Merge branch 'master' of /Volumes/CaseSensitiveDisk/linux

154 files changed, 1223 insertions, 660 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 924fb0bb52e0..7fe9bb245bd3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -269,7 +269,6 @@ S:	Orphan
 F:      drivers/platform/x86/wmi.c
 
 AD1889 ALSA SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 M:      Thibaut Varene <T-Bone@parisc-linux.org>
 W:      http://wiki.parisc-linux.org/AD1889
 L:      linux-parisc@vger.kernel.org
@@ -3047,7 +3046,6 @@ F:	drivers/hwspinlock/hwspinlock_*
 F:      include/linux/hwspinlock.h
 
 HARMONY SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 L:      linux-parisc@vger.kernel.org
 S:      Maintained
 F:      sound/parisc/harmony.*
@@ -3782,7 +3780,7 @@ F:	Documentation/kdump/
 
 KERNEL AUTOMOUNTER v4 (AUTOFS4)
 M:      Ian Kent <raven@themaw.net>
-L:      autofs@linux.kernel.org
+L:      autofs@vger.kernel.org
 S:      Maintained
 F:      fs/autofs4/
 
@@ -5000,9 +4998,8 @@ F:	Documentation/blockdev/paride.txt
 F:      drivers/block/paride/
 
 PARISC ARCHITECTURE
-M:      Kyle McMartin <kyle@mcmartin.ca>
-M:      Helge Deller <deller@gmx.de>
 M:      "James E.J. Bottomley" <jejb@parisc-linux.org>
+M:      Helge Deller <deller@gmx.de>
 L:      linux-parisc@vger.kernel.org
 W:      http://www.parisc-linux.org/
 Q:      http://patchwork.kernel.org/project/linux-parisc/list/
diff --git a/Makefile b/Makefile
index 4ddd641ab615..b61a9638b6fc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index eff8a96c75ee..068b754bc348 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -30,6 +30,7 @@
 #include <linux/serial_sci.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/mmc/host.h>
@@ -37,7 +38,6 @@
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/mfd/tmio.h>
 #include <linux/sh_clk.h>
-#include <linux/dma-mapping.h>
 #include <video/sh_mobile_lcdc.h>
 #include <video/sh_mipi_dsi.h>
 #include <sound/sh_fsi.h>
@@ -159,19 +159,12 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
 static struct sh_mmcif_plat_data sh_mmcif_platdata = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195,
         .caps           = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device mmc_device = {
@@ -321,12 +314,11 @@ static struct resource mipidsi0_resources[] = {
         },
 };
 
-#define DSI0PHYCR       0xe615006c
 static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                                  void __iomem *base,
                                  int enable)
 {
-        struct clk *pck;
+        struct clk *pck, *phy;
         int ret;
 
         pck = clk_get(&pdev->dev, "dsip_clk");
@@ -335,18 +327,27 @@ static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                 goto sh_mipi_set_dot_clock_pck_err;
         }
 
+        phy = clk_get(&pdev->dev, "dsiphy_clk");
+        if (IS_ERR(phy)) {
+                ret = PTR_ERR(phy);
+                goto sh_mipi_set_dot_clock_phy_err;
+        }
+
         if (enable) {
                 clk_set_rate(pck, clk_round_rate(pck,  24000000));
-                __raw_writel(0x2a809010, DSI0PHYCR);
+                clk_set_rate(phy, clk_round_rate(pck, 510000000));
                 clk_enable(pck);
+                clk_enable(phy);
         } else {
                 clk_disable(pck);
+                clk_disable(phy);
         }
 
         ret = 0;
 
+        clk_put(phy);
+sh_mipi_set_dot_clock_phy_err:
         clk_put(pck);
-
 sh_mipi_set_dot_clock_pck_err:
         return ret;
 }
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index aab0a349f759..eeb4d9664584 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -295,15 +295,6 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -311,7 +302,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                           MMC_CAP_8_BIT_DATA |
                           MMC_CAP_NEEDS_POLL,
         .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/arm/mach-shmobile/board-kota2.c b/arch/arm/mach-shmobile/board-kota2.c
index 857ceeec1bb0..c8e7ca23fc06 100644
--- a/arch/arm/mach-shmobile/board-kota2.c
+++ b/arch/arm/mach-shmobile/board-kota2.c
@@ -143,11 +143,10 @@ static struct gpio_keys_button gpio_buttons[] = {
 static struct gpio_keys_platform_data gpio_key_info = {
         .buttons        = gpio_buttons,
         .nbuttons       = ARRAY_SIZE(gpio_buttons),
-        .poll_interval  = 250, /* polled for now */
 };
 
 static struct platform_device gpio_keys_device = {
-        .name   = "gpio-keys-polled", /* polled for now */
+        .name   = "gpio-keys",
         .id     = -1,
         .dev    = {
                 .platform_data  = &gpio_key_info,
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 9b42fbd10f8e..a2813247b455 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -43,7 +43,6 @@
 #include <linux/smsc911x.h>
 #include <linux/sh_intc.h>
 #include <linux/tca6416_keypad.h>
-#include <linux/usb/r8a66597.h>
 #include <linux/usb/renesas_usbhs.h>
 #include <linux/dma-mapping.h>
 
@@ -145,11 +144,6 @@
  * 1-2 short | VBUS 5V       | Host
  * open      | external VBUS | Function
  *
- * *1
- * CN31 is used as
- * CONFIG_USB_R8A66597_HCD      Host
- * CONFIG_USB_RENESAS_USBHS     Function
- *
  * CAUTION
  *
  * renesas_usbhs driver can use external interrupt mode
@@ -161,15 +155,6 @@
  * mackerel can not use external interrupt (IRQ7-PORT167) mode on "USB0",
  * because Touchscreen is using IRQ7-PORT40.
  * It is impossible to use IRQ7 demux on this board.
- *
- * We can use external interrupt mode USB-Function on "USB1".
- * USB1 can become Host by r8a66597, and become Function by renesas_usbhs.
- * But don't select both drivers in same time.
- * These uses same IRQ number for request_irq(), and aren't supporting
- * IRQF_SHARED / IORESOURCE_IRQ_SHAREABLE.
- *
- * Actually these are old/new version of USB driver.
- * This mean its register will be broken if it supports shared IRQ,
  */
 
 /*
@@ -208,6 +193,16 @@
  */
 
 /*
+ * FSI - AK4642
+ *
+ * it needs amixer settings for playing
+ *
+ * amixer set "Headphone" on
+ * amixer set "HPOUTL Mixer DACH" on
+ * amixer set "HPOUTR Mixer DACH" on
+ */
+
+/*
  * FIXME !!
  *
  * gpio_no_direction
@@ -676,51 +671,16 @@ static struct platform_device usbhs0_device = {
  * Use J30 to select between Host and Function. This setting
  * can however not be detected by software. Hotplug of USBHS1
  * is provided via IRQ8.
+ *
+ * Current USB1 works as "USB Host".
+ *  - set J30 "short"
+ *
+ * If you want to use it as "USB gadget",
+ *  - J30 "open"
+ *  - modify usbhs1_get_id() USBHS_HOST -> USBHS_GADGET
+ *  - add .get_vbus = usbhs_get_vbus in usbhs1_private
  */
 #define IRQ8 evt2irq(0x0300)
-
-/* USBHS1 USB Host support via r8a66597_hcd */
-static void usb1_host_port_power(int port, int power)
-{
-        if (!power) /* only power-on is supported for now */
-                return;
-
-        /* set VBOUT/PWEN and EXTLP1 in DVSTCTR */
-        __raw_writew(__raw_readw(0xE68B0008) | 0x600, 0xE68B0008);
-}
-
-static struct r8a66597_platdata usb1_host_data = {
-        .on_chip        = 1,
-        .port_power     = usb1_host_port_power,
-};
-
-static struct resource usb1_host_resources[] = {
-        [0] = {
-                .name   = "USBHS1",
-                .start  = 0xe68b0000,
-                .end    = 0xe68b00e6 - 1,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = evt2irq(0x1ce0) /* USB1_USB1I0 */,
-                .flags  = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device usb1_host_device = {
-        .name   = "r8a66597_hcd",
-        .id     = 1,
-        .dev = {
-                .dma_mask               = NULL,         /*  not use dma */
-                .coherent_dma_mask      = 0xffffffff,
-                .platform_data          = &usb1_host_data,
-        },
-        .num_resources  = ARRAY_SIZE(usb1_host_resources),
-        .resource       = usb1_host_resources,
-};
-
-/* USBHS1 USB Function support via renesas_usbhs */
-
 #define USB_PHY_MODE            (1 << 4)
 #define USB_PHY_INT_EN          ((1 << 3) | (1 << 2))
 #define USB_PHY_ON              (1 << 1)
@@ -776,7 +736,7 @@ static void usbhs1_hardware_exit(struct platform_device *pdev)
 
 static int usbhs1_get_id(struct platform_device *pdev)
 {
-        return USBHS_GADGET;
+        return USBHS_HOST;
 }
 
 static u32 usbhs1_pipe_cfg[] = {
@@ -807,7 +767,6 @@ static struct usbhs_private usbhs1_private = {
                         .hardware_exit  = usbhs1_hardware_exit,
                         .get_id         = usbhs1_get_id,
                         .phy_reset      = usbhs_phy_reset,
-                        .get_vbus       = usbhs_get_vbus,
                 },
                 .driver_param = {
                         .buswait_bwait  = 4,
@@ -1184,15 +1143,6 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -1200,7 +1150,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                           MMC_CAP_8_BIT_DATA |
                           MMC_CAP_NEEDS_POLL,
         .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
@@ -1311,7 +1262,6 @@ static struct platform_device *mackerel_devices[] __initdata = {
         &nor_flash_device,
         &smc911x_device,
         &lcdc_device,
-        &usb1_host_device,
         &usbhs1_device,
         &usbhs0_device,
         &leds_device,
@@ -1473,9 +1423,6 @@ static void __init mackerel_init(void)
         gpio_pull_down(GPIO_PORT167CR); /* VBUS0_1 pull down */
         gpio_request(GPIO_FN_IDIN_1_113, NULL);
 
-        /* USB phy tweak to make the r8a66597_hcd host driver work */
-        __raw_writew(0x8a0a, 0xe6058130);       /* USBCR4 */
-
         /* enable FSI2 port A (ak4643) */
         gpio_request(GPIO_FN_FSIAIBT,   NULL);
         gpio_request(GPIO_FN_FSIAILR,   NULL);
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index afbead6a6e17..7727cca6136c 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -365,6 +365,114 @@ static struct clk div6_clks[DIV6_NR] = {
                         dsi_parent, ARRAY_SIZE(dsi_parent), 12, 3),
 };
 
+/* DSI DIV */
+static unsigned long dsiphy_recalc(struct clk *clk)
+{
+        u32 value;
+
+        value = __raw_readl(clk->mapping->base);
+
+        /* FIXME */
+        if (!(value & 0x000B8000))
+                return clk->parent->rate;
+
+        value &= 0x3f;
+        value += 1;
+
+        if ((value < 12) ||
+            (value > 33)) {
+                pr_err("DSIPHY has wrong value (%d)", value);
+                return 0;
+        }
+
+        return clk->parent->rate / value;
+}
+
+static long dsiphy_round_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_rate_mult_range_round(clk, 12, 33, rate);
+}
+
+static void dsiphy_disable(struct clk *clk)
+{
+        u32 value;
+
+        value = __raw_readl(clk->mapping->base);
+        value &= ~0x000B8000;
+
+        __raw_writel(value , clk->mapping->base);
+}
+
+static int dsiphy_enable(struct clk *clk)
+{
+        u32 value;
+        int multi;
+
+        value = __raw_readl(clk->mapping->base);
+        multi = (value & 0x3f) + 1;
+
+        if ((multi < 12) || (multi > 33))
+                return -EIO;
+
+        __raw_writel(value | 0x000B8000, clk->mapping->base);
+
+        return 0;
+}
+
+static int dsiphy_set_rate(struct clk *clk, unsigned long rate)
+{
+        u32 value;
+        int idx;
+
+        idx = rate / clk->parent->rate;
+        if ((idx < 12) || (idx > 33))
+                return -EINVAL;
+
+        idx += -1;
+
+        value = __raw_readl(clk->mapping->base);
+        value = (value & ~0x3f) + idx;
+
+        __raw_writel(value, clk->mapping->base);
+
+        return 0;
+}
+
+static struct clk_ops dsiphy_clk_ops = {
+        .recalc         = dsiphy_recalc,
+        .round_rate     = dsiphy_round_rate,
+        .set_rate       = dsiphy_set_rate,
+        .enable         = dsiphy_enable,
+        .disable        = dsiphy_disable,
+};
+
+static struct clk_mapping dsi0phy_clk_mapping = {
+        .phys   = DSI0PHYCR,
+        .len    = 4,
+};
+
+static struct clk_mapping dsi1phy_clk_mapping = {
+        .phys   = DSI1PHYCR,
+        .len    = 4,
+};
+
+static struct clk dsi0phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI0P], /* late install */
+        .mapping        = &dsi0phy_clk_mapping,
+};
+
+static struct clk dsi1phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI1P], /* late install */
+        .mapping        = &dsi1phy_clk_mapping,
+};
+
+static struct clk *late_main_clks[] = {
+        &dsi0phy_clk,
+        &dsi1phy_clk,
+};
+
 enum { MSTP001,
         MSTP129, MSTP128, MSTP127, MSTP126, MSTP125, MSTP118, MSTP116, MSTP100,
         MSTP219,
@@ -429,6 +537,8 @@ static struct clk_lookup lookups[] = {
         CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSIT]),
         CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSI0P]),
         CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSI1P]),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.0", &dsi0phy_clk),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.1", &dsi1phy_clk),
 
         /* MSTP32 clocks */
         CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* I2C2 */
@@ -504,6 +614,9 @@ void __init sh73a0_clock_init(void)
         if (!ret)
                 ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
 
+        for (k = 0; !ret && (k < ARRAY_SIZE(late_main_clks)); k++)
+                ret = clk_register(late_main_clks[k]);
+
         clkdev_add_table(lookups, ARRAY_SIZE(lookups));
 
         if (!ret)
diff --git a/arch/arm/mach-shmobile/include/mach/sh73a0.h b/arch/arm/mach-shmobile/include/mach/sh73a0.h
index 881d515a9686..cad57578ceed 100644
--- a/arch/arm/mach-shmobile/include/mach/sh73a0.h
+++ b/arch/arm/mach-shmobile/include/mach/sh73a0.h
@@ -515,8 +515,8 @@ enum {
         SHDMA_SLAVE_MMCIF_RX,
 };
 
-/* PINT interrupts are located at Linux IRQ 768 and up */
-#define SH73A0_PINT0_IRQ(irq) ((irq) + 768)
-#define SH73A0_PINT1_IRQ(irq) ((irq) + 800)
+/* PINT interrupts are located at Linux IRQ 800 and up */
+#define SH73A0_PINT0_IRQ(irq) ((irq) + 800)
+#define SH73A0_PINT1_IRQ(irq) ((irq) + 832)
 
 #endif /* __ASM_SH73A0_H__ */
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index 1eda6b0b69e3..9857595eaa79 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/sh_intc.h>
@@ -445,6 +446,7 @@ void __init sh73a0_init_irq(void)
                 setup_irq(gic_spi(1 + k), &sh73a0_irq_pin_cascade[k]);
 
                 n = intcs_evt2irq(to_intc_vect(gic_spi(1 + k)));
+                WARN_ON(irq_alloc_desc_at(n, numa_node_id()) != n);
                 irq_set_chip_and_handler_name(n, &intca_gic_irq_chip,
                                               handle_level_irq, "level");
                 set_irq_flags(n, IRQF_VALID); /* yuck */
diff --git a/arch/arm/mach-shmobile/pfc-r8a7779.c b/arch/arm/mach-shmobile/pfc-r8a7779.c
index 963532f2b2c4..d14c9b048077 100644
--- a/arch/arm/mach-shmobile/pfc-r8a7779.c
+++ b/arch/arm/mach-shmobile/pfc-r8a7779.c
@@ -2120,7 +2120,7 @@ static struct pinmux_cfg_reg pinmux_config_regs[] = {
             FN_AUDATA3, 0, 0, 0 }
         },
         { PINMUX_CFG_REG_VAR("IPSR4", 0xfffc0030, 32,
-                             3, 1, 1, 1, 1, 1, 1, 3, 3, 1,
+                             3, 1, 1, 1, 1, 1, 1, 3, 3,
                              1, 1, 1, 1, 1, 1, 3, 3, 3, 2) {
             /* IP4_31_29 [3] */
             FN_DU1_DB0, FN_VI2_DATA4_VI2_B4, FN_SCL2_B, FN_SD3_DAT0,
diff --git a/arch/arm/mach-shmobile/pfc-sh7372.c b/arch/arm/mach-shmobile/pfc-sh7372.c
index 1bd6585a6acf..336093f9210a 100644
--- a/arch/arm/mach-shmobile/pfc-sh7372.c
+++ b/arch/arm/mach-shmobile/pfc-sh7372.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/gpio.h>
+#include <mach/irqs.h>
 #include <mach/sh7372.h>
 
 #define CPU_ALL_PORT(fn, pfx, sfx) \
@@ -1594,6 +1595,43 @@ static struct pinmux_data_reg pinmux_data_regs[] = {
         { },
 };
 
+#define EXT_IRQ16L(n) evt2irq(0x200 + ((n) << 5))
+#define EXT_IRQ16H(n) evt2irq(0x3200 + (((n) - 16) << 5))
+static struct pinmux_irq pinmux_irqs[] = {
+        PINMUX_IRQ(EXT_IRQ16L(0), PORT6_FN0, PORT162_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(1), PORT12_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(2), PORT4_FN0, PORT5_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(3), PORT8_FN0, PORT16_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(4), PORT17_FN0, PORT163_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(5), PORT18_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(6), PORT39_FN0, PORT164_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(7), PORT40_FN0, PORT167_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(8), PORT41_FN0, PORT168_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(9), PORT42_FN0, PORT169_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(10), PORT65_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(11), PORT67_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(12), PORT80_FN0, PORT137_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(13), PORT81_FN0, PORT145_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(14), PORT82_FN0, PORT146_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(15), PORT83_FN0, PORT147_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(16), PORT84_FN0, PORT170_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(17), PORT85_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(18), PORT86_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(19), PORT87_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(20), PORT92_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(21), PORT93_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(22), PORT94_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(23), PORT95_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(24), PORT112_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(25), PORT119_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(26), PORT121_FN0, PORT172_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(27), PORT122_FN0, PORT180_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(28), PORT123_FN0, PORT181_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(29), PORT129_FN0, PORT182_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(30), PORT130_FN0, PORT183_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(31), PORT138_FN0, PORT184_FN0),
+};
+
 static struct pinmux_info sh7372_pinmux_info = {
         .name = "sh7372_pfc",
         .reserved_id = PINMUX_RESERVED,
@@ -1614,6 +1652,9 @@ static struct pinmux_info sh7372_pinmux_info = {
 
         .gpio_data = pinmux_data,
         .gpio_data_size = ARRAY_SIZE(pinmux_data),
+
+        .gpio_irq = pinmux_irqs,
+        .gpio_irq_size = ARRAY_SIZE(pinmux_irqs),
 };
 
 void sh7372_pinmux_init(void)
diff --git a/arch/arm/mach-shmobile/smp-sh73a0.c b/arch/arm/mach-shmobile/smp-sh73a0.c
index 0d159d64a345..2d0d4212be41 100644
--- a/arch/arm/mach-shmobile/smp-sh73a0.c
+++ b/arch/arm/mach-shmobile/smp-sh73a0.c
@@ -80,7 +80,7 @@ int __cpuinit sh73a0_boot_secondary(unsigned int cpu)
         /* enable cache coherency */
         modify_scu_cpu_psr(0, 3 << (cpu * 8));
 
-        if (((__raw_readw(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
+        if (((__raw_readl(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
                 __raw_writel(1 << cpu, __io(WUPCR));    /* wake up */
         else
                 __raw_writel(1 << cpu, __io(SRESCR));   /* reset */
diff --git a/arch/c6x/boot/Makefile b/arch/c6x/boot/Makefile
index ecca820e6041..6891257d514c 100644
--- a/arch/c6x/boot/Makefile
+++ b/arch/c6x/boot/Makefile
@@ -13,7 +13,7 @@ obj-y += linked_dtb.o
 endif
 
 $(obj)/%.dtb: $(src)/dts/%.dts FORCE
-        $(call cmd,dtc)
+        $(call if_changed_dep,dtc)
 
 quiet_cmd_cp = CP      $< $@$2
         cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
diff --git a/arch/sh/boards/board-sh7757lcr.c b/arch/sh/boards/board-sh7757lcr.c
index 0838154dd216..24b1ee410daa 100644
--- a/arch/sh/boards/board-sh7757lcr.c
+++ b/arch/sh/boards/board-sh7757lcr.c
@@ -169,6 +169,11 @@ static struct resource sh_eth_giga1_resources[] = {
                 .end    = 0xfee00fff,
                 .flags  = IORESOURCE_MEM,
         }, {
+                /* TSU */
+                .start  = 0xfee01800,
+                .end    = 0xfee01fff,
+                .flags  = IORESOURCE_MEM,
+        }, {
                 .start  = 316,
                 .end    = 316,
                 .flags  = IORESOURCE_IRQ,
@@ -210,20 +215,13 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh7757lcr_mmcif_dma = {
-        .chan_priv_tx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_TX,
-        },
-        .chan_priv_rx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_RX,
-        }
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
-        .dma            = &sh7757lcr_mmcif_dma,
         .sup_pclk       = 0x0f,
-        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA,
+        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA |
+                          MMC_CAP_NONREMOVABLE,
         .ocr            = MMC_VDD_32_33 | MMC_VDD_33_34,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/sh/boards/mach-ap325rxa/setup.c b/arch/sh/boards/mach-ap325rxa/setup.c
index 6418e95c2b6b..ebd0f818a25f 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -22,6 +22,7 @@
 #include <linux/i2c.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <media/ov772x.h>
 #include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 033ef2ba621f..cde7c0085ced 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -29,9 +29,11 @@
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <sound/sh_fsi.h>
 #include <media/sh_mobile_ceu.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <media/mt9t112.h>
 #include <asm/heartbeat.h>
diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index 2a18b06abdaf..5b382e1afaea 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -22,6 +22,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/i2c.h>
 #include <linux/usb/r8a66597.h>
+#include <linux/videodev2.h>
 #include <media/rj54n1cb0c.h>
 #include <media/soc_camera.h>
 #include <media/sh_mobile_ceu.h>
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index 68c3d6f42896..d37ba2720527 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -21,9 +21,11 @@
 #include <linux/delay.h>
 #include <linux/clk.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <media/ov772x.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <asm/clock.h>
 #include <asm/machvec.h>
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 036fe1adaef1..2b07fc016950 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -24,6 +24,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/usb/r8a66597.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <sound/sh_fsi.h>
diff --git a/arch/sh/drivers/pci/pci-sh7780.c b/arch/sh/drivers/pci/pci-sh7780.c
index fa7b978cc727..fb8f14990743 100644
--- a/arch/sh/drivers/pci/pci-sh7780.c
+++ b/arch/sh/drivers/pci/pci-sh7780.c
@@ -74,7 +74,7 @@ struct pci_errors {
         { SH4_PCIINT_MLCK,      "master lock error" },
         { SH4_PCIINT_TABT,      "target-target abort" },
         { SH4_PCIINT_TRET,      "target retry time out" },
-        { SH4_PCIINT_MFDE,      "master function disable erorr" },
+        { SH4_PCIINT_MFDE,      "master function disable error" },
         { SH4_PCIINT_PRTY,      "address parity error" },
         { SH4_PCIINT_SERR,      "SERR" },
         { SH4_PCIINT_TWDP,      "data parity error for target write" },
diff --git a/arch/sh/include/asm/device.h b/arch/sh/include/asm/device.h
index a1c9c0daec10..071bcb4d4bfd 100644
--- a/arch/sh/include/asm/device.h
+++ b/arch/sh/include/asm/device.h
@@ -3,9 +3,10 @@
  *
  * This file is released under the GPLv2
  */
+#ifndef __ASM_SH_DEVICE_H
+#define __ASM_SH_DEVICE_H
 
-struct dev_archdata {
-};
+#include <asm-generic/device.h>
 
 struct platform_device;
 /* allocate contiguous memory chunk and fill in struct resource */
@@ -14,5 +15,4 @@ int platform_resource_setup_memory(struct platform_device *pdev,
 
 void plat_early_device_setup(void);
 
-struct pdev_archdata {
-};
+#endif /* __ASM_SH_DEVICE_H */
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
index b3c039a5064a..70bd96646f42 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
@@ -343,7 +343,7 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh_mobile_ceu.1", &mstp_clks[HWBLK_CEU1]),
         CLKDEV_CON_ID("beu1", &mstp_clks[HWBLK_BEU1]),
         CLKDEV_CON_ID("2ddmac0", &mstp_clks[HWBLK_2DDMAC]),
-        CLKDEV_CON_ID("spu0", &mstp_clks[HWBLK_SPU]),
+        CLKDEV_DEV_ID("sh_fsi.0", &mstp_clks[HWBLK_SPU]),
         CLKDEV_CON_ID("jpu0", &mstp_clks[HWBLK_JPU]),
         CLKDEV_DEV_ID("sh-vou.0", &mstp_clks[HWBLK_VOU]),
         CLKDEV_CON_ID("beu0", &mstp_clks[HWBLK_BEU0]),
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
index a7b2da6b3a1a..2875e8be4f72 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
@@ -133,7 +133,7 @@ static struct resource spi0_resources[] = {
         [0] = {
                 .start  = 0xfe002000,
                 .end    = 0xfe0020ff,
-                .flags  = IORESOURCE_MEM,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_32BIT,
         },
         [1] = {
                 .start  = 86,
@@ -661,6 +661,25 @@ static struct platform_device spi0_device = {
         .resource       = spi0_resources,
 };
 
+static struct resource spi1_resources[] = {
+        {
+                .start  = 0xffd8ee70,
+                .end    = 0xffd8eeff,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_8BIT,
+        },
+        {
+                .start  = 54,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device spi1_device = {
+        .name   = "sh_spi",
+        .id     = 1,
+        .num_resources  = ARRAY_SIZE(spi1_resources),
+        .resource       = spi1_resources,
+};
+
 static struct resource usb_ehci_resources[] = {
         [0] = {
                 .start  = 0xfe4f1000,
@@ -720,6 +739,7 @@ static struct platform_device *sh7757_devices[] __initdata = {
         &dma2_device,
         &dma3_device,
         &spi0_device,
+        &spi1_device,
         &usb_ehci_device,
         &usb_ohci_device,
 };
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index 3147a9a6fb8b..f624174bf239 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -63,7 +63,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         mp_ops->prepare_cpus(max_cpus);
 
 #ifndef CONFIG_HOTPLUG_CPU
-        init_cpu_present(&cpu_possible_map);
+        init_cpu_present(cpu_possible_mask);
 #endif
 }
 
diff --git a/arch/sh/kernel/topology.c b/arch/sh/kernel/topology.c
index 4649a6ff0cfe..772caffba22f 100644
--- a/arch/sh/kernel/topology.c
+++ b/arch/sh/kernel/topology.c
@@ -27,7 +27,7 @@ static cpumask_t cpu_coregroup_map(unsigned int cpu)
          * Presently all SH-X3 SMP cores are multi-cores, so just keep it
          * simple until we have a method for determining topology..
          */
-        return cpu_possible_map;
+        return *cpu_possible_mask;
 }
 
 const struct cpumask *cpu_coregroup_mask(unsigned int cpu)
diff --git a/arch/sh/mm/cache-sh2a.c b/arch/sh/mm/cache-sh2a.c
index ae08cbbfa569..949e2d3138a0 100644
--- a/arch/sh/mm/cache-sh2a.c
+++ b/arch/sh/mm/cache-sh2a.c
@@ -23,6 +23,7 @@
 #define MAX_OCACHE_PAGES        32
 #define MAX_ICACHE_PAGES        32
 
+#ifdef CONFIG_CACHE_WRITEBACK
 static void sh2a_flush_oc_line(unsigned long v, int way)
 {
         unsigned long addr = (v & 0x000007f0) | (way << 11);
@@ -34,6 +35,7 @@ static void sh2a_flush_oc_line(unsigned long v, int way)
                 __raw_writel(data, CACHE_OC_ADDRESS_ARRAY | addr);
         }
 }
+#endif
 
 static void sh2a_invalidate_line(unsigned long cache_addr, unsigned long v)
 {
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 12eb07bfb267..4172af8ceeb3 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1141,7 +1141,9 @@ asmlinkage void __init xen_start_kernel(void)
 
         /* Prevent unwanted bits from being set in PTEs. */
         __supported_pte_mask &= ~_PAGE_GLOBAL;
+#if 0
         if (!xen_initial_domain())
+#endif
                 __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
 
         __supported_pte_mask |= _PAGE_IOMAP;
@@ -1204,10 +1206,6 @@ asmlinkage void __init xen_start_kernel(void)
 
         pgd = (pgd_t *)xen_start_info->pt_base;
 
-        if (!xen_initial_domain())
-                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
-        __supported_pte_mask |= _PAGE_IOMAP;
         /* Don't do the full vcpu_info placement stuff until we have a
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 58a0e46c404d..95c1cf60c669 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -415,13 +415,13 @@ static pteval_t iomap_pte(pteval_t val)
 static pteval_t xen_pte_val(pte_t pte)
 {
         pteval_t pteval = pte.pte;
-
+#if 0
         /* If this is a WC pte, convert back from Xen WC to Linux WC */
         if ((pteval & (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)) == _PAGE_PAT) {
                 WARN_ON(!pat_enabled);
                 pteval = (pteval & ~_PAGE_PAT) | _PAGE_PWT;
         }
-
+#endif
         if (xen_initial_domain() && (pteval & _PAGE_IOMAP))
                 return pteval;
 
@@ -463,7 +463,7 @@ void xen_set_pat(u64 pat)
 static pte_t xen_make_pte(pteval_t pte)
 {
         phys_addr_t addr = (pte & PTE_PFN_MASK);
-
+#if 0
         /* If Linux is trying to set a WC pte, then map to the Xen WC.
          * If _PAGE_PAT is set, then it probably means it is really
          * _PAGE_PSE, so avoid fiddling with the PAT mapping and hope
@@ -476,7 +476,7 @@ static pte_t xen_make_pte(pteval_t pte)
                 if ((pte & (_PAGE_PCD | _PAGE_PWT)) == _PAGE_PWT)
                         pte = (pte & ~(_PAGE_PCD | _PAGE_PWT)) | _PAGE_PAT;
         }
-
+#endif
         /*
          * Unprivileged domains are allowed to do IOMAPpings for
          * PCI passthrough, but not map ISA space.  The ISA
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 5d1d07645132..e8cd652d2017 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1206,9 +1206,9 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         
  out_unmap_both:
         pci_set_drvdata(dev, NULL);
-        pci_iounmap(dev, card->config_regs);
- out_unmap_config:
         pci_iounmap(dev, card->buffers);
+ out_unmap_config:
+        pci_iounmap(dev, card->config_regs);
  out_release_regions:
         pci_release_regions(dev);
  out:
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f00f596c1029..789c9b579aea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0a5c, 0x21e3) },
+        { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         { }     /* Terminating entry */
@@ -726,9 +727,6 @@ static int btusb_send_frame(struct sk_buff *skb)
                 usb_fill_bulk_urb(urb, data->udev, pipe,
                                 skb->data, skb->len, btusb_tx_complete, skb);
 
-                if (skb->priority >= HCI_PRIO_MAX - 1)
-                        urb->transfer_flags  = URB_ISO_ASAP;
-
                 hdev->stat.acl_tx++;
                 break;
 
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index eedca3cf9968..dd87ae96c262 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_client *client,
                         continue;
                 err = device_create_file(&client->dev, &ads1015_in[k].dev_attr);
                 if (err)
-                        goto exit_free;
+                        goto exit_remove;
         }
 
         data->hwmon_dev = hwmon_device_register(&client->dev);
@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_client *client,
 exit_remove:
         for (k = 0; k < ADS1015_CHANNELS; ++k)
                 device_remove_file(&client->dev, &ads1015_in[k].dev_attr);
-exit_free:
         kfree(data);
 exit:
         return err;
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index f609b5727ba9..6bab2001ef3b 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -340,8 +340,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
                         data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                         break;
                 case 1: /* PWM */
                         fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
@@ -361,8 +359,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                 case 0: /* full speed */
                         fanmode  |= (3 << FAN_CTRL_MODE(nr));
                         data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                         break;
                 case 1: /* PWM */
                         fanmode  |= (3 << FAN_CTRL_MODE(nr));
@@ -377,6 +373,9 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
 
         f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
         data->pwm_enable[nr] = val;
+        if (val == 0)
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                                data->pwm[nr]);
         return 0;
 }
 
diff --git a/drivers/hwmon/max6639.c b/drivers/hwmon/max6639.c
index e10a092c603c..a6760bacd915 100644
--- a/drivers/hwmon/max6639.c
+++ b/drivers/hwmon/max6639.c
@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0x2c, 0x2e, 0x2f, I2C_CLIENT_END };
 
 static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 };
 
-#define FAN_FROM_REG(val, div, rpm_range)       ((val) == 0 ? -1 : \
-        (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val)))
+#define FAN_FROM_REG(val, rpm_range)    ((val) == 0 || (val) == 255 ? \
+                                0 : (rpm_ranges[rpm_range] * 30) / (val))
 #define TEMP_LIMIT_TO_REG(val)  SENSORS_LIMIT((val) / 1000, 0, 255)
 
 /*
@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct device *dev,
                 return PTR_ERR(data);
 
         return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index],
-                       data->ppr, data->rpm_range));
+                       data->rpm_range));
 }
 
 static ssize_t show_alarm(struct device *dev,
@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2c_client *client)
         struct max6639_data *data = i2c_get_clientdata(client);
         struct max6639_platform_data *max6639_info =
                 client->dev.platform_data;
-        int i = 0;
+        int i;
         int rpm_range = 1; /* default: 4000 RPM */
-        int err = 0;
+        int err;
 
         /* Reset chip to default values, see below for GCONFIG setup */
         err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2c_client *client)
         else
                 data->ppr = 2;
         data->ppr -= 1;
-        err = i2c_smbus_write_byte_data(client,
-                        MAX6639_REG_FAN_PPR(i),
-                        data->ppr << 5);
-        if (err)
-                goto exit;
 
         if (max6639_info)
                 rpm_range = rpm_range_to_reg(max6639_info->rpm_range);
@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2c_client *client)
 
         for (i = 0; i < 2; i++) {
 
+                /* Set Fan pulse per revolution */
+                err = i2c_smbus_write_byte_data(client,
+                                MAX6639_REG_FAN_PPR(i),
+                                data->ppr << 6);
+                if (err)
+                        goto exit;
+
                 /* Fans config PWM, RPM */
                 err = i2c_smbus_write_byte_data(client,
                         MAX6639_REG_FAN_CONFIG1(i),
diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c
index beaf5a8d9c45..9b97a5b3cf3d 100644
--- a/drivers/hwmon/pmbus/max34440.c
+++ b/drivers/hwmon/pmbus/max34440.c
@@ -82,7 +82,7 @@ static int max34440_write_word_data(struct i2c_client *client, int page,
         case PMBUS_VIRT_RESET_TEMP_HISTORY:
                 ret = pmbus_write_word_data(client, page,
                                             MAX34440_MFR_TEMPERATURE_PEAK,
-                                            0xffff);
+                                            0x8000);
                 break;
         default:
                 ret = -ENODATA;
diff --git a/drivers/media/radio/wl128x/Kconfig b/drivers/media/radio/wl128x/Kconfig
index 86b28579f0c7..ea1e6545df36 100644
--- a/drivers/media/radio/wl128x/Kconfig
+++ b/drivers/media/radio/wl128x/Kconfig
@@ -4,8 +4,8 @@
 menu "Texas Instruments WL128x FM driver (ST based)"
 config RADIO_WL128X
         tristate "Texas Instruments WL128x FM Radio"
-        depends on VIDEO_V4L2 && RFKILL
-        select TI_ST if NET && GPIOLIB
+        depends on VIDEO_V4L2 && RFKILL && GPIOLIB
+        select TI_ST if NET
         help
         Choose Y here if you have this FM radio chip.
 
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 3aeb29a7ce11..7f26fdf2e54e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -47,7 +47,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.3"
+#define MOD_VERSION     "0.9.4"
 
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct urb *urb)
                 return;
 
         ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf0)
+        if (!ictx)
                 return;
 
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf0)
+                goto out;
+
         switch (urb->status) {
         case -ENOENT:           /* usbcore unlink successful! */
                 return;
@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct urb *urb)
                 break;
         }
 
+out:
         usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
 }
 
@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct urb *urb)
                 return;
 
         ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf1)
+        if (!ictx)
                 return;
 
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf1)
+                goto out;
+
         switch (urb->status) {
         case -ENOENT:           /* usbcore unlink successful! */
                 return;
@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct urb *urb)
                 break;
         }
 
+out:
         usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
 }
 
@@ -2242,7 +2260,7 @@ find_endpoint_failed:
         mutex_unlock(&ictx->lock);
         usb_free_urb(rx_urb);
 rx_urb_alloc_failed:
-        dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret);
+        dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
 
         return NULL;
 }
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index e5eb56a5b618..6510110f53d0 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -154,10 +154,20 @@ static int device_authorization(struct hdpvr_device *dev)
         }
 #endif
 
+        dev->fw_ver = dev->usbc_buf[1];
+
         v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
-                          dev->usbc_buf[1], &dev->usbc_buf[2]);
+                          dev->fw_ver, &dev->usbc_buf[2]);
+
+        if (dev->fw_ver > 0x15) {
+                dev->options.brightness = 0x80;
+                dev->options.contrast   = 0x40;
+                dev->options.hue        = 0xf;
+                dev->options.saturation = 0x40;
+                dev->options.sharpness  = 0x80;
+        }
 
-        switch (dev->usbc_buf[1]) {
+        switch (dev->fw_ver) {
         case HDPVR_FIRMWARE_VERSION:
                 dev->flags &= ~HDPVR_FLAG_AC3_CAP;
                 break;
@@ -169,7 +179,7 @@ static int device_authorization(struct hdpvr_device *dev)
         default:
                 v4l2_info(&dev->v4l2_dev, "untested firmware, the driver might"
                           " not work.\n");
-                if (dev->usbc_buf[1] >= HDPVR_FIRMWARE_VERSION_AC3)
+                if (dev->fw_ver >= HDPVR_FIRMWARE_VERSION_AC3)
                         dev->flags |= HDPVR_FLAG_AC3_CAP;
                 else
                         dev->flags &= ~HDPVR_FLAG_AC3_CAP;
@@ -270,6 +280,8 @@ static const struct hdpvr_options hdpvr_default_options = {
         .bitrate_mode   = HDPVR_CONSTANT,
         .gop_mode       = HDPVR_SIMPLE_IDR_GOP,
         .audio_codec    = V4L2_MPEG_AUDIO_ENCODING_AAC,
+        /* original picture controls for firmware version <= 0x15 */
+        /* updated in device_authorization() for newer firmware */
         .brightness     = 0x86,
         .contrast       = 0x80,
         .hue            = 0x80,
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index 087f7c08cb85..11ffe9cc1780 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
 
                 hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
 
+                dev->status = STATUS_STREAMING;
+
                 INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
                 queue_work(dev->workqueue, &dev->worker);
 
                 v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
                          "streaming started\n");
-                dev->status = STATUS_STREAMING;
 
                 return 0;
         }
@@ -722,21 +723,39 @@ static const s32 supported_v4l2_ctrls[] = {
 };
 
 static int fill_queryctrl(struct hdpvr_options *opt, struct v4l2_queryctrl *qc,
-                          int ac3)
+                          int ac3, int fw_ver)
 {
         int err;
 
+        if (fw_ver > 0x15) {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0x1e, 1, 0xf);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        } else {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        }
+
         switch (qc->id) {
-        case V4L2_CID_BRIGHTNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
-        case V4L2_CID_CONTRAST:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SATURATION:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_HUE:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SHARPNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
         case V4L2_CID_MPEG_AUDIO_ENCODING:
                 return v4l2_ctrl_query_fill(
                         qc, V4L2_MPEG_AUDIO_ENCODING_AAC,
@@ -794,7 +813,8 @@ static int vidioc_queryctrl(struct file *file, void *private_data,
 
                 if (qc->id == supported_v4l2_ctrls[i])
                         return fill_queryctrl(&dev->options, qc,
-                                              dev->flags & HDPVR_FLAG_AC3_CAP);
+                                              dev->flags & HDPVR_FLAG_AC3_CAP,
+                                              dev->fw_ver);
 
                 if (qc->id < supported_v4l2_ctrls[i])
                         break;
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index d6439db1d18b..fea3c6926997 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -113,6 +113,7 @@ struct hdpvr_device {
         /* usb control transfer buffer and lock */
         struct mutex            usbc_mutex;
         u8                      *usbc_buf;
+        u8                      fw_ver;
 };
 
 static inline struct hdpvr_device *to_hdpvr_dev(struct v4l2_device *v4l2_dev)
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index a74a79701d34..eaabc27f0fa2 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1407,7 +1407,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
         struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
-        struct video_device *vdev = &ccdc->subdev.devnode;
+        struct video_device *vdev = ccdc->subdev.devnode;
         struct v4l2_event event;
 
         memset(&event, 0, sizeof(event));
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 04a3f1b756a8..192b0d118df4 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
+static int sja1000_is_absent(struct sja1000_priv *priv)
+{
+        return (priv->read_reg(priv, REG_MOD) == 0xFF);
+}
+
 static int sja1000_probe_chip(struct net_device *dev)
 {
         struct sja1000_priv *priv = netdev_priv(dev);
 
-        if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
+        if (priv->reg_base && sja1000_is_absent(priv)) {
                 printk(KERN_INFO "%s: probing @0x%lX failed\n",
                        DRV_NAME, dev->base_addr);
                 return 0;
@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
                 status = priv->read_reg(priv, REG_SR);
+                /* check for absent controller due to hw unplug */
+                if (status == 0xFF && sja1000_is_absent(priv))
+                        return IRQ_NONE;
 
                 if (isrc & IRQ_WUI)
                         dev_warn(dev->dev.parent, "wakeup interrupt\n");
@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
                                 status = priv->read_reg(priv, REG_SR);
+                                /* check for absent controller */
+                                if (status == 0xFF && sja1000_is_absent(priv))
+                                        return IRQ_NONE;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index b8591246eb4c..1ff3c6df35a2 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -2244,10 +2244,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                         dev_info(&adapter->pdev->dev, "tx locked\n");
                 return NETDEV_TX_LOCKED;
         }
-        if (skb->mark == 0x01)
-                type = atl1c_trans_high;
-        else
-                type = atl1c_trans_normal;
 
         if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                 /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 3fb66d09ece5..cab87456a34a 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2339,7 +2339,7 @@ static inline int __init b44_pci_init(void)
         return err;
 }
 
-static inline void __exit b44_pci_exit(void)
+static inline void b44_pci_exit(void)
 {
 #ifdef CONFIG_B44_PCI
         ssb_pcihost_unregister(&b44_pci_driver);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index dd3a0a232ea0..818a573669e6 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3584,7 +3584,11 @@ static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                 fl6.flowi6_oif = dst_addr->sin6_scope_id;
 
         *dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (*dst)
+        if ((*dst)->error) {
+                dst_release(*dst);
+                *dst = NULL;
+                return -ENETUNREACH;
+        } else
                 return 0;
 #endif
 
diff --git a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
index c2c0680a1146..ac37cacc6136 100644
--- a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
+++ b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
@@ -157,7 +157,7 @@ static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
                         CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
                 *fcoe_enc_error = (desc->flags &
                         CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
-                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                *fcoe_eof = (u8)((le16_to_cpu(desc->checksum_fcoe) >>
                         CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
                         CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
                 *checksum = 0;
diff --git a/drivers/net/ethernet/cisco/enic/enic_pp.c b/drivers/net/ethernet/cisco/enic/enic_pp.c
index 22bf03a1829e..c347b6236f8f 100644
--- a/drivers/net/ethernet/cisco/enic/enic_pp.c
+++ b/drivers/net/ethernet/cisco/enic/enic_pp.c
@@ -72,7 +72,7 @@ static int enic_set_port_profile(struct enic *enic, int vf)
         struct enic_port_profile *pp;
         struct vic_provinfo *vp;
         const u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        const u16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
+        const __be16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
         char uuid_str[38];
         char client_mac_str[18];
         u8 *client_mac;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 27d651a80f3f..55cbf65512c3 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
                 ((new_mtu) < IPV6_MIN_MTU))
                 return -EINVAL;
 
-        if (new_mtu > 4000) {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
-                jme_restart_rx_engine(jme);
-        } else {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
-                jme_restart_rx_engine(jme);
-        }
 
         netdev->mtu = new_mtu;
         netdev_update_features(netdev);
 
+        jme_restart_rx_engine(jme);
         jme_reset_link(jme);
 
         return 0;
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 4304072bd3c5..3efc897c9913 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -730,7 +730,7 @@ enum jme_rxcs_values {
         RXCS_RETRYCNT_60        = 0x00000F00,
 
         RXCS_DEFAULT            = RXCS_FIFOTHTP_128T |
-                                  RXCS_FIFOTHNP_128QW |
+                                  RXCS_FIFOTHNP_16QW |
                                   RXCS_DMAREQSZ_128B |
                                   RXCS_RETRYGAP_256ns |
                                   RXCS_RETRYCNT_32,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8fa41f3082cf..9129ace02560 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1036,7 +1036,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int vec = 0, err = 0, i;
 
-        spin_lock(&priv->msix_ctl.pool_lock);
+        mutex_lock(&priv->msix_ctl.pool_lock);
         for (i = 0; !vec && i < dev->caps.comp_pool; i++) {
                 if (~priv->msix_ctl.pool_bm & 1ULL << i) {
                         priv->msix_ctl.pool_bm |= 1ULL << i;
@@ -1058,7 +1058,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
                         eq_set_ci(&priv->eq_table.eq[vec], 1);
                 }
         }
-        spin_unlock(&priv->msix_ctl.pool_lock);
+        mutex_unlock(&priv->msix_ctl.pool_lock);
 
         if (vec) {
                 *vector = vec;
@@ -1079,13 +1079,13 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
         if (likely(i >= 0)) {
                 /*sanity check , making sure were not trying to free irq's
                   Belonging to a legacy EQ*/
-                spin_lock(&priv->msix_ctl.pool_lock);
+                mutex_lock(&priv->msix_ctl.pool_lock);
                 if (priv->msix_ctl.pool_bm & 1ULL << i) {
                         free_irq(priv->eq_table.eq[vec].irq,
                                  &priv->eq_table.eq[vec]);
                         priv->msix_ctl.pool_bm &= ~(1ULL << i);
                 }
-                spin_unlock(&priv->msix_ctl.pool_lock);
+                mutex_unlock(&priv->msix_ctl.pool_lock);
         }
 
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 8a21e10952ea..9ea7cabcaf3c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -685,7 +685,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
         return err;
 }
 
-static int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
+int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
 {
         struct mlx4_cmd_mailbox *outbox = ptr;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 678558b502fc..d498f049c74e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -531,15 +531,14 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
         for (port = 0; port <  dev->caps.num_ports; port++) {
                 /* Change the port type only if the new type is different
                  * from the current, and not set to Auto */
-                if (port_types[port] != dev->caps.port_type[port + 1]) {
+                if (port_types[port] != dev->caps.port_type[port + 1])
                         change = 1;
-                        dev->caps.port_type[port + 1] = port_types[port];
-                }
         }
         if (change) {
                 mlx4_unregister_device(dev);
                 for (port = 1; port <= dev->caps.num_ports; port++) {
                         mlx4_CLOSE_PORT(dev, port);
+                        dev->caps.port_type[port] = port_types[port - 1];
                         err = mlx4_SET_PORT(dev, port);
                         if (err) {
                                 mlx4_err(dev, "Failed to set port %d, "
@@ -986,6 +985,9 @@ static int map_bf_area(struct mlx4_dev *dev)
         resource_size_t bf_len;
         int err = 0;
 
+        if (!dev->caps.bf_reg_size)
+                return -ENXIO;
+
         bf_start = pci_resource_start(dev->pdev, 2) +
                         (dev->caps.num_uars << PAGE_SHIFT);
         bf_len = pci_resource_len(dev->pdev, 2) -
@@ -1825,7 +1827,7 @@ slave_start:
                 goto err_master_mfunc;
 
         priv->msix_ctl.pool_bm = 0;
-        spin_lock_init(&priv->msix_ctl.pool_lock);
+        mutex_init(&priv->msix_ctl.pool_lock);
 
         mlx4_enable_msi_x(dev);
         if ((mlx4_is_mfunc(dev)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index c92269f8c057..28f8251561f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -697,7 +697,7 @@ struct mlx4_sense {
 
 struct mlx4_msix_ctl {
         u64             pool_bm;
-        spinlock_t      pool_lock;
+        struct mutex    pool_lock;
 };
 
 struct mlx4_steer {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 8deeef98280c..25a80d71fb2a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -304,7 +304,7 @@ static int mlx4_HW2SW_MPT(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox
                             MLX4_CMD_TIME_CLASS_B, MLX4_CMD_WRAPPED);
 }
 
-static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
+int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
                           u32 *base_mridx)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -320,14 +320,14 @@ static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_reserve_range);
 
-static void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
+void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
         mlx4_bitmap_free_range(&priv->mr_table.mpt_bitmap, base_mridx, cnt);
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_release_range);
 
-static int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
+int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
                            u64 iova, u64 size, u32 access, int npages,
                            int page_shift, struct mlx4_mr *mr)
 {
@@ -457,7 +457,7 @@ int mlx4_mr_alloc(struct mlx4_dev *dev, u32 pd, u64 iova, u64 size, u32 access,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_alloc);
 
-static void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
+void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
         int err;
 
@@ -852,7 +852,7 @@ err_free:
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_alloc);
 
-static int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
+int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
                             u32 pd, u32 access, int max_pages,
                             int max_maps, u8 page_shift, struct mlx4_fmr *fmr)
 {
@@ -954,7 +954,7 @@ int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_free);
 
-static int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
+int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 {
         if (fmr->maps)
                 return -EBUSY;
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 231176fcd2ba..2784bc706f1e 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1545,7 +1545,7 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
 
         netdev->irq = platform_get_irq(pdev, 0);
 
-        if (netdev->irq < 0) {
+        if ((int)netdev->irq < 0) {
                 err = netdev->irq;
                 goto err_get_irq;
         }
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index aca349861767..fc52fca74193 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
                 if (unlikely(!skb))
                         return -ENOMEM;
 
-                /* Adjust the SKB for padding and checksum */
+                /* Adjust the SKB for padding */
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_buf->len = skb_len - NET_IP_ALIGN;
                 rx_buf->is_page = false;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                   skb->data, rx_buf->len,
@@ -496,6 +495,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
 
                 EFX_BUG_ON_PARANOID(!checksummed);
                 rx_buf->u.skb = NULL;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 gro_result = napi_gro_receive(napi, skb);
         }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 4fa0bcb25dfc..4b2f54565f64 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1009,7 +1009,7 @@ static void emac_rx_handler(void *token, int len, int status)
         int                     ret;
 
         /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
+        if (unlikely(!netif_running(ndev))) {
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -1038,7 +1038,9 @@ static void emac_rx_handler(void *token, int len, int status)
 recycle:
         ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
                         skb_tailroom(skb), GFP_KERNEL);
-        if (WARN_ON(ret < 0))
+
+        WARN_ON(ret == -ENOMEM);
+        if (unlikely(ret < 0))
                 dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c81f136ae670..0856e1b7a849 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,16 +30,16 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
-MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IC1001 PHY drivers");
+MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IP101G/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
 
-/* IP101A/IP1001 */
-#define IP10XX_SPEC_CTRL_STATUS         16  /* Spec. Control Register */
-#define IP1001_SPEC_CTRL_STATUS_2       20  /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3 /* IP1001 RX/TXPHASE_SEL */
-#define IP1001_APS_ON                   11  /* IP1001 APS Mode  bit */
-#define IP101A_APS_ON                   2   /* IP101A APS Mode bit */
+/* IP101A/G - IP1001 */
+#define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
+#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
+#define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
+#define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -98,20 +98,24 @@ static int ip175c_config_init(struct phy_device *phydev)
 
 static int ip1xx_reset(struct phy_device *phydev)
 {
-        int err, bmcr;
+        int bmcr;
 
         /* Software Reset PHY */
         bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
         bmcr |= BMCR_RESET;
-        err = phy_write(phydev, MII_BMCR, bmcr);
-        if (err < 0)
-                return err;
+        bmcr = phy_write(phydev, MII_BMCR, bmcr);
+        if (bmcr < 0)
+                return bmcr;
 
         do {
                 bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
         } while (bmcr & BMCR_RESET);
 
-        return err;
+        return 0;
 }
 
 static int ip1001_config_init(struct phy_device *phydev)
@@ -124,7 +128,10 @@ static int ip1001_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP1001_SPEC_CTRL_STATUS_2);
+        if (c < 0)
+                return c;
         c |= IP1001_APS_ON;
+        c = phy_write(phydev, IP1001_SPEC_CTRL_STATUS_2, c);
         if (c < 0)
                 return c;
 
@@ -132,14 +139,19 @@ static int ip1001_config_init(struct phy_device *phydev)
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+                if (c < 0)
+                        return c;
+
                 c |= IP1001_PHASE_SEL_MASK;
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+                if (c < 0)
+                        return c;
         }
 
-        return c;
+        return 0;
 }
 
-static int ip101a_config_init(struct phy_device *phydev)
+static int ip101a_g_config_init(struct phy_device *phydev)
 {
         int c;
 
@@ -149,7 +161,7 @@ static int ip101a_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
-        c |= IP101A_APS_ON;
+        c |= IP101A_G_APS_ON;
         return c;
 }
 
@@ -191,6 +203,7 @@ static struct phy_driver ip1001_driver = {
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &ip1001_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
@@ -199,13 +212,14 @@ static struct phy_driver ip1001_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
-static struct phy_driver ip101a_driver = {
+static struct phy_driver ip101a_g_driver = {
         .phy_id         = 0x02430c54,
-        .name           = "ICPlus IP101A",
+        .name           = "ICPlus IP101A/G",
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
-        .config_init    = &ip101a_config_init,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &ip101a_g_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
         .suspend        = genphy_suspend,
@@ -221,7 +235,7 @@ static int __init icplus_init(void)
         if (ret < 0)
                 return -ENODEV;
 
-        ret = phy_driver_register(&ip101a_driver);
+        ret = phy_driver_register(&ip101a_g_driver);
         if (ret < 0)
                 return -ENODEV;
 
@@ -231,7 +245,7 @@ static int __init icplus_init(void)
 static void __exit icplus_exit(void)
 {
         phy_driver_unregister(&ip1001_driver);
-        phy_driver_unregister(&ip101a_driver);
+        phy_driver_unregister(&ip101a_g_driver);
         phy_driver_unregister(&ip175c_driver);
 }
 
@@ -241,6 +255,7 @@ module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
         { 0x02430d80, 0x0ffffff0 },
         { 0x02430d90, 0x0ffffff0 },
+        { 0x02430c54, 0x0ffffff0 },
         { }
 };
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index edfa15d2e795..486b4048850d 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         continue;
                 }
                 if (PPP_MP_CB(p)->sequence != seq) {
+                        u32 oldseq;
                         /* Fragment `seq' is missing.  If it is after
                            minseq, it might arrive later, so stop here. */
                         if (seq_after(seq, minseq))
                                 break;
                         /* Fragment `seq' is lost, keep going. */
                         lost = 1;
+                        oldseq = seq;
                         seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                 minseq + 1: PPP_MP_CB(p)->sequence;
+
+                        if (ppp->debug & 1)
+                                netdev_printk(KERN_DEBUG, ppp->dev,
+                                              "lost frag %u..%u\n",
+                                              oldseq, seq-1);
+
                         goto again;
                 }
 
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         struct sk_buff *tmp2;
 
                         skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
                                 __skb_unlink(p, list);
                                 kfree_skb(p);
                         }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                 /* If we have discarded any fragments,
                    signal a receive error. */
                 if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                        skb_queue_walk_safe(list, p, tmp) {
+                                if (p == head)
+                                        break;
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
+                                __skb_unlink(p, list);
+                                kfree_skb(p);
+                        }
+
                         if (ppp->debug & 1)
                                 netdev_printk(KERN_DEBUG, ppp->dev,
                                               "  missed pkts %u..%u\n",
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 41a61efc331e..90a30026a931 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -573,6 +573,13 @@ static const struct usb_device_id	products [] = {
         .driver_info = 0,
 },
 
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 304fe78ff60e..e1324b4a0f66 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1632,7 +1632,7 @@ static int hso_get_count(struct tty_struct *tty,
         struct hso_serial *serial = get_serial_by_tty(tty);
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
-        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+        memset(icount, 0, sizeof(struct serial_icounter_struct));
 
         if (!tiocmget)
                  return -ENOENT;
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index f701d4127087..c3197ce0e2ad 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -316,6 +316,11 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = ZAURUS_PXA_INFO,
 }, {
+        /* C-750/C-760/C-860/SL-C3000 PDA in MDLM mode */
+        USB_DEVICE_AND_INTERFACE_INFO(0x04DD, 0x9031, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
                  | USB_DEVICE_ID_MATCH_DEVICE,
         .idVendor               = 0x04DD,
@@ -349,6 +354,13 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = OLYMPUS_MXL_INFO,
 },
+
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+},
         { },            // END
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index de7fc345148a..3dcd3857a36c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -843,8 +843,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                 /* for simplicity, don't copy L4 headers */
                                 ctx->l4_hdr_size = 0;
                         }
-                        ctx->copy_size = ctx->eth_ip_hdr_size +
-                                         ctx->l4_hdr_size;
+                        ctx->copy_size = min(ctx->eth_ip_hdr_size +
+                                         ctx->l4_hdr_size, skb->len);
                 } else {
                         ctx->eth_ip_hdr_size = 0;
                         ctx->l4_hdr_size = 0;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 635b592ad961..a427a16bb739 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1346,7 +1346,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         fc = hdr->frame_control;
         for (i = 0; i < sc->hw->max_rates; i++) {
                 struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
-                if (!rate->count)
+                if (rate->idx < 0 || !rate->count)
                         break;
 
                 final_ts_idx = i;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c3b6c4652cd6..5b2972b43b0e 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -841,7 +841,12 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                 ret = mwifiex_set_rf_channel(priv, channel,
                                                 priv->adapter->channel_type);
 
-        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);  /* Disable keys */
+        /* As this is new association, clear locally stored
+         * keys and security related flags */
+        priv->sec_info.wpa_enabled = false;
+        priv->sec_info.wpa2_enabled = false;
+        priv->wep_key_curr_index = 0;
+        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
 
         if (mode == NL80211_IFTYPE_ADHOC) {
                 /* "privacy" is set only for ad-hoc mode */
@@ -886,6 +891,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                         dev_dbg(priv->adapter->dev,
                                 "info: setting wep encryption"
                                 " with key len %d\n", sme->key_len);
+                        priv->wep_key_curr_index = sme->key_idx;
                         ret = mwifiex_set_encode(priv, sme->key, sme->key_len,
                                                         sme->key_idx, 0);
                 }
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 53a31c753cb1..20c4557f5abd 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -364,10 +364,7 @@ static void release_controller(struct kref *kref)
         struct rdac_controller *ctlr;
         ctlr = container_of(kref, struct rdac_controller, kref);
 
-        flush_workqueue(kmpath_rdacd);
-        spin_lock(&list_lock);
         list_del(&ctlr->node);
-        spin_unlock(&list_lock);
         kfree(ctlr);
 }
 
@@ -376,20 +373,17 @@ static struct rdac_controller *get_controller(int index, char *array_name,
 {
         struct rdac_controller *ctlr, *tmp;
 
-        spin_lock(&list_lock);
-
         list_for_each_entry(tmp, &ctlr_list, node) {
                 if ((memcmp(tmp->array_id, array_id, UNIQUE_ID_LEN) == 0) &&
                           (tmp->index == index) &&
                           (tmp->host == sdev->host)) {
                         kref_get(&tmp->kref);
-                        spin_unlock(&list_lock);
                         return tmp;
                 }
         }
         ctlr = kmalloc(sizeof(*ctlr), GFP_ATOMIC);
         if (!ctlr)
-                goto done;
+                return NULL;
 
         /* initialize fields of controller */
         memcpy(ctlr->array_id, array_id, UNIQUE_ID_LEN);
@@ -405,8 +399,7 @@ static struct rdac_controller *get_controller(int index, char *array_name,
         INIT_WORK(&ctlr->ms_work, send_mode_select);
         INIT_LIST_HEAD(&ctlr->ms_head);
         list_add(&ctlr->node, &ctlr_list);
-done:
-        spin_unlock(&list_lock);
+
         return ctlr;
 }
 
@@ -517,9 +510,12 @@ static int initialize_controller(struct scsi_device *sdev,
                         index = 0;
                 else
                         index = 1;
+
+                spin_lock(&list_lock);
                 h->ctlr = get_controller(index, array_name, array_id, sdev);
                 if (!h->ctlr)
                         err = SCSI_DH_RES_TEMP_UNAVAIL;
+                spin_unlock(&list_lock);
         }
         return err;
 }
@@ -906,7 +902,9 @@ static int rdac_bus_attach(struct scsi_device *sdev)
         return 0;
 
 clean_ctlr:
+        spin_lock(&list_lock);
         kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
 
 failed:
         kfree(scsi_dh_data);
@@ -921,14 +919,19 @@ static void rdac_bus_detach( struct scsi_device *sdev )
         struct rdac_dh_data *h;
         unsigned long flags;
 
-        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
         scsi_dh_data = sdev->scsi_dh_data;
+        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        if (h->ctlr && h->ctlr->ms_queued)
+                flush_workqueue(kmpath_rdacd);
+
+        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
         sdev->scsi_dh_data = NULL;
         spin_unlock_irqrestore(sdev->request_queue->queue_lock, flags);
 
-        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        spin_lock(&list_lock);
         if (h->ctlr)
                 kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
         kfree(scsi_dh_data);
         module_put(THIS_MODULE);
         sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", RDAC_NAME);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 67b169b7a5be..b538f0883fd2 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4613,11 +4613,13 @@ static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
         ENTER;
         ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
 
-        dev_err(&ioa_cfg->pdev->dev,
-                "Adapter being reset as a result of error recovery.\n");
+        if (!ioa_cfg->in_reset_reload) {
+                dev_err(&ioa_cfg->pdev->dev,
+                        "Adapter being reset as a result of error recovery.\n");
 
-        if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
-                ioa_cfg->sdt_state = GET_DUMP;
+                if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
+                        ioa_cfg->sdt_state = GET_DUMP;
+        }
 
         rc = ipr_reset_reload(ioa_cfg, IPR_SHUTDOWN_ABBREV);
 
@@ -4907,7 +4909,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
         struct ipr_ioa_cfg *ioa_cfg;
         struct ipr_resource_entry *res;
         struct ipr_cmd_pkt *cmd_pkt;
-        u32 ioasc;
+        u32 ioasc, int_reg;
         int op_found = 0;
 
         ENTER;
@@ -4920,7 +4922,17 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
          */
         if (ioa_cfg->in_reset_reload || ioa_cfg->ioa_is_dead)
                 return FAILED;
-        if (!res || !ipr_is_gscsi(res))
+        if (!res)
+                return FAILED;
+
+        /*
+         * If we are aborting a timed out op, chances are that the timeout was caused
+         * by a still not detected EEH error. In such cases, reading a register will
+         * trigger the EEH recovery infrastructure.
+         */
+        int_reg = readl(ioa_cfg->regs.sense_interrupt_reg);
+
+        if (!ipr_is_gscsi(res))
                 return FAILED;
 
         list_for_each_entry(ipr_cmd, &ioa_cfg->pending_q, queue) {
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 1a65d6514237..418391b1c361 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -1848,9 +1848,11 @@ static enum sci_status sci_oem_parameters_set(struct isci_host *ihost)
         if (state == SCIC_RESET ||
             state == SCIC_INITIALIZING ||
             state == SCIC_INITIALIZED) {
+                u8 oem_version = pci_info->orom ? pci_info->orom->hdr.version :
+                        ISCI_ROM_VER_1_0;
 
                 if (sci_oem_parameters_validate(&ihost->oem_parameters,
-                                                pci_info->orom->hdr.version))
+                                                oem_version))
                         return SCI_FAILURE_INVALID_PARAMETER_VALUE;
 
                 return SCI_SUCCESS;
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 0b2c95583660..a78036f5e1a6 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -4548,7 +4548,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
                 printk(MPT2SAS_ERR_FMT "%s: pci error recovery reset\n",
                     ioc->name, __func__);
                 r = 0;
-                goto out;
+                goto out_unlocked;
         }
 
         if (mpt2sas_fwfault_debug)
@@ -4604,6 +4604,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
         spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
         mutex_unlock(&ioc->reset_in_progress_mutex);
 
+ out_unlocked:
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: exit\n", ioc->name,
             __func__));
         return r;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a2f1b3043dfb..9f41b3b4358f 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1036,8 +1036,7 @@ qla2x00_link_state_show(struct device *dev, struct device_attribute *attr,
             vha->device_flags & DFLG_NO_CABLE)
                 len = snprintf(buf, PAGE_SIZE, "Link Down\n");
         else if (atomic_read(&vha->loop_state) != LOOP_READY ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+            qla2x00_reset_active(vha))
                 len = snprintf(buf, PAGE_SIZE, "Unknown Link State\n");
         else {
                 len = snprintf(buf, PAGE_SIZE, "Link Up - ");
@@ -1359,8 +1358,7 @@ qla2x00_thermal_temp_show(struct device *dev,
                 return snprintf(buf, PAGE_SIZE, "\n");
 
         temp = frac = 0;
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+        if (qla2x00_reset_active(vha))
                 ql_log(ql_log_warn, vha, 0x707b,
                     "ISP reset active.\n");
         else if (!vha->hw->flags.eeh_busy)
@@ -1379,8 +1377,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr,
         int rval = QLA_FUNCTION_FAILED;
         uint16_t state[5];
 
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+        if (qla2x00_reset_active(vha))
                 ql_log(ql_log_warn, vha, 0x707c,
                     "ISP reset active.\n");
         else if (!vha->hw->flags.eeh_busy)
@@ -1693,9 +1690,7 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
         if (IS_FWI2_CAPABLE(ha)) {
                 rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma);
         } else if (atomic_read(&base_vha->loop_state) == LOOP_READY &&
-                    !test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) &&
-                    !test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
-                    !ha->dpc_active) {
+            !qla2x00_reset_active(vha) && !ha->dpc_active) {
                 /* Must be in a 'READY' state for statistics retrieval. */
                 rval = qla2x00_get_link_status(base_vha, base_vha->loop_id,
                                                 stats, stats_dma);
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index b1d0f936bf2d..1682e2e4201d 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -108,13 +108,6 @@ qla24xx_proc_fcp_prio_cfg_cmd(struct fc_bsg_job *bsg_job)
                 goto exit_fcp_prio_cfg;
         }
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ret = -EBUSY;
-                goto exit_fcp_prio_cfg;
-        }
-
         /* Get the sub command */
         oper = bsg_job->request->rqst_data.h_vendor.vendor_cmd[1];
 
@@ -646,13 +639,6 @@ qla2x00_process_loopback(struct fc_bsg_job *bsg_job)
         dma_addr_t rsp_data_dma;
         uint32_t rsp_data_len;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7018, "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!vha->flags.online) {
                 ql_log(ql_log_warn, vha, 0x7019, "Host is not online.\n");
                 return -EIO;
@@ -874,13 +860,6 @@ qla84xx_reset(struct fc_bsg_job *bsg_job)
         int rval = 0;
         uint32_t flag;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x702e, "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_QLA84XX(ha)) {
                 ql_dbg(ql_dbg_user, vha, 0x702f, "Not 84xx, exiting.\n");
                 return -EINVAL;
@@ -922,11 +901,6 @@ qla84xx_updatefw(struct fc_bsg_job *bsg_job)
         uint32_t flag;
         uint32_t fw_ver;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags))
-                return -EBUSY;
-
         if (!IS_QLA84XX(ha)) {
                 ql_dbg(ql_dbg_user, vha, 0x7032,
                     "Not 84xx, exiting.\n");
@@ -1036,14 +1010,6 @@ qla84xx_mgmt_cmd(struct fc_bsg_job *bsg_job)
         uint32_t data_len = 0;
         uint32_t dma_direction = DMA_NONE;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7039,
-                    "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_QLA84XX(ha)) {
                 ql_log(ql_log_warn, vha, 0x703a,
                     "Not 84xx, exiting.\n");
@@ -1246,13 +1212,6 @@ qla24xx_iidma(struct fc_bsg_job *bsg_job)
 
         bsg_job->reply->reply_payload_rcv_len = 0;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7045, "abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_IIDMA_CAPABLE(vha->hw)) {
                 ql_log(ql_log_info, vha, 0x7046, "iiDMA not supported.\n");
                 return -EINVAL;
@@ -1668,6 +1627,15 @@ qla24xx_bsg_request(struct fc_bsg_job *bsg_job)
                 vha = shost_priv(host);
         }
 
+        if (qla2x00_reset_active(vha)) {
+                ql_dbg(ql_dbg_user, vha, 0x709f,
+                    "BSG: ISP abort active/needed -- cmd=%d.\n",
+                    bsg_job->request->msgcode);
+                bsg_job->reply->result = (DID_ERROR << 16);
+                bsg_job->job_done(bsg_job);
+                return -EBUSY;
+        }
+
         ql_dbg(ql_dbg_user, vha, 0x7000,
             "Entered %s msgcode=0x%x.\n", __func__, bsg_job->request->msgcode);
 
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 7c54624b5b13..45cbf0ba624d 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -19,7 +19,8 @@
  * | DPC Thread                   |       0x401c       |                |
  * | Async Events                 |       0x5057       | 0x5052         |
  * | Timer Routines               |       0x6011       | 0x600e,0x600f  |
- * | User Space Interactions      |       0x709e       |                |
+ * | User Space Interactions      |       0x709e       | 0x7018,0x702e  |
+ * |                              |                    | 0x7039,0x7045  |
  * | Task Management              |       0x803c       | 0x8025-0x8026  |
  * |                              |                    | 0x800b,0x8039  |
  * | AER/EEH                      |       0x900f       |                |
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index a6a4eebce4a8..af1003f9de1e 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -44,6 +44,7 @@
  * ISP2100 HBAs.
  */
 #define MAILBOX_REGISTER_COUNT_2100     8
+#define MAILBOX_REGISTER_COUNT_2200     24
 #define MAILBOX_REGISTER_COUNT          32
 
 #define QLA2200A_RISC_ROM_VER   4
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 9902834e0b74..7cc4f36cd539 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -131,3 +131,16 @@ qla2x00_hba_err_chk_enabled(srb_t *sp)
         }
         return 0;
 }
+
+static inline int
+qla2x00_reset_active(scsi_qla_host_t *vha)
+{
+        scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
+
+        /* Test appropriate base-vha and vha flags. */
+        return test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_RETRY, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
+}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index e804585cc59c..349843ea32f6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2090,7 +2090,6 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
                         break;
                 case CT_IOCB_TYPE:
                         qla24xx_els_ct_entry(vha, rsp->req, pkt, CT_IOCB_TYPE);
-                        clear_bit(MBX_INTERRUPT, &vha->hw->mbx_cmd_flags);
                         break;
                 case ELS_IOCB_TYPE:
                         qla24xx_els_ct_entry(vha, rsp->req, pkt, ELS_IOCB_TYPE);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 34344d3f8658..08f1d01bdc1c 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -342,6 +342,8 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 
                                 set_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                 clear_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+                                /* Allow next mbx cmd to come in. */
+                                complete(&ha->mbx_cmd_comp);
                                 if (ha->isp_ops->abort_isp(vha)) {
                                         /* Failed. retry later. */
                                         set_bit(ISP_ABORT_NEEDED,
@@ -350,6 +352,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                 clear_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                 ql_dbg(ql_dbg_mbx, base_vha, 0x101f,
                                     "Finished abort_isp.\n");
+                                goto mbx_done;
                         }
                 }
         }
@@ -358,6 +361,7 @@ premature_exit:
         /* Allow next mbx cmd to come in. */
         complete(&ha->mbx_cmd_comp);
 
+mbx_done:
         if (rval) {
                 ql_dbg(ql_dbg_mbx, base_vha, 0x1020,
                     "**** Failed mbx[0]=%x, mb[1]=%x, mb[2]=%x, cmd=%x ****.\n",
@@ -2581,7 +2585,8 @@ qla2x00_stop_firmware(scsi_qla_host_t *vha)
         ql_dbg(ql_dbg_mbx, vha, 0x10a1, "Entered %s.\n", __func__);
 
         mcp->mb[0] = MBC_STOP_FIRMWARE;
-        mcp->out_mb = MBX_0;
+        mcp->mb[1] = 0;
+        mcp->out_mb = MBX_1|MBX_0;
         mcp->in_mb = MBX_0;
         mcp->tov = 5;
         mcp->flags = 0;
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 1cd46cd7ff90..270ba3130fde 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1165,19 +1165,6 @@ qla82xx_pinit_from_rom(scsi_qla_host_t *vha)
                 qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xfeffffff);
         else
                 qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xffffffff);
-
-        /* reset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val |= (1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
-
-        /* unreset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val &= ~(1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
-
         qla82xx_rom_unlock(ha);
 
         /* Read the signature value from the flash.
@@ -3392,7 +3379,7 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                             QLA82XX_CRB_PEG_NET_3 + 0x3c),
                                     qla82xx_rd_32(ha,
                                             QLA82XX_CRB_PEG_NET_4 + 0x3c));
-                                if (LSW(MSB(halt_status)) == 0x67)
+                                if (((halt_status & 0x1fffff00) >> 8) == 0x67)
                                         ql_log(ql_log_warn, vha, 0xb052,
                                             "Firmware aborted with "
                                             "error code 0x00006700. Device is "
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4ed1e4a96b95..036030c95339 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -625,6 +625,12 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
                         cmd->result = DID_NO_CONNECT << 16;
                         goto qc24_fail_command;
         }
+
+        if (!fcport) {
+                cmd->result = DID_NO_CONNECT << 16;
+                goto qc24_fail_command;
+        }
+
         if (atomic_read(&fcport->state) != FCS_ONLINE) {
                 if (atomic_read(&fcport->state) == FCS_DEVICE_DEAD ||
                         atomic_read(&base_vha->loop_state) == LOOP_DEAD) {
@@ -877,6 +883,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         if (ha->isp_ops->abort_command(sp)) {
+                ret = FAILED;
                 ql_dbg(ql_dbg_taskm, vha, 0x8003,
                     "Abort command mbx failed cmd=%p.\n", cmd);
         } else {
@@ -1124,7 +1131,6 @@ static int
 qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
 {
         scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-        fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
         struct qla_hw_data *ha = vha->hw;
         int ret = FAILED;
         unsigned int id, lun;
@@ -1133,15 +1139,6 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
         id = cmd->device->id;
         lun = cmd->device->lun;
 
-        if (!fcport) {
-                return ret;
-        }
-
-        ret = fc_block_scsi_eh(cmd);
-        if (ret != 0)
-                return ret;
-        ret = FAILED;
-
         ql_log(ql_log_info, vha, 0x8018,
             "ADAPTER RESET ISSUED nexus=%ld:%d:%d.\n", vha->host_no, id, lun);
 
@@ -2047,7 +2044,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 ha->nvram_data_off = ~0;
                 ha->isp_ops = &qla2100_isp_ops;
         } else if (IS_QLA2200(ha)) {
-                ha->mbx_count = MAILBOX_REGISTER_COUNT;
+                ha->mbx_count = MAILBOX_REGISTER_COUNT_2200;
                 req_length = REQUEST_ENTRY_CNT_2200;
                 rsp_length = RESPONSE_ENTRY_CNT_2100;
                 ha->max_loop_id = SNS_LAST_LOOP_ID_2100;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 23f33a6d52d7..29d780c38040 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.03.07.12-k"
+#define QLA2XXX_VERSION      "8.03.07.13-k"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index bf8bf79e6a1f..c4670642d023 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -7,6 +7,7 @@
 
 #include <linux/pm_runtime.h>
 #include <linux/export.h>
+#include <linux/async.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -92,6 +93,19 @@ static int scsi_bus_resume_common(struct device *dev)
         return err;
 }
 
+static int scsi_bus_prepare(struct device *dev)
+{
+        if (scsi_is_sdev_device(dev)) {
+                /* sd probing uses async_schedule.  Wait until it finishes. */
+                async_synchronize_full();
+
+        } else if (scsi_is_host_device(dev)) {
+                /* Wait until async scanning is finished */
+                scsi_complete_async_scans();
+        }
+        return 0;
+}
+
 static int scsi_bus_suspend(struct device *dev)
 {
         return scsi_bus_suspend_common(dev, PMSG_SUSPEND);
@@ -110,6 +124,7 @@ static int scsi_bus_poweroff(struct device *dev)
 #else /* CONFIG_PM_SLEEP */
 
 #define scsi_bus_resume_common          NULL
+#define scsi_bus_prepare                NULL
 #define scsi_bus_suspend                NULL
 #define scsi_bus_freeze                 NULL
 #define scsi_bus_poweroff               NULL
@@ -218,6 +233,7 @@ void scsi_autopm_put_host(struct Scsi_Host *shost)
 #endif /* CONFIG_PM_RUNTIME */
 
 const struct dev_pm_ops scsi_bus_pm_ops = {
+        .prepare =              scsi_bus_prepare,
         .suspend =              scsi_bus_suspend,
         .resume =               scsi_bus_resume_common,
         .freeze =               scsi_bus_freeze,
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 68eadd1c67fd..be4fa6d179b1 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -109,6 +109,7 @@ extern void scsi_exit_procfs(void);
 #endif /* CONFIG_PROC_FS */
 
 /* scsi_scan.c */
+extern int scsi_complete_async_scans(void);
 extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
                                    unsigned int, unsigned int, int);
 extern void scsi_forget_host(struct Scsi_Host *);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 89da43f73c00..29c4c0480976 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struct async_scan_data *data)
         }
         spin_unlock(&async_scan_lock);
 
+        scsi_autopm_put_host(shost);
         scsi_host_put(shost);
         kfree(data);
 }
@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)
 
         do_scsi_scan_host(shost);
         scsi_finish_async_scan(data);
-        scsi_autopm_put_host(shost);
         return 0;
 }
 
@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *shost)
         p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no);
         if (IS_ERR(p))
                 do_scan_async(data);
-        /* scsi_autopm_put_host(shost) is called in do_scan_async() */
+        /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */
 }
 EXPORT_SYMBOL(scsi_scan_host);
 
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 45fee368b092..92d314a73f69 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -190,7 +190,7 @@ static int __init sh_clk_init_parent(struct clk *clk)
                 return -EINVAL;
         }
 
-        clk->parent = clk->parent_table[val];
+        clk_reparent(clk, clk->parent_table[val]);
         if (!clk->parent) {
                 pr_err("sh_clk_init_parent: unable to set parent");
                 return -EINVAL;
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index f9975100d56d..3a3fdc62c75b 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -1061,7 +1061,7 @@ static struct pvr2_board {
         int (*init)(void);
         void (*exit)(void);
         char name[16];
-} board_driver[] = {
+} board_driver[] __refdata = {
 #ifdef CONFIG_SH_DREAMCAST
         { pvr2fb_dc_init, pvr2fb_dc_exit, "Sega DC PVR2" },
 #endif
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index d8d8e7ba6a1e..eb1cc92cd67d 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,6 +110,7 @@ struct autofs_sb_info {
         int sub_version;
         int min_proto;
         int max_proto;
+        int compat_daemon;
         unsigned long exp_timeout;
         unsigned int type;
         int reghost_enabled;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 76741d8d7786..85f1fcdb30e7 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -385,6 +385,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 sbi->pipefd = pipefd;
                 sbi->pipe = pipe;
                 sbi->catatonic = 0;
+                sbi->compat_daemon = is_compat_task();
         }
 out:
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index e16980b00b8d..06858d955120 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,6 +19,7 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
+#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
 
@@ -224,6 +225,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         set_autofs_type_indirect(&sbi->type);
         sbi->min_proto = 0;
         sbi->max_proto = 0;
+        sbi->compat_daemon = is_compat_task();
         mutex_init(&sbi->wq_mutex);
         mutex_init(&sbi->pipe_mutex);
         spin_lock_init(&sbi->fs_lock);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index da8876d38a7b..9c098db43344 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,7 +91,24 @@ static int autofs4_write(struct autofs_sb_info *sbi,
 
         return (bytes > 0);
 }
-        
+
+/*
+ * The autofs_v5 packet was misdesigned.
+ *
+ * The packets are identical on x86-32 and x86-64, but have different
+ * alignment. Which means that 'sizeof()' will give different results.
+ * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+ */
+static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+{
+        size_t pktsz = sizeof(struct autofs_v5_packet);
+#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+        if (sbi->compat_daemon > 0)
+                pktsz -= 4;
+#endif
+        return pktsz;
+}
+
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
@@ -155,8 +172,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         {
                 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
 
-                pktsz = sizeof(*packet);
-
+                pktsz = autofs_v5_packet_size(sbi);
                 packet->wait_queue_token = wq->wait_queue_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 633c701a287d..98f6bf10bbd4 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -892,6 +892,8 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 if (eb != eb_in)
                         free_extent_buffer(eb);
                 ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
+                if (ret > 0)
+                        ret = -ENOENT;
                 if (ret)
                         break;
                 next_inum = found_key.offset;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index b669a7d8e499..d986824bb2b4 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -644,7 +644,7 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
 static int btrfsic_process_superblock(struct btrfsic_state *state,
                                       struct btrfs_fs_devices *fs_devices)
 {
-        int ret;
+        int ret = 0;
         struct btrfs_super_block *selected_super;
         struct list_head *dev_head = &fs_devices->devices;
         struct btrfs_device *device;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 14f1c5a0b2d2..d02c27cd14c7 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -588,6 +588,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                    page_offset(bio->bi_io_vec->bv_page),
                                    PAGE_CACHE_SIZE);
         read_unlock(&em_tree->lock);
+        if (!em)
+                return -EIO;
 
         compressed_len = em->block_len;
         cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 27ebe61d3ccc..80b6486fd5e6 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -886,7 +886,7 @@ struct btrfs_block_rsv {
         u64 reserved;
         struct btrfs_space_info *space_info;
         spinlock_t lock;
-        unsigned int full:1;
+        unsigned int full;
 };
 
 /*
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 811d9f918b1c..534266fe505f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2260,6 +2260,12 @@ int open_ctree(struct super_block *sb,
                 goto fail_sb_buffer;
         }
 
+        if (sectorsize < PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size "
+                       "found on %s\n", sb->s_id);
+                goto fail_sb_buffer;
+        }
+
         mutex_lock(&fs_info->chunk_mutex);
         ret = btrfs_read_sys_array(tree_root);
         mutex_unlock(&fs_info->chunk_mutex);
@@ -2301,6 +2307,12 @@ int open_ctree(struct super_block *sb,
 
         btrfs_close_extra_devices(fs_devices);
 
+        if (!fs_devices->latest_bdev) {
+                printk(KERN_CRIT "btrfs: failed to read devices on %s\n",
+                       sb->s_id);
+                goto fail_tree_roots;
+        }
+
 retry_root_backup:
         blocksize = btrfs_level_size(tree_root,
                                      btrfs_super_root_level(disk_super));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 283af7a676a3..37e0a800d34e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3312,7 +3312,8 @@ commit_trans:
         }
         data_sinfo->bytes_may_use += bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 1);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 1);
         spin_unlock(&data_sinfo->lock);
 
         return 0;
@@ -3333,7 +3334,8 @@ void btrfs_free_reserved_data_space(struct inode *inode, u64 bytes)
         spin_lock(&data_sinfo->lock);
         data_sinfo->bytes_may_use -= bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 0);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 0);
         spin_unlock(&data_sinfo->lock);
 }
 
@@ -3611,12 +3613,15 @@ static int may_commit_transaction(struct btrfs_root *root,
         if (space_info != delayed_rsv->space_info)
                 return -ENOSPC;
 
+        spin_lock(&space_info->lock);
         spin_lock(&delayed_rsv->lock);
-        if (delayed_rsv->size < bytes) {
+        if (space_info->bytes_pinned + delayed_rsv->size < bytes) {
                 spin_unlock(&delayed_rsv->lock);
+                spin_unlock(&space_info->lock);
                 return -ENOSPC;
         }
         spin_unlock(&delayed_rsv->lock);
+        spin_unlock(&space_info->lock);
 
 commit:
         trans = btrfs_join_transaction(root);
@@ -3695,9 +3700,9 @@ again:
                 if (used + orig_bytes <= space_info->total_bytes) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         /*
@@ -3766,9 +3771,9 @@ again:
                 if (used + num_bytes < space_info->total_bytes + avail) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         wait_ordered = true;
@@ -3913,8 +3918,8 @@ static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
                         spin_lock(&space_info->lock);
                         space_info->bytes_may_use -= num_bytes;
                         trace_btrfs_space_reservation(fs_info, "space_info",
-                                                      (u64)space_info,
-                                                      num_bytes, 0);
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                         space_info->reservation_progress++;
                         spin_unlock(&space_info->lock);
                 }
@@ -4105,7 +4110,7 @@ static u64 calc_global_metadata_size(struct btrfs_fs_info *fs_info)
         num_bytes += div64_u64(data_used + meta_used, 50);
 
         if (num_bytes * 3 > meta_used)
-                num_bytes = div64_u64(meta_used, 3);
+                num_bytes = div64_u64(meta_used, 3) * 2;
 
         return ALIGN(num_bytes, fs_info->extent_root->leafsize << 10);
 }
@@ -4132,14 +4137,14 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 block_rsv->reserved += num_bytes;
                 sinfo->bytes_may_use += num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 1);
+                                      (u64)(unsigned long)sinfo, num_bytes, 1);
         }
 
         if (block_rsv->reserved >= block_rsv->size) {
                 num_bytes = block_rsv->reserved - block_rsv->size;
                 sinfo->bytes_may_use -= num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 0);
+                                      (u64)(unsigned long)sinfo, num_bytes, 0);
                 sinfo->reservation_progress++;
                 block_rsv->reserved = block_rsv->size;
                 block_rsv->full = 1;
@@ -4192,7 +4197,8 @@ void btrfs_trans_release_metadata(struct btrfs_trans_handle *trans,
         if (!trans->bytes_reserved)
                 return;
 
-        trace_btrfs_space_reservation(root->fs_info, "transaction", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "transaction",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
         trans->bytes_reserved = 0;
@@ -4710,9 +4716,9 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                         space_info->bytes_reserved += num_bytes;
                         if (reserve == RESERVE_ALLOC) {
                                 trace_btrfs_space_reservation(cache->fs_info,
-                                                              "space_info",
-                                                              (u64)space_info,
-                                                              num_bytes, 0);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                                 space_info->bytes_may_use -= num_bytes;
                         }
                 }
@@ -7886,9 +7892,16 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
         u64 start;
         u64 end;
         u64 trimmed = 0;
+        u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
         int ret = 0;
 
-        cache = btrfs_lookup_block_group(fs_info, range->start);
+        /*
+         * try to trim all FS space, our block group may start from non-zero.
+         */
+        if (range->len == total_bytes)
+                cache = btrfs_lookup_first_block_group(fs_info, range->start);
+        else
+                cache = btrfs_lookup_block_group(fs_info, range->start);
 
         while (cache) {
                 if (cache->key.objectid >= (range->start + range->len)) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index fcf77e1ded40..a55fbe6252de 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -513,6 +513,15 @@ hit_next:
         WARN_ON(state->end < start);
         last_end = state->end;
 
+        if (state->end < end && !need_resched())
+                next_node = rb_next(&state->rb_node);
+        else
+                next_node = NULL;
+
+        /* the state doesn't have the wanted bits, go ahead */
+        if (!(state->state & bits))
+                goto next;
+
         /*
          *     | ---- desired range ---- |
          *  | state | or
@@ -565,20 +574,15 @@ hit_next:
                 goto out;
         }
 
-        if (state->end < end && prealloc && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
-
         set |= clear_state_bit(tree, state, &bits, wake);
+next:
         if (last_end == (u64)-1)
                 goto out;
         start = last_end + 1;
         if (start <= end && next_node) {
                 state = rb_entry(next_node, struct extent_state,
                                  rb_node);
-                if (state->start == start)
-                        goto hit_next;
+                goto hit_next;
         }
         goto search_again;
 
@@ -961,8 +965,6 @@ hit_next:
 
                 set_state_bits(tree, state, &bits);
                 clear_state_bit(tree, state, &clear_bits, 0);
-
-                merge_state(tree, state);
                 if (last_end == (u64)-1)
                         goto out;
 
@@ -1007,7 +1009,6 @@ hit_next:
                 if (state->end <= end) {
                         set_state_bits(tree, state, &bits);
                         clear_state_bit(tree, state, &clear_bits, 0);
-                        merge_state(tree, state);
                         if (last_end == (u64)-1)
                                 goto out;
                         start = last_end + 1;
@@ -1068,8 +1069,6 @@ hit_next:
 
                 set_state_bits(tree, prealloc, &bits);
                 clear_state_bit(tree, prealloc, &clear_bits, 0);
-
-                merge_state(tree, prealloc);
                 prealloc = NULL;
                 goto out;
         }
@@ -2154,13 +2153,46 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
                  "this_mirror=%d, num_copies=%d, in_validation=%d\n", read_mode,
                  failrec->this_mirror, num_copies, failrec->in_validation);
 
-        tree->ops->submit_bio_hook(inode, read_mode, bio, failrec->this_mirror,
-                                        failrec->bio_flags, 0);
-        return 0;
+        ret = tree->ops->submit_bio_hook(inode, read_mode, bio,
+                                         failrec->this_mirror,
+                                         failrec->bio_flags, 0);
+        return ret;
 }
 
 /* lots and lots of room for performance fixes in the end_bio funcs */
 
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+{
+        int uptodate = (err == 0);
+        struct extent_io_tree *tree;
+        int ret;
+
+        tree = &BTRFS_I(page->mapping->host)->io_tree;
+
+        if (tree->ops && tree->ops->writepage_end_io_hook) {
+                ret = tree->ops->writepage_end_io_hook(page, start,
+                                               end, NULL, uptodate);
+                if (ret)
+                        uptodate = 0;
+        }
+
+        if (!uptodate && tree->ops &&
+            tree->ops->writepage_io_failed_hook) {
+                ret = tree->ops->writepage_io_failed_hook(NULL, page,
+                                                 start, end, NULL);
+                /* Writeback already completed */
+                if (ret == 0)
+                        return 1;
+        }
+
+        if (!uptodate) {
+                clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
+                ClearPageUptodate(page);
+                SetPageError(page);
+        }
+        return 0;
+}
+
 /*
  * after a writepage IO is done, we need to:
  * clear the uptodate bits on error
@@ -2172,13 +2204,11 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
  */
 static void end_bio_extent_writepage(struct bio *bio, int err)
 {
-        int uptodate = err == 0;
         struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
         int whole_page;
-        int ret;
 
         do {
                 struct page *page = bvec->bv_page;
@@ -2195,28 +2225,9 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
 
                 if (--bvec >= bio->bi_io_vec)
                         prefetchw(&bvec->bv_page->flags);
-                if (tree->ops && tree->ops->writepage_end_io_hook) {
-                        ret = tree->ops->writepage_end_io_hook(page, start,
-                                                       end, NULL, uptodate);
-                        if (ret)
-                                uptodate = 0;
-                }
-
-                if (!uptodate && tree->ops &&
-                    tree->ops->writepage_io_failed_hook) {
-                        ret = tree->ops->writepage_io_failed_hook(bio, page,
-                                                         start, end, NULL);
-                        if (ret == 0) {
-                                uptodate = (err == 0);
-                                continue;
-                        }
-                }
 
-                if (!uptodate) {
-                        clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
-                        ClearPageUptodate(page);
-                        SetPageError(page);
-                }
+                if (end_extent_writepage(page, err, start, end))
+                        continue;
 
                 if (whole_page)
                         end_page_writeback(page);
@@ -2779,9 +2790,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                                 delalloc_start = delalloc_end + 1;
                                 continue;
                         }
-                        tree->ops->fill_delalloc(inode, page, delalloc_start,
-                                                 delalloc_end, &page_started,
-                                                 &nr_written);
+                        ret = tree->ops->fill_delalloc(inode, page,
+                                                       delalloc_start,
+                                                       delalloc_end,
+                                                       &page_started,
+                                                       &nr_written);
+                        BUG_ON(ret);
                         /*
                          * delalloc_end is already one less than the total
                          * length, so we don't subtract one from
@@ -2818,8 +2832,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         if (tree->ops && tree->ops->writepage_start_hook) {
                 ret = tree->ops->writepage_start_hook(page, start,
                                                       page_end);
-                if (ret == -EAGAIN) {
-                        redirty_page_for_writepage(wbc, page);
+                if (ret) {
+                        /* Fixup worker will requeue */
+                        if (ret == -EBUSY)
+                                wbc->pages_skipped++;
+                        else
+                                redirty_page_for_writepage(wbc, page);
                         update_nr_written(page, wbc, nr_written);
                         unlock_page(page);
                         ret = 0;
@@ -3289,7 +3307,7 @@ int try_release_extent_mapping(struct extent_map_tree *map,
                         len = end - start + 1;
                         write_lock(&map->lock);
                         em = lookup_extent_mapping(map, start, len);
-                        if (IS_ERR_OR_NULL(em)) {
+                        if (!em) {
                                 write_unlock(&map->lock);
                                 break;
                         }
@@ -3853,10 +3871,9 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         num_pages = num_extent_pages(eb->start, eb->len);
         clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
-        if (eb_straddles_pages(eb)) {
-                clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                                      cached_state, GFP_NOFS);
-        }
+        clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
+                              cached_state, GFP_NOFS);
+
         for (i = 0; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
                 if (page)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc6a042cb6fc..cecc3518c121 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -319,4 +319,5 @@ struct btrfs_mapping_tree;
 int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                         u64 length, u64 logical, struct page *page,
                         int mirror_num);
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end);
 #endif
diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h
index 33a7890b1f40..1195f09761fe 100644
--- a/fs/btrfs/extent_map.h
+++ b/fs/btrfs/extent_map.h
@@ -26,8 +26,8 @@ struct extent_map {
         unsigned long flags;
         struct block_device *bdev;
         atomic_t refs;
-        unsigned int in_tree:1;
-        unsigned int compress_type:4;
+        unsigned int in_tree;
+        unsigned int compress_type;
 };
 
 struct extent_map_tree {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 859ba2dd8890..e8d06b6b9194 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1605,6 +1605,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                 return -EOPNOTSUPP;
 
         /*
+         * Make sure we have enough space before we do the
+         * allocation.
+         */
+        ret = btrfs_check_data_free_space(inode, len);
+        if (ret)
+                return ret;
+
+        /*
          * wait for ordered IO before we have any locks.  We'll loop again
          * below with the locks held.
          */
@@ -1667,27 +1675,12 @@ static long btrfs_fallocate(struct file *file, int mode,
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-
-                        /*
-                         * Make sure we have enough space before we do the
-                         * allocation.
-                         */
-                        ret = btrfs_check_data_free_space(inode, last_byte -
-                                                          cur_offset);
-                        if (ret) {
-                                free_extent_map(em);
-                                break;
-                        }
-
                         ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                         last_byte - cur_offset,
                                                         1 << inode->i_blkbits,
                                                         offset + len,
                                                         &alloc_hint);
 
-                        /* Let go of our reservation. */
-                        btrfs_free_reserved_data_space(inode, last_byte -
-                                                       cur_offset);
                         if (ret < 0) {
                                 free_extent_map(em);
                                 break;
@@ -1715,6 +1708,8 @@ static long btrfs_fallocate(struct file *file, int mode,
                              &cached_state, GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
+        /* Let go of our reservation. */
+        btrfs_free_reserved_data_space(inode, len);
         return ret;
 }
 
@@ -1761,7 +1756,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
                                                      start - root->sectorsize,
                                                      root->sectorsize, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         goto out;
                 }
                 last_end = em->start + em->len;
@@ -1773,7 +1768,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
         while (1) {
                 em = btrfs_get_extent_fiemap(inode, NULL, 0, start, len, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         break;
                 }
 
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c2f20594c9f7..710ea380c7ed 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -777,6 +777,7 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         spin_lock(&block_group->lock);
         if (block_group->disk_cache_state != BTRFS_DC_WRITTEN) {
                 spin_unlock(&block_group->lock);
+                btrfs_free_path(path);
                 goto out;
         }
         spin_unlock(&block_group->lock);
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 213ffa86ce1b..ee15d88b33d2 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -438,7 +438,8 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
                                           trans->bytes_reserved);
         if (ret)
                 goto out;
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 1);
 again:
         inode = lookup_free_ino_inode(root, path);
@@ -500,7 +501,8 @@ again:
 out_put:
         iput(inode);
 out_release:
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
 out:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 32214fe0f7e3..892b34785ccc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1555,6 +1555,7 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
         struct inode *inode;
         u64 page_start;
         u64 page_end;
+        int ret;
 
         fixup = container_of(work, struct btrfs_writepage_fixup, work);
         page = fixup->page;
@@ -1582,12 +1583,21 @@ again:
                                      page_end, &cached_state, GFP_NOFS);
                 unlock_page(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
+                btrfs_put_ordered_extent(ordered);
                 goto again;
         }
 
-        BUG();
+        ret = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
+        if (ret) {
+                mapping_set_error(page->mapping, ret);
+                end_extent_writepage(page, ret, page_start, page_end);
+                ClearPageChecked(page);
+                goto out;
+         }
+
         btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state);
         ClearPageChecked(page);
+        set_page_dirty(page);
 out:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
                              &cached_state, GFP_NOFS);
@@ -1630,7 +1640,7 @@ static int btrfs_writepage_start_hook(struct page *page, u64 start, u64 end)
         fixup->work.func = btrfs_writepage_fixup_worker;
         fixup->page = page;
         btrfs_queue_worker(&root->fs_info->fixup_workers, &fixup->work);
-        return -EAGAIN;
+        return -EBUSY;
 }
 
 static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
@@ -4575,7 +4585,8 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_insert_dir_item(trans, root, name, name_len,
                                             parent_inode, &key,
                                             btrfs_inode_type(inode), index);
-                BUG_ON(ret);
+                if (ret)
+                        goto fail_dir_item;
 
                 btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                    name_len * 2);
@@ -4583,6 +4594,23 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_update_inode(trans, root, parent_inode);
         }
         return ret;
+
+fail_dir_item:
+        if (unlikely(ino == BTRFS_FIRST_FREE_OBJECTID)) {
+                u64 local_index;
+                int err;
+                err = btrfs_del_root_ref(trans, root->fs_info->tree_root,
+                                 key.objectid, root->root_key.objectid,
+                                 parent_ino, &local_index, name, name_len);
+
+        } else if (add_backref) {
+                u64 local_index;
+                int err;
+
+                err = btrfs_del_inode_ref(trans, root, name, name_len,
+                                          ino, parent_ino, &local_index);
+        }
+        return ret;
 }
 
 static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
@@ -6696,8 +6724,10 @@ int btrfs_create_subvol_root(struct btrfs_trans_handle *trans,
         int err;
         u64 index = 0;
 
-        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2, new_dirid,
-                                new_dirid, S_IFDIR | 0700, &index);
+        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2,
+                                new_dirid, new_dirid,
+                                S_IFDIR | (~current_umask() & S_IRWXUGO),
+                                &index);
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
         inode->i_op = &btrfs_dir_inode_operations;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 03bb62a9ee24..d8b54715c2de 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -861,6 +861,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
         int i_done;
         struct btrfs_ordered_extent *ordered;
         struct extent_state *cached_state = NULL;
+        struct extent_io_tree *tree;
         gfp_t mask = btrfs_alloc_write_mask(inode->i_mapping);
 
         if (isize == 0)
@@ -871,18 +872,34 @@ static int cluster_pages_for_defrag(struct inode *inode,
                                            num_pages << PAGE_CACHE_SHIFT);
         if (ret)
                 return ret;
-again:
-        ret = 0;
         i_done = 0;
+        tree = &BTRFS_I(inode)->io_tree;
 
         /* step one, lock all the pages */
         for (i = 0; i < num_pages; i++) {
                 struct page *page;
+again:
                 page = find_or_create_page(inode->i_mapping,
-                                            start_index + i, mask);
+                                           start_index + i, mask);
                 if (!page)
                         break;
 
+                page_start = page_offset(page);
+                page_end = page_start + PAGE_CACHE_SIZE - 1;
+                while (1) {
+                        lock_extent(tree, page_start, page_end, GFP_NOFS);
+                        ordered = btrfs_lookup_ordered_extent(inode,
+                                                              page_start);
+                        unlock_extent(tree, page_start, page_end, GFP_NOFS);
+                        if (!ordered)
+                                break;
+
+                        unlock_page(page);
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                        lock_page(page);
+                }
+
                 if (!PageUptodate(page)) {
                         btrfs_readpage(NULL, page);
                         lock_page(page);
@@ -893,15 +910,22 @@ again:
                                 break;
                         }
                 }
+
                 isize = i_size_read(inode);
                 file_end = (isize - 1) >> PAGE_CACHE_SHIFT;
-                if (!isize || page->index > file_end ||
-                    page->mapping != inode->i_mapping) {
+                if (!isize || page->index > file_end) {
                         /* whoops, we blew past eof, skip this page */
                         unlock_page(page);
                         page_cache_release(page);
                         break;
                 }
+
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto again;
+                }
+
                 pages[i] = page;
                 i_done++;
         }
@@ -924,25 +948,6 @@ again:
         lock_extent_bits(&BTRFS_I(inode)->io_tree,
                          page_start, page_end - 1, 0, &cached_state,
                          GFP_NOFS);
-        ordered = btrfs_lookup_first_ordered_extent(inode, page_end - 1);
-        if (ordered &&
-            ordered->file_offset + ordered->len > page_start &&
-            ordered->file_offset < page_end) {
-                btrfs_put_ordered_extent(ordered);
-                unlock_extent_cached(&BTRFS_I(inode)->io_tree,
-                                     page_start, page_end - 1,
-                                     &cached_state, GFP_NOFS);
-                for (i = 0; i < i_done; i++) {
-                        unlock_page(pages[i]);
-                        page_cache_release(pages[i]);
-                }
-                btrfs_wait_ordered_range(inode, page_start,
-                                         page_end - page_start);
-                goto again;
-        }
-        if (ordered)
-                btrfs_put_ordered_extent(ordered);
-
         clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start,
                           page_end - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
                           EXTENT_DO_ACCOUNTING, 0, 0, &cached_state,
@@ -1327,6 +1332,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                 goto out;
         }
 
+        if (name[0] == '.' &&
+           (namelen == 1 || (name[1] == '.' && namelen == 2))) {
+                ret = -EEXIST;
+                goto out;
+        }
+
         if (subvol) {
                 ret = btrfs_mksubvol(&file->f_path, name, namelen,
                                      NULL, transid, readonly);
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9770cc5bfb76..abc0fbffa510 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1367,7 +1367,8 @@ out:
 }
 
 static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
-        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length)
+        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length,
+        u64 dev_offset)
 {
         struct btrfs_mapping_tree *map_tree =
                 &sdev->dev->dev_root->fs_info->mapping_tree;
@@ -1391,7 +1392,8 @@ static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
                 goto out;
 
         for (i = 0; i < map->num_stripes; ++i) {
-                if (map->stripes[i].dev == sdev->dev) {
+                if (map->stripes[i].dev == sdev->dev &&
+                    map->stripes[i].physical == dev_offset) {
                         ret = scrub_stripe(sdev, map, i, chunk_offset, length);
                         if (ret)
                                 goto out;
@@ -1487,7 +1489,7 @@ int scrub_enumerate_chunks(struct scrub_dev *sdev, u64 start, u64 end)
                         break;
                 }
                 ret = scrub_chunk(sdev, chunk_tree, chunk_objectid,
-                                  chunk_offset, length);
+                                  chunk_offset, length, found_key.offset);
                 btrfs_put_block_group(cache);
                 if (ret)
                         break;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 287a6728b1ad..04b77e3ceb7a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -327,7 +327,8 @@ again:
 
         if (num_bytes) {
                 trace_btrfs_space_reservation(root->fs_info, "transaction",
-                                              (u64)h, num_bytes, 1);
+                                              (u64)(unsigned long)h,
+                                              num_bytes, 1);
                 h->block_rsv = &root->fs_info->trans_block_rsv;
                 h->bytes_reserved = num_bytes;
         }
@@ -915,7 +916,11 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
                                 dentry->d_name.name, dentry->d_name.len,
                                 parent_inode, &key,
                                 BTRFS_FT_DIR, index);
-        BUG_ON(ret);
+        if (ret) {
+                pending->error = -EEXIST;
+                dput(parent);
+                goto fail;
+        }
 
         btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                          dentry->d_name.len * 2);
@@ -993,12 +998,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
         struct btrfs_pending_snapshot *pending;
         struct list_head *head = &trans->transaction->pending_snapshots;
-        int ret;
 
-        list_for_each_entry(pending, head, list) {
-                ret = create_pending_snapshot(trans, fs_info, pending);
-                BUG_ON(ret);
-        }
+        list_for_each_entry(pending, head, list)
+                create_pending_snapshot(trans, fs_info, pending);
         return 0;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0b4e2af7954d..ef41f285a475 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -459,12 +459,23 @@ int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
         struct btrfs_device *device, *next;
 
+        struct block_device *latest_bdev = NULL;
+        u64 latest_devid = 0;
+        u64 latest_transid = 0;
+
         mutex_lock(&uuid_mutex);
 again:
         /* This is the initialized path, it is safe to release the devices. */
         list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
-                if (device->in_fs_metadata)
+                if (device->in_fs_metadata) {
+                        if (!latest_transid ||
+                            device->generation > latest_transid) {
+                                latest_devid = device->devid;
+                                latest_transid = device->generation;
+                                latest_bdev = device->bdev;
+                        }
                         continue;
+                }
 
                 if (device->bdev) {
                         blkdev_put(device->bdev, device->mode);
@@ -487,6 +498,10 @@ again:
                 goto again;
         }
 
+        fs_devices->latest_bdev = latest_bdev;
+        fs_devices->latest_devid = latest_devid;
+        fs_devices->latest_trans = latest_transid;
+
         mutex_unlock(&uuid_mutex);
         return 0;
 }
@@ -1953,7 +1968,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
         em = lookup_extent_mapping(em_tree, chunk_offset, 1);
         read_unlock(&em_tree->lock);
 
-        BUG_ON(em->start > chunk_offset ||
+        BUG_ON(!em || em->start > chunk_offset ||
                em->start + em->len < chunk_offset);
         map = (struct map_lookup *)em->bdev;
 
@@ -4356,6 +4371,20 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                 return -ENOMEM;
         btrfs_set_buffer_uptodate(sb);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
+        /*
+         * The sb extent buffer is artifical and just used to read the system array.
+         * btrfs_set_buffer_uptodate() call does not properly mark all it's
+         * pages up-to-date when the page is larger: extent does not cover the
+         * whole page and consequently check_page_uptodate does not find all
+         * the page's extents up-to-date (the hole beyond sb),
+         * write_extent_buffer then triggers a WARN_ON.
+         *
+         * Regular short extents go through mark_extent_buffer_dirty/writeback cycle,
+         * but sb spans only this function. Add an explicit SetPageUptodate call
+         * to silence the warning eg. on PowerPC 64.
+         */
+        if (PAGE_CACHE_SIZE > BTRFS_SUPER_INFO_SIZE)
+                SetPageUptodate(sb->first_page);
 
         write_extent_buffer(sb, super_copy, 0, BTRFS_SUPER_INFO_SIZE);
         array_size = btrfs_super_sys_array_size(super_copy);
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 4a588dbd11bf..f4aadd15b613 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -173,7 +173,7 @@ void inode_dio_wait(struct inode *inode)
         if (atomic_read(&inode->i_dio_count))
                 __inode_dio_wait(inode);
 }
-EXPORT_SYMBOL_GPL(inode_dio_wait);
+EXPORT_SYMBOL(inode_dio_wait);
 
 /*
  * inode_dio_done - signal finish of a direct I/O requests
@@ -187,7 +187,7 @@ void inode_dio_done(struct inode *inode)
         if (atomic_dec_and_test(&inode->i_dio_count))
                 wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
 }
-EXPORT_SYMBOL_GPL(inode_dio_done);
+EXPORT_SYMBOL(inode_dio_done);
 
 /*
  * How many pages are in the queue?
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index aabdfc38cf24..ea54cdef04dd 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -320,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
         return !list_empty(p);
 }
 
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+{
+        return container_of(p, struct eppoll_entry, wait);
+}
+
 /* Get the "struct epitem" from a wait queue pointer */
 static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
 {
@@ -467,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
         put_cpu();
 }
 
+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+
+        rcu_read_lock();
+        /* If it is cleared by POLLFREE, it should be rcu-safe */
+        whead = rcu_dereference(pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        rcu_read_unlock();
+}
+
 /*
  * This function unregisters poll callbacks from the associated file
  * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
@@ -481,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
                 pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
 
                 list_del(&pwq->llink);
-                remove_wait_queue(pwq->whead, &pwq->wait);
+                ep_remove_wait_queue(pwq);
                 kmem_cache_free(pwq_cache, pwq);
         }
 }
@@ -842,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
         struct epitem *epi = ep_item_from_wait(wait);
         struct eventpoll *ep = epi->ep;
 
+        if ((unsigned long)key & POLLFREE) {
+                ep_pwq_from_wait(wait)->whead = NULL;
+                /*
+                 * whead = NULL above can race with ep_remove_wait_queue()
+                 * which can do another remove_wait_queue() after us, so we
+                 * can't use __remove_wait_queue(). whead->lock is held by
+                 * the caller.
+                 */
+                list_del_init(&wait->task_list);
+        }
+
         spin_lock_irqsave(&ep->lock, flags);
 
         /*
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 492465b451dd..7ae2a574cb25 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -30,6 +30,21 @@
 #include <linux/signalfd.h>
 #include <linux/syscalls.h>
 
+void signalfd_cleanup(struct sighand_struct *sighand)
+{
+        wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+        /*
+         * The lockless check can race with remove_wait_queue() in progress,
+         * but in this case its caller should run under rcu_read_lock() and
+         * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
+         */
+        if (likely(!waitqueue_active(wqh)))
+                return;
+
+        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        wake_up_poll(wqh, POLLHUP | POLLFREE);
+}
+
 struct signalfd_ctx {
         sigset_t sigmask;
 };
diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
index 44bce836d350..9ce7f44aebd2 100644
--- a/include/asm-generic/poll.h
+++ b/include/asm-generic/poll.h
@@ -28,6 +28,8 @@
 #define POLLRDHUP       0x2000
 #endif
 
+#define POLLFREE        0x4000  /* currently only for epoll */
+
 struct pollfd {
         int fd;
         short events;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f6515f46..7e05fcee75a1 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -561,5 +561,9 @@ asmlinkage ssize_t compat_sys_process_vm_writev(compat_pid_t pid,
                 unsigned long liovcnt, const struct compat_iovec __user *rvec,
                 unsigned long riovcnt, unsigned long flags);
 
+#else
+
+#define is_compat_task() (0)
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c52d4b5f872a..4b24ff453aee 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -137,6 +137,7 @@ enum {
         IFLA_AF_SPEC,
         IFLA_GROUP,             /* Group the device belongs to */
         IFLA_NET_NS_FD,
+        IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
         __IFLA_MAX
 };
 
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 8797ed16feb2..4dd5bd6994a8 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -285,8 +285,8 @@ struct ebt_table {
         struct module *me;
 };
 
-#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
-                     ~(__alignof__(struct ebt_replace)-1))
+#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
+                     ~(__alignof__(struct _xt_align)-1))
 extern struct ebt_table *ebt_register_table(struct net *net,
                                             const struct ebt_table *table);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 8e872ead88b5..577592ea0ea0 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -602,6 +602,9 @@ struct tcamsg {
 #define TCA_ACT_TAB 1 /* attr type must be >=1 */       
 #define TCAA_MAX 1
 
+/* New extended info filters for IFLA_EXT_MASK */
+#define RTEXT_FILTER_VF         (1 << 0)
+
 /* End of information exported to user level */
 
 #ifdef __KERNEL__
diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
index 3ff4961da9b5..247399b2979a 100644
--- a/include/linux/signalfd.h
+++ b/include/linux/signalfd.h
@@ -61,13 +61,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
                 wake_up(&tsk->sighand->signalfd_wqh);
 }
 
+extern void signalfd_cleanup(struct sighand_struct *sighand);
+
 #else /* CONFIG_SIGNALFD */
 
 static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
 
+static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
+
 #endif /* CONFIG_SIGNALFD */
 
 #endif /* __KERNEL__ */
 
 #endif /* _LINUX_SIGNALFD_H */
-
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 50db9b04a552..ae86adee3746 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1465,6 +1465,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
 
+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
+{
+        if (skb_mac_header_was_set(skb)) {
+                const unsigned char *old_mac = skb_mac_header(skb);
+
+                skb_set_mac_header(skb, -skb->mac_len);
+                memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        }
+}
+
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
         return skb->csum_start - skb_headroom(skb);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index abaad6ed9b83..4a82ca0bb0b2 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -256,4 +256,6 @@ void l2cap_exit(void);
 int sco_init(void);
 void sco_exit(void);
 
+void bt_sock_reclassify_lock(struct sock *sk, int proto);
+
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea9231f4935f..453893b3120e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -540,7 +540,7 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
-        cancel_delayed_work_sync(&conn->disc_work);
+        cancel_delayed_work(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
@@ -559,9 +559,9 @@ static inline void hci_conn_put(struct hci_conn *conn)
                 } else {
                         timeo = msecs_to_jiffies(10);
                 }
-                cancel_delayed_work_sync(&conn->disc_work);
+                cancel_delayed_work(&conn->disc_work);
                 queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, jiffies + timeo);
+                                        &conn->disc_work, timeo);
         }
 }
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 68f589150692..b1664ed884e6 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -611,7 +611,7 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 {
         BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
 
-        if (!__cancel_delayed_work(work))
+        if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
         schedule_delayed_work(work, timeout);
 }
@@ -619,20 +619,20 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 static inline void l2cap_clear_timer(struct l2cap_chan *chan,
                                         struct delayed_work *work)
 {
-        if (__cancel_delayed_work(work))
+        if (cancel_delayed_work(work))
                 l2cap_chan_put(chan);
 }
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
 #define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                L2CAP_DEFAULT_RETRANS_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
 #define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                L2CAP_DEFAULT_MONITOR_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
-                L2CAP_DEFAULT_ACK_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
 #define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 
 static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
@@ -834,7 +834,7 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                                                                 bdaddr_t *dst);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 8a2b0ae7dbd2..ab86036bbf0c 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -209,7 +209,7 @@ extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple);
 
-extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_insert_dying_list(struct nf_conn *ct);
 
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 678f1ffaf843..370293901971 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,7 +6,7 @@
 
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
-typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 
 extern int      __rtnl_register(int protocol, int msgtype,
                                 rtnl_doit_func, rtnl_dumpit_func,
diff --git a/kernel/fork.c b/kernel/fork.c
index b77fd559c78e..e2cd3e2a5ae8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -66,6 +66,7 @@
 #include <linux/user-return-notifier.h>
 #include <linux/oom.h>
 #include <linux/khugepaged.h>
+#include <linux/signalfd.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -935,8 +936,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
 
 void __cleanup_sighand(struct sighand_struct *sighand)
 {
-        if (atomic_dec_and_test(&sighand->count))
+        if (atomic_dec_and_test(&sighand->count)) {
+                signalfd_cleanup(sighand);
                 kmem_cache_free(sighand_cachep, sighand);
+        }
 }
 
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6728a7ae6f2d..228d6461c12a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4414,6 +4414,9 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
          */
         BUG_ON(!thresholds);
 
+        if (!thresholds->primary)
+                goto unlock;
+
         usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
 
         /* Check if a threshold crossed before removing */
@@ -4462,7 +4465,7 @@ swap_buffers:
 
         /* To be sure that nobody uses thresholds */
         synchronize_rcu();
-
+unlock:
         mutex_unlock(&memcg->thresholds_lock);
 }
 
diff --git a/mm/nommu.c b/mm/nommu.c
index b982290fd962..f59e170fceb4 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_insert(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* add the VMA to the tree */
@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_remove(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* remove from the MM's tree and list */
@@ -775,8 +779,6 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
 
         if (vma->vm_next)
                 vma->vm_next->vm_prev = vma->vm_prev;
-
-        vma->vm_mm = NULL;
 }
 
 /*
@@ -2052,6 +2054,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
         high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
         down_write(&nommu_region_sem);
+        mutex_lock(&inode->i_mapping->i_mmap_mutex);
 
         /* search for VMAs that fall within the dead zone */
         vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
@@ -2059,6 +2062,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 /* found one - only interested if it's shared out of the page
                  * cache */
                 if (vma->vm_flags & VM_SHARED) {
+                        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
                         up_write(&nommu_region_sem);
                         return -ETXTBSY; /* not quite true, but near enough */
                 }
@@ -2086,6 +2090,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 }
         }
 
+        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
         up_write(&nommu_region_sem);
         return 0;
 }
diff --git a/net/atm/clip.c b/net/atm/clip.c
index c12c2582457c..127fe70a1baa 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -46,8 +46,8 @@
 
 static struct net_device *clip_devs;
 static struct atm_vcc *atmarpd;
-static struct neigh_table clip_tbl;
 static struct timer_list idle_timer;
+static const struct neigh_ops clip_neigh_ops;
 
 static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 {
@@ -123,6 +123,8 @@ static int neigh_check_cb(struct neighbour *n)
         struct atmarp_entry *entry = neighbour_priv(n);
         struct clip_vcc *cv;
 
+        if (n->ops != &clip_neigh_ops)
+                return 0;
         for (cv = entry->vccs; cv; cv = cv->next) {
                 unsigned long exp = cv->last_use + cv->idle_timeout;
 
@@ -154,10 +156,10 @@ static int neigh_check_cb(struct neighbour *n)
 
 static void idle_timer_check(unsigned long dummy)
 {
-        write_lock(&clip_tbl.lock);
-        __neigh_for_each_release(&clip_tbl, neigh_check_cb);
+        write_lock(&arp_tbl.lock);
+        __neigh_for_each_release(&arp_tbl, neigh_check_cb);
         mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
-        write_unlock(&clip_tbl.lock);
+        write_unlock(&arp_tbl.lock);
 }
 
 static int clip_arp_rcv(struct sk_buff *skb)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ef92864ac625..72eb187a5f60 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -71,19 +71,16 @@ static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
         "slock-AF_BLUETOOTH-BTPROTO_AVDTP",
 };
 
-static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
+void bt_sock_reclassify_lock(struct sock *sk, int proto)
 {
-        struct sock *sk = sock->sk;
-
-        if (!sk)
-                return;
-
+        BUG_ON(!sk);
         BUG_ON(sock_owned_by_user(sk));
 
         sock_lock_init_class_and_name(sk,
                         bt_slock_key_strings[proto], &bt_slock_key[proto],
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
+EXPORT_SYMBOL(bt_sock_reclassify_lock);
 
 int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
@@ -145,7 +142,8 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto,
 
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                 err = bt_proto[proto]->create(net, sock, proto, kern);
-                bt_sock_reclassify_lock(sock, proto);
+                if (!err)
+                        bt_sock_reclassify_lock(sock->sk, proto);
                 module_put(bt_proto[proto]->owner);
         }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3db432473ad5..07bc69ed9498 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -635,6 +635,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
+
+                /* encrypt must be pending if auth is also pending */
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 9de93714213a..5aeb62491198 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -640,7 +640,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         /* Reset device */
         skb_queue_purge(&hdev->cmd_q);
         atomic_set(&hdev->cmd_cnt, 1);
-        if (!test_bit(HCI_RAW, &hdev->flags)) {
+        if (!test_bit(HCI_RAW, &hdev->flags) &&
+                                test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
                                         msecs_to_jiffies(250));
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index faf0b11ac1d3..32d338c30e65 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         hci_chan_del(conn->hchan);
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work_sync(&conn->info_timer);
 
         if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work_sync(&conn->security_timer);
                 smp_chan_destroy(conn);
         }
 
@@ -1120,7 +1120,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
         return c1;
 }
 
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
 {
         struct sock *sk = chan->sk;
         bdaddr_t *src = &bt_sk(sk)->src;
@@ -2574,7 +2574,7 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
                                         cmd->ident == conn->info_ident) {
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work(&conn->info_timer);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
                 conn->info_ident = 0;
@@ -2970,7 +2970,8 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         default:
                 sk->sk_err = ECONNRESET;
-                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
+                __set_chan_timer(chan,
+                                msecs_to_jiffies(L2CAP_DISC_REJ_TIMEOUT));
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -3120,7 +3121,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
                         conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
                 return 0;
 
-        __cancel_delayed_work(&conn->info_timer);
+        cancel_delayed_work(&conn->info_timer);
 
         if (result != L2CAP_IR_SUCCESS) {
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
@@ -4478,7 +4479,8 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         __clear_chan_timer(chan);
-                        __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
+                        __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_ENC_TIMEOUT));
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
@@ -4499,7 +4501,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
         if (hcon->type == LE_LINK) {
                 smp_distribute_keys(conn, 0);
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work(&conn->security_timer);
         }
 
         rcu_read_lock();
@@ -4546,7 +4548,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
                                 __clear_chan_timer(chan);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                         }
                 } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
@@ -4566,7 +4569,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 }
                         } else {
                                 l2cap_state_change(chan, BT_DISCONN);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c61d967012b2..401d9428ae4c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -849,6 +849,8 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
         if (!sk)
                 return NULL;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
+
         l2cap_sock_init(sk, parent);
 
         return l2cap_pi(sk)->chan;
@@ -1002,7 +1004,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
+        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 501649bf5596..8a602388f1e7 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,12 +1164,18 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        /* When socket is closed and we are not RFCOMM
-                         * initiator rfcomm_process_rx already calls
-                         * rfcomm_session_put() */
-                        if (s->sock->sk->sk_state != BT_CLOSED)
-                                if (list_empty(&s->dlcs))
-                                        rfcomm_session_put(s);
+                        /* rfcomm_session_put is called later so don't do
+                         * anything here otherwise we will mess up the session
+                         * reference counter:
+                         *
+                         * (a) when we are the initiator dlc_unlink will drive
+                         * the reference counter to 0 (there is no initial put
+                         * after session_add)
+                         *
+                         * (b) when we are not the initiator rfcomm_rx_process
+                         * will explicitly call put to balance the initial hold
+                         * done after session add.
+                         */
                         break;
                 }
         }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index f066678faeee..22169c3f1482 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -956,6 +956,8 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
         if (!sk)
                 goto done;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
+
         rfcomm_sock_init(sk, parent);
         bacpy(&bt_sk(sk)->src, &src);
         bacpy(&bt_sk(sk)->dst, &dst);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e287346e0934..2a83914b0277 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -826,6 +826,8 @@ next_elt:
                 write_unlock_bh(&tbl->lock);
                 cond_resched();
                 write_lock_bh(&tbl->lock);
+                nht = rcu_dereference_protected(tbl->nht,
+                                                lockdep_is_held(&tbl->lock));
         }
         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 65aebd450027..606a6e8f3671 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -60,7 +60,6 @@ struct rtnl_link {
 };
 
 static DEFINE_MUTEX(rtnl_mutex);
-static u16 min_ifinfo_dump_size;
 
 void rtnl_lock(void)
 {
@@ -724,10 +723,11 @@ static void copy_rtnl_link_stats64(void *v, const struct rtnl_link_stats64 *b)
 }
 
 /* All VF info */
-static inline int rtnl_vfinfo_size(const struct net_device *dev)
+static inline int rtnl_vfinfo_size(const struct net_device *dev,
+                                   u32 ext_filter_mask)
 {
-        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
-
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent) &&
+            (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int num_vfs = dev_num_vf(dev->dev.parent);
                 size_t size = nla_total_size(sizeof(struct nlattr));
                 size += nla_total_size(num_vfs * sizeof(struct nlattr));
@@ -766,7 +766,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
                 return port_self_size;
 }
 
-static noinline size_t if_nlmsg_size(const struct net_device *dev)
+static noinline size_t if_nlmsg_size(const struct net_device *dev,
+                                     u32 ext_filter_mask)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
                + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
@@ -784,8 +785,9 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(4) /* IFLA_MASTER */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
-               + nla_total_size(4) /* IFLA_NUM_VF */
-               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
+               + nla_total_size(ext_filter_mask
+                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
                + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
                + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
                + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
@@ -868,7 +870,7 @@ static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
 
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
-                            unsigned int flags)
+                            unsigned int flags, u32 ext_filter_mask)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
@@ -941,10 +943,11 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                 goto nla_put_failure;
         copy_rtnl_link_stats64(nla_data(attr), stats);
 
-        if (dev->dev.parent)
+        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF))
                 NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
 
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
+            && (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int i;
 
                 struct nlattr *vfinfo, *vf;
@@ -1048,6 +1051,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct hlist_head *head;
         struct hlist_node *node;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
 
         s_h = cb->args[0];
         s_idx = cb->args[1];
@@ -1055,6 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
+        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                    ifla_policy);
+
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
@@ -1064,7 +1075,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
                                              NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI) <= 0)
+                                             NLM_F_MULTI,
+                                             ext_filter_mask) <= 0)
                                 goto out;
 
                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -1100,6 +1112,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
         [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
+        [IFLA_EXT_MASK]         = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -1509,8 +1522,6 @@ errout:
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
-                                     min_ifinfo_dump_size);
 
         return err;
 }
@@ -1842,6 +1853,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
         int err;
+        u32 ext_filter_mask = 0;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
         if (err < 0)
@@ -1850,6 +1862,9 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
 
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
                 dev = __dev_get_by_index(net, ifm->ifi_index);
@@ -1861,12 +1876,12 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (dev == NULL)
                 return -ENODEV;
 
-        nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
+        nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL);
         if (nskb == NULL)
                 return -ENOBUFS;
 
         err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
-                               nlh->nlmsg_seq, 0, 0);
+                               nlh->nlmsg_seq, 0, 0, ext_filter_mask);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
@@ -1877,8 +1892,31 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         return err;
 }
 
-static u16 rtnl_calcit(struct sk_buff *skb)
+static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
+        u16 min_ifinfo_dump_size = 0;
+
+        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
+
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
+        if (!ext_filter_mask)
+                return NLMSG_GOODSIZE;
+        /*
+         * traverse the list of net devices and compute the minimum
+         * buffer size based upon the filter mask.
+         */
+        list_for_each_entry(dev, &net->dev_base_head, dev_list) {
+                min_ifinfo_dump_size = max_t(u16, min_ifinfo_dump_size,
+                                             if_nlmsg_size(dev,
+                                                           ext_filter_mask));
+        }
+
         return min_ifinfo_dump_size;
 }
 
@@ -1913,13 +1951,11 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
         int err = -ENOBUFS;
         size_t if_info_size;
 
-        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev)), GFP_KERNEL);
+        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), GFP_KERNEL);
         if (skb == NULL)
                 goto errout;
 
-        min_ifinfo_dump_size = max_t(u16, if_info_size, min_ifinfo_dump_size);
-
-        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0);
+        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -1977,7 +2013,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
                 calcit = rtnl_get_calcit(family, type);
                 if (calcit)
-                        min_dump_alloc = calcit(skb);
+                        min_dump_alloc = calcit(skb, nlh);
 
                 __rtnl_unlock();
                 rtnl = net->rtnl;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 6b3ca5ba4450..38673d2860e2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -65,7 +65,7 @@
    it is infeasible task. The most general solutions would be
    to keep skb->encapsulation counter (sort of local ttl),
    and silently drop packet when it expires. It is a good
-   solution, but it supposes maintaing new variable in ALL
+   solution, but it supposes maintaining new variable in ALL
    skb, even if no tunneling is used.
 
    Current solution: xmit_recursion breaks dead loops. This is a percpu
@@ -91,14 +91,14 @@
 
    One of them is to parse packet trying to detect inner encapsulation
    made by our node. It is difficult or even impossible, especially,
-   taking into account fragmentation. TO be short, tt is not solution at all.
+   taking into account fragmentation. TO be short, ttl is not solution at all.
 
    Current solution: The solution was UNEXPECTEDLY SIMPLE.
    We force DF flag on tunnels with preconfigured hop limit,
    that is ALL. :-) Well, it does not remove the problem completely,
    but exponential growth of network traffic is changed to linear
    (branches, that exceed pmtu are pruned) and tunnel mtu
-   fastly degrades to value <68, where looping stops.
+   rapidly degrades to value <68, where looping stops.
    Yes, it is not good if there exists a router in the loop,
    which does not force DF, even when encapsulating packets have DF set.
    But it is not our problem! Nobody could accuse us, we made
@@ -457,8 +457,8 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
    GRE tunnels with enabled checksum. Tell them "thank you".
 
    Well, I wonder, rfc1812 was written by Cisco employee,
-   what the hell these idiots break standrads established
-   by themself???
+   what the hell these idiots break standards established
+   by themselves???
  */
 
         const struct iphdr *iph = (const struct iphdr *)skb->data;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index aea5a199c37a..b072386cee21 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -630,6 +630,7 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         pr_debug("ping_recvmsg(sk=%p,sk->num=%u)\n", isk, isk->inet_num);
 
+        err = -EOPNOTSUPP;
         if (flags & MSG_OOB)
                 goto out;
 
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 63418185f524..e3db3f915114 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, sizeof(*iph));
         skb_reset_network_header(skb);
-
-        memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-                skb->mac_len);
-        skb_set_mac_header(skb, -skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm4_beet_make_header(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e114ac..ed4bf11ef9f4 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        const unsigned char *old_mac;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c7e95c8c579f..5aa3981a3922 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1926,8 +1926,10 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
         };
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst)
+        if (dst->error) {
+                dst_release(dst);
                 goto out_free;
+        }
 
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8f02ef88e59..c964958ac470 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1545,9 +1545,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return;
-
+        }
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst))
                 return;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index a81ce9450750..9949a356d62c 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 261e6e6f487e..9f2095b19ad0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
-        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 2406b3e7393f..d86217d56bd7 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,14 +63,14 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
                             TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                            TEST(TDLS_PEER_AUTH));
+                            TEST(TDLS_PEER_AUTH), TEST(RATE_CONTROL));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5a5a7767d541..ad64f4d5271a 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -336,7 +336,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         int i;
         u32 mask;
 
-        if (sta) {
+        if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 168427b0ffdc..80cfc006dd74 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -41,7 +41,7 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
 
-        if (!ref)
+        if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
                 return;
 
         ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
@@ -62,6 +62,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
+        set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6f77f12dc3fc..bfed851d0d36 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -52,6 +52,7 @@
  * @WLAN_STA_SP: Station is in a service period, so don't try to
  *      reply to other uAPSD trigger frames or PS-Poll.
  * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
+ * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -71,6 +72,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_UAPSD,
         WLAN_STA_SP,
         WLAN_STA_4ADDR_EVENT,
+        WLAN_STA_RATE_CONTROL,
 };
 
 enum ieee80211_sta_state {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 611c3359b94d..2555816e7788 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         __be16 dport = 0;               /* destination port to forward */
         unsigned int flags;
         struct ip_vs_conn_param param;
+        const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
         union nf_inet_addr snet;        /* source network of the client,
                                            after masking */
 
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         {
                 int protocol = iph.protocol;
                 const union nf_inet_addr *vaddr = &iph.daddr;
-                const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
                 __be16 vport = 0;
 
                 if (dst_port == svc->port) {
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 76613f5a55c0..ed86a3be678e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -404,19 +404,49 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                            &net->ct.hash[repl_hash]);
 }
 
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+int
+nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
         unsigned int hash, repl_hash;
+        struct nf_conntrack_tuple_hash *h;
+        struct hlist_nulls_node *n;
         u16 zone;
 
         zone = nf_ct_zone(ct);
-        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        hash = hash_conntrack(net, zone,
+                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone,
+                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+
+        spin_lock_bh(&nf_conntrack_lock);
 
+        /* See if there's one in the list already, including reverse */
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+
+        add_timer(&ct->timeout);
+        nf_conntrack_get(&ct->ct_general);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        NF_CT_STAT_INC(net, insert);
+        spin_unlock_bh(&nf_conntrack_lock);
+
+        return 0;
+
+out:
+        NF_CT_STAT_INC(net, insert_failed);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return -EEXIST;
 }
-EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
 /* Confirm a connection given skb; places it in hash table */
 int
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9307b033c0c9..30c9d4ca0218 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1367,15 +1367,12 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
                         rcu_read_unlock();
-                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
-                                spin_lock_bh(&nf_conntrack_lock);
                                 err = -EOPNOTSUPP;
                                 goto err1;
                         }
 
-                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname,
                                                             nf_ct_l3num(ct),
@@ -1468,8 +1465,10 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
         if (tstamp)
                 tstamp->start = ktime_to_ns(ktime_get_real());
 
-        add_timer(&ct->timeout);
-        nf_conntrack_hash_insert(ct);
+        err = nf_conntrack_hash_check_insert(ct);
+        if (err < 0)
+                goto err2;
+
         rcu_read_unlock();
 
         return ct;
@@ -1490,6 +1489,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct nf_conntrack_tuple otuple, rtuple;
         struct nf_conntrack_tuple_hash *h = NULL;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+        struct nf_conn *ct;
         u_int8_t u3 = nfmsg->nfgen_family;
         u16 zone;
         int err;
@@ -1510,27 +1510,22 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         return err;
         }
 
-        spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(net, zone, &otuple);
+                h = nf_conntrack_find_get(net, zone, &otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(net, zone, &rtuple);
+                h = nf_conntrack_find_get(net, zone, &rtuple);
 
         if (h == NULL) {
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
-                        struct nf_conn *ct;
                         enum ip_conntrack_events events;
 
                         ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
-                        if (IS_ERR(ct)) {
-                                err = PTR_ERR(ct);
-                                goto out_unlock;
-                        }
+                        if (IS_ERR(ct))
+                                return PTR_ERR(ct);
+
                         err = 0;
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
                                 events = IPCT_RELATED;
                         else
@@ -1545,23 +1540,19 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
                         nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
+                }
 
                 return err;
         }
         /* implicit 'else' */
 
-        /* We manipulate the conntrack inside the global conntrack table lock,
-         * so there's no need to increase the refcount */
         err = -EEXIST;
+        ct = nf_ct_tuplehash_to_ctrack(h);
         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
-                struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
-
+                spin_lock_bh(&nf_conntrack_lock);
                 err = ctnetlink_change_conntrack(ct, cda);
+                spin_unlock_bh(&nf_conntrack_lock);
                 if (err == 0) {
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                       (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
@@ -1570,15 +1561,10 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       (1 << IPCT_MARK),
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
-                        nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
-
-                return err;
+                }
         }
 
-out_unlock:
-        spin_unlock_bh(&nf_conntrack_lock);
+        nf_ct_put(ct);
         return err;
 }
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index b3a7db678b8d..ce60cf0f6c11 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -203,6 +203,27 @@ err:
         return status;
 }
 
+#ifdef CONFIG_BRIDGE_NETFILTER
+/* When called from bridge netfilter, skb->data must point to MAC header
+ * before calling skb_gso_segment(). Else, original MAC header is lost
+ * and segmented skbs will be sent to wrong destination.
+ */
+static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_push(skb, skb->network_header - skb->mac_header);
+}
+
+static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_pull(skb, skb->network_header - skb->mac_header);
+}
+#else
+#define nf_bridge_adjust_skb_data(s) do {} while (0)
+#define nf_bridge_adjust_segmented_data(s) do {} while (0)
+#endif
+
 int nf_queue(struct sk_buff *skb,
              struct list_head *elem,
              u_int8_t pf, unsigned int hook,
@@ -212,7 +233,7 @@ int nf_queue(struct sk_buff *skb,
              unsigned int queuenum)
 {
         struct sk_buff *segs;
-        int err;
+        int err = -EINVAL;
         unsigned int queued;
 
         if (!skb_is_gso(skb))
@@ -228,23 +249,25 @@ int nf_queue(struct sk_buff *skb,
                 break;
         }
 
+        nf_bridge_adjust_skb_data(skb);
         segs = skb_gso_segment(skb, 0);
         /* Does not use PTR_ERR to limit the number of error codes that can be
          * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean
          * 'ignore this hook'.
          */
         if (IS_ERR(segs))
-                return -EINVAL;
-
+                goto out_err;
         queued = 0;
         err = 0;
         do {
                 struct sk_buff *nskb = segs->next;
 
                 segs->next = NULL;
-                if (err == 0)
+                if (err == 0) {
+                        nf_bridge_adjust_segmented_data(segs);
                         err = __nf_queue(segs, elem, pf, hook, indev,
                                            outdev, okfn, queuenum);
+                }
                 if (err == 0)
                         queued++;
                 else
@@ -252,11 +275,12 @@ int nf_queue(struct sk_buff *skb,
                 segs = nskb;
         } while (segs);
 
-        /* also free orig skb if only some segments were queued */
-        if (unlikely(err && queued))
-                err = 0;
-        if (err == 0)
+        if (queued) {
                 kfree_skb(skb);
+                return 0;
+        }
+  out_err:
+        nf_bridge_adjust_segmented_data(skb);
         return err;
 }
 
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 3aae66facf9f..4d5057902839 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -152,9 +152,10 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
         fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
                            (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return false;
-
+        }
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
         skb->dev      = dst->dev;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e83d61ca78ca..5da548fa7ae9 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -501,9 +501,8 @@ tfifo_dequeue:
 
                 /* if more time remaining? */
                 if (cb->time_to_send <= psched_get_time()) {
-                        skb = qdisc_dequeue_tail(sch);
-                        if (unlikely(!skb))
-                                goto qdisc_dequeue;
+                        __skb_unlink(skb, &sch->q);
+                        sch->qstats.backlog -= qdisc_pkt_len(skb);
 
 #ifdef CONFIG_NET_CLS_ACT
                         /*
@@ -539,7 +538,6 @@ deliver:
                 qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
         }
 
-qdisc_dequeue:
         if (q->qdisc) {
                 skb = q->qdisc->ops->dequeue(q->qdisc);
                 if (skb)
diff --git a/scripts/coccicheck b/scripts/coccicheck
index 3c2776466d87..823e972149e5 100755
--- a/scripts/coccicheck
+++ b/scripts/coccicheck
@@ -9,15 +9,10 @@ if [ "$C" = "1" -o "$C" = "2" ]; then
 #    FLAGS="-ignore_unknown_options -very_quiet"
 #    OPTIONS=$*
 
-    if [ "$KBUILD_EXTMOD" = "" ] ; then
-        # Workaround for Coccinelle < 0.2.3
-        FLAGS="-I $srctree/include -very_quiet"
-        shift $(( $# - 1 ))
-        OPTIONS=$1
-    else
-        echo M= is not currently supported when C=1 or C=2
-        exit 1
-    fi
+# Workaround for Coccinelle < 0.2.3
+        FLAGS="-I $srctree/include -very_quiet"
+        shift $(( $# - 1 ))
+        OPTIONS=$1
 else
     ONLINE=0
     FLAGS="-very_quiet"
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index a27235685949..2ae481703141 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -9,12 +9,6 @@ fi
 DEPMOD=$1
 KERNELRELEASE=$2
 
-if ! "$DEPMOD" -V 2>/dev/null | grep -q module-init-tools; then
-        echo "Warning: you may need to install module-init-tools" >&2
-        echo "See http://www.codemonkey.org.uk/docs/post-halloween-2.6.txt" >&2
-        sleep 1
-fi
-
 if ! test -r System.map -a -x "$DEPMOD"; then
         exit 0
 fi
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index d0de2a2c3a2d..b89efe6e4c85 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -46,11 +46,37 @@ struct devtable {
         void *function;
 };
 
+#define ___cat(a,b) a ## b
+#define __cat(a,b) ___cat(a,b)
+
+/* we need some special handling for this host tool running eventually on
+ * Darwin. The Mach-O section handling is a bit different than ELF section
+ * handling. The differnces in detail are:
+ *  a) we have segments which have sections
+ *  b) we need a API call to get the respective section symbols */
+#if defined(__MACH__)
+#include <mach-o/getsect.h>
+
+#define INIT_SECTION(name)  do {                                        \
+                unsigned long name ## _len;                             \
+                char *__cat(pstart_,name) = getsectdata("__TEXT",       \
+                        #name, &__cat(name,_len));                      \
+                char *__cat(pstop_,name) = __cat(pstart_,name) +        \
+                        __cat(name, _len);                              \
+                __cat(__start_,name) = (void *)__cat(pstart_,name);     \
+                __cat(__stop_,name) = (void *)__cat(pstop_,name);       \
+        } while (0)
+#define SECTION(name)   __attribute__((section("__TEXT, " #name)))
+
+struct devtable **__start___devtable, **__stop___devtable;
+#else
+#define INIT_SECTION(name) /* no-op for ELF */
+#define SECTION(name)   __attribute__((section(#name)))
+
 /* We construct a table of pointers in an ELF section (pointers generally
  * go unpadded by gcc).  ld creates boundary syms for us. */
 extern struct devtable *__start___devtable[], *__stop___devtable[];
-#define ___cat(a,b) a ## b
-#define __cat(a,b) ___cat(a,b)
+#endif /* __MACH__ */
 
 #if __GNUC__ == 3 && __GNUC_MINOR__ < 3
 # define __used                 __attribute__((__unused__))
@@ -65,8 +91,8 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
                                                 (type *)NULL,           \
                                                 (char *)NULL)),         \
                 sizeof(type), (function) };                             \
-        static struct devtable *__attribute__((section("__devtable"))) \
-                __used __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
+        static struct devtable *SECTION(__devtable) __used \
+                __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
 
 #define ADD(str, sep, cond, field)                              \
 do {                                                            \
@@ -1080,6 +1106,7 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
                 do_pnp_card_entries(symval, sym->st_size, mod);
         else {
                 struct devtable **p;
+                INIT_SECTION(__devtable);
 
                 for (p = __start___devtable; p < __stop___devtable; p++) {
                         if (sym_is(name, namelen, (*p)->device_id)) {
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index f6cbc3ddb68b..3c6c0b14c807 100644
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -238,14 +238,14 @@ EOF
 fi
 
 # Build header package
-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$)
-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$)
-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$)
+(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
+(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
+(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -)
-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -)
-rm -f /tmp/files$$ /tmp/objfiles$$
+(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
+(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -)
+rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
 arch=$(dpkg --print-architecture)
 
 cat <<EOF >> debian/control