317 files changed, 2925 insertions, 2082 deletions

diff --git a/Documentation/hwmon/sysfs-interface b/Documentation/hwmon/sysfs-interface
index ff45d1f837c8..48ceabedf55d 100644
--- a/Documentation/hwmon/sysfs-interface
+++ b/Documentation/hwmon/sysfs-interface
@@ -91,12 +91,11 @@ name		The chip name.
                 I2C devices get this attribute created automatically.
                 RO
 
-update_rate     The rate at which the chip will update readings.
+update_interval The interval at which the chip will update readings.
                 Unit: millisecond
                 RW
-                Some devices have a variable update rate. This attribute
-                can be used to change the update rate to the desired
-                frequency.
+                Some devices have a variable update rate or interval.
+                This attribute can be used to change it to the desired value.
 
 
 ************
diff --git a/Documentation/power/regulator/overview.txt b/Documentation/power/regulator/overview.txt
index 9363e056188a..8ed17587a74b 100644
--- a/Documentation/power/regulator/overview.txt
+++ b/Documentation/power/regulator/overview.txt
@@ -13,7 +13,7 @@ regulators (where voltage output is controllable) and current sinks (where
 current limit is controllable).
 
 (C) 2008  Wolfson Microelectronics PLC.
-Author: Liam Girdwood <lg@opensource.wolfsonmicro.com>
+Author: Liam Girdwood <lrg@slimlogic.co.uk>
 
 
 Nomenclature
diff --git a/Documentation/workqueue.txt b/Documentation/workqueue.txt
new file mode 100644
index 000000000000..e4498a2872c3
--- /dev/null
+++ b/Documentation/workqueue.txt
@@ -0,0 +1,380 @@
+
+Concurrency Managed Workqueue (cmwq)
+
+September, 2010         Tejun Heo <tj@kernel.org>
+                        Florian Mickler <florian@mickler.org>
+
+CONTENTS
+
+1. Introduction
+2. Why cmwq?
+3. The Design
+4. Application Programming Interface (API)
+5. Example Execution Scenarios
+6. Guidelines
+
+
+1. Introduction
+
+There are many cases where an asynchronous process execution context
+is needed and the workqueue (wq) API is the most commonly used
+mechanism for such cases.
+
+When such an asynchronous execution context is needed, a work item
+describing which function to execute is put on a queue.  An
+independent thread serves as the asynchronous execution context.  The
+queue is called workqueue and the thread is called worker.
+
+While there are work items on the workqueue the worker executes the
+functions associated with the work items one after the other.  When
+there is no work item left on the workqueue the worker becomes idle.
+When a new work item gets queued, the worker begins executing again.
+
+
+2. Why cmwq?
+
+In the original wq implementation, a multi threaded (MT) wq had one
+worker thread per CPU and a single threaded (ST) wq had one worker
+thread system-wide.  A single MT wq needed to keep around the same
+number of workers as the number of CPUs.  The kernel grew a lot of MT
+wq users over the years and with the number of CPU cores continuously
+rising, some systems saturated the default 32k PID space just booting
+up.
+
+Although MT wq wasted a lot of resource, the level of concurrency
+provided was unsatisfactory.  The limitation was common to both ST and
+MT wq albeit less severe on MT.  Each wq maintained its own separate
+worker pool.  A MT wq could provide only one execution context per CPU
+while a ST wq one for the whole system.  Work items had to compete for
+those very limited execution contexts leading to various problems
+including proneness to deadlocks around the single execution context.
+
+The tension between the provided level of concurrency and resource
+usage also forced its users to make unnecessary tradeoffs like libata
+choosing to use ST wq for polling PIOs and accepting an unnecessary
+limitation that no two polling PIOs can progress at the same time.  As
+MT wq don't provide much better concurrency, users which require
+higher level of concurrency, like async or fscache, had to implement
+their own thread pool.
+
+Concurrency Managed Workqueue (cmwq) is a reimplementation of wq with
+focus on the following goals.
+
+* Maintain compatibility with the original workqueue API.
+
+* Use per-CPU unified worker pools shared by all wq to provide
+  flexible level of concurrency on demand without wasting a lot of
+  resource.
+
+* Automatically regulate worker pool and level of concurrency so that
+  the API users don't need to worry about such details.
+
+
+3. The Design
+
+In order to ease the asynchronous execution of functions a new
+abstraction, the work item, is introduced.
+
+A work item is a simple struct that holds a pointer to the function
+that is to be executed asynchronously.  Whenever a driver or subsystem
+wants a function to be executed asynchronously it has to set up a work
+item pointing to that function and queue that work item on a
+workqueue.
+
+Special purpose threads, called worker threads, execute the functions
+off of the queue, one after the other.  If no work is queued, the
+worker threads become idle.  These worker threads are managed in so
+called thread-pools.
+
+The cmwq design differentiates between the user-facing workqueues that
+subsystems and drivers queue work items on and the backend mechanism
+which manages thread-pool and processes the queued work items.
+
+The backend is called gcwq.  There is one gcwq for each possible CPU
+and one gcwq to serve work items queued on unbound workqueues.
+
+Subsystems and drivers can create and queue work items through special
+workqueue API functions as they see fit. They can influence some
+aspects of the way the work items are executed by setting flags on the
+workqueue they are putting the work item on. These flags include
+things like CPU locality, reentrancy, concurrency limits and more. To
+get a detailed overview refer to the API description of
+alloc_workqueue() below.
+
+When a work item is queued to a workqueue, the target gcwq is
+determined according to the queue parameters and workqueue attributes
+and appended on the shared worklist of the gcwq.  For example, unless
+specifically overridden, a work item of a bound workqueue will be
+queued on the worklist of exactly that gcwq that is associated to the
+CPU the issuer is running on.
+
+For any worker pool implementation, managing the concurrency level
+(how many execution contexts are active) is an important issue.  cmwq
+tries to keep the concurrency at a minimal but sufficient level.
+Minimal to save resources and sufficient in that the system is used at
+its full capacity.
+
+Each gcwq bound to an actual CPU implements concurrency management by
+hooking into the scheduler.  The gcwq is notified whenever an active
+worker wakes up or sleeps and keeps track of the number of the
+currently runnable workers.  Generally, work items are not expected to
+hog a CPU and consume many cycles.  That means maintaining just enough
+concurrency to prevent work processing from stalling should be
+optimal.  As long as there are one or more runnable workers on the
+CPU, the gcwq doesn't start execution of a new work, but, when the
+last running worker goes to sleep, it immediately schedules a new
+worker so that the CPU doesn't sit idle while there are pending work
+items.  This allows using a minimal number of workers without losing
+execution bandwidth.
+
+Keeping idle workers around doesn't cost other than the memory space
+for kthreads, so cmwq holds onto idle ones for a while before killing
+them.
+
+For an unbound wq, the above concurrency management doesn't apply and
+the gcwq for the pseudo unbound CPU tries to start executing all work
+items as soon as possible.  The responsibility of regulating
+concurrency level is on the users.  There is also a flag to mark a
+bound wq to ignore the concurrency management.  Please refer to the
+API section for details.
+
+Forward progress guarantee relies on that workers can be created when
+more execution contexts are necessary, which in turn is guaranteed
+through the use of rescue workers.  All work items which might be used
+on code paths that handle memory reclaim are required to be queued on
+wq's that have a rescue-worker reserved for execution under memory
+pressure.  Else it is possible that the thread-pool deadlocks waiting
+for execution contexts to free up.
+
+
+4. Application Programming Interface (API)
+
+alloc_workqueue() allocates a wq.  The original create_*workqueue()
+functions are deprecated and scheduled for removal.  alloc_workqueue()
+takes three arguments - @name, @flags and @max_active.  @name is the
+name of the wq and also used as the name of the rescuer thread if
+there is one.
+
+A wq no longer manages execution resources but serves as a domain for
+forward progress guarantee, flush and work item attributes.  @flags
+and @max_active control how work items are assigned execution
+resources, scheduled and executed.
+
+@flags:
+
+  WQ_NON_REENTRANT
+
+        By default, a wq guarantees non-reentrance only on the same
+        CPU.  A work item may not be executed concurrently on the same
+        CPU by multiple workers but is allowed to be executed
+        concurrently on multiple CPUs.  This flag makes sure
+        non-reentrance is enforced across all CPUs.  Work items queued
+        to a non-reentrant wq are guaranteed to be executed by at most
+        one worker system-wide at any given time.
+
+  WQ_UNBOUND
+
+        Work items queued to an unbound wq are served by a special
+        gcwq which hosts workers which are not bound to any specific
+        CPU.  This makes the wq behave as a simple execution context
+        provider without concurrency management.  The unbound gcwq
+        tries to start execution of work items as soon as possible.
+        Unbound wq sacrifices locality but is useful for the following
+        cases.
+
+        * Wide fluctuation in the concurrency level requirement is
+          expected and using bound wq may end up creating large number
+          of mostly unused workers across different CPUs as the issuer
+          hops through different CPUs.
+
+        * Long running CPU intensive workloads which can be better
+          managed by the system scheduler.
+
+  WQ_FREEZEABLE
+
+        A freezeable wq participates in the freeze phase of the system
+        suspend operations.  Work items on the wq are drained and no
+        new work item starts execution until thawed.
+
+  WQ_RESCUER
+
+        All wq which might be used in the memory reclaim paths _MUST_
+        have this flag set.  This reserves one worker exclusively for
+        the execution of this wq under memory pressure.
+
+  WQ_HIGHPRI
+
+        Work items of a highpri wq are queued at the head of the
+        worklist of the target gcwq and start execution regardless of
+        the current concurrency level.  In other words, highpri work
+        items will always start execution as soon as execution
+        resource is available.
+
+        Ordering among highpri work items is preserved - a highpri
+        work item queued after another highpri work item will start
+        execution after the earlier highpri work item starts.
+
+        Although highpri work items are not held back by other
+        runnable work items, they still contribute to the concurrency
+        level.  Highpri work items in runnable state will prevent
+        non-highpri work items from starting execution.
+
+        This flag is meaningless for unbound wq.
+
+  WQ_CPU_INTENSIVE
+
+        Work items of a CPU intensive wq do not contribute to the
+        concurrency level.  In other words, runnable CPU intensive
+        work items will not prevent other work items from starting
+        execution.  This is useful for bound work items which are
+        expected to hog CPU cycles so that their execution is
+        regulated by the system scheduler.
+
+        Although CPU intensive work items don't contribute to the
+        concurrency level, start of their executions is still
+        regulated by the concurrency management and runnable
+        non-CPU-intensive work items can delay execution of CPU
+        intensive work items.
+
+        This flag is meaningless for unbound wq.
+
+  WQ_HIGHPRI | WQ_CPU_INTENSIVE
+
+        This combination makes the wq avoid interaction with
+        concurrency management completely and behave as a simple
+        per-CPU execution context provider.  Work items queued on a
+        highpri CPU-intensive wq start execution as soon as resources
+        are available and don't affect execution of other work items.
+
+@max_active:
+
+@max_active determines the maximum number of execution contexts per
+CPU which can be assigned to the work items of a wq.  For example,
+with @max_active of 16, at most 16 work items of the wq can be
+executing at the same time per CPU.
+
+Currently, for a bound wq, the maximum limit for @max_active is 512
+and the default value used when 0 is specified is 256.  For an unbound
+wq, the limit is higher of 512 and 4 * num_possible_cpus().  These
+values are chosen sufficiently high such that they are not the
+limiting factor while providing protection in runaway cases.
+
+The number of active work items of a wq is usually regulated by the
+users of the wq, more specifically, by how many work items the users
+may queue at the same time.  Unless there is a specific need for
+throttling the number of active work items, specifying '0' is
+recommended.
+
+Some users depend on the strict execution ordering of ST wq.  The
+combination of @max_active of 1 and WQ_UNBOUND is used to achieve this
+behavior.  Work items on such wq are always queued to the unbound gcwq
+and only one work item can be active at any given time thus achieving
+the same ordering property as ST wq.
+
+
+5. Example Execution Scenarios
+
+The following example execution scenarios try to illustrate how cmwq
+behave under different configurations.
+
+ Work items w0, w1, w2 are queued to a bound wq q0 on the same CPU.
+ w0 burns CPU for 5ms then sleeps for 10ms then burns CPU for 5ms
+ again before finishing.  w1 and w2 burn CPU for 5ms then sleep for
+ 10ms.
+
+Ignoring all other tasks, works and processing overhead, and assuming
+simple FIFO scheduling, the following is one highly simplified version
+of possible sequences of events with the original wq.
+
+ TIME IN MSECS  EVENT
+ 0              w0 starts and burns CPU
+ 5              w0 sleeps
+ 15             w0 wakes up and burns CPU
+ 20             w0 finishes
+ 20             w1 starts and burns CPU
+ 25             w1 sleeps
+ 35             w1 wakes up and finishes
+ 35             w2 starts and burns CPU
+ 40             w2 sleeps
+ 50             w2 wakes up and finishes
+
+And with cmwq with @max_active >= 3,
+
+ TIME IN MSECS  EVENT
+ 0              w0 starts and burns CPU
+ 5              w0 sleeps
+ 5              w1 starts and burns CPU
+ 10             w1 sleeps
+ 10             w2 starts and burns CPU
+ 15             w2 sleeps
+ 15             w0 wakes up and burns CPU
+ 20             w0 finishes
+ 20             w1 wakes up and finishes
+ 25             w2 wakes up and finishes
+
+If @max_active == 2,
+
+ TIME IN MSECS  EVENT
+ 0              w0 starts and burns CPU
+ 5              w0 sleeps
+ 5              w1 starts and burns CPU
+ 10             w1 sleeps
+ 15             w0 wakes up and burns CPU
+ 20             w0 finishes
+ 20             w1 wakes up and finishes
+ 20             w2 starts and burns CPU
+ 25             w2 sleeps
+ 35             w2 wakes up and finishes
+
+Now, let's assume w1 and w2 are queued to a different wq q1 which has
+WQ_HIGHPRI set,
+
+ TIME IN MSECS  EVENT
+ 0              w1 and w2 start and burn CPU
+ 5              w1 sleeps
+ 10             w2 sleeps
+ 10             w0 starts and burns CPU
+ 15             w0 sleeps
+ 15             w1 wakes up and finishes
+ 20             w2 wakes up and finishes
+ 25             w0 wakes up and burns CPU
+ 30             w0 finishes
+
+If q1 has WQ_CPU_INTENSIVE set,
+
+ TIME IN MSECS  EVENT
+ 0              w0 starts and burns CPU
+ 5              w0 sleeps
+ 5              w1 and w2 start and burn CPU
+ 10             w1 sleeps
+ 15             w2 sleeps
+ 15             w0 wakes up and burns CPU
+ 20             w0 finishes
+ 20             w1 wakes up and finishes
+ 25             w2 wakes up and finishes
+
+
+6. Guidelines
+
+* Do not forget to use WQ_RESCUER if a wq may process work items which
+  are used during memory reclaim.  Each wq with WQ_RESCUER set has one
+  rescuer thread reserved for it.  If there is dependency among
+  multiple work items used during memory reclaim, they should be
+  queued to separate wq each with WQ_RESCUER.
+
+* Unless strict ordering is required, there is no need to use ST wq.
+
+* Unless there is a specific need, using 0 for @max_active is
+  recommended.  In most use cases, concurrency level usually stays
+  well under the default limit.
+
+* A wq serves as a domain for forward progress guarantee (WQ_RESCUER),
+  flush and work item attributes.  Work items which are not involved
+  in memory reclaim and don't need to be flushed as a part of a group
+  of work items, and don't require any special attribute, can use one
+  of the system wq.  There is no difference in execution
+  characteristics between using a dedicated wq and a system wq.
+
+* Unless work items are expected to consume a huge amount of CPU
+  cycles, using a bound wq is usually beneficial due to the increased
+  level of locality in wq operations and work item execution.
diff --git a/MAINTAINERS b/MAINTAINERS
index e7c528ff1013..df342839b8c1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1135,7 +1135,7 @@ ATLX ETHERNET DRIVERS
 M:      Jay Cliburn <jcliburn@gmail.com>
 M:      Chris Snook <chris.snook@gmail.com>
 M:      Jie Yang <jie.yang@atheros.com>
-L:      atl1-devel@lists.sourceforge.net
+L:      netdev@vger.kernel.org
 W:      http://sourceforge.net/projects/atl1
 W:      http://atl1.sourceforge.net
 S:      Maintained
@@ -1220,7 +1220,7 @@ F:	drivers/auxdisplay/
 F:      include/linux/cfag12864b.h
 
 AVR32 ARCHITECTURE
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
 W:      http://www.atmel.com/products/AVR32/
 W:      http://avr32linux.org/
 W:      http://avrfreaks.net/
@@ -1228,7 +1228,7 @@ S:	Supported
 F:      arch/avr32/
 
 AVR32/AT32AP MACHINE SUPPORT
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
 S:      Supported
 F:      arch/avr32/mach-at32ap/
 
@@ -2199,6 +2199,12 @@ W:	http://acpi4asus.sf.net
 S:      Maintained
 F:      drivers/platform/x86/eeepc-laptop.c
 
+EFIFB FRAMEBUFFER DRIVER
+L:      linux-fbdev@vger.kernel.org
+M:      Peter Jones <pjones@redhat.com>
+S:      Maintained
+F:      drivers/video/efifb.c
+
 EFS FILESYSTEM
 W:      http://aeschi.ch.eu.org/efs/
 S:      Orphan
@@ -2657,9 +2663,12 @@ S:	Maintained
 F:      drivers/media/video/gspca/
 
 HARDWARE MONITORING
+M:      Jean Delvare <khali@linux-fr.org>
+M:      Guenter Roeck <guenter.roeck@ericsson.com>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
-S:      Orphan
+T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-hwmon/
+S:      Maintained
 F:      Documentation/hwmon/
 F:      drivers/hwmon/
 F:      include/linux/hwmon*.h
@@ -3896,10 +3905,8 @@ F:	Documentation/serial/moxa-smartio
 F:      drivers/char/mxser.*
 
 MSI LAPTOP SUPPORT
-M:      Lennart Poettering <mzxreary@0pointer.de>
+M:      Lee, Chun-Yi <jlee@novell.com>
 L:      platform-driver-x86@vger.kernel.org
-W:      https://tango.0pointer.de/mailman/listinfo/s270-linux
-W:      http://0pointer.de/lennart/tchibo.html
 S:      Maintained
 F:      drivers/platform/x86/msi-laptop.c
 
@@ -3939,7 +3946,7 @@ F:	drivers/char/isicom.c
 F:      include/linux/isicom.h
 
 MUSB MULTIPOINT HIGH SPEED DUAL-ROLE CONTROLLER
-M:      Felipe Balbi <felipe.balbi@nokia.com>
+M:      Felipe Balbi <balbi@ti.com>
 L:      linux-usb@vger.kernel.org
 T:      git git://gitorious.org/usb/usb.git
 S:      Maintained
@@ -4237,7 +4244,7 @@ S:	Maintained
 F:      drivers/char/hw_random/omap-rng.c
 
 OMAP USB SUPPORT
-M:      Felipe Balbi <felipe.balbi@nokia.com>
+M:      Felipe Balbi <balbi@ti.com>
 M:      David Brownell <dbrownell@users.sourceforge.net>
 L:      linux-usb@vger.kernel.org
 L:      linux-omap@vger.kernel.org
diff --git a/Makefile b/Makefile
index 92ab33f16cf0..3133a5772eeb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 36
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Sheep on Meth
 
 # *DOCUMENTATION*
diff --git a/arch/Kconfig b/arch/Kconfig
index 4877a8c8ee16..fe48fc7a3eba 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -32,8 +32,9 @@ config HAVE_OPROFILE
 
 config KPROBES
         bool "Kprobes"
-        depends on KALLSYMS && MODULES
+        depends on MODULES
         depends on HAVE_KPROBES
+        select KALLSYMS
         help
           Kprobes allows you to trap at almost any kernel address and
           execute a callback function.  register_kprobe() establishes
@@ -45,7 +46,6 @@ config OPTPROBES
         def_bool y
         depends on KPROBES && HAVE_OPTPROBES
         depends on !PREEMPT
-        select KALLSYMS_ALL
 
 config HAVE_EFFICIENT_UNALIGNED_ACCESS
         bool
diff --git a/arch/alpha/include/asm/cacheflush.h b/arch/alpha/include/asm/cacheflush.h
index 01d71e1c8a9e..012f1243b1c1 100644
--- a/arch/alpha/include/asm/cacheflush.h
+++ b/arch/alpha/include/asm/cacheflush.h
@@ -43,6 +43,8 @@ extern void smp_imb(void);
 /* ??? Ought to use this in arch/alpha/kernel/signal.c too.  */
 
 #ifndef CONFIG_SMP
+#include <linux/sched.h>
+
 extern void __load_new_mm_context(struct mm_struct *);
 static inline void
 flush_icache_user_range(struct vm_area_struct *vma, struct page *page,
diff --git a/arch/alpha/include/asm/unistd.h b/arch/alpha/include/asm/unistd.h
index 804e5311c841..058937bf5a77 100644
--- a/arch/alpha/include/asm/unistd.h
+++ b/arch/alpha/include/asm/unistd.h
@@ -449,10 +449,13 @@
 #define __NR_pwritev                    491
 #define __NR_rt_tgsigqueueinfo          492
 #define __NR_perf_event_open            493
+#define __NR_fanotify_init              494
+#define __NR_fanotify_mark              495
+#define __NR_prlimit64                  496
 
 #ifdef __KERNEL__
 
-#define NR_SYSCALLS                     494
+#define NR_SYSCALLS                     497
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
@@ -463,6 +466,7 @@
 #define __ARCH_WANT_SYS_OLD_GETRLIMIT
 #define __ARCH_WANT_SYS_OLDUMOUNT
 #define __ARCH_WANT_SYS_SIGPENDING
+#define __ARCH_WANT_SYS_RT_SIGSUSPEND
 
 /* "Conditional" syscalls.  What we want is
 
diff --git a/arch/alpha/kernel/entry.S b/arch/alpha/kernel/entry.S
index b45d913a51c3..ab1ee0ab082b 100644
--- a/arch/alpha/kernel/entry.S
+++ b/arch/alpha/kernel/entry.S
@@ -317,14 +317,14 @@ ret_from_sys_call:
         ldq     $0, SP_OFF($sp)
         and     $0, 8, $0
         beq     $0, restore_all
-ret_from_reschedule:
+ret_to_user:
         /* Make sure need_resched and sigpending don't change between
                 sampling and the rti.  */
         lda     $16, 7
         call_pal PAL_swpipl
         ldl     $5, TI_FLAGS($8)
         and     $5, _TIF_WORK_MASK, $2
-        bne     $5, work_pending
+        bne     $2, work_pending
 restore_all:
         RESTORE_ALL
         call_pal PAL_rti
@@ -363,7 +363,7 @@ $ret_success:
  *       $8: current.
  *      $19: The old syscall number, or zero if this is not a return
  *           from a syscall that errored and is possibly restartable.
- *      $20: Error indication.
+ *      $20: The old a3 value
  */
 
         .align  4
@@ -392,12 +392,18 @@ $work_resched:
 
 $work_notifysig:
         mov     $sp, $16
-        br      $1, do_switch_stack
+        bsr     $1, do_switch_stack
         mov     $sp, $17
         mov     $5, $18
+        mov     $19, $9         /* save old syscall number */
+        mov     $20, $10        /* save old a3 */
+        and     $5, _TIF_SIGPENDING, $2
+        cmovne  $2, 0, $9       /* we don't want double syscall restarts */
         jsr     $26, do_notify_resume
+        mov     $9, $19
+        mov     $10, $20
         bsr     $1, undo_switch_stack
-        br      restore_all
+        br      ret_to_user
 .end work_pending
 
 /*
@@ -430,6 +436,7 @@ strace:
         beq     $1, 1f
         ldq     $27, 0($2)
 1:      jsr     $26, ($27), sys_gettimeofday
+ret_from_straced:
         ldgp    $gp, 0($26)
 
         /* check return.. */
@@ -757,11 +764,15 @@ sys_vfork:
         .ent    sys_sigreturn
 sys_sigreturn:
         .prologue 0
+        lda     $9, ret_from_straced
+        cmpult  $26, $9, $9
         mov     $sp, $17
         lda     $18, -SWITCH_STACK_SIZE($sp)
         lda     $sp, -SWITCH_STACK_SIZE($sp)
         jsr     $26, do_sigreturn
-        br      $1, undo_switch_stack
+        bne     $9, 1f
+        jsr     $26, syscall_trace
+1:      br      $1, undo_switch_stack
         br      ret_from_sys_call
 .end sys_sigreturn
 
@@ -770,47 +781,19 @@ sys_sigreturn:
         .ent    sys_rt_sigreturn
 sys_rt_sigreturn:
         .prologue 0
+        lda     $9, ret_from_straced
+        cmpult  $26, $9, $9
         mov     $sp, $17
         lda     $18, -SWITCH_STACK_SIZE($sp)
         lda     $sp, -SWITCH_STACK_SIZE($sp)
         jsr     $26, do_rt_sigreturn
-        br      $1, undo_switch_stack
+        bne     $9, 1f
+        jsr     $26, syscall_trace
+1:      br      $1, undo_switch_stack
         br      ret_from_sys_call
 .end sys_rt_sigreturn
 
         .align  4
-        .globl  sys_sigsuspend
-        .ent    sys_sigsuspend
-sys_sigsuspend:
-        .prologue 0
-        mov     $sp, $17
-        br      $1, do_switch_stack
-        mov     $sp, $18
-        subq    $sp, 16, $sp
-        stq     $26, 0($sp)
-        jsr     $26, do_sigsuspend
-        ldq     $26, 0($sp)
-        lda     $sp, SWITCH_STACK_SIZE+16($sp)
-        ret
-.end sys_sigsuspend
-
-        .align  4
-        .globl  sys_rt_sigsuspend
-        .ent    sys_rt_sigsuspend
-sys_rt_sigsuspend:
-        .prologue 0
-        mov     $sp, $18
-        br      $1, do_switch_stack
-        mov     $sp, $19
-        subq    $sp, 16, $sp
-        stq     $26, 0($sp)
-        jsr     $26, do_rt_sigsuspend
-        ldq     $26, 0($sp)
-        lda     $sp, SWITCH_STACK_SIZE+16($sp)
-        ret
-.end sys_rt_sigsuspend
-
-        .align  4
         .globl  sys_sethae
         .ent    sys_sethae
 sys_sethae:
diff --git a/arch/alpha/kernel/err_ev6.c b/arch/alpha/kernel/err_ev6.c
index 8ca6345bf131..253cf1a87481 100644
--- a/arch/alpha/kernel/err_ev6.c
+++ b/arch/alpha/kernel/err_ev6.c
@@ -90,11 +90,13 @@ static int
 ev6_parse_cbox(u64 c_addr, u64 c1_syn, u64 c2_syn, 
                u64 c_stat, u64 c_sts, int print)
 {
-        char *sourcename[] = { "UNKNOWN", "UNKNOWN", "UNKNOWN",
-                               "MEMORY", "BCACHE", "DCACHE", 
-                               "BCACHE PROBE", "BCACHE PROBE" };
-        char *streamname[] = { "D", "I" };
-        char *bitsname[] = { "SINGLE", "DOUBLE" };
+        static const char * const sourcename[] = {
+                "UNKNOWN", "UNKNOWN", "UNKNOWN",
+                "MEMORY", "BCACHE", "DCACHE",
+                "BCACHE PROBE", "BCACHE PROBE"
+        };
+        static const char * const streamname[] = { "D", "I" };
+        static const char * const bitsname[] = { "SINGLE", "DOUBLE" };
         int status = MCHK_DISPOSITION_REPORT;
         int source = -1, stream = -1, bits = -1;
 
diff --git a/arch/alpha/kernel/err_marvel.c b/arch/alpha/kernel/err_marvel.c
index 5c905aaaeccd..648ae88aeb8a 100644
--- a/arch/alpha/kernel/err_marvel.c
+++ b/arch/alpha/kernel/err_marvel.c
@@ -589,22 +589,23 @@ marvel_print_pox_spl_cmplt(u64 spl_cmplt)
 static void
 marvel_print_pox_trans_sum(u64 trans_sum)
 {
-        char *pcix_cmd[] = { "Interrupt Acknowledge",
-                             "Special Cycle",
-                             "I/O Read",
-                             "I/O Write",
-                             "Reserved",
-                             "Reserved / Device ID Message",
-                             "Memory Read",
-                             "Memory Write",
-                             "Reserved / Alias to Memory Read Block",
-                             "Reserved / Alias to Memory Write Block",
-                             "Configuration Read",
-                             "Configuration Write",
-                             "Memory Read Multiple / Split Completion",
-                             "Dual Address Cycle",
-                             "Memory Read Line / Memory Read Block",
-                             "Memory Write and Invalidate / Memory Write Block"
+        static const char * const pcix_cmd[] = {
+                "Interrupt Acknowledge",
+                "Special Cycle",
+                "I/O Read",
+                "I/O Write",
+                "Reserved",
+                "Reserved / Device ID Message",
+                "Memory Read",
+                "Memory Write",
+                "Reserved / Alias to Memory Read Block",
+                "Reserved / Alias to Memory Write Block",
+                "Configuration Read",
+                "Configuration Write",
+                "Memory Read Multiple / Split Completion",
+                "Dual Address Cycle",
+                "Memory Read Line / Memory Read Block",
+                "Memory Write and Invalidate / Memory Write Block"
         };
 
 #define IO7__POX_TRANSUM__PCI_ADDR__S           (0)
diff --git a/arch/alpha/kernel/err_titan.c b/arch/alpha/kernel/err_titan.c
index f7ed97ce0dfd..c3b3781a03de 100644
--- a/arch/alpha/kernel/err_titan.c
+++ b/arch/alpha/kernel/err_titan.c
@@ -75,8 +75,12 @@ titan_parse_p_serror(int which, u64 serror, int print)
         int status = MCHK_DISPOSITION_REPORT;
 
 #ifdef CONFIG_VERBOSE_MCHECK
-        char *serror_src[] = {"GPCI", "APCI", "AGP HP", "AGP LP"};
-        char *serror_cmd[] = {"DMA Read", "DMA RMW", "SGTE Read", "Reserved"};
+        static const char * const serror_src[] = {
+                "GPCI", "APCI", "AGP HP", "AGP LP"
+        };
+        static const char * const serror_cmd[] = {
+                "DMA Read", "DMA RMW", "SGTE Read", "Reserved"
+        };
 #endif /* CONFIG_VERBOSE_MCHECK */
 
 #define TITAN__PCHIP_SERROR__LOST_UECC  (1UL << 0)
@@ -140,14 +144,15 @@ titan_parse_p_perror(int which, int port, u64 perror, int print)
         int status = MCHK_DISPOSITION_REPORT;
 
 #ifdef CONFIG_VERBOSE_MCHECK
-        char *perror_cmd[] = { "Interrupt Acknowledge", "Special Cycle",
-                               "I/O Read",              "I/O Write",
-                               "Reserved",              "Reserved",
-                               "Memory Read",           "Memory Write",
-                               "Reserved",              "Reserved",
-                               "Configuration Read",    "Configuration Write",
-                               "Memory Read Multiple",  "Dual Address Cycle",
-                               "Memory Read Line","Memory Write and Invalidate"
+        static const char * const perror_cmd[] = {
+                "Interrupt Acknowledge", "Special Cycle",
+                "I/O Read",             "I/O Write",
+                "Reserved",             "Reserved",
+                "Memory Read",          "Memory Write",
+                "Reserved",             "Reserved",
+                "Configuration Read",   "Configuration Write",
+                "Memory Read Multiple", "Dual Address Cycle",
+                "Memory Read Line",     "Memory Write and Invalidate"
         };
 #endif /* CONFIG_VERBOSE_MCHECK */
 
@@ -273,11 +278,11 @@ titan_parse_p_agperror(int which, u64 agperror, int print)
         int cmd, len;
         unsigned long addr;
 
-        char *agperror_cmd[] = { "Read (low-priority)", "Read (high-priority)",
-                                 "Write (low-priority)",
-                                 "Write (high-priority)",
-                                 "Reserved",            "Reserved",
-                                 "Flush",               "Fence"
+        static const char * const agperror_cmd[] = {
+                "Read (low-priority)",  "Read (high-priority)",
+                "Write (low-priority)", "Write (high-priority)",
+                "Reserved",             "Reserved",
+                "Flush",                "Fence"
         };
 #endif /* CONFIG_VERBOSE_MCHECK */
 
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 5d1e6d6ce684..547e8b84b2f7 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -15,7 +15,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/smp.h>
-#include <linux/smp_lock.h>
 #include <linux/stddef.h>
 #include <linux/syscalls.h>
 #include <linux/unistd.h>
@@ -69,7 +68,6 @@ SYSCALL_DEFINE4(osf_set_program_attributes, unsigned long, text_start,
 {
         struct mm_struct *mm;
 
-        lock_kernel();
         mm = current->mm;
         mm->end_code = bss_start + bss_len;
         mm->start_brk = bss_start + bss_len;
@@ -78,7 +76,6 @@ SYSCALL_DEFINE4(osf_set_program_attributes, unsigned long, text_start,
         printk("set_program_attributes(%lx %lx %lx %lx)\n",
                 text_start, text_len, bss_start, bss_len);
 #endif
-        unlock_kernel();
         return 0;
 }
 
@@ -517,7 +514,6 @@ SYSCALL_DEFINE2(osf_proplist_syscall, enum pl_code, code,
         long error;
         int __user *min_buf_size_ptr;
 
-        lock_kernel();
         switch (code) {
         case PL_SET:
                 if (get_user(error, &args->set.nbytes))
@@ -547,7 +543,6 @@ SYSCALL_DEFINE2(osf_proplist_syscall, enum pl_code, code,
                 error = -EOPNOTSUPP;
                 break;
         };
-        unlock_kernel();
         return error;
 }
 
@@ -594,7 +589,7 @@ SYSCALL_DEFINE2(osf_sigstack, struct sigstack __user *, uss,
 
 SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
 {
-        char *sysinfo_table[] = {
+        const char *sysinfo_table[] = {
                 utsname()->sysname,
                 utsname()->nodename,
                 utsname()->release,
@@ -606,7 +601,7 @@ SYSCALL_DEFINE3(osf_sysinfo, int, command, char __user *, buf, long, count)
                 "dummy",        /* secure RPC domain */
         };
         unsigned long offset;
-        char *res;
+        const char *res;
         long len, err = -EINVAL;
 
         offset = command-1;
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 738fc824e2ea..b899e95f79fd 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -66,7 +66,7 @@ static int pci_mmap_resource(struct kobject *kobj,
 {
         struct pci_dev *pdev = to_pci_dev(container_of(kobj,
                                                        struct device, kobj));
-        struct resource *res = (struct resource *)attr->private;
+        struct resource *res = attr->private;
         enum pci_mmap_state mmap_type;
         struct pci_bus_region bar;
         int i;
diff --git a/arch/alpha/kernel/signal.c b/arch/alpha/kernel/signal.c
index 0932dbb1ef8e..0f6b51ae865a 100644
--- a/arch/alpha/kernel/signal.c
+++ b/arch/alpha/kernel/signal.c
@@ -144,8 +144,7 @@ SYSCALL_DEFINE5(rt_sigaction, int, sig, const struct sigaction __user *, act,
 /*
  * Atomically swap in the new signal mask, and wait for a signal.
  */
-asmlinkage int
-do_sigsuspend(old_sigset_t mask, struct pt_regs *regs, struct switch_stack *sw)
+SYSCALL_DEFINE1(sigsuspend, old_sigset_t, mask)
 {
         mask &= _BLOCKABLE;
         spin_lock_irq(&current->sighand->siglock);
@@ -154,41 +153,6 @@ do_sigsuspend(old_sigset_t mask, struct pt_regs *regs, struct switch_stack *sw)
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
 
-        /* Indicate EINTR on return from any possible signal handler,
-           which will not come back through here, but via sigreturn.  */
-        regs->r0 = EINTR;
-        regs->r19 = 1;
-
-        current->state = TASK_INTERRUPTIBLE;
-        schedule();
-        set_thread_flag(TIF_RESTORE_SIGMASK);
-        return -ERESTARTNOHAND;
-}
-
-asmlinkage int
-do_rt_sigsuspend(sigset_t __user *uset, size_t sigsetsize,
-                 struct pt_regs *regs, struct switch_stack *sw)
-{
-        sigset_t set;
-
-        /* XXX: Don't preclude handling different sized sigset_t's.  */
-        if (sigsetsize != sizeof(sigset_t))
-                return -EINVAL;
-        if (copy_from_user(&set, uset, sizeof(set)))
-                return -EFAULT;
-
-        sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->saved_sigmask = current->blocked;
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
-
-        /* Indicate EINTR on return from any possible signal handler,
-           which will not come back through here, but via sigreturn.  */
-        regs->r0 = EINTR;
-        regs->r19 = 1;
-
         current->state = TASK_INTERRUPTIBLE;
         schedule();
         set_thread_flag(TIF_RESTORE_SIGMASK);
@@ -239,6 +203,8 @@ restore_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
         unsigned long usp;
         long i, err = __get_user(regs->pc, &sc->sc_pc);
 
+        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+
         sw->r26 = (unsigned long) ret_from_sys_call;
 
         err |= __get_user(regs->r0, sc->sc_regs+0);
@@ -591,7 +557,6 @@ syscall_restart(unsigned long r0, unsigned long r19,
                 regs->pc -= 4;
                 break;
         case ERESTART_RESTARTBLOCK:
-                current_thread_info()->restart_block.fn = do_no_restart_syscall;
                 regs->r0 = EINTR;
                 break;
         }
diff --git a/arch/alpha/kernel/srm_env.c b/arch/alpha/kernel/srm_env.c
index 4afc1a1e2e5a..f0df3fbd8402 100644
--- a/arch/alpha/kernel/srm_env.c
+++ b/arch/alpha/kernel/srm_env.c
@@ -87,7 +87,7 @@ static int srm_env_proc_show(struct seq_file *m, void *v)
         srm_env_t       *entry;
         char            *page;
 
-        entry = (srm_env_t *)m->private;
+        entry = m->private;
         page = (char *)__get_free_page(GFP_USER);
         if (!page)
                 return -ENOMEM;
diff --git a/arch/alpha/kernel/systbls.S b/arch/alpha/kernel/systbls.S
index 09acb786e72b..ce594ef533cc 100644
--- a/arch/alpha/kernel/systbls.S
+++ b/arch/alpha/kernel/systbls.S
@@ -512,6 +512,9 @@ sys_call_table:
         .quad sys_pwritev
         .quad sys_rt_tgsigqueueinfo
         .quad sys_perf_event_open
+        .quad sys_fanotify_init
+        .quad sys_fanotify_mark                         /* 495 */
+        .quad sys_prlimit64
 
         .size sys_call_table, . - sys_call_table
         .type sys_call_table, @object
diff --git a/arch/alpha/kernel/time.c b/arch/alpha/kernel/time.c
index eacceb26d9c8..396af1799ea4 100644
--- a/arch/alpha/kernel/time.c
+++ b/arch/alpha/kernel/time.c
@@ -191,16 +191,16 @@ irqreturn_t timer_interrupt(int irq, void *dev)
 
         write_sequnlock(&xtime_lock);
 
-#ifndef CONFIG_SMP
-        while (nticks--)
-                update_process_times(user_mode(get_irq_regs()));
-#endif
-
         if (test_perf_event_pending()) {
                 clear_perf_event_pending();
                 perf_event_do_pending();
         }
 
+#ifndef CONFIG_SMP
+        while (nticks--)
+                update_process_times(user_mode(get_irq_regs()));
+#endif
+
         return IRQ_HANDLED;
 }
 
diff --git a/arch/alpha/kernel/traps.c b/arch/alpha/kernel/traps.c
index b14f015008ad..0414e021a91c 100644
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -13,7 +13,6 @@
 #include <linux/sched.h>
 #include <linux/tty.h>
 #include <linux/delay.h>
-#include <linux/smp_lock.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kallsyms.h>
@@ -623,7 +622,6 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,
                 return;
         }
 
-        lock_kernel();
         printk("Bad unaligned kernel access at %016lx: %p %lx %lu\n",
                 pc, va, opcode, reg);
         do_exit(SIGSEGV);
@@ -646,7 +644,6 @@ got_exception:
          * Yikes!  No one to forward the exception to.
          * Since the registers are in a weird format, dump them ourselves.
          */
-        lock_kernel();
 
         printk("%s(%d): unhandled unaligned exception\n",
                current->comm, task_pid_nr(current));
diff --git a/arch/arm/common/it8152.c b/arch/arm/common/it8152.c
index 7974baacafce..1bec96e85196 100644
--- a/arch/arm/common/it8152.c
+++ b/arch/arm/common/it8152.c
@@ -271,6 +271,14 @@ int dma_needs_bounce(struct device *dev, dma_addr_t dma_addr, size_t size)
                 ((dma_addr + size - PHYS_OFFSET) >= SZ_64M);
 }
 
+int dma_set_coherent_mask(struct device *dev, u64 mask)
+{
+        if (mask >= PHYS_OFFSET + SZ_64M - 1)
+                return 0;
+
+        return -EIO;
+}
+
 int __init it8152_pci_setup(int nr, struct pci_sys_data *sys)
 {
         it8152_io.start = IT8152_IO_BASE + 0x12000;
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index f05a35a59694..1b560825e1cf 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -418,11 +418,13 @@ ENDPROC(sys_clone_wrapper)
 
 sys_sigreturn_wrapper:
                 add     r0, sp, #S_OFF
+                mov     why, #0         @ prevent syscall restart handling
                 b       sys_sigreturn
 ENDPROC(sys_sigreturn_wrapper)
 
 sys_rt_sigreturn_wrapper:
                 add     r0, sp, #S_OFF
+                mov     why, #0         @ prevent syscall restart handling
                 b       sys_rt_sigreturn
 ENDPROC(sys_rt_sigreturn_wrapper)
 
diff --git a/arch/arm/mach-ixp4xx/common-pci.c b/arch/arm/mach-ixp4xx/common-pci.c
index 61cd4d64b985..24498a932ba6 100644
--- a/arch/arm/mach-ixp4xx/common-pci.c
+++ b/arch/arm/mach-ixp4xx/common-pci.c
@@ -503,6 +503,14 @@ struct pci_bus * __devinit ixp4xx_scan_bus(int nr, struct pci_sys_data *sys)
         return pci_scan_bus(sys->busnr, &ixp4xx_ops, sys);
 }
 
+int dma_set_coherent_mask(struct device *dev, u64 mask)
+{
+        if (mask >= SZ_64M - 1)
+                return 0;
+
+        return -EIO;
+}
+
 EXPORT_SYMBOL(ixp4xx_pci_read);
 EXPORT_SYMBOL(ixp4xx_pci_write);
 
diff --git a/arch/arm/mach-ixp4xx/include/mach/hardware.h b/arch/arm/mach-ixp4xx/include/mach/hardware.h
index f91ca6d4fbe8..8138371c406e 100644
--- a/arch/arm/mach-ixp4xx/include/mach/hardware.h
+++ b/arch/arm/mach-ixp4xx/include/mach/hardware.h
@@ -26,6 +26,8 @@
 #define PCIBIOS_MAX_MEM         0x4BFFFFFF
 #endif
 
+#define ARCH_HAS_DMA_SET_COHERENT_MASK
+
 #define pcibios_assign_all_busses()     1
 
 /* Register locations and bits */
diff --git a/arch/arm/mach-pxa/include/mach/hardware.h b/arch/arm/mach-pxa/include/mach/hardware.h
index 7f64d24cd564..428cc7bda9a4 100644
--- a/arch/arm/mach-pxa/include/mach/hardware.h
+++ b/arch/arm/mach-pxa/include/mach/hardware.h
@@ -309,7 +309,7 @@ extern unsigned long get_clock_tick_rate(void);
 #define PCIBIOS_MIN_IO          0
 #define PCIBIOS_MIN_MEM         0
 #define pcibios_assign_all_busses()     1
+#define ARCH_HAS_DMA_SET_COHERENT_MASK
 #endif
 
-
 #endif  /* _ASM_ARCH_HARDWARE_H */
diff --git a/arch/arm/mach-pxa/include/mach/io.h b/arch/arm/mach-pxa/include/mach/io.h
index 262691fb97d8..fdca3be47d9b 100644
--- a/arch/arm/mach-pxa/include/mach/io.h
+++ b/arch/arm/mach-pxa/include/mach/io.h
@@ -6,6 +6,8 @@
 #ifndef __ASM_ARM_ARCH_IO_H
 #define __ASM_ARM_ARCH_IO_H
 
+#include <mach/hardware.h>
+
 #define IO_SPACE_LIMIT 0xffffffff
 
 /*
diff --git a/arch/arm/mach-s3c64xx/dev-spi.c b/arch/arm/mach-s3c64xx/dev-spi.c
index a492b982aa06..405e62128917 100644
--- a/arch/arm/mach-s3c64xx/dev-spi.c
+++ b/arch/arm/mach-s3c64xx/dev-spi.c
@@ -18,10 +18,11 @@
 #include <mach/map.h>
 #include <mach/gpio-bank-c.h>
 #include <mach/spi-clocks.h>
+#include <mach/irqs.h>
 
 #include <plat/s3c64xx-spi.h>
 #include <plat/gpio-cfg.h>
-#include <plat/irqs.h>
+#include <plat/devs.h>
 
 static char *spi_src_clks[] = {
         [S3C64XX_SPI_SRCCLK_PCLK] = "pclk",
diff --git a/arch/arm/mach-s3c64xx/mach-real6410.c b/arch/arm/mach-s3c64xx/mach-real6410.c
index 5c07d013b23d..e130379ba0e8 100644
--- a/arch/arm/mach-s3c64xx/mach-real6410.c
+++ b/arch/arm/mach-s3c64xx/mach-real6410.c
@@ -30,73 +30,73 @@
 #include <plat/devs.h>
 #include <plat/regs-serial.h>
 
-#define UCON S3C2410_UCON_DEFAULT | S3C2410_UCON_UCLK
-#define ULCON S3C2410_LCON_CS8 | S3C2410_LCON_PNONE | S3C2410_LCON_STOPB
-#define UFCON S3C2410_UFCON_RXTRIG8 | S3C2410_UFCON_FIFOMODE
+#define UCON (S3C2410_UCON_DEFAULT | S3C2410_UCON_UCLK)
+#define ULCON (S3C2410_LCON_CS8 | S3C2410_LCON_PNONE | S3C2410_LCON_STOPB)
+#define UFCON (S3C2410_UFCON_RXTRIG8 | S3C2410_UFCON_FIFOMODE)
 
 static struct s3c2410_uartcfg real6410_uartcfgs[] __initdata = {
         [0] = {
-                .hwport      = 0,
-                .flags       = 0,
-                .ucon        = UCON,
-                .ulcon       = ULCON,
-                .ufcon       = UFCON,
+                .hwport = 0,
+                .flags  = 0,
+                .ucon   = UCON,
+                .ulcon  = ULCON,
+                .ufcon  = UFCON,
         },
         [1] = {
-                .hwport      = 1,
-                .flags       = 0,
-                .ucon        = UCON,
-                .ulcon       = ULCON,
-                .ufcon       = UFCON,
+                .hwport = 1,
+                .flags  = 0,
+                .ucon   = UCON,
+                .ulcon  = ULCON,
+                .ufcon  = UFCON,
         },
         [2] = {
-                .hwport      = 2,
-                .flags       = 0,
-                .ucon        = UCON,
-                .ulcon       = ULCON,
-                .ufcon       = UFCON,
+                .hwport = 2,
+                .flags  = 0,
+                .ucon   = UCON,
+                .ulcon  = ULCON,
+                .ufcon  = UFCON,
         },
         [3] = {
-                .hwport      = 3,
-                .flags       = 0,
-                .ucon        = UCON,
-                .ulcon       = ULCON,
-                .ufcon       = UFCON,
+                .hwport = 3,
+                .flags  = 0,
+                .ucon   = UCON,
+                .ulcon  = ULCON,
+                .ufcon  = UFCON,
         },
 };
 
 /* DM9000AEP 10/100 ethernet controller */
 
 static struct resource real6410_dm9k_resource[] = {
-        [0] = {
-                .start = S3C64XX_PA_XM0CSN1,
-                .end   = S3C64XX_PA_XM0CSN1 + 1,
-                .flags = IORESOURCE_MEM
-        },
-        [1] = {
-                .start = S3C64XX_PA_XM0CSN1 + 4,
-                .end   = S3C64XX_PA_XM0CSN1 + 5,
-                .flags = IORESOURCE_MEM
-        },
-        [2] = {
-                .start = S3C_EINT(7),
-                .end   = S3C_EINT(7),
-                .flags = IORESOURCE_IRQ,
-        }
+        [0] = {
+                .start  = S3C64XX_PA_XM0CSN1,
+                .end    = S3C64XX_PA_XM0CSN1 + 1,
+                .flags  = IORESOURCE_MEM
+        },
+        [1] = {
+                .start  = S3C64XX_PA_XM0CSN1 + 4,
+                .end    = S3C64XX_PA_XM0CSN1 + 5,
+                .flags  = IORESOURCE_MEM
+        },
+        [2] = {
+                .start  = S3C_EINT(7),
+                .end    = S3C_EINT(7),
+                .flags  = IORESOURCE_IRQ | IORESOURCE_IRQ_HIGHLEVEL
+        }
 };
 
 static struct dm9000_plat_data real6410_dm9k_pdata = {
-        .flags          = (DM9000_PLATF_16BITONLY | DM9000_PLATF_NO_EEPROM),
+        .flags          = (DM9000_PLATF_16BITONLY | DM9000_PLATF_NO_EEPROM),
 };
 
 static struct platform_device real6410_device_eth = {
-        .name           = "dm9000",
-        .id             = -1,
-        .num_resources  = ARRAY_SIZE(real6410_dm9k_resource),
-        .resource       = real6410_dm9k_resource,
-        .dev            = {
-                .platform_data  = &real6410_dm9k_pdata,
-        },
+        .name           = "dm9000",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(real6410_dm9k_resource),
+        .resource       = real6410_dm9k_resource,
+        .dev            = {
+                .platform_data  = &real6410_dm9k_pdata,
+        },
 };
 
 static struct platform_device *real6410_devices[] __initdata = {
@@ -129,12 +129,12 @@ static void __init real6410_machine_init(void)
         /* set timing for nCS1 suitable for ethernet chip */
 
         __raw_writel((0 << S3C64XX_SROM_BCX__PMC__SHIFT) |
-                        (6 << S3C64XX_SROM_BCX__TACP__SHIFT) |
-                        (4 << S3C64XX_SROM_BCX__TCAH__SHIFT) |
-                        (1 << S3C64XX_SROM_BCX__TCOH__SHIFT) |
-                        (13 << S3C64XX_SROM_BCX__TACC__SHIFT) |
-                        (4 << S3C64XX_SROM_BCX__TCOS__SHIFT) |
-                        (0 << S3C64XX_SROM_BCX__TACS__SHIFT), S3C64XX_SROM_BC1);
+                (6 << S3C64XX_SROM_BCX__TACP__SHIFT) |
+                (4 << S3C64XX_SROM_BCX__TCAH__SHIFT) |
+                (1 << S3C64XX_SROM_BCX__TCOH__SHIFT) |
+                (13 << S3C64XX_SROM_BCX__TACC__SHIFT) |
+                (4 << S3C64XX_SROM_BCX__TCOS__SHIFT) |
+                (0 << S3C64XX_SROM_BCX__TACS__SHIFT), S3C64XX_SROM_BC1);
 
         platform_add_devices(real6410_devices, ARRAY_SIZE(real6410_devices));
 }
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index af91fefef2c6..cfecd70657cb 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -281,6 +281,24 @@ static struct clk init_clocks_disable[] = {
                 .enable         = s5pv210_clk_ip0_ctrl,
                 .ctrlbit        = (1<<29),
         }, {
+                .name           = "fimc",
+                .id             = 0,
+                .parent         = &clk_hclk_dsys.clk,
+                .enable         = s5pv210_clk_ip0_ctrl,
+                .ctrlbit        = (1 << 24),
+        }, {
+                .name           = "fimc",
+                .id             = 1,
+                .parent         = &clk_hclk_dsys.clk,
+                .enable         = s5pv210_clk_ip0_ctrl,
+                .ctrlbit        = (1 << 25),
+        }, {
+                .name           = "fimc",
+                .id             = 2,
+                .parent         = &clk_hclk_dsys.clk,
+                .enable         = s5pv210_clk_ip0_ctrl,
+                .ctrlbit        = (1 << 26),
+        }, {
                 .name           = "otg",
                 .id             = -1,
                 .parent         = &clk_hclk_psys.clk,
@@ -357,7 +375,7 @@ static struct clk init_clocks_disable[] = {
                 .id             = 1,
                 .parent         = &clk_pclk_psys.clk,
                 .enable         = s5pv210_clk_ip3_ctrl,
-                .ctrlbit        = (1<<8),
+                .ctrlbit        = (1 << 10),
         }, {
                 .name           = "i2c",
                 .id             = 2,
diff --git a/arch/arm/mach-s5pv210/cpu.c b/arch/arm/mach-s5pv210/cpu.c
index b9f4d677cf55..77f456c91ad3 100644
--- a/arch/arm/mach-s5pv210/cpu.c
+++ b/arch/arm/mach-s5pv210/cpu.c
@@ -47,7 +47,7 @@ static struct map_desc s5pv210_iodesc[] __initdata = {
         {
                 .virtual        = (unsigned long)S5P_VA_SYSTIMER,
                 .pfn            = __phys_to_pfn(S5PV210_PA_SYSTIMER),
-                .length         = SZ_1M,
+                .length         = SZ_4K,
                 .type           = MT_DEVICE,
         }, {
                 .virtual        = (unsigned long)VA_VIC2,
diff --git a/arch/arm/plat-s5p/dev-fimc0.c b/arch/arm/plat-s5p/dev-fimc0.c
index d3f1a9b5d2b5..608770fc1531 100644
--- a/arch/arm/plat-s5p/dev-fimc0.c
+++ b/arch/arm/plat-s5p/dev-fimc0.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
@@ -18,7 +19,7 @@
 static struct resource s5p_fimc0_resource[] = {
         [0] = {
                 .start  = S5P_PA_FIMC0,
-                .end    = S5P_PA_FIMC0 + SZ_1M - 1,
+                .end    = S5P_PA_FIMC0 + SZ_4K - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -28,9 +29,15 @@ static struct resource s5p_fimc0_resource[] = {
         },
 };
 
+static u64 s5p_fimc0_dma_mask = DMA_BIT_MASK(32);
+
 struct platform_device s5p_device_fimc0 = {
         .name           = "s5p-fimc",
         .id             = 0,
         .num_resources  = ARRAY_SIZE(s5p_fimc0_resource),
         .resource       = s5p_fimc0_resource,
+        .dev            = {
+                .dma_mask               = &s5p_fimc0_dma_mask,
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
+        },
 };
diff --git a/arch/arm/plat-s5p/dev-fimc1.c b/arch/arm/plat-s5p/dev-fimc1.c
index 41bd6986d0ad..76e3a97a87d3 100644
--- a/arch/arm/plat-s5p/dev-fimc1.c
+++ b/arch/arm/plat-s5p/dev-fimc1.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
@@ -18,7 +19,7 @@
 static struct resource s5p_fimc1_resource[] = {
         [0] = {
                 .start  = S5P_PA_FIMC1,
-                .end    = S5P_PA_FIMC1 + SZ_1M - 1,
+                .end    = S5P_PA_FIMC1 + SZ_4K - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -28,9 +29,15 @@ static struct resource s5p_fimc1_resource[] = {
         },
 };
 
+static u64 s5p_fimc1_dma_mask = DMA_BIT_MASK(32);
+
 struct platform_device s5p_device_fimc1 = {
         .name           = "s5p-fimc",
         .id             = 1,
         .num_resources  = ARRAY_SIZE(s5p_fimc1_resource),
         .resource       = s5p_fimc1_resource,
+        .dev            = {
+                .dma_mask               = &s5p_fimc1_dma_mask,
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
+        },
 };
diff --git a/arch/arm/plat-s5p/dev-fimc2.c b/arch/arm/plat-s5p/dev-fimc2.c
index dfddeda6d4a3..24d29816fa2c 100644
--- a/arch/arm/plat-s5p/dev-fimc2.c
+++ b/arch/arm/plat-s5p/dev-fimc2.c
@@ -10,6 +10,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/dma-mapping.h>
 #include <linux/platform_device.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
@@ -18,7 +19,7 @@
 static struct resource s5p_fimc2_resource[] = {
         [0] = {
                 .start  = S5P_PA_FIMC2,
-                .end    = S5P_PA_FIMC2 + SZ_1M - 1,
+                .end    = S5P_PA_FIMC2 + SZ_4K - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -28,9 +29,15 @@ static struct resource s5p_fimc2_resource[] = {
         },
 };
 
+static u64 s5p_fimc2_dma_mask = DMA_BIT_MASK(32);
+
 struct platform_device s5p_device_fimc2 = {
         .name           = "s5p-fimc",
         .id             = 2,
         .num_resources  = ARRAY_SIZE(s5p_fimc2_resource),
         .resource       = s5p_fimc2_resource,
+        .dev            = {
+                .dma_mask               = &s5p_fimc2_dma_mask,
+                .coherent_dma_mask      = DMA_BIT_MASK(32),
+        },
 };
diff --git a/arch/arm/plat-samsung/gpio-config.c b/arch/arm/plat-samsung/gpio-config.c
index 57b68a50f45e..e3d41eaed1ff 100644
--- a/arch/arm/plat-samsung/gpio-config.c
+++ b/arch/arm/plat-samsung/gpio-config.c
@@ -273,13 +273,13 @@ s5p_gpio_drvstr_t s5p_gpio_get_drvstr(unsigned int pin)
         if (!chip)
                 return -EINVAL;
 
-        off = chip->chip.base - pin;
+        off = pin - chip->chip.base;
         shift = off * 2;
         reg = chip->base + 0x0C;
 
         drvstr = __raw_readl(reg);
-        drvstr = 0xffff & (0x3 << shift);
         drvstr = drvstr >> shift;
+        drvstr &= 0x3;
 
         return (__force s5p_gpio_drvstr_t)drvstr;
 }
@@ -296,11 +296,12 @@ int s5p_gpio_set_drvstr(unsigned int pin, s5p_gpio_drvstr_t drvstr)
         if (!chip)
                 return -EINVAL;
 
-        off = chip->chip.base - pin;
+        off = pin - chip->chip.base;
         shift = off * 2;
         reg = chip->base + 0x0C;
 
         tmp = __raw_readl(reg);
+        tmp &= ~(0x3 << shift);
         tmp |= drvstr << shift;
 
         __raw_writel(tmp, reg);
diff --git a/arch/arm/plat-samsung/include/plat/gpio-cfg.h b/arch/arm/plat-samsung/include/plat/gpio-cfg.h
index db4112c6f2be..1c6b92947c5d 100644
--- a/arch/arm/plat-samsung/include/plat/gpio-cfg.h
+++ b/arch/arm/plat-samsung/include/plat/gpio-cfg.h
@@ -143,12 +143,12 @@ extern s3c_gpio_pull_t s3c_gpio_getpull(unsigned int pin);
 /* Define values for the drvstr available for each gpio pin.
  *
  * These values control the value of the output signal driver strength,
- * configurable on most pins on the S5C series.
+ * configurable on most pins on the S5P series.
  */
-#define S5P_GPIO_DRVSTR_LV1     ((__force s5p_gpio_drvstr_t)0x00)
-#define S5P_GPIO_DRVSTR_LV2     ((__force s5p_gpio_drvstr_t)0x01)
-#define S5P_GPIO_DRVSTR_LV3     ((__force s5p_gpio_drvstr_t)0x10)
-#define S5P_GPIO_DRVSTR_LV4     ((__force s5p_gpio_drvstr_t)0x11)
+#define S5P_GPIO_DRVSTR_LV1     ((__force s5p_gpio_drvstr_t)0x0)
+#define S5P_GPIO_DRVSTR_LV2     ((__force s5p_gpio_drvstr_t)0x2)
+#define S5P_GPIO_DRVSTR_LV3     ((__force s5p_gpio_drvstr_t)0x1)
+#define S5P_GPIO_DRVSTR_LV4     ((__force s5p_gpio_drvstr_t)0x3)
 
 /**
  * s5c_gpio_get_drvstr() - get the driver streght value of a gpio pin
diff --git a/arch/frv/kernel/signal.c b/arch/frv/kernel/signal.c
index 0974c0ecc594..bab01298b58e 100644
--- a/arch/frv/kernel/signal.c
+++ b/arch/frv/kernel/signal.c
@@ -121,6 +121,9 @@ static int restore_sigcontext(struct sigcontext __user *sc, int *_gr8)
         struct user_context *user = current->thread.user;
         unsigned long tbr, psr;
 
+        /* Always make any pending restarted system calls return -EINTR */
+        current_thread_info()->restart_block.fn = do_no_restart_syscall;
+
         tbr = user->i.tbr;
         psr = user->i.psr;
         if (copy_from_user(user, &sc->sc_context, sizeof(sc->sc_context)))
@@ -250,6 +253,8 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
         struct sigframe __user *frame;
         int rsig;
 
+        set_fs(USER_DS);
+
         frame = get_sigframe(ka, sizeof(*frame));
 
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -293,22 +298,23 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
                                    (unsigned long) (frame->retcode + 2));
         }
 
-        /* set up registers for signal handler */
-        __frame->sp   = (unsigned long) frame;
-        __frame->lr   = (unsigned long) &frame->retcode;
-        __frame->gr8  = sig;
-
+        /* Set up registers for the signal handler */
         if (current->personality & FDPIC_FUNCPTRS) {
                 struct fdpic_func_descriptor __user *funcptr =
                         (struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
-                __get_user(__frame->pc, &funcptr->text);
-                __get_user(__frame->gr15, &funcptr->GOT);
+                struct fdpic_func_descriptor desc;
+                if (copy_from_user(&desc, funcptr, sizeof(desc)))
+                        goto give_sigsegv;
+                __frame->pc = desc.text;
+                __frame->gr15 = desc.GOT;
         } else {
                 __frame->pc   = (unsigned long) ka->sa.sa_handler;
                 __frame->gr15 = 0;
         }
 
-        set_fs(USER_DS);
+        __frame->sp   = (unsigned long) frame;
+        __frame->lr   = (unsigned long) &frame->retcode;
+        __frame->gr8  = sig;
 
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
@@ -323,7 +329,7 @@ static int setup_frame(int sig, struct k_sigaction *ka, sigset_t *set)
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 
 } /* end setup_frame() */
@@ -338,6 +344,8 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         struct rt_sigframe __user *frame;
         int rsig;
 
+        set_fs(USER_DS);
+
         frame = get_sigframe(ka, sizeof(*frame));
 
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
@@ -392,22 +400,23 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         }
 
         /* Set up registers for signal handler */
-        __frame->sp  = (unsigned long) frame;
-        __frame->lr   = (unsigned long) &frame->retcode;
-        __frame->gr8 = sig;
-        __frame->gr9 = (unsigned long) &frame->info;
-
         if (current->personality & FDPIC_FUNCPTRS) {
                 struct fdpic_func_descriptor __user *funcptr =
                         (struct fdpic_func_descriptor __user *) ka->sa.sa_handler;
-                __get_user(__frame->pc, &funcptr->text);
-                __get_user(__frame->gr15, &funcptr->GOT);
+                struct fdpic_func_descriptor desc;
+                if (copy_from_user(&desc, funcptr, sizeof(desc)))
+                        goto give_sigsegv;
+                __frame->pc = desc.text;
+                __frame->gr15 = desc.GOT;
         } else {
                 __frame->pc   = (unsigned long) ka->sa.sa_handler;
                 __frame->gr15 = 0;
         }
 
-        set_fs(USER_DS);
+        __frame->sp  = (unsigned long) frame;
+        __frame->lr  = (unsigned long) &frame->retcode;
+        __frame->gr8 = sig;
+        __frame->gr9 = (unsigned long) &frame->info;
 
         /* the tracer may want to single-step inside the handler */
         if (test_thread_flag(TIF_SINGLESTEP))
@@ -422,7 +431,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         return 0;
 
 give_sigsegv:
-        force_sig(SIGSEGV, current);
+        force_sigsegv(sig, current);
         return -EFAULT;
 
 } /* end setup_rt_frame() */
@@ -437,7 +446,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         int ret;
 
         /* Are we from a system call? */
-        if (in_syscall(__frame)) {
+        if (__frame->syscallno != -1) {
                 /* If so, check system call restarting.. */
                 switch (__frame->gr8) {
                 case -ERESTART_RESTARTBLOCK:
@@ -456,6 +465,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
                         __frame->gr8 = __frame->orig_gr8;
                         __frame->pc -= 4;
                 }
+                __frame->syscallno = -1;
         }
 
         /* Set up the stack frame */
@@ -538,10 +548,11 @@ no_signal:
                         break;
 
                 case -ERESTART_RESTARTBLOCK:
-                        __frame->gr8 = __NR_restart_syscall;
+                        __frame->gr7 = __NR_restart_syscall;
                         __frame->pc -= 4;
                         break;
                 }
+                __frame->syscallno = -1;
         }
 
         /* if there's no signal to deliver, we just put the saved sigmask
diff --git a/arch/ia64/include/asm/compat.h b/arch/ia64/include/asm/compat.h
index f90edc85b509..9301a2821615 100644
--- a/arch/ia64/include/asm/compat.h
+++ b/arch/ia64/include/asm/compat.h
@@ -199,7 +199,7 @@ ptr_to_compat(void __user *uptr)
 }
 
 static __inline__ void __user *
-compat_alloc_user_space (long len)
+arch_compat_alloc_user_space (long len)
 {
         struct pt_regs *regs = task_pt_regs(current);
         return (void __user *) (((regs->r12 & 0xffffffff) & -16) - len);
diff --git a/arch/ia64/kernel/fsys.S b/arch/ia64/kernel/fsys.S
index 3567d54f8cee..331d42bda77a 100644
--- a/arch/ia64/kernel/fsys.S
+++ b/arch/ia64/kernel/fsys.S
@@ -420,22 +420,31 @@ EX(.fail_efault, ld8 r14=[r33])			// r14 <- *set
         ;;
 
         RSM_PSR_I(p0, r18, r19)                 // mask interrupt delivery
-        mov ar.ccv=0
         andcm r14=r14,r17                       // filter out SIGKILL & SIGSTOP
+        mov r8=EINVAL                   // default to EINVAL
 
 #ifdef CONFIG_SMP
-        mov r17=1
+        // __ticket_spin_trylock(r31)
+        ld4 r17=[r31]
         ;;
-        cmpxchg4.acq r18=[r31],r17,ar.ccv       // try to acquire the lock
-        mov r8=EINVAL                   // default to EINVAL
+        mov.m ar.ccv=r17
+        extr.u r9=r17,17,15
+        adds r19=1,r17
+        extr.u r18=r17,0,15
+        ;;
+        cmp.eq p6,p7=r9,r18
         ;;
+(p6)    cmpxchg4.acq r9=[r31],r19,ar.ccv
+(p6)    dep.z r20=r19,1,15              // next serving ticket for unlock
+(p7)    br.cond.spnt.many .lock_contention
+        ;;
+        cmp4.eq p0,p7=r9,r17
+        adds r31=2,r31
+(p7)    br.cond.spnt.many .lock_contention
         ld8 r3=[r2]                     // re-read current->blocked now that we hold the lock
-        cmp4.ne p6,p0=r18,r0
-(p6)    br.cond.spnt.many .lock_contention
         ;;
 #else
         ld8 r3=[r2]                     // re-read current->blocked now that we hold the lock
-        mov r8=EINVAL                   // default to EINVAL
 #endif
         add r18=IA64_TASK_PENDING_OFFSET+IA64_SIGPENDING_SIGNAL_OFFSET,r16
         add r19=IA64_TASK_SIGNAL_OFFSET,r16
@@ -490,7 +499,9 @@ EX(.fail_efault, ld8 r14=[r33])			// r14 <- *set
 (p6)    br.cond.spnt.few 1b                     // yes -> retry
 
 #ifdef CONFIG_SMP
-        st4.rel [r31]=r0                        // release the lock
+        // __ticket_spin_unlock(r31)
+        st2.rel [r31]=r20
+        mov r20=0                                       // i must not leak kernel bits...
 #endif
         SSM_PSR_I(p0, p9, r31)
         ;;
@@ -512,7 +523,8 @@ EX(.fail_efault, (p15) st8 [r34]=r3)
 
 .sig_pending:
 #ifdef CONFIG_SMP
-        st4.rel [r31]=r0                        // release the lock
+        // __ticket_spin_unlock(r31)
+        st2.rel [r31]=r20                       // release the lock
 #endif
         SSM_PSR_I(p0, p9, r17)
         ;;
diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h
index 9c1acb2b1a92..b2eeb0de1c8d 100644
--- a/arch/m32r/include/asm/signal.h
+++ b/arch/m32r/include/asm/signal.h
@@ -157,7 +157,6 @@ typedef struct sigaltstack {
 #undef __HAVE_ARCH_SIG_BITOPS
 
 struct pt_regs;
-extern int do_signal(struct pt_regs *regs, sigset_t *oldset);
 
 #define ptrace_signal_deliver(regs, cookie)     do { } while (0)
 
diff --git a/arch/m32r/include/asm/unistd.h b/arch/m32r/include/asm/unistd.h
index 76125777483c..c70545689da8 100644
--- a/arch/m32r/include/asm/unistd.h
+++ b/arch/m32r/include/asm/unistd.h
@@ -351,6 +351,7 @@
 #define __ARCH_WANT_SYS_OLD_GETRLIMIT /*will be unused*/
 #define __ARCH_WANT_SYS_OLDUMOUNT
 #define __ARCH_WANT_SYS_RT_SIGACTION
+#define __ARCH_WANT_SYS_RT_SIGSUSPEND
 
 #define __IGNORE_lchown
 #define __IGNORE_setuid
diff --git a/arch/m32r/kernel/entry.S b/arch/m32r/kernel/entry.S
index 403869833b98..225412bc227e 100644
--- a/arch/m32r/kernel/entry.S
+++ b/arch/m32r/kernel/entry.S
@@ -235,10 +235,9 @@ work_resched:
 work_notifysig:                         ; deal with pending signals and
                                         ; notify-resume requests
         mv      r0, sp                  ; arg1 : struct pt_regs *regs
-        ldi     r1, #0                  ; arg2 : sigset_t *oldset
-        mv      r2, r9                  ; arg3 : __u32 thread_info_flags
+        mv      r1, r9                  ; arg2 : __u32 thread_info_flags
         bl      do_notify_resume
-        bra     restore_all
+        bra     resume_userspace
 
         ; perform syscall exit tracing
         ALIGN
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index e555091eb97c..0021ade4cba8 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -592,16 +592,17 @@ void user_enable_single_step(struct task_struct *child)
 
         if (access_process_vm(child, pc&~3, &insn, sizeof(insn), 0)
             != sizeof(insn))
-                break;
+                return -EIO;
 
         compute_next_pc(insn, pc, &next_pc, child);
         if (next_pc & 0x80000000)
-                break;
+                return -EIO;
 
         if (embed_debug_trap(child, next_pc))
-                break;
+                return -EIO;
 
         invalidate_cache();
+        return 0;
 }
 
 void user_disable_single_step(struct task_struct *child)
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 144b0f124fc7..7bbe38645ed5 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -28,37 +28,6 @@
 
 #define DEBUG_SIG 0
 
-#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
-
-int do_signal(struct pt_regs *, sigset_t *);
-
-asmlinkage int
-sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize,
-                  unsigned long r2, unsigned long r3, unsigned long r4,
-                  unsigned long r5, unsigned long r6, struct pt_regs *regs)
-{
-        sigset_t newset;
-
-        /* XXX: Don't preclude handling different sized sigset_t's.  */
-        if (sigsetsize != sizeof(sigset_t))
-                return -EINVAL;
-
-        if (copy_from_user(&newset, unewset, sizeof(newset)))
-                return -EFAULT;
-        sigdelsetmask(&newset, sigmask(SIGKILL)|sigmask(SIGSTOP));
-
-        spin_lock_irq(&current->sighand->siglock);
-        current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
-
-        current->state = TASK_INTERRUPTIBLE;
-        schedule();
-        set_thread_flag(TIF_RESTORE_SIGMASK);
-        return -ERESTARTNOHAND;
-}
-
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                 unsigned long r2, unsigned long r3, unsigned long r4,
@@ -218,7 +187,7 @@ get_sigframe(struct k_sigaction *ka, unsigned long sp, size_t frame_size)
         return (void __user *)((sp - frame_size) & -8ul);
 }
 
-static void setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                            sigset_t *set, struct pt_regs *regs)
 {
         struct rt_sigframe __user *frame;
@@ -275,22 +244,34 @@ static void setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                 current->comm, current->pid, frame, regs->pc);
 #endif
 
-        return;
+        return 0;
 
 give_sigsegv:
         force_sigsegv(sig, current);
+        return -EFAULT;
+}
+
+static int prev_insn(struct pt_regs *regs)
+{
+        u16 inst;
+        if (get_user(&inst, (u16 __user *)(regs->bpc - 2)))
+                return -EFAULT;
+        if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
+                regs->bpc -= 2;
+        else
+                regs->bpc -= 4;
+        regs->syscall_nr = -1;
+        return 0;
 }
 
 /*
  * OK, we're invoking a handler
  */
 
-static void
+static int
 handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
               sigset_t *oldset, struct pt_regs *regs)
 {
-        unsigned short inst;
-
         /* Are we from a system call? */
         if (regs->syscall_nr >= 0) {
                 /* If so, check system call restarting.. */
@@ -308,16 +289,14 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
                         /* fallthrough */
                         case -ERESTARTNOINTR:
                                 regs->r0 = regs->orig_r0;
-                                inst = *(unsigned short *)(regs->bpc - 2);
-                                if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
-                                        regs->bpc -= 2;
-                                else
-                                        regs->bpc -= 4;
+                                if (prev_insn(regs) < 0)
+                                        return -EFAULT;
                 }
         }
 
         /* Set up the stack frame */
-        setup_rt_frame(sig, ka, info, oldset, regs);
+        if (setup_rt_frame(sig, ka, info, oldset, regs))
+                return -EFAULT;
 
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
@@ -325,6 +304,7 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
                 sigaddset(&current->blocked,sig);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
+        return 0;
 }
 
 /*
@@ -332,12 +312,12 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
  * want to handle. Thus you cannot kill init even with a SIGKILL even by
  * mistake.
  */
-int do_signal(struct pt_regs *regs, sigset_t *oldset)
+static void do_signal(struct pt_regs *regs)
 {
         siginfo_t info;
         int signr;
         struct k_sigaction ka;
-        unsigned short inst;
+        sigset_t *oldset;
 
         /*
          * We want the common case to go fast, which
@@ -346,12 +326,14 @@ int do_signal(struct pt_regs *regs, sigset_t *oldset)
          * if so.
          */
         if (!user_mode(regs))
-                return 1;
+                return;
 
         if (try_to_freeze()) 
                 goto no_signal;
 
-        if (!oldset)
+        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                oldset = &current->saved_sigmask;
+        else
                 oldset = &current->blocked;
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
@@ -363,8 +345,10 @@ int do_signal(struct pt_regs *regs, sigset_t *oldset)
                  */
 
                 /* Whee!  Actually deliver the signal.  */
-                handle_signal(signr, &ka, &info, oldset, regs);
-                return 1;
+                if (handle_signal(signr, &ka, &info, oldset, regs) == 0)
+                        clear_thread_flag(TIF_RESTORE_SIGMASK);
+
+                return;
         }
 
  no_signal:
@@ -375,31 +359,24 @@ int do_signal(struct pt_regs *regs, sigset_t *oldset)
                     regs->r0 == -ERESTARTSYS ||
                     regs->r0 == -ERESTARTNOINTR) {
                         regs->r0 = regs->orig_r0;
-                        inst = *(unsigned short *)(regs->bpc - 2);
-                        if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
-                                regs->bpc -= 2;
-                        else
-                                regs->bpc -= 4;
-                }
-                if (regs->r0 == -ERESTART_RESTARTBLOCK){
+                        prev_insn(regs);
+                } else if (regs->r0 == -ERESTART_RESTARTBLOCK){
                         regs->r0 = regs->orig_r0;
                         regs->r7 = __NR_restart_syscall;
-                        inst = *(unsigned short *)(regs->bpc - 2);
-                        if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
-                                regs->bpc -= 2;
-                        else
-                                regs->bpc -= 4;
+                        prev_insn(regs);
                 }
         }
-        return 0;
+        if (test_thread_flag(TIF_RESTORE_SIGMASK)) {
+                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
+        }
 }
 
 /*
  * notification of userspace execution resumption
  * - triggered by current->work.notify_resume
  */
-void do_notify_resume(struct pt_regs *regs, sigset_t *oldset,
-                      __u32 thread_info_flags)
+void do_notify_resume(struct pt_regs *regs, __u32 thread_info_flags)
 {
         /* Pending single-step? */
         if (thread_info_flags & _TIF_SINGLESTEP)
@@ -407,7 +384,7 @@ void do_notify_resume(struct pt_regs *regs, sigset_t *oldset,
 
         /* deal with pending signal delivery */
         if (thread_info_flags & _TIF_SIGPENDING)
-                do_signal(regs,oldset);
+                do_signal(regs);
 
         if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                 clear_thread_flag(TIF_NOTIFY_RESUME);
diff --git a/arch/m68k/include/asm/unistd.h b/arch/m68k/include/asm/unistd.h
index 60b15d0aa072..b43b36beafe3 100644
--- a/arch/m68k/include/asm/unistd.h
+++ b/arch/m68k/include/asm/unistd.h
@@ -340,10 +340,13 @@
 #define __NR_set_thread_area    334
 #define __NR_atomic_cmpxchg_32  335
 #define __NR_atomic_barrier     336
+#define __NR_fanotify_init      337
+#define __NR_fanotify_mark      338
+#define __NR_prlimit64          339
 
 #ifdef __KERNEL__
 
-#define NR_syscalls             337
+#define NR_syscalls             340
 
 #define __ARCH_WANT_IPC_PARSE_VERSION
 #define __ARCH_WANT_OLD_READDIR
diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index 2391bdff0996..6360c437dcf5 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S
@@ -765,4 +765,7 @@ sys_call_table:
         .long sys_set_thread_area
         .long sys_atomic_cmpxchg_32     /* 335 */
         .long sys_atomic_barrier
+        .long sys_fanotify_init
+        .long sys_fanotify_mark
+        .long sys_prlimit64
 
diff --git a/arch/m68knommu/kernel/syscalltable.S b/arch/m68knommu/kernel/syscalltable.S
index b30b3eb197a5..79b1ed198c07 100644
--- a/arch/m68knommu/kernel/syscalltable.S
+++ b/arch/m68knommu/kernel/syscalltable.S
@@ -355,6 +355,9 @@ ENTRY(sys_call_table)
         .long sys_set_thread_area
         .long sys_atomic_cmpxchg_32     /* 335 */
         .long sys_atomic_barrier
+        .long sys_fanotify_init
+        .long sys_fanotify_mark
+        .long sys_prlimit64
 
         .rept NR_syscalls-(.-sys_call_table)/4
                 .long sys_ni_syscall
diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h
index 613f6912dfc1..dbc51065df5b 100644
--- a/arch/mips/include/asm/compat.h
+++ b/arch/mips/include/asm/compat.h
@@ -145,7 +145,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = (struct pt_regs *)
                 ((unsigned long) current_thread_info() + THREAD_SIZE - 32) - 1;
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index 444b9f918fdf..7c2a2f7f8dc1 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -8,7 +8,6 @@ mainmenu "Linux Kernel Configuration"
 config MN10300
         def_bool y
         select HAVE_OPROFILE
-        select HAVE_ARCH_TRACEHOOK
 
 config AM33
         def_bool y
diff --git a/arch/mn10300/include/asm/bitops.h b/arch/mn10300/include/asm/bitops.h
index f49ac49e09ad..3f50e9661076 100644
--- a/arch/mn10300/include/asm/bitops.h
+++ b/arch/mn10300/include/asm/bitops.h
@@ -229,9 +229,9 @@ int ffs(int x)
 #include <asm-generic/bitops/hweight.h>
 
 #define ext2_set_bit_atomic(lock, nr, addr) \
-        test_and_set_bit((nr) ^ 0x18, (addr))
+        test_and_set_bit((nr), (addr))
 #define ext2_clear_bit_atomic(lock, nr, addr) \
-        test_and_clear_bit((nr) ^ 0x18, (addr))
+        test_and_clear_bit((nr), (addr))
 
 #include <asm-generic/bitops/ext2-non-atomic.h>
 #include <asm-generic/bitops/minix-le.h>
diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h
index 7e891fce2370..1865d72a86ff 100644
--- a/arch/mn10300/include/asm/signal.h
+++ b/arch/mn10300/include/asm/signal.h
@@ -78,7 +78,7 @@ typedef unsigned long sigset_t;
 
 /* These should not be considered constants from userland.  */
 #define SIGRTMIN        32
-#define SIGRTMAX        (_NSIG-1)
+#define SIGRTMAX        _NSIG
 
 /*
  * SA_FLAGS values:
diff --git a/arch/mn10300/kernel/mn10300-serial.c b/arch/mn10300/kernel/mn10300-serial.c
index 9d49073e827a..db509dd80565 100644
--- a/arch/mn10300/kernel/mn10300-serial.c
+++ b/arch/mn10300/kernel/mn10300-serial.c
@@ -156,17 +156,17 @@ struct mn10300_serial_port mn10300_serial_port_sif0 = {
         ._intr          = &SC0ICR,
         ._rxb           = &SC0RXB,
         ._txb           = &SC0TXB,
-        .rx_name        = "ttySM0/Rx",
-        .tx_name        = "ttySM0/Tx",
+        .rx_name        = "ttySM0:Rx",
+        .tx_name        = "ttySM0:Tx",
 #ifdef CONFIG_MN10300_TTYSM0_TIMER8
-        .tm_name        = "ttySM0/Timer8",
+        .tm_name        = "ttySM0:Timer8",
         ._tmxmd         = &TM8MD,
         ._tmxbr         = &TM8BR,
         ._tmicr         = &TM8ICR,
         .tm_irq         = TM8IRQ,
         .div_timer      = MNSCx_DIV_TIMER_16BIT,
 #else /* CONFIG_MN10300_TTYSM0_TIMER2 */
-        .tm_name        = "ttySM0/Timer2",
+        .tm_name        = "ttySM0:Timer2",
         ._tmxmd         = &TM2MD,
         ._tmxbr         = (volatile u16 *) &TM2BR,
         ._tmicr         = &TM2ICR,
@@ -209,17 +209,17 @@ struct mn10300_serial_port mn10300_serial_port_sif1 = {
         ._intr          = &SC1ICR,
         ._rxb           = &SC1RXB,
         ._txb           = &SC1TXB,
-        .rx_name        = "ttySM1/Rx",
-        .tx_name        = "ttySM1/Tx",
+        .rx_name        = "ttySM1:Rx",
+        .tx_name        = "ttySM1:Tx",
 #ifdef CONFIG_MN10300_TTYSM1_TIMER9
-        .tm_name        = "ttySM1/Timer9",
+        .tm_name        = "ttySM1:Timer9",
         ._tmxmd         = &TM9MD,
         ._tmxbr         = &TM9BR,
         ._tmicr         = &TM9ICR,
         .tm_irq         = TM9IRQ,
         .div_timer      = MNSCx_DIV_TIMER_16BIT,
 #else /* CONFIG_MN10300_TTYSM1_TIMER3 */
-        .tm_name        = "ttySM1/Timer3",
+        .tm_name        = "ttySM1:Timer3",
         ._tmxmd         = &TM3MD,
         ._tmxbr         = (volatile u16 *) &TM3BR,
         ._tmicr         = &TM3ICR,
@@ -260,9 +260,9 @@ struct mn10300_serial_port mn10300_serial_port_sif2 = {
         .uart.lock      =
         __SPIN_LOCK_UNLOCKED(mn10300_serial_port_sif2.uart.lock),
         .name           = "ttySM2",
-        .rx_name        = "ttySM2/Rx",
-        .tx_name        = "ttySM2/Tx",
-        .tm_name        = "ttySM2/Timer10",
+        .rx_name        = "ttySM2:Rx",
+        .tx_name        = "ttySM2:Tx",
+        .tm_name        = "ttySM2:Timer10",
         ._iobase        = &SC2CTR,
         ._control       = &SC2CTR,
         ._status        = &SC2STR,
diff --git a/arch/parisc/include/asm/compat.h b/arch/parisc/include/asm/compat.h
index 02b77baa5da6..efa0b60c63fe 100644
--- a/arch/parisc/include/asm/compat.h
+++ b/arch/parisc/include/asm/compat.h
@@ -147,7 +147,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static __inline__ void __user *compat_alloc_user_space(long len)
+static __inline__ void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = &current->thread.regs;
         return (void __user *)regs->gr[30];
diff --git a/arch/powerpc/include/asm/compat.h b/arch/powerpc/include/asm/compat.h
index 396d21a80058..a11d4eac4f97 100644
--- a/arch/powerpc/include/asm/compat.h
+++ b/arch/powerpc/include/asm/compat.h
@@ -134,7 +134,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = current->thread.regs;
         unsigned long usp = regs->gpr[1];
diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
index 7109f5b1baa8..2300426e531a 100644
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -138,6 +138,7 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
                         ti->local_flags &= ~_TLF_RESTORE_SIGMASK;
                         sigprocmask(SIG_SETMASK, &current->saved_sigmask, NULL);
                 }
+                regs->trap = 0;
                 return 0;               /* no signals delivered */
         }
 
@@ -164,6 +165,7 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
                 ret = handle_rt_signal64(signr, &ka, &info, oldset, regs);
         }
 
+        regs->trap = 0;
         if (ret) {
                 spin_lock_irq(&current->sighand->siglock);
                 sigorsets(&current->blocked, &current->blocked,
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 266610119f66..b96a3a010c26 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -511,6 +511,7 @@ static long restore_user_regs(struct pt_regs *regs,
         if (!sig)
                 save_r2 = (unsigned int)regs->gpr[2];
         err = restore_general_regs(regs, sr);
+        regs->trap = 0;
         err |= __get_user(msr, &sr->mc_gregs[PT_MSR]);
         if (!sig)
                 regs->gpr[2] = (unsigned long) save_r2;
@@ -884,7 +885,6 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
         regs->nip = (unsigned long) ka->sa.sa_handler;
         /* enter the signal handler in big-endian mode */
         regs->msr &= ~MSR_LE;
-        regs->trap = 0;
         return 1;
 
 badframe:
@@ -1228,7 +1228,6 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
         regs->nip = (unsigned long) ka->sa.sa_handler;
         /* enter the signal handler in big-endian mode */
         regs->msr &= ~MSR_LE;
-        regs->trap = 0;
 
         return 1;
 
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 2fe6fc64b614..27c4a4584f80 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -178,7 +178,7 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
         err |= __get_user(regs->xer, &sc->gp_regs[PT_XER]);
         err |= __get_user(regs->ccr, &sc->gp_regs[PT_CCR]);
         /* skip SOFTE */
-        err |= __get_user(regs->trap, &sc->gp_regs[PT_TRAP]);
+        regs->trap = 0;
         err |= __get_user(regs->dar, &sc->gp_regs[PT_DAR]);
         err |= __get_user(regs->dsisr, &sc->gp_regs[PT_DSISR]);
         err |= __get_user(regs->result, &sc->gp_regs[PT_RESULT]);
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index 104f2007f097..a875c2f542e1 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -181,7 +181,7 @@ static inline int is_compat_task(void)
 
 #endif
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         unsigned long stack;
 
diff --git a/arch/sparc/include/asm/compat.h b/arch/sparc/include/asm/compat.h
index 5016f76ea98a..6f57325bb883 100644
--- a/arch/sparc/include/asm/compat.h
+++ b/arch/sparc/include/asm/compat.h
@@ -167,7 +167,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = current_thread_info()->kregs;
         unsigned long usp = regs->u_regs[UREG_I6];
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 357ced3c33ff..6318e622cfb0 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -1038,6 +1038,7 @@ static int __hw_perf_event_init(struct perf_event *event)
         if (atomic_read(&nmi_active) < 0)
                 return -ENODEV;
 
+        pmap = NULL;
         if (attr->type == PERF_TYPE_HARDWARE) {
                 if (attr->config >= sparc_pmu->max_events)
                         return -EINVAL;
@@ -1046,9 +1047,18 @@ static int __hw_perf_event_init(struct perf_event *event)
                 pmap = sparc_map_cache_event(attr->config);
                 if (IS_ERR(pmap))
                         return PTR_ERR(pmap);
-        } else
+        } else if (attr->type != PERF_TYPE_RAW)
                 return -EOPNOTSUPP;
 
+        if (pmap) {
+                hwc->event_base = perf_event_encode(pmap);
+        } else {
+                /* User gives us "(encoding << 16) | pic_mask" for
+                 * PERF_TYPE_RAW events.
+                 */
+                hwc->event_base = attr->config;
+        }
+
         /* We save the enable bits in the config_base.  */
         hwc->config_base = sparc_pmu->irq_bit;
         if (!attr->exclude_user)
@@ -1058,8 +1068,6 @@ static int __hw_perf_event_init(struct perf_event *event)
         if (!attr->exclude_hv)
                 hwc->config_base |= sparc_pmu->hv_bit;
 
-        hwc->event_base = perf_event_encode(pmap);
-
         n = 0;
         if (event->group_leader != event) {
                 n = collect_events(event->group_leader,
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index ea22cd373c64..75fad425e249 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -453,8 +453,66 @@ static int save_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
         return err;
 }
 
-static void setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
-                          int signo, sigset_t *oldset)
+/* The I-cache flush instruction only works in the primary ASI, which
+ * right now is the nucleus, aka. kernel space.
+ *
+ * Therefore we have to kick the instructions out using the kernel
+ * side linear mapping of the physical address backing the user
+ * instructions.
+ */
+static void flush_signal_insns(unsigned long address)
+{
+        unsigned long pstate, paddr;
+        pte_t *ptep, pte;
+        pgd_t *pgdp;
+        pud_t *pudp;
+        pmd_t *pmdp;
+
+        /* Commit all stores of the instructions we are about to flush.  */
+        wmb();
+
+        /* Disable cross-call reception.  In this way even a very wide
+         * munmap() on another cpu can't tear down the page table
+         * hierarchy from underneath us, since that can't complete
+         * until the IPI tlb flush returns.
+         */
+
+        __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
+        __asm__ __volatile__("wrpr %0, %1, %%pstate"
+                                : : "r" (pstate), "i" (PSTATE_IE));
+
+        pgdp = pgd_offset(current->mm, address);
+        if (pgd_none(*pgdp))
+                goto out_irqs_on;
+        pudp = pud_offset(pgdp, address);
+        if (pud_none(*pudp))
+                goto out_irqs_on;
+        pmdp = pmd_offset(pudp, address);
+        if (pmd_none(*pmdp))
+                goto out_irqs_on;
+
+        ptep = pte_offset_map(pmdp, address);
+        pte = *ptep;
+        if (!pte_present(pte))
+                goto out_unmap;
+
+        paddr = (unsigned long) page_address(pte_page(pte));
+
+        __asm__ __volatile__("flush     %0 + %1"
+                             : /* no outputs */
+                             : "r" (paddr),
+                               "r" (address & (PAGE_SIZE - 1))
+                             : "memory");
+
+out_unmap:
+        pte_unmap(ptep);
+out_irqs_on:
+        __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
+
+}
+
+static int setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
+                         int signo, sigset_t *oldset)
 {
         struct signal_frame32 __user *sf;
         int sigframe_size;
@@ -547,13 +605,7 @@ static void setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
         if (ka->ka_restorer) {
                 regs->u_regs[UREG_I7] = (unsigned long)ka->ka_restorer;
         } else {
-                /* Flush instruction space. */
                 unsigned long address = ((unsigned long)&(sf->insns[0]));
-                pgd_t *pgdp = pgd_offset(current->mm, address);
-                pud_t *pudp = pud_offset(pgdp, address);
-                pmd_t *pmdp = pmd_offset(pudp, address);
-                pte_t *ptep;
-                pte_t pte;
 
                 regs->u_regs[UREG_I7] = (unsigned long) (&(sf->insns[0]) - 2);
         
@@ -562,34 +614,22 @@ static void setup_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                 if (err)
                         goto sigsegv;
 
-                preempt_disable();
-                ptep = pte_offset_map(pmdp, address);
-                pte = *ptep;
-                if (pte_present(pte)) {
-                        unsigned long page = (unsigned long)
-                                page_address(pte_page(pte));
-
-                        wmb();
-                        __asm__ __volatile__("flush     %0 + %1"
-                                             : /* no outputs */
-                                             : "r" (page),
-                                               "r" (address & (PAGE_SIZE - 1))
-                                             : "memory");
-                }
-                pte_unmap(ptep);
-                preempt_enable();
+                flush_signal_insns(address);
         }
-        return;
+        return 0;
 
 sigill:
         do_exit(SIGILL);
+        return -EINVAL;
+
 sigsegv:
         force_sigsegv(signo, current);
+        return -EFAULT;
 }
 
-static void setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
-                             unsigned long signr, sigset_t *oldset,
-                             siginfo_t *info)
+static int setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
+                            unsigned long signr, sigset_t *oldset,
+                            siginfo_t *info)
 {
         struct rt_signal_frame32 __user *sf;
         int sigframe_size;
@@ -687,12 +727,7 @@ static void setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
         if (ka->ka_restorer)
                 regs->u_regs[UREG_I7] = (unsigned long)ka->ka_restorer;
         else {
-                /* Flush instruction space. */
                 unsigned long address = ((unsigned long)&(sf->insns[0]));
-                pgd_t *pgdp = pgd_offset(current->mm, address);
-                pud_t *pudp = pud_offset(pgdp, address);
-                pmd_t *pmdp = pmd_offset(pudp, address);
-                pte_t *ptep;
 
                 regs->u_regs[UREG_I7] = (unsigned long) (&(sf->insns[0]) - 2);
         
@@ -704,38 +739,32 @@ static void setup_rt_frame32(struct k_sigaction *ka, struct pt_regs *regs,
                 if (err)
                         goto sigsegv;
 
-                preempt_disable();
-                ptep = pte_offset_map(pmdp, address);
-                if (pte_present(*ptep)) {
-                        unsigned long page = (unsigned long)
-                                page_address(pte_page(*ptep));
-
-                        wmb();
-                        __asm__ __volatile__("flush     %0 + %1"
-                                             : /* no outputs */
-                                             : "r" (page),
-                                               "r" (address & (PAGE_SIZE - 1))
-                                             : "memory");
-                }
-                pte_unmap(ptep);
-                preempt_enable();
+                flush_signal_insns(address);
         }
-        return;
+        return 0;
 
 sigill:
         do_exit(SIGILL);
+        return -EINVAL;
+
 sigsegv:
         force_sigsegv(signr, current);
+        return -EFAULT;
 }
 
-static inline void handle_signal32(unsigned long signr, struct k_sigaction *ka,
-                                   siginfo_t *info,
-                                   sigset_t *oldset, struct pt_regs *regs)
+static inline int handle_signal32(unsigned long signr, struct k_sigaction *ka,
+                                  siginfo_t *info,
+                                  sigset_t *oldset, struct pt_regs *regs)
 {
+        int err;
+
         if (ka->sa.sa_flags & SA_SIGINFO)
-                setup_rt_frame32(ka, regs, signr, oldset, info);
+                err = setup_rt_frame32(ka, regs, signr, oldset, info);
         else
-                setup_frame32(ka, regs, signr, oldset);
+                err = setup_frame32(ka, regs, signr, oldset);
+
+        if (err)
+                return err;
 
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
@@ -743,6 +772,10 @@ static inline void handle_signal32(unsigned long signr, struct k_sigaction *ka,
                 sigaddset(&current->blocked,signr);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
+
+        tracehook_signal_handler(signr, info, ka, regs, 0);
+
+        return 0;
 }
 
 static inline void syscall_restart32(unsigned long orig_i0, struct pt_regs *regs,
@@ -789,16 +822,14 @@ void do_signal32(sigset_t *oldset, struct pt_regs * regs,
         if (signr > 0) {
                 if (restart_syscall)
                         syscall_restart32(orig_i0, regs, &ka.sa);
-                handle_signal32(signr, &ka, &info, oldset, regs);
-
-                /* A signal was successfully delivered; the saved
-                 * sigmask will have been stored in the signal frame,
-                 * and will be restored by sigreturn, so we can simply
-                 * clear the TS_RESTORE_SIGMASK flag.
-                 */
-                current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
-
-                tracehook_signal_handler(signr, &info, &ka, regs, 0);
+                if (handle_signal32(signr, &ka, &info, oldset, regs) == 0) {
+                        /* A signal was successfully delivered; the saved
+                         * sigmask will have been stored in the signal frame,
+                         * and will be restored by sigreturn, so we can simply
+                         * clear the TS_RESTORE_SIGMASK flag.
+                         */
+                        current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
+                }
                 return;
         }
         if (restart_syscall &&
@@ -809,12 +840,14 @@ void do_signal32(sigset_t *oldset, struct pt_regs * regs,
                 regs->u_regs[UREG_I0] = orig_i0;
                 regs->tpc -= 4;
                 regs->tnpc -= 4;
+                pt_regs_clear_syscall(regs);
         }
         if (restart_syscall &&
             regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                 regs->tpc -= 4;
                 regs->tnpc -= 4;
+                pt_regs_clear_syscall(regs);
         }
 
         /* If there's no signal to deliver, we just put the saved sigmask
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 9882df92ba0a..5e5c5fd03783 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -315,8 +315,8 @@ save_fpu_state(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
         return err;
 }
 
-static void setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
-                        int signo, sigset_t *oldset)
+static int setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
+                       int signo, sigset_t *oldset)
 {
         struct signal_frame __user *sf;
         int sigframe_size, err;
@@ -384,16 +384,19 @@ static void setup_frame(struct k_sigaction *ka, struct pt_regs *regs,
                 /* Flush instruction space. */
                 flush_sig_insns(current->mm, (unsigned long) &(sf->insns[0]));
         }
-        return;
+        return 0;
 
 sigill_and_return:
         do_exit(SIGILL);
+        return -EINVAL;
+
 sigsegv:
         force_sigsegv(signo, current);
+        return -EFAULT;
 }
 
-static void setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
-                           int signo, sigset_t *oldset, siginfo_t *info)
+static int setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
+                          int signo, sigset_t *oldset, siginfo_t *info)
 {
         struct rt_signal_frame __user *sf;
         int sigframe_size;
@@ -466,22 +469,30 @@ static void setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
                 /* Flush instruction space. */
                 flush_sig_insns(current->mm, (unsigned long) &(sf->insns[0]));
         }
-        return;
+        return 0;
 
 sigill:
         do_exit(SIGILL);
+        return -EINVAL;
+
 sigsegv:
         force_sigsegv(signo, current);
+        return -EFAULT;
 }
 
-static inline void
+static inline int
 handle_signal(unsigned long signr, struct k_sigaction *ka,
               siginfo_t *info, sigset_t *oldset, struct pt_regs *regs)
 {
+        int err;
+
         if (ka->sa.sa_flags & SA_SIGINFO)
-                setup_rt_frame(ka, regs, signr, oldset, info);
+                err = setup_rt_frame(ka, regs, signr, oldset, info);
         else
-                setup_frame(ka, regs, signr, oldset);
+                err = setup_frame(ka, regs, signr, oldset);
+
+        if (err)
+                return err;
 
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
@@ -489,6 +500,10 @@ handle_signal(unsigned long signr, struct k_sigaction *ka,
                 sigaddset(&current->blocked, signr);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
+
+        tracehook_signal_handler(signr, info, ka, regs, 0);
+
+        return 0;
 }
 
 static inline void syscall_restart(unsigned long orig_i0, struct pt_regs *regs,
@@ -546,17 +561,15 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
         if (signr > 0) {
                 if (restart_syscall)
                         syscall_restart(orig_i0, regs, &ka.sa);
-                handle_signal(signr, &ka, &info, oldset, regs);
-
-                /* a signal was successfully delivered; the saved
-                 * sigmask will have been stored in the signal frame,
-                 * and will be restored by sigreturn, so we can simply
-                 * clear the TIF_RESTORE_SIGMASK flag.
-                 */
-                if (test_thread_flag(TIF_RESTORE_SIGMASK))
-                        clear_thread_flag(TIF_RESTORE_SIGMASK);
-
-                tracehook_signal_handler(signr, &info, &ka, regs, 0);
+                if (handle_signal(signr, &ka, &info, oldset, regs) == 0) {
+                        /* a signal was successfully delivered; the saved
+                         * sigmask will have been stored in the signal frame,
+                         * and will be restored by sigreturn, so we can simply
+                         * clear the TIF_RESTORE_SIGMASK flag.
+                         */
+                        if (test_thread_flag(TIF_RESTORE_SIGMASK))
+                                clear_thread_flag(TIF_RESTORE_SIGMASK);
+                }
                 return;
         }
         if (restart_syscall &&
@@ -567,12 +580,14 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                 regs->u_regs[UREG_I0] = orig_i0;
                 regs->pc -= 4;
                 regs->npc -= 4;
+                pt_regs_clear_syscall(regs);
         }
         if (restart_syscall &&
             regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                 regs->pc -= 4;
                 regs->npc -= 4;
+                pt_regs_clear_syscall(regs);
         }
 
         /* if there's no signal to deliver, we just put the saved sigmask
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 9fa48c30037e..006fe4515886 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -409,7 +409,7 @@ static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *
         return (void __user *) sp;
 }
 
-static inline void
+static inline int
 setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
                int signo, sigset_t *oldset, siginfo_t *info)
 {
@@ -483,26 +483,37 @@ setup_rt_frame(struct k_sigaction *ka, struct pt_regs *regs,
         }
         /* 4. return to kernel instructions */
         regs->u_regs[UREG_I7] = (unsigned long)ka->ka_restorer;
-        return;
+        return 0;
 
 sigill:
         do_exit(SIGILL);
+        return -EINVAL;
+
 sigsegv:
         force_sigsegv(signo, current);
+        return -EFAULT;
 }
 
-static inline void handle_signal(unsigned long signr, struct k_sigaction *ka,
-                                 siginfo_t *info,
-                                 sigset_t *oldset, struct pt_regs *regs)
+static inline int handle_signal(unsigned long signr, struct k_sigaction *ka,
+                                siginfo_t *info,
+                                sigset_t *oldset, struct pt_regs *regs)
 {
-        setup_rt_frame(ka, regs, signr, oldset,
-                       (ka->sa.sa_flags & SA_SIGINFO) ? info : NULL);
+        int err;
+
+        err = setup_rt_frame(ka, regs, signr, oldset,
+                             (ka->sa.sa_flags & SA_SIGINFO) ? info : NULL);
+        if (err)
+                return err;
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
         if (!(ka->sa.sa_flags & SA_NOMASK))
                 sigaddset(&current->blocked,signr);
         recalc_sigpending();
         spin_unlock_irq(&current->sighand->siglock);
+
+        tracehook_signal_handler(signr, info, ka, regs, 0);
+
+        return 0;
 }
 
 static inline void syscall_restart(unsigned long orig_i0, struct pt_regs *regs,
@@ -571,16 +582,14 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
         if (signr > 0) {
                 if (restart_syscall)
                         syscall_restart(orig_i0, regs, &ka.sa);
-                handle_signal(signr, &ka, &info, oldset, regs);
-
-                /* A signal was successfully delivered; the saved
-                 * sigmask will have been stored in the signal frame,
-                 * and will be restored by sigreturn, so we can simply
-                 * clear the TS_RESTORE_SIGMASK flag.
-                 */
-                current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
-
-                tracehook_signal_handler(signr, &info, &ka, regs, 0);
+                if (handle_signal(signr, &ka, &info, oldset, regs) == 0) {
+                        /* A signal was successfully delivered; the saved
+                         * sigmask will have been stored in the signal frame,
+                         * and will be restored by sigreturn, so we can simply
+                         * clear the TS_RESTORE_SIGMASK flag.
+                         */
+                        current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
+                }
                 return;
         }
         if (restart_syscall &&
@@ -591,12 +600,14 @@ static void do_signal(struct pt_regs *regs, unsigned long orig_i0)
                 regs->u_regs[UREG_I0] = orig_i0;
                 regs->tpc -= 4;
                 regs->tnpc -= 4;
+                pt_regs_clear_syscall(regs);
         }
         if (restart_syscall &&
             regs->u_regs[UREG_I0] == ERESTART_RESTARTBLOCK) {
                 regs->u_regs[UREG_G1] = __NR_restart_syscall;
                 regs->tpc -= 4;
                 regs->tnpc -= 4;
+                pt_regs_clear_syscall(regs);
         }
 
         /* If there's no signal to deliver, we just put the saved sigmask
diff --git a/arch/tile/include/asm/compat.h b/arch/tile/include/asm/compat.h
index 070ad0a5ef1c..8b60ec8b2d19 100644
--- a/arch/tile/include/asm/compat.h
+++ b/arch/tile/include/asm/compat.h
@@ -195,7 +195,7 @@ static inline unsigned long ptr_to_compat_reg(void __user *uptr)
         return (long)(int)(long __force)uptr;
 }
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = task_pt_regs(current);
         return (void __user *)regs->sp - len;
diff --git a/arch/um/kernel/exec.c b/arch/um/kernel/exec.c
index cd145eda3579..49b5e1eb3262 100644
--- a/arch/um/kernel/exec.c
+++ b/arch/um/kernel/exec.c
@@ -62,7 +62,7 @@ static long execve1(const char *file,
         return error;
 }
 
-long um_execve(const char *file, char __user *__user *argv, char __user *__user *env)
+long um_execve(const char *file, const char __user *const __user *argv, const char __user *const __user *env)
 {
         long err;
 
@@ -72,8 +72,8 @@ long um_execve(const char *file, char __user *__user *argv, char __user *__user
         return err;
 }
 
-long sys_execve(const char __user *file, char __user *__user *argv,
-                char __user *__user *env)
+long sys_execve(const char __user *file, const char __user *const __user *argv,
+                const char __user *const __user *env)
 {
         long error;
         char *filename;
diff --git a/arch/um/kernel/internal.h b/arch/um/kernel/internal.h
index 1303a105fe91..5bf97db24a04 100644
--- a/arch/um/kernel/internal.h
+++ b/arch/um/kernel/internal.h
@@ -1 +1 @@
-extern long um_execve(const char *file, char __user *__user *argv, char __user *__user *env);
+extern long um_execve(const char *file, const char __user *const __user *argv, const char __user *const __user *env);
diff --git a/arch/um/kernel/syscall.c b/arch/um/kernel/syscall.c
index 5ddb246626db..f958cb876ee3 100644
--- a/arch/um/kernel/syscall.c
+++ b/arch/um/kernel/syscall.c
@@ -60,8 +60,8 @@ int kernel_execve(const char *filename,
 
         fs = get_fs();
         set_fs(KERNEL_DS);
-        ret = um_execve(filename, (char __user *__user *)argv,
-                        (char __user *__user *) envp);
+        ret = um_execve(filename, (const char __user *const __user *)argv,
+                        (const char __user *const __user *) envp);
         set_fs(fs);
 
         return ret;
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 8aa1b59b9074..e8c8881351b3 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -74,7 +74,7 @@ endif
 
 ifdef CONFIG_CC_STACKPROTECTOR
         cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
-        ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(biarch)),y)
+        ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(KBUILD_CPPFLAGS) $(biarch)),y)
                 stackp-y := -fstack-protector
                 KBUILD_CFLAGS += $(stackp-y)
         else
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index b86feabed69b..518bb99c3394 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -50,7 +50,12 @@
         /*
          * Reload arg registers from stack in case ptrace changed them.
          * We don't reload %eax because syscall_trace_enter() returned
-         * the value it wants us to use in the table lookup.
+         * the %rax value we should see.  Instead, we just truncate that
+         * value to 32 bits again as we did on entry from user mode.
+         * If it's a new value set by user_regset during entry tracing,
+         * this matches the normal truncation of the user-mode value.
+         * If it's -1 to make us punt the syscall, then (u32)-1 is still
+         * an appropriately invalid value.
          */
         .macro LOAD_ARGS32 offset, _r9=0
         .if \_r9
@@ -60,6 +65,7 @@
         movl \offset+48(%rsp),%edx
         movl \offset+56(%rsp),%esi
         movl \offset+64(%rsp),%edi
+        movl %eax,%eax                  /* zero extension */
         .endm
         
         .macro CFI_STARTPROC32 simple
@@ -153,7 +159,7 @@ ENTRY(ia32_sysenter_target)
         testl  $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
         CFI_REMEMBER_STATE
         jnz  sysenter_tracesys
-        cmpl    $(IA32_NR_syscalls-1),%eax
+        cmpq    $(IA32_NR_syscalls-1),%rax
         ja      ia32_badsys
 sysenter_do_call:
         IA32_ARG_FIXUP
@@ -195,7 +201,7 @@ sysexit_from_sys_call:
         movl $AUDIT_ARCH_I386,%edi      /* 1st arg: audit arch */
         call audit_syscall_entry
         movl RAX-ARGOFFSET(%rsp),%eax   /* reload syscall number */
-        cmpl $(IA32_NR_syscalls-1),%eax
+        cmpq $(IA32_NR_syscalls-1),%rax
         ja ia32_badsys
         movl %ebx,%edi                  /* reload 1st syscall arg */
         movl RCX-ARGOFFSET(%rsp),%esi   /* reload 2nd syscall arg */
@@ -248,7 +254,7 @@ sysenter_tracesys:
         call    syscall_trace_enter
         LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
-        cmpl    $(IA32_NR_syscalls-1),%eax
+        cmpq    $(IA32_NR_syscalls-1),%rax
         ja      int_ret_from_sys_call /* sysenter_tracesys has set RAX(%rsp) */
         jmp     sysenter_do_call
         CFI_ENDPROC
@@ -314,7 +320,7 @@ ENTRY(ia32_cstar_target)
         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
         CFI_REMEMBER_STATE
         jnz   cstar_tracesys
-        cmpl $IA32_NR_syscalls-1,%eax
+        cmpq $IA32_NR_syscalls-1,%rax
         ja  ia32_badsys
 cstar_do_call:
         IA32_ARG_FIXUP 1
@@ -367,7 +373,7 @@ cstar_tracesys:
         LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
         xchgl %ebp,%r9d
-        cmpl $(IA32_NR_syscalls-1),%eax
+        cmpq $(IA32_NR_syscalls-1),%rax
         ja int_ret_from_sys_call /* cstar_tracesys has set RAX(%rsp) */
         jmp cstar_do_call
 END(ia32_cstar_target)
@@ -425,7 +431,7 @@ ENTRY(ia32_syscall)
         orl   $TS_COMPAT,TI_status(%r10)
         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
         jnz ia32_tracesys
-        cmpl $(IA32_NR_syscalls-1),%eax
+        cmpq $(IA32_NR_syscalls-1),%rax
         ja ia32_badsys
 ia32_do_call:
         IA32_ARG_FIXUP
@@ -444,7 +450,7 @@ ia32_tracesys:
         call syscall_trace_enter
         LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
-        cmpl $(IA32_NR_syscalls-1),%eax
+        cmpq $(IA32_NR_syscalls-1),%rax
         ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
         jmp ia32_do_call
 END(ia32_syscall)
diff --git a/arch/x86/include/asm/compat.h b/arch/x86/include/asm/compat.h
index 306160e58b48..1d9cd27c2920 100644
--- a/arch/x86/include/asm/compat.h
+++ b/arch/x86/include/asm/compat.h
@@ -205,7 +205,7 @@ static inline compat_uptr_t ptr_to_compat(void __user *uptr)
         return (u32)(unsigned long)uptr;
 }
 
-static inline void __user *compat_alloc_user_space(long len)
+static inline void __user *arch_compat_alloc_user_space(long len)
 {
         struct pt_regs *regs = task_pt_regs(current);
         return (void __user *)regs->sp - len;
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 781a50b29a49..c6fbb7b430d1 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -296,6 +296,7 @@ extern const char * const x86_power_flags[32];
 
 #endif /* CONFIG_X86_64 */
 
+#if __GNUC__ >= 4
 /*
  * Static testing of CPU features.  Used the same as boot_cpu_has().
  * These are only valid after alternatives have run, but will statically
@@ -304,7 +305,7 @@ extern const char * const x86_power_flags[32];
  */
 static __always_inline __pure bool __static_cpu_has(u16 bit)
 {
-#if __GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5)
+#if __GNUC__ > 4 || __GNUC_MINOR__ >= 5
                 asm goto("1: jmp %l[t_no]\n"
                          "2:\n"
                          ".section .altinstructions,\"a\"\n"
@@ -345,7 +346,6 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
 #endif
 }
 
-#if __GNUC__ >= 4
 #define static_cpu_has(bit)                                     \
 (                                                               \
         __builtin_constant_p(boot_cpu_has(bit)) ?               \
diff --git a/arch/x86/include/asm/hpet.h b/arch/x86/include/asm/hpet.h
index 004e6e25e913..1d5c08a1bdfd 100644
--- a/arch/x86/include/asm/hpet.h
+++ b/arch/x86/include/asm/hpet.h
@@ -68,7 +68,6 @@ extern unsigned long force_hpet_address;
 extern u8 hpet_blockid;
 extern int hpet_force_user;
 extern u8 hpet_msi_disable;
-extern u8 hpet_readback_cmp;
 extern int is_hpet_enabled(void);
 extern int hpet_enable(void);
 extern void hpet_disable(void);
diff --git a/arch/x86/include/asm/hw_breakpoint.h b/arch/x86/include/asm/hw_breakpoint.h
index 528a11e8d3e3..824ca07860d0 100644
--- a/arch/x86/include/asm/hw_breakpoint.h
+++ b/arch/x86/include/asm/hw_breakpoint.h
@@ -20,7 +20,7 @@ struct arch_hw_breakpoint {
 #include <linux/list.h>
 
 /* Available HW breakpoint length encodings */
-#define X86_BREAKPOINT_LEN_X            0x00
+#define X86_BREAKPOINT_LEN_X            0x40
 #define X86_BREAKPOINT_LEN_1            0x40
 #define X86_BREAKPOINT_LEN_2            0x44
 #define X86_BREAKPOINT_LEN_4            0x4c
diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c
index 7b598b84c902..f744f54cb248 100644
--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -698,9 +698,11 @@ void __init uv_system_init(void)
                 for (j = 0; j < 64; j++) {
                         if (!test_bit(j, &present))
                                 continue;
-                        uv_blade_info[blade].pnode = (i * 64 + j);
+                        pnode = (i * 64 + j);
+                        uv_blade_info[blade].pnode = pnode;
                         uv_blade_info[blade].nr_possible_cpus = 0;
                         uv_blade_info[blade].nr_online_cpus = 0;
+                        max_pnode = max(pnode, max_pnode);
                         blade++;
                 }
         }
@@ -738,7 +740,6 @@ void __init uv_system_init(void)
                 uv_cpu_hub_info(cpu)->scir.offset = uv_scir_offset(apicid);
                 uv_node_to_blade[nid] = blade;
                 uv_cpu_to_blade[cpu] = blade;
-                max_pnode = max(pnode, max_pnode);
         }
 
         /* Add blade/pnode info for nodes without cpus */
@@ -750,7 +751,6 @@ void __init uv_system_init(void)
                 pnode = (paddr >> m_val) & pnode_mask;
                 blade = boot_pnode_to_blade(pnode);
                 uv_node_to_blade[nid] = blade;
-                max_pnode = max(pnode, max_pnode);
         }
 
         map_gru_high(max_pnode);
diff --git a/arch/x86/kernel/early-quirks.c b/arch/x86/kernel/early-quirks.c
index e5cc7e82e60d..ebdb85cf2686 100644
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -18,7 +18,6 @@
 #include <asm/apic.h>
 #include <asm/iommu.h>
 #include <asm/gart.h>
-#include <asm/hpet.h>
 
 static void __init fix_hypertransport_config(int num, int slot, int func)
 {
@@ -192,21 +191,6 @@ static void __init ati_bugs_contd(int num, int slot, int func)
 }
 #endif
 
-/*
- * Force the read back of the CMP register in hpet_next_event()
- * to work around the problem that the CMP register write seems to be
- * delayed. See hpet_next_event() for details.
- *
- * We do this on all SMBUS incarnations for now until we have more
- * information about the affected chipsets.
- */
-static void __init ati_hpet_bugs(int num, int slot, int func)
-{
-#ifdef CONFIG_HPET_TIMER
-        hpet_readback_cmp = 1;
-#endif
-}
-
 #define QFLAG_APPLY_ONCE        0x1
 #define QFLAG_APPLIED           0x2
 #define QFLAG_DONE              (QFLAG_APPLY_ONCE|QFLAG_APPLIED)
@@ -236,8 +220,6 @@ static struct chipset early_qrk[] __initdata = {
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs },
         { PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_SBX00_SMBUS,
           PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_bugs_contd },
-        { PCI_VENDOR_ID_ATI, PCI_ANY_ID,
-          PCI_CLASS_SERIAL_SMBUS, PCI_ANY_ID, 0, ati_hpet_bugs },
         {}
 };
 
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 351f9c0fea1f..410fdb3f1939 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -35,7 +35,6 @@
 unsigned long                           hpet_address;
 u8                                      hpet_blockid; /* OS timer block num */
 u8                                      hpet_msi_disable;
-u8                                      hpet_readback_cmp;
 
 #ifdef CONFIG_PCI_MSI
 static unsigned long                    hpet_num_timers;
@@ -395,23 +394,27 @@ static int hpet_next_event(unsigned long delta,
          * at that point and we would wait for the next hpet interrupt
          * forever. We found out that reading the CMP register back
          * forces the transfer so we can rely on the comparison with
-         * the counter register below.
+         * the counter register below. If the read back from the
+         * compare register does not match the value we programmed
+         * then we might have a real hardware problem. We can not do
+         * much about it here, but at least alert the user/admin with
+         * a prominent warning.
          *
-         * That works fine on those ATI chipsets, but on newer Intel
-         * chipsets (ICH9...) this triggers due to an erratum: Reading
-         * the comparator immediately following a write is returning
-         * the old value.
+         * An erratum on some chipsets (ICH9,..), results in
+         * comparator read immediately following a write returning old
+         * value. Workaround for this is to read this value second
+         * time, when first read returns old value.
          *
-         * We restrict the read back to the affected ATI chipsets (set
-         * by quirks) and also run it with hpet=verbose for debugging
-         * purposes.
+         * In fact the write to the comparator register is delayed up
+         * to two HPET cycles so the workaround we tried to restrict
+         * the readback to those known to be borked ATI chipsets
+         * failed miserably. So we give up on optimizations forever
+         * and penalize all HPET incarnations unconditionally.
          */
-        if (hpet_readback_cmp || hpet_verbose) {
-                u32 cmp = hpet_readl(HPET_Tn_CMP(timer));
-
-                if (cmp != cnt)
+        if (unlikely((u32)hpet_readl(HPET_Tn_CMP(timer)) != cnt)) {
+                if (hpet_readl(HPET_Tn_CMP(timer)) != cnt)
                         printk_once(KERN_WARNING
-                            "hpet: compare register read back failed.\n");
+                                "hpet: compare register read back failed.\n");
         }
 
         return (s32)(hpet_readl(HPET_COUNTER) - cnt) >= 0 ? -ETIME : 0;
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index a474ec37c32f..ff15c9dcc25d 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -206,11 +206,27 @@ int arch_check_bp_in_kernelspace(struct perf_event *bp)
 int arch_bp_generic_fields(int x86_len, int x86_type,
                            int *gen_len, int *gen_type)
 {
-        /* Len */
-        switch (x86_len) {
-        case X86_BREAKPOINT_LEN_X:
+        /* Type */
+        switch (x86_type) {
+        case X86_BREAKPOINT_EXECUTE:
+                if (x86_len != X86_BREAKPOINT_LEN_X)
+                        return -EINVAL;
+
+                *gen_type = HW_BREAKPOINT_X;
                 *gen_len = sizeof(long);
+                return 0;
+        case X86_BREAKPOINT_WRITE:
+                *gen_type = HW_BREAKPOINT_W;
                 break;
+        case X86_BREAKPOINT_RW:
+                *gen_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* Len */
+        switch (x86_len) {
         case X86_BREAKPOINT_LEN_1:
                 *gen_len = HW_BREAKPOINT_LEN_1;
                 break;
@@ -229,21 +245,6 @@ int arch_bp_generic_fields(int x86_len, int x86_type,
                 return -EINVAL;
         }
 
-        /* Type */
-        switch (x86_type) {
-        case X86_BREAKPOINT_EXECUTE:
-                *gen_type = HW_BREAKPOINT_X;
-                break;
-        case X86_BREAKPOINT_WRITE:
-                *gen_type = HW_BREAKPOINT_W;
-                break;
-        case X86_BREAKPOINT_RW:
-                *gen_type = HW_BREAKPOINT_W | HW_BREAKPOINT_R;
-                break;
-        default:
-                return -EINVAL;
-        }
-
         return 0;
 }
 
@@ -316,9 +317,6 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp)
         ret = -EINVAL;
 
         switch (info->len) {
-        case X86_BREAKPOINT_LEN_X:
-                align = sizeof(long) -1;
-                break;
         case X86_BREAKPOINT_LEN_1:
                 align = 0;
                 break;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 9257510b4836..9d5f55848455 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -324,9 +324,8 @@ static void lguest_load_gdt(const struct desc_ptr *desc)
 }
 
 /*
- * For a single GDT entry which changes, we do the lazy thing: alter our GDT,
- * then tell the Host to reload the entire thing.  This operation is so rare
- * that this naive implementation is reasonable.
+ * For a single GDT entry which changes, we simply change our copy and
+ * then tell the host about it.
  */
 static void lguest_write_gdt_entry(struct desc_struct *dt, int entrynum,
                                    const void *desc, int type)
@@ -338,9 +337,13 @@ static void lguest_write_gdt_entry(struct desc_struct *dt, int entrynum,
 }
 
 /*
- * OK, I lied.  There are three "thread local storage" GDT entries which change
+ * There are three "thread local storage" GDT entries which change
  * on every context switch (these three entries are how glibc implements
- * __thread variables).  So we have a hypercall specifically for this case.
+ * __thread variables).  As an optimization, we have a hypercall
+ * specifically for this case.
+ *
+ * Wouldn't it be nicer to have a general LOAD_GDT_ENTRIES hypercall
+ * which took a range of entries?
  */
 static void lguest_load_tls(struct thread_struct *t, unsigned int cpu)
 {
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index cfe4faabb0f6..009b819f48d0 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -671,7 +671,9 @@ static int __init ppro_init(char **cpu_type)
         case 14:
                 *cpu_type = "i386/core";
                 break;
-        case 15: case 23:
+        case 0x0f:
+        case 0x16:
+        case 0x17:
                 *cpu_type = "i386/core_2";
                 break;
         case 0x1a:
diff --git a/block/blk-map.c b/block/blk-map.c
index c65d7593f7f1..ade0a08c9099 100644
--- a/block/blk-map.c
+++ b/block/blk-map.c
@@ -307,7 +307,7 @@ int blk_rq_map_kern(struct request_queue *q, struct request *rq, void *kbuf,
                 return PTR_ERR(bio);
 
         if (rq_data_dir(rq) == WRITE)
-                bio->bi_rw |= (1 << REQ_WRITE);
+                bio->bi_rw |= REQ_WRITE;
 
         if (do_copy)
                 rq->cmd_flags |= REQ_COPY_USER;
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index f65c6f01c475..9eba291eb6fd 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1019,10 +1019,20 @@ cfq_find_alloc_cfqg(struct cfq_data *cfqd, struct cgroup *cgroup, int create)
          */
         atomic_set(&cfqg->ref, 1);
 
-        /* Add group onto cgroup list */
-        sscanf(dev_name(bdi->dev), "%u:%u", &major, &minor);
-        cfq_blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
+        /*
+         * Add group onto cgroup list. It might happen that bdi->dev is
+         * not initiliazed yet. Initialize this new group without major
+         * and minor info and this info will be filled in once a new thread
+         * comes for IO. See code above.
+         */
+        if (bdi->dev) {
+                sscanf(dev_name(bdi->dev), "%u:%u", &major, &minor);
+                cfq_blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
                                         MKDEV(major, minor));
+        } else
+                cfq_blkiocg_add_blkio_group(blkcg, &cfqg->blkg, (void *)cfqd,
+                                        0);
+
         cfqg->weight = blkcg_get_weight(blkcg, cfqg->blkg.dev);
 
         /* Add group on cfqd list */
diff --git a/drivers/Makefile b/drivers/Makefile
index ae473445ad6d..a2aea53a75ed 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -50,7 +50,7 @@ obj-$(CONFIG_SPI)		+= spi/
 obj-y                           += net/
 obj-$(CONFIG_ATM)               += atm/
 obj-$(CONFIG_FUSION)            += message/
-obj-$(CONFIG_FIREWIRE)          += firewire/
+obj-y                           += firewire/
 obj-y                           += ieee1394/
 obj-$(CONFIG_UIO)               += uio/
 obj-y                           += cdrom/
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6124c2fd2d33..5e4fadcdece9 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
 clean4:
         kfree(h->cmd_pool_bits);
         /* Free up sg elements */
-        for (k = 0; k < h->nr_cmds; k++)
+        for (k-- ; k >= 0; k--)
                 kfree(h->scatter_list[k]);
         kfree(h->scatter_list);
         cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index eab58db5f91c..cd18493c9527 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -806,6 +806,8 @@ static const struct intel_driver_description {
             "G45/G43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
             "B43", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
+            "B43", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
             "G41", NULL, &intel_i965_driver },
         { PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index ee189c74d345..d09b1ab7e8ab 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -186,6 +186,8 @@
 #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
 #define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
 #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
+#define PCI_DEVICE_ID_INTEL_B43_1_HB        0x2E90
+#define PCI_DEVICE_ID_INTEL_B43_1_IG        0x2E92
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
 #define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 3822b4f49c84..7bd7c45b53ef 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -305,6 +305,9 @@ static int num_force_kipmid;
 #ifdef CONFIG_PCI
 static int pci_registered;
 #endif
+#ifdef CONFIG_ACPI
+static int pnp_registered;
+#endif
 #ifdef CONFIG_PPC_OF
 static int of_registered;
 #endif
@@ -2126,7 +2129,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
 {
         struct acpi_device *acpi_dev;
         struct smi_info *info;
-        struct resource *res;
+        struct resource *res, *res_second;
         acpi_handle handle;
         acpi_status status;
         unsigned long long tmp;
@@ -2182,13 +2185,13 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
         info->io.addr_data = res->start;
 
         info->io.regspacing = DEFAULT_REGSPACING;
-        res = pnp_get_resource(dev,
+        res_second = pnp_get_resource(dev,
                                (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
                                         IORESOURCE_IO : IORESOURCE_MEM,
                                1);
-        if (res) {
-                if (res->start > info->io.addr_data)
-                        info->io.regspacing = res->start - info->io.addr_data;
+        if (res_second) {
+                if (res_second->start > info->io.addr_data)
+                        info->io.regspacing = res_second->start - info->io.addr_data;
         }
         info->io.regsize = DEFAULT_REGSPACING;
         info->io.regshift = 0;
@@ -3359,6 +3362,7 @@ static __devinit int init_ipmi_si(void)
 
 #ifdef CONFIG_ACPI
         pnp_register_driver(&ipmi_pnp_driver);
+        pnp_registered = 1;
 #endif
 
 #ifdef CONFIG_DMI
@@ -3526,7 +3530,8 @@ static __exit void cleanup_ipmi_si(void)
                 pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
-        pnp_unregister_driver(&ipmi_pnp_driver);
+        if (pnp_registered)
+                pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 
 #ifdef CONFIG_PPC_OF
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index a398ecdbd758..1f528fad3516 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -788,10 +788,11 @@ static const struct file_operations zero_fops = {
 /*
  * capabilities for /dev/zero
  * - permits private mappings, "copies" are taken of the source of zeros
+ * - no writeback happens
  */
 static struct backing_dev_info zero_bdi = {
         .name           = "char/mem",
-        .capabilities   = BDI_CAP_MAP_COPY,
+        .capabilities   = BDI_CAP_MAP_COPY | BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 
 static const struct file_operations full_fops = {
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 942a9826bd23..c810481a5bc2 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
         ssize_t ret;
         bool nonblock;
 
+        /* Userspace could be out to fool us */
+        if (!count)
+                return 0;
+
         port = filp->private_data;
 
         nonblock = filp->f_flags & O_NONBLOCK;
@@ -642,7 +646,7 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
         poll_wait(filp, &port->waitqueue, wait);
 
         ret = 0;
-        if (port->inbuf)
+        if (!will_read_block(port))
                 ret |= POLLIN | POLLRDNORM;
         if (!will_write_block(port))
                 ret |= POLLOUT;
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 8661c84a105d..b98c67664ae7 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -39,6 +39,10 @@ static DEFINE_SPINLOCK(dca_lock);
 
 static LIST_HEAD(dca_domains);
 
+static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
+
+static int dca_providers_blocked;
+
 static struct pci_bus *dca_pci_rc_from_dev(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -70,6 +74,60 @@ static void dca_free_domain(struct dca_domain *domain)
         kfree(domain);
 }
 
+static int dca_provider_ioat_ver_3_0(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+
+        return ((pdev->vendor == PCI_VENDOR_ID_INTEL) &&
+                ((pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG0) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG1) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG2) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG3) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG4) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG5) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG6) ||
+                (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_TBG7)));
+}
+
+static void unregister_dca_providers(void)
+{
+        struct dca_provider *dca, *_dca;
+        struct list_head unregistered_providers;
+        struct dca_domain *domain;
+        unsigned long flags;
+
+        blocking_notifier_call_chain(&dca_provider_chain,
+                                     DCA_PROVIDER_REMOVE, NULL);
+
+        INIT_LIST_HEAD(&unregistered_providers);
+
+        spin_lock_irqsave(&dca_lock, flags);
+
+        if (list_empty(&dca_domains)) {
+                spin_unlock_irqrestore(&dca_lock, flags);
+                return;
+        }
+
+        /* at this point only one domain in the list is expected */
+        domain = list_first_entry(&dca_domains, struct dca_domain, node);
+        if (!domain)
+                return;
+
+        list_for_each_entry_safe(dca, _dca, &domain->dca_providers, node) {
+                list_del(&dca->node);
+                list_add(&dca->node, &unregistered_providers);
+        }
+
+        dca_free_domain(domain);
+
+        spin_unlock_irqrestore(&dca_lock, flags);
+
+        list_for_each_entry_safe(dca, _dca, &unregistered_providers, node) {
+                dca_sysfs_remove_provider(dca);
+                list_del(&dca->node);
+        }
+}
+
 static struct dca_domain *dca_find_domain(struct pci_bus *rc)
 {
         struct dca_domain *domain;
@@ -90,9 +148,13 @@ static struct dca_domain *dca_get_domain(struct device *dev)
         domain = dca_find_domain(rc);
 
         if (!domain) {
-                domain = dca_allocate_domain(rc);
-                if (domain)
-                        list_add(&domain->node, &dca_domains);
+                if (dca_provider_ioat_ver_3_0(dev) && !list_empty(&dca_domains)) {
+                        dca_providers_blocked = 1;
+                } else {
+                        domain = dca_allocate_domain(rc);
+                        if (domain)
+                                list_add(&domain->node, &dca_domains);
+                }
         }
 
         return domain;
@@ -293,8 +355,6 @@ void free_dca_provider(struct dca_provider *dca)
 }
 EXPORT_SYMBOL_GPL(free_dca_provider);
 
-static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
-
 /**
  * register_dca_provider - register a dca provider
  * @dca - struct created by alloc_dca_provider()
@@ -306,6 +366,13 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
         unsigned long flags;
         struct dca_domain *domain;
 
+        spin_lock_irqsave(&dca_lock, flags);
+        if (dca_providers_blocked) {
+                spin_unlock_irqrestore(&dca_lock, flags);
+                return -ENODEV;
+        }
+        spin_unlock_irqrestore(&dca_lock, flags);
+
         err = dca_sysfs_add_provider(dca, dev);
         if (err)
                 return err;
@@ -313,7 +380,13 @@ int register_dca_provider(struct dca_provider *dca, struct device *dev)
         spin_lock_irqsave(&dca_lock, flags);
         domain = dca_get_domain(dev);
         if (!domain) {
-                spin_unlock_irqrestore(&dca_lock, flags);
+                if (dca_providers_blocked) {
+                        spin_unlock_irqrestore(&dca_lock, flags);
+                        dca_sysfs_remove_provider(dca);
+                        unregister_dca_providers();
+                } else {
+                        spin_unlock_irqrestore(&dca_lock, flags);
+                }
                 return -ENODEV;
         }
         list_add(&dca->node, &domain->dca_providers);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index be29b0bb2471..1b05896648bc 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -263,6 +263,7 @@ static const struct {
         {PCI_VENDOR_ID_JMICRON, PCI_DEVICE_ID_JMICRON_JMB38X_FW, QUIRK_NO_MSI},
         {PCI_VENDOR_ID_NEC,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
         {PCI_VENDOR_ID_VIA,     PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
+        {PCI_VENDOR_ID_RICOH,   PCI_ANY_ID,     QUIRK_CYCLE_TIMER},
         {PCI_VENDOR_ID_APPLE,   PCI_DEVICE_ID_APPLE_UNI_N_FW, QUIRK_BE_HEADERS},
 };
 
diff --git a/drivers/gpu/drm/drm_buffer.c b/drivers/gpu/drm/drm_buffer.c
index 55d03ed05000..529a0dbe9fc6 100644
--- a/drivers/gpu/drm/drm_buffer.c
+++ b/drivers/gpu/drm/drm_buffer.c
@@ -98,8 +98,8 @@ EXPORT_SYMBOL(drm_buffer_alloc);
  *   user_data: A pointer the data that is copied to the buffer.
  *   size: The Number of bytes to copy.
  */
-extern int drm_buffer_copy_from_user(struct drm_buffer *buf,
-                void __user *user_data, int size)
+int drm_buffer_copy_from_user(struct drm_buffer *buf,
+                              void __user *user_data, int size)
 {
         int nr_pages = size / PAGE_SIZE + 1;
         int idx;
@@ -163,7 +163,7 @@ void *drm_buffer_read_object(struct drm_buffer *buf,
 {
         int idx = drm_buffer_index(buf);
         int page = drm_buffer_page(buf);
-        void *obj = 0;
+        void *obj = NULL;
 
         if (idx + objsize <= PAGE_SIZE) {
                 obj = &buf->data[page][idx];
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index d2ab01e90a96..dcbeb98f195a 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -103,8 +103,8 @@ int drm_helper_probe_single_connector_modes(struct drm_connector *connector,
                 if (connector->funcs->force)
                         connector->funcs->force(connector);
         } else {
-                connector->status = connector->funcs->detect(connector);
-                drm_helper_hpd_irq_event(dev);
+                connector->status = connector->funcs->detect(connector, true);
+                drm_kms_helper_poll_enable(dev);
         }
 
         if (connector->status == connector_status_disconnected) {
@@ -637,13 +637,13 @@ int drm_crtc_helper_set_config(struct drm_mode_set *set)
                 mode_changed = true;
 
         if (mode_changed) {
-                old_fb = set->crtc->fb;
-                set->crtc->fb = set->fb;
                 set->crtc->enabled = (set->mode != NULL);
                 if (set->mode != NULL) {
                         DRM_DEBUG_KMS("attempting to set mode from"
                                         " userspace\n");
                         drm_mode_debug_printmodeline(set->mode);
+                        old_fb = set->crtc->fb;
+                        set->crtc->fb = set->fb;
                         if (!drm_crtc_helper_set_mode(set->crtc, set->mode,
                                                       set->x, set->y,
                                                       old_fb)) {
@@ -866,7 +866,7 @@ static void output_poll_execute(struct work_struct *work)
                     !(connector->polled & DRM_CONNECTOR_POLL_HPD))
                         continue;
 
-                status = connector->funcs->detect(connector);
+                status = connector->funcs->detect(connector, false);
                 if (old_status != status)
                         changed = true;
         }
diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
index e20f78b542a7..f5bd9e590c80 100644
--- a/drivers/gpu/drm/drm_pci.c
+++ b/drivers/gpu/drm/drm_pci.c
@@ -164,6 +164,8 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         dev->hose = pdev->sysdata;
 #endif
 
+        mutex_lock(&drm_global_mutex);
+
         if ((ret = drm_fill_in_dev(dev, ent, driver))) {
                 printk(KERN_ERR "DRM: Fill_in_dev failed.\n");
                 goto err_g2;
@@ -199,6 +201,7 @@ int drm_get_pci_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
                  driver->name, driver->major, driver->minor, driver->patchlevel,
                  driver->date, pci_name(pdev), dev->primary->index);
 
+        mutex_unlock(&drm_global_mutex);
         return 0;
 
 err_g4:
@@ -210,6 +213,7 @@ err_g2:
         pci_disable_device(pdev);
 err_g1:
         kfree(dev);
+        mutex_unlock(&drm_global_mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_get_pci_dev);
diff --git a/drivers/gpu/drm/drm_platform.c b/drivers/gpu/drm/drm_platform.c
index 460e9a3afa8d..92d1d0fb7b75 100644
--- a/drivers/gpu/drm/drm_platform.c
+++ b/drivers/gpu/drm/drm_platform.c
@@ -53,6 +53,8 @@ int drm_get_platform_dev(struct platform_device *platdev,
         dev->platformdev = platdev;
         dev->dev = &platdev->dev;
 
+        mutex_lock(&drm_global_mutex);
+
         ret = drm_fill_in_dev(dev, NULL, driver);
 
         if (ret) {
@@ -87,6 +89,8 @@ int drm_get_platform_dev(struct platform_device *platdev,
 
         list_add_tail(&dev->driver_item, &driver->device_list);
 
+        mutex_unlock(&drm_global_mutex);
+
         DRM_INFO("Initialized %s %d.%d.%d %s on minor %d\n",
                  driver->name, driver->major, driver->minor, driver->patchlevel,
                  driver->date, dev->primary->index);
@@ -100,6 +104,7 @@ err_g2:
                 drm_put_minor(&dev->control);
 err_g1:
         kfree(dev);
+        mutex_unlock(&drm_global_mutex);
         return ret;
 }
 EXPORT_SYMBOL(drm_get_platform_dev);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 86118a742231..85da4c40694c 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -159,7 +159,7 @@ static ssize_t status_show(struct device *device,
         struct drm_connector *connector = to_drm_connector(device);
         enum drm_connector_status status;
 
-        status = connector->funcs->detect(connector);
+        status = connector->funcs->detect(connector, true);
         return snprintf(buf, PAGE_SIZE, "%s\n",
                         drm_get_connector_status_name(status));
 }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 216deb579785..6dbe14cc4f74 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -170,6 +170,7 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
         INTEL_VGA_DEVICE(0x2e22, &intel_g45_info),              /* G45_G */
         INTEL_VGA_DEVICE(0x2e32, &intel_g45_info),              /* G41_G */
         INTEL_VGA_DEVICE(0x2e42, &intel_g45_info),              /* B43_G */
+        INTEL_VGA_DEVICE(0x2e92, &intel_g45_info),              /* B43_G.1 */
         INTEL_VGA_DEVICE(0xa001, &intel_pineview_info),
         INTEL_VGA_DEVICE(0xa011, &intel_pineview_info),
         INTEL_VGA_DEVICE(0x0042, &intel_ironlake_d_info),
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 16fca1d1799a..cf4ffbee1c00 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2351,14 +2351,21 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
 
         reg->obj = obj;
 
-        if (IS_GEN6(dev))
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                 sandybridge_write_fence_reg(reg);
-        else if (IS_I965G(dev))
+                break;
+        case 5:
+        case 4:
                 i965_write_fence_reg(reg);
-        else if (IS_I9XX(dev))
+                break;
+        case 3:
                 i915_write_fence_reg(reg);
-        else
+                break;
+        case 2:
                 i830_write_fence_reg(reg);
+                break;
+        }
 
         trace_i915_gem_object_get_fence(obj, obj_priv->fence_reg,
                         obj_priv->tiling_mode);
@@ -2381,22 +2388,26 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
         struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_i915_fence_reg *reg =
                 &dev_priv->fence_regs[obj_priv->fence_reg];
+        uint32_t fence_reg;
 
-        if (IS_GEN6(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                 I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 +
                              (obj_priv->fence_reg * 8), 0);
-        } else if (IS_I965G(dev)) {
+                break;
+        case 5:
+        case 4:
                 I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
-        } else {
-                uint32_t fence_reg;
-
-                if (obj_priv->fence_reg < 8)
-                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
+                break;
+        case 3:
+                if (obj_priv->fence_reg > 8)
+                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg - 8) * 4;
                 else
-                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg -
-                                                       8) * 4;
+        case 2:
+                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
 
                 I915_WRITE(fence_reg, 0);
+                break;
         }
 
         reg->obj = NULL;
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 72cae3cccad8..e85246ef691c 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -79,6 +79,7 @@ mark_free(struct drm_i915_gem_object *obj_priv,
            struct list_head *unwind)
 {
         list_add(&obj_priv->evict_list, unwind);
+        drm_gem_object_reference(&obj_priv->base);
         return drm_mm_scan_add_block(obj_priv->gtt_space);
 }
 
@@ -165,6 +166,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
         list_for_each_entry(obj_priv, &unwind_list, evict_list) {
                 ret = drm_mm_scan_remove_block(obj_priv->gtt_space);
                 BUG_ON(ret);
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* We expect the caller to unpin, evict all and try again, or give up.
@@ -181,18 +183,21 @@ found:
                          * scanning, therefore store to be evicted objects on a
                          * temporary list. */
                         list_move(&obj_priv->evict_list, &eviction_list);
-                }
+                } else
+                        drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* Unbinding will emit any required flushes */
         list_for_each_entry_safe(obj_priv, tmp_obj_priv,
                                  &eviction_list, evict_list) {
 #if WATCH_LRU
-                DRM_INFO("%s: evicting %p\n", __func__, obj);
+                DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
 #endif
                 ret = i915_gem_object_unbind(&obj_priv->base);
                 if (ret)
                         return ret;
+
+                drm_gem_object_unreference(&obj_priv->base);
         }
 
         /* The just created free hole should be on the top of the free stack
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 2c6b98f2440e..31f08581e93a 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -789,16 +789,25 @@ int i915_save_state(struct drm_device *dev)
                 dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
 
         /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
+                break;
+        case 5:
+        case 4:
                 for (i = 0; i < 16; i++)
                         dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
-        } else {
-                for (i = 0; i < 8; i++)
-                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
-
+                break;
+        case 3:
                 if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                         for (i = 0; i < 8; i++)
                                 dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        case 2:
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+                break;
+
         }
 
         return 0;
@@ -815,15 +824,24 @@ int i915_restore_state(struct drm_device *dev)
         I915_WRITE(HWS_PGA, dev_priv->saveHWS);
 
         /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (i * 8), dev_priv->saveFENCE[i]);
+                break;
+        case 5:
+        case 4:
                 for (i = 0; i < 16; i++)
                         I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
-        } else {
-                for (i = 0; i < 8; i++)
-                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
+        case 3:
+        case 2:
                 if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                         for (i = 0; i < 8; i++)
                                 I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
         }
 
         i915_restore_display(dev);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4b7735196cd5..197d4f32585a 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -188,7 +188,7 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
 
         if (wait_for((I915_READ(PCH_ADPA) & ADPA_CRT_HOTPLUG_FORCE_TRIGGER) == 0,
                      1000, 1))
-                DRM_ERROR("timed out waiting for FORCE_TRIGGER");
+                DRM_DEBUG_KMS("timed out waiting for FORCE_TRIGGER");
 
         if (turn_off_dac) {
                 I915_WRITE(PCH_ADPA, temp);
@@ -245,7 +245,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
                 if (wait_for((I915_READ(PORT_HOTPLUG_EN) &
                               CRT_HOTPLUG_FORCE_DETECT) == 0,
                              1000, 1))
-                        DRM_ERROR("timed out waiting for FORCE_DETECT to go off");
+                        DRM_DEBUG_KMS("timed out waiting for FORCE_DETECT to go off");
         }
 
         stat = I915_READ(PORT_HOTPLUG_STAT);
@@ -400,7 +400,8 @@ intel_crt_load_detect(struct drm_crtc *crtc, struct intel_encoder *intel_encoder
         return status;
 }
 
-static enum drm_connector_status intel_crt_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_crt_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
@@ -419,6 +420,9 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
         if (intel_crt_detect_ddc(encoder))
                 return connector_status_connected;
 
+        if (!force)
+                return connector->status;
+
         /* for pre-945g platforms use load detect */
         if (encoder->crtc && encoder->crtc->enabled) {
                 status = intel_crt_load_detect(encoder->crtc, intel_encoder);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 19daead5b525..b5bf51a4502d 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2463,11 +2463,19 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
                                   struct drm_display_mode *adjusted_mode)
 {
         struct drm_device *dev = crtc->dev;
+
         if (HAS_PCH_SPLIT(dev)) {
                 /* FDI link clock is fixed at 2.7G */
                 if (mode->clock * 3 > IRONLAKE_FDI_FREQ * 4)
                         return false;
         }
+
+        /* XXX some encoders set the crtcinfo, others don't.
+         * Obviously we need some form of conflict resolution here...
+         */
+        if (adjusted_mode->crtc_htotal == 0)
+                drm_mode_set_crtcinfo(adjusted_mode, 0);
+
         return true;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 51d142939a26..1a51ee07de3e 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1386,7 +1386,7 @@ ironlake_dp_detect(struct drm_connector *connector)
  * \return false if DP port is disconnected.
  */
 static enum drm_connector_status
-intel_dp_detect(struct drm_connector *connector)
+intel_dp_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index a399f4b2c1c5..7c9ec1472d46 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -221,7 +221,8 @@ static void intel_dvo_mode_set(struct drm_encoder *encoder,
  *
  * Unimplemented.
  */
-static enum drm_connector_status intel_dvo_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_dvo_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_dvo *intel_dvo = enc_to_intel_dvo(encoder);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index ccd4c97e6524..926934a482ec 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -139,7 +139,7 @@ static bool intel_hdmi_mode_fixup(struct drm_encoder *encoder,
 }
 
 static enum drm_connector_status
-intel_hdmi_detect(struct drm_connector *connector)
+intel_hdmi_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder = intel_attached_encoder(connector);
         struct intel_hdmi *intel_hdmi = enc_to_intel_hdmi(encoder);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 4fbb0165b26f..6ec39a86ed06 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -445,7 +445,8 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
  * connected and closed means disconnected.  We also send hotplug events as
  * needed, using lid status notification from the input layer.
  */
-static enum drm_connector_status intel_lvds_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_lvds_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         enum drm_connector_status status = connector_status_connected;
@@ -540,7 +541,9 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
          * the LID nofication event.
          */
         if (connector)
-                connector->status = connector->funcs->detect(connector);
+                connector->status = connector->funcs->detect(connector,
+                                                             false);
+
         /* Don't force modeset on machines where it causes a GPU lockup */
         if (dmi_check_system(intel_no_modeset_on_lid))
                 return NOTIFY_OK;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index e3b7a7ee39cb..e8e902d614ed 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1417,7 +1417,7 @@ intel_analog_is_connected(struct drm_device *dev)
         if (!analog_connector)
                 return false;
 
-        if (analog_connector->funcs->detect(analog_connector) ==
+        if (analog_connector->funcs->detect(analog_connector, false) ==
                         connector_status_disconnected)
                 return false;
 
@@ -1486,7 +1486,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector)
         return status;
 }
 
-static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connector)
+static enum drm_connector_status
+intel_sdvo_detect(struct drm_connector *connector, bool force)
 {
         uint16_t response;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index c671f60ce80b..4a117e318a73 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1341,7 +1341,7 @@ static void intel_tv_find_better_format(struct drm_connector *connector)
  * we have a pipe programmed in order to probe the TV.
  */
 static enum drm_connector_status
-intel_tv_detect(struct drm_connector *connector)
+intel_tv_detect(struct drm_connector *connector, bool force)
 {
         struct drm_display_mode mode;
         struct drm_encoder *encoder = intel_attached_encoder(connector);
@@ -1353,7 +1353,7 @@ intel_tv_detect(struct drm_connector *connector)
 
         if (encoder->crtc && encoder->crtc->enabled) {
                 type = intel_tv_detect_type(intel_tv);
-        } else {
+        } else if (force) {
                 struct drm_crtc *crtc;
                 int dpms_mode;
 
@@ -1364,10 +1364,9 @@ intel_tv_detect(struct drm_connector *connector)
                         intel_release_load_detect_pipe(&intel_tv->base, connector,
                                                        dpms_mode);
                 } else
-                        type = -1;
-        }
-
-        intel_tv->type = type;
+                        return connector_status_unknown;
+        } else
+                return connector->status;
 
         if (type < 0)
                 return connector_status_disconnected;
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index a1473fff06ac..fc737037f751 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -168,7 +168,7 @@ nouveau_connector_set_encoder(struct drm_connector *connector,
 }
 
 static enum drm_connector_status
-nouveau_connector_detect(struct drm_connector *connector)
+nouveau_connector_detect(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct nouveau_connector *nv_connector = nouveau_connector(connector);
@@ -246,7 +246,7 @@ detect_analog:
 }
 
 static enum drm_connector_status
-nouveau_connector_detect_lvds(struct drm_connector *connector)
+nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)
 {
         struct drm_device *dev = connector->dev;
         struct drm_nouveau_private *dev_priv = dev->dev_private;
@@ -267,7 +267,7 @@ nouveau_connector_detect_lvds(struct drm_connector *connector)
 
         /* Try retrieving EDID via DDC */
         if (!dev_priv->vbios.fp_no_ddc) {
-                status = nouveau_connector_detect(connector);
+                status = nouveau_connector_detect(connector, force);
                 if (status == connector_status_connected)
                         goto out;
         }
@@ -558,8 +558,10 @@ nouveau_connector_get_modes(struct drm_connector *connector)
         if (nv_encoder->dcb->type == OUTPUT_LVDS &&
             (nv_encoder->dcb->lvdsconf.use_straps_for_mode ||
              dev_priv->vbios.fp_no_ddc) && nouveau_bios_fp_mode(dev, NULL)) {
-                nv_connector->native_mode = drm_mode_create(dev);
-                nouveau_bios_fp_mode(dev, nv_connector->native_mode);
+                struct drm_display_mode mode;
+
+                nouveau_bios_fp_mode(dev, &mode);
+                nv_connector->native_mode = drm_mode_duplicate(dev, &mode);
         }
 
         /* Find the native mode if this is a digital panel, if we didn't
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 1bc72c3190a9..fe359a239df3 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -4999,7 +4999,7 @@ typedef struct _SW_I2C_IO_DATA_PARAMETERS
 #define SW_I2C_CNTL_WRITE1BIT 6
 
 //==============================VESA definition Portion===============================
-#define VESA_OEM_PRODUCT_REV                                '01.00'
+#define VESA_OEM_PRODUCT_REV                                "01.00"
 #define VESA_MODE_ATTRIBUTE_MODE_SUPPORT             0xBB       //refer to VBE spec p.32, no TTY support
 #define VESA_MODE_WIN_ATTRIBUTE                                              7
 #define VESA_WIN_SIZE                                                                                        64
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index 464a81a1990f..cd0290f946cf 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -539,14 +539,15 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                         pll->algo = PLL_ALGO_LEGACY;
                                         pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
                                 }
-                                /* There is some evidence (often anecdotal) that RV515 LVDS
+                                /* There is some evidence (often anecdotal) that RV515/RV620 LVDS
                                  * (on some boards at least) prefers the legacy algo.  I'm not
                                  * sure whether this should handled generically or on a
                                  * case-by-case quirk basis.  Both algos should work fine in the
                                  * majority of cases.
                                  */
                                 if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) &&
-                                    (rdev->family == CHIP_RV515)) {
+                                    ((rdev->family == CHIP_RV515) ||
+                                     (rdev->family == CHIP_RV620))) {
                                         /* allow the user to overrride just in case */
                                         if (radeon_new_pll == 1)
                                                 pll->algo = PLL_ALGO_NEW;
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index b8b7f010b25f..79082d4398ae 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1160,14 +1160,25 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                                                                         EVERGREEN_MAX_BACKENDS_MASK));
                         break;
                 }
-        } else
-                gb_backend_map =
-                        evergreen_get_tile_pipe_to_backend_map(rdev,
-                                                               rdev->config.evergreen.max_tile_pipes,
-                                                               rdev->config.evergreen.max_backends,
-                                                               ((EVERGREEN_MAX_BACKENDS_MASK <<
-                                                                 rdev->config.evergreen.max_backends) &
-                                                                EVERGREEN_MAX_BACKENDS_MASK));
+        } else {
+                switch (rdev->family) {
+                case CHIP_CYPRESS:
+                case CHIP_HEMLOCK:
+                        gb_backend_map = 0x66442200;
+                        break;
+                case CHIP_JUNIPER:
+                        gb_backend_map = 0x00006420;
+                        break;
+                default:
+                        gb_backend_map =
+                                evergreen_get_tile_pipe_to_backend_map(rdev,
+                                                                       rdev->config.evergreen.max_tile_pipes,
+                                                                       rdev->config.evergreen.max_backends,
+                                                                       ((EVERGREEN_MAX_BACKENDS_MASK <<
+                                                                         rdev->config.evergreen.max_backends) &
+                                                                        EVERGREEN_MAX_BACKENDS_MASK));
+                }
+        }
 
         rdev->config.evergreen.tile_config = gb_addr_config;
         WREG32(GB_BACKEND_MAP, gb_backend_map);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e817a0bb5eb4..e151f16a8f86 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2020,18 +2020,7 @@ bool r100_gpu_cp_is_lockup(struct radeon_device *rdev, struct r100_gpu_lockup *l
                 return false;
         }
         elapsed = jiffies_to_msecs(cjiffies - lockup->last_jiffies);
-        if (elapsed >= 3000) {
-                /* very likely the improbable case where current
-                 * rptr is equal to last recorded, a while ago, rptr
-                 * this is more likely a false positive update tracking
-                 * information which should force us to be recall at
-                 * latter point
-                 */
-                lockup->last_cp_rptr = cp->rptr;
-                lockup->last_jiffies = jiffies;
-                return false;
-        }
-        if (elapsed >= 1000) {
+        if (elapsed >= 10000) {
                 dev_err(rdev->dev, "GPU lockup CP stall for more than %lumsec\n", elapsed);
                 return true;
         }
@@ -3308,13 +3297,14 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
         unsigned long size;
         unsigned prim_walk;
         unsigned nverts;
+        unsigned num_cb = track->num_cb;
 
-        for (i = 0; i < track->num_cb; i++) {
+        if (!track->zb_cb_clear && !track->color_channel_mask &&
+            !track->blend_read_enable)
+                num_cb = 0;
+
+        for (i = 0; i < num_cb; i++) {
                 if (track->cb[i].robj == NULL) {
-                        if (!(track->zb_cb_clear || track->color_channel_mask ||
-                              track->blend_read_enable)) {
-                                continue;
-                        }
                         DRM_ERROR("[drm] No buffer for color buffer %d !\n", i);
                         return -EINVAL;
                 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index afc18d87fdca..ddc3adea1dda 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2729,7 +2729,7 @@ int r600_ib_test(struct radeon_device *rdev)
         if (i < rdev->usec_timeout) {
                 DRM_INFO("ib test succeeded in %u usecs\n", i);
         } else {
-                DRM_ERROR("radeon: ib test failed (sracth(0x%04X)=0x%08X)\n",
+                DRM_ERROR("radeon: ib test failed (scratch(0x%04X)=0x%08X)\n",
                           scratch, tmp);
                 r = -EINVAL;
         }
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index d13622ae74e9..9ceb2a1ce799 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -1,3 +1,28 @@
+/*
+ * Copyright 2009 Advanced Micro Devices, Inc.
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ */
+
 #include "drmP.h"
 #include "drm.h"
 #include "radeon_drm.h"
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.h b/drivers/gpu/drm/radeon/r600_blit_shaders.h
index fdc3b378cbb0..f437d36dd98c 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.h
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.h
@@ -1,3 +1,27 @@
+/*
+ * Copyright 2009 Advanced Micro Devices, Inc.
+ * Copyright 2009 Red Hat Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ *
+ */
 
 #ifndef R600_BLIT_SHADERS_H
 #define R600_BLIT_SHADERS_H
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index d8864949e387..250a3a918193 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1170,9 +1170,8 @@ static inline int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 i
         /* using get ib will give us the offset into the mipmap bo */
         word0 = radeon_get_ib_value(p, idx + 3) << 8;
         if ((mipmap_size + word0) > radeon_bo_size(mipmap)) {
-                dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
-                        w0, h0, bpe, blevel, nlevels, word0, mipmap_size, radeon_bo_size(texture));
-                return -EINVAL;
+                /*dev_warn(p->dev, "mipmap bo too small (%d %d %d %d %d %d -> %d have %ld)\n",
+                  w0, h0, bpe, blevel, nlevels, word0, mipmap_size, radeon_bo_size(texture));*/
         }
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index bd74e428bd14..a04b7a6ad95f 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1485,6 +1485,11 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                         /* PowerMac8,1 ? */
                         /* imac g5 isight */
                         rdev->mode_info.connector_table = CT_IMAC_G5_ISIGHT;
+                } else if ((rdev->pdev->device == 0x4a48) &&
+                           (rdev->pdev->subsystem_vendor == 0x1002) &&
+                           (rdev->pdev->subsystem_device == 0x4a48)) {
+                        /* Mac X800 */
+                        rdev->mode_info.connector_table = CT_MAC_X800;
                 } else
 #endif /* CONFIG_PPC_PMAC */
 #ifdef CONFIG_PPC64
@@ -1961,6 +1966,48 @@ bool radeon_get_legacy_connector_info_from_table(struct drm_device *dev)
                                             CONNECTOR_OBJECT_ID_VGA,
                                             &hpd);
                 break;
+        case CT_MAC_X800:
+                DRM_INFO("Connector Table: %d (mac x800)\n",
+                         rdev->mode_info.connector_table);
+                /* DVI - primary dac, internal tmds */
+                ddc_i2c = combios_setup_i2c_bus(rdev, DDC_DVI, 0, 0);
+                hpd.hpd = RADEON_HPD_1; /* ??? */
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_DFP1_SUPPORT,
+                                                                  0),
+                                          ATOM_DEVICE_DFP1_SUPPORT);
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_CRT1_SUPPORT,
+                                                                  1),
+                                          ATOM_DEVICE_CRT1_SUPPORT);
+                radeon_add_legacy_connector(dev, 0,
+                                            ATOM_DEVICE_DFP1_SUPPORT |
+                                            ATOM_DEVICE_CRT1_SUPPORT,
+                                            DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_SINGLE_LINK_DVI_I,
+                                            &hpd);
+                /* DVI - tv dac, dvo */
+                ddc_i2c = combios_setup_i2c_bus(rdev, DDC_MONID, 0, 0);
+                hpd.hpd = RADEON_HPD_2; /* ??? */
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_DFP2_SUPPORT,
+                                                                  0),
+                                          ATOM_DEVICE_DFP2_SUPPORT);
+                radeon_add_legacy_encoder(dev,
+                                          radeon_get_encoder_enum(dev,
+                                                                  ATOM_DEVICE_CRT2_SUPPORT,
+                                                                  2),
+                                          ATOM_DEVICE_CRT2_SUPPORT);
+                radeon_add_legacy_connector(dev, 1,
+                                            ATOM_DEVICE_DFP2_SUPPORT |
+                                            ATOM_DEVICE_CRT2_SUPPORT,
+                                            DRM_MODE_CONNECTOR_DVII, &ddc_i2c,
+                                            CONNECTOR_OBJECT_ID_DUAL_LINK_DVI_I,
+                                            &hpd);
+                break;
         default:
                 DRM_INFO("Connector table: %d (invalid)\n",
                          rdev->mode_info.connector_table);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index a9dd7847d96e..ecc1a8fafbfd 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -481,7 +481,8 @@ static int radeon_lvds_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_lvds_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_lvds_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = radeon_best_single_encoder(connector);
@@ -594,7 +595,8 @@ static int radeon_vga_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_vga_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_vga_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder;
@@ -691,7 +693,8 @@ static int radeon_tv_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static enum drm_connector_status radeon_tv_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_tv_detect(struct drm_connector *connector, bool force)
 {
         struct drm_encoder *encoder;
         struct drm_encoder_helper_funcs *encoder_funcs;
@@ -748,7 +751,8 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
  * we have to check if this analog encoder is shared with anyone else (TV)
  * if its shared we have to set the other connector to disconnected.
  */
-static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_dvi_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder = NULL;
@@ -972,7 +976,8 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
         return ret;
 }
 
-static enum drm_connector_status radeon_dp_detect(struct drm_connector *connector)
+static enum drm_connector_status
+radeon_dp_detect(struct drm_connector *connector, bool force)
 {
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         enum drm_connector_status ret = connector_status_disconnected;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 6dd434ad2429..127a395f70fb 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1140,17 +1140,18 @@ bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
                                 radeon_crtc->rmx_type = radeon_encoder->rmx_type;
                         else
                                 radeon_crtc->rmx_type = RMX_OFF;
-                        src_v = crtc->mode.vdisplay;
-                        dst_v = radeon_crtc->native_mode.vdisplay;
-                        src_h = crtc->mode.hdisplay;
-                        dst_h = radeon_crtc->native_mode.vdisplay;
                         /* copy native mode */
                         memcpy(&radeon_crtc->native_mode,
                                &radeon_encoder->native_mode,
                                 sizeof(struct drm_display_mode));
+                        src_v = crtc->mode.vdisplay;
+                        dst_v = radeon_crtc->native_mode.vdisplay;
+                        src_h = crtc->mode.hdisplay;
+                        dst_h = radeon_crtc->native_mode.hdisplay;
 
                         /* fix up for overscan on hdmi */
                         if (ASIC_IS_AVIVO(rdev) &&
+                            (!(mode->flags & DRM_MODE_FLAG_INTERLACE)) &&
                             ((radeon_encoder->underscan_type == UNDERSCAN_ON) ||
                              ((radeon_encoder->underscan_type == UNDERSCAN_AUTO) &&
                               drm_detect_hdmi_monitor(radeon_connector->edid) &&
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 5eee3c41d124..8fbbe1c6ebbd 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -203,6 +203,10 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
  */
 int radeon_driver_firstopen_kms(struct drm_device *dev)
 {
+        struct radeon_device *rdev = dev->dev_private;
+
+        if (rdev->powered_down)
+                return -EINVAL;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index efbe975312dc..17a6602b5885 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -204,7 +204,7 @@ struct radeon_i2c_chan {
 
 /* mostly for macs, but really any system without connector tables */
 enum radeon_connector_table {
-        CT_NONE,
+        CT_NONE = 0,
         CT_GENERIC,
         CT_IBOOK,
         CT_POWERBOOK_EXTERNAL,
@@ -215,6 +215,7 @@ enum radeon_connector_table {
         CT_IMAC_G5_ISIGHT,
         CT_EMAC,
         CT_RN50_POWER,
+        CT_MAC_X800,
 };
 
 enum radeon_dvo_chip {
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7cffb3e04232..3451a82adba7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -351,6 +351,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         INIT_LIST_HEAD(&fbo->lru);
         INIT_LIST_HEAD(&fbo->swap);
         fbo->vm_node = NULL;
+        atomic_set(&fbo->cpu_writers, 0);
 
         fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
         kref_init(&fbo->list_kref);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index ca904799f018..b1e02fffd3cc 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -69,7 +69,7 @@ struct ttm_page_pool {
         spinlock_t              lock;
         bool                    fill_lock;
         struct list_head        list;
-        int                     gfp_flags;
+        gfp_t                   gfp_flags;
         unsigned                npages;
         char                    *name;
         unsigned long           nfrees;
@@ -475,7 +475,7 @@ static void ttm_handle_caching_state_failure(struct list_head *pages,
  * This function is reentrant if caller updates count depending on number of
  * pages returned in pages array.
  */
-static int ttm_alloc_new_pages(struct list_head *pages, int gfp_flags,
+static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
                 int ttm_flags, enum ttm_caching_state cstate, unsigned count)
 {
         struct page **caching_array;
@@ -666,7 +666,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
 {
         struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
         struct page *p = NULL;
-        int gfp_flags = GFP_USER;
+        gfp_t gfp_flags = GFP_USER;
         int r;
 
         /* set zero flag for page allocation if required */
@@ -818,7 +818,7 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
         return 0;
 }
 
-void ttm_page_alloc_fini()
+void ttm_page_alloc_fini(void)
 {
         int i;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 2ff5cf78235f..7083b1a24df3 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -335,7 +335,8 @@ static void vmw_ldu_connector_restore(struct drm_connector *connector)
 }
 
 static enum drm_connector_status
-        vmw_ldu_connector_detect(struct drm_connector *connector)
+        vmw_ldu_connector_detect(struct drm_connector *connector,
+                                 bool force)
 {
         if (vmw_connector_to_ldu(connector)->pref_active)
                 return connector_status_connected;
@@ -516,7 +517,7 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 
         drm_connector_init(dev, connector, &vmw_legacy_connector_funcs,
                            DRM_MODE_CONNECTOR_LVDS);
-        connector->status = vmw_ldu_connector_detect(connector);
+        connector->status = vmw_ldu_connector_detect(connector, true);
 
         drm_encoder_init(dev, encoder, &vmw_legacy_encoder_funcs,
                          DRM_MODE_ENCODER_LVDS);
@@ -610,7 +611,7 @@ int vmw_kms_ldu_update_layout(struct vmw_private *dev_priv, unsigned num,
                         ldu->pref_height = 600;
                         ldu->pref_active = false;
                 }
-                con->status = vmw_ldu_connector_detect(con);
+                con->status = vmw_ldu_connector_detect(con, true);
         }
 
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index b87569e96b16..f366f968155a 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -598,7 +598,7 @@ static inline void vga_update_device_decodes(struct vga_device *vgadev,
         pr_debug("vgaarb: decoding count now is: %d\n", vga_decode_count);
 }
 
-void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
+static void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
 {
         struct vga_device *vgadev;
         unsigned long flags;
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 0c52899be964..3f7292486024 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1285,8 +1285,11 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
         { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
@@ -1578,7 +1581,6 @@ static const struct hid_device_id hid_ignore_list[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_AIPTEK, USB_DEVICE_ID_AIPTEK_24) },
         { HID_USB_DEVICE(USB_VENDOR_ID_AIRCABLE, USB_DEVICE_ID_AIRCABLE1) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ALCOR, USB_DEVICE_ID_ALCOR_USBRS232) },
-        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_LCM)},
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUSTEK, USB_DEVICE_ID_ASUSTEK_LCM2)},
         { HID_USB_DEVICE(USB_VENDOR_ID_AVERMEDIA, USB_DEVICE_ID_AVER_FM_MR800) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 85c6d13c9ffa..765a4f53eb5c 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -105,6 +105,7 @@
 
 #define USB_VENDOR_ID_ASUS              0x0486
 #define USB_DEVICE_ID_ASUS_T91MT        0x0185
+#define USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO    0x0186
 
 #define USB_VENDOR_ID_ASUSTEK           0x0b05
 #define USB_DEVICE_ID_ASUSTEK_LCM       0x1726
@@ -128,6 +129,7 @@
 
 #define USB_VENDOR_ID_BTC               0x046e
 #define USB_DEVICE_ID_BTC_EMPREX_REMOTE 0x5578
+#define USB_DEVICE_ID_BTC_EMPREX_REMOTE_2       0x5577
 
 #define USB_VENDOR_ID_CANDO             0x2087
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
@@ -149,6 +151,7 @@
 
 #define USB_VENDOR_ID_CHICONY           0x04f2
 #define USB_DEVICE_ID_CHICONY_TACTICAL_PAD      0x0418
+#define USB_DEVICE_ID_CHICONY_MULTI_TOUCH       0xb19d
 
 #define USB_VENDOR_ID_CIDC              0x1677
 
@@ -507,6 +510,7 @@
 #define USB_VENDOR_ID_UCLOGIC           0x5543
 #define USB_DEVICE_ID_UCLOGIC_TABLET_PF1209     0x0042
 #define USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U    0x0003
+#define USB_DEVICE_ID_UCLOGIC_TABLET_KNA5       0x6001
 
 #define USB_VENDOR_ID_VERNIER           0x08f7
 #define USB_DEVICE_ID_VERNIER_LABPRO    0x0001
diff --git a/drivers/hid/hid-mosart.c b/drivers/hid/hid-mosart.c
index e91437c18906..ac5421d568f1 100644
--- a/drivers/hid/hid-mosart.c
+++ b/drivers/hid/hid-mosart.c
@@ -239,6 +239,7 @@ static void mosart_remove(struct hid_device *hdev)
 
 static const struct hid_device_id mosart_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, mosart_devices);
diff --git a/drivers/hid/hid-topseed.c b/drivers/hid/hid-topseed.c
index 5771f851f856..956ed9ac19d4 100644
--- a/drivers/hid/hid-topseed.c
+++ b/drivers/hid/hid-topseed.c
@@ -64,6 +64,7 @@ static int ts_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static const struct hid_device_id ts_devices[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
         { }
 };
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index b729c0286679..599041a7f670 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -828,6 +828,7 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
                 }
         } else {
                 int skipped_report_id = 0;
+                int report_id = buf[0];
                 if (buf[0] == 0x0) {
                         /* Don't send the Report ID */
                         buf++;
@@ -837,7 +838,7 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co
                 ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
                         HID_REQ_SET_REPORT,
                         USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        ((report_type + 1) << 8) | *buf,
+                        ((report_type + 1) << 8) | report_id,
                         interface->desc.bInterfaceNumber, buf, count,
                         USB_CTRL_SET_TIMEOUT);
                 /* count also the report id, if this was a numbered report. */
@@ -1445,6 +1446,11 @@ static const struct hid_device_id hid_usb_table[] = {
         { }
 };
 
+struct usb_interface *usbhid_find_interface(int minor)
+{
+        return usb_find_interface(&hid_driver, minor);
+}
+
 static struct hid_driver hid_usb_driver = {
         .name = "generic-usb",
         .id_table = hid_usb_table,
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 2643d3147621..70da3181c8a0 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -33,6 +33,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_AASHIMA, USB_DEVICE_ID_AASHIMA_PREDATOR, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_ALPS, USB_DEVICE_ID_IBM_GAMEPAD, HID_QUIRK_BADPAD },
         { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
+        { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
@@ -69,6 +70,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
         { USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD, HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
 
@@ -77,6 +79,8 @@ static const struct hid_blacklist {
 
         { USB_VENDOR_ID_PI_ENGINEERING, USB_DEVICE_ID_PI_ENGINEERING_VEC_USB_FOOTPEDAL, HID_QUIRK_HIDINPUT_FORCE },
 
+        { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH, HID_QUIRK_MULTI_INPUT },
+
         { 0, 0 }
 };
 
diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
index 0a29c51114aa..681e620eb95b 100644
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -270,7 +270,7 @@ static int hiddev_open(struct inode *inode, struct file *file)
         struct hiddev *hiddev;
         int res;
 
-        intf = usb_find_interface(&hiddev_driver, iminor(inode));
+        intf = usbhid_find_interface(iminor(inode));
         if (!intf)
                 return -ENODEV;
         hid = usb_get_intfdata(intf);
diff --git a/drivers/hid/usbhid/usbhid.h b/drivers/hid/usbhid/usbhid.h
index 693fd3e720df..89d2e847dcc6 100644
--- a/drivers/hid/usbhid/usbhid.h
+++ b/drivers/hid/usbhid/usbhid.h
@@ -42,6 +42,7 @@ void usbhid_submit_report
 (struct hid_device *hid, struct hid_report *report, unsigned char dir);
 int usbhid_get_power(struct hid_device *hid);
 void usbhid_put_power(struct hid_device *hid);
+struct usb_interface *usbhid_find_interface(int minor);
 
 /* iofl flags */
 #define HID_CTRL_RUNNING        1
diff --git a/drivers/hwmon/adm1031.c b/drivers/hwmon/adm1031.c
index 15c1a9616af3..0683e6be662c 100644
--- a/drivers/hwmon/adm1031.c
+++ b/drivers/hwmon/adm1031.c
@@ -79,7 +79,7 @@ struct adm1031_data {
         int chip_type;
         char valid;             /* !=0 if following fields are valid */
         unsigned long last_updated;     /* In jiffies */
-        unsigned int update_rate;       /* In milliseconds */
+        unsigned int update_interval;   /* In milliseconds */
         /* The chan_select_table contains the possible configurations for
          * auto fan control.
          */
@@ -743,23 +743,23 @@ static SENSOR_DEVICE_ATTR(temp3_crit_alarm, S_IRUGO, show_alarm, NULL, 12);
 static SENSOR_DEVICE_ATTR(temp3_fault, S_IRUGO, show_alarm, NULL, 13);
 static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO, show_alarm, NULL, 14);
 
-/* Update Rate */
-static const unsigned int update_rates[] = {
+/* Update Interval */
+static const unsigned int update_intervals[] = {
         16000, 8000, 4000, 2000, 1000, 500, 250, 125,
 };
 
-static ssize_t show_update_rate(struct device *dev,
-                                struct device_attribute *attr, char *buf)
+static ssize_t show_update_interval(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct adm1031_data *data = i2c_get_clientdata(client);
 
-        return sprintf(buf, "%u\n", data->update_rate);
+        return sprintf(buf, "%u\n", data->update_interval);
 }
 
-static ssize_t set_update_rate(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t count)
+static ssize_t set_update_interval(struct device *dev,
+                                   struct device_attribute *attr,
+                                   const char *buf, size_t count)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct adm1031_data *data = i2c_get_clientdata(client);
@@ -771,12 +771,15 @@ static ssize_t set_update_rate(struct device *dev,
         if (err)
                 return err;
 
-        /* find the nearest update rate from the table */
-        for (i = 0; i < ARRAY_SIZE(update_rates) - 1; i++) {
-                if (val >= update_rates[i])
+        /*
+         * Find the nearest update interval from the table.
+         * Use it to determine the matching update rate.
+         */
+        for (i = 0; i < ARRAY_SIZE(update_intervals) - 1; i++) {
+                if (val >= update_intervals[i])
                         break;
         }
-        /* if not found, we point to the last entry (lowest update rate) */
+        /* if not found, we point to the last entry (lowest update interval) */
 
         /* set the new update rate while preserving other settings */
         reg = adm1031_read_value(client, ADM1031_REG_FAN_FILTER);
@@ -785,14 +788,14 @@ static ssize_t set_update_rate(struct device *dev,
         adm1031_write_value(client, ADM1031_REG_FAN_FILTER, reg);
 
         mutex_lock(&data->update_lock);
-        data->update_rate = update_rates[i];
+        data->update_interval = update_intervals[i];
         mutex_unlock(&data->update_lock);
 
         return count;
 }
 
-static DEVICE_ATTR(update_rate, S_IRUGO | S_IWUSR, show_update_rate,
-                   set_update_rate);
+static DEVICE_ATTR(update_interval, S_IRUGO | S_IWUSR, show_update_interval,
+                   set_update_interval);
 
 static struct attribute *adm1031_attributes[] = {
         &sensor_dev_attr_fan1_input.dev_attr.attr,
@@ -830,7 +833,7 @@ static struct attribute *adm1031_attributes[] = {
 
         &sensor_dev_attr_auto_fan1_min_pwm.dev_attr.attr,
 
-        &dev_attr_update_rate.attr,
+        &dev_attr_update_interval.attr,
         &dev_attr_alarms.attr,
 
         NULL
@@ -981,7 +984,8 @@ static void adm1031_init_client(struct i2c_client *client)
         mask = ADM1031_UPDATE_RATE_MASK;
         read_val = adm1031_read_value(client, ADM1031_REG_FAN_FILTER);
         i = (read_val & mask) >> ADM1031_UPDATE_RATE_SHIFT;
-        data->update_rate = update_rates[i];
+        /* Save it as update interval */
+        data->update_interval = update_intervals[i];
 }
 
 static struct adm1031_data *adm1031_update_device(struct device *dev)
@@ -993,7 +997,8 @@ static struct adm1031_data *adm1031_update_device(struct device *dev)
 
         mutex_lock(&data->update_lock);
 
-        next_update = data->last_updated + msecs_to_jiffies(data->update_rate);
+        next_update = data->last_updated
+          + msecs_to_jiffies(data->update_interval);
         if (time_after(jiffies, next_update) || !data->valid) {
 
                 dev_dbg(&client->dev, "Starting adm1031 update\n");
diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
index 5b58b20dead1..8dee3f38fdfb 100644
--- a/drivers/hwmon/emc1403.c
+++ b/drivers/hwmon/emc1403.c
@@ -308,7 +308,6 @@ static int emc1403_probe(struct i2c_client *client,
         res = sysfs_create_group(&client->dev.kobj, &m_thermal_gr);
         if (res) {
                 dev_warn(&client->dev, "create group failed\n");
-                hwmon_device_unregister(data->hwmon_dev);
                 goto thermal_error1;
         }
         data->hwmon_dev = hwmon_device_register(&client->dev);
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 0f58ecc5334d..9638d58f99fd 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -79,7 +79,7 @@ enum chips { f75373, f75375 };
 #define F75375_REG_PWM2_DROP_DUTY       0x6C
 
 #define FAN_CTRL_LINEAR(nr)             (4 + nr)
-#define FAN_CTRL_MODE(nr)               (5 + ((nr) * 2))
+#define FAN_CTRL_MODE(nr)               (4 + ((nr) * 2))
 
 /*
  * Data structures and manipulation thereof
@@ -298,7 +298,7 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
-        fanmode = ~(3 << FAN_CTRL_MODE(nr));
+        fanmode &= ~(3 << FAN_CTRL_MODE(nr));
 
         switch (val) {
         case 0: /* Full speed */
@@ -350,7 +350,7 @@ static ssize_t set_pwm_mode(struct device *dev, struct device_attribute *attr,
 
         mutex_lock(&data->update_lock);
         conf = f75375_read8(client, F75375_REG_CONFIG1);
-        conf = ~(1 << FAN_CTRL_LINEAR(nr));
+        conf &= ~(1 << FAN_CTRL_LINEAR(nr));
 
         if (val == 0)
                 conf |= (1 << FAN_CTRL_LINEAR(nr)) ;
diff --git a/drivers/hwmon/lis3lv02d_i2c.c b/drivers/hwmon/lis3lv02d_i2c.c
index dc1f5402c1d7..8e5933b72d19 100644
--- a/drivers/hwmon/lis3lv02d_i2c.c
+++ b/drivers/hwmon/lis3lv02d_i2c.c
@@ -121,7 +121,7 @@ static int lis3lv02d_i2c_suspend(struct i2c_client *client, pm_message_t mesg)
 {
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweroff(lis3);
         return 0;
 }
@@ -130,7 +130,7 @@ static int lis3lv02d_i2c_resume(struct i2c_client *client)
 {
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweron(lis3);
         return 0;
 }
diff --git a/drivers/hwmon/lis3lv02d_spi.c b/drivers/hwmon/lis3lv02d_spi.c
index 82b16808a274..b9be5e3a22b3 100644
--- a/drivers/hwmon/lis3lv02d_spi.c
+++ b/drivers/hwmon/lis3lv02d_spi.c
@@ -92,7 +92,7 @@ static int lis3lv02d_spi_suspend(struct spi_device *spi, pm_message_t mesg)
 {
         struct lis3lv02d *lis3 = spi_get_drvdata(spi);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweroff(&lis3_dev);
 
         return 0;
@@ -102,7 +102,7 @@ static int lis3lv02d_spi_resume(struct spi_device *spi)
 {
         struct lis3lv02d *lis3 = spi_get_drvdata(spi);
 
-        if (!lis3->pdata->wakeup_flags)
+        if (!lis3->pdata || !lis3->pdata->wakeup_flags)
                 lis3lv02d_poweron(lis3);
 
         return 0;
diff --git a/drivers/hwmon/lm95241.c b/drivers/hwmon/lm95241.c
index 94741d42112d..464340f25496 100644
--- a/drivers/hwmon/lm95241.c
+++ b/drivers/hwmon/lm95241.c
@@ -91,7 +91,7 @@ static struct lm95241_data *lm95241_update_device(struct device *dev);
 struct lm95241_data {
         struct device *hwmon_dev;
         struct mutex update_lock;
-        unsigned long last_updated, rate; /* in jiffies */
+        unsigned long last_updated, interval; /* in jiffies */
         char valid; /* zero until following fields are valid */
         /* registers values */
         u8 local_h, local_l; /* local */
@@ -114,23 +114,23 @@ show_temp(local);
 show_temp(remote1);
 show_temp(remote2);
 
-static ssize_t show_rate(struct device *dev, struct device_attribute *attr,
+static ssize_t show_interval(struct device *dev, struct device_attribute *attr,
                          char *buf)
 {
         struct lm95241_data *data = lm95241_update_device(dev);
 
-        snprintf(buf, PAGE_SIZE - 1, "%lu\n", 1000 * data->rate / HZ);
+        snprintf(buf, PAGE_SIZE - 1, "%lu\n", 1000 * data->interval / HZ);
         return strlen(buf);
 }
 
-static ssize_t set_rate(struct device *dev, struct device_attribute *attr,
+static ssize_t set_interval(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
         struct i2c_client *client = to_i2c_client(dev);
         struct lm95241_data *data = i2c_get_clientdata(client);
 
-        strict_strtol(buf, 10, &data->rate);
-        data->rate = data->rate * HZ / 1000;
+        strict_strtol(buf, 10, &data->interval);
+        data->interval = data->interval * HZ / 1000;
 
         return count;
 }
@@ -286,7 +286,8 @@ static DEVICE_ATTR(temp2_min, S_IWUSR | S_IRUGO, show_min1, set_min1);
 static DEVICE_ATTR(temp3_min, S_IWUSR | S_IRUGO, show_min2, set_min2);
 static DEVICE_ATTR(temp2_max, S_IWUSR | S_IRUGO, show_max1, set_max1);
 static DEVICE_ATTR(temp3_max, S_IWUSR | S_IRUGO, show_max2, set_max2);
-static DEVICE_ATTR(rate, S_IWUSR | S_IRUGO, show_rate, set_rate);
+static DEVICE_ATTR(update_interval, S_IWUSR | S_IRUGO, show_interval,
+                   set_interval);
 
 static struct attribute *lm95241_attributes[] = {
         &dev_attr_temp1_input.attr,
@@ -298,7 +299,7 @@ static struct attribute *lm95241_attributes[] = {
         &dev_attr_temp3_min.attr,
         &dev_attr_temp2_max.attr,
         &dev_attr_temp3_max.attr,
-        &dev_attr_rate.attr,
+        &dev_attr_update_interval.attr,
         NULL
 };
 
@@ -376,7 +377,7 @@ static void lm95241_init_client(struct i2c_client *client)
 {
         struct lm95241_data *data = i2c_get_clientdata(client);
 
-        data->rate = HZ;    /* 1 sec default */
+        data->interval = HZ;    /* 1 sec default */
         data->valid = 0;
         data->config = CFG_CR0076;
         data->model = 0;
@@ -410,7 +411,7 @@ static struct lm95241_data *lm95241_update_device(struct device *dev)
 
         mutex_lock(&data->update_lock);
 
-        if (time_after(jiffies, data->last_updated + data->rate) ||
+        if (time_after(jiffies, data->last_updated + data->interval) ||
             !data->valid) {
                 dev_dbg(&client->dev, "Updating lm95241 data.\n");
                 data->local_h =
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index e96e69dd36fb..072c58008a63 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -127,6 +127,7 @@ superio_enter(int ioreg)
 static inline void
 superio_exit(int ioreg)
 {
+        outb(0xaa, ioreg);
         outb(0x02, ioreg);
         outb(0x02, ioreg + 1);
 }
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 7674efb55378..b33c78586bfc 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -680,6 +680,8 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
 
         if (r == 0)
                 r = num;
+
+        omap_i2c_wait_for_bb(dev);
 out:
         omap_i2c_idle(dev);
         return r;
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 4c3d1bfec0c5..068cef0a987a 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1448,19 +1448,13 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif == NULL)
                         continue;
 
-                if (hwif->present)
-                        hwif_register_devices(hwif);
-        }
-
-        ide_host_for_each_port(i, hwif, host) {
-                if (hwif == NULL)
-                        continue;
-
                 ide_sysfs_register_port(hwif);
                 ide_proc_register_port(hwif);
 
-                if (hwif->present)
+                if (hwif->present) {
                         ide_proc_port_register_devices(hwif);
+                        hwif_register_devices(hwif);
+                }
         }
 
         return j ? 0 : -1;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 43cf9cc9c1df..f20d13e717d5 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1643,7 +1643,9 @@ static void super_1_sync(mddev_t *mddev, mdk_rdev_t *rdev)
                 bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
                 if (rdev->sb_size & bmask)
                         rdev->sb_size = (rdev->sb_size | bmask) + 1;
-        }
+        } else
+                max_dev = le32_to_cpu(sb->max_dev);
+
         for (i=0; i<max_dev;i++)
                 sb->dev_roles[i] = cpu_to_le16(0xfffe);
         
@@ -7069,7 +7071,7 @@ void md_check_recovery(mddev_t *mddev)
         if (mddev->ro && !test_bit(MD_RECOVERY_NEEDED, &mddev->recovery))
                 return;
         if ( ! (
-                (mddev->flags && !mddev->external) ||
+                (mddev->flags & ~ (1<<MD_CHANGE_PENDING)) ||
                 test_bit(MD_RECOVERY_NEEDED, &mddev->recovery) ||
                 test_bit(MD_RECOVERY_DONE, &mddev->recovery) ||
                 (mddev->external == 0 && mddev->safemode == 1) ||
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 0b591b658243..b74331260744 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -368,7 +368,7 @@ config VMWARE_BALLOON
           If unsure, say N.
 
           To compile this driver as a module, choose M here: the
-          module will be called vmware_balloon.
+          module will be called vmw_balloon.
 
 config ARM_CHARLCD
         bool "ARM Ltd. Character LCD Driver"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 255a80dc9d73..42eab95cde2a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -33,5 +33,5 @@ obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
-obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
+obj-$(CONFIG_VMWARE_BALLOON)    += vmw_balloon.o
 obj-$(CONFIG_ARM_CHARLCD)       += arm-charlcd.o
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmw_balloon.c
index 2a1e804a71aa..2a1e804a71aa 100644
--- a/drivers/misc/vmware_balloon.c
+++ b/drivers/misc/vmw_balloon.c
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
index a382e3dd0a5d..6fbeefa3a766 100644
--- a/drivers/mtd/nand/bf5xx_nand.c
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -682,7 +682,6 @@ static int __devinit bf5xx_nand_add_partition(struct bf5xx_nand_info *info)
 static int __devexit bf5xx_nand_remove(struct platform_device *pdev)
 {
         struct bf5xx_nand_info *info = to_nand_info(pdev);
-        struct mtd_info *mtd = NULL;
 
         platform_set_drvdata(pdev, NULL);
 
@@ -690,11 +689,7 @@ static int __devexit bf5xx_nand_remove(struct platform_device *pdev)
          * and their partitions, then go through freeing the
          * resources used
          */
-        mtd = &info->mtd;
-        if (mtd) {
-                nand_release(mtd);
-                kfree(mtd);
-        }
+        nand_release(&info->mtd);
 
         peripheral_free_list(bfin_nfc_pin_req);
         bf5xx_nand_dma_remove(info);
@@ -710,7 +705,7 @@ static int bf5xx_nand_scan(struct mtd_info *mtd)
         struct nand_chip *chip = mtd->priv;
         int ret;
 
-        ret = nand_scan_ident(mtd, 1);
+        ret = nand_scan_ident(mtd, 1, NULL);
         if (ret)
                 return ret;
 
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index fcf8ceb277d4..b2828e84d243 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -67,7 +67,9 @@
 #define NFC_V1_V2_CONFIG1_BIG           (1 << 5)
 #define NFC_V1_V2_CONFIG1_RST           (1 << 6)
 #define NFC_V1_V2_CONFIG1_CE            (1 << 7)
-#define NFC_V1_V2_CONFIG1_ONE_CYCLE     (1 << 8)
+#define NFC_V2_CONFIG1_ONE_CYCLE        (1 << 8)
+#define NFC_V2_CONFIG1_PPB(x)           (((x) & 0x3) << 9)
+#define NFC_V2_CONFIG1_FP_INT           (1 << 11)
 
 #define NFC_V1_V2_CONFIG2_INT           (1 << 15)
 
@@ -402,16 +404,16 @@ static void send_read_id_v1_v2(struct mxc_nand_host *host)
         /* Wait for operation to complete */
         wait_op_done(host, true);
 
+        memcpy(host->data_buf, host->main_area0, 16);
+
         if (this->options & NAND_BUSWIDTH_16) {
-                void __iomem *main_buf = host->main_area0;
                 /* compress the ID info */
-                writeb(readb(main_buf + 2), main_buf + 1);
-                writeb(readb(main_buf + 4), main_buf + 2);
-                writeb(readb(main_buf + 6), main_buf + 3);
-                writeb(readb(main_buf + 8), main_buf + 4);
-                writeb(readb(main_buf + 10), main_buf + 5);
+                host->data_buf[1] = host->data_buf[2];
+                host->data_buf[2] = host->data_buf[4];
+                host->data_buf[3] = host->data_buf[6];
+                host->data_buf[4] = host->data_buf[8];
+                host->data_buf[5] = host->data_buf[10];
         }
-        memcpy(host->data_buf, host->main_area0, 16);
 }
 
 static uint16_t get_dev_status_v3(struct mxc_nand_host *host)
@@ -729,27 +731,30 @@ static void preset_v1_v2(struct mtd_info *mtd)
 {
         struct nand_chip *nand_chip = mtd->priv;
         struct mxc_nand_host *host = nand_chip->priv;
-        uint16_t tmp;
-
-        /* enable interrupt, disable spare enable */
-        tmp = readw(NFC_V1_V2_CONFIG1);
-        tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
-        tmp &= ~NFC_V1_V2_CONFIG1_SP_EN;
-        if (nand_chip->ecc.mode == NAND_ECC_HW) {
-                tmp |= NFC_V1_V2_CONFIG1_ECC_EN;
-        } else {
-                tmp &= ~NFC_V1_V2_CONFIG1_ECC_EN;
-        }
+        uint16_t config1 = 0;
+
+        if (nand_chip->ecc.mode == NAND_ECC_HW)
+                config1 |= NFC_V1_V2_CONFIG1_ECC_EN;
+
+        if (nfc_is_v21())
+                config1 |= NFC_V2_CONFIG1_FP_INT;
+
+        if (!cpu_is_mx21())
+                config1 |= NFC_V1_V2_CONFIG1_INT_MSK;
 
         if (nfc_is_v21() && mtd->writesize) {
+                uint16_t pages_per_block = mtd->erasesize / mtd->writesize;
+
                 host->eccsize = get_eccsize(mtd);
                 if (host->eccsize == 4)
-                        tmp |= NFC_V2_CONFIG1_ECC_MODE_4;
+                        config1 |= NFC_V2_CONFIG1_ECC_MODE_4;
+
+                config1 |= NFC_V2_CONFIG1_PPB(ffs(pages_per_block) - 6);
         } else {
                 host->eccsize = 1;
         }
 
-        writew(tmp, NFC_V1_V2_CONFIG1);
+        writew(config1, NFC_V1_V2_CONFIG1);
         /* preset operation */
 
         /* Unlock the internal RAM Buffer */
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 4d89f3780207..4d01cda68844 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1320,6 +1320,7 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
                 goto fail_free_irq;
         }
 
+#ifdef CONFIG_MTD_PARTITIONS
         if (mtd_has_cmdlinepart()) {
                 static const char *probes[] = { "cmdlinepart", NULL };
                 struct mtd_partition *parts;
@@ -1332,6 +1333,9 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
         }
 
         return add_mtd_partitions(mtd, pdata->parts, pdata->nr_parts);
+#else
+        return 0;
+#endif
 
 fail_free_irq:
         free_irq(irq, info);
@@ -1364,7 +1368,9 @@ static int pxa3xx_nand_remove(struct platform_device *pdev)
         platform_set_drvdata(pdev, NULL);
 
         del_mtd_device(mtd);
+#ifdef CONFIG_MTD_PARTITIONS
         del_mtd_partitions(mtd);
+#endif
         irq = platform_get_irq(pdev, 0);
         if (irq >= 0)
                 free_irq(irq, info);
diff --git a/drivers/mtd/onenand/samsung.c b/drivers/mtd/onenand/samsung.c
index cb443af3d45f..a460f1b748c2 100644
--- a/drivers/mtd/onenand/samsung.c
+++ b/drivers/mtd/onenand/samsung.c
@@ -554,14 +554,13 @@ static int s5pc110_dma_ops(void *dst, void *src, size_t count, int direction)
 
         do {
                 status = readl(base + S5PC110_DMA_TRANS_STATUS);
+                if (status & S5PC110_DMA_TRANS_STATUS_TE) {
+                        writel(S5PC110_DMA_TRANS_CMD_TEC,
+                                        base + S5PC110_DMA_TRANS_CMD);
+                        return -EIO;
+                }
         } while (!(status & S5PC110_DMA_TRANS_STATUS_TD));
 
-        if (status & S5PC110_DMA_TRANS_STATUS_TE) {
-                writel(S5PC110_DMA_TRANS_CMD_TEC, base + S5PC110_DMA_TRANS_CMD);
-                writel(S5PC110_DMA_TRANS_CMD_TDC, base + S5PC110_DMA_TRANS_CMD);
-                return -EIO;
-        }
-
         writel(S5PC110_DMA_TRANS_CMD_TDC, base + S5PC110_DMA_TRANS_CMD);
 
         return 0;
@@ -571,13 +570,12 @@ static int s5pc110_read_bufferram(struct mtd_info *mtd, int area,
                 unsigned char *buffer, int offset, size_t count)
 {
         struct onenand_chip *this = mtd->priv;
-        void __iomem *bufferram;
         void __iomem *p;
         void *buf = (void *) buffer;
         dma_addr_t dma_src, dma_dst;
         int err;
 
-        p = bufferram = this->base + area;
+        p = this->base + area;
         if (ONENAND_CURRENT_BUFFERRAM(this)) {
                 if (area == ONENAND_DATARAM)
                         p += this->writesize;
@@ -621,7 +619,7 @@ static int s5pc110_read_bufferram(struct mtd_info *mtd, int area,
 normal:
         if (count != mtd->writesize) {
                 /* Copy the bufferram to memory to prevent unaligned access */
-                memcpy(this->page_buf, bufferram, mtd->writesize);
+                memcpy(this->page_buf, p, mtd->writesize);
                 p = this->page_buf + offset;
         }
 
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index 85671adae455..fa42103b2874 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -635,6 +635,9 @@ struct vortex_private {
                 must_free_region:1,                             /* Flag: if zero, Cardbus owns the I/O region */
                 large_frames:1,                 /* accept large frames */
                 handling_irq:1;                 /* private in_irq indicator */
+        /* {get|set}_wol operations are already serialized by rtnl.
+         * no additional locking is required for the enable_wol and acpi_set_WOL()
+         */
         int drv_flags;
         u16 status_enable;
         u16 intr_enable;
@@ -2939,13 +2942,11 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
         struct vortex_private *vp = netdev_priv(dev);
 
-        spin_lock_irq(&vp->lock);
         wol->supported = WAKE_MAGIC;
 
         wol->wolopts = 0;
         if (vp->enable_wol)
                 wol->wolopts |= WAKE_MAGIC;
-        spin_unlock_irq(&vp->lock);
 }
 
 static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
@@ -2954,13 +2955,11 @@ static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
         if (wol->wolopts & ~WAKE_MAGIC)
                 return -EINVAL;
 
-        spin_lock_irq(&vp->lock);
         if (wol->wolopts & WAKE_MAGIC)
                 vp->enable_wol = 1;
         else
                 vp->enable_wol = 0;
         acpi_set_WOL(dev);
-        spin_unlock_irq(&vp->lock);
 
         return 0;
 }
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 822f586d72af..0ddf4c66afe2 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2466,6 +2466,9 @@ int bond_3ad_lacpdu_recv(struct sk_buff *skb, struct net_device *dev, struct pac
         if (!(dev->flags & IFF_MASTER))
                 goto out;
 
+        if (!pskb_may_pull(skb, sizeof(struct lacpdu)))
+                goto out;
+
         read_lock(&bond->lock);
         slave = bond_get_slave_by_dev((struct bonding *)netdev_priv(dev),
                                         orig_dev);
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index c746b331771d..26bb118c4533 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -362,6 +362,9 @@ static int rlb_arp_recv(struct sk_buff *skb, struct net_device *bond_dev, struct
                 goto out;
         }
 
+        if (!pskb_may_pull(skb, arp_hdr_len(bond_dev)))
+                goto out;
+
         if (skb->len < sizeof(struct arp_pkt)) {
                 pr_debug("Packet is too small to be an ARP\n");
                 goto out;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index ad19585d960b..f208712c0b90 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -2296,6 +2296,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr)
         case CHELSIO_GET_QSET_NUM:{
                 struct ch_reg edata;
 
+                memset(&edata, 0, sizeof(struct ch_reg));
+
                 edata.cmd = CHELSIO_GET_QSET_NUM;
                 edata.val = pi->nqsets;
                 if (copy_to_user(useraddr, &edata, sizeof(edata)))
diff --git a/drivers/net/eql.c b/drivers/net/eql.c
index dda2c7944da9..0cb1cf9cf4b0 100644
--- a/drivers/net/eql.c
+++ b/drivers/net/eql.c
@@ -555,6 +555,8 @@ static int eql_g_master_cfg(struct net_device *dev, master_config_t __user *mcp)
         equalizer_t *eql;
         master_config_t mc;
 
+        memset(&mc, 0, sizeof(master_config_t));
+
         if (eql_is_master(dev)) {
                 eql = netdev_priv(dev);
                 mc.max_slaves = eql->max_slaves;
diff --git a/drivers/net/ll_temac_main.c b/drivers/net/ll_temac_main.c
index bdf2149e5296..87f0a93b165c 100644
--- a/drivers/net/ll_temac_main.c
+++ b/drivers/net/ll_temac_main.c
@@ -38,6 +38,7 @@
 #include <linux/of_device.h>
 #include <linux/of_mdio.h>
 #include <linux/of_platform.h>
+#include <linux/of_address.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
 #include <linux/tcp.h>      /* needed for sizeof(tcphdr) */
diff --git a/drivers/net/ll_temac_mdio.c b/drivers/net/ll_temac_mdio.c
index 5ae28c975b38..8cf9d4f56bb2 100644
--- a/drivers/net/ll_temac_mdio.c
+++ b/drivers/net/ll_temac_mdio.c
@@ -10,6 +10,7 @@
 #include <linux/phy.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_address.h>
 #include <linux/slab.h>
 #include <linux/of_mdio.h>
 
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 49279b0ee526..f9b509a6b09a 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -508,7 +508,8 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                            unsigned int vcc,
                            void *priv_data)
 {
-        int *has_shmem = priv_data;
+        int *priv = priv_data;
+        int try = (*priv & 0x1);
         int i;
         cistpl_io_t *io = &cfg->io;
 
@@ -525,77 +526,103 @@ static int pcnet_confcheck(struct pcmcia_device *p_dev,
                 i = p_dev->resource[1]->end = 0;
         }
 
-        *has_shmem = ((cfg->mem.nwin == 1) &&
-                      (cfg->mem.win[0].len >= 0x4000));
+        *priv &= ((cfg->mem.nwin == 1) &&
+                  (cfg->mem.win[0].len >= 0x4000)) ? 0x10 : ~0x10;
+
         p_dev->resource[0]->start = io->win[i].base;
         p_dev->resource[0]->end = io->win[i].len;
-        p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        if (!try)
+                p_dev->io_lines = io->flags & CISTPL_IO_LINES_MASK;
+        else
+                p_dev->io_lines = 16;
         if (p_dev->resource[0]->end + p_dev->resource[1]->end >= 32)
                 return try_io_port(p_dev);
 
-        return 0;
+        return -EINVAL;
+}
+
+static hw_info_t *pcnet_try_config(struct pcmcia_device *link,
+                                   int *has_shmem, int try)
+{
+        struct net_device *dev = link->priv;
+        hw_info_t *local_hw_info;
+        pcnet_dev_t *info = PRIV(dev);
+        int priv = try;
+        int ret;
+
+        ret = pcmcia_loop_config(link, pcnet_confcheck, &priv);
+        if (ret) {
+                dev_warn(&link->dev, "no useable port range found\n");
+                return NULL;
+        }
+        *has_shmem = (priv & 0x10);
+
+        if (!link->irq)
+                return NULL;
+
+        if (resource_size(link->resource[1]) == 8) {
+                link->conf.Attributes |= CONF_ENABLE_SPKR;
+                link->conf.Status = CCSR_AUDIO_ENA;
+        }
+        if ((link->manf_id == MANFID_IBM) &&
+            (link->card_id == PRODID_IBM_HOME_AND_AWAY))
+                link->conf.ConfigIndex |= 0x10;
+
+        ret = pcmcia_request_configuration(link, &link->conf);
+        if (ret)
+                return NULL;
+
+        dev->irq = link->irq;
+        dev->base_addr = link->resource[0]->start;
+
+        if (info->flags & HAS_MISC_REG) {
+                if ((if_port == 1) || (if_port == 2))
+                        dev->if_port = if_port;
+                else
+                        dev_notice(&link->dev, "invalid if_port requested\n");
+        } else
+                dev->if_port = 0;
+
+        if ((link->conf.ConfigBase == 0x03c0) &&
+            (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
+                dev_info(&link->dev,
+                        "this is an AX88190 card - use axnet_cs instead.\n");
+                return NULL;
+        }
+
+        local_hw_info = get_hwinfo(link);
+        if (!local_hw_info)
+                local_hw_info = get_prom(link);
+        if (!local_hw_info)
+                local_hw_info = get_dl10019(link);
+        if (!local_hw_info)
+                local_hw_info = get_ax88190(link);
+        if (!local_hw_info)
+                local_hw_info = get_hwired(link);
+
+        return local_hw_info;
 }
 
 static int pcnet_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     pcnet_dev_t *info = PRIV(dev);
-    int ret, start_pg, stop_pg, cm_offset;
+    int start_pg, stop_pg, cm_offset;
     int has_shmem = 0;
     hw_info_t *local_hw_info;
 
     dev_dbg(&link->dev, "pcnet_config\n");
 
-    ret = pcmcia_loop_config(link, pcnet_confcheck, &has_shmem);
-    if (ret)
-        goto failed;
-
-    if (!link->irq)
-            goto failed;
-
-    if (resource_size(link->resource[1]) == 8) {
-        link->conf.Attributes |= CONF_ENABLE_SPKR;
-        link->conf.Status = CCSR_AUDIO_ENA;
-    }
-    if ((link->manf_id == MANFID_IBM) &&
-        (link->card_id == PRODID_IBM_HOME_AND_AWAY))
-        link->conf.ConfigIndex |= 0x10;
-
-    ret = pcmcia_request_configuration(link, &link->conf);
-    if (ret)
-            goto failed;
-    dev->irq = link->irq;
-    dev->base_addr = link->resource[0]->start;
-    if (info->flags & HAS_MISC_REG) {
-        if ((if_port == 1) || (if_port == 2))
-            dev->if_port = if_port;
-        else
-            printk(KERN_NOTICE "pcnet_cs: invalid if_port requested\n");
-    } else {
-        dev->if_port = 0;
-    }
-
-    if ((link->conf.ConfigBase == 0x03c0) &&
-        (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
-        printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
-        printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
-        goto failed;
-    }
-
-    local_hw_info = get_hwinfo(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_prom(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_dl10019(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_ax88190(link);
-    if (local_hw_info == NULL)
-        local_hw_info = get_hwired(link);
-
-    if (local_hw_info == NULL) {
-        printk(KERN_NOTICE "pcnet_cs: unable to read hardware net"
-               " address for io base %#3lx\n", dev->base_addr);
-        goto failed;
+    local_hw_info = pcnet_try_config(link, &has_shmem, 0);
+    if (!local_hw_info) {
+            /* check whether forcing io_lines to 16 helps... */
+            pcmcia_disable_device(link);
+            local_hw_info = pcnet_try_config(link, &has_shmem, 1);
+            if (local_hw_info == NULL) {
+                    dev_notice(&link->dev, "unable to read hardware net"
+                            " address for io base %#3lx\n", dev->base_addr);
+                    goto failed;
+            }
     }
 
     info->flags = local_hw_info->flags;
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 6a6b8199a0d6..6c58da2b882c 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -308,7 +308,7 @@ static int mdio_bus_suspend(struct device *dev)
          * may call phy routines that try to grab the same lock, and that may
          * lead to a deadlock.
          */
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                 phy_stop_machine(phydev);
 
         if (!mdio_bus_phy_may_suspend(phydev))
@@ -331,7 +331,7 @@ static int mdio_bus_resume(struct device *dev)
                 return ret;
 
 no_resume:
-        if (phydev->attached_dev)
+        if (phydev->attached_dev && phydev->adjust_link)
                 phy_start_machine(phydev, NULL);
 
         return 0;
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6695a51e09e9..736b91703b3e 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1314,8 +1314,13 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
         hdrlen = (ppp->flags & SC_MP_XSHORTSEQ)? MPHDRLEN_SSN: MPHDRLEN;
         i = 0;
         list_for_each_entry(pch, &ppp->channels, clist) {
-                navail += pch->avail = (pch->chan != NULL);
-                pch->speed = pch->chan->speed;
+                if (pch->chan) {
+                        pch->avail = 1;
+                        navail++;
+                        pch->speed = pch->chan->speed;
+                } else {
+                        pch->avail = 0;
+                }
                 if (pch->avail) {
                         if (skb_queue_empty(&pch->file.xq) ||
                                 !pch->had_frag) {
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 078bbf4e6f19..a0da4a17b025 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2934,7 +2934,7 @@ static const struct rtl_cfg_info {
                 .hw_start       = rtl_hw_start_8168,
                 .region         = 2,
                 .align          = 8,
-                .intr_event     = SYSErr | LinkChg | RxOverflow |
+                .intr_event     = SYSErr | RxFIFOOver | LinkChg | RxOverflow |
                                   TxErr | TxOK | RxOK | RxErr,
                 .napi_event     = TxErr | TxOK | RxOK | RxOverflow,
                 .features       = RTL_FEATURE_GMII | RTL_FEATURE_MSI,
@@ -4625,8 +4625,7 @@ static irqreturn_t rtl8169_interrupt(int irq, void *dev_instance)
                 }
 
                 /* Work around for rx fifo overflow */
-                if (unlikely(status & RxFIFOOver) &&
-                (tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+                if (unlikely(status & RxFIFOOver)) {
                         netif_stop_queue(dev);
                         rtl8169_tx_timeout(dev);
                         break;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 6efca66b8766..1cd752f9a6e1 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1652,6 +1652,8 @@ static int hso_get_count(struct hso_serial *serial,
         struct uart_icount cnow;
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
+        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
         if (!tiocmget)
                  return -ENOENT;
         spin_lock_irq(&serial->serial_lock);
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index c3ceebb5be84..5ac2aa783f58 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -71,6 +71,49 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
 
+/* page table handling */
+#define LEVEL_STRIDE            (9)
+#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
+
+static inline int agaw_to_level(int agaw)
+{
+        return agaw + 2;
+}
+
+static inline int agaw_to_width(int agaw)
+{
+        return 30 + agaw * LEVEL_STRIDE;
+}
+
+static inline int width_to_agaw(int width)
+{
+        return (width - 30) / LEVEL_STRIDE;
+}
+
+static inline unsigned int level_to_offset_bits(int level)
+{
+        return (level - 1) * LEVEL_STRIDE;
+}
+
+static inline int pfn_level_offset(unsigned long pfn, int level)
+{
+        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
+}
+
+static inline unsigned long level_mask(int level)
+{
+        return -1UL << level_to_offset_bits(level);
+}
+
+static inline unsigned long level_size(int level)
+{
+        return 1UL << level_to_offset_bits(level);
+}
+
+static inline unsigned long align_to_level(unsigned long pfn, int level)
+{
+        return (pfn + level_size(level) - 1) & level_mask(level);
+}
 
 /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
    are never going to work. */
@@ -434,8 +477,6 @@ void free_iova_mem(struct iova *iova)
 }
 
 
-static inline int width_to_agaw(int width);
-
 static int __iommu_calculate_agaw(struct intel_iommu *iommu, int max_gaw)
 {
         unsigned long sagaw;
@@ -646,51 +687,6 @@ out:
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-/* page table handling */
-#define LEVEL_STRIDE            (9)
-#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
-
-static inline int agaw_to_level(int agaw)
-{
-        return agaw + 2;
-}
-
-static inline int agaw_to_width(int agaw)
-{
-        return 30 + agaw * LEVEL_STRIDE;
-
-}
-
-static inline int width_to_agaw(int width)
-{
-        return (width - 30) / LEVEL_STRIDE;
-}
-
-static inline unsigned int level_to_offset_bits(int level)
-{
-        return (level - 1) * LEVEL_STRIDE;
-}
-
-static inline int pfn_level_offset(unsigned long pfn, int level)
-{
-        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
-}
-
-static inline unsigned long level_mask(int level)
-{
-        return -1UL << level_to_offset_bits(level);
-}
-
-static inline unsigned long level_size(int level)
-{
-        return 1UL << level_to_offset_bits(level);
-}
-
-static inline unsigned long align_to_level(unsigned long pfn, int level)
-{
-        return (pfn + level_size(level) - 1) & level_mask(level);
-}
-
 static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
                                       unsigned long pfn)
 {
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 54aa1c238cb3..a5c176598d95 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -163,7 +163,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&s->dev, "Configuration isnt't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isnt't locked\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EACCES;
         }
@@ -220,7 +220,7 @@ int pcmcia_map_mem_page(struct pcmcia_device *p_dev, window_handle_t wh,
         s->win[w].card_start = offset;
         ret = s->ops->set_mem_map(s, &s->win[w]);
         if (ret)
-                dev_warn(&s->dev, "failed to set_mem_map\n");
+                dev_warn(&p_dev->dev, "failed to set_mem_map\n");
         mutex_unlock(&s->ops_mutex);
         return ret;
 } /* pcmcia_map_mem_page */
@@ -244,18 +244,18 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "No card present\n");
+                dev_dbg(&p_dev->dev, "No card present\n");
                 ret = -ENODEV;
                 goto unlock;
         }
         if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&s->dev, "Configuration isnt't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isnt't locked\n");
                 ret = -EACCES;
                 goto unlock;
         }
 
         if (mod->Attributes & (CONF_IRQ_CHANGE_VALID | CONF_VCC_CHANGE_VALID)) {
-                dev_dbg(&s->dev,
+                dev_dbg(&p_dev->dev,
                         "changing Vcc or IRQ is not allowed at this time\n");
                 ret = -EINVAL;
                 goto unlock;
@@ -265,20 +265,22 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) &&
             (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
                 if (mod->Vpp1 != mod->Vpp2) {
-                        dev_dbg(&s->dev, "Vpp1 and Vpp2 must be the same\n");
+                        dev_dbg(&p_dev->dev,
+                                "Vpp1 and Vpp2 must be the same\n");
                         ret = -EINVAL;
                         goto unlock;
                 }
                 s->socket.Vpp = mod->Vpp1;
                 if (s->ops->set_socket(s, &s->socket)) {
-                        dev_printk(KERN_WARNING, &s->dev,
+                        dev_printk(KERN_WARNING, &p_dev->dev,
                                    "Unable to set VPP\n");
                         ret = -EIO;
                         goto unlock;
                 }
         } else if ((mod->Attributes & CONF_VPP1_CHANGE_VALID) ||
                    (mod->Attributes & CONF_VPP2_CHANGE_VALID)) {
-                dev_dbg(&s->dev, "changing Vcc is not allowed at this time\n");
+                dev_dbg(&p_dev->dev,
+                        "changing Vcc is not allowed at this time\n");
                 ret = -EINVAL;
                 goto unlock;
         }
@@ -401,7 +403,7 @@ int pcmcia_release_window(struct pcmcia_device *p_dev, struct resource *res)
         win = &s->win[w];
 
         if (!(p_dev->_win & CLIENT_WIN_REQ(w))) {
-                dev_dbg(&s->dev, "not releasing unknown window\n");
+                dev_dbg(&p_dev->dev, "not releasing unknown window\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EINVAL;
         }
@@ -439,7 +441,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
                 return -ENODEV;
 
         if (req->IntType & INT_CARDBUS) {
-                dev_dbg(&s->dev, "IntType may not be INT_CARDBUS\n");
+                dev_dbg(&p_dev->dev, "IntType may not be INT_CARDBUS\n");
                 return -EINVAL;
         }
 
@@ -447,7 +449,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         c = p_dev->function_config;
         if (c->state & CONFIG_LOCKED) {
                 mutex_unlock(&s->ops_mutex);
-                dev_dbg(&s->dev, "Configuration is locked\n");
+                dev_dbg(&p_dev->dev, "Configuration is locked\n");
                 return -EACCES;
         }
 
@@ -455,7 +457,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         s->socket.Vpp = req->Vpp;
         if (s->ops->set_socket(s, &s->socket)) {
                 mutex_unlock(&s->ops_mutex);
-                dev_printk(KERN_WARNING, &s->dev,
+                dev_printk(KERN_WARNING, &p_dev->dev,
                            "Unable to set socket state\n");
                 return -EINVAL;
         }
@@ -569,19 +571,20 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         int ret = -EINVAL;
 
         mutex_lock(&s->ops_mutex);
-        dev_dbg(&s->dev, "pcmcia_request_io: %pR , %pR", &c->io[0], &c->io[1]);
+        dev_dbg(&p_dev->dev, "pcmcia_request_io: %pR , %pR",
+                &c->io[0], &c->io[1]);
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "pcmcia_request_io: No card present\n");
+                dev_dbg(&p_dev->dev, "pcmcia_request_io: No card present\n");
                 goto out;
         }
 
         if (c->state & CONFIG_LOCKED) {
-                dev_dbg(&s->dev, "Configuration is locked\n");
+                dev_dbg(&p_dev->dev, "Configuration is locked\n");
                 goto out;
         }
         if (c->state & CONFIG_IO_REQ) {
-                dev_dbg(&s->dev, "IO already configured\n");
+                dev_dbg(&p_dev->dev, "IO already configured\n");
                 goto out;
         }
 
@@ -601,7 +604,7 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
         c->state |= CONFIG_IO_REQ;
         p_dev->_io = 1;
 
-        dev_dbg(&s->dev, "pcmcia_request_io succeeded: %pR , %pR",
+        dev_dbg(&p_dev->dev, "pcmcia_request_io succeeded: %pR , %pR",
                 &c->io[0], &c->io[1]);
 out:
         mutex_unlock(&s->ops_mutex);
@@ -800,7 +803,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         int w;
 
         if (!(s->state & SOCKET_PRESENT)) {
-                dev_dbg(&s->dev, "No card present\n");
+                dev_dbg(&p_dev->dev, "No card present\n");
                 return -ENODEV;
         }
 
@@ -809,12 +812,12 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 req->Size = s->map_size;
         align = (s->features & SS_CAP_MEM_ALIGN) ? req->Size : s->map_size;
         if (req->Size & (s->map_size-1)) {
-                dev_dbg(&s->dev, "invalid map size\n");
+                dev_dbg(&p_dev->dev, "invalid map size\n");
                 return -EINVAL;
         }
         if ((req->Base && (s->features & SS_CAP_STATIC_MAP)) ||
             (req->Base & (align-1))) {
-                dev_dbg(&s->dev, "invalid base address\n");
+                dev_dbg(&p_dev->dev, "invalid base address\n");
                 return -EINVAL;
         }
         if (req->Base)
@@ -826,7 +829,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 if (!(s->state & SOCKET_WIN_REQ(w)))
                         break;
         if (w == MAX_WIN) {
-                dev_dbg(&s->dev, "all windows are used already\n");
+                dev_dbg(&p_dev->dev, "all windows are used already\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EINVAL;
         }
@@ -837,7 +840,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
                 win->res = pcmcia_find_mem_region(req->Base, req->Size, align,
                                                 0, s);
                 if (!win->res) {
-                        dev_dbg(&s->dev, "allocating mem region failed\n");
+                        dev_dbg(&p_dev->dev, "allocating mem region failed\n");
                         mutex_unlock(&s->ops_mutex);
                         return -EINVAL;
                 }
@@ -851,7 +854,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         win->card_start = 0;
 
         if (s->ops->set_mem_map(s, win) != 0) {
-                dev_dbg(&s->dev, "failed to set memory mapping\n");
+                dev_dbg(&p_dev->dev, "failed to set memory mapping\n");
                 mutex_unlock(&s->ops_mutex);
                 return -EIO;
         }
@@ -874,7 +877,7 @@ int pcmcia_request_window(struct pcmcia_device *p_dev, win_req_t *req, window_ha
         if (win->res)
                 request_resource(&iomem_resource, res);
 
-        dev_dbg(&s->dev, "request_window results in %pR\n", res);
+        dev_dbg(&p_dev->dev, "request_window results in %pR\n", res);
 
         mutex_unlock(&s->ops_mutex);
         *wh = res;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index e35ed128bdef..2d61186ad5a2 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3093,7 +3093,8 @@ static const struct tpacpi_quirk tpacpi_hotkey_qtable[] __initconst = {
         TPACPI_Q_IBM('1', 'D', TPACPI_HK_Q_INIMASK), /* X22, X23, X24 */
 };
 
-typedef u16 tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
+typedef u16 tpacpi_keymap_entry_t;
+typedef tpacpi_keymap_entry_t tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
 
 static int __init hotkey_init(struct ibm_init_struct *iibm)
 {
@@ -3230,7 +3231,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
         };
 
 #define TPACPI_HOTKEY_MAP_SIZE          sizeof(tpacpi_keymap_t)
-#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_t[0])
+#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_entry_t)
 
         int res, i;
         int status;
diff --git a/drivers/power/apm_power.c b/drivers/power/apm_power.c
index 936bae560fa1..dc628cb2e762 100644
--- a/drivers/power/apm_power.c
+++ b/drivers/power/apm_power.c
@@ -233,6 +233,7 @@ static int calculate_capacity(enum apm_source source)
                 empty_design_prop = POWER_SUPPLY_PROP_ENERGY_EMPTY_DESIGN;
                 now_prop = POWER_SUPPLY_PROP_ENERGY_NOW;
                 avg_prop = POWER_SUPPLY_PROP_ENERGY_AVG;
+                break;
         case SOURCE_VOLTAGE:
                 full_prop = POWER_SUPPLY_PROP_VOLTAGE_MAX;
                 empty_prop = POWER_SUPPLY_PROP_VOLTAGE_MIN;
diff --git a/drivers/power/intel_mid_battery.c b/drivers/power/intel_mid_battery.c
index c61ffec2ff10..2a10cd361181 100644
--- a/drivers/power/intel_mid_battery.c
+++ b/drivers/power/intel_mid_battery.c
@@ -185,8 +185,8 @@ static int pmic_scu_ipc_battery_property_get(struct battery_property *prop)
 {
         u32 data[3];
         u8 *p = (u8 *)&data[1];
-        int err = intel_scu_ipc_command(IPC_CMD_BATTERY_PROPERTY,
-                                IPCMSG_BATTERY, NULL, 0, data, 3);
+        int err = intel_scu_ipc_command(IPCMSG_BATTERY,
+                                IPC_CMD_BATTERY_PROPERTY, NULL, 0, data, 3);
 
         prop->capacity = data[0];
         prop->crnt = *p++;
@@ -207,7 +207,7 @@ static int pmic_scu_ipc_battery_property_get(struct battery_property *prop)
 
 static int pmic_scu_ipc_set_charger(int charger)
 {
-        return intel_scu_ipc_simple_command(charger, IPCMSG_BATTERY);
+        return intel_scu_ipc_simple_command(IPCMSG_BATTERY, charger);
 }
 
 /**
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index 7d149a8d8d9b..2ce2eb71d0f5 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -215,7 +215,7 @@ static int pm8607_list_voltage(struct regulator_dev *rdev, unsigned index)
         struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
         int ret = -EINVAL;
 
-        if (info->vol_table && (index < (2 << info->vol_nbits))) {
+        if (info->vol_table && (index < (1 << info->vol_nbits))) {
                 ret = info->vol_table[index];
                 if (info->slope_double)
                         ret <<= 1;
@@ -233,7 +233,7 @@ static int choose_voltage(struct regulator_dev *rdev, int min_uV, int max_uV)
                 max_uV = max_uV >> 1;
         }
         if (info->vol_table) {
-                for (i = 0; i < (2 << info->vol_nbits); i++) {
+                for (i = 0; i < (1 << info->vol_nbits); i++) {
                         if (!info->vol_table[i])
                                 break;
                         if ((min_uV <= info->vol_table[i])
diff --git a/drivers/regulator/ab3100.c b/drivers/regulator/ab3100.c
index 11790990277a..b349266a43de 100644
--- a/drivers/regulator/ab3100.c
+++ b/drivers/regulator/ab3100.c
@@ -634,12 +634,9 @@ static int __devinit ab3100_regulators_probe(struct platform_device *pdev)
                                 "%s: failed to register regulator %s err %d\n",
                                 __func__, ab3100_regulator_desc[i].name,
                                 err);
-                        i--;
                         /* remove the already registered regulators */
-                        while (i > 0) {
+                        while (--i >= 0)
                                 regulator_unregister(ab3100_regulators[i].rdev);
-                                i--;
-                        }
                         return err;
                 }
 
diff --git a/drivers/regulator/ab8500.c b/drivers/regulator/ab8500.c
index dc3f1a491675..28c7ae67cec9 100644
--- a/drivers/regulator/ab8500.c
+++ b/drivers/regulator/ab8500.c
@@ -157,7 +157,7 @@ static int ab8500_list_voltage(struct regulator_dev *rdev, unsigned selector)
         if (info->fixed_uV)
                 return info->fixed_uV;
 
-        if (selector > info->voltages_len)
+        if (selector >= info->voltages_len)
                 return -EINVAL;
 
         return info->supported_voltages[selector];
@@ -344,13 +344,14 @@ static inline struct ab8500_regulator_info *find_regulator_info(int id)
 static __devinit int ab8500_regulator_probe(struct platform_device *pdev)
 {
         struct ab8500 *ab8500 = dev_get_drvdata(pdev->dev.parent);
-        struct ab8500_platform_data *pdata = dev_get_platdata(ab8500->dev);
+        struct ab8500_platform_data *pdata;
         int i, err;
 
         if (!ab8500) {
                 dev_err(&pdev->dev, "null mfd parent\n");
                 return -EINVAL;
         }
+        pdata = dev_get_platdata(ab8500->dev);
 
         /* register all regulators */
         for (i = 0; i < ARRAY_SIZE(ab8500_regulator_info); i++) {
@@ -368,11 +369,9 @@ static __devinit int ab8500_regulator_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "failed to register regulator %s\n",
                                         info->desc.name);
                         /* when we fail, un-register all earlier regulators */
-                        i--;
-                        while (i > 0) {
+                        while (--i >= 0) {
                                 info = &ab8500_regulator_info[i];
                                 regulator_unregister(info->regulator);
-                                i--;
                         }
                         return err;
                 }
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index d59d2f2314af..df1fb53c09d2 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -25,7 +25,7 @@ struct ad5398_chip_info {
         unsigned int current_level;
         unsigned int current_mask;
         unsigned int current_offset;
-        struct regulator_dev rdev;
+        struct regulator_dev *rdev;
 };
 
 static int ad5398_calc_current(struct ad5398_chip_info *chip,
@@ -211,7 +211,6 @@ MODULE_DEVICE_TABLE(i2c, ad5398_id);
 static int __devinit ad5398_probe(struct i2c_client *client,
                                 const struct i2c_device_id *id)
 {
-        struct regulator_dev *rdev;
         struct regulator_init_data *init_data = client->dev.platform_data;
         struct ad5398_chip_info *chip;
         const struct ad5398_current_data_format *df =
@@ -233,9 +232,10 @@ static int __devinit ad5398_probe(struct i2c_client *client,
         chip->current_offset = df->current_offset;
         chip->current_mask = (chip->current_level - 1) << chip->current_offset;
 
-        rdev = regulator_register(&ad5398_reg, &client->dev, init_data, chip);
-        if (IS_ERR(rdev)) {
-                ret = PTR_ERR(rdev);
+        chip->rdev = regulator_register(&ad5398_reg, &client->dev,
+                                        init_data, chip);
+        if (IS_ERR(chip->rdev)) {
+                ret = PTR_ERR(chip->rdev);
                 dev_err(&client->dev, "failed to register %s %s\n",
                         id->name, ad5398_reg.name);
                 goto err;
@@ -254,7 +254,7 @@ static int __devexit ad5398_remove(struct i2c_client *client)
 {
         struct ad5398_chip_info *chip = i2c_get_clientdata(client);
 
-        regulator_unregister(&chip->rdev);
+        regulator_unregister(chip->rdev);
         kfree(chip);
         i2c_set_clientdata(client, NULL);
 
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index e49d2bd393f2..d61ecb885a8c 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -165,7 +165,7 @@ static int __devinit isl6271a_probe(struct i2c_client *i2c,
         mutex_init(&pmic->mtx);
 
         for (i = 0; i < 3; i++) {
-                pmic->rdev[i] = regulator_register(&isl_rd[0], &i2c->dev,
+                pmic->rdev[i] = regulator_register(&isl_rd[i], &i2c->dev,
                                                 init_data, pmic);
                 if (IS_ERR(pmic->rdev[i])) {
                         dev_err(&i2c->dev, "failed to register %s\n", id->name);
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 8867c2710a6d..559cfa271a44 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -121,14 +121,14 @@ static int max1586_v6_set(struct regulator_dev *rdev, int min_uV, int max_uV)
         if (max_uV < MAX1586_V6_MIN_UV || max_uV > MAX1586_V6_MAX_UV)
                 return -EINVAL;
 
-        if (min_uV >= 3000000)
-                selector = 3;
-        if (min_uV < 3000000)
-                selector = 2;
-        if (min_uV < 2500000)
-                selector = 1;
         if (min_uV < 1800000)
                 selector = 0;
+        else if (min_uV < 2500000)
+                selector = 1;
+        else if (min_uV < 3000000)
+                selector = 2;
+        else if (min_uV >= 3000000)
+                selector = 3;
 
         if (max1586_v6_calc_voltage(selector) > max_uV)
                 return -EINVAL;
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index ab67298799f9..a1baf1fbe004 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -549,7 +549,7 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
         if (!max8998)
                 return -ENOMEM;
 
-        size = sizeof(struct regulator_dev *) * (pdata->num_regulators + 1);
+        size = sizeof(struct regulator_dev *) * pdata->num_regulators;
         max8998->rdev = kzalloc(size, GFP_KERNEL);
         if (!max8998->rdev) {
                 kfree(max8998);
@@ -557,7 +557,9 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
         }
 
         rdev = max8998->rdev;
+        max8998->dev = &pdev->dev;
         max8998->iodev = iodev;
+        max8998->num_regulators = pdata->num_regulators;
         platform_set_drvdata(pdev, max8998);
 
         for (i = 0; i < pdata->num_regulators; i++) {
@@ -583,7 +585,7 @@ static __devinit int max8998_pmic_probe(struct platform_device *pdev)
 
         return 0;
 err:
-        for (i = 0; i <= max8998->num_regulators; i++)
+        for (i = 0; i < max8998->num_regulators; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
 
@@ -599,7 +601,7 @@ static int __devexit max8998_pmic_remove(struct platform_device *pdev)
         struct regulator_dev **rdev = max8998->rdev;
         int i;
 
-        for (i = 0; i <= max8998->num_regulators; i++)
+        for (i = 0; i < max8998->num_regulators; i++)
                 if (rdev[i])
                         regulator_unregister(rdev[i]);
 
diff --git a/drivers/regulator/tps6507x-regulator.c b/drivers/regulator/tps6507x-regulator.c
index c239f42aa4a3..020f5878d7ff 100644
--- a/drivers/regulator/tps6507x-regulator.c
+++ b/drivers/regulator/tps6507x-regulator.c
@@ -626,12 +626,6 @@ fail:
         return error;
 }
 
-/**
- * tps6507x_remove - TPS6507x driver i2c remove handler
- * @client: i2c driver client device structure
- *
- * Unregister TPS driver as an i2c client device driver
- */
 static int __devexit tps6507x_pmic_remove(struct platform_device *pdev)
 {
         struct tps6507x_dev *tps6507x_dev = platform_get_drvdata(pdev);
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index 8cff1413a147..51237fbb1bbb 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -133,7 +133,7 @@ static int tps6586x_ldo_get_voltage(struct regulator_dev *rdev)
         mask = ((1 << ri->volt_nbits) - 1) << ri->volt_shift;
         val = (val & mask) >> ri->volt_shift;
 
-        if (val > ri->desc.n_voltages)
+        if (val >= ri->desc.n_voltages)
                 BUG();
 
         return ri->voltages[val] * 1000;
@@ -150,7 +150,7 @@ static int tps6586x_dvm_set_voltage(struct regulator_dev *rdev,
         if (ret)
                 return ret;
 
-        return tps6586x_set_bits(parent, ri->go_reg, ri->go_bit);
+        return tps6586x_set_bits(parent, ri->go_reg, 1 << ri->go_bit);
 }
 
 static int tps6586x_regulator_enable(struct regulator_dev *rdev)
diff --git a/drivers/regulator/wm831x-ldo.c b/drivers/regulator/wm831x-ldo.c
index e686cdb61b97..9edf8f692341 100644
--- a/drivers/regulator/wm831x-ldo.c
+++ b/drivers/regulator/wm831x-ldo.c
@@ -215,8 +215,7 @@ static int wm831x_gp_ldo_set_mode(struct regulator_dev *rdev,
 
         case REGULATOR_MODE_IDLE:
                 ret = wm831x_set_bits(wm831x, ctrl_reg,
-                                      WM831X_LDO1_LP_MODE,
-                                      WM831X_LDO1_LP_MODE);
+                                      WM831X_LDO1_LP_MODE, 0);
                 if (ret < 0)
                         return ret;
 
@@ -225,10 +224,12 @@ static int wm831x_gp_ldo_set_mode(struct regulator_dev *rdev,
                                       WM831X_LDO1_ON_MODE);
                 if (ret < 0)
                         return ret;
+                break;
 
         case REGULATOR_MODE_STANDBY:
                 ret = wm831x_set_bits(wm831x, ctrl_reg,
-                                      WM831X_LDO1_LP_MODE, 0);
+                                      WM831X_LDO1_LP_MODE,
+                                      WM831X_LDO1_LP_MODE);
                 if (ret < 0)
                         return ret;
 
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 0e6ed7db9364..fe4b8a8a9dfd 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1129,7 +1129,7 @@ static unsigned int wm8350_dcdc_get_mode(struct regulator_dev *rdev)
                         mode = REGULATOR_MODE_NORMAL;
         } else if (!active && !sleep)
                 mode = REGULATOR_MODE_IDLE;
-        else if (!sleep)
+        else if (sleep)
                 mode = REGULATOR_MODE_STANDBY;
 
         return mode;
diff --git a/drivers/rtc/rtc-ab3100.c b/drivers/rtc/rtc-ab3100.c
index d26780ea254b..261a07e0fb24 100644
--- a/drivers/rtc/rtc-ab3100.c
+++ b/drivers/rtc/rtc-ab3100.c
@@ -235,6 +235,7 @@ static int __init ab3100_rtc_probe(struct platform_device *pdev)
                 err = PTR_ERR(rtc);
                 return err;
         }
+        platform_set_drvdata(pdev, rtc);
 
         return 0;
 }
@@ -244,6 +245,7 @@ static int __exit ab3100_rtc_remove(struct platform_device *pdev)
         struct rtc_device *rtc = platform_get_drvdata(pdev);
 
         rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
         return 0;
 }
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a0d3ec89d412..f57a87f4ae96 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -310,11 +310,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
 
         s3c_rtc_setaie(alrm->enabled);
 
-        if (alrm->enabled)
-                enable_irq_wake(s3c_rtc_alarmno);
-        else
-                disable_irq_wake(s3c_rtc_alarmno);
-
         return 0;
 }
 
@@ -587,6 +582,10 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
                 ticnt_en_save &= S3C64XX_RTCCON_TICEN;
         }
         s3c_rtc_enable(pdev, 0);
+
+        if (device_may_wakeup(&pdev->dev))
+                enable_irq_wake(s3c_rtc_alarmno);
+
         return 0;
 }
 
@@ -600,6 +599,10 @@ static int s3c_rtc_resume(struct platform_device *pdev)
                 tmp = readb(s3c_rtc_base + S3C2410_RTCCON);
                 writeb(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
         }
+
+        if (device_may_wakeup(&pdev->dev))
+                disable_irq_wake(s3c_rtc_alarmno);
+
         return 0;
 }
 #else
diff --git a/drivers/serial/amba-pl010.c b/drivers/serial/amba-pl010.c
index 50441ffe8e38..2904aa044126 100644
--- a/drivers/serial/amba-pl010.c
+++ b/drivers/serial/amba-pl010.c
@@ -472,14 +472,9 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios,
         spin_unlock_irqrestore(&uap->port.lock, flags);
 }
 
-static void pl010_set_ldisc(struct uart_port *port)
+static void pl010_set_ldisc(struct uart_port *port, int new)
 {
-        int line = port->line;
-
-        if (line >= port->state->port.tty->driver->num)
-                return;
-
-        if (port->state->port.tty->ldisc->ops->num == N_PPS) {
+        if (new == N_PPS) {
                 port->flags |= UPF_HARDPPS_CD;
                 pl010_enable_ms(port);
         } else
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index bc9af503907f..324c385a653d 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -1423,7 +1423,6 @@ static void hsu_global_init(void)
         }
 
         phsu = hsu;
-
         hsu_debugfs_init(hsu);
         return;
 
@@ -1435,18 +1434,20 @@ err_free_region:
 
 static void serial_hsu_remove(struct pci_dev *pdev)
 {
-        struct hsu_port *hsu;
-        int i;
+        void *priv = pci_get_drvdata(pdev);
+        struct uart_hsu_port *up;
 
-        hsu = pci_get_drvdata(pdev);
-        if (!hsu)
+        if (!priv)
                 return;
 
-        for (i = 0; i < 3; i++)
-                uart_remove_one_port(&serial_hsu_reg, &hsu->port[i].port);
+        /* For port 0/1/2, priv is the address of uart_hsu_port */
+        if (pdev->device != 0x081E) {
+                up = priv;
+                uart_remove_one_port(&serial_hsu_reg, &up->port);
+        }
 
         pci_set_drvdata(pdev, NULL);
-        free_irq(hsu->irq, hsu);
+        free_irq(pdev->irq, priv);
         pci_disable_device(pdev);
 }
 
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 8dedb266f143..c4399e23565a 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -500,6 +500,7 @@ static int __init mpc512x_psc_fifoc_init(void)
         psc_fifoc = of_iomap(np, 0);
         if (!psc_fifoc) {
                 pr_err("%s: Can't map FIFOC\n", __func__);
+                of_node_put(np);
                 return -ENODEV;
         }
 
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 141c69554bd4..7d475b2a79e8 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -335,8 +335,6 @@ static int serial_probe(struct pcmcia_device *link)
         info->p_dev = link;
         link->priv = info;
 
-        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
-        link->resource[0]->end = 8;
         link->conf.Attributes = CONF_ENABLE_IRQ;
         if (do_sound) {
                 link->conf.Attributes |= CONF_ENABLE_SPKR;
@@ -411,6 +409,27 @@ static int setup_serial(struct pcmcia_device *handle, struct serial_info * info,
 
 /*====================================================================*/
 
+static int pfc_config(struct pcmcia_device *p_dev)
+{
+        unsigned int port = 0;
+        struct serial_info *info = p_dev->priv;
+
+        if ((p_dev->resource[1]->end != 0) &&
+                (resource_size(p_dev->resource[1]) == 8)) {
+                port = p_dev->resource[1]->start;
+                info->slave = 1;
+        } else if ((info->manfid == MANFID_OSITECH) &&
+                (resource_size(p_dev->resource[0]) == 0x40)) {
+                port = p_dev->resource[0]->start + 0x28;
+                info->slave = 1;
+        }
+        if (info->slave)
+                return setup_serial(p_dev, info, port, p_dev->irq);
+
+        dev_warn(&p_dev->dev, "no usable port range found, giving up\n");
+        return -ENODEV;
+}
+
 static int simple_config_check(struct pcmcia_device *p_dev,
                                cistpl_cftable_entry_t *cf,
                                cistpl_cftable_entry_t *dflt,
@@ -461,23 +480,8 @@ static int simple_config(struct pcmcia_device *link)
         struct serial_info *info = link->priv;
         int i = -ENODEV, try;
 
-        /* If the card is already configured, look up the port and irq */
-        if (link->function_config) {
-                unsigned int port = 0;
-                if ((link->resource[1]->end != 0) &&
-                        (resource_size(link->resource[1]) == 8)) {
-                        port = link->resource[1]->end;
-                        info->slave = 1;
-                } else if ((info->manfid == MANFID_OSITECH) &&
-                        (resource_size(link->resource[0]) == 0x40)) {
-                        port = link->resource[0]->start + 0x28;
-                        info->slave = 1;
-                }
-                if (info->slave) {
-                        return setup_serial(link, info, port,
-                                            link->irq);
-                }
-        }
+        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
+        link->resource[0]->end = 8;
 
         /* First pass: look for a config entry that looks normal.
          * Two tries: without IO aliases, then with aliases */
@@ -491,8 +495,7 @@ static int simple_config(struct pcmcia_device *link)
         if (!pcmcia_loop_config(link, simple_config_check_notpicky, NULL))
                 goto found_port;
 
-        printk(KERN_NOTICE
-               "serial_cs: no usable port range found, giving up\n");
+        dev_warn(&link->dev, "no usable port range found, giving up\n");
         return -1;
 
 found_port:
@@ -558,6 +561,7 @@ static int multi_config(struct pcmcia_device *link)
         int i, base2 = 0;
 
         /* First, look for a generic full-sized window */
+        link->resource[0]->flags |= IO_DATA_PATH_WIDTH_8;
         link->resource[0]->end = info->multi * 8;
         if (pcmcia_loop_config(link, multi_config_check, &base2)) {
                 /* If that didn't work, look for two windows */
@@ -565,15 +569,14 @@ static int multi_config(struct pcmcia_device *link)
                 info->multi = 2;
                 if (pcmcia_loop_config(link, multi_config_check_notpicky,
                                        &base2)) {
-                        printk(KERN_NOTICE "serial_cs: no usable port range"
+                        dev_warn(&link->dev, "no usable port range "
                                "found, giving up\n");
                         return -ENODEV;
                 }
         }
 
         if (!link->irq)
-                dev_warn(&link->dev,
-                        "serial_cs: no usable IRQ found, continuing...\n");
+                dev_warn(&link->dev, "no usable IRQ found, continuing...\n");
 
         /*
          * Apply any configuration quirks.
@@ -675,6 +678,7 @@ static int serial_config(struct pcmcia_device * link)
            multifunction cards that ask for appropriate IO port ranges */
         if ((info->multi == 0) &&
             (link->has_func_id) &&
+            (link->socket->pcmcia_pfc == 0) &&
             ((link->func_id == CISTPL_FUNCID_MULTI) ||
              (link->func_id == CISTPL_FUNCID_SERIAL)))
                 pcmcia_loop_config(link, serial_check_for_multi, info);
@@ -685,7 +689,13 @@ static int serial_config(struct pcmcia_device * link)
         if (info->quirk && info->quirk->multi != -1)
                 info->multi = info->quirk->multi;
 
-        if (info->multi > 1)
+        dev_info(&link->dev,
+                "trying to set up [0x%04x:0x%04x] (pfc: %d, multi: %d, quirk: %p)\n",
+                link->manf_id, link->card_id,
+                link->socket->pcmcia_pfc, info->multi, info->quirk);
+        if (link->socket->pcmcia_pfc)
+                i = pfc_config(link);
+        else if (info->multi > 1)
                 i = multi_config(link);
         else
                 i = simple_config(link);
@@ -704,7 +714,7 @@ static int serial_config(struct pcmcia_device * link)
         return 0;
 
 failed:
-        dev_warn(&link->dev, "serial_cs: failed to initialize\n");
+        dev_warn(&link->dev, "failed to initialize\n");
         serial_remove(link);
         return -ENODEV;
 }
diff --git a/drivers/spi/amba-pl022.c b/drivers/spi/amba-pl022.c
index acd35d1ebd12..4c37c4e28647 100644
--- a/drivers/spi/amba-pl022.c
+++ b/drivers/spi/amba-pl022.c
@@ -503,8 +503,9 @@ static void giveback(struct pl022 *pl022)
         msg->state = NULL;
         if (msg->complete)
                 msg->complete(msg->context);
-        /* This message is completed, so let's turn off the clock! */
+        /* This message is completed, so let's turn off the clocks! */
         clk_disable(pl022->clk);
+        amba_pclk_disable(pl022->adev);
 }
 
 /**
@@ -1139,9 +1140,10 @@ static void pump_messages(struct work_struct *work)
         /* Setup the SPI using the per chip configuration */
         pl022->cur_chip = spi_get_ctldata(pl022->cur_msg->spi);
         /*
-         * We enable the clock here, then the clock will be disabled when
+         * We enable the clocks here, then the clocks will be disabled when
          * giveback() is called in each method (poll/interrupt/DMA)
          */
+        amba_pclk_enable(pl022->adev);
         clk_enable(pl022->clk);
         restore_state(pl022);
         flush(pl022);
@@ -1786,11 +1788,9 @@ pl022_probe(struct amba_device *adev, struct amba_id *id)
         }
 
         /* Disable SSP */
-        clk_enable(pl022->clk);
         writew((readw(SSP_CR1(pl022->virtbase)) & (~SSP_CR1_MASK_SSE)),
                SSP_CR1(pl022->virtbase));
         load_ssp_default_config(pl022);
-        clk_disable(pl022->clk);
 
         status = request_irq(adev->irq[0], pl022_interrupt_handler, 0, "pl022",
                              pl022);
@@ -1818,6 +1818,8 @@ pl022_probe(struct amba_device *adev, struct amba_id *id)
                 goto err_spi_register;
         }
         dev_dbg(dev, "probe succeded\n");
+        /* Disable the silicon block pclk and clock it when needed */
+        amba_pclk_disable(adev);
         return 0;
 
  err_spi_register:
@@ -1879,9 +1881,9 @@ static int pl022_suspend(struct amba_device *adev, pm_message_t state)
                 return status;
         }
 
-        clk_enable(pl022->clk);
+        amba_pclk_enable(adev);
         load_ssp_default_config(pl022);
-        clk_disable(pl022->clk);
+        amba_pclk_disable(adev);
         dev_dbg(&adev->dev, "suspended\n");
         return 0;
 }
@@ -1981,7 +1983,7 @@ static int __init pl022_init(void)
         return amba_driver_register(&pl022_driver);
 }
 
-module_init(pl022_init);
+subsys_initcall(pl022_init);
 
 static void __exit pl022_exit(void)
 {
diff --git a/drivers/spi/dw_spi.c b/drivers/spi/dw_spi.c
index d256cb00604c..56247853c298 100644
--- a/drivers/spi/dw_spi.c
+++ b/drivers/spi/dw_spi.c
@@ -181,10 +181,6 @@ static void flush(struct dw_spi *dws)
         wait_till_not_busy(dws);
 }
 
-static void null_cs_control(u32 command)
-{
-}
-
 static int null_writer(struct dw_spi *dws)
 {
         u8 n_bytes = dws->n_bytes;
@@ -322,7 +318,7 @@ static void giveback(struct dw_spi *dws)
                                         struct spi_transfer,
                                         transfer_list);
 
-        if (!last_transfer->cs_change)
+        if (!last_transfer->cs_change && dws->cs_control)
                 dws->cs_control(MRST_SPI_DEASSERT);
 
         msg->state = NULL;
@@ -396,6 +392,11 @@ static irqreturn_t interrupt_transfer(struct dw_spi *dws)
 static irqreturn_t dw_spi_irq(int irq, void *dev_id)
 {
         struct dw_spi *dws = dev_id;
+        u16 irq_status, irq_mask = 0x3f;
+
+        irq_status = dw_readw(dws, isr) & irq_mask;
+        if (!irq_status)
+                return IRQ_NONE;
 
         if (!dws->cur_msg) {
                 spi_mask_intr(dws, SPI_INT_TXEI);
@@ -544,13 +545,13 @@ static void pump_transfers(unsigned long data)
          */
         if (dws->cs_control) {
                 if (dws->rx && dws->tx)
-                        chip->tmode = 0x00;
+                        chip->tmode = SPI_TMOD_TR;
                 else if (dws->rx)
-                        chip->tmode = 0x02;
+                        chip->tmode = SPI_TMOD_RO;
                 else
-                        chip->tmode = 0x01;
+                        chip->tmode = SPI_TMOD_TO;
 
-                cr0 &= ~(0x3 << SPI_MODE_OFFSET);
+                cr0 &= ~SPI_TMOD_MASK;
                 cr0 |= (chip->tmode << SPI_TMOD_OFFSET);
         }
 
@@ -699,9 +700,6 @@ static int dw_spi_setup(struct spi_device *spi)
                 chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
                 if (!chip)
                         return -ENOMEM;
-
-                chip->cs_control = null_cs_control;
-                chip->enable_dma = 0;
         }
 
         /*
@@ -883,7 +881,7 @@ int __devinit dw_spi_add_host(struct dw_spi *dws)
         dws->dma_inited = 0;
         dws->dma_addr = (dma_addr_t)(dws->paddr + 0x60);
 
-        ret = request_irq(dws->irq, dw_spi_irq, 0,
+        ret = request_irq(dws->irq, dw_spi_irq, IRQF_SHARED,
                         "dw_spi", dws);
         if (ret < 0) {
                 dev_err(&master->dev, "can not get IRQ\n");
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index a9e5c79ae52a..0bcf4c1601a2 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -554,11 +554,9 @@ done:
 EXPORT_SYMBOL_GPL(spi_register_master);
 
 
-static int __unregister(struct device *dev, void *master_dev)
+static int __unregister(struct device *dev, void *null)
 {
-        /* note: before about 2.6.14-rc1 this would corrupt memory: */
-        if (dev != master_dev)
-                spi_unregister_device(to_spi_device(dev));
+        spi_unregister_device(to_spi_device(dev));
         return 0;
 }
 
@@ -576,8 +574,7 @@ void spi_unregister_master(struct spi_master *master)
 {
         int dummy;
 
-        dummy = device_for_each_child(master->dev.parent, &master->dev,
-                                        __unregister);
+        dummy = device_for_each_child(&master->dev, NULL, __unregister);
         device_unregister(&master->dev);
 }
 EXPORT_SYMBOL_GPL(spi_unregister_master);
diff --git a/drivers/spi/spi_s3c64xx.c b/drivers/spi/spi_s3c64xx.c
index 97365815a729..c3038da2648a 100644
--- a/drivers/spi/spi_s3c64xx.c
+++ b/drivers/spi/spi_s3c64xx.c
@@ -200,6 +200,9 @@ static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
                 val = readl(regs + S3C64XX_SPI_STATUS);
         } while (TX_FIFO_LVL(val, sci) && loops--);
 
+        if (loops == 0)
+                dev_warn(&sdd->pdev->dev, "Timed out flushing TX FIFO\n");
+
         /* Flush RxFIFO*/
         loops = msecs_to_loops(1);
         do {
@@ -210,6 +213,9 @@ static void flush_fifo(struct s3c64xx_spi_driver_data *sdd)
                         break;
         } while (loops--);
 
+        if (loops == 0)
+                dev_warn(&sdd->pdev->dev, "Timed out flushing RX FIFO\n");
+
         val = readl(regs + S3C64XX_SPI_CH_CFG);
         val &= ~S3C64XX_SPI_CH_SW_RST;
         writel(val, regs + S3C64XX_SPI_CH_CFG);
@@ -320,16 +326,17 @@ static int wait_for_xfer(struct s3c64xx_spi_driver_data *sdd,
 
         /* millisecs to xfer 'len' bytes @ 'cur_speed' */
         ms = xfer->len * 8 * 1000 / sdd->cur_speed;
-        ms += 5; /* some tolerance */
+        ms += 10; /* some tolerance */
 
         if (dma_mode) {
                 val = msecs_to_jiffies(ms) + 10;
                 val = wait_for_completion_timeout(&sdd->xfer_completion, val);
         } else {
+                u32 status;
                 val = msecs_to_loops(ms);
                 do {
-                        val = readl(regs + S3C64XX_SPI_STATUS);
-                } while (RX_FIFO_LVL(val, sci) < xfer->len && --val);
+                        status = readl(regs + S3C64XX_SPI_STATUS);
+                } while (RX_FIFO_LVL(status, sci) < xfer->len && --val);
         }
 
         if (!val)
@@ -447,8 +454,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)
         writel(val, regs + S3C64XX_SPI_CLK_CFG);
 }
 
-void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
-                                int size, enum s3c2410_dma_buffresult res)
+static void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
+                                 int size, enum s3c2410_dma_buffresult res)
 {
         struct s3c64xx_spi_driver_data *sdd = buf_id;
         unsigned long flags;
@@ -467,8 +474,8 @@ void s3c64xx_spi_dma_rxcb(struct s3c2410_dma_chan *chan, void *buf_id,
         spin_unlock_irqrestore(&sdd->lock, flags);
 }
 
-void s3c64xx_spi_dma_txcb(struct s3c2410_dma_chan *chan, void *buf_id,
-                                int size, enum s3c2410_dma_buffresult res)
+static void s3c64xx_spi_dma_txcb(struct s3c2410_dma_chan *chan, void *buf_id,
+                                 int size, enum s3c2410_dma_buffresult res)
 {
         struct s3c64xx_spi_driver_data *sdd = buf_id;
         unsigned long flags;
@@ -508,8 +515,9 @@ static int s3c64xx_spi_map_mssg(struct s3c64xx_spi_driver_data *sdd,
         list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 
                 if (xfer->tx_buf != NULL) {
-                        xfer->tx_dma = dma_map_single(dev, xfer->tx_buf,
-                                                xfer->len, DMA_TO_DEVICE);
+                        xfer->tx_dma = dma_map_single(dev,
+                                        (void *)xfer->tx_buf, xfer->len,
+                                        DMA_TO_DEVICE);
                         if (dma_mapping_error(dev, xfer->tx_dma)) {
                                 dev_err(dev, "dma_map_single Tx failed\n");
                                 xfer->tx_dma = XFER_DMAADDR_INVALID;
@@ -919,6 +927,13 @@ static int __init s3c64xx_spi_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        sci = pdev->dev.platform_data;
+        if (!sci->src_clk_name) {
+                dev_err(&pdev->dev,
+                        "Board init must call s3c64xx_spi_set_info()\n");
+                return -EINVAL;
+        }
+
         /* Check for availability of necessary resource */
 
         dmatx_res = platform_get_resource(pdev, IORESOURCE_DMA, 0);
@@ -946,8 +961,6 @@ static int __init s3c64xx_spi_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
-        sci = pdev->dev.platform_data;
-
         platform_set_drvdata(pdev, master);
 
         sdd = spi_master_get_devdata(master);
@@ -1170,7 +1183,7 @@ static int __init s3c64xx_spi_init(void)
 {
         return platform_driver_probe(&s3c64xx_spi_driver, s3c64xx_spi_probe);
 }
-module_init(s3c64xx_spi_init);
+subsys_initcall(s3c64xx_spi_init);
 
 static void __exit s3c64xx_spi_exit(void)
 {
diff --git a/drivers/staging/batman-adv/hard-interface.c b/drivers/staging/batman-adv/hard-interface.c
index baa8b05b9e8d..6e973a79aa25 100644
--- a/drivers/staging/batman-adv/hard-interface.c
+++ b/drivers/staging/batman-adv/hard-interface.c
@@ -30,7 +30,6 @@
 #include "hash.h"
 
 #include <linux/if_arp.h>
-#include <linux/netfilter_bridge.h>
 
 #define MIN(x, y) ((x) < (y) ? (x) : (y))
 
@@ -431,11 +430,6 @@ out:
         return NOTIFY_DONE;
 }
 
-static int batman_skb_recv_finish(struct sk_buff *skb)
-{
-        return NF_ACCEPT;
-}
-
 /* receive a packet with the batman ethertype coming on a hard
  * interface */
 int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
@@ -456,13 +450,6 @@ int batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
         if (atomic_read(&module_state) != MODULE_ACTIVE)
                 goto err_free;
 
-        /* if netfilter/ebtables wants to block incoming batman
-         * packets then give them a chance to do so here */
-        ret = NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, dev, NULL,
-                      batman_skb_recv_finish);
-        if (ret != 1)
-                goto err_out;
-
         /* packet should hold at least type and version */
         if (unlikely(skb_headlen(skb) < 2))
                 goto err_free;
diff --git a/drivers/staging/batman-adv/send.c b/drivers/staging/batman-adv/send.c
index 055edee7b4e4..da3c82e47bbd 100644
--- a/drivers/staging/batman-adv/send.c
+++ b/drivers/staging/batman-adv/send.c
@@ -29,7 +29,6 @@
 #include "vis.h"
 #include "aggregation.h"
 
-#include <linux/netfilter_bridge.h>
 
 static void send_outstanding_bcast_packet(struct work_struct *work);
 
@@ -92,12 +91,9 @@ int send_skb_packet(struct sk_buff *skb,
 
         /* dev_queue_xmit() returns a negative result on error.  However on
          * congestion and traffic shaping, it drops and returns NET_XMIT_DROP
-         * (which is > 0). This will not be treated as an error.
-         * Also, if netfilter/ebtables wants to block outgoing batman
-         * packets then giving them a chance to do so here */
+         * (which is > 0). This will not be treated as an error. */
 
-        return NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
-                       dev_queue_xmit);
+        return dev_queue_xmit(skb);
 send_skb_err:
         kfree_skb(skb);
         return NET_XMIT_DROP;
diff --git a/drivers/staging/ti-st/st.h b/drivers/staging/ti-st/st.h
index 9952579425b9..1b3060eb2921 100644
--- a/drivers/staging/ti-st/st.h
+++ b/drivers/staging/ti-st/st.h
@@ -80,5 +80,4 @@ struct st_proto_s {
 extern long st_register(struct st_proto_s *);
 extern long st_unregister(enum proto_type);
 
-extern struct platform_device *st_get_plat_device(void);
 #endif /* ST_H */
diff --git a/drivers/staging/ti-st/st_core.c b/drivers/staging/ti-st/st_core.c
index 063c9b1db1ab..b85d8bfdf600 100644
--- a/drivers/staging/ti-st/st_core.c
+++ b/drivers/staging/ti-st/st_core.c
@@ -38,7 +38,6 @@
 #include "st_ll.h"
 #include "st.h"
 
-#define VERBOSE
 /* strings to be used for rfkill entries and by
  * ST Core to be used for sysfs debug entry
  */
@@ -581,7 +580,7 @@ long st_register(struct st_proto_s *new_proto)
         long err = 0;
         unsigned long flags = 0;
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         pr_info("%s(%d) ", __func__, new_proto->type);
         if (st_gdata == NULL || new_proto == NULL || new_proto->recv == NULL
             || new_proto->reg_complete_cb == NULL) {
@@ -713,7 +712,7 @@ long st_unregister(enum proto_type type)
 
         pr_debug("%s: %d ", __func__, type);
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         if (type < ST_BT || type >= ST_MAX) {
                 pr_err(" protocol %d not supported", type);
                 return -EPROTONOSUPPORT;
@@ -767,7 +766,7 @@ long st_write(struct sk_buff *skb)
 #endif
         long len;
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         if (unlikely(skb == NULL || st_gdata == NULL
                 || st_gdata->tty == NULL)) {
                 pr_err("data/tty unavailable to perform write");
@@ -818,7 +817,7 @@ static int st_tty_open(struct tty_struct *tty)
         struct st_data_s *st_gdata;
         pr_info("%s ", __func__);
 
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
         st_gdata->tty = tty;
         tty->disc_data = st_gdata;
 
diff --git a/drivers/staging/ti-st/st_core.h b/drivers/staging/ti-st/st_core.h
index e0c32d149f5f..8601320a679e 100644
--- a/drivers/staging/ti-st/st_core.h
+++ b/drivers/staging/ti-st/st_core.h
@@ -117,7 +117,7 @@ int st_core_init(struct st_data_s **);
 void st_core_exit(struct st_data_s *);
 
 /* ask for reference from KIM */
-void st_kim_ref(struct st_data_s **);
+void st_kim_ref(struct st_data_s **, int);
 
 #define GPS_STUB_TEST
 #ifdef GPS_STUB_TEST
diff --git a/drivers/staging/ti-st/st_kim.c b/drivers/staging/ti-st/st_kim.c
index b4a6c7fdc4e6..9e99463f76e8 100644
--- a/drivers/staging/ti-st/st_kim.c
+++ b/drivers/staging/ti-st/st_kim.c
@@ -72,11 +72,26 @@ const unsigned char *protocol_names[] = {
         PROTO_ENTRY(ST_GPS, "GPS"),
 };
 
+#define MAX_ST_DEVICES  3       /* Imagine 1 on each UART for now */
+struct platform_device *st_kim_devices[MAX_ST_DEVICES];
 
 /**********************************************************************/
 /* internal functions */
 
 /**
+ * st_get_plat_device -
+ *      function which returns the reference to the platform device
+ *      requested by id. As of now only 1 such device exists (id=0)
+ *      the context requesting for reference can get the id to be
+ *      requested by a. The protocol driver which is registering or
+ *      b. the tty device which is opened.
+ */
+static struct platform_device *st_get_plat_device(int id)
+{
+        return st_kim_devices[id];
+}
+
+/**
  * validate_firmware_response -
  *      function to return whether the firmware response was proper
  *      in case of error don't complete so that waiting for proper
@@ -353,7 +368,7 @@ void st_kim_chip_toggle(enum proto_type type, enum kim_gpio_state state)
         struct kim_data_s       *kim_gdata;
         pr_info(" %s ", __func__);
 
-        kim_pdev = st_get_plat_device();
+        kim_pdev = st_get_plat_device(0);
         kim_gdata = dev_get_drvdata(&kim_pdev->dev);
 
         if (kim_gdata->gpios[type] == -1) {
@@ -574,12 +589,12 @@ static int kim_toggle_radio(void *data, bool blocked)
  *      This would enable multiple such platform devices to exist
  *      on a given platform
  */
-void st_kim_ref(struct st_data_s **core_data)
+void st_kim_ref(struct st_data_s **core_data, int id)
 {
         struct platform_device  *pdev;
         struct kim_data_s       *kim_gdata;
         /* get kim_gdata reference from platform device */
-        pdev = st_get_plat_device();
+        pdev = st_get_plat_device(id);
         kim_gdata = dev_get_drvdata(&pdev->dev);
         *core_data = kim_gdata->core_data;
 }
@@ -623,6 +638,7 @@ static int kim_probe(struct platform_device *pdev)
         long *gpios = pdev->dev.platform_data;
         struct kim_data_s       *kim_gdata;
 
+        st_kim_devices[pdev->id] = pdev;
         kim_gdata = kzalloc(sizeof(struct kim_data_s), GFP_ATOMIC);
         if (!kim_gdata) {
                 pr_err("no mem to allocate");
diff --git a/drivers/staging/vt6655/wpactl.c b/drivers/staging/vt6655/wpactl.c
index 0142338bcafe..4bdb8362de82 100644
--- a/drivers/staging/vt6655/wpactl.c
+++ b/drivers/staging/vt6655/wpactl.c
@@ -766,9 +766,14 @@ static int wpa_set_associate(PSDevice pDevice,
     DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "wpa_ie_len = %d\n", param->u.wpa_associate.wpa_ie_len);
 
 
-        if (param->u.wpa_associate.wpa_ie &&
-            copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
-            return -EINVAL;
+        if (param->u.wpa_associate.wpa_ie_len) {
+                if (!param->u.wpa_associate.wpa_ie)
+                        return -EINVAL;
+                if (param->u.wpa_associate.wpa_ie_len > sizeof(abyWPAIE))
+                        return -EINVAL;
+                if (copy_from_user(&abyWPAIE[0], param->u.wpa_associate.wpa_ie, param->u.wpa_associate.wpa_ie_len))
+                        return -EFAULT;
+        }
 
         if (param->u.wpa_associate.mode == 1)
             pMgmt->eConfigMode = WMAC_CONFIG_IBSS_STA;
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 7e594449600e..9eed5b52d9de 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -91,12 +91,12 @@ config USB_DYNAMIC_MINORS
           If you are unsure about this, say N here.
 
 config USB_SUSPEND
-        bool "USB runtime power management (suspend/resume and wakeup)"
+        bool "USB runtime power management (autosuspend) and wakeup"
         depends on USB && PM_RUNTIME
         help
           If you say Y here, you can use driver calls or the sysfs
-          "power/level" file to suspend or resume individual USB
-          peripherals and to enable or disable autosuspend (see
+          "power/control" file to enable or disable autosuspend for
+          individual USB peripherals (see
           Documentation/usb/power-management.txt for more details).
 
           Also, USB "remote wakeup" signaling is supported, whereby some
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index f06f5dbc8cdc..1e6ccef2cf0c 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -159,9 +159,9 @@ void usb_major_cleanup(void)
 int usb_register_dev(struct usb_interface *intf,
                      struct usb_class_driver *class_driver)
 {
-        int retval = -EINVAL;
+        int retval;
         int minor_base = class_driver->minor_base;
-        int minor = 0;
+        int minor;
         char name[20];
         char *temp;
 
@@ -173,12 +173,17 @@ int usb_register_dev(struct usb_interface *intf,
          */
         minor_base = 0;
 #endif
-        intf->minor = -1;
-
-        dbg ("looking for a minor, starting at %d", minor_base);
 
         if (class_driver->fops == NULL)
-                goto exit;
+                return -EINVAL;
+        if (intf->minor >= 0)
+                return -EADDRINUSE;
+
+        retval = init_usb_class();
+        if (retval)
+                return retval;
+
+        dev_dbg(&intf->dev, "looking for a minor, starting at %d", minor_base);
 
         down_write(&minor_rwsem);
         for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) {
@@ -186,20 +191,12 @@ int usb_register_dev(struct usb_interface *intf,
                         continue;
 
                 usb_minors[minor] = class_driver->fops;
-
-                retval = 0;
+                intf->minor = minor;
                 break;
         }
         up_write(&minor_rwsem);
-
-        if (retval)
-                goto exit;
-
-        retval = init_usb_class();
-        if (retval)
-                goto exit;
-
-        intf->minor = minor;
+        if (intf->minor < 0)
+                return -EXFULL;
 
         /* create a usb class device for this usb interface */
         snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -213,11 +210,11 @@ int usb_register_dev(struct usb_interface *intf,
                                       "%s", temp);
         if (IS_ERR(intf->usb_dev)) {
                 down_write(&minor_rwsem);
-                usb_minors[intf->minor] = NULL;
+                usb_minors[minor] = NULL;
+                intf->minor = -1;
                 up_write(&minor_rwsem);
                 retval = PTR_ERR(intf->usb_dev);
         }
-exit:
         return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 844683e50383..9f0ce7de0e36 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1802,6 +1802,7 @@ free_interfaces:
                 intf->dev.groups = usb_interface_groups;
                 intf->dev.dma_mask = dev->dev.dma_mask;
                 INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
+                intf->minor = -1;
                 device_initialize(&intf->dev);
                 dev_set_name(&intf->dev, "%d-%s:%d.%d",
                         dev->bus->busnum, dev->devpath,
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 58b72d741d93..a1e8d273103f 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -119,6 +119,11 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         ehci->broken_periodic = 1;
                         ehci_info(ehci, "using broken periodic workaround\n");
                 }
+                if (pdev->device == 0x0806 || pdev->device == 0x0811
+                                || pdev->device == 0x0829) {
+                        ehci_info(ehci, "disable lpm for langwell/penwell\n");
+                        ehci->has_lpm = 0;
+                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 59dc3d351b60..5ab5bb89bae3 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -322,6 +322,7 @@ cppi_channel_allocate(struct dma_controller *c,
                                 index, transmit ? 'T' : 'R', cppi_ch);
         cppi_ch->hw_ep = ep;
         cppi_ch->channel.status = MUSB_DMA_STATUS_FREE;
+        cppi_ch->channel.max_len = 0x7fffffff;
 
         DBG(4, "Allocate CPPI%d %cX\n", index, transmit ? 'T' : 'R');
         return &cppi_ch->channel;
diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c
index c79a5e30d437..9e8639d4e862 100644
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -195,15 +195,14 @@ static const struct file_operations musb_regdump_fops = {
 
 static int musb_test_mode_open(struct inode *inode, struct file *file)
 {
-        file->private_data = inode->i_private;
-
         return single_open(file, musb_test_mode_show, inode->i_private);
 }
 
 static ssize_t musb_test_mode_write(struct file *file,
                 const char __user *ubuf, size_t count, loff_t *ppos)
 {
-        struct musb             *musb = file->private_data;
+        struct seq_file         *s = file->private_data;
+        struct musb             *musb = s->private;
         u8                      test = 0;
         char                    buf[18];
 
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6fca870e957e..d065e23f123e 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -300,6 +300,11 @@ static void txstate(struct musb *musb, struct musb_request *req)
 #ifndef CONFIG_MUSB_PIO_ONLY
         if (is_dma_capable() && musb_ep->dma) {
                 struct dma_controller   *c = musb->dma_controller;
+                size_t request_size;
+
+                /* setup DMA, then program endpoint CSR */
+                request_size = min_t(size_t, request->length - request->actual,
+                                        musb_ep->dma->max_len);
 
                 use_dma = (request->dma != DMA_ADDR_INVALID);
 
@@ -307,11 +312,6 @@ static void txstate(struct musb *musb, struct musb_request *req)
 
 #ifdef CONFIG_USB_INVENTRA_DMA
                 {
-                        size_t request_size;
-
-                        /* setup DMA, then program endpoint CSR */
-                        request_size = min_t(size_t, request->length,
-                                                musb_ep->dma->max_len);
                         if (request_size < musb_ep->packet_sz)
                                 musb_ep->dma->desired_mode = 0;
                         else
@@ -373,8 +373,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                 use_dma = use_dma && c->channel_program(
                                 musb_ep->dma, musb_ep->packet_sz,
                                 0,
-                                request->dma,
-                                request->length);
+                                request->dma + request->actual,
+                                request_size);
                 if (!use_dma) {
                         c->channel_release(musb_ep->dma);
                         musb_ep->dma = NULL;
@@ -386,8 +386,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                 use_dma = use_dma && c->channel_program(
                                 musb_ep->dma, musb_ep->packet_sz,
                                 request->zero,
-                                request->dma,
-                                request->length);
+                                request->dma + request->actual,
+                                request_size);
 #endif
         }
 #endif
@@ -501,26 +501,14 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                                 request->zero = 0;
                         }
 
-                        /* ... or if not, then complete it. */
-                        musb_g_giveback(musb_ep, request, 0);
-
-                        /*
-                         * Kickstart next transfer if appropriate;
-                         * the packet that just completed might not
-                         * be transmitted for hours or days.
-                         * REVISIT for double buffering...
-                         * FIXME revisit for stalls too...
-                         */
-                        musb_ep_select(mbase, epnum);
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-                                return;
-
-                        request = musb_ep->desc ? next_request(musb_ep) : NULL;
-                        if (!request) {
-                                DBG(4, "%s idle now\n",
-                                        musb_ep->end_point.name);
-                                return;
+                        if (request->actual == request->length) {
+                                musb_g_giveback(musb_ep, request, 0);
+                                request = musb_ep->desc ? next_request(musb_ep) : NULL;
+                                if (!request) {
+                                        DBG(4, "%s idle now\n",
+                                                musb_ep->end_point.name);
+                                        return;
+                                }
                         }
                 }
 
@@ -568,11 +556,19 @@ static void rxstate(struct musb *musb, struct musb_request *req)
 {
         const u8                epnum = req->epnum;
         struct usb_request      *request = &req->request;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
         void __iomem            *epio = musb->endpoints[epnum].regs;
         unsigned                fifo_count = 0;
-        u16                     len = musb_ep->packet_sz;
+        u16                     len;
         u16                     csr = musb_readw(epio, MUSB_RXCSR);
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
+
+        len = musb_ep->packet_sz;
 
         /* We shouldn't get here while DMA is active, but we do... */
         if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
@@ -647,8 +643,8 @@ static void rxstate(struct musb *musb, struct musb_request *req)
          */
 
                                 csr |= MUSB_RXCSR_DMAENAB;
-#ifdef USE_MODE1
                                 csr |= MUSB_RXCSR_AUTOCLEAR;
+#ifdef USE_MODE1
                                 /* csr |= MUSB_RXCSR_DMAMODE; */
 
                                 /* this special sequence (enabling and then
@@ -663,10 +659,11 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                 if (request->actual < request->length) {
                                         int transfer_size = 0;
 #ifdef USE_MODE1
-                                        transfer_size = min(request->length,
+                                        transfer_size = min(request->length - request->actual,
                                                         channel->max_len);
 #else
-                                        transfer_size = len;
+                                        transfer_size = min(request->length - request->actual,
+                                                        (unsigned)len);
 #endif
                                         if (transfer_size <= musb_ep->packet_sz)
                                                 musb_ep->dma->desired_mode = 0;
@@ -740,9 +737,15 @@ void musb_g_rx(struct musb *musb, u8 epnum)
         u16                     csr;
         struct usb_request      *request;
         void __iomem            *mbase = musb->mregs;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
         void __iomem            *epio = musb->endpoints[epnum].regs;
         struct dma_channel      *dma;
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
 
         musb_ep_select(mbase, epnum);
 
@@ -1081,7 +1084,7 @@ struct free_record {
 /*
  * Context: controller locked, IRQs blocked.
  */
-static void musb_ep_restart(struct musb *musb, struct musb_request *req)
+void musb_ep_restart(struct musb *musb, struct musb_request *req)
 {
         DBG(3, "<== %s request %p len %u on hw_ep%d\n",
                 req->tx ? "TX/IN" : "RX/OUT",
diff --git a/drivers/usb/musb/musb_gadget.h b/drivers/usb/musb/musb_gadget.h
index c8b140325d82..572b1da7f2dc 100644
--- a/drivers/usb/musb/musb_gadget.h
+++ b/drivers/usb/musb/musb_gadget.h
@@ -105,4 +105,6 @@ extern void musb_gadget_cleanup(struct musb *);
 
 extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int);
 
+extern void musb_ep_restart(struct musb *, struct musb_request *);
+
 #endif          /* __MUSB_GADGET_H */
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 59bef8f3a358..6dd03f4c5f49 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -261,6 +261,7 @@ __acquires(musb->lock)
                                         ctrlrequest->wIndex & 0x0f;
                                 struct musb_ep          *musb_ep;
                                 struct musb_hw_ep       *ep;
+                                struct musb_request     *request;
                                 void __iomem            *regs;
                                 int                     is_in;
                                 u16                     csr;
@@ -302,6 +303,14 @@ __acquires(musb->lock)
                                         musb_writew(regs, MUSB_RXCSR, csr);
                                 }
 
+                                /* Maybe start the first request in the queue */
+                                request = to_musb_request(
+                                                next_request(musb_ep));
+                                if (!musb_ep->busy && request) {
+                                        DBG(3, "restarting the request\n");
+                                        musb_ep_restart(musb, request);
+                                }
+
                                 /* select ep0 again */
                                 musb_ep_select(mbase, 0);
                                 } break;
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 877d20b1dff9..9e65c47cc98b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -660,6 +660,12 @@ static bool musb_tx_dma_program(struct dma_controller *dma,
 
         qh->segsize = length;
 
+        /*
+         * Ensure the data reaches to main memory before starting
+         * DMA transfer
+         */
+        wmb();
+
         if (!dma->channel_program(channel, pkt_size, mode,
                         urb->transfer_dma + offset, length)) {
                 dma->channel_release(channel);
diff --git a/drivers/usb/otg/twl4030-usb.c b/drivers/usb/otg/twl4030-usb.c
index 05aaac1c3861..0bc97698af15 100644
--- a/drivers/usb/otg/twl4030-usb.c
+++ b/drivers/usb/otg/twl4030-usb.c
@@ -347,11 +347,20 @@ static void twl4030_i2c_access(struct twl4030_usb *twl, int on)
         }
 }
 
-static void twl4030_phy_power(struct twl4030_usb *twl, int on)
+static void __twl4030_phy_power(struct twl4030_usb *twl, int on)
 {
-        u8 pwr;
+        u8 pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
+
+        if (on)
+                pwr &= ~PHY_PWR_PHYPWD;
+        else
+                pwr |= PHY_PWR_PHYPWD;
 
-        pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
+        WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+}
+
+static void twl4030_phy_power(struct twl4030_usb *twl, int on)
+{
         if (on) {
                 regulator_enable(twl->usb3v1);
                 regulator_enable(twl->usb1v8);
@@ -365,15 +374,13 @@ static void twl4030_phy_power(struct twl4030_usb *twl, int on)
                 twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0,
                                                         VUSB_DEDICATED2);
                 regulator_enable(twl->usb1v5);
-                pwr &= ~PHY_PWR_PHYPWD;
-                WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+                __twl4030_phy_power(twl, 1);
                 twl4030_usb_write(twl, PHY_CLK_CTRL,
                                   twl4030_usb_read(twl, PHY_CLK_CTRL) |
                                         (PHY_CLK_CTRL_CLOCKGATING_EN |
                                                 PHY_CLK_CTRL_CLK32K_EN));
-        } else  {
-                pwr |= PHY_PWR_PHYPWD;
-                WARN_ON(twl4030_usb_write_verify(twl, PHY_PWR_CTRL, pwr) < 0);
+        } else {
+                __twl4030_phy_power(twl, 0);
                 regulator_disable(twl->usb1v5);
                 regulator_disable(twl->usb1v8);
                 regulator_disable(twl->usb3v1);
@@ -387,19 +394,25 @@ static void twl4030_phy_suspend(struct twl4030_usb *twl, int controller_off)
 
         twl4030_phy_power(twl, 0);
         twl->asleep = 1;
+        dev_dbg(twl->dev, "%s\n", __func__);
 }
 
-static void twl4030_phy_resume(struct twl4030_usb *twl)
+static void __twl4030_phy_resume(struct twl4030_usb *twl)
 {
-        if (!twl->asleep)
-                return;
-
         twl4030_phy_power(twl, 1);
         twl4030_i2c_access(twl, 1);
         twl4030_usb_set_mode(twl, twl->usb_mode);
         if (twl->usb_mode == T2_USB_MODE_ULPI)
                 twl4030_i2c_access(twl, 0);
+}
+
+static void twl4030_phy_resume(struct twl4030_usb *twl)
+{
+        if (!twl->asleep)
+                return;
+        __twl4030_phy_resume(twl);
         twl->asleep = 0;
+        dev_dbg(twl->dev, "%s\n", __func__);
 }
 
 static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
@@ -408,8 +421,8 @@ static int twl4030_usb_ldo_init(struct twl4030_usb *twl)
         twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0xC0, PROTECT_KEY);
         twl_i2c_write_u8(TWL4030_MODULE_PM_MASTER, 0x0C, PROTECT_KEY);
 
-        /* put VUSB3V1 LDO in active state */
-        twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);
+        /* Keep VUSB3V1 LDO in sleep state until VBUS/ID change detected*/
+        /*twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0, VUSB_DEDICATED2);*/
 
         /* input to VUSB3V1 LDO is from VBAT, not VBUS */
         twl_i2c_write_u8(TWL4030_MODULE_PM_RECEIVER, 0x14, VUSB_DEDICATED1);
@@ -502,6 +515,26 @@ static irqreturn_t twl4030_usb_irq(int irq, void *_twl)
         return IRQ_HANDLED;
 }
 
+static void twl4030_usb_phy_init(struct twl4030_usb *twl)
+{
+        int status;
+
+        status = twl4030_usb_linkstat(twl);
+        if (status >= 0) {
+                if (status == USB_EVENT_NONE) {
+                        __twl4030_phy_power(twl, 0);
+                        twl->asleep = 1;
+                } else {
+                        __twl4030_phy_resume(twl);
+                        twl->asleep = 0;
+                }
+
+                blocking_notifier_call_chain(&twl->otg.notifier, status,
+                                twl->otg.gadget);
+        }
+        sysfs_notify(&twl->dev->kobj, NULL, "vbus");
+}
+
 static int twl4030_set_suspend(struct otg_transceiver *x, int suspend)
 {
         struct twl4030_usb *twl = xceiv_to_twl(x);
@@ -550,7 +583,6 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
         struct twl4030_usb_data *pdata = pdev->dev.platform_data;
         struct twl4030_usb      *twl;
         int                     status, err;
-        u8                      pwr;
 
         if (!pdata) {
                 dev_dbg(&pdev->dev, "platform_data not available\n");
@@ -569,10 +601,7 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
         twl->otg.set_peripheral = twl4030_set_peripheral;
         twl->otg.set_suspend    = twl4030_set_suspend;
         twl->usb_mode           = pdata->usb_mode;
-
-        pwr = twl4030_usb_read(twl, PHY_PWR_CTRL);
-
-        twl->asleep             = (pwr & PHY_PWR_PHYPWD);
+        twl->asleep = 1;
 
         /* init spinlock for workqueue */
         spin_lock_init(&twl->lock);
@@ -610,15 +639,10 @@ static int __devinit twl4030_usb_probe(struct platform_device *pdev)
                 return status;
         }
 
-        /* The IRQ handler just handles changes from the previous states
-         * of the ID and VBUS pins ... in probe() we must initialize that
-         * previous state.  The easy way:  fake an IRQ.
-         *
-         * REVISIT:  a real IRQ might have happened already, if PREEMPT is
-         * enabled.  Else the IRQ may not yet be configured or enabled,
-         * because of scheduling delays.
+        /* Power down phy or make it work according to
+         * current link state.
          */
-        twl4030_usb_irq(twl->irq, twl);
+        twl4030_usb_phy_init(twl);
 
         dev_info(&pdev->dev, "Initialized TWL4030 USB module\n");
         return 0;
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 30922a7e3347..aa665817a272 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -2024,6 +2024,9 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
 
         case TIOCGICOUNT:
                 cnow = mos7720_port->icount;
+
+                memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
                 icount.cts = cnow.cts;
                 icount.dsr = cnow.dsr;
                 icount.rng = cnow.rng;
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 1c9b6e9b2386..1a42bc213799 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -2285,6 +2285,9 @@ static int mos7840_ioctl(struct tty_struct *tty, struct file *file,
         case TIOCGICOUNT:
                 cnow = mos7840_port->icount;
                 smp_rmb();
+
+                memset(&icount, 0, sizeof(struct serial_icounter_struct));
+
                 icount.cts = cnow.cts;
                 icount.dsr = cnow.dsr;
                 icount.rng = cnow.rng;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 84f842331dfa..7ccc967831f0 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -3508,7 +3508,7 @@ static void fbcon_exit(void)
         softback_buf = 0UL;
 
         for (i = 0; i < FB_MAX; i++) {
-                int pending;
+                int pending = 0;
 
                 mapped = 0;
                 info = registered_fb[i];
@@ -3516,7 +3516,8 @@ static void fbcon_exit(void)
                 if (info == NULL)
                         continue;
 
-                pending = cancel_work_sync(&info->queue);
+                if (info->queue.func)
+                        pending = cancel_work_sync(&info->queue);
                 DPRINTK("fbcon: %s pending work\n", (pending ? "canceled" :
                         "no"));
 
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 815f84b07933..70477c2e4b61 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -13,7 +13,7 @@
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <linux/dmi.h>
-
+#include <linux/pci.h>
 #include <video/vga.h>
 
 static struct fb_var_screeninfo efifb_defined __devinitdata = {
@@ -39,17 +39,31 @@ enum {
         M_I20,          /* 20-Inch iMac */
         M_I20_SR,       /* 20-Inch iMac (Santa Rosa) */
         M_I24,          /* 24-Inch iMac */
+        M_I24_8_1,      /* 24-Inch iMac, 8,1th gen */
+        M_I24_10_1,     /* 24-Inch iMac, 10,1th gen */
+        M_I27_11_1,     /* 27-Inch iMac, 11,1th gen */
         M_MINI,         /* Mac Mini */
+        M_MINI_3_1,     /* Mac Mini, 3,1th gen */
+        M_MINI_4_1,     /* Mac Mini, 4,1th gen */
         M_MB,           /* MacBook */
         M_MB_2,         /* MacBook, 2nd rev. */
         M_MB_3,         /* MacBook, 3rd rev. */
+        M_MB_5_1,       /* MacBook, 5th rev. */
+        M_MB_6_1,       /* MacBook, 6th rev. */
+        M_MB_7_1,       /* MacBook, 7th rev. */
         M_MB_SR,        /* MacBook, 2nd gen, (Santa Rosa) */
         M_MBA,          /* MacBook Air */
         M_MBP,          /* MacBook Pro */
         M_MBP_2,        /* MacBook Pro 2nd gen */
+        M_MBP_2_2,      /* MacBook Pro 2,2nd gen */
         M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
         M_MBP_4,        /* MacBook Pro, 4th gen */
         M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
+        M_MBP_5_2,      /* MacBook Pro, 5,2th gen */
+        M_MBP_5_3,      /* MacBook Pro, 5,3rd gen */
+        M_MBP_6_1,      /* MacBook Pro, 6,1th gen */
+        M_MBP_6_2,      /* MacBook Pro, 6,2th gen */
+        M_MBP_7_1,      /* MacBook Pro, 7,1th gen */
         M_UNKNOWN       /* placeholder */
 };
 
@@ -64,14 +78,28 @@ static struct efifb_dmi_info {
         [M_I20] = { "i20", 0x80010000, 1728 * 4, 1680, 1050 }, /* guess */
         [M_I20_SR] = { "imac7", 0x40010000, 1728 * 4, 1680, 1050 },
         [M_I24] = { "i24", 0x80010000, 2048 * 4, 1920, 1200 }, /* guess */
+        [M_I24_8_1] = { "imac8", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_I24_10_1] = { "imac10", 0xc0010000, 2048 * 4, 1920, 1080 },
+        [M_I27_11_1] = { "imac11", 0xc0010000, 2560 * 4, 2560, 1440 },
         [M_MINI]= { "mini", 0x80000000, 2048 * 4, 1024, 768 },
+        [M_MINI_3_1] = { "mini31", 0x40010000, 1024 * 4, 1024, 768 },
+        [M_MINI_4_1] = { "mini41", 0xc0010000, 2048 * 4, 1920, 1200 },
         [M_MB] = { "macbook", 0x80000000, 2048 * 4, 1280, 800 },
+        [M_MB_5_1] = { "macbook51", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_6_1] = { "macbook61", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_7_1] = { "macbook71", 0x80010000, 2048 * 4, 1280, 800 },
         [M_MBA] = { "mba", 0x80000000, 2048 * 4, 1280, 800 },
         [M_MBP] = { "mbp", 0x80010000, 1472 * 4, 1440, 900 },
         [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
+        [M_MBP_2_2] = { "mbp22", 0x80010000, 1472 * 4, 1440, 900 },
         [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
         [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
         [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_5_2] = { "mbp52", 0xc0010000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_3] = { "mbp53", 0xd0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_6_1] = { "mbp61", 0x90030000, 2048 * 4, 1920, 1200 },
+        [M_MBP_6_2] = { "mbp62", 0x90030000, 2048 * 4, 1680, 1050 },
+        [M_MBP_7_1] = { "mbp71", 0xc0010000, 2048 * 4, 1280, 800 },
         [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
 
@@ -92,7 +120,12 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac6,1", M_I24),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac6,1", M_I24),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac7,1", M_I20_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac8,1", M_I24_8_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac10,1", M_I24_10_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac11,1", M_I27_11_1),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "Macmini1,1", M_MINI),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini3,1", M_MINI_3_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini4,1", M_MINI_4_1),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook1,1", M_MB),
         /* At least one of these two will be right; maybe both? */
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook2,1", M_MB),
@@ -101,14 +134,23 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook3,1", M_MB),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook3,1", M_MB),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook4,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook5,1", M_MB_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook6,1", M_MB_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook7,1", M_MB_7_1),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookAir1,1", M_MBA),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro1,1", M_MBP),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,1", M_MBP_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,2", M_MBP_2_2),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro2,1", M_MBP_2),
         EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
         EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,2", M_MBP_5_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,3", M_MBP_5_3),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,1", M_MBP_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,2", M_MBP_6_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro7,1", M_MBP_7_1),
         {},
 };
 
@@ -116,7 +158,7 @@ static int set_system(const struct dmi_system_id *id)
 {
         struct efifb_dmi_info *info = id->driver_data;
         if (info->base == 0)
-                return -ENODEV;
+                return 0;
 
         printk(KERN_INFO "efifb: dmi detected %s - framebuffer at %p "
                          "(%dx%d, stride %d)\n", id->ident,
@@ -124,18 +166,55 @@ static int set_system(const struct dmi_system_id *id)
                          info->stride);
 
         /* Trust the bootloader over the DMI tables */
-        if (screen_info.lfb_base == 0)
+        if (screen_info.lfb_base == 0) {
+#if defined(CONFIG_PCI)
+                struct pci_dev *dev = NULL;
+                int found_bar = 0;
+#endif
                 screen_info.lfb_base = info->base;
-        if (screen_info.lfb_linelength == 0)
-                screen_info.lfb_linelength = info->stride;
-        if (screen_info.lfb_width == 0)
-                screen_info.lfb_width = info->width;
-        if (screen_info.lfb_height == 0)
-                screen_info.lfb_height = info->height;
-        if (screen_info.orig_video_isVGA == 0)
-                screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
 
-        return 0;
+#if defined(CONFIG_PCI)
+                /* make sure that the address in the table is actually on a
+                 * VGA device's PCI BAR */
+
+                for_each_pci_dev(dev) {
+                        int i;
+                        if ((dev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
+                                continue;
+                        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+                                resource_size_t start, end;
+
+                                start = pci_resource_start(dev, i);
+                                if (start == 0)
+                                        break;
+                                end = pci_resource_end(dev, i);
+                                if (screen_info.lfb_base >= start &&
+                                                screen_info.lfb_base < end) {
+                                        found_bar = 1;
+                                }
+                        }
+                }
+                if (!found_bar)
+                        screen_info.lfb_base = 0;
+#endif
+        }
+        if (screen_info.lfb_base) {
+                if (screen_info.lfb_linelength == 0)
+                        screen_info.lfb_linelength = info->stride;
+                if (screen_info.lfb_width == 0)
+                        screen_info.lfb_width = info->width;
+                if (screen_info.lfb_height == 0)
+                        screen_info.lfb_height = info->height;
+                if (screen_info.orig_video_isVGA == 0)
+                        screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
+        } else {
+                screen_info.lfb_linelength = 0;
+                screen_info.lfb_width = 0;
+                screen_info.lfb_height = 0;
+                screen_info.orig_video_isVGA = 0;
+                return 0;
+        }
+        return 1;
 }
 
 static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 559bf1727a2b..b52f8e4ef1fd 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1701,6 +1701,9 @@ static int	sisfb_ioctl(struct fb_info *info, unsigned int cmd,
                 break;
 
            case FBIOGET_VBLANK:
+
+                memset(&sisvbblank, 0, sizeof(struct fb_vblank));
+
                 sisvbblank.count = 0;
                 sisvbblank.flags = sisfb_setupvbblankflags(ivideo, &sisvbblank.vcount, &sisvbblank.hcount);
 
diff --git a/drivers/video/via/ioctl.c b/drivers/video/via/ioctl.c
index da03c074e32a..4d553d0b8d7a 100644
--- a/drivers/video/via/ioctl.c
+++ b/drivers/video/via/ioctl.c
@@ -25,6 +25,8 @@ int viafb_ioctl_get_viafb_info(u_long arg)
 {
         struct viafb_ioctl_info viainfo;
 
+        memset(&viainfo, 0, sizeof(struct viafb_ioctl_info));
+
         viainfo.viafb_id = VIAID;
         viainfo.vendor_id = PCI_VIA_VENDOR_ID;
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index b036677df8c4..24efd8ea41bb 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -213,11 +213,11 @@ config OMAP_WATCHDOG
           here to enable the OMAP1610/OMAP1710/OMAP2420/OMAP3430/OMAP4430 watchdog timer.
 
 config PNX4008_WATCHDOG
-        tristate "PNX4008 Watchdog"
-        depends on ARCH_PNX4008
+        tristate "PNX4008 and LPC32XX Watchdog"
+        depends on ARCH_PNX4008 || ARCH_LPC32XX
         help
           Say Y here if to include support for the watchdog timer
-          in the PNX4008 processor.
+          in the PNX4008 or LPC32XX processor.
           This driver can be built as a module by choosing M. The module
           will be called pnx4008_wdt.
 
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index 88c83aa57303..f31493e65b38 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -305,7 +305,7 @@ static int __init sbwdog_init(void)
         if (ret) {
                 printk(KERN_ERR "%s: failed to request irq 1 - %d\n",
                                                 ident.identity, ret);
-                return ret;
+                goto out;
         }
 
         ret = misc_register(&sbwdog_miscdev);
@@ -313,14 +313,20 @@ static int __init sbwdog_init(void)
                 printk(KERN_INFO "%s: timeout is %ld.%ld secs\n",
                                 ident.identity,
                                 timeout / 1000000, (timeout / 100000) % 10);
-        } else
-                free_irq(1, (void *)user_dog);
+                return 0;
+        }
+        free_irq(1, (void *)user_dog);
+out:
+        unregister_reboot_notifier(&sbwdog_notifier);
+
         return ret;
 }
 
 static void __exit sbwdog_exit(void)
 {
         misc_deregister(&sbwdog_miscdev);
+        free_irq(1, (void *)user_dog);
+        unregister_reboot_notifier(&sbwdog_notifier);
 }
 
 module_init(sbwdog_init);
diff --git a/drivers/watchdog/ts72xx_wdt.c b/drivers/watchdog/ts72xx_wdt.c
index 458c499c1223..18cdeb4c4258 100644
--- a/drivers/watchdog/ts72xx_wdt.c
+++ b/drivers/watchdog/ts72xx_wdt.c
@@ -449,6 +449,9 @@ static __devinit int ts72xx_wdt_probe(struct platform_device *pdev)
         wdt->pdev = pdev;
         mutex_init(&wdt->lock);
 
+        /* make sure that the watchdog is disabled */
+        ts72xx_wdt_stop(wdt);
+
         error = misc_register(&ts72xx_wdt_miscdev);
         if (error) {
                 dev_err(&pdev->dev, "failed to register miscdev\n");
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index 16c8a2a98c1b..899f168fd19c 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -292,9 +292,11 @@ int v9fs_dir_release(struct inode *inode, struct file *filp)
 
         fid = filp->private_data;
         P9_DPRINTK(P9_DEBUG_VFS,
-                        "inode: %p filp: %p fid: %d\n", inode, filp, fid->fid);
+                        "v9fs_dir_release: inode: %p filp: %p fid: %d\n",
+                        inode, filp, fid ? fid->fid : -1);
         filemap_write_and_wait(inode->i_mapping);
-        p9_client_clunk(fid);
+        if (fid)
+                p9_client_clunk(fid);
         return 0;
 }
 
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index c7c23eab9440..9e670d527646 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -730,7 +730,10 @@ v9fs_vfs_create_dotl(struct inode *dir, struct dentry *dentry, int mode,
                 P9_DPRINTK(P9_DEBUG_VFS, "inode creation failed %d\n", err);
                 goto error;
         }
-        dentry->d_op = &v9fs_cached_dentry_operations;
+        if (v9ses->cache)
+                dentry->d_op = &v9fs_cached_dentry_operations;
+        else
+                dentry->d_op = &v9fs_dentry_operations;
         d_instantiate(dentry, inode);
         err = v9fs_fid_add(dentry, fid);
         if (err < 0)
@@ -1128,6 +1131,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         v9fs_stat2inode(st, dentry->d_inode, dentry->d_inode->i_sb);
                 generic_fillattr(dentry->d_inode, stat);
 
+        p9stat_free(st);
         kfree(st);
         return 0;
 }
@@ -1489,6 +1493,7 @@ static int v9fs_readlink(struct dentry *dentry, char *buffer, int buflen)
 
         retval = strnlen(buffer, buflen);
 done:
+        p9stat_free(st);
         kfree(st);
         return retval;
 }
@@ -1942,7 +1947,7 @@ static const struct inode_operations v9fs_dir_inode_operations_dotu = {
         .unlink = v9fs_vfs_unlink,
         .mkdir = v9fs_vfs_mkdir,
         .rmdir = v9fs_vfs_rmdir,
-        .mknod = v9fs_vfs_mknod_dotl,
+        .mknod = v9fs_vfs_mknod,
         .rename = v9fs_vfs_rename,
         .getattr = v9fs_vfs_getattr,
         .setattr = v9fs_vfs_setattr,
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index f9311077de68..1d12ba0ed3db 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -122,6 +122,10 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
         fid = v9fs_session_init(v9ses, dev_name, data);
         if (IS_ERR(fid)) {
                 retval = PTR_ERR(fid);
+                /*
+                 * we need to call session_close to tear down some
+                 * of the data structure setup by session_init
+                 */
                 goto close_session;
         }
 
@@ -144,7 +148,6 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
                 retval = -ENOMEM;
                 goto release_sb;
         }
-
         sb->s_root = root;
 
         if (v9fs_proto_dotl(v9ses)) {
@@ -152,7 +155,7 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
                 st = p9_client_getattr_dotl(fid, P9_STATS_BASIC);
                 if (IS_ERR(st)) {
                         retval = PTR_ERR(st);
-                        goto clunk_fid;
+                        goto release_sb;
                 }
 
                 v9fs_stat2inode_dotl(st, root->d_inode);
@@ -162,7 +165,7 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
                 st = p9_client_stat(fid);
                 if (IS_ERR(st)) {
                         retval = PTR_ERR(st);
-                        goto clunk_fid;
+                        goto release_sb;
                 }
 
                 root->d_inode->i_ino = v9fs_qid2ino(&st->qid);
@@ -174,19 +177,24 @@ static int v9fs_get_sb(struct file_system_type *fs_type, int flags,
 
         v9fs_fid_add(root, fid);
 
-P9_DPRINTK(P9_DEBUG_VFS, " simple set mount, return 0\n");
+        P9_DPRINTK(P9_DEBUG_VFS, " simple set mount, return 0\n");
         simple_set_mnt(mnt, sb);
         return 0;
 
 clunk_fid:
         p9_client_clunk(fid);
-
 close_session:
         v9fs_session_close(v9ses);
         kfree(v9ses);
         return retval;
-
 release_sb:
+        /*
+         * we will do the session_close and root dentry release
+         * in the below call. But we need to clunk fid, because we haven't
+         * attached the fid to dentry so it won't get clunked
+         * automatically.
+         */
+        p9_client_clunk(fid);
         deactivate_locked_super(sb);
         return retval;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 3006b5bc33d6..250b0a73c8a8 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -712,8 +712,16 @@ static ssize_t aio_run_iocb(struct kiocb *iocb)
          */
         ret = retry(iocb);
 
-        if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED)
+        if (ret != -EIOCBRETRY && ret != -EIOCBQUEUED) {
+                /*
+                 * There's no easy way to restart the syscall since other AIO's
+                 * may be already running. Just fail this IO with EINTR.
+                 */
+                if (unlikely(ret == -ERESTARTSYS || ret == -ERESTARTNOINTR ||
+                             ret == -ERESTARTNOHAND || ret == -ERESTART_RESTARTBLOCK))
+                        ret = -EINTR;
                 aio_complete(iocb, ret, 0);
+        }
 out:
         spin_lock_irq(&ctx->ctx_lock);
 
@@ -1659,6 +1667,9 @@ long do_io_submit(aio_context_t ctx_id, long nr,
         if (unlikely(nr < 0))
                 return -EINVAL;
 
+        if (unlikely(nr > LONG_MAX/sizeof(*iocbpp)))
+                nr = LONG_MAX/sizeof(*iocbpp);
+
         if (unlikely(!access_ok(VERIFY_READ, iocbpp, (nr*sizeof(*iocbpp)))))
                 return -EFAULT;
 
diff --git a/fs/ceph/Kconfig b/fs/ceph/Kconfig
index bc87b9c1d27e..0fcd2640c23f 100644
--- a/fs/ceph/Kconfig
+++ b/fs/ceph/Kconfig
@@ -3,6 +3,7 @@ config CEPH_FS
         depends on INET && EXPERIMENTAL
         select LIBCRC32C
         select CRYPTO_AES
+        select CRYPTO
         help
           Choose Y or M here to include support for mounting the
           experimental Ceph distributed file system.  Ceph is an extremely
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 4cfce1ee31fa..efbc604001c8 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -411,8 +411,8 @@ static int writepage_nounlock(struct page *page, struct writeback_control *wbc)
         if (i_size < page_off + len)
                 len = i_size - page_off;
 
-        dout("writepage %p page %p index %lu on %llu~%u\n",
-             inode, page, page->index, page_off, len);
+        dout("writepage %p page %p index %lu on %llu~%u snapc %p\n",
+             inode, page, page->index, page_off, len, snapc);
 
         writeback_stat = atomic_long_inc_return(&client->writeback_count);
         if (writeback_stat >
@@ -766,7 +766,8 @@ get_more_pages:
                         /* ok */
                         if (locked_pages == 0) {
                                 /* prepare async write request */
-                                offset = page->index << PAGE_CACHE_SHIFT;
+                                offset = (unsigned long long)page->index
+                                        << PAGE_CACHE_SHIFT;
                                 len = wsize;
                                 req = ceph_osdc_new_request(&client->osdc,
                                             &ci->i_layout,
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index a2069b6680ae..73c153092f72 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -814,7 +814,7 @@ int __ceph_caps_used(struct ceph_inode_info *ci)
                 used |= CEPH_CAP_PIN;
         if (ci->i_rd_ref)
                 used |= CEPH_CAP_FILE_RD;
-        if (ci->i_rdcache_ref || ci->i_rdcache_gen)
+        if (ci->i_rdcache_ref || ci->vfs_inode.i_data.nrpages)
                 used |= CEPH_CAP_FILE_CACHE;
         if (ci->i_wr_ref)
                 used |= CEPH_CAP_FILE_WR;
@@ -1195,10 +1195,14 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap,
  * asynchronously back to the MDS once sync writes complete and dirty
  * data is written out.
  *
+ * Unless @again is true, skip cap_snaps that were already sent to
+ * the MDS (i.e., during this session).
+ *
  * Called under i_lock.  Takes s_mutex as needed.
  */
 void __ceph_flush_snaps(struct ceph_inode_info *ci,
-                        struct ceph_mds_session **psession)
+                        struct ceph_mds_session **psession,
+                        int again)
                 __releases(ci->vfs_inode->i_lock)
                 __acquires(ci->vfs_inode->i_lock)
 {
@@ -1227,7 +1231,7 @@ retry:
                  * pages to be written out.
                  */
                 if (capsnap->dirty_pages || capsnap->writing)
-                        continue;
+                        break;
 
                 /*
                  * if cap writeback already occurred, we should have dropped
@@ -1240,6 +1244,13 @@ retry:
                         dout("no auth cap (migrating?), doing nothing\n");
                         goto out;
                 }
+
+                /* only flush each capsnap once */
+                if (!again && !list_empty(&capsnap->flushing_item)) {
+                        dout("already flushed %p, skipping\n", capsnap);
+                        continue;
+                }
+
                 mds = ci->i_auth_cap->session->s_mds;
                 mseq = ci->i_auth_cap->mseq;
 
@@ -1276,8 +1287,8 @@ retry:
                               &session->s_cap_snaps_flushing);
                 spin_unlock(&inode->i_lock);
 
-                dout("flush_snaps %p cap_snap %p follows %lld size %llu\n",
-                     inode, capsnap, next_follows, capsnap->size);
+                dout("flush_snaps %p cap_snap %p follows %lld tid %llu\n",
+                     inode, capsnap, capsnap->follows, capsnap->flush_tid);
                 send_cap_msg(session, ceph_vino(inode).ino, 0,
                              CEPH_CAP_OP_FLUSHSNAP, capsnap->issued, 0,
                              capsnap->dirty, 0, capsnap->flush_tid, 0, mseq,
@@ -1314,7 +1325,7 @@ static void ceph_flush_snaps(struct ceph_inode_info *ci)
         struct inode *inode = &ci->vfs_inode;
 
         spin_lock(&inode->i_lock);
-        __ceph_flush_snaps(ci, NULL);
+        __ceph_flush_snaps(ci, NULL, 0);
         spin_unlock(&inode->i_lock);
 }
 
@@ -1477,7 +1488,7 @@ void ceph_check_caps(struct ceph_inode_info *ci, int flags,
 
         /* flush snaps first time around only */
         if (!list_empty(&ci->i_cap_snaps))
-                __ceph_flush_snaps(ci, &session);
+                __ceph_flush_snaps(ci, &session, 0);
         goto retry_locked;
 retry:
         spin_lock(&inode->i_lock);
@@ -1894,7 +1905,7 @@ static void kick_flushing_capsnaps(struct ceph_mds_client *mdsc,
                 if (cap && cap->session == session) {
                         dout("kick_flushing_caps %p cap %p capsnap %p\n", inode,
                              cap, capsnap);
-                        __ceph_flush_snaps(ci, &session);
+                        __ceph_flush_snaps(ci, &session, 1);
                 } else {
                         pr_err("%p auth cap %p not mds%d ???\n", inode,
                                cap, session->s_mds);
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 6e4f43ff23ec..a1986eb52045 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -1021,11 +1021,15 @@ out_touch:
 static void ceph_dentry_release(struct dentry *dentry)
 {
         struct ceph_dentry_info *di = ceph_dentry(dentry);
-        struct inode *parent_inode = dentry->d_parent->d_inode;
-        u64 snapid = ceph_snap(parent_inode);
+        struct inode *parent_inode = NULL;
+        u64 snapid = CEPH_NOSNAP;
 
+        if (!IS_ROOT(dentry)) {
+                parent_inode = dentry->d_parent->d_inode;
+                if (parent_inode)
+                        snapid = ceph_snap(parent_inode);
+        }
         dout("dentry_release %p parent %p\n", dentry, parent_inode);
-
         if (parent_inode && snapid != CEPH_SNAPDIR) {
                 struct ceph_inode_info *ci = ceph_inode(parent_inode);
 
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index e7cca414da03..62377ec37edf 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -845,7 +845,7 @@ static void ceph_set_dentry_offset(struct dentry *dn)
  * the caller) if we fail.
  */
 static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
-                                    bool *prehash)
+                                    bool *prehash, bool set_offset)
 {
         struct dentry *realdn;
 
@@ -877,7 +877,8 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in,
         }
         if ((!prehash || *prehash) && d_unhashed(dn))
                 d_rehash(dn);
-        ceph_set_dentry_offset(dn);
+        if (set_offset)
+                ceph_set_dentry_offset(dn);
 out:
         return dn;
 }
@@ -1062,7 +1063,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                                 d_delete(dn);
                                 goto done;
                         }
-                        dn = splice_dentry(dn, in, &have_lease);
+                        dn = splice_dentry(dn, in, &have_lease, true);
                         if (IS_ERR(dn)) {
                                 err = PTR_ERR(dn);
                                 goto done;
@@ -1105,7 +1106,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                         goto done;
                 }
                 dout(" linking snapped dir %p to dn %p\n", in, dn);
-                dn = splice_dentry(dn, in, NULL);
+                dn = splice_dentry(dn, in, NULL, true);
                 if (IS_ERR(dn)) {
                         err = PTR_ERR(dn);
                         goto done;
@@ -1237,7 +1238,7 @@ retry_lookup:
                                 err = PTR_ERR(in);
                                 goto out;
                         }
-                        dn = splice_dentry(dn, in, NULL);
+                        dn = splice_dentry(dn, in, NULL, false);
                         if (IS_ERR(dn))
                                 dn = NULL;
                 }
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index f091b1351786..fad95f8f2608 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2374,6 +2374,8 @@ static int encode_caps_cb(struct inode *inode, struct ceph_cap *cap,
                                                 num_fcntl_locks,
                                                 num_flock_locks);
                 unlock_kernel();
+        } else {
+                err = ceph_pagelist_append(pagelist, &rec, reclen);
         }
 
 out_free:
diff --git a/fs/ceph/pagelist.c b/fs/ceph/pagelist.c
index b6859f47d364..46a368b6dce5 100644
--- a/fs/ceph/pagelist.c
+++ b/fs/ceph/pagelist.c
@@ -5,10 +5,18 @@
 
 #include "pagelist.h"
 
+static void ceph_pagelist_unmap_tail(struct ceph_pagelist *pl)
+{
+        struct page *page = list_entry(pl->head.prev, struct page,
+                                       lru);
+        kunmap(page);
+}
+
 int ceph_pagelist_release(struct ceph_pagelist *pl)
 {
         if (pl->mapped_tail)
-                kunmap(pl->mapped_tail);
+                ceph_pagelist_unmap_tail(pl);
+
         while (!list_empty(&pl->head)) {
                 struct page *page = list_first_entry(&pl->head, struct page,
                                                      lru);
@@ -26,7 +34,7 @@ static int ceph_pagelist_addpage(struct ceph_pagelist *pl)
         pl->room += PAGE_SIZE;
         list_add_tail(&page->lru, &pl->head);
         if (pl->mapped_tail)
-                kunmap(pl->mapped_tail);
+                ceph_pagelist_unmap_tail(pl);
         pl->mapped_tail = kmap(page);
         return 0;
 }
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index 4868b9dcac5a..190b6c4a6f2b 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -119,6 +119,7 @@ static struct ceph_snap_realm *ceph_create_snap_realm(
         INIT_LIST_HEAD(&realm->children);
         INIT_LIST_HEAD(&realm->child_item);
         INIT_LIST_HEAD(&realm->empty_item);
+        INIT_LIST_HEAD(&realm->dirty_item);
         INIT_LIST_HEAD(&realm->inodes_with_caps);
         spin_lock_init(&realm->inodes_with_caps_lock);
         __insert_snap_realm(&mdsc->snap_realms, realm);
@@ -467,7 +468,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci)
                 INIT_LIST_HEAD(&capsnap->ci_item);
                 INIT_LIST_HEAD(&capsnap->flushing_item);
 
-                capsnap->follows = snapc->seq - 1;
+                capsnap->follows = snapc->seq;
                 capsnap->issued = __ceph_caps_issued(ci, NULL);
                 capsnap->dirty = dirty;
 
@@ -604,6 +605,7 @@ int ceph_update_snap_trace(struct ceph_mds_client *mdsc,
         struct ceph_snap_realm *realm;
         int invalidate = 0;
         int err = -ENOMEM;
+        LIST_HEAD(dirty_realms);
 
         dout("update_snap_trace deletion=%d\n", deletion);
 more:
@@ -626,24 +628,6 @@ more:
                 }
         }
 
-        if (le64_to_cpu(ri->seq) > realm->seq) {
-                dout("update_snap_trace updating %llx %p %lld -> %lld\n",
-                     realm->ino, realm, realm->seq, le64_to_cpu(ri->seq));
-                /*
-                 * if the realm seq has changed, queue a cap_snap for every
-                 * inode with open caps.  we do this _before_ we update
-                 * the realm info so that we prepare for writeback under the
-                 * _previous_ snap context.
-                 *
-                 * ...unless it's a snap deletion!
-                 */
-                if (!deletion)
-                        queue_realm_cap_snaps(realm);
-        } else {
-                dout("update_snap_trace %llx %p seq %lld unchanged\n",
-                     realm->ino, realm, realm->seq);
-        }
-
         /* ensure the parent is correct */
         err = adjust_snap_realm_parent(mdsc, realm, le64_to_cpu(ri->parent));
         if (err < 0)
@@ -651,6 +635,8 @@ more:
         invalidate += err;
 
         if (le64_to_cpu(ri->seq) > realm->seq) {
+                dout("update_snap_trace updating %llx %p %lld -> %lld\n",
+                     realm->ino, realm, realm->seq, le64_to_cpu(ri->seq));
                 /* update realm parameters, snap lists */
                 realm->seq = le64_to_cpu(ri->seq);
                 realm->created = le64_to_cpu(ri->created);
@@ -668,9 +654,17 @@ more:
                 if (err < 0)
                         goto fail;
 
+                /* queue realm for cap_snap creation */
+                list_add(&realm->dirty_item, &dirty_realms);
+
                 invalidate = 1;
         } else if (!realm->cached_context) {
+                dout("update_snap_trace %llx %p seq %lld new\n",
+                     realm->ino, realm, realm->seq);
                 invalidate = 1;
+        } else {
+                dout("update_snap_trace %llx %p seq %lld unchanged\n",
+                     realm->ino, realm, realm->seq);
         }
 
         dout("done with %llx %p, invalidated=%d, %p %p\n", realm->ino,
@@ -683,6 +677,14 @@ more:
         if (invalidate)
                 rebuild_snap_realms(realm);
 
+        /*
+         * queue cap snaps _after_ we've built the new snap contexts,
+         * so that i_head_snapc can be set appropriately.
+         */
+        list_for_each_entry(realm, &dirty_realms, dirty_item) {
+                queue_realm_cap_snaps(realm);
+        }
+
         __cleanup_empty_realms(mdsc);
         return 0;
 
@@ -715,7 +717,7 @@ static void flush_snaps(struct ceph_mds_client *mdsc)
                 igrab(inode);
                 spin_unlock(&mdsc->snap_flush_lock);
                 spin_lock(&inode->i_lock);
-                __ceph_flush_snaps(ci, &session);
+                __ceph_flush_snaps(ci, &session, 0);
                 spin_unlock(&inode->i_lock);
                 iput(inode);
                 spin_lock(&mdsc->snap_flush_lock);
@@ -816,6 +818,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
                         };
                         struct inode *inode = ceph_find_inode(sb, vino);
                         struct ceph_inode_info *ci;
+                        struct ceph_snap_realm *oldrealm;
 
                         if (!inode)
                                 continue;
@@ -841,18 +844,19 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
                         dout(" will move %p to split realm %llx %p\n",
                              inode, realm->ino, realm);
                         /*
-                         * Remove the inode from the realm's inode
-                         * list, but don't add it to the new realm
-                         * yet.  We don't want the cap_snap to be
-                         * queued (again) by ceph_update_snap_trace()
-                         * below.  Queue it _now_, under the old context.
+                         * Move the inode to the new realm
                          */
                         spin_lock(&realm->inodes_with_caps_lock);
                         list_del_init(&ci->i_snap_realm_item);
+                        list_add(&ci->i_snap_realm_item,
+                                 &realm->inodes_with_caps);
+                        oldrealm = ci->i_snap_realm;
+                        ci->i_snap_realm = realm;
                         spin_unlock(&realm->inodes_with_caps_lock);
                         spin_unlock(&inode->i_lock);
 
-                        ceph_queue_cap_snap(ci);
+                        ceph_get_snap_realm(mdsc, realm);
+                        ceph_put_snap_realm(mdsc, oldrealm);
 
                         iput(inode);
                         continue;
@@ -880,43 +884,9 @@ skip_inode:
         ceph_update_snap_trace(mdsc, p, e,
                                op == CEPH_SNAP_OP_DESTROY);
 
-        if (op == CEPH_SNAP_OP_SPLIT) {
-                /*
-                 * ok, _now_ add the inodes into the new realm.
-                 */
-                for (i = 0; i < num_split_inos; i++) {
-                        struct ceph_vino vino = {
-                                .ino = le64_to_cpu(split_inos[i]),
-                                .snap = CEPH_NOSNAP,
-                        };
-                        struct inode *inode = ceph_find_inode(sb, vino);
-                        struct ceph_inode_info *ci;
-
-                        if (!inode)
-                                continue;
-                        ci = ceph_inode(inode);
-                        spin_lock(&inode->i_lock);
-                        if (list_empty(&ci->i_snap_realm_item)) {
-                                struct ceph_snap_realm *oldrealm =
-                                        ci->i_snap_realm;
-
-                                dout(" moving %p to split realm %llx %p\n",
-                                     inode, realm->ino, realm);
-                                spin_lock(&realm->inodes_with_caps_lock);
-                                list_add(&ci->i_snap_realm_item,
-                                         &realm->inodes_with_caps);
-                                ci->i_snap_realm = realm;
-                                spin_unlock(&realm->inodes_with_caps_lock);
-                                ceph_get_snap_realm(mdsc, realm);
-                                ceph_put_snap_realm(mdsc, oldrealm);
-                        }
-                        spin_unlock(&inode->i_lock);
-                        iput(inode);
-                }
-
+        if (op == CEPH_SNAP_OP_SPLIT)
                 /* we took a reference when we created the realm, above */
                 ceph_put_snap_realm(mdsc, realm);
-        }
 
         __cleanup_empty_realms(mdsc);
 
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index c33897ae5725..b87638e84c4b 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -690,6 +690,8 @@ struct ceph_snap_realm {
 
         struct list_head empty_item;     /* if i have ref==0 */
 
+        struct list_head dirty_item;     /* if realm needs new context */
+
         /* the current set of snaps for this realm */
         struct ceph_snap_context *cached_context;
 
@@ -826,7 +828,8 @@ extern void ceph_put_cap_refs(struct ceph_inode_info *ci, int had);
 extern void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
                                        struct ceph_snap_context *snapc);
 extern void __ceph_flush_snaps(struct ceph_inode_info *ci,
-                               struct ceph_mds_session **psession);
+                               struct ceph_mds_session **psession,
+                               int again);
 extern void ceph_check_caps(struct ceph_inode_info *ci, int flags,
                             struct ceph_mds_session *session);
 extern void ceph_check_delayed_caps(struct ceph_mds_client *mdsc);
diff --git a/fs/char_dev.c b/fs/char_dev.c
index f80a4f25123c..143d393881cb 100644
--- a/fs/char_dev.c
+++ b/fs/char_dev.c
@@ -40,7 +40,9 @@ struct backing_dev_info directly_mappable_cdev_bdi = {
 #endif
                 /* permit direct mmap, for read, write or exec */
                 BDI_CAP_MAP_DIRECT |
-                BDI_CAP_READ_MAP | BDI_CAP_WRITE_MAP | BDI_CAP_EXEC_MAP),
+                BDI_CAP_READ_MAP | BDI_CAP_WRITE_MAP | BDI_CAP_EXEC_MAP |
+                /* no writeback happens */
+                BDI_CAP_NO_ACCT_AND_WRITEBACK),
 };
 
 static struct kobj_map *cdev_map;
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index 0da1debd499d..917b7d449bb2 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -2,8 +2,6 @@ config CIFS
         tristate "CIFS support (advanced network filesystem, SMBFS successor)"
         depends on INET
         select NLS
-        select CRYPTO_MD5
-        select CRYPTO_ARC4
         help
           This is the client VFS module for the Common Internet File System
           (CIFS) protocol which is the successor to the Server Message Block
diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
index 21f0fbd86989..cfd1ce34e0bc 100644
--- a/fs/cifs/asn1.c
+++ b/fs/cifs/asn1.c
@@ -597,13 +597,13 @@ decode_negTokenInit(unsigned char *security_blob, int length,
                                 if (compare_oid(oid, oidlen, MSKRB5_OID,
                                                 MSKRB5_OID_LEN))
                                         server->sec_mskerberos = true;
-                                if (compare_oid(oid, oidlen, KRB5U2U_OID,
+                                else if (compare_oid(oid, oidlen, KRB5U2U_OID,
                                                      KRB5U2U_OID_LEN))
                                         server->sec_kerberosu2u = true;
-                                if (compare_oid(oid, oidlen, KRB5_OID,
+                                else if (compare_oid(oid, oidlen, KRB5_OID,
                                                      KRB5_OID_LEN))
                                         server->sec_kerberos = true;
-                                if (compare_oid(oid, oidlen, NTLMSSP_OID,
+                                else if (compare_oid(oid, oidlen, NTLMSSP_OID,
                                                      NTLMSSP_OID_LEN))
                                         server->sec_ntlmssp = true;
 
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 709f2296bdb4..35042d8f7338 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -27,7 +27,6 @@
 #include "md5.h"
 #include "cifs_unicode.h"
 #include "cifsproto.h"
-#include "ntlmssp.h"
 #include <linux/ctype.h>
 #include <linux/random.h>
 
@@ -43,43 +42,21 @@ extern void SMBencrypt(unsigned char *passwd, const unsigned char *c8,
                        unsigned char *p24);
 
 static int cifs_calculate_signature(const struct smb_hdr *cifs_pdu,
-                        struct TCP_Server_Info *server, char *signature)
+                                    const struct mac_key *key, char *signature)
 {
-        int rc;
+        struct  MD5Context context;
 
-        if (cifs_pdu == NULL || server == NULL || signature == NULL)
+        if ((cifs_pdu == NULL) || (signature == NULL) || (key == NULL))
                 return -EINVAL;
 
-        if (!server->ntlmssp.sdescmd5) {
-                cERROR(1,
-                        "cifs_calculate_signature: can't generate signature\n");
-                return -1;
-        }
-
-        rc = crypto_shash_init(&server->ntlmssp.sdescmd5->shash);
-        if (rc) {
-                cERROR(1, "cifs_calculate_signature: oould not init md5\n");
-                return rc;
-        }
-
-        if (server->secType == RawNTLMSSP)
-                crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                        server->session_key.data.ntlmv2.key,
-                        CIFS_NTLMV2_SESSKEY_SIZE);
-        else
-                crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                        (char *)&server->session_key.data,
-                        server->session_key.len);
-
-        crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                        cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
+        cifs_MD5_init(&context);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
+        cifs_MD5_update(&context, cifs_pdu->Protocol, cifs_pdu->smb_buf_length);
 
-        rc = crypto_shash_final(&server->ntlmssp.sdescmd5->shash, signature);
-
-        return rc;
+        cifs_MD5_final(signature, &context);
+        return 0;
 }
 
-
 int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
                   __u32 *pexpected_response_sequence_number)
 {
@@ -101,7 +78,8 @@ int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
         server->sequence_number++;
         spin_unlock(&GlobalMid_Lock);
 
-        rc = cifs_calculate_signature(cifs_pdu, server, smb_signature);
+        rc = cifs_calculate_signature(cifs_pdu, &server->mac_signing_key,
+                                      smb_signature);
         if (rc)
                 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
         else
@@ -111,39 +89,21 @@ int cifs_sign_smb(struct smb_hdr *cifs_pdu, struct TCP_Server_Info *server,
 }
 
 static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
-                        struct TCP_Server_Info *server, char *signature)
+                                const struct mac_key *key, char *signature)
 {
+        struct  MD5Context context;
         int i;
-        int rc;
 
-        if (iov == NULL || server == NULL || signature == NULL)
+        if ((iov == NULL) || (signature == NULL) || (key == NULL))
                 return -EINVAL;
 
-        if (!server->ntlmssp.sdescmd5) {
-                cERROR(1, "cifs_calc_signature2: can't generate signature\n");
-                return -1;
-        }
-
-        rc = crypto_shash_init(&server->ntlmssp.sdescmd5->shash);
-        if (rc) {
-                cERROR(1, "cifs_calc_signature2: oould not init md5\n");
-                return rc;
-        }
-
-        if (server->secType == RawNTLMSSP)
-                crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                        server->session_key.data.ntlmv2.key,
-                        CIFS_NTLMV2_SESSKEY_SIZE);
-        else
-                crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                        (char *)&server->session_key.data,
-                        server->session_key.len);
-
+        cifs_MD5_init(&context);
+        cifs_MD5_update(&context, (char *)&key->data, key->len);
         for (i = 0; i < n_vec; i++) {
                 if (iov[i].iov_len == 0)
                         continue;
                 if (iov[i].iov_base == NULL) {
-                        cERROR(1, "cifs_calc_signature2: null iovec entry");
+                        cERROR(1, "null iovec entry");
                         return -EIO;
                 }
                 /* The first entry includes a length field (which does not get
@@ -151,18 +111,18 @@ static int cifs_calc_signature2(const struct kvec *iov, int n_vec,
                 if (i == 0) {
                         if (iov[0].iov_len <= 8) /* cmd field at offset 9 */
                                 break; /* nothing to sign or corrupt header */
-                        crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                                iov[i].iov_base + 4, iov[i].iov_len - 4);
+                        cifs_MD5_update(&context, iov[0].iov_base+4,
+                                  iov[0].iov_len-4);
                 } else
-                        crypto_shash_update(&server->ntlmssp.sdescmd5->shash,
-                                iov[i].iov_base, iov[i].iov_len);
+                        cifs_MD5_update(&context, iov[i].iov_base, iov[i].iov_len);
         }
 
-        rc = crypto_shash_final(&server->ntlmssp.sdescmd5->shash, signature);
+        cifs_MD5_final(signature, &context);
 
-        return rc;
+        return 0;
 }
 
+
 int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
                    __u32 *pexpected_response_sequence_number)
 {
@@ -185,7 +145,8 @@ int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
         server->sequence_number++;
         spin_unlock(&GlobalMid_Lock);
 
-        rc = cifs_calc_signature2(iov, n_vec, server, smb_signature);
+        rc = cifs_calc_signature2(iov, n_vec, &server->mac_signing_key,
+                                      smb_signature);
         if (rc)
                 memset(cifs_pdu->Signature.SecuritySignature, 0, 8);
         else
@@ -195,14 +156,14 @@ int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *server,
 }
 
 int cifs_verify_signature(struct smb_hdr *cifs_pdu,
-                          struct TCP_Server_Info *server,
+                          const struct mac_key *mac_key,
                           __u32 expected_sequence_number)
 {
-        int rc;
+        unsigned int rc;
         char server_response_sig[8];
         char what_we_think_sig_should_be[20];
 
-        if (cifs_pdu == NULL || server == NULL)
+        if ((cifs_pdu == NULL) || (mac_key == NULL))
                 return -EINVAL;
 
         if (cifs_pdu->Command == SMB_COM_NEGOTIATE)
@@ -231,7 +192,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
                                         cpu_to_le32(expected_sequence_number);
         cifs_pdu->Signature.Sequence.Reserved = 0;
 
-        rc = cifs_calculate_signature(cifs_pdu, server,
+        rc = cifs_calculate_signature(cifs_pdu, mac_key,
                 what_we_think_sig_should_be);
 
         if (rc)
@@ -248,7 +209,7 @@ int cifs_verify_signature(struct smb_hdr *cifs_pdu,
 }
 
 /* We fill in key by putting in 40 byte array which was allocated by caller */
-int cifs_calculate_session_key(struct session_key *key, const char *rn,
+int cifs_calculate_mac_key(struct mac_key *key, const char *rn,
                            const char *password)
 {
         char temp_key[16];
@@ -306,52 +267,38 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses,
 {
         int rc = 0;
         int len;
-        char nt_hash[CIFS_NTHASH_SIZE];
+        char nt_hash[16];
+        struct HMACMD5Context *pctxt;
         wchar_t *user;
         wchar_t *domain;
-        wchar_t *server;
 
-        if (!ses->server->ntlmssp.sdeschmacmd5) {
-                cERROR(1, "calc_ntlmv2_hash: can't generate ntlmv2 hash\n");
-                return -1;
-        }
+        pctxt = kmalloc(sizeof(struct HMACMD5Context), GFP_KERNEL);
+
+        if (pctxt == NULL)
+                return -ENOMEM;
 
         /* calculate md4 hash of password */
         E_md4hash(ses->password, nt_hash);
 
-        crypto_shash_setkey(ses->server->ntlmssp.hmacmd5, nt_hash,
-                                CIFS_NTHASH_SIZE);
-
-        rc = crypto_shash_init(&ses->server->ntlmssp.sdeschmacmd5->shash);
-        if (rc) {
-                cERROR(1, "calc_ntlmv2_hash: could not init hmacmd5\n");
-                return rc;
-        }
+        /* convert Domainname to unicode and uppercase */
+        hmac_md5_init_limK_to_64(nt_hash, 16, pctxt);
 
         /* convert ses->userName to unicode and uppercase */
         len = strlen(ses->userName);
         user = kmalloc(2 + (len * 2), GFP_KERNEL);
-        if (user == NULL) {
-                cERROR(1, "calc_ntlmv2_hash: user mem alloc failure\n");
-                rc = -ENOMEM;
+        if (user == NULL)
                 goto calc_exit_2;
-        }
         len = cifs_strtoUCS((__le16 *)user, ses->userName, len, nls_cp);
         UniStrupr(user);
-
-        crypto_shash_update(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                                (char *)user, 2 * len);
+        hmac_md5_update((char *)user, 2*len, pctxt);
 
         /* convert ses->domainName to unicode and uppercase */
         if (ses->domainName) {
                 len = strlen(ses->domainName);
 
                 domain = kmalloc(2 + (len * 2), GFP_KERNEL);
-                if (domain == NULL) {
-                        cERROR(1, "calc_ntlmv2_hash: domain mem alloc failure");
-                        rc = -ENOMEM;
+                if (domain == NULL)
                         goto calc_exit_1;
-                }
                 len = cifs_strtoUCS((__le16 *)domain, ses->domainName, len,
                                         nls_cp);
                 /* the following line was removed since it didn't work well
@@ -359,292 +306,65 @@ static int calc_ntlmv2_hash(struct cifsSesInfo *ses,
                    Maybe converting the domain name earlier makes sense */
                 /* UniStrupr(domain); */
 
-                crypto_shash_update(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                                        (char *)domain, 2 * len);
+                hmac_md5_update((char *)domain, 2*len, pctxt);
 
                 kfree(domain);
-        } else if (ses->serverName) {
-                len = strlen(ses->serverName);
-
-                server = kmalloc(2 + (len * 2), GFP_KERNEL);
-                if (server == NULL) {
-                        cERROR(1, "calc_ntlmv2_hash: server mem alloc failure");
-                        rc = -ENOMEM;
-                        goto calc_exit_1;
-                }
-                len = cifs_strtoUCS((__le16 *)server, ses->serverName, len,
-                                        nls_cp);
-                /* the following line was removed since it didn't work well
-                   with lower cased domain name that passed as an option.
-                   Maybe converting the domain name earlier makes sense */
-                /* UniStrupr(domain); */
-
-                crypto_shash_update(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                                        (char *)server, 2 * len);
-
-                kfree(server);
         }
-
-        rc = crypto_shash_final(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                                        ses->server->ntlmv2_hash);
-
 calc_exit_1:
         kfree(user);
 calc_exit_2:
         /* BB FIXME what about bytes 24 through 40 of the signing key?
            compare with the NTLM example */
+        hmac_md5_final(ses->server->ntlmv2_hash, pctxt);
 
+        kfree(pctxt);
         return rc;
 }
 
-static int
-find_domain_name(struct cifsSesInfo *ses)
-{
-        int rc = 0;
-        unsigned int attrsize;
-        unsigned int type;
-        unsigned char *blobptr;
-        struct ntlmssp2_name *attrptr;
-
-        if (ses->server->tiblob) {
-                blobptr = ses->server->tiblob;
-                attrptr = (struct ntlmssp2_name *) blobptr;
-
-                while ((type = attrptr->type) != 0) {
-                        blobptr += 2; /* advance attr type */
-                        attrsize = attrptr->length;
-                        blobptr += 2; /* advance attr size */
-                        if (type == NTLMSSP_AV_NB_DOMAIN_NAME) {
-                                if (!ses->domainName) {
-                                        ses->domainName =
-                                                kmalloc(attrptr->length + 1,
-                                                                GFP_KERNEL);
-                                        if (!ses->domainName)
-                                                        return -ENOMEM;
-                                        cifs_from_ucs2(ses->domainName,
-                                                (__le16 *)blobptr,
-                                                attrptr->length,
-                                                attrptr->length,
-                                                load_nls_default(), false);
-                                }
-                        }
-                        blobptr += attrsize; /* advance attr  value */
-                        attrptr = (struct ntlmssp2_name *) blobptr;
-                }
-        } else {
-                ses->server->tilen = 2 * sizeof(struct ntlmssp2_name);
-                ses->server->tiblob = kmalloc(ses->server->tilen, GFP_KERNEL);
-                if (!ses->server->tiblob) {
-                        ses->server->tilen = 0;
-                        cERROR(1, "Challenge target info allocation failure");
-                        return -ENOMEM;
-                }
-                memset(ses->server->tiblob, 0x0, ses->server->tilen);
-                attrptr = (struct ntlmssp2_name *) ses->server->tiblob;
-                attrptr->type = cpu_to_le16(NTLMSSP_DOMAIN_TYPE);
-        }
-
-        return rc;
-}
-
-static int
-CalcNTLMv2_response(const struct TCP_Server_Info *server,
-                         char *v2_session_response)
-{
-        int rc;
-
-        if (!server->ntlmssp.sdeschmacmd5) {
-                cERROR(1, "calc_ntlmv2_hash: can't generate ntlmv2 hash\n");
-                return -1;
-        }
-
-        crypto_shash_setkey(server->ntlmssp.hmacmd5, server->ntlmv2_hash,
-                CIFS_HMAC_MD5_HASH_SIZE);
-
-        rc = crypto_shash_init(&server->ntlmssp.sdeschmacmd5->shash);
-        if (rc) {
-                cERROR(1, "CalcNTLMv2_response: could not init hmacmd5");
-                return rc;
-        }
-
-        memcpy(v2_session_response + CIFS_SERVER_CHALLENGE_SIZE,
-                server->cryptKey, CIFS_SERVER_CHALLENGE_SIZE);
-        crypto_shash_update(&server->ntlmssp.sdeschmacmd5->shash,
-                v2_session_response + CIFS_SERVER_CHALLENGE_SIZE,
-                sizeof(struct ntlmv2_resp) - CIFS_SERVER_CHALLENGE_SIZE);
-
-        if (server->tilen)
-                crypto_shash_update(&server->ntlmssp.sdeschmacmd5->shash,
-                                        server->tiblob, server->tilen);
-
-        rc = crypto_shash_final(&server->ntlmssp.sdeschmacmd5->shash,
-                                        v2_session_response);
-
-        return rc;
-}
-
-int
-setup_ntlmv2_rsp(struct cifsSesInfo *ses, char *resp_buf,
+void setup_ntlmv2_rsp(struct cifsSesInfo *ses, char *resp_buf,
                       const struct nls_table *nls_cp)
 {
-        int rc = 0;
+        int rc;
         struct ntlmv2_resp *buf = (struct ntlmv2_resp *)resp_buf;
+        struct HMACMD5Context context;
 
         buf->blob_signature = cpu_to_le32(0x00000101);
         buf->reserved = 0;
         buf->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
         get_random_bytes(&buf->client_chal, sizeof(buf->client_chal));
         buf->reserved2 = 0;
-
-        if (!ses->domainName) {
-                rc = find_domain_name(ses);
-                if (rc) {
-                        cERROR(1, "could not get domain/server name rc %d", rc);
-                        return rc;
-                }
-        }
+        buf->names[0].type = cpu_to_le16(NTLMSSP_DOMAIN_TYPE);
+        buf->names[0].length = 0;
+        buf->names[1].type = 0;
+        buf->names[1].length = 0;
 
         /* calculate buf->ntlmv2_hash */
         rc = calc_ntlmv2_hash(ses, nls_cp);
-        if (rc) {
-                cERROR(1, "could not get v2 hash rc %d", rc);
-                return rc;
-        }
-        rc = CalcNTLMv2_response(ses->server, resp_buf);
-        if (rc) {
+        if (rc)
                 cERROR(1, "could not get v2 hash rc %d", rc);
-                return rc;
-        }
-
-        if (!ses->server->ntlmssp.sdeschmacmd5) {
-                cERROR(1, "calc_ntlmv2_hash: can't generate ntlmv2 hash\n");
-                return -1;
-        }
-
-        crypto_shash_setkey(ses->server->ntlmssp.hmacmd5,
-                        ses->server->ntlmv2_hash, CIFS_HMAC_MD5_HASH_SIZE);
+        CalcNTLMv2_response(ses, resp_buf);
 
-        rc = crypto_shash_init(&ses->server->ntlmssp.sdeschmacmd5->shash);
-        if (rc) {
-                cERROR(1, "setup_ntlmv2_rsp: could not init hmacmd5\n");
-                return rc;
-        }
+        /* now calculate the MAC key for NTLMv2 */
+        hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context);
+        hmac_md5_update(resp_buf, 16, &context);
+        hmac_md5_final(ses->server->mac_signing_key.data.ntlmv2.key, &context);
 
-        crypto_shash_update(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                                resp_buf, CIFS_HMAC_MD5_HASH_SIZE);
-
-        rc = crypto_shash_final(&ses->server->ntlmssp.sdeschmacmd5->shash,
-                ses->server->session_key.data.ntlmv2.key);
-
-        memcpy(&ses->server->session_key.data.ntlmv2.resp, resp_buf,
-                        sizeof(struct ntlmv2_resp));
-        ses->server->session_key.len = 16 + sizeof(struct ntlmv2_resp);
-
-        return rc;
+        memcpy(&ses->server->mac_signing_key.data.ntlmv2.resp, resp_buf,
+               sizeof(struct ntlmv2_resp));
+        ses->server->mac_signing_key.len = 16 + sizeof(struct ntlmv2_resp);
 }
 
-int
-calc_seckey(struct TCP_Server_Info *server)
-{
-        int rc;
-        unsigned char sec_key[CIFS_NTLMV2_SESSKEY_SIZE];
-        struct crypto_blkcipher *tfm_arc4;
-        struct scatterlist sgin, sgout;
-        struct blkcipher_desc desc;
-
-        get_random_bytes(sec_key, CIFS_NTLMV2_SESSKEY_SIZE);
-
-        tfm_arc4 = crypto_alloc_blkcipher("ecb(arc4)",
-                                                0, CRYPTO_ALG_ASYNC);
-        if (!tfm_arc4 || IS_ERR(tfm_arc4)) {
-                cERROR(1, "could not allocate " "master crypto API arc4\n");
-                return 1;
-        }
-
-        desc.tfm = tfm_arc4;
-
-        crypto_blkcipher_setkey(tfm_arc4,
-                server->session_key.data.ntlmv2.key, CIFS_CPHTXT_SIZE);
-        sg_init_one(&sgin, sec_key, CIFS_CPHTXT_SIZE);
-        sg_init_one(&sgout, server->ntlmssp.ciphertext, CIFS_CPHTXT_SIZE);
-        rc = crypto_blkcipher_encrypt(&desc, &sgout, &sgin, CIFS_CPHTXT_SIZE);
-
-        if (!rc)
-                memcpy(server->session_key.data.ntlmv2.key,
-                                sec_key, CIFS_NTLMV2_SESSKEY_SIZE);
-
-        crypto_free_blkcipher(tfm_arc4);
-
-        return 0;
-}
-
-void
-cifs_crypto_shash_release(struct TCP_Server_Info *server)
-{
-        if (server->ntlmssp.md5)
-                crypto_free_shash(server->ntlmssp.md5);
-
-        if (server->ntlmssp.hmacmd5)
-                crypto_free_shash(server->ntlmssp.hmacmd5);
-
-        kfree(server->ntlmssp.sdeschmacmd5);
-
-        kfree(server->ntlmssp.sdescmd5);
-}
-
-int
-cifs_crypto_shash_allocate(struct TCP_Server_Info *server)
+void CalcNTLMv2_response(const struct cifsSesInfo *ses,
+                         char *v2_session_response)
 {
-        int rc;
-        unsigned int size;
-
-        server->ntlmssp.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0);
-        if (!server->ntlmssp.hmacmd5 ||
-                        IS_ERR(server->ntlmssp.hmacmd5)) {
-                cERROR(1, "could not allocate crypto hmacmd5\n");
-                return 1;
-        }
-
-        server->ntlmssp.md5 = crypto_alloc_shash("md5", 0, 0);
-        if (!server->ntlmssp.md5 || IS_ERR(server->ntlmssp.md5)) {
-                cERROR(1, "could not allocate crypto md5\n");
-                rc = 1;
-                goto cifs_crypto_shash_allocate_ret1;
-        }
-
-        size = sizeof(struct shash_desc) +
-                        crypto_shash_descsize(server->ntlmssp.hmacmd5);
-        server->ntlmssp.sdeschmacmd5 = kmalloc(size, GFP_KERNEL);
-        if (!server->ntlmssp.sdeschmacmd5) {
-                cERROR(1, "cifs_crypto_shash_allocate: can't alloc hmacmd5\n");
-                rc = -ENOMEM;
-                goto cifs_crypto_shash_allocate_ret2;
-        }
-        server->ntlmssp.sdeschmacmd5->shash.tfm = server->ntlmssp.hmacmd5;
-        server->ntlmssp.sdeschmacmd5->shash.flags = 0x0;
+        struct HMACMD5Context context;
+        /* rest of v2 struct already generated */
+        memcpy(v2_session_response + 8, ses->server->cryptKey, 8);
+        hmac_md5_init_limK_to_64(ses->server->ntlmv2_hash, 16, &context);
 
+        hmac_md5_update(v2_session_response+8,
+                        sizeof(struct ntlmv2_resp) - 8, &context);
 
-        size = sizeof(struct shash_desc) +
-                        crypto_shash_descsize(server->ntlmssp.md5);
-        server->ntlmssp.sdescmd5 = kmalloc(size, GFP_KERNEL);
-        if (!server->ntlmssp.sdescmd5) {
-                cERROR(1, "cifs_crypto_shash_allocate: can't alloc md5\n");
-                rc = -ENOMEM;
-                goto cifs_crypto_shash_allocate_ret3;
-        }
-        server->ntlmssp.sdescmd5->shash.tfm = server->ntlmssp.md5;
-        server->ntlmssp.sdescmd5->shash.flags = 0x0;
-
-        return 0;
-
-cifs_crypto_shash_allocate_ret3:
-        kfree(server->ntlmssp.sdeschmacmd5);
-
-cifs_crypto_shash_allocate_ret2:
-        crypto_free_shash(server->ntlmssp.md5);
-
-cifs_crypto_shash_allocate_ret1:
-        crypto_free_shash(server->ntlmssp.hmacmd5);
-
-        return rc;
+        hmac_md5_final(v2_session_response, &context);
+/*      cifs_dump_mem("v2_sess_rsp: ", v2_session_response, 32); */
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index c9d0cfc086eb..0cdfb8c32ac6 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -25,9 +25,6 @@
 #include <linux/workqueue.h>
 #include "cifs_fs_sb.h"
 #include "cifsacl.h"
-#include <crypto/internal/hash.h>
-#include <linux/scatterlist.h>
-
 /*
  * The sizes of various internal tables and strings
  */
@@ -100,7 +97,7 @@ enum protocolEnum {
         /* Netbios frames protocol not supported at this time */
 };
 
-struct session_key {
+struct mac_key {
         unsigned int len;
         union {
                 char ntlm[CIFS_SESS_KEY_SIZE + 16];
@@ -123,21 +120,6 @@ struct cifs_cred {
         struct cifs_ace *aces;
 };
 
-struct sdesc {
-        struct shash_desc shash;
-        char ctx[];
-};
-
-struct ntlmssp_auth {
-        __u32 client_flags;
-        __u32 server_flags;
-        unsigned char ciphertext[CIFS_CPHTXT_SIZE];
-        struct crypto_shash *hmacmd5;
-        struct crypto_shash *md5;
-        struct sdesc *sdeschmacmd5;
-        struct sdesc *sdescmd5;
-};
-
 /*
  *****************************************************************
  * Except the CIFS PDUs themselves all the
@@ -200,14 +182,11 @@ struct TCP_Server_Info {
         /* 16th byte of RFC1001 workstation name is always null */
         char workstation_RFC1001_name[RFC1001_NAME_LEN_WITH_NULL];
         __u32 sequence_number; /* needed for CIFS PDU signature */
-        struct session_key session_key;
+        struct mac_key mac_signing_key;
         char ntlmv2_hash[16];
         unsigned long lstrp; /* when we got last response from this server */
         u16 dialect; /* dialect index that server chose */
         /* extended security flavors that server supports */
-        unsigned int tilen; /* length of the target info blob */
-        unsigned char *tiblob; /* target info blob in challenge response */
-        struct ntlmssp_auth ntlmssp; /* various keys, ciphers, flags */
         bool    sec_kerberos;           /* supports plain Kerberos */
         bool    sec_mskerberos;         /* supports legacy MS Kerberos */
         bool    sec_kerberosu2u;        /* supports U2U Kerberos */
diff --git a/fs/cifs/cifspdu.h b/fs/cifs/cifspdu.h
index 320e0fd0ba7b..14d036d8db11 100644
--- a/fs/cifs/cifspdu.h
+++ b/fs/cifs/cifspdu.h
@@ -134,12 +134,6 @@
  * Size of the session key (crypto key encrypted with the password
  */
 #define CIFS_SESS_KEY_SIZE (24)
-#define CIFS_CLIENT_CHALLENGE_SIZE (8)
-#define CIFS_SERVER_CHALLENGE_SIZE (8)
-#define CIFS_HMAC_MD5_HASH_SIZE (16)
-#define CIFS_CPHTXT_SIZE (16)
-#define CIFS_NTLMV2_SESSKEY_SIZE (16)
-#define CIFS_NTHASH_SIZE (16)
 
 /*
  * Maximum user name length
@@ -669,6 +663,7 @@ struct ntlmv2_resp {
         __le64  time;
         __u64  client_chal; /* random */
         __u32  reserved2;
+        struct ntlmssp2_name names[2];
         /* array of name entries could follow ending in minimum 4 byte struct */
 } __attribute__((packed));
 
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1378d9133844..1d60c655e3e0 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -87,8 +87,9 @@ extern unsigned int smbCalcSize_LE(struct smb_hdr *ptr);
 extern int decode_negTokenInit(unsigned char *security_blob, int length,
                         struct TCP_Server_Info *server);
 extern int cifs_convert_address(struct sockaddr *dst, const char *src, int len);
+extern int cifs_set_port(struct sockaddr *addr, const unsigned short int port);
 extern int cifs_fill_sockaddr(struct sockaddr *dst, const char *src, int len,
-                                unsigned short int port);
+                                const unsigned short int port);
 extern int map_smb_to_linux_error(struct smb_hdr *smb, int logErr);
 extern void header_assemble(struct smb_hdr *, char /* command */ ,
                             const struct cifsTconInfo *, int /* length of
@@ -361,15 +362,13 @@ extern int cifs_sign_smb(struct smb_hdr *, struct TCP_Server_Info *, __u32 *);
 extern int cifs_sign_smb2(struct kvec *iov, int n_vec, struct TCP_Server_Info *,
                           __u32 *);
 extern int cifs_verify_signature(struct smb_hdr *,
-                                 struct TCP_Server_Info *server,
+                                 const struct mac_key *mac_key,
                                 __u32 expected_sequence_number);
-extern int cifs_calculate_session_key(struct session_key *key, const char *rn,
+extern int cifs_calculate_mac_key(struct mac_key *key, const char *rn,
                                  const char *pass);
-extern int setup_ntlmv2_rsp(struct cifsSesInfo *, char *,
+extern void CalcNTLMv2_response(const struct cifsSesInfo *, char *);
+extern void setup_ntlmv2_rsp(struct cifsSesInfo *, char *,
                              const struct nls_table *);
-extern int cifs_crypto_shash_allocate(struct TCP_Server_Info *);
-extern void cifs_crypto_shash_release(struct TCP_Server_Info *);
-extern int calc_seckey(struct TCP_Server_Info *);
 #ifdef CONFIG_CIFS_WEAK_PW_HASH
 extern void calc_lanman_hash(const char *password, const char *cryptkey,
                                 bool encrypt, char *lnm_session_key);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 4bda920d1f75..c65c3419dd37 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -604,14 +604,11 @@ CIFSSMBNegotiate(unsigned int xid, struct cifsSesInfo *ses)
                         else
                                 rc = -EINVAL;
 
-                        if (server->secType == Kerberos) {
-                                if (!server->sec_kerberos &&
-                                                !server->sec_mskerberos)
-                                        rc = -EOPNOTSUPP;
-                        } else if (server->secType == RawNTLMSSP) {
-                                if (!server->sec_ntlmssp)
-                                        rc = -EOPNOTSUPP;
-                        } else
+                        if (server->sec_kerberos || server->sec_mskerberos)
+                                server->secType = Kerberos;
+                        else if (server->sec_ntlmssp)
+                                server->secType = RawNTLMSSP;
+                        else
                                 rc = -EOPNOTSUPP;
                 }
         } else
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index ec0ea4a43bdb..88c84a38bccb 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -400,7 +400,9 @@ incomplete_rcv:
                         cFYI(1, "call to reconnect done");
                         csocket = server->ssocket;
                         continue;
-                } else if ((length == -ERESTARTSYS) || (length == -EAGAIN)) {
+                } else if (length == -ERESTARTSYS ||
+                           length == -EAGAIN ||
+                           length == -EINTR) {
                         msleep(1); /* minimum sleep to prevent looping
                                 allowing socket to clear and app threads to set
                                 tcpStatus CifsNeedReconnect if server hung */
@@ -414,18 +416,6 @@ incomplete_rcv:
                         } else
                                 continue;
                 } else if (length <= 0) {
-                        if (server->tcpStatus == CifsNew) {
-                                cFYI(1, "tcp session abend after SMBnegprot");
-                                /* some servers kill the TCP session rather than
-                                   returning an SMB negprot error, in which
-                                   case reconnecting here is not going to help,
-                                   and so simply return error to mount */
-                                break;
-                        }
-                        if (!try_to_freeze() && (length == -EINTR)) {
-                                cFYI(1, "cifsd thread killed");
-                                break;
-                        }
                         cFYI(1, "Reconnect after unexpected peek error %d",
                                 length);
                         cifs_reconnect(server);
@@ -466,27 +456,19 @@ incomplete_rcv:
                            an error on SMB negprot response */
                         cFYI(1, "Negative RFC1002 Session Response Error 0x%x)",
                                 pdu_length);
-                        if (server->tcpStatus == CifsNew) {
-                                /* if nack on negprot (rather than
-                                ret of smb negprot error) reconnecting
-                                not going to help, ret error to mount */
-                                break;
-                        } else {
-                                /* give server a second to
-                                clean up before reconnect attempt */
-                                msleep(1000);
-                                /* always try 445 first on reconnect
-                                since we get NACK on some if we ever
-                                connected to port 139 (the NACK is
-                                since we do not begin with RFC1001
-                                session initialize frame) */
-                                server->addr.sockAddr.sin_port =
-                                        htons(CIFS_PORT);
-                                cifs_reconnect(server);
-                                csocket = server->ssocket;
-                                wake_up(&server->response_q);
-                                continue;
-                        }
+                        /* give server a second to clean up  */
+                        msleep(1000);
+                        /* always try 445 first on reconnect since we get NACK
+                         * on some if we ever connected to port 139 (the NACK
+                         * is since we do not begin with RFC1001 session
+                         * initialize frame)
+                         */
+                        cifs_set_port((struct sockaddr *)
+                                        &server->addr.sockAddr, CIFS_PORT);
+                        cifs_reconnect(server);
+                        csocket = server->ssocket;
+                        wake_up(&server->response_q);
+                        continue;
                 } else if (temp != (char) 0) {
                         cERROR(1, "Unknown RFC 1002 frame");
                         cifs_dump_mem(" Received Data: ", (char *)smb_buffer,
@@ -522,8 +504,7 @@ incomplete_rcv:
                      total_read += length) {
                         length = kernel_recvmsg(csocket, &smb_msg, &iov, 1,
                                                 pdu_length - total_read, 0);
-                        if ((server->tcpStatus == CifsExiting) ||
-                            (length == -EINTR)) {
+                        if (server->tcpStatus == CifsExiting) {
                                 /* then will exit */
                                 reconnect = 2;
                                 break;
@@ -534,8 +515,9 @@ incomplete_rcv:
                                 /* Now we will reread sock */
                                 reconnect = 1;
                                 break;
-                        } else if ((length == -ERESTARTSYS) ||
-                                   (length == -EAGAIN)) {
+                        } else if (length == -ERESTARTSYS ||
+                                   length == -EAGAIN ||
+                                   length == -EINTR) {
                                 msleep(1); /* minimum sleep to prevent looping,
                                               allowing socket to clear and app
                                               threads to set tcpStatus
@@ -1708,7 +1690,6 @@ cifs_put_smb_ses(struct cifsSesInfo *ses)
                 CIFSSMBLogoff(xid, ses);
                 _FreeXid(xid);
         }
-        cifs_crypto_shash_release(server);
         sesInfoFree(ses);
         cifs_put_tcp_session(server);
 }
@@ -1725,9 +1706,6 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         if (ses) {
                 cFYI(1, "Existing smb sess found (status=%d)", ses->status);
 
-                /* existing SMB ses has a server reference already */
-                cifs_put_tcp_session(server);
-
                 mutex_lock(&ses->session_mutex);
                 rc = cifs_negotiate_protocol(xid, ses);
                 if (rc) {
@@ -1750,6 +1728,9 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
                         }
                 }
                 mutex_unlock(&ses->session_mutex);
+
+                /* existing SMB ses has a server reference already */
+                cifs_put_tcp_session(server);
                 FreeXid(xid);
                 return ses;
         }
@@ -1788,23 +1769,13 @@ cifs_get_smb_ses(struct TCP_Server_Info *server, struct smb_vol *volume_info)
         ses->linux_uid = volume_info->linux_uid;
         ses->overrideSecFlg = volume_info->secFlg;
 
-        rc = cifs_crypto_shash_allocate(server);
-        if (rc) {
-                cERROR(1, "could not setup hash structures rc %d", rc);
-                goto get_ses_fail;
-        }
-        server->tilen = 0;
-        server->tiblob = NULL;
-
         mutex_lock(&ses->session_mutex);
         rc = cifs_negotiate_protocol(xid, ses);
         if (!rc)
                 rc = cifs_setup_session(xid, ses, volume_info->local_nls);
         mutex_unlock(&ses->session_mutex);
-        if (rc) {
-                cifs_crypto_shash_release(ses->server);
+        if (rc)
                 goto get_ses_fail;
-        }
 
         /* success, put it on the list */
         write_lock(&cifs_tcp_ses_lock);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 86a164f08a74..93f77d438d3c 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1462,29 +1462,18 @@ int cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
 {
         char *fromName = NULL;
         char *toName = NULL;
-        struct cifs_sb_info *cifs_sb_source;
-        struct cifs_sb_info *cifs_sb_target;
+        struct cifs_sb_info *cifs_sb;
         struct cifsTconInfo *tcon;
         FILE_UNIX_BASIC_INFO *info_buf_source = NULL;
         FILE_UNIX_BASIC_INFO *info_buf_target;
         int xid, rc, tmprc;
 
-        cifs_sb_target = CIFS_SB(target_dir->i_sb);
-        cifs_sb_source = CIFS_SB(source_dir->i_sb);
-        tcon = cifs_sb_source->tcon;
+        cifs_sb = CIFS_SB(source_dir->i_sb);
+        tcon = cifs_sb->tcon;
 
         xid = GetXid();
 
         /*
-         * BB: this might be allowed if same server, but different share.
-         * Consider adding support for this
-         */
-        if (tcon != cifs_sb_target->tcon) {
-                rc = -EXDEV;
-                goto cifs_rename_exit;
-        }
-
-        /*
          * we already have the rename sem so we do not need to
          * grab it again here to protect the path integrity
          */
@@ -1519,17 +1508,16 @@ int cifs_rename(struct inode *source_dir, struct dentry *source_dentry,
                 info_buf_target = info_buf_source + 1;
                 tmprc = CIFSSMBUnixQPathInfo(xid, tcon, fromName,
                                         info_buf_source,
-                                        cifs_sb_source->local_nls,
-                                        cifs_sb_source->mnt_cifs_flags &
+                                        cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
                 if (tmprc != 0)
                         goto unlink_target;
 
-                tmprc = CIFSSMBUnixQPathInfo(xid, tcon,
-                                        toName, info_buf_target,
-                                        cifs_sb_target->local_nls,
-                                        /* remap based on source sb */
-                                        cifs_sb_source->mnt_cifs_flags &
+                tmprc = CIFSSMBUnixQPathInfo(xid, tcon, toName,
+                                        info_buf_target,
+                                        cifs_sb->local_nls,
+                                        cifs_sb->mnt_cifs_flags &
                                         CIFS_MOUNT_MAP_SPECIAL_CHR);
 
                 if (tmprc == 0 && (info_buf_source->UniqueId ==
diff --git a/fs/cifs/netmisc.c b/fs/cifs/netmisc.c
index f97851119e6c..9aad47a2d62f 100644
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -206,26 +206,30 @@ cifs_convert_address(struct sockaddr *dst, const char *src, int len)
 }
 
 int
-cifs_fill_sockaddr(struct sockaddr *dst, const char *src, int len,
-                   const unsigned short int port)
+cifs_set_port(struct sockaddr *addr, const unsigned short int port)
 {
-        if (!cifs_convert_address(dst, src, len))
-                return 0;
-
-        switch (dst->sa_family) {
+        switch (addr->sa_family) {
         case AF_INET:
-                ((struct sockaddr_in *)dst)->sin_port = htons(port);
+                ((struct sockaddr_in *)addr)->sin_port = htons(port);
                 break;
         case AF_INET6:
-                ((struct sockaddr_in6 *)dst)->sin6_port = htons(port);
+                ((struct sockaddr_in6 *)addr)->sin6_port = htons(port);
                 break;
         default:
                 return 0;
         }
-
         return 1;
 }
 
+int
+cifs_fill_sockaddr(struct sockaddr *dst, const char *src, int len,
+                   const unsigned short int port)
+{
+        if (!cifs_convert_address(dst, src, len))
+                return 0;
+        return cifs_set_port(dst, port);
+}
+
 /*****************************************************************************
 convert a NT status code to a dos class/code
  *****************************************************************************/
diff --git a/fs/cifs/ntlmssp.h b/fs/cifs/ntlmssp.h
index 1db0f0746a5b..49c9a4e75319 100644
--- a/fs/cifs/ntlmssp.h
+++ b/fs/cifs/ntlmssp.h
@@ -61,19 +61,6 @@
 #define NTLMSSP_NEGOTIATE_KEY_XCH   0x40000000
 #define NTLMSSP_NEGOTIATE_56        0x80000000
 
-/* Define AV Pair Field IDs */
-#define NTLMSSP_AV_EOL                  0
-#define NTLMSSP_AV_NB_COMPUTER_NAME     1
-#define NTLMSSP_AV_NB_DOMAIN_NAME       2
-#define NTLMSSP_AV_DNS_COMPUTER_NAME    3
-#define NTLMSSP_AV_DNS_DOMAIN_NAME      4
-#define NTLMSSP_AV_DNS_TREE_NAME        5
-#define NTLMSSP_AV_FLAGS                6
-#define NTLMSSP_AV_TIMESTAMP            7
-#define NTLMSSP_AV_RESTRICTION          8
-#define NTLMSSP_AV_TARGET_NAME          9
-#define NTLMSSP_AV_CHANNEL_BINDINGS     10
-
 /* Although typedefs are not commonly used for structure definitions */
 /* in the Linux kernel, in this particular case they are useful      */
 /* to more closely match the standards document for NTLMSSP from     */
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 795095f4eac6..0a57cb7db5dd 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -383,9 +383,6 @@ static int decode_ascii_ssetup(char **pbcc_area, int bleft,
 static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
                                     struct cifsSesInfo *ses)
 {
-        unsigned int tioffset; /* challeng message target info area */
-        unsigned int tilen; /* challeng message target info area length  */
-
         CHALLENGE_MESSAGE *pblob = (CHALLENGE_MESSAGE *)bcc_ptr;
 
         if (blob_len < sizeof(CHALLENGE_MESSAGE)) {
@@ -408,20 +405,6 @@ static int decode_ntlmssp_challenge(char *bcc_ptr, int blob_len,
         /* BB spec says that if AvId field of MsvAvTimestamp is populated then
                 we must set the MIC field of the AUTHENTICATE_MESSAGE */
 
-        ses->server->ntlmssp.server_flags = le32_to_cpu(pblob->NegotiateFlags);
-
-        tioffset = cpu_to_le16(pblob->TargetInfoArray.BufferOffset);
-        tilen = cpu_to_le16(pblob->TargetInfoArray.Length);
-        ses->server->tilen = tilen;
-        if (tilen) {
-                ses->server->tiblob = kmalloc(tilen, GFP_KERNEL);
-                if (!ses->server->tiblob) {
-                        cERROR(1, "Challenge target info allocation failure");
-                        return -ENOMEM;
-                }
-                memcpy(ses->server->tiblob,  bcc_ptr + tioffset, tilen);
-        }
-
         return 0;
 }
 
@@ -442,13 +425,12 @@ static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
         /* BB is NTLMV2 session security format easier to use here? */
         flags = NTLMSSP_NEGOTIATE_56 |  NTLMSSP_REQUEST_TARGET |
                 NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
-                NTLMSSP_NEGOTIATE_NTLM;
+                NTLMSSP_NEGOTIATE_NT_ONLY | NTLMSSP_NEGOTIATE_NTLM;
         if (ses->server->secMode &
-           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
-                flags |= NTLMSSP_NEGOTIATE_SIGN |
-                        NTLMSSP_NEGOTIATE_KEY_XCH |
-                        NTLMSSP_NEGOTIATE_EXTENDED_SEC;
-        }
+           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+                flags |= NTLMSSP_NEGOTIATE_SIGN;
+        if (ses->server->secMode & SECMODE_SIGN_REQUIRED)
+                flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
 
         sec_blob->NegotiateFlags |= cpu_to_le32(flags);
 
@@ -469,12 +451,10 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                                    struct cifsSesInfo *ses,
                                    const struct nls_table *nls_cp, bool first)
 {
-        int rc;
-        unsigned int size;
         AUTHENTICATE_MESSAGE *sec_blob = (AUTHENTICATE_MESSAGE *)pbuffer;
         __u32 flags;
         unsigned char *tmp;
-        struct ntlmv2_resp ntlmv2_response = {};
+        char ntlm_session_key[CIFS_SESS_KEY_SIZE];
 
         memcpy(sec_blob->Signature, NTLMSSP_SIGNATURE, 8);
         sec_blob->MessageType = NtLmAuthenticate;
@@ -497,25 +477,19 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         sec_blob->LmChallengeResponse.Length = 0;
         sec_blob->LmChallengeResponse.MaximumLength = 0;
 
-        sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
-        rc = setup_ntlmv2_rsp(ses, (char *)&ntlmv2_response, nls_cp);
-        if (rc) {
-                cERROR(1, "error rc: %d during ntlmssp ntlmv2 setup", rc);
-                goto setup_ntlmv2_ret;
-        }
-        size =  sizeof(struct ntlmv2_resp);
-        memcpy(tmp, (char *)&ntlmv2_response, size);
-        tmp += size;
-        if (ses->server->tilen > 0) {
-                memcpy(tmp, ses->server->tiblob, ses->server->tilen);
-                tmp += ses->server->tilen;
-        } else
-                ses->server->tilen = 0;
+        /* calculate session key,  BB what about adding similar ntlmv2 path? */
+        SMBNTencrypt(ses->password, ses->server->cryptKey, ntlm_session_key);
+        if (first)
+                cifs_calculate_mac_key(&ses->server->mac_signing_key,
+                                       ntlm_session_key, ses->password);
 
-        sec_blob->NtChallengeResponse.Length = cpu_to_le16(size +
-                                ses->server->tilen);
+        memcpy(tmp, ntlm_session_key, CIFS_SESS_KEY_SIZE);
+        sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->NtChallengeResponse.Length = cpu_to_le16(CIFS_SESS_KEY_SIZE);
         sec_blob->NtChallengeResponse.MaximumLength =
-                cpu_to_le16(size + ses->server->tilen);
+                                cpu_to_le16(CIFS_SESS_KEY_SIZE);
+
+        tmp += CIFS_SESS_KEY_SIZE;
 
         if (ses->domainName == NULL) {
                 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
@@ -527,6 +501,7 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 len = cifs_strtoUCS((__le16 *)tmp, ses->domainName,
                                     MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
+                len += 2; /* trailing null */
                 sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->DomainName.Length = cpu_to_le16(len);
                 sec_blob->DomainName.MaximumLength = cpu_to_le16(len);
@@ -543,6 +518,7 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                 len = cifs_strtoUCS((__le16 *)tmp, ses->userName,
                                     MAX_USERNAME_SIZE, nls_cp);
                 len *= 2; /* unicode is 2 bytes each */
+                len += 2; /* trailing null */
                 sec_blob->UserName.BufferOffset = cpu_to_le32(tmp - pbuffer);
                 sec_blob->UserName.Length = cpu_to_le16(len);
                 sec_blob->UserName.MaximumLength = cpu_to_le16(len);
@@ -554,26 +530,9 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
         sec_blob->WorkstationName.MaximumLength = 0;
         tmp += 2;
 
-        if ((ses->server->ntlmssp.server_flags & NTLMSSP_NEGOTIATE_KEY_XCH) &&
-                        !calc_seckey(ses->server)) {
-                memcpy(tmp, ses->server->ntlmssp.ciphertext, CIFS_CPHTXT_SIZE);
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
-                sec_blob->SessionKey.Length = cpu_to_le16(CIFS_CPHTXT_SIZE);
-                sec_blob->SessionKey.MaximumLength =
-                        cpu_to_le16(CIFS_CPHTXT_SIZE);
-                tmp += CIFS_CPHTXT_SIZE;
-        } else {
-                sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
-                sec_blob->SessionKey.Length = 0;
-                sec_blob->SessionKey.MaximumLength = 0;
-        }
-
-        ses->server->sequence_number = 0;
-
-setup_ntlmv2_ret:
-        if (ses->server->tilen > 0)
-                kfree(ses->server->tiblob);
-
+        sec_blob->SessionKey.BufferOffset = cpu_to_le32(tmp - pbuffer);
+        sec_blob->SessionKey.Length = 0;
+        sec_blob->SessionKey.MaximumLength = 0;
         return tmp - pbuffer;
 }
 
@@ -587,14 +546,15 @@ static void setup_ntlmssp_neg_req(SESSION_SETUP_ANDX *pSMB,
         return;
 }
 
-static int setup_ntlmssp_auth_req(char *ntlmsspblob,
+static int setup_ntlmssp_auth_req(SESSION_SETUP_ANDX *pSMB,
                                   struct cifsSesInfo *ses,
                                   const struct nls_table *nls, bool first_time)
 {
         int bloblen;
 
-        bloblen = build_ntlmssp_auth_blob(ntlmsspblob, ses, nls,
+        bloblen = build_ntlmssp_auth_blob(&pSMB->req.SecurityBlob[0], ses, nls,
                                           first_time);
+        pSMB->req.SecurityBlobLength = cpu_to_le16(bloblen);
 
         return bloblen;
 }
@@ -730,7 +690,7 @@ ssetup_ntlmssp_authenticate:
 
                 if (first_time) /* should this be moved into common code
                                   with similar ntlmv2 path? */
-                        cifs_calculate_session_key(&ses->server->session_key,
+                        cifs_calculate_mac_key(&ses->server->mac_signing_key,
                                 ntlm_session_key, ses->password);
                 /* copy session key */
 
@@ -769,21 +729,12 @@ ssetup_ntlmssp_authenticate:
                         cpu_to_le16(sizeof(struct ntlmv2_resp));
 
                 /* calculate session key */
-                rc = setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
-                if (rc) {
-                        kfree(v2_sess_key);
-                        goto ssetup_exit;
-                }
+                setup_ntlmv2_rsp(ses, v2_sess_key, nls_cp);
                 /* FIXME: calculate MAC key */
                 memcpy(bcc_ptr, (char *)v2_sess_key,
                        sizeof(struct ntlmv2_resp));
                 bcc_ptr += sizeof(struct ntlmv2_resp);
                 kfree(v2_sess_key);
-                if (ses->server->tilen > 0) {
-                        memcpy(bcc_ptr, ses->server->tiblob,
-                                ses->server->tilen);
-                        bcc_ptr += ses->server->tilen;
-                }
                 if (ses->capabilities & CAP_UNICODE) {
                         if (iov[0].iov_len % 2) {
                                 *bcc_ptr = 0;
@@ -814,15 +765,15 @@ ssetup_ntlmssp_authenticate:
                 }
                 /* bail out if key is too long */
                 if (msg->sesskey_len >
-                    sizeof(ses->server->session_key.data.krb5)) {
+                    sizeof(ses->server->mac_signing_key.data.krb5)) {
                         cERROR(1, "Kerberos signing key too long (%u bytes)",
                                 msg->sesskey_len);
                         rc = -EOVERFLOW;
                         goto ssetup_exit;
                 }
                 if (first_time) {
-                        ses->server->session_key.len = msg->sesskey_len;
-                        memcpy(ses->server->session_key.data.krb5,
+                        ses->server->mac_signing_key.len = msg->sesskey_len;
+                        memcpy(ses->server->mac_signing_key.data.krb5,
                                 msg->data, msg->sesskey_len);
                 }
                 pSMB->req.hdr.Flags2 |= SMBFLG2_EXT_SEC;
@@ -864,28 +815,12 @@ ssetup_ntlmssp_authenticate:
                         if (phase == NtLmNegotiate) {
                                 setup_ntlmssp_neg_req(pSMB, ses);
                                 iov[1].iov_len = sizeof(NEGOTIATE_MESSAGE);
-                                iov[1].iov_base = &pSMB->req.SecurityBlob[0];
                         } else if (phase == NtLmAuthenticate) {
                                 int blob_len;
-                                char *ntlmsspblob;
-
-                                ntlmsspblob = kmalloc(5 *
-                                        sizeof(struct _AUTHENTICATE_MESSAGE),
-                                        GFP_KERNEL);
-                                if (!ntlmsspblob) {
-                                        cERROR(1, "Can't allocate NTLMSSP");
-                                        rc = -ENOMEM;
-                                        goto ssetup_exit;
-                                }
-
-                                blob_len = setup_ntlmssp_auth_req(ntlmsspblob,
-                                                                ses,
-                                                                nls_cp,
-                                                                first_time);
+                                blob_len = setup_ntlmssp_auth_req(pSMB, ses,
+                                                                  nls_cp,
+                                                                  first_time);
                                 iov[1].iov_len = blob_len;
-                                iov[1].iov_base = ntlmsspblob;
-                                pSMB->req.SecurityBlobLength =
-                                        cpu_to_le16(blob_len);
                                 /* Make sure that we tell the server that we
                                    are using the uid that it just gave us back
                                    on the response (challenge) */
@@ -895,6 +830,7 @@ ssetup_ntlmssp_authenticate:
                                 rc = -ENOSYS;
                                 goto ssetup_exit;
                         }
+                        iov[1].iov_base = &pSMB->req.SecurityBlob[0];
                         /* unicode strings must be word aligned */
                         if ((iov[0].iov_len + iov[1].iov_len) % 2) {
                                 *bcc_ptr = 0;
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index e0588cdf4cc5..82f78c4d6978 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -543,7 +543,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                     (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
                                              SECMODE_SIGN_ENABLED))) {
                         rc = cifs_verify_signature(midQ->resp_buf,
-                                                ses->server,
+                                                &ses->server->mac_signing_key,
                                                 midQ->sequence_number+1);
                         if (rc) {
                                 cERROR(1, "Unexpected SMB signature");
@@ -731,7 +731,7 @@ SendReceive(const unsigned int xid, struct cifsSesInfo *ses,
                     (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
                                              SECMODE_SIGN_ENABLED))) {
                         rc = cifs_verify_signature(out_buf,
-                                                ses->server,
+                                                &ses->server->mac_signing_key,
                                                 midQ->sequence_number+1);
                         if (rc) {
                                 cERROR(1, "Unexpected SMB signature");
@@ -981,7 +981,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifsTconInfo *tcon,
             (ses->server->secMode & (SECMODE_SIGN_REQUIRED |
                                      SECMODE_SIGN_ENABLED))) {
                 rc = cifs_verify_signature(out_buf,
-                                           ses->server,
+                                           &ses->server->mac_signing_key,
                                            midQ->sequence_number+1);
                 if (rc) {
                         cERROR(1, "Unexpected SMB signature");
diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index de89645777c7..116af7546cf0 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -184,8 +184,8 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
         }
 
         /* adjust outsize. is this useful ?? */
-        req->uc_outSize = nbytes;       
-        req->uc_flags |= REQ_WRITE;
+        req->uc_outSize = nbytes;
+        req->uc_flags |= CODA_REQ_WRITE;
         count = nbytes;
 
         /* Convert filedescriptor into a file handle */
diff --git a/fs/compat.c b/fs/compat.c
index 718c7062aec1..0644a154672b 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1153,7 +1153,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
 {
         compat_ssize_t tot_len;
         struct iovec iovstack[UIO_FASTIOV];
-        struct iovec *iov;
+        struct iovec *iov = iovstack;
         ssize_t ret;
         io_fn_t fn;
         iov_fn_t fnv;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 81e086d8aa57..5581122bd2c0 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -52,8 +52,6 @@ struct wb_writeback_work {
 #define CREATE_TRACE_POINTS
 #include <trace/events/writeback.h>
 
-#define inode_to_bdi(inode)     ((inode)->i_mapping->backing_dev_info)
-
 /*
  * We don't actually have pdflush, but this one is exported though /proc...
  */
@@ -71,6 +69,27 @@ int writeback_in_progress(struct backing_dev_info *bdi)
         return test_bit(BDI_writeback_running, &bdi->state);
 }
 
+static inline struct backing_dev_info *inode_to_bdi(struct inode *inode)
+{
+        struct super_block *sb = inode->i_sb;
+        struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
+
+        /*
+         * For inodes on standard filesystems, we use superblock's bdi. For
+         * inodes on virtual filesystems, we want to use inode mapping's bdi
+         * because they can possibly point to something useful (think about
+         * block_dev filesystem).
+         */
+        if (sb->s_bdi && sb->s_bdi != &noop_backing_dev_info) {
+                /* Some device inodes could play dirty tricks. Catch them... */
+                WARN(bdi != sb->s_bdi && bdi_cap_writeback_dirty(bdi),
+                        "Dirtiable inode bdi %s != sb bdi %s\n",
+                        bdi->name, sb->s_bdi->name);
+                return sb->s_bdi;
+        }
+        return bdi;
+}
+
 static void bdi_queue_work(struct backing_dev_info *bdi,
                 struct wb_writeback_work *work)
 {
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index cde1248a6225..ac750bd31a6f 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -932,7 +932,7 @@ int gfs2_logd(void *data)
 
                 do {
                         prepare_to_wait(&sdp->sd_logd_waitq, &wait,
-                                        TASK_UNINTERRUPTIBLE);
+                                        TASK_INTERRUPTIBLE);
                         if (!gfs2_ail_flush_reqd(sdp) &&
                             !gfs2_jrnl_flush_reqd(sdp) &&
                             !kthread_should_stop())
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 6c2aad49d731..f7e13db613cb 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -63,6 +63,7 @@ config NFS_V3_ACL
 config NFS_V4
         bool "NFS client support for NFS version 4"
         depends on NFS_FS
+        select SUNRPC_GSS
         help
           This option enables support for version 4 of the NFS protocol
           (RFC 3530) in the kernel's NFS client.
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 4e7df2adb212..e7340729af89 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -275,7 +275,7 @@ static int nfs_sockaddr_match_ipaddr6(const struct sockaddr *sa1,
             sin1->sin6_scope_id != sin2->sin6_scope_id)
                 return 0;
 
-        return ipv6_addr_equal(&sin1->sin6_addr, &sin1->sin6_addr);
+        return ipv6_addr_equal(&sin1->sin6_addr, &sin2->sin6_addr);
 }
 #else   /* !defined(CONFIG_IPV6) && !defined(CONFIG_IPV6_MODULE) */
 static int nfs_sockaddr_match_ipaddr6(const struct sockaddr *sa1,
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index eb51bd6201da..05bf3c0dc751 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -723,10 +723,6 @@ static int do_vfs_lock(struct file *file, struct file_lock *fl)
                 default:
                         BUG();
         }
-        if (res < 0)
-                dprintk(KERN_WARNING "%s: VFS is out of sync with lock manager"
-                        " - error %d!\n",
-                                __func__, res);
         return res;
 }
 
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ec3966e4706b..f4cbf0c306c6 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -431,7 +431,15 @@ static int nfs_statfs(struct dentry *dentry, struct kstatfs *buf)
                 goto out_err;
 
         error = server->nfs_client->rpc_ops->statfs(server, fh, &res);
+        if (unlikely(error == -ESTALE)) {
+                struct dentry *pd_dentry;
 
+                pd_dentry = dget_parent(dentry);
+                if (pd_dentry != NULL) {
+                        nfs_zap_caches(pd_dentry->d_inode);
+                        dput(pd_dentry);
+                }
+        }
         nfs_free_fattr(res.fattr);
         if (error < 0)
                 goto out_err;
diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index 95932f523aef..4264377552e2 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -69,6 +69,7 @@ config NFSD_V4
         depends on NFSD && PROC_FS && EXPERIMENTAL
         select NFSD_V3
         select FS_POSIX_ACL
+        select SUNRPC_GSS
         help
           This option enables support in your system's NFS server for
           version 4 of the NFS protocol (RFC 3530).
diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c
index a76e0aa5cd3f..391915093fe1 100644
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -209,7 +209,10 @@ static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh,
         }
 
         inode->i_mode = new_mode;
+        inode->i_ctime = CURRENT_TIME;
         di->i_mode = cpu_to_le16(inode->i_mode);
+        di->i_ctime = cpu_to_le64(inode->i_ctime.tv_sec);
+        di->i_ctime_nsec = cpu_to_le32(inode->i_ctime.tv_nsec);
 
         ocfs2_journal_dirty(handle, di_bh);
 
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 1361997cf205..cbe2f057cc28 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -977,7 +977,7 @@ static int o2net_tx_can_proceed(struct o2net_node *nn,
 int o2net_send_message_vec(u32 msg_type, u32 key, struct kvec *caller_vec,
                            size_t caller_veclen, u8 target_node, int *status)
 {
-        int ret;
+        int ret = 0;
         struct o2net_msg *msg = NULL;
         size_t veclen, caller_bytes = 0;
         struct kvec *vec = NULL;
diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c
index f04ebcfffc4a..c49f6de0e7ab 100644
--- a/fs/ocfs2/dir.c
+++ b/fs/ocfs2/dir.c
@@ -3931,6 +3931,15 @@ static int ocfs2_dx_dir_rebalance(struct ocfs2_super *osb, struct inode *dir,
                 goto out_commit;
         }
 
+        cpos = split_hash;
+        ret = ocfs2_dx_dir_new_cluster(dir, &et, cpos, handle,
+                                       data_ac, meta_ac, new_dx_leaves,
+                                       num_dx_leaves);
+        if (ret) {
+                mlog_errno(ret);
+                goto out_commit;
+        }
+
         for (i = 0; i < num_dx_leaves; i++) {
                 ret = ocfs2_journal_access_dl(handle, INODE_CACHE(dir),
                                               orig_dx_leaves[i],
@@ -3939,15 +3948,14 @@ static int ocfs2_dx_dir_rebalance(struct ocfs2_super *osb, struct inode *dir,
                         mlog_errno(ret);
                         goto out_commit;
                 }
-        }
 
-        cpos = split_hash;
-        ret = ocfs2_dx_dir_new_cluster(dir, &et, cpos, handle,
-                                       data_ac, meta_ac, new_dx_leaves,
-                                       num_dx_leaves);
-        if (ret) {
-                mlog_errno(ret);
-                goto out_commit;
+                ret = ocfs2_journal_access_dl(handle, INODE_CACHE(dir),
+                                              new_dx_leaves[i],
+                                              OCFS2_JOURNAL_ACCESS_WRITE);
+                if (ret) {
+                        mlog_errno(ret);
+                        goto out_commit;
+                }
         }
 
         ocfs2_dx_dir_transfer_leaf(dir, split_hash, handle, tmp_dx_leaf,
diff --git a/fs/ocfs2/dlm/dlmcommon.h b/fs/ocfs2/dlm/dlmcommon.h
index 4b6ae2c13b47..765298908f1d 100644
--- a/fs/ocfs2/dlm/dlmcommon.h
+++ b/fs/ocfs2/dlm/dlmcommon.h
@@ -1030,6 +1030,7 @@ int dlm_drop_lockres_ref(struct dlm_ctxt *dlm,
                          struct dlm_lock_resource *res);
 void dlm_clean_master_list(struct dlm_ctxt *dlm,
                            u8 dead_node);
+void dlm_force_free_mles(struct dlm_ctxt *dlm);
 int dlm_lock_basts_flushed(struct dlm_ctxt *dlm, struct dlm_lock *lock);
 int __dlm_lockres_has_locks(struct dlm_lock_resource *res);
 int __dlm_lockres_unused(struct dlm_lock_resource *res);
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 5efdd37dfe48..901ca52bf86b 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -636,8 +636,14 @@ static void *lockres_seq_start(struct seq_file *m, loff_t *pos)
         spin_lock(&dlm->track_lock);
         if (oldres)
                 track_list = &oldres->tracking;
-        else
+        else {
                 track_list = &dlm->tracking_list;
+                if (list_empty(track_list)) {
+                        dl = NULL;
+                        spin_unlock(&dlm->track_lock);
+                        goto bail;
+                }
+        }
 
         list_for_each_entry(res, track_list, tracking) {
                 if (&res->tracking == &dlm->tracking_list)
@@ -660,6 +666,7 @@ static void *lockres_seq_start(struct seq_file *m, loff_t *pos)
         } else
                 dl = NULL;
 
+bail:
         /* passed to seq_show */
         return dl;
 }
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 153abb5abef0..11a5c87fd7f7 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -693,6 +693,7 @@ void dlm_unregister_domain(struct dlm_ctxt *dlm)
 
                 dlm_mark_domain_leaving(dlm);
                 dlm_leave_domain(dlm);
+                dlm_force_free_mles(dlm);
                 dlm_complete_dlm_shutdown(dlm);
         }
         dlm_put(dlm);
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index ffb4c68dafa4..f564b0e5f80d 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -3433,3 +3433,43 @@ void dlm_lockres_release_ast(struct dlm_ctxt *dlm,
         wake_up(&res->wq);
         wake_up(&dlm->migration_wq);
 }
+
+void dlm_force_free_mles(struct dlm_ctxt *dlm)
+{
+        int i;
+        struct hlist_head *bucket;
+        struct dlm_master_list_entry *mle;
+        struct hlist_node *tmp, *list;
+
+        /*
+         * We notified all other nodes that we are exiting the domain and
+         * marked the dlm state to DLM_CTXT_LEAVING. If any mles are still
+         * around we force free them and wake any processes that are waiting
+         * on the mles
+         */
+        spin_lock(&dlm->spinlock);
+        spin_lock(&dlm->master_lock);
+
+        BUG_ON(dlm->dlm_state != DLM_CTXT_LEAVING);
+        BUG_ON((find_next_bit(dlm->domain_map, O2NM_MAX_NODES, 0) < O2NM_MAX_NODES));
+
+        for (i = 0; i < DLM_HASH_BUCKETS; i++) {
+                bucket = dlm_master_hash(dlm, i);
+                hlist_for_each_safe(list, tmp, bucket) {
+                        mle = hlist_entry(list, struct dlm_master_list_entry,
+                                          master_hash_node);
+                        if (mle->type != DLM_MLE_BLOCK) {
+                                mlog(ML_ERROR, "bad mle: %p\n", mle);
+                                dlm_print_one_mle(mle);
+                        }
+                        atomic_set(&mle->woken, 1);
+                        wake_up(&mle->wq);
+
+                        __dlm_unlink_mle(dlm, mle);
+                        __dlm_mle_detach_hb_events(dlm, mle);
+                        __dlm_put_mle(mle);
+                }
+        }
+        spin_unlock(&dlm->master_lock);
+        spin_unlock(&dlm->spinlock);
+}
diff --git a/fs/ocfs2/dlmglue.h b/fs/ocfs2/dlmglue.h
index d1ce48e1b3d6..1d596d8c4a4a 100644
--- a/fs/ocfs2/dlmglue.h
+++ b/fs/ocfs2/dlmglue.h
@@ -84,6 +84,7 @@ enum {
         OI_LS_PARENT,
         OI_LS_RENAME1,
         OI_LS_RENAME2,
+        OI_LS_REFLINK_TARGET,
 };
 
 int ocfs2_dlm_init(struct ocfs2_super *osb);
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 33f1c9a8258d..fa31d05e41b7 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -235,18 +235,31 @@
 #define OCFS2_HAS_REFCOUNT_FL   (0x0010)
 
 /* Inode attributes, keep in sync with EXT2 */
-#define OCFS2_SECRM_FL          (0x00000001)    /* Secure deletion */
-#define OCFS2_UNRM_FL           (0x00000002)    /* Undelete */
-#define OCFS2_COMPR_FL          (0x00000004)    /* Compress file */
-#define OCFS2_SYNC_FL           (0x00000008)    /* Synchronous updates */
-#define OCFS2_IMMUTABLE_FL      (0x00000010)    /* Immutable file */
-#define OCFS2_APPEND_FL         (0x00000020)    /* writes to file may only append */
-#define OCFS2_NODUMP_FL         (0x00000040)    /* do not dump file */
-#define OCFS2_NOATIME_FL        (0x00000080)    /* do not update atime */
-#define OCFS2_DIRSYNC_FL        (0x00010000)    /* dirsync behaviour (directories only) */
-
-#define OCFS2_FL_VISIBLE        (0x000100FF)    /* User visible flags */
-#define OCFS2_FL_MODIFIABLE     (0x000100FF)    /* User modifiable flags */
+#define OCFS2_SECRM_FL                  FS_SECRM_FL     /* Secure deletion */
+#define OCFS2_UNRM_FL                   FS_UNRM_FL      /* Undelete */
+#define OCFS2_COMPR_FL                  FS_COMPR_FL     /* Compress file */
+#define OCFS2_SYNC_FL                   FS_SYNC_FL      /* Synchronous updates */
+#define OCFS2_IMMUTABLE_FL              FS_IMMUTABLE_FL /* Immutable file */
+#define OCFS2_APPEND_FL                 FS_APPEND_FL    /* writes to file may only append */
+#define OCFS2_NODUMP_FL                 FS_NODUMP_FL    /* do not dump file */
+#define OCFS2_NOATIME_FL                FS_NOATIME_FL   /* do not update atime */
+/* Reserved for compression usage... */
+#define OCFS2_DIRTY_FL                  FS_DIRTY_FL
+#define OCFS2_COMPRBLK_FL               FS_COMPRBLK_FL  /* One or more compressed clusters */
+#define OCFS2_NOCOMP_FL                 FS_NOCOMP_FL    /* Don't compress */
+#define OCFS2_ECOMPR_FL                 FS_ECOMPR_FL    /* Compression error */
+/* End compression flags --- maybe not all used */
+#define OCFS2_BTREE_FL                  FS_BTREE_FL     /* btree format dir */
+#define OCFS2_INDEX_FL                  FS_INDEX_FL     /* hash-indexed directory */
+#define OCFS2_IMAGIC_FL                 FS_IMAGIC_FL    /* AFS directory */
+#define OCFS2_JOURNAL_DATA_FL           FS_JOURNAL_DATA_FL /* Reserved for ext3 */
+#define OCFS2_NOTAIL_FL                 FS_NOTAIL_FL    /* file tail should not be merged */
+#define OCFS2_DIRSYNC_FL                FS_DIRSYNC_FL   /* dirsync behaviour (directories only) */
+#define OCFS2_TOPDIR_FL                 FS_TOPDIR_FL    /* Top of directory hierarchies*/
+#define OCFS2_RESERVED_FL               FS_RESERVED_FL  /* reserved for ext2 lib */
+
+#define OCFS2_FL_VISIBLE                FS_FL_USER_VISIBLE      /* User visible flags */
+#define OCFS2_FL_MODIFIABLE             FS_FL_USER_MODIFIABLE   /* User modifiable flags */
 
 /*
  * Extent record flags (e_node.leaf.flags)
diff --git a/fs/ocfs2/ocfs2_ioctl.h b/fs/ocfs2/ocfs2_ioctl.h
index 2d3420af1a83..5d241505690b 100644
--- a/fs/ocfs2/ocfs2_ioctl.h
+++ b/fs/ocfs2/ocfs2_ioctl.h
@@ -23,10 +23,10 @@
 /*
  * ioctl commands
  */
-#define OCFS2_IOC_GETFLAGS      _IOR('f', 1, long)
-#define OCFS2_IOC_SETFLAGS      _IOW('f', 2, long)
-#define OCFS2_IOC32_GETFLAGS    _IOR('f', 1, int)
-#define OCFS2_IOC32_SETFLAGS    _IOW('f', 2, int)
+#define OCFS2_IOC_GETFLAGS      FS_IOC_GETFLAGS
+#define OCFS2_IOC_SETFLAGS      FS_IOC_SETFLAGS
+#define OCFS2_IOC32_GETFLAGS    FS_IOC32_GETFLAGS
+#define OCFS2_IOC32_SETFLAGS    FS_IOC32_SETFLAGS
 
 /*
  * Space reservation / allocation / free ioctls and argument structure
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 0afeda83120f..efdd75607406 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -4201,8 +4201,9 @@ static int __ocfs2_reflink(struct dentry *old_dentry,
                 goto out;
         }
 
-        mutex_lock(&new_inode->i_mutex);
-        ret = ocfs2_inode_lock(new_inode, &new_bh, 1);
+        mutex_lock_nested(&new_inode->i_mutex, I_MUTEX_CHILD);
+        ret = ocfs2_inode_lock_nested(new_inode, &new_bh, 1,
+                                      OI_LS_REFLINK_TARGET);
         if (ret) {
                 mlog_errno(ret);
                 goto out_unlock;
diff --git a/fs/ocfs2/reservations.c b/fs/ocfs2/reservations.c
index d8b6e4259b80..3e78db361bc7 100644
--- a/fs/ocfs2/reservations.c
+++ b/fs/ocfs2/reservations.c
@@ -732,25 +732,23 @@ int ocfs2_resmap_resv_bits(struct ocfs2_reservation_map *resmap,
                            struct ocfs2_alloc_reservation *resv,
                            int *cstart, int *clen)
 {
-        unsigned int wanted = *clen;
-
         if (resv == NULL || ocfs2_resmap_disabled(resmap))
                 return -ENOSPC;
 
         spin_lock(&resv_lock);
 
-        /*
-         * We don't want to over-allocate for temporary
-         * windows. Otherwise, we run the risk of fragmenting the
-         * allocation space.
-         */
-        wanted = ocfs2_resv_window_bits(resmap, resv);
-        if ((resv->r_flags & OCFS2_RESV_FLAG_TMP) || wanted < *clen)
-                wanted = *clen;
-
         if (ocfs2_resv_empty(resv)) {
-                mlog(0, "empty reservation, find new window\n");
+                /*
+                 * We don't want to over-allocate for temporary
+                 * windows. Otherwise, we run the risk of fragmenting the
+                 * allocation space.
+                 */
+                unsigned int wanted = ocfs2_resv_window_bits(resmap, resv);
 
+                if ((resv->r_flags & OCFS2_RESV_FLAG_TMP) || wanted < *clen)
+                        wanted = *clen;
+
+                mlog(0, "empty reservation, find new window\n");
                 /*
                  * Try to get a window here. If it works, we must fall
                  * through and test the bitmap . This avoids some
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 8a286f54dca1..849c2f0e0a0e 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -357,7 +357,7 @@ out:
 static void ocfs2_bg_discontig_add_extent(struct ocfs2_super *osb,
                                           struct ocfs2_group_desc *bg,
                                           struct ocfs2_chain_list *cl,
-                                          u64 p_blkno, u32 clusters)
+                                          u64 p_blkno, unsigned int clusters)
 {
         struct ocfs2_extent_list *el = &bg->bg_list;
         struct ocfs2_extent_rec *rec;
@@ -369,7 +369,7 @@ static void ocfs2_bg_discontig_add_extent(struct ocfs2_super *osb,
         rec->e_blkno = cpu_to_le64(p_blkno);
         rec->e_cpos = cpu_to_le32(le16_to_cpu(bg->bg_bits) /
                                   le16_to_cpu(cl->cl_bpc));
-        rec->e_leaf_clusters = cpu_to_le32(clusters);
+        rec->e_leaf_clusters = cpu_to_le16(clusters);
         le16_add_cpu(&bg->bg_bits, clusters * le16_to_cpu(cl->cl_bpc));
         le16_add_cpu(&bg->bg_free_bits_count,
                      clusters * le16_to_cpu(cl->cl_bpc));
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index d03469f61801..06fa5e77c40e 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -1286,13 +1286,11 @@ int ocfs2_xattr_get_nolock(struct inode *inode,
         xis.inode_bh = xbs.inode_bh = di_bh;
         di = (struct ocfs2_dinode *)di_bh->b_data;
 
-        down_read(&oi->ip_xattr_sem);
         ret = ocfs2_xattr_ibody_get(inode, name_index, name, buffer,
                                     buffer_size, &xis);
         if (ret == -ENODATA && di->i_xattr_loc)
                 ret = ocfs2_xattr_block_get(inode, name_index, name, buffer,
                                             buffer_size, &xbs);
-        up_read(&oi->ip_xattr_sem);
 
         return ret;
 }
@@ -1316,8 +1314,10 @@ static int ocfs2_xattr_get(struct inode *inode,
                 mlog_errno(ret);
                 return ret;
         }
+        down_read(&OCFS2_I(inode)->ip_xattr_sem);
         ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index,
                                      name, buffer, buffer_size);
+        up_read(&OCFS2_I(inode)->ip_xattr_sem);
 
         ocfs2_inode_unlock(inode, 0);
 
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 271afc48b9a5..1dbca4e8cc16 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -363,13 +363,13 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                         mss->referenced += PAGE_SIZE;
                 mapcount = page_mapcount(page);
                 if (mapcount >= 2) {
-                        if (pte_dirty(ptent))
+                        if (pte_dirty(ptent) || PageDirty(page))
                                 mss->shared_dirty += PAGE_SIZE;
                         else
                                 mss->shared_clean += PAGE_SIZE;
                         mss->pss += (PAGE_SIZE << PSS_SHIFT) / mapcount;
                 } else {
-                        if (pte_dirty(ptent))
+                        if (pte_dirty(ptent) || PageDirty(page))
                                 mss->private_dirty += PAGE_SIZE;
                         else
                                 mss->private_clean += PAGE_SIZE;
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 91c817ff02c3..2367fb3f70bc 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -163,7 +163,7 @@ static ssize_t read_vmcore(struct file *file, char __user *buffer,
 
 static const struct file_operations proc_vmcore_operations = {
         .read           = read_vmcore,
-        .llseek         = generic_file_llseek,
+        .llseek         = default_llseek,
 };
 
 static struct vmcore* __init get_new_element(void)
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index c9f3cc5949a8..3e5a51af757c 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -386,7 +386,15 @@ struct drm_connector_funcs {
         void (*dpms)(struct drm_connector *connector, int mode);
         void (*save)(struct drm_connector *connector);
         void (*restore)(struct drm_connector *connector);
-        enum drm_connector_status (*detect)(struct drm_connector *connector);
+
+        /* Check to see if anything is attached to the connector.
+         * @force is set to false whilst polling, true when checking the
+         * connector due to user request. @force can be used by the driver
+         * to avoid expensive, destructive operations during automated
+         * probing.
+         */
+        enum drm_connector_status (*detect)(struct drm_connector *connector,
+                                            bool force);
         int (*fill_modes)(struct drm_connector *connector, uint32_t max_width, uint32_t max_height);
         int (*set_property)(struct drm_connector *connector, struct drm_property *property,
                              uint64_t val);
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 9ddc8780e8db..5778b559d59c 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -360,5 +360,8 @@ extern ssize_t compat_rw_copy_check_uvector(int type,
                 const struct compat_iovec __user *uvector, unsigned long nr_segs,
                 unsigned long fast_segs, struct iovec *fast_pointer,
                 struct iovec **ret_pointer);
+
+extern void __user *compat_alloc_user_space(unsigned long len);
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index ce29b8151198..ba8319ae5fcc 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -102,6 +102,9 @@ static inline u64 dma_get_mask(struct device *dev)
         return DMA_BIT_MASK(32);
 }
 
+#ifdef ARCH_HAS_DMA_SET_COHERENT_MASK
+int dma_set_coherent_mask(struct device *dev, u64 mask);
+#else
 static inline int dma_set_coherent_mask(struct device *dev, u64 mask)
 {
         if (!dma_supported(dev, mask))
@@ -109,6 +112,7 @@ static inline int dma_set_coherent_mask(struct device *dev, u64 mask)
         dev->coherent_dma_mask = mask;
         return 0;
 }
+#endif
 
 extern u64 dma_get_required_mask(struct device *dev);
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 76041b614758..63d069bd80b7 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1093,6 +1093,10 @@ struct file_lock {
 
 #include <linux/fcntl.h>
 
+/* temporary stubs for BKL removal */
+#define lock_flocks() lock_kernel()
+#define unlock_flocks() unlock_kernel()
+
 extern void send_sigio(struct fown_struct *fown, int fd, int band);
 
 #ifdef CONFIG_FILE_LOCKING
diff --git a/include/linux/gpio.h b/include/linux/gpio.h
index 03f616b78cfa..e41f7dd1ae67 100644
--- a/include/linux/gpio.h
+++ b/include/linux/gpio.h
@@ -13,6 +13,7 @@
 #include <linux/errno.h>
 
 struct device;
+struct gpio_chip;
 
 /*
  * Some platforms don't support the GPIO programming interface.
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index 791d5109f34c..50d8009be86c 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -63,20 +63,20 @@ static inline bool netpoll_rx(struct sk_buff *skb)
         unsigned long flags;
         bool ret = false;
 
-        rcu_read_lock_bh();
+        local_irq_save(flags);
         npinfo = rcu_dereference_bh(skb->dev->npinfo);
 
         if (!npinfo || (list_empty(&npinfo->rx_np) && !npinfo->rx_flags))
                 goto out;
 
-        spin_lock_irqsave(&npinfo->rx_lock, flags);
+        spin_lock(&npinfo->rx_lock);
         /* check rx_flags again with the lock held */
         if (npinfo->rx_flags && __netpoll_rx(skb))
                 ret = true;
-        spin_unlock_irqrestore(&npinfo->rx_lock, flags);
+        spin_unlock(&npinfo->rx_lock);
 
 out:
-        rcu_read_unlock_bh();
+        local_irq_restore(flags);
         return ret;
 }
 
diff --git a/include/linux/quotaops.h b/include/linux/quotaops.h
index d50ba858cfe0..d1a9193960f1 100644
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -274,8 +274,14 @@ static inline int dquot_alloc_space(struct inode *inode, qsize_t nr)
         int ret;
 
         ret = dquot_alloc_space_nodirty(inode, nr);
-        if (!ret)
-                mark_inode_dirty_sync(inode);
+        if (!ret) {
+                /*
+                 * Mark inode fully dirty. Since we are allocating blocks, inode
+                 * would become fully dirty soon anyway and it reportedly
+                 * reduces inode_lock contention.
+                 */
+                mark_inode_dirty(inode);
+        }
         return ret;
 }
 
diff --git a/include/linux/spi/dw_spi.h b/include/linux/spi/dw_spi.h
index cc813f95a2f2..c91302f3a257 100644
--- a/include/linux/spi/dw_spi.h
+++ b/include/linux/spi/dw_spi.h
@@ -14,7 +14,9 @@
 #define SPI_MODE_OFFSET                 6
 #define SPI_SCPH_OFFSET                 6
 #define SPI_SCOL_OFFSET                 7
+
 #define SPI_TMOD_OFFSET                 8
+#define SPI_TMOD_MASK                   (0x3 << SPI_TMOD_OFFSET)
 #define SPI_TMOD_TR                     0x0             /* xmit & recv */
 #define SPI_TMOD_TO                     0x1             /* xmit only */
 #define SPI_TMOD_RO                     0x2             /* recv only */
diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h
index 569dc722a600..85f38a63f098 100644
--- a/include/linux/sunrpc/clnt.h
+++ b/include/linux/sunrpc/clnt.h
@@ -30,7 +30,7 @@ struct rpc_inode;
  * The high-level client handle
  */
 struct rpc_clnt {
-        struct kref             cl_kref;        /* Number of references */
+        atomic_t                cl_count;       /* Number of references */
         struct list_head        cl_clients;     /* Global list of clients */
         struct list_head        cl_tasks;       /* List of tasks */
         spinlock_t              cl_lock;        /* spinlock */
diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
index f11100f96482..25e02c941bac 100644
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -235,6 +235,10 @@ static inline unsigned int work_static(struct work_struct *work) { return 0; }
 #define work_clear_pending(work) \
         clear_bit(WORK_STRUCT_PENDING_BIT, work_data_bits(work))
 
+/*
+ * Workqueue flags and constants.  For details, please refer to
+ * Documentation/workqueue.txt.
+ */
 enum {
         WQ_NON_REENTRANT        = 1 << 0, /* guarantee non-reentrance */
         WQ_UNBOUND              = 1 << 1, /* not bound to any cpu */
diff --git a/include/net/tcp.h b/include/net/tcp.h
index eaa9582779d0..3e4b33e36602 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -475,8 +475,22 @@ extern unsigned int tcp_current_mss(struct sock *sk);
 /* Bound MSS / TSO packet size with the half of the window */
 static inline int tcp_bound_to_half_wnd(struct tcp_sock *tp, int pktsize)
 {
-        if (tp->max_window && pktsize > (tp->max_window >> 1))
-                return max(tp->max_window >> 1, 68U - tp->tcp_header_len);
+        int cutoff;
+
+        /* When peer uses tiny windows, there is no use in packetizing
+         * to sub-MSS pieces for the sake of SWS or making sure there
+         * are enough packets in the pipe for fast recovery.
+         *
+         * On the other hand, for extremely large MSS devices, handling
+         * smaller than MSS windows in this way does make sense.
+         */
+        if (tp->max_window >= 512)
+                cutoff = (tp->max_window >> 1);
+        else
+                cutoff = tp->max_window;
+
+        if (cutoff && pktsize > cutoff)
+                return max_t(int, cutoff, 68U - tp->tcp_header_len);
         else
                 return pktsize;
 }
diff --git a/kernel/compat.c b/kernel/compat.c
index e167efce8423..c9e2ec0b34a8 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -1126,3 +1126,24 @@ compat_sys_sysinfo(struct compat_sysinfo __user *info)
 
         return 0;
 }
+
+/*
+ * Allocate user-space memory for the duration of a single system call,
+ * in order to marshall parameters inside a compat thunk.
+ */
+void __user *compat_alloc_user_space(unsigned long len)
+{
+        void __user *ptr;
+
+        /* If len would occupy more than half of the entire compat space... */
+        if (unlikely(len > (((compat_uptr_t)~0) >> 1)))
+                return NULL;
+
+        ptr = arch_compat_alloc_user_space(len);
+
+        if (unlikely(!access_ok(VERIFY_WRITE, ptr, len)))
+                return NULL;
+
+        return ptr;
+}
+EXPORT_SYMBOL_GPL(compat_alloc_user_space);
diff --git a/kernel/fork.c b/kernel/fork.c
index b7e9d60a675d..c445f8cc408d 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -356,10 +356,10 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
                 if (IS_ERR(pol))
                         goto fail_nomem_policy;
                 vma_set_policy(tmp, pol);
+                tmp->vm_mm = mm;
                 if (anon_vma_fork(tmp, mpnt))
                         goto fail_nomem_anon_vma_fork;
                 tmp->vm_flags &= ~VM_LOCKED;
-                tmp->vm_mm = mm;
                 tmp->vm_next = tmp->vm_prev = NULL;
                 file = tmp->vm_file;
                 if (file) {
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
index d71a987fd2bf..c7c2aed9e2dc 100644
--- a/kernel/hw_breakpoint.c
+++ b/kernel/hw_breakpoint.c
@@ -433,7 +433,8 @@ register_user_hw_breakpoint(struct perf_event_attr *attr,
                             perf_overflow_handler_t triggered,
                             struct task_struct *tsk)
 {
-        return perf_event_create_kernel_counter(attr, -1, tsk->pid, triggered);
+        return perf_event_create_kernel_counter(attr, -1, task_pid_vnr(tsk),
+                                                triggered);
 }
 EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
 
diff --git a/kernel/sched.c b/kernel/sched.c
index ed09d4f2a69c..dc85ceb90832 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3513,9 +3513,9 @@ void task_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
         rtime = nsecs_to_cputime(p->se.sum_exec_runtime);
 
         if (total) {
-                u64 temp;
+                u64 temp = rtime;
 
-                temp = (u64)(rtime * utime);
+                temp *= utime;
                 do_div(temp, total);
                 utime = (cputime_t)temp;
         } else
@@ -3546,9 +3546,9 @@ void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *st)
         rtime = nsecs_to_cputime(cputime.sum_exec_runtime);
 
         if (total) {
-                u64 temp;
+                u64 temp = rtime;
 
-                temp = (u64)(rtime * cputime.utime);
+                temp *= cputime.utime;
                 do_div(temp, total);
                 utime = (cputime_t)temp;
         } else
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 9b5b4f86b742..db3f674ca49d 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -54,13 +54,13 @@ enum sched_tunable_scaling sysctl_sched_tunable_scaling
  * Minimal preemption granularity for CPU-bound tasks:
  * (default: 2 msec * (1 + ilog(ncpus)), units: nanoseconds)
  */
-unsigned int sysctl_sched_min_granularity = 2000000ULL;
-unsigned int normalized_sysctl_sched_min_granularity = 2000000ULL;
+unsigned int sysctl_sched_min_granularity = 750000ULL;
+unsigned int normalized_sysctl_sched_min_granularity = 750000ULL;
 
 /*
  * is kept at sysctl_sched_latency / sysctl_sched_min_granularity
  */
-static unsigned int sched_nr_latency = 3;
+static unsigned int sched_nr_latency = 8;
 
 /*
  * After fork, child runs first. If set to 0 (default) then
@@ -3630,7 +3630,7 @@ static inline int nohz_kick_needed(struct rq *rq, int cpu)
         if (time_before(now, nohz.next_balance))
                 return 0;
 
-        if (!rq->nr_running)
+        if (rq->idle_at_tick)
                 return 0;
 
         first_pick_cpu = atomic_read(&nohz.first_pick_cpu);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 727f24e563ae..f77afd939229 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1,19 +1,26 @@
 /*
- * linux/kernel/workqueue.c
+ * kernel/workqueue.c - generic async execution with shared worker pool
  *
- * Generic mechanism for defining kernel helper threads for running
- * arbitrary tasks in process context.
+ * Copyright (C) 2002           Ingo Molnar
  *
- * Started by Ingo Molnar, Copyright (C) 2002
+ *   Derived from the taskqueue/keventd code by:
+ *     David Woodhouse <dwmw2@infradead.org>
+ *     Andrew Morton
+ *     Kai Petzke <wpp@marie.physik.tu-berlin.de>
+ *     Theodore Ts'o <tytso@mit.edu>
  *
- * Derived from the taskqueue/keventd code by:
+ * Made to use alloc_percpu by Christoph Lameter.
  *
- *   David Woodhouse <dwmw2@infradead.org>
- *   Andrew Morton
- *   Kai Petzke <wpp@marie.physik.tu-berlin.de>
- *   Theodore Ts'o <tytso@mit.edu>
+ * Copyright (C) 2010           SUSE Linux Products GmbH
+ * Copyright (C) 2010           Tejun Heo <tj@kernel.org>
  *
- * Made to use alloc_percpu by Christoph Lameter.
+ * This is the generic async execution mechanism.  Work items as are
+ * executed in process context.  The worker pool is shared and
+ * automatically managed.  There is one worker pool for each CPU and
+ * one extra for works which are better served by workers which are
+ * not bound to any specific CPU.
+ *
+ * Please read Documentation/workqueue.txt for details.
  */
 
 #include <linux/module.h>
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index c2bf86f470ed..65d420499a61 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -30,6 +30,7 @@ EXPORT_SYMBOL_GPL(default_backing_dev_info);
 
 struct backing_dev_info noop_backing_dev_info = {
         .name           = "noop",
+        .capabilities   = BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 EXPORT_SYMBOL_GPL(noop_backing_dev_info);
 
@@ -243,6 +244,7 @@ static int __init default_bdi_init(void)
         err = bdi_init(&default_backing_dev_info);
         if (!err)
                 bdi_register(&default_backing_dev_info, NULL, "default");
+        err = bdi_init(&noop_backing_dev_info);
 
         return err;
 }
diff --git a/mm/fremap.c b/mm/fremap.c
index 46f5dacf90a2..7b7f852848de 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -125,7 +125,6 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
 {
         struct mm_struct *mm = current->mm;
         struct address_space *mapping;
-        unsigned long end = start + size;
         struct vm_area_struct *vma;
         int err = -EINVAL;
         int has_write_lock = 0;
@@ -168,7 +167,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
         if (!(vma->vm_flags & VM_CAN_NONLINEAR))
                 goto out;
 
-        if (end <= start || start < vma->vm_start || end > vma->vm_end)
+        if (start < vma->vm_start || start + size > vma->vm_end)
                 goto out;
 
         /* Must set VM_NONLINEAR before any pages are populated. */
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index cc5be788a39f..c03273807182 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2324,11 +2324,8 @@ retry_avoidcopy:
          * and just make the page writable */
         avoidcopy = (page_mapcount(old_page) == 1);
         if (avoidcopy) {
-                if (!trylock_page(old_page)) {
-                        if (PageAnon(old_page))
-                                page_move_anon_rmap(old_page, vma, address);
-                } else
-                        unlock_page(old_page);
+                if (PageAnon(old_page))
+                        page_move_anon_rmap(old_page, vma, address);
                 set_huge_ptep_writable(vma, address, ptep);
                 return 0;
         }
@@ -2404,7 +2401,7 @@ retry_avoidcopy:
                 set_huge_pte_at(mm, address, ptep,
                                 make_huge_pte(vma, new_page, 1));
                 page_remove_rmap(old_page);
-                hugepage_add_anon_rmap(new_page, vma, address);
+                hugepage_add_new_anon_rmap(new_page, vma, address);
                 /* Make the old page be freed below */
                 new_page = old_page;
                 mmu_notifier_invalidate_range_end(mm,
@@ -2631,10 +2628,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                                                                 vma, address);
         }
 
-        if (!pagecache_page) {
-                page = pte_page(entry);
+        /*
+         * hugetlb_cow() requires page locks of pte_page(entry) and
+         * pagecache_page, so here we need take the former one
+         * when page != pagecache_page or !pagecache_page.
+         * Note that locking order is always pagecache_page -> page,
+         * so no worry about deadlock.
+         */
+        page = pte_page(entry);
+        if (page != pagecache_page)
                 lock_page(page);
-        }
 
         spin_lock(&mm->page_table_lock);
         /* Check for a racing update before calling hugetlb_cow */
@@ -2661,9 +2664,8 @@ out_page_table_lock:
         if (pagecache_page) {
                 unlock_page(pagecache_page);
                 put_page(pagecache_page);
-        } else {
-                unlock_page(page);
         }
+        unlock_page(page);
 
 out_mutex:
         mutex_unlock(&hugetlb_instantiation_mutex);
diff --git a/mm/memory.c b/mm/memory.c
index 71b161b73bb5..0e18b4d649ec 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2680,10 +2680,12 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
         delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
 
         /*
-         * Make sure try_to_free_swap didn't release the swapcache
-         * from under us. The page pin isn't enough to prevent that.
+         * Make sure try_to_free_swap or reuse_swap_page or swapoff did not
+         * release the swapcache from under us.  The page pin, and pte_same
+         * test below, are not enough to exclude that.  Even if it is still
+         * swapcache, we need to check that the page's swap has not changed.
          */
-        if (unlikely(!PageSwapCache(page)))
+        if (unlikely(!PageSwapCache(page) || page_private(page) != entry.val))
                 goto out_page;
 
         if (ksm_might_need_to_copy(page, vma, address)) {
diff --git a/mm/mmap.c b/mm/mmap.c
index 6128dc8e5ede..00161a48a451 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2009,6 +2009,7 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
                         removed_exe_file_vma(mm);
                 fput(new->vm_file);
         }
+        unlink_anon_vmas(new);
  out_free_mpol:
         mpol_put(pol);
  out_free_vma:
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index fc81cb22869e..4029583a1024 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -121,8 +121,8 @@ struct task_struct *find_lock_task_mm(struct task_struct *p)
 }
 
 /* return true if the task is not adequate as candidate victim task. */
-static bool oom_unkillable_task(struct task_struct *p, struct mem_cgroup *mem,
-                           const nodemask_t *nodemask)
+static bool oom_unkillable_task(struct task_struct *p,
+                const struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
         if (is_global_init(p))
                 return true;
@@ -208,8 +208,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
          */
         points += p->signal->oom_score_adj;
 
-        if (points < 0)
-                return 0;
+        /*
+         * Never return 0 for an eligible task that may be killed since it's
+         * possible that no single user task uses more than 0.1% of memory and
+         * no single admin tasks uses more than 3.0%.
+         */
+        if (points <= 0)
+                return 1;
         return (points < 1000) ? points : 1000;
 }
 
@@ -339,26 +344,24 @@ static struct task_struct *select_bad_process(unsigned int *ppoints,
 /**
  * dump_tasks - dump current memory state of all system tasks
  * @mem: current's memory controller, if constrained
+ * @nodemask: nodemask passed to page allocator for mempolicy ooms
  *
- * Dumps the current memory state of all system tasks, excluding kernel threads.
+ * Dumps the current memory state of all eligible tasks.  Tasks not in the same
+ * memcg, not in the same cpuset, or bound to a disjoint set of mempolicy nodes
+ * are not shown.
  * State information includes task's pid, uid, tgid, vm size, rss, cpu, oom_adj
  * value, oom_score_adj value, and name.
  *
- * If the actual is non-NULL, only tasks that are a member of the mem_cgroup are
- * shown.
- *
  * Call with tasklist_lock read-locked.
  */
-static void dump_tasks(const struct mem_cgroup *mem)
+static void dump_tasks(const struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
         struct task_struct *p;
         struct task_struct *task;
 
         pr_info("[ pid ]   uid  tgid total_vm      rss cpu oom_adj oom_score_adj name\n");
         for_each_process(p) {
-                if (p->flags & PF_KTHREAD)
-                        continue;
-                if (mem && !task_in_mem_cgroup(p, mem))
+                if (oom_unkillable_task(p, mem, nodemask))
                         continue;
 
                 task = find_lock_task_mm(p);
@@ -381,7 +384,7 @@ static void dump_tasks(const struct mem_cgroup *mem)
 }
 
 static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
-                                                        struct mem_cgroup *mem)
+                        struct mem_cgroup *mem, const nodemask_t *nodemask)
 {
         task_lock(current);
         pr_warning("%s invoked oom-killer: gfp_mask=0x%x, order=%d, "
@@ -394,7 +397,7 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
         mem_cgroup_print_oom_info(mem, p);
         show_mem();
         if (sysctl_oom_dump_tasks)
-                dump_tasks(mem);
+                dump_tasks(mem, nodemask);
 }
 
 #define K(x) ((x) << (PAGE_SHIFT-10))
@@ -436,7 +439,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
         unsigned int victim_points = 0;
 
         if (printk_ratelimit())
-                dump_header(p, gfp_mask, order, mem);
+                dump_header(p, gfp_mask, order, mem, nodemask);
 
         /*
          * If the task is already exiting, don't alarm the sysadmin or kill
@@ -482,7 +485,7 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
  * Determines whether the kernel must panic because of the panic_on_oom sysctl.
  */
 static void check_panic_on_oom(enum oom_constraint constraint, gfp_t gfp_mask,
-                                int order)
+                                int order, const nodemask_t *nodemask)
 {
         if (likely(!sysctl_panic_on_oom))
                 return;
@@ -496,7 +499,7 @@ static void check_panic_on_oom(enum oom_constraint constraint, gfp_t gfp_mask,
                         return;
         }
         read_lock(&tasklist_lock);
-        dump_header(NULL, gfp_mask, order, NULL);
+        dump_header(NULL, gfp_mask, order, NULL, nodemask);
         read_unlock(&tasklist_lock);
         panic("Out of memory: %s panic_on_oom is enabled\n",
                 sysctl_panic_on_oom == 2 ? "compulsory" : "system-wide");
@@ -509,7 +512,7 @@ void mem_cgroup_out_of_memory(struct mem_cgroup *mem, gfp_t gfp_mask)
         unsigned int points = 0;
         struct task_struct *p;
 
-        check_panic_on_oom(CONSTRAINT_MEMCG, gfp_mask, 0);
+        check_panic_on_oom(CONSTRAINT_MEMCG, gfp_mask, 0, NULL);
         limit = mem_cgroup_get_limit(mem) >> PAGE_SHIFT;
         read_lock(&tasklist_lock);
 retry:
@@ -641,6 +644,7 @@ static void clear_system_oom(void)
 void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
                 int order, nodemask_t *nodemask)
 {
+        const nodemask_t *mpol_mask;
         struct task_struct *p;
         unsigned long totalpages;
         unsigned long freed = 0;
@@ -670,7 +674,8 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
          */
         constraint = constrained_alloc(zonelist, gfp_mask, nodemask,
                                                 &totalpages);
-        check_panic_on_oom(constraint, gfp_mask, order);
+        mpol_mask = (constraint == CONSTRAINT_MEMORY_POLICY) ? nodemask : NULL;
+        check_panic_on_oom(constraint, gfp_mask, order, mpol_mask);
 
         read_lock(&tasklist_lock);
         if (sysctl_oom_kill_allocating_task &&
@@ -688,15 +693,13 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask,
         }
 
 retry:
-        p = select_bad_process(&points, totalpages, NULL,
-                        constraint == CONSTRAINT_MEMORY_POLICY ? nodemask :
-                                                                 NULL);
+        p = select_bad_process(&points, totalpages, NULL, mpol_mask);
         if (PTR_ERR(p) == -1UL)
                 goto out;
 
         /* Found nothing?!?! Either we hang forever, or we panic. */
         if (!p) {
-                dump_header(NULL, gfp_mask, order, NULL);
+                dump_header(NULL, gfp_mask, order, NULL, mpol_mask);
                 read_unlock(&tasklist_lock);
                 panic("Out of memory and no killable processes...\n");
         }
diff --git a/mm/percpu.c b/mm/percpu.c
index 58c572b18b07..c76ef3891e0d 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1401,9 +1401,9 @@ int __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
 
                         if (pcpu_first_unit_cpu == NR_CPUS)
                                 pcpu_first_unit_cpu = cpu;
+                        pcpu_last_unit_cpu = cpu;
                 }
         }
-        pcpu_last_unit_cpu = cpu;
         pcpu_nr_units = unit;
 
         for_each_possible_cpu(cpu)
diff --git a/mm/rmap.c b/mm/rmap.c
index f6f0d2dda2ea..9d2ba01bd4f9 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1564,13 +1564,14 @@ static void __hugepage_set_anon_rmap(struct page *page,
         struct vm_area_struct *vma, unsigned long address, int exclusive)
 {
         struct anon_vma *anon_vma = vma->anon_vma;
+
         BUG_ON(!anon_vma);
-        if (!exclusive) {
-                struct anon_vma_chain *avc;
-                avc = list_entry(vma->anon_vma_chain.prev,
-                                 struct anon_vma_chain, same_vma);
-                anon_vma = avc->anon_vma;
-        }
+
+        if (PageAnon(page))
+                return;
+        if (!exclusive)
+                anon_vma = anon_vma->root;
+
         anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
         page->mapping = (struct address_space *) anon_vma;
         page->index = linear_page_index(vma, address);
@@ -1581,6 +1582,8 @@ void hugepage_add_anon_rmap(struct page *page,
 {
         struct anon_vma *anon_vma = vma->anon_vma;
         int first;
+
+        BUG_ON(!PageLocked(page));
         BUG_ON(!anon_vma);
         BUG_ON(address < vma->vm_start || address >= vma->vm_end);
         first = atomic_inc_and_test(&page->_mapcount);
diff --git a/mm/vmscan.c b/mm/vmscan.c
index c391c320dbaf..c5dfabf25f11 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1804,12 +1804,11 @@ static void shrink_zone(int priority, struct zone *zone,
  * If a zone is deemed to be full of pinned pages then just give it a light
  * scan then give up on it.
  */
-static bool shrink_zones(int priority, struct zonelist *zonelist,
+static void shrink_zones(int priority, struct zonelist *zonelist,
                                         struct scan_control *sc)
 {
         struct zoneref *z;
         struct zone *zone;
-        bool all_unreclaimable = true;
 
         for_each_zone_zonelist_nodemask(zone, z, zonelist,
                                         gfp_zone(sc->gfp_mask), sc->nodemask) {
@@ -1827,8 +1826,38 @@ static bool shrink_zones(int priority, struct zonelist *zonelist,
                 }
 
                 shrink_zone(priority, zone, sc);
-                all_unreclaimable = false;
         }
+}
+
+static bool zone_reclaimable(struct zone *zone)
+{
+        return zone->pages_scanned < zone_reclaimable_pages(zone) * 6;
+}
+
+/*
+ * As hibernation is going on, kswapd is freezed so that it can't mark
+ * the zone into all_unreclaimable. It can't handle OOM during hibernation.
+ * So let's check zone's unreclaimable in direct reclaim as well as kswapd.
+ */
+static bool all_unreclaimable(struct zonelist *zonelist,
+                struct scan_control *sc)
+{
+        struct zoneref *z;
+        struct zone *zone;
+        bool all_unreclaimable = true;
+
+        for_each_zone_zonelist_nodemask(zone, z, zonelist,
+                        gfp_zone(sc->gfp_mask), sc->nodemask) {
+                if (!populated_zone(zone))
+                        continue;
+                if (!cpuset_zone_allowed_hardwall(zone, GFP_KERNEL))
+                        continue;
+                if (zone_reclaimable(zone)) {
+                        all_unreclaimable = false;
+                        break;
+                }
+        }
+
         return all_unreclaimable;
 }
 
@@ -1852,7 +1881,6 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                                         struct scan_control *sc)
 {
         int priority;
-        bool all_unreclaimable;
         unsigned long total_scanned = 0;
         struct reclaim_state *reclaim_state = current->reclaim_state;
         struct zoneref *z;
@@ -1869,7 +1897,7 @@ static unsigned long do_try_to_free_pages(struct zonelist *zonelist,
                 sc->nr_scanned = 0;
                 if (!priority)
                         disable_swap_token();
-                all_unreclaimable = shrink_zones(priority, zonelist, sc);
+                shrink_zones(priority, zonelist, sc);
                 /*
                  * Don't shrink slabs when reclaiming memory from
                  * over limit cgroups
@@ -1931,7 +1959,7 @@ out:
                 return sc->nr_reclaimed;
 
         /* top priority shrink_zones still had more to do? don't OOM, then */
-        if (scanning_global_lru(sc) && !all_unreclaimable)
+        if (scanning_global_lru(sc) && !all_unreclaimable(zonelist, sc))
                 return 1;
 
         return 0;
@@ -2197,8 +2225,7 @@ loop_again:
                         total_scanned += sc.nr_scanned;
                         if (zone->all_unreclaimable)
                                 continue;
-                        if (nr_slab == 0 &&
-                            zone->pages_scanned >= (zone_reclaimable_pages(zone) * 6))
+                        if (nr_slab == 0 && !zone_reclaimable(zone))
                                 zone->all_unreclaimable = 1;
                         /*
                          * If we've done a decent amount of scanning and
diff --git a/net/9p/client.c b/net/9p/client.c
index dc6f2f26d023..9eb72505308f 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -331,8 +331,10 @@ static void p9_tag_cleanup(struct p9_client *c)
                 }
         }
 
-        if (c->tagpool)
+        if (c->tagpool) {
+                p9_idpool_put(0, c->tagpool); /* free reserved tag 0 */
                 p9_idpool_destroy(c->tagpool);
+        }
 
         /* free requests associated with tags */
         for (row = 0; row < (c->max_tag/P9_ROW_MAXTAG); row++) {
@@ -944,6 +946,7 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
         int16_t nwqids, count;
 
         err = 0;
+        wqids = NULL;
         clnt = oldfid->clnt;
         if (clone) {
                 fid = p9_fid_create(clnt);
@@ -994,9 +997,11 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
         else
                 fid->qid = oldfid->qid;
 
+        kfree(wqids);
         return fid;
 
 clunk_fid:
+        kfree(wqids);
         p9_client_clunk(fid);
         fid = NULL;
 
diff --git a/net/Kconfig b/net/Kconfig
index e330594d3709..e926884c1675 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -217,7 +217,7 @@ source "net/dns_resolver/Kconfig"
 
 config RPS
         boolean
-        depends on SMP && SYSFS
+        depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
         default y
 
 menu "Network testing"
diff --git a/net/core/dev.c b/net/core/dev.c
index b9b22a3c4c8f..660dd41aaaa6 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4845,7 +4845,7 @@ static void rollback_registered_many(struct list_head *head)
         dev = list_first_entry(head, struct net_device, unreg_list);
         call_netdevice_notifiers(NETDEV_UNREGISTER_BATCH, dev);
 
-        synchronize_net();
+        rcu_barrier();
 
         list_for_each_entry(dev, head, unreg_list)
                 dev_put(dev);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index a1ad0e7180d2..1fdcacd36ce7 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -834,7 +834,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
         int                     mark = 0;
 
 
-        if (len == 8) {
+        if (len == 8 || IGMP_V2_SEEN(in_dev)) {
                 if (ih->code == 0) {
                         /* Alas, old v1 router presents here. */
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 6c40a8c46e79..64b70ad162e3 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1129,6 +1129,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
         case IP_HDRINCL:
                 val = inet->hdrincl;
                 break;
+        case IP_NODEFRAG:
+                val = inet->nodefrag;
+                break;
         case IP_MTU_DISCOVER:
                 val = inet->pmtudisc;
                 break;
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 023ba820236f..582612998211 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -1024,7 +1024,8 @@ static int llc_ui_setsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct llc_sock *llc = llc_sk(sk);
-        int rc = -EINVAL, opt;
+        unsigned int opt;
+        int rc = -EINVAL;
 
         lock_sock(sk);
         if (unlikely(level != SOL_LLC || optlen != sizeof(int)))
diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c
index e4dae0244d76..cf4aea3ba30f 100644
--- a/net/llc/llc_station.c
+++ b/net/llc/llc_station.c
@@ -689,7 +689,7 @@ static void llc_station_rcv(struct sk_buff *skb)
 
 int __init llc_station_init(void)
 {
-        u16 rc = -ENOBUFS;
+        int rc = -ENOBUFS;
         struct sk_buff *skb;
         struct llc_station_state_ev *ev;
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 340662789529..6318e1136b83 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -255,10 +255,6 @@ static int atm_tc_change(struct Qdisc *sch, u32 classid, u32 parent,
                         error = -EINVAL;
                         goto err_out;
                 }
-                if (!list_empty(&flow->list)) {
-                        error = -EEXIST;
-                        goto err_out;
-                }
         } else {
                 int i;
                 unsigned long cl;
diff --git a/net/sctp/output.c b/net/sctp/output.c
index a646681f5acd..bcc4590ccaf2 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -92,7 +92,6 @@ struct sctp_packet *sctp_packet_config(struct sctp_packet *packet,
         SCTP_DEBUG_PRINTK("%s: packet:%p vtag:0x%x\n", __func__,
                           packet, vtag);
 
-        sctp_packet_reset(packet);
         packet->vtag = vtag;
 
         if (ecn_capable && sctp_packet_empty(packet)) {
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 36cb66022a27..e9eaaf7d43c1 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -38,7 +38,7 @@ static const struct rpc_authops *auth_flavors[RPC_AUTH_MAXFLAVOR] = {
 static LIST_HEAD(cred_unused);
 static unsigned long number_cred_unused;
 
-#define MAX_HASHTABLE_BITS (10) 
+#define MAX_HASHTABLE_BITS (14)
 static int param_set_hashtbl_sz(const char *val, const struct kernel_param *kp)
 {
         unsigned long num;
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index dcfc66bab2bb..12c485982814 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -745,17 +745,18 @@ gss_pipe_release(struct inode *inode)
         struct rpc_inode *rpci = RPC_I(inode);
         struct gss_upcall_msg *gss_msg;
 
+restart:
         spin_lock(&inode->i_lock);
-        while (!list_empty(&rpci->in_downcall)) {
+        list_for_each_entry(gss_msg, &rpci->in_downcall, list) {
 
-                gss_msg = list_entry(rpci->in_downcall.next,
-                                struct gss_upcall_msg, list);
+                if (!list_empty(&gss_msg->msg.list))
+                        continue;
                 gss_msg->msg.errno = -EPIPE;
                 atomic_inc(&gss_msg->count);
                 __gss_unhash_msg(gss_msg);
                 spin_unlock(&inode->i_lock);
                 gss_release_msg(gss_msg);
-                spin_lock(&inode->i_lock);
+                goto restart;
         }
         spin_unlock(&inode->i_lock);
 
diff --git a/net/sunrpc/auth_gss/gss_krb5_mech.c b/net/sunrpc/auth_gss/gss_krb5_mech.c
index 032644610524..778e5dfc5144 100644
--- a/net/sunrpc/auth_gss/gss_krb5_mech.c
+++ b/net/sunrpc/auth_gss/gss_krb5_mech.c
@@ -237,6 +237,7 @@ get_key(const void *p, const void *end,
         if (!supported_gss_krb5_enctype(alg)) {
                 printk(KERN_WARNING "gss_kerberos_mech: unsupported "
                         "encryption key algorithm %d\n", alg);
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
         }
         p = simple_get_netobj(p, end, &key);
@@ -282,15 +283,19 @@ gss_import_v1_context(const void *p, const void *end, struct krb5_ctx *ctx)
         ctx->enctype = ENCTYPE_DES_CBC_RAW;
 
         ctx->gk5e = get_gss_krb5_enctype(ctx->enctype);
-        if (ctx->gk5e == NULL)
+        if (ctx->gk5e == NULL) {
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
+        }
 
         /* The downcall format was designed before we completely understood
          * the uses of the context fields; so it includes some stuff we
          * just give some minimal sanity-checking, and some we ignore
          * completely (like the next twenty bytes): */
-        if (unlikely(p + 20 > end || p + 20 < p))
+        if (unlikely(p + 20 > end || p + 20 < p)) {
+                p = ERR_PTR(-EFAULT);
                 goto out_err;
+        }
         p += 20;
         p = simple_get_bytes(p, end, &tmp, sizeof(tmp));
         if (IS_ERR(p))
@@ -619,6 +624,7 @@ gss_import_v2_context(const void *p, const void *end, struct krb5_ctx *ctx,
         if (ctx->seq_send64 != ctx->seq_send) {
                 dprintk("%s: seq_send64 %lx, seq_send %x overflow?\n", __func__,
                         (long unsigned)ctx->seq_send64, ctx->seq_send);
+                p = ERR_PTR(-EINVAL);
                 goto out_err;
         }
         p = simple_get_bytes(p, end, &ctx->enctype, sizeof(ctx->enctype));
diff --git a/net/sunrpc/auth_gss/gss_spkm3_mech.c b/net/sunrpc/auth_gss/gss_spkm3_mech.c
index dc3f1f5ed865..adade3d313f2 100644
--- a/net/sunrpc/auth_gss/gss_spkm3_mech.c
+++ b/net/sunrpc/auth_gss/gss_spkm3_mech.c
@@ -100,6 +100,7 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
         if (version != 1) {
                 dprintk("RPC:       unknown spkm3 token format: "
                                 "obsolete nfs-utils?\n");
+                p = ERR_PTR(-EINVAL);
                 goto out_err_free_ctx;
         }
 
@@ -135,8 +136,10 @@ gss_import_sec_context_spkm3(const void *p, size_t len,
         if (IS_ERR(p))
                 goto out_err_free_intg_alg;
 
-        if (p != end)
+        if (p != end) {
+                p = ERR_PTR(-EFAULT);
                 goto out_err_free_intg_key;
+        }
 
         ctx_id->internal_ctx_id = ctx;
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 2388d83b68ff..fa5549079d79 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -226,7 +226,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
                         goto out_no_principal;
         }
 
-        kref_init(&clnt->cl_kref);
+        atomic_set(&clnt->cl_count, 1);
 
         err = rpc_setup_pipedir(clnt, program->pipe_dir_name);
         if (err < 0)
@@ -390,14 +390,14 @@ rpc_clone_client(struct rpc_clnt *clnt)
                 if (new->cl_principal == NULL)
                         goto out_no_principal;
         }
-        kref_init(&new->cl_kref);
+        atomic_set(&new->cl_count, 1);
         err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
         if (err != 0)
                 goto out_no_path;
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
         xprt_get(clnt->cl_xprt);
-        kref_get(&clnt->cl_kref);
+        atomic_inc(&clnt->cl_count);
         rpc_register_client(new);
         rpciod_up();
         return new;
@@ -465,10 +465,8 @@ EXPORT_SYMBOL_GPL(rpc_shutdown_client);
  * Free an RPC client
  */
 static void
-rpc_free_client(struct kref *kref)
+rpc_free_client(struct rpc_clnt *clnt)
 {
-        struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref);
-
         dprintk("RPC:       destroying %s client for %s\n",
                         clnt->cl_protname, clnt->cl_server);
         if (!IS_ERR(clnt->cl_path.dentry)) {
@@ -495,12 +493,10 @@ out_free:
  * Free an RPC client
  */
 static void
-rpc_free_auth(struct kref *kref)
+rpc_free_auth(struct rpc_clnt *clnt)
 {
-        struct rpc_clnt *clnt = container_of(kref, struct rpc_clnt, cl_kref);
-
         if (clnt->cl_auth == NULL) {
-                rpc_free_client(kref);
+                rpc_free_client(clnt);
                 return;
         }
 
@@ -509,10 +505,11 @@ rpc_free_auth(struct kref *kref)
          *       release remaining GSS contexts. This mechanism ensures
          *       that it can do so safely.
          */
-        kref_init(kref);
+        atomic_inc(&clnt->cl_count);
         rpcauth_release(clnt->cl_auth);
         clnt->cl_auth = NULL;
-        kref_put(kref, rpc_free_client);
+        if (atomic_dec_and_test(&clnt->cl_count))
+                rpc_free_client(clnt);
 }
 
 /*
@@ -525,7 +522,8 @@ rpc_release_client(struct rpc_clnt *clnt)
 
         if (list_empty(&clnt->cl_tasks))
                 wake_up(&destroy_wait);
-        kref_put(&clnt->cl_kref, rpc_free_auth);
+        if (atomic_dec_and_test(&clnt->cl_count))
+                rpc_free_auth(clnt);
 }
 
 /**
@@ -588,7 +586,7 @@ void rpc_task_set_client(struct rpc_task *task, struct rpc_clnt *clnt)
         if (clnt != NULL) {
                 rpc_task_release_client(task);
                 task->tk_client = clnt;
-                kref_get(&clnt->cl_kref);
+                atomic_inc(&clnt->cl_count);
                 if (clnt->cl_softrtry)
                         task->tk_flags |= RPC_TASK_SOFT;
                 /* Add to the client's list of all tasks */
@@ -931,7 +929,7 @@ call_reserveresult(struct rpc_task *task)
         task->tk_status = 0;
         if (status >= 0) {
                 if (task->tk_rqstp) {
-                        task->tk_action = call_allocate;
+                        task->tk_action = call_refresh;
                         return;
                 }
 
@@ -966,13 +964,54 @@ call_reserveresult(struct rpc_task *task)
 }
 
 /*
- * 2.   Allocate the buffer. For details, see sched.c:rpc_malloc.
+ * 2.   Bind and/or refresh the credentials
+ */
+static void
+call_refresh(struct rpc_task *task)
+{
+        dprint_status(task);
+
+        task->tk_action = call_refreshresult;
+        task->tk_status = 0;
+        task->tk_client->cl_stats->rpcauthrefresh++;
+        rpcauth_refreshcred(task);
+}
+
+/*
+ * 2a.  Process the results of a credential refresh
+ */
+static void
+call_refreshresult(struct rpc_task *task)
+{
+        int status = task->tk_status;
+
+        dprint_status(task);
+
+        task->tk_status = 0;
+        task->tk_action = call_allocate;
+        if (status >= 0 && rpcauth_uptodatecred(task))
+                return;
+        switch (status) {
+        case -EACCES:
+                rpc_exit(task, -EACCES);
+                return;
+        case -ENOMEM:
+                rpc_exit(task, -ENOMEM);
+                return;
+        case -ETIMEDOUT:
+                rpc_delay(task, 3*HZ);
+        }
+        task->tk_action = call_refresh;
+}
+
+/*
+ * 2b.  Allocate the buffer. For details, see sched.c:rpc_malloc.
  *      (Note: buffer memory is freed in xprt_release).
  */
 static void
 call_allocate(struct rpc_task *task)
 {
-        unsigned int slack = task->tk_client->cl_auth->au_cslack;
+        unsigned int slack = task->tk_rqstp->rq_cred->cr_auth->au_cslack;
         struct rpc_rqst *req = task->tk_rqstp;
         struct rpc_xprt *xprt = task->tk_xprt;
         struct rpc_procinfo *proc = task->tk_msg.rpc_proc;
@@ -980,7 +1019,7 @@ call_allocate(struct rpc_task *task)
         dprint_status(task);
 
         task->tk_status = 0;
-        task->tk_action = call_refresh;
+        task->tk_action = call_bind;
 
         if (req->rq_buffer)
                 return;
@@ -1017,47 +1056,6 @@ call_allocate(struct rpc_task *task)
         rpc_exit(task, -ERESTARTSYS);
 }
 
-/*
- * 2a.  Bind and/or refresh the credentials
- */
-static void
-call_refresh(struct rpc_task *task)
-{
-        dprint_status(task);
-
-        task->tk_action = call_refreshresult;
-        task->tk_status = 0;
-        task->tk_client->cl_stats->rpcauthrefresh++;
-        rpcauth_refreshcred(task);
-}
-
-/*
- * 2b.  Process the results of a credential refresh
- */
-static void
-call_refreshresult(struct rpc_task *task)
-{
-        int status = task->tk_status;
-
-        dprint_status(task);
-
-        task->tk_status = 0;
-        task->tk_action = call_bind;
-        if (status >= 0 && rpcauth_uptodatecred(task))
-                return;
-        switch (status) {
-        case -EACCES:
-                rpc_exit(task, -EACCES);
-                return;
-        case -ENOMEM:
-                rpc_exit(task, -ENOMEM);
-                return;
-        case -ETIMEDOUT:
-                rpc_delay(task, 3*HZ);
-        }
-        task->tk_action = call_refresh;
-}
-
 static inline int
 rpc_task_need_encode(struct rpc_task *task)
 {
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 95ccbcf45d3e..8c8eef2b8f26 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -48,7 +48,7 @@ static void rpc_purge_list(struct rpc_inode *rpci, struct list_head *head,
                 return;
         do {
                 msg = list_entry(head->next, struct rpc_pipe_msg, list);
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 msg->errno = err;
                 destroy_msg(msg);
         } while (!list_empty(head));
@@ -208,7 +208,7 @@ rpc_pipe_release(struct inode *inode, struct file *filp)
         if (msg != NULL) {
                 spin_lock(&inode->i_lock);
                 msg->errno = -EAGAIN;
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 spin_unlock(&inode->i_lock);
                 rpci->ops->destroy_msg(msg);
         }
@@ -268,7 +268,7 @@ rpc_pipe_read(struct file *filp, char __user *buf, size_t len, loff_t *offset)
         if (res < 0 || msg->len == msg->copied) {
                 filp->private_data = NULL;
                 spin_lock(&inode->i_lock);
-                list_del(&msg->list);
+                list_del_init(&msg->list);
                 spin_unlock(&inode->i_lock);
                 rpci->ops->destroy_msg(msg);
         }
@@ -371,21 +371,23 @@ rpc_show_info(struct seq_file *m, void *v)
 static int
 rpc_info_open(struct inode *inode, struct file *file)
 {
-        struct rpc_clnt *clnt;
+        struct rpc_clnt *clnt = NULL;
         int ret = single_open(file, rpc_show_info, NULL);
 
         if (!ret) {
                 struct seq_file *m = file->private_data;
-                mutex_lock(&inode->i_mutex);
-                clnt = RPC_I(inode)->private;
-                if (clnt) {
-                        kref_get(&clnt->cl_kref);
+
+                spin_lock(&file->f_path.dentry->d_lock);
+                if (!d_unhashed(file->f_path.dentry))
+                        clnt = RPC_I(inode)->private;
+                if (clnt != NULL && atomic_inc_not_zero(&clnt->cl_count)) {
+                        spin_unlock(&file->f_path.dentry->d_lock);
                         m->private = clnt;
                 } else {
+                        spin_unlock(&file->f_path.dentry->d_lock);
                         single_release(inode, file);
                         ret = -EINVAL;
                 }
-                mutex_unlock(&inode->i_mutex);
         }
         return ret;
 }
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index a3cca0a94346..64f2ae1fdc15 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -101,7 +101,7 @@ resume:
                         err = -EHOSTUNREACH;
                         goto error_nolock;
                 }
-                skb_dst_set_noref(skb, dst);
+                skb_dst_set(skb, dst_clone(dst));
                 x = dst->xfrm;
         } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
 
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 204af48c5cc1..ac242a377aea 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -372,14 +372,17 @@ static void snd_pcm_substream_proc_hw_params_read(struct snd_info_entry *entry,
                                                   struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN) {
                 snd_iprintf(buffer, "no setup\n");
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "access: %s\n", snd_pcm_access_name(runtime->access));
         snd_iprintf(buffer, "format: %s\n", snd_pcm_format_name(runtime->format));
@@ -398,20 +401,25 @@ static void snd_pcm_substream_proc_hw_params_read(struct snd_info_entry *entry,
                 snd_iprintf(buffer, "OSS period frames: %lu\n", (unsigned long)runtime->oss.period_frames);
         }
 #endif
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 static void snd_pcm_substream_proc_sw_params_read(struct snd_info_entry *entry,
                                                   struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN) {
                 snd_iprintf(buffer, "no setup\n");
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "tstamp_mode: %s\n", snd_pcm_tstamp_mode_name(runtime->tstamp_mode));
         snd_iprintf(buffer, "period_step: %u\n", runtime->period_step);
@@ -421,24 +429,29 @@ static void snd_pcm_substream_proc_sw_params_read(struct snd_info_entry *entry,
         snd_iprintf(buffer, "silence_threshold: %lu\n", runtime->silence_threshold);
         snd_iprintf(buffer, "silence_size: %lu\n", runtime->silence_size);
         snd_iprintf(buffer, "boundary: %lu\n", runtime->boundary);
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 static void snd_pcm_substream_proc_status_read(struct snd_info_entry *entry,
                                                struct snd_info_buffer *buffer)
 {
         struct snd_pcm_substream *substream = entry->private_data;
-        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_pcm_runtime *runtime;
         struct snd_pcm_status status;
         int err;
+
+        mutex_lock(&substream->pcm->open_mutex);
+        runtime = substream->runtime;
         if (!runtime) {
                 snd_iprintf(buffer, "closed\n");
-                return;
+                goto unlock;
         }
         memset(&status, 0, sizeof(status));
         err = snd_pcm_status(substream, &status);
         if (err < 0) {
                 snd_iprintf(buffer, "error %d\n", err);
-                return;
+                goto unlock;
         }
         snd_iprintf(buffer, "state: %s\n", snd_pcm_state_name(status.state));
         snd_iprintf(buffer, "owner_pid   : %d\n", pid_vnr(substream->pid));
@@ -452,6 +465,8 @@ static void snd_pcm_substream_proc_status_read(struct snd_info_entry *entry,
         snd_iprintf(buffer, "-----\n");
         snd_iprintf(buffer, "hw_ptr      : %ld\n", runtime->status->hw_ptr);
         snd_iprintf(buffer, "appl_ptr    : %ld\n", runtime->control->appl_ptr);
+ unlock:
+        mutex_unlock(&substream->pcm->open_mutex);
 }
 
 #ifdef CONFIG_SND_PCM_XRUN_DEBUG
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 134fc6c2e08d..d4eb2ef80784 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1992,6 +1992,8 @@ void snd_pcm_release_substream(struct snd_pcm_substream *substream)
                 substream->ops->close(substream);
                 substream->hw_opened = 0;
         }
+        if (pm_qos_request_active(&substream->latency_pm_qos_req))
+                pm_qos_remove_request(&substream->latency_pm_qos_req);
         if (substream->pcm_release) {
                 substream->pcm_release(substream);
                 substream->pcm_release = NULL;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 1053fff4bd0a..34940a079051 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -126,6 +126,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, ICH10},"
                          "{Intel, PCH},"
                          "{Intel, CPT},"
+                         "{Intel, PBG},"
                          "{Intel, SCH},"
                          "{ATI, SB450},"
                          "{ATI, SB600},"
@@ -2749,6 +2750,8 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         { PCI_DEVICE(0x8086, 0x3b57), .driver_data = AZX_DRIVER_ICH },
         /* CPT */
         { PCI_DEVICE(0x8086, 0x1c20), .driver_data = AZX_DRIVER_PCH },
+        /* PBG */
+        { PCI_DEVICE(0x8086, 0x1d20), .driver_data = AZX_DRIVER_PCH },
         /* SCH */
         { PCI_DEVICE(0x8086, 0x811b), .driver_data = AZX_DRIVER_SCH },
         /* ATI SB 450/600 */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 71f9d6475b09..972e7c453b3d 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3092,6 +3092,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0402, "Dell Vostro", CXT5066_DELL_VOSTO),
         SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x103c, 0x360b, "HP G60", CXT5066_HP_LAPTOP),
+        SND_PCI_QUIRK(0x1179, 0xff1e, "Toshiba Satellite C650D", CXT5066_IDEAPAD),
         SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
         SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400s", CXT5066_THINKPAD),
diff --git a/sound/pci/hda/patch_nvhdmi.c b/sound/pci/hda/patch_nvhdmi.c
index 69b950d527c3..baa108b9d6aa 100644
--- a/sound/pci/hda/patch_nvhdmi.c
+++ b/sound/pci/hda/patch_nvhdmi.c
@@ -84,7 +84,7 @@ static struct hda_verb nvhdmi_basic_init_7x[] = {
 #else
 /* support all rates and formats */
 #define SUPPORTED_RATES \
-        (SNDRV_PCM_RATE_22050 | SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |\
+        (SNDRV_PCM_RATE_32000 | SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |\
         SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000 | SNDRV_PCM_RATE_176400 |\
          SNDRV_PCM_RATE_192000)
 #define SUPPORTED_MAXBPS        24
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index bcbf9160ed81..a1312a6c8af2 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -14453,6 +14453,7 @@ static void alc269_auto_init(struct hda_codec *codec)
 
 enum {
         ALC269_FIXUP_SONY_VAIO,
+        ALC269_FIXUP_DELL_M101Z,
 };
 
 static const struct hda_verb alc269_sony_vaio_fixup_verbs[] = {
@@ -14464,11 +14465,20 @@ static const struct alc_fixup alc269_fixups[] = {
         [ALC269_FIXUP_SONY_VAIO] = {
                 .verbs = alc269_sony_vaio_fixup_verbs
         },
+        [ALC269_FIXUP_DELL_M101Z] = {
+                .verbs = (const struct hda_verb[]) {
+                        /* Enables internal speaker */
+                        {0x20, AC_VERB_SET_COEF_INDEX, 13},
+                        {0x20, AC_VERB_SET_PROC_COEF, 0x4040},
+                        {}
+                }
+        },
 };
 
 static struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x104d, 0x9071, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
         SND_PCI_QUIRK(0x104d, 0x9077, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+        SND_PCI_QUIRK(0x1028, 0x0470, "Dell M101z", ALC269_FIXUP_DELL_M101Z),
         {}
 };
 
diff --git a/sound/ppc/snd_ps3.c b/sound/ppc/snd_ps3.c
index 2f12da4da561..581a670e8261 100644
--- a/sound/ppc/snd_ps3.c
+++ b/sound/ppc/snd_ps3.c
@@ -579,7 +579,7 @@ static int snd_ps3_delay_to_bytes(struct snd_pcm_substream *substream,
                                   rate * delay_ms / 1000)
                 * substream->runtime->channels;
 
-        pr_debug(KERN_ERR "%s: time=%d rate=%d bytes=%ld, frames=%d, ret=%d\n",
+        pr_debug("%s: time=%d rate=%d bytes=%ld, frames=%d, ret=%d\n",
                  __func__,
                  delay_ms,
                  rate,
diff --git a/sound/soc/s3c24xx/s3c-dma.c b/sound/soc/s3c24xx/s3c-dma.c
index 1b61c23ff300..f1b1bc4bacfb 100644
--- a/sound/soc/s3c24xx/s3c-dma.c
+++ b/sound/soc/s3c24xx/s3c-dma.c
@@ -94,8 +94,7 @@ static void s3c_dma_enqueue(struct snd_pcm_substream *substream)
 
                 if ((pos + len) > prtd->dma_end) {
                         len  = prtd->dma_end - pos;
-                        pr_debug(KERN_DEBUG "%s: corrected dma len %ld\n",
-                               __func__, len);
+                        pr_debug("%s: corrected dma len %ld\n", __func__, len);
                 }
 
                 ret = s3c2410_dma_enqueue(prtd->params->channel,
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 66cf65b510b1..c1f1e3c62984 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -218,7 +218,6 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
         events = file->f_op->poll(file, &irqfd->pt);
 
         list_add_tail(&irqfd->list, &kvm->irqfds.items);
-        spin_unlock_irq(&kvm->irqfds.lock);
 
         /*
          * Check if there was an event already pending on the eventfd
@@ -227,6 +226,8 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
         if (events & POLLIN)
                 schedule_work(&irqfd->inject);
 
+        spin_unlock_irq(&kvm->irqfds.lock);
+
         /*
          * do not drop the file until the irqfd is fully initialized, otherwise
          * we might race against the POLLHUP
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index d4853a54771a..5186e728c53e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -1970,10 +1970,12 @@ static int kvm_cpu_hotplug(struct notifier_block *notifier, unsigned long val,
 
 asmlinkage void kvm_handle_fault_on_reboot(void)
 {
-        if (kvm_rebooting)
+        if (kvm_rebooting) {
                 /* spin while reset goes on */
+                local_irq_enable();
                 while (true)
                         ;
+        }
         /* Fault while not rebooting.  We want the trace. */
         BUG();
 }