Merge branch 'for_2.6.34rc_a' of git://git.pwsan.com/linux-2.6 into omap-fixes-for-linus

362 files changed, 3343 insertions, 2000 deletions

diff --git a/Documentation/PCI/PCI-DMA-mapping.txt b/Documentation/DMA-API-HOWTO.txt
index 52618ab069ad..52618ab069ad 100644
--- a/Documentation/PCI/PCI-DMA-mapping.txt
+++ b/Documentation/DMA-API-HOWTO.txt
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index f8bc802d70b9..3a6aecd078ba 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -340,7 +340,7 @@ Note:
 5.3 swappiness
   Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
 
-  Following cgroups' swapiness can't be changed.
+  Following cgroups' swappiness can't be changed.
   - root cgroup (uses /proc/sys/vm/swappiness).
   - a cgroup which uses hierarchy and it has child cgroup.
   - a cgroup which uses hierarchy and not the root of hierarchy.
diff --git a/Documentation/circular-buffers.txt b/Documentation/circular-buffers.txt
new file mode 100644
index 000000000000..8117e5bf6065
--- /dev/null
+++ b/Documentation/circular-buffers.txt
@@ -0,0 +1,234 @@
+                               ================
+                               CIRCULAR BUFFERS
+                               ================
+
+By: David Howells <dhowells@redhat.com>
+    Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+
+
+Linux provides a number of features that can be used to implement circular
+buffering.  There are two sets of such features:
+
+ (1) Convenience functions for determining information about power-of-2 sized
+     buffers.
+
+ (2) Memory barriers for when the producer and the consumer of objects in the
+     buffer don't want to share a lock.
+
+To use these facilities, as discussed below, there needs to be just one
+producer and just one consumer.  It is possible to handle multiple producers by
+serialising them, and to handle multiple consumers by serialising them.
+
+
+Contents:
+
+ (*) What is a circular buffer?
+
+ (*) Measuring power-of-2 buffers.
+
+ (*) Using memory barriers with circular buffers.
+     - The producer.
+     - The consumer.
+
+
+==========================
+WHAT IS A CIRCULAR BUFFER?
+==========================
+
+First of all, what is a circular buffer?  A circular buffer is a buffer of
+fixed, finite size into which there are two indices:
+
+ (1) A 'head' index - the point at which the producer inserts items into the
+     buffer.
+
+ (2) A 'tail' index - the point at which the consumer finds the next item in
+     the buffer.
+
+Typically when the tail pointer is equal to the head pointer, the buffer is
+empty; and the buffer is full when the head pointer is one less than the tail
+pointer.
+
+The head index is incremented when items are added, and the tail index when
+items are removed.  The tail index should never jump the head index, and both
+indices should be wrapped to 0 when they reach the end of the buffer, thus
+allowing an infinite amount of data to flow through the buffer.
+
+Typically, items will all be of the same unit size, but this isn't strictly
+required to use the techniques below.  The indices can be increased by more
+than 1 if multiple items or variable-sized items are to be included in the
+buffer, provided that neither index overtakes the other.  The implementer must
+be careful, however, as a region more than one unit in size may wrap the end of
+the buffer and be broken into two segments.
+
+
+============================
+MEASURING POWER-OF-2 BUFFERS
+============================
+
+Calculation of the occupancy or the remaining capacity of an arbitrarily sized
+circular buffer would normally be a slow operation, requiring the use of a
+modulus (divide) instruction.  However, if the buffer is of a power-of-2 size,
+then a much quicker bitwise-AND instruction can be used instead.
+
+Linux provides a set of macros for handling power-of-2 circular buffers.  These
+can be made use of by:
+
+        #include <linux/circ_buf.h>
+
+The macros are:
+
+ (*) Measure the remaining capacity of a buffer:
+
+        CIRC_SPACE(head_index, tail_index, buffer_size);
+
+     This returns the amount of space left in the buffer[1] into which items
+     can be inserted.
+
+
+ (*) Measure the maximum consecutive immediate space in a buffer:
+
+        CIRC_SPACE_TO_END(head_index, tail_index, buffer_size);
+
+     This returns the amount of consecutive space left in the buffer[1] into
+     which items can be immediately inserted without having to wrap back to the
+     beginning of the buffer.
+
+
+ (*) Measure the occupancy of a buffer:
+
+        CIRC_CNT(head_index, tail_index, buffer_size);
+
+     This returns the number of items currently occupying a buffer[2].
+
+
+ (*) Measure the non-wrapping occupancy of a buffer:
+
+        CIRC_CNT_TO_END(head_index, tail_index, buffer_size);
+
+     This returns the number of consecutive items[2] that can be extracted from
+     the buffer without having to wrap back to the beginning of the buffer.
+
+
+Each of these macros will nominally return a value between 0 and buffer_size-1,
+however:
+
+ [1] CIRC_SPACE*() are intended to be used in the producer.  To the producer
+     they will return a lower bound as the producer controls the head index,
+     but the consumer may still be depleting the buffer on another CPU and
+     moving the tail index.
+
+     To the consumer it will show an upper bound as the producer may be busy
+     depleting the space.
+
+ [2] CIRC_CNT*() are intended to be used in the consumer.  To the consumer they
+     will return a lower bound as the consumer controls the tail index, but the
+     producer may still be filling the buffer on another CPU and moving the
+     head index.
+
+     To the producer it will show an upper bound as the consumer may be busy
+     emptying the buffer.
+
+ [3] To a third party, the order in which the writes to the indices by the
+     producer and consumer become visible cannot be guaranteed as they are
+     independent and may be made on different CPUs - so the result in such a
+     situation will merely be a guess, and may even be negative.
+
+
+===========================================
+USING MEMORY BARRIERS WITH CIRCULAR BUFFERS
+===========================================
+
+By using memory barriers in conjunction with circular buffers, you can avoid
+the need to:
+
+ (1) use a single lock to govern access to both ends of the buffer, thus
+     allowing the buffer to be filled and emptied at the same time; and
+
+ (2) use atomic counter operations.
+
+There are two sides to this: the producer that fills the buffer, and the
+consumer that empties it.  Only one thing should be filling a buffer at any one
+time, and only one thing should be emptying a buffer at any one time, but the
+two sides can operate simultaneously.
+
+
+THE PRODUCER
+------------
+
+The producer will look something like this:
+
+        spin_lock(&producer_lock);
+
+        unsigned long head = buffer->head;
+        unsigned long tail = ACCESS_ONCE(buffer->tail);
+
+        if (CIRC_SPACE(head, tail, buffer->size) >= 1) {
+                /* insert one item into the buffer */
+                struct item *item = buffer[head];
+
+                produce_item(item);
+
+                smp_wmb(); /* commit the item before incrementing the head */
+
+                buffer->head = (head + 1) & (buffer->size - 1);
+
+                /* wake_up() will make sure that the head is committed before
+                 * waking anyone up */
+                wake_up(consumer);
+        }
+
+        spin_unlock(&producer_lock);
+
+This will instruct the CPU that the contents of the new item must be written
+before the head index makes it available to the consumer and then instructs the
+CPU that the revised head index must be written before the consumer is woken.
+
+Note that wake_up() doesn't have to be the exact mechanism used, but whatever
+is used must guarantee a (write) memory barrier between the update of the head
+index and the change of state of the consumer, if a change of state occurs.
+
+
+THE CONSUMER
+------------
+
+The consumer will look something like this:
+
+        spin_lock(&consumer_lock);
+
+        unsigned long head = ACCESS_ONCE(buffer->head);
+        unsigned long tail = buffer->tail;
+
+        if (CIRC_CNT(head, tail, buffer->size) >= 1) {
+                /* read index before reading contents at that index */
+                smp_read_barrier_depends();
+
+                /* extract one item from the buffer */
+                struct item *item = buffer[tail];
+
+                consume_item(item);
+
+                smp_mb(); /* finish reading descriptor before incrementing tail */
+
+                buffer->tail = (tail + 1) & (buffer->size - 1);
+        }
+
+        spin_unlock(&consumer_lock);
+
+This will instruct the CPU to make sure the index is up to date before reading
+the new item, and then it shall make sure the CPU has finished reading the item
+before it writes the new tail pointer, which will erase the item.
+
+
+Note the use of ACCESS_ONCE() in both algorithms to read the opposition index.
+This prevents the compiler from discarding and reloading its cached value -
+which some compilers will do across smp_read_barrier_depends().  This isn't
+strictly needed if you can be sure that the opposition index will _only_ be
+used the once.
+
+
+===============
+FURTHER READING
+===============
+
+See also Documentation/memory-barriers.txt for a description of Linux's memory
+barrier facilities.
diff --git a/Documentation/filesystems/00-INDEX b/Documentation/filesystems/00-INDEX
index 3bae418c6ad3..4303614b5add 100644
--- a/Documentation/filesystems/00-INDEX
+++ b/Documentation/filesystems/00-INDEX
@@ -16,6 +16,8 @@ befs.txt
         - information about the BeOS filesystem for Linux.
 bfs.txt
         - info for the SCO UnixWare Boot Filesystem (BFS).
+ceph.txt
+        - info for the Ceph Distributed File System
 cifs.txt
         - description of the CIFS filesystem.
 coda.txt
diff --git a/Documentation/filesystems/ceph.txt b/Documentation/filesystems/ceph.txt
index 6e03917316bd..0660c9f5deef 100644
--- a/Documentation/filesystems/ceph.txt
+++ b/Documentation/filesystems/ceph.txt
@@ -8,7 +8,7 @@ Basic features include:
 
  * POSIX semantics
  * Seamless scaling from 1 to many thousands of nodes
- * High availability and reliability.  No single points of failure.
+ * High availability and reliability.  No single point of failure.
  * N-way replication of data across storage nodes
  * Fast recovery from node failures
  * Automatic rebalancing of data on node addition/removal
@@ -94,7 +94,7 @@ Mount Options
 
   wsize=X
         Specify the maximum write size in bytes.  By default there is no
-        maximu.  Ceph will normally size writes based on the file stripe
+        maximum.  Ceph will normally size writes based on the file stripe
         size.
 
   rsize=X
@@ -115,7 +115,7 @@ Mount Options
         number of entries in that directory.
 
   nocrc
-        Disable CRC32C calculation for data writes.  If set, the OSD
+        Disable CRC32C calculation for data writes.  If set, the storage node
         must rely on TCP's error correction to detect data corruption
         in the data payload.
 
@@ -133,7 +133,8 @@ For more information on Ceph, see the home page at
         http://ceph.newdream.net/
 
 The Linux kernel client source tree is available at
-        git://ceph.newdream.net/linux-ceph-client.git
+        git://ceph.newdream.net/git/ceph-client.git
+        git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
 
 and the source for the full system is at
-        git://ceph.newdream.net/ceph.git
+        git://ceph.newdream.net/git/ceph.git
diff --git a/Documentation/filesystems/tmpfs.txt b/Documentation/filesystems/tmpfs.txt
index 3015da0c6b2a..fe09a2cb1858 100644
--- a/Documentation/filesystems/tmpfs.txt
+++ b/Documentation/filesystems/tmpfs.txt
@@ -82,11 +82,13 @@ tmpfs has a mount option to set the NUMA memory allocation policy for
 all files in that instance (if CONFIG_NUMA is enabled) - which can be
 adjusted on the fly via 'mount -o remount ...'
 
-mpol=default             prefers to allocate memory from the local node
+mpol=default             use the process allocation policy
+                         (see set_mempolicy(2))
 mpol=prefer:Node         prefers to allocate memory from the given Node
 mpol=bind:NodeList       allocates memory only from nodes in NodeList
 mpol=interleave          prefers to allocate from each node in turn
 mpol=interleave:NodeList allocates from each node of NodeList in turn
+mpol=local               prefers to allocate memory from the local node
 
 NodeList format is a comma-separated list of decimal numbers and ranges,
 a range being two hyphen-separated decimal numbers, the smallest and
@@ -134,3 +136,5 @@ Author:
    Christoph Rohland <cr@sap.com>, 1.12.01
 Updated:
    Hugh Dickins, 4 June 2007
+Updated:
+   KOSAKI Motohiro, 16 Mar 2010
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index 7f5809eddee6..631ad2f1b229 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -3,6 +3,7 @@
                          ============================
 
 By: David Howells <dhowells@redhat.com>
+    Paul E. McKenney <paulmck@linux.vnet.ibm.com>
 
 Contents:
 
@@ -60,6 +61,10 @@ Contents:
 
      - And then there's the Alpha.
 
+ (*) Example uses.
+
+     - Circular buffers.
+
  (*) References.
 
 
@@ -2226,6 +2231,21 @@ The Alpha defines the Linux kernel's memory barrier model.
 See the subsection on "Cache Coherency" above.
 
 
+============
+EXAMPLE USES
+============
+
+CIRCULAR BUFFERS
+----------------
+
+Memory barriers can be used to implement circular buffering without the need
+of a lock to serialise the producer with the consumer.  See:
+
+        Documentation/circular-buffers.txt
+
+for details.
+
+
 ==========
 REFERENCES
 ==========
diff --git a/Documentation/volatile-considered-harmful.txt b/Documentation/volatile-considered-harmful.txt
index 991c26a6ef64..db0cb228d64a 100644
--- a/Documentation/volatile-considered-harmful.txt
+++ b/Documentation/volatile-considered-harmful.txt
@@ -63,9 +63,9 @@ way to perform a busy wait is:
         cpu_relax();
 
 The cpu_relax() call can lower CPU power consumption or yield to a
-hyperthreaded twin processor; it also happens to serve as a memory barrier,
-so, once again, volatile is unnecessary.  Of course, busy-waiting is
-generally an anti-social act to begin with.
+hyperthreaded twin processor; it also happens to serve as a compiler
+barrier, so, once again, volatile is unnecessary.  Of course, busy-
+waiting is generally an anti-social act to begin with.
 
 There are still a few rare situations where volatile makes sense in the
 kernel:
diff --git a/MAINTAINERS b/MAINTAINERS
index 449d44402083..3d29fa389888 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -797,12 +797,12 @@ M:	Michael Petchkovsky <mkpetch@internode.on.net>
 S:      Maintained
 
 ARM/NOMADIK ARCHITECTURE
-M:     Alessandro Rubini <rubini@unipv.it>
-M:     STEricsson <STEricsson_nomadik_linux@list.st.com>
-L:     linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:     Maintained
-F:     arch/arm/mach-nomadik/
-F:     arch/arm/plat-nomadik/
+M:      Alessandro Rubini <rubini@unipv.it>
+M:      STEricsson <STEricsson_nomadik_linux@list.st.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-nomadik/
+F:      arch/arm/plat-nomadik/
 
 ARM/OPENMOKO NEO FREERUNNER (GTA02) MACHINE SUPPORT
 M:      Nelson Castillo <arhuaco@freaks-unidos.net>
@@ -1443,7 +1443,7 @@ F:	arch/powerpc/platforms/cell/
 
 CEPH DISTRIBUTED FILE SYSTEM CLIENT
 M:      Sage Weil <sage@newdream.net>
-L:      ceph-devel@lists.sourceforge.net
+L:      ceph-devel@vger.kernel.org
 W:      http://ceph.newdream.net/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client.git
 S:      Supported
@@ -1926,17 +1926,17 @@ F:	drivers/scsi/dpt*
 F:      drivers/scsi/dpt/
 
 DRBD DRIVER
-P:     Philipp Reisner
-P:     Lars Ellenberg
-M:     drbd-dev@lists.linbit.com
-L:     drbd-user@lists.linbit.com
-W:     http://www.drbd.org
-T:     git git://git.drbd.org/linux-2.6-drbd.git drbd
-T:     git git://git.drbd.org/drbd-8.3.git
-S:     Supported
-F:     drivers/block/drbd/
-F:     lib/lru_cache.c
-F:     Documentation/blockdev/drbd/
+P:      Philipp Reisner
+P:      Lars Ellenberg
+M:      drbd-dev@lists.linbit.com
+L:      drbd-user@lists.linbit.com
+W:      http://www.drbd.org
+T:      git git://git.drbd.org/linux-2.6-drbd.git drbd
+T:      git git://git.drbd.org/drbd-8.3.git
+S:      Supported
+F:      drivers/block/drbd/
+F:      lib/lru_cache.c
+F:      Documentation/blockdev/drbd/
 
 DRIVER CORE, KOBJECTS, AND SYSFS
 M:      Greg Kroah-Hartman <gregkh@suse.de>
@@ -3083,6 +3083,7 @@ F:	include/scsi/*iscsi*
 ISDN SUBSYSTEM
 M:      Karsten Keil <isdn@linux-pingi.de>
 L:      isdn4linux@listserv.isdn4linux.de (subscribers-only)
+L:      netdev@vger.kernel.org
 W:      http://www.isdn4linux.de
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/kkeil/isdn-2.6.git
 S:      Maintained
@@ -3269,6 +3270,16 @@ S:	Maintained
 F:      include/linux/kexec.h
 F:      kernel/kexec.c
 
+KEYS/KEYRINGS:
+M:      David Howells <dhowells@redhat.com>
+L:      keyrings@linux-nfs.org
+S:      Maintained
+F:      Documentation/keys.txt
+F:      include/linux/key.h
+F:      include/linux/key-type.h
+F:      include/keys/
+F:      security/keys/
+
 KGDB
 M:      Jason Wessel <jason.wessel@windriver.com>
 L:      kgdb-bugreport@lists.sourceforge.net
@@ -3518,8 +3529,8 @@ F:	drivers/scsi/sym53c8xx_2/
 LTP (Linux Test Project)
 M:      Rishikesh K Rajak <risrajak@linux.vnet.ibm.com>
 M:      Garrett Cooper <yanegomi@gmail.com>
-M:     Mike Frysinger <vapier@gentoo.org>
-M:     Subrata Modak <subrata@linux.vnet.ibm.com>
+M:      Mike Frysinger <vapier@gentoo.org>
+M:      Subrata Modak <subrata@linux.vnet.ibm.com>
 L:      ltp-list@lists.sourceforge.net (subscribers-only)
 W:      http://ltp.sourceforge.net/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/galak/ltp.git
@@ -5423,7 +5434,6 @@ S:	Maintained
 F:      sound/soc/codecs/twl4030*
 
 TIPC NETWORK LAYER
-M:      Per Liden <per.liden@ericsson.com>
 M:      Jon Maloy <jon.maloy@ericsson.com>
 M:      Allan Stephens <allan.stephens@windriver.com>
 L:      tipc-discussion@lists.sourceforge.net
@@ -6201,7 +6211,7 @@ F:	arch/x86/
 X86 PLATFORM DRIVERS
 M:      Matthew Garrett <mjg@redhat.com>
 L:      platform-driver-x86@vger.kernel.org
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.git
 S:      Maintained
 F:      drivers/platform/x86
 
diff --git a/Makefile b/Makefile
index a5ba759e0fd5..67c1001cfbf5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 34
-EXTRAVERSION = -rc2
+EXTRAVERSION = -rc3
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/arch/arm/common/locomo.c b/arch/arm/common/locomo.c
index 90ae00b631c2..9dff07c80ddb 100644
--- a/arch/arm/common/locomo.c
+++ b/arch/arm/common/locomo.c
@@ -290,7 +290,7 @@ static int locomo_suspend(struct platform_device *dev, pm_message_t state)
         save->LCM_GPO     = locomo_readl(lchip->base + LOCOMO_GPO);     /* GPIO */
         locomo_writel(0x00, lchip->base + LOCOMO_GPO);
         save->LCM_SPICT   = locomo_readl(lchip->base + LOCOMO_SPI + LOCOMO_SPICT);      /* SPI */
-        locomo_writel(0x40, lchip->base + LOCOMO_SPICT);
+        locomo_writel(0x40, lchip->base + LOCOMO_SPI + LOCOMO_SPICT);
         save->LCM_GPE     = locomo_readl(lchip->base + LOCOMO_GPE);     /* GPIO */
         locomo_writel(0x00, lchip->base + LOCOMO_GPE);
         save->LCM_ASD     = locomo_readl(lchip->base + LOCOMO_ASD);     /* ADSTART */
@@ -418,7 +418,7 @@ __locomo_probe(struct device *me, struct resource *mem, int irq)
         /* Longtime timer */
         locomo_writel(0, lchip->base + LOCOMO_LTINT);
         /* SPI */
-        locomo_writel(0, lchip->base + LOCOMO_SPIIE);
+        locomo_writel(0, lchip->base + LOCOMO_SPI + LOCOMO_SPIIE);
 
         locomo_writel(6 + 8 + 320 + 30 - 10, lchip->base + LOCOMO_ASD);
         r = locomo_readl(lchip->base + LOCOMO_ASD);
@@ -707,7 +707,7 @@ void locomo_m62332_senddata(struct locomo_dev *ldev, unsigned int dac_data, int
         udelay(DAC_SCL_HIGH_HOLD_TIME); /* 4.7 usec */
         if (locomo_readl(mapbase + LOCOMO_DAC) & LOCOMO_DAC_SDAOEB) {   /* High is error */
                 printk(KERN_WARNING "locomo: m62332_senddata Error 1\n");
-                return;
+                goto out;
         }
 
         /* Send Sub address (LSB is channel select) */
@@ -735,7 +735,7 @@ void locomo_m62332_senddata(struct locomo_dev *ldev, unsigned int dac_data, int
         udelay(DAC_SCL_HIGH_HOLD_TIME); /* 4.7 usec */
         if (locomo_readl(mapbase + LOCOMO_DAC) & LOCOMO_DAC_SDAOEB) {   /* High is error */
                 printk(KERN_WARNING "locomo: m62332_senddata Error 2\n");
-                return;
+                goto out;
         }
 
         /* Send DAC data */
@@ -760,9 +760,9 @@ void locomo_m62332_senddata(struct locomo_dev *ldev, unsigned int dac_data, int
         udelay(DAC_SCL_HIGH_HOLD_TIME); /* 4.7 usec */
         if (locomo_readl(mapbase + LOCOMO_DAC) & LOCOMO_DAC_SDAOEB) {   /* High is error */
                 printk(KERN_WARNING "locomo: m62332_senddata Error 3\n");
-                return;
         }
 
+out:
         /* stop */
         r = locomo_readl(mapbase + LOCOMO_DAC);
         r &=  ~(LOCOMO_DAC_SCLOEB);
diff --git a/arch/arm/mach-ixp23xx/include/mach/memory.h b/arch/arm/mach-ixp23xx/include/mach/memory.h
index 94a3a86cfeb8..6ef65d813f16 100644
--- a/arch/arm/mach-ixp23xx/include/mach/memory.h
+++ b/arch/arm/mach-ixp23xx/include/mach/memory.h
@@ -19,7 +19,7 @@
  */
 #define PHYS_OFFSET             (0x00000000)
 
-#define IXP23XX_PCI_SDRAM_OFFSET (*((volatile int *)IXP23XX_PCI_SDRAM_BAR) & 0xfffffff0))
+#define IXP23XX_PCI_SDRAM_OFFSET (*((volatile int *)IXP23XX_PCI_SDRAM_BAR) & 0xfffffff0)
 
 #define __phys_to_bus(x)        ((x) + (IXP23XX_PCI_SDRAM_OFFSET - PHYS_OFFSET))
 #define __bus_to_phys(x)        ((x) - (IXP23XX_PCI_SDRAM_OFFSET - PHYS_OFFSET))
diff --git a/arch/arm/mach-kirkwood/mv88f6281gtw_ge-setup.c b/arch/arm/mach-kirkwood/mv88f6281gtw_ge-setup.c
index 0358f45766cb..5e6f711b1c67 100644
--- a/arch/arm/mach-kirkwood/mv88f6281gtw_ge-setup.c
+++ b/arch/arm/mach-kirkwood/mv88f6281gtw_ge-setup.c
@@ -74,9 +74,9 @@ static struct gpio_keys_button mv88f6281gtw_ge_button_pins[] = {
                 .desc           = "SWR Button",
                 .active_low     = 1,
         }, {
-                .code           = KEY_F1,
+                .code           = KEY_WPS_BUTTON,
                 .gpio           = 46,
-                .desc           = "WPS Button(F1)",
+                .desc           = "WPS Button",
                 .active_low     = 1,
         },
 };
diff --git a/arch/arm/mach-mmp/include/mach/uncompress.h b/arch/arm/mach-mmp/include/mach/uncompress.h
index a7dcc5307216..85bd8a2d84b5 100644
--- a/arch/arm/mach-mmp/include/mach/uncompress.h
+++ b/arch/arm/mach-mmp/include/mach/uncompress.h
@@ -14,7 +14,7 @@
 #define UART2_BASE      (APB_PHYS_BASE + 0x17000)
 #define UART3_BASE      (APB_PHYS_BASE + 0x18000)
 
-static volatile unsigned long *UART = (unsigned long *)UART2_BASE;
+static volatile unsigned long *UART;
 
 static inline void putc(char c)
 {
@@ -37,6 +37,9 @@ static inline void flush(void)
 
 static inline void arch_decomp_setup(void)
 {
+        /* default to UART2 */
+        UART = (unsigned long *)UART2_BASE;
+
         if (machine_is_avengers_lite())
                 UART = (unsigned long *)UART3_BASE;
 }
diff --git a/arch/arm/mach-omap2/clock3xxx_data.c b/arch/arm/mach-omap2/clock3xxx_data.c
index d5153b6bd6cb..9cba5560519b 100644
--- a/arch/arm/mach-omap2/clock3xxx_data.c
+++ b/arch/arm/mach-omap2/clock3xxx_data.c
@@ -895,7 +895,7 @@ static struct clk dpll4_m4x2_ck = {
         .ops            = &clkops_omap2_dflt_wait,
         .parent         = &dpll4_m4_ck,
         .enable_reg     = OMAP_CM_REGADDR(PLL_MOD, CM_CLKEN),
-        .enable_bit     = OMAP3430_PWRDN_CAM_SHIFT,
+        .enable_bit     = OMAP3430_PWRDN_DSS1_SHIFT,
         .flags          = INVERT_ENABLE,
         .clkdm_name     = "dpll4_clkdm",
         .recalc         = &omap3_clkoutx2_recalc,
diff --git a/arch/arm/mach-omap2/clockdomain.c b/arch/arm/mach-omap2/clockdomain.c
index b87ad66f083e..6e568ec995ee 100644
--- a/arch/arm/mach-omap2/clockdomain.c
+++ b/arch/arm/mach-omap2/clockdomain.c
@@ -240,7 +240,7 @@ static void _omap2_clkdm_set_hwsup(struct clockdomain *clkdm, int enable)
                         bits = OMAP24XX_CLKSTCTRL_ENABLE_AUTO;
                 else
                         bits = OMAP24XX_CLKSTCTRL_DISABLE_AUTO;
-        } else if (cpu_is_omap34xx() | cpu_is_omap44xx()) {
+        } else if (cpu_is_omap34xx() || cpu_is_omap44xx()) {
                 if (enable)
                         bits = OMAP34XX_CLKSTCTRL_ENABLE_AUTO;
                 else
@@ -812,7 +812,7 @@ int omap2_clkdm_sleep(struct clockdomain *clkdm)
                 cm_set_mod_reg_bits(OMAP24XX_FORCESTATE,
                             clkdm->pwrdm.ptr->prcm_offs, OMAP2_PM_PWSTCTRL);
 
-        } else if (cpu_is_omap34xx() | cpu_is_omap44xx()) {
+        } else if (cpu_is_omap34xx() || cpu_is_omap44xx()) {
 
                 u32 bits = (OMAP34XX_CLKSTCTRL_FORCE_SLEEP <<
                          __ffs(clkdm->clktrctrl_mask));
@@ -856,7 +856,7 @@ int omap2_clkdm_wakeup(struct clockdomain *clkdm)
                 cm_clear_mod_reg_bits(OMAP24XX_FORCESTATE,
                               clkdm->pwrdm.ptr->prcm_offs, OMAP2_PM_PWSTCTRL);
 
-        } else if (cpu_is_omap34xx() | cpu_is_omap44xx()) {
+        } else if (cpu_is_omap34xx() || cpu_is_omap44xx()) {
 
                 u32 bits = (OMAP34XX_CLKSTCTRL_FORCE_WAKEUP <<
                          __ffs(clkdm->clktrctrl_mask));
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index c6649472ce0d..e436dcb19795 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -1511,6 +1511,9 @@ struct powerdomain *omap_hwmod_get_pwrdm(struct omap_hwmod *oh)
                 c = oh->slaves[oh->_mpu_port_index]->_clk;
         }
 
+        if (!c->clkdm)
+                return NULL;
+
         return c->clkdm->pwrdm.ptr;
 
 }
diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c
index 9a0fb385622b..ebfce7d1a5d3 100644
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -222,7 +222,7 @@ void pwrdm_init(struct powerdomain **pwrdm_list)
 {
         struct powerdomain **p = NULL;
 
-        if (cpu_is_omap24xx() | cpu_is_omap34xx()) {
+        if (cpu_is_omap24xx() || cpu_is_omap34xx()) {
                 pwrstctrl_reg_offs = OMAP2_PM_PWSTCTRL;
                 pwrstst_reg_offs = OMAP2_PM_PWSTST;
         } else if (cpu_is_omap44xx()) {
diff --git a/arch/arm/mach-omap2/prcm.c b/arch/arm/mach-omap2/prcm.c
index 9537f6f2352d..07a60f1204ca 100644
--- a/arch/arm/mach-omap2/prcm.c
+++ b/arch/arm/mach-omap2/prcm.c
@@ -123,7 +123,7 @@ struct omap3_prcm_regs prcm_context;
 u32 omap_prcm_get_reset_sources(void)
 {
         /* XXX This presumably needs modification for 34XX */
-        if (cpu_is_omap24xx() | cpu_is_omap34xx())
+        if (cpu_is_omap24xx() || cpu_is_omap34xx())
                 return prm_read_mod_reg(WKUP_MOD, OMAP2_RM_RSTST) & 0x7f;
         if (cpu_is_omap44xx())
                 return prm_read_mod_reg(WKUP_MOD, OMAP4_RM_RSTST) & 0x7f;
@@ -157,7 +157,7 @@ void omap_prcm_arch_reset(char mode, const char *cmd)
         else
                 WARN_ON(1);
 
-        if (cpu_is_omap24xx() | cpu_is_omap34xx())
+        if (cpu_is_omap24xx() || cpu_is_omap34xx())
                 prm_set_mod_reg_bits(OMAP_RST_DPLL3, prcm_offs,
                                                  OMAP2_RM_RSTCTRL);
         if (cpu_is_omap44xx())
diff --git a/arch/arm/mach-orion5x/wrt350n-v2-setup.c b/arch/arm/mach-orion5x/wrt350n-v2-setup.c
index cb0feca193d4..f9f222ebb7ed 100644
--- a/arch/arm/mach-orion5x/wrt350n-v2-setup.c
+++ b/arch/arm/mach-orion5x/wrt350n-v2-setup.c
@@ -77,7 +77,7 @@ static struct gpio_keys_button wrt350n_v2_buttons[] = {
                 .desc           = "Reset Button",
                 .active_low     = 1,
         }, {
-                .code           = KEY_WLAN,
+                .code           = KEY_WPS_BUTTON,
                 .gpio           = 2,
                 .desc           = "WPS Button",
                 .active_low     = 1,
diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
index 38fbd0a0e402..5b6ee46fa7f6 100644
--- a/arch/arm/mach-pxa/Kconfig
+++ b/arch/arm/mach-pxa/Kconfig
@@ -272,7 +272,6 @@ config MACH_H5000
 config MACH_HIMALAYA
         bool "HTC Himalaya Support"
         select CPU_PXA26x
-        select FB_W100
 
 config MACH_MAGICIAN
         bool "Enable HTC Magician Support"
@@ -454,6 +453,13 @@ config PXA_SHARPSL
 config SHARPSL_PM
         bool
         select APM_EMULATION
+        select SHARPSL_PM_MAX1111
+
+config SHARPSL_PM_MAX1111
+        bool
+        depends on !CORGI_SSP_DEPRECATED
+        select HWMON
+        select SENSORS_MAX1111
 
 config CORGI_SSP_DEPRECATED
         bool
@@ -547,7 +553,6 @@ config MACH_E740
         bool "Toshiba e740"
         default y
         depends on ARCH_PXA_ESERIES
-        select FB_W100
         help
           Say Y here if you intend to run this kernel on a Toshiba
           e740 family PDA.
@@ -556,7 +561,6 @@ config MACH_E750
         bool "Toshiba e750"
         default y
         depends on ARCH_PXA_ESERIES
-        select FB_W100
         help
           Say Y here if you intend to run this kernel on a Toshiba
           e750 family PDA.
@@ -573,7 +577,6 @@ config MACH_E800
         bool "Toshiba e800"
         default y
         depends on ARCH_PXA_ESERIES
-        select FB_W100
         help
           Say Y here if you intend to run this kernel on a Toshiba
           e800 family PDA.
diff --git a/arch/arm/mach-pxa/imote2.c b/arch/arm/mach-pxa/imote2.c
index b2f878bd460b..5161dca8ccc0 100644
--- a/arch/arm/mach-pxa/imote2.c
+++ b/arch/arm/mach-pxa/imote2.c
@@ -559,10 +559,6 @@ static void __init imote2_init(void)
         pxa_set_btuart_info(NULL);
         pxa_set_stuart_info(NULL);
 
-        /* SPI chip select directions - all other directions should
-         * be handled by drivers.*/
-        gpio_direction_output(37, 0);
-
         platform_add_devices(imote2_devices, ARRAY_SIZE(imote2_devices));
 
         pxa2xx_set_spi_info(1, &pxa_ssp_master_0_info);
diff --git a/arch/arm/mach-pxa/include/mach/uncompress.h b/arch/arm/mach-pxa/include/mach/uncompress.h
index 5ef91d9d17e4..759b851ec985 100644
--- a/arch/arm/mach-pxa/include/mach/uncompress.h
+++ b/arch/arm/mach-pxa/include/mach/uncompress.h
@@ -16,9 +16,9 @@
 #define BTUART_BASE     (0x40200000)
 #define STUART_BASE     (0x40700000)
 
-static unsigned long uart_base = FFUART_BASE;
-static unsigned int uart_shift = 2;
-static unsigned int uart_is_pxa = 1;
+static unsigned long uart_base;
+static unsigned int uart_shift;
+static unsigned int uart_is_pxa;
 
 static inline unsigned char uart_read(int offset)
 {
@@ -56,6 +56,11 @@ static inline void flush(void)
 
 static inline void arch_decomp_setup(void)
 {
+        /* initialize to default */
+        uart_base = FFUART_BASE;
+        uart_shift = 2;
+        uart_is_pxa = 1;
+
         if (machine_is_littleton() || machine_is_intelmote2()
             || machine_is_csb726() || machine_is_stargate2()
             || machine_is_cm_x300() || machine_is_balloon3())
diff --git a/arch/arm/mach-pxa/raumfeld.c b/arch/arm/mach-pxa/raumfeld.c
index 3184bdc14526..44bb675e47f1 100644
--- a/arch/arm/mach-pxa/raumfeld.c
+++ b/arch/arm/mach-pxa/raumfeld.c
@@ -37,8 +37,6 @@
 #include <linux/lis3lv02d.h>
 #include <linux/pda_power.h>
 #include <linux/power_supply.h>
-#include <linux/pda_power.h>
-#include <linux/power_supply.h>
 #include <linux/regulator/max8660.h>
 #include <linux/regulator/machine.h>
 #include <linux/regulator/fixed.h>
@@ -444,7 +442,7 @@ static struct gpio_keys_button gpio_keys_button[] = {
                 .active_low             = 0,
                 .wakeup                 = 0,
                 .debounce_interval      = 5, /* ms */
-                .desc                   = "on/off button",
+                .desc                   = "on_off button",
         },
 };
 
diff --git a/arch/arm/mach-pxa/stargate2.c b/arch/arm/mach-pxa/stargate2.c
index a98a434f0111..2041eb1d90ba 100644
--- a/arch/arm/mach-pxa/stargate2.c
+++ b/arch/arm/mach-pxa/stargate2.c
@@ -764,11 +764,6 @@ static void __init stargate2_init(void)
         pxa_set_btuart_info(NULL);
         pxa_set_stuart_info(NULL);
 
-        /* spi chip selects */
-        gpio_direction_output(37, 0);
-        gpio_direction_output(24, 0);
-        gpio_direction_output(39, 0);
-
         platform_add_devices(ARRAY_AND_SIZE(stargate2_devices));
 
         pxa2xx_set_spi_info(1, &pxa_ssp_master_0_info);
diff --git a/arch/arm/plat-omap/include/plat/omap_hwmod.h b/arch/arm/plat-omap/include/plat/omap_hwmod.h
index 440b4164f2f6..36d6ea56ab51 100644
--- a/arch/arm/plat-omap/include/plat/omap_hwmod.h
+++ b/arch/arm/plat-omap/include/plat/omap_hwmod.h
@@ -294,8 +294,8 @@ struct omap_hwmod_class_sysconfig {
         u16 rev_offs;
         u16 sysc_offs;
         u16 syss_offs;
+        u16 sysc_flags;
         u8 idlemodes;
-        u8 sysc_flags;
         u8 clockact;
         struct omap_hwmod_sysc_fields *sysc_fields;
 };
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 31c2f4c30a95..1536f1784cac 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Sat Feb 20 14:16:15 2010
+# Last update: Sat Mar 20 15:35:41 2010
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -2663,7 +2663,7 @@ reb01			MACH_REB01		REB01			2675
 aquila                  MACH_AQUILA             AQUILA                  2676
 spark_sls_hw2           MACH_SPARK_SLS_HW2      SPARK_SLS_HW2           2677
 sheeva_esata            MACH_ESATA_SHEEVAPLUG   ESATA_SHEEVAPLUG        2678
-surf7x30                MACH_SURF7X30           SURF7X30                2679
+msm7x30_surf            MACH_MSM7X30_SURF       MSM7X30_SURF            2679
 micro2440               MACH_MICRO2440          MICRO2440               2680
 am2440                  MACH_AM2440             AM2440                  2681
 tq2440                  MACH_TQ2440             TQ2440                  2682
@@ -2678,3 +2678,74 @@ vc088x			MACH_VC088X		VC088X			2690
 mioa702                 MACH_MIOA702            MIOA702                 2691
 hpmin                   MACH_HPMIN              HPMIN                   2692
 ak880xak                MACH_AK880XAK           AK880XAK                2693
+arm926tomap850          MACH_ARM926TOMAP850     ARM926TOMAP850          2694
+lkevm                   MACH_LKEVM              LKEVM                   2695
+mw6410                  MACH_MW6410             MW6410                  2696
+terastation_wxl         MACH_TERASTATION_WXL    TERASTATION_WXL         2697
+cpu8000e                MACH_CPU8000E           CPU8000E                2698
+catania                 MACH_CATANIA            CATANIA                 2699
+tokyo                   MACH_TOKYO              TOKYO                   2700
+msm7201a_surf           MACH_MSM7201A_SURF      MSM7201A_SURF           2701
+msm7201a_ffa            MACH_MSM7201A_FFA       MSM7201A_FFA            2702
+msm7x25_surf            MACH_MSM7X25_SURF       MSM7X25_SURF            2703
+msm7x25_ffa             MACH_MSM7X25_FFA        MSM7X25_FFA             2704
+msm7x27_surf            MACH_MSM7X27_SURF       MSM7X27_SURF            2705
+msm7x27_ffa             MACH_MSM7X27_FFA        MSM7X27_FFA             2706
+msm7x30_ffa             MACH_MSM7X30_FFA        MSM7X30_FFA             2707
+qsd8x50_surf            MACH_QSD8X50_SURF       QSD8X50_SURF            2708
+qsd8x50_comet           MACH_QSD8X50_COMET      QSD8X50_COMET           2709
+qsd8x50_ffa             MACH_QSD8X50_FFA        QSD8X50_FFA             2710
+qsd8x50a_surf           MACH_QSD8X50A_SURF      QSD8X50A_SURF           2711
+qsd8x50a_ffa            MACH_QSD8X50A_FFA       QSD8X50A_FFA            2712
+adx_xgcp10              MACH_ADX_XGCP10         ADX_XGCP10              2713
+mcgwumts2a              MACH_MCGWUMTS2A         MCGWUMTS2A              2714
+mobikt                  MACH_MOBIKT             MOBIKT                  2715
+mx53_evk                MACH_MX53_EVK           MX53_EVK                2716
+igep0030                MACH_IGEP0030           IGEP0030                2717
+axell_h40_h50_ctrl      MACH_AXELL_H40_H50_CTRL AXELL_H40_H50_CTRL      2718
+dtcommod                MACH_DTCOMMOD           DTCOMMOD                2719
+gould                   MACH_GOULD              GOULD                   2720
+siberia                 MACH_SIBERIA            SIBERIA                 2721
+sbc3530                 MACH_SBC3530            SBC3530                 2722
+qarm                    MACH_QARM               QARM                    2723
+mips                    MACH_MIPS               MIPS                    2724
+mx27grb                 MACH_MX27GRB            MX27GRB                 2725
+sbc8100                 MACH_SBC8100            SBC8100                 2726
+saarb                   MACH_SAARB              SAARB                   2727
+omap3mini               MACH_OMAP3MINI          OMAP3MINI               2728
+cnmbook7se              MACH_CNMBOOK7SE         CNMBOOK7SE              2729
+catan                   MACH_CATAN              CATAN                   2730
+harmony                 MACH_HARMONY            HARMONY                 2731
+tonga                   MACH_TONGA              TONGA                   2732
+cybook_orizon           MACH_CYBOOK_ORIZON      CYBOOK_ORIZON           2733
+htcrhodiumcdma          MACH_HTCRHODIUMCDMA     HTCRHODIUMCDMA          2734
+epc_g45                 MACH_EPC_G45            EPC_G45                 2735
+epc_lpc3250             MACH_EPC_LPC3250        EPC_LPC3250             2736
+mxc91341evb             MACH_MXC91341EVB        MXC91341EVB             2737
+rtw1000                 MACH_RTW1000            RTW1000                 2738
+bobcat                  MACH_BOBCAT             BOBCAT                  2739
+trizeps6                MACH_TRIZEPS6           TRIZEPS6                2740
+msm7x30_fluid           MACH_MSM7X30_FLUID      MSM7X30_FLUID           2741
+nedap9263               MACH_NEDAP9263          NEDAP9263               2742
+netgear_ms2110          MACH_NETGEAR_MS2110     NETGEAR_MS2110          2743
+bmx                     MACH_BMX                BMX                     2744
+netstream               MACH_NETSTREAM          NETSTREAM               2745
+vpnext_rcu              MACH_VPNEXT_RCU         VPNEXT_RCU              2746
+vpnext_mpu              MACH_VPNEXT_MPU         VPNEXT_MPU              2747
+bcmring_tablet_v1       MACH_BCMRING_TABLET_V1  BCMRING_TABLET_V1       2748
+sgarm10                 MACH_SGARM10            SGARM10                 2749
+cm_t3517                MACH_CM_T3517           CM_T3517                2750
+omap3_cps               MACH_OMAP3_CPS          OMAP3_CPS               2751
+axar1500_receiver       MACH_AXAR1500_RECEIVER  AXAR1500_RECEIVER       2752
+wbd222                  MACH_WBD222             WBD222                  2753
+mt65xx                  MACH_MT65XX             MT65XX                  2754
+msm8x60_surf            MACH_MSM8X60_SURF       MSM8X60_SURF            2755
+msm8x60_sim             MACH_MSM8X60_SIM        MSM8X60_SIM             2756
+vmc300                  MACH_VMC300             VMC300                  2757
+tcc8000_sdk             MACH_TCC8000_SDK        TCC8000_SDK             2758
+nanos                   MACH_NANOS              NANOS                   2759
+stamp9g10               MACH_STAMP9G10          STAMP9G10               2760
+stamp9g45               MACH_STAMP9G45          STAMP9G45               2761
+h6053                   MACH_H6053              H6053                   2762
+smint01                 MACH_SMINT01            SMINT01                 2763
+prtlvt2                 MACH_PRTLVT2            PRTLVT2                 2764
diff --git a/arch/cris/arch-v32/drivers/pci/bios.c b/arch/cris/arch-v32/drivers/pci/bios.c
index d4b9c36ddc0f..bc0cfdad1cbc 100644
--- a/arch/cris/arch-v32/drivers/pci/bios.c
+++ b/arch/cris/arch-v32/drivers/pci/bios.c
@@ -50,7 +50,7 @@ pcibios_align_resource(void *data, const struct resource *res,
         if ((res->flags & IORESOURCE_IO) && (start & 0x300))
                 start = (start + 0x3ff) & ~0x3ff;
 
-        return start
+        return start;
 }
 
 int pcibios_enable_resources(struct pci_dev *dev, int mask)
diff --git a/arch/frv/mb93090-mb00/pci-frv.c b/arch/frv/mb93090-mb00/pci-frv.c
index 1ed15d7fea20..6b4fb28e9f99 100644
--- a/arch/frv/mb93090-mb00/pci-frv.c
+++ b/arch/frv/mb93090-mb00/pci-frv.c
@@ -41,7 +41,7 @@ pcibios_align_resource(void *data, const struct resource *res,
         if ((res->flags & IORESOURCE_IO) && (start & 0x300))
                 start = (start + 0x3ff) & ~0x3ff;
 
-        return start
+        return start;
 }
 
 
@@ -94,8 +94,7 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                 r = &dev->resource[idx];
                                 if (!r->start)
                                         continue;
-                                if (pci_claim_resource(dev, idx) < 0)
-                                        printk(KERN_ERR "PCI: Cannot allocate resource region %d of bridge %s\n", idx, pci_name(dev));
+                                pci_claim_resource(dev, idx);
                         }
                 }
                 pcibios_allocate_bus_resources(&bus->children);
@@ -125,7 +124,6 @@ static void __init pcibios_allocate_resources(int pass)
                                 DBG("PCI: Resource %08lx-%08lx (f=%lx, d=%d, p=%d)\n",
                                     r->start, r->end, r->flags, disabled, pass);
                                 if (pci_claim_resource(dev, idx) < 0) {
-                                        printk(KERN_ERR "PCI: Cannot allocate resource region %d of device %s\n", idx, pci_name(dev));
                                         /* We'll assign a new address later */
                                         r->end -= r->start;
                                         r->start = 0;
diff --git a/arch/powerpc/include/asm/asm-compat.h b/arch/powerpc/include/asm/asm-compat.h
index c1b475a941eb..a9b91ed3d4b9 100644
--- a/arch/powerpc/include/asm/asm-compat.h
+++ b/arch/powerpc/include/asm/asm-compat.h
@@ -28,6 +28,7 @@
 #define PPC_LLARX(t, a, b, eh)  PPC_LDARX(t, a, b, eh)
 #define PPC_STLCX       stringify_in_c(stdcx.)
 #define PPC_CNTLZL      stringify_in_c(cntlzd)
+#define PPC_LR_STKOFF   16
 
 /* Move to CR, single-entry optimized version. Only available
  * on POWER4 and later.
@@ -51,6 +52,7 @@
 #define PPC_STLCX       stringify_in_c(stwcx.)
 #define PPC_CNTLZL      stringify_in_c(cntlzw)
 #define PPC_MTOCRF      stringify_in_c(mtcrf)
+#define PPC_LR_STKOFF   4
 
 #endif
 
diff --git a/arch/powerpc/kernel/misc.S b/arch/powerpc/kernel/misc.S
index 2d29752cbe16..b485a87c94e1 100644
--- a/arch/powerpc/kernel/misc.S
+++ b/arch/powerpc/kernel/misc.S
@@ -127,3 +127,31 @@ _GLOBAL(__setup_cpu_power7)
 _GLOBAL(__restore_cpu_power7)
         /* place holder */
         blr
+
+#ifdef CONFIG_EVENT_TRACING
+/*
+ * Get a minimal set of registers for our caller's nth caller.
+ * r3 = regs pointer, r5 = n.
+ *
+ * We only get R1 (stack pointer), NIP (next instruction pointer)
+ * and LR (link register).  These are all we can get in the
+ * general case without doing complicated stack unwinding, but
+ * fortunately they are enough to do a stack backtrace, which
+ * is all we need them for.
+ */
+_GLOBAL(perf_arch_fetch_caller_regs)
+        mr      r6,r1
+        cmpwi   r5,0
+        mflr    r4
+        ble     2f
+        mtctr   r5
+1:      PPC_LL  r6,0(r6)
+        bdnz    1b
+        PPC_LL  r4,PPC_LR_STKOFF(r6)
+2:      PPC_LL  r7,0(r6)
+        PPC_LL  r7,PPC_LR_STKOFF(r7)
+        PPC_STL r6,GPR1-STACK_FRAME_OVERHEAD(r3)
+        PPC_STL r4,_NIP-STACK_FRAME_OVERHEAD(r3)
+        PPC_STL r7,_LINK-STACK_FRAME_OVERHEAD(r3)
+        blr
+#endif /* CONFIG_EVENT_TRACING */
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index a97d69525829..14e0479d3888 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -24,8 +24,8 @@
 /* Symbols defined by linker scripts */
 extern char input_data[];
 extern int input_len;
-extern int _text;
-extern int _end;
+extern char _text, _end;
+extern char _bss, _ebss;
 
 static void error(char *m);
 
@@ -129,12 +129,12 @@ unsigned long decompress_kernel(void)
         unsigned long output_addr;
         unsigned char *output;
 
+        check_ipl_parmblock((void *) 0, (unsigned long) output + SZ__bss_start);
+        memset(&_bss, 0, &_ebss - &_bss);
         free_mem_ptr = (unsigned long)&_end;
         free_mem_end_ptr = free_mem_ptr + HEAP_SIZE;
         output = (unsigned char *) ((free_mem_end_ptr + 4095UL) & -4096UL);
 
-        check_ipl_parmblock((void *) 0, (unsigned long) output + SZ__bss_start);
-
 #ifdef CONFIG_BLK_DEV_INITRD
         /*
          * Move the initrd right behind the end of the decompressed
diff --git a/arch/s390/include/asm/system.h b/arch/s390/include/asm/system.h
index 67ee6c3c6bb3..1741c1556a4e 100644
--- a/arch/s390/include/asm/system.h
+++ b/arch/s390/include/asm/system.h
@@ -110,6 +110,7 @@ extern void pfault_fini(void);
 #endif /* CONFIG_PFAULT */
 
 extern void cmma_init(void);
+extern int memcpy_real(void *, void *, size_t);
 
 #define finish_arch_switch(prev) do {                                        \
         set_fs(current->thread.mm_segment);                                  \
@@ -218,8 +219,8 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
                         "       l       %0,%2\n"
                         "0:     nr      %0,%5\n"
                         "       lr      %1,%0\n"
-                        "       or      %0,%2\n"
-                        "       or      %1,%3\n"
+                        "       or      %0,%3\n"
+                        "       or      %1,%4\n"
                         "       cs      %0,%1,%2\n"
                         "       jnl     1f\n"
                         "       xr      %1,%0\n"
@@ -239,8 +240,8 @@ __cmpxchg(volatile void *ptr, unsigned long old, unsigned long new, int size)
                         "       l       %0,%2\n"
                         "0:     nr      %0,%5\n"
                         "       lr      %1,%0\n"
-                        "       or      %0,%2\n"
-                        "       or      %1,%3\n"
+                        "       or      %0,%3\n"
+                        "       or      %1,%4\n"
                         "       cs      %0,%1,%2\n"
                         "       jnl     1f\n"
                         "       xr      %1,%0\n"
diff --git a/arch/s390/kernel/head.S b/arch/s390/kernel/head.S
index ca4a62bd862f..9d1f76702d47 100644
--- a/arch/s390/kernel/head.S
+++ b/arch/s390/kernel/head.S
@@ -517,7 +517,10 @@ startup:
         lhi     %r1,2                   # mode 2 = esame (dump)
         sigp    %r1,%r0,0x12            # switch to esame mode
         sam64                           # switch to 64 bit mode
+        larl    %r13,4f
+        lmh     %r0,%r15,0(%r13)        # clear high-order half
         jg      startup_continue
+4:      .fill   16,4,0x0
 #else
         mvi     __LC_AR_MODE_ID,0       # set ESA flag (mode 0)
         l       %r13,4f-.LPG0(%r13)
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index 39580e768658..1f70970de0aa 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -21,7 +21,6 @@ startup_continue:
         larl    %r1,sched_clock_base_cc
         mvc     0(8,%r1),__LC_LAST_UPDATE_CLOCK
         larl    %r13,.LPG1              # get base
-        lmh     %r0,%r15,.Lzero64-.LPG1(%r13)   # clear high-order half
         lctlg   %c0,%c15,.Lctl-.LPG1(%r13)      # load control registers
         lg      %r12,.Lparmaddr-.LPG1(%r13)     # pointer to parameter area
                                         # move IPL device to lowcore
@@ -67,7 +66,6 @@ startup_continue:
 .L4malign:.quad 0xffffffffffc00000
 .Lscan2g:.quad  0x80000000 + 0x20000 - 8        # 2GB + 128K - 8
 .Lnop:  .long   0x07000700
-.Lzero64:.fill  16,4,0x0
 .Lparmaddr:
         .quad   PARMAREA
         .align  64
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 77a63ae419f0..ba363d99de43 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -401,7 +401,7 @@ setup_lowcore(void)
          * Setup lowcore for boot cpu
          */
         BUILD_BUG_ON(sizeof(struct _lowcore) != LC_PAGES * 4096);
-        lc = __alloc_bootmem(LC_PAGES * PAGE_SIZE, LC_PAGES * PAGE_SIZE, 0);
+        lc = __alloc_bootmem_low(LC_PAGES * PAGE_SIZE, LC_PAGES * PAGE_SIZE, 0);
         lc->restart_psw.mask = PSW_BASE_BITS | PSW_DEFAULT_KEY;
         lc->restart_psw.addr =
                 PSW_ADDR_AMODE | (unsigned long) restart_int_handler;
@@ -433,7 +433,7 @@ setup_lowcore(void)
 #ifndef CONFIG_64BIT
         if (MACHINE_HAS_IEEE) {
                 lc->extended_save_area_addr = (__u32)
-                        __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, 0);
+                        __alloc_bootmem_low(PAGE_SIZE, PAGE_SIZE, 0);
                 /* enable extended save area */
                 __ctl_set_bit(14, 29);
         }
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 29f65bce55e1..d7d24fc3d6b7 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -292,9 +292,9 @@ static void __init smp_get_save_area(unsigned int cpu, unsigned int phy_cpu)
         zfcpdump_save_areas[cpu] = kmalloc(sizeof(struct save_area), GFP_KERNEL);
         while (raw_sigp(phy_cpu, sigp_stop_and_store_status) == sigp_busy)
                 cpu_relax();
-        memcpy(zfcpdump_save_areas[cpu],
-               (void *)(unsigned long) store_prefix() + SAVE_AREA_BASE,
-               sizeof(struct save_area));
+        memcpy_real(zfcpdump_save_areas[cpu],
+                    (void *)(unsigned long) store_prefix() + SAVE_AREA_BASE,
+                    sizeof(struct save_area));
 }
 
 struct save_area *zfcpdump_save_areas[NR_CPUS + 1];
diff --git a/arch/s390/mm/maccess.c b/arch/s390/mm/maccess.c
index 81756271dc44..a8c2af8c650f 100644
--- a/arch/s390/mm/maccess.c
+++ b/arch/s390/mm/maccess.c
@@ -59,3 +59,29 @@ long probe_kernel_write(void *dst, void *src, size_t size)
         }
         return copied < 0 ? -EFAULT : 0;
 }
+
+int memcpy_real(void *dest, void *src, size_t count)
+{
+        register unsigned long _dest asm("2") = (unsigned long) dest;
+        register unsigned long _len1 asm("3") = (unsigned long) count;
+        register unsigned long _src  asm("4") = (unsigned long) src;
+        register unsigned long _len2 asm("5") = (unsigned long) count;
+        unsigned long flags;
+        int rc = -EFAULT;
+
+        if (!count)
+                return 0;
+        flags = __raw_local_irq_stnsm(0xf8UL);
+        asm volatile (
+                "0:     mvcle   %1,%2,0x0\n"
+                "1:     jo      0b\n"
+                "       lhi     %0,0x0\n"
+                "2:\n"
+                EX_TABLE(1b,2b)
+                : "+d" (rc), "+d" (_dest), "+d" (_src), "+d" (_len1),
+                  "+d" (_len2), "=m" (*((long *) dest))
+                : "m" (*((long *) src))
+                : "cc", "memory");
+        __raw_local_irq_ssm(flags);
+        return rc;
+}
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 39ed8722d11a..6c13b92742e8 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -836,6 +836,8 @@ static void __init sh_eth_init(struct sh_eth_plat_data *pd)
                 pd->mac_addr[i] = mac_read(a, 0x10 + i);
                 msleep(10);
         }
+
+        i2c_put_adapter(a);
 }
 #else
 static void __init sh_eth_init(struct sh_eth_plat_data *pd)
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 66cdbc3c7af9..ccaa290e9aba 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -52,6 +52,13 @@
  * and change SW41 to use 720p
  */
 
+/*
+ * about sound
+ *
+ * This setup.c supports FSI slave mode.
+ * Please change J20, J21, J22 pin to 1-2 connection.
+ */
+
 /* Heartbeat */
 static struct resource heartbeat_resource = {
         .start  = PA_LED,
@@ -276,6 +283,7 @@ static struct clk fsimcka_clk = {
         .rate           = 0, /* unknown */
 };
 
+/* change J20, J21, J22 pin to 1-2 connection to use slave mode */
 struct sh_fsi_platform_info fsi_info = {
         .porta_flags = SH_FSI_BRS_INV |
                        SH_FSI_OUT_SLAVE_MODE |
diff --git a/arch/sh/include/cpu-sh4/cpu/mmu_context.h b/arch/sh/include/cpu-sh4/cpu/mmu_context.h
index 03ea75c5315d..310ec92f2759 100644
--- a/arch/sh/include/cpu-sh4/cpu/mmu_context.h
+++ b/arch/sh/include/cpu-sh4/cpu/mmu_context.h
@@ -19,6 +19,8 @@
 
 #define MMUCR           0xFF000010      /* MMU Control Register */
 
+#define MMU_ITLB_ADDRESS_ARRAY  0xF2000000
+#define MMU_ITLB_ADDRESS_ARRAY2 0xF2800000
 #define MMU_UTLB_ADDRESS_ARRAY  0xF6000000
 #define MMU_UTLB_ADDRESS_ARRAY2 0xF6800000
 #define MMU_PAGE_ASSOC_BIT      0x80
diff --git a/arch/sh/include/cpu-sh4/cpu/watchdog.h b/arch/sh/include/cpu-sh4/cpu/watchdog.h
index 7672301d0c70..7f62b9380938 100644
--- a/arch/sh/include/cpu-sh4/cpu/watchdog.h
+++ b/arch/sh/include/cpu-sh4/cpu/watchdog.h
@@ -21,6 +21,12 @@
 #define WTCNT           0xffcc0000 /*WDTST*/
 #define WTST            WTCNT
 #define WTBST           0xffcc0008 /*WDTBST*/
+/* Register definitions */
+#elif   defined(CONFIG_CPU_SUBTYPE_SH7722) || \
+        defined(CONFIG_CPU_SUBTYPE_SH7723) || \
+        defined(CONFIG_CPU_SUBTYPE_SH7724)
+#define WTCNT           0xa4520000
+#define WTCSR           0xa4520004
 #else
 /* Register definitions */
 #define WTCNT           0xffc00008
diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index bd1c497280a6..94739ee7aa74 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -727,7 +727,7 @@ static int dwarf_parse_cie(void *entry, void *p, unsigned long len,
                            unsigned char *end, struct module *mod)
 {
         struct rb_node **rb_node = &cie_root.rb_node;
-        struct rb_node *parent;
+        struct rb_node *parent = *rb_node;
         struct dwarf_cie *cie;
         unsigned long flags;
         int count;
@@ -856,7 +856,7 @@ static int dwarf_parse_fde(void *entry, u32 entry_type,
                            unsigned char *end, struct module *mod)
 {
         struct rb_node **rb_node = &fde_root.rb_node;
-        struct rb_node *parent;
+        struct rb_node *parent = *rb_node;
         struct dwarf_fde *fde;
         struct dwarf_cie *cie;
         unsigned long flags;
diff --git a/arch/sh/kernel/idle.c b/arch/sh/kernel/idle.c
index 0fd7b41f0a22..273f890b17ae 100644
--- a/arch/sh/kernel/idle.c
+++ b/arch/sh/kernel/idle.c
@@ -112,7 +112,7 @@ void cpu_idle(void)
         }
 }
 
-void __cpuinit select_idle_routine(void)
+void __init select_idle_routine(void)
 {
         /*
          * If a platform has set its own idle routine, leave it alone.
diff --git a/arch/sh/kernel/perf_event.c b/arch/sh/kernel/perf_event.c
index 9f253e9cce01..81b6de41ae5d 100644
--- a/arch/sh/kernel/perf_event.c
+++ b/arch/sh/kernel/perf_event.c
@@ -315,7 +315,7 @@ void hw_perf_disable(void)
         sh_pmu->disable_all();
 }
 
-int register_sh_pmu(struct sh_pmu *pmu)
+int __cpuinit register_sh_pmu(struct sh_pmu *pmu)
 {
         if (sh_pmu)
                 return -EBUSY;
diff --git a/arch/sh/kernel/process_64.c b/arch/sh/kernel/process_64.c
index c90957a459ac..c0d40f671ecd 100644
--- a/arch/sh/kernel/process_64.c
+++ b/arch/sh/kernel/process_64.c
@@ -504,13 +504,6 @@ out:
         return error;
 }
 
-/*
- * These bracket the sleeping functions..
- */
-extern void interruptible_sleep_on(wait_queue_head_t *q);
-
-#define mid_sched       ((unsigned long) interruptible_sleep_on)
-
 #ifdef CONFIG_FRAME_POINTER
 static int in_sh64_switch_to(unsigned long pc)
 {
diff --git a/arch/sh/mm/pmb.c b/arch/sh/mm/pmb.c
index a4662e2782c3..3cc21933063b 100644
--- a/arch/sh/mm/pmb.c
+++ b/arch/sh/mm/pmb.c
@@ -323,6 +323,7 @@ static void __clear_pmb_entry(struct pmb_entry *pmbe)
         writel_uncached(data_val & ~PMB_V, data);
 }
 
+#ifdef CONFIG_PM
 static void set_pmb_entry(struct pmb_entry *pmbe)
 {
         unsigned long flags;
@@ -331,6 +332,7 @@ static void set_pmb_entry(struct pmb_entry *pmbe)
         __set_pmb_entry(pmbe);
         spin_unlock_irqrestore(&pmbe->lock, flags);
 }
+#endif /* CONFIG_PM */
 
 int pmb_bolt_mapping(unsigned long vaddr, phys_addr_t phys,
                      unsigned long size, pgprot_t prot)
@@ -802,7 +804,7 @@ void __init pmb_init(void)
         writel_uncached(0, PMB_IRMCR);
 
         /* Flush out the TLB */
-        __raw_writel(__raw_readl(MMUCR) | MMUCR_TI, MMUCR);
+        local_flush_tlb_all();
         ctrl_barrier();
 }
 
diff --git a/arch/sh/mm/tlb-pteaex.c b/arch/sh/mm/tlb-pteaex.c
index 32dc674c550c..bdd0982b56ee 100644
--- a/arch/sh/mm/tlb-pteaex.c
+++ b/arch/sh/mm/tlb-pteaex.c
@@ -73,5 +73,7 @@ void local_flush_tlb_one(unsigned long asid, unsigned long page)
         jump_to_uncached();
         __raw_writel(page, MMU_UTLB_ADDRESS_ARRAY | MMU_PAGE_ASSOC_BIT);
         __raw_writel(asid, MMU_UTLB_ADDRESS_ARRAY2 | MMU_PAGE_ASSOC_BIT);
+        __raw_writel(page, MMU_ITLB_ADDRESS_ARRAY | MMU_PAGE_ASSOC_BIT);
+        __raw_writel(asid, MMU_ITLB_ADDRESS_ARRAY2 | MMU_PAGE_ASSOC_BIT);
         back_to_cached();
 }
diff --git a/arch/sh/mm/tlbflush_32.c b/arch/sh/mm/tlbflush_32.c
index 004bb3f25b5f..77dc5efa7127 100644
--- a/arch/sh/mm/tlbflush_32.c
+++ b/arch/sh/mm/tlbflush_32.c
@@ -123,18 +123,27 @@ void local_flush_tlb_mm(struct mm_struct *mm)
 void local_flush_tlb_all(void)
 {
         unsigned long flags, status;
+        int i;
 
         /*
          * Flush all the TLB.
-         *
-         * Write to the MMU control register's bit:
-         *      TF-bit for SH-3, TI-bit for SH-4.
-         *      It's same position, bit #2.
          */
         local_irq_save(flags);
+        jump_to_uncached();
+
         status = __raw_readl(MMUCR);
-        status |= 0x04;
-        __raw_writel(status, MMUCR);
+        status = ((status & MMUCR_URB) >> MMUCR_URB_SHIFT);
+
+        if (status == 0)
+                status = MMUCR_URB_NENTRIES;
+
+        for (i = 0; i < status; i++)
+                __raw_writel(0x0, MMU_UTLB_ADDRESS_ARRAY | (i << 8));
+
+        for (i = 0; i < 4; i++)
+                __raw_writel(0x0, MMU_ITLB_ADDRESS_ARRAY | (i << 8));
+
+        back_to_cached();
         ctrl_barrier();
         local_irq_restore(flags);
 }
diff --git a/arch/sparc/include/asm/stat.h b/arch/sparc/include/asm/stat.h
index 39327d6a57eb..a232e9e1f4e5 100644
--- a/arch/sparc/include/asm/stat.h
+++ b/arch/sparc/include/asm/stat.h
@@ -53,8 +53,8 @@ struct stat {
         ino_t           st_ino;
         mode_t          st_mode;
         short           st_nlink;
-        uid16_t         st_uid;
-        gid16_t         st_gid;
+        unsigned short  st_uid;
+        unsigned short  st_gid;
         unsigned short  st_rdev;
         off_t           st_size;
         time_t          st_atime;
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 68cb9b42088f..e2771939341d 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -1337,7 +1337,7 @@ static void perf_callchain_user_32(struct pt_regs *regs,
         callchain_store(entry, PERF_CONTEXT_USER);
         callchain_store(entry, regs->tpc);
 
-        ufp = regs->u_regs[UREG_I6];
+        ufp = regs->u_regs[UREG_I6] & 0xffffffffUL;
         do {
                 struct sparc_stackf32 *usf, sf;
                 unsigned long pc;
diff --git a/arch/sparc/kernel/sysfs.c b/arch/sparc/kernel/sysfs.c
index ca39c606fe8e..1eb8b00aed75 100644
--- a/arch/sparc/kernel/sysfs.c
+++ b/arch/sparc/kernel/sysfs.c
@@ -107,12 +107,12 @@ static unsigned long run_on_cpu(unsigned long cpu,
         unsigned long ret;
 
         /* should return -EINVAL to userspace */
-        if (set_cpus_allowed(current, cpumask_of_cpu(cpu)))
+        if (set_cpus_allowed_ptr(current, cpumask_of(cpu)))
                 return 0;
 
         ret = func(arg);
 
-        set_cpus_allowed(current, old_affinity);
+        set_cpus_allowed_ptr(current, &old_affinity);
 
         return ret;
 }
diff --git a/arch/sparc/kernel/us2e_cpufreq.c b/arch/sparc/kernel/us2e_cpufreq.c
index 791c15138f3a..8f982b76c712 100644
--- a/arch/sparc/kernel/us2e_cpufreq.c
+++ b/arch/sparc/kernel/us2e_cpufreq.c
@@ -238,12 +238,12 @@ static unsigned int us2e_freq_get(unsigned int cpu)
                 return 0;
 
         cpus_allowed = current->cpus_allowed;
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
 
         clock_tick = sparc64_get_clock_tick(cpu) / 1000;
         estar = read_hbreg(HBIRD_ESTAR_MODE_ADDR);
 
-        set_cpus_allowed(current, cpus_allowed);
+        set_cpus_allowed_ptr(current, &cpus_allowed);
 
         return clock_tick / estar_to_divisor(estar);
 }
@@ -259,7 +259,7 @@ static void us2e_set_cpu_divider_index(unsigned int cpu, unsigned int index)
                 return;
 
         cpus_allowed = current->cpus_allowed;
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
 
         new_freq = clock_tick = sparc64_get_clock_tick(cpu) / 1000;
         new_bits = index_to_estar_mode(index);
@@ -281,7 +281,7 @@ static void us2e_set_cpu_divider_index(unsigned int cpu, unsigned int index)
 
         cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
 
-        set_cpus_allowed(current, cpus_allowed);
+        set_cpus_allowed_ptr(current, &cpus_allowed);
 }
 
 static int us2e_freq_target(struct cpufreq_policy *policy,
diff --git a/arch/sparc/kernel/us3_cpufreq.c b/arch/sparc/kernel/us3_cpufreq.c
index 365b6464e2ce..f35d1e794548 100644
--- a/arch/sparc/kernel/us3_cpufreq.c
+++ b/arch/sparc/kernel/us3_cpufreq.c
@@ -86,12 +86,12 @@ static unsigned int us3_freq_get(unsigned int cpu)
                 return 0;
 
         cpus_allowed = current->cpus_allowed;
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
 
         reg = read_safari_cfg();
         ret = get_current_freq(cpu, reg);
 
-        set_cpus_allowed(current, cpus_allowed);
+        set_cpus_allowed_ptr(current, &cpus_allowed);
 
         return ret;
 }
@@ -106,7 +106,7 @@ static void us3_set_cpu_divider_index(unsigned int cpu, unsigned int index)
                 return;
 
         cpus_allowed = current->cpus_allowed;
-        set_cpus_allowed(current, cpumask_of_cpu(cpu));
+        set_cpus_allowed_ptr(current, cpumask_of(cpu));
 
         new_freq = sparc64_get_clock_tick(cpu) / 1000;
         switch (index) {
@@ -140,7 +140,7 @@ static void us3_set_cpu_divider_index(unsigned int cpu, unsigned int index)
 
         cpufreq_notify_transition(&freqs, CPUFREQ_POSTCHANGE);
 
-        set_cpus_allowed(current, cpus_allowed);
+        set_cpus_allowed_ptr(current, &cpus_allowed);
 }
 
 static int us3_freq_target(struct cpufreq_policy *policy,
diff --git a/arch/x86/include/asm/fixmap.h b/arch/x86/include/asm/fixmap.h
index 635f03bb4995..d07b44f7d1dc 100644
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -82,6 +82,9 @@ enum fixed_addresses {
 #endif
         FIX_DBGP_BASE,
         FIX_EARLYCON_MEM_BASE,
+#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
+        FIX_OHCI1394_BASE,
+#endif
 #ifdef CONFIG_X86_LOCAL_APIC
         FIX_APIC_BASE,  /* local (CPU) APIC) -- required for SMP or not */
 #endif
@@ -132,9 +135,6 @@ enum fixed_addresses {
            (__end_of_permanent_fixed_addresses & (TOTAL_FIX_BTMAPS - 1))
          : __end_of_permanent_fixed_addresses,
         FIX_BTMAP_BEGIN = FIX_BTMAP_END + TOTAL_FIX_BTMAPS - 1,
-#ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
-        FIX_OHCI1394_BASE,
-#endif
 #ifdef CONFIG_X86_32
         FIX_WP_TEST,
 #endif
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index a929c9ede33d..46c0fe05f230 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -133,6 +133,7 @@ extern void (*__initconst interrupt[NR_VECTORS-FIRST_EXTERNAL_VECTOR])(void);
 
 typedef int vector_irq_t[NR_VECTORS];
 DECLARE_PER_CPU(vector_irq_t, vector_irq);
+extern void setup_vector_irq(int cpu);
 
 #ifdef CONFIG_X86_IO_APIC
 extern void lock_vector_lock(void);
diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
index 1cd58cdbc03f..4604e6a54d36 100644
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -105,6 +105,8 @@
 #define MSR_AMD64_PATCH_LEVEL           0x0000008b
 #define MSR_AMD64_NB_CFG                0xc001001f
 #define MSR_AMD64_PATCH_LOADER          0xc0010020
+#define MSR_AMD64_OSVW_ID_LENGTH        0xc0010140
+#define MSR_AMD64_OSVW_STATUS           0xc0010141
 #define MSR_AMD64_IBSFETCHCTL           0xc0011030
 #define MSR_AMD64_IBSFETCHLINAD         0xc0011031
 #define MSR_AMD64_IBSFETCHPHYSAD        0xc0011032
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index e4e0ddcb1546..463de9a858ad 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1268,6 +1268,14 @@ void __setup_vector_irq(int cpu)
         /* Mark the inuse vectors */
         for_each_irq_desc(irq, desc) {
                 cfg = desc->chip_data;
+
+                /*
+                 * If it is a legacy IRQ handled by the legacy PIC, this cpu
+                 * will be part of the irq_cfg's domain.
+                 */
+                if (irq < legacy_pic->nr_legacy_irqs && !IO_APIC_IRQ(irq))
+                        cpumask_set_cpu(cpu, cfg->domain);
+
                 if (!cpumask_test_cpu(cpu, cfg->domain))
                         continue;
                 vector = cfg->vector;
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 573458f1caf2..b87e0b6970cb 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -348,10 +348,12 @@ static void amd_pmu_cpu_offline(int cpu)
 
         raw_spin_lock(&amd_nb_lock);
 
-        if (--cpuhw->amd_nb->refcnt == 0)
-                kfree(cpuhw->amd_nb);
+        if (cpuhw->amd_nb) {
+                if (--cpuhw->amd_nb->refcnt == 0)
+                        kfree(cpuhw->amd_nb);
 
-        cpuhw->amd_nb = NULL;
+                cpuhw->amd_nb = NULL;
+        }
 
         raw_spin_unlock(&amd_nb_lock);
 }
diff --git a/arch/x86/kernel/head32.c b/arch/x86/kernel/head32.c
index adedeef1dedc..b2e246037392 100644
--- a/arch/x86/kernel/head32.c
+++ b/arch/x86/kernel/head32.c
@@ -7,6 +7,7 @@
 
 #include <linux/init.h>
 #include <linux/start_kernel.h>
+#include <linux/mm.h>
 
 #include <asm/setup.h>
 #include <asm/sections.h>
@@ -44,9 +45,10 @@ void __init i386_start_kernel(void)
 #ifdef CONFIG_BLK_DEV_INITRD
         /* Reserve INITRD */
         if (boot_params.hdr.type_of_loader && boot_params.hdr.ramdisk_image) {
+                /* Assume only end is not page aligned */
                 u64 ramdisk_image = boot_params.hdr.ramdisk_image;
                 u64 ramdisk_size  = boot_params.hdr.ramdisk_size;
-                u64 ramdisk_end   = ramdisk_image + ramdisk_size;
+                u64 ramdisk_end   = PAGE_ALIGN(ramdisk_image + ramdisk_size);
                 reserve_early(ramdisk_image, ramdisk_end, "RAMDISK");
         }
 #endif
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index b5a9896ca1e7..7147143fd614 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -103,9 +103,10 @@ void __init x86_64_start_reservations(char *real_mode_data)
 #ifdef CONFIG_BLK_DEV_INITRD
         /* Reserve INITRD */
         if (boot_params.hdr.type_of_loader && boot_params.hdr.ramdisk_image) {
+                /* Assume only end is not page aligned */
                 unsigned long ramdisk_image = boot_params.hdr.ramdisk_image;
                 unsigned long ramdisk_size  = boot_params.hdr.ramdisk_size;
-                unsigned long ramdisk_end   = ramdisk_image + ramdisk_size;
+                unsigned long ramdisk_end   = PAGE_ALIGN(ramdisk_image + ramdisk_size);
                 reserve_early(ramdisk_image, ramdisk_end, "RAMDISK");
         }
 #endif
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index ef257fc2921b..f01d390f9c5b 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -141,6 +141,28 @@ void __init init_IRQ(void)
         x86_init.irqs.intr_init();
 }
 
+/*
+ * Setup the vector to irq mappings.
+ */
+void setup_vector_irq(int cpu)
+{
+#ifndef CONFIG_X86_IO_APIC
+        int irq;
+
+        /*
+         * On most of the platforms, legacy PIC delivers the interrupts on the
+         * boot cpu. But there are certain platforms where PIC interrupts are
+         * delivered to multiple cpu's. If the legacy IRQ is handled by the
+         * legacy PIC, for the new cpu that is coming online, setup the static
+         * legacy vector to irq mapping:
+         */
+        for (irq = 0; irq < legacy_pic->nr_legacy_irqs; irq++)
+                per_cpu(vector_irq, cpu)[IRQ0_VECTOR + irq] = irq;
+#endif
+
+        __setup_vector_irq(cpu);
+}
+
 static void __init smp_intr_init(void)
 {
 #ifdef CONFIG_SMP
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index ad9540676fcc..28ad9f4d8b94 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -526,21 +526,37 @@ static int __cpuinit mwait_usable(const struct cpuinfo_x86 *c)
 }
 
 /*
- * Check for AMD CPUs, which have potentially C1E support
+ * Check for AMD CPUs, where APIC timer interrupt does not wake up CPU from C1e.
+ * For more information see
+ * - Erratum #400 for NPT family 0xf and family 0x10 CPUs
+ * - Erratum #365 for family 0x11 (not affected because C1e not in use)
  */
 static int __cpuinit check_c1e_idle(const struct cpuinfo_x86 *c)
 {
+        u64 val;
         if (c->x86_vendor != X86_VENDOR_AMD)
-                return 0;
-
-        if (c->x86 < 0x0F)
-                return 0;
+                goto no_c1e_idle;
 
         /* Family 0x0f models < rev F do not have C1E */
-        if (c->x86 == 0x0f && c->x86_model < 0x40)
-                return 0;
+        if (c->x86 == 0x0F && c->x86_model >= 0x40)
+                return 1;
 
-        return 1;
+        if (c->x86 == 0x10) {
+                /*
+                 * check OSVW bit for CPUs that are not affected
+                 * by erratum #400
+                 */
+                rdmsrl(MSR_AMD64_OSVW_ID_LENGTH, val);
+                if (val >= 2) {
+                        rdmsrl(MSR_AMD64_OSVW_STATUS, val);
+                        if (!(val & BIT(1)))
+                                goto no_c1e_idle;
+                }
+                return 1;
+        }
+
+no_c1e_idle:
+        return 0;
 }
 
 static cpumask_var_t c1e_mask;
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 5d7ba1a449bd..d76e18570c60 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -314,16 +314,17 @@ static void __init reserve_brk(void)
 #define MAX_MAP_CHUNK   (NR_FIX_BTMAPS << PAGE_SHIFT)
 static void __init relocate_initrd(void)
 {
-
+        /* Assume only end is not page aligned */
         u64 ramdisk_image = boot_params.hdr.ramdisk_image;
         u64 ramdisk_size  = boot_params.hdr.ramdisk_size;
+        u64 area_size     = PAGE_ALIGN(ramdisk_size);
         u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
         u64 ramdisk_here;
         unsigned long slop, clen, mapaddr;
         char *p, *q;
 
         /* We need to move the initrd down into lowmem */
-        ramdisk_here = find_e820_area(0, end_of_lowmem, ramdisk_size,
+        ramdisk_here = find_e820_area(0, end_of_lowmem, area_size,
                                          PAGE_SIZE);
 
         if (ramdisk_here == -1ULL)
@@ -332,7 +333,7 @@ static void __init relocate_initrd(void)
 
         /* Note: this includes all the lowmem currently occupied by
            the initrd, we rely on that fact to keep the data intact. */
-        reserve_early(ramdisk_here, ramdisk_here + ramdisk_size,
+        reserve_early(ramdisk_here, ramdisk_here + area_size,
                          "NEW RAMDISK");
         initrd_start = ramdisk_here + PAGE_OFFSET;
         initrd_end   = initrd_start + ramdisk_size;
@@ -376,9 +377,10 @@ static void __init relocate_initrd(void)
 
 static void __init reserve_initrd(void)
 {
+        /* Assume only end is not page aligned */
         u64 ramdisk_image = boot_params.hdr.ramdisk_image;
         u64 ramdisk_size  = boot_params.hdr.ramdisk_size;
-        u64 ramdisk_end   = ramdisk_image + ramdisk_size;
+        u64 ramdisk_end   = PAGE_ALIGN(ramdisk_image + ramdisk_size);
         u64 end_of_lowmem = max_low_pfn_mapped << PAGE_SHIFT;
 
         if (!boot_params.hdr.type_of_loader ||
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index a02e80c3c54b..06d98ae5a802 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -247,7 +247,7 @@ static void __cpuinit smp_callin(void)
         /*
          * Need to setup vector mappings before we enable interrupts.
          */
-        __setup_vector_irq(smp_processor_id());
+        setup_vector_irq(smp_processor_id());
         /*
          * Get our bogomips.
          *
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 44879df55696..2cc249718c46 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -291,8 +291,8 @@ SECTIONS
         .smp_locks : AT(ADDR(.smp_locks) - LOAD_OFFSET) {
                 __smp_locks = .;
                 *(.smp_locks)
-                __smp_locks_end = .;
                 . = ALIGN(PAGE_SIZE);
+                __smp_locks_end = .;
         }
 
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index e71c5cbc8f35..452ee5b8f309 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -331,11 +331,23 @@ int devmem_is_allowed(unsigned long pagenr)
 
 void free_init_pages(char *what, unsigned long begin, unsigned long end)
 {
-        unsigned long addr = begin;
+        unsigned long addr;
+        unsigned long begin_aligned, end_aligned;
 
-        if (addr >= end)
+        /* Make sure boundaries are page aligned */
+        begin_aligned = PAGE_ALIGN(begin);
+        end_aligned   = end & PAGE_MASK;
+
+        if (WARN_ON(begin_aligned != begin || end_aligned != end)) {
+                begin = begin_aligned;
+                end   = end_aligned;
+        }
+
+        if (begin >= end)
                 return;
 
+        addr = begin;
+
         /*
          * If debugging page accesses then do not free this memory but
          * mark them not present - any buggy init-section access will
@@ -343,7 +355,7 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
          */
 #ifdef CONFIG_DEBUG_PAGEALLOC
         printk(KERN_INFO "debug: unmapping init memory %08lx..%08lx\n",
-                begin, PAGE_ALIGN(end));
+                begin, end);
         set_memory_np(begin, (end - begin) >> PAGE_SHIFT);
 #else
         /*
@@ -358,8 +370,7 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
         for (; addr < end; addr += PAGE_SIZE) {
                 ClearPageReserved(virt_to_page(addr));
                 init_page_count(virt_to_page(addr));
-                memset((void *)(addr & ~(PAGE_SIZE-1)),
-                        POISON_FREE_INITMEM, PAGE_SIZE);
+                memset((void *)addr, POISON_FREE_INITMEM, PAGE_SIZE);
                 free_page(addr);
                 totalram_pages++;
         }
@@ -376,6 +387,15 @@ void free_initmem(void)
 #ifdef CONFIG_BLK_DEV_INITRD
 void free_initrd_mem(unsigned long start, unsigned long end)
 {
-        free_init_pages("initrd memory", start, end);
+        /*
+         * end could be not aligned, and We can not align that,
+         * decompresser could be confused by aligned initrd_end
+         * We already reserve the end partial page before in
+         *   - i386_start_kernel()
+         *   - x86_64_start_kernel()
+         *   - relocate_initrd()
+         * So here We can do PAGE_ALIGN() safely to get partial page to be freed
+         */
+        free_init_pages("initrd memory", start, PAGE_ALIGN(end));
 }
 #endif
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 6e22454bfaa6..e31160216efb 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -122,8 +122,8 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
         struct acpi_resource_address64 addr;
         acpi_status status;
         unsigned long flags;
-        struct resource *root;
-        u64 start, end;
+        struct resource *root, *conflict;
+        u64 start, end, max_len;
 
         status = resource_to_addr(acpi_res, &addr);
         if (!ACPI_SUCCESS(status))
@@ -140,6 +140,17 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
         } else
                 return AE_OK;
 
+        max_len = addr.maximum - addr.minimum + 1;
+        if (addr.address_length > max_len) {
+                dev_printk(KERN_DEBUG, &info->bridge->dev,
+                           "host bridge window length %#llx doesn't fit in "
+                           "%#llx-%#llx, trimming\n",
+                           (unsigned long long) addr.address_length,
+                           (unsigned long long) addr.minimum,
+                           (unsigned long long) addr.maximum);
+                addr.address_length = max_len;
+        }
+
         start = addr.minimum + addr.translation_offset;
         end = start + addr.address_length - 1;
 
@@ -157,9 +168,12 @@ setup_resource(struct acpi_resource *acpi_res, void *data)
                 return AE_OK;
         }
 
-        if (insert_resource(root, res)) {
+        conflict = insert_resource_conflict(root, res);
+        if (conflict) {
                 dev_err(&info->bridge->dev,
-                        "can't allocate host bridge window %pR\n", res);
+                        "address space collision: host bridge window %pR "
+                        "conflicts with %s %pR\n",
+                        res, conflict->name, conflict);
         } else {
                 pci_bus_add_resource(info->bus, res, 0);
                 info->res_num++;
diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
index dece3eb9c906..46fd43f79103 100644
--- a/arch/x86/pci/i386.c
+++ b/arch/x86/pci/i386.c
@@ -127,9 +127,6 @@ static void __init pcibios_allocate_bus_resources(struct list_head *bus_list)
                                         continue;
                                 if (!r->start ||
                                     pci_claim_resource(dev, idx) < 0) {
-                                        dev_info(&dev->dev,
-                                                 "can't reserve window %pR\n",
-                                                 r);
                                         /*
                                          * Something is wrong with the region.
                                          * Invalidate the resource to prevent
@@ -181,8 +178,6 @@ static void __init pcibios_allocate_resources(int pass)
                                         "BAR %d: reserving %pr (d=%d, p=%d)\n",
                                         idx, r, disabled, pass);
                                 if (pci_claim_resource(dev, idx) < 0) {
-                                        dev_info(&dev->dev,
-                                                 "can't reserve %pR\n", r);
                                         /* We'll assign a new address later */
                                         r->end -= r->start;
                                         r->start = 0;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index fb7fc24fe727..189cbc2585fa 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -8,6 +8,7 @@
 #include <linux/acpi.h>
 #include <linux/signal.h>
 #include <linux/kthread.h>
+#include <linux/dmi.h>
 
 #include <acpi/acpi_drivers.h>
 
@@ -1032,6 +1033,41 @@ static void acpi_add_id(struct acpi_device *device, const char *dev_id)
         list_add_tail(&id->list, &device->pnp.ids);
 }
 
+/*
+ * Old IBM workstations have a DSDT bug wherein the SMBus object
+ * lacks the SMBUS01 HID and the methods do not have the necessary "_"
+ * prefix.  Work around this.
+ */
+static int acpi_ibm_smbus_match(struct acpi_device *device)
+{
+        acpi_handle h_dummy;
+        struct acpi_buffer path = {ACPI_ALLOCATE_BUFFER, NULL};
+        int result;
+
+        if (!dmi_name_in_vendors("IBM"))
+                return -ENODEV;
+
+        /* Look for SMBS object */
+        result = acpi_get_name(device->handle, ACPI_SINGLE_NAME, &path);
+        if (result)
+                return result;
+
+        if (strcmp("SMBS", path.pointer)) {
+                result = -ENODEV;
+                goto out;
+        }
+
+        /* Does it have the necessary (but misnamed) methods? */
+        result = -ENODEV;
+        if (ACPI_SUCCESS(acpi_get_handle(device->handle, "SBI", &h_dummy)) &&
+            ACPI_SUCCESS(acpi_get_handle(device->handle, "SBR", &h_dummy)) &&
+            ACPI_SUCCESS(acpi_get_handle(device->handle, "SBW", &h_dummy)))
+                result = 0;
+out:
+        kfree(path.pointer);
+        return result;
+}
+
 static void acpi_device_set_id(struct acpi_device *device)
 {
         acpi_status status;
@@ -1082,6 +1118,8 @@ static void acpi_device_set_id(struct acpi_device *device)
                         acpi_add_id(device, ACPI_BAY_HID);
                 else if (ACPI_SUCCESS(acpi_dock_match(device)))
                         acpi_add_id(device, ACPI_DOCK_HID);
+                else if (!acpi_ibm_smbus_match(device))
+                        acpi_add_id(device, ACPI_SMBUS_IBM_HID);
 
                 break;
         case ACPI_BUS_TYPE_POWER:
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 561dec2481cb..277477251a86 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1667,6 +1667,7 @@ unsigned int ata_sff_host_intr(struct ata_port *ap,
 {
         struct ata_eh_info *ehi = &ap->link.eh_info;
         u8 status, host_stat = 0;
+        bool bmdma_stopped = false;
 
         VPRINTK("ata%u: protocol %d task_state %d\n",
                 ap->print_id, qc->tf.protocol, ap->hsm_task_state);
@@ -1699,6 +1700,7 @@ unsigned int ata_sff_host_intr(struct ata_port *ap,
 
                         /* before we do anything else, clear DMA-Start bit */
                         ap->ops->bmdma_stop(qc);
+                        bmdma_stopped = true;
 
                         if (unlikely(host_stat & ATA_DMA_ERR)) {
                                 /* error when transfering data to/from memory */
@@ -1716,8 +1718,14 @@ unsigned int ata_sff_host_intr(struct ata_port *ap,
 
         /* check main status, clearing INTRQ if needed */
         status = ata_sff_irq_status(ap);
-        if (status & ATA_BUSY)
-                goto idle_irq;
+        if (status & ATA_BUSY) {
+                if (bmdma_stopped) {
+                        /* BMDMA engine is already stopped, we're screwed */
+                        qc->err_mask |= AC_ERR_HSM;
+                        ap->hsm_task_state = HSM_ST_ERR;
+                } else
+                        goto idle_irq;
+        }
 
         /* ack bmdma irq events */
         ap->ops->sff_irq_clear(ap);
@@ -1762,13 +1770,16 @@ EXPORT_SYMBOL_GPL(ata_sff_host_intr);
 irqreturn_t ata_sff_interrupt(int irq, void *dev_instance)
 {
         struct ata_host *host = dev_instance;
+        bool retried = false;
         unsigned int i;
-        unsigned int handled = 0, polling = 0;
+        unsigned int handled, idle, polling;
         unsigned long flags;
 
         /* TODO: make _irqsave conditional on x86 PCI IDE legacy mode */
         spin_lock_irqsave(&host->lock, flags);
 
+retry:
+        handled = idle = polling = 0;
         for (i = 0; i < host->n_ports; i++) {
                 struct ata_port *ap = host->ports[i];
                 struct ata_queued_cmd *qc;
@@ -1782,7 +1793,8 @@ irqreturn_t ata_sff_interrupt(int irq, void *dev_instance)
                                 handled |= ata_sff_host_intr(ap, qc);
                         else
                                 polling |= 1 << i;
-                }
+                } else
+                        idle |= 1 << i;
         }
 
         /*
@@ -1790,7 +1802,9 @@ irqreturn_t ata_sff_interrupt(int irq, void *dev_instance)
          * asserting IRQ line, nobody cared will ensue.  Check IRQ
          * pending status if available and clear spurious IRQ.
          */
-        if (!handled) {
+        if (!handled && !retried) {
+                bool retry = false;
+
                 for (i = 0; i < host->n_ports; i++) {
                         struct ata_port *ap = host->ports[i];
 
@@ -1805,8 +1819,23 @@ irqreturn_t ata_sff_interrupt(int irq, void *dev_instance)
                                 ata_port_printk(ap, KERN_INFO,
                                                 "clearing spurious IRQ\n");
 
-                        ap->ops->sff_check_status(ap);
-                        ap->ops->sff_irq_clear(ap);
+                        if (idle & (1 << i)) {
+                                ap->ops->sff_check_status(ap);
+                                ap->ops->sff_irq_clear(ap);
+                        } else {
+                                /* clear INTRQ and check if BUSY cleared */
+                                if (!(ap->ops->sff_check_status(ap) & ATA_BUSY))
+                                        retry |= true;
+                                /*
+                                 * With command in flight, we can't do
+                                 * sff_irq_clear() w/o racing with completion.
+                                 */
+                        }
+                }
+
+                if (retry) {
+                        retried = true;
+                        goto retry;
                 }
         }
 
diff --git a/drivers/ata/pata_via.c b/drivers/ata/pata_via.c
index 3059ec017de3..c59b40710fbd 100644
--- a/drivers/ata/pata_via.c
+++ b/drivers/ata/pata_via.c
@@ -576,6 +576,10 @@ static int via_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
                         u8 rev = isa->revision;
                         pci_dev_put(isa);
 
+                        if ((id->device == 0x0415 || id->device == 0x3164) &&
+                            (config->id != id->device))
+                                continue;
+
                         if (rev >= config->rev_min && rev <= config->rev_max)
                                 break;
                 }
@@ -677,6 +681,7 @@ static const struct pci_device_id via[] = {
         { PCI_VDEVICE(VIA, 0x3164), },
         { PCI_VDEVICE(VIA, 0x5324), },
         { PCI_VDEVICE(VIA, 0xC409), VIA_IDFLAG_SINGLE },
+        { PCI_VDEVICE(VIA, 0x9001), VIA_IDFLAG_SINGLE },
 
         { },
 };
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index d477f4dc5e51..941fcb87e52a 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -439,8 +439,23 @@ static int device_resume_noirq(struct device *dev, pm_message_t state)
         if (dev->bus && dev->bus->pm) {
                 pm_dev_dbg(dev, state, "EARLY ");
                 error = pm_noirq_op(dev, dev->bus->pm, state);
+                if (error)
+                        goto End;
         }
 
+        if (dev->type && dev->type->pm) {
+                pm_dev_dbg(dev, state, "EARLY type ");
+                error = pm_noirq_op(dev, dev->type->pm, state);
+                if (error)
+                        goto End;
+        }
+
+        if (dev->class && dev->class->pm) {
+                pm_dev_dbg(dev, state, "EARLY class ");
+                error = pm_noirq_op(dev, dev->class->pm, state);
+        }
+
+End:
         TRACE_RESUME(error);
         return error;
 }
@@ -735,10 +750,26 @@ static int device_suspend_noirq(struct device *dev, pm_message_t state)
 {
         int error = 0;
 
+        if (dev->class && dev->class->pm) {
+                pm_dev_dbg(dev, state, "LATE class ");
+                error = pm_noirq_op(dev, dev->class->pm, state);
+                if (error)
+                        goto End;
+        }
+
+        if (dev->type && dev->type->pm) {
+                pm_dev_dbg(dev, state, "LATE type ");
+                error = pm_noirq_op(dev, dev->type->pm, state);
+                if (error)
+                        goto End;
+        }
+
         if (dev->bus && dev->bus->pm) {
                 pm_dev_dbg(dev, state, "LATE ");
                 error = pm_noirq_op(dev, dev->bus->pm, state);
         }
+
+End:
         return error;
 }
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index a3e10dc7cc25..b78d5c381efe 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -97,6 +97,9 @@ EXPORT_SYMBOL(intel_agp_enabled);
 #define IS_PINEVIEW (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_M_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_PINEVIEW_HB)
 
+#define IS_SNB (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
+                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
+
 #define IS_G4X (agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_EAGLELAKE_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_Q45_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_G45_HB || \
@@ -107,8 +110,7 @@ EXPORT_SYMBOL(intel_agp_enabled);
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB || \
                 agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB || \
-                agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB)
+                IS_SNB)
 
 extern int agp_memory_reserved;
 
@@ -175,6 +177,10 @@ extern int agp_memory_reserved;
 #define SNB_GMCH_GMS_STOLEN_448M        (0xe << 3)
 #define SNB_GMCH_GMS_STOLEN_480M        (0xf << 3)
 #define SNB_GMCH_GMS_STOLEN_512M        (0x10 << 3)
+#define SNB_GTT_SIZE_0M                 (0 << 8)
+#define SNB_GTT_SIZE_1M                 (1 << 8)
+#define SNB_GTT_SIZE_2M                 (2 << 8)
+#define SNB_GTT_SIZE_MASK               (3 << 8)
 
 static const struct aper_size_info_fixed intel_i810_sizes[] =
 {
@@ -1200,6 +1206,9 @@ static void intel_i9xx_setup_flush(void)
         if (intel_private.ifp_resource.start)
                 return;
 
+        if (IS_SNB)
+                return;
+
         /* setup a resource for this object */
         intel_private.ifp_resource.name = "Intel Flush Page";
         intel_private.ifp_resource.flags = IORESOURCE_MEM;
@@ -1438,6 +1447,8 @@ static unsigned long intel_i965_mask_memory(struct agp_bridge_data *bridge,
 
 static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
 {
+        u16 snb_gmch_ctl;
+
         switch (agp_bridge->dev->device) {
         case PCI_DEVICE_ID_INTEL_GM45_HB:
         case PCI_DEVICE_ID_INTEL_EAGLELAKE_HB:
@@ -1449,9 +1460,26 @@ static void intel_i965_get_gtt_range(int *gtt_offset, int *gtt_size)
         case PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB:
         case PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB:
         case PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB:
+                *gtt_offset = *gtt_size = MB(2);
+                break;
         case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB:
         case PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB:
-                *gtt_offset = *gtt_size = MB(2);
+                *gtt_offset = MB(2);
+
+                pci_read_config_word(intel_private.pcidev, SNB_GMCH_CTRL, &snb_gmch_ctl);
+                switch (snb_gmch_ctl & SNB_GTT_SIZE_MASK) {
+                default:
+                case SNB_GTT_SIZE_0M:
+                        printk(KERN_ERR "Bad GTT size mask: 0x%04x.\n", snb_gmch_ctl);
+                        *gtt_size = MB(0);
+                        break;
+                case SNB_GTT_SIZE_1M:
+                        *gtt_size = MB(1);
+                        break;
+                case SNB_GTT_SIZE_2M:
+                        *gtt_size = MB(2);
+                        break;
+                }
                 break;
         default:
                 *gtt_offset = *gtt_size = KB(512);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index f404ccfc9c20..44288ce0cb45 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -681,6 +681,10 @@ static void resize_console(struct port *port)
         struct virtio_device *vdev;
         struct winsize ws;
 
+        /* The port could have been hot-unplugged */
+        if (!port)
+                return;
+
         vdev = port->portdev->vdev;
         if (virtio_has_feature(vdev, VIRTIO_CONSOLE_F_SIZE)) {
                 vdev->config->get(vdev,
@@ -947,11 +951,18 @@ static void handle_control_message(struct ports_device *portdev,
                  */
                 err = sysfs_create_group(&port->dev->kobj,
                                          &port_attribute_group);
-                if (err)
+                if (err) {
                         dev_err(port->dev,
                                 "Error %d creating sysfs device attributes\n",
                                 err);
-
+                } else {
+                        /*
+                         * Generate a udev event so that appropriate
+                         * symlinks can be created based on udev
+                         * rules.
+                         */
+                        kobject_uevent(&port->dev->kobj, KOBJ_CHANGE);
+                }
                 break;
         case VIRTIO_CONSOLE_PORT_REMOVE:
                 /*
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index 8fc91a019620..f5b6d9fe4def 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -316,7 +316,12 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
                 if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
                         pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
         } else {
-                pr_cont(", core: %d\n", fls((regs->nbsh & 0xf) - 1));
+                u8 assoc_cpus = regs->nbsh & 0xf;
+
+                if (assoc_cpus > 0)
+                        pr_cont(", core: %d", fls(assoc_cpus) - 1);
+
+                pr_cont("\n");
         }
 
         pr_emerg("%s.\n", EXT_ERR_MSG(xec));
diff --git a/drivers/firewire/core-device.c b/drivers/firewire/core-device.c
index 5db0518c66da..882472d1e144 100644
--- a/drivers/firewire/core-device.c
+++ b/drivers/firewire/core-device.c
@@ -126,97 +126,74 @@ int fw_csr_string(const u32 *directory, int key, char *buf, size_t size)
 }
 EXPORT_SYMBOL(fw_csr_string);
 
-static bool is_fw_unit(struct device *dev);
-
-static int match_unit_directory(const u32 *directory, u32 match_flags,
-                                const struct ieee1394_device_id *id)
+static void get_ids(const u32 *directory, int *id)
 {
         struct fw_csr_iterator ci;
-        int key, value, match;
+        int key, value;
 
-        match = 0;
         fw_csr_iterator_init(&ci, directory);
         while (fw_csr_iterator_next(&ci, &key, &value)) {
-                if (key == CSR_VENDOR && value == id->vendor_id)
-                        match |= IEEE1394_MATCH_VENDOR_ID;
-                if (key == CSR_MODEL && value == id->model_id)
-                        match |= IEEE1394_MATCH_MODEL_ID;
-                if (key == CSR_SPECIFIER_ID && value == id->specifier_id)
-                        match |= IEEE1394_MATCH_SPECIFIER_ID;
-                if (key == CSR_VERSION && value == id->version)
-                        match |= IEEE1394_MATCH_VERSION;
+                switch (key) {
+                case CSR_VENDOR:        id[0] = value; break;
+                case CSR_MODEL:         id[1] = value; break;
+                case CSR_SPECIFIER_ID:  id[2] = value; break;
+                case CSR_VERSION:       id[3] = value; break;
+                }
         }
+}
+
+static void get_modalias_ids(struct fw_unit *unit, int *id)
+{
+        get_ids(&fw_parent_device(unit)->config_rom[5], id);
+        get_ids(unit->directory, id);
+}
+
+static bool match_ids(const struct ieee1394_device_id *id_table, int *id)
+{
+        int match = 0;
+
+        if (id[0] == id_table->vendor_id)
+                match |= IEEE1394_MATCH_VENDOR_ID;
+        if (id[1] == id_table->model_id)
+                match |= IEEE1394_MATCH_MODEL_ID;
+        if (id[2] == id_table->specifier_id)
+                match |= IEEE1394_MATCH_SPECIFIER_ID;
+        if (id[3] == id_table->version)
+                match |= IEEE1394_MATCH_VERSION;
 
-        return (match & match_flags) == match_flags;
+        return (match & id_table->match_flags) == id_table->match_flags;
 }
 
+static bool is_fw_unit(struct device *dev);
+
 static int fw_unit_match(struct device *dev, struct device_driver *drv)
 {
-        struct fw_unit *unit = fw_unit(dev);
-        struct fw_device *device;
-        const struct ieee1394_device_id *id;
+        const struct ieee1394_device_id *id_table =
+                        container_of(drv, struct fw_driver, driver)->id_table;
+        int id[] = {0, 0, 0, 0};
 
         /* We only allow binding to fw_units. */
         if (!is_fw_unit(dev))
                 return 0;
 
-        device = fw_parent_device(unit);
-        id = container_of(drv, struct fw_driver, driver)->id_table;
+        get_modalias_ids(fw_unit(dev), id);
 
-        for (; id->match_flags != 0; id++) {
-                if (match_unit_directory(unit->directory, id->match_flags, id))
+        for (; id_table->match_flags != 0; id_table++)
+                if (match_ids(id_table, id))
                         return 1;
 
-                /* Also check vendor ID in the root directory. */
-                if ((id->match_flags & IEEE1394_MATCH_VENDOR_ID) &&
-                    match_unit_directory(&device->config_rom[5],
-                                IEEE1394_MATCH_VENDOR_ID, id) &&
-                    match_unit_directory(unit->directory, id->match_flags
-                                & ~IEEE1394_MATCH_VENDOR_ID, id))
-                        return 1;
-        }
-
         return 0;
 }
 
 static int get_modalias(struct fw_unit *unit, char *buffer, size_t buffer_size)
 {
-        struct fw_device *device = fw_parent_device(unit);
-        struct fw_csr_iterator ci;
+        int id[] = {0, 0, 0, 0};
 
-        int key, value;
-        int vendor = 0;
-        int model = 0;
-        int specifier_id = 0;
-        int version = 0;
-
-        fw_csr_iterator_init(&ci, &device->config_rom[5]);
-        while (fw_csr_iterator_next(&ci, &key, &value)) {
-                switch (key) {
-                case CSR_VENDOR:
-                        vendor = value;
-                        break;
-                case CSR_MODEL:
-                        model = value;
-                        break;
-                }
-        }
-
-        fw_csr_iterator_init(&ci, unit->directory);
-        while (fw_csr_iterator_next(&ci, &key, &value)) {
-                switch (key) {
-                case CSR_SPECIFIER_ID:
-                        specifier_id = value;
-                        break;
-                case CSR_VERSION:
-                        version = value;
-                        break;
-                }
-        }
+        get_modalias_ids(unit, id);
 
         return snprintf(buffer, buffer_size,
                         "ieee1394:ven%08Xmo%08Xsp%08Xver%08X",
-                        vendor, model, specifier_id, version);
+                        id[0], id[1], id[2], id[3]);
 }
 
 static int fw_unit_uevent(struct device *dev, struct kobj_uevent_env *env)
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 1c0b504a42f3..99c20f1b613a 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -331,8 +331,9 @@ void fw_iso_resource_manage(struct fw_card *card, int generation,
         if (ret < 0)
                 *bandwidth = 0;
 
-        if (allocate && ret < 0 && c >= 0) {
-                deallocate_channel(card, irm_id, generation, c, buffer);
+        if (allocate && ret < 0) {
+                if (c >= 0)
+                        deallocate_channel(card, irm_id, generation, c, buffer);
                 *channel = ret;
         }
 }
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 75dc6988cffd..e33917bf97d2 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -231,6 +231,8 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
 
 static char ohci_driver_name[] = KBUILD_MODNAME;
 
+#define PCI_DEVICE_ID_TI_TSB12LV22      0x8009
+
 #define QUIRK_CYCLE_TIMER               1
 #define QUIRK_RESET_PACKET              2
 #define QUIRK_BE_HEADERS                4
@@ -239,6 +241,8 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 static const struct {
         unsigned short vendor, device, flags;
 } ohci_quirks[] = {
+        {PCI_VENDOR_ID_TI,      PCI_DEVICE_ID_TI_TSB12LV22, QUIRK_CYCLE_TIMER |
+                                                            QUIRK_RESET_PACKET},
         {PCI_VENDOR_ID_TI,      PCI_ANY_ID,     QUIRK_RESET_PACKET},
         {PCI_VENDOR_ID_AL,      PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
         {PCI_VENDOR_ID_NEC,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
diff --git a/drivers/gpio/max730x.c b/drivers/gpio/max730x.c
index c9bced55f82b..4a7d662ff9b7 100644
--- a/drivers/gpio/max730x.c
+++ b/drivers/gpio/max730x.c
@@ -242,3 +242,7 @@ int __devexit __max730x_remove(struct device *dev)
         return ret;
 }
 EXPORT_SYMBOL_GPL(__max730x_remove);
+
+MODULE_AUTHOR("Juergen Beisert, Wolfram Sang");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("MAX730x GPIO-Expanders, generic parts");
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 8bfc0bbf13e6..a9f8589490cf 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1881,29 +1881,29 @@ struct drm_ioctl_desc i915_ioctls[] = {
         DRM_IOCTL_DEF(DRM_I915_GET_VBLANK_PIPE,  i915_vblank_pipe_get, DRM_AUTH ),
         DRM_IOCTL_DEF(DRM_I915_VBLANK_SWAP, i915_vblank_swap, DRM_AUTH),
         DRM_IOCTL_DEF(DRM_I915_HWS_ADDR, i915_set_status_page, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_INIT, i915_gem_init_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER, i915_gem_execbuffer, DRM_AUTH),
-        DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER2, i915_gem_execbuffer2, DRM_AUTH),
-        DRM_IOCTL_DEF(DRM_I915_GEM_PIN, i915_gem_pin_ioctl, DRM_AUTH|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_UNPIN, i915_gem_unpin_ioctl, DRM_AUTH|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_BUSY, i915_gem_busy_ioctl, DRM_AUTH),
-        DRM_IOCTL_DEF(DRM_I915_GEM_THROTTLE, i915_gem_throttle_ioctl, DRM_AUTH),
-        DRM_IOCTL_DEF(DRM_I915_GEM_ENTERVT, i915_gem_entervt_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_LEAVEVT, i915_gem_leavevt_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY),
-        DRM_IOCTL_DEF(DRM_I915_GEM_CREATE, i915_gem_create_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_PREAD, i915_gem_pread_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_PWRITE, i915_gem_pwrite_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_MMAP, i915_gem_mmap_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_MMAP_GTT, i915_gem_mmap_gtt_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_SET_DOMAIN, i915_gem_set_domain_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_SET_TILING, i915_gem_set_tiling, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_GET_TILING, i915_gem_get_tiling, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
-        DRM_IOCTL_DEF(DRM_I915_GEM_MADVISE, i915_gem_madvise_ioctl, 0),
-        DRM_IOCTL_DEF(DRM_I915_OVERLAY_PUT_IMAGE, intel_overlay_put_image, DRM_MASTER|DRM_CONTROL_ALLOW),
-        DRM_IOCTL_DEF(DRM_I915_OVERLAY_ATTRS, intel_overlay_attrs, DRM_MASTER|DRM_CONTROL_ALLOW),
+        DRM_IOCTL_DEF(DRM_I915_GEM_INIT, i915_gem_init_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER, i915_gem_execbuffer, DRM_AUTH|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_EXECBUFFER2, i915_gem_execbuffer2, DRM_AUTH|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_PIN, i915_gem_pin_ioctl, DRM_AUTH|DRM_ROOT_ONLY|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_UNPIN, i915_gem_unpin_ioctl, DRM_AUTH|DRM_ROOT_ONLY|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_BUSY, i915_gem_busy_ioctl, DRM_AUTH|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_THROTTLE, i915_gem_throttle_ioctl, DRM_AUTH|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_ENTERVT, i915_gem_entervt_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_LEAVEVT, i915_gem_leavevt_ioctl, DRM_AUTH|DRM_MASTER|DRM_ROOT_ONLY|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_CREATE, i915_gem_create_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_PREAD, i915_gem_pread_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_PWRITE, i915_gem_pwrite_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_MMAP, i915_gem_mmap_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_MMAP_GTT, i915_gem_mmap_gtt_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_SET_DOMAIN, i915_gem_set_domain_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_SW_FINISH, i915_gem_sw_finish_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_SET_TILING, i915_gem_set_tiling, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_GET_TILING, i915_gem_get_tiling, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_GEM_MADVISE, i915_gem_madvise_ioctl, DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_OVERLAY_PUT_IMAGE, intel_overlay_put_image, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
+        DRM_IOCTL_DEF(DRM_I915_OVERLAY_ATTRS, intel_overlay_attrs, DRM_MASTER|DRM_CONTROL_ALLOW|DRM_UNLOCKED),
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 1b2e95455c05..4b26919abdb2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -139,12 +139,12 @@ const static struct intel_device_info intel_ironlake_m_info = {
 
 const static struct intel_device_info intel_sandybridge_d_info = {
         .is_i965g = 1, .is_i9xx = 1, .need_gfx_hws = 1,
-        .has_hotplug = 1,
+        .has_hotplug = 1, .is_gen6 = 1,
 };
 
 const static struct intel_device_info intel_sandybridge_m_info = {
         .is_i965g = 1, .is_mobile = 1, .is_i9xx = 1, .need_gfx_hws = 1,
-        .has_hotplug = 1,
+        .has_hotplug = 1, .is_gen6 = 1,
 };
 
 const static struct pci_device_id pciidlist[] = {
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 979439cfb827..aba8260fbc5e 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -205,6 +205,7 @@ struct intel_device_info {
         u8 is_g4x : 1;
         u8 is_pineview : 1;
         u8 is_ironlake : 1;
+        u8 is_gen6 : 1;
         u8 has_fbc : 1;
         u8 has_rc6 : 1;
         u8 has_pipe_cxsr : 1;
@@ -1084,6 +1085,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define IS_IRONLAKE_M(dev)      ((dev)->pci_device == 0x0046)
 #define IS_IRONLAKE(dev)        (INTEL_INFO(dev)->is_ironlake)
 #define IS_I9XX(dev)            (INTEL_INFO(dev)->is_i9xx)
+#define IS_GEN6(dev)            (INTEL_INFO(dev)->is_gen6)
 #define IS_MOBILE(dev)          (INTEL_INFO(dev)->is_mobile)
 
 #define IS_GEN3(dev)    (IS_I915G(dev) ||                       \
@@ -1107,8 +1109,6 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 
 #define I915_NEED_GFX_HWS(dev)  (INTEL_INFO(dev)->need_gfx_hws)
 
-#define IS_GEN6(dev)    ((dev)->pci_device == 0x0102)
-
 /* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
  * rows, which changed the alignment requirements and fence programming.
  */
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index fba37e9f775d..933e865a8929 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1466,9 +1466,6 @@ i915_gem_object_put_pages(struct drm_gem_object *obj)
                 obj_priv->dirty = 0;
 
         for (i = 0; i < page_count; i++) {
-                if (obj_priv->pages[i] == NULL)
-                        break;
-
                 if (obj_priv->dirty)
                         set_page_dirty(obj_priv->pages[i]);
 
@@ -2227,11 +2224,6 @@ i915_gem_evict_something(struct drm_device *dev, int min_size)
                                 seqno = i915_add_request(dev, NULL, obj->write_domain);
                                 if (seqno == 0)
                                         return -ENOMEM;
-
-                                ret = i915_wait_request(dev, seqno);
-                                if (ret)
-                                        return ret;
-
                                 continue;
                         }
                 }
@@ -2256,7 +2248,6 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
         struct address_space *mapping;
         struct inode *inode;
         struct page *page;
-        int ret;
 
         if (obj_priv->pages_refcount++ != 0)
                 return 0;
@@ -2279,11 +2270,9 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
                                            mapping_gfp_mask (mapping) |
                                            __GFP_COLD |
                                            gfpmask);
-                if (IS_ERR(page)) {
-                        ret = PTR_ERR(page);
-                        i915_gem_object_put_pages(obj);
-                        return ret;
-                }
+                if (IS_ERR(page))
+                        goto err_pages;
+
                 obj_priv->pages[i] = page;
         }
 
@@ -2291,6 +2280,15 @@ i915_gem_object_get_pages(struct drm_gem_object *obj,
                 i915_gem_object_do_bit_17_swizzle(obj);
 
         return 0;
+
+err_pages:
+        while (i--)
+                page_cache_release(obj_priv->pages[i]);
+
+        drm_free_large(obj_priv->pages);
+        obj_priv->pages = NULL;
+        obj_priv->pages_refcount--;
+        return PTR_ERR(page);
 }
 
 static void sandybridge_write_fence_reg(struct drm_i915_fence_reg *reg)
@@ -4730,6 +4728,11 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
                         ring->space += ring->Size;
         }
 
+        if (IS_I9XX(dev) && !IS_GEN3(dev)) {
+                I915_WRITE(MI_MODE,
+                           (VS_TIMER_DISPATCH) << 16 | VS_TIMER_DISPATCH);
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index b5c55d88ff76..c01c878e51ba 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -325,9 +325,12 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                  * need to ensure that any fence register is cleared.
                  */
                 if (!i915_gem_object_fence_offset_ok(obj, args->tiling_mode))
-                    ret = i915_gem_object_unbind(obj);
+                        ret = i915_gem_object_unbind(obj);
+                else if (obj_priv->fence_reg != I915_FENCE_REG_NONE)
+                        ret = i915_gem_object_put_fence_reg(obj);
                 else
-                    ret = i915_gem_object_put_fence_reg(obj);
+                        i915_gem_release_mmap(obj);
+
                 if (ret != 0) {
                         WARN(ret != -ERESTARTSYS,
                              "failed to reset object for tiling switch");
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 3d59862c7ccd..cbbf59f56dfa 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -298,6 +298,10 @@
 #define INSTDONE        0x02090
 #define NOPID           0x02094
 #define HWSTAM          0x02098
+
+#define MI_MODE         0x0209c
+# define VS_TIMER_DISPATCH                              (1 << 6)
+
 #define SCPD0           0x0209c /* 915+ only */
 #define IER             0x020a0
 #define IIR             0x020a4
@@ -366,7 +370,7 @@
 #define   FBC_CTL_PERIODIC      (1<<30)
 #define   FBC_CTL_INTERVAL_SHIFT (16)
 #define   FBC_CTL_UNCOMPRESSIBLE (1<<14)
-#define   FBC_C3_IDLE           (1<<13)
+#define   FBC_CTL_C3_IDLE       (1<<13)
 #define   FBC_CTL_STRIDE_SHIFT  (5)
 #define   FBC_CTL_FENCENO       (1<<0)
 #define FBC_COMMAND             0x0320c
@@ -2172,6 +2176,14 @@
 #define DISPLAY_PORT_PLL_BIOS_1         0x46010
 #define DISPLAY_PORT_PLL_BIOS_2         0x46014
 
+#define PCH_DSPCLK_GATE_D       0x42020
+# define DPFDUNIT_CLOCK_GATE_DISABLE            (1 << 7)
+# define DPARBUNIT_CLOCK_GATE_DISABLE           (1 << 5)
+
+#define PCH_3DCGDIS0            0x46020
+# define MARIUNIT_CLOCK_GATE_DISABLE            (1 << 18)
+# define SVSMUNIT_CLOCK_GATE_DISABLE            (1 << 1)
+
 #define FDI_PLL_FREQ_CTL        0x46030
 #define  FDI_PLL_FREQ_CHANGE_REQUEST    (1<<24)
 #define  FDI_PLL_FREQ_LOCK_LIMIT_MASK   0xfff00
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 70c9d4ba7042..f9ba452f0cbf 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -417,8 +417,9 @@ parse_edp(struct drm_i915_private *dev_priv, struct bdb_header *bdb)
         edp = find_section(bdb, BDB_EDP);
         if (!edp) {
                 if (SUPPORTS_EDP(dev_priv->dev) && dev_priv->edp_support) {
-                        DRM_DEBUG_KMS("No eDP BDB found but eDP panel supported,\
-                                       assume 18bpp panel color depth.\n");
+                        DRM_DEBUG_KMS("No eDP BDB found but eDP panel "
+                                      "supported, assume 18bpp panel color "
+                                      "depth.\n");
                         dev_priv->edp_bpp = 18;
                 }
                 return;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 9cd6de5f9906..58fc7fa0eb1d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1032,7 +1032,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
         /* enable it... */
         fbc_ctl = FBC_CTL_EN | FBC_CTL_PERIODIC;
         if (IS_I945GM(dev))
-                fbc_ctl |= FBC_C3_IDLE; /* 945 needs special SR handling */
+                fbc_ctl |= FBC_CTL_C3_IDLE; /* 945 needs special SR handling */
         fbc_ctl |= (dev_priv->cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
         fbc_ctl |= (interval & 0x2fff) << FBC_CTL_INTERVAL_SHIFT;
         if (obj_priv->tiling_mode != I915_TILING_NONE)
@@ -4717,6 +4717,20 @@ void intel_init_clock_gating(struct drm_device *dev)
          * specs, but enable as much else as we can.
          */
         if (HAS_PCH_SPLIT(dev)) {
+                uint32_t dspclk_gate = VRHUNIT_CLOCK_GATE_DISABLE;
+
+                if (IS_IRONLAKE(dev)) {
+                        /* Required for FBC */
+                        dspclk_gate |= DPFDUNIT_CLOCK_GATE_DISABLE;
+                        /* Required for CxSR */
+                        dspclk_gate |= DPARBUNIT_CLOCK_GATE_DISABLE;
+
+                        I915_WRITE(PCH_3DCGDIS0,
+                                   MARIUNIT_CLOCK_GATE_DISABLE |
+                                   SVSMUNIT_CLOCK_GATE_DISABLE);
+                }
+
+                I915_WRITE(PCH_DSPCLK_GATE_D, dspclk_gate);
                 return;
         } else if (IS_G4X(dev)) {
                 uint32_t dspclk_gate;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 14e516fdc2dd..2b3fa7a3c028 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -607,53 +607,6 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
         I915_WRITE(PFIT_CONTROL, lvds_priv->pfit_control);
 }
 
-/* Some lid devices report incorrect lid status, assume they're connected */
-static const struct dmi_system_id bad_lid_status[] = {
-        {
-                .ident = "Compaq nx9020",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_BOARD_NAME, "3084"),
-                },
-        },
-        {
-                .ident = "Samsung SX20S",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
-                        DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
-                },
-        },
-        {
-                .ident = "Aspire One",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire one"),
-                },
-        },
-        {
-                .ident = "Aspire 1810T",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1810T"),
-                },
-        },
-        {
-                .ident = "PC-81005",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
-                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
-                },
-        },
-        {
-                .ident = "Clevo M5x0N",
-                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
-                        DMI_MATCH(DMI_BOARD_NAME, "M5x0N"),
-                },
-        },
-        { }
-};
-
 /**
  * Detect the LVDS connection.
  *
@@ -669,12 +622,9 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
         /* ACPI lid methods were generally unreliable in this generation, so
          * don't even bother.
          */
-        if (IS_GEN2(dev))
+        if (IS_GEN2(dev) || IS_GEN3(dev))
                 return connector_status_connected;
 
-        if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
-                status = connector_status_disconnected;
-
         return status;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index d355d1d527e7..60595fc26fdd 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -1068,14 +1068,18 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
 
         drmmode_obj = drm_mode_object_find(dev, put_image_rec->crtc_id,
                         DRM_MODE_OBJECT_CRTC);
-        if (!drmmode_obj)
-                return -ENOENT;
+        if (!drmmode_obj) {
+                ret = -ENOENT;
+                goto out_free;
+        }
         crtc = to_intel_crtc(obj_to_crtc(drmmode_obj));
 
         new_bo = drm_gem_object_lookup(dev, file_priv,
                         put_image_rec->bo_handle);
-        if (!new_bo)
-                return -ENOENT;
+        if (!new_bo) {
+                ret = -ENOENT;
+                goto out_free;
+        }
 
         mutex_lock(&dev->mode_config.mutex);
         mutex_lock(&dev->struct_mutex);
@@ -1165,6 +1169,7 @@ out_unlock:
         mutex_unlock(&dev->struct_mutex);
         mutex_unlock(&dev->mode_config.mutex);
         drm_gem_object_unreference_unlocked(new_bo);
+out_free:
         kfree(params);
 
         return ret;
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 3cfd60fd0083..ea4c645ece11 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -116,13 +116,7 @@ int radeon_irq_kms_init(struct radeon_device *rdev)
         }
         /* enable msi */
         rdev->msi_enabled = 0;
-        /* MSIs don't seem to work on my rs780;
-         * not sure about rs880 or other rs780s.
-         * Needs more investigation.
-         */
-        if ((rdev->family >= CHIP_RV380) &&
-            (rdev->family != CHIP_RS780) &&
-            (rdev->family != CHIP_RS880)) {
+        if (rdev->family >= CHIP_RV380) {
                 int ret = pci_enable_msi(rdev->pdev);
                 if (!ret) {
                         rdev->msi_enabled = 1;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index e4595e6147b4..9be8e1754a0b 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -217,8 +217,8 @@ config SENSORS_ASC7621
         depends on HWMON && I2C
         help
           If you say yes here you get support for the aSC7621
-          family of SMBus sensors chip found on most Intel X48, X38, 975,
-          965 and 945 desktop boards.  Currently supported chips:
+          family of SMBus sensors chip found on most Intel X38, X48, X58,
+          945, 965 and 975 desktop boards.  Currently supported chips:
           aSC7621
           aSC7621a
 
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 2d7bceeed0bc..e9b7fbc5a447 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -228,7 +228,7 @@ static int __devinit adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *
                 if (err) {
                         dev_warn(dev,
                                  "Unable to access MSR 0xEE, for Tjmax, left"
-                                 " at default");
+                                 " at default\n");
                 } else if (eax & 0x40000000) {
                         tjmax = tjmax_ee;
                 }
@@ -466,7 +466,7 @@ static int __init coretemp_init(void)
                            family 6 CPU */
                         if ((c->x86 == 0x6) && (c->x86_model > 0xf))
                                 printk(KERN_WARNING DRVNAME ": Unknown CPU "
-                                        "model %x\n", c->x86_model);
+                                        "model 0x%x\n", c->x86_model);
                         continue;
                 }
 
diff --git a/drivers/hwmon/w83793.c b/drivers/hwmon/w83793.c
index 9de81a4c15a2..612807d97155 100644
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -1294,7 +1294,7 @@ static int watchdog_close(struct inode *inode, struct file *filp)
 static ssize_t watchdog_write(struct file *filp, const char __user *buf,
         size_t count, loff_t *offset)
 {
-        size_t ret;
+        ssize_t ret;
         struct w83793_data *data = filp->private_data;
 
         if (count) {
diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
index 365e0becaf12..388cbdc96db7 100644
--- a/drivers/i2c/busses/i2c-scmi.c
+++ b/drivers/i2c/busses/i2c-scmi.c
@@ -33,6 +33,7 @@ struct acpi_smbus_cmi {
         u8 cap_info:1;
         u8 cap_read:1;
         u8 cap_write:1;
+        struct smbus_methods_t *methods;
 };
 
 static const struct smbus_methods_t smbus_methods = {
@@ -41,10 +42,19 @@ static const struct smbus_methods_t smbus_methods = {
         .mt_sbw  = "_SBW",
 };
 
+/* Some IBM BIOSes omit the leading underscore */
+static const struct smbus_methods_t ibm_smbus_methods = {
+        .mt_info = "SBI_",
+        .mt_sbr  = "SBR_",
+        .mt_sbw  = "SBW_",
+};
+
 static const struct acpi_device_id acpi_smbus_cmi_ids[] = {
-        {"SMBUS01", 0},
+        {"SMBUS01", (kernel_ulong_t)&smbus_methods},
+        {ACPI_SMBUS_IBM_HID, (kernel_ulong_t)&ibm_smbus_methods},
         {"", 0}
 };
+MODULE_DEVICE_TABLE(acpi, acpi_smbus_cmi_ids);
 
 #define ACPI_SMBUS_STATUS_OK                    0x00
 #define ACPI_SMBUS_STATUS_FAIL                  0x07
@@ -150,11 +160,11 @@ acpi_smbus_cmi_access(struct i2c_adapter *adap, u16 addr, unsigned short flags,
 
         if (read_write == I2C_SMBUS_READ) {
                 protocol |= ACPI_SMBUS_PRTCL_READ;
-                method = smbus_methods.mt_sbr;
+                method = smbus_cmi->methods->mt_sbr;
                 input.count = 3;
         } else {
                 protocol |= ACPI_SMBUS_PRTCL_WRITE;
-                method = smbus_methods.mt_sbw;
+                method = smbus_cmi->methods->mt_sbw;
                 input.count = 5;
         }
 
@@ -290,13 +300,13 @@ static int acpi_smbus_cmi_add_cap(struct acpi_smbus_cmi *smbus_cmi,
         union acpi_object *obj;
         acpi_status status;
 
-        if (!strcmp(name, smbus_methods.mt_info)) {
+        if (!strcmp(name, smbus_cmi->methods->mt_info)) {
                 status = acpi_evaluate_object(smbus_cmi->handle,
-                                        smbus_methods.mt_info,
+                                        smbus_cmi->methods->mt_info,
                                         NULL, &buffer);
                 if (ACPI_FAILURE(status)) {
                         ACPI_ERROR((AE_INFO, "Evaluating %s: %i",
-                                   smbus_methods.mt_info, status));
+                                   smbus_cmi->methods->mt_info, status));
                         return -EIO;
                 }
 
@@ -319,9 +329,9 @@ static int acpi_smbus_cmi_add_cap(struct acpi_smbus_cmi *smbus_cmi,
 
                 kfree(buffer.pointer);
                 smbus_cmi->cap_info = 1;
-        } else if (!strcmp(name, smbus_methods.mt_sbr))
+        } else if (!strcmp(name, smbus_cmi->methods->mt_sbr))
                 smbus_cmi->cap_read = 1;
-        else if (!strcmp(name, smbus_methods.mt_sbw))
+        else if (!strcmp(name, smbus_cmi->methods->mt_sbw))
                 smbus_cmi->cap_write = 1;
         else
                 ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Unsupported CMI method: %s\n",
@@ -349,6 +359,7 @@ static acpi_status acpi_smbus_cmi_query_methods(acpi_handle handle, u32 level,
 static int acpi_smbus_cmi_add(struct acpi_device *device)
 {
         struct acpi_smbus_cmi *smbus_cmi;
+        const struct acpi_device_id *id;
 
         smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
         if (!smbus_cmi)
@@ -362,6 +373,11 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
         smbus_cmi->cap_read = 0;
         smbus_cmi->cap_write = 0;
 
+        for (id = acpi_smbus_cmi_ids; id->id[0]; id++)
+                if (!strcmp(id->id, acpi_device_hid(device)))
+                        smbus_cmi->methods =
+                                (struct smbus_methods_t *) id->driver_data;
+
         acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
                             acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL);
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index fbedd35feb44..4c3d1bfec0c5 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -695,14 +695,8 @@ static int ide_probe_port(ide_hwif_t *hwif)
         if (irqd)
                 disable_irq(hwif->irq);
 
-        rc = ide_port_wait_ready(hwif);
-        if (rc == -ENODEV) {
-                printk(KERN_INFO "%s: no devices on the port\n", hwif->name);
-                goto out;
-        } else if (rc == -EBUSY)
-                printk(KERN_ERR "%s: not ready before the probe\n", hwif->name);
-        else
-                rc = -ENODEV;
+        if (ide_port_wait_ready(hwif) == -EBUSY)
+                printk(KERN_DEBUG "%s: Wait for ready failed before probe !\n", hwif->name);
 
         /*
          * Second drive should only exist if first drive was found,
@@ -713,7 +707,7 @@ static int ide_probe_port(ide_hwif_t *hwif)
                 if (drive->dev_flags & IDE_DFLAG_PRESENT)
                         rc = 0;
         }
-out:
+
         /*
          * Use cached IRQ number. It might be (and is...) changed by probe
          * code above
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index e65d010b708d..48fd4efc90ad 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -110,7 +110,6 @@ struct via82cxxx_dev
 {
         struct via_isa_bridge *via_config;
         unsigned int via_80w;
-        u8 cached_device[2];
 };
 
 /**
@@ -403,66 +402,10 @@ static const struct ide_port_ops via_port_ops = {
         .cable_detect           = via82cxxx_cable_detect,
 };
 
-static void via_write_devctl(ide_hwif_t *hwif, u8 ctl)
-{
-        struct via82cxxx_dev *vdev = hwif->host->host_priv;
-
-        outb(ctl, hwif->io_ports.ctl_addr);
-        outb(vdev->cached_device[hwif->channel], hwif->io_ports.device_addr);
-}
-
-static void __via_dev_select(ide_drive_t *drive, u8 select)
-{
-        ide_hwif_t *hwif = drive->hwif;
-        struct via82cxxx_dev *vdev = hwif->host->host_priv;
-
-        outb(select, hwif->io_ports.device_addr);
-        vdev->cached_device[hwif->channel] = select;
-}
-
-static void via_dev_select(ide_drive_t *drive)
-{
-        __via_dev_select(drive, drive->select | ATA_DEVICE_OBS);
-}
-
-static void via_tf_load(ide_drive_t *drive, struct ide_taskfile *tf, u8 valid)
-{
-        ide_hwif_t *hwif = drive->hwif;
-        struct ide_io_ports *io_ports = &hwif->io_ports;
-
-        if (valid & IDE_VALID_FEATURE)
-                outb(tf->feature, io_ports->feature_addr);
-        if (valid & IDE_VALID_NSECT)
-                outb(tf->nsect, io_ports->nsect_addr);
-        if (valid & IDE_VALID_LBAL)
-                outb(tf->lbal, io_ports->lbal_addr);
-        if (valid & IDE_VALID_LBAM)
-                outb(tf->lbam, io_ports->lbam_addr);
-        if (valid & IDE_VALID_LBAH)
-                outb(tf->lbah, io_ports->lbah_addr);
-        if (valid & IDE_VALID_DEVICE)
-                __via_dev_select(drive, tf->device);
-}
-
-const struct ide_tp_ops via_tp_ops = {
-        .exec_command           = ide_exec_command,
-        .read_status            = ide_read_status,
-        .read_altstatus         = ide_read_altstatus,
-        .write_devctl           = via_write_devctl,
-
-        .dev_select             = via_dev_select,
-        .tf_load                = via_tf_load,
-        .tf_read                = ide_tf_read,
-
-        .input_data             = ide_input_data,
-        .output_data            = ide_output_data,
-};
-
 static const struct ide_port_info via82cxxx_chipset __devinitdata = {
         .name           = DRV_NAME,
         .init_chipset   = init_chipset_via82cxxx,
         .enablebits     = { { 0x40, 0x02, 0x02 }, { 0x40, 0x01, 0x01 } },
-        .tp_ops         = &via_tp_ops,
         .port_ops       = &via_port_ops,
         .host_flags     = IDE_HFLAG_PIO_NO_BLACKLIST |
                           IDE_HFLAG_POST_SET_MODE |
diff --git a/drivers/isdn/hisax/avma1_cs.c b/drivers/isdn/hisax/avma1_cs.c
index e5deb15cf40c..8d1d63a02b34 100644
--- a/drivers/isdn/hisax/avma1_cs.c
+++ b/drivers/isdn/hisax/avma1_cs.c
@@ -50,7 +50,7 @@ module_param(isdnprot, int, 0);
    handler.
 */
 
-static int avma1cs_config(struct pcmcia_device *link);
+static int avma1cs_config(struct pcmcia_device *link) __devinit ;
 static void avma1cs_release(struct pcmcia_device *link);
 
 /*
@@ -59,7 +59,7 @@ static void avma1cs_release(struct pcmcia_device *link);
    needed to manage one actual PCMCIA card.
 */
 
-static void avma1cs_detach(struct pcmcia_device *p_dev);
+static void avma1cs_detach(struct pcmcia_device *p_dev) __devexit ;
 
 
 /*
@@ -99,7 +99,7 @@ typedef struct local_info_t {
     
 ======================================================================*/
 
-static int avma1cs_probe(struct pcmcia_device *p_dev)
+static int __devinit avma1cs_probe(struct pcmcia_device *p_dev)
 {
     local_info_t *local;
 
@@ -140,7 +140,7 @@ static int avma1cs_probe(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void avma1cs_detach(struct pcmcia_device *link)
+static void __devexit avma1cs_detach(struct pcmcia_device *link)
 {
         dev_dbg(&link->dev, "avma1cs_detach(0x%p)\n", link);
         avma1cs_release(link);
@@ -174,7 +174,7 @@ static int avma1cs_configcheck(struct pcmcia_device *p_dev,
 }
 
 
-static int avma1cs_config(struct pcmcia_device *link)
+static int __devinit avma1cs_config(struct pcmcia_device *link)
 {
     local_info_t *dev;
     int i;
@@ -282,7 +282,7 @@ static struct pcmcia_driver avma1cs_driver = {
                 .name   = "avma1_cs",
         },
         .probe          = avma1cs_probe,
-        .remove         = avma1cs_detach,
+        .remove         = __devexit_p(avma1cs_detach),
         .id_table       = avma1cs_ids,
 };
 
diff --git a/drivers/isdn/hisax/elsa_cs.c b/drivers/isdn/hisax/elsa_cs.c
index c9a30b1c9237..c9f2279e21f5 100644
--- a/drivers/isdn/hisax/elsa_cs.c
+++ b/drivers/isdn/hisax/elsa_cs.c
@@ -76,7 +76,7 @@ module_param(protocol, int, 0);
    handler.
 */
 
-static int elsa_cs_config(struct pcmcia_device *link);
+static int elsa_cs_config(struct pcmcia_device *link) __devinit ;
 static void elsa_cs_release(struct pcmcia_device *link);
 
 /*
@@ -85,7 +85,7 @@ static void elsa_cs_release(struct pcmcia_device *link);
    needed to manage one actual PCMCIA card.
 */
 
-static void elsa_cs_detach(struct pcmcia_device *p_dev);
+static void elsa_cs_detach(struct pcmcia_device *p_dev) __devexit;
 
 /*
    A driver needs to provide a dev_node_t structure for each device
@@ -121,7 +121,7 @@ typedef struct local_info_t {
 
 ======================================================================*/
 
-static int elsa_cs_probe(struct pcmcia_device *link)
+static int __devinit elsa_cs_probe(struct pcmcia_device *link)
 {
     local_info_t *local;
 
@@ -166,7 +166,7 @@ static int elsa_cs_probe(struct pcmcia_device *link)
 
 ======================================================================*/
 
-static void elsa_cs_detach(struct pcmcia_device *link)
+static void __devexit elsa_cs_detach(struct pcmcia_device *link)
 {
         local_info_t *info = link->priv;
 
@@ -210,7 +210,7 @@ static int elsa_cs_configcheck(struct pcmcia_device *p_dev,
         return -ENODEV;
 }
 
-static int elsa_cs_config(struct pcmcia_device *link)
+static int __devinit elsa_cs_config(struct pcmcia_device *link)
 {
     local_info_t *dev;
     int i;
@@ -327,7 +327,7 @@ static struct pcmcia_driver elsa_cs_driver = {
                 .name   = "elsa_cs",
         },
         .probe          = elsa_cs_probe,
-        .remove         = elsa_cs_detach,
+        .remove         = __devexit_p(elsa_cs_detach),
         .id_table       = elsa_ids,
         .suspend        = elsa_suspend,
         .resume         = elsa_resume,
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index 7836ec3c7f86..71b3ddef03bb 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -76,7 +76,7 @@ module_param(protocol, int, 0);
    event handler. 
 */
 
-static int sedlbauer_config(struct pcmcia_device *link);
+static int sedlbauer_config(struct pcmcia_device *link) __devinit ;
 static void sedlbauer_release(struct pcmcia_device *link);
 
 /*
@@ -85,7 +85,7 @@ static void sedlbauer_release(struct pcmcia_device *link);
    needed to manage one actual PCMCIA card.
 */
 
-static void sedlbauer_detach(struct pcmcia_device *p_dev);
+static void sedlbauer_detach(struct pcmcia_device *p_dev) __devexit;
 
 /*
    You'll also need to prototype all the functions that will actually
@@ -129,7 +129,7 @@ typedef struct local_info_t {
     
 ======================================================================*/
 
-static int sedlbauer_probe(struct pcmcia_device *link)
+static int __devinit sedlbauer_probe(struct pcmcia_device *link)
 {
     local_info_t *local;
 
@@ -177,7 +177,7 @@ static int sedlbauer_probe(struct pcmcia_device *link)
 
 ======================================================================*/
 
-static void sedlbauer_detach(struct pcmcia_device *link)
+static void __devexit sedlbauer_detach(struct pcmcia_device *link)
 {
         dev_dbg(&link->dev, "sedlbauer_detach(0x%p)\n", link);
 
@@ -283,7 +283,7 @@ static int sedlbauer_config_check(struct pcmcia_device *p_dev,
 
 
 
-static int sedlbauer_config(struct pcmcia_device *link)
+static int __devinit sedlbauer_config(struct pcmcia_device *link)
 {
     local_info_t *dev = link->priv;
     win_req_t *req;
@@ -441,7 +441,7 @@ static struct pcmcia_driver sedlbauer_driver = {
                 .name   = "sedlbauer_cs",
         },
         .probe          = sedlbauer_probe,
-        .remove         = sedlbauer_detach,
+        .remove         = __devexit_p(sedlbauer_detach),
         .id_table       = sedlbauer_ids,
         .suspend        = sedlbauer_suspend,
         .resume         = sedlbauer_resume,
diff --git a/drivers/isdn/hisax/teles_cs.c b/drivers/isdn/hisax/teles_cs.c
index b0c5976cbdb3..d010a0da8e19 100644
--- a/drivers/isdn/hisax/teles_cs.c
+++ b/drivers/isdn/hisax/teles_cs.c
@@ -57,7 +57,7 @@ module_param(protocol, int, 0);
    handler.
 */
 
-static int teles_cs_config(struct pcmcia_device *link);
+static int teles_cs_config(struct pcmcia_device *link) __devinit ;
 static void teles_cs_release(struct pcmcia_device *link);
 
 /*
@@ -66,7 +66,7 @@ static void teles_cs_release(struct pcmcia_device *link);
    needed to manage one actual PCMCIA card.
 */
 
-static void teles_detach(struct pcmcia_device *p_dev);
+static void teles_detach(struct pcmcia_device *p_dev) __devexit ;
 
 /*
    A linked list of "instances" of the teles_cs device.  Each actual
@@ -112,7 +112,7 @@ typedef struct local_info_t {
 
 ======================================================================*/
 
-static int teles_probe(struct pcmcia_device *link)
+static int __devinit teles_probe(struct pcmcia_device *link)
 {
     local_info_t *local;
 
@@ -156,7 +156,7 @@ static int teles_probe(struct pcmcia_device *link)
 
 ======================================================================*/
 
-static void teles_detach(struct pcmcia_device *link)
+static void __devexit teles_detach(struct pcmcia_device *link)
 {
         local_info_t *info = link->priv;
 
@@ -200,7 +200,7 @@ static int teles_cs_configcheck(struct pcmcia_device *p_dev,
         return -ENODEV;
 }
 
-static int teles_cs_config(struct pcmcia_device *link)
+static int __devinit teles_cs_config(struct pcmcia_device *link)
 {
     local_info_t *dev;
     int i;
@@ -319,7 +319,7 @@ static struct pcmcia_driver teles_cs_driver = {
                 .name   = "teles_cs",
         },
         .probe          = teles_probe,
-        .remove         = teles_detach,
+        .remove         = __devexit_p(teles_detach),
         .id_table       = teles_ids,
         .suspend        = teles_suspend,
         .resume         = teles_resume,
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index b5346b4db91a..b7a85f46a6c2 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -912,8 +912,8 @@ struct c2port_device *c2port_device_register(char *name,
 
         c2dev->dev = device_create(c2port_class, NULL, 0, c2dev,
                                         "c2port%d", id);
-        if (unlikely(!c2dev->dev)) {
-                ret = -ENOMEM;
+        if (unlikely(IS_ERR(c2dev->dev))) {
+                ret = PTR_ERR(c2dev->dev);
                 goto error_device_create;
         }
         dev_set_drvdata(c2dev->dev, c2dev);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 0eac6c814904..e041c003db22 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -225,7 +225,7 @@ static int mmc_read_ext_csd(struct mmc_card *card)
                         mmc_card_set_blockaddr(card);
         }
 
-        switch (ext_csd[EXT_CSD_CARD_TYPE]) {
+        switch (ext_csd[EXT_CSD_CARD_TYPE] & EXT_CSD_CARD_TYPE_MASK) {
         case EXT_CSD_CARD_TYPE_52 | EXT_CSD_CARD_TYPE_26:
                 card->ext_csd.hs_max_dtr = 52000000;
                 break;
@@ -237,7 +237,6 @@ static int mmc_read_ext_csd(struct mmc_card *card)
                 printk(KERN_WARNING "%s: card is mmc v4 but doesn't "
                         "support any high-speed modes.\n",
                         mmc_hostname(card->host));
-                goto out;
         }
 
         if (card->ext_csd.rev >= 3) {
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index a1d4188c430b..e7810b74f396 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -449,11 +449,10 @@ ks8695_rx_irq(int irq, void *dev_id)
 }
 
 /**
- *      ks8695_rx - Receive packets  called by NAPI poll method
+ *      ks8695_rx - Receive packets called by NAPI poll method
  *      @ksp: Private data for the KS8695 Ethernet
- *      @budget: The max packets would be receive
+ *      @budget: Number of packets allowed to process
  */
-
 static int ks8695_rx(struct ks8695_priv *ksp, int budget)
 {
         struct net_device *ndev = ksp->ndev;
@@ -461,7 +460,6 @@ static int ks8695_rx(struct ks8695_priv *ksp, int budget)
         int buff_n;
         u32 flags;
         int pktlen;
-        int last_rx_processed = -1;
         int received = 0;
 
         buff_n = ksp->next_rx_desc_read;
@@ -471,6 +469,7 @@ static int ks8695_rx(struct ks8695_priv *ksp, int budget)
                                         cpu_to_le32(RDES_OWN)))) {
                         rmb();
                         flags = le32_to_cpu(ksp->rx_ring[buff_n].status);
+
                         /* Found an SKB which we own, this means we
                          * received a packet
                          */
@@ -533,23 +532,18 @@ rx_failure:
                         ksp->rx_ring[buff_n].status = cpu_to_le32(RDES_OWN);
 rx_finished:
                         received++;
-                        /* And note this as processed so we can start
-                         * from here next time
-                         */
-                        last_rx_processed = buff_n;
                         buff_n = (buff_n + 1) & MAX_RX_DESC_MASK;
-                        /*And note which RX descriptor we last did */
-                        if (likely(last_rx_processed != -1))
-                                ksp->next_rx_desc_read =
-                                        (last_rx_processed + 1) &
-                                        MAX_RX_DESC_MASK;
         }
+
+        /* And note which RX descriptor we last did */
+        ksp->next_rx_desc_read = buff_n;
+
         /* And refill the buffers */
         ks8695_refill_rxbuffers(ksp);
 
-        /* Kick the RX DMA engine, in case it became
-         *  suspended */
+        /* Kick the RX DMA engine, in case it became suspended */
         ks8695_writereg(ksp, KS8695_DRSC, 0);
+
         return received;
 }
 
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 9ba547069db3..0ebd8208f606 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -84,7 +84,7 @@
 
 #define ATLX_DRIVER_VERSION "2.1.3"
 MODULE_AUTHOR("Xiong Huang <xiong.huang@atheros.com>, \
-        Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
+Chris Snook <csnook@redhat.com>, Jay Cliburn <jcliburn@gmail.com>");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(ATLX_DRIVER_VERSION);
 
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 9560d48944ab..51e1065e7897 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -490,7 +490,7 @@ be_test_ddr_dma(struct be_adapter *adapter)
 {
         int ret, i;
         struct be_dma_mem ddrdma_cmd;
-        u64 pattern[2] = {0x5a5a5a5a5a5a5a5a, 0xa5a5a5a5a5a5a5a5};
+        u64 pattern[2] = {0x5a5a5a5a5a5a5a5aULL, 0xa5a5a5a5a5a5a5a5ULL};
 
         ddrdma_cmd.size = sizeof(struct be_cmd_req_ddrdma_test);
         ddrdma_cmd.va = pci_alloc_consistent(adapter->pdev, ddrdma_cmd.size,
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 381887ba677c..a257babd1bb4 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -246,6 +246,8 @@ static const struct flash_spec flash_5709 = {
 
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
+static void bnx2_init_napi(struct bnx2 *bp);
+
 static inline u32 bnx2_tx_avail(struct bnx2 *bp, struct bnx2_tx_ring_info *txr)
 {
         u32 diff;
@@ -6197,6 +6199,7 @@ bnx2_open(struct net_device *dev)
         bnx2_disable_int(bp);
 
         bnx2_setup_int_mode(bp, disable_msi);
+        bnx2_init_napi(bp);
         bnx2_napi_enable(bp);
         rc = bnx2_alloc_mem(bp);
         if (rc)
@@ -7643,9 +7646,11 @@ poll_bnx2(struct net_device *dev)
         int i;
 
         for (i = 0; i < bp->irq_nvecs; i++) {
-                disable_irq(bp->irq_tbl[i].vector);
-                bnx2_interrupt(bp->irq_tbl[i].vector, &bp->bnx2_napi[i]);
-                enable_irq(bp->irq_tbl[i].vector);
+                struct bnx2_irq *irq = &bp->irq_tbl[i];
+
+                disable_irq(irq->vector);
+                irq->handler(irq->vector, &bp->bnx2_napi[i]);
+                enable_irq(irq->vector);
         }
 }
 #endif
@@ -8207,7 +8212,7 @@ bnx2_init_napi(struct bnx2 *bp)
 {
         int i;
 
-        for (i = 0; i < BNX2_MAX_MSIX_VEC; i++) {
+        for (i = 0; i < bp->irq_nvecs; i++) {
                 struct bnx2_napi *bnapi = &bp->bnx2_napi[i];
                 int (*poll)(struct napi_struct *, int);
 
@@ -8276,7 +8281,6 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         dev->ethtool_ops = &bnx2_ethtool_ops;
 
         bp = netdev_priv(dev);
-        bnx2_init_napi(bp);
 
         pci_set_drvdata(pdev, dev);
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 430c02267d7e..5b92fbff431d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1235,6 +1235,11 @@ void bond_change_active_slave(struct bonding *bond, struct slave *new_active)
                         write_lock_bh(&bond->curr_slave_lock);
                 }
         }
+
+        /* resend IGMP joins since all were sent on curr_active_slave */
+        if (bond->params.mode == BOND_MODE_ROUNDROBIN) {
+                bond_resend_igmp_join_requests(bond);
+        }
 }
 
 /**
@@ -4138,22 +4143,41 @@ static int bond_xmit_roundrobin(struct sk_buff *skb, struct net_device *bond_dev
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave, *start_at;
         int i, slave_no, res = 1;
+        struct iphdr *iph = ip_hdr(skb);
 
         read_lock(&bond->lock);
 
         if (!BOND_IS_OK(bond))
                 goto out;
-
         /*
-         * Concurrent TX may collide on rr_tx_counter; we accept that
-         * as being rare enough not to justify using an atomic op here
+         * Start with the curr_active_slave that joined the bond as the
+         * default for sending IGMP traffic.  For failover purposes one
+         * needs to maintain some consistency for the interface that will
+         * send the join/membership reports.  The curr_active_slave found
+         * will send all of this type of traffic.
          */
-        slave_no = bond->rr_tx_counter++ % bond->slave_cnt;
+        if ((iph->protocol == htons(IPPROTO_IGMP)) &&
+            (skb->protocol == htons(ETH_P_IP))) {
 
-        bond_for_each_slave(bond, slave, i) {
-                slave_no--;
-                if (slave_no < 0)
-                        break;
+                read_lock(&bond->curr_slave_lock);
+                slave = bond->curr_active_slave;
+                read_unlock(&bond->curr_slave_lock);
+
+                if (!slave)
+                        goto out;
+        } else {
+                /*
+                 * Concurrent TX may collide on rr_tx_counter; we accept
+                 * that as being rare enough not to justify using an
+                 * atomic op here.
+                 */
+                slave_no = bond->rr_tx_counter++ % bond->slave_cnt;
+
+                bond_for_each_slave(bond, slave, i) {
+                        slave_no--;
+                        if (slave_no < 0)
+                                break;
+                }
         }
 
         start_at = slave;
diff --git a/drivers/net/can/bfin_can.c b/drivers/net/can/bfin_can.c
index 866905fa4119..03489864376d 100644
--- a/drivers/net/can/bfin_can.c
+++ b/drivers/net/can/bfin_can.c
@@ -22,6 +22,7 @@
 #include <linux/can/dev.h>
 #include <linux/can/error.h>
 
+#include <asm/bfin_can.h>
 #include <asm/portmux.h>
 
 #define DRV_NAME "bfin_can"
@@ -29,90 +30,6 @@
 #define TX_ECHO_SKB_MAX  1
 
 /*
- * transmit and receive channels
- */
-#define TRANSMIT_CHL            24
-#define RECEIVE_STD_CHL         0
-#define RECEIVE_EXT_CHL         4
-#define RECEIVE_RTR_CHL         8
-#define RECEIVE_EXT_RTR_CHL     12
-#define MAX_CHL_NUMBER          32
-
-/*
- * bfin can registers layout
- */
-struct bfin_can_mask_regs {
-        u16 aml;
-        u16 dummy1;
-        u16 amh;
-        u16 dummy2;
-};
-
-struct bfin_can_channel_regs {
-        u16 data[8];
-        u16 dlc;
-        u16 dummy1;
-        u16 tsv;
-        u16 dummy2;
-        u16 id0;
-        u16 dummy3;
-        u16 id1;
-        u16 dummy4;
-};
-
-struct bfin_can_regs {
-        /*
-         * global control and status registers
-         */
-        u16 mc1;           /* offset 0 */
-        u16 dummy1;
-        u16 md1;           /* offset 4 */
-        u16 rsv1[13];
-        u16 mbtif1;        /* offset 0x20 */
-        u16 dummy2;
-        u16 mbrif1;        /* offset 0x24 */
-        u16 dummy3;
-        u16 mbim1;         /* offset 0x28 */
-        u16 rsv2[11];
-        u16 mc2;           /* offset 0x40 */
-        u16 dummy4;
-        u16 md2;           /* offset 0x44 */
-        u16 dummy5;
-        u16 trs2;          /* offset 0x48 */
-        u16 rsv3[11];
-        u16 mbtif2;        /* offset 0x60 */
-        u16 dummy6;
-        u16 mbrif2;        /* offset 0x64 */
-        u16 dummy7;
-        u16 mbim2;         /* offset 0x68 */
-        u16 rsv4[11];
-        u16 clk;           /* offset 0x80 */
-        u16 dummy8;
-        u16 timing;        /* offset 0x84 */
-        u16 rsv5[3];
-        u16 status;        /* offset 0x8c */
-        u16 dummy9;
-        u16 cec;           /* offset 0x90 */
-        u16 dummy10;
-        u16 gis;           /* offset 0x94 */
-        u16 dummy11;
-        u16 gim;           /* offset 0x98 */
-        u16 rsv6[3];
-        u16 ctrl;          /* offset 0xa0 */
-        u16 dummy12;
-        u16 intr;          /* offset 0xa4 */
-        u16 rsv7[7];
-        u16 esr;           /* offset 0xb4 */
-        u16 rsv8[37];
-
-        /*
-         * channel(mailbox) mask and message registers
-         */
-        struct bfin_can_mask_regs msk[MAX_CHL_NUMBER];    /* offset 0x100 */
-        struct bfin_can_channel_regs chl[MAX_CHL_NUMBER]; /* offset 0x200 */
-};
-
-/*
  * bfin can private data
  */
 struct bfin_can_priv {
@@ -163,7 +80,7 @@ static int bfin_can_set_bittiming(struct net_device *dev)
         if (priv->can.ctrlmode & CAN_CTRLMODE_3_SAMPLES)
                 timing |= SAM;
 
-        bfin_write16(&reg->clk, clk);
+        bfin_write16(&reg->clock, clk);
         bfin_write16(&reg->timing, timing);
 
         dev_info(dev->dev.parent, "setting CLOCK=0x%04x TIMING=0x%04x\n",
@@ -185,11 +102,11 @@ static void bfin_can_set_reset_mode(struct net_device *dev)
         bfin_write16(&reg->gim, 0);
 
         /* reset can and enter configuration mode */
-        bfin_write16(&reg->ctrl, SRS | CCR);
+        bfin_write16(&reg->control, SRS | CCR);
         SSYNC();
-        bfin_write16(&reg->ctrl, CCR);
+        bfin_write16(&reg->control, CCR);
         SSYNC();
-        while (!(bfin_read16(&reg->ctrl) & CCA)) {
+        while (!(bfin_read16(&reg->control) & CCA)) {
                 udelay(10);
                 if (--timeout == 0) {
                         dev_err(dev->dev.parent,
@@ -244,7 +161,7 @@ static void bfin_can_set_normal_mode(struct net_device *dev)
         /*
          * leave configuration mode
          */
-        bfin_write16(&reg->ctrl, bfin_read16(&reg->ctrl) & ~CCR);
+        bfin_write16(&reg->control, bfin_read16(&reg->control) & ~CCR);
 
         while (bfin_read16(&reg->status) & CCA) {
                 udelay(10);
@@ -726,7 +643,7 @@ static int bfin_can_suspend(struct platform_device *pdev, pm_message_t mesg)
 
         if (netif_running(dev)) {
                 /* enter sleep mode */
-                bfin_write16(&reg->ctrl, bfin_read16(&reg->ctrl) | SMR);
+                bfin_write16(&reg->control, bfin_read16(&reg->control) | SMR);
                 SSYNC();
                 while (!(bfin_read16(&reg->intr) & SMACK)) {
                         udelay(10);
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 9902b33b7160..2f29c2131851 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -261,7 +261,6 @@ struct e1000_adapter {
         /* TX */
         struct e1000_tx_ring *tx_ring;      /* One per active queue */
         unsigned int restart_queue;
-        unsigned long tx_queue_len;
         u32 txd_cmd;
         u32 tx_int_delay;
         u32 tx_abs_int_delay;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 8be6faee43e6..b15ece26ed84 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -383,8 +383,6 @@ static void e1000_configure(struct e1000_adapter *adapter)
                 adapter->alloc_rx_buf(adapter, ring,
                                       E1000_DESC_UNUSED(ring));
         }
-
-        adapter->tx_queue_len = netdev->tx_queue_len;
 }
 
 int e1000_up(struct e1000_adapter *adapter)
@@ -503,7 +501,6 @@ void e1000_down(struct e1000_adapter *adapter)
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
 
-        netdev->tx_queue_len = adapter->tx_queue_len;
         adapter->link_speed = 0;
         adapter->link_duplex = 0;
         netif_carrier_off(netdev);
@@ -2316,19 +2313,15 @@ static void e1000_watchdog(unsigned long data)
                                 E1000_CTRL_RFCE) ? "RX" : ((ctrl &
                                 E1000_CTRL_TFCE) ? "TX" : "None" )));
 
-                        /* tweak tx_queue_len according to speed/duplex
-                         * and adjust the timeout factor */
-                        netdev->tx_queue_len = adapter->tx_queue_len;
+                        /* adjust timeout factor according to speed/duplex */
                         adapter->tx_timeout_factor = 1;
                         switch (adapter->link_speed) {
                         case SPEED_10:
                                 txb2b = false;
-                                netdev->tx_queue_len = 10;
                                 adapter->tx_timeout_factor = 16;
                                 break;
                         case SPEED_100:
                                 txb2b = false;
-                                netdev->tx_queue_len = 100;
                                 /* maybe add some timeout factor ? */
                                 break;
                         }
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index c2ec095d2163..118bdf483593 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -279,7 +279,6 @@ struct e1000_adapter {
 
         struct napi_struct napi;
 
-        unsigned long tx_queue_len;
         unsigned int restart_queue;
         u32 txd_cmd;
 
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 88d54d3efcef..e1cceb606576 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2289,8 +2289,6 @@ static void e1000_configure_tx(struct e1000_adapter *adapter)
         ew32(TCTL, tctl);
 
         e1000e_config_collision_dist(hw);
-
-        adapter->tx_queue_len = adapter->netdev->tx_queue_len;
 }
 
 /**
@@ -2877,7 +2875,6 @@ void e1000e_down(struct e1000_adapter *adapter)
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
 
-        netdev->tx_queue_len = adapter->tx_queue_len;
         netif_carrier_off(netdev);
         adapter->link_speed = 0;
         adapter->link_duplex = 0;
@@ -3588,21 +3585,15 @@ static void e1000_watchdog_task(struct work_struct *work)
                                                "link gets many collisions.\n");
                         }
 
-                        /*
-                         * tweak tx_queue_len according to speed/duplex
-                         * and adjust the timeout factor
-                         */
-                        netdev->tx_queue_len = adapter->tx_queue_len;
+                        /* adjust timeout factor according to speed/duplex */
                         adapter->tx_timeout_factor = 1;
                         switch (adapter->link_speed) {
                         case SPEED_10:
                                 txb2b = 0;
-                                netdev->tx_queue_len = 10;
                                 adapter->tx_timeout_factor = 16;
                                 break;
                         case SPEED_100:
                                 txb2b = 0;
-                                netdev->tx_queue_len = 100;
                                 adapter->tx_timeout_factor = 10;
                                 break;
                         }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index b6715553cf17..669de028d44f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2393,6 +2393,7 @@ struct sk_buff * gfar_new_skb(struct net_device *dev)
          * as many bytes as needed to align the data properly
          */
         skb_reserve(skb, alignamount);
+        GFAR_CB(skb)->alignamount = alignamount;
 
         return skb;
 }
@@ -2533,13 +2534,13 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit)
                                 newskb = skb;
                         else if (skb) {
                                 /*
-                                 * We need to reset ->data to what it
+                                 * We need to un-reserve() the skb to what it
                                  * was before gfar_new_skb() re-aligned
                                  * it to an RXBUF_ALIGNMENT boundary
                                  * before we put the skb back on the
                                  * recycle list.
                                  */
-                                skb->data = skb->head + NET_SKB_PAD;
+                                skb_reserve(skb, -GFAR_CB(skb)->alignamount);
                                 __skb_queue_head(&priv->rx_recycle, skb);
                         }
                 } else {
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index 3d72dc43dca5..17d25e714236 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -566,6 +566,12 @@ struct rxfcb {
         u16     vlctl;  /* VLAN control word */
 };
 
+struct gianfar_skb_cb {
+        int alignamount;
+};
+
+#define GFAR_CB(skb) ((struct gianfar_skb_cb *)((skb)->cb))
+
 struct rmon_mib
 {
         u32     tr64;   /* 0x.680 - Transmit and Receive 64-byte Frame Counter */
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index 9d7fa2fb85ea..0bc990ec4a8e 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -94,6 +94,7 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
         case E1000_DEV_ID_82576_FIBER:
         case E1000_DEV_ID_82576_SERDES:
         case E1000_DEV_ID_82576_QUAD_COPPER:
+        case E1000_DEV_ID_82576_QUAD_COPPER_ET2:
         case E1000_DEV_ID_82576_SERDES_QUAD:
                 mac->type = e1000_82576;
                 break;
diff --git a/drivers/net/igb/e1000_hw.h b/drivers/net/igb/e1000_hw.h
index 448005276b26..82a533f5192a 100644
--- a/drivers/net/igb/e1000_hw.h
+++ b/drivers/net/igb/e1000_hw.h
@@ -41,6 +41,7 @@ struct e1000_hw;
 #define E1000_DEV_ID_82576_FIBER              0x10E6
 #define E1000_DEV_ID_82576_SERDES             0x10E7
 #define E1000_DEV_ID_82576_QUAD_COPPER        0x10E8
+#define E1000_DEV_ID_82576_QUAD_COPPER_ET2    0x1526
 #define E1000_DEV_ID_82576_NS                 0x150A
 #define E1000_DEV_ID_82576_NS_SERDES          0x1518
 #define E1000_DEV_ID_82576_SERDES_QUAD        0x150D
diff --git a/drivers/net/igb/e1000_mac.c b/drivers/net/igb/e1000_mac.c
index 2a8a886b37eb..be8d010e4021 100644
--- a/drivers/net/igb/e1000_mac.c
+++ b/drivers/net/igb/e1000_mac.c
@@ -1367,7 +1367,8 @@ out:
  *  igb_enable_mng_pass_thru - Enable processing of ARP's
  *  @hw: pointer to the HW structure
  *
- *  Verifies the hardware needs to allow ARPs to be processed by the host.
+ *  Verifies the hardware needs to leave interface enabled so that frames can
+ *  be directed to and from the management interface.
  **/
 bool igb_enable_mng_pass_thru(struct e1000_hw *hw)
 {
@@ -1380,8 +1381,7 @@ bool igb_enable_mng_pass_thru(struct e1000_hw *hw)
 
         manc = rd32(E1000_MANC);
 
-        if (!(manc & E1000_MANC_RCV_TCO_EN) ||
-            !(manc & E1000_MANC_EN_MAC_ADDR_FILTER))
+        if (!(manc & E1000_MANC_RCV_TCO_EN))
                 goto out;
 
         if (hw->mac.arc_subsystem_valid) {
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index a1775705b24c..3b772b822a5d 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -267,7 +267,6 @@ struct igb_adapter {
 
         /* TX */
         struct igb_ring *tx_ring[16];
-        unsigned long tx_queue_len;
         u32 tx_timeout_count;
 
         /* RX */
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 0ed25f059a00..01c65c7447e1 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -72,6 +72,7 @@ static DEFINE_PCI_DEVICE_TABLE(igb_pci_tbl) = {
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_FIBER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_SERDES), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_SERDES_QUAD), board_82575 },
+        { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_QUAD_COPPER_ET2), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82576_QUAD_COPPER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_COPPER), board_82575 },
         { PCI_VDEVICE(INTEL, E1000_DEV_ID_82575EB_FIBER_SERDES), board_82575 },
@@ -1104,9 +1105,6 @@ static void igb_configure(struct igb_adapter *adapter)
                 struct igb_ring *ring = adapter->rx_ring[i];
                 igb_alloc_rx_buffers_adv(ring, igb_desc_unused(ring));
         }
-
-
-        adapter->tx_queue_len = netdev->tx_queue_len;
 }
 
 /**
@@ -1212,7 +1210,6 @@ void igb_down(struct igb_adapter *adapter)
         del_timer_sync(&adapter->watchdog_timer);
         del_timer_sync(&adapter->phy_info_timer);
 
-        netdev->tx_queue_len = adapter->tx_queue_len;
         netif_carrier_off(netdev);
 
         /* record the stats before reset*/
@@ -3105,17 +3102,13 @@ static void igb_watchdog_task(struct work_struct *work)
                                ((ctrl & E1000_CTRL_RFCE) ?  "RX" :
                                ((ctrl & E1000_CTRL_TFCE) ?  "TX" : "None")));
 
-                        /* tweak tx_queue_len according to speed/duplex and
-                         * adjust the timeout factor */
-                        netdev->tx_queue_len = adapter->tx_queue_len;
+                        /* adjust timeout factor according to speed/duplex */
                         adapter->tx_timeout_factor = 1;
                         switch (adapter->link_speed) {
                         case SPEED_10:
-                                netdev->tx_queue_len = 10;
                                 adapter->tx_timeout_factor = 14;
                                 break;
                         case SPEED_100:
-                                netdev->tx_queue_len = 100;
                                 /* maybe add some timeout factor ? */
                                 break;
                         }
@@ -3962,7 +3955,7 @@ void igb_update_stats(struct igb_adapter *adapter)
         struct net_device_stats *net_stats = igb_get_stats(adapter->netdev);
         struct e1000_hw *hw = &adapter->hw;
         struct pci_dev *pdev = adapter->pdev;
-        u32 rnbc, reg;
+        u32 reg, mpc;
         u16 phy_tmp;
         int i;
         u64 bytes, packets;
@@ -4020,7 +4013,9 @@ void igb_update_stats(struct igb_adapter *adapter)
         adapter->stats.symerrs += rd32(E1000_SYMERRS);
         adapter->stats.sec += rd32(E1000_SEC);
 
-        adapter->stats.mpc += rd32(E1000_MPC);
+        mpc = rd32(E1000_MPC);
+        adapter->stats.mpc += mpc;
+        net_stats->rx_fifo_errors += mpc;
         adapter->stats.scc += rd32(E1000_SCC);
         adapter->stats.ecol += rd32(E1000_ECOL);
         adapter->stats.mcc += rd32(E1000_MCC);
@@ -4035,9 +4030,7 @@ void igb_update_stats(struct igb_adapter *adapter)
         adapter->stats.gptc += rd32(E1000_GPTC);
         adapter->stats.gotc += rd32(E1000_GOTCL);
         rd32(E1000_GOTCH); /* clear GOTCL */
-        rnbc = rd32(E1000_RNBC);
-        adapter->stats.rnbc += rnbc;
-        net_stats->rx_fifo_errors += rnbc;
+        adapter->stats.rnbc += rd32(E1000_RNBC);
         adapter->stats.ruc += rd32(E1000_RUC);
         adapter->stats.rfc += rd32(E1000_RFC);
         adapter->stats.rjc += rd32(E1000_RJC);
@@ -5109,7 +5102,7 @@ static void igb_receive_skb(struct igb_q_vector *q_vector,
 {
         struct igb_adapter *adapter = q_vector->adapter;
 
-        if (vlan_tag)
+        if (vlan_tag && adapter->vlgrp)
                 vlan_gro_receive(&q_vector->napi, adapter->vlgrp,
                                  vlan_tag, skb);
         else
diff --git a/drivers/net/igbvf/igbvf.h b/drivers/net/igbvf/igbvf.h
index a1774b29d222..debeee2dc717 100644
--- a/drivers/net/igbvf/igbvf.h
+++ b/drivers/net/igbvf/igbvf.h
@@ -198,7 +198,6 @@ struct igbvf_adapter {
         struct igbvf_ring *tx_ring /* One per active queue */
         ____cacheline_aligned_in_smp;
 
-        unsigned long tx_queue_len;
         unsigned int restart_queue;
         u32 txd_cmd;
 
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index a77afd8a14bb..b41037ed8083 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -1304,8 +1304,6 @@ static void igbvf_configure_tx(struct igbvf_adapter *adapter)
 
         /* enable Report Status bit */
         adapter->txd_cmd |= E1000_ADVTXD_DCMD_RS;
-
-        adapter->tx_queue_len = adapter->netdev->tx_queue_len;
 }
 
 /**
@@ -1524,7 +1522,6 @@ void igbvf_down(struct igbvf_adapter *adapter)
 
         del_timer_sync(&adapter->watchdog_timer);
 
-        netdev->tx_queue_len = adapter->tx_queue_len;
         netif_carrier_off(netdev);
 
         /* record the stats before reset*/
@@ -1857,21 +1854,15 @@ static void igbvf_watchdog_task(struct work_struct *work)
                                                   &adapter->link_duplex);
                         igbvf_print_link_info(adapter);
 
-                        /*
-                         * tweak tx_queue_len according to speed/duplex
-                         * and adjust the timeout factor
-                         */
-                        netdev->tx_queue_len = adapter->tx_queue_len;
+                        /* adjust timeout factor according to speed/duplex */
                         adapter->tx_timeout_factor = 1;
                         switch (adapter->link_speed) {
                         case SPEED_10:
                                 txb2b = 0;
-                                netdev->tx_queue_len = 10;
                                 adapter->tx_timeout_factor = 16;
                                 break;
                         case SPEED_100:
                                 txb2b = 0;
-                                netdev->tx_queue_len = 100;
                                 /* maybe add some timeout factor ? */
                                 break;
                         }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 19e94ee155a2..79c35ae3718c 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -204,14 +204,17 @@ enum ixgbe_ring_f_enum {
 #define IXGBE_MAX_FDIR_INDICES 64
 #ifdef IXGBE_FCOE
 #define IXGBE_MAX_FCOE_INDICES  8
+#define MAX_RX_QUEUES (IXGBE_MAX_FDIR_INDICES + IXGBE_MAX_FCOE_INDICES)
+#define MAX_TX_QUEUES (IXGBE_MAX_FDIR_INDICES + IXGBE_MAX_FCOE_INDICES)
+#else
+#define MAX_RX_QUEUES IXGBE_MAX_FDIR_INDICES
+#define MAX_TX_QUEUES IXGBE_MAX_FDIR_INDICES
 #endif /* IXGBE_FCOE */
 struct ixgbe_ring_feature {
         int indices;
         int mask;
 } ____cacheline_internodealigned_in_smp;
 
-#define MAX_RX_QUEUES 128
-#define MAX_TX_QUEUES 128
 
 #define MAX_RX_PACKET_BUFFERS ((adapter->flags & IXGBE_FLAG_DCB_ENABLED) \
                               ? 8 : 1)
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index 1f30e163bd9c..b405a00817c6 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,7 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
+void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                           ixgbe_link_speed speed,
                                           bool autoneg,
@@ -68,7 +69,9 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
         if (hw->phy.multispeed_fiber) {
                 /* Set up dual speed SFP+ support */
                 mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
         } else {
+                mac->ops.flap_tx_laser = NULL;
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
                     (hw->phy.smart_speed == ixgbe_smart_speed_auto ||
@@ -413,6 +416,41 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
 }
 
 /**
+ *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  When the driver changes the link speeds that it can support,
+ *  it sets autotry_restart to true to indicate that we need to
+ *  initiate a new autotry session with the link partner.  To do
+ *  so, we set the speed then disable and re-enable the tx laser, to
+ *  alert the link partner that it also needs to restart autotry on its
+ *  end.  This is consistent with true clause 37 autoneg, which also
+ *  involves a loss of signal.
+ **/
+void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
+
+        if (hw->mac.autotry_restart) {
+                /* Disable tx laser; allow 100us to go dark per spec */
+                esdp_reg |= IXGBE_ESDP_SDP3;
+                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
+                udelay(100);
+
+                /* Enable tx laser; allow 100ms to light up */
+                esdp_reg &= ~IXGBE_ESDP_SDP3;
+                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
+                msleep(100);
+
+                hw->mac.autotry_restart = false;
+        }
+}
+
+/**
  *  ixgbe_setup_mac_link_multispeed_fiber - Set MAC link speed
  *  @hw: pointer to hardware structure
  *  @speed: new link speed
@@ -440,16 +478,6 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
         speed &= phy_link_speed;
 
         /*
-         * When the driver changes the link speeds that it can support,
-         * it sets autotry_restart to true to indicate that we need to
-         * initiate a new autotry session with the link partner.  To do
-         * so, we set the speed then disable and re-enable the tx laser, to
-         * alert the link partner that it also needs to restart autotry on its
-         * end.  This is consistent with true clause 37 autoneg, which also
-         * involves a loss of signal.
-         */
-
-        /*
          * Try each speed one by one, highest priority first.  We do this in
          * software because 10gb fiber doesn't support speed autonegotiation.
          */
@@ -466,6 +494,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                 /* Set the module link speed */
                 esdp_reg |= (IXGBE_ESDP_SDP5_DIR | IXGBE_ESDP_SDP5);
                 IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
 
                 /* Allow module to change analog characteristics (1G->10G) */
                 msleep(40);
@@ -478,19 +507,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                         return status;
 
                 /* Flap the tx laser if it has not already been done */
-                if (hw->mac.autotry_restart) {
-                        /* Disable tx laser; allow 100us to go dark per spec */
-                        esdp_reg |= IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        udelay(100);
-
-                        /* Enable tx laser; allow 2ms to light up per spec */
-                        esdp_reg &= ~IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        msleep(2);
-
-                        hw->mac.autotry_restart = false;
-                }
+                hw->mac.ops.flap_tx_laser(hw);
 
                 /*
                  * Wait for the controller to acquire link.  Per IEEE 802.3ap,
@@ -525,6 +542,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                 esdp_reg &= ~IXGBE_ESDP_SDP5;
                 esdp_reg |= IXGBE_ESDP_SDP5_DIR;
                 IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+                IXGBE_WRITE_FLUSH(hw);
 
                 /* Allow module to change analog characteristics (10G->1G) */
                 msleep(40);
@@ -537,19 +555,7 @@ s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                         return status;
 
                 /* Flap the tx laser if it has not already been done */
-                if (hw->mac.autotry_restart) {
-                        /* Disable tx laser; allow 100us to go dark per spec */
-                        esdp_reg |= IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        udelay(100);
-
-                        /* Enable tx laser; allow 2ms to light up per spec */
-                        esdp_reg &= ~IXGBE_ESDP_SDP3;
-                        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                        msleep(2);
-
-                        hw->mac.autotry_restart = false;
-                }
+                hw->mac.ops.flap_tx_laser(hw);
 
                 /* Wait for the link partner to also set speed */
                 msleep(100);
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 7949a446e4c7..1959ef76c962 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1853,6 +1853,26 @@ static void ixgbe_diag_test(struct net_device *netdev,
                 if (ixgbe_link_test(adapter, &data[4]))
                         eth_test->flags |= ETH_TEST_FL_FAILED;
 
+                if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                        int i;
+                        for (i = 0; i < adapter->num_vfs; i++) {
+                                if (adapter->vfinfo[i].clear_to_send) {
+                                        netdev_warn(netdev, "%s",
+                                                    "offline diagnostic is not "
+                                                    "supported when VFs are "
+                                                    "present\n");
+                                        data[0] = 1;
+                                        data[1] = 1;
+                                        data[2] = 1;
+                                        data[3] = 1;
+                                        eth_test->flags |= ETH_TEST_FL_FAILED;
+                                        clear_bit(__IXGBE_TESTING,
+                                                  &adapter->state);
+                                        goto skip_ol_tests;
+                                }
+                        }
+                }
+
                 if (if_running)
                         /* indicate we're in test mode */
                         dev_close(netdev);
@@ -1908,6 +1928,7 @@ skip_loopback:
 
                 clear_bit(__IXGBE_TESTING, &adapter->state);
         }
+skip_ol_tests:
         msleep_interruptible(4 * 1000);
 }
 
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index 4123dec0dfb7..9276d5965b0d 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -202,6 +202,15 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
                 addr = sg_dma_address(sg);
                 len = sg_dma_len(sg);
                 while (len) {
+                        /* max number of buffers allowed in one DDP context */
+                        if (j >= IXGBE_BUFFCNT_MAX) {
+                                netif_err(adapter, drv, adapter->netdev,
+                                          "xid=%x:%d,%d,%d:addr=%llx "
+                                          "not enough descriptors\n",
+                                          xid, i, j, dmacount, (u64)addr);
+                                goto out_noddp_free;
+                        }
+
                         /* get the offset of length of current buffer */
                         thisoff = addr & ((dma_addr_t)bufflen - 1);
                         thislen = min((bufflen - thisoff), len);
@@ -227,20 +236,13 @@ int ixgbe_fcoe_ddp_get(struct net_device *netdev, u16 xid,
                         len -= thislen;
                         addr += thislen;
                         j++;
-                        /* max number of buffers allowed in one DDP context */
-                        if (j > IXGBE_BUFFCNT_MAX) {
-                                DPRINTK(DRV, ERR, "xid=%x:%d,%d,%d:addr=%llx "
-                                        "not enough descriptors\n",
-                                        xid, i, j, dmacount, (u64)addr);
-                                goto out_noddp_free;
-                        }
                 }
         }
         /* only the last buffer may have non-full bufflen */
         lastsize = thisoff + thislen;
 
         fcbuff = (IXGBE_FCBUFF_4KB << IXGBE_FCBUFF_BUFFSIZE_SHIFT);
-        fcbuff |= (j << IXGBE_FCBUFF_BUFFCNT_SHIFT);
+        fcbuff |= ((j & 0xff) << IXGBE_FCBUFF_BUFFCNT_SHIFT);
         fcbuff |= (firstoff << IXGBE_FCBUFF_OFFSET_SHIFT);
         fcbuff |= (IXGBE_FCBUFF_VALID);
 
@@ -520,6 +522,9 @@ void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter)
         /* Enable L2 eth type filter for FCoE */
         IXGBE_WRITE_REG(hw, IXGBE_ETQF(IXGBE_ETQF_FILTER_FCOE),
                         (ETH_P_FCOE | IXGBE_ETQF_FCOE | IXGBE_ETQF_FILTER_EN));
+        /* Enable L2 eth type filter for FIP */
+        IXGBE_WRITE_REG(hw, IXGBE_ETQF(IXGBE_ETQF_FILTER_FIP),
+                        (ETH_P_FIP | IXGBE_ETQF_FILTER_EN));
         if (adapter->ring_feature[RING_F_FCOE].indices) {
                 /* Use multiple rx queues for FCoE by redirection table */
                 for (i = 0; i < IXGBE_FCRETA_SIZE; i++) {
@@ -530,6 +535,12 @@ void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter)
                 }
                 IXGBE_WRITE_REG(hw, IXGBE_FCRECTL, IXGBE_FCRECTL_ENA);
                 IXGBE_WRITE_REG(hw, IXGBE_ETQS(IXGBE_ETQF_FILTER_FCOE), 0);
+                fcoe_i = f->mask;
+                fcoe_i &= IXGBE_FCRETA_ENTRY_MASK;
+                fcoe_q = adapter->rx_ring[fcoe_i]->reg_idx;
+                IXGBE_WRITE_REG(hw, IXGBE_ETQS(IXGBE_ETQF_FILTER_FIP),
+                                IXGBE_ETQS_QUEUE_EN |
+                                (fcoe_q << IXGBE_ETQS_RX_QUEUE_SHIFT));
         } else  {
                 /* Use single rx queue for FCoE */
                 fcoe_i = f->mask;
@@ -539,6 +550,12 @@ void ixgbe_configure_fcoe(struct ixgbe_adapter *adapter)
                                 IXGBE_ETQS_QUEUE_EN |
                                 (fcoe_q << IXGBE_ETQS_RX_QUEUE_SHIFT));
         }
+        /* send FIP frames to the first FCoE queue */
+        fcoe_i = f->mask;
+        fcoe_q = adapter->rx_ring[fcoe_i]->reg_idx;
+        IXGBE_WRITE_REG(hw, IXGBE_ETQS(IXGBE_ETQF_FILTER_FIP),
+                        IXGBE_ETQS_QUEUE_EN |
+                        (fcoe_q << IXGBE_ETQS_RX_QUEUE_SHIFT));
 
         IXGBE_WRITE_REG(hw, IXGBE_FCRXCTRL,
                         IXGBE_FCRXCTRL_FCOELLI |
@@ -614,9 +631,9 @@ int ixgbe_fcoe_enable(struct net_device *netdev)
         netdev->vlan_features |= NETIF_F_FSO;
         netdev->vlan_features |= NETIF_F_FCOE_MTU;
         netdev->fcoe_ddp_xid = IXGBE_FCOE_DDP_MAX - 1;
-        netdev_features_change(netdev);
 
         ixgbe_init_interrupt_scheme(adapter);
+        netdev_features_change(netdev);
 
         if (netif_running(netdev))
                 netdev->netdev_ops->ndo_open(netdev);
@@ -660,11 +677,11 @@ int ixgbe_fcoe_disable(struct net_device *netdev)
         netdev->vlan_features &= ~NETIF_F_FSO;
         netdev->vlan_features &= ~NETIF_F_FCOE_MTU;
         netdev->fcoe_ddp_xid = 0;
-        netdev_features_change(netdev);
 
         ixgbe_cleanup_fcoe(adapter);
-
         ixgbe_init_interrupt_scheme(adapter);
+        netdev_features_change(netdev);
+
         if (netif_running(netdev))
                 netdev->netdev_ops->ndo_open(netdev);
         rc = 0;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 684af371462d..0c553f6cb534 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -935,10 +935,12 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                         if (skb->prev)
                                 skb = ixgbe_transform_rsc_queue(skb, &(rx_ring->rsc_count));
                         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
-                                if (IXGBE_RSC_CB(skb)->dma)
+                                if (IXGBE_RSC_CB(skb)->dma) {
                                         pci_unmap_single(pdev, IXGBE_RSC_CB(skb)->dma,
                                                          rx_ring->rx_buf_len,
                                                          PCI_DMA_FROMDEVICE);
+                                        IXGBE_RSC_CB(skb)->dma = 0;
+                                }
                                 if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)
                                         rx_ring->rsc_count += skb_shinfo(skb)->nr_frags;
                                 else
@@ -3054,6 +3056,14 @@ void ixgbe_reinit_locked(struct ixgbe_adapter *adapter)
         while (test_and_set_bit(__IXGBE_RESETTING, &adapter->state))
                 msleep(1);
         ixgbe_down(adapter);
+        /*
+         * If SR-IOV enabled then wait a bit before bringing the adapter
+         * back up to give the VFs time to respond to the reset.  The
+         * two second wait is based upon the watchdog timer cycle in
+         * the VF driver.
+         */
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED)
+                msleep(2000);
         ixgbe_up(adapter);
         clear_bit(__IXGBE_RESETTING, &adapter->state);
 }
@@ -3126,10 +3136,12 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                         rx_buffer_info->skb = NULL;
                         do {
                                 struct sk_buff *this = skb;
-                                if (IXGBE_RSC_CB(this)->dma)
+                                if (IXGBE_RSC_CB(this)->dma) {
                                         pci_unmap_single(pdev, IXGBE_RSC_CB(this)->dma,
                                                          rx_ring->rx_buf_len,
                                                          PCI_DMA_FROMDEVICE);
+                                        IXGBE_RSC_CB(this)->dma = 0;
+                                }
                                 skb = skb->prev;
                                 dev_kfree_skb(this);
                         } while (skb);
@@ -3232,13 +3244,15 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
 
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
-                for (i = 0 ; i < adapter->num_vfs; i++)
-                        adapter->vfinfo[i].clear_to_send = 0;
-
                 /* ping all the active vfs to let them know we are going down */
                 ixgbe_ping_all_vfs(adapter);
+
                 /* Disable all VFTE/VFRE TX/RX */
                 ixgbe_disable_tx_rx(adapter);
+
+                /* Mark all the VFs as inactive */
+                for (i = 0 ; i < adapter->num_vfs; i++)
+                        adapter->vfinfo[i].clear_to_send = 0;
         }
 
         /* disable receives */
@@ -5018,6 +5032,7 @@ static void ixgbe_multispeed_fiber_task(struct work_struct *work)
         autoneg = hw->phy.autoneg_advertised;
         if ((!autoneg) && (hw->mac.ops.get_link_capabilities))
                 hw->mac.ops.get_link_capabilities(hw, &autoneg, &negotiation);
+        hw->mac.autotry_restart = false;
         if (hw->mac.ops.setup_link)
                 hw->mac.ops.setup_link(hw, autoneg, negotiation, true);
         adapter->flags |= IXGBE_FLAG_NEED_LINK_UPDATE;
@@ -5633,7 +5648,8 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
 
 #ifdef IXGBE_FCOE
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
-            (skb->protocol == htons(ETH_P_FCOE))) {
+            ((skb->protocol == htons(ETH_P_FCOE)) ||
+             (skb->protocol == htons(ETH_P_FIP)))) {
                 txq &= (adapter->ring_feature[RING_F_FCOE].indices - 1);
                 txq += adapter->ring_feature[RING_F_FCOE].mask;
                 return txq;
@@ -5680,18 +5696,25 @@ static netdev_tx_t ixgbe_xmit_frame(struct sk_buff *skb,
 
         tx_ring = adapter->tx_ring[skb->queue_mapping];
 
-        if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
-            (skb->protocol == htons(ETH_P_FCOE))) {
-                tx_flags |= IXGBE_TX_FLAGS_FCOE;
 #ifdef IXGBE_FCOE
+        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
 #ifdef CONFIG_IXGBE_DCB
-                tx_flags &= ~(IXGBE_TX_FLAGS_VLAN_PRIO_MASK
-                              << IXGBE_TX_FLAGS_VLAN_SHIFT);
-                tx_flags |= ((adapter->fcoe.up << 13)
-                              << IXGBE_TX_FLAGS_VLAN_SHIFT);
-#endif
+                /* for FCoE with DCB, we force the priority to what
+                 * was specified by the switch */
+                if ((skb->protocol == htons(ETH_P_FCOE)) ||
+                    (skb->protocol == htons(ETH_P_FIP))) {
+                        tx_flags &= ~(IXGBE_TX_FLAGS_VLAN_PRIO_MASK
+                                      << IXGBE_TX_FLAGS_VLAN_SHIFT);
+                        tx_flags |= ((adapter->fcoe.up << 13)
+                                     << IXGBE_TX_FLAGS_VLAN_SHIFT);
+                }
 #endif
+                /* flag for FCoE offloads */
+                if (skb->protocol == htons(ETH_P_FCOE))
+                        tx_flags |= IXGBE_TX_FLAGS_FCOE;
         }
+#endif
+
         /* four things can cause us to need a context descriptor */
         if (skb_is_gso(skb) ||
             (skb->ip_summed == CHECKSUM_PARTIAL) ||
@@ -6046,7 +6069,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         indices += min_t(unsigned int, num_possible_cpus(),
                          IXGBE_MAX_FCOE_INDICES);
 #endif
-        indices = min_t(unsigned int, indices, MAX_TX_QUEUES);
         netdev = alloc_etherdev_mq(sizeof(struct ixgbe_adapter), indices);
         if (!netdev) {
                 err = -ENOMEM;
@@ -6245,9 +6267,6 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         case IXGBE_DEV_ID_82599_KX4:
                 adapter->wol = (IXGBE_WUFC_MAG | IXGBE_WUFC_EX |
                                 IXGBE_WUFC_MC | IXGBE_WUFC_BC);
-                /* Enable ACPI wakeup in GRC */
-                IXGBE_WRITE_REG(hw, IXGBE_GRC,
-                             (IXGBE_READ_REG(hw, IXGBE_GRC) & ~IXGBE_GRC_APME));
                 break;
         default:
                 adapter->wol = 0;
@@ -6380,6 +6399,16 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
         del_timer_sync(&adapter->sfp_timer);
         cancel_work_sync(&adapter->watchdog_task);
         cancel_work_sync(&adapter->sfp_task);
+        if (adapter->hw.phy.multispeed_fiber) {
+                struct ixgbe_hw *hw = &adapter->hw;
+                /*
+                 * Restart clause 37 autoneg, disable and re-enable
+                 * the tx laser, to clear & alert the link partner
+                 * that it needs to restart autotry
+                 */
+                hw->mac.autotry_restart = true;
+                hw->mac.ops.flap_tx_laser(hw);
+        }
         cancel_work_sync(&adapter->multispeed_fiber_task);
         cancel_work_sync(&adapter->sfp_config_module_task);
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 2be907466593..4ec6dc1a5b75 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -1298,6 +1298,7 @@
 #define IXGBE_ETQF_FILTER_BCN            1
 #define IXGBE_ETQF_FILTER_FCOE           2
 #define IXGBE_ETQF_FILTER_1588           3
+#define IXGBE_ETQF_FILTER_FIP            4
 /* VLAN Control Bit Masks */
 #define IXGBE_VLNCTRL_VET       0x0000FFFF  /* bits 0-15 */
 #define IXGBE_VLNCTRL_CFI       0x10000000  /* bit 28 */
@@ -2397,6 +2398,7 @@ struct ixgbe_mac_operations {
         s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
 
         /* Link */
+        void (*flap_tx_laser)(struct ixgbe_hw *);
         s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
         s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
         s32 (*get_link_capabilities)(struct ixgbe_hw *, ixgbe_link_speed *,
diff --git a/drivers/net/ixgbevf/ethtool.c b/drivers/net/ixgbevf/ethtool.c
index 399be0c34c36..6fdd651abcd1 100644
--- a/drivers/net/ixgbevf/ethtool.c
+++ b/drivers/net/ixgbevf/ethtool.c
@@ -46,22 +46,32 @@ struct ixgbe_stats {
         int sizeof_stat;
         int stat_offset;
         int base_stat_offset;
+        int saved_reset_offset;
 };
 
-#define IXGBEVF_STAT(m, b)  sizeof(((struct ixgbevf_adapter *)0)->m), \
-                            offsetof(struct ixgbevf_adapter, m),      \
-                            offsetof(struct ixgbevf_adapter, b)
+#define IXGBEVF_STAT(m, b, r)  sizeof(((struct ixgbevf_adapter *)0)->m), \
+                            offsetof(struct ixgbevf_adapter, m),         \
+                            offsetof(struct ixgbevf_adapter, b),         \
+                            offsetof(struct ixgbevf_adapter, r)
 static struct ixgbe_stats ixgbe_gstrings_stats[] = {
-        {"rx_packets", IXGBEVF_STAT(stats.vfgprc, stats.base_vfgprc)},
-        {"tx_packets", IXGBEVF_STAT(stats.vfgptc, stats.base_vfgptc)},
-        {"rx_bytes", IXGBEVF_STAT(stats.vfgorc, stats.base_vfgorc)},
-        {"tx_bytes", IXGBEVF_STAT(stats.vfgotc, stats.base_vfgotc)},
-        {"tx_busy", IXGBEVF_STAT(tx_busy, zero_base)},
-        {"multicast", IXGBEVF_STAT(stats.vfmprc, stats.base_vfmprc)},
-        {"rx_csum_offload_good", IXGBEVF_STAT(hw_csum_rx_good, zero_base)},
-        {"rx_csum_offload_errors", IXGBEVF_STAT(hw_csum_rx_error, zero_base)},
-        {"tx_csum_offload_ctxt", IXGBEVF_STAT(hw_csum_tx_good, zero_base)},
-        {"rx_header_split", IXGBEVF_STAT(rx_hdr_split, zero_base)},
+        {"rx_packets", IXGBEVF_STAT(stats.vfgprc, stats.base_vfgprc,
+                                    stats.saved_reset_vfgprc)},
+        {"tx_packets", IXGBEVF_STAT(stats.vfgptc, stats.base_vfgptc,
+                                    stats.saved_reset_vfgptc)},
+        {"rx_bytes", IXGBEVF_STAT(stats.vfgorc, stats.base_vfgorc,
+                                  stats.saved_reset_vfgorc)},
+        {"tx_bytes", IXGBEVF_STAT(stats.vfgotc, stats.base_vfgotc,
+                                  stats.saved_reset_vfgotc)},
+        {"tx_busy", IXGBEVF_STAT(tx_busy, zero_base, zero_base)},
+        {"multicast", IXGBEVF_STAT(stats.vfmprc, stats.base_vfmprc,
+                                   stats.saved_reset_vfmprc)},
+        {"rx_csum_offload_good", IXGBEVF_STAT(hw_csum_rx_good, zero_base,
+                                              zero_base)},
+        {"rx_csum_offload_errors", IXGBEVF_STAT(hw_csum_rx_error, zero_base,
+                                                zero_base)},
+        {"tx_csum_offload_ctxt", IXGBEVF_STAT(hw_csum_tx_good, zero_base,
+                                              zero_base)},
+        {"rx_header_split", IXGBEVF_STAT(rx_hdr_split, zero_base, zero_base)},
 };
 
 #define IXGBE_QUEUE_STATS_LEN 0
@@ -455,10 +465,14 @@ static void ixgbevf_get_ethtool_stats(struct net_device *netdev,
                         ixgbe_gstrings_stats[i].stat_offset;
                 char *b = (char *)adapter +
                         ixgbe_gstrings_stats[i].base_stat_offset;
+                char *r = (char *)adapter +
+                        ixgbe_gstrings_stats[i].saved_reset_offset;
                 data[i] = ((ixgbe_gstrings_stats[i].sizeof_stat ==
                             sizeof(u64)) ? *(u64 *)p : *(u32 *)p) -
                           ((ixgbe_gstrings_stats[i].sizeof_stat ==
-                            sizeof(u64)) ? *(u64 *)b : *(u32 *)b);
+                            sizeof(u64)) ? *(u64 *)b : *(u32 *)b) +
+                          ((ixgbe_gstrings_stats[i].sizeof_stat ==
+                            sizeof(u64)) ? *(u64 *)r : *(u32 *)r);
         }
 }
 
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index ca653c49b765..1bbbef3ee3f4 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -965,7 +965,7 @@ static irqreturn_t ixgbevf_msix_mbx(int irq, void *data)
 
         if ((msg & IXGBE_MBVFICR_VFREQ_MASK) == IXGBE_PF_CONTROL_MSG)
                 mod_timer(&adapter->watchdog_timer,
-                          round_jiffies(jiffies + 10));
+                          round_jiffies(jiffies + 1));
 
         return IRQ_HANDLED;
 }
@@ -1610,6 +1610,44 @@ static inline void ixgbevf_rx_desc_queue_enable(struct ixgbevf_adapter *adapter,
                                 (adapter->rx_ring[rxr].count - 1));
 }
 
+static void ixgbevf_save_reset_stats(struct ixgbevf_adapter *adapter)
+{
+        /* Only save pre-reset stats if there are some */
+        if (adapter->stats.vfgprc || adapter->stats.vfgptc) {
+                adapter->stats.saved_reset_vfgprc += adapter->stats.vfgprc -
+                        adapter->stats.base_vfgprc;
+                adapter->stats.saved_reset_vfgptc += adapter->stats.vfgptc -
+                        adapter->stats.base_vfgptc;
+                adapter->stats.saved_reset_vfgorc += adapter->stats.vfgorc -
+                        adapter->stats.base_vfgorc;
+                adapter->stats.saved_reset_vfgotc += adapter->stats.vfgotc -
+                        adapter->stats.base_vfgotc;
+                adapter->stats.saved_reset_vfmprc += adapter->stats.vfmprc -
+                        adapter->stats.base_vfmprc;
+        }
+}
+
+static void ixgbevf_init_last_counter_stats(struct ixgbevf_adapter *adapter)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+
+        adapter->stats.last_vfgprc = IXGBE_READ_REG(hw, IXGBE_VFGPRC);
+        adapter->stats.last_vfgorc = IXGBE_READ_REG(hw, IXGBE_VFGORC_LSB);
+        adapter->stats.last_vfgorc |=
+                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGORC_MSB))) << 32);
+        adapter->stats.last_vfgptc = IXGBE_READ_REG(hw, IXGBE_VFGPTC);
+        adapter->stats.last_vfgotc = IXGBE_READ_REG(hw, IXGBE_VFGOTC_LSB);
+        adapter->stats.last_vfgotc |=
+                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGOTC_MSB))) << 32);
+        adapter->stats.last_vfmprc = IXGBE_READ_REG(hw, IXGBE_VFMPRC);
+
+        adapter->stats.base_vfgprc = adapter->stats.last_vfgprc;
+        adapter->stats.base_vfgorc = adapter->stats.last_vfgorc;
+        adapter->stats.base_vfgptc = adapter->stats.last_vfgptc;
+        adapter->stats.base_vfgotc = adapter->stats.last_vfgotc;
+        adapter->stats.base_vfmprc = adapter->stats.last_vfmprc;
+}
+
 static int ixgbevf_up_complete(struct ixgbevf_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
@@ -1656,6 +1694,9 @@ static int ixgbevf_up_complete(struct ixgbevf_adapter *adapter)
         /* enable transmits */
         netif_tx_start_all_queues(netdev);
 
+        ixgbevf_save_reset_stats(adapter);
+        ixgbevf_init_last_counter_stats(adapter);
+
         /* bring the link up in the watchdog, this could race with our first
          * link up interrupt but shouldn't be a problem */
         adapter->flags |= IXGBE_FLAG_NEED_LINK_UPDATE;
@@ -2228,27 +2269,6 @@ out:
         return err;
 }
 
-static void ixgbevf_init_last_counter_stats(struct ixgbevf_adapter *adapter)
-{
-        struct ixgbe_hw *hw = &adapter->hw;
-
-        adapter->stats.last_vfgprc = IXGBE_READ_REG(hw, IXGBE_VFGPRC);
-        adapter->stats.last_vfgorc = IXGBE_READ_REG(hw, IXGBE_VFGORC_LSB);
-        adapter->stats.last_vfgorc |=
-                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGORC_MSB))) << 32);
-        adapter->stats.last_vfgptc = IXGBE_READ_REG(hw, IXGBE_VFGPTC);
-        adapter->stats.last_vfgotc = IXGBE_READ_REG(hw, IXGBE_VFGOTC_LSB);
-        adapter->stats.last_vfgotc |=
-                (((u64)(IXGBE_READ_REG(hw, IXGBE_VFGOTC_MSB))) << 32);
-        adapter->stats.last_vfmprc = IXGBE_READ_REG(hw, IXGBE_VFMPRC);
-
-        adapter->stats.base_vfgprc = adapter->stats.last_vfgprc;
-        adapter->stats.base_vfgorc = adapter->stats.last_vfgorc;
-        adapter->stats.base_vfgptc = adapter->stats.last_vfgptc;
-        adapter->stats.base_vfgotc = adapter->stats.last_vfgotc;
-        adapter->stats.base_vfmprc = adapter->stats.last_vfmprc;
-}
-
 #define UPDATE_VF_COUNTER_32bit(reg, last_counter, counter)     \
         {                                                       \
                 u32 current_counter = IXGBE_READ_REG(hw, reg);  \
@@ -2399,7 +2419,7 @@ static void ixgbevf_watchdog_task(struct work_struct *work)
                 if (!netif_carrier_ok(netdev)) {
                         hw_dbg(&adapter->hw, "NIC Link is Up %s, ",
                                ((link_speed == IXGBE_LINK_SPEED_10GB_FULL) ?
-                                "10 Gbps" : "1 Gbps"));
+                                "10 Gbps\n" : "1 Gbps\n"));
                         netif_carrier_on(netdev);
                         netif_tx_wake_all_queues(netdev);
                 } else {
@@ -2416,9 +2436,9 @@ static void ixgbevf_watchdog_task(struct work_struct *work)
                 }
         }
 
-pf_has_reset:
         ixgbevf_update_stats(adapter);
 
+pf_has_reset:
         /* Force detection of hung controller every watchdog period */
         adapter->detect_tx_hung = true;
 
@@ -2675,7 +2695,7 @@ static int ixgbevf_open(struct net_device *netdev)
                 if (hw->adapter_stopped) {
                         err = IXGBE_ERR_MBX;
                         printk(KERN_ERR "Unable to start - perhaps the PF"
-                               "Driver isn't up yet\n");
+                               " Driver isn't up yet\n");
                         goto err_setup_reset;
                 }
         }
@@ -2923,9 +2943,10 @@ static int ixgbevf_tx_map(struct ixgbevf_adapter *adapter,
         struct ixgbevf_tx_buffer *tx_buffer_info;
         unsigned int len;
         unsigned int total = skb->len;
-        unsigned int offset = 0, size, count = 0, i;
+        unsigned int offset = 0, size, count = 0;
         unsigned int nr_frags = skb_shinfo(skb)->nr_frags;
         unsigned int f;
+        int i;
 
         i = tx_ring->next_to_use;
 
@@ -3390,8 +3411,6 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
         /* setup the private structure */
         err = ixgbevf_sw_init(adapter);
 
-        ixgbevf_init_last_counter_stats(adapter);
-
 #ifdef MAX_SKB_FRAGS
         netdev->features = NETIF_F_SG |
                            NETIF_F_IP_CSUM |
@@ -3449,6 +3468,8 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
 
         adapter->netdev_registered = true;
 
+        ixgbevf_init_last_counter_stats(adapter);
+
         /* print the MAC address */
         hw_dbg(hw, "%2.2x:%2.2x:%2.2x:%2.2x:%2.2x:%2.2x\n",
                netdev->dev_addr[0],
diff --git a/drivers/net/ixgbevf/vf.h b/drivers/net/ixgbevf/vf.h
index 799600e92700..1f31b052d4b4 100644
--- a/drivers/net/ixgbevf/vf.h
+++ b/drivers/net/ixgbevf/vf.h
@@ -157,6 +157,12 @@ struct ixgbevf_hw_stats {
         u64 vfgorc;
         u64 vfgotc;
         u64 vfmprc;
+
+        u64 saved_reset_vfgprc;
+        u64 saved_reset_vfgptc;
+        u64 saved_reset_vfgorc;
+        u64 saved_reset_vfgotc;
+        u64 saved_reset_vfmprc;
 };
 
 struct ixgbevf_info {
diff --git a/drivers/net/jme.c b/drivers/net/jme.c
index 0f31497833df..c0b59a555384 100644
--- a/drivers/net/jme.c
+++ b/drivers/net/jme.c
@@ -946,6 +946,8 @@ jme_alloc_and_feed_skb(struct jme_adapter *jme, int idx)
                                 jme->jme_vlan_rx(skb, jme->vlgrp,
                                         le16_to_cpu(rxdesc->descwb.vlan));
                                 NET_STAT(jme).rx_bytes += 4;
+                        } else {
+                                dev_kfree_skb(skb);
                         }
                 } else {
                         jme->jme_rx(skb);
@@ -2081,12 +2083,45 @@ jme_tx_timeout(struct net_device *netdev)
         jme_reset_link(jme);
 }
 
+static inline void jme_pause_rx(struct jme_adapter *jme)
+{
+        atomic_dec(&jme->link_changing);
+
+        jme_set_rx_pcc(jme, PCC_OFF);
+        if (test_bit(JME_FLAG_POLL, &jme->flags)) {
+                JME_NAPI_DISABLE(jme);
+        } else {
+                tasklet_disable(&jme->rxclean_task);
+                tasklet_disable(&jme->rxempty_task);
+        }
+}
+
+static inline void jme_resume_rx(struct jme_adapter *jme)
+{
+        struct dynpcc_info *dpi = &(jme->dpi);
+
+        if (test_bit(JME_FLAG_POLL, &jme->flags)) {
+                JME_NAPI_ENABLE(jme);
+        } else {
+                tasklet_hi_enable(&jme->rxclean_task);
+                tasklet_hi_enable(&jme->rxempty_task);
+        }
+        dpi->cur                = PCC_P1;
+        dpi->attempt            = PCC_P1;
+        dpi->cnt                = 0;
+        jme_set_rx_pcc(jme, PCC_P1);
+
+        atomic_inc(&jme->link_changing);
+}
+
 static void
 jme_vlan_rx_register(struct net_device *netdev, struct vlan_group *grp)
 {
         struct jme_adapter *jme = netdev_priv(netdev);
 
+        jme_pause_rx(jme);
         jme->vlgrp = grp;
+        jme_resume_rx(jme);
 }
 
 static void
diff --git a/drivers/net/jme.h b/drivers/net/jme.h
index c19db9146a2f..07ad3a457185 100644
--- a/drivers/net/jme.h
+++ b/drivers/net/jme.h
@@ -25,7 +25,7 @@
 #define __JME_H_INCLUDED__
 
 #define DRV_NAME        "jme"
-#define DRV_VERSION     "1.0.5"
+#define DRV_VERSION     "1.0.6"
 #define PFX             DRV_NAME ": "
 
 #define PCI_DEVICE_ID_JMICRON_JMC250    0x0250
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 0573e0bb4444..13cc1ca261d9 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -976,7 +976,6 @@ static void ks8851_set_rx_mode(struct net_device *dev)
                         crc >>= (32 - 6);  /* get top six bits */
 
                         rxctrl.mchash[crc >> 4] |= (1 << (crc & 0xf));
-                        mcptr = mcptr->next;
                 }
 
                 rxctrl.rxcr1 = RXCR1_RXME | RXCR1_RXPAFMA;
diff --git a/drivers/net/ksz884x.c b/drivers/net/ksz884x.c
index 0f59099ee72f..6c5327af1bf9 100644
--- a/drivers/net/ksz884x.c
+++ b/drivers/net/ksz884x.c
@@ -6322,7 +6322,7 @@ static int netdev_set_eeprom(struct net_device *dev,
         int len;
 
         if (eeprom->magic != EEPROM_MAGIC)
-                return 1;
+                return -EINVAL;
 
         len = (eeprom->offset + eeprom->len + 1) / 2;
         for (i = eeprom->offset / 2; i < len; i++)
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index 144d2e880422..0f703838e21a 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -53,8 +53,8 @@
 
 #define _NETXEN_NIC_LINUX_MAJOR 4
 #define _NETXEN_NIC_LINUX_MINOR 0
-#define _NETXEN_NIC_LINUX_SUBVERSION 72
-#define NETXEN_NIC_LINUX_VERSIONID  "4.0.72"
+#define _NETXEN_NIC_LINUX_SUBVERSION 73
+#define NETXEN_NIC_LINUX_VERSIONID  "4.0.73"
 
 #define NETXEN_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
diff --git a/drivers/net/netxen/netxen_nic_ctx.c b/drivers/net/netxen/netxen_nic_ctx.c
index 2a8ef5fc9663..f26e54716c88 100644
--- a/drivers/net/netxen/netxen_nic_ctx.c
+++ b/drivers/net/netxen/netxen_nic_ctx.c
@@ -669,13 +669,15 @@ int netxen_alloc_hw_resources(struct netxen_adapter *adapter)
                 }
                 sds_ring->desc_head = (struct status_desc *)addr;
 
-                sds_ring->crb_sts_consumer =
-                        netxen_get_ioaddr(adapter,
-                        recv_crb_registers[port].crb_sts_consumer[ring]);
+                if (NX_IS_REVISION_P2(adapter->ahw.revision_id)) {
+                        sds_ring->crb_sts_consumer =
+                                netxen_get_ioaddr(adapter,
+                                recv_crb_registers[port].crb_sts_consumer[ring]);
 
-                sds_ring->crb_intr_mask =
-                        netxen_get_ioaddr(adapter,
-                        recv_crb_registers[port].sw_int_mask[ring]);
+                        sds_ring->crb_intr_mask =
+                                netxen_get_ioaddr(adapter,
+                                recv_crb_registers[port].sw_int_mask[ring]);
+                }
         }
 
 
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 1c63610ead42..7eb925a9f36e 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -761,7 +761,7 @@ nx_get_bios_version(struct netxen_adapter *adapter)
         if (adapter->fw_type == NX_UNIFIED_ROMIMAGE) {
                 bios_ver = cpu_to_le32(*((u32 *) (&fw->data[prd_off])
                                                 + NX_UNI_BIOS_VERSION_OFF));
-                return (bios_ver << 24) + ((bios_ver >> 8) & 0xff00) +
+                return (bios_ver << 16) + ((bios_ver >> 8) & 0xff00) +
                                                         (bios_ver >> 24);
         } else
                 return cpu_to_le32(*(u32 *)&fw->data[NX_BIOS_VERSION_OFFSET]);
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 08780ef1c1f8..01808b28d1b6 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -604,16 +604,14 @@ netxen_cleanup_pci_map(struct netxen_adapter *adapter)
 static int
 netxen_setup_pci_map(struct netxen_adapter *adapter)
 {
-        void __iomem *mem_ptr0 = NULL;
-        void __iomem *mem_ptr1 = NULL;
-        void __iomem *mem_ptr2 = NULL;
         void __iomem *db_ptr = NULL;
 
         resource_size_t mem_base, db_base;
-        unsigned long mem_len, db_len = 0, pci_len0 = 0;
+        unsigned long mem_len, db_len = 0;
 
         struct pci_dev *pdev = adapter->pdev;
         int pci_func = adapter->ahw.pci_func;
+        struct netxen_hardware_context *ahw = &adapter->ahw;
 
         int err = 0;
 
@@ -630,24 +628,40 @@ netxen_setup_pci_map(struct netxen_adapter *adapter)
 
         /* 128 Meg of memory */
         if (mem_len == NETXEN_PCI_128MB_SIZE) {
-                mem_ptr0 = ioremap(mem_base, FIRST_PAGE_GROUP_SIZE);
-                mem_ptr1 = ioremap(mem_base + SECOND_PAGE_GROUP_START,
+
+                ahw->pci_base0 = ioremap(mem_base, FIRST_PAGE_GROUP_SIZE);
+                ahw->pci_base1 = ioremap(mem_base + SECOND_PAGE_GROUP_START,
                                 SECOND_PAGE_GROUP_SIZE);
-                mem_ptr2 = ioremap(mem_base + THIRD_PAGE_GROUP_START,
+                ahw->pci_base2 = ioremap(mem_base + THIRD_PAGE_GROUP_START,
                                 THIRD_PAGE_GROUP_SIZE);
-                pci_len0 = FIRST_PAGE_GROUP_SIZE;
+                if (ahw->pci_base0 == NULL || ahw->pci_base1 == NULL ||
+                                                ahw->pci_base2 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        err = -EIO;
+                        goto err_out;
+                }
+
+                ahw->pci_len0 = FIRST_PAGE_GROUP_SIZE;
+
         } else if (mem_len == NETXEN_PCI_32MB_SIZE) {
-                mem_ptr1 = ioremap(mem_base, SECOND_PAGE_GROUP_SIZE);
-                mem_ptr2 = ioremap(mem_base + THIRD_PAGE_GROUP_START -
+
+                ahw->pci_base1 = ioremap(mem_base, SECOND_PAGE_GROUP_SIZE);
+                ahw->pci_base2 = ioremap(mem_base + THIRD_PAGE_GROUP_START -
                         SECOND_PAGE_GROUP_START, THIRD_PAGE_GROUP_SIZE);
+                if (ahw->pci_base1 == NULL || ahw->pci_base2 == NULL) {
+                        dev_err(&pdev->dev, "failed to map PCI bar 0\n");
+                        err = -EIO;
+                        goto err_out;
+                }
+
         } else if (mem_len == NETXEN_PCI_2MB_SIZE) {
 
-                mem_ptr0 = pci_ioremap_bar(pdev, 0);
-                if (mem_ptr0 == NULL) {
+                ahw->pci_base0 = pci_ioremap_bar(pdev, 0);
+                if (ahw->pci_base0 == NULL) {
                         dev_err(&pdev->dev, "failed to map PCI bar 0\n");
                         return -EIO;
                 }
-                pci_len0 = mem_len;
+                ahw->pci_len0 = mem_len;
         } else {
                 return -EIO;
         }
@@ -656,11 +670,6 @@ netxen_setup_pci_map(struct netxen_adapter *adapter)
 
         dev_info(&pdev->dev, "%dMB memory map\n", (int)(mem_len>>20));
 
-        adapter->ahw.pci_base0 = mem_ptr0;
-        adapter->ahw.pci_len0 = pci_len0;
-        adapter->ahw.pci_base1 = mem_ptr1;
-        adapter->ahw.pci_base2 = mem_ptr2;
-
         if (NX_IS_REVISION_P3P(adapter->ahw.revision_id)) {
                 adapter->ahw.ocm_win_crb = netxen_get_ioaddr(adapter,
                         NETXEN_PCIX_PS_REG(PCIX_OCM_WINDOW_REG(pci_func)));
@@ -1246,8 +1255,8 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         int pci_func_id = PCI_FUNC(pdev->devfn);
         uint8_t revision_id;
 
-        if (pdev->revision >= NX_P3_A0 && pdev->revision < NX_P3_B1) {
-                pr_warning("%s: chip revisions between 0x%x-0x%x"
+        if (pdev->revision >= NX_P3_A0 && pdev->revision <= NX_P3_B1) {
+                pr_warning("%s: chip revisions between 0x%x-0x%x "
                                 "will not be enabled.\n",
                                 module_name(THIS_MODULE), NX_P3_A0, NX_P3_B1);
                 return -ENODEV;
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 776cad2f5715..1028fcb91a28 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1549,6 +1549,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x021b, 0x0101),
         PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x08a1, 0xc0ab),
         PCMCIA_PFC_DEVICE_PROD_ID12(0, "AnyCom", "Fast Ethernet + 56K COMBO", 0x578ba6e7, 0xb0ac62c4),
+        PCMCIA_PFC_DEVICE_PROD_ID12(0, "ATKK", "LM33-PCM-T", 0xba9eb7e2, 0x077c174e),
         PCMCIA_PFC_DEVICE_PROD_ID12(0, "D-Link", "DME336T", 0x1a424a1c, 0xb23897ff),
         PCMCIA_PFC_DEVICE_PROD_ID12(0, "Grey Cell", "GCS3000", 0x2a151fac, 0x48b932ae),
         PCMCIA_PFC_DEVICE_PROD_ID12(0, "Linksys", "EtherFast 10&100 + 56K PC Card (PCMLM56)", 0x0733cc81, 0xb3765033),
@@ -1740,7 +1741,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_MFC_DEVICE_CIS_PROD_ID12(0, "DAYNA COMMUNICATIONS", "LAN AND MODEM MULTIFUNCTION", 0x8fdf8f89, 0xdd5ed9e8, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_PROD_ID4(0, "NSC MF LAN/Modem", 0x58fc6056, "cis/DP83903.cis"),
         PCMCIA_MFC_DEVICE_CIS_MANF_CARD(0, 0x0175, 0x0000, "cis/DP83903.cis"),
-        PCMCIA_DEVICE_CIS_MANF_CARD(0xc00f, 0x0002, "cis/LA-PCM.cis"),
+        PCMCIA_DEVICE_CIS_PROD_ID12("Allied Telesis,K.K", "Ethernet LAN Card", 0x2ad62f3c, 0x9fd2f0a2, "cis/LA-PCM.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("KTI", "PE520 PLUS", 0xad180345, 0x9d58d392, "cis/PE520.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("NDC", "Ethernet", 0x01c43ae1, 0x00b2e941, "cis/NE2K.cis"),
         PCMCIA_DEVICE_CIS_PROD_ID12("PMX   ", "PE-200", 0x34f3f1c8, 0x10b59f8c, "cis/PE-200.cis"),
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 9d3ebf3e975e..96740051cdcc 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -186,8 +186,13 @@ static DEFINE_PCI_DEVICE_TABLE(rtl8169_pci_tbl) = {
 
 MODULE_DEVICE_TABLE(pci, rtl8169_pci_tbl);
 
-static int rx_copybreak = 200;
-static int use_dac = -1;
+/*
+ * we set our copybreak very high so that we don't have
+ * to allocate 16k frames all the time (see note in
+ * rtl8169_open()
+ */
+static int rx_copybreak = 16383;
+static int use_dac;
 static struct {
         u32 msg_enable;
 } debug = { -1 };
@@ -511,8 +516,7 @@ MODULE_DESCRIPTION("RealTek RTL-8169 Gigabit Ethernet driver");
 module_param(rx_copybreak, int, 0);
 MODULE_PARM_DESC(rx_copybreak, "Copy breakpoint for copy-only-tiny-frames");
 module_param(use_dac, int, 0);
-MODULE_PARM_DESC(use_dac, "Enable PCI DAC. -1 defaults on for PCI Express only."
-" Unsafe on 32 bit PCI slot.");
+MODULE_PARM_DESC(use_dac, "Enable PCI DAC. Unsafe on 32 bit PCI slot.");
 module_param_named(debug, debug.msg_enable, int, 0);
 MODULE_PARM_DESC(debug, "Debug verbosity level (0=none, ..., 16=all)");
 MODULE_LICENSE("GPL");
@@ -2821,8 +2825,8 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
         spin_lock_irq(&tp->lock);
 
         RTL_W8(Cfg9346, Cfg9346_Unlock);
-        RTL_W32(MAC0, low);
         RTL_W32(MAC4, high);
+        RTL_W32(MAC0, low);
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
         spin_unlock_irq(&tp->lock);
@@ -2974,7 +2978,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         void __iomem *ioaddr;
         unsigned int i;
         int rc;
-        int this_use_dac = use_dac;
 
         if (netif_msg_drv(&debug)) {
                 printk(KERN_INFO "%s Gigabit Ethernet driver %s loaded\n",
@@ -3040,17 +3043,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         tp->cp_cmd = PCIMulRW | RxChkSum;
 
-        tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-        if (!tp->pcie_cap)
-                netif_info(tp, probe, dev, "no PCI Express capability\n");
-
-        if (this_use_dac < 0)
-                this_use_dac = tp->pcie_cap != 0;
-
         if ((sizeof(dma_addr_t) > 4) &&
-            this_use_dac &&
-            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
-                netif_info(tp, probe, dev, "using 64-bit DMA\n");
+            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && use_dac) {
                 tp->cp_cmd |= PCIDAC;
                 dev->features |= NETIF_F_HIGHDMA;
         } else {
@@ -3069,6 +3063,10 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_free_res_4;
         }
 
+        tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+        if (!tp->pcie_cap)
+                netif_info(tp, probe, dev, "no PCI Express capability\n");
+
         RTL_W16(IntrMask, 0x0000);
 
         /* Soft reset the chip. */
@@ -3224,9 +3222,13 @@ static void __devexit rtl8169_remove_one(struct pci_dev *pdev)
 }
 
 static void rtl8169_set_rxbufsize(struct rtl8169_private *tp,
-                                  struct net_device *dev)
+                                  unsigned int mtu)
 {
-        unsigned int max_frame = dev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+        unsigned int max_frame = mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
+
+        if (max_frame != 16383)
+                printk(KERN_WARNING "WARNING! Changing of MTU on this NIC"
+                        "May lead to frame reception errors!\n");
 
         tp->rx_buf_sz = (max_frame > RX_BUF_SIZE) ? max_frame : RX_BUF_SIZE;
 }
@@ -3238,7 +3240,17 @@ static int rtl8169_open(struct net_device *dev)
         int retval = -ENOMEM;
 
 
-        rtl8169_set_rxbufsize(tp, dev);
+        /*
+         * Note that we use a magic value here, its wierd I know
+         * its done because, some subset of rtl8169 hardware suffers from
+         * a problem in which frames received that are longer than
+         * the size set in RxMaxSize register return garbage sizes
+         * when received.  To avoid this we need to turn off filtering,
+         * which is done by setting a value of 16383 in the RxMaxSize register
+         * and allocating 16k frames to handle the largest possible rx value
+         * thats what the magic math below does.
+         */
+        rtl8169_set_rxbufsize(tp, 16383 - VLAN_ETH_HLEN - ETH_FCS_LEN);
 
         /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
@@ -3891,7 +3903,7 @@ static int rtl8169_change_mtu(struct net_device *dev, int new_mtu)
 
         rtl8169_down(dev);
 
-        rtl8169_set_rxbufsize(tp, dev);
+        rtl8169_set_rxbufsize(tp, dev->mtu);
 
         ret = rtl8169_init_ring(dev);
         if (ret < 0)
@@ -4754,8 +4766,8 @@ static void rtl_set_rx_mode(struct net_device *dev)
                 mc_filter[1] = swab32(data);
         }
 
-        RTL_W32(MAR0 + 0, mc_filter[0]);
         RTL_W32(MAR0 + 4, mc_filter[1]);
+        RTL_W32(MAR0 + 0, mc_filter[0]);
 
         RTL_W32(RxConfig, tmp);
 
diff --git a/drivers/net/tulip/uli526x.c b/drivers/net/tulip/uli526x.c
index 0ab05af237e5..a4f09d490531 100644
--- a/drivers/net/tulip/uli526x.c
+++ b/drivers/net/tulip/uli526x.c
@@ -851,13 +851,15 @@ static void uli526x_rx_packet(struct net_device *dev, struct uli526x_board_info
 
                         if ( !(rdes0 & 0x8000) ||
                                 ((db->cr6_data & CR6_PM) && (rxlen>6)) ) {
+                                struct sk_buff *new_skb = NULL;
+
                                 skb = rxptr->rx_skb_ptr;
 
                                 /* Good packet, send to upper layer */
                                 /* Shorst packet used new SKB */
-                                if ( (rxlen < RX_COPY_SIZE) &&
-                                        ( (skb = dev_alloc_skb(rxlen + 2) )
-                                        != NULL) ) {
+                                if ((rxlen < RX_COPY_SIZE) &&
+                                    (((new_skb = dev_alloc_skb(rxlen + 2)) != NULL))) {
+                                        skb = new_skb;
                                         /* size less than COPY_SIZE, allocate a rxlen SKB */
                                         skb_reserve(skb, 2); /* 16byte align */
                                         memcpy(skb_put(skb, rxlen),
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index d222d7e25273..73f9a31cf94d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1189,9 +1189,21 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
         }
 
         if (csum) {
-                u32 csum_preamble = smsc95xx_calc_csum_preamble(skb);
-                skb_push(skb, 4);
-                memcpy(skb->data, &csum_preamble, 4);
+                if (skb->len <= 45) {
+                        /* workaround - hardware tx checksum does not work
+                         * properly with extremely small packets */
+                        long csstart = skb->csum_start - skb_headroom(skb);
+                        __wsum calc = csum_partial(skb->data + csstart,
+                                skb->len - csstart, 0);
+                        *((__sum16 *)(skb->data + csstart
+                                + skb->csum_offset)) = csum_fold(calc);
+
+                        csum = false;
+                } else {
+                        u32 csum_preamble = smsc95xx_calc_csum_preamble(skb);
+                        skb_push(skb, 4);
+                        memcpy(skb->data, &csum_preamble, 4);
+                }
         }
 
         skb_push(skb, 4);
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3a486f3bad3d..bc278d4ee89d 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -812,7 +812,7 @@ static void set_mii_flow_control(struct velocity_info *vptr)
 
         case FLOW_CNTL_TX_RX:
                 MII_REG_BITS_ON(ANAR_PAUSE, MII_REG_ANAR, vptr->mac_regs);
-                MII_REG_BITS_ON(ANAR_ASMDIR, MII_REG_ANAR, vptr->mac_regs);
+                MII_REG_BITS_OFF(ANAR_ASMDIR, MII_REG_ANAR, vptr->mac_regs);
                 break;
 
         case FLOW_CNTL_DISABLE:
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b2c8207f7bc1..294b486bc3ed 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1353,25 +1353,6 @@ static enum ath9k_pkt_type get_hw_packet_type(struct sk_buff *skb)
         return htype;
 }
 
-static bool is_pae(struct sk_buff *skb)
-{
-        struct ieee80211_hdr *hdr;
-        __le16 fc;
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        fc = hdr->frame_control;
-
-        if (ieee80211_is_data(fc)) {
-                if (ieee80211_is_nullfunc(fc) ||
-                    /* Port Access Entity (IEEE 802.1X) */
-                    (skb->protocol == cpu_to_be16(ETH_P_PAE))) {
-                        return true;
-                }
-        }
-
-        return false;
-}
-
 static int get_hw_crypto_keytype(struct sk_buff *skb)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
@@ -1696,7 +1677,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
+                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 1ed5206721ec..8c12311dbb0a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -124,7 +124,7 @@ void iwl_free_tfds_in_queue(struct iwl_priv *priv,
         if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
                 priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
         else {
-                IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
+                IWL_DEBUG_TX(priv, "free more than tfds_in_queue (%u:%d)\n",
                         priv->stations[sta_id].tid[tid].tfds_in_queue,
                         freed);
                 priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index 0ccba57fb9fb..05e4d68eb4cc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -466,7 +466,8 @@ out:
 
 void wl1251_debugfs_reset(struct wl1251 *wl)
 {
-        memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
+        if (wl->stats.fw_stats != NULL)
+                memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
         wl->stats.retry_count = 0;
         wl->stats.excessive_retries = 0;
 }
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 40b48f569b1e..9665d6b17a2a 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -832,9 +832,8 @@ static inline void dbg_ctrl(struct controller *ctrl)
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
                 if (!pci_resource_len(pdev, i))
                         continue;
-                ctrl_info(ctrl, "  PCI resource [%d]     : 0x%llx@0x%llx\n",
-                          i, (unsigned long long)pci_resource_len(pdev, i),
-                          (unsigned long long)pci_resource_start(pdev, i));
+                ctrl_info(ctrl, "  PCI resource [%d]     : %pR\n",
+                          i, &pdev->resource[i]);
         }
         ctrl_info(ctrl, "Slot Capabilities      : 0x%08x\n", ctrl->slot_cap);
         ctrl_info(ctrl, "  Physical Slot Number : %d\n", PSN(ctrl));
diff --git a/drivers/pci/ioapic.c b/drivers/pci/ioapic.c
index 3e0d7b5dd1b9..fb9fdf4a42bf 100644
--- a/drivers/pci/ioapic.c
+++ b/drivers/pci/ioapic.c
@@ -31,9 +31,9 @@ static int ioapic_probe(struct pci_dev *dev, const struct pci_device_id *ent)
         acpi_status status;
         unsigned long long gsb;
         struct ioapic *ioapic;
-        u64 addr;
         int ret;
         char *type;
+        struct resource *res;
 
         handle = DEVICE_ACPI_HANDLE(&dev->dev);
         if (!handle)
@@ -69,13 +69,12 @@ static int ioapic_probe(struct pci_dev *dev, const struct pci_device_id *ent)
         if (pci_request_region(dev, 0, type))
                 goto exit_disable;
 
-        addr = pci_resource_start(dev, 0);
-        if (acpi_register_ioapic(ioapic->handle, addr, ioapic->gsi_base))
+        res = &dev->resource[0];
+        if (acpi_register_ioapic(ioapic->handle, res->start, ioapic->gsi_base))
                 goto exit_release;
 
         pci_set_drvdata(dev, ioapic);
-        dev_info(&dev->dev, "%s at %#llx, GSI %u\n", type, addr,
-                 ioapic->gsi_base);
+        dev_info(&dev->dev, "%s at %pR, GSI %u\n", type, res, ioapic->gsi_base);
         return 0;
 
 exit_release:
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index cb1dd5f4988c..1531f3a49879 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2576,18 +2576,17 @@ EXPORT_SYMBOL_GPL(pci_reset_function);
  */
 int pcix_get_max_mmrbc(struct pci_dev *dev)
 {
-        int err, cap;
+        int cap;
         u32 stat;
 
         cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
         if (!cap)
                 return -EINVAL;
 
-        err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
-        if (err)
+        if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
                 return -EINVAL;
 
-        return (stat & PCI_X_STATUS_MAX_READ) >> 12;
+        return 512 << ((stat & PCI_X_STATUS_MAX_READ) >> 21);
 }
 EXPORT_SYMBOL(pcix_get_max_mmrbc);
 
@@ -2600,18 +2599,17 @@ EXPORT_SYMBOL(pcix_get_max_mmrbc);
  */
 int pcix_get_mmrbc(struct pci_dev *dev)
 {
-        int ret, cap;
-        u32 cmd;
+        int cap;
+        u16 cmd;
 
         cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
         if (!cap)
                 return -EINVAL;
 
-        ret = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
-        if (!ret)
-                ret = 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
+        if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
+                return -EINVAL;
 
-        return ret;
+        return 512 << ((cmd & PCI_X_CMD_MAX_READ) >> 2);
 }
 EXPORT_SYMBOL(pcix_get_mmrbc);
 
@@ -2626,28 +2624,27 @@ EXPORT_SYMBOL(pcix_get_mmrbc);
  */
 int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
 {
-        int cap, err = -EINVAL;
-        u32 stat, cmd, v, o;
+        int cap;
+        u32 stat, v, o;
+        u16 cmd;
 
         if (mmrbc < 512 || mmrbc > 4096 || !is_power_of_2(mmrbc))
-                goto out;
+                return -EINVAL;
 
         v = ffs(mmrbc) - 10;
 
         cap = pci_find_capability(dev, PCI_CAP_ID_PCIX);
         if (!cap)
-                goto out;
+                return -EINVAL;
 
-        err = pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat);
-        if (err)
-                goto out;
+        if (pci_read_config_dword(dev, cap + PCI_X_STATUS, &stat))
+                return -EINVAL;
 
         if (v > (stat & PCI_X_STATUS_MAX_READ) >> 21)
                 return -E2BIG;
 
-        err = pci_read_config_dword(dev, cap + PCI_X_CMD, &cmd);
-        if (err)
-                goto out;
+        if (pci_read_config_word(dev, cap + PCI_X_CMD, &cmd))
+                return -EINVAL;
 
         o = (cmd & PCI_X_CMD_MAX_READ) >> 2;
         if (o != v) {
@@ -2657,10 +2654,10 @@ int pcix_set_mmrbc(struct pci_dev *dev, int mmrbc)
 
                 cmd &= ~PCI_X_CMD_MAX_READ;
                 cmd |= v << 2;
-                err = pci_write_config_dword(dev, cap + PCI_X_CMD, cmd);
+                if (pci_write_config_word(dev, cap + PCI_X_CMD, cmd))
+                        return -EIO;
         }
-out:
-        return err;
+        return 0;
 }
 EXPORT_SYMBOL(pcix_set_mmrbc);
 
@@ -3023,7 +3020,6 @@ EXPORT_SYMBOL(pcim_pin_device);
 EXPORT_SYMBOL(pci_disable_device);
 EXPORT_SYMBOL(pci_find_capability);
 EXPORT_SYMBOL(pci_bus_find_capability);
-EXPORT_SYMBOL(pci_register_set_vga_state);
 EXPORT_SYMBOL(pci_release_regions);
 EXPORT_SYMBOL(pci_request_regions);
 EXPORT_SYMBOL(pci_request_regions_exclusive);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 2a943090a3b7..882bd8d29fe3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -174,14 +174,19 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
         pci_read_config_dword(dev, pos, &sz);
         pci_write_config_dword(dev, pos, l);
 
+        if (!sz)
+                goto fail;      /* BAR not implemented */
+
         /*
          * All bits set in sz means the device isn't working properly.
-         * If the BAR isn't implemented, all bits must be 0.  If it's a
-         * memory BAR or a ROM, bit 0 must be clear; if it's an io BAR, bit
-         * 1 must be clear.
+         * If it's a memory BAR or a ROM, bit 0 must be clear; if it's
+         * an io BAR, bit 1 must be clear.
          */
-        if (!sz || sz == 0xffffffff)
+        if (sz == 0xffffffff) {
+                dev_err(&dev->dev, "reg %x: invalid size %#x; broken device?\n",
+                        pos, sz);
                 goto fail;
+        }
 
         /*
          * I don't know how l can have all bits set.  Copied from old code.
@@ -244,13 +249,17 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                                    pos, res);
                 }
         } else {
-                sz = pci_size(l, sz, mask);
+                u32 size = pci_size(l, sz, mask);
 
-                if (!sz)
+                if (!size) {
+                        dev_err(&dev->dev, "reg %x: invalid size "
+                                "(l %#x sz %#x mask %#x); broken device?",
+                                pos, l, sz, mask);
                         goto fail;
+                }
 
                 res->start = l;
-                res->end = l + sz;
+                res->end = l + size;
 
                 dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
         }
@@ -312,7 +321,7 @@ static void __devinit pci_read_bridge_io(struct pci_bus *child)
                 dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
         } else {
                 dev_printk(KERN_DEBUG, &dev->dev,
-                         "  bridge window [io  %04lx - %04lx] reg reading\n",
+                         "  bridge window [io  %#06lx-%#06lx] (disabled)\n",
                                  base, limit);
         }
 }
@@ -336,7 +345,7 @@ static void __devinit pci_read_bridge_mmio(struct pci_bus *child)
                 dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
         } else {
                 dev_printk(KERN_DEBUG, &dev->dev,
-                        "  bridge window [mem 0x%08lx - 0x%08lx] reg reading\n",
+                        "  bridge window [mem %#010lx-%#010lx] (disabled)\n",
                                          base, limit + 0xfffff);
         }
 }
@@ -387,7 +396,7 @@ static void __devinit pci_read_bridge_mmio_pref(struct pci_bus *child)
                 dev_printk(KERN_DEBUG, &dev->dev, "  bridge window %pR\n", res);
         } else {
                 dev_printk(KERN_DEBUG, &dev->dev,
-                     "  bridge window [mem 0x%08lx - %08lx pref] reg reading\n",
+                     "  bridge window [mem %#010lx-%#010lx pref] (disabled)\n",
                                          base, limit + 0xfffff);
         }
 }
@@ -673,16 +682,20 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
         int is_cardbus = (dev->hdr_type == PCI_HEADER_TYPE_CARDBUS);
         u32 buses, i, j = 0;
         u16 bctl;
+        u8 primary, secondary, subordinate;
         int broken = 0;
 
         pci_read_config_dword(dev, PCI_PRIMARY_BUS, &buses);
+        primary = buses & 0xFF;
+        secondary = (buses >> 8) & 0xFF;
+        subordinate = (buses >> 16) & 0xFF;
 
-        dev_dbg(&dev->dev, "scanning behind bridge, config %06x, pass %d\n",
-                buses & 0xffffff, pass);
+        dev_dbg(&dev->dev, "scanning [bus %02x-%02x] behind bridge, pass %d\n",
+                secondary, subordinate, pass);
 
         /* Check if setup is sensible at all */
         if (!pass &&
-            ((buses & 0xff) != bus->number || ((buses >> 8) & 0xff) <= bus->number)) {
+            (primary != bus->number || secondary <= bus->number)) {
                 dev_dbg(&dev->dev, "bus configuration invalid, reconfiguring\n");
                 broken = 1;
         }
@@ -693,15 +706,15 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
         pci_write_config_word(dev, PCI_BRIDGE_CONTROL,
                               bctl & ~PCI_BRIDGE_CTL_MASTER_ABORT);
 
-        if ((buses & 0xffff00) && !pcibios_assign_all_busses() && !is_cardbus && !broken) {
-                unsigned int cmax, busnr;
+        if ((secondary || subordinate) && !pcibios_assign_all_busses() &&
+            !is_cardbus && !broken) {
+                unsigned int cmax;
                 /*
                  * Bus already configured by firmware, process it in the first
                  * pass and just note the configuration.
                  */
                 if (pass)
                         goto out;
-                busnr = (buses >> 8) & 0xFF;
 
                 /*
                  * If we already got to this bus through a different bridge,
@@ -710,13 +723,13 @@ int __devinit pci_scan_bridge(struct pci_bus *bus, struct pci_dev *dev, int max,
                  * However, we continue to descend down the hierarchy and
                  * scan remaining child buses.
                  */
-                child = pci_find_bus(pci_domain_nr(bus), busnr);
+                child = pci_find_bus(pci_domain_nr(bus), secondary);
                 if (!child) {
-                        child = pci_add_new_bus(bus, dev, busnr);
+                        child = pci_add_new_bus(bus, dev, secondary);
                         if (!child)
                                 goto out;
-                        child->primary = buses & 0xFF;
-                        child->subordinate = (buses >> 16) & 0xFF;
+                        child->primary = primary;
+                        child->subordinate = subordinate;
                         child->bridge_ctl = bctl;
                 }
 
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 81d19d5683ac..3ea0b29c0104 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -368,8 +368,9 @@ static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
                 bus_region.end = res->end;
                 pcibios_bus_to_resource(dev, res, &bus_region);
 
-                pci_claim_resource(dev, nr);
-                dev_info(&dev->dev, "quirk: %pR claimed by %s\n", res, name);
+                if (pci_claim_resource(dev, nr) == 0)
+                        dev_info(&dev->dev, "quirk: %pR claimed by %s\n",
+                                 res, name);
         }
 }       
 
@@ -1977,11 +1978,25 @@ static void __devinit quirk_via_cx700_pci_parking_caching(struct pci_dev *dev)
         /*
          * Disable PCI Bus Parking and PCI Master read caching on CX700
          * which causes unspecified timing errors with a VT6212L on the PCI
-         * bus leading to USB2.0 packet loss. The defaults are that these
-         * features are turned off but some BIOSes turn them on.
+         * bus leading to USB2.0 packet loss.
+         *
+         * This quirk is only enabled if a second (on the external PCI bus)
+         * VT6212L is found -- the CX700 core itself also contains a USB
+         * host controller with the same PCI ID as the VT6212L.
          */
 
+        /* Count VT6212L instances */
+        struct pci_dev *p = pci_get_device(PCI_VENDOR_ID_VIA,
+                PCI_DEVICE_ID_VIA_8235_USB_2, NULL);
         uint8_t b;
+
+        /* p should contain the first (internal) VT6212L -- see if we have
+           an external one by searching again */
+        p = pci_get_device(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8235_USB_2, p);
+        if (!p)
+                return;
+        pci_dev_put(p);
+
         if (pci_read_config_byte(dev, 0x76, &b) == 0) {
                 if (b & 0x40) {
                         /* Turn off PCI Bus Parking */
@@ -2008,7 +2023,7 @@ static void __devinit quirk_via_cx700_pci_parking_caching(struct pci_dev *dev)
                 }
         }
 }
-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_VIA, 0x324e, quirk_via_cx700_pci_parking_caching);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0x324e, quirk_via_cx700_pci_parking_caching);
 
 /*
  * For Broadcom 5706, 5708, 5709 rev. A nics, any read beyond the
@@ -2108,6 +2123,7 @@ static void __devinit quirk_disable_msi(struct pci_dev *dev)
         }
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
 
 /* Go through the list of Hypertransport capabilities and
  * return 1 if a HT MSI capability is found and enabled */
@@ -2479,6 +2495,39 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4374,
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4375,
                         quirk_msi_intx_disable_bug);
 
+/*
+ * MSI does not work with the AMD RS780/RS880 internal graphics and HDMI audio
+ * devices unless the BIOS has initialized the nb_cntl.strap_msi_enable bit.
+ */
+static void __init rs780_int_gfx_disable_msi(struct pci_dev *int_gfx_bridge)
+{
+        u32 nb_cntl;
+
+        if (!int_gfx_bridge->subordinate)
+                return;
+
+        pci_bus_write_config_dword(int_gfx_bridge->bus, PCI_DEVFN(0, 0),
+                                   0x60, 0);
+        pci_bus_read_config_dword(int_gfx_bridge->bus, PCI_DEVFN(0, 0),
+                                  0x64, &nb_cntl);
+
+        if (!(nb_cntl & BIT(10))) {
+                dev_warn(&int_gfx_bridge->dev,
+                         FW_WARN "RS780: MSI for internal graphics disabled\n");
+                int_gfx_bridge->subordinate->bus_flags |= PCI_BUS_FLAGS_NO_MSI;
+        }
+}
+
+#define PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX     0x9602
+
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD,
+                        PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX,
+                        rs780_int_gfx_disable_msi);
+/* wrong vendor ID on M4A785TD motherboard: */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ASUSTEK,
+                        PCI_DEVICE_ID_AMD_RS780_P2P_INT_GFX,
+                        rs780_int_gfx_disable_msi);
+
 #endif /* CONFIG_PCI_MSI */
 
 #ifdef CONFIG_PCI_IOV
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 7d678bb15ffb..17bed18d24ad 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -93,8 +93,7 @@ void pci_update_resource(struct pci_dev *dev, int resno)
 int pci_claim_resource(struct pci_dev *dev, int resource)
 {
         struct resource *res = &dev->resource[resource];
-        struct resource *root;
-        int err;
+        struct resource *root, *conflict;
 
         root = pci_find_parent_resource(dev, res);
         if (!root) {
@@ -103,12 +102,15 @@ int pci_claim_resource(struct pci_dev *dev, int resource)
                 return -EINVAL;
         }
 
-        err = request_resource(root, res);
-        if (err)
+        conflict = request_resource_conflict(root, res);
+        if (conflict) {
                 dev_err(&dev->dev,
-                        "address space collision: %pR already in use\n", res);
+                        "address space collision: %pR conflicts with %s %pR\n",
+                        res, conflict->name, conflict);
+                return -EBUSY;
+        }
 
-        return err;
+        return 0;
 }
 EXPORT_SYMBOL(pci_claim_resource);
 
diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
index 5d228071ec69..fb904f444d90 100644
--- a/drivers/pcmcia/at91_cf.c
+++ b/drivers/pcmcia/at91_cf.c
@@ -361,7 +361,6 @@ static int at91_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
         struct at91_cf_socket   *cf = platform_get_drvdata(pdev);
         struct at91_cf_data     *board = cf->board;
 
-        pcmcia_socket_dev_suspend(&pdev->dev);
         if (device_may_wakeup(&pdev->dev)) {
                 enable_irq_wake(board->det_pin);
                 if (board->irq_pin)
@@ -381,7 +380,6 @@ static int at91_cf_resume(struct platform_device *pdev)
                         disable_irq_wake(board->irq_pin);
         }
 
-        pcmcia_socket_dev_resume(&pdev->dev);
         return 0;
 }
 
diff --git a/drivers/pcmcia/au1000_generic.c b/drivers/pcmcia/au1000_generic.c
index 171c8a654887..ac4d089430fd 100644
--- a/drivers/pcmcia/au1000_generic.c
+++ b/drivers/pcmcia/au1000_generic.c
@@ -510,17 +510,6 @@ static int au1x00_drv_pcmcia_probe(struct platform_device *dev)
         return ret;
 }
 
-static int au1x00_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int au1x00_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-
 static struct platform_driver au1x00_pcmcia_driver = {
         .driver = {
                 .name           = "au1x00-pcmcia",
@@ -528,8 +517,6 @@ static struct platform_driver au1x00_pcmcia_driver = {
         },
         .probe          = au1x00_drv_pcmcia_probe,
         .remove         = au1x00_drv_pcmcia_remove,
-        .suspend        = au1x00_drv_pcmcia_suspend,
-        .resume         = au1x00_drv_pcmcia_resume,
 };
 
 
diff --git a/drivers/pcmcia/bfin_cf_pcmcia.c b/drivers/pcmcia/bfin_cf_pcmcia.c
index 2482ce7ac6dc..93f9ddeb0c36 100644
--- a/drivers/pcmcia/bfin_cf_pcmcia.c
+++ b/drivers/pcmcia/bfin_cf_pcmcia.c
@@ -300,16 +300,6 @@ static int __devexit bfin_cf_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int bfin_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
-{
-        return pcmcia_socket_dev_suspend(&pdev->dev);
-}
-
-static int bfin_cf_resume(struct platform_device *pdev)
-{
-        return pcmcia_socket_dev_resume(&pdev->dev);
-}
-
 static struct platform_driver bfin_cf_driver = {
         .driver = {
                    .name = (char *)driver_name,
@@ -317,8 +307,6 @@ static struct platform_driver bfin_cf_driver = {
                    },
         .probe = bfin_cf_probe,
         .remove = __devexit_p(bfin_cf_remove),
-        .suspend = bfin_cf_suspend,
-        .resume = bfin_cf_resume,
 };
 
 static int __init bfin_cf_init(void)
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index e679e708db63..75ed866e6953 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -76,65 +76,6 @@ DECLARE_RWSEM(pcmcia_socket_list_rwsem);
 EXPORT_SYMBOL(pcmcia_socket_list_rwsem);
 
 
-/*
- * Low-level PCMCIA socket drivers need to register with the PCCard
- * core using pcmcia_register_socket.
- *
- * socket drivers are expected to use the following callbacks in their
- * .drv struct:
- *  - pcmcia_socket_dev_suspend
- *  - pcmcia_socket_dev_resume
- * These functions check for the appropriate struct pcmcia_soket arrays,
- * and pass them to the low-level functions pcmcia_{suspend,resume}_socket
- */
-static int socket_early_resume(struct pcmcia_socket *skt);
-static int socket_late_resume(struct pcmcia_socket *skt);
-static int socket_resume(struct pcmcia_socket *skt);
-static int socket_suspend(struct pcmcia_socket *skt);
-
-static void pcmcia_socket_dev_run(struct device *dev,
-                                  int (*cb)(struct pcmcia_socket *))
-{
-        struct pcmcia_socket *socket;
-
-        down_read(&pcmcia_socket_list_rwsem);
-        list_for_each_entry(socket, &pcmcia_socket_list, socket_list) {
-                if (socket->dev.parent != dev)
-                        continue;
-                mutex_lock(&socket->skt_mutex);
-                cb(socket);
-                mutex_unlock(&socket->skt_mutex);
-        }
-        up_read(&pcmcia_socket_list_rwsem);
-}
-
-int pcmcia_socket_dev_suspend(struct device *dev)
-{
-        pcmcia_socket_dev_run(dev, socket_suspend);
-        return 0;
-}
-EXPORT_SYMBOL(pcmcia_socket_dev_suspend);
-
-void pcmcia_socket_dev_early_resume(struct device *dev)
-{
-        pcmcia_socket_dev_run(dev, socket_early_resume);
-}
-EXPORT_SYMBOL(pcmcia_socket_dev_early_resume);
-
-void pcmcia_socket_dev_late_resume(struct device *dev)
-{
-        pcmcia_socket_dev_run(dev, socket_late_resume);
-}
-EXPORT_SYMBOL(pcmcia_socket_dev_late_resume);
-
-int pcmcia_socket_dev_resume(struct device *dev)
-{
-        pcmcia_socket_dev_run(dev, socket_resume);
-        return 0;
-}
-EXPORT_SYMBOL(pcmcia_socket_dev_resume);
-
-
 struct pcmcia_socket *pcmcia_get_socket(struct pcmcia_socket *skt)
 {
         struct device *dev = get_device(&skt->dev);
@@ -578,12 +519,18 @@ static int socket_early_resume(struct pcmcia_socket *skt)
 
 static int socket_late_resume(struct pcmcia_socket *skt)
 {
+        int ret;
+
         mutex_lock(&skt->ops_mutex);
         skt->state &= ~SOCKET_SUSPEND;
         mutex_unlock(&skt->ops_mutex);
 
-        if (!(skt->state & SOCKET_PRESENT))
-                return socket_insert(skt);
+        if (!(skt->state & SOCKET_PRESENT)) {
+                ret = socket_insert(skt);
+                if (ret == -ENODEV)
+                        ret = 0;
+                return ret;
+        }
 
         if (skt->resume_status) {
                 socket_shutdown(skt);
@@ -919,11 +866,66 @@ static void pcmcia_release_socket_class(struct class *data)
 }
 
 
+#ifdef CONFIG_PM
+
+static int __pcmcia_pm_op(struct device *dev,
+                          int (*callback) (struct pcmcia_socket *skt))
+{
+        struct pcmcia_socket *s = container_of(dev, struct pcmcia_socket, dev);
+        int ret;
+
+        mutex_lock(&s->skt_mutex);
+        ret = callback(s);
+        mutex_unlock(&s->skt_mutex);
+
+        return ret;
+}
+
+static int pcmcia_socket_dev_suspend_noirq(struct device *dev)
+{
+        return __pcmcia_pm_op(dev, socket_suspend);
+}
+
+static int pcmcia_socket_dev_resume_noirq(struct device *dev)
+{
+        return __pcmcia_pm_op(dev, socket_early_resume);
+}
+
+static int pcmcia_socket_dev_resume(struct device *dev)
+{
+        return __pcmcia_pm_op(dev, socket_late_resume);
+}
+
+static const struct dev_pm_ops pcmcia_socket_pm_ops = {
+        /* dev_resume may be called with IRQs enabled */
+        SET_SYSTEM_SLEEP_PM_OPS(NULL,
+                                pcmcia_socket_dev_resume)
+
+        /* late suspend must be called with IRQs disabled */
+        .suspend_noirq = pcmcia_socket_dev_suspend_noirq,
+        .freeze_noirq = pcmcia_socket_dev_suspend_noirq,
+        .poweroff_noirq = pcmcia_socket_dev_suspend_noirq,
+
+        /* early resume must be called with IRQs disabled */
+        .resume_noirq = pcmcia_socket_dev_resume_noirq,
+        .thaw_noirq = pcmcia_socket_dev_resume_noirq,
+        .restore_noirq = pcmcia_socket_dev_resume_noirq,
+};
+
+#define PCMCIA_SOCKET_CLASS_PM_OPS (&pcmcia_socket_pm_ops)
+
+#else /* CONFIG_PM */
+
+#define PCMCIA_SOCKET_CLASS_PM_OPS NULL
+
+#endif /* CONFIG_PM */
+
 struct class pcmcia_socket_class = {
         .name = "pcmcia_socket",
         .dev_uevent = pcmcia_socket_uevent,
         .dev_release = pcmcia_release_socket,
         .class_release = pcmcia_release_socket_class,
+        .pm = PCMCIA_SOCKET_CLASS_PM_OPS,
 };
 EXPORT_SYMBOL(pcmcia_socket_class);
 
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 9254ab0b29b1..a520193b6453 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -558,37 +558,10 @@ static int __devexit db1x_pcmcia_socket_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int db1x_pcmcia_suspend(struct device *dev)
-{
-        return pcmcia_socket_dev_suspend(dev);
-}
-
-static int db1x_pcmcia_resume(struct device *dev)
-{
-        return pcmcia_socket_dev_resume(dev);
-}
-
-static struct dev_pm_ops db1x_pcmcia_pmops = {
-        .resume         = db1x_pcmcia_resume,
-        .suspend        = db1x_pcmcia_suspend,
-        .thaw           = db1x_pcmcia_resume,
-        .freeze         = db1x_pcmcia_suspend,
-};
-
-#define DB1XXX_SS_PMOPS &db1x_pcmcia_pmops
-
-#else
-
-#define DB1XXX_SS_PMOPS NULL
-
-#endif
-
 static struct platform_driver db1x_pcmcia_socket_driver = {
         .driver = {
                 .name   = "db1xxx_pcmcia",
                 .owner  = THIS_MODULE,
-                .pm     = DB1XXX_SS_PMOPS
         },
         .probe          = db1x_pcmcia_socket_probe,
         .remove         = __devexit_p(db1x_pcmcia_socket_remove),
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index ad93ebd7b2a2..52d33b2a5bc5 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -509,8 +509,12 @@ struct pcmcia_device *pcmcia_device_add(struct pcmcia_socket *s, unsigned int fu
         p_dev->device_no = (s->device_count++);
         mutex_unlock(&s->ops_mutex);
 
-        /* max of 2 devices per card */
-        if (p_dev->device_no >= 2)
+        /* max of 2 PFC devices */
+        if ((p_dev->device_no >= 2) && (function == 0))
+                goto err_free;
+
+        /* max of 4 devices overall */
+        if (p_dev->device_no >= 4)
                 goto err_free;
 
         p_dev->socket = s;
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index f5da62653313..3003bb3dfcc0 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -39,27 +39,11 @@ static struct pci_device_id i82092aa_pci_ids[] = {
 };
 MODULE_DEVICE_TABLE(pci, i82092aa_pci_ids);
 
-#ifdef CONFIG_PM
-static int i82092aa_socket_suspend (struct pci_dev *dev, pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int i82092aa_socket_resume (struct pci_dev *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-#endif
-
 static struct pci_driver i82092aa_pci_driver = {
         .name           = "i82092aa",
         .id_table       = i82092aa_pci_ids,
         .probe          = i82092aa_pci_probe,
         .remove         = __devexit_p(i82092aa_pci_remove),
-#ifdef CONFIG_PM
-        .suspend        = i82092aa_socket_suspend,
-        .resume         = i82092aa_socket_resume,
-#endif
 };
 
 
diff --git a/drivers/pcmcia/i82365.c b/drivers/pcmcia/i82365.c
index c13fd9360511..d53d9b5659c7 100644
--- a/drivers/pcmcia/i82365.c
+++ b/drivers/pcmcia/i82365.c
@@ -1223,16 +1223,7 @@ static int pcic_init(struct pcmcia_socket *s)
         return 0;
 }
 
-static int i82365_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
 
-static int i82365_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
 static struct pccard_operations pcic_operations = {
         .init                   = pcic_init,
         .get_status             = pcic_get_status,
@@ -1248,8 +1239,6 @@ static struct platform_driver i82365_driver = {
                 .name = "i82365",
                 .owner          = THIS_MODULE,
         },
-        .suspend        = i82365_drv_pcmcia_suspend,
-        .resume         = i82365_drv_pcmcia_resume,
 };
 
 static struct platform_device *i82365_device;
diff --git a/drivers/pcmcia/m32r_cfc.c b/drivers/pcmcia/m32r_cfc.c
index 0ece2cd4a85e..ab21264468d6 100644
--- a/drivers/pcmcia/m32r_cfc.c
+++ b/drivers/pcmcia/m32r_cfc.c
@@ -685,16 +685,7 @@ static struct pccard_operations pcc_operations = {
         .set_mem_map            = pcc_set_mem_map,
 };
 
-static int cfc_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
 
-static int cfc_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
 /*====================================================================*/
 
 static struct platform_driver pcc_driver = {
@@ -702,8 +693,6 @@ static struct platform_driver pcc_driver = {
                 .name           = "cfc",
                 .owner          = THIS_MODULE,
         },
-        .suspend        = cfc_drv_pcmcia_suspend,
-        .resume         = cfc_drv_pcmcia_resume,
 };
 
 static struct platform_device pcc_device = {
diff --git a/drivers/pcmcia/m32r_pcc.c b/drivers/pcmcia/m32r_pcc.c
index 72844c5a6d05..0caf3db7c700 100644
--- a/drivers/pcmcia/m32r_pcc.c
+++ b/drivers/pcmcia/m32r_pcc.c
@@ -663,16 +663,6 @@ static struct pccard_operations pcc_operations = {
         .set_mem_map            = pcc_set_mem_map,
 };
 
-static int pcc_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int pcc_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
 /*====================================================================*/
 
 static struct platform_driver pcc_driver = {
@@ -680,8 +670,6 @@ static struct platform_driver pcc_driver = {
                 .name           = "pcc",
                 .owner          = THIS_MODULE,
         },
-        .suspend        = pcc_drv_pcmcia_suspend,
-        .resume         = pcc_drv_pcmcia_resume,
 };
 
 static struct platform_device pcc_device = {
diff --git a/drivers/pcmcia/m8xx_pcmcia.c b/drivers/pcmcia/m8xx_pcmcia.c
index 61c215918128..01ef7de15322 100644
--- a/drivers/pcmcia/m8xx_pcmcia.c
+++ b/drivers/pcmcia/m8xx_pcmcia.c
@@ -1288,21 +1288,6 @@ static int m8xx_remove(struct of_device *ofdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int m8xx_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&pdev->dev);
-}
-
-static int m8xx_resume(struct platform_device *pdev)
-{
-        return pcmcia_socket_dev_resume(&pdev->dev);
-}
-#else
-#define m8xx_suspend NULL
-#define m8xx_resume NULL
-#endif
-
 static const struct of_device_id m8xx_pcmcia_match[] = {
         {
          .type = "pcmcia",
@@ -1318,8 +1303,6 @@ static struct of_platform_driver m8xx_pcmcia_driver = {
         .match_table = m8xx_pcmcia_match,
         .probe = m8xx_probe,
         .remove = m8xx_remove,
-        .suspend = m8xx_suspend,
-        .resume = m8xx_resume,
 };
 
 static int __init m8xx_init(void)
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index 3ef991552398..9edc396577b9 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -330,24 +330,12 @@ static int __exit omap_cf_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int omap_cf_suspend(struct platform_device *pdev, pm_message_t mesg)
-{
-        return pcmcia_socket_dev_suspend(&pdev->dev);
-}
-
-static int omap_cf_resume(struct platform_device *pdev)
-{
-        return pcmcia_socket_dev_resume(&pdev->dev);
-}
-
 static struct platform_driver omap_cf_driver = {
         .driver = {
                 .name   = (char *) driver_name,
                 .owner  = THIS_MODULE,
         },
         .remove         = __exit_p(omap_cf_remove),
-        .suspend        = omap_cf_suspend,
-        .resume         = omap_cf_resume,
 };
 
 static int __init omap_cf_init(void)
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index 7ba57a565cd7..4a34268cc512 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -14,13 +14,13 @@
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>
+#include <linux/io.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/ss.h>
 #include <pcmcia/cs.h>
 
 #include <asm/system.h>
-#include <asm/io.h>
 
 #include "pd6729.h"
 #include "i82365.h"
@@ -222,9 +222,9 @@ static irqreturn_t pd6729_interrupt(int irq, void *dev)
                                                 ? SS_READY : 0;
                         }
 
-                        if (events) {
+                        if (events)
                                 pcmcia_parse_events(&socket[i].socket, events);
-                        }
+
                         active |= events;
                 }
 
@@ -256,9 +256,8 @@ static int pd6729_get_status(struct pcmcia_socket *sock, u_int *value)
         status = indirect_read(socket, I365_STATUS);
         *value = 0;
 
-        if ((status & I365_CS_DETECT) == I365_CS_DETECT) {
+        if ((status & I365_CS_DETECT) == I365_CS_DETECT)
                 *value |= SS_DETECT;
-        }
 
         /*
          * IO cards have a different meaning of bits 0,1
@@ -308,7 +307,7 @@ static int pd6729_set_socket(struct pcmcia_socket *sock, socket_state_t *state)
         socket->card_irq = state->io_irq;
 
         reg = 0;
-        /* The reset bit has "inverse" logic */
+        /* The reset bit has "inverse" logic */
         if (!(state->flags & SS_RESET))
                 reg |= I365_PC_RESET;
         if (state->flags & SS_IOCARD)
@@ -380,7 +379,7 @@ static int pd6729_set_socket(struct pcmcia_socket *sock, socket_state_t *state)
                 indirect_write(socket, I365_POWER, reg);
 
         if (irq_mode == 1) {
-                 /* all interrupts are to be done as PCI interrupts */
+                /* all interrupts are to be done as PCI interrupts */
                 data = PD67_EC1_INV_MGMT_IRQ | PD67_EC1_INV_CARD_IRQ;
         } else
                 data = 0;
@@ -391,9 +390,9 @@ static int pd6729_set_socket(struct pcmcia_socket *sock, socket_state_t *state)
         /* Enable specific interrupt events */
 
         reg = 0x00;
-        if (state->csc_mask & SS_DETECT) {
+        if (state->csc_mask & SS_DETECT)
                 reg |= I365_CSC_DETECT;
-        }
+
         if (state->flags & SS_IOCARD) {
                 if (state->csc_mask & SS_STSCHG)
                         reg |= I365_CSC_STSCHG;
@@ -450,9 +449,12 @@ static int pd6729_set_io_map(struct pcmcia_socket *sock,
 
         ioctl = indirect_read(socket, I365_IOCTL) & ~I365_IOCTL_MASK(map);
 
-        if (io->flags & MAP_0WS) ioctl |= I365_IOCTL_0WS(map);
-        if (io->flags & MAP_16BIT) ioctl |= I365_IOCTL_16BIT(map);
-        if (io->flags & MAP_AUTOSZ) ioctl |= I365_IOCTL_IOCS16(map);
+        if (io->flags & MAP_0WS)
+                ioctl |= I365_IOCTL_0WS(map);
+        if (io->flags & MAP_16BIT)
+                ioctl |= I365_IOCTL_16BIT(map);
+        if (io->flags & MAP_AUTOSZ)
+                ioctl |= I365_IOCTL_IOCS16(map);
 
         indirect_write(socket, I365_IOCTL, ioctl);
 
@@ -497,7 +499,7 @@ static int pd6729_set_mem_map(struct pcmcia_socket *sock,
 
         /* write the stop address */
 
-        i= (mem->res->end >> 12) & 0x0fff;
+        i = (mem->res->end >> 12) & 0x0fff;
         switch (to_cycles(mem->speed)) {
         case 0:
                 break;
@@ -563,7 +565,7 @@ static int pd6729_init(struct pcmcia_socket *sock)
 
 /* the pccard structure and its functions */
 static struct pccard_operations pd6729_operations = {
-        .init                   = pd6729_init,
+        .init                   = pd6729_init,
         .get_status             = pd6729_get_status,
         .set_socket             = pd6729_set_socket,
         .set_io_map             = pd6729_set_io_map,
@@ -578,8 +580,13 @@ static irqreturn_t pd6729_test(int irq, void *dev)
 
 static int pd6729_check_irq(int irq)
 {
-        if (request_irq(irq, pd6729_test, IRQF_PROBE_SHARED, "x", pd6729_test)
-                != 0) return -1;
+        int ret;
+
+        ret = request_irq(irq, pd6729_test, IRQF_PROBE_SHARED, "x",
+                          pd6729_test);
+        if (ret)
+                return -1;
+
         free_irq(irq, pd6729_test);
         return 0;
 }
@@ -591,7 +598,7 @@ static u_int __devinit pd6729_isa_scan(void)
 
         if (irq_mode == 1) {
                 printk(KERN_INFO "pd6729: PCI card interrupts, "
-                                                "PCI status changes\n");
+                       "PCI status changes\n");
                 return 0;
         }
 
@@ -607,9 +614,10 @@ static u_int __devinit pd6729_isa_scan(void)
                 if (mask & (1<<i))
                         printk("%s%d", ((mask & ((1<<i)-1)) ? "," : ""), i);
 
-        if (mask == 0) printk("none!");
-
-        printk("  polling status changes.\n");
+        if (mask == 0)
+                printk("none!");
+        else
+                printk("  polling status changes.\n");
 
         return mask;
 }
@@ -624,11 +632,16 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
 
         socket = kzalloc(sizeof(struct pd6729_socket) * MAX_SOCKETS,
                          GFP_KERNEL);
-        if (!socket)
+        if (!socket) {
+                dev_warn(&dev->dev, "failed to kzalloc socket.\n");
                 return -ENOMEM;
+        }
 
-        if ((ret = pci_enable_device(dev)))
+        ret = pci_enable_device(dev);
+        if (ret) {
+                dev_warn(&dev->dev, "failed to enable pci_device.\n");
                 goto err_out_free_mem;
+        }
 
         if (!pci_resource_start(dev, 0)) {
                 dev_warn(&dev->dev, "refusing to load the driver as the "
@@ -639,7 +652,7 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
         dev_info(&dev->dev, "Cirrus PD6729 PCI to PCMCIA Bridge at 0x%llx "
                 "on irq %d\n",
                 (unsigned long long)pci_resource_start(dev, 0), dev->irq);
-        /*
+        /*
          * Since we have no memory BARs some firmware may not
          * have had PCI_COMMAND_MEMORY enabled, yet the device needs it.
          */
@@ -685,8 +698,9 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
         pci_set_drvdata(dev, socket);
         if (irq_mode == 1) {
                 /* Register the interrupt handler */
-                if ((ret = request_irq(dev->irq, pd6729_interrupt, IRQF_SHARED,
-                                                        "pd6729", socket))) {
+                ret = request_irq(dev->irq, pd6729_interrupt, IRQF_SHARED,
+                                  "pd6729", socket);
+                if (ret) {
                         dev_err(&dev->dev, "Failed to register irq %d\n",
                                 dev->irq);
                         goto err_out_free_res;
@@ -750,18 +764,6 @@ static void __devexit pd6729_pci_remove(struct pci_dev *dev)
         kfree(socket);
 }
 
-#ifdef CONFIG_PM
-static int pd6729_socket_suspend(struct pci_dev *dev, pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int pd6729_socket_resume(struct pci_dev *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-#endif
-
 static struct pci_device_id pd6729_pci_ids[] = {
         {
                 .vendor         = PCI_VENDOR_ID_CIRRUS,
@@ -778,10 +780,6 @@ static struct pci_driver pd6729_pci_driver = {
         .id_table       = pd6729_pci_ids,
         .probe          = pd6729_pci_probe,
         .remove         = __devexit_p(pd6729_pci_remove),
-#ifdef CONFIG_PM
-        .suspend        = pd6729_socket_suspend,
-        .resume         = pd6729_socket_resume,
-#endif
 };
 
 static int pd6729_module_init(void)
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 76e640bccde8..0a876fabfe44 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -325,19 +325,13 @@ static int pxa2xx_drv_pcmcia_remove(struct platform_device *dev)
         return 0;
 }
 
-static int pxa2xx_drv_pcmcia_suspend(struct device *dev)
-{
-        return pcmcia_socket_dev_suspend(dev);
-}
-
 static int pxa2xx_drv_pcmcia_resume(struct device *dev)
 {
         pxa2xx_configure_sockets(dev);
-        return pcmcia_socket_dev_resume(dev);
+        return 0;
 }
 
 static const struct dev_pm_ops pxa2xx_drv_pcmcia_pm_ops = {
-        .suspend        = pxa2xx_drv_pcmcia_suspend,
         .resume         = pxa2xx_drv_pcmcia_resume,
 };
 
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 4663b3fa9f96..2e47991eccf6 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -810,6 +810,13 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
         unsigned long size = end - start + 1;
         int ret = 0;
 
+#if defined(CONFIG_X86)
+        /* on x86, avoid anything < 0x100 for it is often used for
+         * legacy platform devices */
+        if (start < 0x100)
+                start = 0x100;
+#endif
+
         if (end < start)
                 return -EINVAL;
 
@@ -867,10 +874,8 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
                         if (res == &ioport_resource)
                                 continue;
                         dev_printk(KERN_INFO, &s->cb_dev->dev,
-                                   "pcmcia: parent PCI bridge I/O "
-                                   "window: 0x%llx - 0x%llx\n",
-                                   (unsigned long long)res->start,
-                                   (unsigned long long)res->end);
+                                   "pcmcia: parent PCI bridge window: %pR\n",
+                                   res);
                         if (!adjust_io(s, ADD_MANAGED_RESOURCE, res->start, res->end))
                                 done |= IORESOURCE_IO;
 
@@ -880,10 +885,8 @@ static int nonstatic_autoadd_resources(struct pcmcia_socket *s)
                         if (res == &iomem_resource)
                                 continue;
                         dev_printk(KERN_INFO, &s->cb_dev->dev,
-                                   "pcmcia: parent PCI bridge Memory "
-                                   "window: 0x%llx - 0x%llx\n",
-                                   (unsigned long long)res->start,
-                                   (unsigned long long)res->end);
+                                   "pcmcia: parent PCI bridge window: %pR\n",
+                                   res);
                         if (!adjust_memory(s, ADD_MANAGED_RESOURCE, res->start, res->end))
                                 done |= IORESOURCE_MEM;
                 }
diff --git a/drivers/pcmcia/sa1100_generic.c b/drivers/pcmcia/sa1100_generic.c
index 8db86b90c200..518896241429 100644
--- a/drivers/pcmcia/sa1100_generic.c
+++ b/drivers/pcmcia/sa1100_generic.c
@@ -95,17 +95,6 @@ static int sa11x0_drv_pcmcia_remove(struct platform_device *dev)
         return 0;
 }
 
-static int sa11x0_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int sa11x0_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-
 static struct platform_driver sa11x0_pcmcia_driver = {
         .driver = {
                 .name           = "sa11x0-pcmcia",
@@ -113,8 +102,6 @@ static struct platform_driver sa11x0_pcmcia_driver = {
         },
         .probe          = sa11x0_drv_pcmcia_probe,
         .remove         = sa11x0_drv_pcmcia_remove,
-        .suspend        = sa11x0_drv_pcmcia_suspend,
-        .resume         = sa11x0_drv_pcmcia_resume,
 };
 
 /* sa11x0_pcmcia_init()
diff --git a/drivers/pcmcia/sa1111_generic.c b/drivers/pcmcia/sa1111_generic.c
index db79ca61cf96..799e9793e49e 100644
--- a/drivers/pcmcia/sa1111_generic.c
+++ b/drivers/pcmcia/sa1111_generic.c
@@ -213,16 +213,6 @@ static int __devexit pcmcia_remove(struct sa1111_dev *dev)
         return 0;
 }
 
-static int pcmcia_suspend(struct sa1111_dev *dev, pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int pcmcia_resume(struct sa1111_dev *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-
 static struct sa1111_driver pcmcia_driver = {
         .drv = {
                 .name   = "sa1111-pcmcia",
@@ -230,8 +220,6 @@ static struct sa1111_driver pcmcia_driver = {
         .devid          = SA1111_DEVID_PCMCIA,
         .probe          = pcmcia_probe,
         .remove         = __devexit_p(pcmcia_remove),
-        .suspend        = pcmcia_suspend,
-        .resume         = pcmcia_resume,
 };
 
 static int __init sa1111_drv_pcmcia_init(void)
diff --git a/drivers/pcmcia/tcic.c b/drivers/pcmcia/tcic.c
index 12c49ee135e1..bac85f3236bb 100644
--- a/drivers/pcmcia/tcic.c
+++ b/drivers/pcmcia/tcic.c
@@ -348,16 +348,6 @@ static int __init get_tcic_id(void)
     return id;
 }
 
-static int tcic_drv_pcmcia_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int tcic_drv_pcmcia_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
 /*====================================================================*/
 
 static struct platform_driver tcic_driver = {
@@ -365,8 +355,6 @@ static struct platform_driver tcic_driver = {
                 .name = "tcic-pcmcia",
                 .owner          = THIS_MODULE,
         },
-        .suspend        = tcic_drv_pcmcia_suspend,
-        .resume         = tcic_drv_pcmcia_resume,
 };
 
 static struct platform_device tcic_device = {
diff --git a/drivers/pcmcia/vrc4171_card.c b/drivers/pcmcia/vrc4171_card.c
index aaccdb9f4ba1..86e4a1a3c642 100644
--- a/drivers/pcmcia/vrc4171_card.c
+++ b/drivers/pcmcia/vrc4171_card.c
@@ -705,24 +705,11 @@ static int __devinit vrc4171_card_setup(char *options)
 
 __setup("vrc4171_card=", vrc4171_card_setup);
 
-static int vrc4171_card_suspend(struct platform_device *dev,
-                                     pm_message_t state)
-{
-        return pcmcia_socket_dev_suspend(&dev->dev);
-}
-
-static int vrc4171_card_resume(struct platform_device *dev)
-{
-        return pcmcia_socket_dev_resume(&dev->dev);
-}
-
 static struct platform_driver vrc4171_card_driver = {
         .driver = {
                 .name           = vrc4171_card_name,
                 .owner          = THIS_MODULE,
         },
-        .suspend        = vrc4171_card_suspend,
-        .resume         = vrc4171_card_resume,
 };
 
 static int __devinit vrc4171_card_init(void)
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index 418988ab6edf..f19ad02374d9 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -1290,12 +1290,9 @@ static int yenta_dev_suspend_noirq(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
         struct yenta_socket *socket = pci_get_drvdata(pdev);
-        int ret;
-
-        ret = pcmcia_socket_dev_suspend(dev);
 
         if (!socket)
-                return ret;
+                return 0;
 
         if (socket->type && socket->type->save_state)
                 socket->type->save_state(socket);
@@ -1312,7 +1309,7 @@ static int yenta_dev_suspend_noirq(struct device *dev)
          */
         /* pci_set_power_state(dev, 3); */
 
-        return ret;
+        return 0;
 }
 
 static int yenta_dev_resume_noirq(struct device *dev)
@@ -1336,26 +1333,16 @@ static int yenta_dev_resume_noirq(struct device *dev)
         if (socket->type && socket->type->restore_state)
                 socket->type->restore_state(socket);
 
-        pcmcia_socket_dev_early_resume(dev);
-        return 0;
-}
-
-static int yenta_dev_resume(struct device *dev)
-{
-        pcmcia_socket_dev_late_resume(dev);
         return 0;
 }
 
 static const struct dev_pm_ops yenta_pm_ops = {
         .suspend_noirq = yenta_dev_suspend_noirq,
         .resume_noirq = yenta_dev_resume_noirq,
-        .resume = yenta_dev_resume,
         .freeze_noirq = yenta_dev_suspend_noirq,
         .thaw_noirq = yenta_dev_resume_noirq,
-        .thaw = yenta_dev_resume,
         .poweroff_noirq = yenta_dev_suspend_noirq,
         .restore_noirq = yenta_dev_resume_noirq,
-        .restore = yenta_dev_resume,
 };
 
 #define YENTA_PM_OPS    (&yenta_pm_ops)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index c7bbe30010f7..5af16c2bb540 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1038,6 +1038,7 @@ static struct regulator *create_regulator(struct regulator_dev *rdev,
                         goto overflow_err;
 
                 regulator->dev = dev;
+                sysfs_attr_init(&regulator->dev_attr.attr);
                 regulator->dev_attr.attr.name = kstrdup(buf, GFP_KERNEL);
                 if (regulator->dev_attr.attr.name == NULL)
                         goto attr_name_err;
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index f5532ed79272..b20b3e1d821a 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -45,7 +45,7 @@ static int lp3971_set_bits(struct lp3971 *lp3971, u8 reg, u16 mask, u16 val);
         LP3971_BUCK2 -> 4
         LP3971_BUCK3 -> 6
 */
-#define BUCK_VOL_CHANGE_SHIFT(x) (((1 << x) & ~0x01) << 1)
+#define BUCK_VOL_CHANGE_SHIFT(x) (((!!x) << 2) | (x & ~0x01))
 #define BUCK_VOL_CHANGE_FLAG_GO 0x01
 #define BUCK_VOL_CHANGE_FLAG_TARGET 0x02
 #define BUCK_VOL_CHANGE_FLAG_MASK 0x03
@@ -187,7 +187,8 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev,
                 return -EINVAL;
 
         return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
-                LDO_VOL_CONTR_MASK << LDO_VOL_CONTR_SHIFT(ldo), val);
+                        LDO_VOL_CONTR_MASK << LDO_VOL_CONTR_SHIFT(ldo),
+                        val << LDO_VOL_CONTR_SHIFT(ldo));
 }
 
 static struct regulator_ops lp3971_ldo_ops = {
@@ -439,6 +440,10 @@ static int __devinit setup_regulators(struct lp3971 *lp3971,
         lp3971->num_regulators = pdata->num_regulators;
         lp3971->rdev = kcalloc(pdata->num_regulators,
                                 sizeof(struct regulator_dev *), GFP_KERNEL);
+        if (!lp3971->rdev) {
+                err = -ENOMEM;
+                goto err_nomem;
+        }
 
         /* Instantiate the regulators */
         for (i = 0; i < pdata->num_regulators; i++) {
@@ -461,6 +466,7 @@ error:
                 regulator_unregister(lp3971->rdev[i]);
         kfree(lp3971->rdev);
         lp3971->rdev = NULL;
+err_nomem:
         return err;
 }
 
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index a49fc952c9a9..c0b09e15edb6 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -243,8 +243,8 @@ static int __devexit max1586_pmic_remove(struct i2c_client *client)
         for (i = 0; i <= MAX1586_V6; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
-        kfree(rdev);
         i2c_set_clientdata(client, NULL);
+        kfree(rdev);
 
         return 0;
 }
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 3ebdf698c648..833aaedc7e64 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -356,6 +356,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
         dev_info(info->dev, "Max8649 regulator device is detected.\n");
         return 0;
 out:
+        i2c_set_clientdata(client, NULL);
         kfree(info);
         return ret;
 }
@@ -367,9 +368,9 @@ static int __devexit max8649_regulator_remove(struct i2c_client *client)
         if (info) {
                 if (info->regulator)
                         regulator_unregister(info->regulator);
+                i2c_set_clientdata(client, NULL);
                 kfree(info);
         }
-        i2c_set_clientdata(client, NULL);
 
         return 0;
 }
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
index f12f1bb62138..47f90b2fc290 100644
--- a/drivers/regulator/max8660.c
+++ b/drivers/regulator/max8660.c
@@ -470,8 +470,8 @@ static int __devexit max8660_remove(struct i2c_client *client)
         for (i = 0; i < MAX8660_V_END; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
-        kfree(rdev);
         i2c_set_clientdata(client, NULL);
+        kfree(rdev);
 
         return 0;
 }
diff --git a/drivers/regulator/max8925-regulator.c b/drivers/regulator/max8925-regulator.c
index 67873f08ed40..b6218f11c957 100644
--- a/drivers/regulator/max8925-regulator.c
+++ b/drivers/regulator/max8925-regulator.c
@@ -230,7 +230,7 @@ static struct max8925_regulator_info max8925_regulator_info[] = {
         MAX8925_LDO(20, 750, 3900, 50),
 };
 
-static inline struct max8925_regulator_info *find_regulator_info(int id)
+static struct max8925_regulator_info * __devinit find_regulator_info(int id)
 {
         struct max8925_regulator_info *ri;
         int i;
@@ -247,7 +247,7 @@ static int __devinit max8925_regulator_probe(struct platform_device *pdev)
 {
         struct max8925_chip *chip = dev_get_drvdata(pdev->dev.parent);
         struct max8925_platform_data *pdata = chip->dev->platform_data;
-        struct max8925_regulator_info *ri = NULL;
+        struct max8925_regulator_info *ri;
         struct regulator_dev *rdev;
 
         ri = find_regulator_info(pdev->id);
@@ -274,7 +274,9 @@ static int __devexit max8925_regulator_remove(struct platform_device *pdev)
 {
         struct regulator_dev *rdev = platform_get_drvdata(pdev);
 
+        platform_set_drvdata(pdev, NULL);
         regulator_unregister(rdev);
+
         return 0;
 }
 
diff --git a/drivers/rtc/rtc-mc13783.c b/drivers/rtc/rtc-mc13783.c
index d60c81b7b693..1379c7faa448 100644
--- a/drivers/rtc/rtc-mc13783.c
+++ b/drivers/rtc/rtc-mc13783.c
@@ -319,35 +319,38 @@ static int __devinit mc13783_rtc_probe(struct platform_device *pdev)
 {
         int ret;
         struct mc13783_rtc *priv;
+        struct mc13783 *mc13783;
         int rtcrst_pending;
 
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv)
                 return -ENOMEM;
 
-        priv->mc13783 = dev_get_drvdata(pdev->dev.parent);
+        mc13783 = dev_get_drvdata(pdev->dev.parent);
+        priv->mc13783 = mc13783;
+
         platform_set_drvdata(pdev, priv);
 
-        mc13783_lock(priv->mc13783);
+        mc13783_lock(mc13783);
 
-        ret = mc13783_irq_request(priv->mc13783, MC13783_IRQ_RTCRST,
+        ret = mc13783_irq_request(mc13783, MC13783_IRQ_RTCRST,
                         mc13783_rtc_reset_handler, DRIVER_NAME, priv);
         if (ret)
                 goto err_reset_irq_request;
 
-        ret = mc13783_irq_status(priv->mc13783, MC13783_IRQ_RTCRST,
+        ret = mc13783_irq_status(mc13783, MC13783_IRQ_RTCRST,
                         NULL, &rtcrst_pending);
         if (ret)
                 goto err_reset_irq_status;
 
         priv->valid = !rtcrst_pending;
 
-        ret = mc13783_irq_request_nounmask(priv->mc13783, MC13783_IRQ_1HZ,
+        ret = mc13783_irq_request_nounmask(mc13783, MC13783_IRQ_1HZ,
                         mc13783_rtc_update_handler, DRIVER_NAME, priv);
         if (ret)
                 goto err_update_irq_request;
 
-        ret = mc13783_irq_request_nounmask(priv->mc13783, MC13783_IRQ_TODA,
+        ret = mc13783_irq_request_nounmask(mc13783, MC13783_IRQ_TODA,
                         mc13783_rtc_alarm_handler, DRIVER_NAME, priv);
         if (ret)
                 goto err_alarm_irq_request;
@@ -357,22 +360,22 @@ static int __devinit mc13783_rtc_probe(struct platform_device *pdev)
         if (IS_ERR(priv->rtc)) {
                 ret = PTR_ERR(priv->rtc);
 
-                mc13783_irq_free(priv->mc13783, MC13783_IRQ_TODA, priv);
+                mc13783_irq_free(mc13783, MC13783_IRQ_TODA, priv);
 err_alarm_irq_request:
 
-                mc13783_irq_free(priv->mc13783, MC13783_IRQ_1HZ, priv);
+                mc13783_irq_free(mc13783, MC13783_IRQ_1HZ, priv);
 err_update_irq_request:
 
 err_reset_irq_status:
 
-                mc13783_irq_free(priv->mc13783, MC13783_IRQ_RTCRST, priv);
+                mc13783_irq_free(mc13783, MC13783_IRQ_RTCRST, priv);
 err_reset_irq_request:
 
                 platform_set_drvdata(pdev, NULL);
                 kfree(priv);
         }
 
-        mc13783_unlock(priv->mc13783);
+        mc13783_unlock(mc13783);
 
         return ret;
 }
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index 51224f76b980..b3736b8aad39 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -2287,7 +2287,8 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
 
         if (cqr->cpmode == 1) {
                 cplength = 0;
-                datasize = sizeof(struct tcw) + sizeof(struct tsb);
+                /* TCW needs to be 64 byte aligned, so leave enough room */
+                datasize = 64 + sizeof(struct tcw) + sizeof(struct tsb);
         } else {
                 cplength = 2;
                 datasize = 0;
@@ -2316,8 +2317,8 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
         if (cqr->cpmode == 1) {
                 /* make a shallow copy of the original tcw but set new tsb */
                 erp->cpmode = 1;
-                erp->cpaddr = erp->data;
-                tcw = erp->data;
+                erp->cpaddr = PTR_ALIGN(erp->data, 64);
+                tcw = erp->cpaddr;
                 tsb = (struct tsb *) &tcw[1];
                 *tcw = *((struct tcw *)cqr->cpaddr);
                 tcw->tsb = (long)tsb;
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 01f4e7a34aa8..0cb233116855 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3155,11 +3155,11 @@ static void dasd_eckd_dump_sense_tcw(struct dasd_device *device,
 
         tsb = NULL;
         sense = NULL;
-        if (irb->scsw.tm.tcw)
+        if (irb->scsw.tm.tcw && (irb->scsw.tm.fcxs == 0x01))
                 tsb = tcw_get_tsb(
                         (struct tcw *)(unsigned long)irb->scsw.tm.tcw);
 
-        if (tsb && (irb->scsw.tm.fcxs == 0x01)) {
+        if (tsb) {
                 len += sprintf(page + len, KERN_ERR PRINTK_HEADER
                                " tsb->length %d\n", tsb->length);
                 len += sprintf(page + len, KERN_ERR PRINTK_HEADER
diff --git a/drivers/s390/char/sclp_async.c b/drivers/s390/char/sclp_async.c
index 740fe405c395..f449c696e503 100644
--- a/drivers/s390/char/sclp_async.c
+++ b/drivers/s390/char/sclp_async.c
@@ -84,6 +84,7 @@ static int proc_handler_callhome(struct ctl_table *ctl, int write,
                 rc = copy_from_user(buf, buffer, sizeof(buf));
                 if (rc != 0)
                         return -EFAULT;
+                buf[len - 1] = '\0';
                 if (strict_strtoul(buf, 0, &val) != 0)
                         return -EINVAL;
                 if (val != 0 && val != 1)
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index fc7ae05ce48a..4b60ede07f0e 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -308,6 +308,13 @@ struct assign_storage_sccb {
         u16 rn;
 } __packed;
 
+int arch_get_memory_phys_device(unsigned long start_pfn)
+{
+        if (!rzm)
+                return 0;
+        return PFN_PHYS(start_pfn) >> ilog2(rzm);
+}
+
 static unsigned long long rn2addr(u16 rn)
 {
         return (unsigned long long) (rn - 1) * rzm;
@@ -704,13 +711,6 @@ int sclp_chp_deconfigure(struct chp_id chpid)
         return do_chp_configure(SCLP_CMDW_DECONFIGURE_CHPATH | chpid.id << 8);
 }
 
-int arch_get_memory_phys_device(unsigned long start_pfn)
-{
-        if (!rzm)
-                return 0;
-        return PFN_PHYS(start_pfn) / rzm;
-}
-
 struct chp_info_sccb {
         struct sccb_header header;
         u8 recognized[SCLP_CHP_INFO_MASK_SIZE];
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 3438658b66b7..3166d85914f2 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -141,33 +141,6 @@ static int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)
         return memcpy_hsa(dest, src, count, TO_KERNEL);
 }
 
-static int memcpy_real(void *dest, unsigned long src, size_t count)
-{
-        unsigned long flags;
-        int rc = -EFAULT;
-        register unsigned long _dest asm("2") = (unsigned long) dest;
-        register unsigned long _len1 asm("3") = (unsigned long) count;
-        register unsigned long _src  asm("4") = src;
-        register unsigned long _len2 asm("5") = (unsigned long) count;
-
-        if (count == 0)
-                return 0;
-        flags = __raw_local_irq_stnsm(0xf8UL); /* switch to real mode */
-        asm volatile (
-                "0:     mvcle   %1,%2,0x0\n"
-                "1:     jo      0b\n"
-                "       lhi     %0,0x0\n"
-                "2:\n"
-                EX_TABLE(1b,2b)
-                : "+d" (rc), "+d" (_dest), "+d" (_src), "+d" (_len1),
-                  "+d" (_len2), "=m" (*((long*)dest))
-                : "m" (*((long*)src))
-                : "cc", "memory");
-        __raw_local_irq_ssm(flags);
-
-        return rc;
-}
-
 static int memcpy_real_user(void __user *dest, unsigned long src, size_t count)
 {
         static char buf[4096];
@@ -175,7 +148,7 @@ static int memcpy_real_user(void __user *dest, unsigned long src, size_t count)
 
         while (offs < count) {
                 size = min(sizeof(buf), count - offs);
-                if (memcpy_real(buf, src + offs, size))
+                if (memcpy_real(buf, (void *) src + offs, size))
                         return -EFAULT;
                 if (copy_to_user(dest + offs, buf, size))
                         return -EFAULT;
@@ -663,7 +636,7 @@ static int __init zcore_reipl_init(void)
         if (ipib_info.ipib < ZFCPDUMP_HSA_SIZE)
                 rc = memcpy_hsa_kernel(ipl_block, ipib_info.ipib, PAGE_SIZE);
         else
-                rc = memcpy_real(ipl_block, ipib_info.ipib, PAGE_SIZE);
+                rc = memcpy_real(ipl_block, (void *) ipib_info.ipib, PAGE_SIZE);
         if (rc) {
                 free_page((unsigned long) ipl_block);
                 return rc;
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index e91db4b38012..175d202ab37e 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -745,6 +745,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_PFC_DEVICE_PROD_ID13(1, "Xircom", "REM10", 0x2e3ee845, 0x76df1d29),
         PCMCIA_PFC_DEVICE_PROD_ID13(1, "Xircom", "XEM5600", 0x2e3ee845, 0xf1403719),
         PCMCIA_PFC_DEVICE_PROD_ID12(1, "AnyCom", "Fast Ethernet + 56K COMBO", 0x578ba6e7, 0xb0ac62c4),
+        PCMCIA_PFC_DEVICE_PROD_ID12(1, "ATKK", "LM33-PCM-T", 0xba9eb7e2, 0x077c174e),
         PCMCIA_PFC_DEVICE_PROD_ID12(1, "D-Link", "DME336T", 0x1a424a1c, 0xb23897ff),
         PCMCIA_PFC_DEVICE_PROD_ID12(1, "Gateway 2000", "XJEM3336", 0xdd9989be, 0x662c394c),
         PCMCIA_PFC_DEVICE_PROD_ID12(1, "Grey Cell", "GCS3000", 0x2a151fac, 0x48b932ae),
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index f7b9aff88f4a..309de6be8204 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -779,10 +779,6 @@ static irqreturn_t sci_mpxed_interrupt(int irq, void *ptr)
         if ((ssr_status & SCxSR_BRK(port)) && err_enabled)
                 ret = sci_br_interrupt(irq, ptr);
 
-        WARN_ONCE(ret == IRQ_NONE,
-                  "%s: %d IRQ %d, status %x, control %x\n", __func__,
-                  irq, port->line, ssr_status, scr_status);
-
         return ret;
 }
 
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index fad67d33b0bd..f70c49f915fa 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -31,7 +31,9 @@
 # define SCSCR_INIT(port) (port->mapbase == SCIF2) ? 0xF3 : 0xF0
 #elif defined(CONFIG_CPU_SUBTYPE_SH7720) || \
       defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-      defined(CONFIG_ARCH_SHMOBILE)
+      defined(CONFIG_ARCH_SH7367) || \
+      defined(CONFIG_ARCH_SH7377) || \
+      defined(CONFIG_ARCH_SH7372)
 # define SCSCR_INIT(port)  0x0030 /* TIE=0,RIE=0,TE=1,RE=1 */
 # define PORT_PTCR         0xA405011EUL
 # define PORT_PVCR         0xA4050122UL
@@ -94,7 +96,9 @@
 # define SCSCR_INIT(port)       0x0038  /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 #elif defined(CONFIG_CPU_SUBTYPE_SH7724)
 # define SCIF_ORER              0x0001  /* overrun error bit */
-# define SCSCR_INIT(port)       0x0038  /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
+# define SCSCR_INIT(port) ((port)->type == PORT_SCIFA ? \
+        0x30 /* TIE=0,RIE=0,TE=1,RE=1 */ : \
+        0x38 /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */ )
 #elif defined(CONFIG_CPU_SUBTYPE_SH4_202)
 # define SCSPTR2 0xffe80020 /* 16 bit SCIF */
 # define SCIF_ORER 0x0001   /* overrun error bit */
@@ -197,6 +201,8 @@
     defined(CONFIG_CPU_SUBTYPE_SH7786)  || \
     defined(CONFIG_CPU_SUBTYPE_SHX3)
 #define SCI_CTRL_FLAGS_REIE 0x08 /* 7750 SCIF */
+#elif defined(CONFIG_CPU_SUBTYPE_SH7724)
+#define SCI_CTRL_FLAGS_REIE ((port)->type == PORT_SCIFA ? 0 : 8)
 #else
 #define SCI_CTRL_FLAGS_REIE 0
 #endif
@@ -230,7 +236,9 @@
 #if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
     defined(CONFIG_CPU_SUBTYPE_SH7720) || \
     defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-    defined(CONFIG_ARCH_SHMOBILE)
+    defined(CONFIG_ARCH_SH7367) || \
+    defined(CONFIG_ARCH_SH7377) || \
+    defined(CONFIG_ARCH_SH7372)
 # define SCIF_ORER    0x0200
 # define SCIF_ERRORS ( SCIF_PER | SCIF_FER | SCIF_ER | SCIF_BRK | SCIF_ORER)
 # define SCIF_RFDC_MASK 0x007f
@@ -264,7 +272,9 @@
 #if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
     defined(CONFIG_CPU_SUBTYPE_SH7720) || \
     defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-    defined(CONFIG_ARCH_SHMOBILE)
+    defined(CONFIG_ARCH_SH7367) || \
+    defined(CONFIG_ARCH_SH7377) || \
+    defined(CONFIG_ARCH_SH7372)
 # define SCxSR_RDxF_CLEAR(port)  (sci_in(port, SCxSR) & 0xfffc)
 # define SCxSR_ERROR_CLEAR(port) (sci_in(port, SCxSR) & 0xfd73)
 # define SCxSR_TDxE_CLEAR(port)  (sci_in(port, SCxSR) & 0xffdf)
@@ -359,7 +369,10 @@
     SCI_OUT(sci_size, sci_offset, value);                               \
   }
 
-#if defined(CONFIG_CPU_SH3) || defined(CONFIG_ARCH_SHMOBILE)
+#if defined(CONFIG_CPU_SH3) || \
+    defined(CONFIG_ARCH_SH7367) || \
+    defined(CONFIG_ARCH_SH7377) || \
+    defined(CONFIG_ARCH_SH7372)
 #if defined(CONFIG_CPU_SUBTYPE_SH7710) || defined(CONFIG_CPU_SUBTYPE_SH7712)
 #define SCIx_FNS(name, sh3_sci_offset, sh3_sci_size, sh4_sci_offset, sh4_sci_size, \
                                 sh3_scif_offset, sh3_scif_size, sh4_scif_offset, sh4_scif_size, \
@@ -370,7 +383,9 @@
 #elif defined(CONFIG_CPU_SUBTYPE_SH7705) || \
       defined(CONFIG_CPU_SUBTYPE_SH7720) || \
       defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-      defined(CONFIG_ARCH_SHMOBILE)
+      defined(CONFIG_ARCH_SH7367) || \
+      defined(CONFIG_ARCH_SH7377) || \
+      defined(CONFIG_ARCH_SH7372)
 #define SCIF_FNS(name, scif_offset, scif_size) \
   CPU_SCIF_FNS(name, scif_offset, scif_size)
 #else
@@ -406,7 +421,9 @@
 #if defined(CONFIG_CPU_SUBTYPE_SH7705) || \
     defined(CONFIG_CPU_SUBTYPE_SH7720) || \
     defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-    defined(CONFIG_ARCH_SHMOBILE)
+    defined(CONFIG_ARCH_SH7367) || \
+    defined(CONFIG_ARCH_SH7377) || \
+    defined(CONFIG_ARCH_SH7372)
 
 SCIF_FNS(SCSMR,  0x00, 16)
 SCIF_FNS(SCBRR,  0x04,  8)
@@ -589,7 +606,9 @@ static inline int sci_rxd_in(struct uart_port *port)
 #elif defined(CONFIG_CPU_SUBTYPE_SH7705) || \
       defined(CONFIG_CPU_SUBTYPE_SH7720) || \
       defined(CONFIG_CPU_SUBTYPE_SH7721) || \
-      defined(CONFIG_ARCH_SHMOBILE)
+      defined(CONFIG_ARCH_SH7367) || \
+      defined(CONFIG_ARCH_SH7377) || \
+      defined(CONFIG_ARCH_SH7372)
 #define SCBRR_VALUE(bps, clk) (((clk*2)+16*bps)/(32*bps)-1)
 #elif defined(CONFIG_CPU_SUBTYPE_SH7723) ||\
       defined(CONFIG_CPU_SUBTYPE_SH7724)
diff --git a/drivers/staging/et131x/et1310_mac.c b/drivers/staging/et131x/et1310_mac.c
index a292b1edc414..737a9f5401d1 100644
--- a/drivers/staging/et131x/et1310_mac.c
+++ b/drivers/staging/et131x/et1310_mac.c
@@ -226,7 +226,7 @@ void ConfigMACRegs2(struct et131x_adapter *etdev)
         }
 
         /* Enable TXMAC */
-        ctl |= 0x05;    /* TX mac enable, FC disable */
+        ctl |= 0x09;    /* TX mac enable, FC disable */
         writel(ctl, &etdev->regs->txmac.ctl);
 
         /* Ready to start the RXDMA/TXDMA engine */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ad37da2b6cb5..a6a88dfd5029 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -125,7 +125,7 @@ static void handle_tx(struct vhost_net *net)
         mutex_lock(&vq->mutex);
         vhost_disable_notify(vq);
 
-        if (wmem < sock->sk->sk_sndbuf * 2)
+        if (wmem < sock->sk->sk_sndbuf / 2)
                 tx_poll_stop(net);
         hdr_size = vq->hdr_size;
 
@@ -508,12 +508,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         /* Verify that ring has been setup correctly. */
         if (!vhost_vq_access_ok(vq)) {
                 r = -EFAULT;
-                goto err;
+                goto err_vq;
         }
         sock = get_socket(fd);
         if (IS_ERR(sock)) {
                 r = PTR_ERR(sock);
-                goto err;
+                goto err_vq;
         }
 
         /* start polling new socket */
@@ -524,12 +524,14 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         vhost_net_disable_vq(n, vq);
         rcu_assign_pointer(vq->private_data, sock);
         vhost_net_enable_vq(n, vq);
-        mutex_unlock(&vq->mutex);
 done:
         if (oldsock) {
                 vhost_net_flush_vq(n, index);
                 fput(oldsock->file);
         }
+
+err_vq:
+        mutex_unlock(&vq->mutex);
 err:
         mutex_unlock(&n->dev.mutex);
         return r;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 7cd55e078794..7bd7a1e4409d 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -476,8 +476,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->kick) {
                         pollstop = filep = vq->kick;
                         pollstart = vq->kick = eventfp;
@@ -489,8 +491,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->call) {
                         filep = vq->call;
                         ctx = vq->call_ctx;
@@ -505,8 +509,10 @@ static long vhost_set_vring(struct vhost_dev *d, int ioctl, void __user *argp)
                 if (r < 0)
                         break;
                 eventfp = f.fd == -1 ? NULL : eventfd_fget(f.fd);
-                if (IS_ERR(eventfp))
-                        return PTR_ERR(eventfp);
+                if (IS_ERR(eventfp)) {
+                        r = PTR_ERR(eventfp);
+                        break;
+                }
                 if (eventfp != vq->error) {
                         filep = vq->error;
                         vq->error = eventfp;
diff --git a/drivers/video/geode/lxfb.h b/drivers/video/geode/lxfb.h
index cc781c00f75d..e4c4d89b7860 100644
--- a/drivers/video/geode/lxfb.h
+++ b/drivers/video/geode/lxfb.h
@@ -365,6 +365,8 @@ enum fp_registers {
         FP_CRC, /* 0x458 */
 };
 
+#define FP_PT2_HSP                      (1 << 22)
+#define FP_PT2_VSP                      (1 << 23)
 #define FP_PT2_SCRC                     (1 << 27)       /* shfclk free */
 
 #define FP_PM_P                         (1 << 24)       /* panel power ctl */
diff --git a/drivers/video/geode/lxfb_ops.c b/drivers/video/geode/lxfb_ops.c
index 0e5d8c7c3eba..bc35a95e59d4 100644
--- a/drivers/video/geode/lxfb_ops.c
+++ b/drivers/video/geode/lxfb_ops.c
@@ -274,7 +274,15 @@ static void lx_graphics_enable(struct fb_info *info)
                 u32 msrlo, msrhi;
 
                 write_fp(par, FP_PT1, 0);
-                write_fp(par, FP_PT2, FP_PT2_SCRC);
+                temp = FP_PT2_SCRC;
+
+                if (info->var.sync & FB_SYNC_HOR_HIGH_ACT)
+                        temp |= FP_PT2_HSP;
+
+                if (info->var.sync & FB_SYNC_VERT_HIGH_ACT)
+                        temp |= FP_PT2_VSP;
+
+                write_fp(par, FP_PT2, temp);
                 write_fp(par, FP_DFC, FP_DFC_BC);
 
                 msrlo = MSR_LX_MSR_PADSEL_TFT_SEL_LOW;
diff --git a/drivers/video/omap2/displays/panel-generic.c b/drivers/video/omap2/displays/panel-generic.c
index c59e4baed8b2..300eff5de1b4 100644
--- a/drivers/video/omap2/displays/panel-generic.c
+++ b/drivers/video/omap2/displays/panel-generic.c
@@ -116,6 +116,24 @@ static int generic_panel_resume(struct omap_dss_device *dssdev)
         return 0;
 }
 
+static void generic_panel_set_timings(struct omap_dss_device *dssdev,
+                struct omap_video_timings *timings)
+{
+        dpi_set_timings(dssdev, timings);
+}
+
+static void generic_panel_get_timings(struct omap_dss_device *dssdev,
+                struct omap_video_timings *timings)
+{
+        *timings = dssdev->panel.timings;
+}
+
+static int generic_panel_check_timings(struct omap_dss_device *dssdev,
+                struct omap_video_timings *timings)
+{
+        return dpi_check_timings(dssdev, timings);
+}
+
 static struct omap_dss_driver generic_driver = {
         .probe          = generic_panel_probe,
         .remove         = generic_panel_remove,
@@ -125,6 +143,10 @@ static struct omap_dss_driver generic_driver = {
         .suspend        = generic_panel_suspend,
         .resume         = generic_panel_resume,
 
+        .set_timings    = generic_panel_set_timings,
+        .get_timings    = generic_panel_get_timings,
+        .check_timings  = generic_panel_check_timings,
+
         .driver         = {
                 .name   = "generic_panel",
                 .owner  = THIS_MODULE,
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
index 8254a4232a53..54344184dd73 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/omap2/dss/dss.c
@@ -590,6 +590,9 @@ int dss_init(bool skip_init)
                 }
         }
 
+        dss.dsi_clk_source = DSS_SRC_DSS1_ALWON_FCLK;
+        dss.dispc_clk_source = DSS_SRC_DSS1_ALWON_FCLK;
+
         dss_save_context();
 
         rev = dss_read_reg(DSS_REVISION);
diff --git a/drivers/video/omap2/vram.c b/drivers/video/omap2/vram.c
index 55a4de5e5d10..b266ffae0bde 100644
--- a/drivers/video/omap2/vram.c
+++ b/drivers/video/omap2/vram.c
@@ -511,13 +511,14 @@ static u32 omap_vram_sdram_size __initdata;
 static u32 omap_vram_def_sdram_size __initdata;
 static u32 omap_vram_def_sdram_start __initdata;
 
-static void __init omap_vram_early_vram(char **p)
+static int __init omap_vram_early_vram(char *p)
 {
-        omap_vram_def_sdram_size = memparse(*p, p);
-        if (**p == ',')
-                omap_vram_def_sdram_start = simple_strtoul((*p) + 1, p, 16);
+        omap_vram_def_sdram_size = memparse(p, &p);
+        if (*p == ',')
+                omap_vram_def_sdram_start = simple_strtoul(p + 1, &p, 16);
+        return 0;
 }
-__early_param("vram=", omap_vram_early_vram);
+early_param("vram", omap_vram_early_vram);
 
 /*
  * Called from map_io. We need to call to this early enough so that we
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index 75285d3f393c..c91a7f70f7b0 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -668,7 +668,7 @@ static int __init pxa168fb_probe(struct platform_device *pdev)
         /*
          * Map LCD controller registers.
          */
-        fbi->reg_base = ioremap_nocache(res->start, res->end - res->start);
+        fbi->reg_base = ioremap_nocache(res->start, resource_size(res));
         if (fbi->reg_base == NULL) {
                 ret = -ENOMEM;
                 goto failed;
diff --git a/fs/afs/security.c b/fs/afs/security.c
index 3ef504370034..bb4ed144d0e4 100644
--- a/fs/afs/security.c
+++ b/fs/afs/security.c
@@ -189,8 +189,9 @@ void afs_cache_permit(struct afs_vnode *vnode, struct key *key, long acl_order)
         if (!permits)
                 goto out_unlock;
 
-        memcpy(permits->permits, xpermits->permits,
-               count * sizeof(struct afs_permit));
+        if (xpermits)
+                memcpy(permits->permits, xpermits->permits,
+                        count * sizeof(struct afs_permit));
 
         _debug("key %x access %x",
                key_serial(key), vnode->status.caller_access);
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index 15d80bb35d6f..9b6aef0f75e5 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -75,14 +75,16 @@ static int aout_core_dump(struct coredump_params *cprm)
         struct file *file = cprm->file;
         mm_segment_t fs;
         int has_dumped = 0;
-        unsigned long dump_start, dump_size;
+        void __user *dump_start;
+        int dump_size;
         struct user dump;
 #ifdef __alpha__
-#       define START_DATA(u)    (u.start_data)
+#       define START_DATA(u)    ((void __user *)u.start_data)
 #else
-#       define START_DATA(u)    ((u.u_tsize << PAGE_SHIFT) + u.start_code)
+#       define START_DATA(u)    ((void __user *)((u.u_tsize << PAGE_SHIFT) + \
+                                 u.start_code))
 #endif
-#       define START_STACK(u)   (u.start_stack)
+#       define START_STACK(u)   ((void __user *)u.start_stack)
 
         fs = get_fs();
         set_fs(KERNEL_DS);
@@ -104,9 +106,9 @@ static int aout_core_dump(struct coredump_params *cprm)
 
 /* make sure we actually have a data and stack area to dump */
         set_fs(USER_DS);
-        if (!access_ok(VERIFY_READ, (void __user *)START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
+        if (!access_ok(VERIFY_READ, START_DATA(dump), dump.u_dsize << PAGE_SHIFT))
                 dump.u_dsize = 0;
-        if (!access_ok(VERIFY_READ, (void __user *)START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
+        if (!access_ok(VERIFY_READ, START_STACK(dump), dump.u_ssize << PAGE_SHIFT))
                 dump.u_ssize = 0;
 
         set_fs(KERNEL_DS);
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 2c32d00a6690..7ab23e006e4c 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1590,7 +1590,7 @@ static size_t elf_core_vma_data_size(unsigned long mm_flags)
         struct vm_area_struct *vma;
         size_t size = 0;
 
-        for (vma = current->mm->mmap; vma; vma->vm_next)
+        for (vma = current->mm->mmap; vma; vma = vma->vm_next)
                 if (maydump(vma, mm_flags))
                         size += vma->vm_end - vma->vm_start;
         return size;
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 23bb0ceabe31..ce8ef6107727 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -919,6 +919,10 @@ static int context_is_writeable_or_written(struct inode *inode,
 /*
  * We are only allowed to write into/dirty the page if the page is
  * clean, or already dirty within the same snap context.
+ *
+ * called with page locked.
+ * return success with page locked,
+ * or any failure (incl -EAGAIN) with page unlocked.
  */
 static int ceph_update_writeable_page(struct file *file,
                             loff_t pos, unsigned len,
@@ -961,9 +965,11 @@ retry_locked:
                         snapc = ceph_get_snap_context((void *)page->private);
                         unlock_page(page);
                         ceph_queue_writeback(inode);
-                        wait_event_interruptible(ci->i_cap_wq,
+                        r = wait_event_interruptible(ci->i_cap_wq,
                                context_is_writeable_or_written(inode, snapc));
                         ceph_put_snap_context(snapc);
+                        if (r == -ERESTARTSYS)
+                                return r;
                         return -EAGAIN;
                 }
 
@@ -1035,7 +1041,7 @@ static int ceph_write_begin(struct file *file, struct address_space *mapping,
         int r;
 
         do {
-                /* get a page*/
+                /* get a page */
                 page = grab_cache_page_write_begin(mapping, index, 0);
                 if (!page)
                         return -ENOMEM;
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
index f0318427b6da..8d8a84964763 100644
--- a/fs/ceph/auth_x.c
+++ b/fs/ceph/auth_x.c
@@ -28,6 +28,12 @@ static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
         return (ac->want_keys & xi->have_keys) == ac->want_keys;
 }
 
+static int ceph_x_encrypt_buflen(int ilen)
+{
+        return sizeof(struct ceph_x_encrypt_header) + ilen + 16 +
+                sizeof(u32);
+}
+
 static int ceph_x_encrypt(struct ceph_crypto_key *secret,
                           void *ibuf, int ilen, void *obuf, size_t olen)
 {
@@ -150,6 +156,11 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
                 struct timespec validity;
                 struct ceph_crypto_key old_key;
                 void *tp, *tpend;
+                struct ceph_timespec new_validity;
+                struct ceph_crypto_key new_session_key;
+                struct ceph_buffer *new_ticket_blob;
+                unsigned long new_expires, new_renew_after;
+                u64 new_secret_id;
 
                 ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
 
@@ -182,16 +193,16 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
                         goto bad;
 
                 memcpy(&old_key, &th->session_key, sizeof(old_key));
-                ret = ceph_crypto_key_decode(&th->session_key, &dp, dend);
+                ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
                 if (ret)
                         goto out;
 
-                ceph_decode_copy(&dp, &th->validity, sizeof(th->validity));
-                ceph_decode_timespec(&validity, &th->validity);
-                th->expires = get_seconds() + validity.tv_sec;
-                th->renew_after = th->expires - (validity.tv_sec / 4);
-                dout(" expires=%lu renew_after=%lu\n", th->expires,
-                     th->renew_after);
+                ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+                ceph_decode_timespec(&validity, &new_validity);
+                new_expires = get_seconds() + validity.tv_sec;
+                new_renew_after = new_expires - (validity.tv_sec / 4);
+                dout(" expires=%lu renew_after=%lu\n", new_expires,
+                     new_renew_after);
 
                 /* ticket blob for service */
                 ceph_decode_8_safe(&p, end, is_enc, bad);
@@ -216,10 +227,21 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
                 dout(" ticket blob is %d bytes\n", dlen);
                 ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
                 struct_v = ceph_decode_8(&tp);
-                th->secret_id = ceph_decode_64(&tp);
-                ret = ceph_decode_buffer(&th->ticket_blob, &tp, tpend);
+                new_secret_id = ceph_decode_64(&tp);
+                ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
                 if (ret)
                         goto out;
+
+                /* all is well, update our ticket */
+                ceph_crypto_key_destroy(&th->session_key);
+                if (th->ticket_blob)
+                        ceph_buffer_put(th->ticket_blob);
+                th->session_key = new_session_key;
+                th->ticket_blob = new_ticket_blob;
+                th->validity = new_validity;
+                th->secret_id = new_secret_id;
+                th->expires = new_expires;
+                th->renew_after = new_renew_after;
                 dout(" got ticket service %d (%s) secret_id %lld len %d\n",
                      type, ceph_entity_type_name(type), th->secret_id,
                      (int)th->ticket_blob->vec.iov_len);
@@ -242,7 +264,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
                                    struct ceph_x_ticket_handler *th,
                                    struct ceph_x_authorizer *au)
 {
-        int len;
+        int maxlen;
         struct ceph_x_authorize_a *msg_a;
         struct ceph_x_authorize_b msg_b;
         void *p, *end;
@@ -253,15 +275,15 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
         dout("build_authorizer for %s %p\n",
              ceph_entity_type_name(th->service), au);
 
-        len = sizeof(*msg_a) + sizeof(msg_b) + sizeof(u32) +
-                ticket_blob_len + 16;
-        dout("  need len %d\n", len);
-        if (au->buf && au->buf->alloc_len < len) {
+        maxlen = sizeof(*msg_a) + sizeof(msg_b) +
+                ceph_x_encrypt_buflen(ticket_blob_len);
+        dout("  need len %d\n", maxlen);
+        if (au->buf && au->buf->alloc_len < maxlen) {
                 ceph_buffer_put(au->buf);
                 au->buf = NULL;
         }
         if (!au->buf) {
-                au->buf = ceph_buffer_new(len, GFP_NOFS);
+                au->buf = ceph_buffer_new(maxlen, GFP_NOFS);
                 if (!au->buf)
                         return -ENOMEM;
         }
@@ -296,6 +318,7 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
         au->buf->vec.iov_len = p - au->buf->vec.iov_base;
         dout(" built authorizer nonce %llx len %d\n", au->nonce,
              (int)au->buf->vec.iov_len);
+        BUG_ON(au->buf->vec.iov_len > maxlen);
         return 0;
 
 out_buf:
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index db122bb357b8..7d0a0d0adc18 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1407,6 +1407,7 @@ static int try_nonblocking_invalidate(struct inode *inode)
  */
 void ceph_check_caps(struct ceph_inode_info *ci, int flags,
                      struct ceph_mds_session *session)
+        __releases(session->s_mutex)
 {
         struct ceph_client *client = ceph_inode_to_client(&ci->vfs_inode);
         struct ceph_mds_client *mdsc = &client->mdsc;
@@ -1414,7 +1415,6 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags,
         struct ceph_cap *cap;
         int file_wanted, used;
         int took_snap_rwsem = 0;             /* true if mdsc->snap_rwsem held */
-        int drop_session_lock = session ? 0 : 1;
         int issued, implemented, want, retain, revoking, flushing = 0;
         int mds = -1;   /* keep track of how far we've gone through i_caps list
                            to avoid an infinite loop on retry */
@@ -1639,7 +1639,7 @@ ack:
         if (queue_invalidate)
                 ceph_queue_invalidate(inode);
 
-        if (session && drop_session_lock)
+        if (session)
                 mutex_unlock(&session->s_mutex);
         if (took_snap_rwsem)
                 up_read(&mdsc->snap_rwsem);
@@ -2195,18 +2195,19 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
  * Handle a cap GRANT message from the MDS.  (Note that a GRANT may
  * actually be a revocation if it specifies a smaller cap set.)
  *
- * caller holds s_mutex.
+ * caller holds s_mutex and i_lock, we drop both.
+ *
  * return value:
  *  0 - ok
  *  1 - check_caps on auth cap only (writeback)
  *  2 - check_caps (ack revoke)
  */
-static int handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
-                            struct ceph_mds_session *session,
-                            struct ceph_cap *cap,
-                            struct ceph_buffer *xattr_buf)
+static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
+                             struct ceph_mds_session *session,
+                             struct ceph_cap *cap,
+                             struct ceph_buffer *xattr_buf)
         __releases(inode->i_lock)
-
+        __releases(session->s_mutex)
 {
         struct ceph_inode_info *ci = ceph_inode(inode);
         int mds = session->s_mds;
@@ -2216,7 +2217,7 @@ static int handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
         u64 size = le64_to_cpu(grant->size);
         u64 max_size = le64_to_cpu(grant->max_size);
         struct timespec mtime, atime, ctime;
-        int reply = 0;
+        int check_caps = 0;
         int wake = 0;
         int writeback = 0;
         int revoked_rdcache = 0;
@@ -2329,11 +2330,12 @@ static int handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
                 if ((used & ~newcaps) & CEPH_CAP_FILE_BUFFER)
                         writeback = 1; /* will delay ack */
                 else if (dirty & ~newcaps)
-                        reply = 1;     /* initiate writeback in check_caps */
+                        check_caps = 1;  /* initiate writeback in check_caps */
                 else if (((used & ~newcaps) & CEPH_CAP_FILE_CACHE) == 0 ||
                            revoked_rdcache)
-                        reply = 2;     /* send revoke ack in check_caps */
+                        check_caps = 2;     /* send revoke ack in check_caps */
                 cap->issued = newcaps;
+                cap->implemented |= newcaps;
         } else if (cap->issued == newcaps) {
                 dout("caps unchanged: %s -> %s\n",
                      ceph_cap_string(cap->issued), ceph_cap_string(newcaps));
@@ -2346,6 +2348,7 @@ static int handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
                                               * pending revocation */
                 wake = 1;
         }
+        BUG_ON(cap->issued & ~cap->implemented);
 
         spin_unlock(&inode->i_lock);
         if (writeback)
@@ -2359,7 +2362,14 @@ static int handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
                 ceph_queue_invalidate(inode);
         if (wake)
                 wake_up(&ci->i_cap_wq);
-        return reply;
+
+        if (check_caps == 1)
+                ceph_check_caps(ci, CHECK_CAPS_NODELAY|CHECK_CAPS_AUTHONLY,
+                                session);
+        else if (check_caps == 2)
+                ceph_check_caps(ci, CHECK_CAPS_NODELAY, session);
+        else
+                mutex_unlock(&session->s_mutex);
 }
 
 /*
@@ -2548,9 +2558,8 @@ static void handle_cap_export(struct inode *inode, struct ceph_mds_caps *ex,
                         ci->i_cap_exporting_issued = cap->issued;
                 }
                 __ceph_remove_cap(cap);
-        } else {
-                WARN_ON(!cap);
         }
+        /* else, we already released it */
 
         spin_unlock(&inode->i_lock);
 }
@@ -2621,9 +2630,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         u64 cap_id;
         u64 size, max_size;
         u64 tid;
-        int check_caps = 0;
         void *snaptrace;
-        int r;
 
         dout("handle_caps from mds%d\n", mds);
 
@@ -2668,8 +2675,9 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         case CEPH_CAP_OP_IMPORT:
                 handle_cap_import(mdsc, inode, h, session,
                                   snaptrace, le32_to_cpu(h->snap_trace_len));
-                check_caps = 1; /* we may have sent a RELEASE to the old auth */
-                goto done;
+                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_NODELAY,
+                                session);
+                goto done_unlocked;
         }
 
         /* the rest require a cap */
@@ -2686,16 +2694,8 @@ void ceph_handle_caps(struct ceph_mds_session *session,
         switch (op) {
         case CEPH_CAP_OP_REVOKE:
         case CEPH_CAP_OP_GRANT:
-                r = handle_cap_grant(inode, h, session, cap, msg->middle);
-                if (r == 1)
-                        ceph_check_caps(ceph_inode(inode),
-                                        CHECK_CAPS_NODELAY|CHECK_CAPS_AUTHONLY,
-                                        session);
-                else if (r == 2)
-                        ceph_check_caps(ceph_inode(inode),
-                                        CHECK_CAPS_NODELAY,
-                                        session);
-                break;
+                handle_cap_grant(inode, h, session, cap, msg->middle);
+                goto done_unlocked;
 
         case CEPH_CAP_OP_FLUSH_ACK:
                 handle_cap_flush_ack(inode, tid, h, session, cap);
@@ -2713,9 +2713,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
 
 done:
         mutex_unlock(&session->s_mutex);
-
-        if (check_caps)
-                ceph_check_caps(ceph_inode(inode), CHECK_CAPS_NODELAY, NULL);
+done_unlocked:
         if (inode)
                 iput(inode);
         return;
@@ -2838,11 +2836,18 @@ int ceph_encode_inode_release(void **p, struct inode *inode,
         struct ceph_cap *cap;
         struct ceph_mds_request_release *rel = *p;
         int ret = 0;
-
-        dout("encode_inode_release %p mds%d drop %s unless %s\n", inode,
-             mds, ceph_cap_string(drop), ceph_cap_string(unless));
+        int used = 0;
 
         spin_lock(&inode->i_lock);
+        used = __ceph_caps_used(ci);
+
+        dout("encode_inode_release %p mds%d used %s drop %s unless %s\n", inode,
+             mds, ceph_cap_string(used), ceph_cap_string(drop),
+             ceph_cap_string(unless));
+
+        /* only drop unused caps */
+        drop &= ~used;
+
         cap = __get_cap_for_mds(ci, mds);
         if (cap && __cap_is_valid(cap)) {
                 if (force ||
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 5107384ee029..8a9116e15b70 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -288,8 +288,10 @@ more:
                         CEPH_MDS_OP_LSSNAP : CEPH_MDS_OP_READDIR;
 
                 /* discard old result, if any */
-                if (fi->last_readdir)
+                if (fi->last_readdir) {
                         ceph_mdsc_put_request(fi->last_readdir);
+                        fi->last_readdir = NULL;
+                }
 
                 /* requery frag tree, as the frag topology may have changed */
                 frag = ceph_choose_frag(ceph_inode(inode), frag, NULL, NULL);
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 7abe1aed819b..aca82d55cc53 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -378,6 +378,22 @@ void ceph_destroy_inode(struct inode *inode)
 
         ceph_queue_caps_release(inode);
 
+        /*
+         * we may still have a snap_realm reference if there are stray
+         * caps in i_cap_exporting_issued or i_snap_caps.
+         */
+        if (ci->i_snap_realm) {
+                struct ceph_mds_client *mdsc =
+                        &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+                struct ceph_snap_realm *realm = ci->i_snap_realm;
+
+                dout(" dropping residual ref to snap realm %p\n", realm);
+                spin_lock(&realm->inodes_with_caps_lock);
+                list_del_init(&ci->i_snap_realm_item);
+                spin_unlock(&realm->inodes_with_caps_lock);
+                ceph_put_snap_realm(mdsc, realm);
+        }
+
         kfree(ci->i_symlink);
         while ((n = rb_first(&ci->i_fragtree)) != NULL) {
                 frag = rb_entry(n, struct ceph_inode_frag, node);
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index a2600101ec22..5c7920be6420 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -328,6 +328,8 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc,
         struct ceph_mds_session *s;
 
         s = kzalloc(sizeof(*s), GFP_NOFS);
+        if (!s)
+                return ERR_PTR(-ENOMEM);
         s->s_mdsc = mdsc;
         s->s_mds = mds;
         s->s_state = CEPH_MDS_SESSION_NEW;
@@ -529,7 +531,7 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
 {
         dout("__unregister_request %p tid %lld\n", req, req->r_tid);
         rb_erase(&req->r_node, &mdsc->request_tree);
-        ceph_mdsc_put_request(req);
+        RB_CLEAR_NODE(&req->r_node);
 
         if (req->r_unsafe_dir) {
                 struct ceph_inode_info *ci = ceph_inode(req->r_unsafe_dir);
@@ -538,6 +540,8 @@ static void __unregister_request(struct ceph_mds_client *mdsc,
                 list_del_init(&req->r_unsafe_dir_item);
                 spin_unlock(&ci->i_unsafe_lock);
         }
+
+        ceph_mdsc_put_request(req);
 }
 
 /*
@@ -862,6 +866,7 @@ static int send_renew_caps(struct ceph_mds_client *mdsc,
         if (time_after_eq(jiffies, session->s_cap_ttl) &&
             time_after_eq(session->s_cap_ttl, session->s_renew_requested))
                 pr_info("mds%d caps stale\n", session->s_mds);
+        session->s_renew_requested = jiffies;
 
         /* do not try to renew caps until a recovering mds has reconnected
          * with its clients. */
@@ -874,7 +879,6 @@ static int send_renew_caps(struct ceph_mds_client *mdsc,
 
         dout("send_renew_caps to mds%d (%s)\n", session->s_mds,
                 ceph_mds_state_name(state));
-        session->s_renew_requested = jiffies;
         msg = create_session_msg(CEPH_SESSION_REQUEST_RENEWCAPS,
                                  ++session->s_renew_seq);
         if (IS_ERR(msg))
@@ -1566,8 +1570,13 @@ static int __do_request(struct ceph_mds_client *mdsc,
 
         /* get, open session */
         session = __ceph_lookup_mds_session(mdsc, mds);
-        if (!session)
+        if (!session) {
                 session = register_session(mdsc, mds);
+                if (IS_ERR(session)) {
+                        err = PTR_ERR(session);
+                        goto finish;
+                }
+        }
         dout("do_request mds%d session %p state %s\n", mds, session,
              session_state_name(session->s_state));
         if (session->s_state != CEPH_MDS_SESSION_OPEN &&
@@ -1770,7 +1779,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg)
         dout("handle_reply %p\n", req);
 
         /* correct session? */
-        if (!req->r_session && req->r_session != session) {
+        if (req->r_session != session) {
                 pr_err("mdsc_handle_reply got %llu on session mds%d"
                        " not mds%d\n", tid, session->s_mds,
                        req->r_session ? req->r_session->s_mds : -1);
@@ -2682,29 +2691,41 @@ void ceph_mdsc_pre_umount(struct ceph_mds_client *mdsc)
  */
 static void wait_unsafe_requests(struct ceph_mds_client *mdsc, u64 want_tid)
 {
-        struct ceph_mds_request *req = NULL;
+        struct ceph_mds_request *req = NULL, *nextreq;
         struct rb_node *n;
 
         mutex_lock(&mdsc->mutex);
         dout("wait_unsafe_requests want %lld\n", want_tid);
+restart:
         req = __get_oldest_req(mdsc);
         while (req && req->r_tid <= want_tid) {
+                /* find next request */
+                n = rb_next(&req->r_node);
+                if (n)
+                        nextreq = rb_entry(n, struct ceph_mds_request, r_node);
+                else
+                        nextreq = NULL;
                 if ((req->r_op & CEPH_MDS_OP_WRITE)) {
                         /* write op */
                         ceph_mdsc_get_request(req);
+                        if (nextreq)
+                                ceph_mdsc_get_request(nextreq);
                         mutex_unlock(&mdsc->mutex);
                         dout("wait_unsafe_requests  wait on %llu (want %llu)\n",
                              req->r_tid, want_tid);
                         wait_for_completion(&req->r_safe_completion);
                         mutex_lock(&mdsc->mutex);
-                        n = rb_next(&req->r_node);
                         ceph_mdsc_put_request(req);
-                } else {
-                        n = rb_next(&req->r_node);
+                        if (!nextreq)
+                                break;  /* next dne before, so we're done! */
+                        if (RB_EMPTY_NODE(&nextreq->r_node)) {
+                                /* next request was removed from tree */
+                                ceph_mdsc_put_request(nextreq);
+                                goto restart;
+                        }
+                        ceph_mdsc_put_request(nextreq);  /* won't go away */
                 }
-                if (!n)
-                        break;
-                req = rb_entry(n, struct ceph_mds_request, r_node);
+                req = nextreq;
         }
         mutex_unlock(&mdsc->mutex);
         dout("wait_unsafe_requests done\n");
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 781656a49bf8..a32f0f896d9f 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -366,6 +366,14 @@ void ceph_con_open(struct ceph_connection *con, struct ceph_entity_addr *addr)
 }
 
 /*
+ * return true if this connection ever successfully opened
+ */
+bool ceph_con_opened(struct ceph_connection *con)
+{
+        return con->connect_seq > 0;
+}
+
+/*
  * generic get/put
  */
 struct ceph_connection *ceph_con_get(struct ceph_connection *con)
@@ -830,13 +838,6 @@ static void prepare_read_connect(struct ceph_connection *con)
         con->in_base_pos = 0;
 }
 
-static void prepare_read_connect_retry(struct ceph_connection *con)
-{
-        dout("prepare_read_connect_retry %p\n", con);
-        con->in_base_pos = strlen(CEPH_BANNER) + sizeof(con->actual_peer_addr)
-                + sizeof(con->peer_addr_for_me);
-}
-
 static void prepare_read_ack(struct ceph_connection *con)
 {
         dout("prepare_read_ack %p\n", con);
@@ -1146,7 +1147,7 @@ static int process_connect(struct ceph_connection *con)
                 }
                 con->auth_retry = 1;
                 prepare_write_connect(con->msgr, con, 0);
-                prepare_read_connect_retry(con);
+                prepare_read_connect(con);
                 break;
 
         case CEPH_MSGR_TAG_RESETSESSION:
@@ -1843,8 +1844,6 @@ static void ceph_fault(struct ceph_connection *con)
                 goto out;
         }
 
-        clear_bit(BUSY, &con->state);  /* to avoid an improbable race */
-
         mutex_lock(&con->mutex);
         if (test_bit(CLOSED, &con->state))
                 goto out_unlock;
diff --git a/fs/ceph/messenger.h b/fs/ceph/messenger.h
index 4caaa5911110..a343dae73cdc 100644
--- a/fs/ceph/messenger.h
+++ b/fs/ceph/messenger.h
@@ -223,6 +223,7 @@ extern void ceph_con_init(struct ceph_messenger *msgr,
                           struct ceph_connection *con);
 extern void ceph_con_open(struct ceph_connection *con,
                           struct ceph_entity_addr *addr);
+extern bool ceph_con_opened(struct ceph_connection *con);
 extern void ceph_con_close(struct ceph_connection *con);
 extern void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg);
 extern void ceph_con_revoke(struct ceph_connection *con, struct ceph_msg *msg);
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index dbe63db9762f..c7b4dedaace6 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -413,11 +413,22 @@ static void remove_old_osds(struct ceph_osd_client *osdc, int remove_all)
  */
 static int __reset_osd(struct ceph_osd_client *osdc, struct ceph_osd *osd)
 {
+        struct ceph_osd_request *req;
         int ret = 0;
 
         dout("__reset_osd %p osd%d\n", osd, osd->o_osd);
         if (list_empty(&osd->o_requests)) {
                 __remove_osd(osdc, osd);
+        } else if (memcmp(&osdc->osdmap->osd_addr[osd->o_osd],
+                          &osd->o_con.peer_addr,
+                          sizeof(osd->o_con.peer_addr)) == 0 &&
+                   !ceph_con_opened(&osd->o_con)) {
+                dout(" osd addr hasn't changed and connection never opened,"
+                     " letting msgr retry");
+                /* touch each r_stamp for handle_timeout()'s benfit */
+                list_for_each_entry(req, &osd->o_requests, r_osd_item)
+                        req->r_stamp = jiffies;
+                ret = -EAGAIN;
         } else {
                 ceph_con_close(&osd->o_con);
                 ceph_con_open(&osd->o_con, &osdc->osdmap->osd_addr[osd->o_osd]);
@@ -633,7 +644,7 @@ static int __send_request(struct ceph_osd_client *osdc,
         reqhead->flags |= cpu_to_le32(req->r_flags);  /* e.g., RETRY */
         reqhead->reassert_version = req->r_reassert_version;
 
-        req->r_sent_stamp = jiffies;
+        req->r_stamp = jiffies;
         list_move_tail(&osdc->req_lru, &req->r_req_lru_item);
 
         ceph_msg_get(req->r_request); /* send consumes a ref */
@@ -660,7 +671,7 @@ static void handle_timeout(struct work_struct *work)
         unsigned long timeout = osdc->client->mount_args->osd_timeout * HZ;
         unsigned long keepalive =
                 osdc->client->mount_args->osd_keepalive_timeout * HZ;
-        unsigned long last_sent = 0;
+        unsigned long last_stamp = 0;
         struct rb_node *p;
         struct list_head slow_osds;
 
@@ -697,12 +708,12 @@ static void handle_timeout(struct work_struct *work)
                 req = list_entry(osdc->req_lru.next, struct ceph_osd_request,
                                  r_req_lru_item);
 
-                if (time_before(jiffies, req->r_sent_stamp + timeout))
+                if (time_before(jiffies, req->r_stamp + timeout))
                         break;
 
-                BUG_ON(req == last_req && req->r_sent_stamp == last_sent);
+                BUG_ON(req == last_req && req->r_stamp == last_stamp);
                 last_req = req;
-                last_sent = req->r_sent_stamp;
+                last_stamp = req->r_stamp;
 
                 osd = req->r_osd;
                 BUG_ON(!osd);
@@ -718,7 +729,7 @@ static void handle_timeout(struct work_struct *work)
          */
         INIT_LIST_HEAD(&slow_osds);
         list_for_each_entry(req, &osdc->req_lru, r_req_lru_item) {
-                if (time_before(jiffies, req->r_sent_stamp + keepalive))
+                if (time_before(jiffies, req->r_stamp + keepalive))
                         break;
 
                 osd = req->r_osd;
@@ -862,7 +873,9 @@ static int __kick_requests(struct ceph_osd_client *osdc,
 
         dout("kick_requests osd%d\n", kickosd ? kickosd->o_osd : -1);
         if (kickosd) {
-                __reset_osd(osdc, kickosd);
+                err = __reset_osd(osdc, kickosd);
+                if (err == -EAGAIN)
+                        return 1;
         } else {
                 for (p = rb_first(&osdc->osds); p; p = n) {
                         struct ceph_osd *osd =
@@ -913,7 +926,7 @@ static int __kick_requests(struct ceph_osd_client *osdc,
 
 kick:
                 dout("kicking %p tid %llu osd%d\n", req, req->r_tid,
-                     req->r_osd->o_osd);
+                     req->r_osd ? req->r_osd->o_osd : -1);
                 req->r_flags |= CEPH_OSD_FLAG_RETRY;
                 err = __send_request(osdc, req);
                 if (err) {
diff --git a/fs/ceph/osd_client.h b/fs/ceph/osd_client.h
index 1b1a3ca43afc..b0759911e7c3 100644
--- a/fs/ceph/osd_client.h
+++ b/fs/ceph/osd_client.h
@@ -70,7 +70,7 @@ struct ceph_osd_request {
 
         char              r_oid[40];          /* object name */
         int               r_oid_len;
-        unsigned long     r_sent_stamp;
+        unsigned long     r_stamp;            /* send OR check time */
         bool              r_resend;           /* msg send failed, needs retry */
 
         struct ceph_file_layout r_file_layout;
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index b83f2692b835..d82fe87c2a6e 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -480,6 +480,14 @@ static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
         return NULL;
 }
 
+void __decode_pool(void **p, struct ceph_pg_pool_info *pi)
+{
+        ceph_decode_copy(p, &pi->v, sizeof(pi->v));
+        calc_pg_masks(pi);
+        *p += le32_to_cpu(pi->v.num_snaps) * sizeof(u64);
+        *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
+}
+
 /*
  * decode a full map.
  */
@@ -526,12 +534,8 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                                    ev, CEPH_PG_POOL_VERSION);
                         goto bad;
                 }
-                ceph_decode_copy(p, &pi->v, sizeof(pi->v));
+                __decode_pool(p, pi);
                 __insert_pg_pool(&map->pg_pools, pi);
-                calc_pg_masks(pi);
-                *p += le32_to_cpu(pi->v.num_snaps) * sizeof(u64);
-                *p += le32_to_cpu(pi->v.num_removed_snap_intervals)
-                        * sizeof(u64) * 2;
         }
         ceph_decode_32_safe(p, end, map->pool_max, bad);
 
@@ -714,8 +718,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                         pi->id = pool;
                         __insert_pg_pool(&map->pg_pools, pi);
                 }
-                ceph_decode_copy(p, &pi->v, sizeof(pi->v));
-                calc_pg_masks(pi);
+                __decode_pool(p, pi);
         }
 
         /* old_pool */
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index bf2a5f3846a4..df04e210a055 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -314,9 +314,9 @@ static int build_snap_context(struct ceph_snap_realm *realm)
            because we rebuild_snap_realms() works _downward_ in
            hierarchy after each update.) */
         if (realm->cached_context &&
-            realm->cached_context->seq <= realm->seq &&
+            realm->cached_context->seq == realm->seq &&
             (!parent ||
-             realm->cached_context->seq <= parent->cached_context->seq)) {
+             realm->cached_context->seq >= parent->cached_context->seq)) {
                 dout("build_snap_context %llx %p: %p seq %lld (%d snaps)"
                      " (unchanged)\n",
                      realm->ino, realm, realm->cached_context,
@@ -818,7 +818,9 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
                          * queued (again) by ceph_update_snap_trace()
                          * below.  Queue it _now_, under the old context.
                          */
+                        spin_lock(&realm->inodes_with_caps_lock);
                         list_del_init(&ci->i_snap_realm_item);
+                        spin_unlock(&realm->inodes_with_caps_lock);
                         spin_unlock(&inode->i_lock);
 
                         ceph_queue_cap_snap(ci,
diff --git a/fs/ext3/ialloc.c b/fs/ext3/ialloc.c
index ef9008b885b5..0d0e97ed3ff6 100644
--- a/fs/ext3/ialloc.c
+++ b/fs/ext3/ialloc.c
@@ -582,7 +582,9 @@ got:
         inode->i_generation = sbi->s_next_generation++;
         spin_unlock(&sbi->s_next_gen_lock);
 
-        ei->i_state = EXT3_STATE_NEW;
+        ei->i_state_flags = 0;
+        ext3_set_inode_state(inode, EXT3_STATE_NEW);
+
         ei->i_extra_isize =
                 (EXT3_INODE_SIZE(inode->i_sb) > EXT3_GOOD_OLD_INODE_SIZE) ?
                 sizeof(struct ext3_inode) - EXT3_GOOD_OLD_INODE_SIZE : 0;
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 7f920b7263a4..ea33bdf0a300 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -2811,7 +2811,7 @@ struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
         inode->i_mtime.tv_sec = (signed)le32_to_cpu(raw_inode->i_mtime);
         inode->i_atime.tv_nsec = inode->i_ctime.tv_nsec = inode->i_mtime.tv_nsec = 0;
 
-        ei->i_state = 0;
+        ei->i_state_flags = 0;
         ei->i_dir_start_lookup = 0;
         ei->i_dtime = le32_to_cpu(raw_inode->i_dtime);
         /* We now have enough fields to check if the inode was active or not.
diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
index 361c0b9962a8..57f6eef6ccd6 100644
--- a/fs/ext4/ialloc.c
+++ b/fs/ext4/ialloc.c
@@ -263,7 +263,7 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)
                                         ext4_group_t f;
 
                                         f = ext4_flex_group(sbi, block_group);
-                                        atomic_dec(&sbi->s_flex_groups[f].free_inodes);
+                                        atomic_dec(&sbi->s_flex_groups[f].used_dirs);
                                 }
 
                         }
@@ -773,7 +773,7 @@ static int ext4_claim_inode(struct super_block *sb,
                 if (sbi->s_log_groups_per_flex) {
                         ext4_group_t f = ext4_flex_group(sbi, group);
 
-                        atomic_inc(&sbi->s_flex_groups[f].free_inodes);
+                        atomic_inc(&sbi->s_flex_groups[f].used_dirs);
                 }
         }
         gdp->bg_checksum = ext4_group_desc_csum(sbi, group, gdp);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 986120f30066..11119e07233b 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1035,7 +1035,7 @@ static int ext4_indirect_calc_metadata_amount(struct inode *inode,
                                               sector_t lblock)
 {
         struct ext4_inode_info *ei = EXT4_I(inode);
-        int dind_mask = EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1;
+        sector_t dind_mask = ~((sector_t)EXT4_ADDR_PER_BLOCK(inode->i_sb) - 1);
         int blk_bits;
 
         if (lblock < EXT4_NDIR_BLOCKS)
@@ -1050,7 +1050,7 @@ static int ext4_indirect_calc_metadata_amount(struct inode *inode,
         }
         ei->i_da_metadata_calc_last_lblock = lblock & dind_mask;
         ei->i_da_metadata_calc_len = 1;
-        blk_bits = roundup_pow_of_two(lblock + 1);
+        blk_bits = order_base_2(lblock);
         return (blk_bits / EXT4_ADDR_PER_BLOCK_BITS(inode->i_sb)) + 1;
 }
 
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index ba191dae8730..e14d22c170d5 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -68,7 +68,21 @@ static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf);
 static int ext4_unfreeze(struct super_block *sb);
 static void ext4_write_super(struct super_block *sb);
 static int ext4_freeze(struct super_block *sb);
+static int ext4_get_sb(struct file_system_type *fs_type, int flags,
+                       const char *dev_name, void *data, struct vfsmount *mnt);
 
+#if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
+static struct file_system_type ext3_fs_type = {
+        .owner          = THIS_MODULE,
+        .name           = "ext3",
+        .get_sb         = ext4_get_sb,
+        .kill_sb        = kill_block_super,
+        .fs_flags       = FS_REQUIRES_DEV,
+};
+#define IS_EXT3_SB(sb) ((sb)->s_bdev->bd_holder == &ext3_fs_type)
+#else
+#define IS_EXT3_SB(sb) (0)
+#endif
 
 ext4_fsblk_t ext4_block_bitmap(struct super_block *sb,
                                struct ext4_group_desc *bg)
@@ -2539,7 +2553,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
          * enable delayed allocation by default
          * Use -o nodelalloc to turn it off
          */
-        set_opt(sbi->s_mount_opt, DELALLOC);
+        if (!IS_EXT3_SB(sb))
+                set_opt(sbi->s_mount_opt, DELALLOC);
 
         if (!parse_options((char *) data, sb, &journal_devnum,
                            &journal_ioprio, NULL, 0))
@@ -4068,7 +4083,7 @@ static int ext4_get_sb(struct file_system_type *fs_type, int flags,
         return get_sb_bdev(fs_type, flags, dev_name, data, ext4_fill_super,mnt);
 }
 
-#if !defined(CONTIG_EXT2_FS) && !defined(CONFIG_EXT2_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
+#if !defined(CONFIG_EXT2_FS) && !defined(CONFIG_EXT2_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
 static struct file_system_type ext2_fs_type = {
         .owner          = THIS_MODULE,
         .name           = "ext2",
@@ -4095,15 +4110,7 @@ static inline void register_as_ext2(void) { }
 static inline void unregister_as_ext2(void) { }
 #endif
 
-#if !defined(CONTIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
-static struct file_system_type ext3_fs_type = {
-        .owner          = THIS_MODULE,
-        .name           = "ext3",
-        .get_sb         = ext4_get_sb,
-        .kill_sb        = kill_block_super,
-        .fs_flags       = FS_REQUIRES_DEV,
-};
-
+#if !defined(CONFIG_EXT3_FS) && !defined(CONFIG_EXT3_FS_MODULE) && defined(CONFIG_EXT4_USE_FOR_EXT23)
 static inline void register_as_ext3(void)
 {
         int err = register_filesystem(&ext3_fs_type);
diff --git a/fs/fscache/object.c b/fs/fscache/object.c
index e513ac599c8e..0b589a9b4ffc 100644
--- a/fs/fscache/object.c
+++ b/fs/fscache/object.c
@@ -53,7 +53,7 @@ const char fscache_object_states_short[FSCACHE_OBJECT__NSTATES][5] = {
 static void fscache_object_slow_work_put_ref(struct slow_work *);
 static int  fscache_object_slow_work_get_ref(struct slow_work *);
 static void fscache_object_slow_work_execute(struct slow_work *);
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_object_slow_work_desc(struct slow_work *, struct seq_file *);
 #endif
 static void fscache_initialise_object(struct fscache_object *);
@@ -69,7 +69,7 @@ const struct slow_work_ops fscache_object_slow_work_ops = {
         .get_ref        = fscache_object_slow_work_get_ref,
         .put_ref        = fscache_object_slow_work_put_ref,
         .execute        = fscache_object_slow_work_execute,
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         .desc           = fscache_object_slow_work_desc,
 #endif
 };
@@ -364,7 +364,7 @@ static void fscache_object_slow_work_execute(struct slow_work *work)
 /*
  * describe an object for slow-work debugging
  */
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_object_slow_work_desc(struct slow_work *work,
                                           struct seq_file *m)
 {
diff --git a/fs/fscache/operation.c b/fs/fscache/operation.c
index 313e79a14266..9f6c928d4586 100644
--- a/fs/fscache/operation.c
+++ b/fs/fscache/operation.c
@@ -500,7 +500,7 @@ static void fscache_op_execute(struct slow_work *work)
 /*
  * describe an operation for slow-work debugging
  */
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
 static void fscache_op_desc(struct slow_work *work, struct seq_file *m)
 {
         struct fscache_operation *op =
@@ -517,7 +517,7 @@ const struct slow_work_ops fscache_op_slow_work_ops = {
         .get_ref        = fscache_op_get_ref,
         .put_ref        = fscache_op_put_ref,
         .execute        = fscache_op_execute,
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         .desc           = fscache_op_desc,
 #endif
 };
diff --git a/fs/fscache/page.c b/fs/fscache/page.c
index c598ea4c4e7d..69809024d71d 100644
--- a/fs/fscache/page.c
+++ b/fs/fscache/page.c
@@ -881,6 +881,7 @@ submit_failed:
         goto nobufs;
 
 nobufs_unlock_obj:
+        spin_unlock(&cookie->stores_lock);
         spin_unlock(&object->lock);
 nobufs:
         spin_unlock(&cookie->lock);
diff --git a/fs/logfs/dev_bdev.c b/fs/logfs/dev_bdev.c
index 9718c22f186d..a5d0c56d3ebc 100644
--- a/fs/logfs/dev_bdev.c
+++ b/fs/logfs/dev_bdev.c
@@ -80,6 +80,7 @@ static void writeseg_end_io(struct bio *bio, int err)
                         prefetchw(&bvec->bv_page->flags);
 
                 end_page_writeback(page);
+                page_cache_release(page);
         } while (bvec >= bio->bi_io_vec);
         bio_put(bio);
         if (atomic_dec_and_test(&super->s_pending_writes))
@@ -97,8 +98,10 @@ static int __bdev_writeseg(struct super_block *sb, u64 ofs, pgoff_t index,
         unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
         int i;
 
+        if (max_pages > BIO_MAX_PAGES)
+                max_pages = BIO_MAX_PAGES;
         bio = bio_alloc(GFP_NOFS, max_pages);
-        BUG_ON(!bio); /* FIXME: handle this */
+        BUG_ON(!bio);
 
         for (i = 0; i < nr_pages; i++) {
                 if (i >= max_pages) {
@@ -191,8 +194,10 @@ static int do_erase(struct super_block *sb, u64 ofs, pgoff_t index,
         unsigned int max_pages = queue_max_hw_sectors(q) >> (PAGE_SHIFT - 9);
         int i;
 
+        if (max_pages > BIO_MAX_PAGES)
+                max_pages = BIO_MAX_PAGES;
         bio = bio_alloc(GFP_NOFS, max_pages);
-        BUG_ON(!bio); /* FIXME: handle this */
+        BUG_ON(!bio);
 
         for (i = 0; i < nr_pages; i++) {
                 if (i >= max_pages) {
diff --git a/fs/logfs/dir.c b/fs/logfs/dir.c
index 56a8bfbb0120..c76b4b5c7ff6 100644
--- a/fs/logfs/dir.c
+++ b/fs/logfs/dir.c
@@ -303,12 +303,12 @@ static int __logfs_readdir(struct file *file, void *buf, filldir_t filldir)
                                 (filler_t *)logfs_readpage, NULL);
                 if (IS_ERR(page))
                         return PTR_ERR(page);
-                dd = kmap_atomic(page, KM_USER0);
+                dd = kmap(page);
                 BUG_ON(dd->namelen == 0);
 
                 full = filldir(buf, (char *)dd->name, be16_to_cpu(dd->namelen),
                                 pos, be64_to_cpu(dd->ino), dd->type);
-                kunmap_atomic(dd, KM_USER0);
+                kunmap(page);
                 page_cache_release(page);
                 if (full)
                         break;
diff --git a/fs/logfs/journal.c b/fs/logfs/journal.c
index 6ad30a4c9052..d57c7b07b60b 100644
--- a/fs/logfs/journal.c
+++ b/fs/logfs/journal.c
@@ -800,6 +800,7 @@ void do_logfs_journal_wl_pass(struct super_block *sb)
 {
         struct logfs_super *super = logfs_super(sb);
         struct logfs_area *area = super->s_journal_area;
+        struct btree_head32 *head = &super->s_reserved_segments;
         u32 segno, ec;
         int i, err;
 
@@ -807,6 +808,7 @@ void do_logfs_journal_wl_pass(struct super_block *sb)
         /* Drop old segments */
         journal_for_each(i)
                 if (super->s_journal_seg[i]) {
+                        btree_remove32(head, super->s_journal_seg[i]);
                         logfs_set_segment_unreserved(sb,
                                         super->s_journal_seg[i],
                                         super->s_journal_ec[i]);
@@ -819,8 +821,13 @@ void do_logfs_journal_wl_pass(struct super_block *sb)
                 super->s_journal_seg[i] = segno;
                 super->s_journal_ec[i] = ec;
                 logfs_set_segment_reserved(sb, segno);
+                err = btree_insert32(head, segno, (void *)1, GFP_KERNEL);
+                BUG_ON(err); /* mempool should prevent this */
+                err = logfs_erase_segment(sb, segno, 1);
+                BUG_ON(err); /* FIXME: remount-ro would be nicer */
         }
         /* Manually move journal_area */
+        freeseg(sb, area->a_segno);
         area->a_segno = super->s_journal_seg[0];
         area->a_is_open = 0;
         area->a_used_bytes = 0;
diff --git a/fs/logfs/logfs.h b/fs/logfs/logfs.h
index 129779431373..b84b0eec6024 100644
--- a/fs/logfs/logfs.h
+++ b/fs/logfs/logfs.h
@@ -587,6 +587,7 @@ void move_page_to_btree(struct page *page);
 int logfs_init_mapping(struct super_block *sb);
 void logfs_sync_area(struct logfs_area *area);
 void logfs_sync_segments(struct super_block *sb);
+void freeseg(struct super_block *sb, u32 segno);
 
 /* area handling */
 int logfs_init_areas(struct super_block *sb);
diff --git a/fs/logfs/readwrite.c b/fs/logfs/readwrite.c
index 7a23b3e7c0a7..c3a3a6814b84 100644
--- a/fs/logfs/readwrite.c
+++ b/fs/logfs/readwrite.c
@@ -1594,7 +1594,6 @@ int logfs_delete(struct inode *inode, pgoff_t index,
         return ret;
 }
 
-/* Rewrite cannot mark the inode dirty but has to write it immediatly. */
 int logfs_rewrite_block(struct inode *inode, u64 bix, u64 ofs,
                 gc_level_t gc_level, long flags)
 {
@@ -1611,6 +1610,18 @@ int logfs_rewrite_block(struct inode *inode, u64 bix, u64 ofs,
                 if (level != 0)
                         alloc_indirect_block(inode, page, 0);
                 err = logfs_write_buf(inode, page, flags);
+                if (!err && shrink_level(gc_level) == 0) {
+                        /* Rewrite cannot mark the inode dirty but has to
+                         * write it immediatly.
+                         * Q: Can't we just create an alias for the inode
+                         * instead?  And if not, why not?
+                         */
+                        if (inode->i_ino == LOGFS_INO_MASTER)
+                                logfs_write_anchor(inode->i_sb);
+                        else {
+                                err = __logfs_write_inode(inode, flags);
+                        }
+                }
         }
         logfs_put_write_page(page);
         return err;
diff --git a/fs/logfs/segment.c b/fs/logfs/segment.c
index 1a14f9910d55..0ecd8f07c11e 100644
--- a/fs/logfs/segment.c
+++ b/fs/logfs/segment.c
@@ -93,50 +93,58 @@ void __logfs_buf_write(struct logfs_area *area, u64 ofs, void *buf, size_t len,
         } while (len);
 }
 
-/*
- * bdev_writeseg will write full pages.  Memset the tail to prevent data leaks.
- */
-static void pad_wbuf(struct logfs_area *area, int final)
+static void pad_partial_page(struct logfs_area *area)
 {
         struct super_block *sb = area->a_sb;
-        struct logfs_super *super = logfs_super(sb);
         struct page *page;
         u64 ofs = dev_ofs(sb, area->a_segno, area->a_used_bytes);
         pgoff_t index = ofs >> PAGE_SHIFT;
         long offset = ofs & (PAGE_SIZE-1);
         u32 len = PAGE_SIZE - offset;
 
-        if (len == PAGE_SIZE) {
-                /* The math in this function can surely use some love */
-                len = 0;
-        }
-        if (len) {
-                BUG_ON(area->a_used_bytes >= super->s_segsize);
-
-                page = get_mapping_page(area->a_sb, index, 0);
+        if (len % PAGE_SIZE) {
+                page = get_mapping_page(sb, index, 0);
                 BUG_ON(!page); /* FIXME: reserve a pool */
                 memset(page_address(page) + offset, 0xff, len);
                 SetPagePrivate(page);
                 page_cache_release(page);
         }
+}
 
-        if (!final)
-                return;
+static void pad_full_pages(struct logfs_area *area)
+{
+        struct super_block *sb = area->a_sb;
+        struct logfs_super *super = logfs_super(sb);
+        u64 ofs = dev_ofs(sb, area->a_segno, area->a_used_bytes);
+        u32 len = super->s_segsize - area->a_used_bytes;
+        pgoff_t index = PAGE_CACHE_ALIGN(ofs) >> PAGE_CACHE_SHIFT;
+        pgoff_t no_indizes = len >> PAGE_CACHE_SHIFT;
+        struct page *page;
 
-        area->a_used_bytes += len;
-        for ( ; area->a_used_bytes < super->s_segsize;
-                        area->a_used_bytes += PAGE_SIZE) {
-                /* Memset another page */
-                index++;
-                page = get_mapping_page(area->a_sb, index, 0);
+        while (no_indizes) {
+                page = get_mapping_page(sb, index, 0);
                 BUG_ON(!page); /* FIXME: reserve a pool */
-                memset(page_address(page), 0xff, PAGE_SIZE);
+                SetPageUptodate(page);
+                memset(page_address(page), 0xff, PAGE_CACHE_SIZE);
                 SetPagePrivate(page);
                 page_cache_release(page);
+                index++;
+                no_indizes--;
         }
 }
 
 /*
+ * bdev_writeseg will write full pages.  Memset the tail to prevent data leaks.
+ * Also make sure we allocate (and memset) all pages for final writeout.
+ */
+static void pad_wbuf(struct logfs_area *area, int final)
+{
+        pad_partial_page(area);
+        if (final)
+                pad_full_pages(area);
+}
+
+/*
  * We have to be careful with the alias tree.  Since lookup is done by bix,
  * it needs to be normalized, so 14, 15, 16, etc. all match when dealing with
  * indirect blocks.  So always use it through accessor functions.
@@ -683,7 +691,7 @@ int logfs_segment_delete(struct inode *inode, struct logfs_shadow *shadow)
         return 0;
 }
 
-static void freeseg(struct super_block *sb, u32 segno)
+void freeseg(struct super_block *sb, u32 segno)
 {
         struct logfs_super *super = logfs_super(sb);
         struct address_space *mapping = super->s_mapping_inode->i_mapping;
diff --git a/fs/logfs/super.c b/fs/logfs/super.c
index c66beab78dee..9d856c49afc5 100644
--- a/fs/logfs/super.c
+++ b/fs/logfs/super.c
@@ -277,7 +277,7 @@ static int logfs_recover_sb(struct super_block *sb)
         }
         if (valid0 && valid1 && ds_cmp(ds0, ds1)) {
                 printk(KERN_INFO"Superblocks don't match - fixing.\n");
-                return write_one_sb(sb, super->s_devops->find_last_sb);
+                return logfs_write_sb(sb);
         }
         /* If neither is valid now, something's wrong.  Didn't we properly
          * check them before?!? */
@@ -289,6 +289,10 @@ static int logfs_make_writeable(struct super_block *sb)
 {
         int err;
 
+        err = logfs_open_segfile(sb);
+        if (err)
+                return err;
+
         /* Repair any broken superblock copies */
         err = logfs_recover_sb(sb);
         if (err)
@@ -299,10 +303,6 @@ static int logfs_make_writeable(struct super_block *sb)
         if (err)
                 return err;
 
-        err = logfs_open_segfile(sb);
-        if (err)
-                return err;
-
         /* Do one GC pass before any data gets dirtied */
         logfs_gc_pass(sb);
 
@@ -328,7 +328,7 @@ static int logfs_get_sb_final(struct super_block *sb, struct vfsmount *mnt)
 
         sb->s_root = d_alloc_root(rootdir);
         if (!sb->s_root)
-                goto fail;
+                goto fail2;
 
         super->s_erase_page = alloc_pages(GFP_KERNEL, 0);
         if (!super->s_erase_page)
@@ -572,8 +572,7 @@ int logfs_get_sb_device(struct file_system_type *type, int flags,
         return 0;
 
 err1:
-        up_write(&sb->s_umount);
-        deactivate_super(sb);
+        deactivate_locked_super(sb);
         return err;
 err0:
         kfree(super);
diff --git a/fs/namei.c b/fs/namei.c
index 1c0fca6e899e..a7dce91a7e42 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1610,8 +1610,7 @@ exit:
 
 static struct file *do_last(struct nameidata *nd, struct path *path,
                             int open_flag, int acc_mode,
-                            int mode, const char *pathname,
-                            int *want_dir)
+                            int mode, const char *pathname)
 {
         struct dentry *dir = nd->path.dentry;
         struct file *filp;
@@ -1642,7 +1641,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
         if (nd->last.name[nd->last.len]) {
                 if (open_flag & O_CREAT)
                         goto exit;
-                *want_dir = 1;
+                nd->flags |= LOOKUP_DIRECTORY;
         }
 
         /* just plain open? */
@@ -1656,8 +1655,10 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
                 if (path->dentry->d_inode->i_op->follow_link)
                         return NULL;
                 error = -ENOTDIR;
-                if (*want_dir && !path->dentry->d_inode->i_op->lookup)
-                        goto exit_dput;
+                if (nd->flags & LOOKUP_DIRECTORY) {
+                        if (!path->dentry->d_inode->i_op->lookup)
+                                goto exit_dput;
+                }
                 path_to_nameidata(path, nd);
                 audit_inode(pathname, nd->path.dentry);
                 goto ok;
@@ -1766,7 +1767,6 @@ struct file *do_filp_open(int dfd, const char *pathname,
         int count = 0;
         int flag = open_to_namei_flags(open_flag);
         int force_reval = 0;
-        int want_dir = open_flag & O_DIRECTORY;
 
         if (!(open_flag & O_CREAT))
                 mode = 0;
@@ -1828,7 +1828,9 @@ reval:
                 if (open_flag & O_EXCL)
                         nd.flags |= LOOKUP_EXCL;
         }
-        filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname, &want_dir);
+        if (open_flag & O_DIRECTORY)
+                nd.flags |= LOOKUP_DIRECTORY;
+        filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
         while (unlikely(!filp)) { /* trailing symlink */
                 struct path holder;
                 struct inode *inode = path.dentry->d_inode;
@@ -1866,7 +1868,7 @@ reval:
                 }
                 holder = path;
                 nd.flags &= ~LOOKUP_PARENT;
-                filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname, &want_dir);
+                filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
                 if (inode->i_op->put_link)
                         inode->i_op->put_link(holder.dentry, &nd, cookie);
                 path_put(&holder);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index ae8d02294e46..ae0d92736531 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -491,7 +491,8 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
 {
         dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
 
-        if (gfp & __GFP_WAIT)
+        /* Only do I/O if gfp is a superset of GFP_KERNEL */
+        if ((gfp & GFP_KERNEL) == GFP_KERNEL)
                 nfs_wb_page(page->mapping->host, page);
         /* If PagePrivate() is set, then the page is not freeable */
         if (PagePrivate(page))
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 4d338be492cb..dd17713413a5 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -5552,6 +5552,8 @@ static int nfs4_xdr_dec_delegreturn(struct rpc_rqst *rqstp, __be32 *p, struct nf
         if (status != 0)
                 goto out;
         status = decode_delegreturn(&xdr);
+        if (status != 0)
+                goto out;
         decode_getfattr(&xdr, res->fattr, res->server,
                         !RPC_IS_ASYNC(rqstp->rq_task));
 out:
diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
index 636eaafd6ea2..6129a431aa34 100644
--- a/fs/nilfs2/segbuf.c
+++ b/fs/nilfs2/segbuf.c
@@ -323,14 +323,14 @@ int nilfs_write_logs(struct list_head *logs, struct the_nilfs *nilfs)
 int nilfs_wait_on_logs(struct list_head *logs)
 {
         struct nilfs_segment_buffer *segbuf;
-        int err;
+        int err, ret = 0;
 
         list_for_each_entry(segbuf, logs, sb_list) {
                 err = nilfs_segbuf_wait(segbuf);
-                if (err)
-                        return err;
+                if (err && !ret)
+                        ret = err;
         }
-        return 0;
+        return ret;
 }
 
 /*
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 69576a95e13f..c161d89061b5 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1510,6 +1510,12 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
                 if (mode != SC_LSEG_SR || sci->sc_stage.scnt < NILFS_ST_CPFILE)
                         break;
 
+                nilfs_clear_logs(&sci->sc_segbufs);
+
+                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+                if (unlikely(err))
+                        return err;
+
                 if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
                         err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
                                                         sci->sc_freesegs,
@@ -1517,12 +1523,6 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
                                                         NULL);
                         WARN_ON(err); /* do not happen */
                 }
-                nilfs_clear_logs(&sci->sc_segbufs);
-
-                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
-                if (unlikely(err))
-                        return err;
-
                 nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
                 sci->sc_stage = prev_stage;
         }
@@ -1897,8 +1897,7 @@ static void nilfs_segctor_abort_construction(struct nilfs_sc_info *sci,
 
         list_splice_tail_init(&sci->sc_write_logs, &logs);
         ret = nilfs_wait_on_logs(&logs);
-        if (ret)
-                nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret);
+        nilfs_abort_logs(&logs, NULL, sci->sc_super_root, ret ? : err);
 
         list_splice_tail_init(&sci->sc_segbufs, &logs);
         nilfs_cancel_segusage(&logs, nilfs->ns_sufile);
diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
index 0501974bedd0..8ccf0f8c9cc8 100644
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -30,6 +30,8 @@
 #include "alloc.h"
 #include "dlmglue.h"
 #include "file.h"
+#include "inode.h"
+#include "journal.h"
 #include "ocfs2_fs.h"
 
 #include "xattr.h"
@@ -166,6 +168,60 @@ static struct posix_acl *ocfs2_get_acl(struct inode *inode, int type)
 }
 
 /*
+ * Helper function to set i_mode in memory and disk. Some call paths
+ * will not have di_bh or a journal handle to pass, in which case it
+ * will create it's own.
+ */
+static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh,
+                              handle_t *handle, umode_t new_mode)
+{
+        int ret, commit_handle = 0;
+        struct ocfs2_dinode *di;
+
+        if (di_bh == NULL) {
+                ret = ocfs2_read_inode_block(inode, &di_bh);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out;
+                }
+        } else
+                get_bh(di_bh);
+
+        if (handle == NULL) {
+                handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb),
+                                           OCFS2_INODE_UPDATE_CREDITS);
+                if (IS_ERR(handle)) {
+                        ret = PTR_ERR(handle);
+                        mlog_errno(ret);
+                        goto out_brelse;
+                }
+
+                commit_handle = 1;
+        }
+
+        di = (struct ocfs2_dinode *)di_bh->b_data;
+        ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh,
+                                      OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
+        inode->i_mode = new_mode;
+        di->i_mode = cpu_to_le16(inode->i_mode);
+
+        ocfs2_journal_dirty(handle, di_bh);
+
+out_commit:
+        if (commit_handle)
+                ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle);
+out_brelse:
+        brelse(di_bh);
+out:
+        return ret;
+}
+
+/*
  * Set the access or default ACL of an inode.
  */
 static int ocfs2_set_acl(handle_t *handle,
@@ -193,9 +249,14 @@ static int ocfs2_set_acl(handle_t *handle,
                         if (ret < 0)
                                 return ret;
                         else {
-                                inode->i_mode = mode;
                                 if (ret == 0)
                                         acl = NULL;
+
+                                ret = ocfs2_acl_set_mode(inode, di_bh,
+                                                         handle, mode);
+                                if (ret)
+                                        return ret;
+
                         }
                 }
                 break;
@@ -283,6 +344,7 @@ int ocfs2_init_acl(handle_t *handle,
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
         struct posix_acl *acl = NULL;
         int ret = 0;
+        mode_t mode;
 
         if (!S_ISLNK(inode->i_mode)) {
                 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) {
@@ -291,12 +353,17 @@ int ocfs2_init_acl(handle_t *handle,
                         if (IS_ERR(acl))
                                 return PTR_ERR(acl);
                 }
-                if (!acl)
-                        inode->i_mode &= ~current_umask();
+                if (!acl) {
+                        mode = inode->i_mode & ~current_umask();
+                        ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
+                        if (ret) {
+                                mlog_errno(ret);
+                                goto cleanup;
+                        }
+                }
         }
         if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) {
                 struct posix_acl *clone;
-                mode_t mode;
 
                 if (S_ISDIR(inode->i_mode)) {
                         ret = ocfs2_set_acl(handle, inode, di_bh,
@@ -313,7 +380,7 @@ int ocfs2_init_acl(handle_t *handle,
                 mode = inode->i_mode;
                 ret = posix_acl_create_masq(clone, &mode);
                 if (ret >= 0) {
-                        inode->i_mode = mode;
+                        ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode);
                         if (ret > 0) {
                                 ret = ocfs2_set_acl(handle, inode,
                                                     di_bh, ACL_TYPE_ACCESS,
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index a659606dcb95..9289b4357d27 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -1875,7 +1875,6 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
 ok:
                 spin_unlock(&res->spinlock);
         }
-        spin_unlock(&dlm->spinlock);
 
         // mlog(0, "woo!  got an assert_master from node %u!\n",
         //           assert->node_idx);
@@ -1926,7 +1925,6 @@ ok:
                 /* master is known, detach if not already detached.
                  * ensures that only one assert_master call will happen
                  * on this mle. */
-                spin_lock(&dlm->spinlock);
                 spin_lock(&dlm->master_lock);
 
                 rr = atomic_read(&mle->mle_refs.refcount);
@@ -1959,7 +1957,6 @@ ok:
                         __dlm_put_mle(mle);
                 }
                 spin_unlock(&dlm->master_lock);
-                spin_unlock(&dlm->spinlock);
         } else if (res) {
                 if (res->owner != assert->node_idx) {
                         mlog(0, "assert_master from %u, but current "
@@ -1967,6 +1964,7 @@ ok:
                              res->owner, namelen, name);
                 }
         }
+        spin_unlock(&dlm->spinlock);
 
 done:
         ret = 0;
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 278a223aae14..ab207901d32a 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -891,6 +891,21 @@ static int ocfs2_query_inode_wipe(struct inode *inode,
         /* Do some basic inode verification... */
         di = (struct ocfs2_dinode *) di_bh->b_data;
         if (!(di->i_flags & cpu_to_le32(OCFS2_ORPHANED_FL))) {
+                /*
+                 * Inodes in the orphan dir must have ORPHANED_FL.  The only
+                 * inodes that come back out of the orphan dir are reflink
+                 * targets. A reflink target may be moved out of the orphan
+                 * dir between the time we scan the directory and the time we
+                 * process it. This would lead to HAS_REFCOUNT_FL being set but
+                 * ORPHANED_FL not.
+                 */
+                if (di->i_dyn_features & cpu_to_le16(OCFS2_HAS_REFCOUNT_FL)) {
+                        mlog(0, "Reflinked inode %llu is no longer orphaned.  "
+                             "it shouldn't be deleted\n",
+                             (unsigned long long)oi->ip_blkno);
+                        goto bail;
+                }
+
                 /* for lack of a better error? */
                 status = -EEXIST;
                 mlog(ML_ERROR,
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index ca992d91f511..c983715d8d8c 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -872,8 +872,10 @@ static int ocfs2_sync_local_to_main(struct ocfs2_super *osb,
                              (unsigned long long)la_start_blk,
                              (unsigned long long)blkno);
 
-                        status = ocfs2_free_clusters(handle, main_bm_inode,
-                                                     main_bm_bh, blkno, count);
+                        status = ocfs2_release_clusters(handle,
+                                                        main_bm_inode,
+                                                        main_bm_bh, blkno,
+                                                        count);
                         if (status < 0) {
                                 mlog_errno(status);
                                 goto bail;
@@ -984,8 +986,7 @@ static int ocfs2_local_alloc_reserve_for_window(struct ocfs2_super *osb,
         }
 
 retry_enospc:
-        (*ac)->ac_bits_wanted = osb->local_alloc_bits;
-
+        (*ac)->ac_bits_wanted = osb->local_alloc_default_bits;
         status = ocfs2_reserve_cluster_bitmap_bits(osb, *ac);
         if (status == -ENOSPC) {
                 if (ocfs2_recalc_la_window(osb, OCFS2_LA_EVENT_ENOSPC) ==
@@ -1061,6 +1062,7 @@ retry_enospc:
                     OCFS2_LA_DISABLED)
                         goto bail;
 
+                ac->ac_bits_wanted = osb->local_alloc_default_bits;
                 status = ocfs2_claim_clusters(osb, handle, ac,
                                               osb->local_alloc_bits,
                                               &cluster_off,
diff --git a/fs/ocfs2/locks.c b/fs/ocfs2/locks.c
index 544ac6245175..b5cb3ede9408 100644
--- a/fs/ocfs2/locks.c
+++ b/fs/ocfs2/locks.c
@@ -133,7 +133,7 @@ int ocfs2_lock(struct file *file, int cmd, struct file_lock *fl)
 
         if (!(fl->fl_flags & FL_POSIX))
                 return -ENOLCK;
-        if (__mandatory_lock(inode))
+        if (__mandatory_lock(inode) && fl->fl_type != F_UNLCK)
                 return -ENOLCK;
 
         return ocfs2_plock(osb->cconn, OCFS2_I(inode)->ip_blkno, file, cmd, fl);
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index d9cd4e373a53..b1eb50ae4097 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -84,7 +84,7 @@ static int ocfs2_prepare_orphan_dir(struct ocfs2_super *osb,
 static int ocfs2_orphan_add(struct ocfs2_super *osb,
                             handle_t *handle,
                             struct inode *inode,
-                            struct ocfs2_dinode *fe,
+                            struct buffer_head *fe_bh,
                             char *name,
                             struct ocfs2_dir_lookup_result *lookup,
                             struct inode *orphan_dir_inode);
@@ -879,7 +879,7 @@ static int ocfs2_unlink(struct inode *dir,
         fe = (struct ocfs2_dinode *) fe_bh->b_data;
 
         if (inode_is_unlinkable(inode)) {
-                status = ocfs2_orphan_add(osb, handle, inode, fe, orphan_name,
+                status = ocfs2_orphan_add(osb, handle, inode, fe_bh, orphan_name,
                                           &orphan_insert, orphan_dir);
                 if (status < 0) {
                         mlog_errno(status);
@@ -1300,7 +1300,7 @@ static int ocfs2_rename(struct inode *old_dir,
                 if (S_ISDIR(new_inode->i_mode) ||
                     (ocfs2_read_links_count(newfe) == 1)) {
                         status = ocfs2_orphan_add(osb, handle, new_inode,
-                                                  newfe, orphan_name,
+                                                  newfe_bh, orphan_name,
                                                   &orphan_insert, orphan_dir);
                         if (status < 0) {
                                 mlog_errno(status);
@@ -1911,7 +1911,7 @@ leave:
 static int ocfs2_orphan_add(struct ocfs2_super *osb,
                             handle_t *handle,
                             struct inode *inode,
-                            struct ocfs2_dinode *fe,
+                            struct buffer_head *fe_bh,
                             char *name,
                             struct ocfs2_dir_lookup_result *lookup,
                             struct inode *orphan_dir_inode)
@@ -1919,6 +1919,7 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
         struct buffer_head *orphan_dir_bh = NULL;
         int status = 0;
         struct ocfs2_dinode *orphan_fe;
+        struct ocfs2_dinode *fe = (struct ocfs2_dinode *) fe_bh->b_data;
 
         mlog_entry("(inode->i_ino = %lu)\n", inode->i_ino);
 
@@ -1959,6 +1960,21 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
                 goto leave;
         }
 
+        /*
+         * We're going to journal the change of i_flags and i_orphaned_slot.
+         * It's safe anyway, though some callers may duplicate the journaling.
+         * Journaling within the func just make the logic look more
+         * straightforward.
+         */
+        status = ocfs2_journal_access_di(handle,
+                                         INODE_CACHE(inode),
+                                         fe_bh,
+                                         OCFS2_JOURNAL_ACCESS_WRITE);
+        if (status < 0) {
+                mlog_errno(status);
+                goto leave;
+        }
+
         le32_add_cpu(&fe->i_flags, OCFS2_ORPHANED_FL);
 
         /* Record which orphan dir our inode now resides
@@ -1966,6 +1982,8 @@ static int ocfs2_orphan_add(struct ocfs2_super *osb,
          * dir to lock. */
         fe->i_orphaned_slot = cpu_to_le16(osb->slot_num);
 
+        ocfs2_journal_dirty(handle, fe_bh);
+
         mlog(0, "Inode %llu orphaned in slot %d\n",
              (unsigned long long)OCFS2_I(inode)->ip_blkno, osb->slot_num);
 
@@ -2123,7 +2141,7 @@ int ocfs2_create_inode_in_orphan(struct inode *dir,
         }
 
         di = (struct ocfs2_dinode *)new_di_bh->b_data;
-        status = ocfs2_orphan_add(osb, handle, inode, di, orphan_name,
+        status = ocfs2_orphan_add(osb, handle, inode, new_di_bh, orphan_name,
                                   &orphan_insert, orphan_dir);
         if (status < 0) {
                 mlog_errno(status);
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 1238b491db90..adf5e2ebc2c4 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -763,8 +763,18 @@ static inline unsigned int ocfs2_megabytes_to_clusters(struct super_block *sb,
         return megs << (20 - OCFS2_SB(sb)->s_clustersize_bits);
 }
 
-#define ocfs2_set_bit ext2_set_bit
-#define ocfs2_clear_bit ext2_clear_bit
+static inline void _ocfs2_set_bit(unsigned int bit, unsigned long *bitmap)
+{
+        ext2_set_bit(bit, bitmap);
+}
+#define ocfs2_set_bit(bit, addr) _ocfs2_set_bit((bit), (unsigned long *)(addr))
+
+static inline void _ocfs2_clear_bit(unsigned int bit, unsigned long *bitmap)
+{
+        ext2_clear_bit(bit, bitmap);
+}
+#define ocfs2_clear_bit(bit, addr) _ocfs2_clear_bit((bit), (unsigned long *)(addr))
+
 #define ocfs2_test_bit ext2_test_bit
 #define ocfs2_find_next_zero_bit ext2_find_next_zero_bit
 #define ocfs2_find_next_bit ext2_find_next_bit
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 9e96921dffda..29405f2ff616 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4075,6 +4075,7 @@ static int ocfs2_complete_reflink(struct inode *s_inode,
         OCFS2_I(t_inode)->ip_dyn_features = OCFS2_I(s_inode)->ip_dyn_features;
         spin_unlock(&OCFS2_I(t_inode)->ip_lock);
         i_size_write(t_inode, size);
+        t_inode->i_blocks = s_inode->i_blocks;
 
         di->i_xattr_inline_size = s_di->i_xattr_inline_size;
         di->i_clusters = s_di->i_clusters;
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index c3c60bc3e072..19ba00f28547 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -95,13 +95,6 @@ static inline int ocfs2_block_group_set_bits(handle_t *handle,
                                              struct buffer_head *group_bh,
                                              unsigned int bit_off,
                                              unsigned int num_bits);
-static inline int ocfs2_block_group_clear_bits(handle_t *handle,
-                                               struct inode *alloc_inode,
-                                               struct ocfs2_group_desc *bg,
-                                               struct buffer_head *group_bh,
-                                               unsigned int bit_off,
-                                               unsigned int num_bits);
-
 static int ocfs2_relink_block_group(handle_t *handle,
                                     struct inode *alloc_inode,
                                     struct buffer_head *fe_bh,
@@ -152,7 +145,7 @@ static u32 ocfs2_bits_per_group(struct ocfs2_chain_list *cl)
 
 #define do_error(fmt, ...)                                              \
         do{                                                             \
-                if (clean_error)                                        \
+                if (resize)                                     \
                         mlog(ML_ERROR, fmt "\n", ##__VA_ARGS__);        \
                 else                                                    \
                         ocfs2_error(sb, fmt, ##__VA_ARGS__);            \
@@ -160,7 +153,7 @@ static u32 ocfs2_bits_per_group(struct ocfs2_chain_list *cl)
 
 static int ocfs2_validate_gd_self(struct super_block *sb,
                                   struct buffer_head *bh,
-                                  int clean_error)
+                                  int resize)
 {
         struct ocfs2_group_desc *gd = (struct ocfs2_group_desc *)bh->b_data;
 
@@ -211,7 +204,7 @@ static int ocfs2_validate_gd_self(struct super_block *sb,
 static int ocfs2_validate_gd_parent(struct super_block *sb,
                                     struct ocfs2_dinode *di,
                                     struct buffer_head *bh,
-                                    int clean_error)
+                                    int resize)
 {
         unsigned int max_bits;
         struct ocfs2_group_desc *gd = (struct ocfs2_group_desc *)bh->b_data;
@@ -233,8 +226,11 @@ static int ocfs2_validate_gd_parent(struct super_block *sb,
                 return -EINVAL;
         }
 
-        if (le16_to_cpu(gd->bg_chain) >=
-            le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) {
+        /* In resize, we may meet the case bg_chain == cl_next_free_rec. */
+        if ((le16_to_cpu(gd->bg_chain) >
+             le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) ||
+            ((le16_to_cpu(gd->bg_chain) ==
+             le16_to_cpu(di->id2.i_chain.cl_next_free_rec)) && !resize)) {
                 do_error("Group descriptor #%llu has bad chain %u",
                          (unsigned long long)bh->b_blocknr,
                          le16_to_cpu(gd->bg_chain));
@@ -1975,18 +1971,18 @@ int ocfs2_claim_clusters(struct ocfs2_super *osb,
                                       bits_wanted, cluster_start, num_clusters);
 }
 
-static inline int ocfs2_block_group_clear_bits(handle_t *handle,
-                                               struct inode *alloc_inode,
-                                               struct ocfs2_group_desc *bg,
-                                               struct buffer_head *group_bh,
-                                               unsigned int bit_off,
-                                               unsigned int num_bits)
+static int ocfs2_block_group_clear_bits(handle_t *handle,
+                                        struct inode *alloc_inode,
+                                        struct ocfs2_group_desc *bg,
+                                        struct buffer_head *group_bh,
+                                        unsigned int bit_off,
+                                        unsigned int num_bits,
+                                        void (*undo_fn)(unsigned int bit,
+                                                        unsigned long *bmap))
 {
         int status;
         unsigned int tmp;
-        int journal_type = OCFS2_JOURNAL_ACCESS_WRITE;
         struct ocfs2_group_desc *undo_bg = NULL;
-        int cluster_bitmap = 0;
 
         mlog_entry_void();
 
@@ -1996,20 +1992,18 @@ static inline int ocfs2_block_group_clear_bits(handle_t *handle,
 
         mlog(0, "off = %u, num = %u\n", bit_off, num_bits);
 
-        if (ocfs2_is_cluster_bitmap(alloc_inode))
-                journal_type = OCFS2_JOURNAL_ACCESS_UNDO;
-
+        BUG_ON(undo_fn && !ocfs2_is_cluster_bitmap(alloc_inode));
         status = ocfs2_journal_access_gd(handle, INODE_CACHE(alloc_inode),
-                                         group_bh, journal_type);
+                                         group_bh,
+                                         undo_fn ?
+                                         OCFS2_JOURNAL_ACCESS_UNDO :
+                                         OCFS2_JOURNAL_ACCESS_WRITE);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
         }
 
-        if (ocfs2_is_cluster_bitmap(alloc_inode))
-                cluster_bitmap = 1;
-
-        if (cluster_bitmap) {
+        if (undo_fn) {
                 jbd_lock_bh_state(group_bh);
                 undo_bg = (struct ocfs2_group_desc *)
                                         bh2jh(group_bh)->b_committed_data;
@@ -2020,13 +2014,13 @@ static inline int ocfs2_block_group_clear_bits(handle_t *handle,
         while(tmp--) {
                 ocfs2_clear_bit((bit_off + tmp),
                                 (unsigned long *) bg->bg_bitmap);
-                if (cluster_bitmap)
-                        ocfs2_set_bit(bit_off + tmp,
-                                      (unsigned long *) undo_bg->bg_bitmap);
+                if (undo_fn)
+                        undo_fn(bit_off + tmp,
+                                (unsigned long *) undo_bg->bg_bitmap);
         }
         le16_add_cpu(&bg->bg_free_bits_count, num_bits);
 
-        if (cluster_bitmap)
+        if (undo_fn)
                 jbd_unlock_bh_state(group_bh);
 
         status = ocfs2_journal_dirty(handle, group_bh);
@@ -2039,12 +2033,14 @@ bail:
 /*
  * expects the suballoc inode to already be locked.
  */
-int ocfs2_free_suballoc_bits(handle_t *handle,
-                             struct inode *alloc_inode,
-                             struct buffer_head *alloc_bh,
-                             unsigned int start_bit,
-                             u64 bg_blkno,
-                             unsigned int count)
+static int _ocfs2_free_suballoc_bits(handle_t *handle,
+                                     struct inode *alloc_inode,
+                                     struct buffer_head *alloc_bh,
+                                     unsigned int start_bit,
+                                     u64 bg_blkno,
+                                     unsigned int count,
+                                     void (*undo_fn)(unsigned int bit,
+                                                     unsigned long *bitmap))
 {
         int status = 0;
         u32 tmp_used;
@@ -2079,7 +2075,7 @@ int ocfs2_free_suballoc_bits(handle_t *handle,
 
         status = ocfs2_block_group_clear_bits(handle, alloc_inode,
                                               group, group_bh,
-                                              start_bit, count);
+                                              start_bit, count, undo_fn);
         if (status < 0) {
                 mlog_errno(status);
                 goto bail;
@@ -2110,6 +2106,17 @@ bail:
         return status;
 }
 
+int ocfs2_free_suballoc_bits(handle_t *handle,
+                             struct inode *alloc_inode,
+                             struct buffer_head *alloc_bh,
+                             unsigned int start_bit,
+                             u64 bg_blkno,
+                             unsigned int count)
+{
+        return _ocfs2_free_suballoc_bits(handle, alloc_inode, alloc_bh,
+                                         start_bit, bg_blkno, count, NULL);
+}
+
 int ocfs2_free_dinode(handle_t *handle,
                       struct inode *inode_alloc_inode,
                       struct buffer_head *inode_alloc_bh,
@@ -2123,11 +2130,13 @@ int ocfs2_free_dinode(handle_t *handle,
                                         inode_alloc_bh, bit, bg_blkno, 1);
 }
 
-int ocfs2_free_clusters(handle_t *handle,
-                       struct inode *bitmap_inode,
-                       struct buffer_head *bitmap_bh,
-                       u64 start_blk,
-                       unsigned int num_clusters)
+static int _ocfs2_free_clusters(handle_t *handle,
+                                struct inode *bitmap_inode,
+                                struct buffer_head *bitmap_bh,
+                                u64 start_blk,
+                                unsigned int num_clusters,
+                                void (*undo_fn)(unsigned int bit,
+                                                unsigned long *bitmap))
 {
         int status;
         u16 bg_start_bit;
@@ -2154,9 +2163,9 @@ int ocfs2_free_clusters(handle_t *handle,
         mlog(0, "bg_blkno = %llu, bg_start_bit = %u\n",
              (unsigned long long)bg_blkno, bg_start_bit);
 
-        status = ocfs2_free_suballoc_bits(handle, bitmap_inode, bitmap_bh,
-                                          bg_start_bit, bg_blkno,
-                                          num_clusters);
+        status = _ocfs2_free_suballoc_bits(handle, bitmap_inode, bitmap_bh,
+                                           bg_start_bit, bg_blkno,
+                                           num_clusters, undo_fn);
         if (status < 0) {
                 mlog_errno(status);
                 goto out;
@@ -2170,6 +2179,32 @@ out:
         return status;
 }
 
+int ocfs2_free_clusters(handle_t *handle,
+                        struct inode *bitmap_inode,
+                        struct buffer_head *bitmap_bh,
+                        u64 start_blk,
+                        unsigned int num_clusters)
+{
+        return _ocfs2_free_clusters(handle, bitmap_inode, bitmap_bh,
+                                    start_blk, num_clusters,
+                                    _ocfs2_set_bit);
+}
+
+/*
+ * Give never-used clusters back to the global bitmap.  We don't need
+ * to protect these bits in the undo buffer.
+ */
+int ocfs2_release_clusters(handle_t *handle,
+                           struct inode *bitmap_inode,
+                           struct buffer_head *bitmap_bh,
+                           u64 start_blk,
+                           unsigned int num_clusters)
+{
+        return _ocfs2_free_clusters(handle, bitmap_inode, bitmap_bh,
+                                    start_blk, num_clusters,
+                                    _ocfs2_clear_bit);
+}
+
 static inline void ocfs2_debug_bg(struct ocfs2_group_desc *bg)
 {
         printk("Block Group:\n");
diff --git a/fs/ocfs2/suballoc.h b/fs/ocfs2/suballoc.h
index fa60723c43e8..e0f46df357e6 100644
--- a/fs/ocfs2/suballoc.h
+++ b/fs/ocfs2/suballoc.h
@@ -127,6 +127,11 @@ int ocfs2_free_clusters(handle_t *handle,
                         struct buffer_head *bitmap_bh,
                         u64 start_blk,
                         unsigned int num_clusters);
+int ocfs2_release_clusters(handle_t *handle,
+                           struct inode *bitmap_inode,
+                           struct buffer_head *bitmap_bh,
+                           u64 start_blk,
+                           unsigned int num_clusters);
 
 static inline u64 ocfs2_which_suballoc_group(u64 block, unsigned int bit)
 {
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index d1b0d386f6d1..3e7773089b96 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1622,7 +1622,7 @@ static void ocfs2_xa_block_wipe_namevalue(struct ocfs2_xa_loc *loc)
         /* Now tell xh->xh_entries about it */
         for (i = 0; i < count; i++) {
                 offset = le16_to_cpu(xh->xh_entries[i].xe_name_offset);
-                if (offset < namevalue_offset)
+                if (offset <= namevalue_offset)
                         le16_add_cpu(&xh->xh_entries[i].xe_name_offset,
                                      namevalue_size);
         }
@@ -6528,13 +6528,11 @@ static int ocfs2_create_empty_xattr_block(struct inode *inode,
                                           int indexed)
 {
         int ret;
-        struct ocfs2_alloc_context *meta_ac;
         struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
-        struct ocfs2_xattr_set_ctxt ctxt = {
-                .meta_ac = meta_ac,
-        };
+        struct ocfs2_xattr_set_ctxt ctxt;
 
-        ret = ocfs2_reserve_new_metadata_blocks(osb, 1, &meta_ac);
+        memset(&ctxt, 0, sizeof(ctxt));
+        ret = ocfs2_reserve_new_metadata_blocks(osb, 1, &ctxt.meta_ac);
         if (ret < 0) {
                 mlog_errno(ret);
                 return ret;
@@ -6556,7 +6554,7 @@ static int ocfs2_create_empty_xattr_block(struct inode *inode,
 
         ocfs2_commit_trans(osb, ctxt.handle);
 out:
-        ocfs2_free_alloc_context(meta_ac);
+        ocfs2_free_alloc_context(ctxt.meta_ac);
         return ret;
 }
 
diff --git a/fs/partitions/msdos.c b/fs/partitions/msdos.c
index 0028d2ef0662..90be97f1f5a8 100644
--- a/fs/partitions/msdos.c
+++ b/fs/partitions/msdos.c
@@ -31,14 +31,17 @@
  */
 #include <asm/unaligned.h>
 
-#define SYS_IND(p)      (get_unaligned(&p->sys_ind))
-#define NR_SECTS(p)     ({ __le32 __a = get_unaligned(&p->nr_sects);    \
-                                le32_to_cpu(__a); \
-                        })
+#define SYS_IND(p)      get_unaligned(&p->sys_ind)
 
-#define START_SECT(p)   ({ __le32 __a = get_unaligned(&p->start_sect);  \
-                                le32_to_cpu(__a); \
-                        })
+static inline sector_t nr_sects(struct partition *p)
+{
+        return (sector_t)get_unaligned_le32(&p->nr_sects);
+}
+
+static inline sector_t start_sect(struct partition *p)
+{
+        return (sector_t)get_unaligned_le32(&p->start_sect);
+}
 
 static inline int is_extended_partition(struct partition *p)
 {
@@ -104,13 +107,13 @@ static int aix_magic_present(unsigned char *p, struct block_device *bdev)
 
 static void
 parse_extended(struct parsed_partitions *state, struct block_device *bdev,
-                        u32 first_sector, u32 first_size)
+                        sector_t first_sector, sector_t first_size)
 {
         struct partition *p;
         Sector sect;
         unsigned char *data;
-        u32 this_sector, this_size;
-        int sector_size = bdev_logical_block_size(bdev) / 512;
+        sector_t this_sector, this_size;
+        sector_t sector_size = bdev_logical_block_size(bdev) / 512;
         int loopct = 0;         /* number of links followed
                                    without finding a data partition */
         int i;
@@ -145,14 +148,14 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
                  * First process the data partition(s)
                  */
                 for (i=0; i<4; i++, p++) {
-                        u32 offs, size, next;
-                        if (!NR_SECTS(p) || is_extended_partition(p))
+                        sector_t offs, size, next;
+                        if (!nr_sects(p) || is_extended_partition(p))
                                 continue;
 
                         /* Check the 3rd and 4th entries -
                            these sometimes contain random garbage */
-                        offs = START_SECT(p)*sector_size;
-                        size = NR_SECTS(p)*sector_size;
+                        offs = start_sect(p)*sector_size;
+                        size = nr_sects(p)*sector_size;
                         next = this_sector + offs;
                         if (i >= 2) {
                                 if (offs + size > this_size)
@@ -179,13 +182,13 @@ parse_extended(struct parsed_partitions *state, struct block_device *bdev,
                  */
                 p -= 4;
                 for (i=0; i<4; i++, p++)
-                        if (NR_SECTS(p) && is_extended_partition(p))
+                        if (nr_sects(p) && is_extended_partition(p))
                                 break;
                 if (i == 4)
                         goto done;       /* nothing left to do */
 
-                this_sector = first_sector + START_SECT(p) * sector_size;
-                this_size = NR_SECTS(p) * sector_size;
+                this_sector = first_sector + start_sect(p) * sector_size;
+                this_size = nr_sects(p) * sector_size;
                 put_dev_sector(sect);
         }
 done:
@@ -197,7 +200,7 @@ done:
 
 static void
 parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
-                        u32 offset, u32 size, int origin)
+                        sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_SOLARIS_X86_PARTITION
         Sector sect;
@@ -244,7 +247,7 @@ parse_solaris_x86(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin, char *flavour,
+                sector_t offset, sector_t size, int origin, char *flavour,
                 int max_partitions)
 {
         Sector sect;
@@ -263,7 +266,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
         if (le16_to_cpu(l->d_npartitions) < max_partitions)
                 max_partitions = le16_to_cpu(l->d_npartitions);
         for (p = l->d_partitions; p - l->d_partitions < max_partitions; p++) {
-                u32 bsd_start, bsd_size;
+                sector_t bsd_start, bsd_size;
 
                 if (state->next == state->limit)
                         break;
@@ -290,7 +293,7 @@ parse_bsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -300,7 +303,7 @@ parse_freebsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -310,7 +313,7 @@ parse_netbsd(struct parsed_partitions *state, struct block_device *bdev,
 
 static void
 parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_BSD_DISKLABEL
         parse_bsd(state, bdev, offset, size, origin,
@@ -324,7 +327,7 @@ parse_openbsd(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_UNIXWARE_DISKLABEL
         Sector sect;
@@ -348,7 +351,8 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
 
                 if (p->s_label != UNIXWARE_FS_UNUSED)
                         put_partition(state, state->next++,
-                                                START_SECT(p), NR_SECTS(p));
+                                      le32_to_cpu(p->start_sect),
+                                      le32_to_cpu(p->nr_sects));
                 p++;
         }
         put_dev_sector(sect);
@@ -363,7 +367,7 @@ parse_unixware(struct parsed_partitions *state, struct block_device *bdev,
  */
 static void
 parse_minix(struct parsed_partitions *state, struct block_device *bdev,
-                u32 offset, u32 size, int origin)
+                sector_t offset, sector_t size, int origin)
 {
 #ifdef CONFIG_MINIX_SUBPARTITION
         Sector sect;
@@ -390,7 +394,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
                         /* add each partition in use */
                         if (SYS_IND(p) == MINIX_PARTITION)
                                 put_partition(state, state->next++,
-                                              START_SECT(p), NR_SECTS(p));
+                                              start_sect(p), nr_sects(p));
                 }
                 printk(" >\n");
         }
@@ -401,7 +405,7 @@ parse_minix(struct parsed_partitions *state, struct block_device *bdev,
 static struct {
         unsigned char id;
         void (*parse)(struct parsed_partitions *, struct block_device *,
-                        u32, u32, int);
+                        sector_t, sector_t, int);
 } subtypes[] = {
         {FREEBSD_PARTITION, parse_freebsd},
         {NETBSD_PARTITION, parse_netbsd},
@@ -415,7 +419,7 @@ static struct {
  
 int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 {
-        int sector_size = bdev_logical_block_size(bdev) / 512;
+        sector_t sector_size = bdev_logical_block_size(bdev) / 512;
         Sector sect;
         unsigned char *data;
         struct partition *p;
@@ -483,14 +487,21 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 
         state->next = 5;
         for (slot = 1 ; slot <= 4 ; slot++, p++) {
-                u32 start = START_SECT(p)*sector_size;
-                u32 size = NR_SECTS(p)*sector_size;
+                sector_t start = start_sect(p)*sector_size;
+                sector_t size = nr_sects(p)*sector_size;
                 if (!size)
                         continue;
                 if (is_extended_partition(p)) {
-                        /* prevent someone doing mkfs or mkswap on an
-                           extended partition, but leave room for LILO */
-                        put_partition(state, slot, start, size == 1 ? 1 : 2);
+                        /*
+                         * prevent someone doing mkfs or mkswap on an
+                         * extended partition, but leave room for LILO
+                         * FIXME: this uses one logical sector for > 512b
+                         * sector, although it may not be enough/proper.
+                         */
+                        sector_t n = 2;
+                        n = min(size, max(sector_size, n));
+                        put_partition(state, slot, start, n);
+
                         printk(" <");
                         parse_extended(state, bdev, start, size);
                         printk(" >");
@@ -513,7 +524,7 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
                 unsigned char id = SYS_IND(p);
                 int n;
 
-                if (!NR_SECTS(p))
+                if (!nr_sects(p))
                         continue;
 
                 for (n = 0; subtypes[n].parse && id != subtypes[n].id; n++)
@@ -521,8 +532,8 @@ int msdos_partition(struct parsed_partitions *state, struct block_device *bdev)
 
                 if (!subtypes[n].parse)
                         continue;
-                subtypes[n].parse(state, bdev, START_SECT(p)*sector_size,
-                                                NR_SECTS(p)*sector_size, slot);
+                subtypes[n].parse(state, bdev, start_sect(p)*sector_size,
+                                                nr_sects(p)*sector_size, slot);
         }
         put_dev_sector(sect);
         return 1;
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index a44a7897fd4d..b442dac8f5f9 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -490,7 +490,7 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
                 }
                 read_unlock(&kclist_lock);
 
-                if (m == NULL) {
+                if (&m->list == &kclist_head) {
                         if (clear_user(buffer, tsz))
                                 return -EFAULT;
                 } else if (is_vmalloc_or_module_addr((void *)start)) {
diff --git a/fs/read_write.c b/fs/read_write.c
index b7f4a1f94d48..113386d6fd2d 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -258,6 +258,7 @@ ssize_t do_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *pp
         init_sync_kiocb(&kiocb, filp);
         kiocb.ki_pos = *ppos;
         kiocb.ki_left = len;
+        kiocb.ki_nbytes = len;
 
         for (;;) {
                 ret = filp->f_op->aio_read(&kiocb, &iov, 1, kiocb.ki_pos);
@@ -313,6 +314,7 @@ ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, lof
         init_sync_kiocb(&kiocb, filp);
         kiocb.ki_pos = *ppos;
         kiocb.ki_left = len;
+        kiocb.ki_nbytes = len;
 
         for (;;) {
                 ret = filp->f_op->aio_write(&kiocb, &iov, 1, kiocb.ki_pos);
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index ba98546fabbd..f3de5e8a2ae8 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2217,6 +2217,15 @@ static int journal_read_transaction(struct super_block *sb,
                 brelse(d_bh);
                 return 1;
         }
+
+        if (bdev_read_only(sb->s_bdev)) {
+                reiserfs_warning(sb, "clm-2076",
+                                 "device is readonly, unable to replay log");
+                brelse(c_bh);
+                brelse(d_bh);
+                return -EROFS;
+        }
+
         trans_id = get_desc_trans_id(desc);
         /* now we know we've got a good transaction, and it was inside the valid time ranges */
         log_blocks = kmalloc(get_desc_trans_len(desc) *
@@ -2459,12 +2468,6 @@ static int journal_read(struct super_block *sb)
                 goto start_log_replay;
         }
 
-        if (continue_replay && bdev_read_only(sb->s_bdev)) {
-                reiserfs_warning(sb, "clm-2076",
-                                 "device is readonly, unable to replay log");
-                return -1;
-        }
-
         /* ok, there are transactions that need to be replayed.  start with the first log block, find
          ** all the valid transactions, and pick out the oldest.
          */
diff --git a/fs/reiserfs/xattr_security.c b/fs/reiserfs/xattr_security.c
index d8b5bfcbdd30..de1fcffd906b 100644
--- a/fs/reiserfs/xattr_security.c
+++ b/fs/reiserfs/xattr_security.c
@@ -76,7 +76,7 @@ int reiserfs_security_init(struct inode *dir, struct inode *inode,
                 return error;
         }
 
-        if (sec->length) {
+        if (sec->length && reiserfs_xattrs_initialized(inode->i_sb)) {
                 blocks = reiserfs_xattr_jcreate_nblocks(inode) +
                          reiserfs_xattr_nblocks(inode, sec->length);
                 /* We don't want to count the directories twice if we have
diff --git a/include/acpi/acpi_drivers.h b/include/acpi/acpi_drivers.h
index 3a4767c01c5f..4f7b44866b76 100644
--- a/include/acpi/acpi_drivers.h
+++ b/include/acpi/acpi_drivers.h
@@ -65,6 +65,8 @@
 #define ACPI_VIDEO_HID                  "LNXVIDEO"
 #define ACPI_BAY_HID                    "LNXIOBAY"
 #define ACPI_DOCK_HID                   "LNXDOCK"
+/* Quirk for broken IBM BIOSes */
+#define ACPI_SMBUS_IBM_HID              "SMBUSIBM"
 
 /*
  * For fixed hardware buttons, we fabricate acpi_devices with HID
diff --git a/include/linux/circ_buf.h b/include/linux/circ_buf.h
index a2ed0591fb19..90f2471dc6f2 100644
--- a/include/linux/circ_buf.h
+++ b/include/linux/circ_buf.h
@@ -1,3 +1,7 @@
+/*
+ * See Documentation/circular-buffers.txt for more information.
+ */
+
 #ifndef _LINUX_CIRC_BUF_H
 #define _LINUX_CIRC_BUF_H 1
 
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index 0cf725bdd2a1..fc53492b6ad7 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -73,6 +73,7 @@ enum clock_event_nofitiers {
  * @list:               list head for the management code
  * @mode:               operating mode assigned by the management code
  * @next_event:         local storage for the next event in oneshot mode
+ * @retries:            number of forced programming retries
  */
 struct clock_event_device {
         const char              *name;
@@ -93,6 +94,7 @@ struct clock_event_device {
         struct list_head        list;
         enum clock_event_mode   mode;
         ktime_t                 next_event;
+        unsigned long           retries;
 };
 
 /*
diff --git a/include/linux/ext3_fs.h b/include/linux/ext3_fs.h
index cac84b006667..5f494b465097 100644
--- a/include/linux/ext3_fs.h
+++ b/include/linux/ext3_fs.h
@@ -565,17 +565,17 @@ enum {
 
 static inline int ext3_test_inode_state(struct inode *inode, int bit)
 {
-        return test_bit(bit, &EXT3_I(inode)->i_state);
+        return test_bit(bit, &EXT3_I(inode)->i_state_flags);
 }
 
 static inline void ext3_set_inode_state(struct inode *inode, int bit)
 {
-        set_bit(bit, &EXT3_I(inode)->i_state);
+        set_bit(bit, &EXT3_I(inode)->i_state_flags);
 }
 
 static inline void ext3_clear_inode_state(struct inode *inode, int bit)
 {
-        clear_bit(bit, &EXT3_I(inode)->i_state);
+        clear_bit(bit, &EXT3_I(inode)->i_state_flags);
 }
 #else
 /* Assume that user mode programs are passing in an ext3fs superblock, not
diff --git a/include/linux/ext3_fs_i.h b/include/linux/ext3_fs_i.h
index 7679acdb519a..f42c098aed8d 100644
--- a/include/linux/ext3_fs_i.h
+++ b/include/linux/ext3_fs_i.h
@@ -87,7 +87,7 @@ struct ext3_inode_info {
          * near to their parent directory's inode.
          */
         __u32   i_block_group;
-        unsigned long   i_state;        /* Dynamic state flags for ext3 */
+        unsigned long   i_state_flags;  /* Dynamic state flags for ext3 */
 
         /* block reservation info */
         struct ext3_block_alloc_info *i_block_alloc_info;
diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h
index 7be0c6fbe880..c57db27ac861 100644
--- a/include/linux/fscache-cache.h
+++ b/include/linux/fscache-cache.h
@@ -105,7 +105,7 @@ struct fscache_operation {
         /* operation releaser */
         fscache_operation_release_t release;
 
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         const char *name;               /* operation name */
         const char *state;              /* operation state */
 #define fscache_set_op_name(OP, N)      do { (OP)->name  = (N); } while(0)
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index 1822d635be6b..16b92d008bed 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -2,6 +2,7 @@
 #define _IF_TUNNEL_H_
 
 #include <linux/types.h>
+#include <asm/byteorder.h>
 
 #ifdef __KERNEL__
 #include <linux/ip.h>
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index 71ab79da7e7f..26fad187d661 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -112,12 +112,14 @@ struct resource_list {
 extern struct resource ioport_resource;
 extern struct resource iomem_resource;
 
+extern struct resource *request_resource_conflict(struct resource *root, struct resource *new);
 extern int request_resource(struct resource *root, struct resource *new);
 extern int release_resource(struct resource *new);
 void release_child_resources(struct resource *new);
 extern void reserve_region_with_split(struct resource *root,
                              resource_size_t start, resource_size_t end,
                              const char *name);
+extern struct resource *insert_resource_conflict(struct resource *parent, struct resource *new);
 extern int insert_resource(struct resource *parent, struct resource *new);
 extern void insert_resource_expand_to_fit(struct resource *root, struct resource *new);
 extern int allocate_resource(struct resource *root, struct resource *new,
diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
index bc0fc795bd35..ece0b1c33816 100644
--- a/include/linux/kfifo.h
+++ b/include/linux/kfifo.h
@@ -102,8 +102,6 @@ union { \
         unsigned char name##kfifo_buffer[size]; \
         struct kfifo name = __kfifo_initializer(size, name##kfifo_buffer)
 
-#undef __kfifo_initializer
-
 extern void kfifo_init(struct kfifo *fifo, void *buffer,
                         unsigned int size);
 extern __must_check int kfifo_alloc(struct kfifo *fifo, unsigned int size,
diff --git a/include/linux/mmc/mmc.h b/include/linux/mmc/mmc.h
index c02c8db73701..8a49cbf0376d 100644
--- a/include/linux/mmc/mmc.h
+++ b/include/linux/mmc/mmc.h
@@ -268,6 +268,7 @@ struct _mmc_csd {
 
 #define EXT_CSD_CARD_TYPE_26    (1<<0)  /* Card can run at 26MHz */
 #define EXT_CSD_CARD_TYPE_52    (1<<1)  /* Card can run at 52MHz */
+#define EXT_CSD_CARD_TYPE_MASK  0x3     /* Mask out reserved and DDR bits */
 
 #define EXT_CSD_BUS_WIDTH_1     0       /* Card is in 1 bit mode */
 #define EXT_CSD_BUS_WIDTH_4     1       /* Card is in 4 bit mode */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c79a88be7c33..fa8b47637997 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2059,12 +2059,12 @@ static inline void skb_bond_set_mac_by_master(struct sk_buff *skb,
  * duplicates except for 802.3ad ETH_P_SLOW, alb non-mcast/bcast, and
  * ARP on active-backup slaves with arp_validate enabled.
  */
-static inline int skb_bond_should_drop(struct sk_buff *skb)
+static inline int skb_bond_should_drop(struct sk_buff *skb,
+                                       struct net_device *master)
 {
-        struct net_device *dev = skb->dev;
-        struct net_device *master = dev->master;
-
         if (master) {
+                struct net_device *dev = skb->dev;
+
                 if (master->priv_flags & IFF_MASTER_ARPMON)
                         dev->last_rx = jiffies;
 
diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h
index 53923868c9bd..361d6b5630ee 100644
--- a/include/linux/netfilter/nfnetlink.h
+++ b/include/linux/netfilter/nfnetlink.h
@@ -76,7 +76,7 @@ extern int nfnetlink_subsys_unregister(const struct nfnetlink_subsystem *n);
 extern int nfnetlink_has_listeners(struct net *net, unsigned int group);
 extern int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, unsigned group,
                           int echo, gfp_t flags);
-extern void nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
+extern int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error);
 extern int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u_int32_t pid, int flags);
 
 extern void nfnl_lock(void);
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index d654873aa25a..1f7e300094cd 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -59,6 +59,7 @@
 enum nf_ip6_hook_priorities {
         NF_IP6_PRI_FIRST = INT_MIN,
         NF_IP6_PRI_CONNTRACK_DEFRAG = -400,
+        NF_IP6_PRI_RAW = -300,
         NF_IP6_PRI_SELINUX_FIRST = -225,
         NF_IP6_PRI_CONNTRACK = -200,
         NF_IP6_PRI_MANGLE = -150,
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index fde27c017326..6eaca5e1e8ca 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -188,7 +188,7 @@ extern int netlink_has_listeners(struct sock *sk, unsigned int group);
 extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 pid, int nonblock);
 extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 pid,
                              __u32 group, gfp_t allocation);
-extern void netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
+extern int netlink_set_err(struct sock *ssk, __u32 pid, __u32 group, int code);
 extern int netlink_register_notifier(struct notifier_block *nb);
 extern int netlink_unregister_notifier(struct notifier_block *nb);
 
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 3024050c82a1..872a98e13d6a 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -123,22 +123,11 @@ static inline int rcu_read_lock_held(void)
         return lock_is_held(&rcu_lock_map);
 }
 
-/**
- * rcu_read_lock_bh_held - might we be in RCU-bh read-side critical section?
- *
- * If CONFIG_PROVE_LOCKING is selected and enabled, returns nonzero iff in
- * an RCU-bh read-side critical section.  In absence of CONFIG_PROVE_LOCKING,
- * this assumes we are in an RCU-bh read-side critical section unless it can
- * prove otherwise.
- *
- * Check rcu_scheduler_active to prevent false positives during boot.
+/*
+ * rcu_read_lock_bh_held() is defined out of line to avoid #include-file
+ * hell.
  */
-static inline int rcu_read_lock_bh_held(void)
-{
-        if (!debug_lockdep_rcu_enabled())
-                return 1;
-        return lock_is_held(&rcu_bh_lock_map);
-}
+extern int rcu_read_lock_bh_held(void);
 
 /**
  * rcu_read_lock_sched_held - might we be in RCU-sched read-side critical section?
@@ -160,7 +149,7 @@ static inline int rcu_read_lock_sched_held(void)
                 return 1;
         if (debug_locks)
                 lockdep_opinion = lock_is_held(&rcu_sched_lock_map);
-        return lockdep_opinion || preempt_count() != 0;
+        return lockdep_opinion || preempt_count() != 0 || irqs_disabled();
 }
 #else /* #ifdef CONFIG_PREEMPT */
 static inline int rcu_read_lock_sched_held(void)
@@ -191,7 +180,7 @@ static inline int rcu_read_lock_bh_held(void)
 #ifdef CONFIG_PREEMPT
 static inline int rcu_read_lock_sched_held(void)
 {
-        return !rcu_scheduler_active || preempt_count() != 0;
+        return !rcu_scheduler_active || preempt_count() != 0 || irqs_disabled();
 }
 #else /* #ifdef CONFIG_PREEMPT */
 static inline int rcu_read_lock_sched_held(void)
diff --git a/include/linux/reiserfs_xattr.h b/include/linux/reiserfs_xattr.h
index 99928dce37ea..7fa02b4af838 100644
--- a/include/linux/reiserfs_xattr.h
+++ b/include/linux/reiserfs_xattr.h
@@ -70,6 +70,11 @@ int reiserfs_security_write(struct reiserfs_transaction_handle *th,
 void reiserfs_security_free(struct reiserfs_security_handle *sec);
 #endif
 
+static inline int reiserfs_xattrs_initialized(struct super_block *sb)
+{
+        return REISERFS_SB(sb)->priv_root != NULL;
+}
+
 #define xattr_size(size) ((size) + sizeof(struct reiserfs_xattr_header))
 static inline loff_t reiserfs_xattr_nblocks(struct inode *inode, loff_t size)
 {
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 03f816a9b659..124f90cd5a38 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -190,9 +190,6 @@ struct skb_shared_info {
         atomic_t        dataref;
         unsigned short  nr_frags;
         unsigned short  gso_size;
-#ifdef CONFIG_HAS_DMA
-        dma_addr_t      dma_head;
-#endif
         /* Warning: this field is not always filled in (UFO)! */
         unsigned short  gso_segs;
         unsigned short  gso_type;
@@ -201,9 +198,6 @@ struct skb_shared_info {
         struct sk_buff  *frag_list;
         struct skb_shared_hwtstamps hwtstamps;
         skb_frag_t      frags[MAX_SKB_FRAGS];
-#ifdef CONFIG_HAS_DMA
-        dma_addr_t      dma_maps[MAX_SKB_FRAGS];
-#endif
         /* Intermediate layers must ensure that destructor_arg
          * remains valid until skb destructor */
         void *          destructor_arg;
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 7b3aae2052a6..354cc5617f8b 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -255,6 +255,7 @@ struct ucred {
 #define MSG_ERRQUEUE    0x2000  /* Fetch message from error queue */
 #define MSG_NOSIGNAL    0x4000  /* Do not generate SIGPIPE */
 #define MSG_MORE        0x8000  /* Sender will send more */
+#define MSG_WAITFORONE  0x10000 /* recvmmsg(): block until 1+ packets avail */
 
 #define MSG_EOF         MSG_FIN
 
diff --git a/include/linux/sunrpc/bc_xprt.h b/include/linux/sunrpc/bc_xprt.h
index d7152b451e21..7c91260c44a9 100644
--- a/include/linux/sunrpc/bc_xprt.h
+++ b/include/linux/sunrpc/bc_xprt.h
@@ -36,7 +36,6 @@ struct rpc_rqst *xprt_alloc_bc_request(struct rpc_xprt *xprt);
 void xprt_free_bc_request(struct rpc_rqst *req);
 int xprt_setup_backchannel(struct rpc_xprt *, unsigned int min_reqs);
 void xprt_destroy_backchannel(struct rpc_xprt *, int max_reqs);
-void bc_release_request(struct rpc_task *);
 int bc_send(struct rpc_rqst *req);
 
 /*
@@ -59,6 +58,10 @@ static inline int svc_is_backchannel(const struct svc_rqst *rqstp)
 {
         return 0;
 }
+
+static inline void xprt_free_bc_request(struct rpc_rqst *req)
+{
+}
 #endif /* CONFIG_NFS_V4_1 */
 #endif /* _LINUX_SUNRPC_BC_XPRT_H */
 
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index f994ae58a002..057929b0a651 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -688,7 +688,7 @@ asmlinkage long sys_shmat(int shmid, char __user *shmaddr, int shmflg);
 asmlinkage long sys_shmget(key_t key, size_t size, int flag);
 asmlinkage long sys_shmdt(char __user *shmaddr);
 asmlinkage long sys_shmctl(int shmid, int cmd, struct shmid_ds __user *buf);
-asmlinkage long sys_ipc(unsigned int call, int first, int second,
+asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
                 unsigned long third, void __user *ptr, long fifth);
 
 asmlinkage long sys_mq_open(const char __user *name, int oflag, mode_t mode, struct mq_attr __user *attr);
diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index f59604ed0ec6..78b4bd3be496 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -49,7 +49,7 @@ struct tracepoint {
                 void **it_func;                                         \
                                                                         \
                 rcu_read_lock_sched_notrace();                          \
-                it_func = rcu_dereference((tp)->funcs);                 \
+                it_func = rcu_dereference_sched((tp)->funcs);           \
                 if (it_func) {                                          \
                         do {                                            \
                                 ((void(*)(proto))(*it_func))(args);     \
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 04a6908e38d2..ff77e8f882f1 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -176,6 +176,6 @@ extern void hci_sock_cleanup(void);
 extern int bt_sysfs_init(void);
 extern void bt_sysfs_cleanup(void);
 
-extern struct class *bt_class;
+extern struct dentry *bt_debugfs;
 
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/netlink.h b/include/net/netlink.h
index f82e463c875a..4fc05b58503e 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -945,7 +945,11 @@ static inline u64 nla_get_u64(const struct nlattr *nla)
  */
 static inline __be64 nla_get_be64(const struct nlattr *nla)
 {
-        return *(__be64 *) nla_data(nla);
+        __be64 tmp;
+
+        nla_memcpy(&tmp, nla, sizeof(tmp));
+
+        return tmp;
 }
 
 /**
diff --git a/include/pcmcia/ss.h b/include/pcmcia/ss.h
index 32896a773910..2e488b60bc76 100644
--- a/include/pcmcia/ss.h
+++ b/include/pcmcia/ss.h
@@ -277,12 +277,6 @@ extern struct pccard_resource_ops pccard_nonstatic_ops;
 #endif
 
 
-/* socket drivers are expected to use these callbacks in their .drv struct */
-extern int pcmcia_socket_dev_suspend(struct device *dev);
-extern void pcmcia_socket_dev_early_resume(struct device *dev);
-extern void pcmcia_socket_dev_late_resume(struct device *dev);
-extern int pcmcia_socket_dev_resume(struct device *dev);
-
 /* socket drivers use this callback in their IRQ handler */
 extern void pcmcia_parse_events(struct pcmcia_socket *socket,
                                 unsigned int events);
diff --git a/init/main.c b/init/main.c
index a1ab78ceb4b6..cbead27caefc 100644
--- a/init/main.c
+++ b/init/main.c
@@ -858,7 +858,7 @@ static int __init kernel_init(void * unused)
         /*
          * init can allocate pages on any node
          */
-        set_mems_allowed(node_possible_map);
+        set_mems_allowed(node_states[N_HIGH_MEMORY]);
         /*
          * init can run on any cpu.
          */
diff --git a/ipc/syscall.c b/ipc/syscall.c
index 355a3da9ec73..1d6f53f6b562 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -13,7 +13,7 @@
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
 
-SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, int, second,
+SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
                 unsigned long, third, void __user *, ptr, long, fifth)
 {
         int version, ret;
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index ef909a329750..e2769e13980c 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -27,7 +27,6 @@
  */
 
 #include <linux/cgroup.h>
-#include <linux/module.h>
 #include <linux/ctype.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index ba401fab459f..d10946748ec2 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -920,9 +920,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
  *    call to guarantee_online_mems(), as we know no one is changing
  *    our task's cpuset.
  *
- *    Hold callback_mutex around the two modifications of our tasks
- *    mems_allowed to synchronize with cpuset_mems_allowed().
- *
  *    While the mm_struct we are migrating is typically from some
  *    other task, the task_struct mems_allowed that we are hacking
  *    is for our current task, which must allocate new pages for that
@@ -973,15 +970,20 @@ static void cpuset_change_nodemask(struct task_struct *p,
         struct cpuset *cs;
         int migrate;
         const nodemask_t *oldmem = scan->data;
-        nodemask_t newmems;
+        NODEMASK_ALLOC(nodemask_t, newmems, GFP_KERNEL);
+
+        if (!newmems)
+                return;
 
         cs = cgroup_cs(scan->cg);
-        guarantee_online_mems(cs, &newmems);
+        guarantee_online_mems(cs, newmems);
 
         task_lock(p);
-        cpuset_change_task_nodemask(p, &newmems);
+        cpuset_change_task_nodemask(p, newmems);
         task_unlock(p);
 
+        NODEMASK_FREE(newmems);
+
         mm = get_task_mm(p);
         if (!mm)
                 return;
@@ -1051,16 +1053,21 @@ static void update_tasks_nodemask(struct cpuset *cs, const nodemask_t *oldmem,
 static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                            const char *buf)
 {
-        nodemask_t oldmem;
+        NODEMASK_ALLOC(nodemask_t, oldmem, GFP_KERNEL);
         int retval;
         struct ptr_heap heap;
 
+        if (!oldmem)
+                return -ENOMEM;
+
         /*
          * top_cpuset.mems_allowed tracks node_stats[N_HIGH_MEMORY];
          * it's read-only
          */
-        if (cs == &top_cpuset)
-                return -EACCES;
+        if (cs == &top_cpuset) {
+                retval = -EACCES;
+                goto done;
+        }
 
         /*
          * An empty mems_allowed is ok iff there are no tasks in the cpuset.
@@ -1076,11 +1083,13 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
                         goto done;
 
                 if (!nodes_subset(trialcs->mems_allowed,
-                                node_states[N_HIGH_MEMORY]))
-                        return -EINVAL;
+                                node_states[N_HIGH_MEMORY])) {
+                        retval =  -EINVAL;
+                        goto done;
+                }
         }
-        oldmem = cs->mems_allowed;
-        if (nodes_equal(oldmem, trialcs->mems_allowed)) {
+        *oldmem = cs->mems_allowed;
+        if (nodes_equal(*oldmem, trialcs->mems_allowed)) {
                 retval = 0;             /* Too easy - nothing to do */
                 goto done;
         }
@@ -1096,10 +1105,11 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
         cs->mems_allowed = trialcs->mems_allowed;
         mutex_unlock(&callback_mutex);
 
-        update_tasks_nodemask(cs, &oldmem, &heap);
+        update_tasks_nodemask(cs, oldmem, &heap);
 
         heap_free(&heap);
 done:
+        NODEMASK_FREE(oldmem);
         return retval;
 }
 
@@ -1384,40 +1394,47 @@ static void cpuset_attach(struct cgroup_subsys *ss, struct cgroup *cont,
                           struct cgroup *oldcont, struct task_struct *tsk,
                           bool threadgroup)
 {
-        nodemask_t from, to;
         struct mm_struct *mm;
         struct cpuset *cs = cgroup_cs(cont);
         struct cpuset *oldcs = cgroup_cs(oldcont);
+        NODEMASK_ALLOC(nodemask_t, from, GFP_KERNEL);
+        NODEMASK_ALLOC(nodemask_t, to, GFP_KERNEL);
+
+        if (from == NULL || to == NULL)
+                goto alloc_fail;
 
         if (cs == &top_cpuset) {
                 cpumask_copy(cpus_attach, cpu_possible_mask);
-                to = node_possible_map;
         } else {
                 guarantee_online_cpus(cs, cpus_attach);
-                guarantee_online_mems(cs, &to);
         }
+        guarantee_online_mems(cs, to);
 
         /* do per-task migration stuff possibly for each in the threadgroup */
-        cpuset_attach_task(tsk, &to, cs);
+        cpuset_attach_task(tsk, to, cs);
         if (threadgroup) {
                 struct task_struct *c;
                 rcu_read_lock();
                 list_for_each_entry_rcu(c, &tsk->thread_group, thread_group) {
-                        cpuset_attach_task(c, &to, cs);
+                        cpuset_attach_task(c, to, cs);
                 }
                 rcu_read_unlock();
         }
 
         /* change mm; only needs to be done once even if threadgroup */
-        from = oldcs->mems_allowed;
-        to = cs->mems_allowed;
+        *from = oldcs->mems_allowed;
+        *to = cs->mems_allowed;
         mm = get_task_mm(tsk);
         if (mm) {
-                mpol_rebind_mm(mm, &to);
+                mpol_rebind_mm(mm, to);
                 if (is_memory_migrate(cs))
-                        cpuset_migrate_mm(mm, &from, &to);
+                        cpuset_migrate_mm(mm, from, to);
                 mmput(mm);
         }
+
+alloc_fail:
+        NODEMASK_FREE(from);
+        NODEMASK_FREE(to);
 }
 
 /* The various types of files and directories in a cpuset file system */
@@ -1562,13 +1579,21 @@ static int cpuset_sprintf_cpulist(char *page, struct cpuset *cs)
 
 static int cpuset_sprintf_memlist(char *page, struct cpuset *cs)
 {
-        nodemask_t mask;
+        NODEMASK_ALLOC(nodemask_t, mask, GFP_KERNEL);
+        int retval;
+
+        if (mask == NULL)
+                return -ENOMEM;
 
         mutex_lock(&callback_mutex);
-        mask = cs->mems_allowed;
+        *mask = cs->mems_allowed;
         mutex_unlock(&callback_mutex);
 
-        return nodelist_scnprintf(page, PAGE_SIZE, mask);
+        retval = nodelist_scnprintf(page, PAGE_SIZE, *mask);
+
+        NODEMASK_FREE(mask);
+
+        return retval;
 }
 
 static ssize_t cpuset_common_file_read(struct cgroup *cont,
@@ -1997,7 +2022,10 @@ static void scan_for_empty_cpusets(struct cpuset *root)
         struct cpuset *cp;      /* scans cpusets being updated */
         struct cpuset *child;   /* scans child cpusets of cp */
         struct cgroup *cont;
-        nodemask_t oldmems;
+        NODEMASK_ALLOC(nodemask_t, oldmems, GFP_KERNEL);
+
+        if (oldmems == NULL)
+                return;
 
         list_add_tail((struct list_head *)&root->stack_list, &queue);
 
@@ -2014,7 +2042,7 @@ static void scan_for_empty_cpusets(struct cpuset *root)
                     nodes_subset(cp->mems_allowed, node_states[N_HIGH_MEMORY]))
                         continue;
 
-                oldmems = cp->mems_allowed;
+                *oldmems = cp->mems_allowed;
 
                 /* Remove offline cpus and mems from this cpuset. */
                 mutex_lock(&callback_mutex);
@@ -2030,9 +2058,10 @@ static void scan_for_empty_cpusets(struct cpuset *root)
                         remove_tasks_in_empty_cpuset(cp);
                 else {
                         update_tasks_cpumask(cp, NULL);
-                        update_tasks_nodemask(cp, &oldmems, NULL);
+                        update_tasks_nodemask(cp, oldmems, NULL);
                 }
         }
+        NODEMASK_FREE(oldmems);
 }
 
 /*
@@ -2090,20 +2119,33 @@ static int cpuset_track_online_cpus(struct notifier_block *unused_nb,
 static int cpuset_track_online_nodes(struct notifier_block *self,
                                 unsigned long action, void *arg)
 {
+        NODEMASK_ALLOC(nodemask_t, oldmems, GFP_KERNEL);
+
+        if (oldmems == NULL)
+                return NOTIFY_DONE;
+
         cgroup_lock();
         switch (action) {
         case MEM_ONLINE:
-        case MEM_OFFLINE:
+                *oldmems = top_cpuset.mems_allowed;
                 mutex_lock(&callback_mutex);
                 top_cpuset.mems_allowed = node_states[N_HIGH_MEMORY];
                 mutex_unlock(&callback_mutex);
-                if (action == MEM_OFFLINE)
-                        scan_for_empty_cpusets(&top_cpuset);
+                update_tasks_nodemask(&top_cpuset, oldmems, NULL);
+                break;
+        case MEM_OFFLINE:
+                /*
+                 * needn't update top_cpuset.mems_allowed explicitly because
+                 * scan_for_empty_cpusets() will update it.
+                 */
+                scan_for_empty_cpusets(&top_cpuset);
                 break;
         default:
                 break;
         }
         cgroup_unlock();
+
+        NODEMASK_FREE(oldmems);
         return NOTIFY_OK;
 }
 #endif
diff --git a/kernel/cred.c b/kernel/cred.c
index 1ed8ca18790c..1b1129d0cce8 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -364,7 +364,7 @@ struct cred *prepare_usermodehelper_creds(void)
 
         new = kmem_cache_alloc(cred_jar, GFP_ATOMIC);
         if (!new)
-                return NULL;
+                goto free_tgcred;
 
         kdebug("prepare_usermodehelper_creds() alloc %p", new);
 
@@ -397,6 +397,10 @@ struct cred *prepare_usermodehelper_creds(void)
 
 error:
         put_cred(new);
+free_tgcred:
+#ifdef CONFIG_KEYS
+        kfree(tgcred);
+#endif
         return NULL;
 }
 
diff --git a/kernel/early_res.c b/kernel/early_res.c
index 3cb2c661bb78..31aa9332ef3f 100644
--- a/kernel/early_res.c
+++ b/kernel/early_res.c
@@ -333,6 +333,12 @@ void __init free_early_partial(u64 start, u64 end)
         struct early_res *r;
         int i;
 
+        if (start == end)
+                return;
+
+        if (WARN_ONCE(start > end, "  wrong range [%#llx, %#llx]\n", start, end))
+                return;
+
 try_next:
         i = find_overlapped_early(start, end);
         if (i >= max_early_res)
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 42ec11b2af8a..b7091d5ca2f8 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -359,6 +359,23 @@ static inline void mask_ack_irq(struct irq_desc *desc, int irq)
                 if (desc->chip->ack)
                         desc->chip->ack(irq);
         }
+        desc->status |= IRQ_MASKED;
+}
+
+static inline void mask_irq(struct irq_desc *desc, int irq)
+{
+        if (desc->chip->mask) {
+                desc->chip->mask(irq);
+                desc->status |= IRQ_MASKED;
+        }
+}
+
+static inline void unmask_irq(struct irq_desc *desc, int irq)
+{
+        if (desc->chip->unmask) {
+                desc->chip->unmask(irq);
+                desc->status &= ~IRQ_MASKED;
+        }
 }
 
 /*
@@ -484,10 +501,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
         raw_spin_lock(&desc->lock);
         desc->status &= ~IRQ_INPROGRESS;
 
-        if (unlikely(desc->status & IRQ_ONESHOT))
-                desc->status |= IRQ_MASKED;
-        else if (!(desc->status & IRQ_DISABLED) && desc->chip->unmask)
-                desc->chip->unmask(irq);
+        if (!(desc->status & (IRQ_DISABLED | IRQ_ONESHOT)))
+                unmask_irq(desc, irq);
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -524,8 +539,7 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         action = desc->action;
         if (unlikely(!action || (desc->status & IRQ_DISABLED))) {
                 desc->status |= IRQ_PENDING;
-                if (desc->chip->mask)
-                        desc->chip->mask(irq);
+                mask_irq(desc, irq);
                 goto out;
         }
 
@@ -593,7 +607,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 irqreturn_t action_ret;
 
                 if (unlikely(!action)) {
-                        desc->chip->mask(irq);
+                        mask_irq(desc, irq);
                         goto out_unlock;
                 }
 
@@ -605,8 +619,7 @@ handle_edge_irq(unsigned int irq, struct irq_desc *desc)
                 if (unlikely((desc->status &
                                (IRQ_PENDING | IRQ_MASKED | IRQ_DISABLED)) ==
                               (IRQ_PENDING | IRQ_MASKED))) {
-                        desc->chip->unmask(irq);
-                        desc->status &= ~IRQ_MASKED;
+                        unmask_irq(desc, irq);
                 }
 
                 desc->status &= ~IRQ_PENDING;
@@ -716,7 +729,7 @@ set_irq_chip_and_handler_name(unsigned int irq, struct irq_chip *chip,
         __set_irq_handler(irq, handle, 0, name);
 }
 
-void __init set_irq_noprobe(unsigned int irq)
+void set_irq_noprobe(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
@@ -731,7 +744,7 @@ void __init set_irq_noprobe(unsigned int irq)
         raw_spin_unlock_irqrestore(&desc->lock, flags);
 }
 
-void __init set_irq_probe(unsigned int irq)
+void set_irq_probe(unsigned int irq)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         unsigned long flags;
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index eb6078ca60c7..398fda155f6e 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -382,6 +382,7 @@ int can_request_irq(unsigned int irq, unsigned long irqflags)
 {
         struct irq_desc *desc = irq_to_desc(irq);
         struct irqaction *action;
+        unsigned long flags;
 
         if (!desc)
                 return 0;
@@ -389,11 +390,14 @@ int can_request_irq(unsigned int irq, unsigned long irqflags)
         if (desc->status & IRQ_NOREQUEST)
                 return 0;
 
+        raw_spin_lock_irqsave(&desc->lock, flags);
         action = desc->action;
         if (action)
                 if (irqflags & action->flags & IRQF_SHARED)
                         action = NULL;
 
+        raw_spin_unlock_irqrestore(&desc->lock, flags);
+
         return !action;
 }
 
@@ -483,8 +487,26 @@ static int irq_wait_for_interrupt(struct irqaction *action)
  */
 static void irq_finalize_oneshot(unsigned int irq, struct irq_desc *desc)
 {
+again:
         chip_bus_lock(irq, desc);
         raw_spin_lock_irq(&desc->lock);
+
+        /*
+         * Implausible though it may be we need to protect us against
+         * the following scenario:
+         *
+         * The thread is faster done than the hard interrupt handler
+         * on the other CPU. If we unmask the irq line then the
+         * interrupt can come in again and masks the line, leaves due
+         * to IRQ_INPROGRESS and the irq line is masked forever.
+         */
+        if (unlikely(desc->status & IRQ_INPROGRESS)) {
+                raw_spin_unlock_irq(&desc->lock);
+                chip_bus_sync_unlock(irq, desc);
+                cpu_relax();
+                goto again;
+        }
+
         if (!(desc->status & IRQ_DISABLED) && (desc->status & IRQ_MASKED)) {
                 desc->status &= ~IRQ_MASKED;
                 desc->chip->unmask(irq);
diff --git a/kernel/kthread.c b/kernel/kthread.c
index 82ed0ea15194..83911c780175 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -219,7 +219,7 @@ int kthreadd(void *unused)
         set_task_comm(tsk, "kthreadd");
         ignore_signals(tsk);
         set_cpus_allowed_ptr(tsk, cpu_all_mask);
-        set_mems_allowed(node_possible_map);
+        set_mems_allowed(node_states[N_HIGH_MEMORY]);
 
         current->flags |= PF_NOFREEZE | PF_FREEZER_NOSIG;
 
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 1a22dfd42df9..bc7704b3a443 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -1061,9 +1061,9 @@ static void check_thread_timers(struct task_struct *tsk,
         }
 }
 
-static void stop_process_timers(struct task_struct *tsk)
+static void stop_process_timers(struct signal_struct *sig)
 {
-        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        struct thread_group_cputimer *cputimer = &sig->cputimer;
         unsigned long flags;
 
         if (!cputimer->running)
@@ -1072,6 +1072,10 @@ static void stop_process_timers(struct task_struct *tsk)
         spin_lock_irqsave(&cputimer->lock, flags);
         cputimer->running = 0;
         spin_unlock_irqrestore(&cputimer->lock, flags);
+
+        sig->cputime_expires.prof_exp = cputime_zero;
+        sig->cputime_expires.virt_exp = cputime_zero;
+        sig->cputime_expires.sched_exp = 0;
 }
 
 static u32 onecputick;
@@ -1133,7 +1137,7 @@ static void check_process_timers(struct task_struct *tsk,
             list_empty(&timers[CPUCLOCK_VIRT]) &&
             cputime_eq(sig->it[CPUCLOCK_VIRT].expires, cputime_zero) &&
             list_empty(&timers[CPUCLOCK_SCHED])) {
-                stop_process_timers(tsk);
+                stop_process_timers(sig);
                 return;
         }
 
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index f1125c1a6321..63fe25433980 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -45,6 +45,7 @@
 #include <linux/mutex.h>
 #include <linux/module.h>
 #include <linux/kernel_stat.h>
+#include <linux/hardirq.h>
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key rcu_lock_key;
@@ -66,6 +67,28 @@ EXPORT_SYMBOL_GPL(rcu_sched_lock_map);
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
 
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+
+/**
+ * rcu_read_lock_bh_held - might we be in RCU-bh read-side critical section?
+ *
+ * Check for bottom half being disabled, which covers both the
+ * CONFIG_PROVE_RCU and not cases.  Note that if someone uses
+ * rcu_read_lock_bh(), but then later enables BH, lockdep (if enabled)
+ * will show the situation.
+ *
+ * Check debug_lockdep_rcu_enabled() to prevent false positives during boot.
+ */
+int rcu_read_lock_bh_held(void)
+{
+        if (!debug_lockdep_rcu_enabled())
+                return 1;
+        return in_softirq();
+}
+EXPORT_SYMBOL_GPL(rcu_read_lock_bh_held);
+
+#endif /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
+
 /*
  * This function is invoked towards the end of the scheduler's initialization
  * process.  Before this is called, the idle task might contain
diff --git a/kernel/resource.c b/kernel/resource.c
index 2d5be5d9bf5f..9c358e263534 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -219,19 +219,34 @@ void release_child_resources(struct resource *r)
 }
 
 /**
- * request_resource - request and reserve an I/O or memory resource
+ * request_resource_conflict - request and reserve an I/O or memory resource
  * @root: root resource descriptor
  * @new: resource descriptor desired by caller
  *
- * Returns 0 for success, negative error code on error.
+ * Returns 0 for success, conflict resource on error.
  */
-int request_resource(struct resource *root, struct resource *new)
+struct resource *request_resource_conflict(struct resource *root, struct resource *new)
 {
         struct resource *conflict;
 
         write_lock(&resource_lock);
         conflict = __request_resource(root, new);
         write_unlock(&resource_lock);
+        return conflict;
+}
+
+/**
+ * request_resource - request and reserve an I/O or memory resource
+ * @root: root resource descriptor
+ * @new: resource descriptor desired by caller
+ *
+ * Returns 0 for success, negative error code on error.
+ */
+int request_resource(struct resource *root, struct resource *new)
+{
+        struct resource *conflict;
+
+        conflict = request_resource_conflict(root, new);
         return conflict ? -EBUSY : 0;
 }
 
@@ -474,25 +489,40 @@ static struct resource * __insert_resource(struct resource *parent, struct resou
 }
 
 /**
- * insert_resource - Inserts a resource in the resource tree
+ * insert_resource_conflict - Inserts resource in the resource tree
  * @parent: parent of the new resource
  * @new: new resource to insert
  *
- * Returns 0 on success, -EBUSY if the resource can't be inserted.
+ * Returns 0 on success, conflict resource if the resource can't be inserted.
  *
- * This function is equivalent to request_resource when no conflict
+ * This function is equivalent to request_resource_conflict when no conflict
  * happens. If a conflict happens, and the conflicting resources
  * entirely fit within the range of the new resource, then the new
  * resource is inserted and the conflicting resources become children of
  * the new resource.
  */
-int insert_resource(struct resource *parent, struct resource *new)
+struct resource *insert_resource_conflict(struct resource *parent, struct resource *new)
 {
         struct resource *conflict;
 
         write_lock(&resource_lock);
         conflict = __insert_resource(parent, new);
         write_unlock(&resource_lock);
+        return conflict;
+}
+
+/**
+ * insert_resource - Inserts a resource in the resource tree
+ * @parent: parent of the new resource
+ * @new: new resource to insert
+ *
+ * Returns 0 on success, -EBUSY if the resource can't be inserted.
+ */
+int insert_resource(struct resource *parent, struct resource *new)
+{
+        struct resource *conflict;
+
+        conflict = insert_resource_conflict(parent, new);
         return conflict ? -EBUSY : 0;
 }
 
diff --git a/kernel/sched.c b/kernel/sched.c
index 9ab3cd7858d3..49d2fa7b687a 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2650,7 +2650,7 @@ void wake_up_new_task(struct task_struct *p, unsigned long clone_flags)
 {
         unsigned long flags;
         struct rq *rq;
-        int cpu = get_cpu();
+        int cpu __maybe_unused = get_cpu();
 
 #ifdef CONFIG_SMP
         /*
@@ -4902,7 +4902,9 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
         int ret;
         cpumask_var_t mask;
 
-        if (len < cpumask_size())
+        if (len < nr_cpu_ids)
+                return -EINVAL;
+        if (len & (sizeof(unsigned long)-1))
                 return -EINVAL;
 
         if (!alloc_cpumask_var(&mask, GFP_KERNEL))
@@ -4910,10 +4912,12 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
 
         ret = sched_getaffinity(pid, mask);
         if (ret == 0) {
-                if (copy_to_user(user_mask_ptr, mask, cpumask_size()))
+                size_t retlen = min_t(size_t, len, cpumask_size());
+
+                if (copy_to_user(user_mask_ptr, mask, retlen))
                         ret = -EFAULT;
                 else
-                        ret = cpumask_size();
+                        ret = retlen;
         }
         free_cpumask_var(mask);
 
diff --git a/kernel/slow-work.c b/kernel/slow-work.c
index 7494bbf5a270..7d3f4fa9ef4f 100644
--- a/kernel/slow-work.c
+++ b/kernel/slow-work.c
@@ -637,7 +637,7 @@ int delayed_slow_work_enqueue(struct delayed_slow_work *dwork,
                         goto cancelled;
 
                 /* the timer holds a reference whilst it is pending */
-                ret = work->ops->get_ref(work);
+                ret = slow_work_get_ref(work);
                 if (ret < 0)
                         goto cant_get_ref;
 
diff --git a/kernel/slow-work.h b/kernel/slow-work.h
index 321f3c59d732..a29ebd1ef41d 100644
--- a/kernel/slow-work.h
+++ b/kernel/slow-work.h
@@ -43,28 +43,28 @@ extern void slow_work_new_thread_desc(struct slow_work *, struct seq_file *);
  */
 static inline void slow_work_set_thread_pid(int id, pid_t pid)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         slow_work_pids[id] = pid;
 #endif
 }
 
 static inline void slow_work_mark_time(struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         work->mark = CURRENT_TIME;
 #endif
 }
 
 static inline void slow_work_begin_exec(int id, struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         slow_work_execs[id] = work;
 #endif
 }
 
 static inline void slow_work_end_exec(int id, struct slow_work *work)
 {
-#ifdef CONFIG_SLOW_WORK_PROC
+#ifdef CONFIG_SLOW_WORK_DEBUG
         write_lock(&slow_work_execs_lock);
         slow_work_execs[id] = NULL;
         write_unlock(&slow_work_execs_lock);
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index 0d4c7898ab80..4b493f67dcb5 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -155,11 +155,11 @@ void softlockup_tick(void)
          * Wake up the high-prio watchdog task twice per
          * threshold timespan.
          */
-        if (now > touch_ts + softlockup_thresh/2)
+        if (time_after(now - softlockup_thresh/2, touch_ts))
                 wake_up_process(per_cpu(softlockup_watchdog, this_cpu));
 
         /* Warn about unreasonable delays: */
-        if (now <= (touch_ts + softlockup_thresh))
+        if (time_before_eq(now - softlockup_thresh, touch_ts))
                 return;
 
         per_cpu(softlockup_print_ts, this_cpu) = touch_ts;
diff --git a/kernel/time/tick-oneshot.c b/kernel/time/tick-oneshot.c
index 0a8a213016f0..aada0e52680a 100644
--- a/kernel/time/tick-oneshot.c
+++ b/kernel/time/tick-oneshot.c
@@ -22,6 +22,29 @@
 
 #include "tick-internal.h"
 
+/* Limit min_delta to a jiffie */
+#define MIN_DELTA_LIMIT         (NSEC_PER_SEC / HZ)
+
+static int tick_increase_min_delta(struct clock_event_device *dev)
+{
+        /* Nothing to do if we already reached the limit */
+        if (dev->min_delta_ns >= MIN_DELTA_LIMIT)
+                return -ETIME;
+
+        if (dev->min_delta_ns < 5000)
+                dev->min_delta_ns = 5000;
+        else
+                dev->min_delta_ns += dev->min_delta_ns >> 1;
+
+        if (dev->min_delta_ns > MIN_DELTA_LIMIT)
+                dev->min_delta_ns = MIN_DELTA_LIMIT;
+
+        printk(KERN_WARNING "CE: %s increased min_delta_ns to %llu nsec\n",
+               dev->name ? dev->name : "?",
+               (unsigned long long) dev->min_delta_ns);
+        return 0;
+}
+
 /**
  * tick_program_event internal worker function
  */
@@ -37,23 +60,28 @@ int tick_dev_program_event(struct clock_event_device *dev, ktime_t expires,
                 if (!ret || !force)
                         return ret;
 
+                dev->retries++;
                 /*
-                 * We tried 2 times to program the device with the given
-                 * min_delta_ns. If that's not working then we double it
+                 * We tried 3 times to program the device with the given
+                 * min_delta_ns. If that's not working then we increase it
                  * and emit a warning.
                  */
                 if (++i > 2) {
                         /* Increase the min. delta and try again */
-                        if (!dev->min_delta_ns)
-                                dev->min_delta_ns = 5000;
-                        else
-                                dev->min_delta_ns += dev->min_delta_ns >> 1;
-
-                        printk(KERN_WARNING
-                               "CE: %s increasing min_delta_ns to %llu nsec\n",
-                               dev->name ? dev->name : "?",
-                               (unsigned long long) dev->min_delta_ns << 1);
-
+                        if (tick_increase_min_delta(dev)) {
+                                /*
+                                 * Get out of the loop if min_delta_ns
+                                 * hit the limit already. That's
+                                 * better than staying here forever.
+                                 *
+                                 * We clear next_event so we have a
+                                 * chance that the box survives.
+                                 */
+                                printk(KERN_WARNING
+                                       "CE: Reprogramming failure. Giving up\n");
+                                dev->next_event.tv64 = KTIME_MAX;
+                                return -ETIME;
+                        }
                         i = 0;
                 }
 
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 16736379a9ca..39f6177fafac 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -818,7 +818,8 @@ void update_wall_time(void)
         shift = min(shift, maxshift);
         while (offset >= timekeeper.cycle_interval) {
                 offset = logarithmic_accumulation(offset, shift);
-                shift--;
+                if(offset < timekeeper.cycle_interval<<shift)
+                        shift--;
         }
 
         /* correct the clock when NTP error is too big */
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index bdfb8dd1050c..1a4a7dd78777 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -228,6 +228,7 @@ print_tickdevice(struct seq_file *m, struct tick_device *td, int cpu)
         SEQ_printf(m, " event_handler:  ");
         print_name_offset(m, dev->event_handler);
         SEQ_printf(m, "\n");
+        SEQ_printf(m, " retries:        %lu\n", dev->retries);
 }
 
 static void timer_list_show_tickdevices(struct seq_file *m)
@@ -257,7 +258,7 @@ static int timer_list_show(struct seq_file *m, void *v)
         u64 now = ktime_to_ns(ktime_get());
         int cpu;
 
-        SEQ_printf(m, "Timer List Version: v0.5\n");
+        SEQ_printf(m, "Timer List Version: v0.6\n");
         SEQ_printf(m, "HRTIMER_MAX_CLOCK_BASES: %d\n", HRTIMER_MAX_CLOCK_BASES);
         SEQ_printf(m, "now at %Ld nsecs\n", (unsigned long long)now);
 
diff --git a/kernel/timer.c b/kernel/timer.c
index c61a7949387f..fc965eae0e87 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -880,6 +880,7 @@ int try_to_del_timer_sync(struct timer_list *timer)
         if (base->running_timer == timer)
                 goto out;
 
+        timer_stats_timer_clear_start_info(timer);
         ret = 0;
         if (timer_pending(timer)) {
                 detach_timer(timer, 1);
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 05a9f83b8819..d1187ef20caf 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -207,6 +207,14 @@ EXPORT_SYMBOL_GPL(tracing_is_on);
 #define RB_MAX_SMALL_DATA       (RB_ALIGNMENT * RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
 #define RB_EVNT_MIN_SIZE        8U      /* two 32bit words */
 
+#if !defined(CONFIG_64BIT) || defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+# define RB_FORCE_8BYTE_ALIGNMENT       0
+# define RB_ARCH_ALIGNMENT              RB_ALIGNMENT
+#else
+# define RB_FORCE_8BYTE_ALIGNMENT       1
+# define RB_ARCH_ALIGNMENT              8U
+#endif
+
 /* define RINGBUF_TYPE_DATA for 'case RINGBUF_TYPE_DATA:' */
 #define RINGBUF_TYPE_DATA 0 ... RINGBUF_TYPE_DATA_TYPE_LEN_MAX
 
@@ -1547,7 +1555,7 @@ rb_update_event(struct ring_buffer_event *event,
 
         case 0:
                 length -= RB_EVNT_HDR_SIZE;
-                if (length > RB_MAX_SMALL_DATA)
+                if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
                         event->array[0] = length;
                 else
                         event->type_len = DIV_ROUND_UP(length, RB_ALIGNMENT);
@@ -1722,11 +1730,11 @@ static unsigned rb_calculate_event_length(unsigned length)
         if (!length)
                 length = 1;
 
-        if (length > RB_MAX_SMALL_DATA)
+        if (length > RB_MAX_SMALL_DATA || RB_FORCE_8BYTE_ALIGNMENT)
                 length += sizeof(event.array[0]);
 
         length += RB_EVNT_HDR_SIZE;
-        length = ALIGN(length, RB_ALIGNMENT);
+        length = ALIGN(length, RB_ARCH_ALIGNMENT);
 
         return length;
 }
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 8e5ec5e1ab91..1fafb4b99c9b 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -103,7 +103,8 @@ config HEADERS_CHECK
 
 config DEBUG_SECTION_MISMATCH
         bool "Enable full Section mismatch analysis"
-        depends on UNDEFINED
+        depends on UNDEFINED || (BLACKFIN)
+        default y
         # This option is on purpose disabled for now.
         # It will be enabled when we are down to a reasonable number
         # of section mismatch warnings (< 10 for an allyesconfig build)
diff --git a/mm/bootmem.c b/mm/bootmem.c
index d7c791ef0036..9b134460b016 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -180,19 +180,12 @@ static void __init __free_pages_memory(unsigned long start, unsigned long end)
         end_aligned = end & ~(BITS_PER_LONG - 1);
 
         if (end_aligned <= start_aligned) {
-#if 1
-                printk(KERN_DEBUG " %lx - %lx\n", start, end);
-#endif
                 for (i = start; i < end; i++)
                         __free_pages_bootmem(pfn_to_page(i), 0);
 
                 return;
         }
 
-#if 1
-        printk(KERN_DEBUG " %lx %lx - %lx %lx\n",
-                 start, start_aligned, end_aligned, end);
-#endif
         for (i = start; i < start_aligned; i++)
                 __free_pages_bootmem(pfn_to_page(i), 0);
 
@@ -428,9 +421,6 @@ void __init free_bootmem_node(pg_data_t *pgdat, unsigned long physaddr,
 {
 #ifdef CONFIG_NO_BOOTMEM
         free_early(physaddr, physaddr + size);
-#if 0
-        printk(KERN_DEBUG "free %lx %lx\n", physaddr, size);
-#endif
 #else
         unsigned long start, end;
 
@@ -456,9 +446,6 @@ void __init free_bootmem(unsigned long addr, unsigned long size)
 {
 #ifdef CONFIG_NO_BOOTMEM
         free_early(addr, addr + size);
-#if 0
-        printk(KERN_DEBUG "free %lx %lx\n", addr, size);
-#endif
 #else
         unsigned long start, end;
 
diff --git a/mm/ksm.c b/mm/ksm.c
index a93f1b7f508c..8cdfc2a1e8bf 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -751,7 +751,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                  * page
                  */
                 if (page_mapcount(page) + 1 + swapped != page_count(page)) {
-                        set_pte_at_notify(mm, addr, ptep, entry);
+                        set_pte_at(mm, addr, ptep, entry);
                         goto out_unlock;
                 }
                 entry = pte_wrprotect(entry);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7973b5221fb8..9ed760dc7448 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3691,8 +3691,10 @@ static struct mem_cgroup *mem_cgroup_alloc(void)
         else
                 mem = vmalloc(size);
 
-        if (mem)
-                memset(mem, 0, size);
+        if (!mem)
+                return NULL;
+
+        memset(mem, 0, size);
         mem->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
         if (!mem->stat) {
                 if (size < PAGE_SIZE)
@@ -3946,28 +3948,6 @@ one_by_one:
         }
         return ret;
 }
-#else   /* !CONFIG_MMU */
-static int mem_cgroup_can_attach(struct cgroup_subsys *ss,
-                                struct cgroup *cgroup,
-                                struct task_struct *p,
-                                bool threadgroup)
-{
-        return 0;
-}
-static void mem_cgroup_cancel_attach(struct cgroup_subsys *ss,
-                                struct cgroup *cgroup,
-                                struct task_struct *p,
-                                bool threadgroup)
-{
-}
-static void mem_cgroup_move_task(struct cgroup_subsys *ss,
-                                struct cgroup *cont,
-                                struct cgroup *old_cont,
-                                struct task_struct *p,
-                                bool threadgroup)
-{
-}
-#endif
 
 /**
  * is_target_pte_for_mc - check a pte whether it is valid for move charge
@@ -4330,6 +4310,28 @@ static void mem_cgroup_move_task(struct cgroup_subsys *ss,
         }
         mem_cgroup_clear_mc();
 }
+#else   /* !CONFIG_MMU */
+static int mem_cgroup_can_attach(struct cgroup_subsys *ss,
+                                struct cgroup *cgroup,
+                                struct task_struct *p,
+                                bool threadgroup)
+{
+        return 0;
+}
+static void mem_cgroup_cancel_attach(struct cgroup_subsys *ss,
+                                struct cgroup *cgroup,
+                                struct task_struct *p,
+                                bool threadgroup)
+{
+}
+static void mem_cgroup_move_task(struct cgroup_subsys *ss,
+                                struct cgroup *cont,
+                                struct cgroup *old_cont,
+                                struct task_struct *p,
+                                bool threadgroup)
+{
+}
+#endif
 
 struct cgroup_subsys mem_cgroup_subsys = {
         .name = "memory",
diff --git a/mm/memory.c b/mm/memory.c
index 5b7f2002e54b..bc9ba5a1f5b9 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -130,6 +130,7 @@ void __sync_task_rss_stat(struct task_struct *task, struct mm_struct *mm)
 
         for (i = 0; i < NR_MM_COUNTERS; i++) {
                 if (task->rss_stat.count[i]) {
+                        BUG_ON(!mm);
                         add_mm_counter(mm, i, task->rss_stat.count[i]);
                         task->rss_stat.count[i] = 0;
                 }
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 643f66e10187..8034abd3a135 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -806,9 +806,13 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask,
 
         err = 0;
         if (nmask) {
-                task_lock(current);
-                get_policy_nodemask(pol, nmask);
-                task_unlock(current);
+                if (mpol_store_user_nodemask(pol)) {
+                        *nmask = pol->w.user_nodemask;
+                } else {
+                        task_lock(current);
+                        get_policy_nodemask(pol, nmask);
+                        task_unlock(current);
+                }
         }
 
  out:
@@ -2195,8 +2199,8 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                         char *rest = nodelist;
                         while (isdigit(*rest))
                                 rest++;
-                        if (!*rest)
-                                err = 0;
+                        if (*rest)
+                                goto out;
                 }
                 break;
         case MPOL_INTERLEAVE:
@@ -2205,7 +2209,6 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                  */
                 if (!nodelist)
                         nodes = node_states[N_HIGH_MEMORY];
-                err = 0;
                 break;
         case MPOL_LOCAL:
                 /*
@@ -2215,11 +2218,19 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                         goto out;
                 mode = MPOL_PREFERRED;
                 break;
-
-        /*
-         * case MPOL_BIND:    mpol_new() enforces non-empty nodemask.
-         * case MPOL_DEFAULT: mpol_new() enforces empty nodemask, ignores flags.
-         */
+        case MPOL_DEFAULT:
+                /*
+                 * Insist on a empty nodelist
+                 */
+                if (!nodelist)
+                        err = 0;
+                goto out;
+        case MPOL_BIND:
+                /*
+                 * Insist on a nodelist
+                 */
+                if (!nodelist)
+                        goto out;
         }
 
         mode_flags = 0;
@@ -2233,13 +2244,14 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                 else if (!strcmp(flags, "relative"))
                         mode_flags |= MPOL_F_RELATIVE_NODES;
                 else
-                        err = 1;
+                        goto out;
         }
 
         new = mpol_new(mode, mode_flags, &nodes);
         if (IS_ERR(new))
-                err = 1;
-        else {
+                goto out;
+
+        {
                 int ret;
                 NODEMASK_SCRATCH(scratch);
                 if (scratch) {
@@ -2250,13 +2262,15 @@ int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
                         ret = -ENOMEM;
                 NODEMASK_SCRATCH_FREE(scratch);
                 if (ret) {
-                        err = 1;
                         mpol_put(new);
-                } else if (no_context) {
-                        /* save for contextualization */
-                        new->w.user_nodemask = nodes;
+                        goto out;
                 }
         }
+        err = 0;
+        if (no_context) {
+                /* save for contextualization */
+                new->w.user_nodemask = nodes;
+        }
 
 out:
         /* Restore string for error message */
diff --git a/mm/mmu_context.c b/mm/mmu_context.c
index 0777654147c9..9e82e937000e 100644
--- a/mm/mmu_context.c
+++ b/mm/mmu_context.c
@@ -53,6 +53,7 @@ void unuse_mm(struct mm_struct *mm)
         struct task_struct *tsk = current;
 
         task_lock(tsk);
+        sync_mm_rss(tsk, mm);
         tsk->mm = NULL;
         /* active_mm is still 'mm' */
         enter_lazy_tlb(mm, tsk);
diff --git a/mm/nommu.c b/mm/nommu.c
index 605ace8982a8..63fa17d121f0 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -146,7 +146,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                         (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
 
         for (i = 0; i < nr_pages; i++) {
-                vma = find_extend_vma(mm, start);
+                vma = find_vma(mm, start);
                 if (!vma)
                         goto finish_or_fault;
 
@@ -162,7 +162,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
                 }
                 if (vmas)
                         vmas[i] = vma;
-                start += PAGE_SIZE;
+                start = (start + PAGE_SIZE) & PAGE_MASK;
         }
 
         return i;
@@ -764,7 +764,7 @@ EXPORT_SYMBOL(find_vma);
  */
 struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
 {
-        return find_vma(mm, addr & PAGE_MASK);
+        return find_vma(mm, addr);
 }
 
 /*
@@ -1040,10 +1040,9 @@ static int do_mmap_shared_file(struct vm_area_struct *vma)
         if (ret != -ENOSYS)
                 return ret;
 
-        /* getting an ENOSYS error indicates that direct mmap isn't
-         * possible (as opposed to tried but failed) so we'll fall
-         * through to making a private copy of the data and mapping
-         * that if we can */
+        /* getting -ENOSYS indicates that direct mmap isn't possible (as
+         * opposed to tried but failed) so we can only give a suitable error as
+         * it's not possible to make a private copy if MAP_SHARED was given */
         return -ENODEV;
 }
 
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 453512266ea1..db783d7af5a3 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -378,6 +378,8 @@ static void vlan_transfer_features(struct net_device *dev,
 #if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
         vlandev->fcoe_ddp_xid = dev->fcoe_ddp_xid;
 #endif
+        vlandev->real_num_tx_queues = dev->real_num_tx_queues;
+        BUG_ON(vlandev->real_num_tx_queues > vlandev->num_tx_queues);
 
         if (old_features != vlandev->features)
                 netdev_features_change(vlandev);
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index c0316e0ca6e8..c584a0af77d3 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -11,7 +11,7 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
         if (netpoll_rx(skb))
                 return NET_RX_DROP;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
         skb->skb_iif = skb->dev->ifindex;
@@ -83,7 +83,7 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 {
         struct sk_buff *p;
 
-        if (skb_bond_should_drop(skb))
+        if (skb_bond_should_drop(skb, ACCESS_ONCE(skb->dev->master)))
                 goto drop;
 
         skb->skb_iif = skb->dev->ifindex;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 9e83272fc5b0..2fd057c81bbf 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -361,6 +361,14 @@ static netdev_tx_t vlan_dev_hwaccel_hard_start_xmit(struct sk_buff *skb,
         return ret;
 }
 
+static u16 vlan_dev_select_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        struct net_device *rdev = vlan_dev_info(dev)->real_dev;
+        const struct net_device_ops *ops = rdev->netdev_ops;
+
+        return ops->ndo_select_queue(rdev, skb);
+}
+
 static int vlan_dev_change_mtu(struct net_device *dev, int new_mtu)
 {
         /* TODO: gotta make sure the underlying layer can handle it,
@@ -688,7 +696,8 @@ static const struct header_ops vlan_header_ops = {
         .parse   = eth_header_parse,
 };
 
-static const struct net_device_ops vlan_netdev_ops, vlan_netdev_accel_ops;
+static const struct net_device_ops vlan_netdev_ops, vlan_netdev_accel_ops,
+                    vlan_netdev_ops_sq, vlan_netdev_accel_ops_sq;
 
 static int vlan_dev_init(struct net_device *dev)
 {
@@ -722,11 +731,17 @@ static int vlan_dev_init(struct net_device *dev)
         if (real_dev->features & NETIF_F_HW_VLAN_TX) {
                 dev->header_ops      = real_dev->header_ops;
                 dev->hard_header_len = real_dev->hard_header_len;
-                dev->netdev_ops         = &vlan_netdev_accel_ops;
+                if (real_dev->netdev_ops->ndo_select_queue)
+                        dev->netdev_ops = &vlan_netdev_accel_ops_sq;
+                else
+                        dev->netdev_ops = &vlan_netdev_accel_ops;
         } else {
                 dev->header_ops      = &vlan_header_ops;
                 dev->hard_header_len = real_dev->hard_header_len + VLAN_HLEN;
-                dev->netdev_ops         = &vlan_netdev_ops;
+                if (real_dev->netdev_ops->ndo_select_queue)
+                        dev->netdev_ops = &vlan_netdev_ops_sq;
+                else
+                        dev->netdev_ops = &vlan_netdev_ops;
         }
 
         if (is_vlan_dev(real_dev))
@@ -865,6 +880,56 @@ static const struct net_device_ops vlan_netdev_accel_ops = {
 #endif
 };
 
+static const struct net_device_ops vlan_netdev_ops_sq = {
+        .ndo_select_queue       = vlan_dev_select_queue,
+        .ndo_change_mtu         = vlan_dev_change_mtu,
+        .ndo_init               = vlan_dev_init,
+        .ndo_uninit             = vlan_dev_uninit,
+        .ndo_open               = vlan_dev_open,
+        .ndo_stop               = vlan_dev_stop,
+        .ndo_start_xmit =  vlan_dev_hard_start_xmit,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = vlan_dev_set_mac_address,
+        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
+        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
+        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
+        .ndo_do_ioctl           = vlan_dev_ioctl,
+        .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
+};
+
+static const struct net_device_ops vlan_netdev_accel_ops_sq = {
+        .ndo_select_queue       = vlan_dev_select_queue,
+        .ndo_change_mtu         = vlan_dev_change_mtu,
+        .ndo_init               = vlan_dev_init,
+        .ndo_uninit             = vlan_dev_uninit,
+        .ndo_open               = vlan_dev_open,
+        .ndo_stop               = vlan_dev_stop,
+        .ndo_start_xmit =  vlan_dev_hwaccel_hard_start_xmit,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_set_mac_address    = vlan_dev_set_mac_address,
+        .ndo_set_rx_mode        = vlan_dev_set_rx_mode,
+        .ndo_set_multicast_list = vlan_dev_set_rx_mode,
+        .ndo_change_rx_flags    = vlan_dev_change_rx_flags,
+        .ndo_do_ioctl           = vlan_dev_ioctl,
+        .ndo_neigh_setup        = vlan_dev_neigh_setup,
+        .ndo_get_stats          = vlan_dev_get_stats,
+#if defined(CONFIG_FCOE) || defined(CONFIG_FCOE_MODULE)
+        .ndo_fcoe_ddp_setup     = vlan_dev_fcoe_ddp_setup,
+        .ndo_fcoe_ddp_done      = vlan_dev_fcoe_ddp_done,
+        .ndo_fcoe_enable        = vlan_dev_fcoe_enable,
+        .ndo_fcoe_disable       = vlan_dev_fcoe_disable,
+        .ndo_fcoe_get_wwn       = vlan_dev_fcoe_get_wwn,
+#endif
+};
+
 void vlan_setup(struct net_device *dev)
 {
         ether_setup(dev);
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index cafb55b0cea5..05fd125f74fe 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -8,8 +8,7 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
-struct class *bt_class = NULL;
-EXPORT_SYMBOL_GPL(bt_class);
+static struct class *bt_class;
 
 struct dentry *bt_debugfs = NULL;
 EXPORT_SYMBOL_GPL(bt_debugfs);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 4db7ae2fe07d..7794a2e2adce 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/crc16.h>
 #include <net/sock.h>
@@ -2830,6 +2832,11 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                         int len = cmd->len - sizeof(*rsp);
                         char req[64];
 
+                        if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
+                                l2cap_send_disconn_req(conn, sk);
+                                goto done;
+                        }
+
                         /* throw out any old stored conf requests */
                         result = L2CAP_CONF_SUCCESS;
                         len = l2cap_parse_conf_rsp(sk, rsp->data,
@@ -3937,31 +3944,42 @@ drop:
         return 0;
 }
 
-static ssize_t l2cap_sysfs_show(struct class *dev,
-                                struct class_attribute *attr,
-                                char *buf)
+static int l2cap_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&l2cap_sk_list.lock);
 
         sk_for_each(sk, node, &l2cap_sk_list.head) {
                 struct l2cap_pinfo *pi = l2cap_pi(sk);
 
-                str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
-                                pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
+                seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+                                        batostr(&bt_sk(sk)->src),
+                                        batostr(&bt_sk(sk)->dst),
+                                        sk->sk_state, __le16_to_cpu(pi->psm),
+                                        pi->scid, pi->dcid,
+                                        pi->imtu, pi->omtu, pi->sec_level);
         }
 
         read_unlock_bh(&l2cap_sk_list.lock);
 
-        return str - buf;
+        return 0;
 }
 
-static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
+static int l2cap_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, l2cap_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations l2cap_debugfs_fops = {
+        .open           = l2cap_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *l2cap_debugfs;
 
 static const struct proto_ops l2cap_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -4021,8 +4039,12 @@ static int __init l2cap_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_l2cap) < 0)
-                BT_ERR("Failed to create L2CAP info file");
+        if (bt_debugfs) {
+                l2cap_debugfs = debugfs_create_file("l2cap", 0444,
+                                        bt_debugfs, NULL, &l2cap_debugfs_fops);
+                if (!l2cap_debugfs)
+                        BT_ERR("Failed to create L2CAP debug file");
+        }
 
         BT_INFO("L2CAP ver %s", VERSION);
         BT_INFO("L2CAP socket layer initialized");
@@ -4036,7 +4058,7 @@ error:
 
 static void __exit l2cap_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_l2cap);
+        debugfs_remove(l2cap_debugfs);
 
         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
                 BT_ERR("L2CAP socket unregistration failed");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index db8a68e1a5ba..13f114e8b0f9 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -33,6 +33,8 @@
 #include <linux/init.h>
 #include <linux/wait.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/net.h>
 #include <linux/mutex.h>
 #include <linux/kthread.h>
@@ -2098,13 +2100,10 @@ static struct hci_cb rfcomm_cb = {
         .security_cfm   = rfcomm_security_cfm
 };
 
-static ssize_t rfcomm_dlc_sysfs_show(struct class *dev,
-                                     struct class_attribute *attr,
-                                     char *buf)
+static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
 {
         struct rfcomm_session *s;
         struct list_head *pp, *p;
-        char *str = buf;
 
         rfcomm_lock();
 
@@ -2114,18 +2113,32 @@ static ssize_t rfcomm_dlc_sysfs_show(struct class *dev,
                         struct sock *sk = s->sock->sk;
                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
 
-                        str += sprintf(str, "%s %s %ld %d %d %d %d\n",
-                                        batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                        d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
+                        seq_printf(f, "%s %s %ld %d %d %d %d\n",
+                                                batostr(&bt_sk(sk)->src),
+                                                batostr(&bt_sk(sk)->dst),
+                                                d->state, d->dlci, d->mtu,
+                                                d->rx_credits, d->tx_credits);
                 }
         }
 
         rfcomm_unlock();
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
+static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_dlc_debugfs_fops = {
+        .open           = rfcomm_dlc_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_dlc_debugfs;
 
 /* ---- Initialization ---- */
 static int __init rfcomm_init(void)
@@ -2142,8 +2155,12 @@ static int __init rfcomm_init(void)
                 goto unregister;
         }
 
-        if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
+                                bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
+                if (!rfcomm_dlc_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         err = rfcomm_init_ttys();
         if (err < 0)
@@ -2171,7 +2188,7 @@ unregister:
 
 static void __exit rfcomm_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm_dlc);
+        debugfs_remove(rfcomm_dlc_debugfs);
 
         hci_unregister_cb(&rfcomm_cb);
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index ca87d6ac6a20..7f439765403d 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -1061,28 +1063,38 @@ done:
         return result;
 }
 
-static ssize_t rfcomm_sock_sysfs_show(struct class *dev,
-                                      struct class_attribute *attr,
-                                      char *buf)
+static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&rfcomm_sk_list.lock);
 
         sk_for_each(sk, node, &rfcomm_sk_list.head) {
-                str += sprintf(str, "%s %s %d %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
+                seq_printf(f, "%s %s %d %d\n",
+                                batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst),
                                 sk->sk_state, rfcomm_pi(sk)->channel);
         }
 
         read_unlock_bh(&rfcomm_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
+static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations rfcomm_sock_debugfs_fops = {
+        .open           = rfcomm_sock_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *rfcomm_sock_debugfs;
 
 static const struct proto_ops rfcomm_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -1122,8 +1134,12 @@ int __init rfcomm_init_sockets(void)
         if (err < 0)
                 goto error;
 
-        if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
-                BT_ERR("Failed to create RFCOMM info file");
+        if (bt_debugfs) {
+                rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
+                                bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
+                if (!rfcomm_sock_debugfs)
+                        BT_ERR("Failed to create RFCOMM debug file");
+        }
 
         BT_INFO("RFCOMM socket layer initialized");
 
@@ -1137,7 +1153,7 @@ error:
 
 void rfcomm_cleanup_sockets(void)
 {
-        class_remove_file(bt_class, &class_attr_rfcomm);
+        debugfs_remove(rfcomm_sock_debugfs);
 
         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
                 BT_ERR("RFCOMM socket layer unregistration failed");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f93b939539bc..e5b16b76b22e 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -38,6 +38,8 @@
 #include <linux/socket.h>
 #include <linux/skbuff.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/list.h>
 #include <net/sock.h>
 
@@ -953,28 +955,36 @@ drop:
         return 0;
 }
 
-static ssize_t sco_sysfs_show(struct class *dev,
-                                struct class_attribute *attr,
-                                char *buf)
+static int sco_debugfs_show(struct seq_file *f, void *p)
 {
         struct sock *sk;
         struct hlist_node *node;
-        char *str = buf;
 
         read_lock_bh(&sco_sk_list.lock);
 
         sk_for_each(sk, node, &sco_sk_list.head) {
-                str += sprintf(str, "%s %s %d\n",
-                                batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                                sk->sk_state);
+                seq_printf(f, "%s %s %d\n", batostr(&bt_sk(sk)->src),
+                                batostr(&bt_sk(sk)->dst), sk->sk_state);
         }
 
         read_unlock_bh(&sco_sk_list.lock);
 
-        return (str - buf);
+        return 0;
 }
 
-static CLASS_ATTR(sco, S_IRUGO, sco_sysfs_show, NULL);
+static int sco_debugfs_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, sco_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations sco_debugfs_fops = {
+        .open           = sco_debugfs_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+
+static struct dentry *sco_debugfs;
 
 static const struct proto_ops sco_sock_ops = {
         .family         = PF_BLUETOOTH,
@@ -1032,8 +1042,12 @@ static int __init sco_init(void)
                 goto error;
         }
 
-        if (class_create_file(bt_class, &class_attr_sco) < 0)
-                BT_ERR("Failed to create SCO info file");
+        if (bt_debugfs) {
+                sco_debugfs = debugfs_create_file("sco", 0444,
+                                        bt_debugfs, NULL, &sco_debugfs_fops);
+                if (!sco_debugfs)
+                        BT_ERR("Failed to create SCO debug file");
+        }
 
         BT_INFO("SCO (Voice Link) ver %s", VERSION);
         BT_INFO("SCO socket layer initialized");
@@ -1047,7 +1061,7 @@ error:
 
 static void __exit sco_exit(void)
 {
-        class_remove_file(bt_class, &class_attr_sco);
+        debugfs_remove(sco_debugfs);
 
         if (bt_sock_unregister(BTPROTO_SCO) < 0)
                 BT_ERR("SCO socket unregistration failed");
diff --git a/net/core/dev.c b/net/core/dev.c
index bcc490cc9452..59d4394d2ce8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2483,6 +2483,7 @@ int netif_receive_skb(struct sk_buff *skb)
 {
         struct packet_type *ptype, *pt_prev;
         struct net_device *orig_dev;
+        struct net_device *master;
         struct net_device *null_or_orig;
         struct net_device *null_or_bond;
         int ret = NET_RX_DROP;
@@ -2503,11 +2504,12 @@ int netif_receive_skb(struct sk_buff *skb)
 
         null_or_orig = NULL;
         orig_dev = skb->dev;
-        if (orig_dev->master) {
-                if (skb_bond_should_drop(skb))
+        master = ACCESS_ONCE(orig_dev->master);
+        if (master) {
+                if (skb_bond_should_drop(skb, master))
                         null_or_orig = orig_dev; /* deliver only exact match */
                 else
-                        skb->dev = orig_dev->master;
+                        skb->dev = master;
         }
 
         __get_cpu_var(netdev_rx_stat).total++;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index d4ec38fa64e6..6f9206b36dc2 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -614,7 +614,7 @@ void netpoll_print_options(struct netpoll *np)
                          np->name, np->local_port);
         printk(KERN_INFO "%s: local IP %pI4\n",
                          np->name, &np->local_ip);
-        printk(KERN_INFO "%s: interface %s\n",
+        printk(KERN_INFO "%s: interface '%s'\n",
                          np->name, np->dev_name);
         printk(KERN_INFO "%s: remote port %d\n",
                          np->name, np->remote_port);
@@ -661,6 +661,9 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
                 if ((delim = strchr(cur, '@')) == NULL)
                         goto parse_failed;
                 *delim = 0;
+                if (*cur == ' ' || *cur == '\t')
+                        printk(KERN_INFO "%s: warning: whitespace"
+                                        "is not allowed\n", np->name);
                 np->remote_port = simple_strtol(cur, NULL, 10);
                 cur = delim;
         }
@@ -708,7 +711,7 @@ int netpoll_parse_options(struct netpoll *np, char *opt)
         return 0;
 
  parse_failed:
-        printk(KERN_INFO "%s: couldn't parse config at %s!\n",
+        printk(KERN_INFO "%s: couldn't parse config at '%s'!\n",
                np->name, cur);
         return -1;
 }
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 51ca946e3392..3feb2b390308 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1194,7 +1194,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
                 hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
-                        if (idx > s_idx)
+                        if (h > s_h || idx > s_idx)
                                 s_ip_idx = 0;
                         in_dev = __in_dev_get_rcu(dev);
                         if (!in_dev)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index af5d89792860..01ef8ba9025c 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -961,7 +961,9 @@ fib_find_node(struct trie *t, u32 key)
         struct node *n;
 
         pos = 0;
-        n = rcu_dereference(t->trie);
+        n = rcu_dereference_check(t->trie,
+                                  rcu_read_lock_held() ||
+                                  lockdep_rtnl_is_held());
 
         while (n != NULL &&  NODE_TYPE(n) == T_TNODE) {
                 tn = (struct tnode *) n;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index f47c9f76754b..f78402d097b3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -810,11 +810,13 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         tunnel->err_count = 0;
         }
 
-        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
+        max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->u.dst.header_len;
 
         if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
+                if (max_headroom > dev->needed_headroom)
+                        dev->needed_headroom = max_headroom;
                 if (!new_skb) {
                         ip_rt_put(rt);
                         txq->tx_dropped++;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 8582e12e4a62..d0a6092a67be 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -802,6 +802,9 @@ static int ipmr_mfc_add(struct net *net, struct mfcctl *mfc, int mrtsock)
         int line;
         struct mfc_cache *uc, *c, **cp;
 
+        if (mfc->mfcc_parent >= MAXVIFS)
+                return -ENFILE;
+
         line = MFC_HASH(mfc->mfcc_mcastgrp.s_addr, mfc->mfcc_origin.s_addr);
 
         for (cp = &net->ipv4.mfc_cache_array[line];
@@ -1613,17 +1616,20 @@ ipmr_fill_mroute(struct sk_buff *skb, struct mfc_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc_net(c);
-        struct net_device *dev = net->ipv4.vif_table[c->mfc_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mfc_parent > MAXVIFS)
+                return -ENOENT;
+
+        if (VIF_EXISTS(net, c->mfc_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv4.vif_table[c->mfc_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (VIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a770df2493d2..d413b57be9b3 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1097,7 +1097,7 @@ static int slow_chain_length(const struct rtable *head)
 }
 
 static int rt_intern_hash(unsigned hash, struct rtable *rt,
-                          struct rtable **rp, struct sk_buff *skb)
+                          struct rtable **rp, struct sk_buff *skb, int ifindex)
 {
         struct rtable   *rth, **rthp;
         unsigned long   now;
@@ -1212,11 +1212,16 @@ restart:
                     slow_chain_length(rt_hash_table[hash].chain) > rt_chain_length_max) {
                         struct net *net = dev_net(rt->u.dst.dev);
                         int num = ++net->ipv4.current_rt_cache_rebuild_count;
-                        if (!rt_caching(dev_net(rt->u.dst.dev))) {
+                        if (!rt_caching(net)) {
                                 printk(KERN_WARNING "%s: %d rebuilds is over limit, route caching disabled\n",
                                         rt->u.dst.dev->name, num);
                         }
-                        rt_emergency_hash_rebuild(dev_net(rt->u.dst.dev));
+                        rt_emergency_hash_rebuild(net);
+                        spin_unlock_bh(rt_hash_lock_addr(hash));
+
+                        hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
+                                        ifindex, rt_genid(net));
+                        goto restart;
                 }
         }
 
@@ -1441,7 +1446,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                         dev_hold(rt->u.dst.dev);
                                 if (rt->idev)
                                         in_dev_hold(rt->idev);
-                                rt->u.dst.obsolete      = 0;
+                                rt->u.dst.obsolete      = -1;
                                 rt->u.dst.lastuse       = jiffies;
                                 rt->u.dst.path          = &rt->u.dst;
                                 rt->u.dst.neighbour     = NULL;
@@ -1477,7 +1482,7 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                                         &netevent);
 
                                 rt_del(hash, rth);
-                                if (!rt_intern_hash(hash, rt, &rt, NULL))
+                                if (!rt_intern_hash(hash, rt, &rt, NULL, rt->fl.oif))
                                         ip_rt_put(rt);
                                 goto do_next;
                         }
@@ -1506,11 +1511,12 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
         struct dst_entry *ret = dst;
 
         if (rt) {
-                if (dst->obsolete) {
+                if (dst->obsolete > 0) {
                         ip_rt_put(rt);
                         ret = NULL;
                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-                           rt->u.dst.expires) {
+                           (rt->u.dst.expires &&
+                            time_after_eq(jiffies, rt->u.dst.expires))) {
                         unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
                                                 rt->fl.oif,
                                                 rt_genid(dev_net(dst->dev)));
@@ -1726,7 +1732,9 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
 
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
 {
-        return NULL;
+        if (rt_is_expired((struct rtable *)dst))
+                return NULL;
+        return dst;
 }
 
 static void ipv4_dst_destroy(struct dst_entry *dst)
@@ -1888,7 +1896,8 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         if (!rth)
                 goto e_nobufs;
 
-        rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.output = ip_rt_bug;
+        rth->u.dst.obsolete = -1;
 
         atomic_set(&rth->u.dst.__refcnt, 1);
         rth->u.dst.flags= DST_HOST;
@@ -1927,7 +1936,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
 
         in_dev_put(in_dev);
         hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+        return rt_intern_hash(hash, rth, NULL, skb, dev->ifindex);
 
 e_nobufs:
         in_dev_put(in_dev);
@@ -2054,6 +2063,7 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->fl.oif     = 0;
         rth->rt_spec_dst= spec_dst;
 
+        rth->u.dst.obsolete = -1;
         rth->u.dst.input = ip_forward;
         rth->u.dst.output = ip_output;
         rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
@@ -2093,7 +2103,7 @@ static int ip_mkroute_input(struct sk_buff *skb,
         /* put it into the cache */
         hash = rt_hash(daddr, saddr, fl->iif,
                        rt_genid(dev_net(rth->u.dst.dev)));
-        return rt_intern_hash(hash, rth, NULL, skb);
+        return rt_intern_hash(hash, rth, NULL, skb, fl->iif);
 }
 
 /*
@@ -2218,6 +2228,7 @@ local_input:
                 goto e_nobufs;
 
         rth->u.dst.output= ip_rt_bug;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(net);
 
         atomic_set(&rth->u.dst.__refcnt, 1);
@@ -2249,7 +2260,7 @@ local_input:
         }
         rth->rt_type    = res.type;
         hash = rt_hash(daddr, saddr, fl.iif, rt_genid(net));
-        err = rt_intern_hash(hash, rth, NULL, skb);
+        err = rt_intern_hash(hash, rth, NULL, skb, fl.iif);
         goto done;
 
 no_route:
@@ -2444,6 +2455,7 @@ static int __mkroute_output(struct rtable **result,
         rth->rt_spec_dst= fl->fl4_src;
 
         rth->u.dst.output=ip_output;
+        rth->u.dst.obsolete = -1;
         rth->rt_genid = rt_genid(dev_net(dev_out));
 
         RT_CACHE_STAT_INC(out_slow_tot);
@@ -2495,7 +2507,7 @@ static int ip_mkroute_output(struct rtable **rp,
         if (err == 0) {
                 hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif,
                                rt_genid(dev_net(dev_out)));
-                err = rt_intern_hash(hash, rth, rp, NULL);
+                err = rt_intern_hash(hash, rth, rp, NULL, oldflp->oif);
         }
 
         return err;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5901010fad55..6afb6d8662b2 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -429,7 +429,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 if (tp->urg_seq == tp->copied_seq &&
                     !sock_flag(sk, SOCK_URGINLINE) &&
                     tp->urg_data)
-                        target--;
+                        target++;
 
                 /* Potential race condition. If read of tp below will
                  * escape above sk->sk_state, we can be illegally awaken
@@ -1254,6 +1254,39 @@ static void tcp_prequeue_process(struct sock *sk)
         tp->ucopy.memory = 0;
 }
 
+#ifdef CONFIG_NET_DMA
+static void tcp_service_net_dma(struct sock *sk, bool wait)
+{
+        dma_cookie_t done, used;
+        dma_cookie_t last_issued;
+        struct tcp_sock *tp = tcp_sk(sk);
+
+        if (!tp->ucopy.dma_chan)
+                return;
+
+        last_issued = tp->ucopy.dma_cookie;
+        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
+        do {
+                if (dma_async_memcpy_complete(tp->ucopy.dma_chan,
+                                              last_issued, &done,
+                                              &used) == DMA_SUCCESS) {
+                        /* Safe to free early-copied skbs now */
+                        __skb_queue_purge(&sk->sk_async_wait_queue);
+                        break;
+                } else {
+                        struct sk_buff *skb;
+                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
+                               (dma_async_is_complete(skb->dma_cookie, done,
+                                                      used) == DMA_SUCCESS)) {
+                                __skb_dequeue(&sk->sk_async_wait_queue);
+                                kfree_skb(skb);
+                        }
+                }
+        } while (wait);
+}
+#endif
+
 static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
@@ -1546,6 +1579,10 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* __ Set realtime policy in scheduler __ */
                 }
 
+#ifdef CONFIG_NET_DMA
+                if (tp->ucopy.dma_chan)
+                        dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+#endif
                 if (copied >= target) {
                         /* Do not sleep, just process backlog. */
                         release_sock(sk);
@@ -1554,6 +1591,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         sk_wait_data(sk, &timeo);
 
 #ifdef CONFIG_NET_DMA
+                tcp_service_net_dma(sk, false);  /* Don't block */
                 tp->ucopy.wakeup = 0;
 #endif
 
@@ -1633,6 +1671,9 @@ do_prequeue:
                                                 copied = -EFAULT;
                                         break;
                                 }
+
+                                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
+
                                 if ((offset + used) == skb->len)
                                         copied_early = 1;
 
@@ -1702,27 +1743,9 @@ skip_copy:
         }
 
 #ifdef CONFIG_NET_DMA
-        if (tp->ucopy.dma_chan) {
-                dma_cookie_t done, used;
-
-                dma_async_memcpy_issue_pending(tp->ucopy.dma_chan);
-
-                while (dma_async_memcpy_complete(tp->ucopy.dma_chan,
-                                                 tp->ucopy.dma_cookie, &done,
-                                                 &used) == DMA_IN_PROGRESS) {
-                        /* do partial cleanup of sk_async_wait_queue */
-                        while ((skb = skb_peek(&sk->sk_async_wait_queue)) &&
-                               (dma_async_is_complete(skb->dma_cookie, done,
-                                                      used) == DMA_SUCCESS)) {
-                                __skb_dequeue(&sk->sk_async_wait_queue);
-                                kfree_skb(skb);
-                        }
-                }
+        tcp_service_net_dma(sk, true);  /* Wait for queue to drain */
+        tp->ucopy.dma_chan = NULL;
 
-                /* Safe to free early-copied skbs now */
-                __skb_queue_purge(&sk->sk_async_wait_queue);
-                tp->ucopy.dma_chan = NULL;
-        }
         if (tp->ucopy.pinned_list) {
                 dma_unpin_iovec_pages(tp->ucopy.pinned_list);
                 tp->ucopy.pinned_list = NULL;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 788851ca8c5d..c096a4218b8f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2511,6 +2511,9 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
+        if (packets == 0)
+                return;
+
         WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 70df40980a87..f4df5f931f36 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -370,6 +370,11 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3381b4317c27..7e567ae5eaab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3610,7 +3610,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                 hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
-                        if (idx > s_idx)
+                        if (h > s_h || idx > s_idx)
                                 s_ip_idx = 0;
                         ip_idx = 0;
                         if ((idev = __in6_dev_get(dev)) == NULL)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52e0f74fdfe0..27acfb58650a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1113,6 +1113,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
         unsigned char ttls[MAXMIFS];
         int i;
 
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
+
         memset(ttls, 255, MAXMIFS);
         for (i = 0; i < MAXMIFS; i++) {
                 if (IF_ISSET(i, &mfc->mf6cc_ifset))
@@ -1692,17 +1695,20 @@ ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc6_net(c);
-        struct net_device *dev = net->ipv6.vif6_table[c->mf6c_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mf6c_parent > MAXMIFS)
+                return -ENOENT;
+
+        if (MIF_EXISTS(net, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index aef31a29de9e..b9cf7cd61923 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -13,7 +13,7 @@ static const struct xt_table packet_raw = {
         .valid_hooks = RAW_VALID_HOOKS,
         .me = THIS_MODULE,
         .af = NFPROTO_IPV6,
-        .priority = NF_IP6_PRI_FIRST,
+        .priority = NF_IP6_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 52cd3eff31dc..0d7713c5c206 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -879,7 +879,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                 return dst;
 
         return NULL;
@@ -890,12 +890,17 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
         struct rt6_info *rt = (struct rt6_info *) dst;
 
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt);
-                else
+                if (rt->rt6i_flags & RTF_CACHE) {
+                        if (rt6_check_expired(rt)) {
+                                ip6_del_rt(rt);
+                                dst = NULL;
+                        }
+                } else {
                         dst_release(dst);
+                        dst = NULL;
+                }
         }
-        return NULL;
+        return dst;
 }
 
 static void ip6_link_failure(struct sk_buff *skb)
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 368707882647..344145f23c34 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2129,10 +2129,9 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c
         int err;
 
         out_skb = pfkey_xfrm_policy2msg_prep(xp);
-        if (IS_ERR(out_skb)) {
-                err = PTR_ERR(out_skb);
-                goto out;
-        }
+        if (IS_ERR(out_skb))
+                return PTR_ERR(out_skb);
+
         err = pfkey_xfrm_policy2msg(out_skb, xp, dir);
         if (err < 0)
                 return err;
@@ -2148,7 +2147,6 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, struct km_event *c
         out_hdr->sadb_msg_seq = c->seq;
         out_hdr->sadb_msg_pid = c->pid;
         pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
-out:
         return 0;
 
 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2b2af631d2b8..569410a85953 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -582,7 +582,9 @@ nla_put_failure:
 nlmsg_failure:
         kfree_skb(skb);
 errout:
-        nfnetlink_set_err(net, 0, group, -ENOBUFS);
+        if (nfnetlink_set_err(net, 0, group, -ENOBUFS) > 0)
+                return -ENOBUFS;
+
         return 0;
 }
 #endif /* CONFIG_NF_CONNTRACK_EVENTS */
diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
index 8eb0cc23ada3..6afa3d52ea5f 100644
--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -113,9 +113,9 @@ int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 pid,
 }
 EXPORT_SYMBOL_GPL(nfnetlink_send);
 
-void nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error)
+int nfnetlink_set_err(struct net *net, u32 pid, u32 group, int error)
 {
-        netlink_set_err(net->nfnl, pid, group, error);
+        return netlink_set_err(net->nfnl, pid, group, error);
 }
 EXPORT_SYMBOL_GPL(nfnetlink_set_err);
 
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 9e9c48963942..215a64835de8 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -493,6 +493,7 @@ static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
         case 64 ... 95:
                 i[2] = maskl(i[2], p - 64);
                 i[3] = 0;
+                break;
         case 96 ... 127:
                 i[3] = maskl(i[3], p - 96);
                 break;
@@ -879,7 +880,8 @@ static void dl_seq_stop(struct seq_file *s, void *v)
         struct xt_hashlimit_htable *htable = s->private;
         unsigned int *bucket = (unsigned int *)v;
 
-        kfree(bucket);
+        if (!IS_ERR(bucket))
+                kfree(bucket);
         spin_unlock_bh(&htable->lock);
 }
 
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 7073dbb8100c..971d172afece 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -267,7 +267,7 @@ recent_mt(const struct sk_buff *skb, const struct xt_match_param *par)
                 for (i = 0; i < e->nstamps; i++) {
                         if (info->seconds && time_after(time, e->stamps[i]))
                                 continue;
-                        if (info->hit_count && ++hits >= info->hit_count) {
+                        if (!info->hit_count || ++hits >= info->hit_count) {
                                 ret = !ret;
                                 break;
                         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 320d0423a240..acbbae1e89b5 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1093,6 +1093,7 @@ static inline int do_one_set_err(struct sock *sk,
                                  struct netlink_set_err_data *p)
 {
         struct netlink_sock *nlk = nlk_sk(sk);
+        int ret = 0;
 
         if (sk == p->exclude_sk)
                 goto out;
@@ -1104,10 +1105,15 @@ static inline int do_one_set_err(struct sock *sk,
             !test_bit(p->group - 1, nlk->groups))
                 goto out;
 
+        if (p->code == ENOBUFS && nlk->flags & NETLINK_RECV_NO_ENOBUFS) {
+                ret = 1;
+                goto out;
+        }
+
         sk->sk_err = p->code;
         sk->sk_error_report(sk);
 out:
-        return 0;
+        return ret;
 }
 
 /**
@@ -1116,12 +1122,16 @@ out:
  * @pid: the PID of a process that we want to skip (if any)
  * @groups: the broadcast group that will notice the error
  * @code: error code, must be negative (as usual in kernelspace)
+ *
+ * This function returns the number of broadcast listeners that have set the
+ * NETLINK_RECV_NO_ENOBUFS socket option.
  */
-void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
+int netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
 {
         struct netlink_set_err_data info;
         struct hlist_node *node;
         struct sock *sk;
+        int ret = 0;
 
         info.exclude_sk = ssk;
         info.pid = pid;
@@ -1132,9 +1142,10 @@ void netlink_set_err(struct sock *ssk, u32 pid, u32 group, int code)
         read_lock(&nl_table_lock);
 
         sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
-                do_one_set_err(sk, &info);
+                ret += do_one_set_err(sk, &info);
 
         read_unlock(&nl_table_lock);
+        return ret;
 }
 EXPORT_SYMBOL(netlink_set_err);
 
diff --git a/net/rxrpc/ar-accept.c b/net/rxrpc/ar-accept.c
index 77228f28fa36..2d744f22a9a1 100644
--- a/net/rxrpc/ar-accept.c
+++ b/net/rxrpc/ar-accept.c
@@ -88,6 +88,11 @@ static int rxrpc_accept_incoming_call(struct rxrpc_local *local,
 
         /* get a notification message to send to the server app */
         notification = alloc_skb(0, GFP_NOFS);
+        if (!notification) {
+                _debug("no memory");
+                ret = -ENOMEM;
+                goto error_nofree;
+        }
         rxrpc_new_skb(notification);
         notification->mark = RXRPC_SKB_MARK_NEW_CALL;
 
@@ -189,6 +194,7 @@ invalid_service:
         ret = -ECONNREFUSED;
 error:
         rxrpc_free_skb(notification);
+error_nofree:
         _leave(" = %d", ret);
         return ret;
 }
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 21f9c7678aa3..2f691fb180d1 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -328,13 +328,16 @@ config NET_CLS_FLOW
           module will be called cls_flow.
 
 config NET_CLS_CGROUP
-        bool "Control Group Classifier"
+        tristate "Control Group Classifier"
         select NET_CLS
         depends on CGROUPS
         ---help---
           Say Y here if you want to classify packets based on the control
           cgroup of their process.
 
+          To compile this code as a module, choose M here: the
+          module will be called cls_cgroup.
+
 config NET_EMATCH
         bool "Extended Matches"
         select NET_CLS
diff --git a/net/sched/cls_cgroup.c b/net/sched/cls_cgroup.c
index e4877ca6727c..7f27d2c15e08 100644
--- a/net/sched/cls_cgroup.c
+++ b/net/sched/cls_cgroup.c
@@ -24,6 +24,25 @@ struct cgroup_cls_state
         u32 classid;
 };
 
+static struct cgroup_subsys_state *cgrp_create(struct cgroup_subsys *ss,
+                                               struct cgroup *cgrp);
+static void cgrp_destroy(struct cgroup_subsys *ss, struct cgroup *cgrp);
+static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp);
+
+struct cgroup_subsys net_cls_subsys = {
+        .name           = "net_cls",
+        .create         = cgrp_create,
+        .destroy        = cgrp_destroy,
+        .populate       = cgrp_populate,
+#ifdef CONFIG_NET_CLS_CGROUP
+        .subsys_id      = net_cls_subsys_id,
+#else
+#define net_cls_subsys_id net_cls_subsys.subsys_id
+#endif
+        .module         = THIS_MODULE,
+};
+
+
 static inline struct cgroup_cls_state *cgrp_cls_state(struct cgroup *cgrp)
 {
         return container_of(cgroup_subsys_state(cgrp, net_cls_subsys_id),
@@ -79,14 +98,6 @@ static int cgrp_populate(struct cgroup_subsys *ss, struct cgroup *cgrp)
         return cgroup_add_files(cgrp, ss, ss_files, ARRAY_SIZE(ss_files));
 }
 
-struct cgroup_subsys net_cls_subsys = {
-        .name           = "net_cls",
-        .create         = cgrp_create,
-        .destroy        = cgrp_destroy,
-        .populate       = cgrp_populate,
-        .subsys_id      = net_cls_subsys_id,
-};
-
 struct cls_cgroup_head
 {
         u32                     handle;
@@ -277,12 +288,19 @@ static struct tcf_proto_ops cls_cgroup_ops __read_mostly = {
 
 static int __init init_cgroup_cls(void)
 {
-        return register_tcf_proto_ops(&cls_cgroup_ops);
+        int ret = register_tcf_proto_ops(&cls_cgroup_ops);
+        if (ret)
+                return ret;
+        ret = cgroup_load_subsys(&net_cls_subsys);
+        if (ret)
+                unregister_tcf_proto_ops(&cls_cgroup_ops);
+        return ret;
 }
 
 static void __exit exit_cgroup_cls(void)
 {
         unregister_tcf_proto_ops(&cls_cgroup_ops);
+        cgroup_unload_subsys(&net_cls_subsys);
 }
 
 module_init(init_cgroup_cls);
diff --git a/net/socket.c b/net/socket.c
index 769c386bd428..f55ffe9f8c87 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2135,6 +2135,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
                         break;
                 ++datagrams;
 
+                /* MSG_WAITFORONE turns on MSG_DONTWAIT after one packet */
+                if (flags & MSG_WAITFORONE)
+                        flags |= MSG_DONTWAIT;
+
                 if (timeout) {
                         ktime_get_ts(timeout);
                         *timeout = timespec_sub(end_time, *timeout);
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 0cfccc2a0297..c389ccf6437d 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -1280,9 +1280,8 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
         rqstp->rq_release_snd_buf = priv_release_snd_buf;
         return 0;
 out_free:
-        for (i--; i >= 0; i--) {
-                __free_page(rqstp->rq_enc_pages[i]);
-        }
+        rqstp->rq_enc_pages_num = i;
+        priv_release_snd_buf(rqstp);
 out:
         return -EAGAIN;
 }
diff --git a/net/sunrpc/bc_svc.c b/net/sunrpc/bc_svc.c
index 13f214f53120..f0c05d3311c1 100644
--- a/net/sunrpc/bc_svc.c
+++ b/net/sunrpc/bc_svc.c
@@ -37,21 +37,6 @@ SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #define RPCDBG_FACILITY RPCDBG_SVCDSP
 
-void bc_release_request(struct rpc_task *task)
-{
-        struct rpc_rqst *req = task->tk_rqstp;
-
-        dprintk("RPC:       bc_release_request: task= %p\n", task);
-
-        /*
-         * Release this request only if it's a backchannel
-         * preallocated request
-         */
-        if (!bc_prealloc(req))
-                return;
-        xprt_free_bc_request(req);
-}
-
 /* Empty callback ops */
 static const struct rpc_call_ops nfs41_callback_ops = {
 };
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 154034b675bd..19c9983d5360 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -659,6 +659,7 @@ struct rpc_task *rpc_run_bc_task(struct rpc_rqst *req,
         task = rpc_new_task(&task_setup_data);
         if (!task) {
                 xprt_free_bc_request(req);
+                task = ERR_PTR(-ENOMEM);
                 goto out;
         }
         task->tk_rqstp = req;
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 8d63f8fd29b7..20e30c6f8355 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -587,6 +587,8 @@ static struct dentry *__rpc_lookup_create_exclusive(struct dentry *parent,
         struct dentry *dentry;
 
         dentry = __rpc_lookup_create(parent, name);
+        if (IS_ERR(dentry))
+                return dentry;
         if (dentry->d_inode == NULL)
                 return dentry;
         dput(dentry);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 469de292c23c..42f09ade0044 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -46,6 +46,7 @@
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/metrics.h>
+#include <linux/sunrpc/bc_xprt.h>
 
 #include "sunrpc.h"
 
@@ -1032,21 +1033,16 @@ void xprt_release(struct rpc_task *task)
         if (req->rq_release_snd_buf)
                 req->rq_release_snd_buf(req);
 
-        /*
-         * Early exit if this is a backchannel preallocated request.
-         * There is no need to have it added to the RPC slot list.
-         */
-        if (is_bc_request)
-                return;
-
-        memset(req, 0, sizeof(*req));   /* mark unused */
-
         dprintk("RPC: %5u release request %p\n", task->tk_pid, req);
+        if (likely(!is_bc_request)) {
+                memset(req, 0, sizeof(*req));   /* mark unused */
 
-        spin_lock(&xprt->reserve_lock);
-        list_add(&req->rq_list, &xprt->free);
-        rpc_wake_up_next(&xprt->backlog);
-        spin_unlock(&xprt->reserve_lock);
+                spin_lock(&xprt->reserve_lock);
+                list_add(&req->rq_list, &xprt->free);
+                rpc_wake_up_next(&xprt->backlog);
+                spin_unlock(&xprt->reserve_lock);
+        } else
+                xprt_free_bc_request(req);
 }
 
 /**
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index e4839c07c913..9847c30b5001 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2251,9 +2251,6 @@ static struct rpc_xprt_ops xs_tcp_ops = {
         .buf_free               = rpc_free,
         .send_request           = xs_tcp_send_request,
         .set_retrans_timeout    = xprt_set_retrans_timeout_def,
-#if defined(CONFIG_NFS_V4_1)
-        .release_request        = bc_release_request,
-#endif /* CONFIG_NFS_V4_1 */
         .close                  = xs_tcp_close,
         .destroy                = xs_destroy,
         .print_stats            = xs_tcp_print_stats,
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index f76f3d13276d..6f97a13bcee4 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -284,7 +284,7 @@ foreach my $file (@ARGV) {
         my $file_cnt = @files;
         my $lastfile;
 
-        open(my $patch, '<', $file)
+        open(my $patch, "< $file")
             or die "$P: Can't open $file: $!\n";
         while (<$patch>) {
             my $patch_line = $_;
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index c7865c362d28..fcdfb245a575 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1424,6 +1424,8 @@ sub dump_struct($$) {
         $nested =~ s/\/\*.*?\*\///gos;
         # strip kmemcheck_bitfield_{begin,end}.*;
         $members =~ s/kmemcheck_bitfield_.*?;//gos;
+        # strip attributes
+        $members =~ s/__aligned\s*\(\d+\)//gos;
 
         create_parameterlist($members, ';', $file);
         check_sections($file, $declaration_name, "struct", $sectcheck, $struct_actual, $nested);
@@ -1728,6 +1730,7 @@ sub dump_function($$) {
     $prototype =~ s/^noinline +//;
     $prototype =~ s/__devinit +//;
     $prototype =~ s/__init +//;
+    $prototype =~ s/__init_or_module +//;
     $prototype =~ s/^#\s*define\s+//; #ak added
     $prototype =~ s/__attribute__\s*\(\([a-z,]*\)\)//;
 
diff --git a/sound/arm/pxa2xx-pcm-lib.c b/sound/arm/pxa2xx-pcm-lib.c
index 743ac6a29065..fd51fa8b06a1 100644
--- a/sound/arm/pxa2xx-pcm-lib.c
+++ b/sound/arm/pxa2xx-pcm-lib.c
@@ -205,6 +205,7 @@ int __pxa2xx_pcm_open(struct snd_pcm_substream *substream)
         if (!rtd->dma_desc_array)
                 goto err1;
 
+        rtd->dma_ch = -1;
         runtime->private_data = rtd;
         return 0;
 
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index b546ac2660f9..a2ff86189d2a 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -148,6 +148,9 @@ static void pcm_debug_name(struct snd_pcm_substream *substream,
 
 #define xrun_debug(substream, mask) \
                         ((substream)->pstr->xrun_debug & (mask))
+#else
+#define xrun_debug(substream, mask)     0
+#endif
 
 #define dump_stack_on_xrun(substream) do {                      \
                 if (xrun_debug(substream, XRUN_DEBUG_STACK))    \
@@ -169,6 +172,7 @@ static void xrun(struct snd_pcm_substream *substream)
         }
 }
 
+#ifdef CONFIG_SND_PCM_XRUN_DEBUG
 #define hw_ptr_error(substream, fmt, args...)                           \
         do {                                                            \
                 if (xrun_debug(substream, XRUN_DEBUG_BASIC)) {          \
@@ -255,8 +259,6 @@ static void xrun_log_show(struct snd_pcm_substream *substream)
 
 #else /* ! CONFIG_SND_PCM_XRUN_DEBUG */
 
-#define xrun_debug(substream, mask)     0
-#define xrun(substream)                 do { } while (0)
 #define hw_ptr_error(substream, fmt, args...) do { } while (0)
 #define xrun_log(substream, pos)        do { } while (0)
 #define xrun_log_show(substream)        do { } while (0)
diff --git a/sound/oss/vidc.c b/sound/oss/vidc.c
index 725fef0f59a3..a4127bab9231 100644
--- a/sound/oss/vidc.c
+++ b/sound/oss/vidc.c
@@ -363,13 +363,13 @@ static void vidc_audio_trigger(int dev, int enable_bits)
         struct audio_operations *adev = audio_devs[dev];
 
         if (enable_bits & PCM_ENABLE_OUTPUT) {
-                if (!(adev->flags & DMA_ACTIVE)) {
+                if (!(adev->dmap_out->flags & DMA_ACTIVE)) {
                         unsigned long flags;
 
                         local_irq_save(flags);
 
                         /* prevent recusion */
-                        adev->flags |= DMA_ACTIVE;
+                        adev->dmap_out->flags |= DMA_ACTIVE;
 
                         dma_interrupt = vidc_audio_dma_interrupt;
                         vidc_sound_dma_irq(0, NULL);
diff --git a/sound/pci/ac97/ac97_patch.c b/sound/pci/ac97/ac97_patch.c
index 1caf5e3c1f6a..e68c98ef4041 100644
--- a/sound/pci/ac97/ac97_patch.c
+++ b/sound/pci/ac97/ac97_patch.c
@@ -1852,12 +1852,14 @@ static unsigned int ad1981_jacks_blacklist[] = {
         0x10140523, /* Thinkpad R40 */
         0x10140534, /* Thinkpad X31 */
         0x10140537, /* Thinkpad T41p */
+        0x1014053e, /* Thinkpad R40e */
         0x10140554, /* Thinkpad T42p/R50p */
         0x10140567, /* Thinkpad T43p 2668-G7U */
         0x10140581, /* Thinkpad X41-2527 */
         0x10280160, /* Dell Dimension 2400 */
         0x104380b0, /* Asus A7V8X-MX */
         0x11790241, /* Toshiba Satellite A-15 S127 */
+        0x1179ff10, /* Toshiba P500 */
         0x144dc01a, /* Samsung NP-X20C004/SEG */
         0 /* end */
 };
diff --git a/sound/pci/cmipci.c b/sound/pci/cmipci.c
index 1ded64e05643..329968edca9b 100644
--- a/sound/pci/cmipci.c
+++ b/sound/pci/cmipci.c
@@ -941,13 +941,21 @@ static snd_pcm_uframes_t snd_cmipci_pcm_pointer(struct cmipci *cm, struct cmipci
                                                 struct snd_pcm_substream *substream)
 {
         size_t ptr;
-        unsigned int reg;
+        unsigned int reg, rem, tries;
+
         if (!rec->running)
                 return 0;
 #if 1 // this seems better..
         reg = rec->ch ? CM_REG_CH1_FRAME2 : CM_REG_CH0_FRAME2;
-        ptr = rec->dma_size - (snd_cmipci_read_w(cm, reg) + 1);
-        ptr >>= rec->shift;
+        for (tries = 0; tries < 3; tries++) {
+                rem = snd_cmipci_read_w(cm, reg);
+                if (rem < rec->dma_size)
+                        goto ok;
+        } 
+        printk(KERN_ERR "cmipci: invalid PCM pointer: %#x\n", rem);
+        return SNDRV_PCM_POS_XRUN;
+ok:
+        ptr = (rec->dma_size - (rem + 1)) >> rec->shift;
 #else
         reg = rec->ch ? CM_REG_CH1_FRAME1 : CM_REG_CH0_FRAME1;
         ptr = snd_cmipci_read(cm, reg) - rec->offset;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8b2915631cc3..4bb90675f70f 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2269,6 +2269,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
         SND_PCI_QUIRK(0x103c, 0x306d, "HP dv3", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1106, 0x3288, "ASUS M2V-MX SE", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1043, 0x813d, "ASUS P5AD2", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 194a28c54992..61682e1d09da 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1591,6 +1591,21 @@ static int patch_cxt5047(struct hda_codec *codec)
 #endif  
         }
         spec->vmaster_nid = 0x13;
+
+        switch (codec->subsystem_id >> 16) {
+        case 0x103c:
+                /* HP laptops have really bad sound over 0 dB on NID 0x10.
+                 * Fix max PCM level to 0 dB (originally it has 0x1e steps
+                 * with 0 dB offset 0x17)
+                 */
+                snd_hda_override_amp_caps(codec, 0x10, HDA_INPUT,
+                                          (0x17 << AC_AMPCAP_OFFSET_SHIFT) |
+                                          (0x17 << AC_AMPCAP_NUM_STEPS_SHIFT) |
+                                          (0x05 << AC_AMPCAP_STEP_SIZE_SHIFT) |
+                                          (1 << AC_AMPCAP_MUTE_SHIFT));
+                break;
+        }
+
         return 0;
 }
 
diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
index 70669a246902..3c10c0b149f4 100644
--- a/sound/pci/hda/patch_nvhdmi.c
+++ b/sound/pci/hda/patch_nvhdmi.c
@@ -538,8 +538,6 @@ static int patch_nvhdmi_2ch(struct hda_codec *codec)
  * patch entries
  */
 static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
-        { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
-        { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
         { .id = 0x10de0002, .name = "MCP77/78 HDMI",
           .patch = patch_nvhdmi_8ch_7x },
         { .id = 0x10de0003, .name = "MCP77/78 HDMI",
@@ -550,12 +548,16 @@ static struct hda_codec_preset snd_hda_preset_nvhdmi[] = {
           .patch = patch_nvhdmi_8ch_7x },
         { .id = 0x10de0007, .name = "MCP79/7A HDMI",
           .patch = patch_nvhdmi_8ch_7x },
-        { .id = 0x10de000c, .name = "MCP89 HDMI",
+        { .id = 0x10de000a, .name = "GT220 HDMI",
           .patch = patch_nvhdmi_8ch_89 },
         { .id = 0x10de000b, .name = "GT21x HDMI",
           .patch = patch_nvhdmi_8ch_89 },
+        { .id = 0x10de000c, .name = "MCP89 HDMI",
+          .patch = patch_nvhdmi_8ch_89 },
         { .id = 0x10de000d, .name = "GT240 HDMI",
           .patch = patch_nvhdmi_8ch_89 },
+        { .id = 0x10de0067, .name = "MCP67 HDMI", .patch = patch_nvhdmi_2ch },
+        { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
         {} /* terminator */
 };
 
@@ -564,11 +566,12 @@ MODULE_ALIAS("snd-hda-codec-id:10de0003");
 MODULE_ALIAS("snd-hda-codec-id:10de0005");
 MODULE_ALIAS("snd-hda-codec-id:10de0006");
 MODULE_ALIAS("snd-hda-codec-id:10de0007");
-MODULE_ALIAS("snd-hda-codec-id:10de0067");
-MODULE_ALIAS("snd-hda-codec-id:10de8001");
-MODULE_ALIAS("snd-hda-codec-id:10de000c");
+MODULE_ALIAS("snd-hda-codec-id:10de000a");
 MODULE_ALIAS("snd-hda-codec-id:10de000b");
+MODULE_ALIAS("snd-hda-codec-id:10de000c");
 MODULE_ALIAS("snd-hda-codec-id:10de000d");
+MODULE_ALIAS("snd-hda-codec-id:10de0067");
+MODULE_ALIAS("snd-hda-codec-id:10de8001");
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("NVIDIA HDMI HD-audio codec");
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4ec57633af88..9a23444e9e7a 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2532,8 +2532,6 @@ static int alc_build_controls(struct hda_codec *codec)
                         return err;
         }
 
-        alc_free_kctls(codec); /* no longer needed */
-
         /* assign Capture Source enums to NID */
         kctl = snd_hda_find_mixer_ctl(codec, "Capture Source");
         if (!kctl)
@@ -2602,6 +2600,9 @@ static int alc_build_controls(struct hda_codec *codec)
                         }
                 }
         }
+
+        alc_free_kctls(codec); /* no longer needed */
+
         return 0;
 }
 
@@ -10042,8 +10043,11 @@ static void alc882_auto_set_output_and_unmute(struct hda_codec *codec,
         alc_set_pin_output(codec, nid, pin_type);
         if (spec->multiout.dac_nids[dac_idx] == 0x25)
                 idx = 4;
-        else
+        else {
+                if (spec->multiout.num_dacs >= dac_idx)
+                        return;
                 idx = spec->multiout.dac_nids[dac_idx] - 2;
+        }
         snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_CONNECT_SEL, idx);
 
 }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 8c416bb18a57..c4be3fab94e5 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1730,6 +1730,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                       "HP HDX", STAC_HP_HDX),  /* HDX16 */
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3620,
                       "HP dv6", STAC_HP_DV5),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061,
+                      "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */
         SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
                       "HP", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
diff --git a/sound/soc/codecs/tlv320dac33.c b/sound/soc/codecs/tlv320dac33.c
index f9f367d29a90..d50f1699ccb2 100644
--- a/sound/soc/codecs/tlv320dac33.c
+++ b/sound/soc/codecs/tlv320dac33.c
@@ -778,7 +778,7 @@ static int dac33_prepare_chip(struct snd_pcm_substream *substream)
         if (dac33->fifo_mode) {
                 /* Generic for all FIFO modes */
                 /* 50-51 : ASRC Control registers */
-                dac33_write(codec, DAC33_ASRC_CTRL_A, (1 << 4)); /* div=2 */
+                dac33_write(codec, DAC33_ASRC_CTRL_A, DAC33_SRCLKDIV(1));
                 dac33_write(codec, DAC33_ASRC_CTRL_B, 1); /* ??? */
 
                 /* Write registers 0x34 and 0x35 (MSB, LSB) */
@@ -1038,11 +1038,7 @@ static int dac33_set_dai_fmt(struct snd_soc_dai *codec_dai,
         case SND_SOC_DAIFMT_DSP_A:
                 aictrl_a |= DAC33_AFMT_DSP;
                 aictrl_b &= ~DAC33_DATA_DELAY_MASK;
-                aictrl_b |= DAC33_DATA_DELAY(1); /* 1 bit delay */
-                break;
-        case SND_SOC_DAIFMT_DSP_B:
-                aictrl_a |= DAC33_AFMT_DSP;
-                aictrl_b &= ~DAC33_DATA_DELAY_MASK; /* No delay */
+                aictrl_b |= DAC33_DATA_DELAY(0);
                 break;
         case SND_SOC_DAIFMT_RIGHT_J:
                 aictrl_a |= DAC33_AFMT_RIGHT_J;
@@ -1066,7 +1062,7 @@ static void dac33_init_chip(struct snd_soc_codec *codec)
 {
         /* 44-46: DAC Control Registers */
         /* A : DAC sample rate Fsref/1.5 */
-        dac33_write(codec, DAC33_DAC_CTRL_A, DAC33_DACRATE(1));
+        dac33_write(codec, DAC33_DAC_CTRL_A, DAC33_DACRATE(0));
         /* B : DAC src=normal, not muted */
         dac33_write(codec, DAC33_DAC_CTRL_B, DAC33_DACSRCR_RIGHT |
                                              DAC33_DACSRCL_LEFT);
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index 0ad9f5d536c6..486bdd21a98a 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -74,7 +74,7 @@ static void wait_for_dc_servo(struct snd_soc_codec *codec)
                 msleep(1);
                 reg = snd_soc_read(codec, WM8993_DC_SERVO_READBACK_0);
                 dev_dbg(codec->dev, "DC servo: %x\n", reg);
-        } while (reg & WM8993_DCS_DATAPATH_BUSY);
+        } while (reg & WM8993_DCS_DATAPATH_BUSY && count < 400);
 
         if (reg & WM8993_DCS_DATAPATH_BUSY)
                 dev_err(codec->dev, "Timed out waiting for DC Servo\n");
diff --git a/sound/soc/imx/Kconfig b/sound/soc/imx/Kconfig
index c7d0fd9b7de8..7174b4c710de 100644
--- a/sound/soc/imx/Kconfig
+++ b/sound/soc/imx/Kconfig
@@ -1,6 +1,6 @@
 config SND_IMX_SOC
         tristate "SoC Audio for Freescale i.MX CPUs"
-        depends on ARCH_MXC && BROKEN
+        depends on ARCH_MXC
         select SND_PCM
         select FIQ
         select SND_SOC_AC97_BUS
diff --git a/sound/soc/sh/Kconfig b/sound/soc/sh/Kconfig
index 106674979b53..f07f6d8b93e1 100644
--- a/sound/soc/sh/Kconfig
+++ b/sound/soc/sh/Kconfig
@@ -32,6 +32,7 @@ config SND_SOC_SH4_SIU
         select DMA_ENGINE
         select DMADEVICES
         select SH_DMAE
+        select FW_LOADER
 
 ##
 ## Boards
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index c30a33592340..152d6c9b1fa4 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -47,7 +47,6 @@
 #include "util/probe-event.h"
 
 #define MAX_PATH_LEN 256
-#define MAX_PROBES 128
 
 /* Session management structure */
 static struct {
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 0b719e3dde05..1f529321607e 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -455,7 +455,7 @@ static void print_sym_table(void)
         struct sym_entry *syme, *n;
         struct rb_root tmp = RB_ROOT;
         struct rb_node *nd;
-        int sym_width = 0, dso_width = 0, max_dso_width;
+        int sym_width = 0, dso_width = 0, dso_short_width = 0;
         const int win_width = winsize.ws_col - 1;
 
         samples = userspace_samples = 0;
@@ -545,15 +545,20 @@ static void print_sym_table(void)
                 if (syme->map->dso->long_name_len > dso_width)
                         dso_width = syme->map->dso->long_name_len;
 
+                if (syme->map->dso->short_name_len > dso_short_width)
+                        dso_short_width = syme->map->dso->short_name_len;
+
                 if (syme->name_len > sym_width)
                         sym_width = syme->name_len;
         }
 
         printed = 0;
 
-        max_dso_width = winsize.ws_col - sym_width - 29;
-        if (dso_width > max_dso_width)
-                dso_width = max_dso_width;
+        if (sym_width + dso_width > winsize.ws_col - 29) {
+                dso_width = dso_short_width;
+                if (sym_width + dso_width > winsize.ws_col - 29)
+                        sym_width = winsize.ws_col - dso_width - 29;
+        }
         putchar('\n');
         if (nr_counters == 1)
                 printf("             samples  pcnt");
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 53181dbfe4a8..7c004b6ef24f 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -242,7 +242,7 @@ void parse_perf_probe_event(const char *str, struct probe_point *pp,
 
         /* Parse probe point */
         parse_perf_probe_probepoint(argv[0], pp);
-        if (pp->file || pp->line)
+        if (pp->file || pp->line || pp->lazy_line)
                 *need_dwarf = true;
 
         /* Copy arguments and ensure return probe has no C argument */
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 1e6c65ebbd80..c171a243d05b 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -333,8 +333,8 @@ static void show_location(Dwarf_Op *op, struct probe_finder *pf)
                 die("%u exceeds max register number.", regn);
 
         if (deref)
-                ret = snprintf(pf->buf, pf->len, " %s=+%ju(%s)",
-                               pf->var, (uintmax_t)offs, regs);
+                ret = snprintf(pf->buf, pf->len, " %s=%+jd(%s)",
+                               pf->var, (intmax_t)offs, regs);
         else
                 ret = snprintf(pf->buf, pf->len, " %s=%s", pf->var, regs);
         DIE_IF(ret < 0);
@@ -352,8 +352,7 @@ static void show_variable(Dwarf_Die *vr_die, struct probe_finder *pf)
         if (dwarf_attr(vr_die, DW_AT_location, &attr) == NULL)
                 goto error;
         /* TODO: handle more than 1 exprs */
-        ret = dwarf_getlocation_addr(&attr, (pf->addr - pf->cu_base),
-                                     &expr, &nexpr, 1);
+        ret = dwarf_getlocation_addr(&attr, pf->addr, &expr, &nexpr, 1);
         if (ret <= 0 || nexpr == 0)
                 goto error;
 
@@ -437,8 +436,7 @@ static void show_probe_point(Dwarf_Die *sp_die, struct probe_finder *pf)
 
         /* Get the frame base attribute/ops */
         dwarf_attr(sp_die, DW_AT_frame_base, &fb_attr);
-        ret = dwarf_getlocation_addr(&fb_attr, (pf->addr - pf->cu_base),
-                                     &pf->fb_ops, &nops, 1);
+        ret = dwarf_getlocation_addr(&fb_attr, pf->addr, &pf->fb_ops, &nops, 1);
         if (ret <= 0 || nops == 0)
                 pf->fb_ops = NULL;
 
@@ -455,6 +453,9 @@ static void show_probe_point(Dwarf_Die *sp_die, struct probe_finder *pf)
         /* *pf->fb_ops will be cached in libdw. Don't free it. */
         pf->fb_ops = NULL;
 
+        if (pp->found == MAX_PROBES)
+                die("Too many( > %d) probe point found.\n", MAX_PROBES);
+
         pp->probes[pp->found] = strdup(tmp);
         pp->found++;
 }
@@ -641,7 +642,6 @@ static void find_probe_point_by_func(struct probe_finder *pf)
 int find_probe_point(int fd, struct probe_point *pp)
 {
         struct probe_finder pf = {.pp = pp};
-        int ret;
         Dwarf_Off off, noff;
         size_t cuhl;
         Dwarf_Die *diep;
@@ -668,10 +668,6 @@ int find_probe_point(int fd, struct probe_point *pp)
                         pf.fname = NULL;
 
                 if (!pp->file || pf.fname) {
-                        /* Save CU base address (for frame_base) */
-                        ret = dwarf_lowpc(&pf.cu_die, &pf.cu_base);
-                        if (ret != 0)
-                                pf.cu_base = 0;
                         if (pp->function)
                                 find_probe_point_by_func(&pf);
                         else if (pp->lazy_line)
diff --git a/tools/perf/util/probe-finder.h b/tools/perf/util/probe-finder.h
index d1a651793ba6..21f7354397b4 100644
--- a/tools/perf/util/probe-finder.h
+++ b/tools/perf/util/probe-finder.h
@@ -71,7 +71,6 @@ struct probe_finder {
 
         /* For variable searching */
         Dwarf_Op                *fb_ops;        /* Frame base attribute */
-        Dwarf_Addr              cu_base;        /* Current CU base address */
         const char              *var;           /* Current variable name */
         char                    *buf;           /* Current output buffer */
         int                     len;            /* Length of output buffer */
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 323c0aea0a91..c458c4a371d1 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -163,9 +163,17 @@ void dso__set_long_name(struct dso *self, char *name)
         self->long_name_len = strlen(name);
 }
 
+static void dso__set_short_name(struct dso *self, const char *name)
+{
+        if (name == NULL)
+                return;
+        self->short_name = name;
+        self->short_name_len = strlen(name);
+}
+
 static void dso__set_basename(struct dso *self)
 {
-        self->short_name = basename(self->long_name);
+        dso__set_short_name(self, basename(self->long_name));
 }
 
 struct dso *dso__new(const char *name)
@@ -176,7 +184,7 @@ struct dso *dso__new(const char *name)
                 int i;
                 strcpy(self->name, name);
                 dso__set_long_name(self, self->name);
-                self->short_name = self->name;
+                dso__set_short_name(self, self->name);
                 for (i = 0; i < MAP__NR_TYPES; ++i)
                         self->symbols[i] = self->symbol_names[i] = RB_ROOT;
                 self->slen_calculated = 0;
@@ -897,7 +905,6 @@ static int dso__load_sym(struct dso *self, struct map *map, const char *name,
         struct kmap *kmap = self->kernel ? map__kmap(map) : NULL;
         struct map *curr_map = map;
         struct dso *curr_dso = self;
-        size_t dso_name_len = strlen(self->short_name);
         Elf_Data *symstrs, *secstrs;
         uint32_t nr_syms;
         int err = -1;
@@ -987,7 +994,8 @@ static int dso__load_sym(struct dso *self, struct map *map, const char *name,
                         char dso_name[PATH_MAX];
 
                         if (strcmp(section_name,
-                                   curr_dso->short_name + dso_name_len) == 0)
+                                   (curr_dso->short_name +
+                                    self->short_name_len)) == 0)
                                 goto new_symbol;
 
                         if (strcmp(section_name, ".text") == 0) {
@@ -1782,7 +1790,7 @@ struct dso *dso__new_kernel(const char *name)
         struct dso *self = dso__new(name ?: "[kernel.kallsyms]");
 
         if (self != NULL) {
-                self->short_name = "[kernel]";
+                dso__set_short_name(self, "[kernel]");
                 self->kernel     = 1;
         }
 
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 280dadd32a08..f30a37428919 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -110,9 +110,10 @@ struct dso {
         u8               sorted_by_name;
         u8               loaded;
         u8               build_id[BUILD_ID_SIZE];
-        u16              long_name_len;
         const char       *short_name;
         char             *long_name;
+        u16              long_name_len;
+        u16              short_name_len;
         char             name[0];
 };