Merge branch 'akpm' (Andrew's patch-bomb)

Merge Andrew's first set of patches:
 "Non-MM patches:

   - lots of misc bits

   - tree-wide have_clk() cleanups

   - quite a lot of printk tweaks.  I draw your attention to "printk:
     convert the format for KERN_<LEVEL> to a 2 byte pattern" which
     looks a bit scary.  But afaict it's solid.

   - backlight updates

   - lib/ feature work (notably the addition and use of memweight())

   - checkpatch updates

   - rtc updates

   - nilfs updates

   - fatfs updates (partial, still waiting for acks)

   - kdump, proc, fork, IPC, sysctl, taskstats, pps, etc

   - new fault-injection feature work"

* Merge emailed patches from Andrew Morton <akpm@linux-foundation.org>: (128 commits)
  drivers/misc/lkdtm.c: fix missing allocation failure check
  lib/scatterlist: do not re-write gfp_flags in __sg_alloc_table()
  fault-injection: add tool to run command with failslab or fail_page_alloc
  fault-injection: add selftests for cpu and memory hotplug
  powerpc: pSeries reconfig notifier error injection module
  memory: memory notifier error injection module
  PM: PM notifier error injection module
  cpu: rewrite cpu-notifier-error-inject module
  fault-injection: notifier error injection
  c/r: fcntl: add F_GETOWNER_UIDS option
  resource: make sure requested range is included in the root range
  include/linux/aio.h: cpp->C conversions
  fs: cachefiles: add support for large files in filesystem caching
  pps: return PTR_ERR on error in device_create
  taskstats: check nla_reserve() return
  sysctl: suppress kmemleak messages
  ipc: use Kconfig options for __ARCH_WANT_[COMPAT_]IPC_PARSE_VERSION
  ipc: compat: use signed size_t types for msgsnd and msgrcv
  ipc: allow compat IPC version field parsing if !ARCH_WANT_OLD_COMPAT_IPC
  ipc: add COMPAT_SHMLBA support
  ...

185 files changed, 2662 insertions, 1042 deletions

diff --git a/Documentation/fault-injection/fault-injection.txt b/Documentation/fault-injection/fault-injection.txt
index ba4be8b77093..4cf1a2a6bd72 100644
--- a/Documentation/fault-injection/fault-injection.txt
+++ b/Documentation/fault-injection/fault-injection.txt
@@ -240,3 +240,30 @@ trap "echo 0 > /sys/kernel/debug/$FAILTYPE/probability" SIGINT SIGTERM EXIT
 echo "Injecting errors into the module $module... (interrupt to stop)"
 sleep 1000000
 
+Tool to run command with failslab or fail_page_alloc
+----------------------------------------------------
+In order to make it easier to accomplish the tasks mentioned above, we can use
+tools/testing/fault-injection/failcmd.sh.  Please run a command
+"./tools/testing/fault-injection/failcmd.sh --help" for more information and
+see the following examples.
+
+Examples:
+
+Run a command "make -C tools/testing/selftests/ run_tests" with injecting slab
+allocation failure.
+
+        # ./tools/testing/fault-injection/failcmd.sh \
+                -- make -C tools/testing/selftests/ run_tests
+
+Same as above except to specify 100 times failures at most instead of one time
+at most by default.
+
+        # ./tools/testing/fault-injection/failcmd.sh --times=100 \
+                -- make -C tools/testing/selftests/ run_tests
+
+Same as above except to inject page allocation failure instead of slab
+allocation failure.
+
+        # env FAILCMD_TYPE=fail_page_alloc \
+                ./tools/testing/fault-injection/failcmd.sh --times=100 \
+                -- make -C tools/testing/selftests/ run_tests
diff --git a/Documentation/fault-injection/notifier-error-inject.txt b/Documentation/fault-injection/notifier-error-inject.txt
new file mode 100644
index 000000000000..c83526c364e5
--- /dev/null
+++ b/Documentation/fault-injection/notifier-error-inject.txt
@@ -0,0 +1,99 @@
+Notifier error injection
+========================
+
+Notifier error injection provides the ability to inject artifical errors to
+specified notifier chain callbacks. It is useful to test the error handling of
+notifier call chain failures which is rarely executed.  There are kernel
+modules that can be used to test the following notifiers.
+
+ * CPU notifier
+ * PM notifier
+ * Memory hotplug notifier
+ * powerpc pSeries reconfig notifier
+
+CPU notifier error injection module
+-----------------------------------
+This feature can be used to test the error handling of the CPU notifiers by
+injecting artifical errors to CPU notifier chain callbacks.
+
+If the notifier call chain should be failed with some events notified, write
+the error code to debugfs interface
+/sys/kernel/debug/notifier-error-inject/cpu/actions/<notifier event>/error
+
+Possible CPU notifier events to be failed are:
+
+ * CPU_UP_PREPARE
+ * CPU_UP_PREPARE_FROZEN
+ * CPU_DOWN_PREPARE
+ * CPU_DOWN_PREPARE_FROZEN
+
+Example1: Inject CPU offline error (-1 == -EPERM)
+
+        # cd /sys/kernel/debug/notifier-error-inject/cpu
+        # echo -1 > actions/CPU_DOWN_PREPARE/error
+        # echo 0 > /sys/devices/system/cpu/cpu1/online
+        bash: echo: write error: Operation not permitted
+
+Example2: inject CPU online error (-2 == -ENOENT)
+
+        # echo -2 > actions/CPU_UP_PREPARE/error
+        # echo 1 > /sys/devices/system/cpu/cpu1/online
+        bash: echo: write error: No such file or directory
+
+PM notifier error injection module
+----------------------------------
+This feature is controlled through debugfs interface
+/sys/kernel/debug/notifier-error-inject/pm/actions/<notifier event>/error
+
+Possible PM notifier events to be failed are:
+
+ * PM_HIBERNATION_PREPARE
+ * PM_SUSPEND_PREPARE
+ * PM_RESTORE_PREPARE
+
+Example: Inject PM suspend error (-12 = -ENOMEM)
+
+        # cd /sys/kernel/debug/notifier-error-inject/pm/
+        # echo -12 > actions/PM_SUSPEND_PREPARE/error
+        # echo mem > /sys/power/state
+        bash: echo: write error: Cannot allocate memory
+
+Memory hotplug notifier error injection module
+----------------------------------------------
+This feature is controlled through debugfs interface
+/sys/kernel/debug/notifier-error-inject/memory/actions/<notifier event>/error
+
+Possible memory notifier events to be failed are:
+
+ * MEM_GOING_ONLINE
+ * MEM_GOING_OFFLINE
+
+Example: Inject memory hotplug offline error (-12 == -ENOMEM)
+
+        # cd /sys/kernel/debug/notifier-error-inject/memory
+        # echo -12 > actions/MEM_GOING_OFFLINE/error
+        # echo offline > /sys/devices/system/memory/memoryXXX/state
+        bash: echo: write error: Cannot allocate memory
+
+powerpc pSeries reconfig notifier error injection module
+--------------------------------------------------------
+This feature is controlled through debugfs interface
+/sys/kernel/debug/notifier-error-inject/pSeries-reconfig/actions/<notifier event>/error
+
+Possible pSeries reconfig notifier events to be failed are:
+
+ * PSERIES_RECONFIG_ADD
+ * PSERIES_RECONFIG_REMOVE
+ * PSERIES_DRCONF_MEM_ADD
+ * PSERIES_DRCONF_MEM_REMOVE
+
+For more usage examples
+-----------------------
+There are tools/testing/selftests using the notifier error injection features
+for CPU and memory notifiers.
+
+ * tools/testing/selftests/cpu-hotplug/on-off-test.sh
+ * tools/testing/selftests/memory-hotplug/on-off-test.sh
+
+These scripts first do simple online and offline tests and then do fault
+injection tests if notifier error injection module is available.
diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt
index 5df176ed59b8..7561d7ed8e11 100644
--- a/Documentation/printk-formats.txt
+++ b/Documentation/printk-formats.txt
@@ -53,9 +53,20 @@ Struct Resources:
         For printing struct resources. The 'R' and 'r' specifiers result in a
         printed resource with ('R') or without ('r') a decoded flags member.
 
+Raw buffer as a hex string:
+        %*ph    00 01 02  ...  3f
+        %*phC   00:01:02: ... :3f
+        %*phD   00-01-02- ... -3f
+        %*phN   000102 ... 3f
+
+        For printing a small buffers (up to 64 bytes long) as a hex string with
+        certain separator. For the larger buffers consider to use
+        print_hex_dump().
+
 MAC/FDDI addresses:
 
         %pM     00:01:02:03:04:05
+        %pMR    05:04:03:02:01:00
         %pMF    00-01-02-03-04-05
         %pm     000102030405
 
@@ -67,6 +78,10 @@ MAC/FDDI addresses:
         the 'M' specifier to use dash ('-') separators instead of the default
         separator.
 
+        For Bluetooth addresses the 'R' specifier shall be used after the 'M'
+        specifier to use reversed byte order suitable for visual interpretation
+        of Bluetooth addresses which are in the little endian order.
+
 IPv4 addresses:
 
         %pI4    1.2.3.4
diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
index 13d6166d7a27..8c235b6e4246 100644
--- a/Documentation/sysctl/fs.txt
+++ b/Documentation/sysctl/fs.txt
@@ -163,16 +163,22 @@ This value can be used to query and set the core dump mode for setuid
 or otherwise protected/tainted binaries. The modes are
 
 0 - (default) - traditional behaviour. Any process which has changed
-        privilege levels or is execute only will not be dumped
+        privilege levels or is execute only will not be dumped.
 1 - (debug) - all processes dump core when possible. The core dump is
         owned by the current user and no security is applied. This is
         intended for system debugging situations only. Ptrace is unchecked.
+        This is insecure as it allows regular users to examine the memory
+        contents of privileged processes.
 2 - (suidsafe) - any binary which normally would not be dumped is dumped
-        readable by root only. This allows the end user to remove
-        such a dump but not access it directly. For security reasons
-        core dumps in this mode will not overwrite one another or
-        other files. This mode is appropriate when administrators are
-        attempting to debug problems in a normal environment.
+        anyway, but only if the "core_pattern" kernel sysctl is set to
+        either a pipe handler or a fully qualified path. (For more details
+        on this limitation, see CVE-2006-2451.) This mode is appropriate
+        when administrators are attempting to debug problems in a normal
+        environment, and either have a core dump pipe handler that knows
+        to treat privileged core dumps with care, or specific directory
+        defined for catching core dumps. If a core dump happens without
+        a pipe handler or fully qualifid path, a message will be emitted
+        to syslog warning about the lack of a correct setting.
 
 ==============================================================
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 19f705073942..b2e3d88ff4cd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2750,6 +2750,7 @@ M:	Jingoo Han <jg1.han@samsung.com>
 L:      linux-fbdev@vger.kernel.org
 S:      Maintained
 F:      drivers/video/exynos/exynos_dp*
+F:      include/video/exynos_dp*
 
 EXYNOS MIPI DISPLAY DRIVERS
 M:      Inki Dae <inki.dae@samsung.com>
diff --git a/arch/Kconfig b/arch/Kconfig
index 8c3d957fa8e2..72f2fa189cc5 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -248,7 +248,14 @@ config HAVE_CMPXCHG_LOCAL
 config HAVE_CMPXCHG_DOUBLE
         bool
 
+config ARCH_WANT_IPC_PARSE_VERSION
+        bool
+
+config ARCH_WANT_COMPAT_IPC_PARSE_VERSION
+        bool
+
 config ARCH_WANT_OLD_COMPAT_IPC
+        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
         bool
 
 config HAVE_ARCH_SECCOMP_FILTER
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 3de74c9f9610..d5b9b5e645cc 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -14,6 +14,7 @@ config ALPHA
         select AUTO_IRQ_AFFINITY if SMP
         select GENERIC_IRQ_SHOW
         select ARCH_WANT_OPTIONAL_GPIOLIB
+        select ARCH_WANT_IPC_PARSE_VERSION
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_CMOS_UPDATE
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index d1f23b722df4..633b23b0664a 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -470,7 +470,6 @@
 
 #define NR_SYSCALLS                     504
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/alpha/kernel/smc37c669.c b/arch/alpha/kernel/smc37c669.c
index 0435921d41c6..c803fc76ae4f 100644
--- a/arch/alpha/kernel/smc37c669.c
+++ b/arch/alpha/kernel/smc37c669.c
@@ -933,18 +933,6 @@ void SMC37c669_display_device_info(
  *
  *--
  */
-#if 0
-/* $INCLUDE_OPTIONS$ */
-#include    "cp$inc:platform_io.h"
-/* $INCLUDE_OPTIONS_END$ */
-#include    "cp$src:common.h"
-#include    "cp$inc:prototypes.h"
-#include    "cp$src:kernel_def.h"
-#include    "cp$src:msg_def.h"
-#include    "cp$src:smcc669_def.h"
-/* Platform-specific includes */
-#include    "cp$src:platform.h"
-#endif
 
 #ifndef TRUE
 #define TRUE 1
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 6b86bb963a28..7980873525b2 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -11,6 +11,7 @@ config ARM
         select RTC_LIB
         select SYS_SUPPORTS_APM_EMULATION
         select GENERIC_ATOMIC64 if (CPU_V6 || !CPU_32v6K || !AEABI)
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_OPROFILE if (HAVE_PERF_EVENTS)
         select HAVE_ARCH_JUMP_LABEL if !XIP_KERNEL
         select HAVE_ARCH_KGDB
@@ -38,6 +39,7 @@ config ARM
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select GENERIC_IRQ_PROBE
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HARDIRQS_SW_RESEND
         select CPU_PM if (SUSPEND || CPU_IDLE)
         select GENERIC_PCI_IOMAP
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 512cd1473454..0cab47d4a83f 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -446,7 +446,6 @@
 
 #ifdef __KERNEL__
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_GETHOSTNAME
 #define __ARCH_WANT_SYS_PAUSE
diff --git a/arch/arm/lib/io-acorn.S b/arch/arm/lib/io-acorn.S
index 1b197ea7aab3..69719bad674d 100644
--- a/arch/arm/lib/io-acorn.S
+++ b/arch/arm/lib/io-acorn.S
@@ -11,13 +11,14 @@
  *
  */
 #include <linux/linkage.h>
+#include <linux/kern_levels.h>
 #include <asm/assembler.h>
 
                 .text
                 .align
 
 .Liosl_warning:
-                .ascii  "<4>insl/outsl not implemented, called from %08lX\0"
+                .ascii  KERN_WARNING "insl/outsl not implemented, called from %08lX\0"
                 .align
 
 /*
diff --git a/arch/arm/mach-netx/fb.c b/arch/arm/mach-netx/fb.c
index 2cdf6ef69bee..d122ee6ab991 100644
--- a/arch/arm/mach-netx/fb.c
+++ b/arch/arm/mach-netx/fb.c
@@ -69,29 +69,6 @@ void netx_clcd_remove(struct clcd_fb *fb)
                               fb->fb.screen_base, fb->fb.fix.smem_start);
 }
 
-void clk_disable(struct clk *clk)
-{
-}
-
-int clk_set_rate(struct clk *clk, unsigned long rate)
-{
-        return 0;
-}
-
-int clk_enable(struct clk *clk)
-{
-        return 0;
-}
-
-struct clk *clk_get(struct device *dev, const char *id)
-{
-        return dev && strcmp(dev_name(dev), "fb") == 0 ? NULL : ERR_PTR(-ENOENT);
-}
-
-void clk_put(struct clk *clk)
-{
-}
-
 static AMBA_AHB_DEVICE(fb, "fb", 0, 0x00104000, { NETX_IRQ_LCD }, NULL);
 
 int netx_fb_init(struct clcd_board *board, struct clcd_panel *panel)
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index 2d30c7f6edd3..d50f0e486cf2 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -16,6 +16,7 @@
  */
 #include <asm/thread_info.h>
 #include <asm/vfpmacros.h>
+#include <linux/kern_levels.h>
 #include "../kernel/entry-header.S"
 
         .macro  DBGSTR, str
@@ -24,7 +25,7 @@
         add     r0, pc, #4
         bl      printk
         b       1f
-        .asciz  "<7>VFP: \str\n"
+        .asciz  KERN_DEBUG "VFP: \str\n"
         .balign 4
 1:      ldmfd   sp!, {r0-r3, ip, lr}
 #endif
@@ -37,7 +38,7 @@
         add     r0, pc, #4
         bl      printk
         b       1f
-        .asciz  "<7>VFP: \str\n"
+        .asciz  KERN_DEBUG "VFP: \str\n"
         .balign 4
 1:      ldmfd   sp!, {r0-r3, ip, lr}
 #endif
@@ -52,7 +53,7 @@
         add     r0, pc, #4
         bl      printk
         b       1f
-        .asciz  "<7>VFP: \str\n"
+        .asciz  KERN_DEBUG "VFP: \str\n"
         .balign 4
 1:      ldmfd   sp!, {r0-r3, ip, lr}
 #endif
diff --git a/arch/avr32/Kconfig b/arch/avr32/Kconfig
index 71d38c76726c..5ade51c8a87f 100644
--- a/arch/avr32/Kconfig
+++ b/arch/avr32/Kconfig
@@ -12,6 +12,7 @@ config AVR32
         select HARDIRQS_SW_RESEND
         select GENERIC_IRQ_SHOW
         select ARCH_HAVE_CUSTOM_GPIO_H
+        select ARCH_WANT_IPC_PARSE_VERSION
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_CLOCKEVENTS
         help
diff --git a/arch/avr32/boards/atstk1000/atstk1002.c b/arch/avr32/boards/atstk1000/atstk1002.c
index dc5263321480..6c80aba7bf96 100644
--- a/arch/avr32/boards/atstk1000/atstk1002.c
+++ b/arch/avr32/boards/atstk1000/atstk1002.c
@@ -97,7 +97,7 @@ static struct atmel_nand_data atstk1006_nand_data __initdata = {
         .enable_pin     = GPIO_PIN_PB(29),
         .ecc_mode       = NAND_ECC_SOFT,
         .parts          = nand_partitions,
-        .num_parts      = ARRAY_SIZE(num_partitions),
+        .num_parts      = ARRAY_SIZE(nand_partitions),
 };
 #endif
 
diff --git a/arch/avr32/include/asm/unistd.h b/arch/avr32/include/asm/unistd.h
index f714544e5560..1358e366f4be 100644
--- a/arch/avr32/include/asm/unistd.h
+++ b/arch/avr32/include/asm/unistd.h
@@ -318,7 +318,6 @@
 /* SMP stuff */
 #define __IGNORE_getcpu
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
index f7040a1e399f..b92e60958617 100644
--- a/arch/avr32/mm/fault.c
+++ b/arch/avr32/mm/fault.c
@@ -61,10 +61,10 @@ asmlinkage void do_page_fault(unsigned long ecr, struct pt_regs *regs)
         const struct exception_table_entry *fixup;
         unsigned long address;
         unsigned long page;
-        int writeaccess;
         long signr;
         int code;
         int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
 
         if (notify_page_fault(regs, ecr))
                 return;
@@ -86,6 +86,7 @@ asmlinkage void do_page_fault(unsigned long ecr, struct pt_regs *regs)
 
         local_irq_enable();
 
+retry:
         down_read(&mm->mmap_sem);
 
         vma = find_vma(mm, address);
@@ -104,7 +105,6 @@ asmlinkage void do_page_fault(unsigned long ecr, struct pt_regs *regs)
          */
 good_area:
         code = SEGV_ACCERR;
-        writeaccess = 0;
 
         switch (ecr) {
         case ECR_PROTECTION_X:
@@ -121,7 +121,7 @@ good_area:
         case ECR_TLB_MISS_W:
                 if (!(vma->vm_flags & VM_WRITE))
                         goto bad_area;
-                writeaccess = 1;
+                flags |= FAULT_FLAG_WRITE;
                 break;
         default:
                 panic("Unhandled case %lu in do_page_fault!", ecr);
@@ -132,7 +132,11 @@ good_area:
          * sure we exit gracefully rather than endlessly redo the
          * fault.
          */
-        fault = handle_mm_fault(mm, vma, address, writeaccess ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
@@ -140,10 +144,23 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR)
-                tsk->maj_flt++;
-        else
-                tsk->min_flt++;
+
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR)
+                        tsk->maj_flt++;
+                else
+                        tsk->min_flt++;
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /*
+                         * No need to up_read(&mm->mmap_sem) as we would have
+                         * already released it in __lock_page_or_retry() in
+                         * mm/filemap.c.
+                         */
+                        goto retry;
+                }
+        }
 
         up_read(&mm->mmap_sem);
         return;
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index ec44fc6c34ca..f34861920634 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -33,6 +33,7 @@ config BLACKFIN
         select HAVE_PERF_EVENTS
         select ARCH_HAVE_CUSTOM_GPIO_H
         select ARCH_WANT_OPTIONAL_GPIOLIB
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_ATOMIC64
         select GENERIC_IRQ_PROBE
diff --git a/arch/blackfin/include/asm/unistd.h b/arch/blackfin/include/asm/unistd.h
index 3287222cba34..5b2a0748d7d3 100644
--- a/arch/blackfin/include/asm/unistd.h
+++ b/arch/blackfin/include/asm/unistd.h
@@ -434,7 +434,6 @@
 #define __IGNORE_getcpu
 
 #ifdef __KERNEL__
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index bb344650a14f..e92215428a37 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -42,6 +42,7 @@ config CRIS
         select HAVE_IDE
         select GENERIC_ATOMIC64
         select HAVE_GENERIC_HARDIRQS
+        select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_IRQ_SHOW
         select GENERIC_IOMAP
         select GENERIC_SMP_IDLE_THREAD if ETRAX_ARCH_V32
diff --git a/arch/cris/include/asm/unistd.h b/arch/cris/include/asm/unistd.h
index f921b8b0f97e..51873a446f87 100644
--- a/arch/cris/include/asm/unistd.h
+++ b/arch/cris/include/asm/unistd.h
@@ -347,7 +347,6 @@
 
 #include <arch/unistd.h>
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
 #define __ARCH_WANT_STAT64
diff --git a/arch/frv/Kconfig b/arch/frv/Kconfig
index a685910d2d5c..971c0a19facb 100644
--- a/arch/frv/Kconfig
+++ b/arch/frv/Kconfig
@@ -9,6 +9,7 @@ config FRV
         select GENERIC_IRQ_SHOW
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_CPU_DEVICES
+        select ARCH_WANT_IPC_PARSE_VERSION
 
 config ZONE_DMA
         bool
diff --git a/arch/frv/include/asm/unistd.h b/arch/frv/include/asm/unistd.h
index a569dff7cd59..67f23a311db6 100644
--- a/arch/frv/include/asm/unistd.h
+++ b/arch/frv/include/asm/unistd.h
@@ -349,7 +349,6 @@
 
 #define NR_syscalls 338
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 /* #define __ARCH_WANT_OLD_READDIR */
 #define __ARCH_WANT_OLD_STAT
 #define __ARCH_WANT_STAT64
diff --git a/arch/frv/kernel/kernel_thread.S b/arch/frv/kernel/kernel_thread.S
index 4531c830d20b..f0e52943f923 100644
--- a/arch/frv/kernel/kernel_thread.S
+++ b/arch/frv/kernel/kernel_thread.S
@@ -10,10 +10,10 @@
  */
 
 #include <linux/linkage.h>
+#include <linux/kern_levels.h>
 #include <asm/unistd.h>
 
 #define CLONE_VM        0x00000100      /* set if VM shared between processes */
-#define KERN_ERR        "<3>"
 
         .section .rodata
 kernel_thread_emsg:
diff --git a/arch/h8300/Kconfig b/arch/h8300/Kconfig
index 56e890df5053..5e8a0d9a09ce 100644
--- a/arch/h8300/Kconfig
+++ b/arch/h8300/Kconfig
@@ -3,6 +3,7 @@ config H8300
         default y
         select HAVE_IDE
         select HAVE_GENERIC_HARDIRQS
+        select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_IRQ_SHOW
         select GENERIC_CPU_DEVICES
 
diff --git a/arch/h8300/include/asm/unistd.h b/arch/h8300/include/asm/unistd.h
index 718511303b4e..5cd882801d79 100644
--- a/arch/h8300/include/asm/unistd.h
+++ b/arch/h8300/include/asm/unistd.h
@@ -331,7 +331,6 @@
 
 #define NR_syscalls 321
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
 #define __ARCH_WANT_STAT64
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index b638d5bfa14d..49498bbb9616 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -7,6 +7,7 @@ config M32R
         select HAVE_KERNEL_GZIP
         select HAVE_KERNEL_BZIP2
         select HAVE_KERNEL_LZMA
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
diff --git a/arch/m32r/include/asm/unistd.h b/arch/m32r/include/asm/unistd.h
index 3e1db561aacc..d5e66a480782 100644
--- a/arch/m32r/include/asm/unistd.h
+++ b/arch/m32r/include/asm/unistd.h
@@ -336,7 +336,6 @@
 
 #define NR_syscalls 326
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 147120128260..0b0f8b8c4a26 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -10,6 +10,7 @@ config M68K
         select GENERIC_STRNCPY_FROM_USER if MMU
         select GENERIC_STRNLEN_USER if MMU
         select FPU if MMU
+        select ARCH_WANT_IPC_PARSE_VERSION
         select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE
 
 config RWSEM_GENERIC_SPINLOCK
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index ea0b502f845e..045cfd6a9e31 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -357,7 +357,6 @@
 
 #define NR_syscalls             347
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
 #define __ARCH_WANT_STAT64
diff --git a/arch/microblaze/Kconfig b/arch/microblaze/Kconfig
index 0bf44231aaf9..ab9afcaa7f6a 100644
--- a/arch/microblaze/Kconfig
+++ b/arch/microblaze/Kconfig
@@ -15,6 +15,7 @@ config MICROBLAZE
         select TRACING_SUPPORT
         select OF
         select OF_EARLY_FLATTREE
+        select ARCH_WANT_IPC_PARSE_VERSION
         select IRQ_DOMAIN
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_PROBE
diff --git a/arch/microblaze/include/asm/unistd.h b/arch/microblaze/include/asm/unistd.h
index d20ffbc86beb..6985e6e9d826 100644
--- a/arch/microblaze/include/asm/unistd.h
+++ b/arch/microblaze/include/asm/unistd.h
@@ -400,7 +400,6 @@
 #ifdef __KERNEL__
 #ifndef __ASSEMBLY__
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 /* #define __ARCH_WANT_OLD_READDIR */
 /* #define __ARCH_WANT_OLD_STAT */
 #define __ARCH_WANT_STAT64
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 750429018534..e3efc06e6409 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -20,12 +20,14 @@ config MIPS
         select ARCH_BINFMT_ELF_RANDOMIZE_PIE
         select RTC_LIB if !MACH_LOONGSON
         select GENERIC_ATOMIC64 if !64BIT
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_DMA_ATTRS
         select HAVE_DMA_API_DEBUG
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_PROBE
         select GENERIC_IRQ_SHOW
         select HAVE_ARCH_JUMP_LABEL
+        select ARCH_WANT_IPC_PARSE_VERSION
         select IRQ_FORCED_THREADING
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index d8dad5340ea3..bebbde01be92 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -1034,7 +1034,6 @@
 #ifndef __ASSEMBLY__
 
 #define __ARCH_OMIT_COMPAT_SYS_GETDENTS64
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index 687f9b4a2ed6..5cfb086b3903 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -3,6 +3,7 @@ config MN10300
         select HAVE_OPROFILE
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_SHOW
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_ARCH_TRACEHOOK
         select HAVE_ARCH_KGDB
         select HAVE_NMI_WATCHDOG if MN10300_WD_TIMER
diff --git a/arch/mn10300/include/asm/unistd.h b/arch/mn10300/include/asm/unistd.h
index 9051f921cbc7..866eb14749d7 100644
--- a/arch/mn10300/include/asm/unistd.h
+++ b/arch/mn10300/include/asm/unistd.h
@@ -358,7 +358,6 @@
 /*
  * specify the deprecated syscalls we want to support on this arch
  */
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_OLD_STAT
 #define __ARCH_WANT_STAT64
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 9a5d3cdc3e12..352f416269ce 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -115,11 +115,13 @@ config PPC
         select HAVE_OPROFILE
         select HAVE_SYSCALL_WRAPPERS if PPC64
         select GENERIC_ATOMIC64 if PPC32
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_IRQ_WORK
         select HAVE_PERF_EVENTS
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_HW_BREAKPOINT if PERF_EVENTS && PPC_BOOK3S_64
         select HAVE_GENERIC_HARDIRQS
+        select ARCH_WANT_IPC_PARSE_VERSION
         select SPARSE_IRQ
         select IRQ_PER_CPU
         select IRQ_DOMAIN
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index d3d1b5efd7eb..bd377a368611 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -389,7 +389,6 @@
 #include <linux/compiler.h>
 #include <linux/linkage.h>
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_ALARM
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index a39b4690c171..296cd32466df 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -85,6 +85,7 @@ config S390
         select HAVE_ARCH_MUTEX_CPU_RELAX
         select HAVE_ARCH_JUMP_LABEL if !MARCH_G5
         select ARCH_SAVE_PAGE_KEYS if HIBERNATION
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select HAVE_MEMBLOCK
         select HAVE_MEMBLOCK_NODE_MAP
         select HAVE_CMPXCHG_LOCAL
@@ -117,6 +118,7 @@ config S390
         select ARCH_INLINE_WRITE_UNLOCK_BH
         select ARCH_INLINE_WRITE_UNLOCK_IRQ
         select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
+        select ARCH_WANT_IPC_PARSE_VERSION
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_TIME_VSYSCALL
         select GENERIC_CLOCKEVENTS
diff --git a/arch/s390/include/asm/unistd.h b/arch/s390/include/asm/unistd.h
index 2e37157ba6a9..6756e78f4808 100644
--- a/arch/s390/include/asm/unistd.h
+++ b/arch/s390/include/asm/unistd.h
@@ -388,7 +388,6 @@
 #define __IGNORE_recvmmsg
 #define __IGNORE_sendmmsg
 
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_SYS_ALARM
 #define __ARCH_WANT_SYS_GETHOSTNAME
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index a24595d83ad6..36f5141e8041 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -21,6 +21,7 @@ config SUPERH
         select HAVE_KERNEL_LZMA
         select HAVE_KERNEL_XZ
         select HAVE_KERNEL_LZO
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_SYSCALL_TRACEPOINTS
         select HAVE_REGS_AND_STACK_ACCESS_API
         select HAVE_GENERIC_HARDIRQS
@@ -50,6 +51,7 @@ config SUPERH32
         select HAVE_DYNAMIC_FTRACE
         select HAVE_FUNCTION_TRACE_MCOUNT_TEST
         select HAVE_FTRACE_NMI_ENTER if DYNAMIC_FTRACE
+        select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_ARCH_KGDB
         select HAVE_HW_BREAKPOINT
diff --git a/arch/sh/include/asm/unistd.h b/arch/sh/include/asm/unistd.h
index e800a38c9f8d..7bc67076baac 100644
--- a/arch/sh/include/asm/unistd.h
+++ b/arch/sh/include/asm/unistd.h
@@ -6,7 +6,6 @@
 # endif
 
 # define __ARCH_WANT_SYS_RT_SIGSUSPEND
-# define __ARCH_WANT_IPC_PARSE_VERSION
 # define __ARCH_WANT_OLD_READDIR
 # define __ARCH_WANT_OLD_STAT
 # define __ARCH_WANT_STAT64
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index e74ff1377626..67f1f6f5f4e1 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -27,6 +27,7 @@ config SPARC
         select HAVE_ARCH_JUMP_LABEL
         select HAVE_GENERIC_HARDIRQS
         select GENERIC_IRQ_SHOW
+        select ARCH_WANT_IPC_PARSE_VERSION
         select USE_GENERIC_SMP_HELPERS if SMP
         select GENERIC_PCI_IOMAP
         select HAVE_NMI_WATCHDOG if SPARC64
diff --git a/arch/sparc/include/asm/unistd.h b/arch/sparc/include/asm/unistd.h
index c7cb0af0eb59..fb2693464807 100644
--- a/arch/sparc/include/asm/unistd.h
+++ b/arch/sparc/include/asm/unistd.h
@@ -423,7 +423,6 @@
 #endif
 
 #ifdef __KERNEL__
-#define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
 #define __ARCH_WANT_STAT64
 #define __ARCH_WANT_SYS_ALARM
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index c38e5aaae56f..0dc1f5786081 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -470,7 +470,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
                 switch (call) {
                 case SHMAT: {
                         ulong raddr;
-                        err = do_shmat(first, ptr, (int)second, &raddr);
+                        err = do_shmat(first, ptr, (int)second, &raddr, SHMLBA);
                         if (!err) {
                                 if (put_user(raddr,
                                              (ulong __user *) third))
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index c70684f859e1..ba2657c49217 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -70,6 +70,7 @@ config X86
         select HAVE_ARCH_JUMP_LABEL
         select HAVE_TEXT_POKE_SMP
         select HAVE_GENERIC_HARDIRQS
+        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         select SPARSE_IRQ
         select GENERIC_FIND_FIRST_BIT
         select GENERIC_IRQ_PROBE
@@ -84,6 +85,7 @@ config X86
         select GENERIC_IOMAP
         select DCACHE_WORD_ACCESS
         select GENERIC_SMP_IDLE_THREAD
+        select ARCH_WANT_IPC_PARSE_VERSION if X86_32
         select HAVE_ARCH_SECCOMP_FILTER
         select BUILDTIME_EXTABLE_SORT
         select GENERIC_CMOS_UPDATE
diff --git a/arch/x86/include/asm/unistd.h b/arch/x86/include/asm/unistd.h
index 4437001d8e3d..0d9776e9e2dc 100644
--- a/arch/x86/include/asm/unistd.h
+++ b/arch/x86/include/asm/unistd.h
@@ -15,7 +15,6 @@
 # ifdef CONFIG_X86_32
 
 #  include <asm/unistd_32.h>
-#  define __ARCH_WANT_IPC_PARSE_VERSION
 #  define __ARCH_WANT_STAT64
 #  define __ARCH_WANT_SYS_IPC
 #  define __ARCH_WANT_SYS_OLD_MMAP
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 41857970517f..ed858e9e9a74 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -944,7 +944,7 @@ void __init e820_reserve_resources(void)
         for (i = 0; i < e820_saved.nr_map; i++) {
                 struct e820entry *entry = &e820_saved.map[i];
                 firmware_map_add_early(entry->addr,
-                        entry->addr + entry->size - 1,
+                        entry->addr + entry->size,
                         e820_type_to_string(entry->type));
         }
 }
diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c
index 816e6d0d686c..05b3f093d5d7 100644
--- a/arch/xtensa/kernel/syscall.c
+++ b/arch/xtensa/kernel/syscall.c
@@ -44,7 +44,7 @@ asmlinkage long xtensa_shmat(int shmid, char __user *shmaddr, int shmflg)
         unsigned long ret;
         long err;
 
-        err = do_shmat(shmid, shmaddr, shmflg, &ret);
+        err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
         if (err)
                 return err;
         return (long)ret;
diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
index b17885a0b508..5a74c53bc69c 100644
--- a/arch/xtensa/mm/fault.c
+++ b/arch/xtensa/mm/fault.c
@@ -44,6 +44,7 @@ void do_page_fault(struct pt_regs *regs)
 
         int is_write, is_exec;
         int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
 
         info.si_code = SEGV_MAPERR;
 
@@ -71,6 +72,7 @@ void do_page_fault(struct pt_regs *regs)
                address, exccause, regs->pc, is_write? "w":"", is_exec? "x":"");
 #endif
 
+retry:
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
 
@@ -93,6 +95,7 @@ good_area:
         if (is_write) {
                 if (!(vma->vm_flags & VM_WRITE))
                         goto bad_area;
+                flags |= FAULT_FLAG_WRITE;
         } else if (is_exec) {
                 if (!(vma->vm_flags & VM_EXEC))
                         goto bad_area;
@@ -104,7 +107,11 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.
          */
-        fault = handle_mm_fault(mm, vma, address, is_write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
                         goto out_of_memory;
@@ -112,10 +119,22 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR)
-                current->maj_flt++;
-        else
-                current->min_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR)
+                        current->maj_flt++;
+                else
+                        current->min_flt++;
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                         /* No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
+        }
 
         up_read(&mm->mmap_sem);
         return;
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index ac6a5beb28f3..bfaa5cb1629a 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -184,10 +184,8 @@
 struct arasan_cf_dev {
         /* pointer to ata_host structure */
         struct ata_host *host;
-        /* clk structure, only if HAVE_CLK is defined */
-#ifdef CONFIG_HAVE_CLK
+        /* clk structure */
         struct clk *clk;
-#endif
 
         /* physical base address of controller */
         dma_addr_t pbase;
@@ -312,13 +310,11 @@ static int cf_init(struct arasan_cf_dev *acdev)
         unsigned long flags;
         int ret = 0;
 
-#ifdef CONFIG_HAVE_CLK
         ret = clk_enable(acdev->clk);
         if (ret) {
                 dev_dbg(acdev->host->dev, "clock enable failed");
                 return ret;
         }
-#endif
 
         spin_lock_irqsave(&acdev->host->lock, flags);
         /* configure CF interface clock */
@@ -344,9 +340,7 @@ static void cf_exit(struct arasan_cf_dev *acdev)
         writel(readl(acdev->vbase + OP_MODE) & ~CFHOST_ENB,
                         acdev->vbase + OP_MODE);
         spin_unlock_irqrestore(&acdev->host->lock, flags);
-#ifdef CONFIG_HAVE_CLK
         clk_disable(acdev->clk);
-#endif
 }
 
 static void dma_callback(void *dev)
@@ -828,13 +822,11 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
-#ifdef CONFIG_HAVE_CLK
         acdev->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(acdev->clk)) {
                 dev_warn(&pdev->dev, "Clock not found\n");
                 return PTR_ERR(acdev->clk);
         }
-#endif
 
         /* allocate host */
         host = ata_host_alloc(&pdev->dev, 1);
@@ -899,9 +891,7 @@ static int __devinit arasan_cf_probe(struct platform_device *pdev)
                         &arasan_cf_sht);
 
 free_clk:
-#ifdef CONFIG_HAVE_CLK
         clk_put(acdev->clk);
-#endif
         return ret;
 }
 
@@ -912,9 +902,7 @@ static int __devexit arasan_cf_remove(struct platform_device *pdev)
 
         ata_host_detach(host);
         cf_exit(acdev);
-#ifdef CONFIG_HAVE_CLK
         clk_put(acdev->clk);
-#endif
 
         return 0;
 }
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 3f99b9099658..7f0b5ca78516 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -25,7 +25,6 @@ menu "Common Clock Framework"
 
 config COMMON_CLK_DEBUG
         bool "DebugFS representation of clock tree"
-        depends on COMMON_CLK
         select DEBUG_FS
         ---help---
           Creates a directory hierchy in debugfs for visualizing the clk
diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
index c87fdd710560..efdfd009c270 100644
--- a/drivers/clk/clk.c
+++ b/drivers/clk/clk.c
@@ -465,6 +465,9 @@ static void __clk_disable(struct clk *clk)
         if (!clk)
                 return;
 
+        if (WARN_ON(IS_ERR(clk)))
+                return;
+
         if (WARN_ON(clk->enable_count == 0))
                 return;
 
diff --git a/drivers/firmware/memmap.c b/drivers/firmware/memmap.c
index adc07102a20d..c1cdc9236666 100644
--- a/drivers/firmware/memmap.c
+++ b/drivers/firmware/memmap.c
@@ -98,7 +98,7 @@ static LIST_HEAD(map_entries);
 /**
  * firmware_map_add_entry() - Does the real work to add a firmware memmap entry.
  * @start: Start of the memory range.
- * @end:   End of the memory range (inclusive).
+ * @end:   End of the memory range (exclusive).
  * @type:  Type of the memory range.
  * @entry: Pre-allocated (either kmalloc() or bootmem allocator), uninitialised
  *         entry.
@@ -113,7 +113,7 @@ static int firmware_map_add_entry(u64 start, u64 end,
         BUG_ON(start > end);
 
         entry->start = start;
-        entry->end = end;
+        entry->end = end - 1;
         entry->type = type;
         INIT_LIST_HEAD(&entry->list);
         kobject_init(&entry->kobj, &memmap_ktype);
@@ -148,7 +148,7 @@ static int add_sysfs_fw_map_entry(struct firmware_map_entry *entry)
  * firmware_map_add_hotplug() - Adds a firmware mapping entry when we do
  * memory hotplug.
  * @start: Start of the memory range.
- * @end:   End of the memory range (inclusive).
+ * @end:   End of the memory range (exclusive)
  * @type:  Type of the memory range.
  *
  * Adds a firmware mapping entry. This function is for memory hotplug, it is
@@ -175,7 +175,7 @@ int __meminit firmware_map_add_hotplug(u64 start, u64 end, const char *type)
 /**
  * firmware_map_add_early() - Adds a firmware mapping entry.
  * @start: Start of the memory range.
- * @end:   End of the memory range (inclusive).
+ * @end:   End of the memory range.
  * @type:  Type of the memory range.
  *
  * Adds a firmware mapping entry. This function uses the bootmem allocator
diff --git a/drivers/firmware/pcdp.c b/drivers/firmware/pcdp.c
index 51e0e2d8fac6..a330492e06f9 100644
--- a/drivers/firmware/pcdp.c
+++ b/drivers/firmware/pcdp.c
@@ -95,7 +95,7 @@ efi_setup_pcdp_console(char *cmdline)
         if (efi.hcdp == EFI_INVALID_TABLE_ADDR)
                 return -ENODEV;
 
-        pcdp = ioremap(efi.hcdp, 4096);
+        pcdp = early_ioremap(efi.hcdp, 4096);
         printk(KERN_INFO "PCDP: v%d at 0x%lx\n", pcdp->rev, efi.hcdp);
 
         if (strstr(cmdline, "console=hcdp")) {
@@ -131,6 +131,6 @@ efi_setup_pcdp_console(char *cmdline)
         }
 
 out:
-        iounmap(pcdp);
+        early_iounmap(pcdp, 4096);
         return rc;
 }
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index a997c7d3f95d..1034d93fb838 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -41,13 +41,6 @@
 
 #include <asm/irq.h>
 
-#ifndef CONFIG_HAVE_CLK
-#define clk_get(dev, id)        NULL
-#define clk_put(clk)            do { } while (0)
-#define clk_disable(clk)        do { } while (0)
-#define clk_enable(clk)         do { } while (0)
-#endif
-
 struct pxa_reg_layout {
         u32 ibmr;
         u32 idbr;
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 65ebaebf502b..627d19186d5a 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -571,16 +571,6 @@ static void disk_dtr(struct dm_dirty_log *log)
         destroy_log_context(lc);
 }
 
-static int count_bits32(uint32_t *addr, unsigned size)
-{
-        int count = 0, i;
-
-        for (i = 0; i < size; i++) {
-                count += hweight32(*(addr+i));
-        }
-        return count;
-}
-
 static void fail_log_device(struct log_c *lc)
 {
         if (lc->log_dev_failed)
@@ -629,7 +619,8 @@ static int disk_resume(struct dm_dirty_log *log)
 
         /* copy clean across to sync */
         memcpy(lc->sync_bits, lc->clean_bits, size);
-        lc->sync_count = count_bits32(lc->clean_bits, lc->bitset_uint32_count);
+        lc->sync_count = memweight(lc->clean_bits,
+                                lc->bitset_uint32_count * sizeof(uint32_t));
         lc->sync_search = 0;
 
         /* set the correct number of regions in the header */
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index af26bbe6f76e..f7061a5ef1d2 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -2083,7 +2083,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
         /* Walk the entities list and instantiate controls */
         list_for_each_entry(entity, &dev->entities, list) {
                 struct uvc_control *ctrl;
-                unsigned int bControlSize = 0, ncontrols = 0;
+                unsigned int bControlSize = 0, ncontrols;
                 __u8 *bmControls = NULL;
 
                 if (UVC_ENTITY_TYPE(entity) == UVC_VC_EXTENSION_UNIT) {
@@ -2101,8 +2101,7 @@ int uvc_ctrl_init_device(struct uvc_device *dev)
                 uvc_ctrl_prune_entity(dev, entity);
 
                 /* Count supported controls and allocate the controls array */
-                for (i = 0; i < bControlSize; ++i)
-                        ncontrols += hweight8(bmControls[i]);
+                ncontrols = memweight(bmControls, bControlSize);
                 if (ncontrols == 0)
                         continue;
 
diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index 098de2b35784..9a49c243a6ac 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -188,6 +188,13 @@ static int i2o_cfg_parms(unsigned long arg, unsigned int type)
         if (!dev)
                 return -ENXIO;
 
+        /*
+         * Stop users being able to try and allocate arbitary amounts
+         * of DMA space. 64K is way more than sufficient for this.
+         */
+        if (kcmd.oplen > 65536)
+                return -EMSGSIZE;
+
         ops = memdup_user(kcmd.opbuf, kcmd.oplen);
         if (IS_ERR(ops))
                 return PTR_ERR(ops);
diff --git a/drivers/message/i2o/i2o_proc.c b/drivers/message/i2o/i2o_proc.c
index 506c36f6e1db..8001aa6bfb48 100644
--- a/drivers/message/i2o/i2o_proc.c
+++ b/drivers/message/i2o/i2o_proc.c
@@ -255,9 +255,8 @@ static char *scsi_devices[] = {
         "Array Controller Device"
 };
 
-static char *chtostr(u8 * chars, int n)
+static char *chtostr(char *tmp, u8 *chars, int n)
 {
-        char tmp[256];
         tmp[0] = 0;
         return strncat(tmp, (char *)chars, n);
 }
@@ -791,6 +790,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
         } *result;
 
         i2o_exec_execute_ddm_table ddm_table;
+        char tmp[28 + 1];
 
         result = kmalloc(sizeof(*result), GFP_KERNEL);
         if (!result)
@@ -826,7 +826,7 @@ static int i2o_seq_show_ddm_table(struct seq_file *seq, void *v)
                 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
                 seq_printf(seq, "%-#8x", ddm_table.module_id);
                 seq_printf(seq, "%-29s",
-                           chtostr(ddm_table.module_name_version, 28));
+                           chtostr(tmp, ddm_table.module_name_version, 28));
                 seq_printf(seq, "%9d  ", ddm_table.data_size);
                 seq_printf(seq, "%8d", ddm_table.code_size);
 
@@ -893,6 +893,7 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
 
         i2o_driver_result_table *result;
         i2o_driver_store_table *dst;
+        char tmp[28 + 1];
 
         result = kmalloc(sizeof(i2o_driver_result_table), GFP_KERNEL);
         if (result == NULL)
@@ -927,8 +928,9 @@ static int i2o_seq_show_drivers_stored(struct seq_file *seq, void *v)
 
                 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
                 seq_printf(seq, "%-#8x", dst->module_id);
-                seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
-                seq_printf(seq, "%-9s", chtostr(dst->date, 8));
+                seq_printf(seq, "%-29s",
+                           chtostr(tmp, dst->module_name_version, 28));
+                seq_printf(seq, "%-9s", chtostr(tmp, dst->date, 8));
                 seq_printf(seq, "%8d ", dst->module_size);
                 seq_printf(seq, "%8d ", dst->mpb_size);
                 seq_printf(seq, "0x%04x", dst->module_flags);
@@ -1248,6 +1250,7 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
         // == (allow) 512d bytes (max)
         static u16 *work16 = (u16 *) work32;
         int token;
+        char tmp[16 + 1];
 
         token = i2o_parm_field_get(d, 0xF100, -1, &work32, sizeof(work32));
 
@@ -1260,13 +1263,13 @@ static int i2o_seq_show_dev_identity(struct seq_file *seq, void *v)
         seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
         seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
         seq_printf(seq, "Vendor info   : %s\n",
-                   chtostr((u8 *) (work32 + 2), 16));
+                   chtostr(tmp, (u8 *) (work32 + 2), 16));
         seq_printf(seq, "Product info  : %s\n",
-                   chtostr((u8 *) (work32 + 6), 16));
+                   chtostr(tmp, (u8 *) (work32 + 6), 16));
         seq_printf(seq, "Description   : %s\n",
-                   chtostr((u8 *) (work32 + 10), 16));
+                   chtostr(tmp, (u8 *) (work32 + 10), 16));
         seq_printf(seq, "Product rev.  : %s\n",
-                   chtostr((u8 *) (work32 + 14), 8));
+                   chtostr(tmp, (u8 *) (work32 + 14), 8));
 
         seq_printf(seq, "Serial number : ");
         print_serial_number(seq, (u8 *) (work32 + 16),
@@ -1303,6 +1306,8 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
                 u8 pad[256];    // allow up to 256 byte (max) serial number
         } result;
 
+        char tmp[24 + 1];
+
         token = i2o_parm_field_get(d, 0xF101, -1, &result, sizeof(result));
 
         if (token < 0) {
@@ -1312,9 +1317,9 @@ static int i2o_seq_show_ddm_identity(struct seq_file *seq, void *v)
 
         seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
         seq_printf(seq, "Module name         : %s\n",
-                   chtostr(result.module_name, 24));
+                   chtostr(tmp, result.module_name, 24));
         seq_printf(seq, "Module revision     : %s\n",
-                   chtostr(result.module_rev, 8));
+                   chtostr(tmp, result.module_rev, 8));
 
         seq_printf(seq, "Serial number       : ");
         print_serial_number(seq, result.serial_number, sizeof(result) - 36);
@@ -1338,6 +1343,8 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
                 u8 instance_number[4];
         } result;
 
+        char tmp[64 + 1];
+
         token = i2o_parm_field_get(d, 0xF102, -1, &result, sizeof(result));
 
         if (token < 0) {
@@ -1346,13 +1353,13 @@ static int i2o_seq_show_uinfo(struct seq_file *seq, void *v)
         }
 
         seq_printf(seq, "Device name     : %s\n",
-                   chtostr(result.device_name, 64));
+                   chtostr(tmp, result.device_name, 64));
         seq_printf(seq, "Service name    : %s\n",
-                   chtostr(result.service_name, 64));
+                   chtostr(tmp, result.service_name, 64));
         seq_printf(seq, "Physical name   : %s\n",
-                   chtostr(result.physical_location, 64));
+                   chtostr(tmp, result.physical_location, 64));
         seq_printf(seq, "Instance number : %s\n",
-                   chtostr(result.instance_number, 4));
+                   chtostr(tmp, result.instance_number, 4));
 
         return 0;
 }
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 28adefe70f96..08aad69c8da4 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -477,6 +477,8 @@ static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
         int i, n, out;
 
         buf = (char *)__get_free_page(GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
 
         n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
         for (i = 0; i < ARRAY_SIZE(cp_type); i++)
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 2b62232c2c6a..acfaeeb9e01a 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -349,6 +349,11 @@ void st_int_recv(void *disc_data,
                         st_gdata->rx_skb = alloc_skb(
                                         st_gdata->list[type]->max_frame_size,
                                         GFP_ATOMIC);
+                        if (st_gdata->rx_skb == NULL) {
+                                pr_err("out of memory: dropping\n");
+                                goto done;
+                        }
+
                         skb_reserve(st_gdata->rx_skb,
                                         st_gdata->list[type]->reserve);
                         /* next 2 required for BT only */
diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c
index f0921d16f0a9..6ff7ad006c30 100644
--- a/drivers/net/can/c_can/c_can_platform.c
+++ b/drivers/net/can/c_can/c_can_platform.c
@@ -74,7 +74,6 @@ static int __devinit c_can_plat_probe(struct platform_device *pdev)
         const struct platform_device_id *id;
         struct resource *mem;
         int irq;
-#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
 
         /* get the appropriate clk */
@@ -84,7 +83,6 @@ static int __devinit c_can_plat_probe(struct platform_device *pdev)
                 ret = -ENODEV;
                 goto exit;
         }
-#endif
 
         /* get the platform data */
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
@@ -145,10 +143,8 @@ static int __devinit c_can_plat_probe(struct platform_device *pdev)
 
         dev->irq = irq;
         priv->base = addr;
-#ifdef CONFIG_HAVE_CLK
         priv->can.clock.freq = clk_get_rate(clk);
         priv->priv = clk;
-#endif
 
         platform_set_drvdata(pdev, dev);
         SET_NETDEV_DEV(dev, &pdev->dev);
@@ -172,10 +168,8 @@ exit_iounmap:
 exit_release_mem:
         release_mem_region(mem->start, resource_size(mem));
 exit_free_clk:
-#ifdef CONFIG_HAVE_CLK
         clk_put(clk);
 exit:
-#endif
         dev_err(&pdev->dev, "probe failed\n");
 
         return ret;
@@ -196,9 +190,7 @@ static int __devexit c_can_plat_remove(struct platform_device *pdev)
         mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         release_mem_region(mem->start, resource_size(mem));
 
-#ifdef CONFIG_HAVE_CLK
         clk_put(priv->priv);
-#endif
 
         return 0;
 }
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index ab4c376cb276..f2d3665430ad 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -82,9 +82,7 @@ struct stmmac_priv {
         struct stmmac_counters mmc;
         struct dma_features dma_cap;
         int hw_cap_support;
-#ifdef CONFIG_HAVE_CLK
         struct clk *stmmac_clk;
-#endif
         int clk_csr;
         int synopsys_id;
         struct timer_list eee_ctrl_timer;
@@ -113,46 +111,6 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 void stmmac_disable_eee_mode(struct stmmac_priv *priv);
 bool stmmac_eee_init(struct stmmac_priv *priv);
 
-#ifdef CONFIG_HAVE_CLK
-static inline int stmmac_clk_enable(struct stmmac_priv *priv)
-{
-        if (!IS_ERR(priv->stmmac_clk))
-                return clk_prepare_enable(priv->stmmac_clk);
-
-        return 0;
-}
-
-static inline void stmmac_clk_disable(struct stmmac_priv *priv)
-{
-        if (IS_ERR(priv->stmmac_clk))
-                return;
-
-        clk_disable_unprepare(priv->stmmac_clk);
-}
-static inline int stmmac_clk_get(struct stmmac_priv *priv)
-{
-        priv->stmmac_clk = clk_get(priv->device, NULL);
-
-        if (IS_ERR(priv->stmmac_clk))
-                return PTR_ERR(priv->stmmac_clk);
-
-        return 0;
-}
-#else
-static inline int stmmac_clk_enable(struct stmmac_priv *priv)
-{
-        return 0;
-}
-static inline void stmmac_clk_disable(struct stmmac_priv *priv)
-{
-}
-static inline int stmmac_clk_get(struct stmmac_priv *priv)
-{
-        return 0;
-}
-#endif /* CONFIG_HAVE_CLK */
-
-
 #ifdef CONFIG_STMMAC_PLATFORM
 extern struct platform_driver stmmac_pltfr_driver;
 static inline int stmmac_register_platform(void)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f6b04c1a3672..fd8882f9602a 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -28,6 +28,7 @@
         https://bugzilla.stlinux.com/
 *******************************************************************************/
 
+#include <linux/clk.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/ip.h>
@@ -173,12 +174,8 @@ static void stmmac_verify_args(void)
 
 static void stmmac_clk_csr_set(struct stmmac_priv *priv)
 {
-#ifdef CONFIG_HAVE_CLK
         u32 clk_rate;
 
-        if (IS_ERR(priv->stmmac_clk))
-                return;
-
         clk_rate = clk_get_rate(priv->stmmac_clk);
 
         /* Platform provided default clk_csr would be assumed valid
@@ -200,7 +197,6 @@ static void stmmac_clk_csr_set(struct stmmac_priv *priv)
            * we can not estimate the proper divider as it is not known
            * the frequency of clk_csr_i. So we do not change the default
            * divider. */
-#endif
 }
 
 #if defined(STMMAC_XMIT_DEBUG) || defined(STMMAC_RX_DEBUG)
@@ -1070,7 +1066,7 @@ static int stmmac_open(struct net_device *dev)
         } else
                 priv->tm->enable = 1;
 #endif
-        stmmac_clk_enable(priv);
+        clk_enable(priv->stmmac_clk);
 
         stmmac_check_ether_addr(priv);
 
@@ -1192,7 +1188,7 @@ open_error:
         if (priv->phydev)
                 phy_disconnect(priv->phydev);
 
-        stmmac_clk_disable(priv);
+        clk_disable(priv->stmmac_clk);
 
         return ret;
 }
@@ -1250,7 +1246,7 @@ static int stmmac_release(struct net_device *dev)
 #ifdef CONFIG_STMMAC_DEBUG_FS
         stmmac_exit_fs();
 #endif
-        stmmac_clk_disable(priv);
+        clk_disable(priv->stmmac_clk);
 
         return 0;
 }
@@ -2078,11 +2074,14 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
         ret = register_netdev(ndev);
         if (ret) {
                 pr_err("%s: ERROR %i registering the device\n", __func__, ret);
-                goto error;
+                goto error_netdev_register;
         }
 
-        if (stmmac_clk_get(priv))
+        priv->stmmac_clk = clk_get(priv->device, NULL);
+        if (IS_ERR(priv->stmmac_clk)) {
                 pr_warning("%s: warning: cannot get CSR clock\n", __func__);
+                goto error_clk_get;
+        }
 
         /* If a specific clk_csr value is passed from the platform
          * this means that the CSR Clock Range selection cannot be
@@ -2100,15 +2099,17 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
         if (ret < 0) {
                 pr_debug("%s: MDIO bus (id: %d) registration failed",
                          __func__, priv->plat->bus_id);
-                goto error;
+                goto error_mdio_register;
         }
 
         return priv;
 
-error:
-        netif_napi_del(&priv->napi);
-
+error_mdio_register:
+        clk_put(priv->stmmac_clk);
+error_clk_get:
         unregister_netdev(ndev);
+error_netdev_register:
+        netif_napi_del(&priv->napi);
         free_netdev(ndev);
 
         return NULL;
@@ -2177,7 +2178,7 @@ int stmmac_suspend(struct net_device *ndev)
         else {
                 stmmac_set_mac(priv->ioaddr, false);
                 /* Disable clock in case of PWM is off */
-                stmmac_clk_disable(priv);
+                clk_disable(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
         return 0;
@@ -2202,7 +2203,7 @@ int stmmac_resume(struct net_device *ndev)
                 priv->hw->mac->pmt(priv->ioaddr, 0);
         else
                 /* enable the clk prevously disabled */
-                stmmac_clk_enable(priv);
+                clk_enable(priv->stmmac_clk);
 
         netif_device_attach(ndev);
 
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 98fbe62694d4..e771487132f7 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -327,8 +327,10 @@ int pps_register_cdev(struct pps_device *pps)
         }
         pps->dev = device_create(pps_class, pps->info.dev, devt, pps,
                                                         "pps%d", pps->id);
-        if (IS_ERR(pps->dev))
+        if (IS_ERR(pps->dev)) {
+                err = PTR_ERR(pps->dev);
                 goto del_cdev;
+        }
 
         pps->dev->release = pps_device_destruct;
 
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index f049c02413ce..fabc99a75c65 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -704,6 +704,7 @@ config RTC_DRV_AB3100
 config RTC_DRV_AB8500
         tristate "ST-Ericsson AB8500 RTC"
         depends on AB8500_CORE
+        select RTC_INTF_DEV_UIE_EMUL
         help
           Select this to enable the ST-Ericsson AB8500 power management IC RTC
           support. This chip contains a battery- and capacitor-backed RTC.
diff --git a/drivers/rtc/rtc-ab8500.c b/drivers/rtc/rtc-ab8500.c
index 370889d0489b..bf3c2f669c3c 100644
--- a/drivers/rtc/rtc-ab8500.c
+++ b/drivers/rtc/rtc-ab8500.c
@@ -89,22 +89,17 @@ static int ab8500_rtc_read_time(struct device *dev, struct rtc_time *tm)
         if (retval < 0)
                 return retval;
 
-        /* Early AB8500 chips will not clear the rtc read request bit */
-        if (abx500_get_chip_id(dev) == 0) {
-                usleep_range(1000, 1000);
-        } else {
-                /* Wait for some cycles after enabling the rtc read in ab8500 */
-                while (time_before(jiffies, timeout)) {
-                        retval = abx500_get_register_interruptible(dev,
-                                AB8500_RTC, AB8500_RTC_READ_REQ_REG, &value);
-                        if (retval < 0)
-                                return retval;
-
-                        if (!(value & RTC_READ_REQUEST))
-                                break;
-
-                        usleep_range(1000, 5000);
-                }
+        /* Wait for some cycles after enabling the rtc read in ab8500 */
+        while (time_before(jiffies, timeout)) {
+                retval = abx500_get_register_interruptible(dev,
+                        AB8500_RTC, AB8500_RTC_READ_REQ_REG, &value);
+                if (retval < 0)
+                        return retval;
+
+                if (!(value & RTC_READ_REQUEST))
+                        break;
+
+                usleep_range(1000, 5000);
         }
 
         /* Read the Watchtime registers */
@@ -225,7 +220,8 @@ static int ab8500_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 {
         int retval, i;
         unsigned char buf[ARRAY_SIZE(ab8500_rtc_alarm_regs)];
-        unsigned long mins, secs = 0;
+        unsigned long mins, secs = 0, cursec = 0;
+        struct rtc_time curtm;
 
         if (alarm->time.tm_year < (AB8500_RTC_EPOCH - 1900)) {
                 dev_dbg(dev, "year should be equal to or greater than %d\n",
@@ -237,6 +233,18 @@ static int ab8500_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
         rtc_tm_to_time(&alarm->time, &secs);
 
         /*
+         * Check whether alarm is set less than 1min.
+         * Since our RTC doesn't support alarm resolution less than 1min,
+         * return -EINVAL, so UIE EMUL can take it up, incase of UIE_ON
+         */
+        ab8500_rtc_read_time(dev, &curtm); /* Read current time */
+        rtc_tm_to_time(&curtm, &cursec);
+        if ((secs - cursec) < 59) {
+                dev_dbg(dev, "Alarm less than 1 minute not supported\r\n");
+                return -EINVAL;
+        }
+
+        /*
          * Convert it to the number of seconds since 01-01-2000 00:00:00, since
          * we only have a small counter in the RTC.
          */
diff --git a/drivers/rtc/rtc-coh901331.c b/drivers/rtc/rtc-coh901331.c
index a5b8a0c4ea84..76b2156d3c62 100644
--- a/drivers/rtc/rtc-coh901331.c
+++ b/drivers/rtc/rtc-coh901331.c
@@ -155,13 +155,10 @@ static int __exit coh901331_remove(struct platform_device *pdev)
         struct coh901331_port *rtap = dev_get_drvdata(&pdev->dev);
 
         if (rtap) {
-                free_irq(rtap->irq, rtap);
                 rtc_device_unregister(rtap->rtc);
+                clk_unprepare(rtap->clk);
                 clk_put(rtap->clk);
-                iounmap(rtap->virtbase);
-                release_mem_region(rtap->phybase, rtap->physize);
                 platform_set_drvdata(pdev, NULL);
-                kfree(rtap);
         }
 
         return 0;
@@ -174,49 +171,43 @@ static int __init coh901331_probe(struct platform_device *pdev)
         struct coh901331_port *rtap;
         struct resource *res;
 
-        rtap = kzalloc(sizeof(struct coh901331_port), GFP_KERNEL);
+        rtap = devm_kzalloc(&pdev->dev,
+                            sizeof(struct coh901331_port), GFP_KERNEL);
         if (!rtap)
                 return -ENOMEM;
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res) {
-                ret = -ENOENT;
-                goto out_no_resource;
-        }
+        if (!res)
+                return -ENOENT;
+
         rtap->phybase = res->start;
         rtap->physize = resource_size(res);
 
-        if (request_mem_region(rtap->phybase, rtap->physize,
-                               "rtc-coh901331") == NULL) {
-                ret = -EBUSY;
-                goto out_no_memregion;
-        }
+        if (devm_request_mem_region(&pdev->dev, rtap->phybase, rtap->physize,
+                                    "rtc-coh901331") == NULL)
+                return -EBUSY;
 
-        rtap->virtbase = ioremap(rtap->phybase, rtap->physize);
-        if (!rtap->virtbase) {
-                ret = -ENOMEM;
-                goto out_no_remap;
-        }
+        rtap->virtbase = devm_ioremap(&pdev->dev, rtap->phybase, rtap->physize);
+        if (!rtap->virtbase)
+                return -ENOMEM;
 
         rtap->irq = platform_get_irq(pdev, 0);
-        if (request_irq(rtap->irq, coh901331_interrupt, 0,
-                        "RTC COH 901 331 Alarm", rtap)) {
-                ret = -EIO;
-                goto out_no_irq;
-        }
+        if (devm_request_irq(&pdev->dev, rtap->irq, coh901331_interrupt, 0,
+                             "RTC COH 901 331 Alarm", rtap))
+                return -EIO;
 
         rtap->clk = clk_get(&pdev->dev, NULL);
         if (IS_ERR(rtap->clk)) {
                 ret = PTR_ERR(rtap->clk);
                 dev_err(&pdev->dev, "could not get clock\n");
-                goto out_no_clk;
+                return ret;
         }
 
         /* We enable/disable the clock only to assure it works */
-        ret = clk_enable(rtap->clk);
+        ret = clk_prepare_enable(rtap->clk);
         if (ret) {
                 dev_err(&pdev->dev, "could not enable clock\n");
-                goto out_no_clk_enable;
+                goto out_no_clk_prepenable;
         }
         clk_disable(rtap->clk);
 
@@ -232,18 +223,9 @@ static int __init coh901331_probe(struct platform_device *pdev)
 
  out_no_rtc:
         platform_set_drvdata(pdev, NULL);
- out_no_clk_enable:
+        clk_unprepare(rtap->clk);
+ out_no_clk_prepenable:
         clk_put(rtap->clk);
- out_no_clk:
-        free_irq(rtap->irq, rtap);
- out_no_irq:
-        iounmap(rtap->virtbase);
- out_no_remap:
-        platform_set_drvdata(pdev, NULL);
- out_no_memregion:
-        release_mem_region(rtap->phybase, SZ_4K);
- out_no_resource:
-        kfree(rtap);
         return ret;
 }
 
@@ -265,6 +247,7 @@ static int coh901331_suspend(struct platform_device *pdev, pm_message_t state)
                 writel(0, rtap->virtbase + COH901331_IRQ_MASK);
                 clk_disable(rtap->clk);
         }
+        clk_unprepare(rtap->clk);
         return 0;
 }
 
@@ -272,6 +255,7 @@ static int coh901331_resume(struct platform_device *pdev)
 {
         struct coh901331_port *rtap = dev_get_drvdata(&pdev->dev);
 
+        clk_prepare(rtap->clk);
         if (device_may_wakeup(&pdev->dev)) {
                 disable_irq_wake(rtap->irq);
         } else {
@@ -293,6 +277,7 @@ static void coh901331_shutdown(struct platform_device *pdev)
         clk_enable(rtap->clk);
         writel(0, rtap->virtbase + COH901331_IRQ_MASK);
         clk_disable(rtap->clk);
+        clk_unprepare(rtap->clk);
 }
 
 static struct platform_driver coh901331_driver = {
diff --git a/drivers/rtc/rtc-da9052.c b/drivers/rtc/rtc-da9052.c
index da6ab5291a41..78070255bd3f 100644
--- a/drivers/rtc/rtc-da9052.c
+++ b/drivers/rtc/rtc-da9052.c
@@ -245,7 +245,7 @@ static int __devinit da9052_rtc_probe(struct platform_device *pdev)
                                    "ALM", rtc);
         if (ret != 0) {
                 rtc_err(rtc->da9052, "irq registration failed: %d\n", ret);
-                goto err_mem;
+                return ret;
         }
 
         rtc->rtc = rtc_device_register(pdev->name, &pdev->dev,
@@ -259,8 +259,6 @@ static int __devinit da9052_rtc_probe(struct platform_device *pdev)
 
 err_free_irq:
         free_irq(rtc->irq, rtc);
-err_mem:
-        devm_kfree(&pdev->dev, rtc);
         return ret;
 }
 
@@ -271,7 +269,6 @@ static int __devexit da9052_rtc_remove(struct platform_device *pdev)
         rtc_device_unregister(rtc->rtc);
         free_irq(rtc->irq, rtc);
         platform_set_drvdata(pdev, NULL);
-        devm_kfree(&pdev->dev, rtc);
 
         return 0;
 }
diff --git a/drivers/rtc/rtc-mc13xxx.c b/drivers/rtc/rtc-mc13xxx.c
index 546f6850bffb..2643d8874925 100644
--- a/drivers/rtc/rtc-mc13xxx.c
+++ b/drivers/rtc/rtc-mc13xxx.c
@@ -404,9 +404,12 @@ static const struct platform_device_id mc13xxx_rtc_idtable[] = {
                 .name = "mc13783-rtc",
         }, {
                 .name = "mc13892-rtc",
+        }, {
+                .name = "mc34708-rtc",
         },
-        { }
+        { /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(platform, mc13xxx_rtc_idtable);
 
 static struct platform_driver mc13xxx_rtc_driver = {
         .id_table = mc13xxx_rtc_idtable,
@@ -432,4 +435,3 @@ module_exit(mc13xxx_rtc_exit);
 MODULE_AUTHOR("Sascha Hauer <s.hauer@pengutronix.de>");
 MODULE_DESCRIPTION("RTC driver for Freescale MC13XXX PMIC");
 MODULE_LICENSE("GPL v2");
-MODULE_ALIAS("platform:" DRIVER_NAME);
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 97a3284bb7c6..c2fe426a6ef2 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -19,6 +19,7 @@
 #include <linux/rtc.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/of.h>
 
 #define DRV_VERSION "0.4.3"
 
@@ -285,9 +286,19 @@ static const struct i2c_device_id pcf8563_id[] = {
 };
 MODULE_DEVICE_TABLE(i2c, pcf8563_id);
 
+#ifdef CONFIG_OF
+static const struct of_device_id pcf8563_of_match[] __devinitconst = {
+        { .compatible = "nxp,pcf8563" },
+        {}
+};
+MODULE_DEVICE_TABLE(of, pcf8563_of_match);
+#endif
+
 static struct i2c_driver pcf8563_driver = {
         .driver         = {
                 .name   = "rtc-pcf8563",
+                .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(pcf8563_of_match),
         },
         .probe          = pcf8563_probe,
         .remove         = pcf8563_remove,
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index cc0533994f6e..08378e3cc21c 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -68,11 +68,26 @@
 
 #define RTC_TIMER_FREQ 32768
 
+/**
+ * struct pl031_vendor_data - per-vendor variations
+ * @ops: the vendor-specific operations used on this silicon version
+ * @clockwatch: if this is an ST Microelectronics silicon version with a
+ *      clockwatch function
+ * @st_weekday: if this is an ST Microelectronics silicon version that need
+ *      the weekday fix
+ * @irqflags: special IRQ flags per variant
+ */
+struct pl031_vendor_data {
+        struct rtc_class_ops ops;
+        bool clockwatch;
+        bool st_weekday;
+        unsigned long irqflags;
+};
+
 struct pl031_local {
+        struct pl031_vendor_data *vendor;
         struct rtc_device *rtc;
         void __iomem *base;
-        u8 hw_designer;
-        u8 hw_revision:4;
 };
 
 static int pl031_alarm_irq_enable(struct device *dev,
@@ -303,7 +318,8 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
 {
         int ret;
         struct pl031_local *ldata;
-        struct rtc_class_ops *ops = id->data;
+        struct pl031_vendor_data *vendor = id->data;
+        struct rtc_class_ops *ops = &vendor->ops;
         unsigned long time;
 
         ret = amba_request_regions(adev, NULL);
@@ -315,6 +331,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
                 ret = -ENOMEM;
                 goto out;
         }
+        ldata->vendor = vendor;
 
         ldata->base = ioremap(adev->res.start, resource_size(&adev->res));
 
@@ -325,14 +342,11 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
 
         amba_set_drvdata(adev, ldata);
 
-        ldata->hw_designer = amba_manf(adev);
-        ldata->hw_revision = amba_rev(adev);
-
-        dev_dbg(&adev->dev, "designer ID = 0x%02x\n", ldata->hw_designer);
-        dev_dbg(&adev->dev, "revision = 0x%01x\n", ldata->hw_revision);
+        dev_dbg(&adev->dev, "designer ID = 0x%02x\n", amba_manf(adev));
+        dev_dbg(&adev->dev, "revision = 0x%01x\n", amba_rev(adev));
 
         /* Enable the clockwatch on ST Variants */
-        if (ldata->hw_designer == AMBA_VENDOR_ST)
+        if (vendor->clockwatch)
                 writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
                        ldata->base + RTC_CR);
 
@@ -340,7 +354,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
          * On ST PL031 variants, the RTC reset value does not provide correct
          * weekday for 2000-01-01. Correct the erroneous sunday to saturday.
          */
-        if (ldata->hw_designer == AMBA_VENDOR_ST) {
+        if (vendor->st_weekday) {
                 if (readl(ldata->base + RTC_YDR) == 0x2000) {
                         time = readl(ldata->base + RTC_DR);
                         if ((time &
@@ -361,7 +375,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         }
 
         if (request_irq(adev->irq[0], pl031_interrupt,
-                        0, "rtc-pl031", ldata)) {
+                        vendor->irqflags, "rtc-pl031", ldata)) {
                 ret = -EIO;
                 goto out_no_irq;
         }
@@ -383,48 +397,65 @@ err_req:
 }
 
 /* Operations for the original ARM version */
-static struct rtc_class_ops arm_pl031_ops = {
-        .read_time = pl031_read_time,
-        .set_time = pl031_set_time,
-        .read_alarm = pl031_read_alarm,
-        .set_alarm = pl031_set_alarm,
-        .alarm_irq_enable = pl031_alarm_irq_enable,
+static struct pl031_vendor_data arm_pl031 = {
+        .ops = {
+                .read_time = pl031_read_time,
+                .set_time = pl031_set_time,
+                .read_alarm = pl031_read_alarm,
+                .set_alarm = pl031_set_alarm,
+                .alarm_irq_enable = pl031_alarm_irq_enable,
+        },
+        .irqflags = IRQF_NO_SUSPEND,
 };
 
 /* The First ST derivative */
-static struct rtc_class_ops stv1_pl031_ops = {
-        .read_time = pl031_read_time,
-        .set_time = pl031_set_time,
-        .read_alarm = pl031_read_alarm,
-        .set_alarm = pl031_set_alarm,
-        .alarm_irq_enable = pl031_alarm_irq_enable,
+static struct pl031_vendor_data stv1_pl031 = {
+        .ops = {
+                .read_time = pl031_read_time,
+                .set_time = pl031_set_time,
+                .read_alarm = pl031_read_alarm,
+                .set_alarm = pl031_set_alarm,
+                .alarm_irq_enable = pl031_alarm_irq_enable,
+        },
+        .clockwatch = true,
+        .st_weekday = true,
+        .irqflags = IRQF_NO_SUSPEND,
 };
 
 /* And the second ST derivative */
-static struct rtc_class_ops stv2_pl031_ops = {
-        .read_time = pl031_stv2_read_time,
-        .set_time = pl031_stv2_set_time,
-        .read_alarm = pl031_stv2_read_alarm,
-        .set_alarm = pl031_stv2_set_alarm,
-        .alarm_irq_enable = pl031_alarm_irq_enable,
+static struct pl031_vendor_data stv2_pl031 = {
+        .ops = {
+                .read_time = pl031_stv2_read_time,
+                .set_time = pl031_stv2_set_time,
+                .read_alarm = pl031_stv2_read_alarm,
+                .set_alarm = pl031_stv2_set_alarm,
+                .alarm_irq_enable = pl031_alarm_irq_enable,
+        },
+        .clockwatch = true,
+        .st_weekday = true,
+        /*
+         * This variant shares the IRQ with another block and must not
+         * suspend that IRQ line.
+         */
+        .irqflags = IRQF_SHARED | IRQF_NO_SUSPEND,
 };
 
 static struct amba_id pl031_ids[] = {
         {
                 .id = 0x00041031,
                 .mask = 0x000fffff,
-                .data = &arm_pl031_ops,
+                .data = &arm_pl031,
         },
         /* ST Micro variants */
         {
                 .id = 0x00180031,
                 .mask = 0x00ffffff,
-                .data = &stv1_pl031_ops,
+                .data = &stv1_pl031,
         },
         {
                 .id = 0x00280031,
                 .mask = 0x00ffffff,
-                .data = &stv2_pl031_ops,
+                .data = &stv2_pl031,
         },
         {0, 0},
 };
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 33b6ba0afa0d..2c183ebff715 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -138,8 +138,7 @@ static int __devinit r9701_probe(struct spi_device *spi)
          * contain invalid values. If so, try to write a default date:
          * 2000/1/1 00:00:00
          */
-        r9701_get_datetime(&spi->dev, &dt);
-        if (rtc_valid_tm(&dt)) {
+        if (r9701_get_datetime(&spi->dev, &dt)) {
                 dev_info(&spi->dev, "trying to repair invalid date/time\n");
                 dt.tm_sec  = 0;
                 dt.tm_min  = 0;
@@ -148,7 +147,8 @@ static int __devinit r9701_probe(struct spi_device *spi)
                 dt.tm_mon  = 0;
                 dt.tm_year = 100;
 
-                if (r9701_set_datetime(&spi->dev, &dt)) {
+                if (r9701_set_datetime(&spi->dev, &dt) ||
+                                r9701_get_datetime(&spi->dev, &dt)) {
                         dev_err(&spi->dev, "cannot repair RTC register\n");
                         return -ENODEV;
                 }
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index 7e6af0b22f17..bfbd92c8d1c9 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -26,10 +26,10 @@
 #include <linux/log2.h>
 #include <linux/slab.h>
 #include <linux/of.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
 
 #include <mach/hardware.h>
-#include <asm/uaccess.h>
-#include <asm/io.h>
 #include <asm/irq.h>
 #include <plat/regs-rtc.h>
 
diff --git a/drivers/usb/gadget/m66592-udc.c b/drivers/usb/gadget/m66592-udc.c
index 8981fbb5748c..cf6bd626f3fe 100644
--- a/drivers/usb/gadget/m66592-udc.c
+++ b/drivers/usb/gadget/m66592-udc.c
@@ -1583,12 +1583,10 @@ static int __exit m66592_remove(struct platform_device *pdev)
         iounmap(m66592->reg);
         free_irq(platform_get_irq(pdev, 0), m66592);
         m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
-#ifdef CONFIG_HAVE_CLK
         if (m66592->pdata->on_chip) {
                 clk_disable(m66592->clk);
                 clk_put(m66592->clk);
         }
-#endif
         kfree(m66592);
         return 0;
 }
@@ -1602,9 +1600,7 @@ static int __init m66592_probe(struct platform_device *pdev)
         struct resource *res, *ires;
         void __iomem *reg = NULL;
         struct m66592 *m66592 = NULL;
-#ifdef CONFIG_HAVE_CLK
         char clk_name[8];
-#endif
         int ret = 0;
         int i;
 
@@ -1671,7 +1667,6 @@ static int __init m66592_probe(struct platform_device *pdev)
                 goto clean_up;
         }
 
-#ifdef CONFIG_HAVE_CLK
         if (m66592->pdata->on_chip) {
                 snprintf(clk_name, sizeof(clk_name), "usbf%d", pdev->id);
                 m66592->clk = clk_get(&pdev->dev, clk_name);
@@ -1683,7 +1678,7 @@ static int __init m66592_probe(struct platform_device *pdev)
                 }
                 clk_enable(m66592->clk);
         }
-#endif
+
         INIT_LIST_HEAD(&m66592->gadget.ep_list);
         m66592->gadget.ep0 = &m66592->ep[0].ep;
         INIT_LIST_HEAD(&m66592->gadget.ep0->ep_list);
@@ -1731,13 +1726,11 @@ err_add_udc:
         m66592_free_request(&m66592->ep[0].ep, m66592->ep0_req);
 
 clean_up3:
-#ifdef CONFIG_HAVE_CLK
         if (m66592->pdata->on_chip) {
                 clk_disable(m66592->clk);
                 clk_put(m66592->clk);
         }
 clean_up2:
-#endif
         free_irq(ires->start, m66592);
 clean_up:
         if (m66592) {
diff --git a/drivers/usb/gadget/m66592-udc.h b/drivers/usb/gadget/m66592-udc.h
index 88c85b4116a2..16c7e14678b8 100644
--- a/drivers/usb/gadget/m66592-udc.h
+++ b/drivers/usb/gadget/m66592-udc.h
@@ -13,10 +13,7 @@
 #ifndef __M66592_UDC_H__
 #define __M66592_UDC_H__
 
-#ifdef CONFIG_HAVE_CLK
 #include <linux/clk.h>
-#endif
-
 #include <linux/usb/m66592.h>
 
 #define M66592_SYSCFG           0x00
@@ -468,9 +465,7 @@ struct m66592_ep {
 struct m66592 {
         spinlock_t              lock;
         void __iomem            *reg;
-#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
-#endif
         struct m66592_platdata  *pdata;
         unsigned long           irq_trigger;
 
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index f3ac2a20c27c..5a80751accb7 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -1831,12 +1831,12 @@ static int __exit r8a66597_remove(struct platform_device *pdev)
                 iounmap(r8a66597->sudmac_reg);
         free_irq(platform_get_irq(pdev, 0), r8a66597);
         r8a66597_free_request(&r8a66597->ep[0].ep, r8a66597->ep0_req);
-#ifdef CONFIG_HAVE_CLK
+
         if (r8a66597->pdata->on_chip) {
                 clk_disable(r8a66597->clk);
                 clk_put(r8a66597->clk);
         }
-#endif
+
         device_unregister(&r8a66597->gadget.dev);
         kfree(r8a66597);
         return 0;
@@ -1868,9 +1868,7 @@ static int __init r8a66597_sudmac_ioremap(struct r8a66597 *r8a66597,
 
 static int __init r8a66597_probe(struct platform_device *pdev)
 {
-#ifdef CONFIG_HAVE_CLK
         char clk_name[8];
-#endif
         struct resource *res, *ires;
         int irq;
         void __iomem *reg = NULL;
@@ -1934,7 +1932,6 @@ static int __init r8a66597_probe(struct platform_device *pdev)
         r8a66597->timer.data = (unsigned long)r8a66597;
         r8a66597->reg = reg;
 
-#ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip) {
                 snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
                 r8a66597->clk = clk_get(&pdev->dev, clk_name);
@@ -1946,7 +1943,7 @@ static int __init r8a66597_probe(struct platform_device *pdev)
                 }
                 clk_enable(r8a66597->clk);
         }
-#endif
+
         if (r8a66597->pdata->sudmac) {
                 ret = r8a66597_sudmac_ioremap(r8a66597, pdev);
                 if (ret < 0)
@@ -2006,13 +2003,11 @@ err_add_udc:
 clean_up3:
         free_irq(irq, r8a66597);
 clean_up2:
-#ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip) {
                 clk_disable(r8a66597->clk);
                 clk_put(r8a66597->clk);
         }
 clean_up_dev:
-#endif
         device_unregister(&r8a66597->gadget.dev);
 clean_up:
         if (r8a66597) {
diff --git a/drivers/usb/gadget/r8a66597-udc.h b/drivers/usb/gadget/r8a66597-udc.h
index 99908c76ccd1..45c4b2df1785 100644
--- a/drivers/usb/gadget/r8a66597-udc.h
+++ b/drivers/usb/gadget/r8a66597-udc.h
@@ -13,10 +13,7 @@
 #ifndef __R8A66597_H__
 #define __R8A66597_H__
 
-#ifdef CONFIG_HAVE_CLK
 #include <linux/clk.h>
-#endif
-
 #include <linux/usb/r8a66597.h>
 
 #define R8A66597_MAX_SAMPLING   10
@@ -92,9 +89,7 @@ struct r8a66597 {
         void __iomem            *reg;
         void __iomem            *sudmac_reg;
 
-#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
-#endif
         struct r8a66597_platdata        *pdata;
 
         struct usb_gadget               gadget;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index c868be65e763..4c634eb56358 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -95,9 +95,7 @@ static int r8a66597_clock_enable(struct r8a66597 *r8a66597)
         int i = 0;
 
         if (r8a66597->pdata->on_chip) {
-#ifdef CONFIG_HAVE_CLK
                 clk_enable(r8a66597->clk);
-#endif
                 do {
                         r8a66597_write(r8a66597, SCKE, SYSCFG0);
                         tmp = r8a66597_read(r8a66597, SYSCFG0);
@@ -141,9 +139,7 @@ static void r8a66597_clock_disable(struct r8a66597 *r8a66597)
         udelay(1);
 
         if (r8a66597->pdata->on_chip) {
-#ifdef CONFIG_HAVE_CLK
                 clk_disable(r8a66597->clk);
-#endif
         } else {
                 r8a66597_bclr(r8a66597, PLLC, SYSCFG0);
                 r8a66597_bclr(r8a66597, XCKE, SYSCFG0);
@@ -2406,19 +2402,15 @@ static int __devexit r8a66597_remove(struct platform_device *pdev)
         del_timer_sync(&r8a66597->rh_timer);
         usb_remove_hcd(hcd);
         iounmap(r8a66597->reg);
-#ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip)
                 clk_put(r8a66597->clk);
-#endif
         usb_put_hcd(hcd);
         return 0;
 }
 
 static int __devinit r8a66597_probe(struct platform_device *pdev)
 {
-#ifdef CONFIG_HAVE_CLK
         char clk_name[8];
-#endif
         struct resource *res = NULL, *ires;
         int irq = -1;
         void __iomem *reg = NULL;
@@ -2482,7 +2474,6 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         r8a66597->irq_sense_low = irq_trigger == IRQF_TRIGGER_LOW;
 
         if (r8a66597->pdata->on_chip) {
-#ifdef CONFIG_HAVE_CLK
                 snprintf(clk_name, sizeof(clk_name), "usb%d", pdev->id);
                 r8a66597->clk = clk_get(&pdev->dev, clk_name);
                 if (IS_ERR(r8a66597->clk)) {
@@ -2491,7 +2482,6 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
                         ret = PTR_ERR(r8a66597->clk);
                         goto clean_up2;
                 }
-#endif
                 r8a66597->max_root_hub = 1;
         } else
                 r8a66597->max_root_hub = 2;
@@ -2531,11 +2521,9 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         return 0;
 
 clean_up3:
-#ifdef CONFIG_HAVE_CLK
         if (r8a66597->pdata->on_chip)
                 clk_put(r8a66597->clk);
 clean_up2:
-#endif
         usb_put_hcd(hcd);
 
 clean_up:
diff --git a/drivers/usb/host/r8a66597.h b/drivers/usb/host/r8a66597.h
index f28782d20eef..672cea307abb 100644
--- a/drivers/usb/host/r8a66597.h
+++ b/drivers/usb/host/r8a66597.h
@@ -26,10 +26,7 @@
 #ifndef __R8A66597_H__
 #define __R8A66597_H__
 
-#ifdef CONFIG_HAVE_CLK
 #include <linux/clk.h>
-#endif
-
 #include <linux/usb/r8a66597.h>
 
 #define R8A66597_MAX_NUM_PIPE           10
@@ -113,9 +110,7 @@ struct r8a66597_root_hub {
 struct r8a66597 {
         spinlock_t lock;
         void __iomem *reg;
-#ifdef CONFIG_HAVE_CLK
         struct clk *clk;
-#endif
         struct r8a66597_platdata        *pdata;
         struct r8a66597_device          device0;
         struct r8a66597_root_hub        root_hub[R8A66597_MAX_ROOT_HUB];
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index dbcdeea30f09..586105b55a7c 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -81,14 +81,6 @@ struct musb_ep;
 #define is_peripheral_active(m)         (!(m)->is_host)
 #define is_host_active(m)               ((m)->is_host)
 
-#ifndef CONFIG_HAVE_CLK
-/* Dummy stub for clk framework */
-#define clk_get(dev, id)        NULL
-#define clk_put(clock)          do {} while (0)
-#define clk_enable(clock)       do {} while (0)
-#define clk_disable(clock)      do {} while (0)
-#endif
-
 #ifdef CONFIG_PROC_FS
 #include <linux/fs.h>
 #define MUSB_CONFIG_PROC_FS
diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
index 0443a4f71858..df1cbb7ef6ca 100644
--- a/drivers/video/backlight/atmel-pwm-bl.c
+++ b/drivers/video/backlight/atmel-pwm-bl.c
@@ -127,7 +127,8 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
         struct atmel_pwm_bl *pwmbl;
         int retval;
 
-        pwmbl = kzalloc(sizeof(struct atmel_pwm_bl), GFP_KERNEL);
+        pwmbl = devm_kzalloc(&pdev->dev, sizeof(struct atmel_pwm_bl),
+                                GFP_KERNEL);
         if (!pwmbl)
                 return -ENOMEM;
 
@@ -154,7 +155,8 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
                 goto err_free_mem;
 
         if (pwmbl->gpio_on != -1) {
-                retval = gpio_request(pwmbl->gpio_on, "gpio_atmel_pwm_bl");
+                retval = devm_gpio_request(&pdev->dev, pwmbl->gpio_on,
+                                        "gpio_atmel_pwm_bl");
                 if (retval) {
                         pwmbl->gpio_on = -1;
                         goto err_free_pwm;
@@ -164,7 +166,7 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
                 retval = gpio_direction_output(pwmbl->gpio_on,
                                 0 ^ pdata->on_active_low);
                 if (retval)
-                        goto err_free_gpio;
+                        goto err_free_pwm;
         }
 
         memset(&props, 0, sizeof(struct backlight_properties));
@@ -174,7 +176,7 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
                                           &atmel_pwm_bl_ops, &props);
         if (IS_ERR(bldev)) {
                 retval = PTR_ERR(bldev);
-                goto err_free_gpio;
+                goto err_free_pwm;
         }
 
         pwmbl->bldev = bldev;
@@ -196,13 +198,9 @@ static int atmel_pwm_bl_probe(struct platform_device *pdev)
 err_free_bl_dev:
         platform_set_drvdata(pdev, NULL);
         backlight_device_unregister(bldev);
-err_free_gpio:
-        if (pwmbl->gpio_on != -1)
-                gpio_free(pwmbl->gpio_on);
 err_free_pwm:
         pwm_channel_free(&pwmbl->pwmc);
 err_free_mem:
-        kfree(pwmbl);
         return retval;
 }
 
@@ -210,15 +208,12 @@ static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
 {
         struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
 
-        if (pwmbl->gpio_on != -1) {
+        if (pwmbl->gpio_on != -1)
                 gpio_set_value(pwmbl->gpio_on, 0);
-                gpio_free(pwmbl->gpio_on);
-        }
         pwm_channel_disable(&pwmbl->pwmc);
         pwm_channel_free(&pwmbl->pwmc);
         backlight_device_unregister(pwmbl->bldev);
         platform_set_drvdata(pdev, NULL);
-        kfree(pwmbl);
 
         return 0;
 }
diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c
index 23d732677ba1..c781768ba892 100644
--- a/drivers/video/backlight/corgi_lcd.c
+++ b/drivers/video/backlight/corgi_lcd.c
@@ -492,7 +492,8 @@ static int setup_gpio_backlight(struct corgi_lcd *lcd,
         lcd->gpio_backlight_cont = -1;
 
         if (gpio_is_valid(pdata->gpio_backlight_on)) {
-                err = gpio_request(pdata->gpio_backlight_on, "BL_ON");
+                err = devm_gpio_request(&spi->dev, pdata->gpio_backlight_on,
+                                        "BL_ON");
                 if (err) {
                         dev_err(&spi->dev, "failed to request GPIO%d for "
                                 "backlight_on\n", pdata->gpio_backlight_on);
@@ -504,11 +505,12 @@ static int setup_gpio_backlight(struct corgi_lcd *lcd,
         }
 
         if (gpio_is_valid(pdata->gpio_backlight_cont)) {
-                err = gpio_request(pdata->gpio_backlight_cont, "BL_CONT");
+                err = devm_gpio_request(&spi->dev, pdata->gpio_backlight_cont,
+                                        "BL_CONT");
                 if (err) {
                         dev_err(&spi->dev, "failed to request GPIO%d for "
                                 "backlight_cont\n", pdata->gpio_backlight_cont);
-                        goto err_free_backlight_on;
+                        return err;
                 }
 
                 lcd->gpio_backlight_cont = pdata->gpio_backlight_cont;
@@ -525,11 +527,6 @@ static int setup_gpio_backlight(struct corgi_lcd *lcd,
                 }
         }
         return 0;
-
-err_free_backlight_on:
-        if (gpio_is_valid(lcd->gpio_backlight_on))
-                gpio_free(lcd->gpio_backlight_on);
-        return err;
 }
 
 static int __devinit corgi_lcd_probe(struct spi_device *spi)
@@ -602,12 +599,6 @@ static int __devexit corgi_lcd_remove(struct spi_device *spi)
         backlight_update_status(lcd->bl_dev);
         backlight_device_unregister(lcd->bl_dev);
 
-        if (gpio_is_valid(lcd->gpio_backlight_on))
-                gpio_free(lcd->gpio_backlight_on);
-
-        if (gpio_is_valid(lcd->gpio_backlight_cont))
-                gpio_free(lcd->gpio_backlight_cont);
-
         corgi_lcd_set_power(lcd->lcd_dev, FB_BLANK_POWERDOWN);
         lcd_device_unregister(lcd->lcd_dev);
 
diff --git a/drivers/video/backlight/l4f00242t03.c b/drivers/video/backlight/l4f00242t03.c
index 40f606a86093..2d90c0648aa0 100644
--- a/drivers/video/backlight/l4f00242t03.c
+++ b/drivers/video/backlight/l4f00242t03.c
@@ -175,28 +175,27 @@ static int __devinit l4f00242t03_probe(struct spi_device *spi)
 
         priv->spi = spi;
 
-        ret = gpio_request_one(pdata->reset_gpio, GPIOF_OUT_INIT_HIGH,
-                                                "lcd l4f00242t03 reset");
+        ret = devm_gpio_request_one(&spi->dev, pdata->reset_gpio,
+                        GPIOF_OUT_INIT_HIGH, "lcd l4f00242t03 reset");
         if (ret) {
                 dev_err(&spi->dev,
                         "Unable to get the lcd l4f00242t03 reset gpio.\n");
                 return ret;
         }
 
-        ret = gpio_request_one(pdata->data_enable_gpio, GPIOF_OUT_INIT_LOW,
-                                                "lcd l4f00242t03 data enable");
+        ret = devm_gpio_request_one(&spi->dev, pdata->data_enable_gpio,
+                        GPIOF_OUT_INIT_LOW, "lcd l4f00242t03 data enable");
         if (ret) {
                 dev_err(&spi->dev,
                         "Unable to get the lcd l4f00242t03 data en gpio.\n");
-                goto err;
+                return ret;
         }
 
         priv->io_reg = regulator_get(&spi->dev, "vdd");
         if (IS_ERR(priv->io_reg)) {
-                ret = PTR_ERR(priv->io_reg);
                 dev_err(&spi->dev, "%s: Unable to get the IO regulator\n",
                        __func__);
-                goto err2;
+                return PTR_ERR(priv->io_reg);
         }
 
         priv->core_reg = regulator_get(&spi->dev, "vcore");
@@ -204,14 +203,14 @@ static int __devinit l4f00242t03_probe(struct spi_device *spi)
                 ret = PTR_ERR(priv->core_reg);
                 dev_err(&spi->dev, "%s: Unable to get the core regulator\n",
                        __func__);
-                goto err3;
+                goto err1;
         }
 
         priv->ld = lcd_device_register("l4f00242t03",
                                         &spi->dev, priv, &l4f_ops);
         if (IS_ERR(priv->ld)) {
                 ret = PTR_ERR(priv->ld);
-                goto err4;
+                goto err2;
         }
 
         /* Init the LCD */
@@ -223,14 +222,10 @@ static int __devinit l4f00242t03_probe(struct spi_device *spi)
 
         return 0;
 
-err4:
+err2:
         regulator_put(priv->core_reg);
-err3:
+err1:
         regulator_put(priv->io_reg);
-err2:
-        gpio_free(pdata->data_enable_gpio);
-err:
-        gpio_free(pdata->reset_gpio);
 
         return ret;
 }
@@ -238,16 +233,12 @@ err:
 static int __devexit l4f00242t03_remove(struct spi_device *spi)
 {
         struct l4f00242t03_priv *priv = dev_get_drvdata(&spi->dev);
-        struct l4f00242t03_pdata *pdata = priv->spi->dev.platform_data;
 
         l4f00242t03_lcd_power_set(priv->ld, FB_BLANK_POWERDOWN);
         lcd_device_unregister(priv->ld);
 
         dev_set_drvdata(&spi->dev, NULL);
 
-        gpio_free(pdata->data_enable_gpio);
-        gpio_free(pdata->reset_gpio);
-
         regulator_put(priv->io_reg);
         regulator_put(priv->core_reg);
 
diff --git a/drivers/video/backlight/lm3533_bl.c b/drivers/video/backlight/lm3533_bl.c
index bebeb63607db..18dca0c29c68 100644
--- a/drivers/video/backlight/lm3533_bl.c
+++ b/drivers/video/backlight/lm3533_bl.c
@@ -295,7 +295,7 @@ static int __devinit lm3533_bl_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        bl = kzalloc(sizeof(*bl), GFP_KERNEL);
+        bl = devm_kzalloc(&pdev->dev, sizeof(*bl), GFP_KERNEL);
         if (!bl) {
                 dev_err(&pdev->dev,
                                 "failed to allocate memory for backlight\n");
@@ -317,8 +317,7 @@ static int __devinit lm3533_bl_probe(struct platform_device *pdev)
                                                 &lm3533_bl_ops, &props);
         if (IS_ERR(bd)) {
                 dev_err(&pdev->dev, "failed to register backlight device\n");
-                ret = PTR_ERR(bd);
-                goto err_free;
+                return PTR_ERR(bd);
         }
 
         bl->bd = bd;
@@ -348,8 +347,6 @@ err_sysfs_remove:
         sysfs_remove_group(&bd->dev.kobj, &lm3533_bl_attribute_group);
 err_unregister:
         backlight_device_unregister(bd);
-err_free:
-        kfree(bl);
 
         return ret;
 }
@@ -367,7 +364,6 @@ static int __devexit lm3533_bl_remove(struct platform_device *pdev)
         lm3533_ctrlbank_disable(&bl->cb);
         sysfs_remove_group(&bd->dev.kobj, &lm3533_bl_attribute_group);
         backlight_device_unregister(bd);
-        kfree(bl);
 
         return 0;
 }
diff --git a/drivers/video/backlight/lms283gf05.c b/drivers/video/backlight/lms283gf05.c
index a9f2c36966f1..ea43f2254196 100644
--- a/drivers/video/backlight/lms283gf05.c
+++ b/drivers/video/backlight/lms283gf05.c
@@ -158,29 +158,27 @@ static int __devinit lms283gf05_probe(struct spi_device *spi)
         int ret = 0;
 
         if (pdata != NULL) {
-                ret = gpio_request(pdata->reset_gpio, "LMS285GF05 RESET");
+                ret = devm_gpio_request(&spi->dev, pdata->reset_gpio,
+                                        "LMS285GF05 RESET");
                 if (ret)
                         return ret;
 
                 ret = gpio_direction_output(pdata->reset_gpio,
                                                 !pdata->reset_inverted);
                 if (ret)
-                        goto err;
+                        return ret;
         }
 
         st = devm_kzalloc(&spi->dev, sizeof(struct lms283gf05_state),
                                 GFP_KERNEL);
         if (st == NULL) {
                 dev_err(&spi->dev, "No memory for device state\n");
-                ret = -ENOMEM;
-                goto err;
+                return -ENOMEM;
         }
 
         ld = lcd_device_register("lms283gf05", &spi->dev, st, &lms_ops);
-        if (IS_ERR(ld)) {
-                ret = PTR_ERR(ld);
-                goto err;
-        }
+        if (IS_ERR(ld))
+                return PTR_ERR(ld);
 
         st->spi = spi;
         st->ld = ld;
@@ -193,24 +191,14 @@ static int __devinit lms283gf05_probe(struct spi_device *spi)
         lms283gf05_toggle(spi, disp_initseq, ARRAY_SIZE(disp_initseq));
 
         return 0;
-
-err:
-        if (pdata != NULL)
-                gpio_free(pdata->reset_gpio);
-
-        return ret;
 }
 
 static int __devexit lms283gf05_remove(struct spi_device *spi)
 {
         struct lms283gf05_state *st = dev_get_drvdata(&spi->dev);
-        struct lms283gf05_pdata *pdata = st->spi->dev.platform_data;
 
         lcd_device_unregister(st->ld);
 
-        if (pdata != NULL)
-                gpio_free(pdata->reset_gpio);
-
         return 0;
 }
 
diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
index 72a0e0c917cf..aa6d4f71131f 100644
--- a/drivers/video/backlight/lp855x_bl.c
+++ b/drivers/video/backlight/lp855x_bl.c
@@ -14,11 +14,15 @@
 #include <linux/i2c.h>
 #include <linux/backlight.h>
 #include <linux/err.h>
-#include <linux/lp855x.h>
+#include <linux/platform_data/lp855x.h>
 
 /* Registers */
-#define BRIGHTNESS_CTRL         (0x00)
-#define DEVICE_CTRL             (0x01)
+#define BRIGHTNESS_CTRL         0x00
+#define DEVICE_CTRL             0x01
+#define EEPROM_START            0xA0
+#define EEPROM_END              0xA7
+#define EPROM_START             0xA0
+#define EPROM_END               0xAF
 
 #define BUF_SIZE                20
 #define DEFAULT_BL_NAME         "lcd-backlight"
diff --git a/drivers/video/backlight/ot200_bl.c b/drivers/video/backlight/ot200_bl.c
index f519d55a294c..469cf0f109d2 100644
--- a/drivers/video/backlight/ot200_bl.c
+++ b/drivers/video/backlight/ot200_bl.c
@@ -84,7 +84,8 @@ static int ot200_backlight_probe(struct platform_device *pdev)
         int retval = 0;
 
         /* request gpio */
-        if (gpio_request(GPIO_DIMM, "ot200 backlight dimmer") < 0) {
+        if (devm_gpio_request(&pdev->dev, GPIO_DIMM,
+                                "ot200 backlight dimmer") < 0) {
                 dev_err(&pdev->dev, "failed to request GPIO %d\n", GPIO_DIMM);
                 return -ENODEV;
         }
@@ -93,14 +94,13 @@ static int ot200_backlight_probe(struct platform_device *pdev)
         pwm_timer = cs5535_mfgpt_alloc_timer(7, MFGPT_DOMAIN_ANY);
         if (!pwm_timer) {
                 dev_err(&pdev->dev, "MFGPT 7 not available\n");
-                retval = -ENODEV;
-                goto error_mfgpt_alloc;
+                return -ENODEV;
         }
 
-        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data) {
                 retval = -ENOMEM;
-                goto error_kzalloc;
+                goto error_devm_kzalloc;
         }
 
         /* setup gpio */
@@ -122,26 +122,21 @@ static int ot200_backlight_probe(struct platform_device *pdev)
         if (IS_ERR(bl)) {
                 dev_err(&pdev->dev, "failed to register backlight\n");
                 retval = PTR_ERR(bl);
-                goto error_backlight_device_register;
+                goto error_devm_kzalloc;
         }
 
         platform_set_drvdata(pdev, bl);
 
         return 0;
 
-error_backlight_device_register:
-        kfree(data);
-error_kzalloc:
+error_devm_kzalloc:
         cs5535_mfgpt_free_timer(pwm_timer);
-error_mfgpt_alloc:
-        gpio_free(GPIO_DIMM);
         return retval;
 }
 
 static int ot200_backlight_remove(struct platform_device *pdev)
 {
         struct backlight_device *bl = platform_get_drvdata(pdev);
-        struct ot200_backlight_data *data = bl_get_data(bl);
 
         backlight_device_unregister(bl);
 
@@ -152,9 +147,7 @@ static int ot200_backlight_remove(struct platform_device *pdev)
                 MAX_COMP2 - dim_table[100]);
 
         cs5535_mfgpt_free_timer(pwm_timer);
-        gpio_free(GPIO_DIMM);
 
-        kfree(data);
         return 0;
 }
 
diff --git a/drivers/video/backlight/tosa_bl.c b/drivers/video/backlight/tosa_bl.c
index 0d54e607e82d..49342e1d20be 100644
--- a/drivers/video/backlight/tosa_bl.c
+++ b/drivers/video/backlight/tosa_bl.c
@@ -92,14 +92,14 @@ static int __devinit tosa_bl_probe(struct i2c_client *client,
 
         data->comadj = sharpsl_param.comadj == -1 ? COMADJ_DEFAULT : sharpsl_param.comadj;
 
-        ret = gpio_request(TOSA_GPIO_BL_C20MA, "backlight");
+        ret = devm_gpio_request(&client->dev, TOSA_GPIO_BL_C20MA, "backlight");
         if (ret) {
                 dev_dbg(&data->bl->dev, "Unable to request gpio!\n");
                 return ret;
         }
         ret = gpio_direction_output(TOSA_GPIO_BL_C20MA, 0);
         if (ret)
-                goto err_gpio_dir;
+                return ret;
 
         i2c_set_clientdata(client, data);
         data->i2c = client;
@@ -123,8 +123,6 @@ static int __devinit tosa_bl_probe(struct i2c_client *client,
 
 err_reg:
         data->bl = NULL;
-err_gpio_dir:
-        gpio_free(TOSA_GPIO_BL_C20MA);
         return ret;
 }
 
@@ -135,8 +133,6 @@ static int __devexit tosa_bl_remove(struct i2c_client *client)
         backlight_device_unregister(data->bl);
         data->bl = NULL;
 
-        gpio_free(TOSA_GPIO_BL_C20MA);
-
         return 0;
 }
 
diff --git a/drivers/video/backlight/tosa_lcd.c b/drivers/video/backlight/tosa_lcd.c
index 47823b8efff0..33047a66cc24 100644
--- a/drivers/video/backlight/tosa_lcd.c
+++ b/drivers/video/backlight/tosa_lcd.c
@@ -193,7 +193,7 @@ static int __devinit tosa_lcd_probe(struct spi_device *spi)
         data->spi = spi;
         dev_set_drvdata(&spi->dev, data);
 
-        ret = gpio_request(TOSA_GPIO_TG_ON, "tg #pwr");
+        ret = devm_gpio_request(&spi->dev, TOSA_GPIO_TG_ON, "tg #pwr");
         if (ret < 0)
                 goto err_gpio_tg;
 
@@ -201,7 +201,7 @@ static int __devinit tosa_lcd_probe(struct spi_device *spi)
 
         ret = gpio_direction_output(TOSA_GPIO_TG_ON, 0);
         if (ret < 0)
-                goto err_gpio_dir;
+                goto err_gpio_tg;
 
         mdelay(60);
         tosa_lcd_tg_init(data);
@@ -221,8 +221,6 @@ static int __devinit tosa_lcd_probe(struct spi_device *spi)
 
 err_register:
         tosa_lcd_tg_off(data);
-err_gpio_dir:
-        gpio_free(TOSA_GPIO_TG_ON);
 err_gpio_tg:
         dev_set_drvdata(&spi->dev, NULL);
         return ret;
@@ -239,7 +237,6 @@ static int __devexit tosa_lcd_remove(struct spi_device *spi)
 
         tosa_lcd_tg_off(data);
 
-        gpio_free(TOSA_GPIO_TG_ON);
         dev_set_drvdata(&spi->dev, NULL);
 
         return 0;
diff --git a/fs/affs/bitmap.c b/fs/affs/bitmap.c
index 6e0be43ef6ef..a32246b8359e 100644
--- a/fs/affs/bitmap.c
+++ b/fs/affs/bitmap.c
@@ -10,30 +10,6 @@
 #include <linux/slab.h>
 #include "affs.h"
 
-/* This is, of course, shamelessly stolen from fs/minix */
-
-static const int nibblemap[] = { 0,1,1,2,1,2,2,3,1,2,2,3,2,3,3,4 };
-
-static u32
-affs_count_free_bits(u32 blocksize, const void *data)
-{
-        const u32 *map;
-        u32 free;
-        u32 tmp;
-
-        map = data;
-        free = 0;
-        for (blocksize /= 4; blocksize > 0; blocksize--) {
-                tmp = *map++;
-                while (tmp) {
-                        free += nibblemap[tmp & 0xf];
-                        tmp >>= 4;
-                }
-        }
-
-        return free;
-}
-
 u32
 affs_count_free_blocks(struct super_block *sb)
 {
@@ -317,7 +293,7 @@ int affs_init_bitmap(struct super_block *sb, int *flags)
                         goto out;
                 }
                 pr_debug("AFFS: read bitmap block %d: %d\n", blk, bm->bm_key);
-                bm->bm_free = affs_count_free_bits(sb->s_blocksize - 4, bh->b_data + 4);
+                bm->bm_free = memweight(bh->b_data + 4, sb->s_blocksize - 4);
 
                 /* Don't try read the extension if this is the last block,
                  * but we also need the right bm pointer below
@@ -367,7 +343,7 @@ int affs_init_bitmap(struct super_block *sb, int *flags)
 
         /* recalculate bitmap count for last block */
         bm--;
-        bm->bm_free = affs_count_free_bits(sb->s_blocksize - 4, bh->b_data + 4);
+        bm->bm_free = memweight(bh->b_data + 4, sb->s_blocksize - 4);
 
 out:
         affs_brelse(bh);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index adb1cd7ceb9b..4bab807227ad 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3342,10 +3342,22 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size);
 /* super.c */
 int btrfs_parse_options(struct btrfs_root *root, char *options);
 int btrfs_sync_fs(struct super_block *sb, int wait);
+
+#ifdef CONFIG_PRINTK
+__printf(2, 3)
 void btrfs_printk(struct btrfs_fs_info *fs_info, const char *fmt, ...);
+#else
+static inline __printf(2, 3)
+void btrfs_printk(struct btrfs_fs_info *fs_info, const char *fmt, ...)
+{
+}
+#endif
+
+__printf(5, 6)
 void __btrfs_std_error(struct btrfs_fs_info *fs_info, const char *function,
                      unsigned int line, int errno, const char *fmt, ...);
 
+
 void __btrfs_abort_transaction(struct btrfs_trans_handle *trans,
                                struct btrfs_root *root, const char *function,
                                unsigned int line, int errno);
@@ -3386,6 +3398,7 @@ do {								\
                           (errno), fmt, ##args);                \
 } while (0)
 
+__printf(5, 6)
 void __btrfs_panic(struct btrfs_fs_info *fs_info, const char *function,
                    unsigned int line, int errno, const char *fmt, ...);
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 502b20c56e84..fadeba6a5db9 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1114,7 +1114,7 @@ void clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                 spin_unlock(&root->fs_info->delalloc_lock);
                                 btrfs_panic(root->fs_info, -EOVERFLOW,
                                           "Can't clear %lu bytes from "
-                                          " dirty_mdatadata_bytes (%lu)",
+                                          " dirty_mdatadata_bytes (%llu)",
                                           buf->len,
                                           root->fs_info->dirty_metadata_bytes);
                         }
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index c5dbd9149679..4da08652004d 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1241,7 +1241,7 @@ static int __must_check __add_reloc_root(struct btrfs_root *root)
         if (rb_node) {
                 btrfs_panic(root->fs_info, -EEXIST, "Duplicate root found "
                             "for start=%llu while inserting into relocation "
-                            "tree\n");
+                            "tree\n", node->bytenr);
                 kfree(node);
                 return -EEXIST;
         }
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index fa61ef59cd61..8c6e61d6eed5 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -125,6 +125,7 @@ static void btrfs_handle_error(struct btrfs_fs_info *fs_info)
         }
 }
 
+#ifdef CONFIG_PRINTK
 /*
  * __btrfs_std_error decodes expected errors from the caller and
  * invokes the approciate error response.
@@ -167,7 +168,7 @@ void __btrfs_std_error(struct btrfs_fs_info *fs_info, const char *function,
         va_end(args);
 }
 
-const char *logtypes[] = {
+static const char * const logtypes[] = {
         "emergency",
         "alert",
         "critical",
@@ -185,22 +186,50 @@ void btrfs_printk(struct btrfs_fs_info *fs_info, const char *fmt, ...)
         struct va_format vaf;
         va_list args;
         const char *type = logtypes[4];
+        int kern_level;
 
         va_start(args, fmt);
 
-        if (fmt[0] == '<' && isdigit(fmt[1]) && fmt[2] == '>') {
-                memcpy(lvl, fmt, 3);
-                lvl[3] = '\0';
-                fmt += 3;
-                type = logtypes[fmt[1] - '0'];
+        kern_level = printk_get_level(fmt);
+        if (kern_level) {
+                size_t size = printk_skip_level(fmt) - fmt;
+                memcpy(lvl, fmt,  size);
+                lvl[size] = '\0';
+                fmt += size;
+                type = logtypes[kern_level - '0'];
         } else
                 *lvl = '\0';
 
         vaf.fmt = fmt;
         vaf.va = &args;
+
         printk("%sBTRFS %s (device %s): %pV", lvl, type, sb->s_id, &vaf);
+
+        va_end(args);
 }
 
+#else
+
+void __btrfs_std_error(struct btrfs_fs_info *fs_info, const char *function,
+                       unsigned int line, int errno, const char *fmt, ...)
+{
+        struct super_block *sb = fs_info->sb;
+
+        /*
+         * Special case: if the error is EROFS, and we're already
+         * under MS_RDONLY, then it is safe here.
+         */
+        if (errno == -EROFS && (sb->s_flags & MS_RDONLY))
+                return;
+
+        /* Don't go through full error handling during mount */
+        if (sb->s_flags & MS_BORN) {
+                save_error_info(fs_info);
+                btrfs_handle_error(fs_info);
+        }
+}
+#endif
+
 /*
  * We only mark the transaction aborted and then set the file system read-only.
  * This will prevent new transactions from starting or trying to join this
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index c0353dfac51f..c994691d9445 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -919,7 +919,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
          * own time */
         path.mnt = cache->mnt;
         path.dentry = object->backer;
-        file = dentry_open(&path, O_RDWR, cache->cache_cred);
+        file = dentry_open(&path, O_RDWR | O_LARGEFILE, cache->cache_cred);
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
         } else {
diff --git a/fs/exec.c b/fs/exec.c
index e95aeeddd25c..3684353ebd5f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -2002,17 +2002,17 @@ static void coredump_finish(struct mm_struct *mm)
 void set_dumpable(struct mm_struct *mm, int value)
 {
         switch (value) {
-        case 0:
+        case SUID_DUMPABLE_DISABLED:
                 clear_bit(MMF_DUMPABLE, &mm->flags);
                 smp_wmb();
                 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
                 break;
-        case 1:
+        case SUID_DUMPABLE_ENABLED:
                 set_bit(MMF_DUMPABLE, &mm->flags);
                 smp_wmb();
                 clear_bit(MMF_DUMP_SECURELY, &mm->flags);
                 break;
-        case 2:
+        case SUID_DUMPABLE_SAFE:
                 set_bit(MMF_DUMP_SECURELY, &mm->flags);
                 smp_wmb();
                 set_bit(MMF_DUMPABLE, &mm->flags);
@@ -2025,7 +2025,7 @@ static int __get_dumpable(unsigned long mm_flags)
         int ret;
 
         ret = mm_flags & MMF_DUMPABLE_MASK;
-        return (ret >= 2) ? 2 : ret;
+        return (ret > SUID_DUMPABLE_ENABLED) ? SUID_DUMPABLE_SAFE : ret;
 }
 
 int get_dumpable(struct mm_struct *mm)
@@ -2111,6 +2111,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         int retval = 0;
         int flag = 0;
         int ispipe;
+        bool need_nonrelative = false;
         static atomic_t core_dump_count = ATOMIC_INIT(0);
         struct coredump_params cprm = {
                 .signr = signr,
@@ -2136,14 +2137,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
         if (!cred)
                 goto fail;
         /*
-         *      We cannot trust fsuid as being the "true" uid of the
-         *      process nor do we know its entire history. We only know it
-         *      was tainted so we dump it as root in mode 2.
+         * We cannot trust fsuid as being the "true" uid of the process
+         * nor do we know its entire history. We only know it was tainted
+         * so we dump it as root in mode 2, and only into a controlled
+         * environment (pipe handler or fully qualified path).
          */
-        if (__get_dumpable(cprm.mm_flags) == 2) {
+        if (__get_dumpable(cprm.mm_flags) == SUID_DUMPABLE_SAFE) {
                 /* Setuid core dump mode */
                 flag = O_EXCL;          /* Stop rewrite attacks */
                 cred->fsuid = GLOBAL_ROOT_UID;  /* Dump root private */
+                need_nonrelative = true;
         }
 
         retval = coredump_wait(exit_code, &core_state);
@@ -2171,15 +2174,16 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
                 }
 
                 if (cprm.limit == 1) {
-                        /*
+                        /* See umh_pipe_setup() which sets RLIMIT_CORE = 1.
+                         *
                          * Normally core limits are irrelevant to pipes, since
                          * we're not writing to the file system, but we use
-                         * cprm.limit of 1 here as a speacial value. Any
-                         * non-1 limit gets set to RLIM_INFINITY below, but
-                         * a limit of 0 skips the dump.  This is a consistent
-                         * way to catch recursive crashes.  We can still crash
-                         * if the core_pattern binary sets RLIM_CORE =  !1
-                         * but it runs as root, and can do lots of stupid things
+                         * cprm.limit of 1 here as a speacial value, this is a
+                         * consistent way to catch recursive crashes.
+                         * We can still crash if the core_pattern binary sets
+                         * RLIM_CORE = !1, but it runs as root, and can do
+                         * lots of stupid things.
+                         *
                          * Note that we use task_tgid_vnr here to grab the pid
                          * of the process group leader.  That way we get the
                          * right pid if a thread in a multi-threaded
@@ -2223,6 +2227,14 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs)
                 if (cprm.limit < binfmt->min_coredump)
                         goto fail_unlock;
 
+                if (need_nonrelative && cn.corename[0] != '/') {
+                        printk(KERN_WARNING "Pid %d(%s) can only dump core "\
+                                "to fully qualified path!\n",
+                                task_tgid_vnr(current), current->comm);
+                        printk(KERN_WARNING "Skipping core dump\n");
+                        goto fail_unlock;
+                }
+
                 cprm.file = filp_open(cn.corename,
                                  O_CREAT | 2 | O_NOFOLLOW | O_LARGEFILE | flag,
                                  0600);
diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c
index 1c3613998862..376aa77f3ca7 100644
--- a/fs/ext2/balloc.c
+++ b/fs/ext2/balloc.c
@@ -1444,19 +1444,9 @@ ext2_fsblk_t ext2_new_block(struct inode *inode, unsigned long goal, int *errp)
 
 #ifdef EXT2FS_DEBUG
 
-static const int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0};
-
-unsigned long ext2_count_free (struct buffer_head * map, unsigned int numchars)
+unsigned long ext2_count_free(struct buffer_head *map, unsigned int numchars)
 {
-        unsigned int i;
-        unsigned long sum = 0;
-
-        if (!map)
-                return (0);
-        for (i = 0; i < numchars; i++)
-                sum += nibblemap[map->b_data[i] & 0xf] +
-                        nibblemap[(map->b_data[i] >> 4) & 0xf];
-        return (sum);
+        return numchars * BITS_PER_BYTE - memweight(map->b_data, numchars);
 }
 
 #endif  /*  EXT2FS_DEBUG  */
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index c13eb7b91a11..8f370e012e61 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -644,6 +644,7 @@ unsigned long ext2_count_free_inodes (struct super_block * sb)
         }
         brelse(bitmap_bh);
         printk("ext2_count_free_inodes: stored = %lu, computed = %lu, %lu\n",
+                (unsigned long)
                 percpu_counter_read(&EXT2_SB(sb)->s_freeinodes_counter),
                 desc_count, bitmap_count);
         return desc_count;
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 25cd60892116..90d901f0486b 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -1813,7 +1813,7 @@ ext3_fsblk_t ext3_count_free_blocks(struct super_block *sb)
         brelse(bitmap_bh);
         printk("ext3_count_free_blocks: stored = "E3FSBLK
                 ", computed = "E3FSBLK", "E3FSBLK"\n",
-               le32_to_cpu(es->s_free_blocks_count),
+               (ext3_fsblk_t)le32_to_cpu(es->s_free_blocks_count),
                 desc_count, bitmap_count);
         return bitmap_count;
 #else
diff --git a/fs/ext3/bitmap.c b/fs/ext3/bitmap.c
index 909d13e26560..ef9c643e8e9d 100644
--- a/fs/ext3/bitmap.c
+++ b/fs/ext3/bitmap.c
@@ -11,19 +11,9 @@
 
 #ifdef EXT3FS_DEBUG
 
-static const int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0};
-
 unsigned long ext3_count_free (struct buffer_head * map, unsigned int numchars)
 {
-        unsigned int i;
-        unsigned long sum = 0;
-
-        if (!map)
-                return (0);
-        for (i = 0; i < numchars; i++)
-                sum += nibblemap[map->b_data[i] & 0xf] +
-                        nibblemap[(map->b_data[i] >> 4) & 0xf];
-        return (sum);
+        return numchars * BITS_PER_BYTE - memweight(map->b_data, numchars);
 }
 
 #endif  /*  EXT3FS_DEBUG  */
diff --git a/fs/ext4/bitmap.c b/fs/ext4/bitmap.c
index a94b9c63ee5c..f8716eab9995 100644
--- a/fs/ext4/bitmap.c
+++ b/fs/ext4/bitmap.c
@@ -11,16 +11,9 @@
 #include <linux/jbd2.h>
 #include "ext4.h"
 
-static const int nibblemap[] = {4, 3, 3, 2, 3, 2, 2, 1, 3, 2, 2, 1, 2, 1, 1, 0};
-
 unsigned int ext4_count_free(char *bitmap, unsigned int numchars)
 {
-        unsigned int i, sum = 0;
-
-        for (i = 0; i < numchars; i++)
-                sum += nibblemap[bitmap[i] & 0xf] +
-                        nibblemap[(bitmap[i] >> 4) & 0xf];
-        return sum;
+        return numchars * BITS_PER_BYTE - memweight(bitmap, numchars);
 }
 
 int ext4_inode_bitmap_csum_verify(struct super_block *sb, ext4_group_t group,
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 6eaa28c98ad1..dc49ed2cbffa 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -35,6 +35,11 @@
 #define FAT_MAX_UNI_CHARS       ((MSDOS_SLOTS - 1) * 13 + 1)
 #define FAT_MAX_UNI_SIZE        (FAT_MAX_UNI_CHARS * sizeof(wchar_t))
 
+static inline unsigned char fat_tolower(unsigned char c)
+{
+        return ((c >= 'A') && (c <= 'Z')) ? c+32 : c;
+}
+
 static inline loff_t fat_make_i_pos(struct super_block *sb,
                                     struct buffer_head *bh,
                                     struct msdos_dir_entry *de)
@@ -333,6 +338,124 @@ parse_long:
         return 0;
 }
 
+/**
+ * fat_parse_short - Parse MS-DOS (short) directory entry.
+ * @sb:         superblock
+ * @de:         directory entry to parse
+ * @name:       FAT_MAX_SHORT_SIZE array in which to place extracted name
+ * @dot_hidden: Nonzero == prepend '.' to names with ATTR_HIDDEN
+ *
+ * Returns the number of characters extracted into 'name'.
+ */
+static int fat_parse_short(struct super_block *sb,
+                           const struct msdos_dir_entry *de,
+                           unsigned char *name, int dot_hidden)
+{
+        const struct msdos_sb_info *sbi = MSDOS_SB(sb);
+        int isvfat = sbi->options.isvfat;
+        int nocase = sbi->options.nocase;
+        unsigned short opt_shortname = sbi->options.shortname;
+        struct nls_table *nls_disk = sbi->nls_disk;
+        wchar_t uni_name[14];
+        unsigned char c, work[MSDOS_NAME];
+        unsigned char *ptname = name;
+        int chi, chl, i, j, k;
+        int dotoffset = 0;
+        int name_len = 0, uni_len = 0;
+
+        if (!isvfat && dot_hidden && (de->attr & ATTR_HIDDEN)) {
+                *ptname++ = '.';
+                dotoffset = 1;
+        }
+
+        memcpy(work, de->name, sizeof(work));
+        /* see namei.c, msdos_format_name */
+        if (work[0] == 0x05)
+                work[0] = 0xE5;
+
+        /* Filename */
+        for (i = 0, j = 0; i < 8;) {
+                c = work[i];
+                if (!c)
+                        break;
+                chl = fat_shortname2uni(nls_disk, &work[i], 8 - i,
+                                        &uni_name[j++], opt_shortname,
+                                        de->lcase & CASE_LOWER_BASE);
+                if (chl <= 1) {
+                        if (!isvfat)
+                                ptname[i] = nocase ? c : fat_tolower(c);
+                        i++;
+                        if (c != ' ') {
+                                name_len = i;
+                                uni_len  = j;
+                        }
+                } else {
+                        uni_len = j;
+                        if (isvfat)
+                                i += min(chl, 8-i);
+                        else {
+                                for (chi = 0; chi < chl && i < 8; chi++, i++)
+                                        ptname[i] = work[i];
+                        }
+                        if (chl)
+                                name_len = i;
+                }
+        }
+
+        i = name_len;
+        j = uni_len;
+        fat_short2uni(nls_disk, ".", 1, &uni_name[j++]);
+        if (!isvfat)
+                ptname[i] = '.';
+        i++;
+
+        /* Extension */
+        for (k = 8; k < MSDOS_NAME;) {
+                c = work[k];
+                if (!c)
+                        break;
+                chl = fat_shortname2uni(nls_disk, &work[k], MSDOS_NAME - k,
+                                        &uni_name[j++], opt_shortname,
+                                        de->lcase & CASE_LOWER_EXT);
+                if (chl <= 1) {
+                        k++;
+                        if (!isvfat)
+                                ptname[i] = nocase ? c : fat_tolower(c);
+                        i++;
+                        if (c != ' ') {
+                                name_len = i;
+                                uni_len  = j;
+                        }
+                } else {
+                        uni_len = j;
+                        if (isvfat) {
+                                int offset = min(chl, MSDOS_NAME-k);
+                                k += offset;
+                                i += offset;
+                        } else {
+                                for (chi = 0; chi < chl && k < MSDOS_NAME;
+                                     chi++, i++, k++) {
+                                                ptname[i] = work[k];
+                                }
+                        }
+                        if (chl)
+                                name_len = i;
+                }
+        }
+
+        if (name_len > 0) {
+                name_len += dotoffset;
+
+                if (sbi->options.isvfat) {
+                        uni_name[uni_len] = 0x0000;
+                        name_len = fat_uni_to_x8(sb, uni_name, name,
+                                                 FAT_MAX_SHORT_SIZE);
+                }
+        }
+
+        return name_len;
+}
+
 /*
  * Return values: negative -> error, 0 -> not found, positive -> found,
  * value is the total amount of slots, including the shortname entry.
@@ -344,15 +467,11 @@ int fat_search_long(struct inode *inode, const unsigned char *name,
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct buffer_head *bh = NULL;
         struct msdos_dir_entry *de;
-        struct nls_table *nls_disk = sbi->nls_disk;
         unsigned char nr_slots;
-        wchar_t bufuname[14];
         wchar_t *unicode = NULL;
-        unsigned char work[MSDOS_NAME];
         unsigned char bufname[FAT_MAX_SHORT_SIZE];
-        unsigned short opt_shortname = sbi->options.shortname;
         loff_t cpos = 0;
-        int chl, i, j, last_u, err, len;
+        int err, len;
 
         err = -ENOENT;
         while (1) {
@@ -380,47 +499,16 @@ parse_record:
                                 goto end_of_dir;
                 }
 
-                memcpy(work, de->name, sizeof(de->name));
-                /* see namei.c, msdos_format_name */
-                if (work[0] == 0x05)
-                        work[0] = 0xE5;
-                for (i = 0, j = 0, last_u = 0; i < 8;) {
-                        if (!work[i])
-                                break;
-                        chl = fat_shortname2uni(nls_disk, &work[i], 8 - i,
-                                                &bufuname[j++], opt_shortname,
-                                                de->lcase & CASE_LOWER_BASE);
-                        if (chl <= 1) {
-                                if (work[i] != ' ')
-                                        last_u = j;
-                        } else {
-                                last_u = j;
-                        }
-                        i += chl;
-                }
-                j = last_u;
-                fat_short2uni(nls_disk, ".", 1, &bufuname[j++]);
-                for (i = 8; i < MSDOS_NAME;) {
-                        if (!work[i])
-                                break;
-                        chl = fat_shortname2uni(nls_disk, &work[i],
-                                                MSDOS_NAME - i,
-                                                &bufuname[j++], opt_shortname,
-                                                de->lcase & CASE_LOWER_EXT);
-                        if (chl <= 1) {
-                                if (work[i] != ' ')
-                                        last_u = j;
-                        } else {
-                                last_u = j;
-                        }
-                        i += chl;
-                }
-                if (!last_u)
+                /* Never prepend '.' to hidden files here.
+                 * That is done only for msdos mounts (and only when
+                 * 'dotsOK=yes'); if we are executing here, it is in the
+                 * context of a vfat mount.
+                 */
+                len = fat_parse_short(sb, de, bufname, 0);
+                if (len == 0)
                         continue;
 
                 /* Compare shortname */
-                bufuname[last_u] = 0x0000;
-                len = fat_uni_to_x8(sb, bufuname, bufname, sizeof(bufname));
                 if (fat_name_match(sbi, name, name_len, bufname, len))
                         goto found;
 
@@ -469,20 +557,15 @@ static int __fat_readdir(struct inode *inode, struct file *filp, void *dirent,
         struct msdos_sb_info *sbi = MSDOS_SB(sb);
         struct buffer_head *bh;
         struct msdos_dir_entry *de;
-        struct nls_table *nls_disk = sbi->nls_disk;
         unsigned char nr_slots;
-        wchar_t bufuname[14];
         wchar_t *unicode = NULL;
-        unsigned char c, work[MSDOS_NAME];
-        unsigned char bufname[FAT_MAX_SHORT_SIZE], *ptname = bufname;
-        unsigned short opt_shortname = sbi->options.shortname;
+        unsigned char bufname[FAT_MAX_SHORT_SIZE];
         int isvfat = sbi->options.isvfat;
-        int nocase = sbi->options.nocase;
         const char *fill_name = NULL;
         unsigned long inum;
         unsigned long lpos, dummy, *furrfu = &lpos;
         loff_t cpos;
-        int chi, chl, i, i2, j, last, last_u, dotoffset = 0, fill_len = 0;
+        int short_len = 0, fill_len = 0;
         int ret = 0;
 
         lock_super(sb);
@@ -556,74 +639,10 @@ parse_record:
                 }
         }
 
-        if (sbi->options.dotsOK) {
-                ptname = bufname;
-                dotoffset = 0;
-                if (de->attr & ATTR_HIDDEN) {
-                        *ptname++ = '.';
-                        dotoffset = 1;
-                }
-        }
-
-        memcpy(work, de->name, sizeof(de->name));
-        /* see namei.c, msdos_format_name */
-        if (work[0] == 0x05)
-                work[0] = 0xE5;
-        for (i = 0, j = 0, last = 0, last_u = 0; i < 8;) {
-                if (!(c = work[i]))
-                        break;
-                chl = fat_shortname2uni(nls_disk, &work[i], 8 - i,
-                                        &bufuname[j++], opt_shortname,
-                                        de->lcase & CASE_LOWER_BASE);
-                if (chl <= 1) {
-                        ptname[i++] = (!nocase && c>='A' && c<='Z') ? c+32 : c;
-                        if (c != ' ') {
-                                last = i;
-                                last_u = j;
-                        }
-                } else {
-                        last_u = j;
-                        for (chi = 0; chi < chl && i < 8; chi++) {
-                                ptname[i] = work[i];
-                                i++; last = i;
-                        }
-                }
-        }
-        i = last;
-        j = last_u;
-        fat_short2uni(nls_disk, ".", 1, &bufuname[j++]);
-        ptname[i++] = '.';
-        for (i2 = 8; i2 < MSDOS_NAME;) {
-                if (!(c = work[i2]))
-                        break;
-                chl = fat_shortname2uni(nls_disk, &work[i2], MSDOS_NAME - i2,
-                                        &bufuname[j++], opt_shortname,
-                                        de->lcase & CASE_LOWER_EXT);
-                if (chl <= 1) {
-                        i2++;
-                        ptname[i++] = (!nocase && c>='A' && c<='Z') ? c+32 : c;
-                        if (c != ' ') {
-                                last = i;
-                                last_u = j;
-                        }
-                } else {
-                        last_u = j;
-                        for (chi = 0; chi < chl && i2 < MSDOS_NAME; chi++) {
-                                ptname[i++] = work[i2++];
-                                last = i;
-                        }
-                }
-        }
-        if (!last)
+        short_len = fat_parse_short(sb, de, bufname, sbi->options.dotsOK);
+        if (short_len == 0)
                 goto record_end;
 
-        i = last + dotoffset;
-        j = last_u;
-
-        if (isvfat) {
-                bufuname[j] = 0x0000;
-                i = fat_uni_to_x8(sb, bufuname, bufname, sizeof(bufname));
-        }
         if (nr_slots) {
                 /* hack for fat_ioctl_filldir() */
                 struct fat_ioctl_filldir_callback *p = dirent;
@@ -631,12 +650,12 @@ parse_record:
                 p->longname = fill_name;
                 p->long_len = fill_len;
                 p->shortname = bufname;
-                p->short_len = i;
+                p->short_len = short_len;
                 fill_name = NULL;
                 fill_len = 0;
         } else {
                 fill_name = bufname;
-                fill_len = i;
+                fill_len = short_len;
         }
 
 start_filldir:
diff --git a/fs/fat/fat.h b/fs/fat/fat.h
index fc35c5c69136..2deeeb86f331 100644
--- a/fs/fat/fat.h
+++ b/fs/fat/fat.h
@@ -217,6 +217,21 @@ static inline void fat16_towchar(wchar_t *dst, const __u8 *src, size_t len)
 #endif
 }
 
+static inline int fat_get_start(const struct msdos_sb_info *sbi,
+                                const struct msdos_dir_entry *de)
+{
+        int cluster = le16_to_cpu(de->start);
+        if (sbi->fat_bits == 32)
+                cluster |= (le16_to_cpu(de->starthi) << 16);
+        return cluster;
+}
+
+static inline void fat_set_start(struct msdos_dir_entry *de, int cluster)
+{
+        de->start   = cpu_to_le16(cluster);
+        de->starthi = cpu_to_le16(cluster >> 16);
+}
+
 static inline void fatwchar_to16(__u8 *dst, const wchar_t *src, size_t len)
 {
 #ifdef __BIG_ENDIAN
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 0038b32cb362..05e897fe9866 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -369,10 +369,7 @@ static int fat_fill_inode(struct inode *inode, struct msdos_dir_entry *de)
                 inode->i_op = sbi->dir_ops;
                 inode->i_fop = &fat_dir_operations;
 
-                MSDOS_I(inode)->i_start = le16_to_cpu(de->start);
-                if (sbi->fat_bits == 32)
-                        MSDOS_I(inode)->i_start |= (le16_to_cpu(de->starthi) << 16);
-
+                MSDOS_I(inode)->i_start = fat_get_start(sbi, de);
                 MSDOS_I(inode)->i_logstart = MSDOS_I(inode)->i_start;
                 error = fat_calc_dir_size(inode);
                 if (error < 0)
@@ -385,9 +382,7 @@ static int fat_fill_inode(struct inode *inode, struct msdos_dir_entry *de)
                 inode->i_mode = fat_make_mode(sbi, de->attr,
                         ((sbi->options.showexec && !is_exec(de->name + 8))
                          ? S_IRUGO|S_IWUGO : S_IRWXUGO));
-                MSDOS_I(inode)->i_start = le16_to_cpu(de->start);
-                if (sbi->fat_bits == 32)
-                        MSDOS_I(inode)->i_start |= (le16_to_cpu(de->starthi) << 16);
+                MSDOS_I(inode)->i_start = fat_get_start(sbi, de);
 
                 MSDOS_I(inode)->i_logstart = MSDOS_I(inode)->i_start;
                 inode->i_size = le32_to_cpu(de->size);
@@ -613,8 +608,7 @@ retry:
         else
                 raw_entry->size = cpu_to_le32(inode->i_size);
         raw_entry->attr = fat_make_attrs(inode);
-        raw_entry->start = cpu_to_le16(MSDOS_I(inode)->i_logstart);
-        raw_entry->starthi = cpu_to_le16(MSDOS_I(inode)->i_logstart >> 16);
+        fat_set_start(raw_entry, MSDOS_I(inode)->i_logstart);
         fat_time_unix2fat(sbi, &inode->i_mtime, &raw_entry->time,
                           &raw_entry->date, NULL);
         if (sbi->options.isvfat) {
diff --git a/fs/fat/namei_msdos.c b/fs/fat/namei_msdos.c
index 70d993a93805..b0e12bf9f4a1 100644
--- a/fs/fat/namei_msdos.c
+++ b/fs/fat/namei_msdos.c
@@ -246,8 +246,7 @@ static int msdos_add_entry(struct inode *dir, const unsigned char *name,
         de.ctime_cs = 0;
         de.time = time;
         de.date = date;
-        de.start = cpu_to_le16(cluster);
-        de.starthi = cpu_to_le16(cluster >> 16);
+        fat_set_start(&de, cluster);
         de.size = 0;
 
         err = fat_add_entries(dir, &de, 1, sinfo);
@@ -530,9 +529,7 @@ static int do_msdos_rename(struct inode *old_dir, unsigned char *old_name,
                 mark_inode_dirty(old_inode);
 
         if (update_dotdot) {
-                int start = MSDOS_I(new_dir)->i_logstart;
-                dotdot_de->start = cpu_to_le16(start);
-                dotdot_de->starthi = cpu_to_le16(start >> 16);
+                fat_set_start(dotdot_de, MSDOS_I(new_dir)->i_logstart);
                 mark_buffer_dirty_inode(dotdot_bh, old_inode);
                 if (IS_DIRSYNC(new_dir)) {
                         err = sync_dirty_buffer(dotdot_bh);
@@ -572,9 +569,7 @@ error_dotdot:
         corrupt = 1;
 
         if (update_dotdot) {
-                int start = MSDOS_I(old_dir)->i_logstart;
-                dotdot_de->start = cpu_to_le16(start);
-                dotdot_de->starthi = cpu_to_le16(start >> 16);
+                fat_set_start(dotdot_de, MSDOS_I(old_dir)->i_logstart);
                 mark_buffer_dirty_inode(dotdot_bh, old_inode);
                 corrupt |= sync_dirty_buffer(dotdot_bh);
         }
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 6cc480652433..6a6d8c0715a1 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -651,8 +651,7 @@ shortname:
         de->time = de->ctime = time;
         de->date = de->cdate = de->adate = date;
         de->ctime_cs = time_cs;
-        de->start = cpu_to_le16(cluster);
-        de->starthi = cpu_to_le16(cluster >> 16);
+        fat_set_start(de, cluster);
         de->size = 0;
 out_free:
         __putname(uname);
@@ -965,9 +964,7 @@ static int vfat_rename(struct inode *old_dir, struct dentry *old_dentry,
                 mark_inode_dirty(old_inode);
 
         if (update_dotdot) {
-                int start = MSDOS_I(new_dir)->i_logstart;
-                dotdot_de->start = cpu_to_le16(start);
-                dotdot_de->starthi = cpu_to_le16(start >> 16);
+                fat_set_start(dotdot_de, MSDOS_I(new_dir)->i_logstart);
                 mark_buffer_dirty_inode(dotdot_bh, old_inode);
                 if (IS_DIRSYNC(new_dir)) {
                         err = sync_dirty_buffer(dotdot_bh);
@@ -1009,9 +1006,7 @@ error_dotdot:
         corrupt = 1;
 
         if (update_dotdot) {
-                int start = MSDOS_I(old_dir)->i_logstart;
-                dotdot_de->start = cpu_to_le16(start);
-                dotdot_de->starthi = cpu_to_le16(start >> 16);
+                fat_set_start(dotdot_de, MSDOS_I(old_dir)->i_logstart);
                 mark_buffer_dirty_inode(dotdot_bh, old_inode);
                 corrupt |= sync_dirty_buffer(dotdot_bh);
         }
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 81b70e665bf0..887b5ba8c9b5 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -20,6 +20,7 @@
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
+#include <linux/user_namespace.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -340,6 +341,31 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
         return ret;
 }
 
+#ifdef CONFIG_CHECKPOINT_RESTORE
+static int f_getowner_uids(struct file *filp, unsigned long arg)
+{
+        struct user_namespace *user_ns = current_user_ns();
+        uid_t * __user dst = (void * __user)arg;
+        uid_t src[2];
+        int err;
+
+        read_lock(&filp->f_owner.lock);
+        src[0] = from_kuid(user_ns, filp->f_owner.uid);
+        src[1] = from_kuid(user_ns, filp->f_owner.euid);
+        read_unlock(&filp->f_owner.lock);
+
+        err  = put_user(src[0], &dst[0]);
+        err |= put_user(src[1], &dst[1]);
+
+        return err;
+}
+#else
+static int f_getowner_uids(struct file *filp, unsigned long arg)
+{
+        return -EINVAL;
+}
+#endif
+
 static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
                 struct file *filp)
 {
@@ -396,6 +422,9 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
         case F_SETOWN_EX:
                 err = f_setown_ex(filp, arg);
                 break;
+        case F_GETOWNER_UIDS:
+                err = f_getowner_uids(filp, arg);
+                break;
         case F_GETSIG:
                 err = filp->f_owner.signum;
                 break;
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 473332098013..fdafb2d71654 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -365,7 +365,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
         u64 last_fs_block, last_fs_page;
         int err;
 
-        err = -EINVAL;
+        err = -ENOMEM;
         sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
         if (!sbi)
                 goto out;
diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
index 13487ad16894..78e2d93e5c83 100644
--- a/fs/minix/itree_v2.c
+++ b/fs/minix/itree_v2.c
@@ -32,7 +32,8 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH])
         if (block < 0) {
                 printk("MINIX-fs: block_to_path: block %ld < 0 on dev %s\n",
                         block, bdevname(sb->s_bdev, b));
-        } else if (block >= (minix_sb(inode->i_sb)->s_max_size/sb->s_blocksize)) {
+        } else if ((u64)block * (u64)sb->s_blocksize >=
+                        minix_sb(sb)->s_max_size) {
                 if (printk_ratelimit())
                         printk("MINIX-fs: block_to_path: "
                                "block %ld too big on dev %s\n",
diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h
index f5fde36b9e28..fb7238100548 100644
--- a/fs/nilfs2/alloc.h
+++ b/fs/nilfs2/alloc.h
@@ -76,15 +76,23 @@ int nilfs_palloc_freev(struct inode *, __u64 *, size_t);
 #define nilfs_clear_bit_atomic          ext2_clear_bit_atomic
 #define nilfs_find_next_zero_bit        find_next_zero_bit_le
 
-/*
- * persistent object allocator cache
+/**
+ * struct nilfs_bh_assoc - block offset and buffer head association
+ * @blkoff: block offset
+ * @bh: buffer head
  */
-
 struct nilfs_bh_assoc {
         unsigned long blkoff;
         struct buffer_head *bh;
 };
 
+/**
+ * struct nilfs_palloc_cache - persistent object allocator cache
+ * @lock: cache protecting lock
+ * @prev_desc: blockgroup descriptors cache
+ * @prev_bitmap: blockgroup bitmap cache
+ * @prev_entry: translation entries cache
+ */
 struct nilfs_palloc_cache {
         spinlock_t lock;
         struct nilfs_bh_assoc prev_desc;
diff --git a/fs/nilfs2/bmap.h b/fs/nilfs2/bmap.h
index 40d9f453d31c..b89e68076adc 100644
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -135,6 +135,13 @@ struct nilfs_bmap {
 /* state */
 #define NILFS_BMAP_DIRTY        0x00000001
 
+/**
+ * struct nilfs_bmap_store - shadow copy of bmap state
+ * @data: cached raw block mapping of on-disk inode
+ * @last_allocated_key: cached value of last allocated key for data block
+ * @last_allocated_ptr: cached value of last allocated ptr for data block
+ * @state: cached value of state field of bmap structure
+ */
 struct nilfs_bmap_store {
         __le64 data[NILFS_BMAP_SIZE / sizeof(__le64)];
         __u64 last_allocated_key;
diff --git a/fs/nilfs2/btnode.h b/fs/nilfs2/btnode.h
index 3a4dd2d8d3fc..d876b565ce64 100644
--- a/fs/nilfs2/btnode.h
+++ b/fs/nilfs2/btnode.h
@@ -29,7 +29,13 @@
 #include <linux/fs.h>
 #include <linux/backing-dev.h>
 
-
+/**
+ * struct nilfs_btnode_chkey_ctxt - change key context
+ * @oldkey: old key of block's moving content
+ * @newkey: new key for block's content
+ * @bh: buffer head of old buffer
+ * @newbh: buffer head of new buffer
+ */
 struct nilfs_btnode_chkey_ctxt {
         __u64 oldkey;
         __u64 newkey;
diff --git a/fs/nilfs2/cpfile.c b/fs/nilfs2/cpfile.c
index dab5c4c6dfaf..deaa3d33a0aa 100644
--- a/fs/nilfs2/cpfile.c
+++ b/fs/nilfs2/cpfile.c
@@ -286,7 +286,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
         __u64 cno;
         void *kaddr;
         unsigned long tnicps;
-        int ret, ncps, nicps, count, i;
+        int ret, ncps, nicps, nss, count, i;
 
         if (unlikely(start == 0 || start > end)) {
                 printk(KERN_ERR "%s: invalid range of checkpoint numbers: "
@@ -301,6 +301,7 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
         if (ret < 0)
                 goto out_sem;
         tnicps = 0;
+        nss = 0;
 
         for (cno = start; cno < end; cno += ncps) {
                 ncps = nilfs_cpfile_checkpoints_in_block(cpfile, cno, end);
@@ -318,8 +319,9 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
                         cpfile, cno, cp_bh, kaddr);
                 nicps = 0;
                 for (i = 0; i < ncps; i++, cp = (void *)cp + cpsz) {
-                        WARN_ON(nilfs_checkpoint_snapshot(cp));
-                        if (!nilfs_checkpoint_invalid(cp)) {
+                        if (nilfs_checkpoint_snapshot(cp)) {
+                                nss++;
+                        } else if (!nilfs_checkpoint_invalid(cp)) {
                                 nilfs_checkpoint_set_invalid(cp);
                                 nicps++;
                         }
@@ -364,6 +366,8 @@ int nilfs_cpfile_delete_checkpoints(struct inode *cpfile,
         }
 
         brelse(header_bh);
+        if (nss > 0)
+                ret = -EBUSY;
 
  out_sem:
         up_write(&NILFS_MDT(cpfile)->mi_sem);
diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
index b5c13f3576b9..fa0f80308c2d 100644
--- a/fs/nilfs2/dat.c
+++ b/fs/nilfs2/dat.c
@@ -33,6 +33,12 @@
 #define NILFS_CNO_MIN   ((__u64)1)
 #define NILFS_CNO_MAX   (~(__u64)0)
 
+/**
+ * struct nilfs_dat_info - on-memory private data of DAT file
+ * @mi: on-memory private data of metadata file
+ * @palloc_cache: persistent object allocator cache of DAT file
+ * @shadow: shadow map of DAT file
+ */
 struct nilfs_dat_info {
         struct nilfs_mdt_info mi;
         struct nilfs_palloc_cache palloc_cache;
diff --git a/fs/nilfs2/export.h b/fs/nilfs2/export.h
index a71cc412b651..19ccbf9522ab 100644
--- a/fs/nilfs2/export.h
+++ b/fs/nilfs2/export.h
@@ -5,6 +5,14 @@
 
 extern const struct export_operations nilfs_export_ops;
 
+/**
+ * struct nilfs_fid - NILFS file id type
+ * @cno: checkpoint number
+ * @ino: inode number
+ * @gen: file generation (version) for NFS
+ * @parent_gen: parent generation (version) for NFS
+ * @parent_ino: parent inode number
+ */
 struct nilfs_fid {
         u64 cno;
         u64 ino;
diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c
index 5a48df79d674..d8e65bde083c 100644
--- a/fs/nilfs2/ifile.c
+++ b/fs/nilfs2/ifile.c
@@ -29,7 +29,11 @@
 #include "alloc.h"
 #include "ifile.h"
 
-
+/**
+ * struct nilfs_ifile_info - on-memory private data of ifile
+ * @mi: on-memory private data of metadata file
+ * @palloc_cache: persistent object allocator cache of ifile
+ */
 struct nilfs_ifile_info {
         struct nilfs_mdt_info mi;
         struct nilfs_palloc_cache palloc_cache;
diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
index 7cc64465ec26..6e2c3db976b2 100644
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -34,6 +34,13 @@
 #include "cpfile.h"
 #include "ifile.h"
 
+/**
+ * struct nilfs_iget_args - arguments used during comparison between inodes
+ * @ino: inode number
+ * @cno: checkpoint number
+ * @root: pointer on NILFS root object (mounted checkpoint)
+ * @for_gc: inode for GC flag
+ */
 struct nilfs_iget_args {
         u64 ino;
         __u64 cno;
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 06658caa18bd..0b6387c67e6c 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -182,7 +182,7 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         if (copy_from_user(&cpmode, argp, sizeof(cpmode)))
                 goto out;
 
-        down_read(&inode->i_sb->s_umount);
+        mutex_lock(&nilfs->ns_snapshot_mount_mutex);
 
         nilfs_transaction_begin(inode->i_sb, &ti, 0);
         ret = nilfs_cpfile_change_cpmode(
@@ -192,7 +192,7 @@ static int nilfs_ioctl_change_cpmode(struct inode *inode, struct file *filp,
         else
                 nilfs_transaction_commit(inode->i_sb); /* never fails */
 
-        up_read(&inode->i_sb->s_umount);
+        mutex_unlock(&nilfs->ns_snapshot_mount_mutex);
 out:
         mnt_drop_write_file(filp);
         return ret;
diff --git a/fs/nilfs2/mdt.h b/fs/nilfs2/mdt.h
index ab20a4baa50f..ab172e8549c5 100644
--- a/fs/nilfs2/mdt.h
+++ b/fs/nilfs2/mdt.h
@@ -28,6 +28,13 @@
 #include "nilfs.h"
 #include "page.h"
 
+/**
+ * struct nilfs_shadow_map - shadow mapping of meta data file
+ * @bmap_store: shadow copy of bmap state
+ * @frozen_data: shadowed dirty data pages
+ * @frozen_btnodes: shadowed dirty b-tree nodes' pages
+ * @frozen_buffers: list of frozen buffers
+ */
 struct nilfs_shadow_map {
         struct nilfs_bmap_store bmap_store;
         struct address_space frozen_data;
diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
index 250add84da76..74cece80e9a3 100644
--- a/fs/nilfs2/nilfs.h
+++ b/fs/nilfs2/nilfs.h
@@ -32,8 +32,21 @@
 #include "the_nilfs.h"
 #include "bmap.h"
 
-/*
- * nilfs inode data in memory
+/**
+ * struct nilfs_inode_info - nilfs inode data in memory
+ * @i_flags: inode flags
+ * @i_state: dynamic state flags
+ * @i_bmap: pointer on i_bmap_data
+ * @i_bmap_data: raw block mapping
+ * @i_xattr: <TODO>
+ * @i_dir_start_lookup: page index of last successful search
+ * @i_cno: checkpoint number for GC inode
+ * @i_btnode_cache: cached pages of b-tree nodes
+ * @i_dirty: list for connecting dirty files
+ * @xattr_sem: semaphore for extended attributes processing
+ * @i_bh: buffer contains disk inode
+ * @i_root: root object of the current filesystem tree
+ * @vfs_inode: VFS inode object
  */
 struct nilfs_inode_info {
         __u32 i_flags;
diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
index c5b7653a4391..3127e9f438a7 100644
--- a/fs/nilfs2/sufile.c
+++ b/fs/nilfs2/sufile.c
@@ -30,7 +30,13 @@
 #include "mdt.h"
 #include "sufile.h"
 
-
+/**
+ * struct nilfs_sufile_info - on-memory private data of sufile
+ * @mi: on-memory private data of metadata file
+ * @ncleansegs: number of clean segments
+ * @allocmin: lower limit of allocatable segment range
+ * @allocmax: upper limit of allocatable segment range
+ */
 struct nilfs_sufile_info {
         struct nilfs_mdt_info mi;
         unsigned long ncleansegs;/* number of clean segments */
diff --git a/fs/nilfs2/super.c b/fs/nilfs2/super.c
index d57c42f974ea..6522cac6057c 100644
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -677,7 +677,6 @@ static const struct super_operations nilfs_sops = {
         .destroy_inode  = nilfs_destroy_inode,
         .dirty_inode    = nilfs_dirty_inode,
         /* .write_inode    = nilfs_write_inode, */
-        /* .put_inode      = nilfs_put_inode, */
         /* .drop_inode    = nilfs_drop_inode, */
         .evict_inode    = nilfs_evict_inode,
         .put_super      = nilfs_put_super,
@@ -685,8 +684,6 @@ static const struct super_operations nilfs_sops = {
         .sync_fs        = nilfs_sync_fs,
         .freeze_fs      = nilfs_freeze,
         .unfreeze_fs    = nilfs_unfreeze,
-        /* .write_super_lockfs */
-        /* .unlockfs */
         .statfs         = nilfs_statfs,
         .remount_fs     = nilfs_remount,
         /* .umount_begin */
@@ -948,6 +945,8 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
         struct nilfs_root *root;
         int ret;
 
+        mutex_lock(&nilfs->ns_snapshot_mount_mutex);
+
         down_read(&nilfs->ns_segctor_sem);
         ret = nilfs_cpfile_is_snapshot(nilfs->ns_cpfile, cno);
         up_read(&nilfs->ns_segctor_sem);
@@ -972,6 +971,7 @@ static int nilfs_attach_snapshot(struct super_block *s, __u64 cno,
         ret = nilfs_get_root_dentry(s, root, root_dentry);
         nilfs_put_root(root);
  out:
+        mutex_unlock(&nilfs->ns_snapshot_mount_mutex);
         return ret;
 }
 
diff --git a/fs/nilfs2/the_nilfs.c b/fs/nilfs2/the_nilfs.c
index 501b7f8b739f..41e6a04a561f 100644
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -76,6 +76,7 @@ struct the_nilfs *alloc_nilfs(struct block_device *bdev)
         nilfs->ns_bdev = bdev;
         atomic_set(&nilfs->ns_ndirtyblks, 0);
         init_rwsem(&nilfs->ns_sem);
+        mutex_init(&nilfs->ns_snapshot_mount_mutex);
         INIT_LIST_HEAD(&nilfs->ns_dirty_files);
         INIT_LIST_HEAD(&nilfs->ns_gc_inodes);
         spin_lock_init(&nilfs->ns_inode_lock);
diff --git a/fs/nilfs2/the_nilfs.h b/fs/nilfs2/the_nilfs.h
index 9992b11312ff..6eee4177807b 100644
--- a/fs/nilfs2/the_nilfs.h
+++ b/fs/nilfs2/the_nilfs.h
@@ -47,11 +47,13 @@ enum {
  * @ns_flags: flags
  * @ns_bdev: block device
  * @ns_sem: semaphore for shared states
+ * @ns_snapshot_mount_mutex: mutex to protect snapshot mounts
  * @ns_sbh: buffer heads of on-disk super blocks
  * @ns_sbp: pointers to super block data
  * @ns_sbwtime: previous write time of super block
  * @ns_sbwcount: write count of super block
  * @ns_sbsize: size of valid data in super block
+ * @ns_mount_state: file system state
  * @ns_seg_seq: segment sequence counter
  * @ns_segnum: index number of the latest full segment.
  * @ns_nextnum: index number of the full segment index to be used next
@@ -99,6 +101,7 @@ struct the_nilfs {
 
         struct block_device    *ns_bdev;
         struct rw_semaphore     ns_sem;
+        struct mutex            ns_snapshot_mount_mutex;
 
         /*
          * used for
@@ -229,9 +232,8 @@ THE_NILFS_FNS(SB_DIRTY, sb_dirty)
  * @count: refcount of this structure
  * @nilfs: nilfs object
  * @ifile: inode file
- * @root: root inode
  * @inodes_count: number of inodes
- * @blocks_count: number of blocks (Reserved)
+ * @blocks_count: number of blocks
  */
 struct nilfs_root {
         __u64 cno;
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index b341492542ca..2bc149d6a784 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -2660,31 +2660,14 @@ static const struct super_operations ntfs_sops = {
         .alloc_inode    = ntfs_alloc_big_inode,   /* VFS: Allocate new inode. */
         .destroy_inode  = ntfs_destroy_big_inode, /* VFS: Deallocate inode. */
 #ifdef NTFS_RW
-        //.dirty_inode  = NULL,                 /* VFS: Called from
-        //                                         __mark_inode_dirty(). */
         .write_inode    = ntfs_write_inode,     /* VFS: Write dirty inode to
                                                    disk. */
-        //.drop_inode   = NULL,                 /* VFS: Called just after the
-        //                                         inode reference count has
-        //                                         been decreased to zero.
-        //                                         NOTE: The inode lock is
-        //                                         held. See fs/inode.c::
-        //                                         generic_drop_inode(). */
-        //.delete_inode = NULL,                 /* VFS: Delete inode from disk.
-        //                                         Called when i_count becomes
-        //                                         0 and i_nlink is also 0. */
-        //.write_super  = NULL,                 /* Flush dirty super block to
-        //                                         disk. */
-        //.sync_fs      = NULL,                 /* ? */
-        //.write_super_lockfs   = NULL,         /* ? */
-        //.unlockfs     = NULL,                 /* ? */
 #endif /* NTFS_RW */
         .put_super      = ntfs_put_super,       /* Syscall: umount. */
         .statfs         = ntfs_statfs,          /* Syscall: statfs */
         .remount_fs     = ntfs_remount,         /* Syscall: mount -o remount. */
         .evict_inode    = ntfs_evict_big_inode, /* VFS: Called when an inode is
                                                    removed from memory. */
-        //.umount_begin = NULL,                 /* Forced umount. */
         .show_options   = ntfs_show_options,    /* Show mount options in
                                                    proc. */
 };
diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
index 210c35237548..a9f78c74d687 100644
--- a/fs/ocfs2/localalloc.c
+++ b/fs/ocfs2/localalloc.c
@@ -784,14 +784,10 @@ bail:
 
 static u32 ocfs2_local_alloc_count_bits(struct ocfs2_dinode *alloc)
 {
-        int i;
-        u8 *buffer;
-        u32 count = 0;
+        u32 count;
         struct ocfs2_local_alloc *la = OCFS2_LOCAL_ALLOC(alloc);
 
-        buffer = la->la_bitmap;
-        for (i = 0; i < le16_to_cpu(la->la_size); i++)
-                count += hweight8(buffer[i]);
+        count = memweight(la->la_bitmap, le16_to_cpu(la->la_size));
 
         trace_ocfs2_local_alloc_count_bits(count);
         return count;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 2772208338f8..1b6c84cbdb73 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -695,8 +695,6 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
                 mmput(mm);
         }
 
-        /* OK to pass negative loff_t, we can catch out-of-range */
-        file->f_mode |= FMODE_UNSIGNED_OFFSET;
         file->private_data = mm;
 
         return 0;
@@ -704,7 +702,12 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 
 static int mem_open(struct inode *inode, struct file *file)
 {
-        return __mem_open(inode, file, PTRACE_MODE_ATTACH);
+        int ret = __mem_open(inode, file, PTRACE_MODE_ATTACH);
+
+        /* OK to pass negative loff_t, we can catch out-of-range */
+        file->f_mode |= FMODE_UNSIGNED_OFFSET;
+
+        return ret;
 }
 
 static ssize_t mem_rw(struct file *file, char __user *buf,
@@ -827,15 +830,16 @@ static ssize_t environ_read(struct file *file, char __user *buf,
         if (!atomic_inc_not_zero(&mm->mm_users))
                 goto free;
         while (count > 0) {
-                int this_len, retval, max_len;
-
-                this_len = mm->env_end - (mm->env_start + src);
+                size_t this_len, max_len;
+                int retval;
 
-                if (this_len <= 0)
+                if (src >= (mm->env_end - mm->env_start))
                         break;
 
-                max_len = (count > PAGE_SIZE) ? PAGE_SIZE : count;
-                this_len = (this_len > max_len) ? max_len : this_len;
+                this_len = mm->env_end - (mm->env_start + src);
+
+                max_len = min_t(size_t, PAGE_SIZE, count);
+                this_len = min(max_len, this_len);
 
                 retval = access_remote_vm(mm, (mm->env_start + src),
                         page, this_len, 0);
diff --git a/fs/qnx4/bitmap.c b/fs/qnx4/bitmap.c
index 22e0d60e53ef..76a7a697b778 100644
--- a/fs/qnx4/bitmap.c
+++ b/fs/qnx4/bitmap.c
@@ -17,23 +17,6 @@
 #include <linux/bitops.h>
 #include "qnx4.h"
 
-static void count_bits(register const char *bmPart, register int size,
-                       int *const tf)
-{
-        char b;
-        int tot = *tf;
-
-        if (size > QNX4_BLOCK_SIZE) {
-                size = QNX4_BLOCK_SIZE;
-        }
-        do {
-                b = *bmPart++;
-                tot += 8 - hweight8(b);
-                size--;
-        } while (size != 0);
-        *tf = tot;
-}
-
 unsigned long qnx4_count_free_blocks(struct super_block *sb)
 {
         int start = le32_to_cpu(qnx4_sb(sb)->BitMap->di_first_xtnt.xtnt_blk) - 1;
@@ -44,13 +27,16 @@ unsigned long qnx4_count_free_blocks(struct super_block *sb)
         struct buffer_head *bh;
 
         while (total < size) {
+                int bytes = min(size - total, QNX4_BLOCK_SIZE);
+
                 if ((bh = sb_bread(sb, start + offset)) == NULL) {
                         printk(KERN_ERR "qnx4: I/O error in counting free blocks\n");
                         break;
                 }
-                count_bits(bh->b_data, size - total, &total_free);
+                total_free += bytes * BITS_PER_BYTE -
+                                memweight(bh->b_data, bytes);
                 brelse(bh);
-                total += QNX4_BLOCK_SIZE;
+                total += bytes;
                 offset++;
         }
 
diff --git a/fs/xattr.c b/fs/xattr.c
index 1d7ac3790458..4d45b7189e7e 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -427,6 +427,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
 {
         ssize_t error;
         void *kvalue = NULL;
+        void *vvalue = NULL;
         char kname[XATTR_NAME_MAX + 1];
 
         error = strncpy_from_user(kname, name, sizeof(kname));
@@ -438,9 +439,13 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
         if (size) {
                 if (size > XATTR_SIZE_MAX)
                         size = XATTR_SIZE_MAX;
-                kvalue = kzalloc(size, GFP_KERNEL);
-                if (!kvalue)
-                        return -ENOMEM;
+                kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
+                if (!kvalue) {
+                        vvalue = vmalloc(size);
+                        if (!vvalue)
+                                return -ENOMEM;
+                        kvalue = vvalue;
+                }
         }
 
         error = vfs_getxattr(d, kname, kvalue, size);
@@ -452,7 +457,10 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
                    than XATTR_SIZE_MAX bytes. Not possible. */
                 error = -E2BIG;
         }
-        kfree(kvalue);
+        if (vvalue)
+                vfree(vvalue);
+        else
+                kfree(kvalue);
         return error;
 }
 
diff --git a/include/asm-generic/fcntl.h b/include/asm-generic/fcntl.h
index 9e5b0356e2bb..a48937d4a5ea 100644
--- a/include/asm-generic/fcntl.h
+++ b/include/asm-generic/fcntl.h
@@ -120,6 +120,10 @@
 #define F_GETOWN_EX     16
 #endif
 
+#ifndef F_GETOWNER_UIDS
+#define F_GETOWNER_UIDS 17
+#endif
+
 #define F_OWNER_TID     0
 #define F_OWNER_PID     1
 #define F_OWNER_PGRP    2
diff --git a/include/linux/aio.h b/include/linux/aio.h
index b1a520ec8b59..31ff6dba4872 100644
--- a/include/linux/aio.h
+++ b/include/linux/aio.h
@@ -126,22 +126,20 @@ struct kiocb {
         struct eventfd_ctx      *ki_eventfd;
 };
 
-#define is_sync_kiocb(iocb)     ((iocb)->ki_key == KIOCB_SYNC_KEY)
-#define init_sync_kiocb(x, filp)                        \
-        do {                                            \
-                struct task_struct *tsk = current;      \
-                (x)->ki_flags = 0;                      \
-                (x)->ki_users = 1;                      \
-                (x)->ki_key = KIOCB_SYNC_KEY;           \
-                (x)->ki_filp = (filp);                  \
-                (x)->ki_ctx = NULL;                     \
-                (x)->ki_cancel = NULL;                  \
-                (x)->ki_retry = NULL;                   \
-                (x)->ki_dtor = NULL;                    \
-                (x)->ki_obj.tsk = tsk;                  \
-                (x)->ki_user_data = 0;                  \
-                (x)->private = NULL;                    \
-        } while (0)
+static inline bool is_sync_kiocb(struct kiocb *kiocb)
+{
+        return kiocb->ki_key == KIOCB_SYNC_KEY;
+}
+
+static inline void init_sync_kiocb(struct kiocb *kiocb, struct file *filp)
+{
+        *kiocb = (struct kiocb) {
+                        .ki_users = 1,
+                        .ki_key = KIOCB_SYNC_KEY,
+                        .ki_filp = filp,
+                        .ki_obj.tsk = current,
+                };
+}
 
 #define AIO_RING_MAGIC                  0xa10a10a1
 #define AIO_RING_COMPAT_FEATURES        1
@@ -161,8 +159,6 @@ struct aio_ring {
         struct io_event         io_events[0];
 }; /* 128 bytes + ring size */
 
-#define aio_ring_avail(info, ring)      (((ring)->head + (info)->nr - 1 - (ring)->tail) % (info)->nr)
-
 #define AIO_RING_PAGES  8
 struct aio_ring_info {
         unsigned long           mmap_base;
@@ -177,6 +173,12 @@ struct aio_ring_info {
         struct page             *internal_pages[AIO_RING_PAGES];
 };
 
+static inline unsigned aio_ring_avail(struct aio_ring_info *info,
+                                        struct aio_ring *ring)
+{
+        return (ring->head + info->nr - 1 - ring->tail) % info->nr;
+}
+
 struct kioctx {
         atomic_t                users;
         int                     dead;
diff --git a/include/linux/clk.h b/include/linux/clk.h
index 2fd6a4234531..b3ac22d0fc1f 100644
--- a/include/linux/clk.h
+++ b/include/linux/clk.h
@@ -85,6 +85,43 @@ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb);
 #endif
 
 /**
+ * clk_prepare - prepare a clock source
+ * @clk: clock source
+ *
+ * This prepares the clock source for use.
+ *
+ * Must not be called from within atomic context.
+ */
+#ifdef CONFIG_HAVE_CLK_PREPARE
+int clk_prepare(struct clk *clk);
+#else
+static inline int clk_prepare(struct clk *clk)
+{
+        might_sleep();
+        return 0;
+}
+#endif
+
+/**
+ * clk_unprepare - undo preparation of a clock source
+ * @clk: clock source
+ *
+ * This undoes a previously prepared clock.  The caller must balance
+ * the number of prepare and unprepare calls.
+ *
+ * Must not be called from within atomic context.
+ */
+#ifdef CONFIG_HAVE_CLK_PREPARE
+void clk_unprepare(struct clk *clk);
+#else
+static inline void clk_unprepare(struct clk *clk)
+{
+        might_sleep();
+}
+#endif
+
+#ifdef CONFIG_HAVE_CLK
+/**
  * clk_get - lookup and obtain a reference to a clock producer.
  * @dev: device for clock "consumer"
  * @id: clock consumer ID
@@ -122,24 +159,6 @@ struct clk *clk_get(struct device *dev, const char *id);
 struct clk *devm_clk_get(struct device *dev, const char *id);
 
 /**
- * clk_prepare - prepare a clock source
- * @clk: clock source
- *
- * This prepares the clock source for use.
- *
- * Must not be called from within atomic context.
- */
-#ifdef CONFIG_HAVE_CLK_PREPARE
-int clk_prepare(struct clk *clk);
-#else
-static inline int clk_prepare(struct clk *clk)
-{
-        might_sleep();
-        return 0;
-}
-#endif
-
-/**
  * clk_enable - inform the system when the clock source should be running.
  * @clk: clock source
  *
@@ -167,47 +186,6 @@ int clk_enable(struct clk *clk);
  */
 void clk_disable(struct clk *clk);
 
-
-/**
- * clk_unprepare - undo preparation of a clock source
- * @clk: clock source
- *
- * This undoes a previously prepared clock.  The caller must balance
- * the number of prepare and unprepare calls.
- *
- * Must not be called from within atomic context.
- */
-#ifdef CONFIG_HAVE_CLK_PREPARE
-void clk_unprepare(struct clk *clk);
-#else
-static inline void clk_unprepare(struct clk *clk)
-{
-        might_sleep();
-}
-#endif
-
-/* clk_prepare_enable helps cases using clk_enable in non-atomic context. */
-static inline int clk_prepare_enable(struct clk *clk)
-{
-        int ret;
-
-        ret = clk_prepare(clk);
-        if (ret)
-                return ret;
-        ret = clk_enable(clk);
-        if (ret)
-                clk_unprepare(clk);
-
-        return ret;
-}
-
-/* clk_disable_unprepare helps cases using clk_disable in non-atomic context. */
-static inline void clk_disable_unprepare(struct clk *clk)
-{
-        clk_disable(clk);
-        clk_unprepare(clk);
-}
-
 /**
  * clk_get_rate - obtain the current clock rate (in Hz) for a clock source.
  *                This is only valid once the clock source has been enabled.
@@ -298,6 +276,78 @@ struct clk *clk_get_parent(struct clk *clk);
  */
 struct clk *clk_get_sys(const char *dev_id, const char *con_id);
 
+#else /* !CONFIG_HAVE_CLK */
+
+static inline struct clk *clk_get(struct device *dev, const char *id)
+{
+        return NULL;
+}
+
+static inline struct clk *devm_clk_get(struct device *dev, const char *id)
+{
+        return NULL;
+}
+
+static inline void clk_put(struct clk *clk) {}
+
+static inline void devm_clk_put(struct device *dev, struct clk *clk) {}
+
+static inline int clk_enable(struct clk *clk)
+{
+        return 0;
+}
+
+static inline void clk_disable(struct clk *clk) {}
+
+static inline unsigned long clk_get_rate(struct clk *clk)
+{
+        return 0;
+}
+
+static inline int clk_set_rate(struct clk *clk, unsigned long rate)
+{
+        return 0;
+}
+
+static inline long clk_round_rate(struct clk *clk, unsigned long rate)
+{
+        return 0;
+}
+
+static inline int clk_set_parent(struct clk *clk, struct clk *parent)
+{
+        return 0;
+}
+
+static inline struct clk *clk_get_parent(struct clk *clk)
+{
+        return NULL;
+}
+
+#endif
+
+/* clk_prepare_enable helps cases using clk_enable in non-atomic context. */
+static inline int clk_prepare_enable(struct clk *clk)
+{
+        int ret;
+
+        ret = clk_prepare(clk);
+        if (ret)
+                return ret;
+        ret = clk_enable(clk);
+        if (ret)
+                clk_unprepare(clk);
+
+        return ret;
+}
+
+/* clk_disable_unprepare helps cases using clk_disable in non-atomic context. */
+static inline void clk_disable_unprepare(struct clk *clk)
+{
+        clk_disable(clk);
+        clk_unprepare(clk);
+}
+
 /**
  * clk_add_alias - add a new clock alias
  * @alias: name for clock alias
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 4e890394ef99..09b28b7369d7 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -265,9 +265,9 @@ long compat_sys_shmat(int first, int second, compat_uptr_t third, int version,
 #else
 long compat_sys_semctl(int semid, int semnum, int cmd, int arg);
 long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
-                size_t msgsz, int msgflg);
+                compat_ssize_t msgsz, int msgflg);
 long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
-                size_t msgsz, long msgtyp, int msgflg);
+                compat_ssize_t msgsz, long msgtyp, int msgflg);
 long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg);
 #endif
 long compat_sys_msgctl(int first, int second, void __user *uptr);
diff --git a/include/linux/kern_levels.h b/include/linux/kern_levels.h
new file mode 100644
index 000000000000..866caaa9e2bb
--- /dev/null
+++ b/include/linux/kern_levels.h
@@ -0,0 +1,25 @@
+#ifndef __KERN_LEVELS_H__
+#define __KERN_LEVELS_H__
+
+#define KERN_SOH        "\001"          /* ASCII Start Of Header */
+#define KERN_SOH_ASCII  '\001'
+
+#define KERN_EMERG      KERN_SOH "0"    /* system is unusable */
+#define KERN_ALERT      KERN_SOH "1"    /* action must be taken immediately */
+#define KERN_CRIT       KERN_SOH "2"    /* critical conditions */
+#define KERN_ERR        KERN_SOH "3"    /* error conditions */
+#define KERN_WARNING    KERN_SOH "4"    /* warning conditions */
+#define KERN_NOTICE     KERN_SOH "5"    /* normal but significant condition */
+#define KERN_INFO       KERN_SOH "6"    /* informational */
+#define KERN_DEBUG      KERN_SOH "7"    /* debug-level messages */
+
+#define KERN_DEFAULT    KERN_SOH "d"    /* the default kernel loglevel */
+
+/*
+ * Annotation for a "continued" line of log printout (only done after a
+ * line that had no enclosing \n). Only to be used by core/arch code
+ * during early bootup (a continued line is not SMP-safe otherwise).
+ */
+#define KERN_CONT       ""
+
+#endif
diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
index 89bd4a4dcfb4..98755767c7b0 100644
--- a/include/linux/nilfs2_fs.h
+++ b/include/linux/nilfs2_fs.h
@@ -293,7 +293,7 @@ struct nilfs_dir_entry {
         __le64  inode;                  /* Inode number */
         __le16  rec_len;                /* Directory entry length */
         __u8    name_len;               /* Name length */
-        __u8    file_type;
+        __u8    file_type;              /* Dir entry type (file, dir, etc) */
         char    name[NILFS_NAME_LEN];   /* File name */
         char    pad;
 };
@@ -395,7 +395,7 @@ union nilfs_binfo {
 };
 
 /**
- * struct nilfs_segment_summary - segment summary
+ * struct nilfs_segment_summary - segment summary header
  * @ss_datasum: checksum of data
  * @ss_sumsum: checksum of segment summary
  * @ss_magic: magic number
@@ -683,9 +683,9 @@ struct nilfs_sufile_header {
 
 /**
  * nilfs_suinfo - segment usage information
- * @sui_lastmod:
- * @sui_nblocks:
- * @sui_flags:
+ * @sui_lastmod: timestamp of last modification
+ * @sui_nblocks: number of written blocks in segment
+ * @sui_flags: segment usage flags
  */
 struct nilfs_suinfo {
         __u64 sui_lastmod;
@@ -716,9 +716,10 @@ enum {
 };
 
 /**
- * struct nilfs_cpmode -
- * @cc_cno:
- * @cc_mode:
+ * struct nilfs_cpmode - change checkpoint mode structure
+ * @cm_cno: checkpoint number
+ * @cm_mode: mode of checkpoint
+ * @cm_pad: padding
  */
 struct nilfs_cpmode {
         __u64 cm_cno;
@@ -728,11 +729,11 @@ struct nilfs_cpmode {
 
 /**
  * struct nilfs_argv - argument vector
- * @v_base:
- * @v_nmembs:
- * @v_size:
- * @v_flags:
- * @v_index:
+ * @v_base: pointer on data array from userspace
+ * @v_nmembs: number of members in data array
+ * @v_size: size of data array in bytes
+ * @v_flags: flags
+ * @v_index: start number of target data items
  */
 struct nilfs_argv {
         __u64 v_base;
@@ -743,9 +744,9 @@ struct nilfs_argv {
 };
 
 /**
- * struct nilfs_period -
- * @p_start:
- * @p_end:
+ * struct nilfs_period - period of checkpoint numbers
+ * @p_start: start checkpoint number (inclusive)
+ * @p_end: end checkpoint number (exclusive)
  */
 struct nilfs_period {
         __u64 p_start;
@@ -753,7 +754,7 @@ struct nilfs_period {
 };
 
 /**
- * struct nilfs_cpstat -
+ * struct nilfs_cpstat - checkpoint statistics
  * @cs_cno: checkpoint number
  * @cs_ncps: number of checkpoints
  * @cs_nsss: number of snapshots
@@ -765,7 +766,7 @@ struct nilfs_cpstat {
 };
 
 /**
- * struct nilfs_sustat -
+ * struct nilfs_sustat - segment usage statistics
  * @ss_nsegs: number of segments
  * @ss_ncleansegs: number of clean segments
  * @ss_ndirtysegs: number of dirty segments
@@ -784,10 +785,10 @@ struct nilfs_sustat {
 
 /**
  * struct nilfs_vinfo - virtual block number information
- * @vi_vblocknr:
- * @vi_start:
- * @vi_end:
- * @vi_blocknr:
+ * @vi_vblocknr: virtual block number
+ * @vi_start: start checkpoint number (inclusive)
+ * @vi_end: end checkpoint number (exclusive)
+ * @vi_blocknr: disk block number
  */
 struct nilfs_vinfo {
         __u64 vi_vblocknr;
@@ -797,7 +798,15 @@ struct nilfs_vinfo {
 };
 
 /**
- * struct nilfs_vdesc -
+ * struct nilfs_vdesc - descriptor of virtual block number
+ * @vd_ino: inode number
+ * @vd_cno: checkpoint number
+ * @vd_vblocknr: virtual block number
+ * @vd_period: period of checkpoint numbers
+ * @vd_blocknr: disk block number
+ * @vd_offset: logical block offset inside a file
+ * @vd_flags: flags (data or node block)
+ * @vd_pad: padding
  */
 struct nilfs_vdesc {
         __u64 vd_ino;
@@ -811,7 +820,13 @@ struct nilfs_vdesc {
 };
 
 /**
- * struct nilfs_bdesc -
+ * struct nilfs_bdesc - descriptor of disk block number
+ * @bd_ino: inode number
+ * @bd_oblocknr: disk block address (for skipping dead blocks)
+ * @bd_blocknr: disk block address
+ * @bd_offset: logical block offset inside a file
+ * @bd_level: level in the b-tree organization
+ * @bd_pad: padding
  */
 struct nilfs_bdesc {
         __u64 bd_ino;
diff --git a/include/linux/lp855x.h b/include/linux/platform_data/lp855x.h
index 781a490a451b..cc76f1f18f18 100644
--- a/include/linux/lp855x.h
+++ b/include/linux/platform_data/lp855x.h
@@ -47,12 +47,6 @@
                                 (LP8556_I2C_ONLY << BRT_MODE_SHFT))
 #define LP8556_COMB2_CONFIG     (LP8556_COMBINED2 << BRT_MODE_SHFT)
 
-/* ROM area boundary */
-#define EEPROM_START    (0xA0)
-#define EEPROM_END      (0xA7)
-#define EPROM_START     (0xA0)
-#define EPROM_END       (0xAF)
-
 enum lp855x_chip_id {
         LP8550,
         LP8551,
diff --git a/include/linux/platform_data/mv_usb.h b/include/linux/platform_data/mv_usb.h
index d94804aca764..944b01dd103e 100644
--- a/include/linux/platform_data/mv_usb.h
+++ b/include/linux/platform_data/mv_usb.h
@@ -52,13 +52,4 @@ struct mv_usb_platform_data {
         int     (*set_vbus)(unsigned int vbus);
         int     (*private_init)(void __iomem *opregs, void __iomem *phyregs);
 };
-
-#ifndef CONFIG_HAVE_CLK
-/* Dummy stub for clk framework */
-#define clk_get(dev, id)       NULL
-#define clk_put(clock)         do {} while (0)
-#define clk_enable(clock)      do {} while (0)
-#define clk_disable(clock)     do {} while (0)
-#endif
-
 #endif
diff --git a/include/linux/printk.h b/include/linux/printk.h
index 1bec2f7a2d42..9afc01e5a0a6 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -2,27 +2,34 @@
 #define __KERNEL_PRINTK__
 
 #include <linux/init.h>
+#include <linux/kern_levels.h>
 
 extern const char linux_banner[];
 extern const char linux_proc_banner[];
 
-#define KERN_EMERG      "<0>"   /* system is unusable                   */
-#define KERN_ALERT      "<1>"   /* action must be taken immediately     */
-#define KERN_CRIT       "<2>"   /* critical conditions                  */
-#define KERN_ERR        "<3>"   /* error conditions                     */
-#define KERN_WARNING    "<4>"   /* warning conditions                   */
-#define KERN_NOTICE     "<5>"   /* normal but significant condition     */
-#define KERN_INFO       "<6>"   /* informational                        */
-#define KERN_DEBUG      "<7>"   /* debug-level messages                 */
-
-/* Use the default kernel loglevel */
-#define KERN_DEFAULT    "<d>"
-/*
- * Annotation for a "continued" line of log printout (only done after a
- * line that had no enclosing \n). Only to be used by core/arch code
- * during early bootup (a continued line is not SMP-safe otherwise).
- */
-#define KERN_CONT       "<c>"
+static inline int printk_get_level(const char *buffer)
+{
+        if (buffer[0] == KERN_SOH_ASCII && buffer[1]) {
+                switch (buffer[1]) {
+                case '0' ... '7':
+                case 'd':       /* KERN_DEFAULT */
+                        return buffer[1];
+                }
+        }
+        return 0;
+}
+
+static inline const char *printk_skip_level(const char *buffer)
+{
+        if (printk_get_level(buffer)) {
+                switch (buffer[1]) {
+                case '0' ... '7':
+                case 'd':       /* KERN_DEFAULT */
+                        return buffer + 2;
+                }
+        }
+        return buffer;
+}
 
 extern int console_printk[];
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index a721cef7e2d4..68dcffaa62a0 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -334,6 +334,14 @@ static inline void lockup_detector_init(void)
 }
 #endif
 
+#if defined(CONFIG_LOCKUP_DETECTOR) && defined(CONFIG_SUSPEND)
+void lockup_detector_bootcpu_resume(void);
+#else
+static inline void lockup_detector_bootcpu_resume(void)
+{
+}
+#endif
+
 #ifdef CONFIG_DETECT_HUNG_TASK
 extern unsigned int  sysctl_hung_task_panic;
 extern unsigned long sysctl_hung_task_check_count;
@@ -406,6 +414,11 @@ static inline void arch_pick_mmap_layout(struct mm_struct *mm) {}
 extern void set_dumpable(struct mm_struct *mm, int value);
 extern int get_dumpable(struct mm_struct *mm);
 
+/* get/set_dumpable() values */
+#define SUID_DUMPABLE_DISABLED  0
+#define SUID_DUMPABLE_ENABLED   1
+#define SUID_DUMPABLE_SAFE      2
+
 /* mm flags */
 /* dumpable bits */
 #define MMF_DUMPABLE      0  /* core dump is permitted */
diff --git a/include/linux/shm.h b/include/linux/shm.h
index 92808b86703b..edd086883ccb 100644
--- a/include/linux/shm.h
+++ b/include/linux/shm.h
@@ -107,12 +107,14 @@ struct shmid_kernel /* private to the kernel */
 #define SHM_NORESERVE   010000  /* don't check for reservations */
 
 #ifdef CONFIG_SYSVIPC
-long do_shmat(int shmid, char __user *shmaddr, int shmflg, unsigned long *addr);
+long do_shmat(int shmid, char __user *shmaddr, int shmflg, unsigned long *addr,
+              unsigned long shmlba);
 extern int is_file_shm_hugepages(struct file *file);
 extern void exit_shm(struct task_struct *task);
 #else
 static inline long do_shmat(int shmid, char __user *shmaddr,
-                                int shmflg, unsigned long *addr)
+                            int shmflg, unsigned long *addr,
+                            unsigned long shmlba)
 {
         return -ENOSYS;
 }
diff --git a/include/linux/string.h b/include/linux/string.h
index e033564f10ba..ffe0442e18d2 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -145,4 +145,7 @@ static inline bool strstarts(const char *str, const char *prefix)
         return strncmp(str, prefix, strlen(prefix)) == 0;
 }
 #endif
+
+extern size_t memweight(const void *ptr, size_t bytes);
+
 #endif /* _LINUX_STRING_H_ */
diff --git a/ipc/compat.c b/ipc/compat.c
index a6df704f521e..ad9518eb26e0 100644
--- a/ipc/compat.c
+++ b/ipc/compat.c
@@ -118,7 +118,7 @@ extern int sem_ctls[];
 
 static inline int compat_ipc_parse_version(int *cmd)
 {
-#ifdef CONFIG_ARCH_WANT_OLD_COMPAT_IPC
+#ifdef  CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION
         int version = *cmd & IPC_64;
 
         /* this is tricky: architectures that have support for the old
@@ -373,21 +373,21 @@ long compat_sys_semctl(int semid, int semnum, int cmd, int arg)
 }
 
 long compat_sys_msgsnd(int msqid, struct compat_msgbuf __user *msgp,
-                       size_t msgsz, int msgflg)
+                       compat_ssize_t msgsz, int msgflg)
 {
         compat_long_t mtype;
 
         if (get_user(mtype, &msgp->mtype))
                 return -EFAULT;
-        return do_msgsnd(msqid, mtype, msgp->mtext, msgsz, msgflg);
+        return do_msgsnd(msqid, mtype, msgp->mtext, (ssize_t)msgsz, msgflg);
 }
 
 long compat_sys_msgrcv(int msqid, struct compat_msgbuf __user *msgp,
-                       size_t msgsz, long msgtyp, int msgflg)
+                       compat_ssize_t msgsz, long msgtyp, int msgflg)
 {
         long err, mtype;
 
-        err =  do_msgrcv(msqid, &mtype, msgp->mtext, msgsz, msgtyp, msgflg);
+        err =  do_msgrcv(msqid, &mtype, msgp->mtext, (ssize_t)msgsz, msgtyp, msgflg);
         if (err < 0)
                 goto out;
 
@@ -514,6 +514,10 @@ long compat_sys_msgctl(int first, int second, void __user *uptr)
         return err;
 }
 
+#ifndef COMPAT_SHMLBA
+#define COMPAT_SHMLBA   SHMLBA
+#endif
+
 #ifdef CONFIG_ARCH_WANT_OLD_COMPAT_IPC
 long compat_sys_shmat(int first, int second, compat_uptr_t third, int version,
                         void __user *uptr)
@@ -524,7 +528,7 @@ long compat_sys_shmat(int first, int second, compat_uptr_t third, int version,
 
         if (version == 1)
                 return -EINVAL;
-        err = do_shmat(first, uptr, second, &raddr);
+        err = do_shmat(first, uptr, second, &raddr, COMPAT_SHMLBA);
         if (err < 0)
                 return err;
         uaddr = compat_ptr(third);
@@ -536,7 +540,7 @@ long compat_sys_shmat(int shmid, compat_uptr_t shmaddr, int shmflg)
         unsigned long ret;
         long err;
 
-        err = do_shmat(shmid, compat_ptr(shmaddr), shmflg, &ret);
+        err = do_shmat(shmid, compat_ptr(shmaddr), shmflg, &ret, COMPAT_SHMLBA);
         if (err)
                 return err;
         force_successful_syscall_return();
diff --git a/ipc/shm.c b/ipc/shm.c
index 41c1285d697a..00faa05cf72a 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -953,7 +953,8 @@ out:
  * "raddr" thing points to kernel space, and there has to be a wrapper around
  * this.
  */
-long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
+long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
+              unsigned long shmlba)
 {
         struct shmid_kernel *shp;
         unsigned long addr;
@@ -973,9 +974,9 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr)
         if (shmid < 0)
                 goto out;
         else if ((addr = (ulong)shmaddr)) {
-                if (addr & (SHMLBA-1)) {
+                if (addr & (shmlba - 1)) {
                         if (shmflg & SHM_RND)
-                                addr &= ~(SHMLBA-1);       /* round down */
+                                addr &= ~(shmlba - 1);     /* round down */
                         else
 #ifndef __ARCH_FORCE_SHMLBA
                                 if (addr & ~PAGE_MASK)
@@ -1107,7 +1108,7 @@ SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
         unsigned long ret;
         long err;
 
-        err = do_shmat(shmid, shmaddr, shmflg, &ret);
+        err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
         if (err)
                 return err;
         force_successful_syscall_return();
diff --git a/ipc/syscall.c b/ipc/syscall.c
index 1d6f53f6b562..0d1e32ce048e 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -73,7 +73,7 @@ SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
                 default: {
                         unsigned long raddr;
                         ret = do_shmat(first, (char __user *)ptr,
-                                       second, &raddr);
+                                       second, &raddr, SHMLBA);
                         if (ret)
                                 return ret;
                         return put_user(raddr, (unsigned long __user *) third);
diff --git a/ipc/util.c b/ipc/util.c
index 75261a31d48d..eb07fd356f27 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -804,7 +804,7 @@ out_up:
         return ERR_PTR(err);
 }
 
-#ifdef __ARCH_WANT_IPC_PARSE_VERSION
+#ifdef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
 
 
 /**
@@ -826,7 +826,7 @@ int ipc_parse_version (int *cmd)
         }
 }
 
-#endif /* __ARCH_WANT_IPC_PARSE_VERSION */
+#endif /* CONFIG_ARCH_WANT_IPC_PARSE_VERSION */
 
 #ifdef CONFIG_PROC_FS
 struct ipc_proc_iter {
diff --git a/ipc/util.h b/ipc/util.h
index 6f5c20bedaab..850ef3e962cb 100644
--- a/ipc/util.h
+++ b/ipc/util.h
@@ -130,7 +130,7 @@ struct kern_ipc_perm *ipcctl_pre_down(struct ipc_namespace *ns,
                                       struct ipc_ids *ids, int id, int cmd,
                                       struct ipc64_perm *perm, int extra_perm);
 
-#ifndef __ARCH_WANT_IPC_PARSE_VERSION
+#ifndef CONFIG_ARCH_WANT_IPC_PARSE_VERSION
   /* On IA-64, we always use the "64-bit version" of the IPC structures.  */ 
 # define ipc_parse_version(cmd) IPC_64
 #else
diff --git a/kernel/fork.c b/kernel/fork.c
index ff1cad3b7bdc..8efac1fe56bc 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -114,6 +114,10 @@ int nr_processes(void)
         return total;
 }
 
+void __weak arch_release_task_struct(struct task_struct *tsk)
+{
+}
+
 #ifndef CONFIG_ARCH_TASK_STRUCT_ALLOCATOR
 static struct kmem_cache *task_struct_cachep;
 
@@ -122,17 +126,17 @@ static inline struct task_struct *alloc_task_struct_node(int node)
         return kmem_cache_alloc_node(task_struct_cachep, GFP_KERNEL, node);
 }
 
-void __weak arch_release_task_struct(struct task_struct *tsk) { }
-
 static inline void free_task_struct(struct task_struct *tsk)
 {
-        arch_release_task_struct(tsk);
         kmem_cache_free(task_struct_cachep, tsk);
 }
 #endif
 
+void __weak arch_release_thread_info(struct thread_info *ti)
+{
+}
+
 #ifndef CONFIG_ARCH_THREAD_INFO_ALLOCATOR
-void __weak arch_release_thread_info(struct thread_info *ti) { }
 
 /*
  * Allocate pages if THREAD_SIZE is >= PAGE_SIZE, otherwise use a
@@ -150,7 +154,6 @@ static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
 
 static inline void free_thread_info(struct thread_info *ti)
 {
-        arch_release_thread_info(ti);
         free_pages((unsigned long)ti, THREAD_SIZE_ORDER);
 }
 # else
@@ -164,7 +167,6 @@ static struct thread_info *alloc_thread_info_node(struct task_struct *tsk,
 
 static void free_thread_info(struct thread_info *ti)
 {
-        arch_release_thread_info(ti);
         kmem_cache_free(thread_info_cache, ti);
 }
 
@@ -205,10 +207,12 @@ static void account_kernel_stack(struct thread_info *ti, int account)
 void free_task(struct task_struct *tsk)
 {
         account_kernel_stack(tsk->stack, -1);
+        arch_release_thread_info(tsk->stack);
         free_thread_info(tsk->stack);
         rt_mutex_debug_task_free(tsk);
         ftrace_graph_exit_task(tsk);
         put_seccomp_filter(tsk);
+        arch_release_task_struct(tsk);
         free_task_struct(tsk);
 }
 EXPORT_SYMBOL(free_task);
@@ -298,23 +302,16 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
                 return NULL;
 
         ti = alloc_thread_info_node(tsk, node);
-        if (!ti) {
-                free_task_struct(tsk);
-                return NULL;
-        }
+        if (!ti)
+                goto free_tsk;
 
         err = arch_dup_task_struct(tsk, orig);
+        if (err)
+                goto free_ti;
 
-        /*
-         * We defer looking at err, because we will need this setup
-         * for the clean up path to work correctly.
-         */
         tsk->stack = ti;
-        setup_thread_stack(tsk, orig);
-
-        if (err)
-                goto out;
 
+        setup_thread_stack(tsk, orig);
         clear_user_return_notifier(tsk);
         clear_tsk_need_resched(tsk);
         stackend = end_of_stack(tsk);
@@ -338,8 +335,9 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
 
         return tsk;
 
-out:
+free_ti:
         free_thread_info(ti);
+free_tsk:
         free_task_struct(tsk);
         return NULL;
 }
@@ -391,8 +389,8 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 }
                 charge = 0;
                 if (mpnt->vm_flags & VM_ACCOUNT) {
-                        unsigned long len;
-                        len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+                        unsigned long len = vma_pages(mpnt);
+
                         if (security_vm_enough_memory_mm(oldmm, len)) /* sic */
                                 goto fail_nomem;
                         charge = len;
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 4e2e472f6aeb..0668d58d6413 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1424,7 +1424,7 @@ static void update_vmcoreinfo_note(void)
 
 void crash_save_vmcoreinfo(void)
 {
-        vmcoreinfo_append_str("CRASHTIME=%ld", get_seconds());
+        vmcoreinfo_append_str("CRASHTIME=%ld\n", get_seconds());
         update_vmcoreinfo_note();
 }
 
diff --git a/kernel/kmod.c b/kernel/kmod.c
index ff2c7cb86d77..6f99aead66c6 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -45,6 +45,13 @@ extern int max_threads;
 
 static struct workqueue_struct *khelper_wq;
 
+/*
+ * kmod_thread_locker is used for deadlock avoidance.  There is no explicit
+ * locking to protect this global - it is private to the singleton khelper
+ * thread and should only ever be modified by that thread.
+ */
+static const struct task_struct *kmod_thread_locker;
+
 #define CAP_BSET        (void *)1
 #define CAP_PI          (void *)2
 
@@ -221,6 +228,13 @@ fail:
         return 0;
 }
 
+static int call_helper(void *data)
+{
+        /* Worker thread started blocking khelper thread. */
+        kmod_thread_locker = current;
+        return ____call_usermodehelper(data);
+}
+
 static void call_usermodehelper_freeinfo(struct subprocess_info *info)
 {
         if (info->cleanup)
@@ -295,9 +309,12 @@ static void __call_usermodehelper(struct work_struct *work)
         if (wait == UMH_WAIT_PROC)
                 pid = kernel_thread(wait_for_helper, sub_info,
                                     CLONE_FS | CLONE_FILES | SIGCHLD);
-        else
-                pid = kernel_thread(____call_usermodehelper, sub_info,
+        else {
+                pid = kernel_thread(call_helper, sub_info,
                                     CLONE_VFORK | SIGCHLD);
+                /* Worker thread stopped blocking khelper thread. */
+                kmod_thread_locker = NULL;
+        }
 
         switch (wait) {
         case UMH_NO_WAIT:
@@ -548,6 +565,16 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
                 retval = -EBUSY;
                 goto out;
         }
+        /*
+         * Worker thread must not wait for khelper thread at below
+         * wait_for_completion() if the thread was created with CLONE_VFORK
+         * flag, for khelper thread is already waiting for the thread at
+         * wait_for_completion() in do_fork().
+         */
+        if (wait != UMH_NO_WAIT && current == kmod_thread_locker) {
+                retval = -EBUSY;
+                goto out;
+        }
 
         sub_info->complete = &done;
         sub_info->wait = wait;
@@ -577,6 +604,12 @@ unlock:
         return retval;
 }
 
+/*
+ * call_usermodehelper_fns() will not run the caller-provided cleanup function
+ * if a memory allocation failure is experienced.  So the caller might need to
+ * check the call_usermodehelper_fns() return value: if it is -ENOMEM, perform
+ * the necessaary cleanup within the caller.
+ */
 int call_usermodehelper_fns(
         char *path, char **argv, char **envp, int wait,
         int (*init)(struct subprocess_info *info, struct cred *new),
diff --git a/kernel/panic.c b/kernel/panic.c
index d2a5f4ecc6dd..e1b2822fff97 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -75,6 +75,14 @@ void panic(const char *fmt, ...)
         int state = 0;
 
         /*
+         * Disable local interrupts. This will prevent panic_smp_self_stop
+         * from deadlocking the first cpu that invokes the panic, since
+         * there is nothing to prevent an interrupt handler (that runs
+         * after the panic_lock is acquired) from invoking panic again.
+         */
+        local_irq_disable();
+
+        /*
          * It's possible to come here directly from a panic-assertion and
          * not have preempt disabled. Some functions called from here want
          * preempt to be disabled. No point enabling it later though...
diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c
index c8b7446b27df..1da39ea248fd 100644
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -178,6 +178,9 @@ static int suspend_enter(suspend_state_t state, bool *wakeup)
         arch_suspend_enable_irqs();
         BUG_ON(irqs_disabled());
 
+        /* Kick the lockup detector */
+        lockup_detector_bootcpu_resume();
+
  Enable_cpus:
         enable_nonboot_cpus();
 
diff --git a/kernel/printk.c b/kernel/printk.c
index 50c96b5651b6..6a76ab9d4476 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -389,8 +389,10 @@ static ssize_t devkmsg_writev(struct kiocb *iocb, const struct iovec *iv,
 
         line = buf;
         for (i = 0; i < count; i++) {
-                if (copy_from_user(line, iv[i].iov_base, iv[i].iov_len))
+                if (copy_from_user(line, iv[i].iov_base, iv[i].iov_len)) {
+                        ret = -EFAULT;
                         goto out;
+                }
                 line += iv[i].iov_len;
         }
 
@@ -1540,17 +1542,23 @@ asmlinkage int vprintk_emit(int facility, int level,
                 lflags |= LOG_NEWLINE;
         }
 
-        /* strip syslog prefix and extract log level or control flags */
-        if (text[0] == '<' && text[1] && text[2] == '>') {
-                switch (text[1]) {
-                case '0' ... '7':
-                        if (level == -1)
-                                level = text[1] - '0';
-                case 'd':       /* KERN_DEFAULT */
-                        lflags |= LOG_PREFIX;
-                case 'c':       /* KERN_CONT */
-                        text += 3;
-                        text_len -= 3;
+        /* strip kernel syslog prefix and extract log level or control flags */
+        if (facility == 0) {
+                int kern_level = printk_get_level(text);
+
+                if (kern_level) {
+                        const char *end_of_header = printk_skip_level(text);
+                        switch (kern_level) {
+                        case '0' ... '7':
+                                if (level == -1)
+                                        level = kern_level - '0';
+                        case 'd':       /* KERN_DEFAULT */
+                                lflags |= LOG_PREFIX;
+                        case 'c':       /* KERN_CONT */
+                                break;
+                        }
+                        text_len -= end_of_header - text;
+                        text = (char *)end_of_header;
                 }
         }
 
diff --git a/kernel/resource.c b/kernel/resource.c
index dc8b47764443..34d45886ee84 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -7,6 +7,8 @@
  * Arbitrary resource management.
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/export.h>
 #include <linux/errno.h>
 #include <linux/ioport.h>
@@ -791,8 +793,28 @@ void __init reserve_region_with_split(struct resource *root,
                 resource_size_t start, resource_size_t end,
                 const char *name)
 {
+        int abort = 0;
+
         write_lock(&resource_lock);
-        __reserve_region_with_split(root, start, end, name);
+        if (root->start > start || root->end < end) {
+                pr_err("requested range [0x%llx-0x%llx] not in root %pr\n",
+                       (unsigned long long)start, (unsigned long long)end,
+                       root);
+                if (start > root->end || end < root->start)
+                        abort = 1;
+                else {
+                        if (end > root->end)
+                                end = root->end;
+                        if (start < root->start)
+                                start = root->start;
+                        pr_err("fixing request to [0x%llx-0x%llx]\n",
+                               (unsigned long long)start,
+                               (unsigned long long)end);
+                }
+                dump_stack();
+        }
+        if (!abort)
+                __reserve_region_with_split(root, start, end, name);
         write_unlock(&resource_lock);
 }
 
diff --git a/kernel/sys.c b/kernel/sys.c
index 2d39a84cd857..241507f23eca 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2015,7 +2015,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 break;
                         }
                         me->pdeath_signal = arg2;
-                        error = 0;
                         break;
                 case PR_GET_PDEATHSIG:
                         error = put_user(me->pdeath_signal, (int __user *)arg2);
@@ -2029,7 +2028,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 break;
                         }
                         set_dumpable(me->mm, arg2);
-                        error = 0;
                         break;
 
                 case PR_SET_UNALIGN:
@@ -2056,10 +2054,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                 case PR_SET_TIMING:
                         if (arg2 != PR_TIMING_STATISTICAL)
                                 error = -EINVAL;
-                        else
-                                error = 0;
                         break;
-
                 case PR_SET_NAME:
                         comm[sizeof(me->comm)-1] = 0;
                         if (strncpy_from_user(comm, (char __user *)arg2,
@@ -2067,20 +2062,19 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 return -EFAULT;
                         set_task_comm(me, comm);
                         proc_comm_connector(me);
-                        return 0;
+                        break;
                 case PR_GET_NAME:
                         get_task_comm(comm, me);
                         if (copy_to_user((char __user *)arg2, comm,
                                          sizeof(comm)))
                                 return -EFAULT;
-                        return 0;
+                        break;
                 case PR_GET_ENDIAN:
                         error = GET_ENDIAN(me, arg2);
                         break;
                 case PR_SET_ENDIAN:
                         error = SET_ENDIAN(me, arg2);
                         break;
-
                 case PR_GET_SECCOMP:
                         error = prctl_get_seccomp();
                         break;
@@ -2108,7 +2102,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                         current->default_timer_slack_ns;
                         else
                                 current->timer_slack_ns = arg2;
-                        error = 0;
                         break;
                 case PR_MCE_KILL:
                         if (arg4 | arg5)
@@ -2134,7 +2127,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                         default:
                                 return -EINVAL;
                         }
-                        error = 0;
                         break;
                 case PR_MCE_KILL_GET:
                         if (arg2 | arg3 | arg4 | arg5)
@@ -2153,7 +2145,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                         break;
                 case PR_SET_CHILD_SUBREAPER:
                         me->signal->is_child_subreaper = !!arg2;
-                        error = 0;
                         break;
                 case PR_GET_CHILD_SUBREAPER:
                         error = put_user(me->signal->is_child_subreaper,
@@ -2195,46 +2186,52 @@ static void argv_cleanup(struct subprocess_info *info)
         argv_free(info->argv);
 }
 
-/**
- * orderly_poweroff - Trigger an orderly system poweroff
- * @force: force poweroff if command execution fails
- *
- * This may be called from any context to trigger a system shutdown.
- * If the orderly shutdown fails, it will force an immediate shutdown.
- */
-int orderly_poweroff(bool force)
+static int __orderly_poweroff(void)
 {
         int argc;
-        char **argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
+        char **argv;
         static char *envp[] = {
                 "HOME=/",
                 "PATH=/sbin:/bin:/usr/sbin:/usr/bin",
                 NULL
         };
-        int ret = -ENOMEM;
+        int ret;
 
+        argv = argv_split(GFP_ATOMIC, poweroff_cmd, &argc);
         if (argv == NULL) {
                 printk(KERN_WARNING "%s failed to allocate memory for \"%s\"\n",
                        __func__, poweroff_cmd);
-                goto out;
+                return -ENOMEM;
         }
 
         ret = call_usermodehelper_fns(argv[0], argv, envp, UMH_NO_WAIT,
                                       NULL, argv_cleanup, NULL);
-out:
-        if (likely(!ret))
-                return 0;
-
         if (ret == -ENOMEM)
                 argv_free(argv);
 
-        if (force) {
+        return ret;
+}
+
+/**
+ * orderly_poweroff - Trigger an orderly system poweroff
+ * @force: force poweroff if command execution fails
+ *
+ * This may be called from any context to trigger a system shutdown.
+ * If the orderly shutdown fails, it will force an immediate shutdown.
+ */
+int orderly_poweroff(bool force)
+{
+        int ret = __orderly_poweroff();
+
+        if (ret && force) {
                 printk(KERN_WARNING "Failed to start orderly shutdown: "
                        "forcing the issue\n");
 
-                /* I guess this should try to kick off some daemon to
-                   sync and poweroff asap.  Or not even bother syncing
-                   if we're doing an emergency shutdown? */
+                /*
+                 * I guess this should try to kick off some daemon to sync and
+                 * poweroff asap.  Or not even bother syncing if we're doing an
+                 * emergency shutdown?
+                 */
                 emergency_sync();
                 kernel_power_off();
         }
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 4ab11879aeb4..97186b99b0e4 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -30,6 +30,7 @@
 #include <linux/security.h>
 #include <linux/ctype.h>
 #include <linux/kmemcheck.h>
+#include <linux/kmemleak.h>
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -174,6 +175,11 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write,
                                 void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
 
+static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
+                void __user *buffer, size_t *lenp, loff_t *ppos);
+static int proc_dostring_coredump(struct ctl_table *table, int write,
+                void __user *buffer, size_t *lenp, loff_t *ppos);
+
 #ifdef CONFIG_MAGIC_SYSRQ
 /* Note: sysrq code uses it's own private copy */
 static int __sysrq_enabled = SYSRQ_DEFAULT_ENABLE;
@@ -410,7 +416,7 @@ static struct ctl_table kern_table[] = {
                 .data           = core_pattern,
                 .maxlen         = CORENAME_MAX_SIZE,
                 .mode           = 0644,
-                .proc_handler   = proc_dostring,
+                .proc_handler   = proc_dostring_coredump,
         },
         {
                 .procname       = "core_pipe_limit",
@@ -1498,7 +1504,7 @@ static struct ctl_table fs_table[] = {
                 .data           = &suid_dumpable,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec_minmax,
+                .proc_handler   = proc_dointvec_minmax_coredump,
                 .extra1         = &zero,
                 .extra2         = &two,
         },
@@ -1551,7 +1557,10 @@ static struct ctl_table dev_table[] = {
 
 int __init sysctl_init(void)
 {
-        register_sysctl_table(sysctl_base_table);
+        struct ctl_table_header *hdr;
+
+        hdr = register_sysctl_table(sysctl_base_table);
+        kmemleak_not_leak(hdr);
         return 0;
 }
 
@@ -2009,6 +2018,34 @@ int proc_dointvec_minmax(struct ctl_table *table, int write,
                                 do_proc_dointvec_minmax_conv, &param);
 }
 
+static void validate_coredump_safety(void)
+{
+        if (suid_dumpable == SUID_DUMPABLE_SAFE &&
+            core_pattern[0] != '/' && core_pattern[0] != '|') {
+                printk(KERN_WARNING "Unsafe core_pattern used with "\
+                        "suid_dumpable=2. Pipe handler or fully qualified "\
+                        "core dump path required.\n");
+        }
+}
+
+static int proc_dointvec_minmax_coredump(struct ctl_table *table, int write,
+                void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int error = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+        if (!error)
+                validate_coredump_safety();
+        return error;
+}
+
+static int proc_dostring_coredump(struct ctl_table *table, int write,
+                  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+        int error = proc_dostring(table, write, buffer, lenp, ppos);
+        if (!error)
+                validate_coredump_safety();
+        return error;
+}
+
 static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int write,
                                      void __user *buffer,
                                      size_t *lenp, loff_t *ppos,
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index e66046456f4f..d0a32796550f 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -436,6 +436,11 @@ static int cgroupstats_user_cmd(struct sk_buff *skb, struct genl_info *info)
 
         na = nla_reserve(rep_skb, CGROUPSTATS_TYPE_CGROUP_STATS,
                                 sizeof(struct cgroupstats));
+        if (na == NULL) {
+                rc = -EMSGSIZE;
+                goto err;
+        }
+
         stats = nla_data(na);
         memset(stats, 0, sizeof(*stats));
 
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 4b1dfba70f7c..69add8a9da68 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -575,7 +575,7 @@ out:
 /*
  * Create/destroy watchdog threads as CPUs come and go:
  */
-static int __cpuinit
+static int
 cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
 {
         int hotcpu = (unsigned long)hcpu;
@@ -610,10 +610,27 @@ cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
         return NOTIFY_OK;
 }
 
-static struct notifier_block __cpuinitdata cpu_nfb = {
+static struct notifier_block cpu_nfb = {
         .notifier_call = cpu_callback
 };
 
+#ifdef CONFIG_SUSPEND
+/*
+ * On exit from suspend we force an offline->online transition on the boot CPU
+ * so that the PMU state that was lost while in suspended state gets set up
+ * properly for the boot CPU.  This information is required for restarting the
+ * NMI watchdog.
+ */
+void lockup_detector_bootcpu_resume(void)
+{
+        void *cpu = (void *)(long)smp_processor_id();
+
+        cpu_callback(&cpu_nfb, CPU_DEAD_FROZEN, cpu);
+        cpu_callback(&cpu_nfb, CPU_UP_PREPARE_FROZEN, cpu);
+        cpu_callback(&cpu_nfb, CPU_ONLINE_FROZEN, cpu);
+}
+#endif
+
 void __init lockup_detector_init(void)
 {
         void *cpu = (void *)(long)smp_processor_id();
diff --git a/lib/Kconfig b/lib/Kconfig
index bfdbb1ff0aa3..bb94c1ba616a 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -340,6 +340,9 @@ config NLATTR
 config GENERIC_ATOMIC64
        bool
 
+config ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
+        def_bool y if GENERIC_ATOMIC64
+
 config LRU_CACHE
         tristate
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 4a186508bf8b..2403a63b5da5 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1084,18 +1084,105 @@ config LKDTM
         Documentation on how to use the module can be found in
         Documentation/fault-injection/provoke-crashes.txt
 
+config NOTIFIER_ERROR_INJECTION
+        tristate "Notifier error injection"
+        depends on DEBUG_KERNEL
+        select DEBUG_FS
+        help
+          This option provides the ability to inject artifical errors to
+          specified notifier chain callbacks. It is useful to test the error
+          handling of notifier call chain failures.
+
+          Say N if unsure.
+
 config CPU_NOTIFIER_ERROR_INJECT
         tristate "CPU notifier error injection module"
-        depends on HOTPLUG_CPU && DEBUG_KERNEL
+        depends on HOTPLUG_CPU && NOTIFIER_ERROR_INJECTION
         help
           This option provides a kernel module that can be used to test
-          the error handling of the cpu notifiers
+          the error handling of the cpu notifiers by injecting artifical
+          errors to CPU notifier chain callbacks.  It is controlled through
+          debugfs interface under /sys/kernel/debug/notifier-error-inject/cpu
+
+          If the notifier call chain should be failed with some events
+          notified, write the error code to "actions/<notifier event>/error".
+
+          Example: Inject CPU offline error (-1 == -EPERM)
+
+          # cd /sys/kernel/debug/notifier-error-inject/cpu
+          # echo -1 > actions/CPU_DOWN_PREPARE/error
+          # echo 0 > /sys/devices/system/cpu/cpu1/online
+          bash: echo: write error: Operation not permitted
 
           To compile this code as a module, choose M here: the module will
           be called cpu-notifier-error-inject.
 
           If unsure, say N.
 
+config PM_NOTIFIER_ERROR_INJECT
+        tristate "PM notifier error injection module"
+        depends on PM && NOTIFIER_ERROR_INJECTION
+        default m if PM_DEBUG
+        help
+          This option provides the ability to inject artifical errors to
+          PM notifier chain callbacks.  It is controlled through debugfs
+          interface /sys/kernel/debug/notifier-error-inject/pm
+
+          If the notifier call chain should be failed with some events
+          notified, write the error code to "actions/<notifier event>/error".
+
+          Example: Inject PM suspend error (-12 = -ENOMEM)
+
+          # cd /sys/kernel/debug/notifier-error-inject/pm/
+          # echo -12 > actions/PM_SUSPEND_PREPARE/error
+          # echo mem > /sys/power/state
+          bash: echo: write error: Cannot allocate memory
+
+          To compile this code as a module, choose M here: the module will
+          be called pm-notifier-error-inject.
+
+          If unsure, say N.
+
+config MEMORY_NOTIFIER_ERROR_INJECT
+        tristate "Memory hotplug notifier error injection module"
+        depends on MEMORY_HOTPLUG_SPARSE && NOTIFIER_ERROR_INJECTION
+        help
+          This option provides the ability to inject artifical errors to
+          memory hotplug notifier chain callbacks.  It is controlled through
+          debugfs interface under /sys/kernel/debug/notifier-error-inject/memory
+
+          If the notifier call chain should be failed with some events
+          notified, write the error code to "actions/<notifier event>/error".
+
+          Example: Inject memory hotplug offline error (-12 == -ENOMEM)
+
+          # cd /sys/kernel/debug/notifier-error-inject/memory
+          # echo -12 > actions/MEM_GOING_OFFLINE/error
+          # echo offline > /sys/devices/system/memory/memoryXXX/state
+          bash: echo: write error: Cannot allocate memory
+
+          To compile this code as a module, choose M here: the module will
+          be called pSeries-reconfig-notifier-error-inject.
+
+          If unsure, say N.
+
+config PSERIES_RECONFIG_NOTIFIER_ERROR_INJECT
+        tristate "pSeries reconfig notifier error injection module"
+        depends on PPC_PSERIES && NOTIFIER_ERROR_INJECTION
+        help
+          This option provides the ability to inject artifical errors to
+          pSeries reconfig notifier chain callbacks.  It is controlled
+          through debugfs interface under
+          /sys/kernel/debug/notifier-error-inject/pSeries-reconfig/
+
+          If the notifier call chain should be failed with some events
+          notified, write the error code to "actions/<notifier event>/error".
+
+          To compile this code as a module, choose M here: the module will
+          be called memory-notifier-error-inject.
+
+          If unsure, say N.
+
 config FAULT_INJECTION
         bool "Fault-injection framework"
         depends on DEBUG_KERNEL
diff --git a/lib/Makefile b/lib/Makefile
index 2f2be5a8734c..9cb4104f47d9 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -22,7 +22,7 @@ lib-y	+= kobject.o klist.o
 obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o hexdump.o kasprintf.o bitmap.o scatterlist.o \
          string_helpers.o gcd.o lcm.o list_sort.o uuid.o flex_array.o \
-         bsearch.o find_last_bit.o find_next_bit.o llist.o
+         bsearch.o find_last_bit.o find_next_bit.o llist.o memweight.o
 obj-y += kstrtox.o
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
 
@@ -90,7 +90,12 @@ obj-$(CONFIG_AUDIT_GENERIC) += audit.o
 obj-$(CONFIG_SWIOTLB) += swiotlb.o
 obj-$(CONFIG_IOMMU_HELPER) += iommu-helper.o
 obj-$(CONFIG_FAULT_INJECTION) += fault-inject.o
+obj-$(CONFIG_NOTIFIER_ERROR_INJECTION) += notifier-error-inject.o
 obj-$(CONFIG_CPU_NOTIFIER_ERROR_INJECT) += cpu-notifier-error-inject.o
+obj-$(CONFIG_PM_NOTIFIER_ERROR_INJECT) += pm-notifier-error-inject.o
+obj-$(CONFIG_MEMORY_NOTIFIER_ERROR_INJECT) += memory-notifier-error-inject.o
+obj-$(CONFIG_PSERIES_RECONFIG_NOTIFIER_ERROR_INJECT) += \
+        pSeries-reconfig-notifier-error-inject.o
 
 lib-$(CONFIG_GENERIC_BUG) += bug.o
 
diff --git a/lib/atomic64_test.c b/lib/atomic64_test.c
index cb99b91c3a1d..00bca223d1e1 100644
--- a/lib/atomic64_test.c
+++ b/lib/atomic64_test.c
@@ -114,8 +114,7 @@ static __init int test_atomic64(void)
         r += one;
         BUG_ON(v.counter != r);
 
-#if defined(CONFIG_X86) || defined(CONFIG_MIPS) || defined(CONFIG_PPC) || \
-    defined(CONFIG_S390) || defined(_ASM_GENERIC_ATOMIC64_H) || defined(CONFIG_ARM)
+#ifdef CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
         INIT(onestwos);
         BUG_ON(atomic64_dec_if_positive(&v) != (onestwos - 1));
         r -= one;
@@ -129,7 +128,7 @@ static __init int test_atomic64(void)
         BUG_ON(atomic64_dec_if_positive(&v) != (-one - one));
         BUG_ON(v.counter != r);
 #else
-#warning Please implement atomic64_dec_if_positive for your architecture, and add it to the IF above
+#warning Please implement atomic64_dec_if_positive for your architecture and select the above Kconfig symbol
 #endif
 
         INIT(onestwos);
diff --git a/lib/cpu-notifier-error-inject.c b/lib/cpu-notifier-error-inject.c
index 4dc20321b0d5..707ca24f7b18 100644
--- a/lib/cpu-notifier-error-inject.c
+++ b/lib/cpu-notifier-error-inject.c
@@ -1,58 +1,45 @@
 #include <linux/kernel.h>
-#include <linux/cpu.h>
 #include <linux/module.h>
-#include <linux/notifier.h>
+#include <linux/cpu.h>
 
-static int priority;
-static int cpu_up_prepare_error;
-static int cpu_down_prepare_error;
+#include "notifier-error-inject.h"
 
+static int priority;
 module_param(priority, int, 0);
 MODULE_PARM_DESC(priority, "specify cpu notifier priority");
 
-module_param(cpu_up_prepare_error, int, 0644);
-MODULE_PARM_DESC(cpu_up_prepare_error,
-                "specify error code to inject CPU_UP_PREPARE action");
-
-module_param(cpu_down_prepare_error, int, 0644);
-MODULE_PARM_DESC(cpu_down_prepare_error,
-                "specify error code to inject CPU_DOWN_PREPARE action");
-
-static int err_inject_cpu_callback(struct notifier_block *nfb,
-                                unsigned long action, void *hcpu)
-{
-        int err = 0;
-
-        switch (action) {
-        case CPU_UP_PREPARE:
-        case CPU_UP_PREPARE_FROZEN:
-                err = cpu_up_prepare_error;
-                break;
-        case CPU_DOWN_PREPARE:
-        case CPU_DOWN_PREPARE_FROZEN:
-                err = cpu_down_prepare_error;
-                break;
+static struct notifier_err_inject cpu_notifier_err_inject = {
+        .actions = {
+                { NOTIFIER_ERR_INJECT_ACTION(CPU_UP_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(CPU_UP_PREPARE_FROZEN) },
+                { NOTIFIER_ERR_INJECT_ACTION(CPU_DOWN_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(CPU_DOWN_PREPARE_FROZEN) },
+                {}
         }
-        if (err)
-                printk(KERN_INFO "Injecting error (%d) at cpu notifier\n", err);
-
-        return notifier_from_errno(err);
-}
-
-static struct notifier_block err_inject_cpu_notifier = {
-        .notifier_call = err_inject_cpu_callback,
 };
 
+static struct dentry *dir;
+
 static int err_inject_init(void)
 {
-        err_inject_cpu_notifier.priority = priority;
+        int err;
+
+        dir = notifier_err_inject_init("cpu", notifier_err_inject_dir,
+                                        &cpu_notifier_err_inject, priority);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+
+        err = register_hotcpu_notifier(&cpu_notifier_err_inject.nb);
+        if (err)
+                debugfs_remove_recursive(dir);
 
-        return register_hotcpu_notifier(&err_inject_cpu_notifier);
+        return err;
 }
 
 static void err_inject_exit(void)
 {
-        unregister_hotcpu_notifier(&err_inject_cpu_notifier);
+        unregister_hotcpu_notifier(&cpu_notifier_err_inject.nb);
+        debugfs_remove_recursive(dir);
 }
 
 module_init(err_inject_init);
diff --git a/lib/crc32.c b/lib/crc32.c
index b0d278fb1d91..61774b8db4de 100644
--- a/lib/crc32.c
+++ b/lib/crc32.c
@@ -74,7 +74,9 @@ crc32_body(u32 crc, unsigned char const *buf, size_t len, const u32 (*tab)[256])
         size_t i;
 # endif
         const u32 *t0=tab[0], *t1=tab[1], *t2=tab[2], *t3=tab[3];
+# if CRC_LE_BITS != 32
         const u32 *t4 = tab[4], *t5 = tab[5], *t6 = tab[6], *t7 = tab[7];
+# endif
         u32 q;
 
         /* Align it */
diff --git a/lib/memory-notifier-error-inject.c b/lib/memory-notifier-error-inject.c
new file mode 100644
index 000000000000..e6239bf0b0df
--- /dev/null
+++ b/lib/memory-notifier-error-inject.c
@@ -0,0 +1,48 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/memory.h>
+
+#include "notifier-error-inject.h"
+
+static int priority;
+module_param(priority, int, 0);
+MODULE_PARM_DESC(priority, "specify memory notifier priority");
+
+static struct notifier_err_inject memory_notifier_err_inject = {
+        .actions = {
+                { NOTIFIER_ERR_INJECT_ACTION(MEM_GOING_ONLINE) },
+                { NOTIFIER_ERR_INJECT_ACTION(MEM_GOING_OFFLINE) },
+                {}
+        }
+};
+
+static struct dentry *dir;
+
+static int err_inject_init(void)
+{
+        int err;
+
+        dir = notifier_err_inject_init("memory", notifier_err_inject_dir,
+                                        &memory_notifier_err_inject, priority);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+
+        err = register_memory_notifier(&memory_notifier_err_inject.nb);
+        if (err)
+                debugfs_remove_recursive(dir);
+
+        return err;
+}
+
+static void err_inject_exit(void)
+{
+        unregister_memory_notifier(&memory_notifier_err_inject.nb);
+        debugfs_remove_recursive(dir);
+}
+
+module_init(err_inject_init);
+module_exit(err_inject_exit);
+
+MODULE_DESCRIPTION("memory notifier error injection module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Akinobu Mita <akinobu.mita@gmail.com>");
diff --git a/lib/memweight.c b/lib/memweight.c
new file mode 100644
index 000000000000..e35fc8771893
--- /dev/null
+++ b/lib/memweight.c
@@ -0,0 +1,38 @@
+#include <linux/export.h>
+#include <linux/bug.h>
+#include <linux/bitmap.h>
+
+/**
+ * memweight - count the total number of bits set in memory area
+ * @ptr: pointer to the start of the area
+ * @bytes: the size of the area
+ */
+size_t memweight(const void *ptr, size_t bytes)
+{
+        size_t ret = 0;
+        size_t longs;
+        const unsigned char *bitmap = ptr;
+
+        for (; bytes > 0 && ((unsigned long)bitmap) % sizeof(long);
+                        bytes--, bitmap++)
+                ret += hweight8(*bitmap);
+
+        longs = bytes / sizeof(long);
+        if (longs) {
+                BUG_ON(longs >= INT_MAX / BITS_PER_LONG);
+                ret += bitmap_weight((unsigned long *)bitmap,
+                                longs * BITS_PER_LONG);
+                bytes -= longs * sizeof(long);
+                bitmap += longs * sizeof(long);
+        }
+        /*
+         * The reason that this last loop is distinct from the preceding
+         * bitmap_weight() call is to compute 1-bits in the last region smaller
+         * than sizeof(long) properly on big-endian systems.
+         */
+        for (; bytes > 0; bytes--, bitmap++)
+                ret += hweight8(*bitmap);
+
+        return ret;
+}
+EXPORT_SYMBOL(memweight);
diff --git a/lib/notifier-error-inject.c b/lib/notifier-error-inject.c
new file mode 100644
index 000000000000..44b92cb6224f
--- /dev/null
+++ b/lib/notifier-error-inject.c
@@ -0,0 +1,112 @@
+#include <linux/module.h>
+
+#include "notifier-error-inject.h"
+
+static int debugfs_errno_set(void *data, u64 val)
+{
+        *(int *)data = clamp_t(int, val, -MAX_ERRNO, 0);
+        return 0;
+}
+
+static int debugfs_errno_get(void *data, u64 *val)
+{
+        *val = *(int *)data;
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_errno, debugfs_errno_get, debugfs_errno_set,
+                        "%lld\n");
+
+static struct dentry *debugfs_create_errno(const char *name, mode_t mode,
+                                struct dentry *parent, int *value)
+{
+        return debugfs_create_file(name, mode, parent, value, &fops_errno);
+}
+
+static int notifier_err_inject_callback(struct notifier_block *nb,
+                                unsigned long val, void *p)
+{
+        int err = 0;
+        struct notifier_err_inject *err_inject =
+                container_of(nb, struct notifier_err_inject, nb);
+        struct notifier_err_inject_action *action;
+
+        for (action = err_inject->actions; action->name; action++) {
+                if (action->val == val) {
+                        err = action->error;
+                        break;
+                }
+        }
+        if (err)
+                pr_info("Injecting error (%d) to %s\n", err, action->name);
+
+        return notifier_from_errno(err);
+}
+
+struct dentry *notifier_err_inject_dir;
+EXPORT_SYMBOL_GPL(notifier_err_inject_dir);
+
+struct dentry *notifier_err_inject_init(const char *name, struct dentry *parent,
+                        struct notifier_err_inject *err_inject, int priority)
+{
+        struct notifier_err_inject_action *action;
+        mode_t mode = S_IFREG | S_IRUSR | S_IWUSR;
+        struct dentry *dir;
+        struct dentry *actions_dir;
+
+        err_inject->nb.notifier_call = notifier_err_inject_callback;
+        err_inject->nb.priority = priority;
+
+        dir = debugfs_create_dir(name, parent);
+        if (!dir)
+                return ERR_PTR(-ENOMEM);
+
+        actions_dir = debugfs_create_dir("actions", dir);
+        if (!actions_dir)
+                goto fail;
+
+        for (action = err_inject->actions; action->name; action++) {
+                struct dentry *action_dir;
+
+                action_dir = debugfs_create_dir(action->name, actions_dir);
+                if (!action_dir)
+                        goto fail;
+
+                /*
+                 * Create debugfs r/w file containing action->error. If
+                 * notifier call chain is called with action->val, it will
+                 * fail with the error code
+                 */
+                if (!debugfs_create_errno("error", mode, action_dir,
+                                        &action->error))
+                        goto fail;
+        }
+        return dir;
+fail:
+        debugfs_remove_recursive(dir);
+        return ERR_PTR(-ENOMEM);
+}
+EXPORT_SYMBOL_GPL(notifier_err_inject_init);
+
+static int __init err_inject_init(void)
+{
+        notifier_err_inject_dir =
+                debugfs_create_dir("notifier-error-inject", NULL);
+
+        if (!notifier_err_inject_dir)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static void __exit err_inject_exit(void)
+{
+        debugfs_remove_recursive(notifier_err_inject_dir);
+}
+
+module_init(err_inject_init);
+module_exit(err_inject_exit);
+
+MODULE_DESCRIPTION("Notifier error injection module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Akinobu Mita <akinobu.mita@gmail.com>");
diff --git a/lib/notifier-error-inject.h b/lib/notifier-error-inject.h
new file mode 100644
index 000000000000..99b3b6fc470b
--- /dev/null
+++ b/lib/notifier-error-inject.h
@@ -0,0 +1,24 @@
+#include <linux/atomic.h>
+#include <linux/debugfs.h>
+#include <linux/notifier.h>
+
+struct notifier_err_inject_action {
+        unsigned long val;
+        int error;
+        const char *name;
+};
+
+#define NOTIFIER_ERR_INJECT_ACTION(action)      \
+        .name = #action, .val = (action),
+
+struct notifier_err_inject {
+        struct notifier_block nb;
+        struct notifier_err_inject_action actions[];
+        /* The last slot must be terminated with zero sentinel */
+};
+
+extern struct dentry *notifier_err_inject_dir;
+
+extern struct dentry *notifier_err_inject_init(const char *name,
+                struct dentry *parent, struct notifier_err_inject *err_inject,
+                int priority);
diff --git a/lib/pSeries-reconfig-notifier-error-inject.c b/lib/pSeries-reconfig-notifier-error-inject.c
new file mode 100644
index 000000000000..7f7c98dcd5c4
--- /dev/null
+++ b/lib/pSeries-reconfig-notifier-error-inject.c
@@ -0,0 +1,51 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+#include <asm/pSeries_reconfig.h>
+
+#include "notifier-error-inject.h"
+
+static int priority;
+module_param(priority, int, 0);
+MODULE_PARM_DESC(priority, "specify pSeries reconfig notifier priority");
+
+static struct notifier_err_inject reconfig_err_inject = {
+        .actions = {
+                { NOTIFIER_ERR_INJECT_ACTION(PSERIES_RECONFIG_ADD) },
+                { NOTIFIER_ERR_INJECT_ACTION(PSERIES_RECONFIG_REMOVE) },
+                { NOTIFIER_ERR_INJECT_ACTION(PSERIES_DRCONF_MEM_ADD) },
+                { NOTIFIER_ERR_INJECT_ACTION(PSERIES_DRCONF_MEM_REMOVE) },
+                {}
+        }
+};
+
+static struct dentry *dir;
+
+static int err_inject_init(void)
+{
+        int err;
+
+        dir = notifier_err_inject_init("pSeries-reconfig",
+                notifier_err_inject_dir, &reconfig_err_inject, priority);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+
+        err = pSeries_reconfig_notifier_register(&reconfig_err_inject.nb);
+        if (err)
+                debugfs_remove_recursive(dir);
+
+        return err;
+}
+
+static void err_inject_exit(void)
+{
+        pSeries_reconfig_notifier_unregister(&reconfig_err_inject.nb);
+        debugfs_remove_recursive(dir);
+}
+
+module_init(err_inject_init);
+module_exit(err_inject_exit);
+
+MODULE_DESCRIPTION("pSeries reconfig notifier error injection module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Akinobu Mita <akinobu.mita@gmail.com>");
diff --git a/lib/pm-notifier-error-inject.c b/lib/pm-notifier-error-inject.c
new file mode 100644
index 000000000000..c094b2dedc23
--- /dev/null
+++ b/lib/pm-notifier-error-inject.c
@@ -0,0 +1,49 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/suspend.h>
+
+#include "notifier-error-inject.h"
+
+static int priority;
+module_param(priority, int, 0);
+MODULE_PARM_DESC(priority, "specify PM notifier priority");
+
+static struct notifier_err_inject pm_notifier_err_inject = {
+        .actions = {
+                { NOTIFIER_ERR_INJECT_ACTION(PM_HIBERNATION_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(PM_SUSPEND_PREPARE) },
+                { NOTIFIER_ERR_INJECT_ACTION(PM_RESTORE_PREPARE) },
+                {}
+        }
+};
+
+static struct dentry *dir;
+
+static int err_inject_init(void)
+{
+        int err;
+
+        dir = notifier_err_inject_init("pm", notifier_err_inject_dir,
+                                        &pm_notifier_err_inject, priority);
+        if (IS_ERR(dir))
+                return PTR_ERR(dir);
+
+        err = register_pm_notifier(&pm_notifier_err_inject.nb);
+        if (err)
+                debugfs_remove_recursive(dir);
+
+        return err;
+}
+
+static void err_inject_exit(void)
+{
+        unregister_pm_notifier(&pm_notifier_err_inject.nb);
+        debugfs_remove_recursive(dir);
+}
+
+module_init(err_inject_init);
+module_exit(err_inject_exit);
+
+MODULE_DESCRIPTION("PM notifier error injection module");
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Akinobu Mita <akinobu.mita@gmail.com>");
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index e719adf695bf..fadae774a20c 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -279,14 +279,6 @@ int __sg_alloc_table(struct sg_table *table, unsigned int nents,
                 if (!left)
                         sg_mark_end(&sg[sg_size - 1]);
 
-                /*
-                 * only really needed for mempool backed sg allocations (like
-                 * SCSI), a possible improvement here would be to pass the
-                 * table pointer into the allocator and let that clear these
-                 * flags
-                 */
-                gfp_mask &= ~__GFP_WAIT;
-                gfp_mask |= __GFP_HIGH;
                 prv = sg;
         } while (left);
 
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index e91fbc23fff1..eb10578ae055 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -58,7 +58,7 @@ static void spin_dump(raw_spinlock_t *lock, const char *msg)
         printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n",
                 msg, raw_smp_processor_id(),
                 current->comm, task_pid_nr(current));
-        printk(KERN_EMERG " lock: %ps, .magic: %08x, .owner: %s/%d, "
+        printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, "
                         ".owner_cpu: %d\n",
                 lock, lock->magic,
                 owner ? owner->comm : "<none>",
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index c3f36d415bdf..0e337541f005 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -655,6 +655,50 @@ char *resource_string(char *buf, char *end, struct resource *res,
 }
 
 static noinline_for_stack
+char *hex_string(char *buf, char *end, u8 *addr, struct printf_spec spec,
+                 const char *fmt)
+{
+        int i, len = 1;         /* if we pass '%ph[CDN]', field witdh remains
+                                   negative value, fallback to the default */
+        char separator;
+
+        if (spec.field_width == 0)
+                /* nothing to print */
+                return buf;
+
+        if (ZERO_OR_NULL_PTR(addr))
+                /* NULL pointer */
+                return string(buf, end, NULL, spec);
+
+        switch (fmt[1]) {
+        case 'C':
+                separator = ':';
+                break;
+        case 'D':
+                separator = '-';
+                break;
+        case 'N':
+                separator = 0;
+                break;
+        default:
+                separator = ' ';
+                break;
+        }
+
+        if (spec.field_width > 0)
+                len = min_t(int, spec.field_width, 64);
+
+        for (i = 0; i < len && buf < end - 1; i++) {
+                buf = hex_byte_pack(buf, addr[i]);
+
+                if (buf < end && separator && i != len - 1)
+                        *buf++ = separator;
+        }
+
+        return buf;
+}
+
+static noinline_for_stack
 char *mac_address_string(char *buf, char *end, u8 *addr,
                          struct printf_spec spec, const char *fmt)
 {
@@ -662,15 +706,28 @@ char *mac_address_string(char *buf, char *end, u8 *addr,
         char *p = mac_addr;
         int i;
         char separator;
+        bool reversed = false;
 
-        if (fmt[1] == 'F') {            /* FDDI canonical format */
+        switch (fmt[1]) {
+        case 'F':
                 separator = '-';
-        } else {
+                break;
+
+        case 'R':
+                reversed = true;
+                /* fall through */
+
+        default:
                 separator = ':';
+                break;
         }
 
         for (i = 0; i < 6; i++) {
-                p = hex_byte_pack(p, addr[i]);
+                if (reversed)
+                        p = hex_byte_pack(p, addr[5 - i]);
+                else
+                        p = hex_byte_pack(p, addr[i]);
+
                 if (fmt[0] == 'M' && i != 5)
                         *p++ = separator;
         }
@@ -933,6 +990,7 @@ int kptr_restrict __read_mostly;
  * - 'm' For a 6-byte MAC address, it prints the hex address without colons
  * - 'MF' For a 6-byte MAC FDDI address, it prints the address
  *       with a dash-separated hex notation
+ * - '[mM]R For a 6-byte MAC address, Reverse order (Bluetooth)
  * - 'I' [46] for IPv4/IPv6 addresses printed in the usual way
  *       IPv4 uses dot-separated decimal without leading 0's (1.2.3.4)
  *       IPv6 uses colon separated network-order 16 bit hex with leading 0's
@@ -960,6 +1018,13 @@ int kptr_restrict __read_mostly;
  *       correctness of the format string and va_list arguments.
  * - 'K' For a kernel pointer that should be hidden from unprivileged users
  * - 'NF' For a netdev_features_t
+ * - 'h[CDN]' For a variable-length buffer, it prints it as a hex string with
+ *            a certain separator (' ' by default):
+ *              C colon
+ *              D dash
+ *              N no separator
+ *            The maximum supported length is 64 bytes of the input. Consider
+ *            to use print_hex_dump() for the larger input.
  *
  * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
  * function pointers are really function descriptors, which contain a
@@ -993,9 +1058,12 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
         case 'R':
         case 'r':
                 return resource_string(buf, end, ptr, spec, fmt);
+        case 'h':
+                return hex_string(buf, end, ptr, spec, fmt);
         case 'M':                       /* Colon separated: 00:01:02:03:04:05 */
         case 'm':                       /* Contiguous: 000102030405 */
-                                        /* [mM]F (FDDI, bit reversed) */
+                                        /* [mM]F (FDDI) */
+                                        /* [mM]R (Reverse order; Bluetooth) */
                 return mac_address_string(buf, end, ptr, spec, fmt);
         case 'I':                       /* Formatted IP supported
                                          * 4:   1.2.3.4
@@ -1030,7 +1098,8 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
                  * %pK cannot be used in IRQ context because its test
                  * for CAP_SYSLOG would be meaningless.
                  */
-                if (in_irq() || in_serving_softirq() || in_nmi()) {
+                if (kptr_restrict && (in_irq() || in_serving_softirq() ||
+                                      in_nmi())) {
                         if (spec.field_width == -1)
                                 spec.field_width = default_width;
                         return string(buf, end, "pK-error", spec);
@@ -1280,8 +1349,12 @@ qualifier:
  * %pI6c print an IPv6 address as specified by RFC 5952
  * %pU[bBlL] print a UUID/GUID in big or little endian using lower or upper
  *   case.
+ * %*ph[CDN] a variable-length hex string with a separator (supports up to 64
+ *           bytes of the input)
  * %n is ignored
  *
+ * ** Please update Documentation/printk-formats.txt when making changes **
+ *
  * The return value is the number of characters which would
  * be generated for the given input, excluding the trailing
  * '\0', as per ISO C99. If you want to have the exact
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index de4ce7058450..6de0d613bbe6 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1433,8 +1433,8 @@ static int soft_offline_huge_page(struct page *page, int flags)
         /* Keep page count to indicate a given hugepage is isolated. */
 
         list_add(&hpage->lru, &pagelist);
-        ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, 0,
-                                true);
+        ret = migrate_huge_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL, false,
+                                MIGRATE_SYNC);
         if (ret) {
                 struct page *page1, *page2;
                 list_for_each_entry_safe(page1, page2, &pagelist, lru)
@@ -1563,7 +1563,7 @@ int soft_offline_page(struct page *page, int flags)
                                             page_is_file_cache(page));
                 list_add(&page->lru, &pagelist);
                 ret = migrate_pages(&pagelist, new_page, MPOL_MF_MOVE_ALL,
-                                                        0, MIGRATE_SYNC);
+                                                        false, MIGRATE_SYNC);
                 if (ret) {
                         putback_lru_pages(&pagelist);
                         pr_info("soft offline: %#lx: migration failed %d, type %lx\n",
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index e5bd60ff48e3..913d6bdfdda3 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1600,13 +1600,17 @@ sub process {
 
 # Check signature styles
                 if (!$in_header_lines &&
-                    $line =~ /^(\s*)($signature_tags)(\s*)(.*)/) {
+                    $line =~ /^(\s*)([a-z0-9_-]+by:|$signature_tags)(\s*)(.*)/i) {
                         my $space_before = $1;
                         my $sign_off = $2;
                         my $space_after = $3;
                         my $email = $4;
                         my $ucfirst_sign_off = ucfirst(lc($sign_off));
 
+                        if ($sign_off !~ /$signature_tags/) {
+                                WARN("BAD_SIGN_OFF",
+                                     "Non-standard signature: $sign_off\n" . $herecurr);
+                        }
                         if (defined $space_before && $space_before ne "") {
                                 WARN("BAD_SIGN_OFF",
                                      "Do not use whitespace before $ucfirst_sign_off\n" . $herecurr);
@@ -1848,8 +1852,8 @@ sub process {
 
                         my $pos = pos_last_openparen($rest);
                         if ($pos >= 0) {
-                                $line =~ /^\+([ \t]*)/;
-                                my $newindent = $1;
+                                $line =~ /^(\+| )([ \t]*)/;
+                                my $newindent = $2;
 
                                 my $goodtabindent = $oldindent .
                                         "\t" x ($pos / 8) .
@@ -2984,6 +2988,45 @@ sub process {
                         }
                 }
 
+# do {} while (0) macro tests:
+# single-statement macros do not need to be enclosed in do while (0) loop,
+# macro should not end with a semicolon
+                if ($^V && $^V ge 5.10.0 &&
+                    $realfile !~ m@/vmlinux.lds.h$@ &&
+                    $line =~ /^.\s*\#\s*define\s+$Ident(\()?/) {
+                        my $ln = $linenr;
+                        my $cnt = $realcnt;
+                        my ($off, $dstat, $dcond, $rest);
+                        my $ctx = '';
+                        ($dstat, $dcond, $ln, $cnt, $off) =
+                                ctx_statement_block($linenr, $realcnt, 0);
+                        $ctx = $dstat;
+
+                        $dstat =~ s/\\\n.//g;
+
+                        if ($dstat =~ /^\+\s*#\s*define\s+$Ident\s*${balanced_parens}\s*do\s*{(.*)\s*}\s*while\s*\(\s*0\s*\)\s*([;\s]*)\s*$/) {
+                                my $stmts = $2;
+                                my $semis = $3;
+
+                                $ctx =~ s/\n*$//;
+                                my $cnt = statement_rawlines($ctx);
+                                my $herectx = $here . "\n";
+
+                                for (my $n = 0; $n < $cnt; $n++) {
+                                        $herectx .= raw_line($linenr, $n) . "\n";
+                                }
+
+                                if (($stmts =~ tr/;/;/) == 1) {
+                                        WARN("SINGLE_STATEMENT_DO_WHILE_MACRO",
+                                             "Single statement macros should not use a do {} while (0) loop\n" . "$herectx");
+                                }
+                                if (defined $semis && $semis ne "") {
+                                        WARN("DO_WHILE_MACRO_WITH_TRAILING_SEMICOLON",
+                                             "do {} while (0) macros should not be semicolon terminated\n" . "$herectx");
+                                }
+                        }
+                }
+
 # make sure symbols are always wrapped with VMLINUX_SYMBOL() ...
 # all assignments may have only one of the following with an assignment:
 #       .
@@ -3261,6 +3304,12 @@ sub process {
                              "sizeof(& should be avoided\n" . $herecurr);
                 }
 
+# check for sizeof without parenthesis
+                if ($line =~ /\bsizeof\s+((?:\*\s*|)$Lval|$Type(?:\s+$Lval|))/) {
+                        WARN("SIZEOF_PARENTHESIS",
+                             "sizeof $1 should be sizeof($1)\n" . $herecurr);
+                }
+
 # check for line continuations in quoted strings with odd counts of "
                 if ($rawline =~ /\\$/ && $rawline =~ tr/"/"/ % 2) {
                         WARN("LINE_CONTINUATIONS",
@@ -3309,6 +3358,22 @@ sub process {
                         }
                 }
 
+# check usleep_range arguments
+                if ($^V && $^V ge 5.10.0 &&
+                    defined $stat &&
+                    $stat =~ /^\+(?:.*?)\busleep_range\s*\(\s*($FuncArg)\s*,\s*($FuncArg)\s*\)/) {
+                        my $min = $1;
+                        my $max = $7;
+                        if ($min eq $max) {
+                                WARN("USLEEP_RANGE",
+                                     "usleep_range should not use min == max args; see Documentation/timers/timers-howto.txt\n" . "$here\n$stat\n");
+                        } elsif ($min =~ /^\d+$/ && $max =~ /^\d+$/ &&
+                                 $min > $max) {
+                                WARN("USLEEP_RANGE",
+                                     "usleep_range args reversed, use min then max; see Documentation/timers/timers-howto.txt\n" . "$here\n$stat\n");
+                        }
+                }
+
 # check for new externs in .c files.
                 if ($realfile =~ /\.c$/ && defined $stat &&
                     $stat =~ /^.\s*(?:extern\s+)?$Type\s+($Ident)(\s*)\(/s)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 79690f401a58..6c77f63c7591 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3185,6 +3185,7 @@ static int selinux_file_fcntl(struct file *file, unsigned int cmd,
         case F_GETFL:
         case F_GETOWN:
         case F_GETSIG:
+        case F_GETOWNER_UIDS:
                 /* Just check FD__USE permission */
                 err = file_has_perm(cred, file, 0);
                 break;
diff --git a/sound/core/misc.c b/sound/core/misc.c
index 768167925409..30e027ecf4da 100644
--- a/sound/core/misc.c
+++ b/sound/core/misc.c
@@ -68,6 +68,7 @@ void __snd_printk(unsigned int level, const char *path, int line,
 {
         va_list args;
 #ifdef CONFIG_SND_VERBOSE_PRINTK
+        int kern_level;
         struct va_format vaf;
         char verbose_fmt[] = KERN_DEFAULT "ALSA %s:%d %pV";
 #endif
@@ -81,12 +82,16 @@ void __snd_printk(unsigned int level, const char *path, int line,
 #ifdef CONFIG_SND_VERBOSE_PRINTK
         vaf.fmt = format;
         vaf.va = &args;
-        if (format[0] == '<' && format[2] == '>') {
-                memcpy(verbose_fmt, format, 3);
-                vaf.fmt = format + 3;
+
+        kern_level = printk_get_level(format);
+        if (kern_level) {
+                const char *end_of_header = printk_skip_level(format);
+                memcpy(verbose_fmt, format, end_of_header - format);
+                vaf.fmt = end_of_header;
         } else if (level)
-                memcpy(verbose_fmt, KERN_DEBUG, 3);
+                memcpy(verbose_fmt, KERN_DEBUG, sizeof(KERN_DEBUG) - 1);
         printk(verbose_fmt, sanity_file_name(path), line, &vaf);
+
 #else
         vprintk(format, args);
 #endif
diff --git a/tools/testing/fault-injection/failcmd.sh b/tools/testing/fault-injection/failcmd.sh
new file mode 100644
index 000000000000..1776e924b202
--- /dev/null
+++ b/tools/testing/fault-injection/failcmd.sh
@@ -0,0 +1,219 @@
+#!/bin/bash
+#
+# NAME
+#       failcmd.sh - run a command with injecting slab/page allocation failures
+#
+# SYNOPSIS
+#       failcmd.sh --help
+#       failcmd.sh [<options>] command [arguments]
+#
+# DESCRIPTION
+#       Run command with injecting slab/page allocation failures by fault
+#       injection.
+#
+#       NOTE: you need to run this script as root.
+#
+
+usage()
+{
+        cat >&2 <<EOF
+Usage: $0 [options] command [arguments]
+
+OPTIONS
+        -p percent
+        --probability=percent
+                likelihood of failure injection, in percent.
+                Default value is 1
+
+        -t value
+        --times=value
+                specifies how many times failures may happen at most.
+                Default value is 1
+
+        --oom-kill-allocating-task=value
+                set /proc/sys/vm/oom_kill_allocating_task to specified value
+                before running the command.
+                Default value is 1
+
+        -h, --help
+                Display a usage message and exit
+
+        --interval=value, --space=value, --verbose=value, --task-filter=value,
+        --stacktrace-depth=value, --require-start=value, --require-end=value,
+        --reject-start=value, --reject-end=value, --ignore-gfp-wait=value
+                See Documentation/fault-injection/fault-injection.txt for more
+                information
+
+        failslab options:
+        --cache-filter=value
+
+        fail_page_alloc options:
+        --ignore-gfp-highmem=value, --min-order=value
+
+ENVIRONMENT
+        FAILCMD_TYPE
+                The following values for FAILCMD_TYPE are recognized:
+
+                failslab
+                        inject slab allocation failures
+                fail_page_alloc
+                        inject page allocation failures
+
+                If FAILCMD_TYPE is not defined, then failslab is used.
+EOF
+}
+
+if [ $UID != 0 ]; then
+        echo must be run as root >&2
+        exit 1
+fi
+
+DEBUGFS=`mount -t debugfs | head -1 | awk '{ print $3}'`
+
+if [ ! -d "$DEBUGFS" ]; then
+        echo debugfs is not mounted >&2
+        exit 1
+fi
+
+FAILCMD_TYPE=${FAILCMD_TYPE:-failslab}
+FAULTATTR=$DEBUGFS/$FAILCMD_TYPE
+
+if [ ! -d $FAULTATTR ]; then
+        echo $FAILCMD_TYPE is not available >&2
+        exit 1
+fi
+
+LONGOPTS=probability:,interval:,times:,space:,verbose:,task-filter:
+LONGOPTS=$LONGOPTS,stacktrace-depth:,require-start:,require-end:
+LONGOPTS=$LONGOPTS,reject-start:,reject-end:,oom-kill-allocating-task:,help
+
+if [ $FAILCMD_TYPE = failslab ]; then
+        LONGOPTS=$LONGOPTS,ignore-gfp-wait:,cache-filter:
+elif [ $FAILCMD_TYPE = fail_page_alloc ]; then
+        LONGOPTS=$LONGOPTS,ignore-gfp-wait:,ignore-gfp-highmem:,min-order:
+fi
+
+TEMP=`getopt -o p:i:t:s:v:h --long $LONGOPTS -n 'failcmd.sh' -- "$@"`
+
+if [ $? != 0 ]; then
+        usage
+        exit 1
+fi
+
+eval set -- "$TEMP"
+
+fault_attr_default()
+{
+        echo N > $FAULTATTR/task-filter
+        echo 0 > $FAULTATTR/probability
+        echo 1 > $FAULTATTR/times
+}
+
+fault_attr_default
+
+oom_kill_allocating_task_saved=`cat /proc/sys/vm/oom_kill_allocating_task`
+
+restore_values()
+{
+        fault_attr_default
+        echo $oom_kill_allocating_task_saved \
+                > /proc/sys/vm/oom_kill_allocating_task
+}
+
+#
+# Default options
+#
+declare -i oom_kill_allocating_task=1
+declare task_filter=Y
+declare -i probability=1
+declare -i times=1
+
+while true; do
+        case "$1" in
+        -p|--probability)
+                probability=$2
+                shift 2
+                ;;
+        -i|--interval)
+                echo $2 > $FAULTATTR/interval
+                shift 2
+                ;;
+        -t|--times)
+                times=$2
+                shift 2
+                ;;
+        -s|--space)
+                echo $2 > $FAULTATTR/space
+                shift 2
+                ;;
+        -v|--verbose)
+                echo $2 > $FAULTATTR/verbose
+                shift 2
+                ;;
+        --task-filter)
+                task_filter=$2
+                shift 2
+                ;;
+        --stacktrace-depth)
+                echo $2 > $FAULTATTR/stacktrace-depth
+                shift 2
+                ;;
+        --require-start)
+                echo $2 > $FAULTATTR/require-start
+                shift 2
+                ;;
+        --require-end)
+                echo $2 > $FAULTATTR/require-end
+                shift 2
+                ;;
+        --reject-start)
+                echo $2 > $FAULTATTR/reject-start
+                shift 2
+                ;;
+        --reject-end)
+                echo $2 > $FAULTATTR/reject-end
+                shift 2
+                ;;
+        --oom-kill-allocating-task)
+                oom_kill_allocating_task=$2
+                shift 2
+                ;;
+        --ignore-gfp-wait)
+                echo $2 > $FAULTATTR/ignore-gfp-wait
+                shift 2
+                ;;
+        --cache-filter)
+                echo $2 > $FAULTATTR/cache_filter
+                shift 2
+                ;;
+        --ignore-gfp-highmem)
+                echo $2 > $FAULTATTR/ignore-gfp-highmem
+                shift 2
+                ;;
+        --min-order)
+                echo $2 > $FAULTATTR/min-order
+                shift 2
+                ;;
+        -h|--help)
+                usage
+                exit 0
+                shift
+                ;;
+        --)
+                shift
+                break
+                ;;
+        esac
+done
+
+[ -z "$@" ] && exit 0
+
+echo $oom_kill_allocating_task > /proc/sys/vm/oom_kill_allocating_task
+echo $task_filter > $FAULTATTR/task-filter
+echo $probability > $FAULTATTR/probability
+echo $times > $FAULTATTR/times
+
+trap "restore_values" SIGINT SIGTERM EXIT
+
+cmd="echo 1 > /proc/self/make-it-fail && exec $@"
+bash -c "$cmd"
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index a4162e15c25f..85baf11e2acd 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -1,4 +1,4 @@
-TARGETS = breakpoints kcmp mqueue vm
+TARGETS = breakpoints kcmp mqueue vm cpu-hotplug memory-hotplug
 
 all:
         for TARGET in $(TARGETS); do \
diff --git a/tools/testing/selftests/cpu-hotplug/Makefile b/tools/testing/selftests/cpu-hotplug/Makefile
new file mode 100644
index 000000000000..7c9c20ff578a
--- /dev/null
+++ b/tools/testing/selftests/cpu-hotplug/Makefile
@@ -0,0 +1,6 @@
+all:
+
+run_tests:
+        ./on-off-test.sh
+
+clean:
diff --git a/tools/testing/selftests/cpu-hotplug/on-off-test.sh b/tools/testing/selftests/cpu-hotplug/on-off-test.sh
new file mode 100644
index 000000000000..bdde7cf428bb
--- /dev/null
+++ b/tools/testing/selftests/cpu-hotplug/on-off-test.sh
@@ -0,0 +1,221 @@
+#!/bin/bash
+
+SYSFS=
+
+prerequisite()
+{
+        msg="skip all tests:"
+
+        if [ $UID != 0 ]; then
+                echo $msg must be run as root >&2
+                exit 0
+        fi
+
+        SYSFS=`mount -t sysfs | head -1 | awk '{ print $3 }'`
+
+        if [ ! -d "$SYSFS" ]; then
+                echo $msg sysfs is not mounted >&2
+                exit 0
+        fi
+
+        if ! ls $SYSFS/devices/system/cpu/cpu* > /dev/null 2>&1; then
+                echo $msg cpu hotplug is not supported >&2
+                exit 0
+        fi
+}
+
+#
+# list all hot-pluggable CPUs
+#
+hotpluggable_cpus()
+{
+        local state=${1:-.\*}
+
+        for cpu in $SYSFS/devices/system/cpu/cpu*; do
+                if [ -f $cpu/online ] && grep -q $state $cpu/online; then
+                        echo ${cpu##/*/cpu}
+                fi
+        done
+}
+
+hotplaggable_offline_cpus()
+{
+        hotpluggable_cpus 0
+}
+
+hotpluggable_online_cpus()
+{
+        hotpluggable_cpus 1
+}
+
+cpu_is_online()
+{
+        grep -q 1 $SYSFS/devices/system/cpu/cpu$1/online
+}
+
+cpu_is_offline()
+{
+        grep -q 0 $SYSFS/devices/system/cpu/cpu$1/online
+}
+
+online_cpu()
+{
+        echo 1 > $SYSFS/devices/system/cpu/cpu$1/online
+}
+
+offline_cpu()
+{
+        echo 0 > $SYSFS/devices/system/cpu/cpu$1/online
+}
+
+online_cpu_expect_success()
+{
+        local cpu=$1
+
+        if ! online_cpu $cpu; then
+                echo $FUNCNAME $cpu: unexpected fail >&2
+        elif ! cpu_is_online $cpu; then
+                echo $FUNCNAME $cpu: unexpected offline >&2
+        fi
+}
+
+online_cpu_expect_fail()
+{
+        local cpu=$1
+
+        if online_cpu $cpu 2> /dev/null; then
+                echo $FUNCNAME $cpu: unexpected success >&2
+        elif ! cpu_is_offline $cpu; then
+                echo $FUNCNAME $cpu: unexpected online >&2
+        fi
+}
+
+offline_cpu_expect_success()
+{
+        local cpu=$1
+
+        if ! offline_cpu $cpu; then
+                echo $FUNCNAME $cpu: unexpected fail >&2
+        elif ! cpu_is_offline $cpu; then
+                echo $FUNCNAME $cpu: unexpected offline >&2
+        fi
+}
+
+offline_cpu_expect_fail()
+{
+        local cpu=$1
+
+        if offline_cpu $cpu 2> /dev/null; then
+                echo $FUNCNAME $cpu: unexpected success >&2
+        elif ! cpu_is_online $cpu; then
+                echo $FUNCNAME $cpu: unexpected offline >&2
+        fi
+}
+
+error=-12
+priority=0
+
+while getopts e:hp: opt; do
+        case $opt in
+        e)
+                error=$OPTARG
+                ;;
+        h)
+                echo "Usage $0 [ -e errno ] [ -p notifier-priority ]"
+                exit
+                ;;
+        p)
+                priority=$OPTARG
+                ;;
+        esac
+done
+
+if ! [ "$error" -ge -4095 -a "$error" -lt 0 ]; then
+        echo "error code must be -4095 <= errno < 0" >&2
+        exit 1
+fi
+
+prerequisite
+
+#
+# Online all hot-pluggable CPUs
+#
+for cpu in `hotplaggable_offline_cpus`; do
+        online_cpu_expect_success $cpu
+done
+
+#
+# Offline all hot-pluggable CPUs
+#
+for cpu in `hotpluggable_online_cpus`; do
+        offline_cpu_expect_success $cpu
+done
+
+#
+# Online all hot-pluggable CPUs again
+#
+for cpu in `hotplaggable_offline_cpus`; do
+        online_cpu_expect_success $cpu
+done
+
+#
+# Test with cpu notifier error injection
+#
+
+DEBUGFS=`mount -t debugfs | head -1 | awk '{ print $3 }'`
+NOTIFIER_ERR_INJECT_DIR=$DEBUGFS/notifier-error-inject/cpu
+
+prerequisite_extra()
+{
+        msg="skip extra tests:"
+
+        /sbin/modprobe -q -r cpu-notifier-error-inject
+        /sbin/modprobe -q cpu-notifier-error-inject priority=$priority
+
+        if [ ! -d "$DEBUGFS" ]; then
+                echo $msg debugfs is not mounted >&2
+                exit 0
+        fi
+
+        if [ ! -d $NOTIFIER_ERR_INJECT_DIR ]; then
+                echo $msg cpu-notifier-error-inject module is not available >&2
+                exit 0
+        fi
+}
+
+prerequisite_extra
+
+#
+# Offline all hot-pluggable CPUs
+#
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/CPU_DOWN_PREPARE/error
+for cpu in `hotpluggable_online_cpus`; do
+        offline_cpu_expect_success $cpu
+done
+
+#
+# Test CPU hot-add error handling (offline => online)
+#
+echo $error > $NOTIFIER_ERR_INJECT_DIR/actions/CPU_UP_PREPARE/error
+for cpu in `hotplaggable_offline_cpus`; do
+        online_cpu_expect_fail $cpu
+done
+
+#
+# Online all hot-pluggable CPUs
+#
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/CPU_UP_PREPARE/error
+for cpu in `hotplaggable_offline_cpus`; do
+        online_cpu_expect_success $cpu
+done
+
+#
+# Test CPU hot-remove error handling (online => offline)
+#
+echo $error > $NOTIFIER_ERR_INJECT_DIR/actions/CPU_DOWN_PREPARE/error
+for cpu in `hotpluggable_online_cpus`; do
+        offline_cpu_expect_fail $cpu
+done
+
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/CPU_DOWN_PREPARE/error
+/sbin/modprobe -q -r cpu-notifier-error-inject
diff --git a/tools/testing/selftests/memory-hotplug/Makefile b/tools/testing/selftests/memory-hotplug/Makefile
new file mode 100644
index 000000000000..7c9c20ff578a
--- /dev/null
+++ b/tools/testing/selftests/memory-hotplug/Makefile
@@ -0,0 +1,6 @@
+all:
+
+run_tests:
+        ./on-off-test.sh
+
+clean:
diff --git a/tools/testing/selftests/memory-hotplug/on-off-test.sh b/tools/testing/selftests/memory-hotplug/on-off-test.sh
new file mode 100644
index 000000000000..a2816f631542
--- /dev/null
+++ b/tools/testing/selftests/memory-hotplug/on-off-test.sh
@@ -0,0 +1,230 @@
+#!/bin/bash
+
+SYSFS=
+
+prerequisite()
+{
+        msg="skip all tests:"
+
+        if [ $UID != 0 ]; then
+                echo $msg must be run as root >&2
+                exit 0
+        fi
+
+        SYSFS=`mount -t sysfs | head -1 | awk '{ print $3 }'`
+
+        if [ ! -d "$SYSFS" ]; then
+                echo $msg sysfs is not mounted >&2
+                exit 0
+        fi
+
+        if ! ls $SYSFS/devices/system/memory/memory* > /dev/null 2>&1; then
+                echo $msg memory hotplug is not supported >&2
+                exit 0
+        fi
+}
+
+#
+# list all hot-pluggable memory
+#
+hotpluggable_memory()
+{
+        local state=${1:-.\*}
+
+        for memory in $SYSFS/devices/system/memory/memory*; do
+                if grep -q 1 $memory/removable &&
+                   grep -q $state $memory/state; then
+                        echo ${memory##/*/memory}
+                fi
+        done
+}
+
+hotplaggable_offline_memory()
+{
+        hotpluggable_memory offline
+}
+
+hotpluggable_online_memory()
+{
+        hotpluggable_memory online
+}
+
+memory_is_online()
+{
+        grep -q online $SYSFS/devices/system/memory/memory$1/state
+}
+
+memory_is_offline()
+{
+        grep -q offline $SYSFS/devices/system/memory/memory$1/state
+}
+
+online_memory()
+{
+        echo online > $SYSFS/devices/system/memory/memory$1/state
+}
+
+offline_memory()
+{
+        echo offline > $SYSFS/devices/system/memory/memory$1/state
+}
+
+online_memory_expect_success()
+{
+        local memory=$1
+
+        if ! online_memory $memory; then
+                echo $FUNCNAME $memory: unexpected fail >&2
+        elif ! memory_is_online $memory; then
+                echo $FUNCNAME $memory: unexpected offline >&2
+        fi
+}
+
+online_memory_expect_fail()
+{
+        local memory=$1
+
+        if online_memory $memory 2> /dev/null; then
+                echo $FUNCNAME $memory: unexpected success >&2
+        elif ! memory_is_offline $memory; then
+                echo $FUNCNAME $memory: unexpected online >&2
+        fi
+}
+
+offline_memory_expect_success()
+{
+        local memory=$1
+
+        if ! offline_memory $memory; then
+                echo $FUNCNAME $memory: unexpected fail >&2
+        elif ! memory_is_offline $memory; then
+                echo $FUNCNAME $memory: unexpected offline >&2
+        fi
+}
+
+offline_memory_expect_fail()
+{
+        local memory=$1
+
+        if offline_memory $memory 2> /dev/null; then
+                echo $FUNCNAME $memory: unexpected success >&2
+        elif ! memory_is_online $memory; then
+                echo $FUNCNAME $memory: unexpected offline >&2
+        fi
+}
+
+error=-12
+priority=0
+ratio=10
+
+while getopts e:hp:r: opt; do
+        case $opt in
+        e)
+                error=$OPTARG
+                ;;
+        h)
+                echo "Usage $0 [ -e errno ] [ -p notifier-priority ] [ -r percent-of-memory-to-offline ]"
+                exit
+                ;;
+        p)
+                priority=$OPTARG
+                ;;
+        r)
+                ratio=$OPTARG
+                ;;
+        esac
+done
+
+if ! [ "$error" -ge -4095 -a "$error" -lt 0 ]; then
+        echo "error code must be -4095 <= errno < 0" >&2
+        exit 1
+fi
+
+prerequisite
+
+#
+# Online all hot-pluggable memory
+#
+for memory in `hotplaggable_offline_memory`; do
+        online_memory_expect_success $memory
+done
+
+#
+# Offline $ratio percent of hot-pluggable memory
+#
+for memory in `hotpluggable_online_memory`; do
+        if [ $((RANDOM % 100)) -lt $ratio ]; then
+                offline_memory_expect_success $memory
+        fi
+done
+
+#
+# Online all hot-pluggable memory again
+#
+for memory in `hotplaggable_offline_memory`; do
+        online_memory_expect_success $memory
+done
+
+#
+# Test with memory notifier error injection
+#
+
+DEBUGFS=`mount -t debugfs | head -1 | awk '{ print $3 }'`
+NOTIFIER_ERR_INJECT_DIR=$DEBUGFS/notifier-error-inject/memory
+
+prerequisite_extra()
+{
+        msg="skip extra tests:"
+
+        /sbin/modprobe -q -r memory-notifier-error-inject
+        /sbin/modprobe -q memory-notifier-error-inject priority=$priority
+
+        if [ ! -d "$DEBUGFS" ]; then
+                echo $msg debugfs is not mounted >&2
+                exit 0
+        fi
+
+        if [ ! -d $NOTIFIER_ERR_INJECT_DIR ]; then
+                echo $msg memory-notifier-error-inject module is not available >&2
+                exit 0
+        fi
+}
+
+prerequisite_extra
+
+#
+# Offline $ratio percent of hot-pluggable memory
+#
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/MEM_GOING_OFFLINE/error
+for memory in `hotpluggable_online_memory`; do
+        if [ $((RANDOM % 100)) -lt $ratio ]; then
+                offline_memory_expect_success $memory
+        fi
+done
+
+#
+# Test memory hot-add error handling (offline => online)
+#
+echo $error > $NOTIFIER_ERR_INJECT_DIR/actions/MEM_GOING_ONLINE/error
+for memory in `hotplaggable_offline_memory`; do
+        online_memory_expect_fail $memory
+done
+
+#
+# Online all hot-pluggable memory
+#
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/MEM_GOING_ONLINE/error
+for memory in `hotplaggable_offline_memory`; do
+        online_memory_expect_success $memory
+done
+
+#
+# Test memory hot-remove error handling (online => offline)
+#
+echo $error > $NOTIFIER_ERR_INJECT_DIR/actions/MEM_GOING_OFFLINE/error
+for memory in `hotpluggable_online_memory`; do
+        offline_memory_expect_fail $memory
+done
+
+echo 0 > $NOTIFIER_ERR_INJECT_DIR/actions/MEM_GOING_OFFLINE/error
+/sbin/modprobe -q -r memory-notifier-error-inject