samples/kfifo/dma-example.c
index ee03a4f0b64f..06473791c08a 100644
--- a/samples/kfifo/dma-example.c
+++ b/samples/kfifo/dma-example.c
@@ -24,6 +24,7 @@ static int __init example_init(void)
 {
         int                     i;
         unsigned int            ret;
+        unsigned int            nents;
         struct scatterlist      sg[10];
 
         printk(KERN_INFO "DMA fifo test start\n");
@@ -61,9 +62,9 @@ static int __init example_init(void)
          * byte at the beginning, after the kfifo_skip().
          */
         sg_init_table(sg, ARRAY_SIZE(sg));
-        ret = kfifo_dma_in_prepare(&fifo, sg, ARRAY_SIZE(sg), FIFO_SIZE);
-        printk(KERN_INFO "DMA sgl entries: %d\n", ret);
-        if (!ret) {
+        nents = kfifo_dma_in_prepare(&fifo, sg, ARRAY_SIZE(sg), FIFO_SIZE);
+        printk(KERN_INFO "DMA sgl entries: %d\n", nents);
+        if (!nents) {
                 /* fifo is full and no sgl was created */
                 printk(KERN_WARNING "error kfifo_dma_in_prepare\n");
                 return -EIO;
@@ -71,7 +72,7 @@ static int __init example_init(void)
 
         /* receive data */
         printk(KERN_INFO "scatterlist for receive:\n");
-        for (i = 0; i < ARRAY_SIZE(sg); i++) {
+        for (i = 0; i < nents; i++) {
                 printk(KERN_INFO
                 "sg[%d] -> "
                 "page_link 0x%.8lx offset 0x%.8x length 0x%.8x\n",
@@ -91,16 +92,16 @@ static int __init example_init(void)
         kfifo_dma_in_finish(&fifo, ret);
 
         /* Prepare to transmit data, example: 8 bytes */
-        ret = kfifo_dma_out_prepare(&fifo, sg, ARRAY_SIZE(sg), 8);
-        printk(KERN_INFO "DMA sgl entries: %d\n", ret);
-        if (!ret) {
+        nents = kfifo_dma_out_prepare(&fifo, sg, ARRAY_SIZE(sg), 8);
+        printk(KERN_INFO "DMA sgl entries: %d\n", nents);
+        if (!nents) {
                 /* no data was available and no sgl was created */
                 printk(KERN_WARNING "error kfifo_dma_out_prepare\n");
                 return -EIO;
         }
 
         printk(KERN_INFO "scatterlist for transmit:\n");
-        for (i = 0; i < ARRAY_SIZE(sg); i++) {
+        for (i = 0; i < nents; i++) {
                 printk(KERN_INFO
                 "sg[%d] -> "
                 "page_link 0x%.8lx offset 0x%.8x length 0x%.8x\n",
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 5b7c86ea43a1..7ef429cd5cb3 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -427,7 +427,7 @@ static void check_conf(struct menu *menu)
                                 if (sym->name && !sym_is_choice_value(sym)) {
                                         printf("CONFIG_%s\n", sym->name);
                                 }
-                        } else {
+                        } else if (input_mode != oldnoconfig) {
                                 if (!conf_cnt++)
                                         printf(_("*\n* Restart config...\n*\n"));
                                 rootEntry = menu_get_parent_menu(menu);
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index 6ee2e4fb1481..170459c224a1 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -165,7 +165,6 @@ struct menu {
         struct symbol *sym;
         struct property *prompt;
         struct expr *dep;
-        struct expr *dir_dep;
         unsigned int flags;
         char *help;
         struct file *file;
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 4fb590247f33..edda8b49619d 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -107,7 +107,6 @@ static struct expr *menu_check_dep(struct expr *e)
 void menu_add_dep(struct expr *dep)
 {
         current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep));
-        current_entry->dir_dep = current_entry->dep;
 }
 
 void menu_set_type(int type)
@@ -291,10 +290,6 @@ void menu_finalize(struct menu *parent)
                 for (menu = parent->list; menu; menu = menu->next)
                         menu_finalize(menu);
         } else if (sym) {
-                /* ignore inherited dependencies for dir_dep */
-                sym->dir_dep.expr = expr_transform(expr_copy(parent->dir_dep));
-                sym->dir_dep.expr = expr_eliminate_dups(sym->dir_dep.expr);
-
                 basedep = parent->prompt ? parent->prompt->visible.expr : NULL;
                 basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no);
                 basedep = expr_eliminate_dups(expr_transform(basedep));
@@ -325,6 +320,8 @@ void menu_finalize(struct menu *parent)
                         parent->next = last_menu->next;
                         last_menu->next = NULL;
                 }
+
+                sym->dir_dep.expr = parent->dep;
         }
         for (menu = parent->list; menu; menu = menu->next) {
                 if (sym && sym_is_choice(sym) &&
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 943712ca6c0a..1f8b305449db 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -350,6 +350,7 @@ void sym_calc_value(struct symbol *sym)
                                 }
                         }
                 calc_newval:
+#if 0
                         if (sym->dir_dep.tri == no && sym->rev_dep.tri != no) {
                                 fprintf(stderr, "warning: (");
                                 expr_fprint(sym->rev_dep.expr, stderr);
@@ -358,6 +359,7 @@ void sym_calc_value(struct symbol *sym)
                                 expr_fprint(sym->dir_dep.expr, stderr);
                                 fprintf(stderr, ")\n");
                         }
+#endif
                         newval.tri = EXPR_OR(newval.tri, sym->rev_dep.tri);
                 }
                 if (newval.tri == mod && sym_get_type(sym) == S_BOOLEAN)
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index ef43995119a4..c668b447c725 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -1416,15 +1416,19 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
         const pid_t gpid = task_pid_nr(current);
         static const int tomoyo_buffer_len = 4096;
         char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS);
+        pid_t ppid;
         if (!buffer)
                 return NULL;
         do_gettimeofday(&tv);
+        rcu_read_lock();
+        ppid = task_tgid_vnr(current->real_parent);
+        rcu_read_unlock();
         snprintf(buffer, tomoyo_buffer_len - 1,
                  "#timestamp=%lu profile=%u mode=%s (global-pid=%u)"
                  " task={ pid=%u ppid=%u uid=%u gid=%u euid=%u"
                  " egid=%u suid=%u sgid=%u fsuid=%u fsgid=%u }",
                  tv.tv_sec, r->profile, tomoyo_mode[r->mode], gpid,
-                 (pid_t) sys_getpid(), (pid_t) sys_getppid(),
+                 task_tgid_vnr(current), ppid,
                  current_uid(), current_gid(), current_euid(),
                  current_egid(), current_suid(), current_sgid(),
                  current_fsuid(), current_fsgid());
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index 04454cb7b24a..7c66bd898782 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -689,9 +689,6 @@ struct tomoyo_profile {
 
 /********** Function prototypes. **********/
 
-extern asmlinkage long sys_getpid(void);
-extern asmlinkage long sys_getppid(void);
-
 /* Check whether the given string starts with the given keyword. */
 bool tomoyo_str_starts(char **src, const char *find);
 /* Get tomoyo_realpath() of current process. */
diff --git a/sound/core/control.c b/sound/core/control.c
index 070aab490191..45a818002d99 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -31,6 +31,7 @@
 
 /* max number of user-defined controls */
 #define MAX_USER_CONTROLS       32
+#define MAX_CONTROL_COUNT       1028
 
 struct snd_kctl_ioctl {
         struct list_head list;          /* list of all ioctls */
@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
         
         if (snd_BUG_ON(!control || !control->count))
                 return NULL;
+
+        if (control->count > MAX_CONTROL_COUNT)
+                return NULL;
+
         kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
         if (kctl == NULL) {
                 snd_printk(KERN_ERR "Cannot allocate control instance\n");
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index a7868ad4d530..cbbed0db9e56 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file)
 {
         struct snd_rawmidi_file *rfile;
         struct snd_rawmidi *rmidi;
+        struct module *module;
 
         rfile = file->private_data;
         rmidi = rfile->rmidi;
         rawmidi_release_priv(rfile);
         kfree(rfile);
+        module = rmidi->card->module;
         snd_card_file_remove(rmidi->card, file);
-        module_put(rmidi->card->module);
+        module_put(module);
         return 0;
 }
 
diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
index 1adb8a3c2b62..42d7844ecd0b 100644
--- a/sound/i2c/other/ak4xxx-adda.c
+++ b/sound/i2c/other/ak4xxx-adda.c
@@ -900,7 +900,7 @@ static int proc_init(struct snd_akm4xxx *ak)
         return 0;
 }
 #else /* !CONFIG_PROC_FS */
-static int proc_init(struct snd_akm4xxx *ak) {}
+static int proc_init(struct snd_akm4xxx *ak) { return 0; }
 #endif
 
 int snd_akm4xxx_build_controls(struct snd_akm4xxx *ak)
diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 92aa762ffb7e..07f803e6d203 100644
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -391,11 +391,11 @@ static long sound_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case SND_DEV_DSP:
         case SND_DEV_DSP16:
         case SND_DEV_AUDIO:
-                return audio_ioctl(dev, file, cmd, p);
+                ret = audio_ioctl(dev, file, cmd, p);
                 break;
 
         case SND_DEV_MIDIN:
-                return MIDIbuf_ioctl(dev, file, cmd, p);
+                ret = MIDIbuf_ioctl(dev, file, cmd, p);
                 break;
 
         }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 95148e58026c..c16c5ba0fda0 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1747,6 +1747,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                       "HP dv6", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061,
                       "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x363e,
+                      "HP DV6", STAC_HP_DV5),
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
                       "HP", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 4f1fa77c1feb..1950e19af1cf 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -1017,7 +1017,7 @@ builtin-revert.o wt-status.o: wt-status.h
 # we compile into subdirectories. if the target directory is not the source directory, they might not exists. So
 # we depend the various files onto their directories.
 DIRECTORY_DEPS = $(LIB_OBJS) $(BUILTIN_OBJS) $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)common-cmds.h
-$(DIRECTORY_DEPS): $(sort $(dir $(DIRECTORY_DEPS)))
+$(DIRECTORY_DEPS): | $(sort $(dir $(DIRECTORY_DEPS)))
 # In the second step, we make a rule to actually create these directories
 $(sort $(dir $(DIRECTORY_DEPS))):
         $(QUIET_MKDIR)$(MKDIR) -p $@ 2>/dev/null
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index ef7aa0a0c526..95aaf565c704 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -73,6 +73,18 @@ void get_term_dimensions(struct winsize *ws);
 #define cpu_relax()     asm volatile("":::"memory")
 #endif
 
+#ifdef __mips__
+#include "../../arch/mips/include/asm/unistd.h"
+#define rmb()           asm volatile(                                   \
+                                ".set   mips2\n\t"                      \
+                                "sync\n\t"                              \
+                                ".set   mips0"                          \
+                                : /* no output */                       \
+                                : /* no input */                        \
+                                : "memory")
+#define cpu_relax()     asm volatile("" ::: "memory")
+#endif
+
 #include <time.h>
 #include <unistd.h>
 #include <sys/types.h>
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index 7ea983acfaea..f7af2fca965d 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -97,7 +97,7 @@ void setup_python_scripting(void)
         register_python_scripting(&python_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops python_scripting_ops;
+extern struct scripting_ops python_scripting_ops;
 
 void setup_python_scripting(void)
 {
@@ -158,7 +158,7 @@ void setup_perl_scripting(void)
         register_perl_scripting(&perl_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops perl_scripting_ops;
+extern struct scripting_ops perl_scripting_ops;
 
 void setup_perl_scripting(void)
 {
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index dafdf6775d77..6866aa4c41e0 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -773,7 +773,7 @@ int hists__browse(struct hists *self, const char *helpline, const char *ev_name)
 
                         switch (key) {
                         case 'a':
-                                if (browser->selection->map == NULL &&
+                                if (browser->selection->map == NULL ||
                                     browser->selection->map->dso->annotate_warned)
                                         continue;
                                 goto do_annotate;