Merge branch 'sh/stable-updates' into sh-latest

author: Paul Mundt <lethal@linux-sh.org> 2011-06-21 04:47:44 -0400
committer: Paul Mundt <lethal@linux-sh.org> 2011-06-21 04:47:44 -0400
commit: 9dd056e9eba106ef622795b566f769a9ab0a49a8 (patch)
tree: 390c07ea2c3b9631c2e8fe64c1a6feba0b503e8b
parent: 08ef2e427b59393d68a65b16e97e894b662a5573 (diff)
parent: f2b9726105824fdeea32a339e5072a358f89a25b (diff)
215 files changed, 2487 insertions, 1483 deletions
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index f48178024067..db3b1aba32a3 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -843,6 +843,7 @@ Provides counts of softirq handlers serviced since boot time, for each cpu.
 TASKLET:          0          0          0        290
   SCHED:      27035      26983      26971      26746
 HRTIMER:          0          0          0          0
+     RCU:       1678       1769       2178       2250
 1.3 IDE devices in /proc/ide
diff --git a/MAINTAINERS b/MAINTAINERS
index 6c59eb90fdf4..f0358cd91de3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2291,8 +2291,7 @@ F:	drivers/scsi/eata_pio.*
 EBTABLES
 M:      Bart De Schuymer <bart.de.schuymer@pandora.be>
-L:      ebtables-user@lists.sourceforge.net
+L:      netfilter-devel@vger.kernel.org
-L:      ebtables-devel@lists.sourceforge.net
 W:      http://ebtables.sourceforge.net/
 S:      Maintained
 F:      include/linux/netfilter_bridge/ebt_*.h
@@ -6463,7 +6462,7 @@ M:	Jiri Kosina <jkosina@suse.cz>
 L:      linux-usb@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid.git
 S:      Maintained
-F:      Documentation/usb/hiddev.txt
+F:      Documentation/hid/hiddev.txt
 F:      drivers/hid/usbhid/
 USB ISP116X DRIVER
@@ -7007,6 +7006,13 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
+X86 MCE INFRASTRUCTURE
+M:      Tony Luck <tony.luck@intel.com>
+M:      Borislav Petkov <bp@amd64.org>
+L:      linux-edac@vger.kernel.org
+S:      Maintained
+F:      arch/x86/kernel/cpu/mcheck/*
 XEN HYPERVISOR INTERFACE
 M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
 M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
diff --git a/Makefile b/Makefile
index badb9239e2bb..41330a06e4ec 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Sneaky Weasel
 # *DOCUMENTATION*
@@ -1526,7 +1526,8 @@ quiet_cmd_rmfiles = $(if $(wildcard $(rm-files)),CLEAN   $(wildcard $(rm-files))
 # Run depmod only if we have System.map and depmod is executable
 quiet_cmd_depmod = DEPMOD  $(KERNELRELEASE)
-      cmd_depmod = $(srctree)/scripts/depmod.sh $(DEPMOD) $(KERNELRELEASE)
+      cmd_depmod = $(CONFIG_SHELL) $(srctree)/scripts/depmod.sh $(DEPMOD) \
+                   $(KERNELRELEASE)
 # Create temporary dir for module support files
 # clean it up only when building all modules
diff --git a/arch/arm/mach-msm/timer.c b/arch/arm/mach-msm/timer.c
index 38b95e949d13..63621f152c98 100644
--- a/arch/arm/mach-msm/timer.c
+++ b/arch/arm/mach-msm/timer.c
@@ -23,6 +23,8 @@
 #include <linux/io.h>
 #include <asm/mach/time.h>
+#include <asm/hardware/gic.h>
 #include <mach/msm_iomap.h>
 #include <mach/cpu.h>
@@ -55,10 +57,12 @@ enum timer_location {
 #if defined(CONFIG_ARCH_QSD8X50)
 #define DGT_HZ (19200000 / 4) /* 19.2 MHz / 4 by default */
 #define MSM_DGT_SHIFT (0)
-#elif defined(CONFIG_ARCH_MSM7X30) || defined(CONFIG_ARCH_MSM8X60) || \
+#elif defined(CONFIG_ARCH_MSM7X30)
-                                      defined(CONFIG_ARCH_MSM8960)
 #define DGT_HZ (24576000 / 4) /* 24.576 MHz (LPXO) / 4 by default */
 #define MSM_DGT_SHIFT (0)
+#elif defined(CONFIG_ARCH_MSM8X60) || defined(CONFIG_ARCH_MSM8960)
+#define DGT_HZ (27000000 / 4) /* 27 MHz (PXO) / 4 by default */
+#define MSM_DGT_SHIFT (0)
 #else
 #define DGT_HZ 19200000 /* 19.2 MHz or 600 KHz after shift */
 #define MSM_DGT_SHIFT (5)
@@ -100,7 +104,11 @@ static cycle_t msm_read_timer_count(struct clocksource *cs)
 {
        struct msm_clock *clk = container_of(cs, struct msm_clock, clocksource);
-        return readl(clk->global_counter);
+        /*
+         * Shift timer count down by a constant due to unreliable lower bits
+         * on some targets.
+         */
+        return readl(clk->global_counter) >> clk->shift;
 }
 static struct msm_clock *clockevent_to_clock(struct clock_event_device *evt)
diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
index af98117043d2..5b114d1558c8 100644
--- a/arch/arm/mach-omap1/Makefile
+++ b/arch/arm/mach-omap1/Makefile
@@ -4,14 +4,14 @@
 # Common support
 obj-y := io.o id.o sram.o time.o irq.o mux.o flash.o serial.o devices.o dma.o
-obj-y += clock.o clock_data.o opp_data.o reset.o
+obj-y += clock.o clock_data.o opp_data.o reset.o pm_bus.o
 obj-$(CONFIG_OMAP_MCBSP) += mcbsp.o
 obj-$(CONFIG_OMAP_32K_TIMER)    += timer32k.o
 # Power Management
-obj-$(CONFIG_PM) += pm.o sleep.o pm_bus.o
+obj-$(CONFIG_PM) += pm.o sleep.o
 # DSP
 obj-$(CONFIG_OMAP_MBOX_FWK)     += mailbox_mach.o
diff --git a/arch/arm/mach-omap1/pm_bus.c b/arch/arm/mach-omap1/pm_bus.c
index fe31d933f0ed..334fb8871bc3 100644
--- a/arch/arm/mach-omap1/pm_bus.c
+++ b/arch/arm/mach-omap1/pm_bus.c
@@ -56,9 +56,13 @@ static struct dev_power_domain default_power_domain = {
                USE_PLATFORM_PM_SLEEP_OPS
        },
 };
+#define OMAP1_PWR_DOMAIN (&default_power_domain)
+#else
+#define OMAP1_PWR_DOMAIN NULL
+#endif /* CONFIG_PM_RUNTIME */
 static struct pm_clk_notifier_block platform_bus_notifier = {
-        .pwr_domain = &default_power_domain,
+        .pwr_domain = OMAP1_PWR_DOMAIN,
        .con_ids = { "ick", "fck", NULL, },
 };
@@ -72,4 +76,4 @@ static int __init omap1_pm_runtime_init(void)
        return 0;
 }
 core_initcall(omap1_pm_runtime_init);
-#endif /* CONFIG_PM_RUNTIME */
diff --git a/arch/arm/mach-omap2/board-omap3pandora.c b/arch/arm/mach-omap2/board-omap3pandora.c
index 2a0bb4818cae..23f71d40883e 100644
--- a/arch/arm/mach-omap2/board-omap3pandora.c
+++ b/arch/arm/mach-omap2/board-omap3pandora.c
@@ -84,7 +84,8 @@ static struct mtd_partition omap3pandora_nand_partitions[] = {
 static struct omap_nand_platform_data pandora_nand_data = {
        .cs             = 0,
-        .devsize        = 1,    /* '0' for 8-bit, '1' for 16-bit device */
+        .devsize        = NAND_BUSWIDTH_16,
+        .xfer_type      = NAND_OMAP_PREFETCH_DMA,
        .parts          = omap3pandora_nand_partitions,
        .nr_parts       = ARRAY_SIZE(omap3pandora_nand_partitions),
 };
diff --git a/arch/arm/mach-omap2/pm-debug.c b/arch/arm/mach-omap2/pm-debug.c
index a5a83b358ddd..e01da45c0537 100644
--- a/arch/arm/mach-omap2/pm-debug.c
+++ b/arch/arm/mach-omap2/pm-debug.c
@@ -189,7 +189,7 @@ static struct dentry *pm_dbg_dir;
 static int pm_dbg_init_done;
-static int __init pm_dbg_init(void);
+static int pm_dbg_init(void);
 enum {
        DEBUG_FILE_COUNTERS = 0,
@@ -595,7 +595,7 @@ static int option_set(void *data, u64 val)
 DEFINE_SIMPLE_ATTRIBUTE(pm_dbg_option_fops, option_get, option_set, "%llu\n");
-static int __init pm_dbg_init(void)
+static int pm_dbg_init(void)
 {
        int i;
        struct dentry *d;
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 7fe74067d85f..094279aefe9c 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
+#include <linux/gpio.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
 #include <linux/apm-emulation.h>
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index c95258c274c1..1e2aba23e0d6 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -382,10 +382,8 @@ void ag5evm_sdhi1_set_pwr(struct platform_device *pdev, int state)
 }
 static struct sh_mobile_sdhi_info sh_sdhi1_platdata = {
-        .dma_slave_tx   = SHDMA_SLAVE_SDHI1_TX,
-        .dma_slave_rx   = SHDMA_SLAVE_SDHI1_RX,
        .tmio_flags     = TMIO_MMC_WRPROTECT_DISABLE,
-        .tmio_caps      = MMC_CAP_NONREMOVABLE,
+        .tmio_caps      = MMC_CAP_NONREMOVABLE | MMC_CAP_SDIO_IRQ,
        .tmio_ocr_mask  = MMC_VDD_32_33 | MMC_VDD_33_34,
        .set_pwr        = ag5evm_sdhi1_set_pwr,
 };
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 776f20560e72..7e1d37584321 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -126,7 +126,7 @@
 * ------+--------------------+--------------------+-------
 * IRQ0  | ICR1A.IRQ0SA=0010  | SDHI2 card detect  | Low
 * IRQ6  | ICR1A.IRQ6SA=0011  | Ether(LAN9220)     | High
- * IRQ7  | ICR1A.IRQ7SA=0010  | LCD Tuch Panel     | Low
+ * IRQ7  | ICR1A.IRQ7SA=0010  | LCD Touch Panel    | Low
 * IRQ8  | ICR2A.IRQ8SA=0010  | MMC/SD card detect | Low
 * IRQ9  | ICR2A.IRQ9SA=0010  | KEY(TCA6408)       | Low
 * IRQ21 | ICR4A.IRQ21SA=0011 | Sensor(ADXL345)    | High
@@ -165,10 +165,10 @@
 * USB1 can become Host by r8a66597, and become Function by renesas_usbhs.
 * But don't select both drivers in same time.
 * These uses same IRQ number for request_irq(), and aren't supporting
- * IRQF_SHARD / IORESOURCE_IRQ_SHAREABLE.
+ * IRQF_SHARED / IORESOURCE_IRQ_SHAREABLE.
 *
 * Actually these are old/new version of USB driver.
- * This mean its register will be broken if it supports SHARD IRQ,
+ * This mean its register will be broken if it supports shared IRQ,
 */
 /*
@@ -562,7 +562,121 @@ out:
                clk_put(hdmi_ick);
 }
-/* USB1 (Host) */
+/* USBHS0 is connected to CN22 which takes a USB Mini-B plug
+ *
+ * The sh7372 SoC has IRQ7 set aside for USBHS0 hotplug,
+ * but on this particular board IRQ7 is already used by
+ * the touch screen. This leaves us with software polling.
+ */
+#define USBHS0_POLL_INTERVAL (HZ * 5)
+struct usbhs_private {
+        unsigned int usbphyaddr;
+        unsigned int usbcrcaddr;
+        struct renesas_usbhs_platform_info info;
+        struct delayed_work work;
+        struct platform_device *pdev;
+};
+#define usbhs_get_priv(pdev)                            \
+        container_of(renesas_usbhs_get_info(pdev),      \
+                     struct usbhs_private, info)
+#define usbhs_is_connected(priv)                        \
+        (!((1 << 7) & __raw_readw(priv->usbcrcaddr)))
+static int usbhs_get_vbus(struct platform_device *pdev)
+{
+        return usbhs_is_connected(usbhs_get_priv(pdev));
+}
+static void usbhs_phy_reset(struct platform_device *pdev)
+{
+        struct usbhs_private *priv = usbhs_get_priv(pdev);
+        /* init phy */
+        __raw_writew(0x8a0a, priv->usbcrcaddr);
+}
+static int usbhs0_get_id(struct platform_device *pdev)
+{
+        return USBHS_GADGET;
+}
+static void usbhs0_work_function(struct work_struct *work)
+{
+        struct usbhs_private *priv = container_of(work, struct usbhs_private,
+                                                  work.work);
+        renesas_usbhs_call_notify_hotplug(priv->pdev);
+        schedule_delayed_work(&priv->work, USBHS0_POLL_INTERVAL);
+}
+static int usbhs0_hardware_init(struct platform_device *pdev)
+{
+        struct usbhs_private *priv = usbhs_get_priv(pdev);
+        priv->pdev = pdev;
+        INIT_DELAYED_WORK(&priv->work, usbhs0_work_function);
+        schedule_delayed_work(&priv->work, USBHS0_POLL_INTERVAL);
+        return 0;
+}
+static void usbhs0_hardware_exit(struct platform_device *pdev)
+{
+        struct usbhs_private *priv = usbhs_get_priv(pdev);
+        cancel_delayed_work_sync(&priv->work);
+}
+static struct usbhs_private usbhs0_private = {
+        .usbcrcaddr     = 0xe605810c,           /* USBCR2 */
+        .info = {
+                .platform_callback = {
+                        .hardware_init  = usbhs0_hardware_init,
+                        .hardware_exit  = usbhs0_hardware_exit,
+                        .phy_reset      = usbhs_phy_reset,
+                        .get_id         = usbhs0_get_id,
+                        .get_vbus       = usbhs_get_vbus,
+                },
+                .driver_param = {
+                        .buswait_bwait  = 4,
+                },
+        },
+};
+static struct resource usbhs0_resources[] = {
+        [0] = {
+                .name   = "USBHS0",
+                .start  = 0xe6890000,
+                .end    = 0xe68900e6 - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = evt2irq(0x1ca0) /* USB0_USB0I0 */,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device usbhs0_device = {
+        .name   = "renesas_usbhs",
+        .id     = 0,
+        .dev = {
+                .platform_data          = &usbhs0_private.info,
+        },
+        .num_resources  = ARRAY_SIZE(usbhs0_resources),
+        .resource       = usbhs0_resources,
+};
+/* USBHS1 is connected to CN31 which takes a USB Mini-AB plug
+ *
+ * Use J30 to select between Host and Function. This setting
+ * can however not be detected by software. Hotplug of USBHS1
+ * is provided via IRQ8.
+ */
+#define IRQ8 evt2irq(0x0300)
+/* USBHS1 USB Host support via r8a66597_hcd */
 static void usb1_host_port_power(int port, int power)
 {
        if (!power) /* only power-on is supported for now */
@@ -579,9 +693,9 @@ static struct r8a66597_platdata usb1_host_data = {
 static struct resource usb1_host_resources[] = {
        [0] = {
-                .name   = "USBHS",
+                .name   = "USBHS1",
-                .start  = 0xE68B0000,
+                .start  = 0xe68b0000,
-                .end    = 0xE68B00E6 - 1,
+                .end    = 0xe68b00e6 - 1,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
@@ -602,37 +716,14 @@ static struct platform_device usb1_host_device = {
        .resource       = usb1_host_resources,
 };
-/* USB1 (Function) */
+/* USBHS1 USB Function support via renesas_usbhs */
 #define USB_PHY_MODE            (1 << 4)
 #define USB_PHY_INT_EN          ((1 << 3) | (1 << 2))
 #define USB_PHY_ON              (1 << 1)
 #define USB_PHY_OFF             (1 << 0)
 #define USB_PHY_INT_CLR         (USB_PHY_ON | USB_PHY_OFF)
-struct usbhs_private {
-        unsigned int irq;
-        unsigned int usbphyaddr;
-        unsigned int usbcrcaddr;
-        struct renesas_usbhs_platform_info info;
-};
-#define usbhs_get_priv(pdev)                            \
-        container_of(renesas_usbhs_get_info(pdev),      \
-                     struct usbhs_private, info)
-#define usbhs_is_connected(priv)                        \
-        (!((1 << 7) & __raw_readw(priv->usbcrcaddr)))
-static int usbhs1_get_id(struct platform_device *pdev)
-{
-        return USBHS_GADGET;
-}
-static int usbhs1_get_vbus(struct platform_device *pdev)
-{
-        return usbhs_is_connected(usbhs_get_priv(pdev));
-}
 static irqreturn_t usbhs1_interrupt(int irq, void *data)
 {
        struct platform_device *pdev = data;
@@ -654,12 +745,10 @@ static int usbhs1_hardware_init(struct platform_device *pdev)
        struct usbhs_private *priv = usbhs_get_priv(pdev);
        int ret;
-        irq_set_irq_type(priv->irq, IRQ_TYPE_LEVEL_HIGH);
        /* clear interrupt status */
        __raw_writew(USB_PHY_MODE | USB_PHY_INT_CLR, priv->usbphyaddr);
-        ret = request_irq(priv->irq, usbhs1_interrupt, 0,
+        ret = request_irq(IRQ8, usbhs1_interrupt, IRQF_TRIGGER_HIGH,
                          dev_name(&pdev->dev), pdev);
        if (ret) {
                dev_err(&pdev->dev, "request_irq err\n");
@@ -679,15 +768,12 @@ static void usbhs1_hardware_exit(struct platform_device *pdev)
        /* clear interrupt status */
        __raw_writew(USB_PHY_MODE | USB_PHY_INT_CLR, priv->usbphyaddr);
-        free_irq(priv->irq, pdev);
+        free_irq(IRQ8, pdev);
 }
-static void usbhs1_phy_reset(struct platform_device *pdev)
+static int usbhs1_get_id(struct platform_device *pdev)
 {
-        struct usbhs_private *priv = usbhs_get_priv(pdev);
+        return USBHS_GADGET;
-        /* init phy */
-        __raw_writew(0x8a0a, priv->usbcrcaddr);
 }
 static u32 usbhs1_pipe_cfg[] = {
@@ -710,16 +796,15 @@ static u32 usbhs1_pipe_cfg[] = {
 };
 static struct usbhs_private usbhs1_private = {
-        .irq            = evt2irq(0x0300),      /* IRQ8 */
+        .usbphyaddr     = 0xe60581e2,           /* USBPHY1INTAP */
-        .usbphyaddr     = 0xE60581E2,           /* USBPHY1INTAP */
+        .usbcrcaddr     = 0xe6058130,           /* USBCR4 */
-        .usbcrcaddr     = 0xE6058130,           /* USBCR4 */
        .info = {
                .platform_callback = {
                        .hardware_init  = usbhs1_hardware_init,
                        .hardware_exit  = usbhs1_hardware_exit,
-                        .phy_reset      = usbhs1_phy_reset,
                        .get_id         = usbhs1_get_id,
-                        .get_vbus       = usbhs1_get_vbus,
+                        .phy_reset      = usbhs_phy_reset,
+                        .get_vbus       = usbhs_get_vbus,
                },
                .driver_param = {
                        .buswait_bwait  = 4,
@@ -731,9 +816,9 @@ static struct usbhs_private usbhs1_private = {
 static struct resource usbhs1_resources[] = {
        [0] = {
-                .name   = "USBHS",
+                .name   = "USBHS1",
-                .start  = 0xE68B0000,
+                .start  = 0xe68b0000,
-                .end    = 0xE68B00E6 - 1,
+                .end    = 0xe68b00e6 - 1,
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
@@ -752,7 +837,6 @@ static struct platform_device usbhs1_device = {
        .resource       = usbhs1_resources,
 };
 /* LED */
 static struct gpio_led mackerel_leds[] = {
        {
@@ -1203,6 +1287,7 @@ static struct platform_device *mackerel_devices[] __initdata = {
        &nor_flash_device,
        &smc911x_device,
        &lcdc_device,
+        &usbhs0_device,
        &usb1_host_device,
        &usbhs1_device,
        &leds_device,
@@ -1301,6 +1386,7 @@ static void __init mackerel_map_io(void)
 #define GPIO_PORT9CR    0xE6051009
 #define GPIO_PORT10CR   0xE605100A
+#define GPIO_PORT167CR  0xE60520A7
 #define GPIO_PORT168CR  0xE60520A8
 #define SRCR4           0xe61580bc
 #define USCCR1          0xE6058144
@@ -1354,17 +1440,17 @@ static void __init mackerel_init(void)
        gpio_request(GPIO_PORT151, NULL); /* LCDDON */
        gpio_direction_output(GPIO_PORT151, 1);
-        /* USB enable */
+        /* USBHS0 */
-        gpio_request(GPIO_FN_VBUS0_1,    NULL);
+        gpio_request(GPIO_FN_VBUS0_0, NULL);
-        gpio_request(GPIO_FN_IDIN_1_18,  NULL);
+        gpio_pull_down(GPIO_PORT168CR); /* VBUS0_0 pull down */
-        gpio_request(GPIO_FN_PWEN_1_115, NULL);
-        gpio_request(GPIO_FN_OVCN_1_114, NULL);
+        /* USBHS1 */
-        gpio_request(GPIO_FN_EXTLP_1,    NULL);
+        gpio_request(GPIO_FN_VBUS0_1, NULL);
-        gpio_request(GPIO_FN_OVCN2_1,    NULL);
+        gpio_pull_down(GPIO_PORT167CR); /* VBUS0_1 pull down */
-        gpio_pull_down(GPIO_PORT168CR);
+        gpio_request(GPIO_FN_IDIN_1_113, NULL);
-        /* setup USB phy */
+        /* USB phy tweak to make the r8a66597_hcd host driver work */
-        __raw_writew(0x8a0a, 0xE6058130);       /* USBCR4 */
+        __raw_writew(0x8a0a, 0xe6058130);       /* USBCR4 */
        /* enable FSI2 port A (ak4643) */
        gpio_request(GPIO_FN_FSIAIBT,   NULL);
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index 5d0e1503ece6..a911a60e7719 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -250,6 +250,11 @@ static irqreturn_t sh73a0_intcs_demux(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
+static int sh73a0_set_wake(struct irq_data *data, unsigned int on)
+{
+        return 0; /* always allow wakeup */
+}
 void __init sh73a0_init_irq(void)
 {
        void __iomem *gic_dist_base = __io(0xf0001000);
@@ -257,6 +262,7 @@ void __init sh73a0_init_irq(void)
        void __iomem *intevtsa = ioremap_nocache(0xffd20100, PAGE_SIZE);
        gic_init(0, 29, gic_dist_base, gic_cpu_base);
+        gic_arch_extn.irq_set_wake = sh73a0_set_wake;
        register_intc_controller(&intcs_desc);
diff --git a/arch/arm/mach-shmobile/setup-sh7367.c b/arch/arm/mach-shmobile/setup-sh7367.c
index 2c10190dbb55..e546017f15de 100644
--- a/arch/arm/mach-shmobile/setup-sh7367.c
+++ b/arch/arm/mach-shmobile/setup-sh7367.c
@@ -38,7 +38,7 @@ static struct plat_sci_port scif0_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xc00), evt2irq(0xc00),
                            evt2irq(0xc00), evt2irq(0xc00) },
 };
@@ -57,7 +57,7 @@ static struct plat_sci_port scif1_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xc20), evt2irq(0xc20),
                            evt2irq(0xc20), evt2irq(0xc20) },
 };
@@ -76,7 +76,7 @@ static struct plat_sci_port scif2_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xc40), evt2irq(0xc40),
                            evt2irq(0xc40), evt2irq(0xc40) },
 };
@@ -95,7 +95,7 @@ static struct plat_sci_port scif3_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xc60), evt2irq(0xc60),
                            evt2irq(0xc60), evt2irq(0xc60) },
 };
@@ -114,7 +114,7 @@ static struct plat_sci_port scif4_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xd20), evt2irq(0xd20),
                            evt2irq(0xd20), evt2irq(0xd20) },
 };
@@ -133,7 +133,7 @@ static struct plat_sci_port scif5_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFA,
        .irqs           = { evt2irq(0xd40), evt2irq(0xd40),
                            evt2irq(0xd40), evt2irq(0xd40) },
 };
@@ -152,7 +152,7 @@ static struct plat_sci_port scif6_platform_data = {
        .flags          = UPF_BOOT_AUTOCONF,
        .scscr          = SCSCR_RE | SCSCR_TE,
        .scbrr_algo_id  = SCBRR_ALGO_4,
-        .type           = PORT_SCIF,
+        .type           = PORT_SCIFB,
        .irqs           = { evt2irq(0xd60), evt2irq(0xd60),
                            evt2irq(0xd60), evt2irq(0xd60) },
 };
diff --git a/arch/arm/plat-omap/omap_device.c b/arch/arm/plat-omap/omap_device.c
index a37b8eb65b76..49fc0df0c21f 100644
--- a/arch/arm/plat-omap/omap_device.c
+++ b/arch/arm/plat-omap/omap_device.c
@@ -84,6 +84,7 @@
 #include <linux/io.h>
 #include <linux/clk.h>
 #include <linux/clkdev.h>
+#include <linux/pm_runtime.h>
 #include <plat/omap_device.h>
 #include <plat/omap_hwmod.h>
@@ -539,20 +540,34 @@ int omap_early_device_register(struct omap_device *od)
 static int _od_runtime_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
+        int ret;
+        ret = pm_generic_runtime_suspend(dev);
+        if (!ret)
+                omap_device_idle(pdev);
+        return ret;
+}
-        return omap_device_idle(pdev);
+static int _od_runtime_idle(struct device *dev)
+{
+        return pm_generic_runtime_idle(dev);
 }
 static int _od_runtime_resume(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
-        return omap_device_enable(pdev);
+        omap_device_enable(pdev);
+        return pm_generic_runtime_resume(dev);
 }
 static struct dev_power_domain omap_device_power_domain = {
        .ops = {
                .runtime_suspend = _od_runtime_suspend,
+                .runtime_idle = _od_runtime_idle,
                .runtime_resume = _od_runtime_resume,
                USE_PLATFORM_PM_SLEEP_OPS
        }
diff --git a/arch/sh/configs/sh7757lcr_defconfig b/arch/sh/configs/sh7757lcr_defconfig
index 33ddb130a7c8..cfde98ddb29d 100644
--- a/arch/sh/configs/sh7757lcr_defconfig
+++ b/arch/sh/configs/sh7757lcr_defconfig
@@ -9,7 +9,6 @@ CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_LOG_BUF_SHIFT=14
 CONFIG_BLK_DEV_INITRD=y
-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS_ALL=y
 CONFIG_SLAB=y
@@ -39,8 +38,6 @@ CONFIG_IPV6=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 # CONFIG_FW_LOADER is not set
 CONFIG_MTD=y
-CONFIG_MTD_CONCAT=y
-CONFIG_MTD_PARTITIONS=y
 CONFIG_MTD_CHAR=y
 CONFIG_MTD_BLOCK=y
 CONFIG_MTD_M25P80=y
@@ -56,18 +53,19 @@ CONFIG_SH_ETH=y
 # CONFIG_KEYBOARD_ATKBD is not set
 # CONFIG_MOUSE_PS2 is not set
 # CONFIG_SERIO is not set
+# CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_SH_SCI=y
 CONFIG_SERIAL_SH_SCI_NR_UARTS=3
 CONFIG_SERIAL_SH_SCI_CONSOLE=y
-# CONFIG_LEGACY_PTYS is not set
 # CONFIG_HW_RANDOM is not set
 CONFIG_SPI=y
 CONFIG_SPI_SH=y
 # CONFIG_HWMON is not set
-CONFIG_MFD_SH_MOBILE_SDHI=y
 CONFIG_USB=y
 CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_SH=y
 CONFIG_USB_OHCI_HCD=y
+CONFIG_USB_OHCI_SH=y
 CONFIG_USB_STORAGE=y
 CONFIG_MMC=y
 CONFIG_MMC_SDHI=y
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
index 423dabf542d3..717a76b399b1 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
@@ -659,6 +659,54 @@ static struct platform_device spi0_device = {
        .resource       = spi0_resources,
 };
+static struct resource usb_ehci_resources[] = {
+        [0] = {
+                .start  = 0xfe4f1000,
+                .end    = 0xfe4f10ff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 57,
+                .end    = 57,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device usb_ehci_device = {
+        .name           = "sh_ehci",
+        .id             = -1,
+        .dev = {
+                .dma_mask = &usb_ehci_device.dev.coherent_dma_mask,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
+        },
+        .num_resources  = ARRAY_SIZE(usb_ehci_resources),
+        .resource       = usb_ehci_resources,
+};
+static struct resource usb_ohci_resources[] = {
+        [0] = {
+                .start  = 0xfe4f1800,
+                .end    = 0xfe4f18ff,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = 57,
+                .end    = 57,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device usb_ohci_device = {
+        .name           = "sh_ohci",
+        .id             = -1,
+        .dev = {
+                .dma_mask = &usb_ohci_device.dev.coherent_dma_mask,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
+        },
+        .num_resources  = ARRAY_SIZE(usb_ohci_resources),
+        .resource       = usb_ohci_resources,
+};
 static struct platform_device *sh7757_devices[] __initdata = {
        &scif2_device,
        &scif3_device,
@@ -670,6 +718,8 @@ static struct platform_device *sh7757_devices[] __initdata = {
        &dma2_device,
        &dma3_device,
        &spi0_device,
+        &usb_ehci_device,
+        &usb_ohci_device,
 };
 static int __init sh7757_devices_setup(void)
diff --git a/arch/x86/include/asm/memblock.h b/arch/x86/include/asm/memblock.h
index 19ae14ba6978..0cd3800f33b9 100644
--- a/arch/x86/include/asm/memblock.h
+++ b/arch/x86/include/asm/memblock.h
@@ -4,7 +4,6 @@
 #define ARCH_DISCARD_MEMBLOCK
 u64 memblock_x86_find_in_range_size(u64 start, u64 *sizep, u64 align);
-void memblock_x86_to_bootmem(u64 start, u64 end);
 void memblock_x86_reserve_range(u64 start, u64 end, char *name);
 void memblock_x86_free_range(u64 start, u64 end);
@@ -19,5 +18,6 @@ u64 memblock_x86_hole_size(u64 start, u64 end);
 u64 memblock_x86_find_in_range_node(int nid, u64 start, u64 end, u64 size, u64 align);
 u64 memblock_x86_free_memory_in_range(u64 addr, u64 limit);
 u64 memblock_x86_memory_in_range(u64 addr, u64 limit);
+bool memblock_x86_check_reserved_size(u64 *addrp, u64 *sizep, u64 align);
 #endif
diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h
index 31d84acc1512..a518c0a45044 100644
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -22,6 +22,8 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
        u64 product;
 #ifdef __i386__
        u32 tmp1, tmp2;
+#else
+        ulong tmp;
 #endif
        if (shift < 0)
@@ -42,8 +44,11 @@ static inline u64 pvclock_scale_delta(u64 delta, u32 mul_frac, int shift)
                : "a" ((u32)delta), "1" ((u32)(delta >> 32)), "2" (mul_frac) );
 #elif defined(__x86_64__)
        __asm__ (
-                "mul %%rdx ; shrd $32,%%rdx,%%rax"
+                "mul %[mul_frac] ; shrd $32, %[hi], %[lo]"
-                : "=a" (product) : "0" (delta), "d" ((u64)mul_frac) );
+                : [lo]"=a"(product),
+                  [hi]"=d"(tmp)
+                : "0"(delta),
+                  [mul_frac]"rm"((u64)mul_frac));
 #else
 #error implement me!
 #endif
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index bd14bb4c8594..aee38623b768 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -565,7 +565,7 @@ gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t gfn,
 static bool mapping_level_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t large_gfn)
 {
-        return gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
+        return !gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
 }
 static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn)
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 6c4dc010c4cb..9d03ad4dd5ec 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -121,7 +121,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
                                    gva_t addr, u32 access)
 {
        pt_element_t pte;
-        pt_element_t __user *ptep_user;
+        pt_element_t __user *uninitialized_var(ptep_user);
        gfn_t table_gfn;
        unsigned index, pt_access, uninitialized_var(pte_access);
        gpa_t pte_gpa;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4c3fa0f67469..d48ec60ea421 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2047,7 +2047,8 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
                                        unsigned long cr0,
                                        struct kvm_vcpu *vcpu)
 {
-        vmx_decache_cr3(vcpu);
+        if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
+                vmx_decache_cr3(vcpu);
        if (!(cr0 & X86_CR0_PG)) {
                /* From paging/starting to nonpaging */
                vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,
diff --git a/arch/x86/mm/memblock.c b/arch/x86/mm/memblock.c
index aa1169392b83..992da5ec5a64 100644
--- a/arch/x86/mm/memblock.c
+++ b/arch/x86/mm/memblock.c
@@ -8,7 +8,7 @@
 #include <linux/range.h>
 /* Check for already reserved areas */
-static bool __init check_with_memblock_reserved_size(u64 *addrp, u64 *sizep, u64 align)
+bool __init memblock_x86_check_reserved_size(u64 *addrp, u64 *sizep, u64 align)
 {
        struct memblock_region *r;
        u64 addr = *addrp, last;
@@ -59,7 +59,7 @@ u64 __init memblock_x86_find_in_range_size(u64 start, u64 *sizep, u64 align)
                if (addr >= ei_last)
                        continue;
                *sizep = ei_last - addr;
-                while (check_with_memblock_reserved_size(&addr, sizep, align))
+                while (memblock_x86_check_reserved_size(&addr, sizep, align))
                        ;
                if (*sizep)
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index 0d3a4fa34560..474356b98ede 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -310,14 +310,31 @@ void __init efi_reserve_boot_services(void)
        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                efi_memory_desc_t *md = p;
-                unsigned long long start = md->phys_addr;
+                u64 start = md->phys_addr;
-                unsigned long long size = md->num_pages << EFI_PAGE_SHIFT;
+                u64 size = md->num_pages << EFI_PAGE_SHIFT;
                if (md->type != EFI_BOOT_SERVICES_CODE &&
                    md->type != EFI_BOOT_SERVICES_DATA)
                        continue;
+                /* Only reserve where possible:
-                memblock_x86_reserve_range(start, start + size, "EFI Boot");
+                 * - Not within any already allocated areas
+                 * - Not over any memory area (really needed, if above?)
+                 * - Not within any part of the kernel
+                 * - Not the bios reserved area
+                */
+                if ((start+size >= virt_to_phys(_text)
+                                && start <= virt_to_phys(_end)) ||
+                        !e820_all_mapped(start, start+size, E820_RAM) ||
+                        memblock_x86_check_reserved_size(&start, &size,
+                                                        1<<EFI_PAGE_SHIFT)) {
+                        /* Could not reserve, skip it */
+                        md->num_pages = 0;
+                        memblock_dbg(PFX "Could not reserve boot range "
+                                        "[0x%010llx-0x%010llx]\n",
+                                                start, start+size-1);
+                } else
+                        memblock_x86_reserve_range(start, start+size,
+                                                        "EFI Boot");
        }
 }
@@ -334,6 +351,10 @@ static void __init efi_free_boot_services(void)
                    md->type != EFI_BOOT_SERVICES_DATA)
                        continue;
+                /* Could not reserve boot area */
+                if (!size)
+                        continue;
                free_bootmem_late(start, size);
        }
 }
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index dd7b88f2ec7a..5525163a0398 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1033,6 +1033,13 @@ static void xen_machine_halt(void)
        xen_reboot(SHUTDOWN_poweroff);
 }
+static void xen_machine_power_off(void)
+{
+        if (pm_power_off)
+                pm_power_off();
+        xen_reboot(SHUTDOWN_poweroff);
+}
 static void xen_crash_shutdown(struct pt_regs *regs)
 {
        xen_reboot(SHUTDOWN_crash);
@@ -1058,7 +1065,7 @@ int xen_panic_handler_init(void)
 static const struct machine_ops xen_machine_ops __initconst = {
        .restart = xen_restart,
        .halt = xen_machine_halt,
-        .power_off = xen_machine_halt,
+        .power_off = xen_machine_power_off,
        .shutdown = xen_machine_halt,
        .crash_shutdown = xen_crash_shutdown,
        .emergency_restart = xen_emergency_restart,
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index dc708dcc62f1..673e968df3cf 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -59,6 +59,7 @@
 #include <asm/page.h>
 #include <asm/init.h>
 #include <asm/pat.h>
+#include <asm/smp.h>
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -1231,7 +1232,7 @@ static void xen_flush_tlb_others(const struct cpumask *cpus,
 {
        struct {
                struct mmuext_op op;
-                DECLARE_BITMAP(mask, NR_CPUS);
+                DECLARE_BITMAP(mask, num_processors);
        } *args;
        struct multicall_space mcs;
@@ -1599,6 +1600,11 @@ static void __init xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
                for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
                        pte_t pte;
+#ifdef CONFIG_X86_32
+                        if (pfn > max_pfn_mapped)
+                                max_pfn_mapped = pfn;
+#endif
                        if (!pte_none(pte_page[pteidx]))
                                continue;
@@ -1766,7 +1772,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
        initial_kernel_pmd =
                extend_brk(sizeof(pmd_t) * PTRS_PER_PMD, PAGE_SIZE);
-        max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->mfn_list));
+        max_pfn_mapped = PFN_DOWN(__pa(xen_start_info->pt_base) +
+                                  xen_start_info->nr_pt_frames * PAGE_SIZE +
+                                  512*1024);
        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
        memcpy(initial_kernel_pmd, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index be1a464f6d66..60aeeb56948f 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -227,11 +227,7 @@ char * __init xen_memory_setup(void)
        memcpy(map_raw, map, sizeof(map));
        e820.nr_map = 0;
-#ifdef CONFIG_X86_32
        xen_extra_mem_start = mem_end;
-#else
-        xen_extra_mem_start = max((1ULL << 32), mem_end);
-#endif
        for (i = 0; i < memmap.nr_entries; i++) {
                unsigned long long end;
@@ -266,6 +262,12 @@ char * __init xen_memory_setup(void)
                if (map[i].size > 0)
                        e820_add_region(map[i].addr, map[i].size, map[i].type);
        }
+        /* Align the balloon area so that max_low_pfn does not get set
+         * to be at the _end_ of the PCI gap at the far end (fee01000).
+         * Note that xen_extra_mem_start gets set in the loop above to be
+         * past the last E820 region. */
+        if (xen_initial_domain() && (xen_extra_mem_start < (1ULL<<32)))
+                xen_extra_mem_start = (1ULL<<32);
        /*
         * In domU, the ISA region is normal, usable memory, but we
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index 41038c01de40..b4533a86d7e4 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -205,11 +205,18 @@ static void __init xen_smp_prepare_boot_cpu(void)
 static void __init xen_smp_prepare_cpus(unsigned int max_cpus)
 {
        unsigned cpu;
+        unsigned int i;
        xen_init_lock_cpu(0);
        smp_store_cpu_info(0);
        cpu_data(0).x86_max_cores = 1;
+        for_each_possible_cpu(i) {
+                zalloc_cpumask_var(&per_cpu(cpu_sibling_map, i), GFP_KERNEL);
+                zalloc_cpumask_var(&per_cpu(cpu_core_map, i), GFP_KERNEL);
+                zalloc_cpumask_var(&per_cpu(cpu_llc_shared_map, i), GFP_KERNEL);
+        }
        set_cpu_sibling_map(0);
        if (xen_smp_intr_init(0))
diff --git a/drivers/bluetooth/btmrvl_debugfs.c b/drivers/bluetooth/btmrvl_debugfs.c
index fd6305bf953e..8ecf4c6c2874 100644
--- a/drivers/bluetooth/btmrvl_debugfs.c
+++ b/drivers/bluetooth/btmrvl_debugfs.c
@@ -64,6 +64,8 @@ static ssize_t btmrvl_hscfgcmd_write(struct file *file,
                return -EFAULT;
        ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.hscfgcmd = result;
@@ -108,6 +110,8 @@ static ssize_t btmrvl_psmode_write(struct file *file, const char __user *ubuf,
                return -EFAULT;
        ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.psmode = result;
@@ -147,6 +151,8 @@ static ssize_t btmrvl_pscmd_write(struct file *file, const char __user *ubuf,
                return -EFAULT;
        ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.pscmd = result;
@@ -191,6 +197,8 @@ static ssize_t btmrvl_gpiogap_write(struct file *file, const char __user *ubuf,
                return -EFAULT;
        ret = strict_strtol(buf, 16, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.gpio_gap = result;
@@ -230,6 +238,8 @@ static ssize_t btmrvl_hscmd_write(struct file *file, const char __user *ubuf,
                return -EFAULT;
        ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.hscmd = result;
        if (priv->btmrvl_dev.hscmd) {
@@ -272,6 +282,8 @@ static ssize_t btmrvl_hsmode_write(struct file *file, const char __user *ubuf,
                return -EFAULT;
        ret = strict_strtol(buf, 10, &result);
+        if (ret)
+                return ret;
        priv->btmrvl_dev.hsmode = result;
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 853f92d23ddb..faf7c5217848 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -298,11 +298,13 @@ static int cpufreq_stat_notifier_trans(struct notifier_block *nb,
        old_index = stat->last_index;
        new_index = freq_table_get_index(stat, freq->new);
-        cpufreq_stats_update(freq->cpu);
+        /* We can't do stat->time_in_state[-1]= .. */
-        if (old_index == new_index)
+        if (old_index == -1 || new_index == -1)
                return 0;
-        if (old_index == -1 || new_index == -1)
+        cpufreq_stats_update(freq->cpu);
+        if (old_index == new_index)
                return 0;
        spin_lock(&cpufreq_stats_lock);
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index 83479b6fb9a1..bce576d7478e 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -1079,6 +1079,9 @@ static int transition_frequency_fidvid(struct powernow_k8_data *data,
        }
        res = transition_fid_vid(data, fid, vid);
+        if (res)
+                return res;
        freqs.new = find_khz_freq_from_fid(data->currfid);
        for_each_cpu(i, data->available_cores) {
@@ -1101,7 +1104,8 @@ static int transition_frequency_pstate(struct powernow_k8_data *data,
        /* get MSR index for hardware pstate transition */
        pstate = index & HW_PSTATE_MASK;
        if (pstate > data->max_hw_pstate)
-                return 0;
+                return -EINVAL;
        freqs.old = find_khz_freq_from_pstate(data->powernow_table,
                        data->currpstate);
        freqs.new = find_khz_freq_from_pstate(data->powernow_table, pstate);
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 01f74a8459d9..35bebde23e83 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -469,8 +469,9 @@ static inline void set_24xx_gpio_triggering(struct gpio_bank *bank, int gpio,
                                        + OMAP24XX_GPIO_CLEARWKUENA);
                }
        }
-        /* This part needs to be executed always for OMAP34xx */
+        /* This part needs to be executed always for OMAP{34xx, 44xx} */
-        if (cpu_is_omap34xx() || (bank->non_wakeup_gpios & gpio_bit)) {
+        if (cpu_is_omap34xx() || cpu_is_omap44xx() ||
+                        (bank->non_wakeup_gpios & gpio_bit)) {
                /*
                 * Log the edge gpio and manually trigger the IRQ
                 * after resume if the input level changes
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 0a9357c66ff8..09292193dafe 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -184,9 +184,9 @@ drm_edid_block_valid(u8 *raw_edid)
 bad:
        if (raw_edid) {
-                DRM_ERROR("Raw EDID:\n");
+                printk(KERN_ERR "Raw EDID:\n");
                print_hex_dump_bytes(KERN_ERR, DUMP_PREFIX_NONE, raw_edid, EDID_LENGTH);
-                printk("\n");
+                printk(KERN_ERR "\n");
        }
        return 0;
 }
@@ -258,6 +258,17 @@ drm_do_probe_ddc_edid(struct i2c_adapter *adapter, unsigned char *buf,
        return ret == 2 ? 0 : -1;
 }
+static bool drm_edid_is_zero(u8 *in_edid, int length)
+{
+        int i;
+        u32 *raw_edid = (u32 *)in_edid;
+        for (i = 0; i < length / 4; i++)
+                if (*(raw_edid + i) != 0)
+                        return false;
+        return true;
+}
 static u8 *
 drm_do_get_edid(struct drm_connector *connector, struct i2c_adapter *adapter)
 {
@@ -273,6 +284,10 @@ drm_do_get_edid(struct drm_connector *connector, struct i2c_adapter *adapter)
                        goto out;
                if (drm_edid_block_valid(block))
                        break;
+                if (i == 0 && drm_edid_is_zero(block, EDID_LENGTH)) {
+                        connector->null_edid_counter++;
+                        goto carp;
+                }
        }
        if (i == 4)
                goto carp;
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index d61d185cf040..4a058c7af6c0 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -28,6 +28,7 @@
 * IN THE SOFTWARE.
 */
 #include <linux/compat.h>
+#include <linux/ratelimit.h>
 #include "drmP.h"
 #include "drm_core.h"
@@ -253,10 +254,10 @@ static int compat_drm_addmap(struct file *file, unsigned int cmd,
                return -EFAULT;
        m32.handle = (unsigned long)handle;
-        if (m32.handle != (unsigned long)handle && printk_ratelimit())
+        if (m32.handle != (unsigned long)handle)
-                printk(KERN_ERR "compat_drm_addmap truncated handle"
+                printk_ratelimited(KERN_ERR "compat_drm_addmap truncated handle"
-                       " %p for type %d offset %x\n",
+                                   " %p for type %d offset %x\n",
-                       handle, m32.type, m32.offset);
+                                   handle, m32.type, m32.offset);
        if (copy_to_user(argp, &m32, sizeof(m32)))
                return -EFAULT;
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index e1aee4f6a7c6..b6a19cb07caf 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -251,7 +251,7 @@ err:
 }
-int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
+static int drm_pci_irq_by_busid(struct drm_device *dev, struct drm_irq_busid *p)
 {
        if ((p->busnum >> 8) != drm_get_pci_domain(dev) ||
            (p->busnum & 0xff) != dev->pdev->bus->number ||
@@ -292,6 +292,7 @@ static struct drm_bus drm_pci_bus = {
        .get_name = drm_pci_get_name,
        .set_busid = drm_pci_set_busid,
        .set_unique = drm_pci_set_unique,
+        .irq_by_busid = drm_pci_irq_by_busid,
        .agp_init = drm_pci_agp_init,
 };
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index b9fafe3b045b..9e34a1abeb61 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1740,6 +1740,16 @@ void ironlake_irq_preinstall(struct drm_device *dev)
                INIT_WORK(&dev_priv->rps_work, gen6_pm_rps_work);
        I915_WRITE(HWSTAM, 0xeffe);
+        if (IS_GEN6(dev)) {
+                /* Workaround stalls observed on Sandy Bridge GPUs by
+                 * making the blitter command streamer generate a
+                 * write to the Hardware Status Page for
+                 * MI_USER_INTERRUPT.  This appears to serialize the
+                 * previous seqno write out before the interrupt
+                 * happens.
+                 */
+                I915_WRITE(GEN6_BLITTER_HWSTAM, ~GEN6_BLITTER_USER_INTERRUPT);
+        }
        /* XXX hotplug from PCH */
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index d3b903bce7c5..d98cee60b602 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -401,8 +401,7 @@ int intel_setup_gmbus(struct drm_device *dev)
                bus->reg0 = i | GMBUS_RATE_100KHZ;
                /* XXX force bit banging until GMBUS is fully debugged */
-                if (IS_GEN2(dev))
+                bus->force_bit = intel_gpio_create(dev_priv, i);
-                        bus->force_bit = intel_gpio_create(dev_priv, i);
        }
        intel_i2c_reset(dev_priv->dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index f0d459bb46e4..525744d593c1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -262,7 +262,6 @@ static bool nouveau_dsm_detect(void)
                vga_count++;
                retval = nouveau_dsm_pci_probe(pdev);
-                printk("ret val is %d\n", retval);
                if (retval & NOUVEAU_DSM_HAS_MUX)
                        has_dsm |= 1;
                if (retval & NOUVEAU_DSM_HAS_OPT)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 4b9f4493c9f9..7347075ca5b8 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -339,11 +339,12 @@ semaphore_acquire(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
        int ret;
        if (dev_priv->chipset < 0x84) {
-                ret = RING_SPACE(chan, 3);
+                ret = RING_SPACE(chan, 4);
                if (ret)
                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_OFFSET, 2);
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 3);
+                OUT_RING  (chan, NvSema);
                OUT_RING  (chan, sema->mem->start);
                OUT_RING  (chan, 1);
        } else
@@ -351,10 +352,12 @@ semaphore_acquire(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
                struct nouveau_vma *vma = &dev_priv->fence.bo->vma;
                u64 offset = vma->offset + sema->mem->start;
-                ret = RING_SPACE(chan, 5);
+                ret = RING_SPACE(chan, 7);
                if (ret)
                        return ret;
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, chan->vram_handle);
                BEGIN_RING(chan, NvSubSw, 0x0010, 4);
                OUT_RING  (chan, upper_32_bits(offset));
                OUT_RING  (chan, lower_32_bits(offset));
@@ -394,11 +397,12 @@ semaphore_release(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
        int ret;
        if (dev_priv->chipset < 0x84) {
-                ret = RING_SPACE(chan, 4);
+                ret = RING_SPACE(chan, 5);
                if (ret)
                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_OFFSET, 1);
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 2);
+                OUT_RING  (chan, NvSema);
                OUT_RING  (chan, sema->mem->start);
                BEGIN_RING(chan, NvSubSw, NV_SW_SEMAPHORE_RELEASE, 1);
                OUT_RING  (chan, 1);
@@ -407,10 +411,12 @@ semaphore_release(struct nouveau_channel *chan, struct nouveau_semaphore *sema)
                struct nouveau_vma *vma = &dev_priv->fence.bo->vma;
                u64 offset = vma->offset + sema->mem->start;
-                ret = RING_SPACE(chan, 5);
+                ret = RING_SPACE(chan, 7);
                if (ret)
                        return ret;
+                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
+                OUT_RING  (chan, chan->vram_handle);
                BEGIN_RING(chan, NvSubSw, 0x0010, 4);
                OUT_RING  (chan, upper_32_bits(offset));
                OUT_RING  (chan, lower_32_bits(offset));
@@ -504,22 +510,22 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
        struct nouveau_gpuobj *obj = NULL;
        int ret;
-        if (dev_priv->card_type >= NV_C0)
+        if (dev_priv->card_type < NV_C0) {
-                goto out_initialised;
+                /* Create an NV_SW object for various sync purposes */
+                ret = nouveau_gpuobj_gr_new(chan, NvSw, NV_SW);
+                if (ret)
+                        return ret;
-        /* Create an NV_SW object for various sync purposes */
+                ret = RING_SPACE(chan, 2);
-        ret = nouveau_gpuobj_gr_new(chan, NvSw, NV_SW);
+                if (ret)
-        if (ret)
+                        return ret;
-                return ret;
-        /* we leave subchannel empty for nvc0 */
+                BEGIN_RING(chan, NvSubSw, 0, 1);
-        ret = RING_SPACE(chan, 2);
+                OUT_RING  (chan, NvSw);
-        if (ret)
+                FIRE_RING (chan);
-                return ret;
+        }
-        BEGIN_RING(chan, NvSubSw, 0, 1);
-        OUT_RING(chan, NvSw);
-        /* Create a DMA object for the shared cross-channel sync area. */
+        /* Setup area of memory shared between all channels for x-chan sync */
        if (USE_SEMA(dev) && dev_priv->chipset < 0x84) {
                struct ttm_mem_reg *mem = &dev_priv->fence.bo->bo.mem;
@@ -534,23 +540,8 @@ nouveau_fence_channel_init(struct nouveau_channel *chan)
                nouveau_gpuobj_ref(NULL, &obj);
                if (ret)
                        return ret;
-                ret = RING_SPACE(chan, 2);
-                if (ret)
-                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
-                OUT_RING(chan, NvSema);
-        } else {
-                ret = RING_SPACE(chan, 2);
-                if (ret)
-                        return ret;
-                BEGIN_RING(chan, NvSubSw, NV_SW_DMA_SEMAPHORE, 1);
-                OUT_RING  (chan, chan->vram_handle); /* whole VM */
        }
-        FIRE_RING(chan);
-out_initialised:
        INIT_LIST_HEAD(&chan->fence.pending);
        spin_lock_init(&chan->fence.lock);
        atomic_set(&chan->fence.last_sequence_irq, 0);
diff --git a/drivers/gpu/drm/nouveau/nouveau_perf.c b/drivers/gpu/drm/nouveau/nouveau_perf.c
index 922fb6b664ed..ef9dec0e6f8b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_perf.c
+++ b/drivers/gpu/drm/nouveau/nouveau_perf.c
@@ -182,6 +182,11 @@ nouveau_perf_init(struct drm_device *dev)
                entries   = perf[2];
        }
+        if (entries > NOUVEAU_PM_MAX_LEVEL) {
+                NV_DEBUG(dev, "perf table has too many entries - buggy vbios?\n");
+                entries = NOUVEAU_PM_MAX_LEVEL;
+        }
        entry = perf + headerlen;
        for (i = 0; i < entries; i++) {
                struct nouveau_pm_level *perflvl = &pm->perflvl[pm->nr_perflvl];
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index 80218887e0a0..144f79a350ae 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -881,8 +881,8 @@ int nouveau_load(struct drm_device *dev, unsigned long flags)
 #ifdef __BIG_ENDIAN
        /* Put the card in BE mode if it's not */
-        if (nv_rd32(dev, NV03_PMC_BOOT_1))
+        if (nv_rd32(dev, NV03_PMC_BOOT_1) != 0x01000001)
-                nv_wr32(dev, NV03_PMC_BOOT_1, 0x00000001);
+                nv_wr32(dev, NV03_PMC_BOOT_1, 0x01000001);
        DRM_MEMORYBARRIER();
 #endif
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 74a3f6872701..08da478ba544 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -409,7 +409,7 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        struct nouveau_channel *evo = dispc->sync;
        int ret;
-        ret = RING_SPACE(evo, 24);
+        ret = RING_SPACE(evo, chan ? 25 : 27);
        if (unlikely(ret))
                return ret;
@@ -458,8 +458,19 @@ nv50_display_flip_next(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        /* queue the flip on the crtc's "display sync" channel */
        BEGIN_RING(evo, 0, 0x0100, 1);
        OUT_RING  (evo, 0xfffe0000);
-        BEGIN_RING(evo, 0, 0x0084, 5);
+        if (chan) {
-        OUT_RING  (evo, chan ? 0x00000100 : 0x00000010);
+                BEGIN_RING(evo, 0, 0x0084, 1);
+                OUT_RING  (evo, 0x00000100);
+        } else {
+                BEGIN_RING(evo, 0, 0x0084, 1);
+                OUT_RING  (evo, 0x00000010);
+                /* allows gamma somehow, PDISP will bitch at you if
+                 * you don't wait for vblank before changing this..
+                 */
+                BEGIN_RING(evo, 0, 0x00e0, 1);
+                OUT_RING  (evo, 0x40000000);
+        }
+        BEGIN_RING(evo, 0, 0x0088, 4);
        OUT_RING  (evo, dispc->sem.offset);
        OUT_RING  (evo, 0xf00d0000 | dispc->sem.value);
        OUT_RING  (evo, 0x74b1e000);
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 49611e2365d9..1b50ad8919d5 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -1200,6 +1200,7 @@ typedef struct _EXTERNAL_ENCODER_CONTROL_PARAMETERS_V3
 #define EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING_OFF   0x10
 #define EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING       0x11
 #define EXTERNAL_ENCODER_ACTION_V3_DACLOAD_DETECTION      0x12
+#define EXTERNAL_ENCODER_ACTION_V3_DDC_SETUP              0x14
 // ucConfig
 #define EXTERNAL_ENCODER_CONFIG_V3_DPLINKRATE_MASK                              0x03
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 84a69e7fa11e..9541995e4b21 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -671,6 +671,13 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                                                DISPPLL_CONFIG_DUAL_LINK;
                                        }
                                }
+                                if (radeon_encoder_is_dp_bridge(encoder)) {
+                                        struct drm_encoder *ext_encoder = radeon_atom_get_external_encoder(encoder);
+                                        struct radeon_encoder *ext_radeon_encoder = to_radeon_encoder(ext_encoder);
+                                        args.v3.sInput.ucExtTransmitterID = ext_radeon_encoder->encoder_id;
+                                } else
+                                        args.v3.sInput.ucExtTransmitterID = 0;
                                atom_execute_table(rdev->mode_info.atom_context,
                                                   index, (uint32_t *)&args);
                                adjusted_clock = le32_to_cpu(args.v3.sOutput.ulDispPllFreq) * 10;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 86157b172c88..445af7981637 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -88,7 +88,8 @@ u32 evergreen_page_flip(struct radeon_device *rdev, int crtc_id, u64 crtc_base)
 /* get temperature in millidegrees */
 int evergreen_get_temp(struct radeon_device *rdev)
 {
-        u32 temp, toffset, actual_temp = 0;
+        u32 temp, toffset;
+        int actual_temp = 0;
        if (rdev->family == CHIP_JUNIPER) {
                toffset = (RREG32(CG_THERMAL_CTRL) & TOFFSET_MASK) >>
@@ -139,11 +140,17 @@ void evergreen_pm_misc(struct radeon_device *rdev)
        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
        if (voltage->type == VOLTAGE_SW) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                if (voltage->voltage && (voltage->voltage != rdev->pm.current_vddc)) {
                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                        rdev->pm.current_vddc = voltage->voltage;
                        DRM_DEBUG("Setting: vddc: %d\n", voltage->voltage);
                }
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->vddci == 0xff01)
+                        return;
                if (voltage->vddci && (voltage->vddci != rdev->pm.current_vddci)) {
                        radeon_atom_set_voltage(rdev, voltage->vddci, SET_VOLTAGE_TYPE_ASIC_VDDCI);
                        rdev->pm.current_vddci = voltage->vddci;
@@ -2694,28 +2701,25 @@ static inline u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
 int evergreen_irq_process(struct radeon_device *rdev)
 {
-        u32 wptr = evergreen_get_ih_wptr(rdev);
+        u32 wptr;
-        u32 rptr = rdev->ih.rptr;
+        u32 rptr;
        u32 src_id, src_data;
        u32 ring_index;
        unsigned long flags;
        bool queue_hotplug = false;
-        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+        if (!rdev->ih.enabled || rdev->shutdown)
-        if (!rdev->ih.enabled)
                return IRQ_NONE;
-        spin_lock_irqsave(&rdev->ih.lock, flags);
+        wptr = evergreen_get_ih_wptr(rdev);
+        rptr = rdev->ih.rptr;
+        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+        spin_lock_irqsave(&rdev->ih.lock, flags);
        if (rptr == wptr) {
                spin_unlock_irqrestore(&rdev->ih.lock, flags);
                return IRQ_NONE;
        }
-        if (rdev->shutdown) {
-                spin_unlock_irqrestore(&rdev->ih.lock, flags);
-                return IRQ_NONE;
-        }
 restart_ih:
        /* display interrupts */
        evergreen_irq_ack(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7dd45ca64e29..f79d2ccb6755 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -590,6 +590,9 @@ void r600_pm_misc(struct radeon_device *rdev)
        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                if (voltage->voltage != rdev->pm.current_vddc) {
                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                        rdev->pm.current_vddc = voltage->voltage;
@@ -3294,27 +3297,26 @@ static inline u32 r600_get_ih_wptr(struct radeon_device *rdev)
 int r600_irq_process(struct radeon_device *rdev)
 {
-        u32 wptr = r600_get_ih_wptr(rdev);
+        u32 wptr;
-        u32 rptr = rdev->ih.rptr;
+        u32 rptr;
        u32 src_id, src_data;
        u32 ring_index;
        unsigned long flags;
        bool queue_hotplug = false;
-        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
+        if (!rdev->ih.enabled || rdev->shutdown)
-        if (!rdev->ih.enabled)
                return IRQ_NONE;
+        wptr = r600_get_ih_wptr(rdev);
+        rptr = rdev->ih.rptr;
+        DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
        spin_lock_irqsave(&rdev->ih.lock, flags);
        if (rptr == wptr) {
                spin_unlock_irqrestore(&rdev->ih.lock, flags);
                return IRQ_NONE;
        }
-        if (rdev->shutdown) {
-                spin_unlock_irqrestore(&rdev->ih.lock, flags);
-                return IRQ_NONE;
-        }
 restart_ih:
        /* display interrupts */
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 9bd162fc9b0c..b2449629537d 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -938,6 +938,13 @@ static struct radeon_asic cayman_asic = {
 int radeon_asic_init(struct radeon_device *rdev)
 {
        radeon_register_accessor_init(rdev);
+        /* set the number of crtcs */
+        if (rdev->flags & RADEON_SINGLE_CRTC)
+                rdev->num_crtc = 1;
+        else
+                rdev->num_crtc = 2;
        switch (rdev->family) {
        case CHIP_R100:
        case CHIP_RV100:
@@ -1017,6 +1024,11 @@ int radeon_asic_init(struct radeon_device *rdev)
        case CHIP_JUNIPER:
        case CHIP_CYPRESS:
        case CHIP_HEMLOCK:
+                /* set num crtcs */
+                if (rdev->family == CHIP_CEDAR)
+                        rdev->num_crtc = 4;
+                else
+                        rdev->num_crtc = 6;
                rdev->asic = &evergreen_asic;
                break;
        case CHIP_PALM:
@@ -1027,10 +1039,17 @@ int radeon_asic_init(struct radeon_device *rdev)
        case CHIP_BARTS:
        case CHIP_TURKS:
        case CHIP_CAICOS:
+                /* set num crtcs */
+                if (rdev->family == CHIP_CAICOS)
+                        rdev->num_crtc = 4;
+                else
+                        rdev->num_crtc = 6;
                rdev->asic = &btc_asic;
                break;
        case CHIP_CAYMAN:
                rdev->asic = &cayman_asic;
+                /* set num crtcs */
+                rdev->num_crtc = 6;
                break;
        default:
                /* FIXME: not supported yet */
@@ -1042,18 +1061,6 @@ int radeon_asic_init(struct radeon_device *rdev)
                rdev->asic->set_memory_clock = NULL;
        }
-        /* set the number of crtcs */
-        if (rdev->flags & RADEON_SINGLE_CRTC)
-                rdev->num_crtc = 1;
-        else {
-                if (ASIC_IS_DCE41(rdev))
-                        rdev->num_crtc = 2;
-                else if (ASIC_IS_DCE4(rdev))
-                        rdev->num_crtc = 6;
-                else
-                        rdev->num_crtc = 2;
-        }
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index fa62a503ae70..1e725d9f767f 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -2607,6 +2607,10 @@ void radeon_atom_set_voltage(struct radeon_device *rdev, u16 voltage_level, u8 v
        if (!atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev))
                return;
+        /* 0xff01 is a flag rather then an actual voltage */
+        if (voltage_level == 0xff01)
+                return;
        switch (crev) {
        case 1:
                args.v1.ucVoltageType = voltage_type;
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 797c8bcbb6a4..e4594676a07c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1553,9 +1553,12 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                           (rdev->pdev->subsystem_device == 0x4a48)) {
                        /* Mac X800 */
                        rdev->mode_info.connector_table = CT_MAC_X800;
-                } else if (of_machine_is_compatible("PowerMac7,2") ||
+                } else if ((of_machine_is_compatible("PowerMac7,2") ||
-                           of_machine_is_compatible("PowerMac7,3")) {
+                            of_machine_is_compatible("PowerMac7,3")) &&
-                        /* Mac G5 9600 */
+                           (rdev->pdev->device == 0x4150) &&
+                           (rdev->pdev->subsystem_vendor == 0x1002) &&
+                           (rdev->pdev->subsystem_device == 0x4150)) {
+                        /* Mac G5 tower 9600 */
                        rdev->mode_info.connector_table = CT_MAC_G5_9600;
                } else
 #endif /* CONFIG_PPC_PMAC */
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 9c2929c7e79f..cbfca3a24fdf 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -44,6 +44,8 @@ extern void
 radeon_legacy_backlight_init(struct radeon_encoder *radeon_encoder,
                             struct drm_connector *drm_connector);
+bool radeon_connector_encoder_is_dp_bridge(struct drm_connector *connector);
 void radeon_connector_hotplug(struct drm_connector *connector)
 {
        struct drm_device *dev = connector->dev;
@@ -836,6 +838,13 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
                if (!radeon_connector->edid) {
                        DRM_ERROR("%s: probed a monitor but no|invalid EDID\n",
                                        drm_get_connector_name(connector));
+                        /* rs690 seems to have a problem with connectors not existing and always
+                         * return a block of 0's. If we see this just stop polling on this output */
+                        if ((rdev->family == CHIP_RS690 || rdev->family == CHIP_RS740) && radeon_connector->base.null_edid_counter) {
+                                ret = connector_status_disconnected;
+                                DRM_ERROR("%s: detected RS690 floating bus bug, stopping ddc detect\n", drm_get_connector_name(connector));
+                                radeon_connector->ddc_bus = NULL;
+                        }
                } else {
                        radeon_connector->use_digital = !!(radeon_connector->edid->input & DRM_EDID_INPUT_DIGITAL);
@@ -1063,10 +1072,11 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
 {
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
        struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
+        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
        int ret;
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+        if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) ||
-                struct drm_encoder *encoder;
+            (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                struct drm_display_mode *mode;
                if (!radeon_dig_connector->edp_on)
@@ -1078,7 +1088,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
                if (ret > 0) {
-                        encoder = radeon_best_single_encoder(connector);
                        if (encoder) {
                                radeon_fixup_lvds_native_mode(encoder, connector);
                                /* add scaled modes */
@@ -1102,8 +1111,14 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                        /* add scaled modes */
                        radeon_add_common_modes(encoder, connector);
                }
-        } else
+        } else {
+                /* need to setup ddc on the bridge */
+                if (radeon_connector_encoder_is_dp_bridge(connector)) {
+                        if (encoder)
+                                radeon_atom_ext_encoder_setup_ddc(encoder);
+                }
                ret = radeon_ddc_get_modes(radeon_connector);
+        }
        return ret;
 }
@@ -1187,14 +1202,15 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
        enum drm_connector_status ret = connector_status_disconnected;
        struct radeon_connector_atom_dig *radeon_dig_connector = radeon_connector->con_priv;
+        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
        if (radeon_connector->edid) {
                kfree(radeon_connector->edid);
                radeon_connector->edid = NULL;
        }
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+        if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) ||
-                struct drm_encoder *encoder = radeon_best_single_encoder(connector);
+            (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                if (encoder) {
                        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
                        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
@@ -1214,6 +1230,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                        atombios_set_edp_panel_power(connector,
                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
        } else {
+                /* need to setup ddc on the bridge */
+                if (radeon_connector_encoder_is_dp_bridge(connector)) {
+                        if (encoder)
+                                radeon_atom_ext_encoder_setup_ddc(encoder);
+                }
                radeon_dig_connector->dp_sink_type = radeon_dp_getsinktype(radeon_connector);
                if (radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
                        ret = connector_status_connected;
@@ -1228,6 +1249,16 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
                                        ret = connector_status_connected;
                        }
                }
+                if ((ret == connector_status_disconnected) &&
+                    radeon_connector->dac_load_detect) {
+                        struct drm_encoder *encoder = radeon_best_single_encoder(connector);
+                        struct drm_encoder_helper_funcs *encoder_funcs;
+                        if (encoder) {
+                                encoder_funcs = encoder->helper_private;
+                                ret = encoder_funcs->detect(encoder, connector);
+                        }
+                }
        }
        radeon_connector_update_scratch_regs(connector, ret);
@@ -1242,7 +1273,8 @@ static int radeon_dp_mode_valid(struct drm_connector *connector,
        /* XXX check mode bandwidth */
-        if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+        if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) ||
+            (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                struct drm_encoder *encoder = radeon_best_single_encoder(connector);
                if ((mode->hdisplay < 320) || (mode->vdisplay < 240))
@@ -1252,7 +1284,7 @@ static int radeon_dp_mode_valid(struct drm_connector *connector,
                        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
                        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
-                /* AVIVO hardware supports downscaling modes larger than the panel
+                        /* AVIVO hardware supports downscaling modes larger than the panel
                         * to the panel size, but I'm not sure this is desirable.
                         */
                        if ((mode->hdisplay > native_mode->hdisplay) ||
@@ -1401,6 +1433,10 @@ radeon_add_atom_connector(struct drm_device *dev,
                default:
                        connector->interlace_allowed = true;
                        connector->doublescan_allowed = true;
+                        radeon_connector->dac_load_detect = true;
+                        drm_connector_attach_property(&radeon_connector->base,
+                                                      rdev->mode_info.load_detect_property,
+                                                      1);
                        break;
                case DRM_MODE_CONNECTOR_DVII:
                case DRM_MODE_CONNECTOR_DVID:
@@ -1422,6 +1458,12 @@ radeon_add_atom_connector(struct drm_device *dev,
                                connector->doublescan_allowed = true;
                        else
                                connector->doublescan_allowed = false;
+                        if (connector_type == DRM_MODE_CONNECTOR_DVII) {
+                                radeon_connector->dac_load_detect = true;
+                                drm_connector_attach_property(&radeon_connector->base,
+                                                              rdev->mode_info.load_detect_property,
+                                                              1);
+                        }
                        break;
                case DRM_MODE_CONNECTOR_LVDS:
                case DRM_MODE_CONNECTOR_eDP:
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index e680501c78ea..7cfaa7e2f3b5 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -215,6 +215,8 @@ int radeon_wb_init(struct radeon_device *rdev)
                return r;
        }
+        /* clear wb memory */
+        memset((char *)rdev->wb.wb, 0, RADEON_GPU_PAGE_SIZE);
        /* disable event_write fences */
        rdev->wb.use_event = false;
        /* disabled via module param */
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 03f124d626c2..b293487e5aa3 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -367,7 +367,8 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
        }
        if (ASIC_IS_DCE3(rdev) &&
-            (radeon_encoder->active_device & (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT))) {
+            ((radeon_encoder->active_device & (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT)) ||
+             radeon_encoder_is_dp_bridge(encoder))) {
                struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
                radeon_dp_set_link_config(connector, mode);
        }
@@ -660,21 +661,16 @@ atombios_get_encoder_mode(struct drm_encoder *encoder)
        if (radeon_encoder_is_dp_bridge(encoder))
                return ATOM_ENCODER_MODE_DP;
+        /* DVO is always DVO */
+        if (radeon_encoder->encoder_id == ATOM_ENCODER_MODE_DVO)
+                return ATOM_ENCODER_MODE_DVO;
        connector = radeon_get_connector_for_encoder(encoder);
-        if (!connector) {
+        /* if we don't have an active device yet, just use one of
-                switch (radeon_encoder->encoder_id) {
+         * the connectors tied to the encoder.
-                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+         */
-                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+        if (!connector)
-                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+                connector = radeon_get_connector_for_encoder_init(encoder);
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
-                        return ATOM_ENCODER_MODE_DVI;
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1:
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2:
-                default:
-                        return ATOM_ENCODER_MODE_CRT;
-                }
-        }
        radeon_connector = to_radeon_connector(connector);
        switch (connector->connector_type) {
@@ -1094,9 +1090,10 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                        break;
                }
-                if (is_dp)
+                if (is_dp) {
                        args.v2.acConfig.fCoherentMode = 1;
-                else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
+                        args.v2.acConfig.fDPConnector = 1;
+                } else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
                        if (dig->coherent_mode)
                                args.v2.acConfig.fCoherentMode = 1;
                        if (radeon_encoder->pixel_clock > 165000)
@@ -1435,7 +1432,11 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
        if (is_dig) {
                switch (mode) {
                case DRM_MODE_DPMS_ON:
-                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
+                        /* some early dce3.2 boards have a bug in their transmitter control table */
+                        if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
+                        else
+                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                        if (atombios_get_encoder_mode(encoder) == ATOM_ENCODER_MODE_DP) {
                                struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
@@ -1526,26 +1527,29 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
        }
        if (ext_encoder) {
-                int action;
                switch (mode) {
                case DRM_MODE_DPMS_ON:
                default:
-                        if (ASIC_IS_DCE41(rdev))
+                        if (ASIC_IS_DCE41(rdev)) {
-                                action = EXTERNAL_ENCODER_ACTION_V3_ENABLE_OUTPUT;
+                                atombios_external_encoder_setup(encoder, ext_encoder,
-                        else
+                                                                EXTERNAL_ENCODER_ACTION_V3_ENABLE_OUTPUT);
-                                action = ATOM_ENABLE;
+                                atombios_external_encoder_setup(encoder, ext_encoder,
+                                                                EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING_OFF);
+                        } else
+                                atombios_external_encoder_setup(encoder, ext_encoder, ATOM_ENABLE);
                        break;
                case DRM_MODE_DPMS_STANDBY:
                case DRM_MODE_DPMS_SUSPEND:
                case DRM_MODE_DPMS_OFF:
-                        if (ASIC_IS_DCE41(rdev))
+                        if (ASIC_IS_DCE41(rdev)) {
-                                action = EXTERNAL_ENCODER_ACTION_V3_DISABLE_OUTPUT;
+                                atombios_external_encoder_setup(encoder, ext_encoder,
-                        else
+                                                                EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING);
-                                action = ATOM_DISABLE;
+                                atombios_external_encoder_setup(encoder, ext_encoder,
+                                                                EXTERNAL_ENCODER_ACTION_V3_DISABLE_OUTPUT);
+                        } else
+                                atombios_external_encoder_setup(encoder, ext_encoder, ATOM_DISABLE);
                        break;
                }
-                atombios_external_encoder_setup(encoder, ext_encoder, action);
        }
        radeon_atombios_encoder_dpms_scratch_regs(encoder, (mode == DRM_MODE_DPMS_ON) ? true : false);
@@ -2004,6 +2008,65 @@ radeon_atom_dac_detect(struct drm_encoder *encoder, struct drm_connector *connec
        return connector_status_disconnected;
 }
+static enum drm_connector_status
+radeon_atom_dig_detect(struct drm_encoder *encoder, struct drm_connector *connector)
+{
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        struct drm_encoder *ext_encoder = radeon_atom_get_external_encoder(encoder);
+        u32 bios_0_scratch;
+        if (!ASIC_IS_DCE4(rdev))
+                return connector_status_unknown;
+        if (!ext_encoder)
+                return connector_status_unknown;
+        if ((radeon_connector->devices & ATOM_DEVICE_CRT_SUPPORT) == 0)
+                return connector_status_unknown;
+        /* load detect on the dp bridge */
+        atombios_external_encoder_setup(encoder, ext_encoder,
+                                        EXTERNAL_ENCODER_ACTION_V3_DACLOAD_DETECTION);
+        bios_0_scratch = RREG32(R600_BIOS_0_SCRATCH);
+        DRM_DEBUG_KMS("Bios 0 scratch %x %08x\n", bios_0_scratch, radeon_encoder->devices);
+        if (radeon_connector->devices & ATOM_DEVICE_CRT1_SUPPORT) {
+                if (bios_0_scratch & ATOM_S0_CRT1_MASK)
+                        return connector_status_connected;
+        }
+        if (radeon_connector->devices & ATOM_DEVICE_CRT2_SUPPORT) {
+                if (bios_0_scratch & ATOM_S0_CRT2_MASK)
+                        return connector_status_connected;
+        }
+        if (radeon_connector->devices & ATOM_DEVICE_CV_SUPPORT) {
+                if (bios_0_scratch & (ATOM_S0_CV_MASK|ATOM_S0_CV_MASK_A))
+                        return connector_status_connected;
+        }
+        if (radeon_connector->devices & ATOM_DEVICE_TV1_SUPPORT) {
+                if (bios_0_scratch & (ATOM_S0_TV1_COMPOSITE | ATOM_S0_TV1_COMPOSITE_A))
+                        return connector_status_connected; /* CTV */
+                else if (bios_0_scratch & (ATOM_S0_TV1_SVIDEO | ATOM_S0_TV1_SVIDEO_A))
+                        return connector_status_connected; /* STV */
+        }
+        return connector_status_disconnected;
+}
+void
+radeon_atom_ext_encoder_setup_ddc(struct drm_encoder *encoder)
+{
+        struct drm_encoder *ext_encoder = radeon_atom_get_external_encoder(encoder);
+        if (ext_encoder)
+                /* ddc_setup on the dp bridge */
+                atombios_external_encoder_setup(encoder, ext_encoder,
+                                                EXTERNAL_ENCODER_ACTION_V3_DDC_SETUP);
+}
 static void radeon_atom_encoder_prepare(struct drm_encoder *encoder)
 {
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
@@ -2167,7 +2230,7 @@ static const struct drm_encoder_helper_funcs radeon_atom_dig_helper_funcs = {
        .mode_set = radeon_atom_encoder_mode_set,
        .commit = radeon_atom_encoder_commit,
        .disable = radeon_atom_encoder_disable,
-        /* no detect for TMDS/LVDS yet */
+        .detect = radeon_atom_dig_detect,
 };
 static const struct drm_encoder_helper_funcs radeon_atom_dac_helper_funcs = {
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 1f8229436570..021d2b6b556f 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -40,6 +40,35 @@
 #include "radeon.h"
 #include "radeon_trace.h"
+static void radeon_fence_write(struct radeon_device *rdev, u32 seq)
+{
+        if (rdev->wb.enabled) {
+                u32 scratch_index;
+                if (rdev->wb.use_event)
+                        scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
+                else
+                        scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
+                rdev->wb.wb[scratch_index/4] = cpu_to_le32(seq);;
+        } else
+                WREG32(rdev->fence_drv.scratch_reg, seq);
+}
+static u32 radeon_fence_read(struct radeon_device *rdev)
+{
+        u32 seq;
+        if (rdev->wb.enabled) {
+                u32 scratch_index;
+                if (rdev->wb.use_event)
+                        scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
+                else
+                        scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
+                seq = le32_to_cpu(rdev->wb.wb[scratch_index/4]);
+        } else
+                seq = RREG32(rdev->fence_drv.scratch_reg);
+        return seq;
+}
 int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
 {
        unsigned long irq_flags;
@@ -50,12 +79,12 @@ int radeon_fence_emit(struct radeon_device *rdev, struct radeon_fence *fence)
                return 0;
        }
        fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
-        if (!rdev->cp.ready) {
+        if (!rdev->cp.ready)
                /* FIXME: cp is not running assume everythings is done right
                 * away
                 */
-                WREG32(rdev->fence_drv.scratch_reg, fence->seq);
+                radeon_fence_write(rdev, fence->seq);
-        } else
+        else
                radeon_fence_ring_emit(rdev, fence);
        trace_radeon_fence_emit(rdev->ddev, fence->seq);
@@ -73,15 +102,7 @@ static bool radeon_fence_poll_locked(struct radeon_device *rdev)
        bool wake = false;
        unsigned long cjiffies;
-        if (rdev->wb.enabled) {
+        seq = radeon_fence_read(rdev);
-                u32 scratch_index;
-                if (rdev->wb.use_event)
-                        scratch_index = R600_WB_EVENT_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
-                else
-                        scratch_index = RADEON_WB_SCRATCH_OFFSET + rdev->fence_drv.scratch_reg - rdev->scratch.reg_base;
-                seq = le32_to_cpu(rdev->wb.wb[scratch_index/4]);
-        } else
-                seq = RREG32(rdev->fence_drv.scratch_reg);
        if (seq != rdev->fence_drv.last_seq) {
                rdev->fence_drv.last_seq = seq;
                rdev->fence_drv.last_jiffies = jiffies;
@@ -251,7 +272,7 @@ retry:
                        r = radeon_gpu_reset(rdev);
                        if (r)
                                return r;
-                        WREG32(rdev->fence_drv.scratch_reg, fence->seq);
+                        radeon_fence_write(rdev, fence->seq);
                        rdev->gpu_lockup = false;
                }
                timeout = RADEON_FENCE_JIFFIES_TIMEOUT;
@@ -351,7 +372,7 @@ int radeon_fence_driver_init(struct radeon_device *rdev)
                write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
                return r;
        }
-        WREG32(rdev->fence_drv.scratch_reg, 0);
+        radeon_fence_write(rdev, 0);
        atomic_set(&rdev->fence_drv.seq, 0);
        INIT_LIST_HEAD(&rdev->fence_drv.created);
        INIT_LIST_HEAD(&rdev->fence_drv.emited);
@@ -391,7 +412,7 @@ static int radeon_debugfs_fence_info(struct seq_file *m, void *data)
        struct radeon_fence *fence;
        seq_printf(m, "Last signaled fence 0x%08X\n",
-                   RREG32(rdev->fence_drv.scratch_reg));
+                   radeon_fence_read(rdev));
        if (!list_empty(&rdev->fence_drv.emited)) {
                   fence = list_entry(rdev->fence_drv.emited.prev,
                                      struct radeon_fence, list);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 977a341266b6..6df4e3cec0c2 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -483,6 +483,8 @@ extern void radeon_atom_encoder_init(struct radeon_device *rdev);
 extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
                                           int action, uint8_t lane_num,
                                           uint8_t lane_set);
+extern void radeon_atom_ext_encoder_setup_ddc(struct drm_encoder *encoder);
+extern struct drm_encoder *radeon_atom_get_external_encoder(struct drm_encoder *encoder);
 extern int radeon_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
                                u8 write_byte, u8 *read_byte);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index ef8a5babe9f7..6f508ffd1035 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -105,6 +105,9 @@ void rv770_pm_misc(struct radeon_device *rdev)
        struct radeon_voltage *voltage = &ps->clock_info[req_cm_idx].voltage;
        if ((voltage->type == VOLTAGE_SW) && voltage->voltage) {
+                /* 0xff01 is a flag rather then an actual voltage */
+                if (voltage->voltage == 0xff01)
+                        return;
                if (voltage->voltage != rdev->pm.current_vddc) {
                        radeon_atom_set_voltage(rdev, voltage->voltage, SET_VOLTAGE_TYPE_ASIC_VDDC);
                        rdev->pm.current_vddc = voltage->voltage;
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 67d2a7585934..36ca465c00ce 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -305,6 +305,7 @@ config HID_MULTITOUCH
          - 3M PCT touch screens
          - ActionStar dual touch panels
          - Cando dual touch panels
+          - Chunghwa panels
          - CVTouch panels
          - Cypress TrueTouch panels
          - Elo TouchSystems IntelliTouch Plus panels
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index c957c4b4fe70..f7440e8ce3e7 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1359,6 +1359,7 @@ static const struct hid_device_id hid_have_special_driver[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT, USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CVTOUCH, USB_DEVICE_ID_CVTOUCH_SCREEN) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 0b374a6d6db0..aecb5a4b8d6d 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -173,6 +173,9 @@
 #define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 #define USB_DEVICE_ID_CHICONY_WIRELESS  0x0618
+#define USB_VENDOR_ID_CHUNGHWAT         0x2247
+#define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH      0x0001
 #define USB_VENDOR_ID_CIDC              0x1677
 #define USB_VENDOR_ID_CMEDIA            0x0d8c
@@ -622,6 +625,7 @@
 #define USB_VENDOR_ID_UCLOGIC           0x5543
 #define USB_DEVICE_ID_UCLOGIC_TABLET_PF1209     0x0042
 #define USB_DEVICE_ID_UCLOGIC_TABLET_KNA5       0x6001
+#define USB_DEVICE_ID_UCLOGIC_TABLET_TWA60      0x0064
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U    0x0003
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U    0x0004
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U    0x0005
diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
index a5eda4c8127a..0ec91c18a421 100644
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -501,17 +501,9 @@ static int magicmouse_probe(struct hid_device *hdev,
        }
        report->size = 6;
-        /*
-         * The device reponds with 'invalid report id' when feature
-         * report switching it into multitouch mode is sent to it.
-         *
-         * This results in -EIO from the _raw low-level transport callback,
-         * but there seems to be no other way of switching the mode.
-         * Thus the super-ugly hacky success check below.
-         */
        ret = hdev->hid_output_raw_report(hdev, feature, sizeof(feature),
                        HID_FEATURE_REPORT);
-        if (ret != -EIO) {
+        if (ret != sizeof(feature)) {
                hid_err(hdev, "unable to request touch data (%d)\n", ret);
                goto err_stop_hw;
        }
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index ecd4d2db9e80..0b2dcd0ee591 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -64,6 +64,7 @@ struct mt_device {
        struct mt_class *mtclass;       /* our mt device class */
        unsigned last_field_index;      /* last field index of the report */
        unsigned last_slot_field;       /* the last field of a slot */
+        int last_mt_collection; /* last known mt-related collection */
        __s8 inputmode;         /* InputMode HID feature, -1 if non-existent */
        __u8 num_received;      /* how many contacts we received */
        __u8 num_expected;      /* expected last contact index */
@@ -225,8 +226,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                cls->sn_move);
                        /* touchscreen emulation */
                        set_abs(hi->input, ABS_X, field, cls->sn_move);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_GD_Y:
                        if (quirks & MT_QUIRK_EGALAX_XYZ_FIXUP)
@@ -237,8 +240,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                cls->sn_move);
                        /* touchscreen emulation */
                        set_abs(hi->input, ABS_Y, field, cls->sn_move);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                }
                return 0;
@@ -246,31 +251,40 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
        case HID_UP_DIGITIZER:
                switch (usage->hid) {
                case HID_DG_INRANGE:
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_CONFIDENCE:
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_TIPSWITCH:
                        hid_map_usage(hi, usage, bit, max, EV_KEY, BTN_TOUCH);
                        input_set_capability(hi->input, EV_KEY, BTN_TOUCH);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_CONTACTID:
                        input_mt_init_slots(hi->input, td->maxcontacts);
                        td->last_slot_field = usage->hid;
                        td->last_field_index = field->index;
+                        td->last_mt_collection = usage->collection_index;
                        return 1;
                case HID_DG_WIDTH:
                        hid_map_usage(hi, usage, bit, max,
                                        EV_ABS, ABS_MT_TOUCH_MAJOR);
                        set_abs(hi->input, ABS_MT_TOUCH_MAJOR, field,
                                cls->sn_width);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_HEIGHT:
                        hid_map_usage(hi, usage, bit, max,
@@ -279,8 +293,10 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                                cls->sn_height);
                        input_set_abs_params(hi->input,
                                        ABS_MT_ORIENTATION, 0, 1, 0, 0);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_TIPPRESSURE:
                        if (quirks & MT_QUIRK_EGALAX_XYZ_FIXUP)
@@ -292,16 +308,20 @@ static int mt_input_mapping(struct hid_device *hdev, struct hid_input *hi,
                        /* touchscreen emulation */
                        set_abs(hi->input, ABS_PRESSURE, field,
                                cls->sn_pressure);
-                        td->last_slot_field = usage->hid;
+                        if (td->last_mt_collection == usage->collection_index) {
-                        td->last_field_index = field->index;
+                                td->last_slot_field = usage->hid;
+                                td->last_field_index = field->index;
+                        }
                        return 1;
                case HID_DG_CONTACTCOUNT:
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index)
+                                td->last_field_index = field->index;
                        return 1;
                case HID_DG_CONTACTMAX:
                        /* we don't set td->last_slot_field as contactcount and
                         * contact max are global to the report */
-                        td->last_field_index = field->index;
+                        if (td->last_mt_collection == usage->collection_index)
+                                td->last_field_index = field->index;
                        return -1;
                }
                /* let hid-input decide for the others */
@@ -516,6 +536,7 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id)
        }
        td->mtclass = mtclass;
        td->inputmode = -1;
+        td->last_mt_collection = -1;
        hid_set_drvdata(hdev, td);
        ret = hid_parse(hdev);
@@ -593,6 +614,11 @@ static const struct hid_device_id mt_devices[] = {
                HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
                        USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+        /* Chunghwa Telecom touch panels */
+        {  .driver_data = MT_CLS_DEFAULT,
+                HID_USB_DEVICE(USB_VENDOR_ID_CHUNGHWAT,
+                        USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH) },
        /* CVTouch panels */
        { .driver_data = MT_CLS_DEFAULT,
                HID_USB_DEVICE(USB_VENDOR_ID_CVTOUCH,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 0e30b140edca..621959d5cc42 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -74,6 +74,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH, HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index ff3c644888b1..7c1188b53c3e 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -248,12 +248,15 @@ static int hiddev_release(struct inode * inode, struct file * file)
                        usbhid_close(list->hiddev->hid);
                        usbhid_put_power(list->hiddev->hid);
                } else {
+                        mutex_unlock(&list->hiddev->existancelock);
                        kfree(list->hiddev);
+                        kfree(list);
+                        return 0;
                }
        }
-        kfree(list);
        mutex_unlock(&list->hiddev->existancelock);
+        kfree(list);
        return 0;
 }
@@ -923,10 +926,11 @@ void hiddev_disconnect(struct hid_device *hid)
        usb_deregister_dev(usbhid->intf, &hiddev_class);
        if (hiddev->open) {
+                mutex_unlock(&hiddev->existancelock);
                usbhid_close(hiddev->hid);
                wake_up_interruptible(&hiddev->wait);
        } else {
+                mutex_unlock(&hiddev->existancelock);
                kfree(hiddev);
        }
-        mutex_unlock(&hiddev->existancelock);
 }
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index b5e892017e0c..dcb78a7a8047 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -268,6 +268,7 @@ static struct device_attribute atk_name_attr =
 static void atk_init_attribute(struct device_attribute *attr, char *name,
                sysfs_show_func show)
 {
+        sysfs_attr_init(&attr->attr);
        attr->attr.name = name;
        attr->attr.mode = 0444;
        attr->show = show;
@@ -1188,19 +1189,15 @@ static int atk_create_files(struct atk_data *data)
        int err;
        list_for_each_entry(s, &data->sensor_list, list) {
-                sysfs_attr_init(&s->input_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->input_attr);
                if (err)
                        return err;
-                sysfs_attr_init(&s->label_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->label_attr);
                if (err)
                        return err;
-                sysfs_attr_init(&s->limit1_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->limit1_attr);
                if (err)
                        return err;
-                sysfs_attr_init(&s->limit2_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->limit2_attr);
                if (err)
                        return err;
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 85e937984ff7..0070d5476dd0 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -97,9 +97,7 @@ struct platform_data {
 struct pdev_entry {
        struct list_head list;
        struct platform_device *pdev;
-        unsigned int cpu;
        u16 phys_proc_id;
-        u16 cpu_core_id;
 };
 static LIST_HEAD(pdev_list);
@@ -653,9 +651,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        }
        pdev_entry->pdev = pdev;
-        pdev_entry->cpu = cpu;
        pdev_entry->phys_proc_id = TO_PHYS_ID(cpu);
-        pdev_entry->cpu_core_id = TO_CORE_ID(cpu);
        list_add_tail(&pdev_entry->list, &pdev_list);
        mutex_unlock(&pdev_list_mutex);
diff --git a/drivers/hwmon/ibmaem.c b/drivers/hwmon/ibmaem.c
index 537409d07ee7..1a409c5bc9bc 100644
--- a/drivers/hwmon/ibmaem.c
+++ b/drivers/hwmon/ibmaem.c
@@ -947,6 +947,7 @@ static int aem_register_sensors(struct aem_data *data,
        /* Set up read-only sensors */
        while (ro->label) {
+                sysfs_attr_init(&sensors->dev_attr.attr);
                sensors->dev_attr.attr.name = ro->label;
                sensors->dev_attr.attr.mode = S_IRUGO;
                sensors->dev_attr.show = ro->show;
@@ -963,6 +964,7 @@ static int aem_register_sensors(struct aem_data *data,
        /* Set up read-write sensors */
        while (rw->label) {
+                sysfs_attr_init(&sensors->dev_attr.attr);
                sensors->dev_attr.attr.name = rw->label;
                sensors->dev_attr.attr.mode = S_IRUGO | S_IWUSR;
                sensors->dev_attr.show = rw->show;
diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
index 06d4eafcf76b..41dbf8161ed7 100644
--- a/drivers/hwmon/ibmpex.c
+++ b/drivers/hwmon/ibmpex.c
@@ -358,6 +358,7 @@ static int create_sensor(struct ibmpex_bmc_data *data, int type,
        else if (type == POWER_SENSOR)
                sprintf(n, power_sensor_name_templates[func], "power", counter);
+        sysfs_attr_init(&data->sensors[sensor].attr[func].dev_attr.attr);
        data->sensors[sensor].attr[func].dev_attr.attr.name = n;
        data->sensors[sensor].attr[func].dev_attr.attr.mode = S_IRUGO;
        data->sensors[sensor].attr[func].dev_attr.show = ibmpex_show_sensor;
diff --git a/drivers/hwmon/s3c-hwmon.c b/drivers/hwmon/s3c-hwmon.c
index 92b42db43bcf..b39f52e2752a 100644
--- a/drivers/hwmon/s3c-hwmon.c
+++ b/drivers/hwmon/s3c-hwmon.c
@@ -232,6 +232,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
        attr = &attrs->in;
        attr->index = channel;
+        sysfs_attr_init(&attr->dev_attr.attr);
        attr->dev_attr.attr.name  = attrs->in_name;
        attr->dev_attr.attr.mode  = S_IRUGO;
        attr->dev_attr.show = s3c_hwmon_ch_show;
@@ -249,6 +250,7 @@ static int s3c_hwmon_create_attr(struct device *dev,
                attr = &attrs->label;
                attr->index = channel;
+                sysfs_attr_init(&attr->dev_attr.attr);
                attr->dev_attr.attr.name  = attrs->label_name;
                attr->dev_attr.attr.mode  = S_IRUGO;
                attr->dev_attr.show = s3c_hwmon_label_show;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index be0921ef6b52..4cf25347b015 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -111,7 +111,8 @@ static void evdev_event(struct input_handle *handle,
        rcu_read_unlock();
-        wake_up_interruptible(&evdev->wait);
+        if (type == EV_SYN && code == SYN_REPORT)
+                wake_up_interruptible(&evdev->wait);
 }
 static int evdev_fasync(int fd, struct file *file, int on)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 75e11c7b70fd..da38d97a51b1 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1756,7 +1756,7 @@ static unsigned int input_estimate_events_per_packet(struct input_dev *dev)
        } else if (test_bit(ABS_MT_TRACKING_ID, dev->absbit)) {
                mt_slots = dev->absinfo[ABS_MT_TRACKING_ID].maximum -
                           dev->absinfo[ABS_MT_TRACKING_ID].minimum + 1,
-                clamp(mt_slots, 2, 32);
+                mt_slots = clamp(mt_slots, 2, 32);
        } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
                mt_slots = 2;
        } else {
diff --git a/drivers/input/keyboard/omap-keypad.c b/drivers/input/keyboard/omap-keypad.c
index f23a743817db..33d0bdc837c0 100644
--- a/drivers/input/keyboard/omap-keypad.c
+++ b/drivers/input/keyboard/omap-keypad.c
@@ -209,6 +209,7 @@ static void omap_kp_tasklet(unsigned long data)
 #endif
                }
        }
+        input_sync(omap_kp_data->input);
        memcpy(keypad_state, new_state, sizeof(keypad_state));
        if (key_down) {
diff --git a/drivers/input/keyboard/sh_keysc.c b/drivers/input/keyboard/sh_keysc.c
index 834cf98e7efb..6876700a4469 100644
--- a/drivers/input/keyboard/sh_keysc.c
+++ b/drivers/input/keyboard/sh_keysc.c
@@ -32,7 +32,7 @@ static const struct {
        [SH_KEYSC_MODE_3] = { 2, 4, 7 },
        [SH_KEYSC_MODE_4] = { 3, 6, 6 },
        [SH_KEYSC_MODE_5] = { 4, 6, 7 },
-        [SH_KEYSC_MODE_6] = { 5, 7, 7 },
+        [SH_KEYSC_MODE_6] = { 5, 8, 8 },
 };
 struct sh_keysc_priv {
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 257e033986e4..0110b5a3a167 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -187,7 +187,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
                if (size == 0)
                        size = xres ? : 1;
-                clamp(value, min, max);
+                value = clamp(value, min, max);
                mousedev->packet.x = ((value - min) * xres) / size;
                mousedev->packet.abs_event = 1;
@@ -201,7 +201,7 @@ static void mousedev_abs_event(struct input_dev *dev, struct mousedev *mousedev,
                if (size == 0)
                        size = yres ? : 1;
-                clamp(value, min, max);
+                value = clamp(value, min, max);
                mousedev->packet.y = yres - ((value - min) * yres) / size;
                mousedev->packet.abs_event = 1;
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 59de638225fe..e35058bcd7b9 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -156,8 +156,10 @@ static int if_open(struct tty_struct *tty, struct file *filp)
        if (!cs || !try_module_get(cs->driver->owner))
                return -ENODEV;
-        if (mutex_lock_interruptible(&cs->mutex))
+        if (mutex_lock_interruptible(&cs->mutex)) {
+                module_put(cs->driver->owner);
                return -ERESTARTSYS;
+        }
        tty->driver_data = cs;
        ++cs->open_count;
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index ee5109a3cd98..42f067347bc7 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -495,14 +495,14 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
+        dev->stats.tx_packets++;
+        dev->stats.tx_bytes += skb->len;
        if (atomic_dec_return(&queued_msg->use_count) == 0) {
                dev_kfree_skb(skb);
                kfree(queued_msg);
        }
-        dev->stats.tx_packets++;
-        dev->stats.tx_bytes += skb->len;
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/3c503.c b/drivers/net/3c503.c
index d84f6e8903a5..5b732988d493 100644
--- a/drivers/net/3c503.c
+++ b/drivers/net/3c503.c
@@ -412,7 +412,7 @@ el2_open(struct net_device *dev)
                outb_p(0x04 << ((*irqp == 9) ? 2 : *irqp), E33G_IDCFR);
                outb_p(0x00, E33G_IDCFR);
                msleep(1);
-                free_irq(*irqp, el2_probe_interrupt);
+                free_irq(*irqp, &seen);
                if (!seen)
                        continue;
@@ -422,6 +422,7 @@ el2_open(struct net_device *dev)
                        continue;
                if (retval < 0)
                        goto err_disable;
+                break;
        } while (*++irqp);
        if (*irqp == 0) {
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 68d45ba2d9b9..6c019e148546 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -52,13 +52,13 @@ MODULE_DESCRIPTION(DRV_DESC);
 MODULE_ALIAS("platform:bfin_mac");
 #if defined(CONFIG_BFIN_MAC_USE_L1)
-# define bfin_mac_alloc(dma_handle, size)  l1_data_sram_zalloc(size)
+# define bfin_mac_alloc(dma_handle, size, num)  l1_data_sram_zalloc(size*num)
-# define bfin_mac_free(dma_handle, ptr)    l1_data_sram_free(ptr)
+# define bfin_mac_free(dma_handle, ptr, num)    l1_data_sram_free(ptr)
 #else
-# define bfin_mac_alloc(dma_handle, size) \
+# define bfin_mac_alloc(dma_handle, size, num) \
-        dma_alloc_coherent(NULL, size, dma_handle, GFP_KERNEL)
+        dma_alloc_coherent(NULL, size*num, dma_handle, GFP_KERNEL)
-# define bfin_mac_free(dma_handle, ptr) \
+# define bfin_mac_free(dma_handle, ptr, num) \
-        dma_free_coherent(NULL, sizeof(*ptr), ptr, dma_handle)
+        dma_free_coherent(NULL, sizeof(*ptr)*num, ptr, dma_handle)
 #endif
 #define PKT_BUF_SZ 1580
@@ -95,7 +95,7 @@ static void desc_list_free(void)
                                t = t->next;
                        }
                }
-                bfin_mac_free(dma_handle, tx_desc);
+                bfin_mac_free(dma_handle, tx_desc, CONFIG_BFIN_TX_DESC_NUM);
        }
        if (rx_desc) {
@@ -109,7 +109,7 @@ static void desc_list_free(void)
                                r = r->next;
                        }
                }
-                bfin_mac_free(dma_handle, rx_desc);
+                bfin_mac_free(dma_handle, rx_desc, CONFIG_BFIN_RX_DESC_NUM);
        }
 }
@@ -126,13 +126,13 @@ static int desc_list_init(void)
 #endif
        tx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_tx) *
+                                sizeof(struct net_dma_desc_tx),
                                CONFIG_BFIN_TX_DESC_NUM);
        if (tx_desc == NULL)
                goto init_error;
        rx_desc = bfin_mac_alloc(&dma_handle,
-                                sizeof(struct net_dma_desc_rx) *
+                                sizeof(struct net_dma_desc_rx),
                                CONFIG_BFIN_RX_DESC_NUM);
        if (rx_desc == NULL)
                goto init_error;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 652b30e525d0..eafe44a528ac 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1297,6 +1297,7 @@ static inline int slave_enable_netpoll(struct slave *slave)
                goto out;
        np->dev = slave->dev;
+        strlcpy(np->dev_name, slave->dev->name, IFNAMSIZ);
        err = __netpoll_setup(np);
        if (err) {
                kfree(np);
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 7a84e45487e8..7583a9572bcc 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -105,7 +105,7 @@ static int do_pd_setup(struct fs_enet_private *fep)
                goto out_ep;
        fep->fcc.mem = (void __iomem *)cpm2_immr;
-        fpi->dpram_offset = cpm_dpalloc(128, 8);
+        fpi->dpram_offset = cpm_dpalloc(128, 32);
        if (IS_ERR_VALUE(fpi->dpram_offset)) {
                ret = fpi->dpram_offset;
                goto out_fcccp;
diff --git a/drivers/net/hp100.c b/drivers/net/hp100.c
index 8e10d2f6a5ad..c3ecb118c1df 100644
--- a/drivers/net/hp100.c
+++ b/drivers/net/hp100.c
@@ -1580,12 +1580,12 @@ static netdev_tx_t hp100_start_xmit_bm(struct sk_buff *skb,
        hp100_outl(ringptr->pdl_paddr, TX_PDA_L);       /* Low Prio. Queue */
        lp->txrcommit++;
-        spin_unlock_irqrestore(&lp->lock, flags);
-        /* Update statistics */
        dev->stats.tx_packets++;
        dev->stats.tx_bytes += skb->len;
+        spin_unlock_irqrestore(&lp->lock, flags);
        return NETDEV_TX_OK;
 drop:
diff --git a/drivers/net/hplance.c b/drivers/net/hplance.c
index b6060f7538df..a900d5bf2948 100644
--- a/drivers/net/hplance.c
+++ b/drivers/net/hplance.c
@@ -135,7 +135,7 @@ static void __devexit hplance_remove_one(struct dio_dev *d)
 }
 /* Initialise a single lance board at the given DIO device */
-static void __init hplance_init(struct net_device *dev, struct dio_dev *d)
+static void __devinit hplance_init(struct net_device *dev, struct dio_dev *d)
 {
        unsigned long va = (d->resource.start + DIO_VIRADDRBASE);
        struct hplance_private *lp;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index b644383017f9..c0788a31ff0f 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1965,11 +1965,11 @@ netxen_nic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
        netxen_tso_check(netdev, tx_ring, first_desc, skb);
-        netxen_nic_update_cmd_producer(adapter, tx_ring);
        adapter->stats.txbytes += skb->len;
        adapter->stats.xmitcalled++;
+        netxen_nic_update_cmd_producer(adapter, tx_ring);
        return NETDEV_TX_OK;
 drop_packet:
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index 392a6c4b72e5..a70244306c94 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -58,6 +58,7 @@ config BROADCOM_PHY
 config BCM63XX_PHY
        tristate "Drivers for Broadcom 63xx SOCs internal PHY"
+        depends on BCM63XX
        ---help---
          Currently supports the 6348 and 6358 PHYs.
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index b0c9522bb535..2cd8dc5847b4 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -543,11 +543,20 @@ static void recalibrate(struct dp83640_clock *clock)
 /* time stamping methods */
-static void decode_evnt(struct dp83640_private *dp83640,
+static int decode_evnt(struct dp83640_private *dp83640,
-                        struct phy_txts *phy_txts, u16 ests)
+                       void *data, u16 ests)
 {
+        struct phy_txts *phy_txts;
        struct ptp_clock_event event;
        int words = (ests >> EVNT_TS_LEN_SHIFT) & EVNT_TS_LEN_MASK;
+        u16 ext_status = 0;
+        if (ests & MULT_EVNT) {
+                ext_status = *(u16 *) data;
+                data += sizeof(ext_status);
+        }
+        phy_txts = data;
        switch (words) { /* fall through in every case */
        case 3:
@@ -565,6 +574,9 @@ static void decode_evnt(struct dp83640_private *dp83640,
        event.timestamp = phy2txts(&dp83640->edata);
        ptp_clock_event(dp83640->clock->ptp_clock, &event);
+        words = ext_status ? words + 2 : words + 1;
+        return words * sizeof(u16);
 }
 static void decode_rxts(struct dp83640_private *dp83640,
@@ -643,9 +655,7 @@ static void decode_status_frame(struct dp83640_private *dp83640,
                } else if (PSF_EVNT == type && len >= sizeof(*phy_txts)) {
-                        phy_txts = (struct phy_txts *) ptr;
+                        size = decode_evnt(dp83640, ptr, ests);
-                        decode_evnt(dp83640, phy_txts, ests);
-                        size = sizeof(*phy_txts);
                } else {
                        size = 0;
@@ -1034,8 +1044,8 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
        if (is_status_frame(skb, type)) {
                decode_status_frame(dp83640, skb);
-                /* Let the stack drop this frame. */
+                kfree_skb(skb);
-                return false;
+                return true;
        }
        SKB_PTP_TYPE(skb) = type;
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index a1b82c9c67d2..c554a397e558 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -523,7 +523,7 @@ static void ppp_async_process(unsigned long arg)
 #define PUT_BYTE(ap, buf, c, islcp)     do {            \
        if ((islcp && c < 0x20) || (ap->xaccm[c >> 5] & (1 << (c & 0x1f)))) {\
                *buf++ = PPP_ESCAPE;                    \
-                *buf++ = c ^ 0x20;                      \
+                *buf++ = c ^ PPP_TRANS;                 \
        } else                                          \
                *buf++ = c;                             \
 } while (0)
@@ -896,7 +896,7 @@ ppp_async_input(struct asyncppp *ap, const unsigned char *buf,
                                sp = skb_put(skb, n);
                                memcpy(sp, buf, n);
                                if (ap->state & SC_ESCAPE) {
-                                        sp[0] ^= 0x20;
+                                        sp[0] ^= PPP_TRANS;
                                        ap->state &= ~SC_ESCAPE;
                                }
                        }
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 89f7540d90f9..5f597ca592bb 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -1273,7 +1273,7 @@ static int pxa168_eth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        wmb();
        wrl(pep, SDMA_CMD, SDMA_CMD_TXDH | SDMA_CMD_ERD);
-        stats->tx_bytes += skb->len;
+        stats->tx_bytes += length;
        stats->tx_packets++;
        dev->trans_start = jiffies;
        if (pep->tx_ring_size - pep->tx_desc_count <= 1) {
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index ef1ce2ebeb4a..05d81780d1fd 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1621,7 +1621,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
         *
         * (RTL_R32(TxConfig) & 0x700000) == 0x200000 ? 8101Eb : 8101Ec
         */
-        static const struct {
+        static const struct rtl_mac_info {
                u32 mask;
                u32 val;
                int mac_version;
@@ -1689,7 +1689,8 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
                /* Catch-all */
                { 0x00000000, 0x00000000,       RTL_GIGA_MAC_NONE   }
-        }, *p = mac_info;
+        };
+        const struct rtl_mac_info *p = mac_info;
        u32 reg;
        reg = RTL_R32(TxConfig);
@@ -3681,7 +3682,7 @@ static void rtl_set_rx_max_size(void __iomem *ioaddr, unsigned int rx_buf_sz)
 static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
 {
-        static const struct {
+        static const struct rtl_cfg2_info {
                u32 mac_version;
                u32 clk;
                u32 val;
@@ -3690,7 +3691,8 @@ static void rtl8169_set_magic_reg(void __iomem *ioaddr, unsigned mac_version)
                { RTL_GIGA_MAC_VER_05, PCI_Clock_66MHz, 0x000fffff },
                { RTL_GIGA_MAC_VER_06, PCI_Clock_33MHz, 0x00ffff00 }, // 8110SCe
                { RTL_GIGA_MAC_VER_06, PCI_Clock_66MHz, 0x00ffffff }
-        }, *p = cfg2_info;
+        };
+        const struct rtl_cfg2_info *p = cfg2_info;
        unsigned int i;
        u32 clk;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 74e94054ab1a..5235f48be1be 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -460,7 +460,23 @@ static u32 tun_net_fix_features(struct net_device *dev, u32 features)
        return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
 }
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void tun_poll_controller(struct net_device *dev)
+{
+        /*
+         * Tun only receives frames when:
+         * 1) the char device endpoint gets data from user space
+         * 2) the tun socket gets a sendmsg call from user space
+         * Since both of those are syncronous operations, we are guaranteed
+         * never to have pending data when we poll for it
+         * so theres nothing to do here but return.
+         * We need this though so netpoll recognizes us as an interface that
+         * supports polling, which enables bridge devices in virt setups to
+         * still use netconsole
+         */
+        return;
+}
+#endif
 static const struct net_device_ops tun_netdev_ops = {
        .ndo_uninit             = tun_net_uninit,
        .ndo_open               = tun_net_open,
@@ -468,6 +484,9 @@ static const struct net_device_ops tun_netdev_ops = {
        .ndo_start_xmit         = tun_net_xmit,
        .ndo_change_mtu         = tun_net_change_mtu,
        .ndo_fix_features       = tun_net_fix_features,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 static const struct net_device_ops tap_netdev_ops = {
@@ -480,6 +499,9 @@ static const struct net_device_ops tap_netdev_ops = {
        .ndo_set_multicast_list = tun_net_mclist,
        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_validate_addr      = eth_validate_addr,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller    = tun_poll_controller,
+#endif
 };
 /* Initialize net device. */
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 9d4f9117260f..84d4608153c9 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,6 +385,16 @@ config USB_NET_CX82310_ETH
          router with USB ethernet port. This driver is for routers only,
          it will not work with ADSL modems (use cxacru driver instead).
+config USB_NET_KALMIA
+        tristate "Samsung Kalmia based LTE USB modem"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Samsung Kalmia based USB modem
+          as Samsung GT-B3730.
+          To compile this driver as a module, choose M here: the
+          module will be called kalmia.
 config USB_HSO
        tristate "Option USB High Speed Mobile Devices"
        depends on USB && RFKILL
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index c7ec8a5f0a90..c203fa21f6b1 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_NET_KALMIA)    += kalmia.o
 obj-$(CONFIG_USB_IPHETH)        += ipheth.o
 obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 obj-$(CONFIG_USB_NET_CX82310_ETH)       += cx82310_eth.o
diff --git a/drivers/net/usb/kalmia.c b/drivers/net/usb/kalmia.c
new file mode 100644
index 000000000000..d965fb1e013e
--- /dev/null
+++ b/drivers/net/usb/kalmia.c
@@ -0,0 +1,384 @@
+/*
+ * USB network interface driver for Samsung Kalmia based LTE USB modem like the
+ * Samsung GT-B3730 and GT-B3710.
+ *
+ * Copyright (C) 2011 Marius Bjoernstad Kotsbak <marius@kotsbak.com>
+ *
+ * Sponsored by Quicklink Video Distribution Services Ltd.
+ *
+ * Based on the cdc_eem module.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+#include <linux/gfp.h>
+/*
+ * The Samsung Kalmia based LTE USB modems have a CDC ACM port for modem control
+ * handled by the "option" module and an ethernet data port handled by this
+ * module.
+ *
+ * The stick must first be switched into modem mode by usb_modeswitch
+ * or similar tool. Then the modem gets sent two initialization packets by
+ * this module, which gives the MAC address of the device. User space can then
+ * connect the modem using AT commands through the ACM port and then use
+ * DHCP on the network interface exposed by this module. Network packets are
+ * sent to and from the modem in a proprietary format discovered after watching
+ * the behavior of the windows driver for the modem.
+ *
+ * More information about the use of the modem is available in usb_modeswitch
+ * forum and the project page:
+ *
+ * http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?t=465
+ * https://github.com/mkotsbak/Samsung-GT-B3730-linux-driver
+ */
+/* #define      DEBUG */
+/* #define      VERBOSE */
+#define KALMIA_HEADER_LENGTH 6
+#define KALMIA_ALIGN_SIZE 4
+#define KALMIA_USB_TIMEOUT 10000
+/*-------------------------------------------------------------------------*/
+static int
+kalmia_send_init_packet(struct usbnet *dev, u8 *init_msg, u8 init_msg_len,
+        u8 *buffer, u8 expected_len)
+{
+        int act_len;
+        int status;
+        netdev_dbg(dev->net, "Sending init packet");
+        status = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 0x02),
+                init_msg, init_msg_len, &act_len, KALMIA_USB_TIMEOUT);
+        if (status != 0) {
+                netdev_err(dev->net,
+                        "Error sending init packet. Status %i, length %i\n",
+                        status, act_len);
+                return status;
+        }
+        else if (act_len != init_msg_len) {
+                netdev_err(dev->net,
+                        "Did not send all of init packet. Bytes sent: %i",
+                        act_len);
+        }
+        else {
+                netdev_dbg(dev->net, "Successfully sent init packet.");
+        }
+        status = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, 0x81),
+                buffer, expected_len, &act_len, KALMIA_USB_TIMEOUT);
+        if (status != 0)
+                netdev_err(dev->net,
+                        "Error receiving init result. Status %i, length %i\n",
+                        status, act_len);
+        else if (act_len != expected_len)
+                netdev_err(dev->net, "Unexpected init result length: %i\n",
+                        act_len);
+        return status;
+}
+static int
+kalmia_init_and_get_ethernet_addr(struct usbnet *dev, u8 *ethernet_addr)
+{
+        char init_msg_1[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
+                0x00, 0x00 };
+        char init_msg_2[] =
+                { 0x57, 0x50, 0x04, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0xf4,
+                0x00, 0x00 };
+        char receive_buf[28];
+        int status;
+        status = kalmia_send_init_packet(dev, init_msg_1, sizeof(init_msg_1)
+                / sizeof(init_msg_1[0]), receive_buf, 24);
+        if (status != 0)
+                return status;
+        status = kalmia_send_init_packet(dev, init_msg_2, sizeof(init_msg_2)
+                / sizeof(init_msg_2[0]), receive_buf, 28);
+        if (status != 0)
+                return status;
+        memcpy(ethernet_addr, receive_buf + 10, ETH_ALEN);
+        return status;
+}
+static int
+kalmia_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 status;
+        u8 ethernet_addr[ETH_ALEN];
+        /* Don't bind to AT command interface */
+        if (intf->cur_altsetting->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC)
+                return -EINVAL;
+        dev->in = usb_rcvbulkpipe(dev->udev, 0x81 & USB_ENDPOINT_NUMBER_MASK);
+        dev->out = usb_sndbulkpipe(dev->udev, 0x02 & USB_ENDPOINT_NUMBER_MASK);
+        dev->status = NULL;
+        dev->net->hard_header_len += KALMIA_HEADER_LENGTH;
+        dev->hard_mtu = 1400;
+        dev->rx_urb_size = dev->hard_mtu * 10; // Found as optimal after testing
+        status = kalmia_init_and_get_ethernet_addr(dev, ethernet_addr);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+        memcpy(dev->net->dev_addr, ethernet_addr, ETH_ALEN);
+        memcpy(dev->net->perm_addr, ethernet_addr, ETH_ALEN);
+        return status;
+}
+static struct sk_buff *
+kalmia_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        struct sk_buff *skb2 = NULL;
+        u16 content_len;
+        unsigned char *header_start;
+        unsigned char ether_type_1, ether_type_2;
+        u8 remainder, padlen = 0;
+        if (!skb_cloned(skb)) {
+                int headroom = skb_headroom(skb);
+                int tailroom = skb_tailroom(skb);
+                if ((tailroom >= KALMIA_ALIGN_SIZE) && (headroom
+                        >= KALMIA_HEADER_LENGTH))
+                        goto done;
+                if ((headroom + tailroom) > (KALMIA_HEADER_LENGTH
+                        + KALMIA_ALIGN_SIZE)) {
+                        skb->data = memmove(skb->head + KALMIA_HEADER_LENGTH,
+                                skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                        goto done;
+                }
+        }
+        skb2 = skb_copy_expand(skb, KALMIA_HEADER_LENGTH,
+                KALMIA_ALIGN_SIZE, flags);
+        if (!skb2)
+                return NULL;
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+        done: header_start = skb_push(skb, KALMIA_HEADER_LENGTH);
+        ether_type_1 = header_start[KALMIA_HEADER_LENGTH + 12];
+        ether_type_2 = header_start[KALMIA_HEADER_LENGTH + 13];
+        netdev_dbg(dev->net, "Sending etherType: %02x%02x", ether_type_1,
+                ether_type_2);
+        /* According to empiric data for data packages */
+        header_start[0] = 0x57;
+        header_start[1] = 0x44;
+        content_len = skb->len - KALMIA_HEADER_LENGTH;
+        header_start[2] = (content_len & 0xff); /* low byte */
+        header_start[3] = (content_len >> 8); /* high byte */
+        header_start[4] = ether_type_1;
+        header_start[5] = ether_type_2;
+        /* Align to 4 bytes by padding with zeros */
+        remainder = skb->len % KALMIA_ALIGN_SIZE;
+        if (remainder > 0) {
+                padlen = KALMIA_ALIGN_SIZE - remainder;
+                memset(skb_put(skb, padlen), 0, padlen);
+        }
+        netdev_dbg(
+                dev->net,
+                "Sending package with length %i and padding %i. Header: %02x:%02x:%02x:%02x:%02x:%02x.",
+                content_len, padlen, header_start[0], header_start[1],
+                header_start[2], header_start[3], header_start[4],
+                header_start[5]);
+        return skb;
+}
+static int
+kalmia_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.
+         */
+        const u8 HEADER_END_OF_USB_PACKET[] =
+                { 0x57, 0x5a, 0x00, 0x00, 0x08, 0x00 };
+        const u8 EXPECTED_UNKNOWN_HEADER_1[] =
+                { 0x57, 0x43, 0x1e, 0x00, 0x15, 0x02 };
+        const u8 EXPECTED_UNKNOWN_HEADER_2[] =
+                { 0x57, 0x50, 0x0e, 0x00, 0x00, 0x00 };
+        u8 i = 0;
+        /* incomplete header? */
+        if (skb->len < KALMIA_HEADER_LENGTH)
+                return 0;
+        do {
+                struct sk_buff *skb2 = NULL;
+                u8 *header_start;
+                u16 usb_packet_length, ether_packet_length;
+                int is_last;
+                header_start = skb->data;
+                if (unlikely(header_start[0] != 0x57 || header_start[1] != 0x44)) {
+                        if (!memcmp(header_start, EXPECTED_UNKNOWN_HEADER_1,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_1)) || !memcmp(
+                                header_start, EXPECTED_UNKNOWN_HEADER_2,
+                                sizeof(EXPECTED_UNKNOWN_HEADER_2))) {
+                                netdev_dbg(
+                                        dev->net,
+                                        "Received expected unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                        else {
+                                netdev_err(
+                                        dev->net,
+                                        "Received unknown frame header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                                return 0;
+                        }
+                }
+                else
+                        netdev_dbg(
+                                dev->net,
+                                "Received header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                header_start[0], header_start[1], header_start[2],
+                                header_start[3], header_start[4], header_start[5],
+                                skb->len - KALMIA_HEADER_LENGTH);
+                /* subtract start header and end header */
+                usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
+                ether_packet_length = header_start[2] + (header_start[3] << 8);
+                skb_pull(skb, KALMIA_HEADER_LENGTH);
+                /* Some small packets misses end marker */
+                if (usb_packet_length < ether_packet_length) {
+                        ether_packet_length = usb_packet_length
+                                + KALMIA_HEADER_LENGTH;
+                        is_last = true;
+                }
+                else {
+                        netdev_dbg(dev->net, "Correct package length #%i", i
+                                + 1);
+                        is_last = (memcmp(skb->data + ether_packet_length,
+                                HEADER_END_OF_USB_PACKET,
+                                sizeof(HEADER_END_OF_USB_PACKET)) == 0);
+                        if (!is_last) {
+                                header_start = skb->data + ether_packet_length;
+                                netdev_dbg(
+                                        dev->net,
+                                        "End header: %02x:%02x:%02x:%02x:%02x:%02x. Package length: %i\n",
+                                        header_start[0], header_start[1],
+                                        header_start[2], header_start[3],
+                                        header_start[4], header_start[5],
+                                        skb->len - KALMIA_HEADER_LENGTH);
+                        }
+                }
+                if (is_last) {
+                        skb2 = skb;
+                }
+                else {
+                        skb2 = skb_clone(skb, GFP_ATOMIC);
+                        if (unlikely(!skb2))
+                                return 0;
+                }
+                skb_trim(skb2, ether_packet_length);
+                if (is_last) {
+                        return 1;
+                }
+                else {
+                        usbnet_skb_return(dev, skb2);
+                        skb_pull(skb, ether_packet_length);
+                }
+                i++;
+        }
+        while (skb->len);
+        return 1;
+}
+static const struct driver_info kalmia_info = {
+        .description = "Samsung Kalmia LTE USB dongle",
+        .flags = FLAG_WWAN,
+        .bind = kalmia_bind,
+        .rx_fixup = kalmia_rx_fixup,
+        .tx_fixup = kalmia_tx_fixup
+};
+/*-------------------------------------------------------------------------*/
+static const struct usb_device_id products[] = {
+        /* The unswitched USB ID, to get the module auto loaded: */
+        { USB_DEVICE(0x04e8, 0x689a) },
+        /* The stick swithed into modem (by e.g. usb_modeswitch): */
+        { USB_DEVICE(0x04e8, 0x6889),
+                .driver_info = (unsigned long) &kalmia_info, },
+        { /* EMPTY == end of list */} };
+MODULE_DEVICE_TABLE( usb, products);
+static struct usb_driver kalmia_driver = {
+        .name = "kalmia",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume
+};
+static int __init kalmia_init(void)
+{
+        return usb_register(&kalmia_driver);
+}
+module_init( kalmia_init);
+static void __exit kalmia_exit(void)
+{
+        usb_deregister(&kalmia_driver);
+}
+module_exit( kalmia_exit);
+MODULE_AUTHOR("Marius Bjoernstad Kotsbak <marius@kotsbak.com>");
+MODULE_DESCRIPTION("Samsung Kalmia USB network driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
index e050bd65e037..777d1a4e81b2 100644
--- a/drivers/net/wan/farsync.c
+++ b/drivers/net/wan/farsync.c
@@ -2203,8 +2203,10 @@ fst_open(struct net_device *dev)
        if (port->mode != FST_RAW) {
                err = hdlc_open(dev);
-                if (err)
+                if (err) {
+                        module_put(THIS_MODULE);
                        return err;
+                }
        }
        fst_openport(port);
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 660831ce293c..687c1f223497 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1288,6 +1288,8 @@ int mwifiex_register_cfg80211(struct net_device *dev, u8 *mac,
        *(unsigned long *) wdev_priv = (unsigned long) priv;
+        set_wiphy_dev(wdev->wiphy, (struct device *) priv->adapter->dev);
        ret = wiphy_register(wdev->wiphy);
        if (ret < 0) {
                dev_err(priv->adapter->dev, "%s: registering cfg80211 device\n",
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 32261189bcef..aeac3cc4dbe4 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -2474,6 +2474,7 @@ struct mwl8k_cmd_set_hw_spec {
 * faster client.
 */
 #define MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY  0x00000400
+#define MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR        0x00000200
 #define MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT           0x00000080
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP       0x00000020
 #define MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON          0x00000010
@@ -2510,7 +2511,8 @@ static int mwl8k_cmd_set_hw_spec(struct ieee80211_hw *hw)
        cmd->flags = cpu_to_le32(MWL8K_SET_HW_SPEC_FLAG_HOST_DECR_MGMT |
                                 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_PROBERESP |
                                 MWL8K_SET_HW_SPEC_FLAG_HOSTFORM_BEACON |
-                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY);
+                                 MWL8K_SET_HW_SPEC_FLAG_ENABLE_LIFE_TIME_EXPIRY |
+                                 MWL8K_SET_HW_SPEC_FLAG_GENERATE_CCMP_HDR);
        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
        cmd->total_rxd = cpu_to_le32(MWL8K_RX_DESCS);
diff --git a/drivers/pcmcia/pxa2xx_vpac270.c b/drivers/pcmcia/pxa2xx_vpac270.c
index 435002dfc3ca..712baab3c83d 100644
--- a/drivers/pcmcia/pxa2xx_vpac270.c
+++ b/drivers/pcmcia/pxa2xx_vpac270.c
@@ -11,6 +11,7 @@
 *
 */
+#include <linux/gpio.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
diff --git a/drivers/spi/spi_bfin5xx.c b/drivers/spi/spi_bfin5xx.c
index f706dba165cf..cc880c95e7de 100644
--- a/drivers/spi/spi_bfin5xx.c
+++ b/drivers/spi/spi_bfin5xx.c
@@ -681,13 +681,14 @@ static void bfin_spi_pump_transfers(unsigned long data)
        drv_data->cs_change = transfer->cs_change;
        /* Bits per word setup */
-        bits_per_word = transfer->bits_per_word ? : message->spi->bits_per_word;
+        bits_per_word = transfer->bits_per_word ? :
-        if ((bits_per_word > 0) && (bits_per_word % 16 == 0)) {
+                message->spi->bits_per_word ? : 8;
+        if (bits_per_word % 16 == 0) {
                drv_data->n_bytes = bits_per_word/8;
                drv_data->len = (transfer->len) >> 1;
                cr_width = BIT_CTL_WORDSIZE;
                drv_data->ops = &bfin_bfin_spi_transfer_ops_u16;
-        } else if ((bits_per_word > 0) && (bits_per_word % 8 == 0)) {
+        } else if (bits_per_word % 8 == 0) {
                drv_data->n_bytes = bits_per_word/8;
                drv_data->len = transfer->len;
                cr_width = 0;
diff --git a/drivers/staging/iio/accel/adis16201.h b/drivers/staging/iio/accel/adis16201.h
index 0b9b85424dfa..4cc1a5bfab40 100644
--- a/drivers/staging/iio/accel/adis16201.h
+++ b/drivers/staging/iio/accel/adis16201.h
@@ -81,7 +81,6 @@ struct adis16201_state {
 int adis16201_set_irq(struct iio_dev *indio_dev, bool enable);
-#ifdef CONFIG_IIO_RING_BUFFER
 enum adis16201_scan {
        ADIS16201_SCAN_SUPPLY,
        ADIS16201_SCAN_ACC_X,
@@ -92,6 +91,7 @@ enum adis16201_scan {
        ADIS16201_SCAN_INCLI_Y,
 };
+#ifdef CONFIG_IIO_RING_BUFFER
 void adis16201_remove_trigger(struct iio_dev *indio_dev);
 int adis16201_probe_trigger(struct iio_dev *indio_dev);
diff --git a/drivers/staging/iio/accel/adis16203.h b/drivers/staging/iio/accel/adis16203.h
index 8bb8ce50c248..175e21bb9b40 100644
--- a/drivers/staging/iio/accel/adis16203.h
+++ b/drivers/staging/iio/accel/adis16203.h
@@ -76,7 +76,6 @@ struct adis16203_state {
 int adis16203_set_irq(struct iio_dev *indio_dev, bool enable);
-#ifdef CONFIG_IIO_RING_BUFFER
 enum adis16203_scan {
        ADIS16203_SCAN_SUPPLY,
        ADIS16203_SCAN_AUX_ADC,
@@ -85,6 +84,7 @@ enum adis16203_scan {
        ADIS16203_SCAN_INCLI_Y,
 };
+#ifdef CONFIG_IIO_RING_BUFFER
 void adis16203_remove_trigger(struct iio_dev *indio_dev);
 int adis16203_probe_trigger(struct iio_dev *indio_dev);
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index ebb893c49e90..d7aaec5667bf 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -248,10 +248,6 @@ static int atyfb_sync(struct fb_info *info);
 static int aty_init(struct fb_info *info);
-#ifdef CONFIG_ATARI
-static int store_video_par(char *videopar, unsigned char m64_num);
-#endif
 static void aty_get_crtc(const struct atyfb_par *par, struct crtc *crtc);
 static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc);
@@ -2268,11 +2264,13 @@ error:
        return;
 }
+#ifdef CONFIG_PCI
 static void aty_bl_exit(struct backlight_device *bd)
 {
        backlight_device_unregister(bd);
        printk("aty: Backlight unloaded\n");
 }
+#endif /* CONFIG_PCI */
 #endif /* CONFIG_FB_ATY_BACKLIGHT */
@@ -2789,7 +2787,7 @@ aty_init_exit:
        return ret;
 }
-#ifdef CONFIG_ATARI
+#if defined(CONFIG_ATARI) && !defined(MODULE)
 static int __devinit store_video_par(char *video_str, unsigned char m64_num)
 {
        char *p;
@@ -2818,7 +2816,7 @@ static int __devinit store_video_par(char *video_str, unsigned char m64_num)
        phys_vmembase[m64_num] = 0;
        return -1;
 }
-#endif /* CONFIG_ATARI */
+#endif /* CONFIG_ATARI && !MODULE */
 /*
 * Blank the display.
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 69c49dfce9cf..784139aed079 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -541,7 +541,7 @@ static int __init efifb_init(void)
         */
        ret = platform_driver_probe(&efifb_driver, efifb_probe);
        if (ret) {
-                platform_device_unregister(&efifb_driver);
+                platform_device_unregister(&efifb_device);
                return ret;
        }
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 0352afa49a39..4aecf213c9be 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -235,13 +235,12 @@ static int s3c_fb_check_var(struct fb_var_screeninfo *var,
                            struct fb_info *info)
 {
        struct s3c_fb_win *win = info->par;
-        struct s3c_fb_pd_win *windata = win->windata;
        struct s3c_fb *sfb = win->parent;
        dev_dbg(sfb->dev, "checking parameters\n");
-        var->xres_virtual = max((unsigned int)windata->virtual_x, var->xres);
+        var->xres_virtual = max(var->xres_virtual, var->xres);
-        var->yres_virtual = max((unsigned int)windata->virtual_y, var->yres);
+        var->yres_virtual = max(var->yres_virtual, var->yres);
        if (!s3c_fb_validate_win_bpp(win, var->bits_per_pixel)) {
                dev_dbg(sfb->dev, "win %d: unsupported bpp %d\n",
@@ -558,6 +557,13 @@ static int s3c_fb_set_par(struct fb_info *info)
        vidosd_set_alpha(win, alpha);
        vidosd_set_size(win, data);
+        /* Enable DMA channel for this window */
+        if (sfb->variant.has_shadowcon) {
+                data = readl(sfb->regs + SHADOWCON);
+                data |= SHADOWCON_CHx_ENABLE(win_no);
+                writel(data, sfb->regs + SHADOWCON);
+        }
        data = WINCONx_ENWIN;
        /* note, since we have to round up the bits-per-pixel, we end up
@@ -637,13 +643,6 @@ static int s3c_fb_set_par(struct fb_info *info)
        writel(data, regs + sfb->variant.wincon + (win_no * 4));
        writel(0x0, regs + sfb->variant.winmap + (win_no * 4));
-        /* Enable DMA channel for this window */
-        if (sfb->variant.has_shadowcon) {
-                data = readl(sfb->regs + SHADOWCON);
-                data |= SHADOWCON_CHx_ENABLE(win_no);
-                writel(data, sfb->regs + SHADOWCON);
-        }
        shadow_protect_win(win, 0);
        return 0;
@@ -1487,11 +1486,10 @@ static int __devexit s3c_fb_remove(struct platform_device *pdev)
        release_mem_region(sfb->regs_res->start, resource_size(sfb->regs_res));
-        kfree(sfb);
        pm_runtime_put_sync(sfb->dev);
        pm_runtime_disable(sfb->dev);
+        kfree(sfb);
        return 0;
 }
diff --git a/drivers/video/sh_mobile_hdmi.c b/drivers/video/sh_mobile_hdmi.c
index 6ae40b630dc9..7d54e2c612f7 100644
--- a/drivers/video/sh_mobile_hdmi.c
+++ b/drivers/video/sh_mobile_hdmi.c
@@ -1127,23 +1127,16 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                struct fb_info *info = hdmi->info;
                unsigned long parent_rate = 0, hdmi_rate;
-                /* A device has been plugged in */
-                pm_runtime_get_sync(hdmi->dev);
                ret = sh_hdmi_read_edid(hdmi, &hdmi_rate, &parent_rate);
-                if (ret < 0) {
+                if (ret < 0)
-                        pm_runtime_put(hdmi->dev);
                        goto out;
-                }
                hdmi->hp_state = HDMI_HOTPLUG_EDID_DONE;
                /* Reconfigure the clock */
                ret = sh_hdmi_clk_configure(hdmi, hdmi_rate, parent_rate);
-                if (ret < 0) {
+                if (ret < 0)
-                        pm_runtime_put(hdmi->dev);
                        goto out;
-                }
                msleep(10);
                sh_hdmi_configure(hdmi);
@@ -1191,7 +1184,6 @@ static void sh_hdmi_edid_work_fn(struct work_struct *work)
                fb_set_suspend(hdmi->info, 1);
                console_unlock();
-                pm_runtime_put(hdmi->dev);
        }
 out:
@@ -1312,7 +1304,7 @@ static int __init sh_hdmi_probe(struct platform_device *pdev)
        INIT_DELAYED_WORK(&hdmi->edid_work, sh_hdmi_edid_work_fn);
        pm_runtime_enable(&pdev->dev);
-        pm_runtime_resume(&pdev->dev);
+        pm_runtime_get_sync(&pdev->dev);
        /* Product and revision IDs are 0 in sh-mobile version */
        dev_info(&pdev->dev, "Detected HDMI controller 0x%x:0x%x\n",
@@ -1340,7 +1332,7 @@ static int __init sh_hdmi_probe(struct platform_device *pdev)
 ecodec:
        free_irq(irq, hdmi);
 ereqirq:
-        pm_runtime_suspend(&pdev->dev);
+        pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        iounmap(hdmi->base);
 emap:
@@ -1377,7 +1369,7 @@ static int __exit sh_hdmi_remove(struct platform_device *pdev)
        free_irq(irq, hdmi);
        /* Wait for already scheduled work */
        cancel_delayed_work_sync(&hdmi->edid_work);
-        pm_runtime_suspend(&pdev->dev);
+        pm_runtime_put(&pdev->dev);
        pm_runtime_disable(&pdev->dev);
        clk_disable(hdmi->hdmi_clk);
        clk_put(hdmi->hdmi_clk);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 553da68bd510..30df85d8fca8 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -395,9 +395,9 @@ static void unmask_evtchn(int port)
 static void xen_irq_init(unsigned irq)
 {
        struct irq_info *info;
+#ifdef CONFIG_SMP
        struct irq_desc *desc = irq_to_desc(irq);
-#ifdef CONFIG_SMP
        /* By default all event channels notify CPU#0. */
        cpumask_copy(desc->irq_data.affinity, cpumask_of(0));
 #endif
diff --git a/fs/afs/dir.c b/fs/afs/dir.c
index 20c106f24927..1b0b19550015 100644
--- a/fs/afs/dir.c
+++ b/fs/afs/dir.c
@@ -584,11 +584,11 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry,
 success:
        d_add(dentry, inode);
-        _leave(" = 0 { vn=%u u=%u } -> { ino=%lu v=%llu }",
+        _leave(" = 0 { vn=%u u=%u } -> { ino=%lu v=%u }",
               fid.vnode,
               fid.unique,
               dentry->d_inode->i_ino,
-               (unsigned long long)dentry->d_inode->i_version);
+               dentry->d_inode->i_generation);
        return NULL;
 }
@@ -671,10 +671,10 @@ static int afs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
                 * been deleted and replaced, and the original vnode ID has
                 * been reused */
                if (fid.unique != vnode->fid.unique) {
-                        _debug("%s: file deleted (uq %u -> %u I:%llu)",
+                        _debug("%s: file deleted (uq %u -> %u I:%u)",
                               dentry->d_name.name, fid.unique,
                               vnode->fid.unique,
-                               (unsigned long long)dentry->d_inode->i_version);
+                               dentry->d_inode->i_generation);
                        spin_lock(&vnode->lock);
                        set_bit(AFS_VNODE_DELETED, &vnode->flags);
                        spin_unlock(&vnode->lock);
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index 4bd0218473a9..346e3289abd7 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -89,7 +89,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp,
                        i_size_write(&vnode->vfs_inode, size);
                        vnode->vfs_inode.i_uid = status->owner;
                        vnode->vfs_inode.i_gid = status->group;
-                        vnode->vfs_inode.i_version = vnode->fid.unique;
+                        vnode->vfs_inode.i_generation = vnode->fid.unique;
                        vnode->vfs_inode.i_nlink = status->nlink;
                        mode = vnode->vfs_inode.i_mode;
@@ -102,6 +102,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp,
                vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server;
                vnode->vfs_inode.i_mtime        = vnode->vfs_inode.i_ctime;
                vnode->vfs_inode.i_atime        = vnode->vfs_inode.i_ctime;
+                vnode->vfs_inode.i_version      = data_version;
        }
        expected_version = status->data_version;
diff --git a/fs/afs/inode.c b/fs/afs/inode.c
index db66c5201474..0fdab6e03d87 100644
--- a/fs/afs/inode.c
+++ b/fs/afs/inode.c
@@ -75,7 +75,8 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key)
        inode->i_ctime.tv_nsec  = 0;
        inode->i_atime          = inode->i_mtime = inode->i_ctime;
        inode->i_blocks         = 0;
-        inode->i_version        = vnode->fid.unique;
+        inode->i_generation     = vnode->fid.unique;
+        inode->i_version        = vnode->status.data_version;
        inode->i_mapping->a_ops = &afs_fs_aops;
        /* check to see whether a symbolic link is really a mountpoint */
@@ -100,7 +101,7 @@ static int afs_iget5_test(struct inode *inode, void *opaque)
        struct afs_iget_data *data = opaque;
        return inode->i_ino == data->fid.vnode &&
-                inode->i_version == data->fid.unique;
+                inode->i_generation == data->fid.unique;
 }
 /*
@@ -122,7 +123,7 @@ static int afs_iget5_set(struct inode *inode, void *opaque)
        struct afs_vnode *vnode = AFS_FS_I(inode);
        inode->i_ino = data->fid.vnode;
-        inode->i_version = data->fid.unique;
+        inode->i_generation = data->fid.unique;
        vnode->fid = data->fid;
        vnode->volume = data->volume;
@@ -380,8 +381,7 @@ int afs_getattr(struct vfsmount *mnt, struct dentry *dentry,
        inode = dentry->d_inode;
-        _enter("{ ino=%lu v=%llu }", inode->i_ino,
+        _enter("{ ino=%lu v=%u }", inode->i_ino, inode->i_generation);
-                (unsigned long long)inode->i_version);
        generic_fillattr(inode, stat);
        return 0;
diff --git a/fs/afs/super.c b/fs/afs/super.c
index fb240e8766d6..356dcf0929e8 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -31,8 +31,8 @@
 static void afs_i_init_once(void *foo);
 static struct dentry *afs_mount(struct file_system_type *fs_type,
                      int flags, const char *dev_name, void *data);
+static void afs_kill_super(struct super_block *sb);
 static struct inode *afs_alloc_inode(struct super_block *sb);
-static void afs_put_super(struct super_block *sb);
 static void afs_destroy_inode(struct inode *inode);
 static int afs_statfs(struct dentry *dentry, struct kstatfs *buf);
@@ -40,7 +40,7 @@ struct file_system_type afs_fs_type = {
        .owner          = THIS_MODULE,
        .name           = "afs",
        .mount          = afs_mount,
-        .kill_sb        = kill_anon_super,
+        .kill_sb        = afs_kill_super,
        .fs_flags       = 0,
 };
@@ -50,7 +50,6 @@ static const struct super_operations afs_super_ops = {
        .drop_inode     = afs_drop_inode,
        .destroy_inode  = afs_destroy_inode,
        .evict_inode    = afs_evict_inode,
-        .put_super      = afs_put_super,
        .show_options   = generic_show_options,
 };
@@ -282,19 +281,25 @@ static int afs_parse_device_name(struct afs_mount_params *params,
 */
 static int afs_test_super(struct super_block *sb, void *data)
 {
-        struct afs_mount_params *params = data;
+        struct afs_super_info *as1 = data;
        struct afs_super_info *as = sb->s_fs_info;
-        return as->volume == params->volume;
+        return as->volume == as1->volume;
+}
+static int afs_set_super(struct super_block *sb, void *data)
+{
+        sb->s_fs_info = data;
+        return set_anon_super(sb, NULL);
 }
 /*
 * fill in the superblock
 */
-static int afs_fill_super(struct super_block *sb, void *data)
+static int afs_fill_super(struct super_block *sb,
+                          struct afs_mount_params *params)
 {
-        struct afs_mount_params *params = data;
+        struct afs_super_info *as = sb->s_fs_info;
-        struct afs_super_info *as = NULL;
        struct afs_fid fid;
        struct dentry *root = NULL;
        struct inode *inode = NULL;
@@ -302,23 +307,13 @@ static int afs_fill_super(struct super_block *sb, void *data)
        _enter("");
-        /* allocate a superblock info record */
-        as = kzalloc(sizeof(struct afs_super_info), GFP_KERNEL);
-        if (!as) {
-                _leave(" = -ENOMEM");
-                return -ENOMEM;
-        }
-        afs_get_volume(params->volume);
-        as->volume = params->volume;
        /* fill in the superblock */
        sb->s_blocksize         = PAGE_CACHE_SIZE;
        sb->s_blocksize_bits    = PAGE_CACHE_SHIFT;
        sb->s_magic             = AFS_FS_MAGIC;
        sb->s_op                = &afs_super_ops;
-        sb->s_fs_info           = as;
        sb->s_bdi               = &as->volume->bdi;
+        strlcpy(sb->s_id, as->volume->vlocation->vldb.name, sizeof(sb->s_id));
        /* allocate the root inode and dentry */
        fid.vid         = as->volume->vid;
@@ -326,7 +321,7 @@ static int afs_fill_super(struct super_block *sb, void *data)
        fid.unique      = 1;
        inode = afs_iget(sb, params->key, &fid, NULL, NULL);
        if (IS_ERR(inode))
-                goto error_inode;
+                return PTR_ERR(inode);
        if (params->autocell)
                set_bit(AFS_VNODE_AUTOCELL, &AFS_FS_I(inode)->flags);
@@ -342,16 +337,8 @@ static int afs_fill_super(struct super_block *sb, void *data)
        _leave(" = 0");
        return 0;
-error_inode:
-        ret = PTR_ERR(inode);
-        inode = NULL;
 error:
        iput(inode);
-        afs_put_volume(as->volume);
-        kfree(as);
-        sb->s_fs_info = NULL;
        _leave(" = %d", ret);
        return ret;
 }
@@ -367,6 +354,7 @@ static struct dentry *afs_mount(struct file_system_type *fs_type,
        struct afs_volume *vol;
        struct key *key;
        char *new_opts = kstrdup(options, GFP_KERNEL);
+        struct afs_super_info *as;
        int ret;
        _enter(",,%s,%p", dev_name, options);
@@ -399,12 +387,22 @@ static struct dentry *afs_mount(struct file_system_type *fs_type,
                ret = PTR_ERR(vol);
                goto error;
        }
-        params.volume = vol;
+        /* allocate a superblock info record */
+        as = kzalloc(sizeof(struct afs_super_info), GFP_KERNEL);
+        if (!as) {
+                ret = -ENOMEM;
+                afs_put_volume(vol);
+                goto error;
+        }
+        as->volume = vol;
        /* allocate a deviceless superblock */
-        sb = sget(fs_type, afs_test_super, set_anon_super, &params);
+        sb = sget(fs_type, afs_test_super, afs_set_super, as);
        if (IS_ERR(sb)) {
                ret = PTR_ERR(sb);
+                afs_put_volume(vol);
+                kfree(as);
                goto error;
        }
@@ -422,16 +420,16 @@ static struct dentry *afs_mount(struct file_system_type *fs_type,
        } else {
                _debug("reuse");
                ASSERTCMP(sb->s_flags, &, MS_ACTIVE);
+                afs_put_volume(vol);
+                kfree(as);
        }
-        afs_put_volume(params.volume);
        afs_put_cell(params.cell);
        kfree(new_opts);
        _leave(" = 0 [%p]", sb);
        return dget(sb->s_root);
 error:
-        afs_put_volume(params.volume);
        afs_put_cell(params.cell);
        key_put(params.key);
        kfree(new_opts);
@@ -439,18 +437,12 @@ error:
        return ERR_PTR(ret);
 }
-/*
+static void afs_kill_super(struct super_block *sb)
- * finish the unmounting process on the superblock
- */
-static void afs_put_super(struct super_block *sb)
 {
        struct afs_super_info *as = sb->s_fs_info;
+        kill_anon_super(sb);
-        _enter("");
        afs_put_volume(as->volume);
+        kfree(as);
-        _leave("");
 }
 /*
diff --git a/fs/afs/write.c b/fs/afs/write.c
index 789b3afb3423..b806285ff853 100644
--- a/fs/afs/write.c
+++ b/fs/afs/write.c
@@ -84,23 +84,21 @@ void afs_put_writeback(struct afs_writeback *wb)
 * partly or wholly fill a page that's under preparation for writing
 */
 static int afs_fill_page(struct afs_vnode *vnode, struct key *key,
-                         loff_t pos, unsigned len, struct page *page)
+                         loff_t pos, struct page *page)
 {
        loff_t i_size;
-        unsigned eof;
        int ret;
+        int len;
-        _enter(",,%llu,%u", (unsigned long long)pos, len);
+        _enter(",,%llu", (unsigned long long)pos);
-        ASSERTCMP(len, <=, PAGE_CACHE_SIZE);
        i_size = i_size_read(&vnode->vfs_inode);
-        if (pos + len > i_size)
+        if (pos + PAGE_CACHE_SIZE > i_size)
-                eof = i_size;
+                len = i_size - pos;
        else
-                eof = PAGE_CACHE_SIZE;
+                len = PAGE_CACHE_SIZE;
-        ret = afs_vnode_fetch_data(vnode, key, 0, eof, page);
+        ret = afs_vnode_fetch_data(vnode, key, pos, len, page);
        if (ret < 0) {
                if (ret == -ENOENT) {
                        _debug("got NOENT from server"
@@ -153,9 +151,8 @@ int afs_write_begin(struct file *file, struct address_space *mapping,
        *pagep = page;
        /* page won't leak in error case: it eventually gets cleaned off LRU */
-        if (!PageUptodate(page)) {
+        if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) {
-                _debug("not up to date");
+                ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page);
-                ret = afs_fill_page(vnode, key, pos, len, page);
                if (ret < 0) {
                        kfree(candidate);
                        _leave(" = %d [prep]", ret);
diff --git a/fs/bad_inode.c b/fs/bad_inode.c
index 9ad2369d9e35..bfcb18feb1df 100644
--- a/fs/bad_inode.c
+++ b/fs/bad_inode.c
@@ -231,9 +231,6 @@ static int bad_inode_readlink(struct dentry *dentry, char __user *buffer,
 static int bad_inode_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        return -EIO;
 }
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 378b5b4443f3..300628795fdb 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -967,6 +967,12 @@ struct btrfs_fs_info {
        struct srcu_struct subvol_srcu;
        spinlock_t trans_lock;
+        /*
+         * the reloc mutex goes with the trans lock, it is taken
+         * during commit to protect us from the relocation code
+         */
+        struct mutex reloc_mutex;
        struct list_head trans_list;
        struct list_head hashers;
        struct list_head dead_roots;
@@ -1172,6 +1178,14 @@ struct btrfs_root {
        u32 type;
        u64 highest_objectid;
+        /* btrfs_record_root_in_trans is a multi-step process,
+         * and it can race with the balancing code.   But the
+         * race is very small, and only the first time the root
+         * is added to each transaction.  So in_trans_setup
+         * is used to tell us when more checks are required
+         */
+        unsigned long in_trans_setup;
        int ref_cows;
        int track_dirty;
        int in_radix;
@@ -1181,7 +1195,6 @@ struct btrfs_root {
        struct btrfs_key defrag_max;
        int defrag_running;
        char *name;
-        int in_sysfs;
        /* the dirty list is only used by non-reference counted roots */
        struct list_head dirty_list;
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index 6462c29d2d37..f1cbd028f7b3 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -297,7 +297,6 @@ struct btrfs_delayed_item *btrfs_alloc_delayed_item(u32 data_len)
                item->data_len = data_len;
                item->ins_or_del = 0;
                item->bytes_reserved = 0;
-                item->block_rsv = NULL;
                item->delayed_node = NULL;
                atomic_set(&item->refs, 1);
        }
@@ -593,10 +592,8 @@ static int btrfs_delayed_item_reserve_metadata(struct btrfs_trans_handle *trans,
        num_bytes = btrfs_calc_trans_metadata_size(root, 1);
        ret = btrfs_block_rsv_migrate(src_rsv, dst_rsv, num_bytes);
-        if (!ret) {
+        if (!ret)
                item->bytes_reserved = num_bytes;
-                item->block_rsv = dst_rsv;
-        }
        return ret;
 }
@@ -604,10 +601,13 @@ static int btrfs_delayed_item_reserve_metadata(struct btrfs_trans_handle *trans,
 static void btrfs_delayed_item_release_metadata(struct btrfs_root *root,
                                                struct btrfs_delayed_item *item)
 {
+        struct btrfs_block_rsv *rsv;
        if (!item->bytes_reserved)
                return;
-        btrfs_block_rsv_release(root, item->block_rsv,
+        rsv = &root->fs_info->global_block_rsv;
+        btrfs_block_rsv_release(root, rsv,
                                item->bytes_reserved);
 }
@@ -1014,6 +1014,7 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
        struct btrfs_delayed_root *delayed_root;
        struct btrfs_delayed_node *curr_node, *prev_node;
        struct btrfs_path *path;
+        struct btrfs_block_rsv *block_rsv;
        int ret = 0;
        path = btrfs_alloc_path();
@@ -1021,6 +1022,9 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
                return -ENOMEM;
        path->leave_spinning = 1;
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &root->fs_info->global_block_rsv;
        delayed_root = btrfs_get_delayed_root(root);
        curr_node = btrfs_first_delayed_node(delayed_root);
@@ -1045,6 +1049,7 @@ int btrfs_run_delayed_items(struct btrfs_trans_handle *trans,
        }
        btrfs_free_path(path);
+        trans->block_rsv = block_rsv;
        return ret;
 }
@@ -1052,6 +1057,7 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                                              struct btrfs_delayed_node *node)
 {
        struct btrfs_path *path;
+        struct btrfs_block_rsv *block_rsv;
        int ret;
        path = btrfs_alloc_path();
@@ -1059,6 +1065,9 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                return -ENOMEM;
        path->leave_spinning = 1;
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &node->root->fs_info->global_block_rsv;
        ret = btrfs_insert_delayed_items(trans, path, node->root, node);
        if (!ret)
                ret = btrfs_delete_delayed_items(trans, path, node->root, node);
@@ -1066,6 +1075,7 @@ static int __btrfs_commit_inode_delayed_items(struct btrfs_trans_handle *trans,
                ret = btrfs_update_delayed_inode(trans, node->root, path, node);
        btrfs_free_path(path);
+        trans->block_rsv = block_rsv;
        return ret;
 }
@@ -1116,6 +1126,7 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
        struct btrfs_path *path;
        struct btrfs_delayed_node *delayed_node = NULL;
        struct btrfs_root *root;
+        struct btrfs_block_rsv *block_rsv;
        unsigned long nr = 0;
        int need_requeue = 0;
        int ret;
@@ -1134,6 +1145,9 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
        if (IS_ERR(trans))
                goto free_path;
+        block_rsv = trans->block_rsv;
+        trans->block_rsv = &root->fs_info->global_block_rsv;
        ret = btrfs_insert_delayed_items(trans, path, root, delayed_node);
        if (!ret)
                ret = btrfs_delete_delayed_items(trans, path, root,
@@ -1176,6 +1190,7 @@ static void btrfs_async_run_delayed_node_done(struct btrfs_work *work)
        nr = trans->blocks_used;
+        trans->block_rsv = block_rsv;
        btrfs_end_transaction_dmeta(trans, root);
        __btrfs_btree_balance_dirty(root, nr);
 free_path:
@@ -1222,6 +1237,13 @@ again:
        return 0;
 }
+void btrfs_assert_delayed_root_empty(struct btrfs_root *root)
+{
+        struct btrfs_delayed_root *delayed_root;
+        delayed_root = btrfs_get_delayed_root(root);
+        WARN_ON(btrfs_first_delayed_node(delayed_root));
+}
 void btrfs_balance_delayed_items(struct btrfs_root *root)
 {
        struct btrfs_delayed_root *delayed_root;
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index eb7d240aa648..d1a6a2915c66 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -75,7 +75,6 @@ struct btrfs_delayed_item {
        struct list_head tree_list;     /* used for batch insert/delete items */
        struct list_head readdir_list;  /* used for readdir items */
        u64 bytes_reserved;
-        struct btrfs_block_rsv *block_rsv;
        struct btrfs_delayed_node *delayed_node;
        atomic_t refs;
        int ins_or_del;
@@ -138,4 +137,8 @@ int btrfs_readdir_delayed_dir_index(struct file *filp, void *dirent,
 /* for init */
 int __init btrfs_delayed_inode_init(void);
 void btrfs_delayed_inode_exit(void);
+/* for debugging */
+void btrfs_assert_delayed_root_empty(struct btrfs_root *root);
 #endif
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 9f68c6898653..1ac8db5dc0a3 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1044,7 +1044,6 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
        root->last_trans = 0;
        root->highest_objectid = 0;
        root->name = NULL;
-        root->in_sysfs = 0;
        root->inode_tree = RB_ROOT;
        INIT_RADIX_TREE(&root->delayed_nodes_tree, GFP_ATOMIC);
        root->block_rsv = NULL;
@@ -1300,19 +1299,21 @@ again:
                return root;
        root->free_ino_ctl = kzalloc(sizeof(*root->free_ino_ctl), GFP_NOFS);
-        if (!root->free_ino_ctl)
-                goto fail;
        root->free_ino_pinned = kzalloc(sizeof(*root->free_ino_pinned),
                                        GFP_NOFS);
-        if (!root->free_ino_pinned)
+        if (!root->free_ino_pinned || !root->free_ino_ctl) {
+                ret = -ENOMEM;
                goto fail;
+        }
        btrfs_init_free_ino_ctl(root);
        mutex_init(&root->fs_commit_mutex);
        spin_lock_init(&root->cache_lock);
        init_waitqueue_head(&root->cache_wait);
-        set_anon_super(&root->anon_super, NULL);
+        ret = set_anon_super(&root->anon_super, NULL);
+        if (ret)
+                goto fail;
        if (btrfs_root_refs(&root->root_item) == 0) {
                ret = -ENOENT;
@@ -1618,6 +1619,7 @@ struct btrfs_root *open_ctree(struct super_block *sb,
        spin_lock_init(&fs_info->fs_roots_radix_lock);
        spin_lock_init(&fs_info->delayed_iput_lock);
        spin_lock_init(&fs_info->defrag_inodes_lock);
+        mutex_init(&fs_info->reloc_mutex);
        init_completion(&fs_info->kobj_unregister);
        fs_info->tree_root = tree_root;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index b42efc2ded51..1f61bf5b4960 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3314,10 +3314,6 @@ static int shrink_delalloc(struct btrfs_trans_handle *trans,
        if (reserved == 0)
                return 0;
-        /* nothing to shrink - nothing to reclaim */
-        if (root->fs_info->delalloc_bytes == 0)
-                return 0;
        max_reclaim = min(reserved, to_reclaim);
        while (loops < 1024) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 751ddf8fc58a..0a9b10c5b0a7 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -3076,6 +3076,7 @@ int btrfs_unlink_subvol(struct btrfs_trans_handle *trans,
        ret = btrfs_update_inode(trans, root, dir);
        BUG_ON(ret);
+        btrfs_free_path(path);
        return 0;
 }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index b793d112d1f6..a3c4751e07db 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -482,8 +482,10 @@ static int create_snapshot(struct btrfs_root *root, struct dentry *dentry,
        ret = btrfs_snap_reserve_metadata(trans, pending_snapshot);
        BUG_ON(ret);
+        spin_lock(&root->fs_info->trans_lock);
        list_add(&pending_snapshot->list,
                 &trans->transaction->pending_snapshots);
+        spin_unlock(&root->fs_info->trans_lock);
        if (async_transid) {
                *async_transid = trans->transid;
                ret = btrfs_commit_transaction_async(trans,
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b1ef27cc673b..5e0a3dc79a45 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1368,7 +1368,7 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
        int ret;
        if (!root->reloc_root)
-                return 0;
+                goto out;
        reloc_root = root->reloc_root;
        root_item = &reloc_root->root_item;
@@ -1390,6 +1390,8 @@ int btrfs_update_reloc_root(struct btrfs_trans_handle *trans,
        ret = btrfs_update_root(trans, root->fs_info->tree_root,
                                &reloc_root->root_key, root_item);
        BUG_ON(ret);
+out:
        return 0;
 }
@@ -2142,10 +2144,11 @@ int prepare_to_merge(struct reloc_control *rc, int err)
        u64 num_bytes = 0;
        int ret;
-        spin_lock(&root->fs_info->trans_lock);
+        mutex_lock(&root->fs_info->reloc_mutex);
        rc->merging_rsv_size += root->nodesize * (BTRFS_MAX_LEVEL - 1) * 2;
        rc->merging_rsv_size += rc->nodes_relocated * 2;
-        spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
 again:
        if (!err) {
                num_bytes = rc->merging_rsv_size;
@@ -2214,9 +2217,16 @@ int merge_reloc_roots(struct reloc_control *rc)
        int ret;
 again:
        root = rc->extent_root;
-        spin_lock(&root->fs_info->trans_lock);
+        /*
+         * this serializes us with btrfs_record_root_in_transaction,
+         * we have to make sure nobody is in the middle of
+         * adding their roots to the list while we are
+         * doing this splice
+         */
+        mutex_lock(&root->fs_info->reloc_mutex);
        list_splice_init(&rc->reloc_roots, &reloc_roots);
-        spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
        while (!list_empty(&reloc_roots)) {
                found = 1;
@@ -3590,17 +3600,19 @@ next:
 static void set_reloc_control(struct reloc_control *rc)
 {
        struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
-        spin_lock(&fs_info->trans_lock);
+        mutex_lock(&fs_info->reloc_mutex);
        fs_info->reloc_ctl = rc;
-        spin_unlock(&fs_info->trans_lock);
+        mutex_unlock(&fs_info->reloc_mutex);
 }
 static void unset_reloc_control(struct reloc_control *rc)
 {
        struct btrfs_fs_info *fs_info = rc->extent_root->fs_info;
-        spin_lock(&fs_info->trans_lock);
+        mutex_lock(&fs_info->reloc_mutex);
        fs_info->reloc_ctl = NULL;
-        spin_unlock(&fs_info->trans_lock);
+        mutex_unlock(&fs_info->reloc_mutex);
 }
 static int check_extent_flags(u64 flags)
diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c
index c3c223ae6691..daac9ae6d731 100644
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -28,152 +28,6 @@
 #include "disk-io.h"
 #include "transaction.h"
-static ssize_t root_blocks_used_show(struct btrfs_root *root, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_root_used(&root->root_item));
-}
-static ssize_t root_block_limit_show(struct btrfs_root *root, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_root_limit(&root->root_item));
-}
-static ssize_t super_blocks_used_show(struct btrfs_fs_info *fs, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_bytes_used(&fs->super_copy));
-}
-static ssize_t super_total_blocks_show(struct btrfs_fs_info *fs, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_total_bytes(&fs->super_copy));
-}
-static ssize_t super_blocksize_show(struct btrfs_fs_info *fs, char *buf)
-{
-        return snprintf(buf, PAGE_SIZE, "%llu\n",
-                (unsigned long long)btrfs_super_sectorsize(&fs->super_copy));
-}
-/* this is for root attrs (subvols/snapshots) */
-struct btrfs_root_attr {
-        struct attribute attr;
-        ssize_t (*show)(struct btrfs_root *, char *);
-        ssize_t (*store)(struct btrfs_root *, const char *, size_t);
-};
-#define ROOT_ATTR(name, mode, show, store) \
-static struct btrfs_root_attr btrfs_root_attr_##name = __ATTR(name, mode, \
-                                                              show, store)
-ROOT_ATTR(blocks_used,  0444,   root_blocks_used_show,  NULL);
-ROOT_ATTR(block_limit,  0644,   root_block_limit_show,  NULL);
-static struct attribute *btrfs_root_attrs[] = {
-        &btrfs_root_attr_blocks_used.attr,
-        &btrfs_root_attr_block_limit.attr,
-        NULL,
-};
-/* this is for super attrs (actual full fs) */
-struct btrfs_super_attr {
-        struct attribute attr;
-        ssize_t (*show)(struct btrfs_fs_info *, char *);
-        ssize_t (*store)(struct btrfs_fs_info *, const char *, size_t);
-};
-#define SUPER_ATTR(name, mode, show, store) \
-static struct btrfs_super_attr btrfs_super_attr_##name = __ATTR(name, mode, \
-                                                                show, store)
-SUPER_ATTR(blocks_used,         0444,   super_blocks_used_show,         NULL);
-SUPER_ATTR(total_blocks,        0444,   super_total_blocks_show,        NULL);
-SUPER_ATTR(blocksize,           0444,   super_blocksize_show,           NULL);
-static struct attribute *btrfs_super_attrs[] = {
-        &btrfs_super_attr_blocks_used.attr,
-        &btrfs_super_attr_total_blocks.attr,
-        &btrfs_super_attr_blocksize.attr,
-        NULL,
-};
-static ssize_t btrfs_super_attr_show(struct kobject *kobj,
-                                    struct attribute *attr, char *buf)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        struct btrfs_super_attr *a = container_of(attr,
-                                                  struct btrfs_super_attr,
-                                                  attr);
-        return a->show ? a->show(fs, buf) : 0;
-}
-static ssize_t btrfs_super_attr_store(struct kobject *kobj,
-                                     struct attribute *attr,
-                                     const char *buf, size_t len)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        struct btrfs_super_attr *a = container_of(attr,
-                                                  struct btrfs_super_attr,
-                                                  attr);
-        return a->store ? a->store(fs, buf, len) : 0;
-}
-static ssize_t btrfs_root_attr_show(struct kobject *kobj,
-                                    struct attribute *attr, char *buf)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        struct btrfs_root_attr *a = container_of(attr,
-                                                 struct btrfs_root_attr,
-                                                 attr);
-        return a->show ? a->show(root, buf) : 0;
-}
-static ssize_t btrfs_root_attr_store(struct kobject *kobj,
-                                     struct attribute *attr,
-                                     const char *buf, size_t len)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        struct btrfs_root_attr *a = container_of(attr,
-                                                 struct btrfs_root_attr,
-                                                 attr);
-        return a->store ? a->store(root, buf, len) : 0;
-}
-static void btrfs_super_release(struct kobject *kobj)
-{
-        struct btrfs_fs_info *fs = container_of(kobj, struct btrfs_fs_info,
-                                                super_kobj);
-        complete(&fs->kobj_unregister);
-}
-static void btrfs_root_release(struct kobject *kobj)
-{
-        struct btrfs_root *root = container_of(kobj, struct btrfs_root,
-                                                root_kobj);
-        complete(&root->kobj_unregister);
-}
-static const struct sysfs_ops btrfs_super_attr_ops = {
-        .show   = btrfs_super_attr_show,
-        .store  = btrfs_super_attr_store,
-};
-static const struct sysfs_ops btrfs_root_attr_ops = {
-        .show   = btrfs_root_attr_show,
-        .store  = btrfs_root_attr_store,
-};
 /* /sys/fs/btrfs/ entry */
 static struct kset *btrfs_kset;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 2b3590b9fe98..51dcec86757f 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -126,28 +126,85 @@ static noinline int join_transaction(struct btrfs_root *root, int nofail)
 * to make sure the old root from before we joined the transaction is deleted
 * when the transaction commits
 */
-int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
+static int record_root_in_trans(struct btrfs_trans_handle *trans,
                               struct btrfs_root *root)
 {
        if (root->ref_cows && root->last_trans < trans->transid) {
                WARN_ON(root == root->fs_info->extent_root);
                WARN_ON(root->commit_root != root->node);
+                /*
+                 * see below for in_trans_setup usage rules
+                 * we have the reloc mutex held now, so there
+                 * is only one writer in this function
+                 */
+                root->in_trans_setup = 1;
+                /* make sure readers find in_trans_setup before
+                 * they find our root->last_trans update
+                 */
+                smp_wmb();
                spin_lock(&root->fs_info->fs_roots_radix_lock);
                if (root->last_trans == trans->transid) {
                        spin_unlock(&root->fs_info->fs_roots_radix_lock);
                        return 0;
                }
-                root->last_trans = trans->transid;
                radix_tree_tag_set(&root->fs_info->fs_roots_radix,
                           (unsigned long)root->root_key.objectid,
                           BTRFS_ROOT_TRANS_TAG);
                spin_unlock(&root->fs_info->fs_roots_radix_lock);
+                root->last_trans = trans->transid;
+                /* this is pretty tricky.  We don't want to
+                 * take the relocation lock in btrfs_record_root_in_trans
+                 * unless we're really doing the first setup for this root in
+                 * this transaction.
+                 *
+                 * Normally we'd use root->last_trans as a flag to decide
+                 * if we want to take the expensive mutex.
+                 *
+                 * But, we have to set root->last_trans before we
+                 * init the relocation root, otherwise, we trip over warnings
+                 * in ctree.c.  The solution used here is to flag ourselves
+                 * with root->in_trans_setup.  When this is 1, we're still
+                 * fixing up the reloc trees and everyone must wait.
+                 *
+                 * When this is zero, they can trust root->last_trans and fly
+                 * through btrfs_record_root_in_trans without having to take the
+                 * lock.  smp_wmb() makes sure that all the writes above are
+                 * done before we pop in the zero below
+                 */
                btrfs_init_reloc_root(trans, root);
+                smp_wmb();
+                root->in_trans_setup = 0;
        }
        return 0;
 }
+int btrfs_record_root_in_trans(struct btrfs_trans_handle *trans,
+                               struct btrfs_root *root)
+{
+        if (!root->ref_cows)
+                return 0;
+        /*
+         * see record_root_in_trans for comments about in_trans_setup usage
+         * and barriers
+         */
+        smp_rmb();
+        if (root->last_trans == trans->transid &&
+            !root->in_trans_setup)
+                return 0;
+        mutex_lock(&root->fs_info->reloc_mutex);
+        record_root_in_trans(trans, root);
+        mutex_unlock(&root->fs_info->reloc_mutex);
+        return 0;
+}
 /* wait for commit against the current transaction to become unblocked
 * when this is done, it is safe to start a new transaction, but the current
 * transaction might not be fully on disk.
@@ -882,7 +939,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        parent = dget_parent(dentry);
        parent_inode = parent->d_inode;
        parent_root = BTRFS_I(parent_inode)->root;
-        btrfs_record_root_in_trans(trans, parent_root);
+        record_root_in_trans(trans, parent_root);
        /*
         * insert the directory item
@@ -900,7 +957,16 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
        ret = btrfs_update_inode(trans, parent_root, parent_inode);
        BUG_ON(ret);
-        btrfs_record_root_in_trans(trans, root);
+        /*
+         * pull in the delayed directory update
+         * and the delayed inode item
+         * otherwise we corrupt the FS during
+         * snapshot
+         */
+        ret = btrfs_run_delayed_items(trans, root);
+        BUG_ON(ret);
+        record_root_in_trans(trans, root);
        btrfs_set_root_last_snapshot(&root->root_item, trans->transid);
        memcpy(new_root_item, &root->root_item, sizeof(*new_root_item));
        btrfs_check_and_init_root_item(new_root_item);
@@ -961,14 +1027,6 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
        int ret;
        list_for_each_entry(pending, head, list) {
-                /*
-                 * We must deal with the delayed items before creating
-                 * snapshots, or we will create a snapthot with inconsistent
-                 * information.
-                */
-                ret = btrfs_run_delayed_items(trans, fs_info->fs_root);
-                BUG_ON(ret);
                ret = create_pending_snapshot(trans, fs_info, pending);
                BUG_ON(ret);
        }
@@ -1241,21 +1299,42 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
                        schedule_timeout(1);
                finish_wait(&cur_trans->writer_wait, &wait);
-                spin_lock(&root->fs_info->trans_lock);
-                root->fs_info->trans_no_join = 1;
-                spin_unlock(&root->fs_info->trans_lock);
        } while (atomic_read(&cur_trans->num_writers) > 1 ||
                 (should_grow && cur_trans->num_joined != joined));
-        ret = create_pending_snapshots(trans, root->fs_info);
+        /*
-        BUG_ON(ret);
+         * Ok now we need to make sure to block out any other joins while we
+         * commit the transaction.  We could have started a join before setting
+         * no_join so make sure to wait for num_writers to == 1 again.
+         */
+        spin_lock(&root->fs_info->trans_lock);
+        root->fs_info->trans_no_join = 1;
+        spin_unlock(&root->fs_info->trans_lock);
+        wait_event(cur_trans->writer_wait,
+                   atomic_read(&cur_trans->num_writers) == 1);
+        /*
+         * the reloc mutex makes sure that we stop
+         * the balancing code from coming in and moving
+         * extents around in the middle of the commit
+         */
+        mutex_lock(&root->fs_info->reloc_mutex);
        ret = btrfs_run_delayed_items(trans, root);
        BUG_ON(ret);
+        ret = create_pending_snapshots(trans, root->fs_info);
+        BUG_ON(ret);
        ret = btrfs_run_delayed_refs(trans, root, (unsigned long)-1);
        BUG_ON(ret);
+        /*
+         * make sure none of the code above managed to slip in a
+         * delayed item
+         */
+        btrfs_assert_delayed_root_empty(root);
        WARN_ON(cur_trans != trans->transaction);
        btrfs_scrub_pause(root);
@@ -1312,6 +1391,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
        root->fs_info->running_transaction = NULL;
        root->fs_info->trans_no_join = 0;
        spin_unlock(&root->fs_info->trans_lock);
+        mutex_unlock(&root->fs_info->reloc_mutex);
        wake_up(&root->fs_info->transaction_wait);
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 592396c6dc47..4ce8a9f41d1e 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3177,7 +3177,7 @@ again:
                tmp_key.offset = (u64)-1;
                wc.replay_dest = btrfs_read_fs_root_no_name(fs_info, &tmp_key);
-                BUG_ON(!wc.replay_dest);
+                BUG_ON(IS_ERR_OR_NULL(wc.replay_dest));
                wc.replay_dest->log_root = log;
                btrfs_record_root_in_trans(trans, wc.replay_dest);
diff --git a/fs/buffer.c b/fs/buffer.c
index 49c9aada0374..1a80b048ade8 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -1902,10 +1902,8 @@ int __block_write_begin(struct page *page, loff_t pos, unsigned len,
                if (!buffer_uptodate(*wait_bh))
                        err = -EIO;
        }
-        if (unlikely(err)) {
+        if (unlikely(err))
                page_zero_new_buffers(page, from, to);
-                ClearPageUptodate(page);
-        }
        return err;
 }
 EXPORT_SYMBOL(__block_write_begin);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index e9def996e383..2f0c58646c10 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -257,9 +257,6 @@ static int cifs_permission(struct inode *inode, int mask, unsigned int flags)
 {
        struct cifs_sb_info *cifs_sb;
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        cifs_sb = CIFS_SB(inode->i_sb);
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_PERM) {
diff --git a/fs/coda/pioctl.c b/fs/coda/pioctl.c
index 6cbb3afb36dc..cb140ef293e4 100644
--- a/fs/coda/pioctl.c
+++ b/fs/coda/pioctl.c
@@ -43,8 +43,6 @@ const struct file_operations coda_ioctl_operations = {
 /* the coda pioctl inode ops */
 static int coda_ioctl_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        return (mask & MAY_EXEC) ? -EACCES : 0;
 }
diff --git a/fs/exec.c b/fs/exec.c
index 97e0d52d72fd..6075a1e727ae 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1996,7 +1996,7 @@ static void wait_for_dump_helpers(struct file *file)
 * is a special value that we use to trap recursive
 * core dumps
 */
-static int umh_pipe_setup(struct subprocess_info *info)
+static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
 {
        struct file *rp, *wp;
        struct fdtable *fdt;
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 3db5ba4568fc..b3cc8586984e 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -974,7 +974,7 @@ out_no_inode:
 out_no_read:
        printk(KERN_WARNING "%s: bread failed, dev=%s, iso_blknum=%d, block=%d\n",
                __func__, s->s_id, iso_blknum, block);
-        goto out_freesbi;
+        goto out_freebh;
 out_bad_zone_size:
        printk(KERN_WARNING "ISOFS: Bad logical zone size %ld\n",
                sbi->s_log_zone_size);
@@ -989,6 +989,7 @@ out_unknown_format:
 out_freebh:
        brelse(bh);
+        brelse(pri_bh);
 out_freesbi:
        kfree(opt.iocharset);
        kfree(sbi);
diff --git a/fs/logfs/dir.c b/fs/logfs/dir.c
index 9ed89d1663f8..1afae26cf236 100644
--- a/fs/logfs/dir.c
+++ b/fs/logfs/dir.c
@@ -555,13 +555,6 @@ static int logfs_symlink(struct inode *dir, struct dentry *dentry,
        return __logfs_create(dir, dentry, inode, target, destlen);
 }
-static int logfs_permission(struct inode *inode, int mask, unsigned int flags)
-{
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-        return generic_permission(inode, mask, flags, NULL);
-}
 static int logfs_link(struct dentry *old_dentry, struct inode *dir,
                struct dentry *dentry)
 {
@@ -820,7 +813,6 @@ const struct inode_operations logfs_dir_iops = {
        .mknod          = logfs_mknod,
        .rename         = logfs_rename,
        .rmdir          = logfs_rmdir,
-        .permission     = logfs_permission,
        .symlink        = logfs_symlink,
        .unlink         = logfs_unlink,
 };
diff --git a/fs/namei.c b/fs/namei.c
index 9802345df5e7..0223c41fb114 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -238,7 +238,8 @@ int generic_permission(struct inode *inode, int mask, unsigned int flags,
        /*
         * Read/write DACs are always overridable.
-         * Executable DACs are overridable if at least one exec bit is set.
+         * Executable DACs are overridable for all directories and
+         * for non-directories that have least one exec bit set.
         */
        if (!(mask & MAY_EXEC) || execute_ok(inode))
                if (ns_capable(inode_userns(inode), CAP_DAC_OVERRIDE))
@@ -812,6 +813,11 @@ static int follow_automount(struct path *path, unsigned flags,
        if (!mnt) /* mount collision */
                return 0;
+        if (!*need_mntput) {
+                /* lock_mount() may release path->mnt on error */
+                mntget(path->mnt);
+                *need_mntput = true;
+        }
        err = finish_automount(mnt, path);
        switch (err) {
@@ -819,12 +825,9 @@ static int follow_automount(struct path *path, unsigned flags,
                /* Someone else made a mount here whilst we were busy */
                return 0;
        case 0:
-                dput(path->dentry);
+                path_put(path);
-                if (*need_mntput)
-                        mntput(path->mnt);
                path->mnt = mnt;
                path->dentry = dget(mnt->mnt_root);
-                *need_mntput = true;
                return 0;
        default:
                return err;
@@ -844,9 +847,10 @@ static int follow_automount(struct path *path, unsigned flags,
 */
 static int follow_managed(struct path *path, unsigned flags)
 {
+        struct vfsmount *mnt = path->mnt; /* held by caller, must be left alone */
        unsigned managed;
        bool need_mntput = false;
-        int ret;
+        int ret = 0;
        /* Given that we're not holding a lock here, we retain the value in a
         * local variable for each dentry as we look at it so that we don't see
@@ -861,7 +865,7 @@ static int follow_managed(struct path *path, unsigned flags)
                        BUG_ON(!path->dentry->d_op->d_manage);
                        ret = path->dentry->d_op->d_manage(path->dentry, false);
                        if (ret < 0)
-                                return ret == -EISDIR ? 0 : ret;
+                                break;
                }
                /* Transit to a mounted filesystem. */
@@ -887,14 +891,19 @@ static int follow_managed(struct path *path, unsigned flags)
                if (managed & DCACHE_NEED_AUTOMOUNT) {
                        ret = follow_automount(path, flags, &need_mntput);
                        if (ret < 0)
-                                return ret == -EISDIR ? 0 : ret;
+                                break;
                        continue;
                }
                /* We didn't change the current path point */
                break;
        }
-        return 0;
+        if (need_mntput && path->mnt == mnt)
+                mntput(path->mnt);
+        if (ret == -EISDIR)
+                ret = 0;
+        return ret;
 }
 int follow_down_one(struct path *path)
@@ -1003,9 +1012,6 @@ failed:
 * Follow down to the covering mount currently visible to userspace.  At each
 * point, the filesystem owning that dentry may be queried as to whether the
 * caller is permitted to proceed or not.
- *
- * Care must be taken as namespace_sem may be held (indicated by mounting_here
- * being true).
 */
 int follow_down(struct path *path)
 {
@@ -2713,8 +2719,10 @@ static long do_unlinkat(int dfd, const char __user *pathname)
        error = PTR_ERR(dentry);
        if (!IS_ERR(dentry)) {
                /* Why not before? Because we want correct error value */
+                if (nd.last.name[nd.last.len])
+                        goto slashes;
                inode = dentry->d_inode;
-                if (nd.last.name[nd.last.len] || !inode)
+                if (!inode)
                        goto slashes;
                ihold(inode);
                error = mnt_want_write(nd.path.mnt);
diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index 18b3e8975fe0..fbb2a5ef5817 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -82,6 +82,7 @@ config NFSD_V4
        select NFSD_V3
        select FS_POSIX_ACL
        select SUNRPC_GSS
+        select CRYPTO
        help
          This option enables support in your system's NFS server for
          version 4 of the NFS protocol (RFC 3530).
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 1f5eae40f34e..2b1449dd2f49 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -13,6 +13,7 @@
 #include <linux/lockd/lockd.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/gss_api.h>
+#include <linux/sunrpc/gss_krb5_enctypes.h>
 #include "idmap.h"
 #include "nfsd.h"
@@ -189,18 +190,10 @@ static struct file_operations export_features_operations = {
        .release        = single_release,
 };
-#ifdef CONFIG_SUNRPC_GSS
+#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
 static int supported_enctypes_show(struct seq_file *m, void *v)
 {
-        struct gss_api_mech *k5mech;
+        seq_printf(m, KRB5_SUPPORTED_ENCTYPES);
-        k5mech = gss_mech_get_by_name("krb5");
-        if (k5mech == NULL)
-                goto out;
-        if (k5mech->gm_upcall_enctypes != NULL)
-                seq_printf(m, k5mech->gm_upcall_enctypes);
-        gss_mech_put(k5mech);
-out:
        return 0;
 }
@@ -215,7 +208,7 @@ static struct file_operations supported_enctypes_ops = {
        .llseek         = seq_lseek,
        .release        = single_release,
 };
-#endif /* CONFIG_SUNRPC_GSS */
+#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
 extern int nfsd_pool_stats_open(struct inode *inode, struct file *file);
 extern int nfsd_pool_stats_release(struct inode *inode, struct file *file);
@@ -1427,9 +1420,9 @@ static int nfsd_fill_super(struct super_block * sb, void * data, int silent)
                [NFSD_Versions] = {"versions", &transaction_ops, S_IWUSR|S_IRUSR},
                [NFSD_Ports] = {"portlist", &transaction_ops, S_IWUSR|S_IRUGO},
                [NFSD_MaxBlkSize] = {"max_block_size", &transaction_ops, S_IWUSR|S_IRUGO},
-#ifdef CONFIG_SUNRPC_GSS
+#if defined(CONFIG_SUNRPC_GSS) || defined(CONFIG_SUNRPC_GSS_MODULE)
                [NFSD_SupportedEnctypes] = {"supported_krb5_enctypes", &supported_enctypes_ops, S_IRUGO},
-#endif /* CONFIG_SUNRPC_GSS */
+#endif /* CONFIG_SUNRPC_GSS or CONFIG_SUNRPC_GSS_MODULE */
 #ifdef CONFIG_NFSD_V4
                [NFSD_Leasetime] = {"nfsv4leasetime", &transaction_ops, S_IWUSR|S_IRUSR},
                [NFSD_Gracetime] = {"nfsv4gracetime", &transaction_ops, S_IWUSR|S_IRUSR},
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index d5718273bb32..fd0acca5370a 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -696,7 +696,15 @@ nfsd_access(struct svc_rqst *rqstp, struct svc_fh *fhp, u32 *access, u32 *suppor
 }
 #endif /* CONFIG_NFSD_V3 */
+static int nfsd_open_break_lease(struct inode *inode, int access)
+{
+        unsigned int mode;
+        if (access & NFSD_MAY_NOT_BREAK_LEASE)
+                return 0;
+        mode = (access & NFSD_MAY_WRITE) ? O_WRONLY : O_RDONLY;
+        return break_lease(inode, mode | O_NONBLOCK);
+}
 /*
 * Open an existing file or directory.
@@ -744,12 +752,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
        if (!inode->i_fop)
                goto out;
-        /*
+        host_err = nfsd_open_break_lease(inode, access);
-         * Check to see if there are any leases on this file.
-         * This may block while leases are broken.
-         */
-        if (!(access & NFSD_MAY_NOT_BREAK_LEASE))
-                host_err = break_lease(inode, O_NONBLOCK | ((access & NFSD_MAY_WRITE) ? O_WRONLY : 0));
        if (host_err) /* NOMEM or WOULDBLOCK */
                goto out_nfserr;
@@ -1660,8 +1663,10 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp,
        if (!dold->d_inode)
                goto out_drop_write;
        host_err = nfsd_break_lease(dold->d_inode);
-        if (host_err)
+        if (host_err) {
+                err = nfserrno(host_err);
                goto out_drop_write;
+        }
        host_err = vfs_link(dold, dirp, dnew);
        if (!host_err) {
                err = nfserrno(commit_metadata(ffhp));
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index b954878ad6ce..b9b45fc2903e 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -801,12 +801,7 @@ out_err:
 int nilfs_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        struct nilfs_root *root;
+        struct nilfs_root *root = NILFS_I(inode)->i_root;
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-        root = NILFS_I(inode)->i_root;
        if ((mask & MAY_WRITE) && root &&
            root->cno != NILFS_CPTREE_CURRENT_CNO)
                return -EROFS; /* snapshot is not writable */
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 14def991d9dd..8a84210ca080 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2169,11 +2169,7 @@ static const struct file_operations proc_fd_operations = {
 */
 static int proc_fd_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        int rv;
+        int rv = generic_permission(inode, mask, flags, NULL);
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
-        rv = generic_permission(inode, mask, flags, NULL);
        if (rv == 0)
                return 0;
        if (task_pid(current) == proc_pid(inode))
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index 781dec5bd682..be177f702acb 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -38,18 +38,21 @@ static struct dentry *proc_ns_instantiate(struct inode *dir,
        struct inode *inode;
        struct proc_inode *ei;
        struct dentry *error = ERR_PTR(-ENOENT);
+        void *ns;
        inode = proc_pid_make_inode(dir->i_sb, task);
        if (!inode)
                goto out;
+        ns = ns_ops->get(task);
+        if (!ns)
+                goto out_iput;
        ei = PROC_I(inode);
        inode->i_mode = S_IFREG|S_IRUSR;
        inode->i_fop  = &ns_file_operations;
        ei->ns_ops    = ns_ops;
-        ei->ns        = ns_ops->get(task);
+        ei->ns        = ns;
-        if (!ei->ns)
-                goto out_iput;
        dentry->d_op = &pid_dentry_operations;
        d_add(dentry, inode);
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index f50133c11c24..d167de365a8d 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -304,9 +304,6 @@ static int proc_sys_permission(struct inode *inode, int mask,unsigned int flags)
        struct ctl_table *table;
        int error;
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        /* Executable files are not allowed under /proc/sys/ */
        if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))
                return -EACCES;
diff --git a/fs/proc/root.c b/fs/proc/root.c
index a9000e9cfee5..d6c3b416529b 100644
--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -28,11 +28,12 @@ static int proc_test_super(struct super_block *sb, void *data)
 static int proc_set_super(struct super_block *sb, void *data)
 {
-        struct pid_namespace *ns;
+        int err = set_anon_super(sb, NULL);
+        if (!err) {
-        ns = (struct pid_namespace *)data;
+                struct pid_namespace *ns = (struct pid_namespace *)data;
-        sb->s_fs_info = get_pid_ns(ns);
+                sb->s_fs_info = get_pid_ns(ns);
-        return set_anon_super(sb, NULL);
+        }
+        return err;
 }
 static struct dentry *proc_mount(struct file_system_type *fs_type,
diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
index e8a62f41b458..d78089690965 100644
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -954,8 +954,6 @@ static int xattr_mount_check(struct super_block *s)
 int reiserfs_permission(struct inode *inode, int mask, unsigned int flags)
 {
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        /*
         * We don't do permission checks on the internal objects.
         * Permissions are determined by the "owning" object.
diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
index 266895783b47..e34f0d99ea4e 100644
--- a/fs/sysfs/mount.c
+++ b/fs/sysfs/mount.c
@@ -95,6 +95,14 @@ static int sysfs_set_super(struct super_block *sb, void *data)
        return error;
 }
+static void free_sysfs_super_info(struct sysfs_super_info *info)
+{
+        int type;
+        for (type = KOBJ_NS_TYPE_NONE; type < KOBJ_NS_TYPES; type++)
+                kobj_ns_drop(type, info->ns[type]);
+        kfree(info);
+}
 static struct dentry *sysfs_mount(struct file_system_type *fs_type,
        int flags, const char *dev_name, void *data)
 {
@@ -108,11 +116,11 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
                return ERR_PTR(-ENOMEM);
        for (type = KOBJ_NS_TYPE_NONE; type < KOBJ_NS_TYPES; type++)
-                info->ns[type] = kobj_ns_current(type);
+                info->ns[type] = kobj_ns_grab_current(type);
        sb = sget(fs_type, sysfs_test_super, sysfs_set_super, info);
        if (IS_ERR(sb) || sb->s_fs_info != info)
-                kfree(info);
+                free_sysfs_super_info(info);
        if (IS_ERR(sb))
                return ERR_CAST(sb);
        if (!sb->s_root) {
@@ -131,12 +139,11 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
 static void sysfs_kill_sb(struct super_block *sb)
 {
        struct sysfs_super_info *info = sysfs_info(sb);
        /* Remove the superblock from fs_supers/s_instances
         * so we can't find it, before freeing sysfs_super_info.
         */
        kill_anon_super(sb);
-        kfree(info);
+        free_sysfs_super_info(info);
 }
 static struct file_system_type sysfs_fs_type = {
@@ -145,28 +152,6 @@ static struct file_system_type sysfs_fs_type = {
        .kill_sb        = sysfs_kill_sb,
 };
-void sysfs_exit_ns(enum kobj_ns_type type, const void *ns)
-{
-        struct super_block *sb;
-        mutex_lock(&sysfs_mutex);
-        spin_lock(&sb_lock);
-        list_for_each_entry(sb, &sysfs_fs_type.fs_supers, s_instances) {
-                struct sysfs_super_info *info = sysfs_info(sb);
-                /*
-                 * If we see a superblock on the fs_supers/s_instances
-                 * list the unmount has not completed and sb->s_fs_info
-                 * points to a valid struct sysfs_super_info.
-                 */
-                /* Ignore superblocks with the wrong ns */
-                if (info->ns[type] != ns)
-                        continue;
-                info->ns[type] = NULL;
-        }
-        spin_unlock(&sb_lock);
-        mutex_unlock(&sysfs_mutex);
-}
 int __init sysfs_init(void)
 {
        int err = -ENOMEM;
diff --git a/fs/sysfs/sysfs.h b/fs/sysfs/sysfs.h
index 3d28af31d863..2ed2404f3113 100644
--- a/fs/sysfs/sysfs.h
+++ b/fs/sysfs/sysfs.h
@@ -136,7 +136,7 @@ struct sysfs_addrm_cxt {
 * instance).
 */
 struct sysfs_super_info {
-        const void *ns[KOBJ_NS_TYPES];
+        void *ns[KOBJ_NS_TYPES];
 };
 #define sysfs_info(SB) ((struct sysfs_super_info *)(SB->s_fs_info))
 extern struct sysfs_dirent sysfs_root;
diff --git a/fs/timerfd.c b/fs/timerfd.c
index f67acbdda5e8..dffeb3795af1 100644
--- a/fs/timerfd.c
+++ b/fs/timerfd.c
@@ -61,7 +61,9 @@ static enum hrtimer_restart timerfd_tmrproc(struct hrtimer *htmr)
 /*
 * Called when the clock was set to cancel the timers in the cancel
- * list.
+ * list. This will wake up processes waiting on these timers. The
+ * wake-up requires ctx->ticks to be non zero, therefore we increment
+ * it before calling wake_up_locked().
 */
 void timerfd_clock_was_set(void)
 {
@@ -76,6 +78,7 @@ void timerfd_clock_was_set(void)
                spin_lock_irqsave(&ctx->wqh.lock, flags);
                if (ctx->moffs.tv64 != moffs.tv64) {
                        ctx->moffs.tv64 = KTIME_MAX;
+                        ctx->ticks++;
                        wake_up_locked(&ctx->wqh);
                }
                spin_unlock_irqrestore(&ctx->wqh.lock, flags);
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index b5aeb5a8ebed..529be0582029 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -1848,7 +1848,6 @@ static void ubifs_put_super(struct super_block *sb)
        bdi_destroy(&c->bdi);
        ubi_close_volume(c->ubi);
        mutex_unlock(&c->umount_mutex);
-        kfree(c);
 }
 static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
@@ -1971,61 +1970,65 @@ static struct ubi_volume_desc *open_ubi(const char *name, int mode)
        return ERR_PTR(-EINVAL);
 }
-static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
+static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi)
 {
-        struct ubi_volume_desc *ubi = sb->s_fs_info;
        struct ubifs_info *c;
-        struct inode *root;
-        int err;
        c = kzalloc(sizeof(struct ubifs_info), GFP_KERNEL);
-        if (!c)
+        if (c) {
-                return -ENOMEM;
+                spin_lock_init(&c->cnt_lock);
+                spin_lock_init(&c->cs_lock);
+                spin_lock_init(&c->buds_lock);
+                spin_lock_init(&c->space_lock);
+                spin_lock_init(&c->orphan_lock);
+                init_rwsem(&c->commit_sem);
+                mutex_init(&c->lp_mutex);
+                mutex_init(&c->tnc_mutex);
+                mutex_init(&c->log_mutex);
+                mutex_init(&c->mst_mutex);
+                mutex_init(&c->umount_mutex);
+                mutex_init(&c->bu_mutex);
+                mutex_init(&c->write_reserve_mutex);
+                init_waitqueue_head(&c->cmt_wq);
+                c->buds = RB_ROOT;
+                c->old_idx = RB_ROOT;
+                c->size_tree = RB_ROOT;
+                c->orph_tree = RB_ROOT;
+                INIT_LIST_HEAD(&c->infos_list);
+                INIT_LIST_HEAD(&c->idx_gc);
+                INIT_LIST_HEAD(&c->replay_list);
+                INIT_LIST_HEAD(&c->replay_buds);
+                INIT_LIST_HEAD(&c->uncat_list);
+                INIT_LIST_HEAD(&c->empty_list);
+                INIT_LIST_HEAD(&c->freeable_list);
+                INIT_LIST_HEAD(&c->frdi_idx_list);
+                INIT_LIST_HEAD(&c->unclean_leb_list);
+                INIT_LIST_HEAD(&c->old_buds);
+                INIT_LIST_HEAD(&c->orph_list);
+                INIT_LIST_HEAD(&c->orph_new);
+                c->no_chk_data_crc = 1;
+                c->highest_inum = UBIFS_FIRST_INO;
+                c->lhead_lnum = c->ltail_lnum = UBIFS_LOG_LNUM;
+                ubi_get_volume_info(ubi, &c->vi);
+                ubi_get_device_info(c->vi.ubi_num, &c->di);
+        }
+        return c;
+}
-        spin_lock_init(&c->cnt_lock);
+static int ubifs_fill_super(struct super_block *sb, void *data, int silent)
-        spin_lock_init(&c->cs_lock);
+{
-        spin_lock_init(&c->buds_lock);
+        struct ubifs_info *c = sb->s_fs_info;
-        spin_lock_init(&c->space_lock);
+        struct inode *root;
-        spin_lock_init(&c->orphan_lock);
+        int err;
-        init_rwsem(&c->commit_sem);
-        mutex_init(&c->lp_mutex);
-        mutex_init(&c->tnc_mutex);
-        mutex_init(&c->log_mutex);
-        mutex_init(&c->mst_mutex);
-        mutex_init(&c->umount_mutex);
-        mutex_init(&c->bu_mutex);
-        mutex_init(&c->write_reserve_mutex);
-        init_waitqueue_head(&c->cmt_wq);
-        c->buds = RB_ROOT;
-        c->old_idx = RB_ROOT;
-        c->size_tree = RB_ROOT;
-        c->orph_tree = RB_ROOT;
-        INIT_LIST_HEAD(&c->infos_list);
-        INIT_LIST_HEAD(&c->idx_gc);
-        INIT_LIST_HEAD(&c->replay_list);
-        INIT_LIST_HEAD(&c->replay_buds);
-        INIT_LIST_HEAD(&c->uncat_list);
-        INIT_LIST_HEAD(&c->empty_list);
-        INIT_LIST_HEAD(&c->freeable_list);
-        INIT_LIST_HEAD(&c->frdi_idx_list);
-        INIT_LIST_HEAD(&c->unclean_leb_list);
-        INIT_LIST_HEAD(&c->old_buds);
-        INIT_LIST_HEAD(&c->orph_list);
-        INIT_LIST_HEAD(&c->orph_new);
-        c->no_chk_data_crc = 1;
        c->vfs_sb = sb;
-        c->highest_inum = UBIFS_FIRST_INO;
-        c->lhead_lnum = c->ltail_lnum = UBIFS_LOG_LNUM;
-        ubi_get_volume_info(ubi, &c->vi);
-        ubi_get_device_info(c->vi.ubi_num, &c->di);
        /* Re-open the UBI device in read-write mode */
        c->ubi = ubi_open_volume(c->vi.ubi_num, c->vi.vol_id, UBI_READWRITE);
        if (IS_ERR(c->ubi)) {
                err = PTR_ERR(c->ubi);
-                goto out_free;
+                goto out;
        }
        /*
@@ -2091,24 +2094,29 @@ out_bdi:
        bdi_destroy(&c->bdi);
 out_close:
        ubi_close_volume(c->ubi);
-out_free:
+out:
-        kfree(c);
        return err;
 }
 static int sb_test(struct super_block *sb, void *data)
 {
-        dev_t *dev = data;
+        struct ubifs_info *c1 = data;
        struct ubifs_info *c = sb->s_fs_info;
-        return c->vi.cdev == *dev;
+        return c->vi.cdev == c1->vi.cdev;
+}
+static int sb_set(struct super_block *sb, void *data)
+{
+        sb->s_fs_info = data;
+        return set_anon_super(sb, NULL);
 }
 static struct dentry *ubifs_mount(struct file_system_type *fs_type, int flags,
                        const char *name, void *data)
 {
        struct ubi_volume_desc *ubi;
-        struct ubi_volume_info vi;
+        struct ubifs_info *c;
        struct super_block *sb;
        int err;
@@ -2125,19 +2133,25 @@ static struct dentry *ubifs_mount(struct file_system_type *fs_type, int flags,
                        name, (int)PTR_ERR(ubi));
                return ERR_CAST(ubi);
        }
-        ubi_get_volume_info(ubi, &vi);
-        dbg_gen("opened ubi%d_%d", vi.ubi_num, vi.vol_id);
+        c = alloc_ubifs_info(ubi);
+        if (!c) {
+                err = -ENOMEM;
+                goto out_close;
+        }
+        dbg_gen("opened ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
-        sb = sget(fs_type, &sb_test, &set_anon_super, &vi.cdev);
+        sb = sget(fs_type, sb_test, sb_set, c);
        if (IS_ERR(sb)) {
                err = PTR_ERR(sb);
+                kfree(c);
                goto out_close;
        }
        if (sb->s_root) {
                struct ubifs_info *c1 = sb->s_fs_info;
+                kfree(c);
                /* A new mount point for already mounted UBIFS */
                dbg_gen("this ubi volume is already mounted");
                if (!!(flags & MS_RDONLY) != c1->ro_mount) {
@@ -2146,11 +2160,6 @@ static struct dentry *ubifs_mount(struct file_system_type *fs_type, int flags,
                }
        } else {
                sb->s_flags = flags;
-                /*
-                 * Pass 'ubi' to 'fill_super()' in sb->s_fs_info where it is
-                 * replaced by 'c'.
-                 */
-                sb->s_fs_info = ubi;
                err = ubifs_fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
                if (err)
                        goto out_deact;
@@ -2170,11 +2179,18 @@ out_close:
        return ERR_PTR(err);
 }
+static void kill_ubifs_super(struct super_block *s)
+{
+        struct ubifs_info *c = s->s_fs_info;
+        kill_anon_super(s);
+        kfree(c);
+}
 static struct file_system_type ubifs_fs_type = {
        .name    = "ubifs",
        .owner   = THIS_MODULE,
        .mount   = ubifs_mount,
-        .kill_sb = kill_anon_super,
+        .kill_sb = kill_ubifs_super,
 };
 /*
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index f4213ba1ff85..7f782af286bf 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -131,19 +131,34 @@ xfs_file_fsync(
 {
        struct inode            *inode = file->f_mapping->host;
        struct xfs_inode        *ip = XFS_I(inode);
+        struct xfs_mount        *mp = ip->i_mount;
        struct xfs_trans        *tp;
        int                     error = 0;
        int                     log_flushed = 0;
        trace_xfs_file_fsync(ip);
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+        if (XFS_FORCED_SHUTDOWN(mp))
                return -XFS_ERROR(EIO);
        xfs_iflags_clear(ip, XFS_ITRUNCATED);
        xfs_ioend_wait(ip);
+        if (mp->m_flags & XFS_MOUNT_BARRIER) {
+                /*
+                 * If we have an RT and/or log subvolume we need to make sure
+                 * to flush the write cache the device used for file data
+                 * first.  This is to ensure newly written file data make
+                 * it to disk before logging the new inode size in case of
+                 * an extending write.
+                 */
+                if (XFS_IS_REALTIME_INODE(ip))
+                        xfs_blkdev_issue_flush(mp->m_rtdev_targp);
+                else if (mp->m_logdev_targp != mp->m_ddev_targp)
+                        xfs_blkdev_issue_flush(mp->m_ddev_targp);
+        }
        /*
         * We always need to make sure that the required inode state is safe on
         * disk.  The inode might be clean but we still might need to force the
@@ -175,9 +190,9 @@ xfs_file_fsync(
                 * updates.  The sync transaction will also force the log.
                 */
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
-                tp = xfs_trans_alloc(ip->i_mount, XFS_TRANS_FSYNC_TS);
+                tp = xfs_trans_alloc(mp, XFS_TRANS_FSYNC_TS);
                error = xfs_trans_reserve(tp, 0,
-                                XFS_FSYNC_TS_LOG_RES(ip->i_mount), 0, 0, 0);
+                                XFS_FSYNC_TS_LOG_RES(mp), 0, 0, 0);
                if (error) {
                        xfs_trans_cancel(tp, 0);
                        return -error;
@@ -209,28 +224,25 @@ xfs_file_fsync(
                 * force the log.
                 */
                if (xfs_ipincount(ip)) {
-                        error = _xfs_log_force_lsn(ip->i_mount,
+                        error = _xfs_log_force_lsn(mp,
                                        ip->i_itemp->ili_last_lsn,
                                        XFS_LOG_SYNC, &log_flushed);
                }
                xfs_iunlock(ip, XFS_ILOCK_SHARED);
        }
-        if (ip->i_mount->m_flags & XFS_MOUNT_BARRIER) {
+        /*
-                /*
+         * If we only have a single device, and the log force about was
-                 * If the log write didn't issue an ordered tag we need
+         * a no-op we might have to flush the data device cache here.
-                 * to flush the disk cache for the data device now.
+         * This can only happen for fdatasync/O_DSYNC if we were overwriting
-                 */
+         * an already allocated file and thus do not have any metadata to
-                if (!log_flushed)
+         * commit.
-                        xfs_blkdev_issue_flush(ip->i_mount->m_ddev_targp);
+         */
+        if ((mp->m_flags & XFS_MOUNT_BARRIER) &&
-                /*
+            mp->m_logdev_targp == mp->m_ddev_targp &&
-                 * If this inode is on the RT dev we need to flush that
+            !XFS_IS_REALTIME_INODE(ip) &&
-                 * cache as well.
+            !log_flushed)
-                 */
+                xfs_blkdev_issue_flush(mp->m_ddev_targp);
-                if (XFS_IS_REALTIME_INODE(ip))
-                        xfs_blkdev_issue_flush(ip->i_mount->m_rtdev_targp);
-        }
        return -error;
 }
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index dd21784525a8..d44d92cd12b1 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -182,7 +182,7 @@ xfs_vn_mknod(
        if (IS_POSIXACL(dir)) {
                default_acl = xfs_get_acl(dir, ACL_TYPE_DEFAULT);
                if (IS_ERR(default_acl))
-                        return -PTR_ERR(default_acl);
+                        return PTR_ERR(default_acl);
                if (!default_acl)
                        mode &= ~current_umask();
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 1e3a7ce804dc..a1a881e68a9a 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -627,68 +627,6 @@ xfs_blkdev_put(
                blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
 }
-/*
- * Try to write out the superblock using barriers.
- */
-STATIC int
-xfs_barrier_test(
-        xfs_mount_t     *mp)
-{
-        xfs_buf_t       *sbp = xfs_getsb(mp, 0);
-        int             error;
-        XFS_BUF_UNDONE(sbp);
-        XFS_BUF_UNREAD(sbp);
-        XFS_BUF_UNDELAYWRITE(sbp);
-        XFS_BUF_WRITE(sbp);
-        XFS_BUF_UNASYNC(sbp);
-        XFS_BUF_ORDERED(sbp);
-        xfsbdstrat(mp, sbp);
-        error = xfs_buf_iowait(sbp);
-        /*
-         * Clear all the flags we set and possible error state in the
-         * buffer.  We only did the write to try out whether barriers
-         * worked and shouldn't leave any traces in the superblock
-         * buffer.
-         */
-        XFS_BUF_DONE(sbp);
-        XFS_BUF_ERROR(sbp, 0);
-        XFS_BUF_UNORDERED(sbp);
-        xfs_buf_relse(sbp);
-        return error;
-}
-STATIC void
-xfs_mountfs_check_barriers(xfs_mount_t *mp)
-{
-        int error;
-        if (mp->m_logdev_targp != mp->m_ddev_targp) {
-                xfs_notice(mp,
-                  "Disabling barriers, not supported with external log device");
-                mp->m_flags &= ~XFS_MOUNT_BARRIER;
-                return;
-        }
-        if (xfs_readonly_buftarg(mp->m_ddev_targp)) {
-                xfs_notice(mp,
-                        "Disabling barriers, underlying device is readonly");
-                mp->m_flags &= ~XFS_MOUNT_BARRIER;
-                return;
-        }
-        error = xfs_barrier_test(mp);
-        if (error) {
-                xfs_notice(mp,
-                        "Disabling barriers, trial barrier write failed");
-                mp->m_flags &= ~XFS_MOUNT_BARRIER;
-                return;
-        }
-}
 void
 xfs_blkdev_issue_flush(
        xfs_buftarg_t           *buftarg)
@@ -1240,14 +1178,6 @@ xfs_fs_remount(
                switch (token) {
                case Opt_barrier:
                        mp->m_flags |= XFS_MOUNT_BARRIER;
-                        /*
-                         * Test if barriers are actually working if we can,
-                         * else delay this check until the filesystem is
-                         * marked writeable.
-                         */
-                        if (!(mp->m_flags & XFS_MOUNT_RDONLY))
-                                xfs_mountfs_check_barriers(mp);
                        break;
                case Opt_nobarrier:
                        mp->m_flags &= ~XFS_MOUNT_BARRIER;
@@ -1282,8 +1212,6 @@ xfs_fs_remount(
        /* ro -> rw */
        if ((mp->m_flags & XFS_MOUNT_RDONLY) && !(*flags & MS_RDONLY)) {
                mp->m_flags &= ~XFS_MOUNT_RDONLY;
-                if (mp->m_flags & XFS_MOUNT_BARRIER)
-                        xfs_mountfs_check_barriers(mp);
                /*
                 * If this is the first remount to writeable state we
@@ -1465,9 +1393,6 @@ xfs_fs_fill_super(
        if (error)
                goto out_free_sb;
-        if (mp->m_flags & XFS_MOUNT_BARRIER)
-                xfs_mountfs_check_barriers(mp);
        error = xfs_filestream_mount(mp);
        if (error)
                goto out_free_sb;
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index 211930246f20..41d5b8f2bf92 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -1372,8 +1372,17 @@ xlog_sync(xlog_t		*log,
        XFS_BUF_ASYNC(bp);
        bp->b_flags |= XBF_LOG_BUFFER;
-        if (log->l_mp->m_flags & XFS_MOUNT_BARRIER)
+        if (log->l_mp->m_flags & XFS_MOUNT_BARRIER) {
+                /*
+                 * If we have an external log device, flush the data device
+                 * before flushing the log to make sure all meta data
+                 * written back from the AIL actually made it to disk
+                 * before writing out the new log tail LSN in the log buffer.
+                 */
+                if (log->l_mp->m_logdev_targp != log->l_mp->m_ddev_targp)
+                        xfs_blkdev_issue_flush(log->l_mp->m_ddev_targp);
                XFS_BUF_ORDERED(bp);
+        }
        ASSERT(XFS_BUF_ADDR(bp) <= log->l_logBBsize-1);
        ASSERT(XFS_BUF_ADDR(bp) + BTOBB(count) <= log->l_logBBsize);
diff --git a/include/asm-generic/gpio.h b/include/asm-generic/gpio.h
index fcdcb5d5c995..d494001b1226 100644
--- a/include/asm-generic/gpio.h
+++ b/include/asm-generic/gpio.h
@@ -170,16 +170,6 @@ extern int __gpio_cansleep(unsigned gpio);
 extern int __gpio_to_irq(unsigned gpio);
-#define GPIOF_DIR_OUT   (0 << 0)
-#define GPIOF_DIR_IN    (1 << 0)
-#define GPIOF_INIT_LOW  (0 << 1)
-#define GPIOF_INIT_HIGH (1 << 1)
-#define GPIOF_IN                (GPIOF_DIR_IN)
-#define GPIOF_OUT_INIT_LOW      (GPIOF_DIR_OUT | GPIOF_INIT_LOW)
-#define GPIOF_OUT_INIT_HIGH     (GPIOF_DIR_OUT | GPIOF_INIT_HIGH)
 /**
 * struct gpio - a structure describing a GPIO with configuration
 * @gpio:       the GPIO number
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 9573e0ce3120..33d12f87f0e0 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -520,6 +520,8 @@ struct drm_connector {
        uint32_t encoder_ids[DRM_CONNECTOR_MAX_ENCODER];
        uint32_t force_encoder_id;
        struct drm_encoder *encoder; /* currently active encoder */
+        int null_edid_counter; /* needed to workaround some HW bugs where we get all 0s */
 };
 /**
diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h
index d4646b48dc4a..18a1baf31f2d 100644
--- a/include/linux/clocksource.h
+++ b/include/linux/clocksource.h
@@ -188,6 +188,7 @@ struct clocksource {
 #ifdef CONFIG_CLOCKSOURCE_WATCHDOG
        /* Watchdog related data, used by the framework */
        struct list_head wd_list;
+        cycle_t cs_last;
        cycle_t wd_last;
 #endif
 } ____cacheline_aligned;
diff --git a/include/linux/device_cgroup.h b/include/linux/device_cgroup.h
index 0b0d9c39ed67..7aad1f440867 100644
--- a/include/linux/device_cgroup.h
+++ b/include/linux/device_cgroup.h
@@ -2,8 +2,16 @@
 #include <linux/fs.h>
 #ifdef CONFIG_CGROUP_DEVICE
-extern int devcgroup_inode_permission(struct inode *inode, int mask);
+extern int __devcgroup_inode_permission(struct inode *inode, int mask);
 extern int devcgroup_inode_mknod(int mode, dev_t dev);
+static inline int devcgroup_inode_permission(struct inode *inode, int mask)
+{
+        if (likely(!inode->i_rdev))
+                return 0;
+        if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
+                return 0;
+        return __devcgroup_inode_permission(inode, mask);
+}
 #else
 static inline int devcgroup_inode_permission(struct inode *inode, int mask)
 { return 0; }
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 1c777878f1ea..6e73e2e9ae33 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -744,7 +744,7 @@ struct inode {
        spinlock_t              i_lock; /* i_blocks, i_bytes, maybe i_size */
        unsigned int            i_flags;
-        unsigned int            i_state;
+        unsigned long           i_state;
 #ifdef CONFIG_SECURITY
        void                    *i_security;
 #endif
diff --git a/include/linux/gpio.h b/include/linux/gpio.h
index 32d47e710661..17b5a0d80e42 100644
--- a/include/linux/gpio.h
+++ b/include/linux/gpio.h
@@ -3,6 +3,17 @@
 /* see Documentation/gpio.txt */
+/* make these flag values available regardless of GPIO kconfig options */
+#define GPIOF_DIR_OUT   (0 << 0)
+#define GPIOF_DIR_IN    (1 << 0)
+#define GPIOF_INIT_LOW  (0 << 1)
+#define GPIOF_INIT_HIGH (1 << 1)
+#define GPIOF_IN                (GPIOF_DIR_IN)
+#define GPIOF_OUT_INIT_LOW      (GPIOF_DIR_OUT | GPIOF_INIT_LOW)
+#define GPIOF_OUT_INIT_HIGH     (GPIOF_DIR_OUT | GPIOF_INIT_HIGH)
 #ifdef CONFIG_GENERIC_GPIO
 #include <asm/gpio.h>
diff --git a/include/linux/input/sh_keysc.h b/include/linux/input/sh_keysc.h
index 649dc7f12925..5d253cd93691 100644
--- a/include/linux/input/sh_keysc.h
+++ b/include/linux/input/sh_keysc.h
@@ -1,7 +1,7 @@
 #ifndef __SH_KEYSC_H__
 #define __SH_KEYSC_H__
-#define SH_KEYSC_MAXKEYS 49
+#define SH_KEYSC_MAXKEYS 64
 struct sh_keysc_info {
        enum { SH_KEYSC_MODE_1, SH_KEYSC_MODE_2, SH_KEYSC_MODE_3,
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 6c12989839d9..f6efed0039ed 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -414,6 +414,7 @@ enum
        TASKLET_SOFTIRQ,
        SCHED_SOFTIRQ,
        HRTIMER_SOFTIRQ,
+        RCU_SOFTIRQ,    /* Preferable RCU should always be the last softirq */
        NR_SOFTIRQS
 };
diff --git a/include/linux/kmod.h b/include/linux/kmod.h
index d4a5c84c503d..0da38cf7db7b 100644
--- a/include/linux/kmod.h
+++ b/include/linux/kmod.h
@@ -45,7 +45,7 @@ static inline int request_module_nowait(const char *name, ...) { return -ENOSYS;
 #endif
-struct key;
+struct cred;
 struct file;
 enum umh_wait {
@@ -62,7 +62,7 @@ struct subprocess_info {
        char **envp;
        enum umh_wait wait;
        int retval;
-        int (*init)(struct subprocess_info *info);
+        int (*init)(struct subprocess_info *info, struct cred *new);
        void (*cleanup)(struct subprocess_info *info);
        void *data;
 };
@@ -73,7 +73,7 @@ struct subprocess_info *call_usermodehelper_setup(char *path, char **argv,
 /* Set various pieces of state into the subprocess_info structure */
 void call_usermodehelper_setfns(struct subprocess_info *info,
-                    int (*init)(struct subprocess_info *info),
+                    int (*init)(struct subprocess_info *info, struct cred *new),
                    void (*cleanup)(struct subprocess_info *info),
                    void *data);
@@ -87,7 +87,7 @@ void call_usermodehelper_freeinfo(struct subprocess_info *info);
 static inline int
 call_usermodehelper_fns(char *path, char **argv, char **envp,
                        enum umh_wait wait,
-                        int (*init)(struct subprocess_info *info),
+                        int (*init)(struct subprocess_info *info, struct cred *new),
                        void (*cleanup)(struct subprocess_info *), void *data)
 {
        struct subprocess_info *info;
diff --git a/include/linux/kobject_ns.h b/include/linux/kobject_ns.h
index 82cb5bf461fb..f66b065a8b5f 100644
--- a/include/linux/kobject_ns.h
+++ b/include/linux/kobject_ns.h
@@ -32,15 +32,17 @@ enum kobj_ns_type {
 /*
 * Callbacks so sysfs can determine namespaces
- *   @current_ns: return calling task's namespace
+ *   @grab_current_ns: return a new reference to calling task's namespace
 *   @netlink_ns: return namespace to which a sock belongs (right?)
 *   @initial_ns: return the initial namespace (i.e. init_net_ns)
+ *   @drop_ns: drops a reference to namespace
 */
 struct kobj_ns_type_operations {
        enum kobj_ns_type type;
-        const void *(*current_ns)(void);
+        void *(*grab_current_ns)(void);
        const void *(*netlink_ns)(struct sock *sk);
        const void *(*initial_ns)(void);
+        void (*drop_ns)(void *);
 };
 int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
@@ -48,9 +50,9 @@ int kobj_ns_type_registered(enum kobj_ns_type type);
 const struct kobj_ns_type_operations *kobj_child_ns_ops(struct kobject *parent);
 const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj);
-const void *kobj_ns_current(enum kobj_ns_type type);
+void *kobj_ns_grab_current(enum kobj_ns_type type);
 const void *kobj_ns_netlink(enum kobj_ns_type type, struct sock *sk);
 const void *kobj_ns_initial(enum kobj_ns_type type);
-void kobj_ns_exit(enum kobj_ns_type type, const void *ns);
+void kobj_ns_drop(enum kobj_ns_type type, void *ns);
 #endif /* _LINUX_KOBJECT_NS_H */
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 7ad824d510a2..8cc38d3bab0c 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -85,12 +85,15 @@ int smp_call_function_any(const struct cpumask *mask,
 * Generic and arch helpers
 */
 #ifdef CONFIG_USE_GENERIC_SMP_HELPERS
+void __init call_function_init(void);
 void generic_smp_call_function_single_interrupt(void);
 void generic_smp_call_function_interrupt(void);
 void ipi_call_lock(void);
 void ipi_call_unlock(void);
 void ipi_call_lock_irq(void);
 void ipi_call_unlock_irq(void);
+#else
+static inline void call_function_init(void) { }
 #endif
 /*
@@ -134,7 +137,7 @@ static inline void smp_send_reschedule(int cpu) { }
 #define smp_prepare_boot_cpu()                  do {} while (0)
 #define smp_call_function_many(mask, func, info, wait) \
                        (up_smp_call_function(func, info))
-static inline void init_call_single_data(void) { }
+static inline void call_function_init(void) { }
 static inline int
 smp_call_function_any(const struct cpumask *mask, smp_call_func_t func,
diff --git a/include/linux/sunrpc/gss_krb5_enctypes.h b/include/linux/sunrpc/gss_krb5_enctypes.h
new file mode 100644
index 000000000000..ec6234eee89c
--- /dev/null
+++ b/include/linux/sunrpc/gss_krb5_enctypes.h
@@ -0,0 +1,4 @@
+/*
+ * Dumb way to share this static piece of information with nfsd
+ */
+#define KRB5_SUPPORTED_ENCTYPES "18,17,16,23,3,1,2"
diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
index c3acda60eee0..e2696d76a599 100644
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -177,9 +177,6 @@ struct sysfs_dirent *sysfs_get_dirent(struct sysfs_dirent *parent_sd,
 struct sysfs_dirent *sysfs_get(struct sysfs_dirent *sd);
 void sysfs_put(struct sysfs_dirent *sd);
-/* Called to clear a ns tag when it is no longer valid */
-void sysfs_exit_ns(enum kobj_ns_type type, const void *tag);
 int __must_check sysfs_init(void);
 #else /* CONFIG_SYSFS */
@@ -338,10 +335,6 @@ static inline void sysfs_put(struct sysfs_dirent *sd)
 {
 }
-static inline void sysfs_exit_ns(int type, const void *tag)
-{
-}
 static inline int __must_check sysfs_init(void)
 {
        return 0;
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 2bf9ed9ef26b..aef430d779bd 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -35,8 +35,11 @@ struct netns_ipvs;
 #define NETDEV_HASHENTRIES (1 << NETDEV_HASHBITS)
 struct net {
+        atomic_t                passive;        /* To decided when the network
+                                                 * namespace should be freed.
+                                                 */
        atomic_t                count;          /* To decided when the network
-                                                 *  namespace should be freed.
+                                                 *  namespace should be shut down.
                                                 */
 #ifdef NETNS_REFCNT_DEBUG
        atomic_t                use_count;      /* To track references we
@@ -154,6 +157,9 @@ int net_eq(const struct net *net1, const struct net *net2)
 {
        return net1 == net2;
 }
+extern void net_drop_ns(void *);
 #else
 static inline struct net *get_net(struct net *net)
@@ -175,6 +181,8 @@ int net_eq(const struct net *net1, const struct net *net2)
 {
        return 1;
 }
+#define net_drop_ns NULL
 #endif
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index c7c42e7acc31..5d4f8e586e32 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -307,6 +307,12 @@ static inline int nf_ct_is_untracked(const struct nf_conn *ct)
        return test_bit(IPS_UNTRACKED_BIT, &ct->status);
 }
+/* Packet is received from loopback */
+static inline bool nf_is_loopback_packet(const struct sk_buff *skb)
+{
+        return skb->dev && skb->skb_iif && skb->dev->flags & IFF_LOOPBACK;
+}
 extern int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp);
 extern unsigned int nf_conntrack_htable_size;
 extern unsigned int nf_conntrack_max;
diff --git a/include/trace/events/irq.h b/include/trace/events/irq.h
index ae045ca7d356..1c09820df585 100644
--- a/include/trace/events/irq.h
+++ b/include/trace/events/irq.h
@@ -20,7 +20,8 @@ struct softirq_action;
                         softirq_name(BLOCK_IOPOLL),    \
                         softirq_name(TASKLET),         \
                         softirq_name(SCHED),           \
-                         softirq_name(HRTIMER))
+                         softirq_name(HRTIMER),         \
+                         softirq_name(RCU))
 /**
 * irq_handler_entry - called immediately before the irq action handler
diff --git a/init/main.c b/init/main.c
index cafba67c13bf..d7211faed2ad 100644
--- a/init/main.c
+++ b/init/main.c
@@ -542,6 +542,7 @@ asmlinkage void __init start_kernel(void)
        timekeeping_init();
        time_init();
        profile_init();
+        call_function_init();
        if (!irqs_disabled())
                printk(KERN_CRIT "start_kernel(): bug: interrupts were "
                                 "enabled early\n");
diff --git a/kernel/kmod.c b/kernel/kmod.c
index ad6a81c58b44..47613dfb7b28 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -156,12 +156,6 @@ static int ____call_usermodehelper(void *data)
         */
        set_user_nice(current, 0);
-        if (sub_info->init) {
-                retval = sub_info->init(sub_info);
-                if (retval)
-                        goto fail;
-        }
        retval = -ENOMEM;
        new = prepare_kernel_cred(current);
        if (!new)
@@ -173,6 +167,14 @@ static int ____call_usermodehelper(void *data)
                                             new->cap_inheritable);
        spin_unlock(&umh_sysctl_lock);
+        if (sub_info->init) {
+                retval = sub_info->init(sub_info, new);
+                if (retval) {
+                        abort_creds(new);
+                        goto fail;
+                }
+        }
        commit_creds(new);
        retval = kernel_execve(sub_info->path,
@@ -388,7 +390,7 @@ EXPORT_SYMBOL(call_usermodehelper_setup);
 * context in which call_usermodehelper_exec is called.
 */
 void call_usermodehelper_setfns(struct subprocess_info *info,
-                    int (*init)(struct subprocess_info *info),
+                    int (*init)(struct subprocess_info *info, struct cred *new),
                    void (*cleanup)(struct subprocess_info *info),
                    void *data)
 {
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 89419ff92e99..7e59ffb3d0ba 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -87,6 +87,8 @@ static struct rcu_state *rcu_state;
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+#ifdef CONFIG_RCU_BOOST
 /*
 * Control variables for per-CPU and per-rcu_node kthreads.  These
 * handle all flavors of RCU.
@@ -98,8 +100,11 @@ DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
 DEFINE_PER_CPU(char, rcu_cpu_has_work);
 static char rcu_kthreads_spawnable;
+#endif /* #ifdef CONFIG_RCU_BOOST */
 static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu);
-static void invoke_rcu_cpu_kthread(void);
+static void invoke_rcu_core(void);
+static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp);
 #define RCU_KTHREAD_PRIO 1      /* RT priority for per-CPU kthreads. */
@@ -1088,14 +1093,8 @@ static void __rcu_offline_cpu(int cpu, struct rcu_state *rsp)
        int need_report = 0;
        struct rcu_data *rdp = per_cpu_ptr(rsp->rda, cpu);
        struct rcu_node *rnp;
-        struct task_struct *t;
-        /* Stop the CPU's kthread. */
+        rcu_stop_cpu_kthread(cpu);
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t != NULL) {
-                per_cpu(rcu_cpu_kthread_task, cpu) = NULL;
-                kthread_stop(t);
-        }
        /* Exclude any attempts to start a new grace period. */
        raw_spin_lock_irqsave(&rsp->onofflock, flags);
@@ -1231,7 +1230,7 @@ static void rcu_do_batch(struct rcu_state *rsp, struct rcu_data *rdp)
        /* Re-raise the RCU softirq if there are callbacks remaining. */
        if (cpu_has_callbacks_ready_to_invoke(rdp))
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
 }
 /*
@@ -1277,7 +1276,7 @@ void rcu_check_callbacks(int cpu, int user)
        }
        rcu_preempt_check_callbacks(cpu);
        if (rcu_pending(cpu))
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
 }
 #ifdef CONFIG_SMP
@@ -1442,13 +1441,14 @@ __rcu_process_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
        }
        /* If there are callbacks ready, invoke them. */
-        rcu_do_batch(rsp, rdp);
+        if (cpu_has_callbacks_ready_to_invoke(rdp))
+                invoke_rcu_callbacks(rsp, rdp);
 }
 /*
 * Do softirq processing for the current CPU.
 */
-static void rcu_process_callbacks(void)
+static void rcu_process_callbacks(struct softirq_action *unused)
 {
        __rcu_process_callbacks(&rcu_sched_state,
                                &__get_cpu_var(rcu_sched_data));
@@ -1465,342 +1465,20 @@ static void rcu_process_callbacks(void)
 * the current CPU with interrupts disabled, the rcu_cpu_kthread_task
 * cannot disappear out from under us.
 */
-static void invoke_rcu_cpu_kthread(void)
+static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
-{
-        unsigned long flags;
-        local_irq_save(flags);
-        __this_cpu_write(rcu_cpu_has_work, 1);
-        if (__this_cpu_read(rcu_cpu_kthread_task) == NULL) {
-                local_irq_restore(flags);
-                return;
-        }
-        wake_up_process(__this_cpu_read(rcu_cpu_kthread_task));
-        local_irq_restore(flags);
-}
-/*
- * Wake up the specified per-rcu_node-structure kthread.
- * Because the per-rcu_node kthreads are immortal, we don't need
- * to do anything to keep them alive.
- */
-static void invoke_rcu_node_kthread(struct rcu_node *rnp)
-{
-        struct task_struct *t;
-        t = rnp->node_kthread_task;
-        if (t != NULL)
-                wake_up_process(t);
-}
-/*
- * Set the specified CPU's kthread to run RT or not, as specified by
- * the to_rt argument.  The CPU-hotplug locks are held, so the task
- * is not going away.
- */
-static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
-{
-        int policy;
-        struct sched_param sp;
-        struct task_struct *t;
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t == NULL)
-                return;
-        if (to_rt) {
-                policy = SCHED_FIFO;
-                sp.sched_priority = RCU_KTHREAD_PRIO;
-        } else {
-                policy = SCHED_NORMAL;
-                sp.sched_priority = 0;
-        }
-        sched_setscheduler_nocheck(t, policy, &sp);
-}
-/*
- * Timer handler to initiate the waking up of per-CPU kthreads that
- * have yielded the CPU due to excess numbers of RCU callbacks.
- * We wake up the per-rcu_node kthread, which in turn will wake up
- * the booster kthread.
- */
-static void rcu_cpu_kthread_timer(unsigned long arg)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, arg);
-        struct rcu_node *rnp = rdp->mynode;
-        atomic_or(rdp->grpmask, &rnp->wakemask);
-        invoke_rcu_node_kthread(rnp);
-}
-/*
- * Drop to non-real-time priority and yield, but only after posting a
- * timer that will cause us to regain our real-time priority if we
- * remain preempted.  Either way, we restore our real-time priority
- * before returning.
- */
-static void rcu_yield(void (*f)(unsigned long), unsigned long arg)
-{
-        struct sched_param sp;
-        struct timer_list yield_timer;
-        setup_timer_on_stack(&yield_timer, f, arg);
-        mod_timer(&yield_timer, jiffies + 2);
-        sp.sched_priority = 0;
-        sched_setscheduler_nocheck(current, SCHED_NORMAL, &sp);
-        set_user_nice(current, 19);
-        schedule();
-        sp.sched_priority = RCU_KTHREAD_PRIO;
-        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
-        del_timer(&yield_timer);
-}
-/*
- * Handle cases where the rcu_cpu_kthread() ends up on the wrong CPU.
- * This can happen while the corresponding CPU is either coming online
- * or going offline.  We cannot wait until the CPU is fully online
- * before starting the kthread, because the various notifier functions
- * can wait for RCU grace periods.  So we park rcu_cpu_kthread() until
- * the corresponding CPU is online.
- *
- * Return 1 if the kthread needs to stop, 0 otherwise.
- *
- * Caller must disable bh.  This function can momentarily enable it.
- */
-static int rcu_cpu_kthread_should_stop(int cpu)
-{
-        while (cpu_is_offline(cpu) ||
-               !cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)) ||
-               smp_processor_id() != cpu) {
-                if (kthread_should_stop())
-                        return 1;
-                per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
-                per_cpu(rcu_cpu_kthread_cpu, cpu) = raw_smp_processor_id();
-                local_bh_enable();
-                schedule_timeout_uninterruptible(1);
-                if (!cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)))
-                        set_cpus_allowed_ptr(current, cpumask_of(cpu));
-                local_bh_disable();
-        }
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        return 0;
-}
-/*
- * Per-CPU kernel thread that invokes RCU callbacks.  This replaces the
- * earlier RCU softirq.
- */
-static int rcu_cpu_kthread(void *arg)
-{
-        int cpu = (int)(long)arg;
-        unsigned long flags;
-        int spincnt = 0;
-        unsigned int *statusp = &per_cpu(rcu_cpu_kthread_status, cpu);
-        char work;
-        char *workp = &per_cpu(rcu_cpu_has_work, cpu);
-        for (;;) {
-                *statusp = RCU_KTHREAD_WAITING;
-                rcu_wait(*workp != 0 || kthread_should_stop());
-                local_bh_disable();
-                if (rcu_cpu_kthread_should_stop(cpu)) {
-                        local_bh_enable();
-                        break;
-                }
-                *statusp = RCU_KTHREAD_RUNNING;
-                per_cpu(rcu_cpu_kthread_loops, cpu)++;
-                local_irq_save(flags);
-                work = *workp;
-                *workp = 0;
-                local_irq_restore(flags);
-                if (work)
-                        rcu_process_callbacks();
-                local_bh_enable();
-                if (*workp != 0)
-                        spincnt++;
-                else
-                        spincnt = 0;
-                if (spincnt > 10) {
-                        *statusp = RCU_KTHREAD_YIELDING;
-                        rcu_yield(rcu_cpu_kthread_timer, (unsigned long)cpu);
-                        spincnt = 0;
-                }
-        }
-        *statusp = RCU_KTHREAD_STOPPED;
-        return 0;
-}
-/*
- * Spawn a per-CPU kthread, setting up affinity and priority.
- * Because the CPU hotplug lock is held, no other CPU will be attempting
- * to manipulate rcu_cpu_kthread_task.  There might be another CPU
- * attempting to access it during boot, but the locking in kthread_bind()
- * will enforce sufficient ordering.
- */
-static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
 {
-        struct sched_param sp;
+        if (likely(!rsp->boost)) {
-        struct task_struct *t;
+                rcu_do_batch(rsp, rdp);
-        if (!rcu_kthreads_spawnable ||
-            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
-                return 0;
-        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
-        if (IS_ERR(t))
-                return PTR_ERR(t);
-        kthread_bind(t, cpu);
-        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
-        WARN_ON_ONCE(per_cpu(rcu_cpu_kthread_task, cpu) != NULL);
-        per_cpu(rcu_cpu_kthread_task, cpu) = t;
-        sp.sched_priority = RCU_KTHREAD_PRIO;
-        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-        return 0;
-}
-/*
- * Per-rcu_node kthread, which is in charge of waking up the per-CPU
- * kthreads when needed.  We ignore requests to wake up kthreads
- * for offline CPUs, which is OK because force_quiescent_state()
- * takes care of this case.
- */
-static int rcu_node_kthread(void *arg)
-{
-        int cpu;
-        unsigned long flags;
-        unsigned long mask;
-        struct rcu_node *rnp = (struct rcu_node *)arg;
-        struct sched_param sp;
-        struct task_struct *t;
-        for (;;) {
-                rnp->node_kthread_status = RCU_KTHREAD_WAITING;
-                rcu_wait(atomic_read(&rnp->wakemask) != 0);
-                rnp->node_kthread_status = RCU_KTHREAD_RUNNING;
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                mask = atomic_xchg(&rnp->wakemask, 0);
-                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1) {
-                        if ((mask & 0x1) == 0)
-                                continue;
-                        preempt_disable();
-                        t = per_cpu(rcu_cpu_kthread_task, cpu);
-                        if (!cpu_online(cpu) || t == NULL) {
-                                preempt_enable();
-                                continue;
-                        }
-                        per_cpu(rcu_cpu_has_work, cpu) = 1;
-                        sp.sched_priority = RCU_KTHREAD_PRIO;
-                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-                        preempt_enable();
-                }
-        }
-        /* NOTREACHED */
-        rnp->node_kthread_status = RCU_KTHREAD_STOPPED;
-        return 0;
-}
-/*
- * Set the per-rcu_node kthread's affinity to cover all CPUs that are
- * served by the rcu_node in question.  The CPU hotplug lock is still
- * held, so the value of rnp->qsmaskinit will be stable.
- *
- * We don't include outgoingcpu in the affinity set, use -1 if there is
- * no outgoing CPU.  If there are no CPUs left in the affinity set,
- * this function allows the kthread to execute on any CPU.
- */
-static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
-{
-        cpumask_var_t cm;
-        int cpu;
-        unsigned long mask = rnp->qsmaskinit;
-        if (rnp->node_kthread_task == NULL)
-                return;
-        if (!alloc_cpumask_var(&cm, GFP_KERNEL))
                return;
-        cpumask_clear(cm);
-        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
-                if ((mask & 0x1) && cpu != outgoingcpu)
-                        cpumask_set_cpu(cpu, cm);
-        if (cpumask_weight(cm) == 0) {
-                cpumask_setall(cm);
-                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++)
-                        cpumask_clear_cpu(cpu, cm);
-                WARN_ON_ONCE(cpumask_weight(cm) == 0);
        }
-        set_cpus_allowed_ptr(rnp->node_kthread_task, cm);
+        invoke_rcu_callbacks_kthread();
-        rcu_boost_kthread_setaffinity(rnp, cm);
-        free_cpumask_var(cm);
 }
-/*
+static void invoke_rcu_core(void)
- * Spawn a per-rcu_node kthread, setting priority and affinity.
- * Called during boot before online/offline can happen, or, if
- * during runtime, with the main CPU-hotplug locks held.  So only
- * one of these can be executing at a time.
- */
-static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
-                                                struct rcu_node *rnp)
 {
-        unsigned long flags;
+        raise_softirq(RCU_SOFTIRQ);
-        int rnp_index = rnp - &rsp->node[0];
-        struct sched_param sp;
-        struct task_struct *t;
-        if (!rcu_kthreads_spawnable ||
-            rnp->qsmaskinit == 0)
-                return 0;
-        if (rnp->node_kthread_task == NULL) {
-                t = kthread_create(rcu_node_kthread, (void *)rnp,
-                                   "rcun%d", rnp_index);
-                if (IS_ERR(t))
-                        return PTR_ERR(t);
-                raw_spin_lock_irqsave(&rnp->lock, flags);
-                rnp->node_kthread_task = t;
-                raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                sp.sched_priority = 99;
-                sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
-        }
-        return rcu_spawn_one_boost_kthread(rsp, rnp, rnp_index);
 }
-static void rcu_wake_one_boost_kthread(struct rcu_node *rnp);
-/*
- * Spawn all kthreads -- called as soon as the scheduler is running.
- */
-static int __init rcu_spawn_kthreads(void)
-{
-        int cpu;
-        struct rcu_node *rnp;
-        struct task_struct *t;
-        rcu_kthreads_spawnable = 1;
-        for_each_possible_cpu(cpu) {
-                per_cpu(rcu_cpu_has_work, cpu) = 0;
-                if (cpu_online(cpu)) {
-                        (void)rcu_spawn_one_cpu_kthread(cpu);
-                        t = per_cpu(rcu_cpu_kthread_task, cpu);
-                        if (t)
-                                wake_up_process(t);
-                }
-        }
-        rnp = rcu_get_root(rcu_state);
-        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-        if (rnp->node_kthread_task)
-                wake_up_process(rnp->node_kthread_task);
-        if (NUM_RCU_NODES > 1) {
-                rcu_for_each_leaf_node(rcu_state, rnp) {
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-                        t = rnp->node_kthread_task;
-                        if (t)
-                                wake_up_process(t);
-                        rcu_wake_one_boost_kthread(rnp);
-                }
-        }
-        return 0;
-}
-early_initcall(rcu_spawn_kthreads);
 static void
 __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
           struct rcu_state *rsp)
@@ -2207,44 +1885,6 @@ static void __cpuinit rcu_prepare_cpu(int cpu)
        rcu_preempt_init_percpu_data(cpu);
 }
-static void __cpuinit rcu_prepare_kthreads(int cpu)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
-        struct rcu_node *rnp = rdp->mynode;
-        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
-        if (rcu_kthreads_spawnable) {
-                (void)rcu_spawn_one_cpu_kthread(cpu);
-                if (rnp->node_kthread_task == NULL)
-                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
-        }
-}
-/*
- * kthread_create() creates threads in TASK_UNINTERRUPTIBLE state,
- * but the RCU threads are woken on demand, and if demand is low this
- * could be a while triggering the hung task watchdog.
- *
- * In order to avoid this, poke all tasks once the CPU is fully
- * up and running.
- */
-static void __cpuinit rcu_online_kthreads(int cpu)
-{
-        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
-        struct rcu_node *rnp = rdp->mynode;
-        struct task_struct *t;
-        t = per_cpu(rcu_cpu_kthread_task, cpu);
-        if (t)
-                wake_up_process(t);
-        t = rnp->node_kthread_task;
-        if (t)
-                wake_up_process(t);
-        rcu_wake_one_boost_kthread(rnp);
-}
 /*
 * Handle CPU online/offline notification events.
 */
@@ -2262,7 +1902,6 @@ static int __cpuinit rcu_cpu_notify(struct notifier_block *self,
                rcu_prepare_kthreads(cpu);
                break;
        case CPU_ONLINE:
-                rcu_online_kthreads(cpu);
        case CPU_DOWN_FAILED:
                rcu_node_kthread_setaffinity(rnp, -1);
                rcu_cpu_kthread_setrt(cpu, 1);
@@ -2410,6 +2049,7 @@ void __init rcu_init(void)
        rcu_init_one(&rcu_sched_state, &rcu_sched_data);
        rcu_init_one(&rcu_bh_state, &rcu_bh_data);
        __rcu_init_preempt();
+         open_softirq(RCU_SOFTIRQ, rcu_process_callbacks);
        /*
         * We don't need protection against CPU-hotplug here because
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 7b9a08b4aaea..01b2ccda26fb 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -369,6 +369,7 @@ struct rcu_state {
                                                /*  period because */
                                                /*  force_quiescent_state() */
                                                /*  was running. */
+        u8      boost;                          /* Subject to priority boost. */
        unsigned long gpnum;                    /* Current gp number. */
        unsigned long completed;                /* # of last completed gp. */
@@ -426,6 +427,7 @@ static int rcu_preempt_blocked_readers_cgp(struct rcu_node *rnp);
 #ifdef CONFIG_HOTPLUG_CPU
 static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp,
                                      unsigned long flags);
+static void rcu_stop_cpu_kthread(int cpu);
 #endif /* #ifdef CONFIG_HOTPLUG_CPU */
 static void rcu_print_detail_task_stall(struct rcu_state *rsp);
 static void rcu_print_task_stall(struct rcu_node *rnp);
@@ -450,11 +452,19 @@ static void rcu_preempt_send_cbs_to_online(void);
 static void __init __rcu_init_preempt(void);
 static void rcu_needs_cpu_flush(void);
 static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags);
+static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
+static void invoke_rcu_callbacks_kthread(void);
+#ifdef CONFIG_RCU_BOOST
+static void rcu_preempt_do_callbacks(void);
 static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
                                          cpumask_var_t cm);
-static void rcu_preempt_boost_start_gp(struct rcu_node *rnp);
 static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
                                                 struct rcu_node *rnp,
                                                 int rnp_index);
+static void invoke_rcu_node_kthread(struct rcu_node *rnp);
+static void rcu_yield(void (*f)(unsigned long), unsigned long arg);
+#endif /* #ifdef CONFIG_RCU_BOOST */
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt);
+static void __cpuinit rcu_prepare_kthreads(int cpu);
 #endif /* #ifndef RCU_TREE_NONCORE */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index c8bff3099a89..14dc7dd00902 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -602,6 +602,15 @@ static void rcu_preempt_process_callbacks(void)
                                &__get_cpu_var(rcu_preempt_data));
 }
+#ifdef CONFIG_RCU_BOOST
+static void rcu_preempt_do_callbacks(void)
+{
+        rcu_do_batch(&rcu_preempt_state, &__get_cpu_var(rcu_preempt_data));
+}
+#endif /* #ifdef CONFIG_RCU_BOOST */
 /*
 * Queue a preemptible-RCU callback for invocation after a grace period.
 */
@@ -1249,6 +1258,23 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
 }
 /*
+ * Wake up the per-CPU kthread to invoke RCU callbacks.
+ */
+static void invoke_rcu_callbacks_kthread(void)
+{
+        unsigned long flags;
+        local_irq_save(flags);
+        __this_cpu_write(rcu_cpu_has_work, 1);
+        if (__this_cpu_read(rcu_cpu_kthread_task) == NULL) {
+                local_irq_restore(flags);
+                return;
+        }
+        wake_up_process(__this_cpu_read(rcu_cpu_kthread_task));
+        local_irq_restore(flags);
+}
+/*
 * Set the affinity of the boost kthread.  The CPU-hotplug locks are
 * held, so no one should be messing with the existence of the boost
 * kthread.
@@ -1288,6 +1314,7 @@ static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
        if (&rcu_preempt_state != rsp)
                return 0;
+        rsp->boost = 1;
        if (rnp->boost_kthread_task != NULL)
                return 0;
        t = kthread_create(rcu_boost_kthread, (void *)rnp,
@@ -1299,13 +1326,372 @@ static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
        sp.sched_priority = RCU_KTHREAD_PRIO;
        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+        wake_up_process(t); /* get to TASK_INTERRUPTIBLE quickly. */
        return 0;
 }
-static void __cpuinit rcu_wake_one_boost_kthread(struct rcu_node *rnp)
+#ifdef CONFIG_HOTPLUG_CPU
+/*
+ * Stop the RCU's per-CPU kthread when its CPU goes offline,.
+ */
+static void rcu_stop_cpu_kthread(int cpu)
 {
-        if (rnp->boost_kthread_task)
+        struct task_struct *t;
-                wake_up_process(rnp->boost_kthread_task);
+        /* Stop the CPU's kthread. */
+        t = per_cpu(rcu_cpu_kthread_task, cpu);
+        if (t != NULL) {
+                per_cpu(rcu_cpu_kthread_task, cpu) = NULL;
+                kthread_stop(t);
+        }
+}
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_kthread_do_work(void)
+{
+        rcu_do_batch(&rcu_sched_state, &__get_cpu_var(rcu_sched_data));
+        rcu_do_batch(&rcu_bh_state, &__get_cpu_var(rcu_bh_data));
+        rcu_preempt_do_callbacks();
+}
+/*
+ * Wake up the specified per-rcu_node-structure kthread.
+ * Because the per-rcu_node kthreads are immortal, we don't need
+ * to do anything to keep them alive.
+ */
+static void invoke_rcu_node_kthread(struct rcu_node *rnp)
+{
+        struct task_struct *t;
+        t = rnp->node_kthread_task;
+        if (t != NULL)
+                wake_up_process(t);
+}
+/*
+ * Set the specified CPU's kthread to run RT or not, as specified by
+ * the to_rt argument.  The CPU-hotplug locks are held, so the task
+ * is not going away.
+ */
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
+{
+        int policy;
+        struct sched_param sp;
+        struct task_struct *t;
+        t = per_cpu(rcu_cpu_kthread_task, cpu);
+        if (t == NULL)
+                return;
+        if (to_rt) {
+                policy = SCHED_FIFO;
+                sp.sched_priority = RCU_KTHREAD_PRIO;
+        } else {
+                policy = SCHED_NORMAL;
+                sp.sched_priority = 0;
+        }
+        sched_setscheduler_nocheck(t, policy, &sp);
+}
+/*
+ * Timer handler to initiate the waking up of per-CPU kthreads that
+ * have yielded the CPU due to excess numbers of RCU callbacks.
+ * We wake up the per-rcu_node kthread, which in turn will wake up
+ * the booster kthread.
+ */
+static void rcu_cpu_kthread_timer(unsigned long arg)
+{
+        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, arg);
+        struct rcu_node *rnp = rdp->mynode;
+        atomic_or(rdp->grpmask, &rnp->wakemask);
+        invoke_rcu_node_kthread(rnp);
+}
+/*
+ * Drop to non-real-time priority and yield, but only after posting a
+ * timer that will cause us to regain our real-time priority if we
+ * remain preempted.  Either way, we restore our real-time priority
+ * before returning.
+ */
+static void rcu_yield(void (*f)(unsigned long), unsigned long arg)
+{
+        struct sched_param sp;
+        struct timer_list yield_timer;
+        setup_timer_on_stack(&yield_timer, f, arg);
+        mod_timer(&yield_timer, jiffies + 2);
+        sp.sched_priority = 0;
+        sched_setscheduler_nocheck(current, SCHED_NORMAL, &sp);
+        set_user_nice(current, 19);
+        schedule();
+        sp.sched_priority = RCU_KTHREAD_PRIO;
+        sched_setscheduler_nocheck(current, SCHED_FIFO, &sp);
+        del_timer(&yield_timer);
+}
+/*
+ * Handle cases where the rcu_cpu_kthread() ends up on the wrong CPU.
+ * This can happen while the corresponding CPU is either coming online
+ * or going offline.  We cannot wait until the CPU is fully online
+ * before starting the kthread, because the various notifier functions
+ * can wait for RCU grace periods.  So we park rcu_cpu_kthread() until
+ * the corresponding CPU is online.
+ *
+ * Return 1 if the kthread needs to stop, 0 otherwise.
+ *
+ * Caller must disable bh.  This function can momentarily enable it.
+ */
+static int rcu_cpu_kthread_should_stop(int cpu)
+{
+        while (cpu_is_offline(cpu) ||
+               !cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)) ||
+               smp_processor_id() != cpu) {
+                if (kthread_should_stop())
+                        return 1;
+                per_cpu(rcu_cpu_kthread_status, cpu) = RCU_KTHREAD_OFFCPU;
+                per_cpu(rcu_cpu_kthread_cpu, cpu) = raw_smp_processor_id();
+                local_bh_enable();
+                schedule_timeout_uninterruptible(1);
+                if (!cpumask_equal(&current->cpus_allowed, cpumask_of(cpu)))
+                        set_cpus_allowed_ptr(current, cpumask_of(cpu));
+                local_bh_disable();
+        }
+        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
+        return 0;
+}
+/*
+ * Per-CPU kernel thread that invokes RCU callbacks.  This replaces the
+ * earlier RCU softirq.
+ */
+static int rcu_cpu_kthread(void *arg)
+{
+        int cpu = (int)(long)arg;
+        unsigned long flags;
+        int spincnt = 0;
+        unsigned int *statusp = &per_cpu(rcu_cpu_kthread_status, cpu);
+        char work;
+        char *workp = &per_cpu(rcu_cpu_has_work, cpu);
+        for (;;) {
+                *statusp = RCU_KTHREAD_WAITING;
+                rcu_wait(*workp != 0 || kthread_should_stop());
+                local_bh_disable();
+                if (rcu_cpu_kthread_should_stop(cpu)) {
+                        local_bh_enable();
+                        break;
+                }
+                *statusp = RCU_KTHREAD_RUNNING;
+                per_cpu(rcu_cpu_kthread_loops, cpu)++;
+                local_irq_save(flags);
+                work = *workp;
+                *workp = 0;
+                local_irq_restore(flags);
+                if (work)
+                        rcu_kthread_do_work();
+                local_bh_enable();
+                if (*workp != 0)
+                        spincnt++;
+                else
+                        spincnt = 0;
+                if (spincnt > 10) {
+                        *statusp = RCU_KTHREAD_YIELDING;
+                        rcu_yield(rcu_cpu_kthread_timer, (unsigned long)cpu);
+                        spincnt = 0;
+                }
+        }
+        *statusp = RCU_KTHREAD_STOPPED;
+        return 0;
+}
+/*
+ * Spawn a per-CPU kthread, setting up affinity and priority.
+ * Because the CPU hotplug lock is held, no other CPU will be attempting
+ * to manipulate rcu_cpu_kthread_task.  There might be another CPU
+ * attempting to access it during boot, but the locking in kthread_bind()
+ * will enforce sufficient ordering.
+ *
+ * Please note that we cannot simply refuse to wake up the per-CPU
+ * kthread because kthreads are created in TASK_UNINTERRUPTIBLE state,
+ * which can result in softlockup complaints if the task ends up being
+ * idle for more than a couple of minutes.
+ *
+ * However, please note also that we cannot bind the per-CPU kthread to its
+ * CPU until that CPU is fully online.  We also cannot wait until the
+ * CPU is fully online before we create its per-CPU kthread, as this would
+ * deadlock the system when CPU notifiers tried waiting for grace
+ * periods.  So we bind the per-CPU kthread to its CPU only if the CPU
+ * is online.  If its CPU is not yet fully online, then the code in
+ * rcu_cpu_kthread() will wait until it is fully online, and then do
+ * the binding.
+ */
+static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
+{
+        struct sched_param sp;
+        struct task_struct *t;
+        if (!rcu_kthreads_spawnable ||
+            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
+                return 0;
+        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
+        if (IS_ERR(t))
+                return PTR_ERR(t);
+        if (cpu_online(cpu))
+                kthread_bind(t, cpu);
+        per_cpu(rcu_cpu_kthread_cpu, cpu) = cpu;
+        WARN_ON_ONCE(per_cpu(rcu_cpu_kthread_task, cpu) != NULL);
+        sp.sched_priority = RCU_KTHREAD_PRIO;
+        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+        per_cpu(rcu_cpu_kthread_task, cpu) = t;
+        wake_up_process(t); /* Get to TASK_INTERRUPTIBLE quickly. */
+        return 0;
+}
+/*
+ * Per-rcu_node kthread, which is in charge of waking up the per-CPU
+ * kthreads when needed.  We ignore requests to wake up kthreads
+ * for offline CPUs, which is OK because force_quiescent_state()
+ * takes care of this case.
+ */
+static int rcu_node_kthread(void *arg)
+{
+        int cpu;
+        unsigned long flags;
+        unsigned long mask;
+        struct rcu_node *rnp = (struct rcu_node *)arg;
+        struct sched_param sp;
+        struct task_struct *t;
+        for (;;) {
+                rnp->node_kthread_status = RCU_KTHREAD_WAITING;
+                rcu_wait(atomic_read(&rnp->wakemask) != 0);
+                rnp->node_kthread_status = RCU_KTHREAD_RUNNING;
+                raw_spin_lock_irqsave(&rnp->lock, flags);
+                mask = atomic_xchg(&rnp->wakemask, 0);
+                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
+                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1) {
+                        if ((mask & 0x1) == 0)
+                                continue;
+                        preempt_disable();
+                        t = per_cpu(rcu_cpu_kthread_task, cpu);
+                        if (!cpu_online(cpu) || t == NULL) {
+                                preempt_enable();
+                                continue;
+                        }
+                        per_cpu(rcu_cpu_has_work, cpu) = 1;
+                        sp.sched_priority = RCU_KTHREAD_PRIO;
+                        sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+                        preempt_enable();
+                }
+        }
+        /* NOTREACHED */
+        rnp->node_kthread_status = RCU_KTHREAD_STOPPED;
+        return 0;
+}
+/*
+ * Set the per-rcu_node kthread's affinity to cover all CPUs that are
+ * served by the rcu_node in question.  The CPU hotplug lock is still
+ * held, so the value of rnp->qsmaskinit will be stable.
+ *
+ * We don't include outgoingcpu in the affinity set, use -1 if there is
+ * no outgoing CPU.  If there are no CPUs left in the affinity set,
+ * this function allows the kthread to execute on any CPU.
+ */
+static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
+{
+        cpumask_var_t cm;
+        int cpu;
+        unsigned long mask = rnp->qsmaskinit;
+        if (rnp->node_kthread_task == NULL)
+                return;
+        if (!alloc_cpumask_var(&cm, GFP_KERNEL))
+                return;
+        cpumask_clear(cm);
+        for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++, mask >>= 1)
+                if ((mask & 0x1) && cpu != outgoingcpu)
+                        cpumask_set_cpu(cpu, cm);
+        if (cpumask_weight(cm) == 0) {
+                cpumask_setall(cm);
+                for (cpu = rnp->grplo; cpu <= rnp->grphi; cpu++)
+                        cpumask_clear_cpu(cpu, cm);
+                WARN_ON_ONCE(cpumask_weight(cm) == 0);
+        }
+        set_cpus_allowed_ptr(rnp->node_kthread_task, cm);
+        rcu_boost_kthread_setaffinity(rnp, cm);
+        free_cpumask_var(cm);
+}
+/*
+ * Spawn a per-rcu_node kthread, setting priority and affinity.
+ * Called during boot before online/offline can happen, or, if
+ * during runtime, with the main CPU-hotplug locks held.  So only
+ * one of these can be executing at a time.
+ */
+static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
+                                                struct rcu_node *rnp)
+{
+        unsigned long flags;
+        int rnp_index = rnp - &rsp->node[0];
+        struct sched_param sp;
+        struct task_struct *t;
+        if (!rcu_kthreads_spawnable ||
+            rnp->qsmaskinit == 0)
+                return 0;
+        if (rnp->node_kthread_task == NULL) {
+                t = kthread_create(rcu_node_kthread, (void *)rnp,
+                                   "rcun%d", rnp_index);
+                if (IS_ERR(t))
+                        return PTR_ERR(t);
+                raw_spin_lock_irqsave(&rnp->lock, flags);
+                rnp->node_kthread_task = t;
+                raw_spin_unlock_irqrestore(&rnp->lock, flags);
+                sp.sched_priority = 99;
+                sched_setscheduler_nocheck(t, SCHED_FIFO, &sp);
+                wake_up_process(t); /* get to TASK_INTERRUPTIBLE quickly. */
+        }
+        return rcu_spawn_one_boost_kthread(rsp, rnp, rnp_index);
+}
+/*
+ * Spawn all kthreads -- called as soon as the scheduler is running.
+ */
+static int __init rcu_spawn_kthreads(void)
+{
+        int cpu;
+        struct rcu_node *rnp;
+        rcu_kthreads_spawnable = 1;
+        for_each_possible_cpu(cpu) {
+                per_cpu(rcu_cpu_has_work, cpu) = 0;
+                if (cpu_online(cpu))
+                        (void)rcu_spawn_one_cpu_kthread(cpu);
+        }
+        rnp = rcu_get_root(rcu_state);
+        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        if (NUM_RCU_NODES > 1) {
+                rcu_for_each_leaf_node(rcu_state, rnp)
+                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        }
+        return 0;
+}
+early_initcall(rcu_spawn_kthreads);
+static void __cpuinit rcu_prepare_kthreads(int cpu)
+{
+        struct rcu_data *rdp = per_cpu_ptr(rcu_state->rda, cpu);
+        struct rcu_node *rnp = rdp->mynode;
+        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
+        if (rcu_kthreads_spawnable) {
+                (void)rcu_spawn_one_cpu_kthread(cpu);
+                if (rnp->node_kthread_task == NULL)
+                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
+        }
 }
 #else /* #ifdef CONFIG_RCU_BOOST */
@@ -1315,23 +1701,32 @@ static void rcu_initiate_boost(struct rcu_node *rnp, unsigned long flags)
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
 }
-static void rcu_boost_kthread_setaffinity(struct rcu_node *rnp,
+static void invoke_rcu_callbacks_kthread(void)
-                                          cpumask_var_t cm)
 {
+        WARN_ON_ONCE(1);
 }
 static void rcu_preempt_boost_start_gp(struct rcu_node *rnp)
 {
 }
-static int __cpuinit rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
+#ifdef CONFIG_HOTPLUG_CPU
-                                                 struct rcu_node *rnp,
-                                                 int rnp_index)
+static void rcu_stop_cpu_kthread(int cpu)
+{
+}
+#endif /* #ifdef CONFIG_HOTPLUG_CPU */
+static void rcu_node_kthread_setaffinity(struct rcu_node *rnp, int outgoingcpu)
+{
+}
+static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
 {
-        return 0;
 }
-static void __cpuinit rcu_wake_one_boost_kthread(struct rcu_node *rnp)
+static void __cpuinit rcu_prepare_kthreads(int cpu)
 {
 }
@@ -1509,7 +1904,7 @@ static DEFINE_PER_CPU(unsigned long, rcu_dyntick_holdoff);
 *
 * Because it is not legal to invoke rcu_process_callbacks() with irqs
 * disabled, we do one pass of force_quiescent_state(), then do a
- * invoke_rcu_cpu_kthread() to cause rcu_process_callbacks() to be invoked
+ * invoke_rcu_core() to cause rcu_process_callbacks() to be invoked
 * later.  The per-cpu rcu_dyntick_drain variable controls the sequencing.
 */
 int rcu_needs_cpu(int cpu)
@@ -1560,7 +1955,7 @@ int rcu_needs_cpu(int cpu)
        /* If RCU callbacks are still pending, RCU still needs this CPU. */
        if (c)
-                invoke_rcu_cpu_kthread();
+                invoke_rcu_core();
        return c;
 }
diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
index 9678cc3650f5..4e144876dc68 100644
--- a/kernel/rcutree_trace.c
+++ b/kernel/rcutree_trace.c
@@ -46,6 +46,8 @@
 #define RCU_TREE_NONCORE
 #include "rcutree.h"
+#ifdef CONFIG_RCU_BOOST
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_status);
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_cpu);
 DECLARE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
@@ -58,6 +60,8 @@ static char convert_kthread_status(unsigned int kthread_status)
        return "SRWOY"[kthread_status];
 }
+#endif /* #ifdef CONFIG_RCU_BOOST */
 static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
 {
        if (!rdp->beenonline)
@@ -76,7 +80,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                   rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
        seq_printf(m, " of=%lu ri=%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, " ql=%ld qs=%c%c%c%c kt=%d/%c/%d ktl=%x b=%ld",
+        seq_printf(m, " ql=%ld qs=%c%c%c%c",
                   rdp->qlen,
                   ".N"[rdp->nxttail[RCU_NEXT_READY_TAIL] !=
                        rdp->nxttail[RCU_NEXT_TAIL]],
@@ -84,13 +88,16 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
                        rdp->nxttail[RCU_NEXT_READY_TAIL]],
                   ".W"[rdp->nxttail[RCU_DONE_TAIL] !=
                        rdp->nxttail[RCU_WAIT_TAIL]],
-                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]],
+                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]]);
+#ifdef CONFIG_RCU_BOOST
+        seq_printf(m, " kt=%d/%c/%d ktl=%x",
                   per_cpu(rcu_cpu_has_work, rdp->cpu),
                   convert_kthread_status(per_cpu(rcu_cpu_kthread_status,
                                          rdp->cpu)),
                   per_cpu(rcu_cpu_kthread_cpu, rdp->cpu),
-                   per_cpu(rcu_cpu_kthread_loops, rdp->cpu) & 0xffff,
+                   per_cpu(rcu_cpu_kthread_loops, rdp->cpu) & 0xffff);
-                   rdp->blimit);
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_printf(m, " b=%ld", rdp->blimit);
        seq_printf(m, " ci=%lu co=%lu ca=%lu\n",
                   rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
@@ -147,18 +154,21 @@ static void print_one_rcu_data_csv(struct seq_file *m, struct rcu_data *rdp)
                   rdp->dynticks_fqs);
 #endif /* #ifdef CONFIG_NO_HZ */
        seq_printf(m, ",%lu,%lu", rdp->offline_fqs, rdp->resched_ipi);
-        seq_printf(m, ",%ld,\"%c%c%c%c\",%d,\"%c\",%ld", rdp->qlen,
+        seq_printf(m, ",%ld,\"%c%c%c%c\"", rdp->qlen,
                   ".N"[rdp->nxttail[RCU_NEXT_READY_TAIL] !=
                        rdp->nxttail[RCU_NEXT_TAIL]],
                   ".R"[rdp->nxttail[RCU_WAIT_TAIL] !=
                        rdp->nxttail[RCU_NEXT_READY_TAIL]],
                   ".W"[rdp->nxttail[RCU_DONE_TAIL] !=
                        rdp->nxttail[RCU_WAIT_TAIL]],
-                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]],
+                   ".D"[&rdp->nxtlist != rdp->nxttail[RCU_DONE_TAIL]]);
+#ifdef CONFIG_RCU_BOOST
+        seq_printf(m, ",%d,\"%c\"",
                   per_cpu(rcu_cpu_has_work, rdp->cpu),
                   convert_kthread_status(per_cpu(rcu_cpu_kthread_status,
-                                          rdp->cpu)),
+                                          rdp->cpu)));
-                   rdp->blimit);
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_printf(m, ",%ld", rdp->blimit);
        seq_printf(m, ",%lu,%lu,%lu\n",
                   rdp->n_cbs_invoked, rdp->n_cbs_orphaned, rdp->n_cbs_adopted);
 }
@@ -169,7 +179,11 @@ static int show_rcudata_csv(struct seq_file *m, void *unused)
 #ifdef CONFIG_NO_HZ
        seq_puts(m, "\"dt\",\"dt nesting\",\"dt NMI nesting\",\"df\",");
 #endif /* #ifdef CONFIG_NO_HZ */
-        seq_puts(m, "\"of\",\"ri\",\"ql\",\"b\",\"ci\",\"co\",\"ca\"\n");
+        seq_puts(m, "\"of\",\"ri\",\"ql\",\"qs\"");
+#ifdef CONFIG_RCU_BOOST
+        seq_puts(m, "\"kt\",\"ktl\"");
+#endif /* #ifdef CONFIG_RCU_BOOST */
+        seq_puts(m, ",\"b\",\"ci\",\"co\",\"ca\"\n");
 #ifdef CONFIG_TREE_PREEMPT_RCU
        seq_puts(m, "\"rcu_preempt:\"\n");
        PRINT_RCU_DATA(rcu_preempt_data, print_one_rcu_data_csv, m);
diff --git a/kernel/smp.c b/kernel/smp.c
index 73a195193558..fb67dfa8394e 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -74,7 +74,7 @@ static struct notifier_block __cpuinitdata hotplug_cfd_notifier = {
        .notifier_call          = hotplug_cfd,
 };
-static int __cpuinit init_call_single_data(void)
+void __init call_function_init(void)
 {
        void *cpu = (void *)(long)smp_processor_id();
        int i;
@@ -88,10 +88,7 @@ static int __cpuinit init_call_single_data(void)
        hotplug_cfd(&hotplug_cfd_notifier, CPU_UP_PREPARE, cpu);
        register_cpu_notifier(&hotplug_cfd_notifier);
-        return 0;
 }
-early_initcall(init_call_single_data);
 /*
 * csd_lock/csd_unlock used to serialize access to per-cpu csd resources
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 13960170cad4..40cf63ddd4b3 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -58,7 +58,7 @@ DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
 char *softirq_to_name[NR_SOFTIRQS] = {
        "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
-        "TASKLET", "SCHED", "HRTIMER"
+        "TASKLET", "SCHED", "HRTIMER", "RCU"
 };
 /*
diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
index 1c95fd677328..e0980f0d9a0a 100644
--- a/kernel/time/clocksource.c
+++ b/kernel/time/clocksource.c
@@ -185,7 +185,6 @@ static struct clocksource *watchdog;
 static struct timer_list watchdog_timer;
 static DECLARE_WORK(watchdog_work, clocksource_watchdog_work);
 static DEFINE_SPINLOCK(watchdog_lock);
-static cycle_t watchdog_last;
 static int watchdog_running;
 static int clocksource_watchdog_kthread(void *data);
@@ -254,11 +253,6 @@ static void clocksource_watchdog(unsigned long data)
        if (!watchdog_running)
                goto out;
-        wdnow = watchdog->read(watchdog);
-        wd_nsec = clocksource_cyc2ns((wdnow - watchdog_last) & watchdog->mask,
-                                     watchdog->mult, watchdog->shift);
-        watchdog_last = wdnow;
        list_for_each_entry(cs, &watchdog_list, wd_list) {
                /* Clocksource already marked unstable? */
@@ -268,19 +262,28 @@ static void clocksource_watchdog(unsigned long data)
                        continue;
                }
+                local_irq_disable();
                csnow = cs->read(cs);
+                wdnow = watchdog->read(watchdog);
+                local_irq_enable();
                /* Clocksource initialized ? */
                if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) {
                        cs->flags |= CLOCK_SOURCE_WATCHDOG;
-                        cs->wd_last = csnow;
+                        cs->wd_last = wdnow;
+                        cs->cs_last = csnow;
                        continue;
                }
-                /* Check the deviation from the watchdog clocksource. */
+                wd_nsec = clocksource_cyc2ns((wdnow - cs->wd_last) & watchdog->mask,
-                cs_nsec = clocksource_cyc2ns((csnow - cs->wd_last) &
+                                             watchdog->mult, watchdog->shift);
+                cs_nsec = clocksource_cyc2ns((csnow - cs->cs_last) &
                                             cs->mask, cs->mult, cs->shift);
-                cs->wd_last = csnow;
+                cs->cs_last = csnow;
+                cs->wd_last = wdnow;
+                /* Check the deviation from the watchdog clocksource. */
                if (abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD) {
                        clocksource_unstable(cs, cs_nsec - wd_nsec);
                        continue;
@@ -318,7 +321,6 @@ static inline void clocksource_start_watchdog(void)
                return;
        init_timer(&watchdog_timer);
        watchdog_timer.function = clocksource_watchdog;
-        watchdog_last = watchdog->read(watchdog);
        watchdog_timer.expires = jiffies + WATCHDOG_INTERVAL;
        add_timer_on(&watchdog_timer, cpumask_first(cpu_online_mask));
        watchdog_running = 1;
diff --git a/kernel/trace/trace_printk.c b/kernel/trace/trace_printk.c
index dff763b7baf1..1f06468a10d7 100644
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -240,13 +240,10 @@ static const char **find_next(void *v, loff_t *pos)
        const char **fmt = v;
        int start_index;
-        if (!fmt)
-                fmt = __start___trace_bprintk_fmt + *pos;
        start_index = __stop___trace_bprintk_fmt - __start___trace_bprintk_fmt;
        if (*pos < start_index)
-                return fmt;
+                return __start___trace_bprintk_fmt + *pos;
        return find_next_mod_format(start_index, v, fmt, pos);
 }
diff --git a/lib/kobject.c b/lib/kobject.c
index 82dc34c095c2..640bd98a4c8a 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -948,14 +948,14 @@ const struct kobj_ns_type_operations *kobj_ns_ops(struct kobject *kobj)
 }
-const void *kobj_ns_current(enum kobj_ns_type type)
+void *kobj_ns_grab_current(enum kobj_ns_type type)
 {
-        const void *ns = NULL;
+        void *ns = NULL;
        spin_lock(&kobj_ns_type_lock);
        if ((type > KOBJ_NS_TYPE_NONE) && (type < KOBJ_NS_TYPES) &&
            kobj_ns_ops_tbl[type])
-                ns = kobj_ns_ops_tbl[type]->current_ns();
+                ns = kobj_ns_ops_tbl[type]->grab_current_ns();
        spin_unlock(&kobj_ns_type_lock);
        return ns;
@@ -987,23 +987,15 @@ const void *kobj_ns_initial(enum kobj_ns_type type)
        return ns;
 }
-/*
+void kobj_ns_drop(enum kobj_ns_type type, void *ns)
- * kobj_ns_exit - invalidate a namespace tag
- *
- * @type: the namespace type (i.e. KOBJ_NS_TYPE_NET)
- * @ns: the actual namespace being invalidated
- *
- * This is called when a tag is no longer valid.  For instance,
- * when a network namespace exits, it uses this helper to
- * make sure no sb's sysfs_info points to the now-invalidated
- * netns.
- */
-void kobj_ns_exit(enum kobj_ns_type type, const void *ns)
 {
-        sysfs_exit_ns(type, ns);
+        spin_lock(&kobj_ns_type_lock);
+        if ((type > KOBJ_NS_TYPE_NONE) && (type < KOBJ_NS_TYPES) &&
+            kobj_ns_ops_tbl[type] && kobj_ns_ops_tbl[type]->drop_ns)
+                kobj_ns_ops_tbl[type]->drop_ns(ns);
+        spin_unlock(&kobj_ns_type_lock);
 }
 EXPORT_SYMBOL(kobject_get);
 EXPORT_SYMBOL(kobject_put);
 EXPORT_SYMBOL(kobject_del);
diff --git a/mm/migrate.c b/mm/migrate.c
index e4a5c912983d..666e4e677414 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -288,7 +288,7 @@ static int migrate_page_move_mapping(struct address_space *mapping,
         */
        __dec_zone_page_state(page, NR_FILE_PAGES);
        __inc_zone_page_state(newpage, NR_FILE_PAGES);
-        if (PageSwapBacked(page)) {
+        if (!PageSwapCache(page) && PageSwapBacked(page)) {
                __dec_zone_page_state(page, NR_SHMEM);
                __inc_zone_page_state(newpage, NR_SHMEM);
        }
diff --git a/mm/mmap.c b/mm/mmap.c
index bbdc9af5e117..d49736ff8a8d 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -906,14 +906,7 @@ struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *vma)
        if (anon_vma)
                return anon_vma;
 try_prev:
-        /*
+        near = vma->vm_prev;
-         * It is potentially slow to have to call find_vma_prev here.
-         * But it's only on the first write fault on the vma, not
-         * every time, and we could devise a way to avoid it later
-         * (e.g. stash info in next's anon_vma_node when assigning
-         * an anon_vma, or when trying vma_merge).  Another time.
-         */
-        BUG_ON(find_vma_prev(vma->vm_mm, vma->vm_start, &near) != vma);
        if (!near)
                goto none;
@@ -2044,9 +2037,10 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
                return -EINVAL;
        /* Find the first overlapping VMA */
-        vma = find_vma_prev(mm, start, &prev);
+        vma = find_vma(mm, start);
        if (!vma)
                return 0;
+        prev = vma->vm_prev;
        /* we have  start < vma->vm_end  */
        /* if it doesn't overlap, we have nothing.. */
diff --git a/mm/rmap.c b/mm/rmap.c
index 0eb463ea88dd..27dfd3b82b0f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -112,9 +112,9 @@ static inline void anon_vma_free(struct anon_vma *anon_vma)
        kmem_cache_free(anon_vma_cachep, anon_vma);
 }
-static inline struct anon_vma_chain *anon_vma_chain_alloc(void)
+static inline struct anon_vma_chain *anon_vma_chain_alloc(gfp_t gfp)
 {
-        return kmem_cache_alloc(anon_vma_chain_cachep, GFP_KERNEL);
+        return kmem_cache_alloc(anon_vma_chain_cachep, gfp);
 }
 static void anon_vma_chain_free(struct anon_vma_chain *anon_vma_chain)
@@ -159,7 +159,7 @@ int anon_vma_prepare(struct vm_area_struct *vma)
                struct mm_struct *mm = vma->vm_mm;
                struct anon_vma *allocated;
-                avc = anon_vma_chain_alloc();
+                avc = anon_vma_chain_alloc(GFP_KERNEL);
                if (!avc)
                        goto out_enomem;
@@ -200,6 +200,32 @@ int anon_vma_prepare(struct vm_area_struct *vma)
        return -ENOMEM;
 }
+/*
+ * This is a useful helper function for locking the anon_vma root as
+ * we traverse the vma->anon_vma_chain, looping over anon_vma's that
+ * have the same vma.
+ *
+ * Such anon_vma's should have the same root, so you'd expect to see
+ * just a single mutex_lock for the whole traversal.
+ */
+static inline struct anon_vma *lock_anon_vma_root(struct anon_vma *root, struct anon_vma *anon_vma)
+{
+        struct anon_vma *new_root = anon_vma->root;
+        if (new_root != root) {
+                if (WARN_ON_ONCE(root))
+                        mutex_unlock(&root->mutex);
+                root = new_root;
+                mutex_lock(&root->mutex);
+        }
+        return root;
+}
+static inline void unlock_anon_vma_root(struct anon_vma *root)
+{
+        if (root)
+                mutex_unlock(&root->mutex);
+}
 static void anon_vma_chain_link(struct vm_area_struct *vma,
                                struct anon_vma_chain *avc,
                                struct anon_vma *anon_vma)
@@ -208,13 +234,11 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
        avc->anon_vma = anon_vma;
        list_add(&avc->same_vma, &vma->anon_vma_chain);
-        anon_vma_lock(anon_vma);
        /*
         * It's critical to add new vmas to the tail of the anon_vma,
         * see comment in huge_memory.c:__split_huge_page().
         */
        list_add_tail(&avc->same_anon_vma, &anon_vma->head);
-        anon_vma_unlock(anon_vma);
 }
 /*
@@ -224,13 +248,24 @@ static void anon_vma_chain_link(struct vm_area_struct *vma,
 int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
        struct anon_vma_chain *avc, *pavc;
+        struct anon_vma *root = NULL;
        list_for_each_entry_reverse(pavc, &src->anon_vma_chain, same_vma) {
-                avc = anon_vma_chain_alloc();
+                struct anon_vma *anon_vma;
-                if (!avc)
-                        goto enomem_failure;
+                avc = anon_vma_chain_alloc(GFP_NOWAIT | __GFP_NOWARN);
-                anon_vma_chain_link(dst, avc, pavc->anon_vma);
+                if (unlikely(!avc)) {
+                        unlock_anon_vma_root(root);
+                        root = NULL;
+                        avc = anon_vma_chain_alloc(GFP_KERNEL);
+                        if (!avc)
+                                goto enomem_failure;
+                }
+                anon_vma = pavc->anon_vma;
+                root = lock_anon_vma_root(root, anon_vma);
+                anon_vma_chain_link(dst, avc, anon_vma);
        }
+        unlock_anon_vma_root(root);
        return 0;
 enomem_failure:
@@ -263,7 +298,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        anon_vma = anon_vma_alloc();
        if (!anon_vma)
                goto out_error;
-        avc = anon_vma_chain_alloc();
+        avc = anon_vma_chain_alloc(GFP_KERNEL);
        if (!avc)
                goto out_error_free_anon_vma;
@@ -280,7 +315,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        get_anon_vma(anon_vma->root);
        /* Mark this anon_vma as the one where our new (COWed) pages go. */
        vma->anon_vma = anon_vma;
+        anon_vma_lock(anon_vma);
        anon_vma_chain_link(vma, avc, anon_vma);
+        anon_vma_unlock(anon_vma);
        return 0;
@@ -291,36 +328,43 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
        return -ENOMEM;
 }
-static void anon_vma_unlink(struct anon_vma_chain *anon_vma_chain)
-{
-        struct anon_vma *anon_vma = anon_vma_chain->anon_vma;
-        int empty;
-        /* If anon_vma_fork fails, we can get an empty anon_vma_chain. */
-        if (!anon_vma)
-                return;
-        anon_vma_lock(anon_vma);
-        list_del(&anon_vma_chain->same_anon_vma);
-        /* We must garbage collect the anon_vma if it's empty */
-        empty = list_empty(&anon_vma->head);
-        anon_vma_unlock(anon_vma);
-        if (empty)
-                put_anon_vma(anon_vma);
-}
 void unlink_anon_vmas(struct vm_area_struct *vma)
 {
        struct anon_vma_chain *avc, *next;
+        struct anon_vma *root = NULL;
        /*
         * Unlink each anon_vma chained to the VMA.  This list is ordered
         * from newest to oldest, ensuring the root anon_vma gets freed last.
         */
        list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
-                anon_vma_unlink(avc);
+                struct anon_vma *anon_vma = avc->anon_vma;
+                root = lock_anon_vma_root(root, anon_vma);
+                list_del(&avc->same_anon_vma);
+                /*
+                 * Leave empty anon_vmas on the list - we'll need
+                 * to free them outside the lock.
+                 */
+                if (list_empty(&anon_vma->head))
+                        continue;
+                list_del(&avc->same_vma);
+                anon_vma_chain_free(avc);
+        }
+        unlock_anon_vma_root(root);
+        /*
+         * Iterate the list once more, it now only contains empty and unlinked
+         * anon_vmas, destroy them. Could not do before due to __put_anon_vma()
+         * needing to acquire the anon_vma->root->mutex.
+         */
+        list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+                struct anon_vma *anon_vma = avc->anon_vma;
+                put_anon_vma(anon_vma);
                list_del(&avc->same_vma);
                anon_vma_chain_free(avc);
        }
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index c7a581a96894..917ecb93ea28 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -205,7 +205,7 @@ int register_vlan_dev(struct net_device *dev)
        grp->nr_vlans++;
        if (ngrp) {
-                if (ops->ndo_vlan_rx_register)
+                if (ops->ndo_vlan_rx_register && (real_dev->features & NETIF_F_HW_VLAN_RX))
                        ops->ndo_vlan_rx_register(real_dev, ngrp);
                rcu_assign_pointer(real_dev->vlgrp, ngrp);
        }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f13ddbf858ba..77930aa522e3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -477,14 +477,16 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         * command otherwise */
        u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
-        /* Events for 1.2 and newer controllers */
+        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
-        if (hdev->lmp_ver > 1) {
+         * any event mask for pre 1.2 devices */
-                events[4] |= 0x01; /* Flow Specification Complete */
+        if (hdev->lmp_ver <= 1)
-                events[4] |= 0x02; /* Inquiry Result with RSSI */
+                return;
-                events[4] |= 0x04; /* Read Remote Extended Features Complete */
-                events[5] |= 0x08; /* Synchronous Connection Complete */
+        events[4] |= 0x01; /* Flow Specification Complete */
-                events[5] |= 0x10; /* Synchronous Connection Changed */
+        events[4] |= 0x02; /* Inquiry Result with RSSI */
-        }
+        events[4] |= 0x04; /* Read Remote Extended Features Complete */
+        events[5] |= 0x08; /* Synchronous Connection Complete */
+        events[5] |= 0x10; /* Synchronous Connection Changed */
        if (hdev->features[3] & LMP_RSSI_INQ)
                events[4] |= 0x04; /* Inquiry Result with RSSI */
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 18dc9888d8c2..8248303f44e8 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -413,6 +413,7 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                        break;
                }
+                memset(&cinfo, 0, sizeof(cinfo));
                cinfo.hci_handle = chan->conn->hcon->handle;
                memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 386cfaffd4b7..1b10727ce523 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -788,6 +788,7 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
+                memset(&cinfo, 0, sizeof(cinfo));
                cinfo.hci_handle = conn->hcon->handle;
                memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 42fdffd1d76c..cb4fb7837e5c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -369,6 +369,15 @@ static void __sco_sock_close(struct sock *sk)
        case BT_CONNECTED:
        case BT_CONFIG:
+                if (sco_pi(sk)->conn) {
+                        sk->sk_state = BT_DISCONN;
+                        sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
+                        hci_conn_put(sco_pi(sk)->conn->hcon);
+                        sco_pi(sk)->conn->hcon = NULL;
+                } else
+                        sco_chan_del(sk, ECONNRESET);
+                break;
        case BT_CONNECT:
        case BT_DISCONN:
                sco_chan_del(sk, ECONNRESET);
@@ -819,7 +828,9 @@ static void sco_chan_del(struct sock *sk, int err)
                conn->sk = NULL;
                sco_pi(sk)->conn = NULL;
                sco_conn_unlock(conn);
-                hci_conn_put(conn->hcon);
+                if (conn->hcon)
+                        hci_conn_put(conn->hcon);
        }
        sk->sk_state = BT_CLOSED;
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index a6b2f86378c7..c188c803c09c 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -243,6 +243,7 @@ int br_netpoll_enable(struct net_bridge_port *p)
                goto out;
        np->dev = p->dev;
+        strlcpy(np->dev_name, p->dev->name, IFNAMSIZ);
        err = __netpoll_setup(np);
        if (err) {
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2f14eafdeeab..29b9812c8da0 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1424,7 +1424,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
        switch (ih->type) {
        case IGMP_HOST_MEMBERSHIP_REPORT:
        case IGMPV2_HOST_MEMBERSHIP_REPORT:
-                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
                err = br_ip4_multicast_add_group(br, port, ih->group);
                break;
        case IGMPV3_HOST_MEMBERSHIP_REPORT:
@@ -1543,7 +1543,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                        goto out;
                }
                mld = (struct mld_msg *)skb_transport_header(skb2);
-                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
                err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
                break;
            }
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 3a66b8c10e09..c23979e79dfa 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -255,7 +255,7 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                if (cfsrvl_phyid_match(layer, phyid) && layer->ctrlcmd) {
-                        if ((ctrl == _CAIF_CTRLCMD_PHYIF_FLOW_OFF_IND ||
+                        if ((ctrl == _CAIF_CTRLCMD_PHYIF_DOWN_IND ||
                                ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&
                                        layer->id != 0) {
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 11b98bc2aa8f..33d2a1fba131 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1179,9 +1179,14 @@ static void remove_queue_kobjects(struct net_device *net)
 #endif
 }
-static const void *net_current_ns(void)
+static void *net_grab_current_ns(void)
 {
-        return current->nsproxy->net_ns;
+        struct net *ns = current->nsproxy->net_ns;
+#ifdef CONFIG_NET_NS
+        if (ns)
+                atomic_inc(&ns->passive);
+#endif
+        return ns;
 }
 static const void *net_initial_ns(void)
@@ -1196,22 +1201,13 @@ static const void *net_netlink_ns(struct sock *sk)
 struct kobj_ns_type_operations net_ns_type_operations = {
        .type = KOBJ_NS_TYPE_NET,
-        .current_ns = net_current_ns,
+        .grab_current_ns = net_grab_current_ns,
        .netlink_ns = net_netlink_ns,
        .initial_ns = net_initial_ns,
+        .drop_ns = net_drop_ns,
 };
 EXPORT_SYMBOL_GPL(net_ns_type_operations);
-static void net_kobj_ns_exit(struct net *net)
-{
-        kobj_ns_exit(KOBJ_NS_TYPE_NET, net);
-}
-static struct pernet_operations kobj_net_ops = {
-        .exit = net_kobj_ns_exit,
-};
 #ifdef CONFIG_HOTPLUG
 static int netdev_uevent(struct device *d, struct kobj_uevent_env *env)
 {
@@ -1339,6 +1335,5 @@ EXPORT_SYMBOL(netdev_class_remove_file);
 int netdev_kobject_init(void)
 {
        kobj_ns_type_register(&net_ns_type_operations);
-        register_pernet_subsys(&kobj_net_ops);
        return class_register(&net_class);
 }
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index e41e5110c65c..ea489db1bc23 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -128,6 +128,7 @@ static __net_init int setup_net(struct net *net)
        LIST_HEAD(net_exit_list);
        atomic_set(&net->count, 1);
+        atomic_set(&net->passive, 1);
 #ifdef NETNS_REFCNT_DEBUG
        atomic_set(&net->use_count, 0);
@@ -210,6 +211,13 @@ static void net_free(struct net *net)
        kmem_cache_free(net_cachep, net);
 }
+void net_drop_ns(void *p)
+{
+        struct net *ns = p;
+        if (ns && atomic_dec_and_test(&ns->passive))
+                net_free(ns);
+}
 struct net *copy_net_ns(unsigned long flags, struct net *old_net)
 {
        struct net *net;
@@ -230,7 +238,7 @@ struct net *copy_net_ns(unsigned long flags, struct net *old_net)
        }
        mutex_unlock(&net_mutex);
        if (rv < 0) {
-                net_free(net);
+                net_drop_ns(net);
                return ERR_PTR(rv);
        }
        return net;
@@ -286,7 +294,7 @@ static void cleanup_net(struct work_struct *work)
        /* Finally it is safe to free my network namespace structure */
        list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
                list_del_init(&net->exit_list);
-                net_free(net);
+                net_drop_ns(net);
        }
 }
 static DECLARE_WORK(net_cleanup_work, cleanup_net);
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index ed0eab39f531..02548b292b53 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -44,7 +44,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
        pr_debug("%s\n", __func__);
        if (!buf)
-                goto out;
+                return -EMSGSIZE;
        hdr = genlmsg_put(msg, 0, seq, &nl802154_family, flags,
                IEEE802154_LIST_PHY);
@@ -65,6 +65,7 @@ static int ieee802154_nl_fill_phy(struct sk_buff *msg, u32 pid,
                                pages * sizeof(uint32_t), buf);
        mutex_unlock(&phy->pib_lock);
+        kfree(buf);
        return genlmsg_end(msg, hdr);
 nla_put_failure:
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 9c1926027a26..eae1f676f870 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -676,6 +676,7 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
        lock_sock(sk2);
+        sock_rps_record_flow(sk2);
        WARN_ON(!((1 << sk2->sk_state) &
                  (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 6ffe94ca5bc9..3267d3898437 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -437,7 +437,7 @@ static int valid_cc(const void *bc, int len, int cc)
                        return 0;
                if (cc == len)
                        return 1;
-                if (op->yes < 4)
+                if (op->yes < 4 || op->yes & 3)
                        return 0;
                len -= op->yes;
                bc  += op->yes;
@@ -447,11 +447,11 @@ static int valid_cc(const void *bc, int len, int cc)
 static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
 {
-        const unsigned char *bc = bytecode;
+        const void *bc = bytecode;
        int  len = bytecode_len;
        while (len > 0) {
-                struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc;
+                const struct inet_diag_bc_op *op = bc;
 //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
                switch (op->code) {
@@ -462,22 +462,20 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
                case INET_DIAG_BC_S_LE:
                case INET_DIAG_BC_D_GE:
                case INET_DIAG_BC_D_LE:
-                        if (op->yes < 4 || op->yes > len + 4)
-                                return -EINVAL;
                case INET_DIAG_BC_JMP:
-                        if (op->no < 4 || op->no > len + 4)
+                        if (op->no < 4 || op->no > len + 4 || op->no & 3)
                                return -EINVAL;
                        if (op->no < len &&
                            !valid_cc(bytecode, bytecode_len, len - op->no))
                                return -EINVAL;
                        break;
                case INET_DIAG_BC_NOP:
-                        if (op->yes < 4 || op->yes > len + 4)
-                                return -EINVAL;
                        break;
                default:
                        return -EINVAL;
                }
+                if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+                        return -EINVAL;
                bc  += op->yes;
                len -= op->yes;
        }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index f7f9bd7ba12d..5c9b9d963918 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -203,7 +203,8 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        else
                pmsg->outdev_name[0] = '\0';
-        if (entry->indev && entry->skb->dev) {
+        if (entry->indev && entry->skb->dev &&
+            entry->skb->mac_header != entry->skb->network_header) {
                pmsg->hw_type = entry->skb->dev->type;
                pmsg->hw_addrlen = dev_parse_header(entry->skb,
                                                    pmsg->hw_addr);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 764743843503..24e556e83a3b 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -566,7 +566,7 @@ check_entry(const struct ipt_entry *e, const char *name)
        const struct xt_entry_target *t;
        if (!ip_checkentry(&e->ip)) {
-                duprintf("ip check failed %p %s.\n", e, par->match->name);
+                duprintf("ip check failed %p %s.\n", e, name);
                return -EINVAL;
        }
diff --git a/net/ipv4/netfilter/ipt_ecn.c b/net/ipv4/netfilter/ipt_ecn.c
index af6e9c778345..2b57e52c746c 100644
--- a/net/ipv4/netfilter/ipt_ecn.c
+++ b/net/ipv4/netfilter/ipt_ecn.c
@@ -25,7 +25,8 @@ MODULE_LICENSE("GPL");
 static inline bool match_ip(const struct sk_buff *skb,
                            const struct ipt_ecn_info *einfo)
 {
-        return (ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect;
+        return ((ip_hdr(skb)->tos & IPT_ECN_IP_MASK) == einfo->ip_ect) ^
+               !!(einfo->invert & IPT_ECN_OP_MATCH_IP);
 }
 static inline bool match_tcp(const struct sk_buff *skb,
@@ -76,8 +77,6 @@ static bool ecn_mt(const struct sk_buff *skb, struct xt_action_param *par)
                        return false;
        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR)) {
-                if (ip_hdr(skb)->protocol != IPPROTO_TCP)
-                        return false;
                if (!match_tcp(skb, info, &par->hotdrop))
                        return false;
        }
@@ -97,7 +96,7 @@ static int ecn_mt_check(const struct xt_mtchk_param *par)
                return -EINVAL;
        if (info->operation & (IPT_ECN_OP_MATCH_ECE|IPT_ECN_OP_MATCH_CWR) &&
-            ip->proto != IPPROTO_TCP) {
+            (ip->proto != IPPROTO_TCP || ip->invflags & IPT_INV_PROTO)) {
                pr_info("cannot match TCP bits in rule for non-tcp packets\n");
                return -EINVAL;
        }
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index db10075dd88e..de9da21113a1 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -121,7 +121,9 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
                return ret;
        }
-        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
+        /* adjust seqs for loopback traffic only in outgoing direction */
+        if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status) &&
+            !nf_is_loopback_packet(skb)) {
                typeof(nf_nat_seq_adjust_hook) seq_adjust;
                seq_adjust = rcu_dereference(nf_nat_seq_adjust_hook);
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 9aaa67165f42..39b403f854c6 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -41,7 +41,6 @@
 #include <linux/proc_fs.h>
 #include <net/sock.h>
 #include <net/ping.h>
-#include <net/icmp.h>
 #include <net/udp.h>
 #include <net/route.h>
 #include <net/inet_common.h>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 045f0ec6a4a0..aa13ef105110 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1902,9 +1902,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
        hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
        rth = rt_intern_hash(hash, rth, skb, dev->ifindex);
-        err = 0;
+        return IS_ERR(rth) ? PTR_ERR(rth) : 0;
-        if (IS_ERR(rth))
-                err = PTR_ERR(rth);
 e_nobufs:
        return -ENOBUFS;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a7d6671e33b8..708dc203b034 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1589,6 +1589,7 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                        goto discard;
                if (nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                        if (tcp_child_process(sk, nsk, skb)) {
                                rsk = nsk;
                                goto reset;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 065fe405fb58..249394863284 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -204,7 +204,8 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
        else
                pmsg->outdev_name[0] = '\0';
-        if (entry->indev && entry->skb->dev) {
+        if (entry->indev && entry->skb->dev &&
+            entry->skb->mac_header != entry->skb->network_header) {
                pmsg->hw_type = entry->skb->dev->type;
                pmsg->hw_addrlen = dev_parse_header(entry->skb, pmsg->hw_addr);
        }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d1fd28711ba5..87551ca568cd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1644,6 +1644,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 * the new socket..
                 */
                if(nsk != sk) {
+                        sock_rps_save_rxhash(nsk, skb->rxhash);
                        if (tcp_child_process(sk, nsk, skb))
                                goto reset;
                        if (opt_skb)
diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
index bf28ac2fc99b..782db275ac53 100644
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -776,8 +776,16 @@ static void ip_vs_conn_expire(unsigned long data)
                if (cp->control)
                        ip_vs_control_del(cp);
-                if (cp->flags & IP_VS_CONN_F_NFCT)
+                if (cp->flags & IP_VS_CONN_F_NFCT) {
                        ip_vs_conn_drop_conntrack(cp);
+                        /* Do not access conntracks during subsys cleanup
+                         * because nf_conntrack_find_get can not be used after
+                         * conntrack cleanup for the net.
+                         */
+                        smp_rmb();
+                        if (ipvs->enable)
+                                ip_vs_conn_drop_conntrack(cp);
+                }
                ip_vs_pe_put(cp->pe);
                kfree(cp->pe_data);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 55af2242bccd..24c28d238dcb 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1945,6 +1945,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net)
 {
        EnterFunction(2);
        net_ipvs(net)->enable = 0;      /* Disable packet reception */
+        smp_wmb();
        __ip_vs_sync_cleanup(net);
        LeaveFunction(2);
 }
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index e0ee010935e7..2e7ccbb43ddb 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -456,7 +456,8 @@ __build_packet_message(struct nfulnl_instance *inst,
        if (skb->mark)
                NLA_PUT_BE32(inst->skb, NFULA_MARK, htonl(skb->mark));
-        if (indev && skb->dev) {
+        if (indev && skb->dev &&
+            skb->mac_header != skb->network_header) {
                struct nfulnl_msg_packet_hw phw;
                int len = dev_parse_header(skb, phw.hw_addr);
                if (len > 0) {
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index b83123f12b42..fdd2fafe0a14 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -335,7 +335,8 @@ nfqnl_build_packet_message(struct nfqnl_instance *queue,
        if (entskb->mark)
                NLA_PUT_BE32(skb, NFQA_MARK, htonl(entskb->mark));
-        if (indev && entskb->dev) {
+        if (indev && entskb->dev &&
+            entskb->mac_header != entskb->network_header) {
                struct nfqnl_msg_packet_hw phw;
                int len = dev_parse_header(entskb, phw.hw_addr);
                if (len) {
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 0a9a2ec2e469..c3b75333b821 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -43,6 +43,7 @@
 #include <linux/sunrpc/gss_krb5.h>
 #include <linux/sunrpc/xdr.h>
 #include <linux/crypto.h>
+#include <linux/sunrpc/gss_krb5_enctypes.h>
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY        RPCDBG_AUTH
@@ -750,7 +751,7 @@ static struct gss_api_mech gss_kerberos_mech = {
        .gm_ops         = &gss_kerberos_ops,
        .gm_pf_num      = ARRAY_SIZE(gss_kerberos_pfs),
        .gm_pfs         = gss_kerberos_pfs,
-        .gm_upcall_enctypes = "18,17,16,23,3,1,2",
+        .gm_upcall_enctypes = KRB5_SUPPORTED_ENCTYPES,
 };
 static int __init init_kerberos_module(void)
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index cd1f779fa51d..1be68269e1c2 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -474,17 +474,11 @@ struct cgroup_subsys devices_subsys = {
        .subsys_id = devices_subsys_id,
 };
-int devcgroup_inode_permission(struct inode *inode, int mask)
+int __devcgroup_inode_permission(struct inode *inode, int mask)
 {
        struct dev_cgroup *dev_cgroup;
        struct dev_whitelist_item *wh;
-        dev_t device = inode->i_rdev;
-        if (!device)
-                return 0;
-        if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode))
-                return 0;
        rcu_read_lock();
        dev_cgroup = task_devcgroup(current);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index d31862e0aa1c..8e319a416eec 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -71,9 +71,8 @@ EXPORT_SYMBOL(complete_request_key);
 * This is called in context of freshly forked kthread before kernel_execve(),
 * so we can simply install the desired session_keyring at this point.
 */
-static int umh_keys_init(struct subprocess_info *info)
+static int umh_keys_init(struct subprocess_info *info, struct cred *cred)
 {
-        struct cred *cred = (struct cred*)current_cred();
        struct key *keyring = info->data;
        return install_session_keyring_to_cred(cred, keyring);
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 77d44138864f..35459340019e 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -29,6 +29,7 @@
 #include <linux/audit.h>
 #include <linux/uaccess.h>
 #include <linux/kobject.h>
+#include <linux/ctype.h>
 /* selinuxfs pseudo filesystem for exporting the security policy API.
   Based on the proc code and the fs/nfsd/nfsctl.c code. */
@@ -751,6 +752,14 @@ out:
        return length;
 }
+static inline int hexcode_to_int(int code) {
+        if (code == '\0' || !isxdigit(code))
+                return -1;
+        if (isdigit(code))
+                return code - '0';
+        return tolower(code) - 'a' + 10;
+}
 static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
 {
        char *scon = NULL, *tcon = NULL;
@@ -785,8 +794,34 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
        nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf);
        if (nargs < 3 || nargs > 4)
                goto out;
-        if (nargs == 4)
+        if (nargs == 4) {
+                /*
+                 * If and when the name of new object to be queried contains
+                 * either whitespace or multibyte characters, they shall be
+                 * encoded based on the percentage-encoding rule.
+                 * If not encoded, the sscanf logic picks up only left-half
+                 * of the supplied name; splitted by a whitespace unexpectedly.
+                 */
+                char   *r, *w;
+                int     c1, c2;
+                r = w = namebuf;
+                do {
+                        c1 = *r++;
+                        if (c1 == '+')
+                                c1 = ' ';
+                        else if (c1 == '%') {
+                                if ((c1 = hexcode_to_int(*r++)) < 0)
+                                        goto out;
+                                if ((c2 = hexcode_to_int(*r++)) < 0)
+                                        goto out;
+                                c1 = (c1 << 4) | c2;
+                        }
+                        *w++ = c1;
+                } while (c1 != '\0');
                objname = namebuf;
+        }
        length = security_context_to_sid(scon, strlen(scon) + 1, &ssid);
        if (length)
diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
index 102e9ec1b77a..d246aca3f4fb 100644
--- a/security/selinux/ss/policydb.c
+++ b/security/selinux/ss/policydb.c
@@ -3222,6 +3222,9 @@ static int filename_trans_write(struct policydb *p, void *fp)
        __le32 buf[1];
        int rc;
+        if (p->policyvers < POLICYDB_VERSION_FILENAME_TRANS)
+                return 0;
        nel = 0;
        rc = hashtab_map(p->filename_trans, hashtab_cnt, &nel);
        if (rc)
diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c
index 86ee16ca365e..440030818db7 100644
--- a/sound/firewire/isight.c
+++ b/sound/firewire/isight.c
@@ -209,6 +209,7 @@ static void isight_packet(struct fw_iso_context *context, u32 cycle,
                isight->packet_index = -1;
                return;
        }
+        fw_iso_context_queue_flush(isight->context);
        if (++index >= QUEUE_LENGTH)
                index = 0;
diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
index 5e619a84da06..15f0161ce4a2 100644
--- a/sound/pci/emu10k1/emu10k1_main.c
+++ b/sound/pci/emu10k1/emu10k1_main.c
@@ -1440,6 +1440,14 @@ static struct snd_emu_chip_details emu_chip_details[] = {
         .ca0102_chip = 1,
         .spk71 = 1,
         .emu_model = EMU_MODEL_EMU0404}, /* EMU 0404 */
+        /* EMU0404 PCIe */
+        {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x40051102,
+         .driver = "Audigy2", .name = "E-mu 0404 PCIe [MAEM8984]",
+         .id = "EMU0404",
+         .emu10k2_chip = 1,
+         .ca0108_chip = 1,
+         .spk71 = 1,
+         .emu_model = EMU_MODEL_EMU0404}, /* EMU 0404 PCIe ver_03 */
        /* Note that all E-mu cards require kernel 2.6 or newer. */
        {.vendor = 0x1102, .device = 0x0008,
         .driver = "Audigy2", .name = "SB Audigy 2 Value [Unknown]",
diff --git a/sound/pci/hda/hda_beep.h b/sound/pci/hda/hda_beep.h
index f1de1bac042c..55f0647458c7 100644
--- a/sound/pci/hda/hda_beep.h
+++ b/sound/pci/hda/hda_beep.h
@@ -50,7 +50,12 @@ int snd_hda_enable_beep_device(struct hda_codec *codec, int enable);
 int snd_hda_attach_beep_device(struct hda_codec *codec, int nid);
 void snd_hda_detach_beep_device(struct hda_codec *codec);
 #else
-#define snd_hda_attach_beep_device(...)         0
+static inline int snd_hda_attach_beep_device(struct hda_codec *codec, int nid)
-#define snd_hda_detach_beep_device(...)
+{
+        return 0;
+}
+static inline void snd_hda_detach_beep_device(struct hda_codec *codec)
+{
+}
 #endif
 #endif
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 43fcfbd32847..61a774b3d3cb 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -13316,9 +13316,8 @@ static void alc268_acer_lc_setup(struct hda_codec *codec)
        struct alc_spec *spec = codec->spec;
        spec->autocfg.hp_pins[0] = 0x15;
        spec->autocfg.speaker_pins[0] = 0x14;
-        spec->automute_mixer_nid[0] = 0x0f;
        spec->automute = 1;
-        spec->automute_mode = ALC_AUTOMUTE_MIXER;
+        spec->automute_mode = ALC_AUTOMUTE_AMP;
        spec->ext_mic.pin = 0x18;
        spec->ext_mic.mux_idx = 0;
        spec->int_mic.pin = 0x12;
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 605c99e1e520..c952582fb218 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -832,10 +832,13 @@ static int via_hp_build(struct hda_codec *codec)
        knew->subdevice = HDA_SUBDEV_NID_FLAG | nid;
        knew->private_value = nid;
-        knew = via_clone_control(spec, &via_hp_mixer[1]);
+        nid = side_mute_channel(spec);
-        if (knew == NULL)
+        if (nid) {
-                return -ENOMEM;
+                knew = via_clone_control(spec, &via_hp_mixer[1]);
-        knew->subdevice = side_mute_channel(spec);
+                if (knew == NULL)
+                        return -ENOMEM;
+                knew->subdevice = nid;
+        }
        return 0;
 }
diff --git a/sound/pci/lola/lola.c b/sound/pci/lola/lola.c
index 34b24286d279..2692e5ae5f2d 100644
--- a/sound/pci/lola/lola.c
+++ b/sound/pci/lola/lola.c
@@ -445,7 +445,7 @@ static void lola_reset_setups(struct lola *chip)
        lola_setup_all_analog_gains(chip, PLAY, false); /* output, update */
 }
-static int lola_parse_tree(struct lola *chip)
+static int __devinit lola_parse_tree(struct lola *chip)
 {
        unsigned int val;
        int nid, err;
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 949691a876d3..3f08afc0f0d3 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -521,6 +521,7 @@ MODULE_SUPPORTED_DEVICE("{{RME HDSPM-MADI}}");
 #define HDSPM_DMA_AREA_KILOBYTES (HDSPM_DMA_AREA_BYTES/1024)
 /* revisions >= 230 indicate AES32 card */
+#define HDSPM_MADI_OLD_REV      207
 #define HDSPM_MADI_REV          210
 #define HDSPM_RAYDAT_REV        211
 #define HDSPM_AIO_REV           212
@@ -1143,7 +1144,7 @@ static int hdspm_external_sample_rate(struct hdspm *hdspm)
                /* if wordclock has synced freq and wordclock is valid */
                if ((status2 & HDSPM_wcLock) != 0 &&
-                                (status & HDSPM_SelSyncRef0) == 0) {
+                                (status2 & HDSPM_SelSyncRef0) == 0) {
                        rate_bits = status2 & HDSPM_wcFreqMask;
@@ -1639,12 +1640,14 @@ static int snd_hdspm_midi_input_read (struct hdspm_midi *hmidi)
                }
        }
        hmidi->pending = 0;
+        spin_unlock_irqrestore(&hmidi->lock, flags);
+        spin_lock_irqsave(&hmidi->hdspm->lock, flags);
        hmidi->hdspm->control_register |= hmidi->ie;
        hdspm_write(hmidi->hdspm, HDSPM_controlRegister,
                    hmidi->hdspm->control_register);
+        spin_unlock_irqrestore(&hmidi->hdspm->lock, flags);
-        spin_unlock_irqrestore (&hmidi->lock, flags);
        return snd_hdspm_midi_output_write (hmidi);
 }
@@ -6377,6 +6380,7 @@ static int __devinit snd_hdspm_create(struct snd_card *card,
        switch (hdspm->firmware_rev) {
        case HDSPM_MADI_REV:
+        case HDSPM_MADI_OLD_REV:
                hdspm->io_type = MADI;
                hdspm->card_name = "RME MADI";
                hdspm->midiPorts = 3;
diff --git a/sound/usb/6fire/firmware.c b/sound/usb/6fire/firmware.c
index a91719d5918b..1e3ae3327dd3 100644
--- a/sound/usb/6fire/firmware.c
+++ b/sound/usb/6fire/firmware.c
@@ -270,7 +270,6 @@ static int usb6fire_fw_ezusb_upload(
        data = 0x00; /* resume ezusb cpu */
        ret = usb6fire_fw_ezusb_write(device, 0xa0, 0xe600, &data, 1);
        if (ret < 0) {
-                release_firmware(fw);
                snd_printk(KERN_ERR PREFIX "unable to upload ezusb "
                                "firmware %s: end message.\n", fwname);
                return ret;
diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
index b137b25865cc..d144cdb2f159 100644
--- a/sound/usb/6fire/pcm.c
+++ b/sound/usb/6fire/pcm.c
@@ -395,12 +395,12 @@ static int usb6fire_pcm_open(struct snd_pcm_substream *alsa_sub)
        alsa_rt->hw = pcm_hw;
        if (alsa_sub->stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                if (rt->rate >= 0)
+                if (rt->rate < ARRAY_SIZE(rates))
                        alsa_rt->hw.rates = rates_alsaid[rt->rate];
                alsa_rt->hw.channels_max = OUT_N_CHANNELS;
                sub = &rt->playback;
        } else if (alsa_sub->stream == SNDRV_PCM_STREAM_CAPTURE) {
-                if (rt->rate >= 0)
+                if (rt->rate < ARRAY_SIZE(rates))
                        alsa_rt->hw.rates = rates_alsaid[rt->rate];
                alsa_rt->hw.channels_max = IN_N_CHANNELS;
                sub = &rt->capture;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 032ba6398a5c..940257b5774e 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -633,7 +633,7 @@ prefix_SQ = $(subst ','\'',$(prefix))
 SHELL_PATH_SQ = $(subst ','\'',$(SHELL_PATH))
-LIBS = -Wl,--whole-archive $(PERFLIBS) -Wl,--no-whole-archive $(EXTLIBS)
+LIBS = -Wl,--whole-archive $(PERFLIBS) -Wl,--no-whole-archive -Wl,--start-group $(EXTLIBS) -Wl,--end-group
 ALL_CFLAGS += $(BASIC_CFLAGS)
 ALL_CFLAGS += $(ARCH_CFLAGS)
diff --git a/tools/perf/util/PERF-VERSION-GEN b/tools/perf/util/PERF-VERSION-GEN
index 9c5fb4d93824..ad73300f7bac 100755
--- a/tools/perf/util/PERF-VERSION-GEN
+++ b/tools/perf/util/PERF-VERSION-GEN
@@ -23,7 +23,7 @@ if test -d ../../.git -o -f ../../.git &&
 then
        VN=$(echo "$VN" | sed -e 's/-/./g');
 else
-        VN=$(make -sC ../.. kernelversion)
+        VN=$(MAKEFLAGS= make -sC ../.. kernelversion)
 fi
 VN=$(expr "$VN" : v*'\(.*\)')
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 1e88485c16a0..0a7ed5b5e281 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -2187,6 +2187,7 @@ static const struct flag flags[] = {
        { "TASKLET_SOFTIRQ", 6 },
        { "SCHED_SOFTIRQ", 7 },
        { "HRTIMER_SOFTIRQ", 8 },
+        { "RCU_SOFTIRQ", 9 },
        { "HRTIMER_NORESTART", 0 },
        { "HRTIMER_RESTART", 1 },
author	Paul Mundt <lethal@linux-sh.org>	2011-06-21 04:47:44 -0400
committer	Paul Mundt <lethal@linux-sh.org>	2011-06-21 04:47:44 -0400
commit	9dd056e9eba106ef622795b566f769a9ab0a49a8 (patch)
tree	390c07ea2c3b9631c2e8fe64c1a6feba0b503e8b
parent	08ef2e427b59393d68a65b16e97e894b662a5573 (diff)
parent	f2b9726105824fdeea32a339e5072a358f89a25b (diff)