Merge branch 'spear/dt' into next/dt2

* spear/dt:
  ARM: SPEAr600: Add device-tree support to SPEAr600 boards

(update to v3.3-rc7)

Conflicts:
	arch/arm/mach-spear6xx/spear6xx.c
	arch/arm/mach-vexpress/Kconfig

The conflicts are between the previous contents of the next/dt2
branch and upstream changes from v3.3-rc7.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>

227 files changed, 1492 insertions, 904 deletions

diff --git a/Documentation/devicetree/bindings/arm/spear.txt b/Documentation/devicetree/bindings/arm/spear.txt
new file mode 100644
index 000000000000..f8e54f092328
--- /dev/null
+++ b/Documentation/devicetree/bindings/arm/spear.txt
@@ -0,0 +1,8 @@
+ST SPEAr Platforms Device Tree Bindings
+---------------------------------------
+
+Boards with the ST SPEAr600 SoC shall have the following properties:
+
+Required root node property:
+
+compatible = "st,spear600";
diff --git a/Documentation/devicetree/bindings/gpio/led.txt b/Documentation/devicetree/bindings/gpio/led.txt
index 141087cf3107..fd2bd56e7195 100644
--- a/Documentation/devicetree/bindings/gpio/led.txt
+++ b/Documentation/devicetree/bindings/gpio/led.txt
@@ -7,9 +7,9 @@ Each LED is represented as a sub-node of the gpio-leds device.  Each
 node's name represents the name of the corresponding LED.
 
 LED sub-node properties:
-- gpios :  Should specify the LED's GPIO, see "Specifying GPIO information
-  for devices" in Documentation/devicetree/booting-without-of.txt.  Active
-  low LEDs should be indicated using flags in the GPIO specifier.
+- gpios :  Should specify the LED's GPIO, see "gpios property" in
+  Documentation/devicetree/gpio.txt.  Active low LEDs should be
+  indicated using flags in the GPIO specifier.
 - label :  (optional) The label for this LED.  If omitted, the label is
   taken from the node name (excluding the unit address).
 - linux,default-trigger :  (optional) This parameter, if present, is a
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index ecc6a6cd26c1..a20008ab319a 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -30,6 +30,7 @@ national	National Semiconductor
 nintendo        Nintendo
 nvidia  NVIDIA
 nxp     NXP Semiconductors
+picochip        Picochip Ltd
 powervr Imagination Technologies
 qcom    Qualcomm, Inc.
 ramtron Ramtron International
diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
index a22ecf48f255..52729a756c1b 100644
--- a/Documentation/hwmon/jc42
+++ b/Documentation/hwmon/jc42
@@ -7,21 +7,29 @@ Supported chips:
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
         http://www.analog.com/static/imported-files/data_sheets/ADT7408.pdf
-  * IDT TSE2002B3, TS3000B3
-    Prefix: 'tse2002b3', 'ts3000b3'
+  * Atmel AT30TS00
+    Prefix: 'at30ts00'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
-        http://www.idt.com/products/getdoc.cfm?docid=18715691
-        http://www.idt.com/products/getdoc.cfm?docid=18715692
+        http://www.atmel.com/Images/doc8585.pdf
+  * IDT TSE2002B3, TSE2002GB2, TS3000B3, TS3000GB2
+    Prefix: 'tse2002', 'ts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002B3C_DST_20100512_120303152056.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002GB2A1_DST_20111107_120303145914.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000B3A_DST_20101129_120303152013.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000GB2A1_DST_20111104_120303151012.pdf
   * Maxim MAX6604
     Prefix: 'max6604'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
         http://datasheets.maxim-ic.com/en/ds/MAX6604.pdf
-  * Microchip MCP9805, MCP98242, MCP98243, MCP9843
-    Prefixes: 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
+  * Microchip MCP9804, MCP9805, MCP98242, MCP98243, MCP9843
+    Prefixes: 'mcp9804', 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
+        http://ww1.microchip.com/downloads/en/DeviceDoc/22203C.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/21977b.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/21996a.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/22153c.pdf
@@ -48,6 +56,12 @@ Supported chips:
     Datasheets:
         http://www.st.com/stonline/products/literature/ds/13447/stts424.pdf
         http://www.st.com/stonline/products/literature/ds/13448/stts424e02.pdf
+  * ST Microelectronics STTS2002, STTS3000
+    Prefix: 'stts2002', 'stts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00225278.pdf
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATA_BRIEF/CD00270920.pdf
   * JEDEC JC 42.4 compliant temperature sensor chips
     Prefix: 'jc42'
     Addresses scanned: I2C 0x18 - 0x1f
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index f274c28b5103..2f95308251d4 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -13,7 +13,8 @@ Detection
 
 All ALPS touchpads should respond to the "E6 report" command sequence:
 E8-E6-E6-E6-E9. An ALPS touchpad should respond with either 00-00-0A or
-00-00-64.
+00-00-64 if no buttons are pressed. The bits 0-2 of the first byte will be 1s
+if some buttons are pressed.
 
 If the E6 report is successful, the touchpad model is identified using the "E7
 report" sequence: E8-E7-E7-E7-E9. The response is the model signature and is
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 033d4e69b43b..d99fd9c0ec0e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2211,6 +2211,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
                         default: off.
 
+        printk.always_kmsg_dump=
+                        Trigger kmsg_dump for cases other than kernel oops or
+                        panics
+                        Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
+                        default: disabled
+
         printk.time=    Show timing data prefixed to each printk message line
                         Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 
diff --git a/MAINTAINERS b/MAINTAINERS
index f096b0d8e973..24c94d68a39b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -962,7 +962,7 @@ F:	drivers/tty/serial/msm_serial.c
 F:      drivers/platform/msm/
 F:      drivers/*/pm8???-*
 F:      include/linux/mfd/pm8xxx/
-T:      git git://codeaurora.org/quic/kernel/davidb/linux-msm.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git
 S:      Maintained
 
 ARM/TOSA MACHINE SUPPORT
@@ -1310,7 +1310,7 @@ F:	drivers/atm/
 F:      include/linux/atm*
 
 ATMEL AT91 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.atmel.com/products/AT91/
 W:      http://www.at91.com/
@@ -1318,7 +1318,7 @@ S:	Maintained
 F:      drivers/mmc/host/at91_mci.c
 
 ATMEL AT91 / AT32 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 S:      Maintained
 F:      drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
diff --git a/Makefile b/Makefile
index 66d13c917bc7..56d481727c30 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/futex.h b/arch/alpha/include/asm/futex.h
index e8a761aee088..f939794363ac 100644
--- a/arch/alpha/include/asm/futex.h
+++ b/arch/alpha/include/asm/futex.h
@@ -108,7 +108,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
         "       lda     $31,3b-2b(%0)\n"
         "       .previous\n"
         :       "+r"(ret), "=&r"(prev), "=&r"(cmp)
-        :       "r"(uaddr), "r"((long)oldval), "r"(newval)
+        :       "r"(uaddr), "r"((long)(int)oldval), "r"(newval)
         :       "memory");
 
         *uval = prev;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index cabd8f556a1f..b0e65d6f1193 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1281,7 +1281,7 @@ config ARM_ERRATA_743622
         depends on CPU_V7
         help
           This option enables the workaround for the 743622 Cortex-A9
-          (r2p0..r2p2) erratum. Under very rare conditions, a faulty
+          (r2p*) erratum. Under very rare conditions, a faulty
           optimisation in the Cortex-A9 Store Buffer may lead to data
           corruption. This workaround sets a specific bit in the diagnostic
           register of the Cortex-A9 which disables the Store Buffer
diff --git a/arch/arm/boot/.gitignore b/arch/arm/boot/.gitignore
index ce1c5ff746e7..3c79f85975aa 100644
--- a/arch/arm/boot/.gitignore
+++ b/arch/arm/boot/.gitignore
@@ -3,3 +3,4 @@ zImage
 xipImage
 bootpImage
 uImage
+*.dtb
diff --git a/arch/arm/boot/dts/spear600-evb.dts b/arch/arm/boot/dts/spear600-evb.dts
new file mode 100644
index 000000000000..636292e18c90
--- /dev/null
+++ b/arch/arm/boot/dts/spear600-evb.dts
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2012 Stefan Roese <sr@denx.de>
+ *
+ * The code contained herein is licensed under the GNU General Public
+ * License. You may obtain a copy of the GNU General Public License
+ * Version 2 or later at the following locations:
+ *
+ * http://www.opensource.org/licenses/gpl-license.html
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+
+/dts-v1/;
+/include/ "spear600.dtsi"
+
+/ {
+        model = "ST SPEAr600 Evaluation Board";
+        compatible = "st,spear600-evb", "st,spear600";
+        #address-cells = <1>;
+        #size-cells = <1>;
+
+        memory {
+                device_type = "memory";
+                reg = <0 0x10000000>;
+        };
+
+        ahb {
+                gmac: ethernet@e0800000 {
+                        phy-mode = "gmii";
+                        status = "okay";
+                };
+
+                apb {
+                        serial@d0000000 {
+                                status = "okay";
+                        };
+
+                        serial@d0080000 {
+                                status = "okay";
+                        };
+
+                        i2c@d0200000 {
+                                clock-frequency = <400000>;
+                                status = "okay";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi
new file mode 100644
index 000000000000..ebe0885a2b98
--- /dev/null
+++ b/arch/arm/boot/dts/spear600.dtsi
@@ -0,0 +1,174 @@
+/*
+ * Copyright 2012 Stefan Roese <sr@denx.de>
+ *
+ * The code contained herein is licensed under the GNU General Public
+ * License. You may obtain a copy of the GNU General Public License
+ * Version 2 or later at the following locations:
+ *
+ * http://www.opensource.org/licenses/gpl-license.html
+ * http://www.gnu.org/copyleft/gpl.html
+ */
+
+/include/ "skeleton.dtsi"
+
+/ {
+        compatible = "st,spear600";
+
+        cpus {
+                cpu@0 {
+                        compatible = "arm,arm926ejs";
+                };
+        };
+
+        memory {
+                device_type = "memory";
+                reg = <0 0x40000000>;
+        };
+
+        ahb {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "simple-bus";
+                ranges = <0xd0000000 0xd0000000 0x30000000>;
+
+                vic0: interrupt-controller@f1100000 {
+                        compatible = "arm,pl190-vic";
+                        interrupt-controller;
+                        reg = <0xf1100000 0x1000>;
+                        #interrupt-cells = <1>;
+                };
+
+                vic1: interrupt-controller@f1000000 {
+                        compatible = "arm,pl190-vic";
+                        interrupt-controller;
+                        reg = <0xf1000000 0x1000>;
+                        #interrupt-cells = <1>;
+                };
+
+                gmac: ethernet@e0800000 {
+                        compatible = "st,spear600-gmac";
+                        reg = <0xe0800000 0x8000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <24 23>;
+                        interrupt-names = "macirq", "eth_wake_irq";
+                        status = "disabled";
+                };
+
+                fsmc: flash@d1800000 {
+                        compatible = "st,spear600-fsmc-nand";
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        reg = <0xd1800000 0x1000        /* FSMC Register */
+                               0xd2000000 0x4000>;      /* NAND Base */
+                        reg-names = "fsmc_regs", "nand_data";
+                        st,ale-off = <0x20000>;
+                        st,cle-off = <0x10000>;
+                        status = "disabled";
+                };
+
+                smi: flash@fc000000 {
+                        compatible = "st,spear600-smi";
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        reg = <0xfc000000 0x1000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <12>;
+                        status = "disabled";
+                };
+
+                ehci@e1800000 {
+                        compatible = "st,spear600-ehci", "usb-ehci";
+                        reg = <0xe1800000 0x1000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <27>;
+                        status = "disabled";
+                };
+
+                ehci@e2000000 {
+                        compatible = "st,spear600-ehci", "usb-ehci";
+                        reg = <0xe2000000 0x1000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <29>;
+                        status = "disabled";
+                };
+
+                ohci@e1900000 {
+                        compatible = "st,spear600-ohci", "usb-ohci";
+                        reg = <0xe1900000 0x1000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <26>;
+                        status = "disabled";
+                };
+
+                ohci@e2100000 {
+                        compatible = "st,spear600-ohci", "usb-ohci";
+                        reg = <0xe2100000 0x1000>;
+                        interrupt-parent = <&vic1>;
+                        interrupts = <28>;
+                        status = "disabled";
+                };
+
+                apb {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        compatible = "simple-bus";
+                        ranges = <0xd0000000 0xd0000000 0x30000000>;
+
+                        serial@d0000000 {
+                                compatible = "arm,pl011", "arm,primecell";
+                                reg = <0xd0000000 0x1000>;
+                                interrupt-parent = <&vic0>;
+                                interrupts = <24>;
+                                status = "disabled";
+                        };
+
+                        serial@d0080000 {
+                                compatible = "arm,pl011", "arm,primecell";
+                                reg = <0xd0080000 0x1000>;
+                                interrupt-parent = <&vic0>;
+                                interrupts = <25>;
+                                status = "disabled";
+                        };
+
+                        /* local/cpu GPIO */
+                        gpio0: gpio@f0100000 {
+                                #gpio-cells = <2>;
+                                compatible = "arm,pl061", "arm,primecell";
+                                gpio-controller;
+                                reg = <0xf0100000 0x1000>;
+                                interrupt-parent = <&vic0>;
+                                interrupts = <18>;
+                        };
+
+                        /* basic GPIO */
+                        gpio1: gpio@fc980000 {
+                                #gpio-cells = <2>;
+                                compatible = "arm,pl061", "arm,primecell";
+                                gpio-controller;
+                                reg = <0xfc980000 0x1000>;
+                                interrupt-parent = <&vic1>;
+                                interrupts = <19>;
+                        };
+
+                        /* appl GPIO */
+                        gpio2: gpio@d8100000 {
+                                #gpio-cells = <2>;
+                                compatible = "arm,pl061", "arm,primecell";
+                                gpio-controller;
+                                reg = <0xd8100000 0x1000>;
+                                interrupt-parent = <&vic1>;
+                                interrupts = <4>;
+                        };
+
+                        i2c@d0200000 {
+                                #address-cells = <1>;
+                                #size-cells = <0>;
+                                compatible = "snps,designware-i2c";
+                                reg = <0xd0200000 0x1000>;
+                                interrupt-parent = <&vic0>;
+                                interrupts = <28>;
+                                status = "disabled";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/include/asm/pmu.h b/arch/arm/include/asm/pmu.h
index b5a5be2536c1..90114faa9f3c 100644
--- a/arch/arm/include/asm/pmu.h
+++ b/arch/arm/include/asm/pmu.h
@@ -134,7 +134,7 @@ int __init armpmu_register(struct arm_pmu *armpmu, char *name, int type);
 
 u64 armpmu_event_update(struct perf_event *event,
                         struct hw_perf_event *hwc,
-                        int idx, int overflow);
+                        int idx);
 
 int armpmu_event_set_period(struct perf_event *event,
                             struct hw_perf_event *hwc,
diff --git a/arch/arm/kernel/ecard.c b/arch/arm/kernel/ecard.c
index 4dd0edab6a65..1651d4950744 100644
--- a/arch/arm/kernel/ecard.c
+++ b/arch/arm/kernel/ecard.c
@@ -242,6 +242,7 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
+        vma.vm_flags = VM_EXEC;
         vma.vm_mm = mm;
 
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 5bb91bf3d47f..b2abfa18f137 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -180,7 +180,7 @@ armpmu_event_set_period(struct perf_event *event,
 u64
 armpmu_event_update(struct perf_event *event,
                     struct hw_perf_event *hwc,
-                    int idx, int overflow)
+                    int idx)
 {
         struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
         u64 delta, prev_raw_count, new_raw_count;
@@ -193,13 +193,7 @@ again:
                              new_raw_count) != prev_raw_count)
                 goto again;
 
-        new_raw_count &= armpmu->max_period;
-        prev_raw_count &= armpmu->max_period;
-
-        if (overflow)
-                delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
-        else
-                delta = new_raw_count - prev_raw_count;
+        delta = (new_raw_count - prev_raw_count) & armpmu->max_period;
 
         local64_add(delta, &event->count);
         local64_sub(delta, &hwc->period_left);
@@ -216,7 +210,7 @@ armpmu_read(struct perf_event *event)
         if (hwc->idx < 0)
                 return;
 
-        armpmu_event_update(event, hwc, hwc->idx, 0);
+        armpmu_event_update(event, hwc, hwc->idx);
 }
 
 static void
@@ -232,7 +226,7 @@ armpmu_stop(struct perf_event *event, int flags)
         if (!(hwc->state & PERF_HES_STOPPED)) {
                 armpmu->disable(hwc, hwc->idx);
                 barrier(); /* why? */
-                armpmu_event_update(event, hwc, hwc->idx, 0);
+                armpmu_event_update(event, hwc, hwc->idx);
                 hwc->state |= PERF_HES_STOPPED | PERF_HES_UPTODATE;
         }
 }
@@ -518,7 +512,13 @@ __hw_perf_event_init(struct perf_event *event)
         hwc->config_base            |= (unsigned long)mapping;
 
         if (!hwc->sample_period) {
-                hwc->sample_period  = armpmu->max_period;
+                /*
+                 * For non-sampling runs, limit the sample_period to half
+                 * of the counter width. That way, the new counter value
+                 * is far less likely to overtake the previous one unless
+                 * you have some serious IRQ latency issues.
+                 */
+                hwc->sample_period  = armpmu->max_period >> 1;
                 hwc->last_period    = hwc->sample_period;
                 local64_set(&hwc->period_left, hwc->sample_period);
         }
@@ -680,6 +680,28 @@ static void __init cpu_pmu_init(struct arm_pmu *armpmu)
 }
 
 /*
+ * PMU hardware loses all context when a CPU goes offline.
+ * When a CPU is hotplugged back in, since some hardware registers are
+ * UNKNOWN at reset, the PMU must be explicitly reset to avoid reading
+ * junk values out of them.
+ */
+static int __cpuinit pmu_cpu_notify(struct notifier_block *b,
+                                        unsigned long action, void *hcpu)
+{
+        if ((action & ~CPU_TASKS_FROZEN) != CPU_STARTING)
+                return NOTIFY_DONE;
+
+        if (cpu_pmu && cpu_pmu->reset)
+                cpu_pmu->reset(NULL);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata pmu_cpu_notifier = {
+        .notifier_call = pmu_cpu_notify,
+};
+
+/*
  * CPU PMU identification and registration.
  */
 static int __init
@@ -730,6 +752,7 @@ init_hw_perf_events(void)
                 pr_info("enabled with %s PMU driver, %d counters available\n",
                         cpu_pmu->name, cpu_pmu->num_events);
                 cpu_pmu_init(cpu_pmu);
+                register_cpu_notifier(&pmu_cpu_notifier);
                 armpmu_register(cpu_pmu, "cpu", PERF_TYPE_RAW);
         } else {
                 pr_info("no hardware support available\n");
diff --git a/arch/arm/kernel/perf_event_v6.c b/arch/arm/kernel/perf_event_v6.c
index 533be9930ec2..b78af0cc6ef3 100644
--- a/arch/arm/kernel/perf_event_v6.c
+++ b/arch/arm/kernel/perf_event_v6.c
@@ -467,23 +467,6 @@ armv6pmu_enable_event(struct hw_perf_event *hwc,
         raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
 
-static int counter_is_active(unsigned long pmcr, int idx)
-{
-        unsigned long mask = 0;
-        if (idx == ARMV6_CYCLE_COUNTER)
-                mask = ARMV6_PMCR_CCOUNT_IEN;
-        else if (idx == ARMV6_COUNTER0)
-                mask = ARMV6_PMCR_COUNT0_IEN;
-        else if (idx == ARMV6_COUNTER1)
-                mask = ARMV6_PMCR_COUNT1_IEN;
-
-        if (mask)
-                return pmcr & mask;
-
-        WARN_ONCE(1, "invalid counter number (%d)\n", idx);
-        return 0;
-}
-
 static irqreturn_t
 armv6pmu_handle_irq(int irq_num,
                     void *dev)
@@ -513,7 +496,8 @@ armv6pmu_handle_irq(int irq_num,
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
-                if (!counter_is_active(pmcr, idx))
+                /* Ignore if we don't have an event. */
+                if (!event)
                         continue;
 
                 /*
@@ -524,7 +508,7 @@ armv6pmu_handle_irq(int irq_num,
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 6933244c68f9..4d7095af2ab3 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -809,6 +809,11 @@ static inline int armv7_pmnc_disable_intens(int idx)
 
         counter = ARMV7_IDX_TO_COUNTER(idx);
         asm volatile("mcr p15, 0, %0, c9, c14, 2" : : "r" (BIT(counter)));
+        isb();
+        /* Clear the overflow flag in case an interrupt is pending. */
+        asm volatile("mcr p15, 0, %0, c9, c12, 3" : : "r" (BIT(counter)));
+        isb();
+
         return idx;
 }
 
@@ -955,6 +960,10 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
+                /* Ignore if we don't have an event. */
+                if (!event)
+                        continue;
+
                 /*
                  * We have a single interrupt for all counters. Check that
                  * each counter has overflowed before we process it.
@@ -963,7 +972,7 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
diff --git a/arch/arm/kernel/perf_event_xscale.c b/arch/arm/kernel/perf_event_xscale.c
index 3b99d8269829..71a21e6712f5 100644
--- a/arch/arm/kernel/perf_event_xscale.c
+++ b/arch/arm/kernel/perf_event_xscale.c
@@ -255,11 +255,14 @@ xscale1pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
+                if (!event)
+                        continue;
+
                 if (!xscale1_pmnc_counter_has_overflowed(pmnc, idx))
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
@@ -592,11 +595,14 @@ xscale2pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
-                if (!xscale2_pmnc_counter_has_overflowed(pmnc, idx))
+                if (!event)
+                        continue;
+
+                if (!xscale2_pmnc_counter_has_overflowed(of_flags, idx))
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
@@ -663,7 +669,7 @@ xscale2pmu_enable_event(struct hw_perf_event *hwc, int idx)
 static void
 xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
 {
-        unsigned long flags, ien, evtsel;
+        unsigned long flags, ien, evtsel, of_flags;
         struct pmu_hw_events *events = cpu_pmu->get_hw_events();
 
         ien = xscale2pmu_read_int_enable();
@@ -672,26 +678,31 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
         switch (idx) {
         case XSCALE_CYCLE_COUNTER:
                 ien &= ~XSCALE2_CCOUNT_INT_EN;
+                of_flags = XSCALE2_CCOUNT_OVERFLOW;
                 break;
         case XSCALE_COUNTER0:
                 ien &= ~XSCALE2_COUNT0_INT_EN;
                 evtsel &= ~XSCALE2_COUNT0_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT0_EVT_SHFT;
+                of_flags = XSCALE2_COUNT0_OVERFLOW;
                 break;
         case XSCALE_COUNTER1:
                 ien &= ~XSCALE2_COUNT1_INT_EN;
                 evtsel &= ~XSCALE2_COUNT1_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT1_EVT_SHFT;
+                of_flags = XSCALE2_COUNT1_OVERFLOW;
                 break;
         case XSCALE_COUNTER2:
                 ien &= ~XSCALE2_COUNT2_INT_EN;
                 evtsel &= ~XSCALE2_COUNT2_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT2_EVT_SHFT;
+                of_flags = XSCALE2_COUNT2_OVERFLOW;
                 break;
         case XSCALE_COUNTER3:
                 ien &= ~XSCALE2_COUNT3_INT_EN;
                 evtsel &= ~XSCALE2_COUNT3_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT3_EVT_SHFT;
+                of_flags = XSCALE2_COUNT3_OVERFLOW;
                 break;
         default:
                 WARN_ONCE(1, "invalid counter number (%d)\n", idx);
@@ -701,6 +712,7 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
         raw_spin_lock_irqsave(&events->pmu_lock, flags);
         xscale2pmu_write_event_select(evtsel);
         xscale2pmu_write_int_enable(ien);
+        xscale2pmu_write_overflow_flags(of_flags);
         raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
 
diff --git a/arch/arm/mach-ep93xx/vision_ep9307.c b/arch/arm/mach-ep93xx/vision_ep9307.c
index d5fb44f16d31..d67d0b4feb6f 100644
--- a/arch/arm/mach-ep93xx/vision_ep9307.c
+++ b/arch/arm/mach-ep93xx/vision_ep9307.c
@@ -34,6 +34,7 @@
 #include <mach/ep93xx_spi.h>
 #include <mach/gpio-ep93xx.h>
 
+#include <asm/hardware/vic.h>
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
 #include <asm/mach/arch.h>
@@ -361,6 +362,7 @@ MACHINE_START(VISION_EP9307, "Vision Engraving Systems EP9307")
         .atag_offset    = 0x100,
         .map_io         = vision_map_io,
         .init_irq       = ep93xx_init_irq,
+        .handle_irq     = vic_handle_irq,
         .timer          = &ep93xx_timer,
         .init_machine   = vision_init_machine,
         .restart        = ep93xx_restart,
diff --git a/arch/arm/mach-exynos/mach-universal_c210.c b/arch/arm/mach-exynos/mach-universal_c210.c
index 0fc65ffde8ff..38939956c34f 100644
--- a/arch/arm/mach-exynos/mach-universal_c210.c
+++ b/arch/arm/mach-exynos/mach-universal_c210.c
@@ -13,6 +13,7 @@
 #include <linux/i2c.h>
 #include <linux/gpio_keys.h>
 #include <linux/gpio.h>
+#include <linux/interrupt.h>
 #include <linux/fb.h>
 #include <linux/mfd/max8998.h>
 #include <linux/regulator/machine.h>
@@ -595,6 +596,7 @@ static struct mxt_platform_data qt602240_platform_data = {
         .threshold      = 0x28,
         .voltage        = 2800000,              /* 2.8V */
         .orient         = MXT_DIAGONAL,
+        .irqflags       = IRQF_TRIGGER_FALLING,
 };
 
 static struct i2c_board_info i2c3_devs[] __initdata = {
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 6c5826605eae..719ee423abe2 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -343,6 +343,7 @@ static void __init omap3_check_revision(const char **cpu_rev)
         case 0xb944:
                 omap_revision = AM335X_REV_ES1_0;
                 *cpu_rev = "1.0";
+                break;
         case 0xb8f2:
                 switch (rev) {
                 case 0:
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index 2cc1aa004b94..415a6f1cf419 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -420,8 +420,7 @@ static void __exit omap2_mbox_exit(void)
         platform_driver_unregister(&omap2_mbox_driver);
 }
 
-/* must be ready before omap3isp is probed */
-subsys_initcall(omap2_mbox_init);
+module_init(omap2_mbox_init);
 module_exit(omap2_mbox_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/arch/arm/mach-omap2/omap-iommu.c b/arch/arm/mach-omap2/omap-iommu.c
index b8822048e409..ac49384d0285 100644
--- a/arch/arm/mach-omap2/omap-iommu.c
+++ b/arch/arm/mach-omap2/omap-iommu.c
@@ -150,7 +150,8 @@ err_out:
                 platform_device_put(omap_iommu_pdev[i]);
         return err;
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index ebc595091312..70de277f5c15 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -31,6 +31,7 @@
 
 #include "common.h"
 #include "omap4-sar-layout.h"
+#include <linux/export.h>
 
 #ifdef CONFIG_CACHE_L2X0
 static void __iomem *l2cache_base;
@@ -55,6 +56,7 @@ void omap_bus_sync(void)
                 isb();
         }
 }
+EXPORT_SYMBOL(omap_bus_sync);
 
 /* Steal one page physical memory for barrier implementation */
 int __init omap_barrier_reserve_memblock(void)
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 10b20c652e5d..4b57757bf9d1 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -270,7 +270,6 @@ static struct regulator_init_data omap4_vusb_idata = {
         .constraints = {
                 .min_uV                 = 3300000,
                 .max_uV                 = 3300000,
-                .apply_uV               = true,
                 .valid_modes_mask       = REGULATOR_MODE_NORMAL
                                         | REGULATOR_MODE_STANDBY,
                 .valid_ops_mask         = REGULATOR_CHANGE_MODE
diff --git a/arch/arm/mach-pxa/generic.h b/arch/arm/mach-pxa/generic.h
index 0d729e6619df..42d5cca66257 100644
--- a/arch/arm/mach-pxa/generic.h
+++ b/arch/arm/mach-pxa/generic.h
@@ -49,7 +49,6 @@ extern unsigned pxa3xx_get_clk_frequency_khz(int);
 #endif
 
 extern struct syscore_ops pxa_irq_syscore_ops;
-extern struct syscore_ops pxa_gpio_syscore_ops;
 extern struct syscore_ops pxa2xx_mfp_syscore_ops;
 extern struct syscore_ops pxa3xx_mfp_syscore_ops;
 
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index f14775536b83..29b62afc6f7c 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -226,6 +226,12 @@ static void __init pxa25x_mfp_init(void)
 {
         int i;
 
+        /* running before pxa_gpio_probe() */
+#ifdef CONFIG_CPU_PXA26x
+        pxa_last_gpio = 89;
+#else
+        pxa_last_gpio = 84;
+#endif
         for (i = 0; i <= pxa_last_gpio; i++)
                 gpio_desc[i].valid = 1;
 
@@ -295,6 +301,7 @@ static void __init pxa27x_mfp_init(void)
 {
         int i, gpio;
 
+        pxa_last_gpio = 120;    /* running before pxa_gpio_probe() */
         for (i = 0; i <= pxa_last_gpio; i++) {
                 /* skip GPIO2, 5, 6, 7, 8, they are not
                  * valid pins allow configuration
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 00d6eacab8e4..3352b37b60cf 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -208,6 +208,7 @@ static struct clk_lookup pxa25x_clkregs[] = {
         INIT_CLKREG(&clk_pxa25x_gpio11, NULL, "GPIO11_CLK"),
         INIT_CLKREG(&clk_pxa25x_gpio12, NULL, "GPIO12_CLK"),
         INIT_CLKREG(&clk_pxa25x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 
 static struct clk_lookup pxa25x_hwuart_clkreg =
@@ -367,7 +368,6 @@ static int __init pxa25x_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa2xx_clock_syscore_ops);
 
                 ret = platform_add_devices(pxa25x_devices,
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index c1673b3441d4..6bce78edce7a 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -229,6 +229,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
         INIT_CLKREG(&clk_pxa27x_im, NULL, "IMCLK"),
         INIT_CLKREG(&clk_pxa27x_memc, NULL, "MEMCLK"),
         INIT_CLKREG(&clk_pxa27x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 
 #ifdef CONFIG_PM
@@ -455,7 +456,6 @@ static int __init pxa27x_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa2xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c
index 4f402afa6609..3918a672238e 100644
--- a/arch/arm/mach-pxa/pxa3xx.c
+++ b/arch/arm/mach-pxa/pxa3xx.c
@@ -462,7 +462,6 @@ static int __init pxa3xx_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa3xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa3xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa95x.c b/arch/arm/mach-pxa/pxa95x.c
index d082a583df78..5ce434b95e87 100644
--- a/arch/arm/mach-pxa/pxa95x.c
+++ b/arch/arm/mach-pxa/pxa95x.c
@@ -283,7 +283,6 @@ static int __init pxa95x_init(void)
                         return ret;
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa3xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-s3c2440/common.h b/arch/arm/mach-s3c2440/common.h
index db8a98ac68c5..0c1eb1dfc534 100644
--- a/arch/arm/mach-s3c2440/common.h
+++ b/arch/arm/mach-s3c2440/common.h
@@ -12,6 +12,6 @@
 #ifndef __ARCH_ARM_MACH_S3C2440_COMMON_H
 #define __ARCH_ARM_MACH_S3C2440_COMMON_H
 
-void s3c2440_restart(char mode, const char *cmd);
+void s3c244x_restart(char mode, const char *cmd);
 
 #endif /* __ARCH_ARM_MACH_S3C2440_COMMON_H */
diff --git a/arch/arm/mach-s3c2440/mach-anubis.c b/arch/arm/mach-s3c2440/mach-anubis.c
index 24569550de1a..19b577bc09b8 100644
--- a/arch/arm/mach-s3c2440/mach-anubis.c
+++ b/arch/arm/mach-s3c2440/mach-anubis.c
@@ -487,5 +487,5 @@ MACHINE_START(ANUBIS, "Simtec-Anubis")
         .init_machine   = anubis_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-at2440evb.c b/arch/arm/mach-s3c2440/mach-at2440evb.c
index d6a9763110cd..d7ae49c90118 100644
--- a/arch/arm/mach-s3c2440/mach-at2440evb.c
+++ b/arch/arm/mach-s3c2440/mach-at2440evb.c
@@ -222,5 +222,5 @@ MACHINE_START(AT2440EVB, "AT2440EVB")
         .init_machine   = at2440evb_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
index 5859e609d28c..9a4a5bc008e6 100644
--- a/arch/arm/mach-s3c2440/mach-gta02.c
+++ b/arch/arm/mach-s3c2440/mach-gta02.c
@@ -601,5 +601,5 @@ MACHINE_START(NEO1973_GTA02, "GTA02")
         .init_irq       = s3c24xx_init_irq,
         .init_machine   = gta02_machine_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-mini2440.c b/arch/arm/mach-s3c2440/mach-mini2440.c
index adbbb85bc4cd..5d66fb218a41 100644
--- a/arch/arm/mach-s3c2440/mach-mini2440.c
+++ b/arch/arm/mach-s3c2440/mach-mini2440.c
@@ -701,5 +701,5 @@ MACHINE_START(MINI2440, "MINI2440")
         .init_machine   = mini2440_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-nexcoder.c b/arch/arm/mach-s3c2440/mach-nexcoder.c
index 40eaf844bc1f..5198e3e1c5be 100644
--- a/arch/arm/mach-s3c2440/mach-nexcoder.c
+++ b/arch/arm/mach-s3c2440/mach-nexcoder.c
@@ -158,5 +158,5 @@ MACHINE_START(NEXCODER_2440, "NexVision - Nexcoder 2440")
         .init_machine   = nexcoder_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-osiris.c b/arch/arm/mach-s3c2440/mach-osiris.c
index 4c480ef734f6..c5daeb612a88 100644
--- a/arch/arm/mach-s3c2440/mach-osiris.c
+++ b/arch/arm/mach-s3c2440/mach-osiris.c
@@ -436,5 +436,5 @@ MACHINE_START(OSIRIS, "Simtec-OSIRIS")
         .init_irq       = s3c24xx_init_irq,
         .init_machine   = osiris_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx1950.c b/arch/arm/mach-s3c2440/mach-rx1950.c
index 80077f6472ee..6f68abf44fab 100644
--- a/arch/arm/mach-s3c2440/mach-rx1950.c
+++ b/arch/arm/mach-s3c2440/mach-rx1950.c
@@ -822,5 +822,5 @@ MACHINE_START(RX1950, "HP iPAQ RX1950")
         .init_irq = s3c24xx_init_irq,
         .init_machine = rx1950_init_machine,
         .timer = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx3715.c b/arch/arm/mach-s3c2440/mach-rx3715.c
index 20103bafbd4b..56af35447598 100644
--- a/arch/arm/mach-s3c2440/mach-rx3715.c
+++ b/arch/arm/mach-s3c2440/mach-rx3715.c
@@ -213,5 +213,5 @@ MACHINE_START(RX3715, "IPAQ-RX3715")
         .init_irq       = rx3715_init_irq,
         .init_machine   = rx3715_init_machine,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-smdk2440.c b/arch/arm/mach-s3c2440/mach-smdk2440.c
index 1deb60d12a60..83a1036d7dcb 100644
--- a/arch/arm/mach-s3c2440/mach-smdk2440.c
+++ b/arch/arm/mach-s3c2440/mach-smdk2440.c
@@ -183,5 +183,5 @@ MACHINE_START(S3C2440, "SMDK2440")
         .map_io         = smdk2440_map_io,
         .init_machine   = smdk2440_machine_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/s3c2440.c b/arch/arm/mach-s3c2440/s3c2440.c
index 517623a09fc5..2b3dddb49af7 100644
--- a/arch/arm/mach-s3c2440/s3c2440.c
+++ b/arch/arm/mach-s3c2440/s3c2440.c
@@ -35,7 +35,6 @@
 #include <plat/cpu.h>
 #include <plat/s3c244x.h>
 #include <plat/pm.h>
-#include <plat/watchdog-reset.h>
 
 #include <plat/gpio-core.h>
 #include <plat/gpio-cfg.h>
@@ -74,15 +73,3 @@ void __init s3c2440_map_io(void)
         s3c24xx_gpiocfg_default.set_pull = s3c24xx_gpio_setpull_1up;
         s3c24xx_gpiocfg_default.get_pull = s3c24xx_gpio_getpull_1up;
 }
-
-void s3c2440_restart(char mode, const char *cmd)
-{
-        if (mode == 's') {
-                soft_restart(0);
-        }
-
-        arch_wdt_reset();
-
-        /* we'll take a jump through zero as a poor second */
-        soft_restart(0);
-}
diff --git a/arch/arm/mach-s3c2440/s3c244x.c b/arch/arm/mach-s3c2440/s3c244x.c
index 36bc60f61d0a..d15852f642b7 100644
--- a/arch/arm/mach-s3c2440/s3c244x.c
+++ b/arch/arm/mach-s3c2440/s3c244x.c
@@ -46,6 +46,7 @@
 #include <plat/pm.h>
 #include <plat/pll.h>
 #include <plat/nand-core.h>
+#include <plat/watchdog-reset.h>
 
 static struct map_desc s3c244x_iodesc[] __initdata = {
         IODESC_ENT(CLKPWR),
@@ -196,3 +197,14 @@ struct syscore_ops s3c244x_pm_syscore_ops = {
         .suspend        = s3c244x_suspend,
         .resume         = s3c244x_resume,
 };
+
+void s3c244x_restart(char mode, const char *cmd)
+{
+        if (mode == 's')
+                soft_restart(0);
+
+        arch_wdt_reset();
+
+        /* we'll take a jump through zero as a poor second */
+        soft_restart(0);
+}
diff --git a/arch/arm/mach-spear6xx/Kconfig b/arch/arm/mach-spear6xx/Kconfig
index ff4ae5ba00f1..fbe298bd1d92 100644
--- a/arch/arm/mach-spear6xx/Kconfig
+++ b/arch/arm/mach-spear6xx/Kconfig
@@ -5,11 +5,12 @@
 if ARCH_SPEAR6XX
 
 menu "SPEAr6xx Implementations"
-config BOARD_SPEAR600_EVB
-        bool "SPEAr600 Evaluation Board"
+config BOARD_SPEAR600_DT
+        bool "SPEAr600 generic board configured via device-tree"
         select MACH_SPEAR600
+        select USE_OF
         help
-          Supports ST SPEAr600 Evaluation Board
+          Supports ST SPEAr600 boards configured via the device-tree
 
 endmenu
 
diff --git a/arch/arm/mach-spear6xx/Makefile b/arch/arm/mach-spear6xx/Makefile
index cc1a4d82d459..76e5750552fc 100644
--- a/arch/arm/mach-spear6xx/Makefile
+++ b/arch/arm/mach-spear6xx/Makefile
@@ -4,9 +4,3 @@
 
 # common files
 obj-y   += clock.o spear6xx.o
-
-# spear600 specific files
-obj-$(CONFIG_MACH_SPEAR600) += spear600.o
-
-# spear600 boards files
-obj-$(CONFIG_BOARD_SPEAR600_EVB) += spear600_evb.o
diff --git a/arch/arm/mach-spear6xx/clock.c b/arch/arm/mach-spear6xx/clock.c
index ac70e0d88fef..358f2800f17b 100644
--- a/arch/arm/mach-spear6xx/clock.c
+++ b/arch/arm/mach-spear6xx/clock.c
@@ -641,8 +641,8 @@ static struct clk_lookup spear_clk_lookups[] = {
         { .con_id = "gpt0_synth_clk",   .clk = &gpt0_synth_clk},
         { .con_id = "gpt2_synth_clk",   .clk = &gpt2_synth_clk},
         { .con_id = "gpt3_synth_clk",   .clk = &gpt3_synth_clk},
-        { .dev_id = "uart0",            .clk = &uart0_clk},
-        { .dev_id = "uart1",            .clk = &uart1_clk},
+        { .dev_id = "d0000000.serial",  .clk = &uart0_clk},
+        { .dev_id = "d0080000.serial",  .clk = &uart1_clk},
         { .dev_id = "firda",            .clk = &firda_clk},
         { .dev_id = "clcd",             .clk = &clcd_clk},
         { .dev_id = "gpt0",             .clk = &gpt0_clk},
@@ -655,20 +655,20 @@ static struct clk_lookup spear_clk_lookups[] = {
         { .con_id = "usbh.1_clk",       .clk = &usbh1_clk},
         /* clock derived from ahb clk */
         { .con_id = "apb_clk",          .clk = &apb_clk},
-        { .dev_id = "i2c_designware.0", .clk = &i2c_clk},
+        { .dev_id = "d0200000.i2c",     .clk = &i2c_clk},
         { .dev_id = "dma",              .clk = &dma_clk},
         { .dev_id = "jpeg",             .clk = &jpeg_clk},
         { .dev_id = "gmac",             .clk = &gmac_clk},
         { .dev_id = "smi",              .clk = &smi_clk},
-        { .con_id = "fsmc",             .clk = &fsmc_clk},
+        { .dev_id = "fsmc-nand",        .clk = &fsmc_clk},
         /* clock derived from apb clk */
         { .dev_id = "adc",              .clk = &adc_clk},
         { .dev_id = "ssp-pl022.0",      .clk = &ssp0_clk},
         { .dev_id = "ssp-pl022.1",      .clk = &ssp1_clk},
         { .dev_id = "ssp-pl022.2",      .clk = &ssp2_clk},
-        { .dev_id = "gpio0",            .clk = &gpio0_clk},
-        { .dev_id = "gpio1",            .clk = &gpio1_clk},
-        { .dev_id = "gpio2",            .clk = &gpio2_clk},
+        { .dev_id = "f0100000.gpio",    .clk = &gpio0_clk},
+        { .dev_id = "fc980000.gpio",    .clk = &gpio1_clk},
+        { .dev_id = "d8100000.gpio",    .clk = &gpio2_clk},
 };
 
 void __init spear6xx_clk_init(void)
diff --git a/arch/arm/mach-spear6xx/spear600.c b/arch/arm/mach-spear6xx/spear600.c
deleted file mode 100644
index d0e6eeae9b04..000000000000
--- a/arch/arm/mach-spear6xx/spear600.c
+++ /dev/null
@@ -1,25 +0,0 @@
-/*
- * arch/arm/mach-spear6xx/spear600.c
- *
- * SPEAr600 machine source file
- *
- * Copyright (C) 2009 ST Microelectronics
- * Rajeev Kumar<rajeev-dlh.kumar@st.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2. This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-
-#include <linux/ptrace.h>
-#include <asm/irq.h>
-#include <mach/generic.h>
-#include <mach/hardware.h>
-
-/* Add spear600 specific devices here */
-
-void __init spear600_init(void)
-{
-        /* call spear6xx family common init function */
-        spear6xx_init();
-}
diff --git a/arch/arm/mach-spear6xx/spear600_evb.c b/arch/arm/mach-spear6xx/spear600_evb.c
deleted file mode 100644
index c6e4254741cc..000000000000
--- a/arch/arm/mach-spear6xx/spear600_evb.c
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * arch/arm/mach-spear6xx/spear600_evb.c
- *
- * SPEAr600 evaluation board source file
- *
- * Copyright (C) 2009 ST Microelectronics
- * Viresh Kumar<viresh.kumar@st.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2. This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
- */
-
-#include <asm/hardware/vic.h>
-#include <asm/mach/arch.h>
-#include <asm/mach-types.h>
-#include <mach/generic.h>
-#include <mach/hardware.h>
-
-static struct amba_device *amba_devs[] __initdata = {
-        &gpio_device[0],
-        &gpio_device[1],
-        &gpio_device[2],
-        &uart_device[0],
-        &uart_device[1],
-};
-
-static struct platform_device *plat_devs[] __initdata = {
-};
-
-static void __init spear600_evb_init(void)
-{
-        unsigned int i;
-
-        /* call spear600 machine init function */
-        spear600_init();
-
-        /* Add Platform Devices */
-        platform_add_devices(plat_devs, ARRAY_SIZE(plat_devs));
-
-        /* Add Amba Devices */
-        for (i = 0; i < ARRAY_SIZE(amba_devs); i++)
-                amba_device_register(amba_devs[i], &iomem_resource);
-}
-
-MACHINE_START(SPEAR600, "ST-SPEAR600-EVB")
-        .atag_offset    =       0x100,
-        .map_io         =       spear6xx_map_io,
-        .init_irq       =       spear6xx_init_irq,
-        .handle_irq     =       vic_handle_irq,
-        .timer          =       &spear6xx_timer,
-        .init_machine   =       spear600_evb_init,
-        .restart        =       spear_restart,
-MACHINE_END
diff --git a/arch/arm/mach-spear6xx/spear6xx.c b/arch/arm/mach-spear6xx/spear6xx.c
index b997b1b10ba0..2ed8b14c82c8 100644
--- a/arch/arm/mach-spear6xx/spear6xx.c
+++ b/arch/arm/mach-spear6xx/spear6xx.c
@@ -6,111 +6,21 @@
  * Copyright (C) 2009 ST Microelectronics
  * Rajeev Kumar<rajeev-dlh.kumar@st.com>
  *
+ * Copyright 2012 Stefan Roese <sr@denx.de>
+ *
  * This file is licensed under the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/types.h>
-#include <linux/amba/pl061.h>
-#include <linux/ptrace.h>
-#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
 #include <asm/hardware/vic.h>
-#include <asm/irq.h>
 #include <asm/mach/arch.h>
 #include <mach/generic.h>
 #include <mach/hardware.h>
-#include <mach/irqs.h>
-
-/* Add spear6xx machines common devices here */
-/* uart device registration */
-struct amba_device uart_device[] = {
-        {
-                .dev = {
-                        .init_name = "uart0",
-                },
-                .res = {
-                        .start = SPEAR6XX_ICM1_UART0_BASE,
-                        .end = SPEAR6XX_ICM1_UART0_BASE + SZ_4K - 1,
-                        .flags = IORESOURCE_MEM,
-                },
-                .irq = {IRQ_UART_0},
-        }, {
-                .dev = {
-                        .init_name = "uart1",
-                },
-                .res = {
-                        .start = SPEAR6XX_ICM1_UART1_BASE,
-                        .end = SPEAR6XX_ICM1_UART1_BASE + SZ_4K - 1,
-                        .flags = IORESOURCE_MEM,
-                },
-                .irq = {IRQ_UART_1},
-        }
-};
-
-/* gpio device registration */
-static struct pl061_platform_data gpio_plat_data[] = {
-        {
-                .gpio_base      = 0,
-                .irq_base       = SPEAR_GPIO0_INT_BASE,
-        }, {
-                .gpio_base      = 8,
-                .irq_base       = SPEAR_GPIO1_INT_BASE,
-        }, {
-                .gpio_base      = 16,
-                .irq_base       = SPEAR_GPIO2_INT_BASE,
-        },
-};
-
-struct amba_device gpio_device[] = {
-        {
-                .dev = {
-                        .init_name = "gpio0",
-                        .platform_data = &gpio_plat_data[0],
-                },
-                .res = {
-                        .start = SPEAR6XX_CPU_GPIO_BASE,
-                        .end = SPEAR6XX_CPU_GPIO_BASE + SZ_4K - 1,
-                        .flags = IORESOURCE_MEM,
-                },
-                .irq = {IRQ_LOCAL_GPIO},
-        }, {
-                .dev = {
-                        .init_name = "gpio1",
-                        .platform_data = &gpio_plat_data[1],
-                },
-                .res = {
-                        .start = SPEAR6XX_ICM3_GPIO_BASE,
-                        .end = SPEAR6XX_ICM3_GPIO_BASE + SZ_4K - 1,
-                        .flags = IORESOURCE_MEM,
-                },
-                .irq = {IRQ_BASIC_GPIO},
-        }, {
-                .dev = {
-                        .init_name = "gpio2",
-                        .platform_data = &gpio_plat_data[2],
-                },
-                .res = {
-                        .start = SPEAR6XX_ICM2_GPIO_BASE,
-                        .end = SPEAR6XX_ICM2_GPIO_BASE + SZ_4K - 1,
-                        .flags = IORESOURCE_MEM,
-                },
-                .irq = {IRQ_APPL_GPIO},
-        }
-};
-
-/* This will add devices, and do machine specific tasks */
-void __init spear6xx_init(void)
-{
-        /* nothing to do for now */
-}
-
-/* This will initialize vic */
-void __init spear6xx_init_irq(void)
-{
-        vic_init((void __iomem *)VA_SPEAR6XX_CPU_VIC_PRI_BASE, 0, ~0, 0);
-        vic_init((void __iomem *)VA_SPEAR6XX_CPU_VIC_SEC_BASE, 32, ~0, 0);
-}
 
 /* Following will create static virtual/physical mappings */
 static struct map_desc spear6xx_io_desc[] __initdata = {
@@ -181,3 +91,33 @@ static void __init spear6xx_timer_init(void)
 struct sys_timer spear6xx_timer = {
         .init = spear6xx_timer_init,
 };
+
+static void __init spear600_dt_init(void)
+{
+        of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL);
+}
+
+static const char *spear600_dt_board_compat[] = {
+        "st,spear600",
+        NULL
+};
+
+static const struct of_device_id vic_of_match[] __initconst = {
+        { .compatible = "arm,pl190-vic", .data = vic_of_init, },
+        { /* Sentinel */ }
+};
+
+static void __init spear6xx_dt_init_irq(void)
+{
+        of_irq_init(vic_of_match);
+}
+
+DT_MACHINE_START(SPEAR600_DT, "ST SPEAr600 (Flattened Device Tree)")
+        .map_io         =       spear6xx_map_io,
+        .init_irq       =       spear6xx_dt_init_irq,
+        .handle_irq     =       vic_handle_irq,
+        .timer          =       &spear6xx_timer,
+        .init_machine   =       spear600_dt_init,
+        .restart        =       spear_restart,
+        .dt_compat      =       spear600_dt_board_compat,
+MACHINE_END
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index afb3706bab2a..ea908c66aebd 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -5,7 +5,7 @@ config UX500_SOC_COMMON
         default y
         select ARM_GIC
         select HAS_MTU
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
         select ARM_ERRATA_754322
         select ARM_ERRATA_764369
 
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0404ccbb8aa3..f1c8486f7501 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -230,9 +230,7 @@ __v7_setup:
         mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
 #endif
 #ifdef CONFIG_ARM_ERRATA_743622
-        teq     r6, #0x20                       @ present in r2p0
-        teqne   r6, #0x21                       @ present in r2p1
-        teqne   r6, #0x22                       @ present in r2p2
+        teq     r5, #0x00200000                 @ only present in r2p*
         mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
         orreq   r10, r10, #1 << 6               @ set bit #6
         mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 2efd6454bce0..37bbbbb981b2 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -428,8 +428,16 @@
 #define OMAP_GPMC_NR_IRQS       8
 #define OMAP_GPMC_IRQ_END       (OMAP_GPMC_IRQ_BASE + OMAP_GPMC_NR_IRQS)
 
+/* PRCM IRQ handler */
+#ifdef CONFIG_ARCH_OMAP2PLUS
+#define OMAP_PRCM_IRQ_BASE      (OMAP_GPMC_IRQ_END)
+#define OMAP_PRCM_NR_IRQS       64
+#define OMAP_PRCM_IRQ_END       (OMAP_PRCM_IRQ_BASE + OMAP_PRCM_NR_IRQS)
+#else
+#define OMAP_PRCM_IRQ_END       OMAP_GPMC_IRQ_END
+#endif
 
-#define NR_IRQS                 OMAP_GPMC_IRQ_END
+#define NR_IRQS                 OMAP_PRCM_IRQ_END
 
 #define OMAP_IRQ_BIT(irq)       (1 << ((irq) % 32))
 
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index 9fe35348e03b..2bab4c99a234 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -1249,7 +1249,7 @@ static void s3c2410_dma_resume(void)
         struct s3c2410_dma_chan *cp = s3c2410_chans + dma_channels - 1;
         int channel;
 
-        for (channel = dma_channels - 1; channel >= 0; cp++, channel--)
+        for (channel = dma_channels - 1; channel >= 0; cp--, channel--)
                 s3c2410_dma_resume_chan(cp);
 }
 
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index f10768e988d4..d21d744e4d99 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -1409,7 +1409,7 @@ void __init s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd)
 
 #ifdef CONFIG_S3C_DEV_USB_HSOTG
 static struct resource s3c_usb_hsotg_resources[] = {
-        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_16K),
+        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_128K),
         [1] = DEFINE_RES_IRQ(IRQ_OTG),
 };
 
diff --git a/arch/arm/plat-spear/time.c b/arch/arm/plat-spear/time.c
index 0c77e4298675..abb5bdecd509 100644
--- a/arch/arm/plat-spear/time.c
+++ b/arch/arm/plat-spear/time.c
@@ -145,11 +145,13 @@ static void clockevent_set_mode(enum clock_event_mode mode,
 static int clockevent_next_event(unsigned long cycles,
                                  struct clock_event_device *clk_event_dev)
 {
-        u16 val;
+        u16 val = readw(gpt_base + CR(CLKEVT));
+
+        if (val & CTRL_ENABLE)
+                writew(val & ~CTRL_ENABLE, gpt_base + CR(CLKEVT));
 
         writew(cycles, gpt_base + LOAD(CLKEVT));
 
-        val = readw(gpt_base + CR(CLKEVT));
         val |= CTRL_ENABLE | CTRL_INT_ENABLE;
         writew(val, gpt_base + CR(CLKEVT));
 
diff --git a/arch/c6x/include/asm/processor.h b/arch/c6x/include/asm/processor.h
index 8154c4ee8c9c..77ecbded1f37 100644
--- a/arch/c6x/include/asm/processor.h
+++ b/arch/c6x/include/asm/processor.h
@@ -122,8 +122,8 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 
 extern unsigned long get_wchan(struct task_struct *p);
 
-#define KSTK_EIP(tsk)   (task_pt_regs(task)->pc)
-#define KSTK_ESP(tsk)   (task_pt_regs(task)->sp)
+#define KSTK_EIP(task)  (task_pt_regs(task)->pc)
+#define KSTK_ESP(task)  (task_pt_regs(task)->sp)
 
 #define cpu_relax()             do { } while (0)
 
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 7da4d0081487..a7193ae13a5d 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -146,7 +146,7 @@ static int __init alchemy_time_init(unsigned int m2int)
         cd->shift = 32;
         cd->mult = div_sc(32768, NSEC_PER_SEC, cd->shift);
         cd->max_delta_ns = clockevent_delta2ns(0xffffffff, cd);
-        cd->min_delta_ns = clockevent_delta2ns(8, cd);  /* ~0.25ms */
+        cd->min_delta_ns = clockevent_delta2ns(9, cd);  /* ~0.28ms */
         clockevents_register_device(cd);
         setup_irq(m2int, &au1x_rtcmatch2_irqaction);
 
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index 24f546985b69..e21507052066 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -96,7 +96,7 @@ void __init ath79_register_wmac(u8 *cal_data)
 {
         if (soc_is_ar913x())
                 ar913x_wmac_setup();
-        if (soc_is_ar933x())
+        else if (soc_is_ar933x())
                 ar933x_wmac_setup();
         else
                 BUG();
diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
index 4479fd669ac1..28c6b276c216 100644
--- a/arch/mips/configs/nlm_xlp_defconfig
+++ b/arch/mips/configs/nlm_xlp_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_SECCOMP is not set
 CONFIG_USE_OF=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_CGROUPS=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlp"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_LZMA=y
diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
index 7c68666fdd64..d0b857d98c91 100644
--- a/arch/mips/configs/nlm_xlr_defconfig
+++ b/arch/mips/configs/nlm_xlr_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_KEXEC=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_NAMESPACES=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlr"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
diff --git a/arch/mips/configs/powertv_defconfig b/arch/mips/configs/powertv_defconfig
index 3b0b6e8c8533..7fda0ce5f692 100644
--- a/arch/mips/configs/powertv_defconfig
+++ b/arch/mips/configs/powertv_defconfig
@@ -6,7 +6,7 @@ CONFIG_HZ_1000=y
 CONFIG_PREEMPT=y
 # CONFIG_SECCOMP is not set
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
diff --git a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
index 556e1be20bf6..fb9975c74c57 100644
--- a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
+++ b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
@@ -11,6 +11,9 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 
+struct gpio;
+struct gpio_chip;
+
 /* with the current GPIC design, up to 128 GPIOs are possible.
  * The only implementation so far is in the Au1300, which has 75 externally
  * available GPIOs.
@@ -203,7 +206,22 @@ static inline int gpio_request(unsigned int gpio, const char *label)
         return 0;
 }
 
-static inline void gpio_free(unsigned int gpio)
+static inline int gpio_request_one(unsigned gpio,
+                                        unsigned long flags, const char *label)
+{
+        return 0;
+}
+
+static inline int gpio_request_array(struct gpio *array, size_t num)
+{
+        return 0;
+}
+
+static inline void gpio_free(unsigned gpio)
+{
+}
+
+static inline void gpio_free_array(struct gpio *array, size_t num)
 {
 }
 
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index d41790928c64..da9bd7d270d1 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -39,9 +39,6 @@
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #else /* !CONFIG_HUGETLB_PAGE */
-# ifndef BUILD_BUG
-#  define BUILD_BUG() do { extern void __build_bug(void); __build_bug(); } while (0)
-# endif
 #define HPAGE_SHIFT     ({BUILD_BUG(); 0; })
 #define HPAGE_SIZE      ({BUILD_BUG(); 0; })
 #define HPAGE_MASK      ({BUILD_BUG(); 0; })
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 58fe71afd879..d5e950ab8527 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -8,7 +8,6 @@
  * SMP support for BMIPS
  */
 
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cc4a3f120f54..d79ae5437b58 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1135,7 +1135,7 @@ asmlinkage void do_mt(struct pt_regs *regs)
                 printk(KERN_DEBUG "YIELD Scheduler Exception\n");
                 break;
         case 5:
-                printk(KERN_DEBUG "Gating Storage Schedulier Exception\n");
+                printk(KERN_DEBUG "Gating Storage Scheduler Exception\n");
                 break;
         default:
                 printk(KERN_DEBUG "*** UNKNOWN THREAD EXCEPTION %d ***\n",
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index a81176f44c74..924da5eb7031 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -69,7 +69,6 @@ SECTIONS
         RODATA
 
         /* writeable */
-        _sdata = .;                             /* Start of data section */
         .data : {       /* Data */
                 . = . + DATAOFFSET;             /* for CONFIG_MAPPED_KERNEL */
 
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 937cf3368164..69ebd586d7ff 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -42,6 +42,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         const int field = sizeof(unsigned long) * 2;
         siginfo_t info;
         int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                                                 (write ? FAULT_FLAG_WRITE : 0);
 
 #if 0
         printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
@@ -91,6 +93,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         if (in_atomic() || !mm)
                 goto bad_area_nosemaphore;
 
+retry:
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (!vma)
@@ -144,7 +147,11 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.
          */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
@@ -153,12 +160,27 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
-                tsk->maj_flt++;
-        } else {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
-                tsk->min_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR) {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
+                                                  regs, address);
+                        tsk->maj_flt++;
+                } else {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                                  regs, address);
+                        tsk->min_flt++;
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /*
+                         * No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
         }
 
         up_read(&mm->mmap_sem);
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index aec2b111d35b..15521505ebe8 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -279,7 +279,6 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
         /* Propagate hose info into the subordinate devices.  */
 
-        struct list_head *ln;
         struct pci_dev *dev = bus->self;
 
         if (pci_probe_only && dev &&
@@ -288,9 +287,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
                 pcibios_fixup_device_resources(dev, bus);
         }
 
-        for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
-                dev = pci_dev_b(ln);
-
+        list_for_each_entry(dev, &bus->devices, bus_list) {
                 if ((dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
                         pcibios_fixup_device_resources(dev, bus);
         }
diff --git a/arch/mips/pmc-sierra/yosemite/ht-irq.c b/arch/mips/pmc-sierra/yosemite/ht-irq.c
index 86b98e98fb4f..62ead6601c69 100644
--- a/arch/mips/pmc-sierra/yosemite/ht-irq.c
+++ b/arch/mips/pmc-sierra/yosemite/ht-irq.c
@@ -35,16 +35,6 @@
  */
 void __init titan_ht_pcibios_fixup_bus(struct pci_bus *bus)
 {
-        struct pci_bus *current_bus = bus;
-        struct pci_dev *devices;
-        struct list_head *devices_link;
-
-        list_for_each(devices_link, &(current_bus->devices)) {
-                devices = pci_dev_b(devices_link);
-                if (devices == NULL)
-                        continue;
-        }
-
         /*
          * PLX and SPKT related changes go here
          */
diff --git a/arch/mips/txx9/generic/7segled.c b/arch/mips/txx9/generic/7segled.c
index 8e93b2122524..4642f56e70e5 100644
--- a/arch/mips/txx9/generic/7segled.c
+++ b/arch/mips/txx9/generic/7segled.c
@@ -102,7 +102,7 @@ static int __init tx_7segled_init_sysfs(void)
                         break;
                 }
                 dev->id = i;
-                dev->dev = &tx_7segled_subsys;
+                dev->bus = &tx_7segled_subsys;
                 error = device_register(dev);
                 if (!error) {
                         device_create_file(dev, &dev_attr_ascii);
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index fd843877e841..39e49091f648 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -315,6 +315,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         current->mm->free_area_cache = TASK_UNMAPPED_BASE;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -410,13 +417,6 @@ beyond_if:
 
         set_brk(current->mm->start_brk, current->mm->brk);
 
-        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) {
-                /* Someone check-me: is this error path enough? */
-                send_sig(SIGKILL, current, 0);
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
         /* start thread */
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index fc45ba887d05..e395693abdb1 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
 }
 
 /* TSC based delay: */
-static void delay_tsc(unsigned long loops)
+static void delay_tsc(unsigned long __loops)
 {
-        unsigned long bclock, now;
+        u32 bclock, now, loops = __loops;
         int cpu;
 
         preempt_disable();
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index f581a18c0d4d..8ecbb4bba4b3 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -333,13 +333,15 @@ try_again:
                  * Lookup failure means no vma is above this address,
                  * i.e. return with success:
                  */
-                if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
+                vma = find_vma(mm, addr);
+                if (!vma)
                         return addr;
 
                 /*
                  * new region fits between prev_vma->vm_end and
                  * vma->vm_start, use it:
                  */
+                prev_vma = vma->vm_prev;
                 if (addr + len <= vma->vm_start &&
                             (!prev_vma || (addr >= prev_vma->vm_end))) {
                         /* remember the address as a hint for next time */
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index a312e76063a7..49a5cb55429b 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -60,6 +60,16 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                         DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
                 },
         },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=42619 */
+        {
+                .callback = set_use_crs,
+                .ident = "MSI MS-7253",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-7253"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                },
+        },
 
         /* Now for the blacklist.. */
 
@@ -282,9 +292,6 @@ static void add_resources(struct pci_root_info *info)
         int i;
         struct resource *res, *root, *conflict;
 
-        if (!pci_use_crs)
-                return;
-
         coalesce_windows(info, IORESOURCE_MEM);
         coalesce_windows(info, IORESOURCE_IO);
 
@@ -336,8 +343,13 @@ get_current_resources(struct acpi_device *device, int busnum,
         acpi_walk_resources(device->handle, METHOD_NAME__CRS, setup_resource,
                                 &info);
 
-        add_resources(&info);
-        return;
+        if (pci_use_crs) {
+                add_resources(&info);
+
+                return;
+        }
+
+        kfree(info.name);
 
 name_alloc_fail:
         kfree(info.res);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9baf11e86362..744f078f4dd8 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3832,7 +3832,7 @@ static int __floppy_read_block_0(struct block_device *bdev)
         bio.bi_size = size;
         bio.bi_bdev = bdev;
         bio.bi_sector = 0;
-        bio.bi_flags = BIO_QUIET;
+        bio.bi_flags = (1 << BIO_QUIET);
         init_completion(&complete);
         bio.bi_private = &complete;
         bio.bi_end_io = floppy_rb0_complete;
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 4a5b099c3bc5..53404af2e748 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,6 +321,8 @@ static int cdv_chip_setup(struct drm_device *dev)
         cdv_get_core_freq(dev);
         gma_intel_opregion_init(dev);
         psb_intel_init_bios(dev);
+        REG_WRITE(PORT_HOTPLUG_EN, 0);
+        REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
         return 0;
 }
 
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 830dfdd6bf15..be616735ec91 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,7 +247,6 @@ static struct fb_ops psbfb_roll_ops = {
         .fb_imageblit = cfb_imageblit,
         .fb_pan_display = psbfb_pan,
         .fb_mmap = psbfb_mmap,
-        .fb_sync = psbfb_sync,
         .fb_ioctl = psbfb_ioctl,
 };
 
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 5d5330f667f1..aff194fbe9f3 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -446,10 +446,9 @@ int psb_gtt_init(struct drm_device *dev, int resume)
         pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
         gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
                                                                 >> PAGE_SHIFT;
-        /* Some CDV firmware doesn't report this currently. In which case the
-           system has 64 gtt pages */
+        /* CDV doesn't report this. In which case the system has 64 gtt pages */
         if (pg->gtt_start == 0 || gtt_pages == 0) {
-                dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
                 gtt_pages = 64;
                 pg->gtt_start = dev_priv->pge_ctl;
         }
@@ -461,10 +460,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 
         if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
                 static struct resource fudge;   /* Preferably peppermint */
-                /* This can occur on CDV SDV systems. Fudge it in this case.
+                /* This can occur on CDV systems. Fudge it in this case.
                    We really don't care what imaginary space is being allocated
                    at this point */
-                dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
                 pg->gatt_start = 0x40000000;
                 pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
                 /* This is a little confusing but in fact the GTT is providing
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index fbcd84803b60..17ca72ce3027 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2362,6 +2362,9 @@ void r600_semaphore_ring_emit(struct radeon_device *rdev,
         uint64_t addr = semaphore->gpu_addr;
         unsigned sel = emit_wait ? PACKET3_SEM_SEL_WAIT : PACKET3_SEM_SEL_SIGNAL;
 
+        if (rdev->family < CHIP_CAYMAN)
+                sel |= PACKET3_SEM_WAIT_ON_SIGNAL;
+
         radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
         radeon_ring_write(ring, addr & 0xffffffff);
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.c b/drivers/gpu/drm/radeon/r600_blit_shaders.c
index 2d1f6c5ee2a7..73e2c7c6edbc 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.c
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.c
@@ -314,6 +314,10 @@ const u32 r6xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
@@ -626,6 +630,10 @@ const u32 r7xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 3ee1fd7ef394..9b23670716f1 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -831,6 +831,7 @@
 #define PACKET3_STRMOUT_BUFFER_UPDATE                   0x34
 #define PACKET3_INDIRECT_BUFFER_MP                      0x38
 #define PACKET3_MEM_SEMAPHORE                           0x39
+#              define PACKET3_SEM_WAIT_ON_SIGNAL    (0x1 << 12)
 #              define PACKET3_SEM_SEL_SIGNAL        (0x6 << 29)
 #              define PACKET3_SEM_SEL_WAIT          (0x7 << 29)
 #define PACKET3_MPEG_INDEX                              0x3A
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 8b3d8ed52ff6..8c9a8115b632 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1057,7 +1057,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
                     (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
                         return MODE_OK;
                 else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
-                        if (ASIC_IS_DCE3(rdev)) {
+                        if (0) {
                                 /* HDMI 1.3+ supports max clock of 340 Mhz */
                                 if (mode->clock > 340000)
                                         return MODE_CLOCK_HIGH;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8c49fef1ce78..3d314338d843 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1078,15 +1078,21 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
         .create_handle = radeon_user_framebuffer_create_handle,
 };
 
-void
+int
 radeon_framebuffer_init(struct drm_device *dev,
                         struct radeon_framebuffer *rfb,
                         struct drm_mode_fb_cmd2 *mode_cmd,
                         struct drm_gem_object *obj)
 {
+        int ret;
         rfb->obj = obj;
-        drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        ret = drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        if (ret) {
+                rfb->obj = NULL;
+                return ret;
+        }
         drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
+        return 0;
 }
 
 static struct drm_framebuffer *
@@ -1096,6 +1102,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
 {
         struct drm_gem_object *obj;
         struct radeon_framebuffer *radeon_fb;
+        int ret;
 
         obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
         if (obj ==  NULL) {
@@ -1108,7 +1115,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
         if (radeon_fb == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        if (ret) {
+                kfree(radeon_fb);
+                drm_gem_object_unreference_unlocked(obj);
+                return NULL;
+        }
 
         return &radeon_fb->base;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9419c51bcf50..26e92708d114 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -307,8 +307,6 @@ void radeon_panel_mode_fixup(struct drm_encoder *encoder,
 bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                                     u32 pixel_clock)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector;
         struct radeon_connector_atom_dig *dig_connector;
@@ -326,7 +324,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
         case DRM_MODE_CONNECTOR_HDMIB:
                 if (radeon_connector->use_digital) {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
@@ -348,7 +346,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                         return false;
                 else {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cf2bf35b56b8..195471cf65d3 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -209,6 +209,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
                                                           sizes->surface_depth);
 
         ret = radeonfb_create_pinned_object(rfbdev, &mode_cmd, &gobj);
+        if (ret) {
+                DRM_ERROR("failed to create fbcon object %d\n", ret);
+                return ret;
+        }
+
         rbo = gem_to_radeon_bo(gobj);
 
         /* okay we have an object now allocate the framebuffer */
@@ -220,7 +225,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
 
         info->par = rfbdev;
 
-        radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        if (ret) {
+                DRM_ERROR("failed to initalise framebuffer %d\n", ret);
+                goto out_unref;
+        }
 
         fb = &rfbdev->rfb.base;
 
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 4330e3253573..8a85598fb242 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -649,7 +649,7 @@ extern void radeon_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                      u16 blue, int regno);
 extern void radeon_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
                                      u16 *blue, int regno);
-void radeon_framebuffer_init(struct drm_device *dev,
+int radeon_framebuffer_init(struct drm_device *dev,
                              struct radeon_framebuffer *rfb,
                              struct drm_mode_fb_cmd2 *mode_cmd,
                              struct drm_gem_object *obj);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b8574cddd953..63552e30d0c3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -59,6 +59,9 @@
 #define USB_VENDOR_ID_AIRCABLE          0x16CA
 #define USB_DEVICE_ID_AIRCABLE1         0x1502
 
+#define USB_VENDOR_ID_AIREN             0x1a2c
+#define USB_DEVICE_ID_AIREN_SLIMPLUS    0x0002
+
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
 
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+        /*
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                 dbg_hid("Ignoring out-of-range value %x\n", value);
                 return;
         }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index c831af937481..57d4e1e1df48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -54,6 +54,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
 
+        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 02260406b9e4..dad895fec62a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -497,8 +497,9 @@ config SENSORS_JC42
           If you say yes here, you get support for JEDEC JC42.4 compliant
           temperature sensors, which are used on many DDR3 memory modules for
           mobile devices and servers.  Support will include, but not be limited
-          to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
-          MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+          to, ADT7408, AT30TS00, CAT34TS02, CAT6095, MAX6604, MCP9804, MCP9805,
+          MCP98242, MCP98243, MCP9843, SE97, SE98, STTS424(E), STTS2002,
+          STTS3000, TSE2002B3, TSE2002GB2, TS3000B3, and TS3000GB2.
 
           This driver can also be built as a module.  If so, the module
           will be called jc42.
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index 28c09eead36b..b927ee5ccdd7 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -64,6 +64,7 @@ static const unsigned short normal_i2c[] = {
 
 /* Manufacturer IDs */
 #define ADT_MANID               0x11d4  /* Analog Devices */
+#define ATMEL_MANID             0x001f  /* Atmel */
 #define MAX_MANID               0x004d  /* Maxim */
 #define IDT_MANID               0x00b3  /* IDT */
 #define MCP_MANID               0x0054  /* Microchip */
@@ -77,15 +78,25 @@ static const unsigned short normal_i2c[] = {
 #define ADT7408_DEVID           0x0801
 #define ADT7408_DEVID_MASK      0xffff
 
+/* Atmel */
+#define AT30TS00_DEVID          0x8201
+#define AT30TS00_DEVID_MASK     0xffff
+
 /* IDT */
 #define TS3000B3_DEVID          0x2903  /* Also matches TSE2002B3 */
 #define TS3000B3_DEVID_MASK     0xffff
 
+#define TS3000GB2_DEVID         0x2912  /* Also matches TSE2002GB2 */
+#define TS3000GB2_DEVID_MASK    0xffff
+
 /* Maxim */
 #define MAX6604_DEVID           0x3e00
 #define MAX6604_DEVID_MASK      0xffff
 
 /* Microchip */
+#define MCP9804_DEVID           0x0200
+#define MCP9804_DEVID_MASK      0xfffc
+
 #define MCP98242_DEVID          0x2000
 #define MCP98242_DEVID_MASK     0xfffc
 
@@ -113,6 +124,12 @@ static const unsigned short normal_i2c[] = {
 #define STTS424E_DEVID          0x0000
 #define STTS424E_DEVID_MASK     0xfffe
 
+#define STTS2002_DEVID          0x0300
+#define STTS2002_DEVID_MASK     0xffff
+
+#define STTS3000_DEVID          0x0200
+#define STTS3000_DEVID_MASK     0xffff
+
 static u16 jc42_hysteresis[] = { 0, 1500, 3000, 6000 };
 
 struct jc42_chips {
@@ -123,8 +140,11 @@ struct jc42_chips {
 
 static struct jc42_chips jc42_chips[] = {
         { ADT_MANID, ADT7408_DEVID, ADT7408_DEVID_MASK },
+        { ATMEL_MANID, AT30TS00_DEVID, AT30TS00_DEVID_MASK },
         { IDT_MANID, TS3000B3_DEVID, TS3000B3_DEVID_MASK },
+        { IDT_MANID, TS3000GB2_DEVID, TS3000GB2_DEVID_MASK },
         { MAX_MANID, MAX6604_DEVID, MAX6604_DEVID_MASK },
+        { MCP_MANID, MCP9804_DEVID, MCP9804_DEVID_MASK },
         { MCP_MANID, MCP98242_DEVID, MCP98242_DEVID_MASK },
         { MCP_MANID, MCP98243_DEVID, MCP98243_DEVID_MASK },
         { MCP_MANID, MCP9843_DEVID, MCP9843_DEVID_MASK },
@@ -133,6 +153,8 @@ static struct jc42_chips jc42_chips[] = {
         { NXP_MANID, SE98_DEVID, SE98_DEVID_MASK },
         { STM_MANID, STTS424_DEVID, STTS424_DEVID_MASK },
         { STM_MANID, STTS424E_DEVID, STTS424E_DEVID_MASK },
+        { STM_MANID, STTS2002_DEVID, STTS2002_DEVID_MASK },
+        { STM_MANID, STTS3000_DEVID, STTS3000_DEVID_MASK },
 };
 
 /* Each client has this additional data */
@@ -159,10 +181,12 @@ static struct jc42_data *jc42_update_device(struct device *dev);
 
 static const struct i2c_device_id jc42_id[] = {
         { "adt7408", 0 },
+        { "at30ts00", 0 },
         { "cat94ts02", 0 },
         { "cat6095", 0 },
         { "jc42", 0 },
         { "max6604", 0 },
+        { "mcp9804", 0 },
         { "mcp9805", 0 },
         { "mcp98242", 0 },
         { "mcp98243", 0 },
@@ -171,8 +195,10 @@ static const struct i2c_device_id jc42_id[] = {
         { "se97b", 0 },
         { "se98", 0 },
         { "stts424", 0 },
-        { "tse2002b3", 0 },
-        { "ts3000b3", 0 },
+        { "stts2002", 0 },
+        { "stts3000", 0 },
+        { "tse2002", 0 },
+        { "ts3000", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, jc42_id);
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 00460d8d8423..d89b33967a85 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -54,7 +54,8 @@
                                                    lcrit_alarm, crit_alarm */
 #define PMBUS_IOUT_BOOLEANS_PER_PAGE    3       /* alarm, lcrit_alarm,
                                                    crit_alarm */
-#define PMBUS_POUT_BOOLEANS_PER_PAGE    2       /* alarm, crit_alarm */
+#define PMBUS_POUT_BOOLEANS_PER_PAGE    3       /* cap_alarm, alarm, crit_alarm
+                                                 */
 #define PMBUS_MAX_BOOLEANS_PER_FAN      2       /* alarm, fault */
 #define PMBUS_MAX_BOOLEANS_PER_TEMP     4       /* min_alarm, max_alarm,
                                                    lcrit_alarm, crit_alarm */
diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index 48c7b4a716ae..880b90cf4d32 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -33,6 +33,7 @@ enum chips { zl2004, zl2005, zl2006, zl2008, zl2105, zl2106, zl6100, zl6105 };
 struct zl6100_data {
         int id;
         ktime_t access;         /* chip access time */
+        int delay;              /* Delay between chip accesses in uS */
         struct pmbus_driver_info info;
 };
 
@@ -52,10 +53,10 @@ MODULE_PARM_DESC(delay, "Delay between chip accesses in uS");
 /* Some chips need a delay between accesses */
 static inline void zl6100_wait(const struct zl6100_data *data)
 {
-        if (delay) {
+        if (data->delay) {
                 s64 delta = ktime_us_delta(ktime_get(), data->access);
-                if (delta < delay)
-                        udelay(delay - delta);
+                if (delta < data->delay)
+                        udelay(data->delay - delta);
         }
 }
 
@@ -207,8 +208,9 @@ static int zl6100_probe(struct i2c_client *client,
          * can be cleared later for additional chips if tests show that it
          * is not needed (in other words, better be safe than sorry).
          */
+        data->delay = delay;
         if (data->id == zl2004 || data->id == zl6105)
-                delay = 0;
+                data->delay = 0;
 
         /*
          * Since there was a direct I2C device access above, wait before
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index afc166fcc3d9..7df5bfef2624 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -332,7 +332,7 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
         struct input_event event;
-        int retval;
+        int retval = 0;
 
         if (count < input_event_size())
                 return -EINVAL;
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index 37651373a95b..f3bc4189a7ba 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -172,7 +172,7 @@ static void twl4030_vibra_close(struct input_dev *input)
 }
 
 /*** Module ***/
-#if CONFIG_PM
+#if CONFIG_PM_SLEEP
 static int twl4030_vibra_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -189,10 +189,10 @@ static int twl4030_vibra_resume(struct device *dev)
         vibra_disable_leds();
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
                          twl4030_vibra_suspend, twl4030_vibra_resume);
-#endif
 
 static int __devinit twl4030_vibra_probe(struct platform_device *pdev)
 {
@@ -273,9 +273,7 @@ static struct platform_driver twl4030_vibra_driver = {
         .driver         = {
                 .name   = "twl4030-vibra",
                 .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm     = &twl4030_vibra_pm_ops,
-#endif
         },
 };
 module_platform_driver(twl4030_vibra_driver);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index bd87380bd879..4c6a72d3d48c 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -952,7 +952,9 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
 
         /*
          * First try "E6 report".
-         * ALPS should return 0,0,10 or 0,0,100
+         * ALPS should return 0,0,10 or 0,0,100 if no buttons are pressed.
+         * The bits 0-2 of the first byte will be 1s if some buttons are
+         * pressed.
          */
         param[0] = 0;
         if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES) ||
@@ -968,7 +970,8 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
         psmouse_dbg(psmouse, "E6 report: %2.2x %2.2x %2.2x",
                     param[0], param[1], param[2]);
 
-        if (param[0] != 0 || param[1] != 0 || (param[2] != 10 && param[2] != 100))
+        if ((param[0] & 0xf8) != 0 || param[1] != 0 ||
+            (param[2] != 10 && param[2] != 100))
                 return NULL;
 
         /*
diff --git a/drivers/input/tablet/Kconfig b/drivers/input/tablet/Kconfig
index 58a87755b936..e53f4081a586 100644
--- a/drivers/input/tablet/Kconfig
+++ b/drivers/input/tablet/Kconfig
@@ -77,6 +77,8 @@ config TABLET_USB_WACOM
         tristate "Wacom Intuos/Graphire tablet support (USB)"
         depends on USB_ARCH_HAS_HCD
         select USB
+        select NEW_LEDS
+        select LEDS_CLASS
         help
           Say Y here if you want to use the USB version of the Wacom Intuos
           or Graphire tablet.  Make sure to say Y to "Mouse support"
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 88672ec296c1..cd3ed29e0801 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -926,7 +926,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
 {
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
-        int count = data[1] & 0x03;
+        int count = data[1] & 0x07;
         int i;
 
         if (data[0] != 0x02)
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bdea288dc185..a35e98ad9725 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -275,7 +275,7 @@ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 }
 
 /* Programs the physical address of the device table into the IOMMU hardware */
-static void __init iommu_set_device_table(struct amd_iommu *iommu)
+static void iommu_set_device_table(struct amd_iommu *iommu)
 {
         u64 entry;
 
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 9fb18c147825..b280c433e4a0 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -323,7 +323,7 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio,
          * Corrupt successful READs while in down state.
          * If flags were specified, only corrupt those that match.
          */
-        if (!error && bio_submitted_while_down &&
+        if (fc->corrupt_bio_byte && !error && bio_submitted_while_down &&
             (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
             all_corrupt_bio_flags_match(bio, fc))
                 corrupt_bio_data(bio, fc);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ad2eba40e319..ea5dd289fe2a 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -296,6 +296,8 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
         unsigned offset;
         unsigned num_bvecs;
         sector_t remaining = where->count;
+        struct request_queue *q = bdev_get_queue(where->bdev);
+        sector_t discard_sectors;
 
         /*
          * where->count may be zero if rw holds a flush and we need to
@@ -305,9 +307,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 /*
                  * Allocate a suitably sized-bio.
                  */
-                num_bvecs = dm_sector_div_up(remaining,
-                                             (PAGE_SIZE >> SECTOR_SHIFT));
-                num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
+                if (rw & REQ_DISCARD)
+                        num_bvecs = 1;
+                else
+                        num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev),
+                                          dm_sector_div_up(remaining, (PAGE_SIZE >> SECTOR_SHIFT)));
+
                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                 bio->bi_sector = where->sector + (where->count - remaining);
                 bio->bi_bdev = where->bdev;
@@ -315,10 +320,14 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 bio->bi_destructor = dm_bio_destructor;
                 store_io_and_region_in_bio(bio, io, region);
 
-                /*
-                 * Try and add as many pages as possible.
-                 */
-                while (remaining) {
+                if (rw & REQ_DISCARD) {
+                        discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        bio->bi_size = discard_sectors << SECTOR_SHIFT;
+                        remaining -= discard_sectors;
+                } else while (remaining) {
+                        /*
+                         * Try and add as many pages as possible.
+                         */
                         dp->get_page(dp, &page, &len, &offset);
                         len = min(len, to_bytes(remaining));
                         if (!bio_add_page(bio, page, len, offset))
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 31c2dc25886d..1ce84ed0b765 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1437,7 +1437,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 
         if (!argc) {
                 DMWARN("Empty message received.");
-                goto out;
+                goto out_argv;
         }
 
         table = dm_get_live_table(md);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 86cb7e5d83d5..787022c18187 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -668,7 +668,14 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
                 return ret;
 
         sb = page_address(rdev->sb_page);
-        if (sb->magic != cpu_to_le32(DM_RAID_MAGIC)) {
+
+        /*
+         * Two cases that we want to write new superblocks and rebuild:
+         * 1) New device (no matching magic number)
+         * 2) Device specified for rebuild (!In_sync w/ offset == 0)
+         */
+        if ((sb->magic != cpu_to_le32(DM_RAID_MAGIC)) ||
+            (!test_bit(In_sync, &rdev->flags) && !rdev->recovery_offset)) {
                 super_sync(rdev->mddev, rdev);
 
                 set_bit(FirstUse, &rdev->flags);
@@ -745,11 +752,8 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
          */
         rdev_for_each(r, t, mddev) {
                 if (!test_bit(In_sync, &r->flags)) {
-                        if (!test_bit(FirstUse, &r->flags))
-                                DMERR("Superblock area of "
-                                      "rebuild device %d should have been "
-                                      "cleared.", r->raid_disk);
-                        set_bit(FirstUse, &r->flags);
+                        DMINFO("Device %d specified for rebuild: "
+                               "Clearing superblock", r->raid_disk);
                         rebuilds++;
                 } else if (test_bit(FirstUse, &r->flags))
                         new_devs++;
@@ -971,6 +975,7 @@ static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         INIT_WORK(&rs->md.event_work, do_table_event);
         ti->private = rs;
+        ti->num_flush_requests = 1;
 
         mutex_lock(&rs->md.reconfig_mutex);
         ret = md_run(&rs->md);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 59c4f0446ffa..237571af77fd 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -385,6 +385,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
                 data_sm = dm_sm_disk_create(tm, nr_blocks);
                 if (IS_ERR(data_sm)) {
                         DMERR("sm_disk_create failed");
+                        dm_tm_unlock(tm, sblock);
                         r = PTR_ERR(data_sm);
                         goto bad;
                 }
@@ -789,6 +790,11 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
         return 0;
 }
 
+/*
+ * __open_device: Returns @td corresponding to device with id @dev,
+ * creating it if @create is set and incrementing @td->open_count.
+ * On failure, @td is undefined.
+ */
 static int __open_device(struct dm_pool_metadata *pmd,
                          dm_thin_id dev, int create,
                          struct dm_thin_device **td)
@@ -799,10 +805,16 @@ static int __open_device(struct dm_pool_metadata *pmd,
         struct disk_device_details details_le;
 
         /*
-         * Check the device isn't already open.
+         * If the device is already open, return it.
          */
         list_for_each_entry(td2, &pmd->thin_devices, list)
                 if (td2->id == dev) {
+                        /*
+                         * May not create an already-open device.
+                         */
+                        if (create)
+                                return -EEXIST;
+
                         td2->open_count++;
                         *td = td2;
                         return 0;
@@ -817,6 +829,9 @@ static int __open_device(struct dm_pool_metadata *pmd,
                 if (r != -ENODATA || !create)
                         return r;
 
+                /*
+                 * Create new device.
+                 */
                 changed = 1;
                 details_le.mapped_blocks = 0;
                 details_le.transaction_id = cpu_to_le64(pmd->trans_id);
@@ -882,12 +897,10 @@ static int __create_thin(struct dm_pool_metadata *pmd,
 
         r = __open_device(pmd, dev, 1, &td);
         if (r) {
-                __close_device(td);
                 dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
                 dm_btree_del(&pmd->bl_info, dev_root);
                 return r;
         }
-        td->changed = 1;
         __close_device(td);
 
         return r;
@@ -967,14 +980,14 @@ static int __create_snap(struct dm_pool_metadata *pmd,
                 goto bad;
 
         r = __set_snapshot_details(pmd, td, origin, pmd->time);
+        __close_device(td);
+
         if (r)
                 goto bad;
 
-        __close_device(td);
         return 0;
 
 bad:
-        __close_device(td);
         dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
         dm_btree_remove(&pmd->details_info, pmd->details_root,
                         &key, &pmd->details_root);
@@ -1211,6 +1224,8 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
         if (r)
                 return r;
 
+        td->mapped_blocks--;
+        td->changed = 1;
         pmd->need_commit = 1;
 
         return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a368db2431a5..a0b225eb4ac4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -624,7 +624,7 @@ int md_raid1_congested(struct mddev *mddev, int bits)
                 return 1;
 
         rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks * 2; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags)) {
                         struct request_queue *q = bdev_get_queue(rdev->bdev);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6e8aa213f0d5..58c44d6453a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -67,6 +67,7 @@ static int max_queued_requests = 1024;
 
 static void allow_barrier(struct r10conf *conf);
 static void lower_barrier(struct r10conf *conf);
+static int enough(struct r10conf *conf, int ignore);
 
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -347,6 +348,19 @@ static void raid10_end_read_request(struct bio *bio, int error)
                  * wait for the 'master' bio.
                  */
                 set_bit(R10BIO_Uptodate, &r10_bio->state);
+        } else {
+                /* If all other devices that store this block have
+                 * failed, we want to return the error upwards rather
+                 * than fail the last device.  Here we redefine
+                 * "uptodate" to mean "Don't want to retry"
+                 */
+                unsigned long flags;
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (!enough(conf, rdev->raid_disk))
+                        uptodate = 1;
+                spin_unlock_irqrestore(&conf->device_lock, flags);
+        }
+        if (uptodate) {
                 raid_end_bio_io(r10_bio);
                 rdev_dec_pending(rdev, conf->mddev);
         } else {
@@ -2052,6 +2066,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        "md/raid10:%s: %s: Failing raid device\n",
                        mdname(mddev), b);
                 md_error(mddev, conf->mirrors[d].rdev);
+                r10_bio->devs[r10_bio->read_slot].bio = IO_BLOCKED;
                 return;
         }
 
@@ -2105,8 +2120,11 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                                     rdev,
                                     r10_bio->devs[r10_bio->read_slot].addr
                                     + sect,
-                                    s, 0))
+                                    s, 0)) {
                                 md_error(mddev, rdev);
+                                r10_bio->devs[r10_bio->read_slot].bio
+                                        = IO_BLOCKED;
+                        }
                         break;
                 }
 
@@ -2299,17 +2317,20 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
          * This is all done synchronously while the array is
          * frozen.
          */
+        bio = r10_bio->devs[slot].bio;
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r10_bio->devs[slot].bio = NULL;
+
         if (mddev->ro == 0) {
                 freeze_array(conf);
                 fix_read_error(conf, mddev, r10_bio);
                 unfreeze_array(conf);
-        }
+        } else
+                r10_bio->devs[slot].bio = IO_BLOCKED;
+
         rdev_dec_pending(rdev, mddev);
 
-        bio = r10_bio->devs[slot].bio;
-        bdevname(bio->bi_bdev, b);
-        r10_bio->devs[slot].bio =
-                mddev->ro ? IO_BLOCKED : NULL;
 read_more:
         rdev = read_balance(conf, r10_bio, &max_sectors);
         if (rdev == NULL) {
@@ -2318,13 +2339,10 @@ read_more:
                        mdname(mddev), b,
                        (unsigned long long)r10_bio->sector);
                 raid_end_bio_io(r10_bio);
-                bio_put(bio);
                 return;
         }
 
         do_sync = (r10_bio->master_bio->bi_rw & REQ_SYNC);
-        if (bio)
-                bio_put(bio);
         slot = r10_bio->read_slot;
         printk_ratelimited(
                 KERN_ERR
@@ -2360,7 +2378,6 @@ read_more:
                         mbio->bi_phys_segments++;
                 spin_unlock_irq(&conf->device_lock);
                 generic_make_request(bio);
-                bio = NULL;
 
                 r10_bio = mempool_alloc(conf->r10bio_pool,
                                         GFP_NOIO);
@@ -3243,7 +3260,6 @@ static int run(struct mddev *mddev)
                         disk->rdev = rdev;
                 }
 
-                disk->rdev = rdev;
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 53e2a80f42fa..d295941c9a3d 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -956,11 +956,12 @@ int __devinit ab8500_init(struct ab8500 *ab8500)
         return ret;
 
 out_freeirq:
-        if (ab8500->irq_base) {
+        if (ab8500->irq_base)
                 free_irq(ab8500->irq, ab8500);
 out_removeirq:
+        if (ab8500->irq_base)
                 ab8500_irq_remove(ab8500);
-        }
+
         return ret;
 }
 
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0f5922812bff..411f523d4878 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -123,7 +123,7 @@ static int mfd_add_device(struct device *parent, int id,
                 }
 
                 if (!cell->ignore_resource_conflicts) {
-                        ret = acpi_check_resource_conflict(res);
+                        ret = acpi_check_resource_conflict(&res[r]);
                         if (ret)
                                 goto fail_res;
                 }
diff --git a/drivers/mfd/s5m-core.c b/drivers/mfd/s5m-core.c
index e075c113eec6..caadabeed8e9 100644
--- a/drivers/mfd/s5m-core.c
+++ b/drivers/mfd/s5m-core.c
@@ -105,7 +105,7 @@ static int s5m87xx_i2c_probe(struct i2c_client *i2c,
         s5m87xx->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(s5m87xx->rtc, s5m87xx);
 
-        if (pdata->cfg_pmic_irq)
+        if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
         s5m_irq_init(s5m87xx);
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 01cf5012a08f..4392f6bca156 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -168,7 +168,7 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
 
         tps65910_gpio_init(tps65910, pmic_plat_data->gpio_base);
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 5fec23a9ac03..74fd8cb5f372 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -151,7 +151,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
         ret = tps65912_irq_init(tps65912, init_data->irq, init_data);
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
index 8a1fafd0bf7d..9fd01bf63c51 100644
--- a/drivers/mfd/wm8350-irq.c
+++ b/drivers/mfd/wm8350-irq.c
@@ -496,7 +496,6 @@ int wm8350_irq_init(struct wm8350 *wm8350, int irq,
 
         mutex_init(&wm8350->irq_lock);
         wm8350->chip_irq = irq;
-        wm8350->irq_base = pdata->irq_base;
 
         if (pdata && pdata->irq_base > 0)
                 irq_base = pdata->irq_base;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index f117e7fb9321..a04b3c108c8c 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -256,6 +256,20 @@ static int wm8994_suspend(struct device *dev)
                 break;
         }
 
+        switch (wm8994->type) {
+        case WM1811:
+                ret = wm8994_reg_read(wm8994, WM8994_ANTIPOP_2);
+                if (ret < 0) {
+                        dev_err(dev, "Failed to read jackdet: %d\n", ret);
+                } else if (ret & WM1811_JACKDET_MODE_MASK) {
+                        dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
+
         /* Disable LDO pulldowns while the device is suspended if we
          * don't know that something will be driving them. */
         if (!wm8994->ldo_ena_always_driven)
diff --git a/drivers/mfd/wm8994-regmap.c b/drivers/mfd/wm8994-regmap.c
index c598ae69b8ff..bc0c5096539a 100644
--- a/drivers/mfd/wm8994-regmap.c
+++ b/drivers/mfd/wm8994-regmap.c
@@ -806,6 +806,7 @@ static bool wm1811_readable_register(struct device *dev, unsigned int reg)
         case WM8994_DC_SERVO_2:
         case WM8994_DC_SERVO_READBACK:
         case WM8994_DC_SERVO_4:
+        case WM8994_DC_SERVO_4E:
         case WM8994_ANALOGUE_HP_1:
         case WM8958_MIC_DETECT_1:
         case WM8958_MIC_DETECT_2:
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 19fc7c1cb428..f428d86bfc10 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -984,9 +984,9 @@ static int __init c2port_init(void)
                 " - (C) 2007 Rodolfo Giometti\n");
 
         c2port_class = class_create(THIS_MODULE, "c2port");
-        if (!c2port_class) {
+        if (IS_ERR(c2port_class)) {
                 printk(KERN_ERR "c2port: failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(c2port_class);
         }
         c2port_class->dev_attrs = c2port_attrs;
 
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 690255c7d4dc..132378b89d76 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2068,6 +2068,9 @@ static int mmc_rescan_try_freq(struct mmc_host *host, unsigned freq)
          */
         mmc_hw_reset_for_init(host);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * sdio_reset sends CMD52 to reset card.  Since we do not know
          * if the card is being re-initialized, just send it.  CMD52
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 30055f2b0d44..c3704e293a7b 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -238,10 +238,10 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         /* Hold MCI clock for 8 cycles by default */
         host->clk_delay = 8;
         /*
-         * Default clock gating delay is 200ms.
+         * Default clock gating delay is 0ms to avoid wasting power.
          * This value can be tuned by writing into sysfs entry.
          */
-        host->clkgate_delay = 200;
+        host->clkgate_delay = 0;
         host->clk_gated = false;
         INIT_DELAYED_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a48066344fa8..2b9ed1401dc4 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -816,6 +816,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
         if (!mmc_host_is_spi(host))
                 mmc_set_bus_mode(host, MMC_BUSMODE_OPENDRAIN);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * Since we're changing the OCR value, we seem to
          * need to tell some cards to go back to the idle
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 5017f9354ce2..c272c6868ecf 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -911,6 +911,9 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr,
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         err = mmc_sd_get_cid(host, ocr, cid, &rocr);
         if (err)
                 return err;
@@ -1156,11 +1159,6 @@ int mmc_attach_sd(struct mmc_host *host)
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
-        /* Make sure we are at 3.3V signalling voltage */
-        err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, false);
-        if (err)
-                return err;
-
         /* Disable preset value enable if already set since last time */
         if (host->ops->enable_preset_value) {
                 mmc_host_clk_hold(host);
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 12cde6ee17f5..2c7c83f832d2 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -585,6 +585,9 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
          * Inform the card of the voltage
          */
         if (!powered_resume) {
+                /* The initialization should be done at 3.3 V I/O voltage. */
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
                 err = mmc_send_io_op_cond(host, host->ocr, &ocr);
                 if (err)
                         goto err;
@@ -996,6 +999,11 @@ static int mmc_sdio_power_restore(struct mmc_host *host)
          * With these steps taken, mmc_select_voltage() is also required to
          * restore the correct voltage setting of the card.
          */
+
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        if (!mmc_card_keep_power(host))
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         sdio_reset(host);
         mmc_go_idle(host);
         mmc_send_if_cond(host, host->ocr_avail);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 6985cdb0bb26..e4449a54ae8f 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1948,12 +1948,12 @@ static bool atmci_filter(struct dma_chan *chan, void *slave)
         }
 }
 
-static void atmci_configure_dma(struct atmel_mci *host)
+static bool atmci_configure_dma(struct atmel_mci *host)
 {
         struct mci_platform_data        *pdata;
 
         if (host == NULL)
-                return;
+                return false;
 
         pdata = host->pdev->dev.platform_data;
 
@@ -1970,12 +1970,15 @@ static void atmci_configure_dma(struct atmel_mci *host)
                 host->dma.chan =
                         dma_request_channel(mask, atmci_filter, pdata->dma_slave);
         }
-        if (!host->dma.chan)
-                dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
-        else
+        if (!host->dma.chan) {
+                dev_warn(&host->pdev->dev, "no DMA channel available\n");
+                return false;
+        } else {
                 dev_info(&host->pdev->dev,
                                         "Using %s for DMA transfers\n",
                                         dma_chan_name(host->dma.chan));
+                return true;
+        }
 }
 
 static inline unsigned int atmci_get_version(struct atmel_mci *host)
@@ -2085,8 +2088,7 @@ static int __init atmci_probe(struct platform_device *pdev)
 
         /* Get MCI capabilities and set operations according to it */
         atmci_get_cap(host);
-        if (host->caps.has_dma) {
-                dev_info(&pdev->dev, "using DMA\n");
+        if (host->caps.has_dma && atmci_configure_dma(host)) {
                 host->prepare_data = &atmci_prepare_data_dma;
                 host->submit_data = &atmci_submit_data_dma;
                 host->stop_transfer = &atmci_stop_transfer_dma;
@@ -2096,15 +2098,12 @@ static int __init atmci_probe(struct platform_device *pdev)
                 host->submit_data = &atmci_submit_data_pdc;
                 host->stop_transfer = &atmci_stop_transfer_pdc;
         } else {
-                dev_info(&pdev->dev, "no DMA, no PDC\n");
+                dev_info(&pdev->dev, "using PIO\n");
                 host->prepare_data = &atmci_prepare_data;
                 host->submit_data = &atmci_submit_data;
                 host->stop_transfer = &atmci_stop_transfer;
         }
 
-        if (host->caps.has_dma)
-                atmci_configure_dma(host);
-
         platform_set_drvdata(pdev, host);
 
         /* We need at least one slot to succeed */
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 304f2f98b680..bdfd05517dd5 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1271,12 +1271,13 @@ static int __devinit mmci_probe(struct amba_device *dev,
         /*
          * Block size can be up to 2048 bytes, but must be a power of two.
          */
-        mmc->max_blk_size = 2048;
+        mmc->max_blk_size = 1 << 11;
 
         /*
-         * No limit on the number of blocks transferred.
+         * Limit the number of blocks transferred so that we don't overflow
+         * the maximum request size.
          */
-        mmc->max_blk_count = mmc->max_req_size;
+        mmc->max_blk_count = mmc->max_req_size >> 11;
 
         spin_lock_init(&host->lock);
 
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d601e41af282..0be4e2013632 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -269,8 +269,9 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
                 imx_data->scratchpad = val;
                 return;
         case SDHCI_COMMAND:
-                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION)
-                        && (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
+                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION ||
+                     host->cmd->opcode == MMC_SET_BLOCK_COUNT) &&
+                    (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
                         val |= SDHCI_CMD_ABORTCMD;
 
                 if (is_imx6q_usdhc(imx_data)) {
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 0a4fc62a381d..c998e1afebc6 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -978,7 +978,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->netdev_ops = &cfhsi_ops;
         dev->type = ARPHRD_CAIF;
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
-        dev->mtu = CFHSI_MAX_PAYLOAD_SZ;
+        dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->tx_queue_len = 0;
         dev->destructor = free_netdev;
         skb_queue_head_init(&cfhsi->qhead);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 1ff3c6df35a2..47a9bb2c813c 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1710,7 +1710,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
                                         "atl1c hardware error (status = 0x%x)\n",
                                         status & ISR_ERROR);
                         /* reset MAC */
-                        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+                        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
                         schedule_work(&adapter->common_task);
                         return IRQ_HANDLED;
                 }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a1f2e0fed78b..35c2a202d67a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -5352,7 +5352,7 @@ static void tg3_tx(struct tg3_napi *tnapi)
                 }
         }
 
-        netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
+        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
 
         tnapi->tx_cons = sw_idx;
 
@@ -6793,7 +6793,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb_tx_timestamp(skb);
-        netdev_sent_queue(tp->dev, skb->len);
+        netdev_tx_sent_queue(txq, skb->len);
 
         /* Packets are ready, update Tx producer idx local and on card. */
         tw32_tx_mbox(tnapi->prodmbox, entry);
@@ -7275,8 +7275,8 @@ static void tg3_free_rings(struct tg3 *tp)
 
                         dev_kfree_skb_any(skb);
                 }
+                netdev_tx_reset_queue(netdev_get_tx_queue(tp->dev, j));
         }
-        netdev_reset_queue(tp->dev);
 }
 
 /* Initialize tx/rx rings for packet processing.
@@ -7886,10 +7886,8 @@ static int tg3_chip_reset(struct tg3 *tp)
         return 0;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
-                                                 struct rtnl_link_stats64 *);
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
-                                                struct tg3_ethtool_stats *);
+static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
+static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
 
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7910,7 +7908,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
 
         if (tp->hw_stats) {
                 /* Save the stats across chip resets... */
-                tg3_get_stats64(tp->dev, &tp->net_stats_prev),
+                tg3_get_nstats(tp, &tp->net_stats_prev),
                 tg3_get_estats(tp, &tp->estats_prev);
 
                 /* And make sure the next sample is new data */
@@ -9847,7 +9845,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
        return ((u64)val->high << 32) | ((u64)val->low);
 }
 
-static u64 calc_crc_errors(struct tg3 *tp)
+static u64 tg3_calc_crc_errors(struct tg3 *tp)
 {
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
@@ -9856,14 +9854,12 @@ static u64 calc_crc_errors(struct tg3 *tp)
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
                 u32 val;
 
-                spin_lock_bh(&tp->lock);
                 if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
                         tg3_writephy(tp, MII_TG3_TEST1,
                                      val | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
                 } else
                         val = 0;
-                spin_unlock_bh(&tp->lock);
 
                 tp->phy_crc_errors += val;
 
@@ -9877,14 +9873,13 @@ static u64 calc_crc_errors(struct tg3 *tp)
         estats->member =        old_estats->member + \
                                 get_stat64(&hw_stats->member)
 
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
-                                               struct tg3_ethtool_stats *estats)
+static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
 {
         struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
         if (!hw_stats)
-                return old_estats;
+                return;
 
         ESTAT_ADD(rx_octets);
         ESTAT_ADD(rx_fragments);
@@ -9963,20 +9958,13 @@ static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
         ESTAT_ADD(nic_tx_threshold_hit);
 
         ESTAT_ADD(mbuf_lwm_thresh_hit);
-
-        return estats;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
-                                                 struct rtnl_link_stats64 *stats)
+static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 {
-        struct tg3 *tp = netdev_priv(dev);
         struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
-        if (!hw_stats)
-                return old_stats;
-
         stats->rx_packets = old_stats->rx_packets +
                 get_stat64(&hw_stats->rx_ucast_packets) +
                 get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10019,15 +10007,13 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
                 get_stat64(&hw_stats->tx_carrier_sense_errors);
 
         stats->rx_crc_errors = old_stats->rx_crc_errors +
-                calc_crc_errors(tp);
+                tg3_calc_crc_errors(tp);
 
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
         stats->rx_dropped = tp->rx_dropped;
         stats->tx_dropped = tp->tx_dropped;
-
-        return stats;
 }
 
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15409,6 +15395,21 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
         }
 }
 
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
+{
+        struct tg3 *tp = netdev_priv(dev);
+
+        if (!tp->hw_stats)
+                return &tp->net_stats_prev;
+
+        spin_lock_bh(&tp->lock);
+        tg3_get_nstats(tp, stats);
+        spin_unlock_bh(&tp->lock);
+
+        return stats;
+}
+
 static const struct net_device_ops tg3_netdev_ops = {
         .ndo_open               = tg3_open,
         .ndo_stop               = tg3_close,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e83d12c7bf20..9d76e59d9526 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -196,6 +196,8 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         CH_DEVICE(0x4408, 4),
         CH_DEVICE(0x4409, 4),
         CH_DEVICE(0x440a, 4),
+        CH_DEVICE(0x440d, 4),
+        CH_DEVICE(0x440e, 4),
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index e53365a71484..d963c1d57f71 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2892,6 +2892,8 @@ static struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x4808, 0),   /* T420-cx */
         CH_DEVICE(0x4809, 0),   /* T420-bt */
         CH_DEVICE(0x480a, 0),   /* T404-bt */
+        CH_DEVICE(0x480d, 0),   /* T480-cr */
+        CH_DEVICE(0x480e, 0),   /* T440-lp-cr */
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index ee93a2087fe6..c52295cd05ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
         u32 rx_coalesce_usecs;
         u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-        u32 num_vfs;
+        u16 num_vfs;
 #endif
         struct enic_port_profile *pp;
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ab3f67f980d8..0e4edd3b6bee 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
         if (pos) {
                 pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-                        (u16 *)&enic->num_vfs);
+                        &enic->num_vfs);
                 if (enic->num_vfs) {
                         err = pci_enable_sriov(pdev, enic->num_vfs);
                         if (err) {
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 5d5fb2627184..e6893cdfd13b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -336,7 +336,9 @@ static struct rtnl_link_stats64 *ehea_get_stats64(struct net_device *dev,
         stats->tx_bytes = tx_bytes;
         stats->rx_packets = rx_packets;
 
-        return &port->stats;
+        stats->multicast = port->stats.multicast;
+        stats->rx_errors = port->stats.rx_errors;
+        return stats;
 }
 
 static void ehea_update_stats(struct work_struct *work)
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 738f950a1ce5..fb2b36759cbf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -151,11 +151,6 @@ static int __mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
                 context->log_page_size   = mtt->page_shift - MLX4_ICM_PAGE_SHIFT;
         }
 
-        port = ((context->pri_path.sched_queue >> 6) & 1) + 1;
-        if (dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH)
-                context->pri_path.sched_queue = (context->pri_path.sched_queue &
-                                                0xc3);
-
         *(__be32 *) mailbox->buf = cpu_to_be32(optpar);
         memcpy(mailbox->buf + 8, context, sizeof *context);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index bfdb7af19e49..8752e6e08169 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2255,8 +2255,7 @@ int mlx4_MODIFY_CQ_wrapper(struct mlx4_dev *dev, int slave,
 
         if (vhcr->op_modifier == 0) {
                 err = handle_resize(dev, slave, vhcr, inbox, outbox, cmd, cq);
-                if (err)
-                        goto ex_put;
+                goto ex_put;
         }
 
         err = mlx4_DMA_wrapper(dev, slave, vhcr, inbox, outbox, cmd);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 9cb5f912e489..29e23bec809c 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                         pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                         hw->phy.autoneg_advertised = opt.def;
                 } else {
-                        hw->phy.autoneg_advertised = AutoNeg;
-                        pch_gbe_validate_option(
-                                (int *)(&hw->phy.autoneg_advertised),
-                                &opt, adapter);
+                        int tmp = AutoNeg;
+
+                        pch_gbe_validate_option(&tmp, &opt, adapter);
+                        hw->phy.autoneg_advertised = tmp;
                 }
         }
 
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                          .p = fc_list } }
                 };
-                hw->mac.fc = FlowControl;
-                pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                                &opt, adapter);
+                int tmp = FlowControl;
+
+                pch_gbe_validate_option(&tmp, &opt, adapter);
+                hw->mac.fc = tmp;
         }
 
         pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index b97132d9dff0..8f29feb35548 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 
 config NET_PACKET_ENGINE
         bool "Packet Engine devices"
+        default y
         depends on PCI
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 7931531c3a40..e61560e16385 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,7 +3017,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 (void __iomem *)port_regs;
         u32 delay = 10;
         int status = 0;
-        unsigned long hw_flags = 0;
 
         if (ql_mii_setup(qdev))
                 return -1;
@@ -3228,9 +3227,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                 if (value & PORT_STATUS_IC)
                         break;
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+                spin_unlock_irq(&qdev->hw_lock);
                 msleep(500);
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+                spin_lock_irq(&qdev->hw_lock);
         } while (--delay);
 
         if (delay == 0) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a0c800b50ad..bbacb3741ec0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.enable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.disable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
@@ -6186,6 +6194,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct rtl8169_private *tp = netdev_priv(dev);
+        struct device *d = &pdev->dev;
+
+        pm_runtime_get_sync(d);
 
         rtl8169_net_suspend(dev);
 
@@ -6207,6 +6218,8 @@ static void rtl_shutdown(struct pci_dev *pdev)
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
+
+        pm_runtime_put_noidle(d);
 }
 
 static struct pci_driver rtl8169_pci_driver = {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 466c58a7353d..bf01841bda5b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -313,7 +313,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
 static void netvsc_get_drvinfo(struct net_device *net,
                                struct ethtool_drvinfo *info)
 {
-        strcpy(info->driver, "hv_netvsc");
+        strcpy(info->driver, KBUILD_MODNAME);
         strcpy(info->version, HV_DRV_VERSION);
         strcpy(info->fw_version, "N/A");
 }
@@ -485,7 +485,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 
 /* The one and only one */
 static struct  hv_driver netvsc_drv = {
-        .name = "netvsc",
+        .name = KBUILD_MODNAME,
         .id_table = id_table,
         .probe = netvsc_probe,
         .remove = netvsc_remove,
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fae0fbd8bc88..81b96e303757 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -589,6 +589,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                 entry = (struct skb_data *) skb->cb;
                 urb = entry->urb;
 
+                spin_unlock_irqrestore(&q->lock, flags);
                 // during some PM-driven resume scenarios,
                 // these (async) unlinks complete immediately
                 retval = usb_unlink_urb (urb);
@@ -596,6 +597,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                         netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
                 else
                         count++;
+                spin_lock_irqsave(&q->lock, flags);
         }
         spin_unlock_irqrestore (&q->lock, flags);
         return count;
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3dcd3857a36c..756c0f5565a5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                         ctx->l4_hdr_size = ((struct tcphdr *)
                                            skb_transport_header(skb))->doff * 4;
                                 else if (iph->protocol == IPPROTO_UDP)
-                                        /*
-                                         * Use tcp header size so that bytes to
-                                         * be copied are more than required by
-                                         * the device.
-                                         */
                                         ctx->l4_hdr_size =
-                                                        sizeof(struct tcphdr);
+                                                        sizeof(struct udphdr);
                                 else
                                         ctx->l4_hdr_size = 0;
                         } else {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ed54797db191..fc46a81ad538 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index f901a17f76ba..86a891f93fc9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
         ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
         ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
 
         return 0;
@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
         ATH_FREE_BANK(ah->analogBank6Data);
         ATH_FREE_BANK(ah->analogBank6TPCData);
         ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
         ATH_FREE_BANK(ah->bank6Temp);
 
 #undef ATH_FREE_BANK
@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         if (ah->eep_ops->set_addac)
                 ah->eep_ops->set_addac(ah, chan);
 
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
-
+        REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
         REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
 
         ENABLE_REGWRITE_BUFFER(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 11f192a1ceb7..d190411ac8f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
                                ARRAY_SIZE(ar5416Addac), 2);
         }
+
+        /* iniAddac needs to be modified for these chips */
+        if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
+                struct ar5416IniArray *addac = &ah->iniAddac;
+                u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
+                u32 *data;
+
+                data = kmalloc(size, GFP_KERNEL);
+                if (!data)
+                        return;
+
+                memcpy(data, addac->ia_array, size);
+                addac->ia_array = data;
+
+                if (!AR_SREV_5416_22_OR_LATER(ah)) {
+                        /* override CLKDRV value */
+                        INI_RA(addac, 31,1) = 0;
+                }
+        }
 }
 
 /* Support for Japan ch.14 (2484) spread */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6a29004a71b0..c8261d4fc780 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,7 +940,6 @@ struct ath_hw {
         u32 *analogBank6Data;
         u32 *analogBank6TPCData;
         u32 *analogBank7Data;
-        u32 *addac5416_21;
         u32 *bank6Temp;
 
         u8 txpower_limit;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d19a9ee9d057..bbc813dee983 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1234,6 +1234,7 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ieee80211_sta *sta;
         struct carl9170_sta_info *sta_info;
+        struct ieee80211_tx_info *tx_info;
 
         rcu_read_lock();
         sta = __carl9170_get_tx_sta(ar, skb);
@@ -1241,16 +1242,18 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
                 goto out_rcu;
 
         sta_info = (void *) sta->drv_priv;
-        if (unlikely(sta_info->sleeping)) {
-                struct ieee80211_tx_info *tx_info;
+        tx_info = IEEE80211_SKB_CB(skb);
 
+        if (unlikely(sta_info->sleeping) &&
+            !(tx_info->flags & (IEEE80211_TX_CTL_POLL_RESPONSE |
+                                IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
                 rcu_read_unlock();
 
-                tx_info = IEEE80211_SKB_CB(skb);
                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
                         atomic_dec(&ar->tx_ampdu_upload);
 
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                carl9170_release_dev_space(ar, skb);
                 carl9170_tx_status(ar, skb, false);
                 return true;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 90911eec0cf5..30b58870b1b6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,17 +1051,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                 }
                 /* either retransmit or send bar if ack not recd */
                 if (!ack_recd) {
-                        struct ieee80211_tx_rate *txrate =
-                            tx_info->status.rates;
-                        if (retry && (txrate[0].count < (int)retry_limit)) {
+                        if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 ini->txretry[index]++;
                                 ini->tx_in_transit--;
                                 /*
                                  * Use high prededence for retransmit to
                                  * give some punch
                                  */
-                                /* brcms_c_txq_enq(wlc, scb, p,
-                                 * BRCMS_PRIO_TO_PREC(tid)); */
                                 brcms_c_txq_enq(wlc, scb, p,
                                                 BRCMS_PRIO_TO_HI_PREC(tid));
                         } else {
@@ -1074,9 +1070,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                     IEEE80211_TX_STAT_AMPDU_NO_BACK;
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
-                                wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
-                                        "transit %d\n", "AMPDU status", seq,
-                                        ini->tx_in_transit);
+                                BCMMSG(wiphy,
+                                       "BA Timeout, seq %d, in_transit %d\n",
+                                       seq, ini->tx_in_transit);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 64cf439035c3..ca78e91de86c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1240,7 +1240,7 @@ int iwlagn_suspend(struct iwl_priv *priv,
                                 .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                                .len[0] = sizeof(key_data.rsc_tsc),
+                                .len[0] = sizeof(*key_data.rsc_tsc),
                         };
 
                         ret = iwl_trans_send_cmd(trans(priv), &rsc_tsc_cmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 7353826095f1..e483cfa8d14e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,6 +1187,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         unsigned long flags;
         struct iwl_addsta_cmd sta_cmd;
         u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
+        __le16 key_flags;
 
         /* if station isn't there, neither is the key */
         if (sta_id == IWL_INVALID_STATION)
@@ -1212,7 +1213,14 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 IWL_ERR(priv, "offset %d not used in uCode key table.\n",
                         keyconf->hw_key_idx);
 
-        sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
+                     STA_KEY_FLG_INVALID;
+
+        if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        sta_cmd.key.key_flags = key_flags;
         sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 5b2972b43b0e..2210a0f9af2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -846,6 +846,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         priv->sec_info.wpa_enabled = false;
         priv->sec_info.wpa2_enabled = false;
         priv->wep_key_curr_index = 0;
+        priv->sec_info.encryption_mode = 0;
         ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
 
         if (mode == NL80211_IFTYPE_ADHOC) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..d2a1ea98d0f2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1220,7 +1220,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                 cancel_work_sync(&rt2x00dev->rxdone_work);
                 cancel_work_sync(&rt2x00dev->txdone_work);
         }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
 
         /*
          * Free the tx status fifo.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index ea2bd1be2640..91a375fb6ae6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -23,7 +23,6 @@
 #include <asm/machdep.h>
 #endif /* CONFIG_PPC */
 
-#include <asm/setup.h>
 #include <asm/page.h>
 
 char *of_fdt_get_string(struct boot_param_header *blob, u32 offset)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 980c079e4443..483c0adcad87 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -182,7 +182,7 @@ struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
         if (!phy_id || sz < sizeof(*phy_id))
                 return NULL;
 
-        sprintf(bus_id, PHY_ID_FMT, "0", be32_to_cpu(phy_id[0]));
+        sprintf(bus_id, PHY_ID_FMT, "fixed-0", be32_to_cpu(phy_id[0]));
 
         phy = phy_connect(dev, bus_id, hndlr, 0, iface);
         return IS_ERR(phy) ? NULL : phy;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2baadd21b7a6..98fbe62694d4 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -369,9 +369,9 @@ static int __init pps_init(void)
         int err;
 
         pps_class = class_create(THIS_MODULE, "pps");
-        if (!pps_class) {
+        if (IS_ERR(pps_class)) {
                 pr_err("failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(pps_class);
         }
         pps_class->dev_attrs = pps_attrs;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 691b1ab1a3d0..30d2072f480b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
          */
         mport = priv->mport;
 
-        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
-        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
 
         while (wr_ptr != rd_ptr) {
                 idb_entry = (u64 *)(priv->idb_base +
                                         (TSI721_IDB_ENTRY_SIZE * rd_ptr));
                 rd_ptr++;
+                rd_ptr %= IDB_QSIZE;
                 idb.msg = *idb_entry;
                 *idb_entry = 0;
 
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 3767364452fd..ea4d8f575ac6 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -260,8 +260,8 @@ static int da9052_set_ldo5_6_voltage(struct regulator_dev *rdev,
          * the LDO activate bit to implment the changes on the
          * LDO output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
@@ -280,8 +280,8 @@ static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
          * the DCDC activate bit to implment the changes on the
          * DCDC output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_get_regulator_voltage_sel(struct regulator_dev *rdev)
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 5c15ba01e9c7..40ecf5165899 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -662,7 +662,7 @@ static int tps65910_set_voltage_dcdc(struct regulator_dev *dev,
                 tps65910_reg_write(pmic, TPS65910_VDD2_OP, vsel);
                 break;
         case TPS65911_REG_VDDCTRL:
-                vsel = selector;
+                vsel = selector + 3;
                 tps65910_reg_write(pmic, TPS65911_VDDCTRL_OP, vsel);
         }
 
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 9beba49c3c5b..2853c2a6f10f 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -125,6 +125,13 @@ static int __devinit r9701_probe(struct spi_device *spi)
         unsigned char tmp;
         int res;
 
+        tmp = R100CNT;
+        res = read_regs(&spi->dev, &tmp, 1);
+        if (res || tmp != 0x20) {
+                dev_err(&spi->dev, "cannot read RTC register\n");
+                return -ENODEV;
+        }
+
         rtc = rtc_device_register("r9701",
                                 &spi->dev, &r9701_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc))
@@ -132,13 +139,6 @@ static int __devinit r9701_probe(struct spi_device *spi)
 
         dev_set_drvdata(&spi->dev, rtc);
 
-        tmp = R100CNT;
-        res = read_regs(&spi->dev, &tmp, 1);
-        if (res || tmp != 0x20) {
-                rtc_device_unregister(rtc);
-                return res;
-        }
-
         return 0;
 }
 
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3ef8d071c64a..770a740a393c 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -167,7 +167,7 @@ again:
         DBF_ERROR("%4x EQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
@@ -215,7 +215,7 @@ again:
         DBF_ERROR("%4x SQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 0cb39ff21171..f8fb2d691c0a 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -408,7 +408,7 @@ int sd_dif_prepare(struct request *rq, sector_t hw_sector, unsigned int sector_s
                         kunmap_atomic(sdt, KM_USER0);
                 }
 
-                bio->bi_flags |= BIO_MAPPED_INTEGRITY;
+                bio->bi_flags |= (1 << BIO_MAPPED_INTEGRITY);
         }
 
         return 0;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 2f9cb43a2398..f37ad2271ad5 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1083,7 +1083,7 @@ err_alloc_rx_sg:
         return -ENOMEM;
 }
 
-static int __init pl022_dma_probe(struct pl022 *pl022)
+static int __devinit pl022_dma_probe(struct pl022 *pl022)
 {
         dma_cap_mask_t mask;
 
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b3d17416d86a..830cd62d8492 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -365,7 +365,7 @@ config PPC_EPAPR_HV_BYTECHAN
 
 config PPC_EARLY_DEBUG_EHV_BC
         bool "Early console (udbg) support for ePAPR hypervisors"
-        depends on PPC_EPAPR_HV_BYTECHAN
+        depends on PPC_EPAPR_HV_BYTECHAN=y
         help
           Select this option to enable early console (a.k.a. "udbg") support
           via an ePAPR byte channel.  You also need to choose the byte channel
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index c26a82e83f6e..b556a72264d1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -239,7 +239,7 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 }
 
-static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
+static void ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 {
         struct usb_hcd *hcd = ehci_to_hcd(ehci);
         struct fsl_usb2_platform_data *pdata;
@@ -299,19 +299,12 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 #endif
                 out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
         }
-
-        if (!(in_be32(non_ehci + FSL_SOC_USB_CTRL) & CTRL_PHY_CLK_VALID)) {
-                printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_fsl_reinit(struct ehci_hcd *ehci)
 {
-        if (ehci_fsl_usb_setup(ehci))
-                return -ENODEV;
+        ehci_fsl_usb_setup(ehci);
         ehci_port_power(ehci, 0);
 
         return 0;
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index bdf43e2adc51..491806221165 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -45,6 +45,5 @@
 #define FSL_SOC_USB_PRICTRL     0x40c   /* NOTE: big-endian */
 #define FSL_SOC_USB_SICTRL      0x410   /* NOTE: big-endian */
 #define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
-#define CTRL_PHY_CLK_VALID      (1 << 17)
 #define SNOOP_SIZE_2GB          0x1e
 #endif                          /* _EHCI_FSL_H */
diff --git a/fs/aio.c b/fs/aio.c
index 969beb0e2231..b9d64d89a043 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-        BUG_ON(atomic_read(&kioctx->users) <= 0);
-        atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
         return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         mm = ctx->mm = current->mm;
         atomic_inc(&mm->mm_count);
 
-        atomic_set(&ctx->users, 1);
+        atomic_set(&ctx->users, 2);
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->ring_info.ring_lock);
         init_waitqueue_head(&ctx->wait);
@@ -490,6 +484,8 @@ static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
                 kmem_cache_free(kiocb_cachep, req);
                 ctx->reqs_active--;
         }
+        if (unlikely(!ctx->reqs_active && ctx->dead))
+                wake_up_all(&ctx->wait);
         spin_unlock_irq(&ctx->ctx_lock);
 }
 
@@ -607,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
                         fput(req->ki_filp);
 
                 /* Link the iocb into the context's free list */
+                rcu_read_lock();
                 spin_lock_irq(&ctx->ctx_lock);
                 really_put_req(ctx, req);
+                /*
+                 * at that point ctx might've been killed, but actual
+                 * freeing is RCU'd
+                 */
                 spin_unlock_irq(&ctx->ctx_lock);
+                rcu_read_unlock();
 
-                put_ioctx(ctx);
                 spin_lock_irq(&fput_lock);
         }
         spin_unlock_irq(&fput_lock);
@@ -642,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
          * this function will be executed w/out any aio kthread wakeup.
          */
         if (unlikely(!fput_atomic(req->ki_filp))) {
-                get_ioctx(ctx);
                 spin_lock(&fput_lock);
                 list_add(&req->ki_list, &fput_head);
                 spin_unlock(&fput_lock);
@@ -1336,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
         ret = PTR_ERR(ioctx);
         if (!IS_ERR(ioctx)) {
                 ret = put_user(ioctx->user_id, ctxp);
-                if (!ret)
+                if (!ret) {
+                        put_ioctx(ioctx);
                         return 0;
-
-                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+                }
                 io_destroy(ioctx);
         }
 
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index a6395bdb26ae..1ff94054d35a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -259,6 +259,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         current->mm->free_area_cache = current->mm->mmap_base;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -352,13 +359,6 @@ beyond_if:
                 return retval;
         }
 
-        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) { 
-                /* Someone check-me: is this error path enough? */ 
-                send_sig(SIGKILL, current, 0); 
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 98f6bf10bbd4..0436c12da8c2 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -583,7 +583,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
         struct btrfs_path *path;
         struct btrfs_key info_key = { 0 };
         struct btrfs_delayed_ref_root *delayed_refs = NULL;
-        struct btrfs_delayed_ref_head *head = NULL;
+        struct btrfs_delayed_ref_head *head;
         int info_level = 0;
         int ret;
         struct list_head prefs_delayed;
@@ -607,6 +607,8 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
          * at a specified point in time
          */
 again:
+        head = NULL;
+
         ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
         if (ret < 0)
                 goto out;
@@ -635,8 +637,10 @@ again:
                         goto again;
                 }
                 ret = __add_delayed_refs(head, seq, &info_key, &prefs_delayed);
-                if (ret)
+                if (ret) {
+                        spin_unlock(&delayed_refs->lock);
                         goto out;
+                }
         }
         spin_unlock(&delayed_refs->lock);
 
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 2373b39a132b..22db04550f6a 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -305,7 +305,7 @@ again:
 
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_insert(&dev->reada_zones,
-                                (unsigned long)zone->end >> PAGE_CACHE_SHIFT,
+                                (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                 zone);
         spin_unlock(&fs_info->reada_lock);
 
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 63a196b97d50..bc7e24420ac0 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                          * If either that or op not supported returned, follow
                          * the normal lookup.
                          */
-                        if ((rc == 0) || (rc == -ENOENT))
+                        switch (rc) {
+                        case 0:
+                                /*
+                                 * The server may allow us to open things like
+                                 * FIFOs, but the client isn't set up to deal
+                                 * with that. If it's not a regular file, just
+                                 * close it and proceed as if it were a normal
+                                 * lookup.
+                                 */
+                                if (newInode && !S_ISREG(newInode->i_mode)) {
+                                        CIFSSMBClose(xid, pTcon, fileHandle);
+                                        break;
+                                }
+                        case -ENOENT:
                                 posix_open = true;
-                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+                        case -EOPNOTSUPP:
+                                break;
+                        default:
                                 pTcon->broken_posix_open = true;
+                        }
                 }
                 if (!posix_open)
                         rc = cifs_get_inode_info_unix(&newInode, full_path,
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a5f54b7d9822..745da3d0653e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -534,6 +534,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
         if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                 fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                 fattr->cf_dtype = DT_DIR;
+                /*
+                 * Server can return wrong NumberOfLinks value for directories
+                 * when Unix extensions are disabled - fake it.
+                 */
+                fattr->cf_nlink = 2;
         } else {
                 fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
                 fattr->cf_dtype = DT_REG;
@@ -541,9 +546,9 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 /* clear write bits if ATTR_READONLY is set */
                 if (fattr->cf_cifsattrs & ATTR_READONLY)
                         fattr->cf_mode &= ~(S_IWUGO);
-        }
 
-        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+        }
 
         fattr->cf_uid = cifs_sb->mnt_uid;
         fattr->cf_gid = cifs_sb->mnt_gid;
@@ -1322,7 +1327,6 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                         }
 /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
         to set uid/gid */
-                        inc_nlink(inode);
 
                         cifs_unix_basic_to_fattr(&fattr, pInfo, cifs_sb);
                         cifs_fill_uniqueid(inode->i_sb, &fattr);
@@ -1355,7 +1359,6 @@ mkdir_retry_old:
                 d_drop(direntry);
         } else {
 mkdir_get_info:
-                inc_nlink(inode);
                 if (pTcon->unix_ext)
                         rc = cifs_get_inode_info_unix(&newinode, full_path,
                                                       inode->i_sb, xid);
@@ -1436,6 +1439,11 @@ mkdir_get_info:
                 }
         }
 mkdir_out:
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        CIFS_I(inode)->time = 0;
         kfree(full_path);
         FreeXid(xid);
         cifs_put_tlink(tlink);
@@ -1475,7 +1483,6 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         cifs_put_tlink(tlink);
 
         if (!rc) {
-                drop_nlink(inode);
                 spin_lock(&direntry->d_inode->i_lock);
                 i_size_write(direntry->d_inode, 0);
                 clear_nlink(direntry->d_inode);
@@ -1483,12 +1490,15 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         }
 
         cifsInode = CIFS_I(direntry->d_inode);
-        cifsInode->time = 0;    /* force revalidate to go get info when
-                                   needed */
+        /* force revalidate to go get info when needed */
+        cifsInode->time = 0;
 
         cifsInode = CIFS_I(inode);
-        cifsInode->time = 0;    /* force revalidate to get parent dir info
-                                   since cached search results now invalid */
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        cifsInode->time = 0;
 
         direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                 current_fs_time(inode->i_sb);
diff --git a/fs/dcache.c b/fs/dcache.c
index 138be96e25b6..bcbdb33fcc20 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -137,6 +137,26 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
 }
 #endif
 
+/*
+ * Compare 2 name strings, return 0 if they match, otherwise non-zero.
+ * The strings are both count bytes long, and count is non-zero.
+ */
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
+        if (scount != tcount)
+                return 1;
+
+        do {
+                if (*cs != *ct)
+                        return 1;
+                cs++;
+                ct++;
+                tcount--;
+        } while (tcount);
+        return 0;
+}
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
diff --git a/fs/exec.c b/fs/exec.c
index 92ce83a11e90..153dee14fe55 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1915,7 +1915,6 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        struct completion *vfork_done;
         int core_waiters = -EBUSY;
 
         init_completion(&core_state->startup);
@@ -1927,22 +1926,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
         up_write(&mm->mmap_sem);
 
-        if (unlikely(core_waiters < 0))
-                goto fail;
-
-        /*
-         * Make sure nobody is waiting for us to release the VM,
-         * otherwise we can deadlock when we wait on each other
-         */
-        vfork_done = tsk->vfork_done;
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
-
-        if (core_waiters)
+        if (core_waiters > 0)
                 wait_for_completion(&core_state->startup);
-fail:
+
         return core_waiters;
 }
 
diff --git a/include/linux/amba/serial.h b/include/linux/amba/serial.h
index 514ed45c462e..d117b29d1062 100644
--- a/include/linux/amba/serial.h
+++ b/include/linux/amba/serial.h
@@ -23,6 +23,8 @@
 #ifndef ASM_ARM_HARDWARE_SERIAL_AMBA_H
 #define ASM_ARM_HARDWARE_SERIAL_AMBA_H
 
+#include <linux/types.h>
+
 /* -------------------------------------------------------------------------------
  *  From AMBA UART (PL010) Block Specification
  * -------------------------------------------------------------------------------
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 4270bedd2308..ff5f5256d175 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -47,26 +47,6 @@ struct dentry_stat_t {
 };
 extern struct dentry_stat_t dentry_stat;
 
-/*
- * Compare 2 name strings, return 0 if they match, otherwise non-zero.
- * The strings are both count bytes long, and count is non-zero.
- */
-static inline int dentry_cmp(const unsigned char *cs, size_t scount,
-                                const unsigned char *ct, size_t tcount)
-{
-        if (scount != tcount)
-                return 1;
-
-        do {
-                if (*cs != *ct)
-                        return 1;
-                cs++;
-                ct++;
-                tcount--;
-        } while (tcount);
-        return 0;
-}
-
 /* Name hashing routines. Initial hash value */
 /* Hash courtesy of the R5 hash in reiserfs modulo sign bits */
 #define init_name_hash()                0
diff --git a/include/linux/kmsg_dump.h b/include/linux/kmsg_dump.h
index fee66317e071..35f7237ec972 100644
--- a/include/linux/kmsg_dump.h
+++ b/include/linux/kmsg_dump.h
@@ -15,13 +15,18 @@
 #include <linux/errno.h>
 #include <linux/list.h>
 
+/*
+ * Keep this list arranged in rough order of priority. Anything listed after
+ * KMSG_DUMP_OOPS will not be logged by default unless printk.always_kmsg_dump
+ * is passed to the kernel.
+ */
 enum kmsg_dump_reason {
-        KMSG_DUMP_OOPS,
         KMSG_DUMP_PANIC,
+        KMSG_DUMP_OOPS,
+        KMSG_DUMP_EMERG,
         KMSG_DUMP_RESTART,
         KMSG_DUMP_HALT,
         KMSG_DUMP_POWEROFF,
-        KMSG_DUMP_EMERG,
 };
 
 /**
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 4d34356fe644..b80de520670b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -129,7 +129,6 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                         struct page *newpage);
 
-extern void mem_cgroup_reset_owner(struct page *page);
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern int do_swap_account;
 #endif
@@ -392,10 +391,6 @@ static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
                                 struct page *newpage)
 {
 }
-
-static inline void mem_cgroup_reset_owner(struct page *page)
-{
-}
 #endif /* CONFIG_CGROUP_MEM_CONT */
 
 #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
diff --git a/include/linux/of.h b/include/linux/of.h
index 50059cf63135..612f84b007c6 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -281,6 +281,14 @@ static inline struct property *of_find_property(const struct device_node *np,
         return NULL;
 }
 
+static inline struct device_node *of_find_compatible_node(
+                                                struct device_node *from,
+                                                const char *type,
+                                                const char *compat)
+{
+        return NULL;
+}
+
 static inline int of_property_read_u32_array(const struct device_node *np,
                                              const char *propname,
                                              u32 *out_values, size_t sz)
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 32cd1f67462e..21638ae14e07 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -348,9 +348,9 @@ do {									\
 #define _this_cpu_generic_to_op(pcp, val, op)                           \
 do {                                                                    \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         *__this_cpu_ptr(&(pcp)) op val;                                 \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
 } while (0)
 
 #ifndef this_cpu_write
@@ -449,10 +449,10 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         __this_cpu_add(pcp, val);                                       \
         ret__ = __this_cpu_read(pcp);                                   \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -479,10 +479,10 @@ do {									\
 #define _this_cpu_generic_xchg(pcp, nval)                               \
 ({      typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         __this_cpu_write(pcp, nval);                                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -507,11 +507,11 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         if (ret__ == (oval))                                            \
                 __this_cpu_write(pcp, nval);                            \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -544,10 +544,10 @@ do {									\
 ({                                                                      \
         int ret__;                                                      \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_generic_cmpxchg_double(pcp1, pcp2,           \
                         oval1, oval2, nval1, nval2);                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -718,12 +718,13 @@ do {									\
 # ifndef __this_cpu_add_return_8
 #  define __this_cpu_add_return_8(pcp, val)     __this_cpu_generic_add_return(pcp, val)
 # endif
-# define __this_cpu_add_return(pcp, val)        __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
+# define __this_cpu_add_return(pcp, val)        \
+        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
 
-#define __this_cpu_sub_return(pcp, val) this_cpu_add_return(pcp, -(val))
-#define __this_cpu_inc_return(pcp)      this_cpu_add_return(pcp, 1)
-#define __this_cpu_dec_return(pcp)      this_cpu_add_return(pcp, -1)
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
+#define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
+#define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
 
 #define __this_cpu_generic_xchg(pcp, nval)                              \
 ({      typeof(pcp) ret__;                                              \
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 7d379a6bfd88..0657368bd78f 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1777,7 +1777,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 /*
  * Per process flags
  */
-#define PF_STARTING     0x00000002      /* being created */
 #define PF_EXITING      0x00000004      /* getting shut down */
 #define PF_EXITPIDONE   0x00000008      /* pi exit done on shut down */
 #define PF_VCPU         0x00000010      /* I'm a virtual CPU */
@@ -2371,7 +2370,7 @@ static inline int thread_group_empty(struct task_struct *p)
  * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring
  * subscriptions and synchronises with wait4().  Also used in procfs.  Also
  * pins the final release of task.io_context.  Also protects ->cpuset and
- * ->cgroup.subsys[].
+ * ->cgroup.subsys[]. And ->vfork_done.
  *
  * Nests both inside and outside of read_lock(&tasklist_lock).
  * It must not be nested with write_lock_irq(&tasklist_lock),
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 46a85c9e1f25..3c7ffdb40dc6 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -412,7 +412,8 @@ struct tcp_sock {
 
         struct tcp_sack_block recv_sack_cache[4];
 
-        struct sk_buff *highest_sack;   /* highest skb with SACK received
+        struct sk_buff *highest_sack;   /* skb just after the highest
+                                         * skb with SACKed bit set
                                          * (validity guaranteed only if
                                          * sacked_out > 0)
                                          */
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 06b795dd5906..b94765e38e80 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -35,12 +35,12 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
-        int                     redirect_genid;
         unsigned long           rate_last;
         unsigned long           pmtu_expires;
         u32                     pmtu_orig;
         u32                     pmtu_learned;
         struct inetpeer_addr_base redirect_learned;
+        struct list_head        gc_list;
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
          * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
@@ -96,6 +96,8 @@ static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr,
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
 
+extern void inetpeer_invalidate_tree(int family);
+
 /*
  * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
  * tcp_ts_stamp if no refcount is taken on inet_peer
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 42c29bfbcee3..2d80c291fffb 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1364,8 +1364,9 @@ static inline void tcp_push_pending_frames(struct sock *sk)
         }
 }
 
-/* Start sequence of the highest skb with SACKed bit, valid only if
- * sacked > 0 or when the caller has ensured validity by itself.
+/* Start sequence of the skb just after the highest skb with SACKed
+ * bit, valid only if sacked_out > 0 or when the caller has ensured
+ * validity by itself.
  */
 static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
 {
diff --git a/kernel/fork.c b/kernel/fork.c
index e2cd3e2a5ae8..26a7a6707fa7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -668,6 +668,38 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
         return mm;
 }
 
+static void complete_vfork_done(struct task_struct *tsk)
+{
+        struct completion *vfork;
+
+        task_lock(tsk);
+        vfork = tsk->vfork_done;
+        if (likely(vfork)) {
+                tsk->vfork_done = NULL;
+                complete(vfork);
+        }
+        task_unlock(tsk);
+}
+
+static int wait_for_vfork_done(struct task_struct *child,
+                                struct completion *vfork)
+{
+        int killed;
+
+        freezer_do_not_count();
+        killed = wait_for_completion_killable(vfork);
+        freezer_count();
+
+        if (killed) {
+                task_lock(child);
+                child->vfork_done = NULL;
+                task_unlock(child);
+        }
+
+        put_task_struct(child);
+        return killed;
+}
+
 /* Please note the differences between mmput and mm_release.
  * mmput is called whenever we stop holding onto a mm_struct,
  * error success whatever.
@@ -683,8 +715,6 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  */
 void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
-        struct completion *vfork_done = tsk->vfork_done;
-
         /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
         if (unlikely(tsk->robust_list)) {
@@ -704,17 +734,15 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         /* Get rid of any cached register state */
         deactivate_mm(tsk, mm);
 
-        /* notify parent sleeping on vfork() */
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
+        if (tsk->vfork_done)
+                complete_vfork_done(tsk);
 
         /*
          * If we're exiting normally, clear a user-space tid field if
          * requested.  We leave this alone when dying by signal, to leave
          * the value intact in a core dump, and to save the unnecessary
-         * trouble otherwise.  Userland only wants this done for a sys_exit.
+         * trouble, say, a killed vfork parent shouldn't touch this mm.
+         * Userland only wants this done for a sys_exit.
          */
         if (tsk->clear_child_tid) {
                 if (!(tsk->flags & PF_SIGNALED) &&
@@ -1018,7 +1046,6 @@ static void copy_flags(unsigned long clone_flags, struct task_struct *p)
 
         new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
         new_flags |= PF_FORKNOEXEC;
-        new_flags |= PF_STARTING;
         p->flags = new_flags;
 }
 
@@ -1548,16 +1575,9 @@ long do_fork(unsigned long clone_flags,
                 if (clone_flags & CLONE_VFORK) {
                         p->vfork_done = &vfork;
                         init_completion(&vfork);
+                        get_task_struct(p);
                 }
 
-                /*
-                 * We set PF_STARTING at creation in case tracing wants to
-                 * use this to distinguish a fully live task from one that
-                 * hasn't finished SIGSTOP raising yet.  Now we clear it
-                 * and set the child going.
-                 */
-                p->flags &= ~PF_STARTING;
-
                 wake_up_new_task(p);
 
                 /* forking complete and child started to run, tell ptracer */
@@ -1565,10 +1585,8 @@ long do_fork(unsigned long clone_flags,
                         ptrace_event(trace, nr);
 
                 if (clone_flags & CLONE_VFORK) {
-                        freezer_do_not_count();
-                        wait_for_completion(&vfork);
-                        freezer_count();
-                        ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
+                        if (!wait_for_vfork_done(p, &vfork))
+                                ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
                 }
         } else {
                 nr = PTR_ERR(p);
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 2e48ec0c2e91..c21449f85a2a 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -119,15 +119,20 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
  * For preemptible RCU it is sufficient to call rcu_read_unlock in order
  * to exit the grace period. For classic RCU, a reschedule is required.
  */
-static void rcu_lock_break(struct task_struct *g, struct task_struct *t)
+static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
 {
+        bool can_cont;
+
         get_task_struct(g);
         get_task_struct(t);
         rcu_read_unlock();
         cond_resched();
         rcu_read_lock();
+        can_cont = pid_alive(g) && pid_alive(t);
         put_task_struct(t);
         put_task_struct(g);
+
+        return can_cont;
 }
 
 /*
@@ -154,9 +159,7 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
                         goto unlock;
                 if (!--batch_count) {
                         batch_count = HUNG_TASK_BATCHING;
-                        rcu_lock_break(g, t);
-                        /* Exit if t or g was unhashed during refresh. */
-                        if (t->state == TASK_DEAD || g->state == TASK_DEAD)
+                        if (!rcu_lock_break(g, t))
                                 goto unlock;
                 }
                 /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 32313c084442..0f0d4704ddd8 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -985,6 +985,11 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
                 /* add new interrupt at end of irq queue */
                 do {
+                        /*
+                         * Or all existing action->thread_mask bits,
+                         * so we can find the next zero bit for this
+                         * new action.
+                         */
                         thread_mask |= old->thread_mask;
                         old_ptr = &old->next;
                         old = *old_ptr;
@@ -993,14 +998,41 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         }
 
         /*
-         * Setup the thread mask for this irqaction. Unlikely to have
-         * 32 resp 64 irqs sharing one line, but who knows.
+         * Setup the thread mask for this irqaction for ONESHOT. For
+         * !ONESHOT irqs the thread mask is 0 so we can avoid a
+         * conditional in irq_wake_thread().
          */
-        if (new->flags & IRQF_ONESHOT && thread_mask == ~0UL) {
-                ret = -EBUSY;
-                goto out_mask;
+        if (new->flags & IRQF_ONESHOT) {
+                /*
+                 * Unlikely to have 32 resp 64 irqs sharing one line,
+                 * but who knows.
+                 */
+                if (thread_mask == ~0UL) {
+                        ret = -EBUSY;
+                        goto out_mask;
+                }
+                /*
+                 * The thread_mask for the action is or'ed to
+                 * desc->thread_active to indicate that the
+                 * IRQF_ONESHOT thread handler has been woken, but not
+                 * yet finished. The bit is cleared when a thread
+                 * completes. When all threads of a shared interrupt
+                 * line have completed desc->threads_active becomes
+                 * zero and the interrupt line is unmasked. See
+                 * handle.c:irq_wake_thread() for further information.
+                 *
+                 * If no thread is woken by primary (hard irq context)
+                 * interrupt handlers, then desc->threads_active is
+                 * also checked for zero to unmask the irq line in the
+                 * affected hard irq flow handlers
+                 * (handle_[fasteoi|level]_irq).
+                 *
+                 * The new action gets the first zero bit of
+                 * thread_mask assigned. See the loop above which or's
+                 * all existing action->thread_mask bits.
+                 */
+                new->thread_mask = 1 << ffz(thread_mask);
         }
-        new->thread_mask = 1 << ffz(thread_mask);
 
         if (!shared) {
                 init_waitqueue_head(&desc->wait_for_threads);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9788c0ec6f43..c62b8546cc90 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1334,8 +1334,10 @@ int __kprobes register_kprobe(struct kprobe *p)
         if (!kernel_text_address((unsigned long) p->addr) ||
             in_kprobes_functions((unsigned long) p->addr) ||
             ftrace_text_reserved(p->addr, p->addr) ||
-            jump_label_text_reserved(p->addr, p->addr))
-                goto fail_with_jump_label;
+            jump_label_text_reserved(p->addr, p->addr)) {
+                ret = -EINVAL;
+                goto cannot_probe;
+        }
 
         /* User can pass only KPROBE_FLAG_DISABLED to register_kprobe */
         p->flags &= KPROBE_FLAG_DISABLED;
@@ -1352,7 +1354,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                  * its code to prohibit unexpected unloading.
                  */
                 if (unlikely(!try_module_get(probed_mod)))
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
 
                 /*
                  * If the module freed .init.text, we couldn't insert
@@ -1361,7 +1363,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                 if (within_module_init((unsigned long)p->addr, probed_mod) &&
                     probed_mod->state != MODULE_STATE_COMING) {
                         module_put(probed_mod);
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
                 }
                 /* ret will be updated by following code */
         }
@@ -1409,7 +1411,7 @@ out:
 
         return ret;
 
-fail_with_jump_label:
+cannot_probe:
         preempt_enable();
         jump_label_unlock();
         return ret;
diff --git a/kernel/printk.c b/kernel/printk.c
index 13c0a1143f49..32690a0b7a18 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -702,6 +702,9 @@ static bool printk_time = 0;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
 
+static bool always_kmsg_dump;
+module_param_named(always_kmsg_dump, always_kmsg_dump, bool, S_IRUGO | S_IWUSR);
+
 /* Check if we have any console registered that can be called early in boot. */
 static int have_callable_console(void)
 {
@@ -1732,6 +1735,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
         unsigned long l1, l2;
         unsigned long flags;
 
+        if ((reason > KMSG_DUMP_OOPS) && !always_kmsg_dump)
+                return;
+
         /* Theoretically, the log could move on after we do this, but
            there's not a lot we can do about that. The new messages
            will overwrite the start of what we dump. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 33a0676ea744..b342f57879e6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -6728,7 +6728,7 @@ int __init sched_create_sysfs_power_savings_entries(struct device *dev)
 static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
                              void *hcpu)
 {
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_ONLINE:
         case CPU_DOWN_FAILED:
                 cpuset_update_active_cpus();
@@ -6741,7 +6741,7 @@ static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
 static int cpuset_cpu_inactive(struct notifier_block *nfb, unsigned long action,
                                void *hcpu)
 {
-        switch (action) {
+        switch (action & ~CPU_TASKS_FROZEN) {
         case CPU_DOWN_PREPARE:
                 cpuset_update_active_cpus();
                 return NOTIFY_OK;
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 77cb245f8e7b..0ab9ae8057f0 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -818,17 +818,9 @@ static int __init fixup_activate(void *addr, enum debug_obj_state state)
                 if (obj->static_init == 1) {
                         debug_object_init(obj, &descr_type_test);
                         debug_object_activate(obj, &descr_type_test);
-                        /*
-                         * Real code should return 0 here ! This is
-                         * not a fixup of some bad behaviour. We
-                         * merily call the debug_init function to keep
-                         * track of the object.
-                         */
-                        return 1;
-                } else {
-                        /* Real code needs to emit a warning here */
+                        return 0;
                 }
-                return 0;
+                return 1;
 
         case ODEBUG_STATE_ACTIVE:
                 debug_object_deactivate(obj, &descr_type_test);
@@ -967,7 +959,7 @@ static void __init debug_objects_selftest(void)
 
         obj.static_init = 1;
         debug_object_activate(&obj, &descr_type_test);
-        if (check_results(&obj, ODEBUG_STATE_ACTIVE, ++fixups, warnings))
+        if (check_results(&obj, ODEBUG_STATE_ACTIVE, fixups, warnings))
                 goto out;
         debug_object_init(&obj, &descr_type_test);
         if (check_results(&obj, ODEBUG_STATE_INIT, ++fixups, ++warnings))
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 8e75003d62f6..38e612e66da5 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -891,9 +891,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
         case 'U':
                 return uuid_string(buf, end, ptr, spec, fmt);
         case 'V':
-                return buf + vsnprintf(buf, end > buf ? end - buf : 0,
-                                       ((struct va_format *)ptr)->fmt,
-                                       *(((struct va_format *)ptr)->va));
+                {
+                        va_list va;
+
+                        va_copy(va, *((struct va_format *)ptr)->va);
+                        buf += vsnprintf(buf, end > buf ? end - buf : 0,
+                                         ((struct va_format *)ptr)->fmt, va);
+                        va_end(va);
+                        return buf;
+                }
         case 'K':
                 /*
                  * %pK cannot be used in IRQ context because its test
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 91d3efb25d15..8f7fc394f636 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
                 set_pmd_at(mm, haddr, pmd, entry);
                 prepare_pmd_huge_pte(pgtable, mm);
                 add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                mm->nr_ptes++;
                 spin_unlock(&mm->page_table_lock);
         }
 
@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         pmd = pmd_mkold(pmd_wrprotect(pmd));
         set_pmd_at(dst_mm, addr, dst_pmd, pmd);
         prepare_pmd_huge_pte(pgtable, dst_mm);
+        dst_mm->nr_ptes++;
 
         ret = 0;
 out_unlock:
@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
         }
         kfree(pages);
 
-        mm->nr_ptes++;
         smp_wmb(); /* make pte visible before pmd */
         pmd_populate(mm, pmd, pgtable);
         page_remove_rmap(page);
@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                         VM_BUG_ON(page_mapcount(page) < 0);
                         add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
                         VM_BUG_ON(!PageHead(page));
+                        tlb->mm->nr_ptes--;
                         spin_unlock(&tlb->mm->page_table_lock);
                         tlb_remove_page(tlb, page);
                         pte_free(tlb->mm, pgtable);
@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
                         pte_unmap(pte);
                 }
 
-                mm->nr_ptes++;
                 smp_wmb(); /* make pte visible before pmd */
                 /*
                  * Up to this point the pmd is present and huge and
@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         set_pmd_at(mm, address, pmd, _pmd);
         update_mmu_cache(vma, address, _pmd);
         prepare_pmd_huge_pte(pgtable, mm);
-        mm->nr_ptes--;
         spin_unlock(&mm->page_table_lock);
 
 #ifndef CONFIG_NUMA
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5f34bd8dda34..a876871f6be5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                         set_page_dirty(page);
                 list_add(&page->lru, &page_list);
         }
-        spin_unlock(&mm->page_table_lock);
         flush_tlb_range(vma, start, end);
+        spin_unlock(&mm->page_table_lock);
         mmu_notifier_invalidate_range_end(mm, start, end);
         list_for_each_entry_safe(page, tmp, &page_list, lru) {
                 page_remove_rmap(page);
diff --git a/mm/ksm.c b/mm/ksm.c
index 1925ffbfb27f..310544a379ae 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -28,7 +28,6 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/memcontrol.h>
 #include <linux/rbtree.h>
 #include <linux/memory.h>
 #include <linux/mmu_notifier.h>
@@ -1572,16 +1571,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
 
         new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
         if (new_page) {
-                /*
-                 * The memcg-specific accounting when moving
-                 * pages around the LRU lists relies on the
-                 * page's owner (memcg) to be valid.  Usually,
-                 * pages are assigned to a new owner before
-                 * being put on the LRU list, but since this
-                 * is not the case here, the stale owner from
-                 * a previous allocation cycle must be reset.
-                 */
-                mem_cgroup_reset_owner(new_page);
                 copy_user_highpage(new_page, page, address, vma);
 
                 SetPageDirty(new_page);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 228d6461c12a..d0e57a3cda18 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1042,6 +1042,19 @@ struct lruvec *mem_cgroup_lru_add_list(struct zone *zone, struct page *page,
 
         pc = lookup_page_cgroup(page);
         memcg = pc->mem_cgroup;
+
+        /*
+         * Surreptitiously switch any uncharged page to root:
+         * an uncharged page off lru does nothing to secure
+         * its former mem_cgroup from sudden removal.
+         *
+         * Our caller holds lru_lock, and PageCgroupUsed is updated
+         * under page_cgroup lock: between them, they make all uses
+         * of pc->mem_cgroup safe.
+         */
+        if (!PageCgroupUsed(pc) && memcg != root_mem_cgroup)
+                pc->mem_cgroup = memcg = root_mem_cgroup;
+
         mz = page_cgroup_zoneinfo(memcg, page);
         /* compound_order() is stabilized through lru_lock */
         MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
@@ -2408,8 +2421,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                        struct page *page,
                                        unsigned int nr_pages,
                                        struct page_cgroup *pc,
-                                       enum charge_type ctype)
+                                       enum charge_type ctype,
+                                       bool lrucare)
 {
+        struct zone *uninitialized_var(zone);
+        bool was_on_lru = false;
+
         lock_page_cgroup(pc);
         if (unlikely(PageCgroupUsed(pc))) {
                 unlock_page_cgroup(pc);
@@ -2420,6 +2437,21 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
          * we don't need page_cgroup_lock about tail pages, becase they are not
          * accessed by any other context at this point.
          */
+
+        /*
+         * In some cases, SwapCache and FUSE(splice_buf->radixtree), the page
+         * may already be on some other mem_cgroup's LRU.  Take care of it.
+         */
+        if (lrucare) {
+                zone = page_zone(page);
+                spin_lock_irq(&zone->lru_lock);
+                if (PageLRU(page)) {
+                        ClearPageLRU(page);
+                        del_page_from_lru_list(zone, page, page_lru(page));
+                        was_on_lru = true;
+                }
+        }
+
         pc->mem_cgroup = memcg;
         /*
          * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2443,9 +2475,18 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                 break;
         }
 
+        if (lrucare) {
+                if (was_on_lru) {
+                        VM_BUG_ON(PageLRU(page));
+                        SetPageLRU(page);
+                        add_page_to_lru_list(zone, page, page_lru(page));
+                }
+                spin_unlock_irq(&zone->lru_lock);
+        }
+
         mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), nr_pages);
         unlock_page_cgroup(pc);
-        WARN_ON_ONCE(PageLRU(page));
+
         /*
          * "charge_statistics" updated event counter. Then, check it.
          * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
@@ -2643,7 +2684,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
         if (ret == -ENOMEM)
                 return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
         return 0;
 }
 
@@ -2663,35 +2704,6 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr,
                                         enum charge_type ctype);
 
-static void
-__mem_cgroup_commit_charge_lrucare(struct page *page, struct mem_cgroup *memcg,
-                                        enum charge_type ctype)
-{
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        struct zone *zone = page_zone(page);
-        unsigned long flags;
-        bool removed = false;
-
-        /*
-         * In some case, SwapCache, FUSE(splice_buf->radixtree), the page
-         * is already on LRU. It means the page may on some other page_cgroup's
-         * LRU. Take care of it.
-         */
-        spin_lock_irqsave(&zone->lru_lock, flags);
-        if (PageLRU(page)) {
-                del_page_from_lru_list(zone, page, page_lru(page));
-                ClearPageLRU(page);
-                removed = true;
-        }
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
-        if (removed) {
-                add_page_to_lru_list(zone, page, page_lru(page));
-                SetPageLRU(page);
-        }
-        spin_unlock_irqrestore(&zone->lru_lock, flags);
-        return;
-}
-
 int mem_cgroup_cache_charge(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask)
 {
@@ -2769,13 +2781,16 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                         enum charge_type ctype)
 {
+        struct page_cgroup *pc;
+
         if (mem_cgroup_disabled())
                 return;
         if (!memcg)
                 return;
         cgroup_exclude_rmdir(&memcg->css);
 
-        __mem_cgroup_commit_charge_lrucare(page, memcg, ctype);
+        pc = lookup_page_cgroup(page);
+        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
@@ -3027,23 +3042,6 @@ void mem_cgroup_uncharge_end(void)
         batch->memcg = NULL;
 }
 
-/*
- * A function for resetting pc->mem_cgroup for newly allocated pages.
- * This function should be called if the newpage will be added to LRU
- * before start accounting.
- */
-void mem_cgroup_reset_owner(struct page *newpage)
-{
-        struct page_cgroup *pc;
-
-        if (mem_cgroup_disabled())
-                return;
-
-        pc = lookup_page_cgroup(newpage);
-        VM_BUG_ON(PageCgroupUsed(pc));
-        pc->mem_cgroup = root_mem_cgroup;
-}
-
 #ifdef CONFIG_SWAP
 /*
  * called after __delete_from_swap_cache() and drop "page" account.
@@ -3248,7 +3246,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
         return ret;
 }
 
@@ -3332,7 +3330,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
          * the newpage may be on LRU(or pagevec for LRU) already. We lock
          * LRU while we overwrite pc->mem_cgroup.
          */
-        __mem_cgroup_commit_charge_lrucare(newpage, memcg, type);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
 }
 
 #ifdef CONFIG_DEBUG_VM
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 06b145fb64ab..47296fee23db 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -640,10 +640,11 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
         unsigned long vmstart;
         unsigned long vmend;
 
-        vma = find_vma_prev(mm, start, &prev);
+        vma = find_vma(mm, start);
         if (!vma || vma->vm_start > start)
                 return -EFAULT;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index df141f60289e..1503b6b54ecb 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -839,8 +839,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         if (!newpage)
                 return -ENOMEM;
 
-        mem_cgroup_reset_owner(newpage);
-
         if (page_count(page) == 1) {
                 /* page was freed from under us. So we are done. */
                 goto out;
diff --git a/mm/mlock.c b/mm/mlock.c
index 4f4f53bdc65d..ef726e8aa8e9 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -385,10 +385,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
                 return -EINVAL;
         if (end == start)
                 return 0;
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         if (!vma || vma->vm_start > start)
                 return -ENOMEM;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f758c7f4c81..da15a79b1441 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1266,8 +1266,9 @@ munmap_back:
         vma->vm_pgoff = pgoff;
         INIT_LIST_HEAD(&vma->anon_vma_chain);
 
+        error = -EINVAL;        /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
+
         if (file) {
-                error = -EINVAL;
                 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
                         goto free_vma;
                 if (vm_flags & VM_DENYWRITE) {
@@ -1293,6 +1294,8 @@ munmap_back:
                 pgoff = vma->vm_pgoff;
                 vm_flags = vma->vm_flags;
         } else if (vm_flags & VM_SHARED) {
+                if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
+                        goto free_vma;
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
@@ -1605,7 +1608,6 @@ EXPORT_SYMBOL(find_vma);
 
 /*
  * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
- * Note: pprev is set to NULL when return value is NULL.
  */
 struct vm_area_struct *
 find_vma_prev(struct mm_struct *mm, unsigned long addr,
@@ -1614,7 +1616,16 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
         struct vm_area_struct *vma;
 
         vma = find_vma(mm, addr);
-        *pprev = vma ? vma->vm_prev : NULL;
+        if (vma) {
+                *pprev = vma->vm_prev;
+        } else {
+                struct rb_node *rb_node = mm->mm_rb.rb_node;
+                *pprev = NULL;
+                while (rb_node) {
+                        *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+                        rb_node = rb_node->rb_right;
+                }
+        }
         return vma;
 }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 5a688a2756be..f437d054c3bf 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -262,10 +262,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
 
         down_write(&current->mm->mmap_sem);
 
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         error = -ENOMEM;
         if (!vma)
                 goto out;
+        prev = vma->vm_prev;
         if (unlikely(grows & PROT_GROWSDOWN)) {
                 if (vma->vm_start >= end)
                         goto out;
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index de1616aa9b1e..1ccbd714059c 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_cgroup(swp_entry_t ent,
         pgoff_t offset = swp_offset(ent);
         struct swap_cgroup_ctrl *ctrl;
         struct page *mappage;
+        struct swap_cgroup *sc;
 
         ctrl = &swap_cgroup_ctrl[swp_type(ent)];
         if (ctrlp)
                 *ctrlp = ctrl;
 
         mappage = ctrl->map[offset / SC_PER_PAGE];
-        return page_address(mappage) + offset % SC_PER_PAGE;
+        sc = page_address(mappage);
+        return sc + offset % SC_PER_PAGE;
 }
 
 /**
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 12a48a88c0d8..405d331804c3 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -184,8 +184,7 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
                                    page_end - page_start);
         }
 
-        for (i = page_start; i < page_end; i++)
-                __clear_bit(i, populated);
+        bitmap_clear(populated, page_start, page_end - page_start);
 }
 
 /**
diff --git a/mm/swap.c b/mm/swap.c
index fff1ff7fb9ad..14380e9fbe33 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -652,7 +652,7 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct zone* zone,
                        struct page *page, struct page *page_tail)
 {
-        int active;
+        int uninitialized_var(active);
         enum lru_list lru;
         const int file = 0;
 
@@ -672,7 +672,6 @@ void lru_add_page_tail(struct zone* zone,
                         active = 0;
                         lru = LRU_INACTIVE_ANON;
                 }
-                update_page_reclaim_stat(zone, page_tail, file, active);
         } else {
                 SetPageUnevictable(page_tail);
                 lru = LRU_UNEVICTABLE;
@@ -693,6 +692,9 @@ void lru_add_page_tail(struct zone* zone,
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
+
+        if (!PageUnevictable(page))
+                update_page_reclaim_stat(zone, page_tail, file, active);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -710,8 +712,8 @@ static void __pagevec_lru_add_fn(struct page *page, void *arg)
         SetPageLRU(page);
         if (active)
                 SetPageActive(page);
-        update_page_reclaim_stat(zone, page, file, active);
         add_page_to_lru_list(zone, page, lru);
+        update_page_reclaim_stat(zone, page, file, active);
 }
 
 /*
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 470038a91873..ea6b32d61873 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -300,16 +300,6 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                         new_page = alloc_page_vma(gfp_mask, vma, addr);
                         if (!new_page)
                                 break;          /* Out of memory */
-                        /*
-                         * The memcg-specific accounting when moving
-                         * pages around the LRU lists relies on the
-                         * page's owner (memcg) to be valid.  Usually,
-                         * pages are assigned to a new owner before
-                         * being put on the LRU list, but since this
-                         * is not the case here, the stale owner from
-                         * a previous allocation cycle must be reset.
-                         */
-                        mem_cgroup_reset_owner(new_page);
                 }
 
                 /*
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 568d5bf17534..702a1ae9220b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                           &ip6h->saddr);
+        if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                               &ip6h->saddr)) {
+                kfree_skb(skb);
+                return NULL;
+        }
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 84122472656c..dec4f3817133 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -62,6 +62,15 @@ static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #define brnf_filter_pppoe_tagged 0
 #endif
 
+#define IS_IP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
+
+#define IS_IPV6(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
+
+#define IS_ARP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
+
 static inline __be16 vlan_proto(const struct sk_buff *skb)
 {
         if (vlan_tx_tag_present(skb))
@@ -639,8 +648,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                 return NF_DROP;
         br = p->br;
 
-        if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-            IS_PPPOE_IPV6(skb)) {
+        if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
                 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
                         return NF_ACCEPT;
 
@@ -651,8 +659,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
         if (!brnf_call_iptables && !br->nf_call_iptables)
                 return NF_ACCEPT;
 
-        if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb) &&
-            !IS_PPPOE_IP(skb))
+        if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
                 return NF_ACCEPT;
 
         nf_bridge_pull_encap_header_rcsum(skb);
@@ -701,7 +708,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
         struct net_device *in;
 
-        if (skb->protocol != htons(ETH_P_ARP) && !IS_VLAN_ARP(skb)) {
+        if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
                 in = nf_bridge->physindev;
                 if (nf_bridge->mask & BRNF_PKT_TYPE) {
                         skb->pkt_type = PACKET_OTHERHOST;
@@ -718,6 +725,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
         return 0;
 }
 
+
 /* This is the 'purely bridged' case.  For IP, we pass the packet to
  * netfilter with indev and outdev set to the bridge device,
  * but we are still able to filter on the 'real' indev/outdev
@@ -744,11 +752,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
         if (!parent)
                 return NF_DROP;
 
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
-            IS_PPPOE_IP(skb))
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-                 IS_PPPOE_IPV6(skb))
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
         else
                 return NF_ACCEPT;
@@ -795,7 +801,7 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
         if (!brnf_call_arptables && !br->nf_call_arptables)
                 return NF_ACCEPT;
 
-        if (skb->protocol != htons(ETH_P_ARP)) {
+        if (!IS_ARP(skb)) {
                 if (!IS_VLAN_ARP(skb))
                         return NF_ACCEPT;
                 nf_bridge_pull_encap_header(skb);
@@ -853,11 +859,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
         if (!realoutdev)
                 return NF_DROP;
 
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
-            IS_PPPOE_IP(skb))
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-                 IS_PPPOE_IPV6(skb))
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
         else
                 return NF_ACCEPT;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index dd147d78a588..8c836d96ba76 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -17,9 +17,9 @@
 #include "br_private_stp.h"
 
 /* since time values in bpdu are in jiffies and then scaled (1/256)
- * before sending, make sure that is at least one.
+ * before sending, make sure that is at least one STP tick.
  */
-#define MESSAGE_AGE_INCR        ((HZ < 256) ? 1 : (HZ/256))
+#define MESSAGE_AGE_INCR        ((HZ / 256) + 1)
 
 static const char *const br_port_state_names[] = {
         [BR_STATE_DISABLED] = "disabled",
@@ -31,7 +31,7 @@ static const char *const br_port_state_names[] = {
 
 void br_log_state(const struct net_bridge_port *p)
 {
-        br_info(p->br, "port %u(%s) entering %s state\n",
+        br_info(p->br, "port %u(%s) entered %s state\n",
                 (unsigned) p->port_no, p->dev->name,
                 br_port_state_names[p->state]);
 }
@@ -186,7 +186,7 @@ static void br_record_config_information(struct net_bridge_port *p,
         p->designated_cost = bpdu->root_path_cost;
         p->designated_bridge = bpdu->bridge_id;
         p->designated_port = bpdu->port_id;
-        p->designated_age = jiffies + bpdu->message_age;
+        p->designated_age = jiffies - bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
                   + (p->br->max_age - bpdu->message_age));
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 19308e305d85..f494496373d6 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -98,14 +98,13 @@ void br_stp_disable_port(struct net_bridge_port *p)
         struct net_bridge *br = p->br;
         int wasroot;
 
-        br_log_state(p);
-
         wasroot = br_is_root_bridge(br);
         br_become_designated_port(p);
         p->state = BR_STATE_DISABLED;
         p->topology_change_ack = 0;
         p->config_pending = 0;
 
+        br_log_state(p);
         br_ifinfo_notify(RTM_NEWLINK, p);
 
         del_timer(&p->message_age_timer);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5864cc491369..5fe2ff3b01ef 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1335,7 +1335,12 @@ static inline int ebt_make_matchname(const struct ebt_entry_match *m,
     const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)m - base);
-        if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+
+        /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
+           long. Copy 29 bytes and fill remaining bytes with zeroes. */
+        strncpy(name, m->u.match->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1344,7 +1349,10 @@ static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
     const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)w - base);
-        if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+
+        strncpy(name, w->u.watcher->name, sizeof(name));
+        if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1355,6 +1363,7 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
         int ret;
         char __user *hlp;
         const struct ebt_entry_target *t;
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
 
         if (e->bitmask == 0)
                 return 0;
@@ -1368,7 +1377,8 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
         if (ret != 0)
                 return ret;
-        if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
+        strncpy(name, t->u.target->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1893,10 +1903,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
 
         switch (compat_mwt) {
         case EBT_COMPAT_MATCH:
-                match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (match == NULL)
-                        return -ENOENT;
+                match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(match))
                         return PTR_ERR(match);
 
@@ -1915,10 +1922,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
                 break;
         case EBT_COMPAT_WATCHER: /* fallthrough */
         case EBT_COMPAT_TARGET:
-                wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (wt == NULL)
-                        return -ENOENT;
+                wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(wt))
                         return PTR_ERR(wt);
                 off = xt_compat_target_offset(wt);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 606a6e8f3671..f965dce6f20f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1060,11 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
-        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
-                    ifla_policy);
+        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
 
-        if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
 
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
@@ -1900,10 +1901,11 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
         u32 ext_filter_mask = 0;
         u16 min_ifinfo_dump_size = 0;
 
-        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
-
-        if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
 
         if (!ext_filter_mask)
                 return NLMSG_GOODSIZE;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index bf4a9c4808e1..d4d61b694fab 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/net.h>
+#include <linux/workqueue.h>
 #include <net/ip.h>
 #include <net/inetpeer.h>
 #include <net/secure_seq.h>
@@ -66,6 +67,11 @@
 
 static struct kmem_cache *peer_cachep __read_mostly;
 
+static LIST_HEAD(gc_list);
+static const int gc_delay = 60 * HZ;
+static struct delayed_work gc_work;
+static DEFINE_SPINLOCK(gc_lock);
+
 #define node_height(x) x->avl_height
 
 #define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
@@ -102,6 +108,50 @@ int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries m
 int inet_peer_minttl __read_mostly = 120 * HZ;  /* TTL under high load: 120 sec */
 int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;      /* usual time to live: 10 min */
 
+static void inetpeer_gc_worker(struct work_struct *work)
+{
+        struct inet_peer *p, *n;
+        LIST_HEAD(list);
+
+        spin_lock_bh(&gc_lock);
+        list_replace_init(&gc_list, &list);
+        spin_unlock_bh(&gc_lock);
+
+        if (list_empty(&list))
+                return;
+
+        list_for_each_entry_safe(p, n, &list, gc_list) {
+
+                if(need_resched())
+                        cond_resched();
+
+                if (p->avl_left != peer_avl_empty) {
+                        list_add_tail(&p->avl_left->gc_list, &list);
+                        p->avl_left = peer_avl_empty;
+                }
+
+                if (p->avl_right != peer_avl_empty) {
+                        list_add_tail(&p->avl_right->gc_list, &list);
+                        p->avl_right = peer_avl_empty;
+                }
+
+                n = list_entry(p->gc_list.next, struct inet_peer, gc_list);
+
+                if (!atomic_read(&p->refcnt)) {
+                        list_del(&p->gc_list);
+                        kmem_cache_free(peer_cachep, p);
+                }
+        }
+
+        if (list_empty(&list))
+                return;
+
+        spin_lock_bh(&gc_lock);
+        list_splice(&list, &gc_list);
+        spin_unlock_bh(&gc_lock);
+
+        schedule_delayed_work(&gc_work, gc_delay);
+}
 
 /* Called from ip_output.c:ip_init  */
 void __init inet_initpeers(void)
@@ -126,6 +176,7 @@ void __init inet_initpeers(void)
                         0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                         NULL);
 
+        INIT_DELAYED_WORK_DEFERRABLE(&gc_work, inetpeer_gc_worker);
 }
 
 static int addr_compare(const struct inetpeer_addr *a,
@@ -447,9 +498,8 @@ relookup:
                 p->rate_last = 0;
                 p->pmtu_expires = 0;
                 p->pmtu_orig = 0;
-                p->redirect_genid = 0;
                 memset(&p->redirect_learned, 0, sizeof(p->redirect_learned));
-
+                INIT_LIST_HEAD(&p->gc_list);
 
                 /* Link the node. */
                 link_to_pool(p, base);
@@ -509,3 +559,30 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
         return rc;
 }
 EXPORT_SYMBOL(inet_peer_xrlim_allow);
+
+void inetpeer_invalidate_tree(int family)
+{
+        struct inet_peer *old, *new, *prev;
+        struct inet_peer_base *base = family_to_base(family);
+
+        write_seqlock_bh(&base->lock);
+
+        old = base->root;
+        if (old == peer_avl_empty_rcu)
+                goto out;
+
+        new = peer_avl_empty_rcu;
+
+        prev = cmpxchg(&base->root, old, new);
+        if (prev == old) {
+                base->total = 0;
+                spin_lock(&gc_lock);
+                list_add_tail(&prev->gc_list, &gc_list);
+                spin_unlock(&gc_lock);
+                schedule_delayed_work(&gc_work, gc_delay);
+        }
+
+out:
+        write_sequnlock_bh(&base->lock);
+}
+EXPORT_SYMBOL(inetpeer_invalidate_tree);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bcacf54e5418..019774796174 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -132,7 +132,6 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int rt_chain_length_max __read_mostly    = 20;
-static int redirect_genid;
 
 static struct delayed_work expires_work;
 static unsigned long expires_ljiffies;
@@ -937,7 +936,7 @@ static void rt_cache_invalidate(struct net *net)
 
         get_random_bytes(&shuffle, sizeof(shuffle));
         atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-        redirect_genid++;
+        inetpeer_invalidate_tree(AF_INET);
 }
 
 /*
@@ -1485,10 +1484,8 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 
                                 peer = rt->peer;
                                 if (peer) {
-                                        if (peer->redirect_learned.a4 != new_gw ||
-                                            peer->redirect_genid != redirect_genid) {
+                                        if (peer->redirect_learned.a4 != new_gw) {
                                                 peer->redirect_learned.a4 = new_gw;
-                                                peer->redirect_genid = redirect_genid;
                                                 atomic_inc(&__rt_peer_genid);
                                         }
                                         check_peer_redir(&rt->dst, peer);
@@ -1793,8 +1790,6 @@ static void ipv4_validate_peer(struct rtable *rt)
                 if (peer) {
                         check_peer_pmtu(&rt->dst, peer);
 
-                        if (peer->redirect_genid != redirect_genid)
-                                peer->redirect_learned.a4 = 0;
                         if (peer->redirect_learned.a4 &&
                             peer->redirect_learned.a4 != rt->rt_gateway)
                                 check_peer_redir(&rt->dst, peer);
@@ -1958,8 +1953,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                 dst_init_metrics(&rt->dst, peer->metrics, false);
 
                 check_peer_pmtu(&rt->dst, peer);
-                if (peer->redirect_genid != redirect_genid)
-                        peer->redirect_learned.a4 = 0;
+
                 if (peer->redirect_learned.a4 &&
                     peer->redirect_learned.a4 != rt->rt_gateway) {
                         rt->rt_gateway = peer->redirect_learned.a4;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53c8ce4046b2..b5e315f13641 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1403,8 +1403,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         BUG_ON(!pcount);
 
-        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
-        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
+        /* Adjust counters and hints for the newly sacked sequence
+         * range but discard the return value since prev is already
+         * marked. We must tag the range first because the seq
+         * advancement below implicitly advances
+         * tcp_highest_sack_seq() when skb is highest_sack.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
+
+        if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1430,12 +1438,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* Adjust counters and hints for the newly sacked sequence range but
-         * discard the return value since prev is already marked.
-         */
-        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                        start_seq, end_seq, dup_sack, pcount);
-
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
 
@@ -1583,6 +1585,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
+        if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+                goto fallback;
+
         if (!skb_shift(prev, skb, len))
                 goto fallback;
         if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
@@ -2567,6 +2573,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 
                 if (cnt > packets) {
                         if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c02280a4d126..6b8ebc5da0e1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
+        /* Join all-router multicast group if forwarding is set */
+        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
+
         return ndev;
 }
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01a21c2f6ab3..8e2137bd87e2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1332,6 +1332,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 hw_roc = true;
 
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
                 if (sdata->old_idle == sdata->vif.bss_conf.idle)
                         continue;
                 if (!ieee80211_sdata_running(sdata))
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index ad64f4d5271a..f9b8e819ca63 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -344,7 +344,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 info->control.rates[i].idx = -1;
                 info->control.rates[i].flags = 0;
-                info->control.rates[i].count = 1;
+                info->control.rates[i].count = 0;
         }
 
         if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ed86a3be678e..fa4b82c8ae80 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -635,8 +635,12 @@ static noinline int early_drop(struct net *net, unsigned int hash)
 
         if (del_timer(&ct->timeout)) {
                 death_by_timeout((unsigned long)ct);
-                dropped = 1;
-                NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                /* Check if we indeed killed this entry. Reliable event
+                   delivery may have inserted it into the dying list. */
+                if (test_bit(IPS_DYING_BIT, &ct->status)) {
+                        dropped = 1;
+                        NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                }
         }
         nf_ct_put(ct);
         return dropped;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 30c9d4ca0218..10687692831e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1041,16 +1041,13 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
         if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                 rcu_read_unlock();
-                spin_unlock_bh(&nf_conntrack_lock);
                 nfnl_unlock();
                 if (request_module("nf-nat-ipv4") < 0) {
                         nfnl_lock();
-                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         return -EOPNOTSUPP;
                 }
                 nfnl_lock();
-                spin_lock_bh(&nf_conntrack_lock);
                 rcu_read_lock();
                 if (nfnetlink_parse_nat_setup_hook)
                         return -EAGAIN;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 2725d1bdf291..48badffaafc1 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira Networks.
+ * Copyright (c) 2007-2012 Nicira Networks.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -145,9 +145,16 @@ static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
                         inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
                                                  *addr, new_addr, 1);
         } else if (nh->protocol == IPPROTO_UDP) {
-                if (likely(transport_len >= sizeof(struct udphdr)))
-                        inet_proto_csum_replace4(&udp_hdr(skb)->check, skb,
-                                                 *addr, new_addr, 1);
+                if (likely(transport_len >= sizeof(struct udphdr))) {
+                        struct udphdr *uh = udp_hdr(skb);
+
+                        if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+                                inet_proto_csum_replace4(&uh->check, skb,
+                                                         *addr, new_addr, 1);
+                                if (!uh->check)
+                                        uh->check = CSUM_MANGLED_0;
+                        }
+                }
         }
 
         csum_replace4(&nh->check, *addr, new_addr);
@@ -197,8 +204,22 @@ static void set_tp_port(struct sk_buff *skb, __be16 *port,
         skb->rxhash = 0;
 }
 
-static int set_udp_port(struct sk_buff *skb,
-                        const struct ovs_key_udp *udp_port_key)
+static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
+{
+        struct udphdr *uh = udp_hdr(skb);
+
+        if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
+                set_tp_port(skb, port, new_port, &uh->check);
+
+                if (!uh->check)
+                        uh->check = CSUM_MANGLED_0;
+        } else {
+                *port = new_port;
+                skb->rxhash = 0;
+        }
+}
+
+static int set_udp(struct sk_buff *skb, const struct ovs_key_udp *udp_port_key)
 {
         struct udphdr *uh;
         int err;
@@ -210,16 +231,15 @@ static int set_udp_port(struct sk_buff *skb,
 
         uh = udp_hdr(skb);
         if (udp_port_key->udp_src != uh->source)
-                set_tp_port(skb, &uh->source, udp_port_key->udp_src, &uh->check);
+                set_udp_port(skb, &uh->source, udp_port_key->udp_src);
 
         if (udp_port_key->udp_dst != uh->dest)
-                set_tp_port(skb, &uh->dest, udp_port_key->udp_dst, &uh->check);
+                set_udp_port(skb, &uh->dest, udp_port_key->udp_dst);
 
         return 0;
 }
 
-static int set_tcp_port(struct sk_buff *skb,
-                        const struct ovs_key_tcp *tcp_port_key)
+static int set_tcp(struct sk_buff *skb, const struct ovs_key_tcp *tcp_port_key)
 {
         struct tcphdr *th;
         int err;
@@ -328,11 +348,11 @@ static int execute_set_action(struct sk_buff *skb,
                 break;
 
         case OVS_KEY_ATTR_TCP:
-                err = set_tcp_port(skb, nla_data(nested_attr));
+                err = set_tcp(skb, nla_data(nested_attr));
                 break;
 
         case OVS_KEY_ATTR_UDP:
-                err = set_udp_port(skb, nla_data(nested_attr));
+                err = set_udp(skb, nla_data(nested_attr));
                 break;
         }
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ce64c18b8c79..2c030505b335 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1521,6 +1521,9 @@ static struct vport *lookup_vport(struct ovs_header *ovs_header,
                 vport = ovs_vport_locate(nla_data(a[OVS_VPORT_ATTR_NAME]));
                 if (!vport)
                         return ERR_PTR(-ENODEV);
+                if (ovs_header->dp_ifindex &&
+                    ovs_header->dp_ifindex != get_dpifindex(vport->dp))
+                        return ERR_PTR(-ENODEV);
                 return vport;
         } else if (a[OVS_VPORT_ATTR_PORT_NO]) {
                 u32 port_no = nla_get_u32(a[OVS_VPORT_ATTR_PORT_NO]);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index f286bb8fda13..22c73b78ac6f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2068,12 +2068,16 @@ static int alc_build_controls(struct hda_codec *codec)
  */
 
 static void alc_init_special_input_src(struct hda_codec *codec);
+static int alc269_fill_coef(struct hda_codec *codec);
 
 static int alc_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
         unsigned int i;
 
+        if (codec->vendor_id == 0x10ec0269)
+                alc269_fill_coef(codec);
+
         alc_fix_pll(codec);
         alc_auto_init_amp(codec, spec->init_amp);
 
@@ -4367,6 +4371,7 @@ enum {
         ALC882_FIXUP_PB_M5210,
         ALC882_FIXUP_ACER_ASPIRE_7736,
         ALC882_FIXUP_ASUS_W90V,
+        ALC889_FIXUP_CD,
         ALC889_FIXUP_VAIO_TT,
         ALC888_FIXUP_EEE1601,
         ALC882_FIXUP_EAPD,
@@ -4494,6 +4499,13 @@ static const struct alc_fixup alc882_fixups[] = {
                         { }
                 }
         },
+        [ALC889_FIXUP_CD] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x1c, 0x993301f0 }, /* CD */
+                        { }
+                }
+        },
         [ALC889_FIXUP_VAIO_TT] = {
                 .type = ALC_FIXUP_PINS,
                 .v.pins = (const struct alc_pincfg[]) {
@@ -4650,6 +4662,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3", ALC889_FIXUP_CD),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -5467,8 +5480,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = {
 
 static int alc269_fill_coef(struct hda_codec *codec)
 {
+        struct alc_spec *spec = codec->spec;
         int val;
 
+        if (spec->codec_variant != ALC269_TYPE_ALC269VB)
+                return 0;
+
         if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
                 alc_write_coef_idx(codec, 0xf, 0x960b);
                 alc_write_coef_idx(codec, 0xe, 0x8817);
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index cc9f6c83d661..bc030a2088da 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -6333,6 +6333,7 @@ static int __devinit snd_hdspm_create_hwdep(struct snd_card *card,
 
         hw->ops.open = snd_hdspm_hwdep_dummy_op;
         hw->ops.ioctl = snd_hdspm_hwdep_ioctl;
+        hw->ops.ioctl_compat = snd_hdspm_hwdep_ioctl;
         hw->ops.release = snd_hdspm_hwdep_dummy_op;
 
         return 0;
diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
index c6012ff5bd3e..d23b19a59d83 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -367,7 +367,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .platform_name = "samsung-audio",
         .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
         .init = neo1973_wm8753_init,
         .ops = &neo1973_hifi_ops,
 },
@@ -376,7 +376,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .stream_name = "Voice",
         .cpu_dai_name = "dfbmcs320-pcm",
         .codec_dai_name = "wm8753-voice",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
         .ops = &neo1973_voice_ops,
 },
 };
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 0abfb18b911f..227b6ae99785 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -204,6 +204,9 @@ static void perf_record__open(struct perf_record *rec)
 
                 if (opts->group && pos != first)
                         group_fd = first->fd;
+fallback_missing_features:
+                if (opts->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                 attr->sample_id_all = opts->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -217,15 +220,23 @@ try_again:
                         } else if (err ==  ENODEV && opts->cpu_list) {
                                 die("No such device - did you specify"
                                         " an out-of-range profile CPU?\n");
-                        } else if (err == EINVAL && opts->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                opts->sample_id_all_avail = false;
-                                if (!opts->sample_time && !opts->raw_samples && !time_needed)
-                                        attr->sample_type &= ~PERF_SAMPLE_TIME;
-
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!opts->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        opts->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (opts->sample_id_all_avail) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        opts->sample_id_all_avail = false;
+                                        if (!opts->sample_time && !opts->raw_samples && !time_needed)
+                                                attr->sample_type &= ~PERF_SAMPLE_TIME;
+
+                                        goto retry_sample_id;
+                                }
                         }
 
                         /*
@@ -503,9 +514,9 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                         return err;
         }
 
-        if (!!rec->no_buildid
+        if (!rec->no_buildid
             && !perf_header__has_feat(&session->header, HEADER_BUILD_ID)) {
-                pr_err("Couldn't generating buildids. "
+                pr_err("Couldn't generate buildids. "
                        "Use --no-buildid to profile anyway.\n");
                 return -1;
         }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index dd162aa24baa..ecff31257eb3 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -857,6 +857,9 @@ static void perf_top__start_counters(struct perf_top *top)
                 attr->mmap = 1;
                 attr->comm = 1;
                 attr->inherit = top->inherit;
+fallback_missing_features:
+                if (top->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                 attr->sample_id_all = top->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -868,12 +871,20 @@ try_again:
                         if (err == EPERM || err == EACCES) {
                                 ui__error_paranoid();
                                 goto out_err;
-                        } else if (err == EINVAL && top->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                top->sample_id_all_avail = false;
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!top->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        top->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (top->sample_id_all_avail) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        top->sample_id_all_avail = false;
+                                        goto retry_sample_id;
+                                }
                         }
                         /*
                          * If it's cycles then fall back to hrtimer
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 64f8bee31ced..16e7d20eee83 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -199,6 +199,7 @@ struct perf_record_opts {
         bool         sample_address;
         bool         sample_time;
         bool         sample_id_all_avail;
+        bool         exclude_guest_missing;
         bool         system_wide;
         bool         period;
         unsigned int freq;
diff --git a/tools/perf/util/top.h b/tools/perf/util/top.h
index a248f3c2c60d..f2eab81435ae 100644
--- a/tools/perf/util/top.h
+++ b/tools/perf/util/top.h
@@ -34,6 +34,7 @@ struct perf_top {
         bool               inherit;
         bool               group;
         bool               sample_id_all_avail;
+        bool               exclude_guest_missing;
         bool               dump_symtab;
         const char         *cpu_list;
         struct hist_entry  *sym_filter_entry;
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 813141047fc2..fb25d1329218 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -6,7 +6,7 @@
  * XXX We need to find a better place for these things...
  */
 bool perf_host  = true;
-bool perf_guest = true;
+bool perf_guest = false;
 
 void event_attr_init(struct perf_event_attr *attr)
 {