334 files changed, 3899 insertions, 1543 deletions
diff --git a/CREDITS b/CREDITS
index d8fe12a9421f..2346b09ca8bb 100644
--- a/CREDITS
+++ b/CREDITS
@@ -1823,6 +1823,11 @@ S: Kattreinstr 38
 S: D-64295
 S: Germany
+N: Avi Kivity
+E: avi.kivity@gmail.com
+D: Kernel-based Virtual Machine (KVM)
+S: Ra'annana, Israel
 N: Andi Kleen
 E: andi@firstfloor.org
 U: http://www.halobates.de
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index c07f7b4fb88d..71c4da413444 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -466,6 +466,10 @@ Note:
 5.3 swappiness
 Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only.
+Please note that unlike the global swappiness, memcg knob set to 0
+really prevents from any swapping even if there is a swap storage
+available. This might lead to memcg OOM killer if there are no file
+pages to reclaim.
 Following cgroups' swappiness can't be changed.
 - root cgroup (uses /proc/sys/vm/swappiness).
diff --git a/Documentation/devicetree/bindings/net/mdio-gpio.txt b/Documentation/devicetree/bindings/net/mdio-gpio.txt
index bc9549529014..c79bab025369 100644
--- a/Documentation/devicetree/bindings/net/mdio-gpio.txt
+++ b/Documentation/devicetree/bindings/net/mdio-gpio.txt
@@ -8,9 +8,16 @@ gpios property as described in section VIII.1 in the following order:
 MDC, MDIO.
+Note: Each gpio-mdio bus should have an alias correctly numbered in "aliases"
+node.
 Example:
-mdio {
+aliases {
+        mdio-gpio0 = <&mdio0>;
+};
+mdio0: mdio {
        compatible = "virtual,mdio-gpio";
        #address-cells = <1>;
        #size-cells = <0>;
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index a1793d670cd0..3844d21d6ca3 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -33,7 +33,7 @@ Table of Contents
  2     Modifying System Parameters
  3     Per-Process Parameters
-  3.1   /proc/<pid>/oom_score_adj - Adjust the oom-killer
+  3.1   /proc/<pid>/oom_adj & /proc/<pid>/oom_score_adj - Adjust the oom-killer
                                                                score
  3.2   /proc/<pid>/oom_score - Display current oom-killer score
  3.3   /proc/<pid>/io - Display the IO accounting fields
@@ -1320,10 +1320,10 @@ of the kernel.
 CHAPTER 3: PER-PROCESS PARAMETERS
 ------------------------------------------------------------------------------
-3.1 /proc/<pid>/oom_score_adj- Adjust the oom-killer score
+3.1 /proc/<pid>/oom_adj & /proc/<pid>/oom_score_adj- Adjust the oom-killer score
 --------------------------------------------------------------------------------
-This file can be used to adjust the badness heuristic used to select which
+These file can be used to adjust the badness heuristic used to select which
 process gets killed in out of memory conditions.
 The badness heuristic assigns a value to each candidate task ranging from 0
@@ -1361,6 +1361,12 @@ same system, cpuset, mempolicy, or memory controller resources to use at least
 equivalent to discounting 50% of the task's allowed memory from being considered
 as scoring against the task.
+For backwards compatibility with previous kernels, /proc/<pid>/oom_adj may also
+be used to tune the badness score.  Its acceptable values range from -16
+(OOM_ADJUST_MIN) to +15 (OOM_ADJUST_MAX) and a special value of -17
+(OOM_DISABLE) to disable oom killing entirely for that task.  Its value is
+scaled linearly with /proc/<pid>/oom_score_adj.
 The value of /proc/<pid>/oom_score_adj may be reduced no lower than the last
 value set by a CAP_SYS_RESOURCE process. To reduce the value any lower
 requires CAP_SYS_RESOURCE.
@@ -1375,7 +1381,9 @@ minimal amount of work.
 -------------------------------------------------------------
 This file can be used to check the current score used by the oom-killer is for
-any given <pid>.
+any given <pid>. Use it together with /proc/<pid>/oom_score_adj to tune which
+process should be killed in an out-of-memory situation.
 3.3  /proc/<pid>/io - Display the IO accounting fields
 -------------------------------------------------------
diff --git a/Documentation/networking/netdev-features.txt b/Documentation/networking/netdev-features.txt
index 4164f5c02e4b..f310edec8a77 100644
--- a/Documentation/networking/netdev-features.txt
+++ b/Documentation/networking/netdev-features.txt
@@ -164,4 +164,4 @@ read the CRC recorded by the NIC on receipt of the packet.
 This requests that the NIC receive all possible frames, including errored
 frames (such as bad FCS, etc).  This can be helpful when sniffing a link with
 bad packets on it.  Some NICs may receive more packets if also put into normal
-PROMISC mdoe.
+PROMISC mode.
diff --git a/Documentation/networking/vxlan.txt b/Documentation/networking/vxlan.txt
index 5b34b762d7d5..6d993510f091 100644
--- a/Documentation/networking/vxlan.txt
+++ b/Documentation/networking/vxlan.txt
@@ -32,7 +32,7 @@ no entry is in the forwarding table.
  # ip link delete vxlan0
 3. Show vxlan info
-  # ip -d show vxlan0
+  # ip -d link show vxlan0
 It is possible to create, destroy and display the vxlan
 forwarding table using the new bridge command.
@@ -41,7 +41,7 @@ forwarding table using the new bridge command.
  # bridge fdb add to 00:17:42:8a:b4:05 dst 192.19.0.2 dev vxlan0
 2. Delete forwarding table entry
-  # bridge fdb delete 00:17:42:8a:b4:05
+  # bridge fdb delete 00:17:42:8a:b4:05 dev vxlan0
 3. Show forwarding table
  # bridge fdb show dev vxlan0
diff --git a/MAINTAINERS b/MAINTAINERS
index 99199e63f349..140ebd063f1b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -526,17 +526,17 @@ F:	drivers/video/geode/
 F:      arch/x86/include/asm/geode.h
 AMD IOMMU (AMD-VI)
-M:      Joerg Roedel <joerg.roedel@amd.com>
+M:      Joerg Roedel <joro@8bytes.org>
 L:      iommu@lists.linux-foundation.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu.git
-S:      Supported
+S:      Maintained
 F:      drivers/iommu/amd_iommu*.[ch]
 F:      include/linux/amd-iommu.h
 AMD MICROCODE UPDATE SUPPORT
-M:      Andreas Herrmann <andreas.herrmann3@amd.com>
+M:      Andreas Herrmann <herrmann.der.user@googlemail.com>
 L:      amd64-microcode@amd64.org
-S:      Supported
+S:      Maintained
 F:      arch/x86/kernel/microcode_amd.c
 AMS (Apple Motion Sensor) DRIVER
@@ -840,6 +840,14 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kristoffer/linux-hpc.git
 F:      arch/arm/mach-sa1100/jornada720.c
 F:      arch/arm/mach-sa1100/include/mach/jornada720.h
+ARM/IGEP MACHINE SUPPORT
+M:      Enric Balletbo i Serra <eballetbo@gmail.com>
+M:      Javier Martinez Canillas <javier@dowhile0.org>
+L:      linux-omap@vger.kernel.org
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-omap2/board-igep0020.c
 ARM/INCOME PXA270 SUPPORT
 M:      Marek Vasut <marek.vasut@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -2707,10 +2715,10 @@ F:	include/linux/edac.h
 EDAC-AMD64
 M:      Doug Thompson <dougthompson@xmission.com>
-M:      Borislav Petkov <borislav.petkov@amd.com>
+M:      Borislav Petkov <bp@alien8.de>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
-S:      Supported
+S:      Maintained
 F:      drivers/edac/amd64_edac*
 EDAC-E752X
@@ -3597,6 +3605,49 @@ F:	drivers/hid/hid-hyperv.c
 F:      drivers/net/hyperv/
 F:      drivers/staging/hv/
+I2C OVER PARALLEL PORT
+M:      Jean Delvare <khali@linux-fr.org>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/i2c/busses/i2c-parport
+F:      Documentation/i2c/busses/i2c-parport-light
+F:      drivers/i2c/busses/i2c-parport.c
+F:      drivers/i2c/busses/i2c-parport-light.c
+I2C/SMBUS CONTROLLER DRIVERS FOR PC
+M:      Jean Delvare <khali@linux-fr.org>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/i2c/busses/i2c-ali1535
+F:      Documentation/i2c/busses/i2c-ali1563
+F:      Documentation/i2c/busses/i2c-ali15x3
+F:      Documentation/i2c/busses/i2c-amd756
+F:      Documentation/i2c/busses/i2c-amd8111
+F:      Documentation/i2c/busses/i2c-i801
+F:      Documentation/i2c/busses/i2c-nforce2
+F:      Documentation/i2c/busses/i2c-piix4
+F:      Documentation/i2c/busses/i2c-sis5595
+F:      Documentation/i2c/busses/i2c-sis630
+F:      Documentation/i2c/busses/i2c-sis96x
+F:      Documentation/i2c/busses/i2c-via
+F:      Documentation/i2c/busses/i2c-viapro
+F:      drivers/i2c/busses/i2c-ali1535.c
+F:      drivers/i2c/busses/i2c-ali1563.c
+F:      drivers/i2c/busses/i2c-ali15x3.c
+F:      drivers/i2c/busses/i2c-amd756.c
+F:      drivers/i2c/busses/i2c-amd756-s4882.c
+F:      drivers/i2c/busses/i2c-amd8111.c
+F:      drivers/i2c/busses/i2c-i801.c
+F:      drivers/i2c/busses/i2c-isch.c
+F:      drivers/i2c/busses/i2c-nforce2.c
+F:      drivers/i2c/busses/i2c-nforce2-s4985.c
+F:      drivers/i2c/busses/i2c-piix4.c
+F:      drivers/i2c/busses/i2c-sis5595.c
+F:      drivers/i2c/busses/i2c-sis630.c
+F:      drivers/i2c/busses/i2c-sis96x.c
+F:      drivers/i2c/busses/i2c-via.c
+F:      drivers/i2c/busses/i2c-viapro.c
 I2C/SMBUS STUB DRIVER
 M:      "Mark M. Hoffman" <mhoffman@lightlink.com>
 L:      linux-i2c@vger.kernel.org
@@ -3604,9 +3655,8 @@ S:	Maintained
 F:      drivers/i2c/busses/i2c-stub.c
 I2C SUBSYSTEM
-M:      "Jean Delvare (PC drivers, core)" <khali@linux-fr.org>
+M:      Wolfram Sang <w.sang@pengutronix.de>
 M:      "Ben Dooks (embedded platforms)" <ben-linux@fluff.org>
-M:      "Wolfram Sang (embedded platforms)" <w.sang@pengutronix.de>
 L:      linux-i2c@vger.kernel.org
 W:      http://i2c.wiki.kernel.org/
 T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-i2c/
@@ -3617,6 +3667,13 @@ F:	drivers/i2c/
 F:      include/linux/i2c.h
 F:      include/linux/i2c-*.h
+I2C-TAOS-EVM DRIVER
+M:      Jean Delvare <khali@linux-fr.org>
+L:      linux-i2c@vger.kernel.org
+S:      Maintained
+F:      Documentation/i2c/busses/i2c-taos-evm
+F:      drivers/i2c/busses/i2c-taos-evm.c
 I2C-TINY-USB DRIVER
 M:      Till Harbaum <till@harbaum.org>
 L:      linux-i2c@vger.kernel.org
@@ -3703,7 +3760,7 @@ S:	Maintained
 F:      drivers/platform/x86/ideapad-laptop.c
 IDE/ATAPI DRIVERS
-M:      Borislav Petkov <petkovbb@gmail.com>
+M:      Borislav Petkov <bp@alien8.de>
 L:      linux-ide@vger.kernel.org
 S:      Maintained
 F:      Documentation/cdrom/ide-cd
@@ -4230,8 +4287,8 @@ F:	include/linux/lockd/
 F:      include/linux/sunrpc/
 KERNEL VIRTUAL MACHINE (KVM)
-M:      Avi Kivity <avi@redhat.com>
 M:      Marcelo Tosatti <mtosatti@redhat.com>
+M:      Gleb Natapov <gleb@redhat.com>
 L:      kvm@vger.kernel.org
 W:      http://kvm.qumranet.com
 S:      Supported
@@ -5363,7 +5420,7 @@ S:	Maintained
 F:      sound/drivers/opl4/
 OPROFILE
-M:      Robert Richter <robert.richter@amd.com>
+M:      Robert Richter <rric@kernel.org>
 L:      oprofile-list@lists.sf.net
 S:      Maintained
 F:      arch/*/include/asm/oprofile*.h
@@ -7209,6 +7266,14 @@ L:	linux-xtensa@linux-xtensa.org
 S:      Maintained
 F:      arch/xtensa/
+THERMAL
+M:      Zhang Rui <rui.zhang@intel.com>
+L:      linux-pm@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux.git
+S:      Supported
+F:      drivers/thermal/
+F:      include/linux/thermal.h
 THINKPAD ACPI EXTRAS DRIVER
 M:      Henrique de Moraes Holschuh <ibm-acpi@hmh.eng.br>
 L:      ibm-acpi-devel@lists.sourceforge.net
@@ -7886,13 +7951,6 @@ M:	Roger Luethi <rl@hellgate.ch>
 S:      Maintained
 F:      drivers/net/ethernet/via/via-rhine.c
-VIAPRO SMBUS DRIVER
-M:      Jean Delvare <khali@linux-fr.org>
-L:      linux-i2c@vger.kernel.org
-S:      Maintained
-F:      Documentation/i2c/busses/i2c-viapro
-F:      drivers/i2c/busses/i2c-viapro.c
 VIA SD/MMC CARD CONTROLLER DRIVER
 M:      Bruce Chang <brucechang@via.com.tw>
 M:      Harald Welte <HaraldWelte@viatech.com>
@@ -8147,7 +8205,7 @@ F:	drivers/platform/x86
 X86 MCE INFRASTRUCTURE
 M:      Tony Luck <tony.luck@intel.com>
-M:      Borislav Petkov <bp@amd64.org>
+M:      Borislav Petkov <bp@alien8.de>
 L:      linux-edac@vger.kernel.org
 S:      Maintained
 F:      arch/x86/kernel/cpu/mcheck/*
diff --git a/Makefile b/Makefile
index 6edac73ee1ba..3d2fc460b22f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 7
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Terrified Chipmunk
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 1e6956a90608..14db93e4c8a8 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -445,7 +445,7 @@ struct procfs_args {
 * unhappy with OSF UFS. [CHECKME]
 */
 static int
-osf_ufs_mount(char *dirname, struct ufs_args __user *args, int flags)
+osf_ufs_mount(const char *dirname, struct ufs_args __user *args, int flags)
 {
        int retval;
        struct cdfs_args tmp;
@@ -465,7 +465,7 @@ osf_ufs_mount(char *dirname, struct ufs_args __user *args, int flags)
 }
 static int
-osf_cdfs_mount(char *dirname, struct cdfs_args __user *args, int flags)
+osf_cdfs_mount(const char *dirname, struct cdfs_args __user *args, int flags)
 {
        int retval;
        struct cdfs_args tmp;
@@ -485,7 +485,7 @@ osf_cdfs_mount(char *dirname, struct cdfs_args __user *args, int flags)
 }
 static int
-osf_procfs_mount(char *dirname, struct procfs_args __user *args, int flags)
+osf_procfs_mount(const char *dirname, struct procfs_args __user *args, int flags)
 {
        struct procfs_args tmp;
diff --git a/arch/arm/boot/Makefile b/arch/arm/boot/Makefile
index f2aa09eb658e..9137df539b61 100644
--- a/arch/arm/boot/Makefile
+++ b/arch/arm/boot/Makefile
@@ -33,7 +33,7 @@ ifeq ($(CONFIG_XIP_KERNEL),y)
 $(obj)/xipImage: vmlinux FORCE
        $(call if_changed,objcopy)
-        $(kecho) '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
+        @$(kecho) '  Kernel: $@ is ready (physical address: $(CONFIG_XIP_PHYS_ADDR))'
 $(obj)/Image $(obj)/zImage: FORCE
        @echo 'Kernel configured for XIP (CONFIG_XIP_KERNEL=y)'
@@ -48,14 +48,14 @@ $(obj)/xipImage: FORCE
 $(obj)/Image: vmlinux FORCE
        $(call if_changed,objcopy)
-        $(kecho) '  Kernel: $@ is ready'
+        @$(kecho) '  Kernel: $@ is ready'
 $(obj)/compressed/vmlinux: $(obj)/Image FORCE
        $(Q)$(MAKE) $(build)=$(obj)/compressed $@
 $(obj)/zImage:  $(obj)/compressed/vmlinux FORCE
        $(call if_changed,objcopy)
-        $(kecho) '  Kernel: $@ is ready'
+        @$(kecho) '  Kernel: $@ is ready'
 endif
@@ -90,7 +90,7 @@ fi
 $(obj)/uImage:  $(obj)/zImage FORCE
        @$(check_for_multiple_loadaddr)
        $(call if_changed,uimage)
-        $(kecho) '  Image $@ is ready'
+        @$(kecho) '  Image $@ is ready'
 $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
        $(Q)$(MAKE) $(build)=$(obj)/bootp $@
@@ -98,7 +98,7 @@ $(obj)/bootp/bootp: $(obj)/zImage initrd FORCE
 $(obj)/bootpImage: $(obj)/bootp/bootp FORCE
        $(call if_changed,objcopy)
-        $(kecho) '  Kernel: $@ is ready'
+        @$(kecho) '  Kernel: $@ is ready'
 PHONY += initrd FORCE
 initrd:
diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
index b1497c7d7d68..df7f2270fc91 100644
--- a/arch/arm/boot/dts/tegra30.dtsi
+++ b/arch/arm/boot/dts/tegra30.dtsi
@@ -73,8 +73,8 @@
        pinmux: pinmux {
                compatible = "nvidia,tegra30-pinmux";
-                reg = <0x70000868 0xd0    /* Pad control registers */
+                reg = <0x70000868 0xd4    /* Pad control registers */
-                       0x70003000 0x3e0>; /* Mux registers */
+                       0x70003000 0x3e4>; /* Mux registers */
        };
        serial@70006000 {
diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c
index 1e122bcd7845..3cee0e6ea7c3 100644
--- a/arch/arm/mach-at91/at91rm9200_devices.c
+++ b/arch/arm/mach-at91/at91rm9200_devices.c
@@ -68,7 +68,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data)
        /* Enable overcurrent notification */
        for (i = 0; i < data->ports; i++) {
-                if (data->overcurrent_pin[i])
+                if (gpio_is_valid(data->overcurrent_pin[i]))
                        at91_set_gpio_input(data->overcurrent_pin[i], 1);
        }
diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c
index aa1e58729885..414bd855fb0c 100644
--- a/arch/arm/mach-at91/at91sam9260_devices.c
+++ b/arch/arm/mach-at91/at91sam9260_devices.c
@@ -72,7 +72,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data)
        /* Enable overcurrent notification */
        for (i = 0; i < data->ports; i++) {
-                if (data->overcurrent_pin[i])
+                if (gpio_is_valid(data->overcurrent_pin[i]))
                        at91_set_gpio_input(data->overcurrent_pin[i], 1);
        }
diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c
index b9487696b7be..cd604aad8e96 100644
--- a/arch/arm/mach-at91/at91sam9261_devices.c
+++ b/arch/arm/mach-at91/at91sam9261_devices.c
@@ -72,7 +72,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data)
        /* Enable overcurrent notification */
        for (i = 0; i < data->ports; i++) {
-                if (data->overcurrent_pin[i])
+                if (gpio_is_valid(data->overcurrent_pin[i]))
                        at91_set_gpio_input(data->overcurrent_pin[i], 1);
        }
diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c
index cb85da2eccea..9c61e59a2104 100644
--- a/arch/arm/mach-at91/at91sam9263_devices.c
+++ b/arch/arm/mach-at91/at91sam9263_devices.c
@@ -78,7 +78,7 @@ void __init at91_add_device_usbh(struct at91_usbh_data *data)
        /* Enable overcurrent notification */
        for (i = 0; i < data->ports; i++) {
-                if (data->overcurrent_pin[i])
+                if (gpio_is_valid(data->overcurrent_pin[i]))
                        at91_set_gpio_input(data->overcurrent_pin[i], 1);
        }
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index b1596072dcc2..fcd233cb33d2 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -1841,8 +1841,8 @@ static struct resource sha_resources[] = {
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = AT91SAM9G45_ID_AESTDESSHA,
+                .start  = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
-                .end    = AT91SAM9G45_ID_AESTDESSHA,
+                .end    = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
                .flags  = IORESOURCE_IRQ,
        },
 };
@@ -1874,8 +1874,8 @@ static struct resource tdes_resources[] = {
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = AT91SAM9G45_ID_AESTDESSHA,
+                .start  = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
-                .end    = AT91SAM9G45_ID_AESTDESSHA,
+                .end    = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
                .flags  = IORESOURCE_IRQ,
        },
 };
@@ -1910,8 +1910,8 @@ static struct resource aes_resources[] = {
                .flags  = IORESOURCE_MEM,
        },
        [1] = {
-                .start  = AT91SAM9G45_ID_AESTDESSHA,
+                .start  = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
-                .end    = AT91SAM9G45_ID_AESTDESSHA,
+                .end    = NR_IRQS_LEGACY + AT91SAM9G45_ID_AESTDESSHA,
                .flags  = IORESOURCE_IRQ,
        },
 };
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index cd0c8b1e1ecf..14e9947bad6e 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -713,8 +713,7 @@ static int dm644x_venc_setup_clock(enum vpbe_enc_timings_type type,
                break;
        case VPBE_ENC_CUSTOM_TIMINGS:
                if (pclock <= 27000000) {
-                        v |= DM644X_VPSS_MUXSEL_PLL2_MODE |
+                        v |= DM644X_VPSS_DACCLKEN;
-                             DM644X_VPSS_DACCLKEN;
                        writel(v, DAVINCI_SYSMOD_VIRT(SYSMOD_VPSS_CLKCTL));
                } else {
                        /*
diff --git a/arch/arm/mach-exynos/dma.c b/arch/arm/mach-exynos/dma.c
index 21d568b3b149..87e07d6fc615 100644
--- a/arch/arm/mach-exynos/dma.c
+++ b/arch/arm/mach-exynos/dma.c
@@ -275,6 +275,9 @@ static int __init exynos_dma_init(void)
                exynos_pdma1_pdata.nr_valid_peri =
                        ARRAY_SIZE(exynos4210_pdma1_peri);
                exynos_pdma1_pdata.peri_id = exynos4210_pdma1_peri;
+                if (samsung_rev() == EXYNOS4210_REV_0)
+                        exynos_mdma1_device.res.start = EXYNOS4_PA_S_MDMA1;
        } else if (soc_is_exynos4212() || soc_is_exynos4412()) {
                exynos_pdma0_pdata.nr_valid_peri =
                        ARRAY_SIZE(exynos4212_pdma0_peri);
diff --git a/arch/arm/mach-exynos/include/mach/map.h b/arch/arm/mach-exynos/include/mach/map.h
index e7373311bfbc..872840b2ff45 100644
--- a/arch/arm/mach-exynos/include/mach/map.h
+++ b/arch/arm/mach-exynos/include/mach/map.h
@@ -90,6 +90,7 @@
 #define EXYNOS4_PA_MDMA0                0x10810000
 #define EXYNOS4_PA_MDMA1                0x12850000
+#define EXYNOS4_PA_S_MDMA1              0x12840000
 #define EXYNOS4_PA_PDMA0                0x12680000
 #define EXYNOS4_PA_PDMA1                0x12690000
 #define EXYNOS5_PA_MDMA0                0x10800000
diff --git a/arch/arm/mach-highbank/system.c b/arch/arm/mach-highbank/system.c
index 82c27230d4a9..86e37cd9376c 100644
--- a/arch/arm/mach-highbank/system.c
+++ b/arch/arm/mach-highbank/system.c
@@ -28,6 +28,7 @@ void highbank_restart(char mode, const char *cmd)
                hignbank_set_pwr_soft_reset();
        scu_power_mode(scu_base_addr, SCU_PM_POWEROFF);
-        cpu_do_idle();
+        while (1)
+                cpu_do_idle();
 }
diff --git a/arch/arm/mach-imx/clk-gate2.c b/arch/arm/mach-imx/clk-gate2.c
index 3c1b8ff9a0a6..cc49c7ae186e 100644
--- a/arch/arm/mach-imx/clk-gate2.c
+++ b/arch/arm/mach-imx/clk-gate2.c
@@ -112,7 +112,7 @@ struct clk *clk_register_gate2(struct device *dev, const char *name,
        clk = clk_register(dev, &gate->hw);
        if (IS_ERR(clk))
-                kfree(clk);
+                kfree(gate);
        return clk;
 }
diff --git a/arch/arm/mach-imx/ehci-imx25.c b/arch/arm/mach-imx/ehci-imx25.c
index 27e40d17de99..134c190e3003 100644
--- a/arch/arm/mach-imx/ehci-imx25.c
+++ b/arch/arm/mach-imx/ehci-imx25.c
@@ -30,7 +30,7 @@
 #define MX25_H1_SIC_SHIFT       21
 #define MX25_H1_SIC_MASK        (0x3 << MX25_H1_SIC_SHIFT)
 #define MX25_H1_PP_BIT          (1 << 18)
-#define MX25_H1_PM_BIT          (1 << 8)
+#define MX25_H1_PM_BIT          (1 << 16)
 #define MX25_H1_IPPUE_UP_BIT    (1 << 7)
 #define MX25_H1_IPPUE_DOWN_BIT  (1 << 6)
 #define MX25_H1_TLL_BIT         (1 << 5)
diff --git a/arch/arm/mach-imx/ehci-imx35.c b/arch/arm/mach-imx/ehci-imx35.c
index a596f709a937..554e7cccff53 100644
--- a/arch/arm/mach-imx/ehci-imx35.c
+++ b/arch/arm/mach-imx/ehci-imx35.c
@@ -30,7 +30,7 @@
 #define MX35_H1_SIC_SHIFT       21
 #define MX35_H1_SIC_MASK        (0x3 << MX35_H1_SIC_SHIFT)
 #define MX35_H1_PP_BIT          (1 << 18)
-#define MX35_H1_PM_BIT          (1 << 8)
+#define MX35_H1_PM_BIT          (1 << 16)
 #define MX35_H1_IPPUE_UP_BIT    (1 << 7)
 #define MX35_H1_IPPUE_DOWN_BIT  (1 << 6)
 #define MX35_H1_TLL_BIT         (1 << 5)
diff --git a/arch/arm/mach-omap2/board-igep0020.c b/arch/arm/mach-omap2/board-igep0020.c
index cea5d5292628..0f24cb84ba5a 100644
--- a/arch/arm/mach-omap2/board-igep0020.c
+++ b/arch/arm/mach-omap2/board-igep0020.c
@@ -579,6 +579,11 @@ static void __init igep_wlan_bt_init(void)
        } else
                return;
+        /* Make sure that the GPIO pins are muxed correctly */
+        omap_mux_init_gpio(igep_wlan_bt_gpios[0].gpio, OMAP_PIN_OUTPUT);
+        omap_mux_init_gpio(igep_wlan_bt_gpios[1].gpio, OMAP_PIN_OUTPUT);
+        omap_mux_init_gpio(igep_wlan_bt_gpios[2].gpio, OMAP_PIN_OUTPUT);
        err = gpio_request_array(igep_wlan_bt_gpios,
                                 ARRAY_SIZE(igep_wlan_bt_gpios));
        if (err) {
diff --git a/arch/arm/mach-omap2/clockdomains44xx_data.c b/arch/arm/mach-omap2/clockdomains44xx_data.c
index b56d06b48782..95192a062d5d 100644
--- a/arch/arm/mach-omap2/clockdomains44xx_data.c
+++ b/arch/arm/mach-omap2/clockdomains44xx_data.c
@@ -359,7 +359,7 @@ static struct clockdomain iss_44xx_clkdm = {
        .clkdm_offs       = OMAP4430_CM2_CAM_CAM_CDOFFS,
        .wkdep_srcs       = iss_wkup_sleep_deps,
        .sleepdep_srcs    = iss_wkup_sleep_deps,
-        .flags            = CLKDM_CAN_HWSUP_SWSUP,
+        .flags            = CLKDM_CAN_SWSUP,
 };
 static struct clockdomain l3_dss_44xx_clkdm = {
diff --git a/arch/arm/mach-omap2/common-board-devices.c b/arch/arm/mach-omap2/common-board-devices.c
index ad856092c06a..d246efd9f734 100644
--- a/arch/arm/mach-omap2/common-board-devices.c
+++ b/arch/arm/mach-omap2/common-board-devices.c
@@ -63,30 +63,36 @@ void __init omap_ads7846_init(int bus_num, int gpio_pendown, int gpio_debounce,
        struct spi_board_info *spi_bi = &ads7846_spi_board_info;
        int err;
-        err = gpio_request_one(gpio_pendown, GPIOF_IN, "TSPenDown");
+        /*
-        if (err) {
+         * If a board defines get_pendown_state() function, request the pendown
-                pr_err("Couldn't obtain gpio for TSPenDown: %d\n", err);
+         * GPIO and set the GPIO debounce time.
-                return;
+         * If a board does not define the get_pendown_state() function, then
-        }
+         * the ads7846 driver will setup the pendown GPIO itself.
+         */
+        if (board_pdata && board_pdata->get_pendown_state) {
+                err = gpio_request_one(gpio_pendown, GPIOF_IN, "TSPenDown");
+                if (err) {
+                        pr_err("Couldn't obtain gpio for TSPenDown: %d\n", err);
+                        return;
+                }
+                if (gpio_debounce)
+                        gpio_set_debounce(gpio_pendown, gpio_debounce);
-        if (gpio_debounce)
+                gpio_export(gpio_pendown, 0);
-                gpio_set_debounce(gpio_pendown, gpio_debounce);
+        }
        spi_bi->bus_num = bus_num;
        spi_bi->irq     = gpio_to_irq(gpio_pendown);
+        ads7846_config.gpio_pendown = gpio_pendown;
        if (board_pdata) {
                board_pdata->gpio_pendown = gpio_pendown;
+                board_pdata->gpio_pendown_debounce = gpio_debounce;
                spi_bi->platform_data = board_pdata;
-                if (board_pdata->get_pendown_state)
-                        gpio_export(gpio_pendown, 0);
-        } else {
-                ads7846_config.gpio_pendown = gpio_pendown;
        }
-        if (!board_pdata || (board_pdata && !board_pdata->get_pendown_state))
-                gpio_free(gpio_pendown);
        spi_register_board_info(&ads7846_spi_board_info, 1);
 }
 #else
diff --git a/arch/arm/mach-omap2/devices.c b/arch/arm/mach-omap2/devices.c
index cf365c387c06..d2215e9873a5 100644
--- a/arch/arm/mach-omap2/devices.c
+++ b/arch/arm/mach-omap2/devices.c
@@ -19,6 +19,7 @@
 #include <linux/of.h>
 #include <linux/pinctrl/machine.h>
 #include <linux/platform_data/omap4-keypad.h>
+#include <linux/platform_data/omap_ocp2scp.h>
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
@@ -615,6 +616,83 @@ static void omap_init_vout(void)
 static inline void omap_init_vout(void) {}
 #endif
+#if defined(CONFIG_OMAP_OCP2SCP) || defined(CONFIG_OMAP_OCP2SCP_MODULE)
+static int count_ocp2scp_devices(struct omap_ocp2scp_dev *ocp2scp_dev)
+{
+        int cnt = 0;
+        while (ocp2scp_dev->drv_name != NULL) {
+                cnt++;
+                ocp2scp_dev++;
+        }
+        return cnt;
+}
+static void omap_init_ocp2scp(void)
+{
+        struct omap_hwmod       *oh;
+        struct platform_device  *pdev;
+        int                     bus_id = -1, dev_cnt = 0, i;
+        struct omap_ocp2scp_dev *ocp2scp_dev;
+        const char              *oh_name, *name;
+        struct omap_ocp2scp_platform_data *pdata;
+        if (!cpu_is_omap44xx())
+                return;
+        oh_name = "ocp2scp_usb_phy";
+        name    = "omap-ocp2scp";
+        oh = omap_hwmod_lookup(oh_name);
+        if (!oh) {
+                pr_err("%s: could not find omap_hwmod for %s\n", __func__,
+                                                                oh_name);
+                return;
+        }
+        pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
+        if (!pdata) {
+                pr_err("%s: No memory for ocp2scp pdata\n", __func__);
+                return;
+        }
+        ocp2scp_dev = oh->dev_attr;
+        dev_cnt = count_ocp2scp_devices(ocp2scp_dev);
+        if (!dev_cnt) {
+                pr_err("%s: No devices connected to ocp2scp\n", __func__);
+                kfree(pdata);
+                return;
+        }
+        pdata->devices = kzalloc(sizeof(struct omap_ocp2scp_dev *)
+                                        * dev_cnt, GFP_KERNEL);
+        if (!pdata->devices) {
+                pr_err("%s: No memory for ocp2scp pdata devices\n", __func__);
+                kfree(pdata);
+                return;
+        }
+        for (i = 0; i < dev_cnt; i++, ocp2scp_dev++)
+                pdata->devices[i] = ocp2scp_dev;
+        pdata->dev_cnt  = dev_cnt;
+        pdev = omap_device_build(name, bus_id, oh, pdata, sizeof(*pdata), NULL,
+                                                                0, false);
+        if (IS_ERR(pdev)) {
+                pr_err("Could not build omap_device for %s %s\n",
+                                                name, oh_name);
+                kfree(pdata->devices);
+                kfree(pdata);
+                return;
+        }
+}
+#else
+static inline void omap_init_ocp2scp(void) { }
+#endif
 /*-------------------------------------------------------------------------*/
 static int __init omap2_init_devices(void)
@@ -642,6 +720,7 @@ static int __init omap2_init_devices(void)
        omap_init_sham();
        omap_init_aes();
        omap_init_vout();
+        omap_init_ocp2scp();
        return 0;
 }
diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c
index 139adca3bda1..b3b00f43dd7c 100644
--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -420,6 +420,38 @@ static int _set_softreset(struct omap_hwmod *oh, u32 *v)
 }
 /**
+ * _wait_softreset_complete - wait for an OCP softreset to complete
+ * @oh: struct omap_hwmod * to wait on
+ *
+ * Wait until the IP block represented by @oh reports that its OCP
+ * softreset is complete.  This can be triggered by software (see
+ * _ocp_softreset()) or by hardware upon returning from off-mode (one
+ * example is HSMMC).  Waits for up to MAX_MODULE_SOFTRESET_WAIT
+ * microseconds.  Returns the number of microseconds waited.
+ */
+static int _wait_softreset_complete(struct omap_hwmod *oh)
+{
+        struct omap_hwmod_class_sysconfig *sysc;
+        u32 softrst_mask;
+        int c = 0;
+        sysc = oh->class->sysc;
+        if (sysc->sysc_flags & SYSS_HAS_RESET_STATUS)
+                omap_test_timeout((omap_hwmod_read(oh, sysc->syss_offs)
+                                   & SYSS_RESETDONE_MASK),
+                                  MAX_MODULE_SOFTRESET_WAIT, c);
+        else if (sysc->sysc_flags & SYSC_HAS_RESET_STATUS) {
+                softrst_mask = (0x1 << sysc->sysc_fields->srst_shift);
+                omap_test_timeout(!(omap_hwmod_read(oh, sysc->sysc_offs)
+                                    & softrst_mask),
+                                  MAX_MODULE_SOFTRESET_WAIT, c);
+        }
+        return c;
+}
+/**
 * _set_dmadisable: set OCP_SYSCONFIG.DMADISABLE bit in @v
 * @oh: struct omap_hwmod *
 *
@@ -1280,6 +1312,18 @@ static void _enable_sysc(struct omap_hwmod *oh)
        if (!oh->class->sysc)
                return;
+        /*
+         * Wait until reset has completed, this is needed as the IP
+         * block is reset automatically by hardware in some cases
+         * (off-mode for example), and the drivers require the
+         * IP to be ready when they access it
+         */
+        if (oh->flags & HWMOD_CONTROL_OPT_CLKS_IN_RESET)
+                _enable_optional_clocks(oh);
+        _wait_softreset_complete(oh);
+        if (oh->flags & HWMOD_CONTROL_OPT_CLKS_IN_RESET)
+                _disable_optional_clocks(oh);
        v = oh->_sysc_cache;
        sf = oh->class->sysc->sysc_flags;
@@ -1802,7 +1846,7 @@ static int _am33xx_disable_module(struct omap_hwmod *oh)
 */
 static int _ocp_softreset(struct omap_hwmod *oh)
 {
-        u32 v, softrst_mask;
+        u32 v;
        int c = 0;
        int ret = 0;
@@ -1832,19 +1876,7 @@ static int _ocp_softreset(struct omap_hwmod *oh)
        if (oh->class->sysc->srst_udelay)
                udelay(oh->class->sysc->srst_udelay);
-        if (oh->class->sysc->sysc_flags & SYSS_HAS_RESET_STATUS)
+        c = _wait_softreset_complete(oh);
-                omap_test_timeout((omap_hwmod_read(oh,
-                                                    oh->class->sysc->syss_offs)
-                                   & SYSS_RESETDONE_MASK),
-                                  MAX_MODULE_SOFTRESET_WAIT, c);
-        else if (oh->class->sysc->sysc_flags & SYSC_HAS_RESET_STATUS) {
-                softrst_mask = (0x1 << oh->class->sysc->sysc_fields->srst_shift);
-                omap_test_timeout(!(omap_hwmod_read(oh,
-                                                     oh->class->sysc->sysc_offs)
-                                   & softrst_mask),
-                                  MAX_MODULE_SOFTRESET_WAIT, c);
-        }
        if (c == MAX_MODULE_SOFTRESET_WAIT)
                pr_warning("omap_hwmod: %s: softreset failed (waited %d usec)\n",
                           oh->name, MAX_MODULE_SOFTRESET_WAIT);
@@ -2351,6 +2383,9 @@ static int __init _setup_reset(struct omap_hwmod *oh)
        if (oh->_state != _HWMOD_STATE_INITIALIZED)
                return -EINVAL;
+        if (oh->flags & HWMOD_EXT_OPT_MAIN_CLK)
+                return -EPERM;
        if (oh->rst_lines_cnt == 0) {
                r = _enable(oh);
                if (r) {
diff --git a/arch/arm/mach-omap2/omap_hwmod.h b/arch/arm/mach-omap2/omap_hwmod.h
index 87b59b45c678..87a3c5b7aa74 100644
--- a/arch/arm/mach-omap2/omap_hwmod.h
+++ b/arch/arm/mach-omap2/omap_hwmod.h
@@ -442,6 +442,11 @@ struct omap_hwmod_omap4_prcm {
 *     in order to complete the reset. Optional clocks will be disabled
 *     again after the reset.
 * HWMOD_16BIT_REG: Module has 16bit registers
+ * HWMOD_EXT_OPT_MAIN_CLK: The only main functional clock source for
+ *     this IP block comes from an off-chip source and is not always
+ *     enabled.  This prevents the hwmod code from being able to
+ *     enable and reset the IP block early.  XXX Eventually it should
+ *     be possible to query the clock framework for this information.
 */
 #define HWMOD_SWSUP_SIDLE                       (1 << 0)
 #define HWMOD_SWSUP_MSTANDBY                    (1 << 1)
@@ -452,6 +457,7 @@ struct omap_hwmod_omap4_prcm {
 #define HWMOD_NO_IDLEST                         (1 << 6)
 #define HWMOD_CONTROL_OPT_CLKS_IN_RESET         (1 << 7)
 #define HWMOD_16BIT_REG                         (1 << 8)
+#define HWMOD_EXT_OPT_MAIN_CLK                  (1 << 9)
 /*
 * omap_hwmod._int_flags definitions
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 7a6132848f5d..b80bbf607ef8 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -25,6 +25,7 @@
 #include <plat-omap/dma-omap.h>
+#include <linux/platform_data/omap_ocp2scp.h>
 #include <linux/platform_data/spi-omap2-mcspi.h>
 #include <linux/platform_data/asoc-ti-mcbsp.h>
 #include <plat/dmtimer.h>
@@ -2126,6 +2127,14 @@ static struct omap_hwmod omap44xx_mcpdm_hwmod = {
        .name           = "mcpdm",
        .class          = &omap44xx_mcpdm_hwmod_class,
        .clkdm_name     = "abe_clkdm",
+        /*
+         * It's suspected that the McPDM requires an off-chip main
+         * functional clock, controlled via I2C.  This IP block is
+         * currently reset very early during boot, before I2C is
+         * available, so it doesn't seem that we have any choice in
+         * the kernel other than to avoid resetting it.
+         */
+        .flags          = HWMOD_EXT_OPT_MAIN_CLK,
        .mpu_irqs       = omap44xx_mcpdm_irqs,
        .sdma_reqs      = omap44xx_mcpdm_sdma_reqs,
        .main_clk       = "mcpdm_fck",
@@ -2682,6 +2691,32 @@ static struct omap_hwmod_class omap44xx_ocp2scp_hwmod_class = {
        .sysc   = &omap44xx_ocp2scp_sysc,
 };
+/* ocp2scp dev_attr */
+static struct resource omap44xx_usb_phy_and_pll_addrs[] = {
+        {
+                .name           = "usb_phy",
+                .start          = 0x4a0ad080,
+                .end            = 0x4a0ae000,
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                /* XXX: Remove this once control module driver is in place */
+                .name           = "ctrl_dev",
+                .start          = 0x4a002300,
+                .end            = 0x4a002303,
+                .flags          = IORESOURCE_MEM,
+        },
+        { }
+};
+static struct omap_ocp2scp_dev ocp2scp_dev_attr[] = {
+        {
+                .drv_name       = "omap-usb2",
+                .res            = omap44xx_usb_phy_and_pll_addrs,
+        },
+        { }
+};
 /* ocp2scp_usb_phy */
 static struct omap_hwmod omap44xx_ocp2scp_usb_phy_hwmod = {
        .name           = "ocp2scp_usb_phy",
@@ -2695,6 +2730,7 @@ static struct omap_hwmod omap44xx_ocp2scp_usb_phy_hwmod = {
                        .modulemode   = MODULEMODE_HWCTRL,
                },
        },
+        .dev_attr       = ocp2scp_dev_attr,
 };
 /*
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 827f54a1dd1d..e49b40b4c90a 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -70,6 +70,7 @@ void __init omap4_pmic_init(const char *pmic_type,
 {
        /* PMIC part*/
        omap_mux_init_signal("sys_nirq1", OMAP_PIN_INPUT_PULLUP | OMAP_PIN_OFF_WAKEUPENABLE);
+        omap_mux_init_signal("fref_clk0_out.sys_drm_msecure", OMAP_PIN_OUTPUT);
        omap_pmic_init(1, 400, pmic_type, 7 + OMAP44XX_IRQ_GIC_START, pmic_data);
        /* Register additional devices on i2c1 bus if needed */
@@ -363,7 +364,7 @@ static struct regulator_init_data omap4_clk32kg_idata = {
 };
 static struct regulator_consumer_supply omap4_vdd1_supply[] = {
-        REGULATOR_SUPPLY("vcc", "mpu.0"),
+        REGULATOR_SUPPLY("vcc", "cpu0"),
 };
 static struct regulator_consumer_supply omap4_vdd2_supply[] = {
diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
index 880249b17012..75878c37959b 100644
--- a/arch/arm/mach-omap2/vc.c
+++ b/arch/arm/mach-omap2/vc.c
@@ -264,7 +264,7 @@ static void __init omap_vc_i2c_init(struct voltagedomain *voltdm)
        if (initialized) {
                if (voltdm->pmic->i2c_high_speed != i2c_high_speed)
-                        pr_warn("%s: I2C config for vdd_%s does not match other channels (%u).",
+                        pr_warn("%s: I2C config for vdd_%s does not match other channels (%u).\n",
                                __func__, voltdm->name, i2c_high_speed);
                return;
        }
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index 5ecbd17b5641..e2c6391863fe 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -28,6 +28,7 @@
 #include <linux/mfd/asic3.h>
 #include <linux/mtd/physmap.h>
 #include <linux/pda_power.h>
+#include <linux/pwm.h>
 #include <linux/pwm_backlight.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/gpio-regulator.h>
@@ -556,7 +557,7 @@ static struct platform_device hx4700_lcd = {
 */
 static struct platform_pwm_backlight_data backlight_data = {
-        .pwm_id         = 1,
+        .pwm_id         = -1,   /* Superseded by pwm_lookup */
        .max_brightness = 200,
        .dft_brightness = 100,
        .pwm_period_ns  = 30923,
@@ -571,6 +572,10 @@ static struct platform_device backlight = {
        },
 };
+static struct pwm_lookup hx4700_pwm_lookup[] = {
+        PWM_LOOKUP("pxa27x-pwm.1", 0, "pwm-backlight", NULL),
+};
 /*
 * USB "Transceiver"
 */
@@ -872,6 +877,7 @@ static void __init hx4700_init(void)
        pxa_set_stuart_info(NULL);
        platform_add_devices(devices, ARRAY_SIZE(devices));
+        pwm_add_table(hx4700_pwm_lookup, ARRAY_SIZE(hx4700_pwm_lookup));
        pxa_set_ficp_info(&ficp_info);
        pxa27x_set_i2c_power_info(NULL);
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 438f02fe122a..842596d4d31e 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -86,10 +86,7 @@ static void spitz_discharge1(int on)
        gpio_set_value(SPITZ_GPIO_LED_GREEN, on);
 }
-static unsigned long gpio18_config[] = {
+static unsigned long gpio18_config = GPIO18_GPIO;
-        GPIO18_RDY,
-        GPIO18_GPIO,
-};
 static void spitz_presuspend(void)
 {
@@ -112,7 +109,7 @@ static void spitz_presuspend(void)
        PGSR3 &= ~SPITZ_GPIO_G3_STROBE_BIT;
        PGSR2 |= GPIO_bit(SPITZ_GPIO_KEY_STROBE0);
-        pxa2xx_mfp_config(&gpio18_config[0], 1);
+        pxa2xx_mfp_config(&gpio18_config, 1);
        gpio_request_one(18, GPIOF_OUT_INIT_HIGH, "Unknown");
        gpio_free(18);
@@ -131,7 +128,6 @@ static void spitz_presuspend(void)
 static void spitz_postsuspend(void)
 {
-        pxa2xx_mfp_config(&gpio18_config[1], 1);
 }
 static int spitz_should_wakeup(unsigned int resume_on_alarm)
diff --git a/arch/arm/tools/Makefile b/arch/arm/tools/Makefile
index cd60a81163e9..32d05c8219dc 100644
--- a/arch/arm/tools/Makefile
+++ b/arch/arm/tools/Makefile
@@ -5,6 +5,6 @@
 #
 include/generated/mach-types.h: $(src)/gen-mach-types $(src)/mach-types
-        $(kecho) '  Generating $@'
+        @$(kecho) '  Generating $@'
        @mkdir -p $(dir $@)
        $(Q)$(AWK) -f $^ > $@ || { rm -f $@; /bin/false; }
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 54f6116697f7..d2f05a608274 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -222,7 +222,7 @@ extern void __iomem *__ioremap(phys_addr_t phys_addr, size_t size, pgprot_t prot
 extern void __iounmap(volatile void __iomem *addr);
 #define PROT_DEFAULT            (PTE_TYPE_PAGE | PTE_AF | PTE_DIRTY)
-#define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_XN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
+#define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL_NC))
 #define ioremap(addr, size)             __ioremap((addr), (size), __pgprot(PROT_DEVICE_nGnRE))
diff --git a/arch/arm64/include/asm/pgtable-hwdef.h b/arch/arm64/include/asm/pgtable-hwdef.h
index 0f3b4581d925..75fd13d289b9 100644
--- a/arch/arm64/include/asm/pgtable-hwdef.h
+++ b/arch/arm64/include/asm/pgtable-hwdef.h
@@ -38,7 +38,8 @@
 #define PMD_SECT_S              (_AT(pmdval_t, 3) << 8)
 #define PMD_SECT_AF             (_AT(pmdval_t, 1) << 10)
 #define PMD_SECT_NG             (_AT(pmdval_t, 1) << 11)
-#define PMD_SECT_XN             (_AT(pmdval_t, 1) << 54)
+#define PMD_SECT_PXN            (_AT(pmdval_t, 1) << 53)
+#define PMD_SECT_UXN            (_AT(pmdval_t, 1) << 54)
 /*
 * AttrIndx[2:0] encoding (mapping attributes defined in the MAIR* registers).
@@ -57,7 +58,8 @@
 #define PTE_SHARED              (_AT(pteval_t, 3) << 8)         /* SH[1:0], inner shareable */
 #define PTE_AF                  (_AT(pteval_t, 1) << 10)        /* Access Flag */
 #define PTE_NG                  (_AT(pteval_t, 1) << 11)        /* nG */
-#define PTE_XN                  (_AT(pteval_t, 1) << 54)        /* XN */
+#define PTE_PXN                 (_AT(pteval_t, 1) << 53)        /* Privileged XN */
+#define PTE_UXN                 (_AT(pteval_t, 1) << 54)        /* User XN */
 /*
 * AttrIndx[2:0] encoding (mapping attributes defined in the MAIR* registers).
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 8960239be722..14aba2db6776 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -62,23 +62,23 @@ extern pgprot_t pgprot_default;
 #define _MOD_PROT(p, b) __pgprot(pgprot_val(p) | (b))
-#define PAGE_NONE               _MOD_PROT(pgprot_default, PTE_NG | PTE_XN | PTE_RDONLY)
+#define PAGE_NONE               _MOD_PROT(pgprot_default, PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define PAGE_SHARED             _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_XN)
+#define PAGE_SHARED             _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_UXN)
-#define PAGE_SHARED_EXEC        _MOD_PROT(pgprot_default, PTE_USER | PTE_NG)
+#define PAGE_SHARED_EXEC        _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN)
-#define PAGE_COPY               _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_XN | PTE_RDONLY)
+#define PAGE_COPY               _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define PAGE_COPY_EXEC          _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_RDONLY)
+#define PAGE_COPY_EXEC          _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_RDONLY)
-#define PAGE_READONLY           _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_XN | PTE_RDONLY)
+#define PAGE_READONLY           _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define PAGE_READONLY_EXEC      _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_RDONLY)
+#define PAGE_READONLY_EXEC      _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_RDONLY)
-#define PAGE_KERNEL             _MOD_PROT(pgprot_default, PTE_XN | PTE_DIRTY)
+#define PAGE_KERNEL             _MOD_PROT(pgprot_default, PTE_PXN | PTE_UXN | PTE_DIRTY)
-#define PAGE_KERNEL_EXEC        _MOD_PROT(pgprot_default, PTE_DIRTY)
+#define PAGE_KERNEL_EXEC        _MOD_PROT(pgprot_default, PTE_UXN | PTE_DIRTY)
-#define __PAGE_NONE             __pgprot(_PAGE_DEFAULT | PTE_NG | PTE_XN | PTE_RDONLY)
+#define __PAGE_NONE             __pgprot(_PAGE_DEFAULT | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define __PAGE_SHARED           __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_XN)
+#define __PAGE_SHARED           __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN)
-#define __PAGE_SHARED_EXEC      __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG)
+#define __PAGE_SHARED_EXEC      __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN)
-#define __PAGE_COPY             __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_XN | PTE_RDONLY)
+#define __PAGE_COPY             __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define __PAGE_COPY_EXEC        __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_RDONLY)
+#define __PAGE_COPY_EXEC        __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_RDONLY)
-#define __PAGE_READONLY         __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_XN | PTE_RDONLY)
+#define __PAGE_READONLY         __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
-#define __PAGE_READONLY_EXEC    __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_RDONLY)
+#define __PAGE_READONLY_EXEC    __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_RDONLY)
 #endif /* __ASSEMBLY__ */
@@ -130,10 +130,10 @@ extern struct page *empty_zero_page;
 #define pte_young(pte)          (pte_val(pte) & PTE_AF)
 #define pte_special(pte)        (pte_val(pte) & PTE_SPECIAL)
 #define pte_write(pte)          (!(pte_val(pte) & PTE_RDONLY))
-#define pte_exec(pte)           (!(pte_val(pte) & PTE_XN))
+#define pte_exec(pte)           (!(pte_val(pte) & PTE_UXN))
 #define pte_present_exec_user(pte) \
-        ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_XN)) == \
+        ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == \
         (PTE_VALID | PTE_USER))
 #define PTE_BIT_FUNC(fn,op) \
@@ -262,7 +262,7 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
-        const pteval_t mask = PTE_USER | PTE_XN | PTE_RDONLY;
+        const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY;
        pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
        return pte;
 }
diff --git a/arch/ia64/mm/init.c b/arch/ia64/mm/init.c
index acd5b68e8871..082e383c1b6f 100644
--- a/arch/ia64/mm/init.c
+++ b/arch/ia64/mm/init.c
@@ -637,7 +637,6 @@ mem_init (void)
        high_memory = __va(max_low_pfn * PAGE_SIZE);
-        reset_zone_present_pages();
        for_each_online_pgdat(pgdat)
                if (pgdat->bdata->node_bootmem_map)
                        totalram_pages += free_all_bootmem_node(pgdat);
diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
index 67e489d8d1bd..2df26b57c26a 100644
--- a/arch/m68k/include/asm/signal.h
+++ b/arch/m68k/include/asm/signal.h
@@ -41,7 +41,7 @@ struct k_sigaction {
 static inline void sigaddset(sigset_t *set, int _sig)
 {
        asm ("bfset %0{%1,#1}"
-                : "+od" (*set)
+                : "+o" (*set)
                : "id" ((_sig - 1) ^ 31)
                : "cc");
 }
@@ -49,7 +49,7 @@ static inline void sigaddset(sigset_t *set, int _sig)
 static inline void sigdelset(sigset_t *set, int _sig)
 {
        asm ("bfclr %0{%1,#1}"
-                : "+od" (*set)
+                : "+o" (*set)
                : "id" ((_sig - 1) ^ 31)
                : "cc");
 }
@@ -65,7 +65,7 @@ static inline int __gen_sigismember(sigset_t *set, int _sig)
        int ret;
        asm ("bfextu %1{%2,#1},%0"
                : "=d" (ret)
-                : "od" (*set), "id" ((_sig-1) ^ 31)
+                : "o" (*set), "id" ((_sig-1) ^ 31)
                : "cc");
        return ret;
 }
diff --git a/arch/mips/cavium-octeon/executive/cvmx-l2c.c b/arch/mips/cavium-octeon/executive/cvmx-l2c.c
index d38246e33ddb..9f883bf76953 100644
--- a/arch/mips/cavium-octeon/executive/cvmx-l2c.c
+++ b/arch/mips/cavium-octeon/executive/cvmx-l2c.c
@@ -30,6 +30,7 @@
 * measurement, and debugging facilities.
 */
+#include <linux/irqflags.h>
 #include <asm/octeon/cvmx.h>
 #include <asm/octeon/cvmx-l2c.h>
 #include <asm/octeon/cvmx-spinlock.h>
diff --git a/arch/mips/fw/arc/misc.c b/arch/mips/fw/arc/misc.c
index 7cf80ca2c1d2..f9f5307434c2 100644
--- a/arch/mips/fw/arc/misc.c
+++ b/arch/mips/fw/arc/misc.c
@@ -11,6 +11,7 @@
 */
 #include <linux/init.h>
 #include <linux/kernel.h>
+#include <linux/irqflags.h>
 #include <asm/bcache.h>
diff --git a/arch/mips/include/asm/bitops.h b/arch/mips/include/asm/bitops.h
index 82ad35ce2b45..46ac73abd5ee 100644
--- a/arch/mips/include/asm/bitops.h
+++ b/arch/mips/include/asm/bitops.h
@@ -14,7 +14,6 @@
 #endif
 #include <linux/compiler.h>
-#include <linux/irqflags.h>
 #include <linux/types.h>
 #include <asm/barrier.h>
 #include <asm/byteorder.h>              /* sigh ... */
@@ -44,6 +43,24 @@
 #define smp_mb__before_clear_bit()      smp_mb__before_llsc()
 #define smp_mb__after_clear_bit()       smp_llsc_mb()
+/*
+ * These are the "slower" versions of the functions and are in bitops.c.
+ * These functions call raw_local_irq_{save,restore}().
+ */
+void __mips_set_bit(unsigned long nr, volatile unsigned long *addr);
+void __mips_clear_bit(unsigned long nr, volatile unsigned long *addr);
+void __mips_change_bit(unsigned long nr, volatile unsigned long *addr);
+int __mips_test_and_set_bit(unsigned long nr,
+                            volatile unsigned long *addr);
+int __mips_test_and_set_bit_lock(unsigned long nr,
+                                 volatile unsigned long *addr);
+int __mips_test_and_clear_bit(unsigned long nr,
+                              volatile unsigned long *addr);
+int __mips_test_and_change_bit(unsigned long nr,
+                               volatile unsigned long *addr);
 /*
 * set_bit - Atomically set a bit in memory
 * @nr: the bit to set
@@ -57,7 +74,7 @@
 static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
 {
        unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long temp;
        if (kernel_uses_llsc && R10000_LLSC_WAR) {
@@ -92,17 +109,8 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
                        : "=&r" (temp), "+m" (*m)
                        : "ir" (1UL << bit));
                } while (unlikely(!temp));
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                __mips_set_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                *a |= mask;
-                raw_local_irq_restore(flags);
-        }
 }
 /*
@@ -118,7 +126,7 @@ static inline void set_bit(unsigned long nr, volatile unsigned long *addr)
 static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
 {
        unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long temp;
        if (kernel_uses_llsc && R10000_LLSC_WAR) {
@@ -153,17 +161,8 @@ static inline void clear_bit(unsigned long nr, volatile unsigned long *addr)
                        : "=&r" (temp), "+m" (*m)
                        : "ir" (~(1UL << bit)));
                } while (unlikely(!temp));
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                __mips_clear_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                *a &= ~mask;
-                raw_local_irq_restore(flags);
-        }
 }
 /*
@@ -191,7 +190,7 @@ static inline void clear_bit_unlock(unsigned long nr, volatile unsigned long *ad
 */
 static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
 {
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        if (kernel_uses_llsc && R10000_LLSC_WAR) {
                unsigned long *m = ((unsigned long *) addr) + (nr >> SZLONG_LOG);
@@ -220,17 +219,8 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
                        : "=&r" (temp), "+m" (*m)
                        : "ir" (1UL << bit));
                } while (unlikely(!temp));
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                __mips_change_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                *a ^= mask;
-                raw_local_irq_restore(flags);
-        }
 }
 /*
@@ -244,7 +234,7 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *addr)
 static inline int test_and_set_bit(unsigned long nr,
        volatile unsigned long *addr)
 {
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long res;
        smp_mb__before_llsc();
@@ -281,18 +271,8 @@ static inline int test_and_set_bit(unsigned long nr,
                } while (unlikely(!res));
                res = temp & (1UL << bit);
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                res = __mips_test_and_set_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                res = (mask & *a);
-                *a |= mask;
-                raw_local_irq_restore(flags);
-        }
        smp_llsc_mb();
@@ -310,7 +290,7 @@ static inline int test_and_set_bit(unsigned long nr,
 static inline int test_and_set_bit_lock(unsigned long nr,
        volatile unsigned long *addr)
 {
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long res;
        if (kernel_uses_llsc && R10000_LLSC_WAR) {
@@ -345,18 +325,8 @@ static inline int test_and_set_bit_lock(unsigned long nr,
                } while (unlikely(!res));
                res = temp & (1UL << bit);
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                res = __mips_test_and_set_bit_lock(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                res = (mask & *a);
-                *a |= mask;
-                raw_local_irq_restore(flags);
-        }
        smp_llsc_mb();
@@ -373,7 +343,7 @@ static inline int test_and_set_bit_lock(unsigned long nr,
 static inline int test_and_clear_bit(unsigned long nr,
        volatile unsigned long *addr)
 {
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long res;
        smp_mb__before_llsc();
@@ -428,18 +398,8 @@ static inline int test_and_clear_bit(unsigned long nr,
                } while (unlikely(!res));
                res = temp & (1UL << bit);
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                res = __mips_test_and_clear_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                res = (mask & *a);
-                *a &= ~mask;
-                raw_local_irq_restore(flags);
-        }
        smp_llsc_mb();
@@ -457,7 +417,7 @@ static inline int test_and_clear_bit(unsigned long nr,
 static inline int test_and_change_bit(unsigned long nr,
        volatile unsigned long *addr)
 {
-        unsigned short bit = nr & SZLONG_MASK;
+        int bit = nr & SZLONG_MASK;
        unsigned long res;
        smp_mb__before_llsc();
@@ -494,18 +454,8 @@ static inline int test_and_change_bit(unsigned long nr,
                } while (unlikely(!res));
                res = temp & (1UL << bit);
-        } else {
+        } else
-                volatile unsigned long *a = addr;
+                res = __mips_test_and_change_bit(nr, addr);
-                unsigned long mask;
-                unsigned long flags;
-                a += nr >> SZLONG_LOG;
-                mask = 1UL << bit;
-                raw_local_irq_save(flags);
-                res = (mask & *a);
-                *a ^= mask;
-                raw_local_irq_restore(flags);
-        }
        smp_llsc_mb();
diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h
index 58277e0e9cd4..3c5d1464b7bd 100644
--- a/arch/mips/include/asm/compat.h
+++ b/arch/mips/include/asm/compat.h
@@ -290,7 +290,7 @@ struct compat_shmid64_ds {
 static inline int is_compat_task(void)
 {
-        return test_thread_flag(TIF_32BIT);
+        return test_thread_flag(TIF_32BIT_ADDR);
 }
 #endif /* _ASM_COMPAT_H */
diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
index 29d9c23c20c7..ff2e0345e013 100644
--- a/arch/mips/include/asm/io.h
+++ b/arch/mips/include/asm/io.h
@@ -15,6 +15,7 @@
 #include <linux/compiler.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
+#include <linux/irqflags.h>
 #include <asm/addrspace.h>
 #include <asm/bug.h>
diff --git a/arch/mips/include/asm/irqflags.h b/arch/mips/include/asm/irqflags.h
index 309cbcd6909c..9f3384c789d7 100644
--- a/arch/mips/include/asm/irqflags.h
+++ b/arch/mips/include/asm/irqflags.h
@@ -16,83 +16,13 @@
 #include <linux/compiler.h>
 #include <asm/hazards.h>
-__asm__(
+#if defined(CONFIG_CPU_MIPSR2) && !defined(CONFIG_MIPS_MT_SMTC)
-        "       .macro  arch_local_irq_enable                           \n"
-        "       .set    push                                            \n"
-        "       .set    reorder                                         \n"
-        "       .set    noat                                            \n"
-#ifdef CONFIG_MIPS_MT_SMTC
-        "       mfc0    $1, $2, 1       # SMTC - clear TCStatus.IXMT    \n"
-        "       ori     $1, 0x400                                       \n"
-        "       xori    $1, 0x400                                       \n"
-        "       mtc0    $1, $2, 1                                       \n"
-#elif defined(CONFIG_CPU_MIPSR2)
-        "       ei                                                      \n"
-#else
-        "       mfc0    $1,$12                                          \n"
-        "       ori     $1,0x1f                                         \n"
-        "       xori    $1,0x1e                                         \n"
-        "       mtc0    $1,$12                                          \n"
-#endif
-        "       irq_enable_hazard                                       \n"
-        "       .set    pop                                             \n"
-        "       .endm");
-extern void smtc_ipi_replay(void);
-static inline void arch_local_irq_enable(void)
-{
-#ifdef CONFIG_MIPS_MT_SMTC
-        /*
-         * SMTC kernel needs to do a software replay of queued
-         * IPIs, at the cost of call overhead on each local_irq_enable()
-         */
-        smtc_ipi_replay();
-#endif
-        __asm__ __volatile__(
-                "arch_local_irq_enable"
-                : /* no outputs */
-                : /* no inputs */
-                : "memory");
-}
-/*
- * For cli() we have to insert nops to make sure that the new value
- * has actually arrived in the status register before the end of this
- * macro.
- * R4000/R4400 need three nops, the R4600 two nops and the R10000 needs
- * no nops at all.
- */
-/*
- * For TX49, operating only IE bit is not enough.
- *
- * If mfc0 $12 follows store and the mfc0 is last instruction of a
- * page and fetching the next instruction causes TLB miss, the result
- * of the mfc0 might wrongly contain EXL bit.
- *
- * ERT-TX49H2-027, ERT-TX49H3-012, ERT-TX49HL3-006, ERT-TX49H4-008
- *
- * Workaround: mask EXL bit of the result or place a nop before mfc0.
- */
 __asm__(
        "       .macro  arch_local_irq_disable\n"
        "       .set    push                                            \n"
        "       .set    noat                                            \n"
-#ifdef CONFIG_MIPS_MT_SMTC
-        "       mfc0    $1, $2, 1                                       \n"
-        "       ori     $1, 0x400                                       \n"
-        "       .set    noreorder                                       \n"
-        "       mtc0    $1, $2, 1                                       \n"
-#elif defined(CONFIG_CPU_MIPSR2)
        "       di                                                      \n"
-#else
-        "       mfc0    $1,$12                                          \n"
-        "       ori     $1,0x1f                                         \n"
-        "       xori    $1,0x1f                                         \n"
-        "       .set    noreorder                                       \n"
-        "       mtc0    $1,$12                                          \n"
-#endif
        "       irq_disable_hazard                                      \n"
        "       .set    pop                                             \n"
        "       .endm                                                   \n");
@@ -106,46 +36,14 @@ static inline void arch_local_irq_disable(void)
                : "memory");
 }
-__asm__(
-        "       .macro  arch_local_save_flags flags                     \n"
-        "       .set    push                                            \n"
-        "       .set    reorder                                         \n"
-#ifdef CONFIG_MIPS_MT_SMTC
-        "       mfc0    \\flags, $2, 1                                  \n"
-#else
-        "       mfc0    \\flags, $12                                    \n"
-#endif
-        "       .set    pop                                             \n"
-        "       .endm                                                   \n");
-static inline unsigned long arch_local_save_flags(void)
-{
-        unsigned long flags;
-        asm volatile("arch_local_save_flags %0" : "=r" (flags));
-        return flags;
-}
 __asm__(
        "       .macro  arch_local_irq_save result                      \n"
        "       .set    push                                            \n"
        "       .set    reorder                                         \n"
        "       .set    noat                                            \n"
-#ifdef CONFIG_MIPS_MT_SMTC
-        "       mfc0    \\result, $2, 1                                 \n"
-        "       ori     $1, \\result, 0x400                             \n"
-        "       .set    noreorder                                       \n"
-        "       mtc0    $1, $2, 1                                       \n"
-        "       andi    \\result, \\result, 0x400                       \n"
-#elif defined(CONFIG_CPU_MIPSR2)
        "       di      \\result                                        \n"
        "       andi    \\result, 1                                     \n"
-#else
-        "       mfc0    \\result, $12                                   \n"
-        "       ori     $1, \\result, 0x1f                              \n"
-        "       xori    $1, 0x1f                                        \n"
-        "       .set    noreorder                                       \n"
-        "       mtc0    $1, $12                                         \n"
-#endif
        "       irq_disable_hazard                                      \n"
        "       .set    pop                                             \n"
        "       .endm                                                   \n");
@@ -160,61 +58,37 @@ static inline unsigned long arch_local_irq_save(void)
        return flags;
 }
 __asm__(
        "       .macro  arch_local_irq_restore flags                    \n"
        "       .set    push                                            \n"
        "       .set    noreorder                                       \n"
        "       .set    noat                                            \n"
-#ifdef CONFIG_MIPS_MT_SMTC
+#if defined(CONFIG_IRQ_CPU)
-        "mfc0   $1, $2, 1                                               \n"
-        "andi   \\flags, 0x400                                          \n"
-        "ori    $1, 0x400                                               \n"
-        "xori   $1, 0x400                                               \n"
-        "or     \\flags, $1                                             \n"
-        "mtc0   \\flags, $2, 1                                          \n"
-#elif defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
        /*
         * Slow, but doesn't suffer from a relatively unlikely race
         * condition we're having since days 1.
         */
        "       beqz    \\flags, 1f                                     \n"
-        "        di                                                     \n"
+        "       di                                                      \n"
        "       ei                                                      \n"
        "1:                                                             \n"
-#elif defined(CONFIG_CPU_MIPSR2)
+#else
        /*
         * Fast, dangerous.  Life is fun, life is good.
         */
        "       mfc0    $1, $12                                         \n"
        "       ins     $1, \\flags, 0, 1                               \n"
        "       mtc0    $1, $12                                         \n"
-#else
-        "       mfc0    $1, $12                                         \n"
-        "       andi    \\flags, 1                                      \n"
-        "       ori     $1, 0x1f                                        \n"
-        "       xori    $1, 0x1f                                        \n"
-        "       or      \\flags, $1                                     \n"
-        "       mtc0    \\flags, $12                                    \n"
 #endif
        "       irq_disable_hazard                                      \n"
        "       .set    pop                                             \n"
        "       .endm                                                   \n");
 static inline void arch_local_irq_restore(unsigned long flags)
 {
        unsigned long __tmp1;
-#ifdef CONFIG_MIPS_MT_SMTC
-        /*
-         * SMTC kernel needs to do a software replay of queued
-         * IPIs, at the cost of branch and call overhead on each
-         * local_irq_restore()
-         */
-        if (unlikely(!(flags & 0x0400)))
-                smtc_ipi_replay();
-#endif
        __asm__ __volatile__(
                "arch_local_irq_restore\t%0"
                : "=r" (__tmp1)
@@ -232,6 +106,75 @@ static inline void __arch_local_irq_restore(unsigned long flags)
                : "0" (flags)
                : "memory");
 }
+#else
+/* Functions that require preempt_{dis,en}able() are in mips-atomic.c */
+void arch_local_irq_disable(void);
+unsigned long arch_local_irq_save(void);
+void arch_local_irq_restore(unsigned long flags);
+void __arch_local_irq_restore(unsigned long flags);
+#endif /* if defined(CONFIG_CPU_MIPSR2) && !defined(CONFIG_MIPS_MT_SMTC) */
+__asm__(
+        "       .macro  arch_local_irq_enable                           \n"
+        "       .set    push                                            \n"
+        "       .set    reorder                                         \n"
+        "       .set    noat                                            \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    $1, $2, 1       # SMTC - clear TCStatus.IXMT    \n"
+        "       ori     $1, 0x400                                       \n"
+        "       xori    $1, 0x400                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
+        "       ei                                                      \n"
+#else
+        "       mfc0    $1,$12                                          \n"
+        "       ori     $1,0x1f                                         \n"
+        "       xori    $1,0x1e                                         \n"
+        "       mtc0    $1,$12                                          \n"
+#endif
+        "       irq_enable_hazard                                       \n"
+        "       .set    pop                                             \n"
+        "       .endm");
+extern void smtc_ipi_replay(void);
+static inline void arch_local_irq_enable(void)
+{
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * SMTC kernel needs to do a software replay of queued
+         * IPIs, at the cost of call overhead on each local_irq_enable()
+         */
+        smtc_ipi_replay();
+#endif
+        __asm__ __volatile__(
+                "arch_local_irq_enable"
+                : /* no outputs */
+                : /* no inputs */
+                : "memory");
+}
+__asm__(
+        "       .macro  arch_local_save_flags flags                     \n"
+        "       .set    push                                            \n"
+        "       .set    reorder                                         \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    \\flags, $2, 1                                  \n"
+#else
+        "       mfc0    \\flags, $12                                    \n"
+#endif
+        "       .set    pop                                             \n"
+        "       .endm                                                   \n");
+static inline unsigned long arch_local_save_flags(void)
+{
+        unsigned long flags;
+        asm volatile("arch_local_save_flags %0" : "=r" (flags));
+        return flags;
+}
 static inline int arch_irqs_disabled_flags(unsigned long flags)
 {
@@ -245,7 +188,7 @@ static inline int arch_irqs_disabled_flags(unsigned long flags)
 #endif
 }
-#endif
+#endif /* #ifndef __ASSEMBLY__ */
 /*
 * Do the CPU's IRQ-state tracing from assembly code.
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 8debe9e91754..18806a52061c 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -112,12 +112,6 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define TIF_LOAD_WATCH          25      /* If set, load watch registers */
 #define TIF_SYSCALL_TRACE       31      /* syscall trace active */
-#ifdef CONFIG_MIPS32_O32
-#define TIF_32BIT TIF_32BIT_REGS
-#elif defined(CONFIG_MIPS32_N32)
-#define TIF_32BIT _TIF_32BIT_ADDR
-#endif /* CONFIG_MIPS32_O32 */
 #define _TIF_SYSCALL_TRACE      (1<<TIF_SYSCALL_TRACE)
 #define _TIF_SIGPENDING         (1<<TIF_SIGPENDING)
 #define _TIF_NEED_RESCHED       (1<<TIF_NEED_RESCHED)
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index a53f8ec37aac..290dc6a1d7a3 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -79,7 +79,7 @@ static struct resource data_resource = { .name = "Kernel data", };
 void __init add_memory_region(phys_t start, phys_t size, long type)
 {
        int x = boot_mem_map.nr_map;
-        struct boot_mem_map_entry *prev = boot_mem_map.map + x - 1;
+        int i;
        /* Sanity check */
        if (start + size < start) {
@@ -88,15 +88,29 @@ void __init add_memory_region(phys_t start, phys_t size, long type)
        }
        /*
-         * Try to merge with previous entry if any.  This is far less than
+         * Try to merge with existing entry, if any.
-         * perfect but is sufficient for most real world cases.
         */
-        if (x && prev->addr + prev->size == start && prev->type == type) {
+        for (i = 0; i < boot_mem_map.nr_map; i++) {
-                prev->size += size;
+                struct boot_mem_map_entry *entry = boot_mem_map.map + i;
+                unsigned long top;
+                if (entry->type != type)
+                        continue;
+                if (start + size < entry->addr)
+                        continue;                       /* no overlap */
+                if (entry->addr + entry->size < start)
+                        continue;                       /* no overlap */
+                top = max(entry->addr + entry->size, start + size);
+                entry->addr = min(entry->addr, start);
+                entry->size = top - entry->addr;
                return;
        }
-        if (x == BOOT_MEM_MAP_MAX) {
+        if (boot_mem_map.nr_map == BOOT_MEM_MAP_MAX) {
                pr_err("Ooops! Too many entries in the memory map!\n");
                return;
        }
diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile
index c4a82e841c73..eeddc58802e1 100644
--- a/arch/mips/lib/Makefile
+++ b/arch/mips/lib/Makefile
@@ -2,8 +2,9 @@
 # Makefile for MIPS-specific library files..
 #
-lib-y   += csum_partial.o delay.o memcpy.o memset.o \
+lib-y   += bitops.o csum_partial.o delay.o memcpy.o memset.o \
-           strlen_user.o strncpy_user.o strnlen_user.o uncached.o
+           mips-atomic.o strlen_user.o strncpy_user.o \
+           strnlen_user.o uncached.o
 obj-y                   += iomap.o
 obj-$(CONFIG_PCI)       += iomap-pci.o
diff --git a/arch/mips/lib/bitops.c b/arch/mips/lib/bitops.c
new file mode 100644
index 000000000000..239a9c957b02
--- /dev/null
+++ b/arch/mips/lib/bitops.c
@@ -0,0 +1,179 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (c) 1994-1997, 99, 2000, 06, 07 Ralf Baechle (ralf@linux-mips.org)
+ * Copyright (c) 1999, 2000  Silicon Graphics, Inc.
+ */
+#include <linux/bitops.h>
+#include <linux/irqflags.h>
+#include <linux/export.h>
+/**
+ * __mips_set_bit - Atomically set a bit in memory.  This is called by
+ * set_bit() if it cannot find a faster solution.
+ * @nr: the bit to set
+ * @addr: the address to start counting from
+ */
+void __mips_set_bit(unsigned long nr, volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        *a |= mask;
+        raw_local_irq_restore(flags);
+}
+EXPORT_SYMBOL(__mips_set_bit);
+/**
+ * __mips_clear_bit - Clears a bit in memory.  This is called by clear_bit() if
+ * it cannot find a faster solution.
+ * @nr: Bit to clear
+ * @addr: Address to start counting from
+ */
+void __mips_clear_bit(unsigned long nr, volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        *a &= ~mask;
+        raw_local_irq_restore(flags);
+}
+EXPORT_SYMBOL(__mips_clear_bit);
+/**
+ * __mips_change_bit - Toggle a bit in memory.  This is called by change_bit()
+ * if it cannot find a faster solution.
+ * @nr: Bit to change
+ * @addr: Address to start counting from
+ */
+void __mips_change_bit(unsigned long nr, volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        *a ^= mask;
+        raw_local_irq_restore(flags);
+}
+EXPORT_SYMBOL(__mips_change_bit);
+/**
+ * __mips_test_and_set_bit - Set a bit and return its old value.  This is
+ * called by test_and_set_bit() if it cannot find a faster solution.
+ * @nr: Bit to set
+ * @addr: Address to count from
+ */
+int __mips_test_and_set_bit(unsigned long nr,
+                            volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        unsigned long res;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        res = (mask & *a);
+        *a |= mask;
+        raw_local_irq_restore(flags);
+        return res;
+}
+EXPORT_SYMBOL(__mips_test_and_set_bit);
+/**
+ * __mips_test_and_set_bit_lock - Set a bit and return its old value.  This is
+ * called by test_and_set_bit_lock() if it cannot find a faster solution.
+ * @nr: Bit to set
+ * @addr: Address to count from
+ */
+int __mips_test_and_set_bit_lock(unsigned long nr,
+                                 volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        unsigned long res;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        res = (mask & *a);
+        *a |= mask;
+        raw_local_irq_restore(flags);
+        return res;
+}
+EXPORT_SYMBOL(__mips_test_and_set_bit_lock);
+/**
+ * __mips_test_and_clear_bit - Clear a bit and return its old value.  This is
+ * called by test_and_clear_bit() if it cannot find a faster solution.
+ * @nr: Bit to clear
+ * @addr: Address to count from
+ */
+int __mips_test_and_clear_bit(unsigned long nr, volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        unsigned long res;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        res = (mask & *a);
+        *a &= ~mask;
+        raw_local_irq_restore(flags);
+        return res;
+}
+EXPORT_SYMBOL(__mips_test_and_clear_bit);
+/**
+ * __mips_test_and_change_bit - Change a bit and return its old value.  This is
+ * called by test_and_change_bit() if it cannot find a faster solution.
+ * @nr: Bit to change
+ * @addr: Address to count from
+ */
+int __mips_test_and_change_bit(unsigned long nr, volatile unsigned long *addr)
+{
+        volatile unsigned long *a = addr;
+        unsigned bit = nr & SZLONG_MASK;
+        unsigned long mask;
+        unsigned long flags;
+        unsigned long res;
+        a += nr >> SZLONG_LOG;
+        mask = 1UL << bit;
+        raw_local_irq_save(flags);
+        res = (mask & *a);
+        *a ^= mask;
+        raw_local_irq_restore(flags);
+        return res;
+}
+EXPORT_SYMBOL(__mips_test_and_change_bit);
diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c
new file mode 100644
index 000000000000..cd160be3ce4d
--- /dev/null
+++ b/arch/mips/lib/mips-atomic.c
@@ -0,0 +1,176 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 1994, 95, 96, 97, 98, 99, 2003 by Ralf Baechle
+ * Copyright (C) 1996 by Paul M. Antoine
+ * Copyright (C) 1999 Silicon Graphics
+ * Copyright (C) 2000 MIPS Technologies, Inc.
+ */
+#include <asm/irqflags.h>
+#include <asm/hazards.h>
+#include <linux/compiler.h>
+#include <linux/preempt.h>
+#include <linux/export.h>
+#if !defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_MIPS_MT_SMTC)
+/*
+ * For cli() we have to insert nops to make sure that the new value
+ * has actually arrived in the status register before the end of this
+ * macro.
+ * R4000/R4400 need three nops, the R4600 two nops and the R10000 needs
+ * no nops at all.
+ */
+/*
+ * For TX49, operating only IE bit is not enough.
+ *
+ * If mfc0 $12 follows store and the mfc0 is last instruction of a
+ * page and fetching the next instruction causes TLB miss, the result
+ * of the mfc0 might wrongly contain EXL bit.
+ *
+ * ERT-TX49H2-027, ERT-TX49H3-012, ERT-TX49HL3-006, ERT-TX49H4-008
+ *
+ * Workaround: mask EXL bit of the result or place a nop before mfc0.
+ */
+__asm__(
+        "       .macro  arch_local_irq_disable\n"
+        "       .set    push                                            \n"
+        "       .set    noat                                            \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    $1, $2, 1                                       \n"
+        "       ori     $1, 0x400                                       \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
+        /* see irqflags.h for inline function */
+#else
+        "       mfc0    $1,$12                                          \n"
+        "       ori     $1,0x1f                                         \n"
+        "       xori    $1,0x1f                                         \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1,$12                                          \n"
+#endif
+        "       irq_disable_hazard                                      \n"
+        "       .set    pop                                             \n"
+        "       .endm                                                   \n");
+notrace void arch_local_irq_disable(void)
+{
+        preempt_disable();
+        __asm__ __volatile__(
+                "arch_local_irq_disable"
+                : /* no outputs */
+                : /* no inputs */
+                : "memory");
+        preempt_enable();
+}
+EXPORT_SYMBOL(arch_local_irq_disable);
+__asm__(
+        "       .macro  arch_local_irq_save result                      \n"
+        "       .set    push                                            \n"
+        "       .set    reorder                                         \n"
+        "       .set    noat                                            \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "       mfc0    \\result, $2, 1                                 \n"
+        "       ori     $1, \\result, 0x400                             \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1, $2, 1                                       \n"
+        "       andi    \\result, \\result, 0x400                       \n"
+#elif defined(CONFIG_CPU_MIPSR2)
+        /* see irqflags.h for inline function */
+#else
+        "       mfc0    \\result, $12                                   \n"
+        "       ori     $1, \\result, 0x1f                              \n"
+        "       xori    $1, 0x1f                                        \n"
+        "       .set    noreorder                                       \n"
+        "       mtc0    $1, $12                                         \n"
+#endif
+        "       irq_disable_hazard                                      \n"
+        "       .set    pop                                             \n"
+        "       .endm                                                   \n");
+notrace unsigned long arch_local_irq_save(void)
+{
+        unsigned long flags;
+        preempt_disable();
+        asm volatile("arch_local_irq_save\t%0"
+                     : "=r" (flags)
+                     : /* no inputs */
+                     : "memory");
+        preempt_enable();
+        return flags;
+}
+EXPORT_SYMBOL(arch_local_irq_save);
+__asm__(
+        "       .macro  arch_local_irq_restore flags                    \n"
+        "       .set    push                                            \n"
+        "       .set    noreorder                                       \n"
+        "       .set    noat                                            \n"
+#ifdef CONFIG_MIPS_MT_SMTC
+        "mfc0   $1, $2, 1                                               \n"
+        "andi   \\flags, 0x400                                          \n"
+        "ori    $1, 0x400                                               \n"
+        "xori   $1, 0x400                                               \n"
+        "or     \\flags, $1                                             \n"
+        "mtc0   \\flags, $2, 1                                          \n"
+#elif defined(CONFIG_CPU_MIPSR2) && defined(CONFIG_IRQ_CPU)
+        /* see irqflags.h for inline function */
+#elif defined(CONFIG_CPU_MIPSR2)
+        /* see irqflags.h for inline function */
+#else
+        "       mfc0    $1, $12                                         \n"
+        "       andi    \\flags, 1                                      \n"
+        "       ori     $1, 0x1f                                        \n"
+        "       xori    $1, 0x1f                                        \n"
+        "       or      \\flags, $1                                     \n"
+        "       mtc0    \\flags, $12                                    \n"
+#endif
+        "       irq_disable_hazard                                      \n"
+        "       .set    pop                                             \n"
+        "       .endm                                                   \n");
+notrace void arch_local_irq_restore(unsigned long flags)
+{
+        unsigned long __tmp1;
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * SMTC kernel needs to do a software replay of queued
+         * IPIs, at the cost of branch and call overhead on each
+         * local_irq_restore()
+         */
+        if (unlikely(!(flags & 0x0400)))
+                smtc_ipi_replay();
+#endif
+        preempt_disable();
+        __asm__ __volatile__(
+                "arch_local_irq_restore\t%0"
+                : "=r" (__tmp1)
+                : "0" (flags)
+                : "memory");
+        preempt_enable();
+}
+EXPORT_SYMBOL(arch_local_irq_restore);
+notrace void __arch_local_irq_restore(unsigned long flags)
+{
+        unsigned long __tmp1;
+        preempt_disable();
+        __asm__ __volatile__(
+                "arch_local_irq_restore\t%0"
+                : "=r" (__tmp1)
+                : "0" (flags)
+                : "memory");
+        preempt_enable();
+}
+EXPORT_SYMBOL(__arch_local_irq_restore);
+#endif /* !defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_MIPS_MT_SMTC) */
diff --git a/arch/mips/mti-malta/malta-platform.c b/arch/mips/mti-malta/malta-platform.c
index 80562b81f0f2..74732177851c 100644
--- a/arch/mips/mti-malta/malta-platform.c
+++ b/arch/mips/mti-malta/malta-platform.c
@@ -29,6 +29,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <asm/mips-boards/maltaint.h>
 #include <mtd/mtd-abi.h>
 #define SMC_PORT(base, int)                                             \
@@ -48,7 +49,7 @@ static struct plat_serial8250_port uart8250_data[] = {
        SMC_PORT(0x2F8, 3),
        {
                .mapbase        = 0x1f000900,   /* The CBUS UART */
-                .irq            = MIPS_CPU_IRQ_BASE + 2,
+                .irq            = MIPS_CPU_IRQ_BASE + MIPSCPU_INT_MB2,
                .uartclk        = 3686400,      /* Twice the usual clk! */
                .iotype         = UPIO_MEM32,
                .flags          = CBUS_UART_FLAGS,
diff --git a/arch/parisc/kernel/signal32.c b/arch/parisc/kernel/signal32.c
index fd49aeda9eb8..5dede04f2f3e 100644
--- a/arch/parisc/kernel/signal32.c
+++ b/arch/parisc/kernel/signal32.c
@@ -65,7 +65,8 @@ put_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
 {
        compat_sigset_t s;
-        if (sz != sizeof *set) panic("put_sigset32()");
+        if (sz != sizeof *set)
+                return -EINVAL;
        sigset_64to32(&s, set);
        return copy_to_user(up, &s, sizeof s);
@@ -77,7 +78,8 @@ get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
        compat_sigset_t s;
        int r;
-        if (sz != sizeof *set) panic("put_sigset32()");
+        if (sz != sizeof *set)
+                return -EINVAL;
        if ((r = copy_from_user(&s, up, sz)) == 0) {
                sigset_32to64(set, &s);
diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
index 7426e40699bd..f76c10863c62 100644
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -73,6 +73,8 @@ static unsigned long get_shared_area(struct address_space *mapping,
        struct vm_area_struct *vma;
        int offset = mapping ? get_offset(mapping) : 0;
+        offset = (offset + (pgoff << PAGE_SHIFT)) & 0x3FF000;
        addr = DCACHE_ALIGN(addr - offset) + offset;
        for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi
index 7ab286ab5300..39ed65a44c5f 100644
--- a/arch/powerpc/boot/dts/mpc5200b.dtsi
+++ b/arch/powerpc/boot/dts/mpc5200b.dtsi
@@ -231,6 +231,12 @@
                        interrupts = <2 7 0>;
                };
+                sclpc@3c00 {
+                        compatible = "fsl,mpc5200-lpbfifo";
+                        reg = <0x3c00 0x60>;
+                        interrupts = <2 23 0>;
+                };
                i2c@3d00 {
                        #address-cells = <1>;
                        #size-cells = <0>;
diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi
index 3444eb8f0ade..24f668039295 100644
--- a/arch/powerpc/boot/dts/o2d.dtsi
+++ b/arch/powerpc/boot/dts/o2d.dtsi
@@ -86,12 +86,6 @@
                                reg = <0>;
                        };
                };
-                sclpc@3c00 {
-                        compatible = "fsl,mpc5200-lpbfifo";
-                        reg = <0x3c00 0x60>;
-                        interrupts = <3 23 0>;
-                };
        };
        localbus {
diff --git a/arch/powerpc/boot/dts/pcm030.dts b/arch/powerpc/boot/dts/pcm030.dts
index 9e354997eb7e..96512c058033 100644
--- a/arch/powerpc/boot/dts/pcm030.dts
+++ b/arch/powerpc/boot/dts/pcm030.dts
@@ -59,7 +59,7 @@
                        #gpio-cells = <2>;
                };
-                psc@2000 { /* PSC1 in ac97 mode */
+                audioplatform: psc@2000 { /* PSC1 in ac97 mode */
                        compatible = "mpc5200b-psc-ac97","fsl,mpc5200b-psc-ac97";
                        cell-index = <0>;
                };
@@ -134,4 +134,9 @@
        localbus {
                status = "disabled";
        };
+        sound {
+                compatible = "phytec,pcm030-audio-fabric";
+                asoc-platform = <&audioplatform>;
+        };
 };
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pic.c b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
index 8520b58a5e9a..b89ef65392dc 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pic.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pic.c
@@ -372,10 +372,11 @@ static int mpc52xx_irqhost_map(struct irq_domain *h, unsigned int virq,
        case MPC52xx_IRQ_L1_MAIN: irqchip = &mpc52xx_main_irqchip; break;
        case MPC52xx_IRQ_L1_PERP: irqchip = &mpc52xx_periph_irqchip; break;
        case MPC52xx_IRQ_L1_SDMA: irqchip = &mpc52xx_sdma_irqchip; break;
-        default:
+        case MPC52xx_IRQ_L1_CRIT:
-                pr_err("%s: invalid irq: virq=%i, l1=%i, l2=%i\n",
+                pr_warn("%s: Critical IRQ #%d is unsupported! Nopping it.\n",
-                       __func__, virq, l1irq, l2irq);
+                        __func__, l2irq);
-                return -EINVAL;
+                irq_set_chip(virq, &no_irq_chip);
+                return 0;
        }
        irq_set_chip_and_handler(virq, irqchip, handle_level_irq);
diff --git a/arch/powerpc/platforms/pseries/eeh_pe.c b/arch/powerpc/platforms/pseries/eeh_pe.c
index 797cd181dc3f..d16c8ded1084 100644
--- a/arch/powerpc/platforms/pseries/eeh_pe.c
+++ b/arch/powerpc/platforms/pseries/eeh_pe.c
@@ -449,7 +449,7 @@ int eeh_rmv_from_parent_pe(struct eeh_dev *edev, int purge_pe)
                        if (list_empty(&pe->edevs)) {
                                cnt = 0;
                                list_for_each_entry(child, &pe->child_list, child) {
-                                        if (!(pe->type & EEH_PE_INVALID)) {
+                                        if (!(child->type & EEH_PE_INVALID)) {
                                                cnt++;
                                                break;
                                        }
diff --git a/arch/powerpc/platforms/pseries/msi.c b/arch/powerpc/platforms/pseries/msi.c
index d19f4977c834..e5b084723131 100644
--- a/arch/powerpc/platforms/pseries/msi.c
+++ b/arch/powerpc/platforms/pseries/msi.c
@@ -220,7 +220,8 @@ static struct device_node *find_pe_dn(struct pci_dev *dev, int *total)
        /* Get the top level device in the PE */
        edev = of_node_to_eeh_dev(dn);
-        edev = list_first_entry(&edev->pe->edevs, struct eeh_dev, list);
+        if (edev->pe)
+                edev = list_first_entry(&edev->pe->edevs, struct eeh_dev, list);
        dn = eeh_dev_to_of_node(edev);
        if (!dn)
                return NULL;
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 5dba755a43e6..d385f396dfee 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -96,6 +96,7 @@ config S390
        select HAVE_MEMBLOCK_NODE_MAP
        select HAVE_CMPXCHG_LOCAL
        select HAVE_CMPXCHG_DOUBLE
+        select HAVE_ALIGNED_STRUCT_PAGE if SLUB
        select HAVE_VIRT_CPU_ACCOUNTING
        select VIRT_CPU_ACCOUNTING
        select ARCH_DISCARD_MEMBLOCK
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index a34a9d612fc0..18cd6b592650 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -20,7 +20,7 @@
 #define PSW32_MASK_CC           0x00003000UL
 #define PSW32_MASK_PM           0x00000f00UL
-#define PSW32_MASK_USER         0x00003F00UL
+#define PSW32_MASK_USER         0x0000FF00UL
 #define PSW32_ADDR_AMODE        0x80000000UL
 #define PSW32_ADDR_INSN         0x7FFFFFFFUL
diff --git a/arch/s390/include/asm/topology.h b/arch/s390/include/asm/topology.h
index 9ca305383760..9935cbd6a46f 100644
--- a/arch/s390/include/asm/topology.h
+++ b/arch/s390/include/asm/topology.h
@@ -8,6 +8,9 @@ struct cpu;
 #ifdef CONFIG_SCHED_BOOK
+extern unsigned char cpu_socket_id[NR_CPUS];
+#define topology_physical_package_id(cpu) (cpu_socket_id[cpu])
 extern unsigned char cpu_core_id[NR_CPUS];
 extern cpumask_t cpu_core_map[NR_CPUS];
diff --git a/arch/s390/include/uapi/asm/ptrace.h b/arch/s390/include/uapi/asm/ptrace.h
index 705588a16d70..a5ca214b34fd 100644
--- a/arch/s390/include/uapi/asm/ptrace.h
+++ b/arch/s390/include/uapi/asm/ptrace.h
@@ -239,7 +239,7 @@ typedef struct
 #define PSW_MASK_EA             0x00000000UL
 #define PSW_MASK_BA             0x00000000UL
-#define PSW_MASK_USER           0x00003F00UL
+#define PSW_MASK_USER           0x0000FF00UL
 #define PSW_ADDR_AMODE          0x80000000UL
 #define PSW_ADDR_INSN           0x7FFFFFFFUL
@@ -269,7 +269,7 @@ typedef struct
 #define PSW_MASK_EA             0x0000000100000000UL
 #define PSW_MASK_BA             0x0000000080000000UL
-#define PSW_MASK_USER           0x00003F8180000000UL
+#define PSW_MASK_USER           0x0000FF8180000000UL
 #define PSW_ADDR_AMODE          0x0000000000000000UL
 #define PSW_ADDR_INSN           0xFFFFFFFFFFFFFFFFUL
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index a1e8a8694bb7..593fcc9253fc 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -309,6 +309,10 @@ static int restore_sigregs32(struct pt_regs *regs,_sigregs32 __user *sregs)
        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
                (__u64)(regs32.psw.mask & PSW32_MASK_USER) << 32 |
                (__u64)(regs32.psw.addr & PSW32_ADDR_AMODE);
+        /* Check for invalid user address space control. */
+        if ((regs->psw.mask & PSW_MASK_ASC) >= (psw_kernel_bits & PSW_MASK_ASC))
+                regs->psw.mask = (psw_user_bits & PSW_MASK_ASC) |
+                        (regs->psw.mask & ~PSW_MASK_ASC);
        regs->psw.addr = (__u64)(regs32.psw.addr & PSW32_ADDR_INSN);
        for (i = 0; i < NUM_GPRS; i++)
                regs->gprs[i] = (__u64) regs32.gprs[i];
@@ -481,7 +485,10 @@ static int setup_frame32(int sig, struct k_sigaction *ka,
        /* Set up registers for signal handler */
        regs->gprs[15] = (__force __u64) frame;
-        regs->psw.mask |= PSW_MASK_BA;          /* force amode 31 */
+        /* Force 31 bit amode and default user address space control. */
+        regs->psw.mask = PSW_MASK_BA |
+                (psw_user_bits & PSW_MASK_ASC) |
+                (regs->psw.mask & ~PSW_MASK_ASC);
        regs->psw.addr = (__force __u64) ka->sa.sa_handler;
        regs->gprs[2] = map_signal(sig);
@@ -549,7 +556,10 @@ static int setup_rt_frame32(int sig, struct k_sigaction *ka, siginfo_t *info,
        /* Set up registers for signal handler */
        regs->gprs[15] = (__force __u64) frame;
-        regs->psw.mask |= PSW_MASK_BA;          /* force amode 31 */
+        /* Force 31 bit amode and default user address space control. */
+        regs->psw.mask = PSW_MASK_BA |
+                (psw_user_bits & PSW_MASK_ASC) |
+                (regs->psw.mask & ~PSW_MASK_ASC);
        regs->psw.addr = (__u64) ka->sa.sa_handler;
        regs->gprs[2] = map_signal(sig);
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index c13a2a37ef00..d1259d875074 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -136,6 +136,10 @@ static int restore_sigregs(struct pt_regs *regs, _sigregs __user *sregs)
        /* Use regs->psw.mask instead of psw_user_bits to preserve PER bit. */
        regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
                (user_sregs.regs.psw.mask & PSW_MASK_USER);
+        /* Check for invalid user address space control. */
+        if ((regs->psw.mask & PSW_MASK_ASC) >= (psw_kernel_bits & PSW_MASK_ASC))
+                regs->psw.mask = (psw_user_bits & PSW_MASK_ASC) |
+                        (regs->psw.mask & ~PSW_MASK_ASC);
        /* Check for invalid amode */
        if (regs->psw.mask & PSW_MASK_EA)
                regs->psw.mask |= PSW_MASK_BA;
@@ -273,7 +277,10 @@ static int setup_frame(int sig, struct k_sigaction *ka,
        /* Set up registers for signal handler */
        regs->gprs[15] = (unsigned long) frame;
-        regs->psw.mask |= PSW_MASK_EA | PSW_MASK_BA;    /* 64 bit amode */
+        /* Force default amode and default user address space control. */
+        regs->psw.mask = PSW_MASK_EA | PSW_MASK_BA |
+                (psw_user_bits & PSW_MASK_ASC) |
+                (regs->psw.mask & ~PSW_MASK_ASC);
        regs->psw.addr = (unsigned long) ka->sa.sa_handler | PSW_ADDR_AMODE;
        regs->gprs[2] = map_signal(sig);
@@ -346,7 +353,10 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        /* Set up registers for signal handler */
        regs->gprs[15] = (unsigned long) frame;
-        regs->psw.mask |= PSW_MASK_EA | PSW_MASK_BA;    /* 64 bit amode */
+        /* Force default amode and default user address space control. */
+        regs->psw.mask = PSW_MASK_EA | PSW_MASK_BA |
+                (psw_user_bits & PSW_MASK_ASC) |
+                (regs->psw.mask & ~PSW_MASK_ASC);
        regs->psw.addr = (unsigned long) ka->sa.sa_handler | PSW_ADDR_AMODE;
        regs->gprs[2] = map_signal(sig);
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index 54d93f4b6818..dd55f7c20104 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -40,6 +40,7 @@ static DEFINE_SPINLOCK(topology_lock);
 static struct mask_info core_info;
 cpumask_t cpu_core_map[NR_CPUS];
 unsigned char cpu_core_id[NR_CPUS];
+unsigned char cpu_socket_id[NR_CPUS];
 static struct mask_info book_info;
 cpumask_t cpu_book_map[NR_CPUS];
@@ -83,11 +84,12 @@ static struct mask_info *add_cpus_to_mask(struct topology_cpu *tl_cpu,
                        cpumask_set_cpu(lcpu, &book->mask);
                        cpu_book_id[lcpu] = book->id;
                        cpumask_set_cpu(lcpu, &core->mask);
+                        cpu_core_id[lcpu] = rcpu;
                        if (one_core_per_cpu) {
-                                cpu_core_id[lcpu] = rcpu;
+                                cpu_socket_id[lcpu] = rcpu;
                                core = core->next;
                        } else {
-                                cpu_core_id[lcpu] = core->id;
+                                cpu_socket_id[lcpu] = core->id;
                        }
                        smp_cpu_set_polarization(lcpu, tl_cpu->pp);
                }
diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c
index 8b8285310b5a..1f5315d1215c 100644
--- a/arch/s390/mm/gup.c
+++ b/arch/s390/mm/gup.c
@@ -180,8 +180,7 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
        addr = start;
        len = (unsigned long) nr_pages << PAGE_SHIFT;
        end = start + len;
-        if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+        if ((end < start) || (end > TASK_SIZE))
-                                        (void __user *)start, len)))
                return 0;
        local_irq_save(flags);
@@ -229,7 +228,7 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write,
        addr = start;
        len = (unsigned long) nr_pages << PAGE_SHIFT;
        end = start + len;
-        if (end < start)
+        if ((end < start) || (end > TASK_SIZE))
                goto slow_irqon;
        /*
diff --git a/arch/sparc/include/asm/prom.h b/arch/sparc/include/asm/prom.h
index f93003123bce..67c62578d170 100644
--- a/arch/sparc/include/asm/prom.h
+++ b/arch/sparc/include/asm/prom.h
@@ -63,10 +63,13 @@ extern char *of_console_options;
 extern void irq_trans_init(struct device_node *dp);
 extern char *build_path_component(struct device_node *dp);
-/* SPARC has a local implementation */
+/* SPARC has local implementations */
 extern int of_address_to_resource(struct device_node *dev, int index,
                                  struct resource *r);
 #define of_address_to_resource of_address_to_resource
+void __iomem *of_iomap(struct device_node *node, int index);
+#define of_iomap of_iomap
 #endif /* __KERNEL__ */
 #endif /* _SPARC_PROM_H */
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 867de2f8189c..689e1ba62809 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -295,9 +295,7 @@ void do_rt_sigreturn(struct pt_regs *regs)
                err |= restore_fpu_state(regs, fpu_save);
        err |= __copy_from_user(&set, &sf->mask, sizeof(sigset_t));
-        err |= do_sigaltstack(&sf->stack, NULL, (unsigned long)sf);
+        if (err || do_sigaltstack(&sf->stack, NULL, (unsigned long)sf) == -EFAULT)
-        if (err)
                goto segv;
        err |= __get_user(rwin_save, &sf->rwin_save);
diff --git a/arch/unicore32/Kconfig b/arch/unicore32/Kconfig
index e5c5473e69ce..c4fbb21e802b 100644
--- a/arch/unicore32/Kconfig
+++ b/arch/unicore32/Kconfig
@@ -16,6 +16,8 @@ config UNICORE32
        select ARCH_WANT_FRAME_POINTERS
        select GENERIC_IOMAP
        select MODULES_USE_ELF_REL
+        select GENERIC_KERNEL_THREAD
+        select GENERIC_KERNEL_EXECVE
        help
          UniCore-32 is 32-bit Instruction Set Architecture,
          including a series of low-power-consumption RISC chip
@@ -64,6 +66,9 @@ config GENERIC_CALIBRATE_DELAY
 config ARCH_MAY_HAVE_PC_FDC
        bool
+config ZONE_DMA
+        def_bool y
 config NEED_DMA_MAP_STATE
       def_bool y
@@ -216,7 +221,7 @@ config PUV3_GPIO
        bool
        depends on !ARCH_FPGA
        select GENERIC_GPIO
-        select GPIO_SYSFS if EXPERIMENTAL
+        select GPIO_SYSFS
        default y
 if PUV3_NB0916
diff --git a/arch/unicore32/include/asm/Kbuild b/arch/unicore32/include/asm/Kbuild
index c910c9857e11..601e92f18af6 100644
--- a/arch/unicore32/include/asm/Kbuild
+++ b/arch/unicore32/include/asm/Kbuild
@@ -1,4 +1,3 @@
-include include/asm-generic/Kbuild.asm
 generic-y += atomic.h
 generic-y += auxvec.h
diff --git a/arch/unicore32/include/asm/bug.h b/arch/unicore32/include/asm/bug.h
index b1ff8cadb086..93a56f3e2344 100644
--- a/arch/unicore32/include/asm/bug.h
+++ b/arch/unicore32/include/asm/bug.h
@@ -19,9 +19,4 @@ extern void die(const char *msg, struct pt_regs *regs, int err);
 extern void uc32_notify_die(const char *str, struct pt_regs *regs,
                struct siginfo *info, unsigned long err, unsigned long trap);
-extern asmlinkage void __backtrace(void);
-extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
-extern void __show_regs(struct pt_regs *);
 #endif /* __UNICORE_BUG_H__ */
diff --git a/arch/unicore32/include/asm/cmpxchg.h b/arch/unicore32/include/asm/cmpxchg.h
index df4d5acfd19f..8e797ad4fa24 100644
--- a/arch/unicore32/include/asm/cmpxchg.h
+++ b/arch/unicore32/include/asm/cmpxchg.h
@@ -35,7 +35,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
                        : "memory", "cc");
                break;
        default:
-                ret = __xchg_bad_pointer();
+                __xchg_bad_pointer();
        }
        return ret;
diff --git a/arch/unicore32/include/asm/kvm_para.h b/arch/unicore32/include/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b957..000000000000
--- a/arch/unicore32/include/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/unicore32/include/asm/processor.h b/arch/unicore32/include/asm/processor.h
index 14382cb09657..4eaa42167667 100644
--- a/arch/unicore32/include/asm/processor.h
+++ b/arch/unicore32/include/asm/processor.h
@@ -72,11 +72,6 @@ unsigned long get_wchan(struct task_struct *p);
 #define cpu_relax()                     barrier()
-/*
- * Create a new kernel thread
- */
-extern int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags);
 #define task_pt_regs(p) \
        ((struct pt_regs *)(THREAD_START_SP + task_stack_page(p)) - 1)
diff --git a/arch/unicore32/include/asm/ptrace.h b/arch/unicore32/include/asm/ptrace.h
index b9caf9b0997b..726749dab52f 100644
--- a/arch/unicore32/include/asm/ptrace.h
+++ b/arch/unicore32/include/asm/ptrace.h
@@ -12,80 +12,10 @@
 #ifndef __UNICORE_PTRACE_H__
 #define __UNICORE_PTRACE_H__
-#define PTRACE_GET_THREAD_AREA  22
+#include <uapi/asm/ptrace.h>
-/*
- * PSR bits
- */
-#define USER_MODE       0x00000010
-#define REAL_MODE       0x00000011
-#define INTR_MODE       0x00000012
-#define PRIV_MODE       0x00000013
-#define ABRT_MODE       0x00000017
-#define EXTN_MODE       0x0000001b
-#define SUSR_MODE       0x0000001f
-#define MODE_MASK       0x0000001f
-#define PSR_R_BIT       0x00000040
-#define PSR_I_BIT       0x00000080
-#define PSR_V_BIT       0x10000000
-#define PSR_C_BIT       0x20000000
-#define PSR_Z_BIT       0x40000000
-#define PSR_S_BIT       0x80000000
-/*
- * Groups of PSR bits
- */
-#define PSR_f           0xff000000      /* Flags                */
-#define PSR_c           0x000000ff      /* Control              */
 #ifndef __ASSEMBLY__
-/*
- * This struct defines the way the registers are stored on the
- * stack during a system call.  Note that sizeof(struct pt_regs)
- * has to be a multiple of 8.
- */
-struct pt_regs {
-        unsigned long uregs[34];
-};
-#define UCreg_asr               uregs[32]
-#define UCreg_pc                uregs[31]
-#define UCreg_lr                uregs[30]
-#define UCreg_sp                uregs[29]
-#define UCreg_ip                uregs[28]
-#define UCreg_fp                uregs[27]
-#define UCreg_26                uregs[26]
-#define UCreg_25                uregs[25]
-#define UCreg_24                uregs[24]
-#define UCreg_23                uregs[23]
-#define UCreg_22                uregs[22]
-#define UCreg_21                uregs[21]
-#define UCreg_20                uregs[20]
-#define UCreg_19                uregs[19]
-#define UCreg_18                uregs[18]
-#define UCreg_17                uregs[17]
-#define UCreg_16                uregs[16]
-#define UCreg_15                uregs[15]
-#define UCreg_14                uregs[14]
-#define UCreg_13                uregs[13]
-#define UCreg_12                uregs[12]
-#define UCreg_11                uregs[11]
-#define UCreg_10                uregs[10]
-#define UCreg_09                uregs[9]
-#define UCreg_08                uregs[8]
-#define UCreg_07                uregs[7]
-#define UCreg_06                uregs[6]
-#define UCreg_05                uregs[5]
-#define UCreg_04                uregs[4]
-#define UCreg_03                uregs[3]
-#define UCreg_02                uregs[2]
-#define UCreg_01                uregs[1]
-#define UCreg_00                uregs[0]
-#define UCreg_ORIG_00           uregs[33]
-#ifdef __KERNEL__
 #define user_mode(regs) \
        (processor_mode(regs) == USER_MODE)
@@ -125,9 +55,5 @@ static inline int valid_user_regs(struct pt_regs *regs)
 #define instruction_pointer(regs)       ((regs)->UCreg_pc)
-#endif /* __KERNEL__ */
 #endif /* __ASSEMBLY__ */
 #endif
diff --git a/arch/unicore32/include/uapi/asm/Kbuild b/arch/unicore32/include/uapi/asm/Kbuild
index baebb3da1d44..0514d7ad6855 100644
--- a/arch/unicore32/include/uapi/asm/Kbuild
+++ b/arch/unicore32/include/uapi/asm/Kbuild
@@ -1,3 +1,10 @@
 # UAPI Header export list
 include include/uapi/asm-generic/Kbuild.asm
+header-y += byteorder.h
+header-y += kvm_para.h
+header-y += ptrace.h
+header-y += sigcontext.h
+header-y += unistd.h
+generic-y += kvm_para.h
diff --git a/arch/unicore32/include/asm/byteorder.h b/arch/unicore32/include/uapi/asm/byteorder.h
index ebe1b3fef3e3..ebe1b3fef3e3 100644
--- a/arch/unicore32/include/asm/byteorder.h
+++ b/arch/unicore32/include/uapi/asm/byteorder.h
diff --git a/arch/unicore32/include/uapi/asm/ptrace.h b/arch/unicore32/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000000..187aa2e98a53
--- /dev/null
+++ b/arch/unicore32/include/uapi/asm/ptrace.h
@@ -0,0 +1,90 @@
+/*
+ * linux/arch/unicore32/include/asm/ptrace.h
+ *
+ * Code specific to PKUnity SoC and UniCore ISA
+ *
+ * Copyright (C) 2001-2010 GUAN Xue-tao
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef _UAPI__UNICORE_PTRACE_H__
+#define _UAPI__UNICORE_PTRACE_H__
+#define PTRACE_GET_THREAD_AREA  22
+/*
+ * PSR bits
+ */
+#define USER_MODE       0x00000010
+#define REAL_MODE       0x00000011
+#define INTR_MODE       0x00000012
+#define PRIV_MODE       0x00000013
+#define ABRT_MODE       0x00000017
+#define EXTN_MODE       0x0000001b
+#define SUSR_MODE       0x0000001f
+#define MODE_MASK       0x0000001f
+#define PSR_R_BIT       0x00000040
+#define PSR_I_BIT       0x00000080
+#define PSR_V_BIT       0x10000000
+#define PSR_C_BIT       0x20000000
+#define PSR_Z_BIT       0x40000000
+#define PSR_S_BIT       0x80000000
+/*
+ * Groups of PSR bits
+ */
+#define PSR_f           0xff000000      /* Flags                */
+#define PSR_c           0x000000ff      /* Control              */
+#ifndef __ASSEMBLY__
+/*
+ * This struct defines the way the registers are stored on the
+ * stack during a system call.  Note that sizeof(struct pt_regs)
+ * has to be a multiple of 8.
+ */
+struct pt_regs {
+        unsigned long uregs[34];
+};
+#define UCreg_asr               uregs[32]
+#define UCreg_pc                uregs[31]
+#define UCreg_lr                uregs[30]
+#define UCreg_sp                uregs[29]
+#define UCreg_ip                uregs[28]
+#define UCreg_fp                uregs[27]
+#define UCreg_26                uregs[26]
+#define UCreg_25                uregs[25]
+#define UCreg_24                uregs[24]
+#define UCreg_23                uregs[23]
+#define UCreg_22                uregs[22]
+#define UCreg_21                uregs[21]
+#define UCreg_20                uregs[20]
+#define UCreg_19                uregs[19]
+#define UCreg_18                uregs[18]
+#define UCreg_17                uregs[17]
+#define UCreg_16                uregs[16]
+#define UCreg_15                uregs[15]
+#define UCreg_14                uregs[14]
+#define UCreg_13                uregs[13]
+#define UCreg_12                uregs[12]
+#define UCreg_11                uregs[11]
+#define UCreg_10                uregs[10]
+#define UCreg_09                uregs[9]
+#define UCreg_08                uregs[8]
+#define UCreg_07                uregs[7]
+#define UCreg_06                uregs[6]
+#define UCreg_05                uregs[5]
+#define UCreg_04                uregs[4]
+#define UCreg_03                uregs[3]
+#define UCreg_02                uregs[2]
+#define UCreg_01                uregs[1]
+#define UCreg_00                uregs[0]
+#define UCreg_ORIG_00           uregs[33]
+#endif /* __ASSEMBLY__ */
+#endif /* _UAPI__UNICORE_PTRACE_H__ */
diff --git a/arch/unicore32/include/asm/sigcontext.h b/arch/unicore32/include/uapi/asm/sigcontext.h
index 6a2d7671c052..6a2d7671c052 100644
--- a/arch/unicore32/include/asm/sigcontext.h
+++ b/arch/unicore32/include/uapi/asm/sigcontext.h
diff --git a/arch/unicore32/include/asm/unistd.h b/arch/unicore32/include/uapi/asm/unistd.h
index 2abcf61c615d..d18a3be89b38 100644
--- a/arch/unicore32/include/asm/unistd.h
+++ b/arch/unicore32/include/uapi/asm/unistd.h
@@ -12,3 +12,4 @@
 /* Use the standard ABI for syscalls. */
 #include <asm-generic/unistd.h>
+#define __ARCH_WANT_SYS_EXECVE
diff --git a/arch/unicore32/kernel/entry.S b/arch/unicore32/kernel/entry.S
index dcb87ab19ddd..7049350c790f 100644
--- a/arch/unicore32/kernel/entry.S
+++ b/arch/unicore32/kernel/entry.S
@@ -573,17 +573,16 @@ ENDPROC(ret_to_user)
 */
 ENTRY(ret_from_fork)
        b.l     schedule_tail
-        get_thread_info tsk
-        ldw     r1, [tsk+], #TI_FLAGS           @ check for syscall tracing
-        mov     why, #1
-        cand.a  r1, #_TIF_SYSCALL_TRACE         @ are we tracing syscalls?
-        beq     ret_slow_syscall
-        mov     r1, sp
-        mov     r0, #1                          @ trace exit [IP = 1]
-        b.l     syscall_trace
        b       ret_slow_syscall
 ENDPROC(ret_from_fork)
+ENTRY(ret_from_kernel_thread)
+        b.l     schedule_tail
+        mov     r0, r5
+        adr     lr, ret_slow_syscall
+        mov     pc, r4
+ENDPROC(ret_from_kernel_thread)
 /*=============================================================================
 * SWI handler
 *-----------------------------------------------------------------------------
@@ -669,11 +668,6 @@ __cr_alignment:
 #endif
        .ltorg
-ENTRY(sys_execve)
-                add     r3, sp, #S_OFF
-                b       __sys_execve
-ENDPROC(sys_execve)
 ENTRY(sys_clone)
                add     ip, sp, #S_OFF
                stw     ip, [sp+], #4
diff --git a/arch/unicore32/kernel/process.c b/arch/unicore32/kernel/process.c
index b008586dad75..a8fe265ce2c0 100644
--- a/arch/unicore32/kernel/process.c
+++ b/arch/unicore32/kernel/process.c
@@ -258,6 +258,7 @@ void release_thread(struct task_struct *dead_task)
 }
 asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
+asmlinkage void ret_from_kernel_thread(void) __asm__("ret_from_kernel_thread");
 int
 copy_thread(unsigned long clone_flags, unsigned long stack_start,
@@ -266,17 +267,22 @@ copy_thread(unsigned long clone_flags, unsigned long stack_start,
        struct thread_info *thread = task_thread_info(p);
        struct pt_regs *childregs = task_pt_regs(p);
-        *childregs = *regs;
-        childregs->UCreg_00 = 0;
-        childregs->UCreg_sp = stack_start;
        memset(&thread->cpu_context, 0, sizeof(struct cpu_context_save));
        thread->cpu_context.sp = (unsigned long)childregs;
-        thread->cpu_context.pc = (unsigned long)ret_from_fork;
+        if (unlikely(!regs)) {
+                thread->cpu_context.pc = (unsigned long)ret_from_kernel_thread;
-        if (clone_flags & CLONE_SETTLS)
+                thread->cpu_context.r4 = stack_start;
-                childregs->UCreg_16 = regs->UCreg_03;
+                thread->cpu_context.r5 = stk_sz;
+                memset(childregs, 0, sizeof(struct pt_regs));
+        } else {
+                thread->cpu_context.pc = (unsigned long)ret_from_fork;
+                *childregs = *regs;
+                childregs->UCreg_00 = 0;
+                childregs->UCreg_sp = stack_start;
+                if (clone_flags & CLONE_SETTLS)
+                        childregs->UCreg_16 = regs->UCreg_03;
+        }
        return 0;
 }
@@ -305,42 +311,6 @@ int dump_fpu(struct pt_regs *regs, elf_fpregset_t *fp)
 }
 EXPORT_SYMBOL(dump_fpu);
-/*
- * Shuffle the argument into the correct register before calling the
- * thread function.  r1 is the thread argument, r2 is the pointer to
- * the thread function, and r3 points to the exit function.
- */
-asm(".pushsection .text\n"
-"       .align\n"
-"       .type   kernel_thread_helper, #function\n"
-"kernel_thread_helper:\n"
-"       mov.a   asr, r7\n"
-"       mov     r0, r4\n"
-"       mov     lr, r6\n"
-"       mov     pc, r5\n"
-"       .size   kernel_thread_helper, . - kernel_thread_helper\n"
-"       .popsection");
-/*
- * Create a kernel thread.
- */
-pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
-{
-        struct pt_regs regs;
-        memset(&regs, 0, sizeof(regs));
-        regs.UCreg_04 = (unsigned long)arg;
-        regs.UCreg_05 = (unsigned long)fn;
-        regs.UCreg_06 = (unsigned long)do_exit;
-        regs.UCreg_07 = PRIV_MODE;
-        regs.UCreg_pc = (unsigned long)kernel_thread_helper;
-        regs.UCreg_asr = regs.UCreg_07 | PSR_I_BIT;
-        return do_fork(flags|CLONE_VM|CLONE_UNTRACED, 0, &regs, 0, NULL, NULL);
-}
-EXPORT_SYMBOL(kernel_thread);
 unsigned long get_wchan(struct task_struct *p)
 {
        struct stackframe frame;
diff --git a/arch/unicore32/kernel/setup.h b/arch/unicore32/kernel/setup.h
index f23955028a18..30f749da8f73 100644
--- a/arch/unicore32/kernel/setup.h
+++ b/arch/unicore32/kernel/setup.h
@@ -30,4 +30,10 @@ extern char __vectors_start[], __vectors_end[];
 extern void kernel_thread_helper(void);
 extern void __init early_signal_init(void);
+extern asmlinkage void __backtrace(void);
+extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
+extern void __show_regs(struct pt_regs *);
 #endif
diff --git a/arch/unicore32/kernel/sys.c b/arch/unicore32/kernel/sys.c
index fabdee96110b..9680134b31f0 100644
--- a/arch/unicore32/kernel/sys.c
+++ b/arch/unicore32/kernel/sys.c
@@ -42,69 +42,6 @@ asmlinkage long __sys_clone(unsigned long clone_flags, unsigned long newsp,
                        parent_tid, child_tid);
 }
-/* sys_execve() executes a new program.
- * This is called indirectly via a small wrapper
- */
-asmlinkage long __sys_execve(const char __user *filename,
-                          const char __user *const __user *argv,
-                          const char __user *const __user *envp,
-                          struct pt_regs *regs)
-{
-        int error;
-        struct filename *fn;
-        fn = getname(filename);
-        error = PTR_ERR(fn);
-        if (IS_ERR(fn))
-                goto out;
-        error = do_execve(fn->name, argv, envp, regs);
-        putname(fn);
-out:
-        return error;
-}
-int kernel_execve(const char *filename,
-                  const char *const argv[],
-                  const char *const envp[])
-{
-        struct pt_regs regs;
-        int ret;
-        memset(&regs, 0, sizeof(struct pt_regs));
-        ret = do_execve(filename,
-                        (const char __user *const __user *)argv,
-                        (const char __user *const __user *)envp, &regs);
-        if (ret < 0)
-                goto out;
-        /*
-         * Save argc to the register structure for userspace.
-         */
-        regs.UCreg_00 = ret;
-        /*
-         * We were successful.  We won't be returning to our caller, but
-         * instead to user space by manipulating the kernel stack.
-         */
-        asm("add        r0, %0, %1\n\t"
-                "mov    r1, %2\n\t"
-                "mov    r2, %3\n\t"
-                "mov    r22, #0\n\t"    /* not a syscall */
-                "mov    r23, %0\n\t"    /* thread structure */
-                "b.l    memmove\n\t"    /* copy regs to top of stack */
-                "mov    sp, r0\n\t"     /* reposition stack pointer */
-                "b      ret_to_user"
-                :
-                : "r" (current_thread_info()),
-                  "Ir" (THREAD_START_SP - sizeof(regs)),
-                  "r" (&regs),
-                  "Ir" (sizeof(regs))
-                : "r0", "r1", "r2", "r3", "ip", "lr", "memory");
- out:
-        return ret;
-}
 /* Note: used by the compat code even in 64-bit Linux. */
 SYSCALL_DEFINE6(mmap2, unsigned long, addr, unsigned long, len,
                unsigned long, prot, unsigned long, flags,
diff --git a/arch/unicore32/mm/fault.c b/arch/unicore32/mm/fault.c
index 2eeb9c04cab0..f9b5c10bccee 100644
--- a/arch/unicore32/mm/fault.c
+++ b/arch/unicore32/mm/fault.c
@@ -168,7 +168,7 @@ static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
 }
 static int __do_pf(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
-                struct task_struct *tsk)
+                unsigned int flags, struct task_struct *tsk)
 {
        struct vm_area_struct *vma;
        int fault;
@@ -194,14 +194,7 @@ good_area:
         * If for any reason at all we couldn't handle the fault, make
         * sure we exit gracefully rather than endlessly redo the fault.
         */
-        fault = handle_mm_fault(mm, vma, addr & PAGE_MASK,
+        fault = handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
-                            (!(fsr ^ 0x12)) ? FAULT_FLAG_WRITE : 0);
-        if (unlikely(fault & VM_FAULT_ERROR))
-                return fault;
-        if (fault & VM_FAULT_MAJOR)
-                tsk->maj_flt++;
-        else
-                tsk->min_flt++;
        return fault;
 check_stack:
@@ -216,6 +209,8 @@ static int do_pf(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
        struct task_struct *tsk;
        struct mm_struct *mm;
        int fault, sig, code;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                                 ((!(fsr ^ 0x12)) ? FAULT_FLAG_WRITE : 0);
        tsk = current;
        mm = tsk->mm;
@@ -236,6 +231,7 @@ static int do_pf(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
                if (!user_mode(regs)
                    && !search_exception_tables(regs->UCreg_pc))
                        goto no_context;
+retry:
                down_read(&mm->mmap_sem);
        } else {
                /*
@@ -251,7 +247,28 @@ static int do_pf(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
 #endif
        }
-        fault = __do_pf(mm, addr, fsr, tsk);
+        fault = __do_pf(mm, addr, fsr, flags, tsk);
+        /* If we need to retry but a fatal signal is pending, handle the
+         * signal first. We do not need to release the mmap_sem because
+         * it would already be released in __lock_page_or_retry in
+         * mm/filemap.c. */
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return 0;
+        if (!(fault & VM_FAULT_ERROR) && (flags & FAULT_FLAG_ALLOW_RETRY)) {
+                if (fault & VM_FAULT_MAJOR)
+                        tsk->maj_flt++;
+                else
+                        tsk->min_flt++;
+                if (fault & VM_FAULT_RETRY) {
+                        /* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk
+                        * of starvation. */
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        goto retry;
+                }
+        }
        up_read(&mm->mmap_sem);
        /*
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index c760e073963e..e87b0cac14b5 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -12,6 +12,8 @@
 #include <asm/setup.h>
 #include <asm/desc.h>
+#undef memcpy                   /* Use memcpy from misc.c */
 #include "eboot.h"
 static efi_system_table_t *sys_table;
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 2a017441b8b2..8c132a625b94 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -476,6 +476,3 @@ die:
 setup_corrupt:
        .byte   7
        .string "No setup signature found...\n"
-        .data
-dummy:  .long   0
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index dcfde52979c3..19f16ebaf4fa 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -205,21 +205,14 @@ static inline bool user_64bit_mode(struct pt_regs *regs)
 }
 #endif
-/*
- * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
- * when it traps.  The previous stack will be directly underneath the saved
- * registers, and 'sp/ss' won't even have been saved. Thus the '&regs->sp'.
- *
- * This is valid only for kernel mode traps.
- */
-static inline unsigned long kernel_stack_pointer(struct pt_regs *regs)
-{
 #ifdef CONFIG_X86_32
-        return (unsigned long)(&regs->sp);
+extern unsigned long kernel_stack_pointer(struct pt_regs *regs);
 #else
+static inline unsigned long kernel_stack_pointer(struct pt_regs *regs)
+{
        return regs->sp;
-#endif
 }
+#endif
 #define GET_IP(regs) ((regs)->ip)
 #define GET_FP(regs) ((regs)->bp)
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index f7e98a2c0d12..1b7d1656a042 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -631,6 +631,20 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                }
        }
+        /*
+         * The way access filter has a performance penalty on some workloads.
+         * Disable it on the affected CPUs.
+         */
+        if ((c->x86 == 0x15) &&
+            (c->x86_model >= 0x02) && (c->x86_model < 0x20)) {
+                u64 val;
+                if (!rdmsrl_safe(0xc0011021, &val) && !(val & 0x1E)) {
+                        val |= 0x1E;
+                        wrmsrl_safe(0xc0011021, val);
+                }
+        }
        cpu_detect_cache_sizes(c);
        /* Multi core CPU? */
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 698b6ec12e0f..1ac581f38dfa 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -6,7 +6,7 @@
 *
 *  Written by Jacob Shin - AMD, Inc.
 *
- *  Support: borislav.petkov@amd.com
+ *  Maintained by: Borislav Petkov <bp@alien8.de>
 *
 *  April 2006
 *     - added support for AMD Family 0x10 processors
diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c
index 5f88abf07e9c..4f9a3cbfc4a3 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
@@ -285,34 +285,39 @@ void cmci_clear(void)
        raw_spin_unlock_irqrestore(&cmci_discover_lock, flags);
 }
+static long cmci_rediscover_work_func(void *arg)
+{
+        int banks;
+        /* Recheck banks in case CPUs don't all have the same */
+        if (cmci_supported(&banks))
+                cmci_discover(banks);
+        return 0;
+}
 /*
 * After a CPU went down cycle through all the others and rediscover
 * Must run in process context.
 */
 void cmci_rediscover(int dying)
 {
-        int banks;
+        int cpu, banks;
-        int cpu;
-        cpumask_var_t old;
        if (!cmci_supported(&banks))
                return;
-        if (!alloc_cpumask_var(&old, GFP_KERNEL))
-                return;
-        cpumask_copy(old, &current->cpus_allowed);
        for_each_online_cpu(cpu) {
                if (cpu == dying)
                        continue;
-                if (set_cpus_allowed_ptr(current, cpumask_of(cpu)))
+                if (cpu == smp_processor_id()) {
+                        cmci_rediscover_work_func(NULL);
                        continue;
-                /* Recheck banks in case CPUs don't all have the same */
+                }
-                if (cmci_supported(&banks))
-                        cmci_discover(banks);
-        }
-        set_cpus_allowed_ptr(current, old);
+                work_on_cpu(cpu, cmci_rediscover_work_func, NULL);
-        free_cpumask_var(old);
+        }
 }
 /*
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index b51b2c7ee51f..1328fe49a3f1 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -995,8 +995,8 @@ END(interrupt)
         */
        .p2align CONFIG_X86_L1_CACHE_SHIFT
 common_interrupt:
-        ASM_CLAC
        XCPT_FRAME
+        ASM_CLAC
        addq $-0x80,(%rsp)              /* Adjust vector to [-256,-1] range */
        interrupt do_IRQ
        /* 0(%rsp): old_rsp-ARGOFFSET */
@@ -1135,8 +1135,8 @@ END(common_interrupt)
 */
 .macro apicinterrupt num sym do_sym
 ENTRY(\sym)
-        ASM_CLAC
        INTR_FRAME
+        ASM_CLAC
        pushq_cfi $~(\num)
 .Lcommon_\sym:
        interrupt \do_sym
@@ -1190,8 +1190,8 @@ apicinterrupt IRQ_WORK_VECTOR \
 */
 .macro zeroentry sym do_sym
 ENTRY(\sym)
-        ASM_CLAC
        INTR_FRAME
+        ASM_CLAC
        PARAVIRT_ADJUST_EXCEPTION_FRAME
        pushq_cfi $-1           /* ORIG_RAX: no syscall to restart */
        subq $ORIG_RAX-R15, %rsp
@@ -1208,8 +1208,8 @@ END(\sym)
 .macro paranoidzeroentry sym do_sym
 ENTRY(\sym)
-        ASM_CLAC
        INTR_FRAME
+        ASM_CLAC
        PARAVIRT_ADJUST_EXCEPTION_FRAME
        pushq_cfi $-1           /* ORIG_RAX: no syscall to restart */
        subq $ORIG_RAX-R15, %rsp
@@ -1227,8 +1227,8 @@ END(\sym)
 #define INIT_TSS_IST(x) PER_CPU_VAR(init_tss) + (TSS_ist + ((x) - 1) * 8)
 .macro paranoidzeroentry_ist sym do_sym ist
 ENTRY(\sym)
-        ASM_CLAC
        INTR_FRAME
+        ASM_CLAC
        PARAVIRT_ADJUST_EXCEPTION_FRAME
        pushq_cfi $-1           /* ORIG_RAX: no syscall to restart */
        subq $ORIG_RAX-R15, %rsp
@@ -1247,8 +1247,8 @@ END(\sym)
 .macro errorentry sym do_sym
 ENTRY(\sym)
-        ASM_CLAC
        XCPT_FRAME
+        ASM_CLAC
        PARAVIRT_ADJUST_EXCEPTION_FRAME
        subq $ORIG_RAX-R15, %rsp
        CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
@@ -1266,8 +1266,8 @@ END(\sym)
        /* error code is on the stack already */
 .macro paranoiderrorentry sym do_sym
 ENTRY(\sym)
-        ASM_CLAC
        XCPT_FRAME
+        ASM_CLAC
        PARAVIRT_ADJUST_EXCEPTION_FRAME
        subq $ORIG_RAX-R15, %rsp
        CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index 7720ff5a9ee2..efdec7cd8e01 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -8,8 +8,8 @@
 *  Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
 *
 *  Maintainers:
- *  Andreas Herrmann <andreas.herrmann3@amd.com>
+ *  Andreas Herrmann <herrmann.der.user@googlemail.com>
- *  Borislav Petkov <borislav.petkov@amd.com>
+ *  Borislav Petkov <bp@alien8.de>
 *
 *  This driver allows to upgrade microcode on F10h AMD
 *  CPUs and later.
@@ -190,6 +190,7 @@ static unsigned int verify_patch_size(int cpu, u32 patch_size,
 #define F1XH_MPB_MAX_SIZE 2048
 #define F14H_MPB_MAX_SIZE 1824
 #define F15H_MPB_MAX_SIZE 4096
+#define F16H_MPB_MAX_SIZE 3458
        switch (c->x86) {
        case 0x14:
@@ -198,6 +199,9 @@ static unsigned int verify_patch_size(int cpu, u32 patch_size,
        case 0x15:
                max_size = F15H_MPB_MAX_SIZE;
                break;
+        case 0x16:
+                max_size = F16H_MPB_MAX_SIZE;
+                break;
        default:
                max_size = F1XH_MPB_MAX_SIZE;
                break;
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index b00b33a18390..5e0596b0632e 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -22,6 +22,7 @@
 #include <linux/perf_event.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/rcupdate.h>
+#include <linux/module.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -166,6 +167,35 @@ static inline bool invalid_selector(u16 value)
 #define FLAG_MASK               FLAG_MASK_32
+/*
+ * X86_32 CPUs don't save ss and esp if the CPU is already in kernel mode
+ * when it traps.  The previous stack will be directly underneath the saved
+ * registers, and 'sp/ss' won't even have been saved. Thus the '&regs->sp'.
+ *
+ * Now, if the stack is empty, '&regs->sp' is out of range. In this
+ * case we try to take the previous stack. To always return a non-null
+ * stack pointer we fall back to regs as stack if no previous stack
+ * exists.
+ *
+ * This is valid only for kernel mode traps.
+ */
+unsigned long kernel_stack_pointer(struct pt_regs *regs)
+{
+        unsigned long context = (unsigned long)regs & ~(THREAD_SIZE - 1);
+        unsigned long sp = (unsigned long)&regs->sp;
+        struct thread_info *tinfo;
+        if (context == (sp & ~(THREAD_SIZE - 1)))
+                return sp;
+        tinfo = (struct thread_info *)context;
+        if (tinfo->previous_esp)
+                return tinfo->previous_esp;
+        return (unsigned long)regs;
+}
+EXPORT_SYMBOL_GPL(kernel_stack_pointer);
 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 {
        BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
index a10e46016851..58fc51488828 100644
--- a/arch/x86/kvm/cpuid.h
+++ b/arch/x86/kvm/cpuid.h
@@ -24,6 +24,9 @@ static inline bool guest_cpuid_has_xsave(struct kvm_vcpu *vcpu)
 {
        struct kvm_cpuid_entry2 *best;
+        if (!static_cpu_has(X86_FEATURE_XSAVE))
+                return 0;
        best = kvm_find_cpuid_entry(vcpu, 1, 0);
        return best && (best->ecx & bit(X86_FEATURE_XSAVE));
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index ad6b1dd06f8b..f85815945fc6 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6549,19 +6549,22 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)
                }
        }
-        exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
        /* Exposing INVPCID only when PCID is exposed */
        best = kvm_find_cpuid_entry(vcpu, 0x7, 0);
        if (vmx_invpcid_supported() &&
            best && (best->ebx & bit(X86_FEATURE_INVPCID)) &&
            guest_cpuid_has_pcid(vcpu)) {
+                exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
                exec_control |= SECONDARY_EXEC_ENABLE_INVPCID;
                vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
                             exec_control);
        } else {
-                exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+                if (cpu_has_secondary_exec_ctrls()) {
-                vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+                        exec_control = vmcs_read32(SECONDARY_VM_EXEC_CONTROL);
-                             exec_control);
+                        exec_control &= ~SECONDARY_EXEC_ENABLE_INVPCID;
+                        vmcs_write32(SECONDARY_VM_EXEC_CONTROL,
+                                     exec_control);
+                }
                if (best)
                        best->ebx &= ~bit(X86_FEATURE_INVPCID);
        }
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 224a7e78cb6c..4f7641756be2 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -5781,6 +5781,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
        int pending_vec, max_bits, idx;
        struct desc_ptr dt;
+        if (!guest_cpuid_has_xsave(vcpu) && (sregs->cr4 & X86_CR4_OSXSAVE))
+                return -EINVAL;
        dt.size = sregs->idt.limit;
        dt.address = sregs->idt.base;
        kvm_x86_ops->set_idt(vcpu, &dt);
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 0777f042e400..60f926cd8b0e 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -197,7 +197,7 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start,
        }
        if (end == TLB_FLUSH_ALL || tlb_flushall_shift == -1
-                                        || vmflag == VM_HUGETLB) {
+                                        || vmflag & VM_HUGETLB) {
                local_flush_tlb();
                goto flush_all;
        }
diff --git a/arch/x86/pci/ce4100.c b/arch/x86/pci/ce4100.c
index 41bd2a2d2c50..b914e20b5a00 100644
--- a/arch/x86/pci/ce4100.c
+++ b/arch/x86/pci/ce4100.c
@@ -115,6 +115,16 @@ static void sata_revid_read(struct sim_dev_reg *reg, u32 *value)
        reg_read(reg, value);
 }
+static void reg_noirq_read(struct sim_dev_reg *reg, u32 *value)
+{
+        unsigned long flags;
+        raw_spin_lock_irqsave(&pci_config_lock, flags);
+        /* force interrupt pin value to 0 */
+        *value = reg->sim_reg.value & 0xfff00ff;
+        raw_spin_unlock_irqrestore(&pci_config_lock, flags);
+}
 static struct sim_dev_reg bus1_fixups[] = {
        DEFINE_REG(2, 0, 0x10, (16*MB), reg_init, reg_read, reg_write)
        DEFINE_REG(2, 0, 0x14, (256), reg_init, reg_read, reg_write)
@@ -144,6 +154,7 @@ static struct sim_dev_reg bus1_fixups[] = {
        DEFINE_REG(11, 5, 0x10, (64*KB), reg_init, reg_read, reg_write)
        DEFINE_REG(11, 6, 0x10, (256), reg_init, reg_read, reg_write)
        DEFINE_REG(11, 7, 0x10, (64*KB), reg_init, reg_read, reg_write)
+        DEFINE_REG(11, 7, 0x3c, 256, reg_init, reg_noirq_read, reg_write)
        DEFINE_REG(12, 0, 0x10, (128*KB), reg_init, reg_read, reg_write)
        DEFINE_REG(12, 0, 0x14, (256), reg_init, reg_read, reg_write)
        DEFINE_REG(12, 1, 0x10, (1024), reg_init, reg_read, reg_write)
@@ -161,8 +172,10 @@ static struct sim_dev_reg bus1_fixups[] = {
        DEFINE_REG(16, 0, 0x10, (64*KB), reg_init, reg_read, reg_write)
        DEFINE_REG(16, 0, 0x14, (64*MB), reg_init, reg_read, reg_write)
        DEFINE_REG(16, 0, 0x18, (64*MB), reg_init, reg_read, reg_write)
+        DEFINE_REG(16, 0, 0x3c, 256, reg_init, reg_noirq_read, reg_write)
        DEFINE_REG(17, 0, 0x10, (128*KB), reg_init, reg_read, reg_write)
        DEFINE_REG(18, 0, 0x10, (1*KB), reg_init, reg_read, reg_write)
+        DEFINE_REG(18, 0, 0x3c, 256, reg_init, reg_noirq_read, reg_write)
 };
 static void __init init_sim_regs(void)
diff --git a/arch/x86/platform/ce4100/ce4100.c b/arch/x86/platform/ce4100/ce4100.c
index 4c61b52191eb..92525cb8e54c 100644
--- a/arch/x86/platform/ce4100/ce4100.c
+++ b/arch/x86/platform/ce4100/ce4100.c
@@ -21,12 +21,25 @@
 #include <asm/i8259.h>
 #include <asm/io.h>
 #include <asm/io_apic.h>
+#include <asm/emergency-restart.h>
 static int ce4100_i8042_detect(void)
 {
        return 0;
 }
+/*
+ * The CE4100 platform has an internal 8051 Microcontroller which is
+ * responsible for signaling to the external Power Management Unit the
+ * intention to reset, reboot or power off the system. This 8051 device has
+ * its command register mapped at I/O port 0xcf9 and the value 0x4 is used
+ * to power off the system.
+ */
+static void ce4100_power_off(void)
+{
+        outb(0x4, 0xcf9);
+}
 #ifdef CONFIG_SERIAL_8250
 static unsigned int mem_serial_in(struct uart_port *p, int offset)
@@ -139,8 +152,19 @@ void __init x86_ce4100_early_setup(void)
        x86_init.mpparse.find_smp_config = x86_init_noop;
        x86_init.pci.init = ce4100_pci_init;
+        /*
+         * By default, the reboot method is ACPI which is supported by the
+         * CE4100 bootloader CEFDK using FADT.ResetReg Address and ResetValue
+         * the bootloader will however issue a system power off instead of
+         * reboot. By using BOOT_KBD we ensure proper system reboot as
+         * expected.
+         */
+        reboot_type = BOOT_KBD;
 #ifdef CONFIG_X86_IO_APIC
        x86_init.pci.init_irq = sdv_pci_init;
        x86_init.mpparse.setup_ioapic_ids = setup_ioapic_ids_from_mpc_nocheck;
 #endif
+        pm_power_off = ce4100_power_off;
 }
diff --git a/block/blk-exec.c b/block/blk-exec.c
index 8b6dc5bd4dd0..f71eac35c1b9 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -52,11 +52,17 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
                           rq_end_io_fn *done)
 {
        int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
+        bool is_pm_resume;
        WARN_ON(irqs_disabled());
        rq->rq_disk = bd_disk;
        rq->end_io = done;
+        /*
+         * need to check this before __blk_run_queue(), because rq can
+         * be freed before that returns.
+         */
+        is_pm_resume = rq->cmd_type == REQ_TYPE_PM_RESUME;
        spin_lock_irq(q->queue_lock);
@@ -71,7 +77,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
        __elv_add_request(q, rq, where);
        __blk_run_queue(q);
        /* the queue is stopped so it won't be run */
-        if (rq->cmd_type == REQ_TYPE_PM_RESUME)
+        if (is_pm_resume)
                q->request_fn(q);
        spin_unlock_irq(q->queue_lock);
 }
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index b1ae48054dc5..b7078afddb74 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -238,7 +238,7 @@ static int __devexit ahci_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ahci_suspend(struct device *dev)
 {
        struct ahci_platform_data *pdata = dev_get_platdata(dev);
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index fd9ecf74e631..5b0ba3f20edc 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -1105,10 +1105,15 @@ static int ata_acpi_bind_device(struct ata_port *ap, struct scsi_device *sdev,
        struct acpi_device *acpi_dev;
        struct acpi_device_power_state *states;
-        if (ap->flags & ATA_FLAG_ACPI_SATA)
+        if (ap->flags & ATA_FLAG_ACPI_SATA) {
-                ata_dev = &ap->link.device[sdev->channel];
+                if (!sata_pmp_attached(ap))
-        else
+                        ata_dev = &ap->link.device[sdev->id];
+                else
+                        ata_dev = &ap->pmp_link[sdev->channel].device[sdev->id];
+        }
+        else {
                ata_dev = &ap->link.device[sdev->id];
+        }
        *handle = ata_dev_acpi_handle(ata_dev);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 3cc7096cfda7..f46fbd3bd3fb 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2942,6 +2942,10 @@ const struct ata_timing *ata_timing_find_mode(u8 xfer_mode)
        if (xfer_mode == t->mode)
                return t;
+        WARN_ONCE(true, "%s: unable to find timing for xfer_mode 0x%x\n",
+                        __func__, xfer_mode);
        return NULL;
 }
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index e3bda074fa12..a6df6a351d6e 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -1052,6 +1052,8 @@ static void ata_scsi_sdev_config(struct scsi_device *sdev)
 {
        sdev->use_10_for_rw = 1;
        sdev->use_10_for_ms = 1;
+        sdev->no_report_opcodes = 1;
+        sdev->no_write_same = 1;
        /* Schedule policy is determined by ->qc_defer() callback and
         * it needs to see every deferred qc.  Set dev_blocked to 1 to
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 26201ebef3ca..371fd2c698b7 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -317,6 +317,12 @@ static int cf_init(struct arasan_cf_dev *acdev)
                return ret;
        }
+        ret = clk_set_rate(acdev->clk, 166000000);
+        if (ret) {
+                dev_warn(acdev->host->dev, "clock set rate failed");
+                return ret;
+        }
        spin_lock_irqsave(&acdev->host->lock, flags);
        /* configure CF interface clock */
        writel((pdata->cf_if_clk <= CF_IF_CLK_200M) ? pdata->cf_if_clk :
@@ -908,7 +914,7 @@ static int __devexit arasan_cf_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int arasan_cf_suspend(struct device *dev)
 {
        struct ata_host *host = dev_get_drvdata(dev);
diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
index 0d7c4c2cd26f..400bf1c3e982 100644
--- a/drivers/ata/sata_highbank.c
+++ b/drivers/ata/sata_highbank.c
@@ -260,7 +260,7 @@ static const struct of_device_id ahci_of_match[] = {
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
-static int __init ahci_highbank_probe(struct platform_device *pdev)
+static int __devinit ahci_highbank_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
        struct ahci_host_priv *hpriv;
@@ -378,7 +378,7 @@ static int __devexit ahci_highbank_remove(struct platform_device *pdev)
        return 0;
 }
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int ahci_highbank_suspend(struct device *dev)
 {
        struct ata_host *host = dev_get_drvdata(dev);
diff --git a/drivers/ata/sata_svw.c b/drivers/ata/sata_svw.c
index 44a4256533e1..08608de87e4e 100644
--- a/drivers/ata/sata_svw.c
+++ b/drivers/ata/sata_svw.c
@@ -142,6 +142,39 @@ static int k2_sata_scr_write(struct ata_link *link,
        return 0;
 }
+static int k2_sata_softreset(struct ata_link *link,
+                             unsigned int *class, unsigned long deadline)
+{
+        u8 dmactl;
+        void __iomem *mmio = link->ap->ioaddr.bmdma_addr;
+        dmactl = readb(mmio + ATA_DMA_CMD);
+        /* Clear the start bit */
+        if (dmactl & ATA_DMA_START) {
+                dmactl &= ~ATA_DMA_START;
+                writeb(dmactl, mmio + ATA_DMA_CMD);
+        }
+        return ata_sff_softreset(link, class, deadline);
+}
+static int k2_sata_hardreset(struct ata_link *link,
+                             unsigned int *class, unsigned long deadline)
+{
+        u8 dmactl;
+        void __iomem *mmio = link->ap->ioaddr.bmdma_addr;
+        dmactl = readb(mmio + ATA_DMA_CMD);
+        /* Clear the start bit */
+        if (dmactl & ATA_DMA_START) {
+                dmactl &= ~ATA_DMA_START;
+                writeb(dmactl, mmio + ATA_DMA_CMD);
+        }
+        return sata_sff_hardreset(link, class, deadline);
+}
 static void k2_sata_tf_load(struct ata_port *ap, const struct ata_taskfile *tf)
 {
@@ -346,6 +379,8 @@ static struct scsi_host_template k2_sata_sht = {
 static struct ata_port_operations k2_sata_ops = {
        .inherits               = &ata_bmdma_port_ops,
+        .softreset              = k2_sata_softreset,
+        .hardreset              = k2_sata_hardreset,
        .sff_tf_load            = k2_sata_tf_load,
        .sff_tf_read            = k2_sata_tf_read,
        .sff_check_status       = k2_stat_check_status,
diff --git a/drivers/base/power/qos.c b/drivers/base/power/qos.c
index 74a67e0019a2..fbbd4ed2edf2 100644
--- a/drivers/base/power/qos.c
+++ b/drivers/base/power/qos.c
@@ -451,7 +451,7 @@ int dev_pm_qos_add_ancestor_request(struct device *dev,
        if (ancestor)
                error = dev_pm_qos_add_request(ancestor, req, value);
-        if (error)
+        if (error < 0)
                req->dev = NULL;
        return error;
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 3804a0af3ef1..9fe4f1865558 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -935,7 +935,7 @@ aoe_end_request(struct aoedev *d, struct request *rq, int fastfail)
        /* cf. http://lkml.org/lkml/2006/10/31/28 */
        if (!fastfail)
-                q->request_fn(q);
+                __blk_run_queue(q);
 }
 static void
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 1c49d7173966..2ddd64a9ffde 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4330,6 +4330,7 @@ out_unreg_region:
 out_unreg_blkdev:
        unregister_blkdev(FLOPPY_MAJOR, "fd");
 out_put_disk:
+        destroy_workqueue(floppy_wq);
        for (drive = 0; drive < N_DRIVE; drive++) {
                if (!disks[drive])
                        break;
@@ -4340,7 +4341,6 @@ out_put_disk:
                }
                put_disk(disks[drive]);
        }
-        destroy_workqueue(floppy_wq);
        return err;
 }
@@ -4555,6 +4555,8 @@ static void __exit floppy_module_exit(void)
        unregister_blkdev(FLOPPY_MAJOR, "fd");
        platform_driver_unregister(&floppy_driver);
+        destroy_workqueue(floppy_wq);
        for (drive = 0; drive < N_DRIVE; drive++) {
                del_timer_sync(&motor_off_timer[drive]);
@@ -4578,7 +4580,6 @@ static void __exit floppy_module_exit(void)
        cancel_delayed_work_sync(&fd_timeout);
        cancel_delayed_work_sync(&fd_timer);
-        destroy_workqueue(floppy_wq);
        if (atomic_read(&usage_count))
                floppy_release_irq_and_dma();
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index adc6f36564cf..9694dd99bbbc 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -559,7 +559,7 @@ static void mtip_timeout_function(unsigned long int data)
        struct mtip_cmd *command;
        int tag, cmdto_cnt = 0;
        unsigned int bit, group;
-        unsigned int num_command_slots = port->dd->slot_groups * 32;
+        unsigned int num_command_slots;
        unsigned long to, tagaccum[SLOTBITS_IN_LONGS];
        if (unlikely(!port))
@@ -572,6 +572,7 @@ static void mtip_timeout_function(unsigned long int data)
        }
        /* clear the tag accumulator */
        memset(tagaccum, 0, SLOTBITS_IN_LONGS * sizeof(long));
+        num_command_slots = port->dd->slot_groups * 32;
        for (tag = 0; tag < num_command_slots; tag++) {
                /*
@@ -2218,8 +2219,8 @@ static int exec_drive_taskfile(struct driver_data *dd,
                fis.device);
        /* check for erase mode support during secure erase.*/
-        if ((fis.command == ATA_CMD_SEC_ERASE_UNIT)
+        if ((fis.command == ATA_CMD_SEC_ERASE_UNIT) && outbuf &&
-                                        && (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
+                                        (outbuf[0] & MTIP_SEC_ERASE_MODE)) {
                erasemode = 1;
        }
@@ -2439,7 +2440,7 @@ static int mtip_hw_ioctl(struct driver_data *dd, unsigned int cmd,
 * return value
 *      None
 */
-static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
+static void mtip_hw_submit_io(struct driver_data *dd, sector_t sector,
                              int nsect, int nents, int tag, void *callback,
                              void *data, int dir)
 {
@@ -2447,6 +2448,7 @@ static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
        struct mtip_port *port = dd->port;
        struct mtip_cmd *command = &port->commands[tag];
        int dma_dir = (dir == READ) ? DMA_FROM_DEVICE : DMA_TO_DEVICE;
+        u64 start = sector;
        /* Map the scatter list for DMA access */
        nents = dma_map_sg(&dd->pdev->dev, command->sg, nents, dma_dir);
@@ -2465,8 +2467,12 @@ static void mtip_hw_submit_io(struct driver_data *dd, sector_t start,
        fis->opts        = 1 << 7;
        fis->command     =
                (dir == READ ? ATA_CMD_FPDMA_READ : ATA_CMD_FPDMA_WRITE);
-        *((unsigned int *) &fis->lba_low) = (start & 0xFFFFFF);
+        fis->lba_low     = start & 0xFF;
-        *((unsigned int *) &fis->lba_low_ex) = ((start >> 24) & 0xFFFFFF);
+        fis->lba_mid     = (start >> 8) & 0xFF;
+        fis->lba_hi      = (start >> 16) & 0xFF;
+        fis->lba_low_ex  = (start >> 24) & 0xFF;
+        fis->lba_mid_ex  = (start >> 32) & 0xFF;
+        fis->lba_hi_ex   = (start >> 40) & 0xFF;
        fis->device      = 1 << 6;
        fis->features    = nsect & 0xFF;
        fis->features_ex = (nsect >> 8) & 0xFF;
diff --git a/drivers/block/mtip32xx/mtip32xx.h b/drivers/block/mtip32xx/mtip32xx.h
index 5f4a917bd8bb..b1742640556a 100644
--- a/drivers/block/mtip32xx/mtip32xx.h
+++ b/drivers/block/mtip32xx/mtip32xx.h
@@ -34,7 +34,7 @@
 #define PCIE_CONFIG_EXT_DEVICE_CONTROL_OFFSET   0x48
 /* check for erase mode support during secure erase */
-#define MTIP_SEC_ERASE_MODE     0x3
+#define MTIP_SEC_ERASE_MODE     0x2
 /* # of times to retry timed out/failed IOs */
 #define MTIP_MAX_RETRIES        2
@@ -155,14 +155,14 @@ enum {
        MTIP_DDF_REBUILD_FAILED_BIT = 8,
 };
-__packed struct smart_attr{
+struct smart_attr {
        u8 attr_id;
        u16 flags;
        u8 cur;
        u8 worst;
        u32 data;
        u8 res[3];
-};
+} __packed;
 /* Register Frame Information Structure (FIS), host to device. */
 struct host_to_dev_fis {
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index fc2de5528dcc..b00000e8aef6 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -67,6 +67,7 @@ static struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x13d3, 0x3304) },
        { USB_DEVICE(0x0930, 0x0215) },
        { USB_DEVICE(0x0489, 0xE03D) },
+        { USB_DEVICE(0x0489, 0xE027) },
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03F0, 0x311D) },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index debda27df9b0..ee82f2fb65f0 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -124,6 +124,7 @@ static struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
        { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
+        { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/bus/omap-ocp2scp.c b/drivers/bus/omap-ocp2scp.c
index ff63560b8467..0c48b0e05ed6 100644
--- a/drivers/bus/omap-ocp2scp.c
+++ b/drivers/bus/omap-ocp2scp.c
@@ -22,6 +22,26 @@
 #include <linux/pm_runtime.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/platform_data/omap_ocp2scp.h>
+/**
+ * _count_resources - count for the number of resources
+ * @res: struct resource *
+ *
+ * Count and return the number of resources populated for the device that is
+ * connected to ocp2scp.
+ */
+static unsigned _count_resources(struct resource *res)
+{
+        int cnt = 0;
+        while (res->start != res->end) {
+                cnt++;
+                res++;
+        }
+        return cnt;
+}
 static int ocp2scp_remove_devices(struct device *dev, void *c)
 {
@@ -34,20 +54,62 @@ static int ocp2scp_remove_devices(struct device *dev, void *c)
 static int __devinit omap_ocp2scp_probe(struct platform_device *pdev)
 {
-        int                     ret;
+        int ret;
-        struct device_node      *np = pdev->dev.of_node;
+        unsigned res_cnt, i;
+        struct device_node *np = pdev->dev.of_node;
+        struct platform_device *pdev_child;
+        struct omap_ocp2scp_platform_data *pdata = pdev->dev.platform_data;
+        struct omap_ocp2scp_dev *dev;
        if (np) {
                ret = of_platform_populate(np, NULL, NULL, &pdev->dev);
                if (ret) {
-                        dev_err(&pdev->dev, "failed to add resources for ocp2scp child\n");
+                        dev_err(&pdev->dev,
+                            "failed to add resources for ocp2scp child\n");
                        goto err0;
                }
+        } else if (pdata) {
+                for (i = 0, dev = *pdata->devices; i < pdata->dev_cnt; i++,
+                    dev++) {
+                        res_cnt = _count_resources(dev->res);
+                        pdev_child = platform_device_alloc(dev->drv_name,
+                            PLATFORM_DEVID_AUTO);
+                        if (!pdev_child) {
+                                dev_err(&pdev->dev,
+                                  "failed to allocate mem for ocp2scp child\n");
+                                goto err0;
+                        }
+                        ret = platform_device_add_resources(pdev_child,
+                            dev->res, res_cnt);
+                        if (ret) {
+                                dev_err(&pdev->dev,
+                                 "failed to add resources for ocp2scp child\n");
+                                goto err1;
+                        }
+                        pdev_child->dev.parent  = &pdev->dev;
+                        ret = platform_device_add(pdev_child);
+                        if (ret) {
+                                dev_err(&pdev->dev,
+                                   "failed to register ocp2scp child device\n");
+                                goto err1;
+                        }
+                }
+        } else {
+                dev_err(&pdev->dev, "OCP2SCP initialized without plat data\n");
+                return -EINVAL;
        }
        pm_runtime_enable(&pdev->dev);
        return 0;
+err1:
+        platform_device_put(pdev_child);
 err0:
        device_for_each_child(&pdev->dev, NULL, ocp2scp_remove_devices);
diff --git a/drivers/clk/ux500/u8500_clk.c b/drivers/clk/ux500/u8500_clk.c
index ca4a25ed844c..e2c17d187d98 100644
--- a/drivers/clk/ux500/u8500_clk.c
+++ b/drivers/clk/ux500/u8500_clk.c
@@ -40,7 +40,7 @@ void u8500_clk_init(void)
                                CLK_IS_ROOT|CLK_IGNORE_UNUSED,
                                32768);
        clk_register_clkdev(clk, "clk32k", NULL);
-        clk_register_clkdev(clk, NULL, "rtc-pl031");
+        clk_register_clkdev(clk, "apb_pclk", "rtc-pl031");
        /* PRCMU clocks */
        fw_version = prcmu_get_fw_version();
@@ -228,10 +228,17 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p1_pclk2", "per1clk", U8500_CLKRST1_BASE,
                                BIT(2), 0);
+        clk_register_clkdev(clk, "apb_pclk", "nmk-i2c.1");
        clk = clk_reg_prcc_pclk("p1_pclk3", "per1clk", U8500_CLKRST1_BASE,
                                BIT(3), 0);
+        clk_register_clkdev(clk, "apb_pclk", "msp0");
+        clk_register_clkdev(clk, "apb_pclk", "ux500-msp-i2s.0");
        clk = clk_reg_prcc_pclk("p1_pclk4", "per1clk", U8500_CLKRST1_BASE,
                                BIT(4), 0);
+        clk_register_clkdev(clk, "apb_pclk", "msp1");
+        clk_register_clkdev(clk, "apb_pclk", "ux500-msp-i2s.1");
        clk = clk_reg_prcc_pclk("p1_pclk5", "per1clk", U8500_CLKRST1_BASE,
                                BIT(5), 0);
@@ -239,6 +246,7 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p1_pclk6", "per1clk", U8500_CLKRST1_BASE,
                                BIT(6), 0);
+        clk_register_clkdev(clk, "apb_pclk", "nmk-i2c.2");
        clk = clk_reg_prcc_pclk("p1_pclk7", "per1clk", U8500_CLKRST1_BASE,
                                BIT(7), 0);
@@ -246,6 +254,7 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p1_pclk8", "per1clk", U8500_CLKRST1_BASE,
                                BIT(8), 0);
+        clk_register_clkdev(clk, "apb_pclk", "slimbus0");
        clk = clk_reg_prcc_pclk("p1_pclk9", "per1clk", U8500_CLKRST1_BASE,
                                BIT(9), 0);
@@ -255,11 +264,16 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p1_pclk10", "per1clk", U8500_CLKRST1_BASE,
                                BIT(10), 0);
+        clk_register_clkdev(clk, "apb_pclk", "nmk-i2c.4");
        clk = clk_reg_prcc_pclk("p1_pclk11", "per1clk", U8500_CLKRST1_BASE,
                                BIT(11), 0);
+        clk_register_clkdev(clk, "apb_pclk", "msp3");
+        clk_register_clkdev(clk, "apb_pclk", "ux500-msp-i2s.3");
        clk = clk_reg_prcc_pclk("p2_pclk0", "per2clk", U8500_CLKRST2_BASE,
                                BIT(0), 0);
+        clk_register_clkdev(clk, "apb_pclk", "nmk-i2c.3");
        clk = clk_reg_prcc_pclk("p2_pclk1", "per2clk", U8500_CLKRST2_BASE,
                                BIT(1), 0);
@@ -279,12 +293,13 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p2_pclk5", "per2clk", U8500_CLKRST2_BASE,
                                BIT(5), 0);
+        clk_register_clkdev(clk, "apb_pclk", "msp2");
+        clk_register_clkdev(clk, "apb_pclk", "ux500-msp-i2s.2");
        clk = clk_reg_prcc_pclk("p2_pclk6", "per2clk", U8500_CLKRST2_BASE,
                                BIT(6), 0);
        clk_register_clkdev(clk, "apb_pclk", "sdi1");
        clk = clk_reg_prcc_pclk("p2_pclk7", "per2clk", U8500_CLKRST2_BASE,
                                BIT(7), 0);
        clk_register_clkdev(clk, "apb_pclk", "sdi3");
@@ -316,10 +331,15 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_pclk("p3_pclk1", "per3clk", U8500_CLKRST3_BASE,
                                BIT(1), 0);
+        clk_register_clkdev(clk, "apb_pclk", "ssp0");
        clk = clk_reg_prcc_pclk("p3_pclk2", "per3clk", U8500_CLKRST3_BASE,
                                BIT(2), 0);
+        clk_register_clkdev(clk, "apb_pclk", "ssp1");
        clk = clk_reg_prcc_pclk("p3_pclk3", "per3clk", U8500_CLKRST3_BASE,
                                BIT(3), 0);
+        clk_register_clkdev(clk, "apb_pclk", "nmk-i2c.0");
        clk = clk_reg_prcc_pclk("p3_pclk4", "per3clk", U8500_CLKRST3_BASE,
                                BIT(4), 0);
@@ -401,10 +421,17 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_kclk("p1_i2c1_kclk", "i2cclk",
                        U8500_CLKRST1_BASE, BIT(2), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "nmk-i2c.1");
        clk = clk_reg_prcc_kclk("p1_msp0_kclk", "msp02clk",
                        U8500_CLKRST1_BASE, BIT(3), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "msp0");
+        clk_register_clkdev(clk, NULL, "ux500-msp-i2s.0");
        clk = clk_reg_prcc_kclk("p1_msp1_kclk", "msp1clk",
                        U8500_CLKRST1_BASE, BIT(4), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "msp1");
+        clk_register_clkdev(clk, NULL, "ux500-msp-i2s.1");
        clk = clk_reg_prcc_kclk("p1_sdi0_kclk", "sdmmcclk",
                        U8500_CLKRST1_BASE, BIT(5), CLK_SET_RATE_GATE);
@@ -412,17 +439,25 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_kclk("p1_i2c2_kclk", "i2cclk",
                        U8500_CLKRST1_BASE, BIT(6), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "nmk-i2c.2");
        clk = clk_reg_prcc_kclk("p1_slimbus0_kclk", "slimclk",
-                        U8500_CLKRST1_BASE, BIT(3), CLK_SET_RATE_GATE);
+                        U8500_CLKRST1_BASE, BIT(8), CLK_SET_RATE_GATE);
-        /* FIXME: Redefinition of BIT(3). */
+        clk_register_clkdev(clk, NULL, "slimbus0");
        clk = clk_reg_prcc_kclk("p1_i2c4_kclk", "i2cclk",
                        U8500_CLKRST1_BASE, BIT(9), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "nmk-i2c.4");
        clk = clk_reg_prcc_kclk("p1_msp3_kclk", "msp1clk",
                        U8500_CLKRST1_BASE, BIT(10), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "msp3");
+        clk_register_clkdev(clk, NULL, "ux500-msp-i2s.3");
        /* Periph2 */
        clk = clk_reg_prcc_kclk("p2_i2c3_kclk", "i2cclk",
                        U8500_CLKRST2_BASE, BIT(0), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "nmk-i2c.3");
        clk = clk_reg_prcc_kclk("p2_sdi4_kclk", "sdmmcclk",
                        U8500_CLKRST2_BASE, BIT(2), CLK_SET_RATE_GATE);
@@ -430,6 +465,8 @@ void u8500_clk_init(void)
        clk = clk_reg_prcc_kclk("p2_msp2_kclk", "msp02clk",
                        U8500_CLKRST2_BASE, BIT(3), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "msp2");
+        clk_register_clkdev(clk, NULL, "ux500-msp-i2s.2");
        clk = clk_reg_prcc_kclk("p2_sdi1_kclk", "sdmmcclk",
                        U8500_CLKRST2_BASE, BIT(4), CLK_SET_RATE_GATE);
@@ -450,10 +487,15 @@ void u8500_clk_init(void)
        /* Periph3 */
        clk = clk_reg_prcc_kclk("p3_ssp0_kclk", "sspclk",
                        U8500_CLKRST3_BASE, BIT(1), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "ssp0");
        clk = clk_reg_prcc_kclk("p3_ssp1_kclk", "sspclk",
                        U8500_CLKRST3_BASE, BIT(2), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "ssp1");
        clk = clk_reg_prcc_kclk("p3_i2c0_kclk", "i2cclk",
                        U8500_CLKRST3_BASE, BIT(3), CLK_SET_RATE_GATE);
+        clk_register_clkdev(clk, NULL, "nmk-i2c.0");
        clk = clk_reg_prcc_kclk("p3_sdi2_kclk", "sdmmcclk",
                        U8500_CLKRST3_BASE, BIT(4), CLK_SET_RATE_GATE);
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 8d4804732bac..8c4139647efc 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -33,7 +33,7 @@
 *              detection. The mods to Rev F required more family
 *              information detection.
 *
- *      Changes/Fixes by Borislav Petkov <borislav.petkov@amd.com>:
+ *      Changes/Fixes by Borislav Petkov <bp@alien8.de>:
 *              - misc fixes and code cleanups
 *
 * This module is based on the following documents
diff --git a/drivers/edac/edac_stub.c b/drivers/edac/edac_stub.c
index 6c86f6e54558..351945fa2ecd 100644
--- a/drivers/edac/edac_stub.c
+++ b/drivers/edac/edac_stub.c
@@ -5,7 +5,7 @@
 *
 * 2007 (c) MontaVista Software, Inc.
 * 2010 (c) Advanced Micro Devices Inc.
- *          Borislav Petkov <borislav.petkov@amd.com>
+ *          Borislav Petkov <bp@alien8.de>
 *
 * This file is licensed under the terms of the GNU General Public
 * License version 2. This program is licensed "as is" without any
diff --git a/drivers/edac/mce_amd_inj.c b/drivers/edac/mce_amd_inj.c
index 66b5151c1080..2ae78f20cc28 100644
--- a/drivers/edac/mce_amd_inj.c
+++ b/drivers/edac/mce_amd_inj.c
@@ -6,7 +6,7 @@
 * This file may be distributed under the terms of the GNU General Public
 * License version 2.
 *
- * Copyright (c) 2010:  Borislav Petkov <borislav.petkov@amd.com>
+ * Copyright (c) 2010:  Borislav Petkov <bp@alien8.de>
 *                      Advanced Micro Devices Inc.
 */
@@ -168,6 +168,6 @@ module_init(edac_init_mce_inject);
 module_exit(edac_exit_mce_inject);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Borislav Petkov <borislav.petkov@amd.com>");
+MODULE_AUTHOR("Borislav Petkov <bp@alien8.de>");
 MODULE_AUTHOR("AMD Inc.");
 MODULE_DESCRIPTION("MCE injection facility for testing MCE decoding");
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 1162d6b3bf85..bb1b392f5cda 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -1546,6 +1546,8 @@ static int sbp2_scsi_slave_configure(struct scsi_device *sdev)
        struct sbp2_logical_unit *lu = sdev->hostdata;
        sdev->use_10_for_rw = 1;
+        sdev->no_report_opcodes = 1;
+        sdev->no_write_same = 1;
        if (sbp2_param_exclusive_login)
                sdev->manage_start_stop = 1;
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index f11d8e3b4041..47150f5ded04 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -466,7 +466,7 @@ config GPIO_ADP5588_IRQ
 config GPIO_ADNP
        tristate "Avionic Design N-bit GPIO expander"
-        depends on I2C && OF
+        depends on I2C && OF_GPIO
        help
          This option enables support for N GPIOs found on Avionic Design
          I2C GPIO expanders. The register space will be extended by powers
diff --git a/drivers/gpio/gpio-mcp23s08.c b/drivers/gpio/gpio-mcp23s08.c
index 0f425189de11..ce1c84760076 100644
--- a/drivers/gpio/gpio-mcp23s08.c
+++ b/drivers/gpio/gpio-mcp23s08.c
@@ -77,7 +77,7 @@ struct mcp23s08_driver_data {
 /*----------------------------------------------------------------------*/
-#ifdef CONFIG_I2C
+#if IS_ENABLED(CONFIG_I2C)
 static int mcp23008_read(struct mcp23s08 *mcp, unsigned reg)
 {
@@ -399,7 +399,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev,
                break;
 #endif /* CONFIG_SPI_MASTER */
-#ifdef CONFIG_I2C
+#if IS_ENABLED(CONFIG_I2C)
        case MCP_TYPE_008:
                mcp->ops = &mcp23008_ops;
                mcp->chip.ngpio = 8;
@@ -473,7 +473,7 @@ fail:
 /*----------------------------------------------------------------------*/
-#ifdef CONFIG_I2C
+#if IS_ENABLED(CONFIG_I2C)
 static int __devinit mcp230xx_probe(struct i2c_client *client,
                                    const struct i2c_device_id *id)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index cf7afb9eb61a..be65c0451ad5 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -92,6 +92,11 @@ static inline void __iomem *mvebu_gpioreg_out(struct mvebu_gpio_chip *mvchip)
        return mvchip->membase + GPIO_OUT_OFF;
 }
+static inline void __iomem *mvebu_gpioreg_blink(struct mvebu_gpio_chip *mvchip)
+{
+        return mvchip->membase + GPIO_BLINK_EN_OFF;
+}
 static inline void __iomem *mvebu_gpioreg_io_conf(struct mvebu_gpio_chip *mvchip)
 {
        return mvchip->membase + GPIO_IO_CONF_OFF;
@@ -206,6 +211,23 @@ static int mvebu_gpio_get(struct gpio_chip *chip, unsigned pin)
        return (u >> pin) & 1;
 }
+static void mvebu_gpio_blink(struct gpio_chip *chip, unsigned pin, int value)
+{
+        struct mvebu_gpio_chip *mvchip =
+                container_of(chip, struct mvebu_gpio_chip, chip);
+        unsigned long flags;
+        u32 u;
+        spin_lock_irqsave(&mvchip->lock, flags);
+        u = readl_relaxed(mvebu_gpioreg_blink(mvchip));
+        if (value)
+                u |= 1 << pin;
+        else
+                u &= ~(1 << pin);
+        writel_relaxed(u, mvebu_gpioreg_blink(mvchip));
+        spin_unlock_irqrestore(&mvchip->lock, flags);
+}
 static int mvebu_gpio_direction_input(struct gpio_chip *chip, unsigned pin)
 {
        struct mvebu_gpio_chip *mvchip =
@@ -244,6 +266,7 @@ static int mvebu_gpio_direction_output(struct gpio_chip *chip, unsigned pin,
        if (ret)
                return ret;
+        mvebu_gpio_blink(chip, pin, 0);
        mvebu_gpio_set(chip, pin, value);
        spin_lock_irqsave(&mvchip->lock, flags);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index b726b478a4f5..6345878ae1e7 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -143,7 +143,7 @@ static void intel_crt_dpms(struct drm_connector *connector, int mode)
        int old_dpms;
        /* PCH platforms and VLV only support on/off. */
-        if (INTEL_INFO(dev)->gen < 5 && mode != DRM_MODE_DPMS_ON)
+        if (INTEL_INFO(dev)->gen >= 5 && mode != DRM_MODE_DPMS_ON)
                mode = DRM_MODE_DPMS_OFF;
        if (mode == connector->dpms)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 461a637f1ef7..4154bcd7a070 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -3841,6 +3841,17 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                        }
                }
+                if (intel_encoder->type == INTEL_OUTPUT_EDP) {
+                        /* Use VBT settings if we have an eDP panel */
+                        unsigned int edp_bpc = dev_priv->edp.bpp / 3;
+                        if (edp_bpc < display_bpc) {
+                                DRM_DEBUG_KMS("clamping display bpc (was %d) to eDP (%d)\n", display_bpc, edp_bpc);
+                                display_bpc = edp_bpc;
+                        }
+                        continue;
+                }
                /*
                 * HDMI is either 12 or 8, so if the display lets 10bpc sneak
                 * through, clamp it down.  (Note: >12bpc will be caught below.)
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 79d308da29ff..c600fb06e25e 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2382,6 +2382,18 @@ intel_sdvo_output_setup(struct intel_sdvo *intel_sdvo, uint16_t flags)
        return true;
 }
+static void intel_sdvo_output_cleanup(struct intel_sdvo *intel_sdvo)
+{
+        struct drm_device *dev = intel_sdvo->base.base.dev;
+        struct drm_connector *connector, *tmp;
+        list_for_each_entry_safe(connector, tmp,
+                                 &dev->mode_config.connector_list, head) {
+                if (intel_attached_encoder(connector) == &intel_sdvo->base)
+                        intel_sdvo_destroy(connector);
+        }
+}
 static bool intel_sdvo_tv_create_property(struct intel_sdvo *intel_sdvo,
                                          struct intel_sdvo_connector *intel_sdvo_connector,
                                          int type)
@@ -2705,7 +2717,8 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                                    intel_sdvo->caps.output_flags) != true) {
                DRM_DEBUG_KMS("SDVO output failed to setup on %s\n",
                              SDVO_NAME(intel_sdvo));
-                goto err;
+                /* Output_setup can leave behind connectors! */
+                goto err_output;
        }
        /* Only enable the hotplug irq if we need it, to work around noisy
@@ -2718,12 +2731,12 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
        /* Set the input timing to the screen. Assume always input 0. */
        if (!intel_sdvo_set_target_input(intel_sdvo))
-                goto err;
+                goto err_output;
        if (!intel_sdvo_get_input_pixel_clock_range(intel_sdvo,
                                                    &intel_sdvo->pixel_clock_min,
                                                    &intel_sdvo->pixel_clock_max))
-                goto err;
+                goto err_output;
        DRM_DEBUG_KMS("%s device VID/DID: %02X:%02X.%02X, "
                        "clock range %dMHz - %dMHz, "
@@ -2743,6 +2756,9 @@ bool intel_sdvo_init(struct drm_device *dev, uint32_t sdvo_reg, bool is_sdvob)
                        (SDVO_OUTPUT_TMDS1 | SDVO_OUTPUT_RGB1) ? 'Y' : 'N');
        return true;
+err_output:
+        intel_sdvo_output_cleanup(intel_sdvo);
 err:
        drm_encoder_cleanup(&intel_encoder->base);
        i2c_del_adapter(&intel_sdvo->ddc);
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 05a909a17cee..15b182c84ce8 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -49,13 +49,7 @@ nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
                if (chan->vblank.crtc != crtc)
                        continue;
-                if (nv_device(priv)->chipset == 0x50) {
+                if (nv_device(priv)->chipset >= 0xc0) {
-                        nv_wr32(priv, 0x001704, chan->vblank.channel);
-                        nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
-                        bar->flush(bar);
-                        nv_wr32(priv, 0x001570, chan->vblank.offset);
-                        nv_wr32(priv, 0x001574, chan->vblank.value);
-                } else {
                        nv_wr32(priv, 0x001718, 0x80000000 | chan->vblank.channel);
                        bar->flush(bar);
                        nv_wr32(priv, 0x06000c,
@@ -63,6 +57,17 @@ nv50_disp_intr_vblank(struct nv50_disp_priv *priv, int crtc)
                        nv_wr32(priv, 0x060010,
                                lower_32_bits(chan->vblank.offset));
                        nv_wr32(priv, 0x060014, chan->vblank.value);
+                } else {
+                        nv_wr32(priv, 0x001704, chan->vblank.channel);
+                        nv_wr32(priv, 0x001710, 0x80000000 | chan->vblank.ctxdma);
+                        bar->flush(bar);
+                        if (nv_device(priv)->chipset == 0x50) {
+                                nv_wr32(priv, 0x001570, chan->vblank.offset);
+                                nv_wr32(priv, 0x001574, chan->vblank.value);
+                        } else {
+                                nv_wr32(priv, 0x060010, chan->vblank.offset);
+                                nv_wr32(priv, 0x060014, chan->vblank.value);
+                        }
                }
                list_del(&chan->vblank.head);
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv40.c b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv40.c
index e45035efb8ca..7bbb1e1b7a8d 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/ctxnv40.c
@@ -669,21 +669,27 @@ nv40_grctx_fill(struct nouveau_device *device, struct nouveau_gpuobj *mem)
                           });
 }
-void
+int
 nv40_grctx_init(struct nouveau_device *device, u32 *size)
 {
-        u32 ctxprog[256], i;
+        u32 *ctxprog = kmalloc(256 * 4, GFP_KERNEL), i;
        struct nouveau_grctx ctx = {
                .device = device,
                .mode = NOUVEAU_GRCTX_PROG,
                .data = ctxprog,
-                .ctxprog_max = ARRAY_SIZE(ctxprog)
+                .ctxprog_max = 256,
        };
+        if (!ctxprog)
+                return -ENOMEM;
        nv40_grctx_generate(&ctx);
        nv_wr32(device, 0x400324, 0);
        for (i = 0; i < ctx.ctxprog_len; i++)
                nv_wr32(device, 0x400328, ctxprog[i]);
        *size = ctx.ctxvals_pos * 4;
+        kfree(ctxprog);
+        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
index 425001204a89..cc6574eeb80e 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.c
@@ -346,7 +346,9 @@ nv40_graph_init(struct nouveau_object *object)
                return ret;
        /* generate and upload context program */
-        nv40_grctx_init(nv_device(priv), &priv->size);
+        ret = nv40_grctx_init(nv_device(priv), &priv->size);
+        if (ret)
+                return ret;
        /* No context present currently */
        nv_wr32(priv, NV40_PGRAPH_CTXCTL_CUR, 0x00000000);
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.h b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.h
index d2ac975afc2e..7da35a4e7970 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nv40.h
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nv40.h
@@ -15,7 +15,7 @@ nv44_graph_class(void *priv)
        return !(0x0baf & (1 << (device->chipset & 0x0f)));
 }
-void nv40_grctx_init(struct nouveau_device *, u32 *size);
+int  nv40_grctx_init(struct nouveau_device *, u32 *size);
 void nv40_grctx_fill(struct nouveau_device *, struct nouveau_gpuobj *);
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/include/core/object.h b/drivers/gpu/drm/nouveau/core/include/core/object.h
index 818feabbf4a0..486f1a9217fd 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/object.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/object.h
@@ -175,14 +175,18 @@ nv_mo32(void *obj, u32 addr, u32 mask, u32 data)
        return temp;
 }
-static inline bool
+static inline int
-nv_strncmp(void *obj, u32 addr, u32 len, const char *str)
+nv_memcmp(void *obj, u32 addr, const char *str, u32 len)
 {
+        unsigned char c1, c2;
        while (len--) {
-                if (nv_ro08(obj, addr++) != *(str++))
+                c1 = nv_ro08(obj, addr++);
-                        return false;
+                c2 = *(str++);
+                if (c1 != c2)
+                        return c1 - c2;
        }
-        return true;
+        return 0;
 }
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
index 39e73b91d360..41b7a6a76f19 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/clock.h
@@ -54,6 +54,7 @@ int nv04_clock_pll_calc(struct nouveau_clock *, struct nvbios_pll *,
                        int clk, struct nouveau_pll_vals *);
 int nv04_clock_pll_prog(struct nouveau_clock *, u32 reg1,
                        struct nouveau_pll_vals *);
+int nva3_clock_pll_calc(struct nouveau_clock *, struct nvbios_pll *,
+                        int clk, struct nouveau_pll_vals *);
 #endif
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
index 7d750382a833..c51197157749 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/dcb.c
@@ -64,7 +64,7 @@ dcb_table(struct nouveau_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len)
                }
        } else
        if (*ver >= 0x15) {
-                if (!nv_strncmp(bios, dcb - 7, 7, "DEV_REC")) {
+                if (!nv_memcmp(bios, dcb - 7, "DEV_REC", 7)) {
                        u16 i2c = nv_ro16(bios, dcb + 2);
                        *hdr = 4;
                        *cnt = (i2c - dcb) / 10;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nva3.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nva3.c
index cc8d7d162d7c..9068c98b96f6 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nva3.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nva3.c
@@ -66,6 +66,24 @@ nva3_clock_pll_set(struct nouveau_clock *clk, u32 type, u32 freq)
        return ret;
 }
+int
+nva3_clock_pll_calc(struct nouveau_clock *clock, struct nvbios_pll *info,
+                    int clk, struct nouveau_pll_vals *pv)
+{
+        int ret, N, M, P;
+        ret = nva3_pll_calc(clock, info, clk, &N, NULL, &M, &P);
+        if (ret > 0) {
+                pv->refclk = info->refclk;
+                pv->N1 = N;
+                pv->M1 = M;
+                pv->log2P = P;
+        }
+        return ret;
+}
 static int
 nva3_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                struct nouveau_oclass *oclass, void *data, u32 size,
@@ -80,6 +98,7 @@ nva3_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                return ret;
        priv->base.pll_set = nva3_clock_pll_set;
+        priv->base.pll_calc = nva3_clock_pll_calc;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
index 5ccce0b17bf3..f6962c9b6c36 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
@@ -79,6 +79,7 @@ nvc0_clock_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
                return ret;
        priv->base.pll_set = nvc0_clock_pll_set;
+        priv->base.pll_calc = nva3_clock_pll_calc;
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index cc79c796afee..cbf1fc60a386 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -241,6 +241,10 @@ nouveau_abi16_ioctl_channel_alloc(ABI16_IOCTL_ARGS)
        if (unlikely(!abi16))
                return -ENOMEM;
+        if (!drm->channel)
+                return nouveau_abi16_put(abi16, -ENODEV);
        client = nv_client(abi16->client);
        if (init->fb_ctxdma_handle == ~0 || init->tt_ctxdma_handle == ~0)
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 0910125cbbc3..8503b2ea570a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -129,7 +129,8 @@ nouveau_accel_init(struct nouveau_drm *drm)
        /* initialise synchronisation routines */
        if      (device->card_type < NV_10) ret = nv04_fence_create(drm);
-        else if (device->chipset   <  0x84) ret = nv10_fence_create(drm);
+        else if (device->card_type < NV_50) ret = nv10_fence_create(drm);
+        else if (device->chipset   <  0x84) ret = nv50_fence_create(drm);
        else if (device->card_type < NV_C0) ret = nv84_fence_create(drm);
        else                                ret = nvc0_fence_create(drm);
        if (ret) {
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
index ba498f8e47a2..010bae19554a 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -1625,7 +1625,7 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_SETUP, 0, 0);
                        atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
                        /* some early dce3.2 boards have a bug in their transmitter control table */
-                        if ((rdev->family != CHIP_RV710) || (rdev->family != CHIP_RV730))
+                        if ((rdev->family != CHIP_RV710) && (rdev->family != CHIP_RV730))
                                atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
                }
                if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index af31f829f4a8..219942c660d7 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1330,6 +1330,8 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                        break;
                                udelay(1);
                        }
+                } else {
+                        save->crtc_enabled[i] = false;
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index 10ea17a6b2a6..42433344cb1b 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -69,9 +69,12 @@ static struct radeon_agpmode_quirk radeon_agpmode_quirk_list[] = {
        /* Intel 82830 830 Chipset Host Bridge / Mobility M6 LY Needs AGPMode 2 (fdo #17360)*/
        { PCI_VENDOR_ID_INTEL, 0x3575, PCI_VENDOR_ID_ATI, 0x4c59,
                PCI_VENDOR_ID_DELL, 0x00e3, 2},
-        /* Intel 82852/82855 host bridge / Mobility FireGL 9000 R250 Needs AGPMode 1 (lp #296617) */
+        /* Intel 82852/82855 host bridge / Mobility FireGL 9000 RV250 Needs AGPMode 1 (lp #296617) */
        { PCI_VENDOR_ID_INTEL, 0x3580, PCI_VENDOR_ID_ATI, 0x4c66,
                PCI_VENDOR_ID_DELL, 0x0149, 1},
+        /* Intel 82855PM host bridge / Mobility FireGL 9000 RV250 Needs AGPMode 1 for suspend/resume */
+        { PCI_VENDOR_ID_INTEL, 0x3340, PCI_VENDOR_ID_ATI, 0x4c66,
+                PCI_VENDOR_ID_IBM, 0x0531, 1},
        /* Intel 82852/82855 host bridge / Mobility 9600 M10 RV350 Needs AGPMode 1 (deb #467460) */
        { PCI_VENDOR_ID_INTEL, 0x3580, PCI_VENDOR_ID_ATI, 0x4e50,
                0x1025, 0x0061, 1},
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index 860dc4813e99..bd2a3b40cd12 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -749,7 +749,10 @@ static int ttm_get_pages(struct page **pages, unsigned npages, int flags,
        /* clear the pages coming from the pool if requested */
        if (flags & TTM_PAGE_FLAG_ZERO_ALLOC) {
                list_for_each_entry(p, &plist, lru) {
-                        clear_page(page_address(p));
+                        if (PageHighMem(p))
+                                clear_highpage(p);
+                        else
+                                clear_page(page_address(p));
                }
        }
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index bf8260133ea9..7d759a430294 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -308,9 +308,7 @@ int ttm_tt_swapin(struct ttm_tt *ttm)
                if (unlikely(to_page == NULL))
                        goto out_err;
-                preempt_disable();
                copy_highpage(to_page, from_page);
-                preempt_enable();
                page_cache_release(from_page);
        }
@@ -358,9 +356,7 @@ int ttm_tt_swapout(struct ttm_tt *ttm, struct file *persistent_swap_storage)
                        ret = PTR_ERR(to_page);
                        goto out_err;
                }
-                preempt_disable();
                copy_highpage(to_page, from_page);
-                preempt_enable();
                set_page_dirty(to_page);
                mark_page_accessed(to_page);
                page_cache_release(to_page);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index b07ca2e4d04b..7290811f89be 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
        memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size);
        ret = copy_to_user(buffer, bounce, size);
+        if (ret)
+                ret = -EFAULT;
        vfree(bounce);
        if (unlikely(ret != 0))
diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
index f676c01bb471..6fcd466d0825 100644
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -46,9 +46,9 @@ static __u8 *ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                rdesc[559] = 0x45;
        }
        /* the same as above (s/usage/physical/) */
-        if ((quirks & MS_RDESC_3K) && *rsize == 106 &&
+        if ((quirks & MS_RDESC_3K) && *rsize == 106 && rdesc[94] == 0x19 &&
-                        !memcmp((char []){ 0x19, 0x00, 0x29, 0xff },
+                        rdesc[95] == 0x00 && rdesc[96] == 0x29 &&
-                                &rdesc[94], 4)) {
+                        rdesc[97] == 0xff) {
                rdesc[94] = 0x35;
                rdesc[96] = 0x45;
        }
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index aa59a254be2c..c02bf208084f 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -39,6 +39,7 @@
 #define AT91_TWI_STOP           0x0002  /* Send a Stop Condition */
 #define AT91_TWI_MSEN           0x0004  /* Master Transfer Enable */
 #define AT91_TWI_SVDIS          0x0020  /* Slave Transfer Disable */
+#define AT91_TWI_QUICK          0x0040  /* SMBus quick command */
 #define AT91_TWI_SWRST          0x0080  /* Software Reset */
 #define AT91_TWI_MMR            0x0004  /* Master Mode Register */
@@ -212,7 +213,11 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
        INIT_COMPLETION(dev->cmd_complete);
        dev->transfer_status = 0;
-        if (dev->msg->flags & I2C_M_RD) {
+        if (!dev->buf_len) {
+                at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_QUICK);
+                at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
+        } else if (dev->msg->flags & I2C_M_RD) {
                unsigned start_flags = AT91_TWI_START;
                if (at91_twi_read(dev, AT91_TWI_SR) & AT91_TWI_RXRDY) {
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 286ca1917820..0670da79ee5e 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -287,12 +287,14 @@ read_init_dma_fail:
 select_init_dma_fail:
        dma_unmap_sg(i2c->dev, &i2c->sg_io[0], 1, DMA_TO_DEVICE);
 select_init_pio_fail:
+        dmaengine_terminate_all(i2c->dmach);
        return -EINVAL;
 /* Write failpath. */
 write_init_dma_fail:
        dma_unmap_sg(i2c->dev, i2c->sg_io, 2, DMA_TO_DEVICE);
 write_init_pio_fail:
+        dmaengine_terminate_all(i2c->dmach);
        return -EINVAL;
 }
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index db31eaed6ea5..3525c9e62cb0 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -43,7 +43,6 @@
 #include <linux/slab.h>
 #include <linux/i2c-omap.h>
 #include <linux/pm_runtime.h>
-#include <linux/pm_qos.h>
 /* I2C controller revisions */
 #define OMAP_I2C_OMAP1_REV_2            0x20
@@ -187,8 +186,9 @@ struct omap_i2c_dev {
        int                     reg_shift;      /* bit shift for I2C register addresses */
        struct completion       cmd_complete;
        struct resource         *ioarea;
-        u32                     latency;        /* maximum MPU wkup latency */
+        u32                     latency;        /* maximum mpu wkup latency */
-        struct pm_qos_request   pm_qos_request;
+        void                    (*set_mpu_wkup_lat)(struct device *dev,
+                                                    long latency);
        u32                     speed;          /* Speed of bus in kHz */
        u32                     dtrev;          /* extra revision from DT */
        u32                     flags;
@@ -494,7 +494,9 @@ static void omap_i2c_resize_fifo(struct omap_i2c_dev *dev, u8 size, bool is_rx)
                dev->b_hw = 1; /* Enable hardware fixes */
        /* calculate wakeup latency constraint for MPU */
-        dev->latency = (1000000 * dev->threshold) / (1000 * dev->speed / 8);
+        if (dev->set_mpu_wkup_lat != NULL)
+                dev->latency = (1000000 * dev->threshold) /
+                        (1000 * dev->speed / 8);
 }
 /*
@@ -522,6 +524,9 @@ static int omap_i2c_xfer_msg(struct i2c_adapter *adap,
        dev->buf = msg->buf;
        dev->buf_len = msg->len;
+        /* make sure writes to dev->buf_len are ordered */
+        barrier();
        omap_i2c_write_reg(dev, OMAP_I2C_CNT_REG, dev->buf_len);
        /* Clear the FIFO Buffers */
@@ -579,7 +584,6 @@ static int omap_i2c_xfer_msg(struct i2c_adapter *adap,
         */
        timeout = wait_for_completion_timeout(&dev->cmd_complete,
                                                OMAP_I2C_TIMEOUT);
-        dev->buf_len = 0;
        if (timeout == 0) {
                dev_err(dev->dev, "controller timed out\n");
                omap_i2c_init(dev);
@@ -629,16 +633,8 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
        if (r < 0)
                goto out;
-        /*
+        if (dev->set_mpu_wkup_lat != NULL)
-         * When waiting for completion of a i2c transfer, we need to
+                dev->set_mpu_wkup_lat(dev->dev, dev->latency);
-         * set a wake up latency constraint for the MPU. This is to
-         * ensure quick enough wakeup from idle, when transfer
-         * completes.
-         */
-        if (dev->latency)
-                pm_qos_add_request(&dev->pm_qos_request,
-                                   PM_QOS_CPU_DMA_LATENCY,
-                                   dev->latency);
        for (i = 0; i < num; i++) {
                r = omap_i2c_xfer_msg(adap, &msgs[i], (i == (num - 1)));
@@ -646,8 +642,8 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
                        break;
        }
-        if (dev->latency)
+        if (dev->set_mpu_wkup_lat != NULL)
-                pm_qos_remove_request(&dev->pm_qos_request);
+                dev->set_mpu_wkup_lat(dev->dev, -1);
        if (r == 0)
                r = num;
@@ -1104,6 +1100,7 @@ omap_i2c_probe(struct platform_device *pdev)
        } else if (pdata != NULL) {
                dev->speed = pdata->clkrate;
                dev->flags = pdata->flags;
+                dev->set_mpu_wkup_lat = pdata->set_mpu_wkup_lat;
                dev->dtrev = pdata->rev;
        }
@@ -1159,8 +1156,9 @@ omap_i2c_probe(struct platform_device *pdev)
                        dev->b_hw = 1; /* Enable hardware fixes */
                /* calculate wakeup latency constraint for MPU */
-                dev->latency = (1000000 * dev->fifo_size) /
+                if (dev->set_mpu_wkup_lat != NULL)
-                               (1000 * dev->speed / 8);
+                        dev->latency = (1000000 * dev->fifo_size) /
+                                       (1000 * dev->speed / 8);
        }
        /* reset ASAP, clearing any IRQs */
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 3e0335f1fc60..9d902725bac9 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -806,6 +806,7 @@ static int s3c24xx_i2c_parse_dt_gpio(struct s3c24xx_i2c *i2c)
                        dev_err(i2c->dev, "invalid gpio[%d]: %d\n", idx, gpio);
                        goto free_gpio;
                }
+                i2c->gpios[idx] = gpio;
                ret = gpio_request(gpio, "i2c-bus");
                if (ret) {
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index 5f097f309b9f..7fa5b24b16db 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -169,7 +169,7 @@ static int __devinit i2c_mux_pinctrl_probe(struct platform_device *pdev)
        mux->busses = devm_kzalloc(&pdev->dev,
                                   sizeof(mux->busses) * mux->pdata->bus_count,
                                   GFP_KERNEL);
-        if (!mux->states) {
+        if (!mux->busses) {
                dev_err(&pdev->dev, "Cannot allocate busses\n");
                ret = -ENOMEM;
                goto err;
diff --git a/drivers/input/input-mt.c b/drivers/input/input-mt.c
index c0ec7d42c3be..1abbc170d8b7 100644
--- a/drivers/input/input-mt.c
+++ b/drivers/input/input-mt.c
@@ -26,10 +26,14 @@ static void copy_abs(struct input_dev *dev, unsigned int dst, unsigned int src)
 * input_mt_init_slots() - initialize MT input slots
 * @dev: input device supporting MT events and finger tracking
 * @num_slots: number of slots used by the device
+ * @flags: mt tasks to handle in core
 *
 * This function allocates all necessary memory for MT slot handling
 * in the input device, prepares the ABS_MT_SLOT and
 * ABS_MT_TRACKING_ID events for use and sets up appropriate buffers.
+ * Depending on the flags set, it also performs pointer emulation and
+ * frame synchronization.
+ *
 * May be called repeatedly. Returns -EINVAL if attempting to
 * reinitialize with a different number of slots.
 */
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 8f02e3d0e712..4c842c320c2e 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -12,8 +12,8 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #define MOUSEDEV_MINOR_BASE     32
-#define MOUSEDEV_MINORS         32
+#define MOUSEDEV_MINORS         31
-#define MOUSEDEV_MIX            31
+#define MOUSEDEV_MIX            63
 #include <linux/sched.h>
 #include <linux/slab.h>
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index f02028ec3db6..78e5d9ab0ba7 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -955,7 +955,8 @@ static int ads7846_resume(struct device *dev)
 static SIMPLE_DEV_PM_OPS(ads7846_pm, ads7846_suspend, ads7846_resume);
-static int __devinit ads7846_setup_pendown(struct spi_device *spi, struct ads7846 *ts)
+static int __devinit ads7846_setup_pendown(struct spi_device *spi,
+                                           struct ads7846 *ts)
 {
        struct ads7846_platform_data *pdata = spi->dev.platform_data;
        int err;
@@ -981,6 +982,9 @@ static int __devinit ads7846_setup_pendown(struct spi_device *spi, struct ads784
                ts->gpio_pendown = pdata->gpio_pendown;
+                if (pdata->gpio_pendown_debounce)
+                        gpio_set_debounce(pdata->gpio_pendown,
+                                          pdata->gpio_pendown_debounce);
        } else {
                dev_err(&spi->dev, "no get_pendown_state nor gpio_pendown?\n");
                return -EINVAL;
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index d4a4cd445cab..0badfa48b32b 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -4108,7 +4108,7 @@ static void swap_pci_ref(struct pci_dev **from, struct pci_dev *to)
 static int intel_iommu_add_device(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        struct pci_dev *bridge, *dma_pdev;
+        struct pci_dev *bridge, *dma_pdev = NULL;
        struct iommu_group *group;
        int ret;
@@ -4122,7 +4122,7 @@ static int intel_iommu_add_device(struct device *dev)
                        dma_pdev = pci_get_domain_bus_and_slot(
                                                pci_domain_nr(pdev->bus),
                                                bridge->subordinate->number, 0);
-                else
+                if (!dma_pdev)
                        dma_pdev = pci_dev_get(bridge);
        } else
                dma_pdev = pci_dev_get(pdev);
diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
index 41678639b7e3..4252d743963d 100644
--- a/drivers/iommu/tegra-smmu.c
+++ b/drivers/iommu/tegra-smmu.c
@@ -1052,6 +1052,7 @@ static int smmu_debugfs_stats_show(struct seq_file *s, void *v)
                        stats[i], val, offs);
        }
        seq_printf(s, "\n");
+        dput(dent);
        return 0;
 }
diff --git a/drivers/irqchip/irq-bcm2835.c b/drivers/irqchip/irq-bcm2835.c
index dc670ccc6978..16c78f1c5ef2 100644
--- a/drivers/irqchip/irq-bcm2835.c
+++ b/drivers/irqchip/irq-bcm2835.c
@@ -168,7 +168,8 @@ static int __init armctrl_of_init(struct device_node *node,
 }
 static struct of_device_id irq_of_match[] __initconst = {
-        { .compatible = "brcm,bcm2835-armctrl-ic", .data = armctrl_of_init }
+        { .compatible = "brcm,bcm2835-armctrl-ic", .data = armctrl_of_init },
+        { }
 };
 void __init bcm2835_init_irq(void)
diff --git a/drivers/leds/ledtrig-cpu.c b/drivers/leds/ledtrig-cpu.c
index b312056da14d..4239b3955ff0 100644
--- a/drivers/leds/ledtrig-cpu.c
+++ b/drivers/leds/ledtrig-cpu.c
@@ -33,8 +33,6 @@
 struct led_trigger_cpu {
        char name[MAX_NAME_LEN];
        struct led_trigger *_trig;
-        struct mutex lock;
-        int lock_is_inited;
 };
 static DEFINE_PER_CPU(struct led_trigger_cpu, cpu_trig);
@@ -50,12 +48,6 @@ void ledtrig_cpu(enum cpu_led_event ledevt)
 {
        struct led_trigger_cpu *trig = &__get_cpu_var(cpu_trig);
-        /* mutex lock should be initialized before calling mutex_call() */
-        if (!trig->lock_is_inited)
-                return;
-        mutex_lock(&trig->lock);
        /* Locate the correct CPU LED */
        switch (ledevt) {
        case CPU_LED_IDLE_END:
@@ -75,8 +67,6 @@ void ledtrig_cpu(enum cpu_led_event ledevt)
                /* Will leave the LED as it is */
                break;
        }
-        mutex_unlock(&trig->lock);
 }
 EXPORT_SYMBOL(ledtrig_cpu);
@@ -117,14 +107,9 @@ static int __init ledtrig_cpu_init(void)
        for_each_possible_cpu(cpu) {
                struct led_trigger_cpu *trig = &per_cpu(cpu_trig, cpu);
-                mutex_init(&trig->lock);
                snprintf(trig->name, MAX_NAME_LEN, "cpu%d", cpu);
-                mutex_lock(&trig->lock);
                led_trigger_register_simple(trig->name, &trig->_trig);
-                trig->lock_is_inited = 1;
-                mutex_unlock(&trig->lock);
        }
        register_syscore_ops(&ledtrig_cpu_syscore_ops);
@@ -142,15 +127,9 @@ static void __exit ledtrig_cpu_exit(void)
        for_each_possible_cpu(cpu) {
                struct led_trigger_cpu *trig = &per_cpu(cpu_trig, cpu);
-                mutex_lock(&trig->lock);
                led_trigger_unregister_simple(trig->_trig);
                trig->_trig = NULL;
                memset(trig->name, 0, MAX_NAME_LEN);
-                trig->lock_is_inited = 0;
-                mutex_unlock(&trig->lock);
-                mutex_destroy(&trig->lock);
        }
        unregister_syscore_ops(&ledtrig_cpu_syscore_ops);
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 02db9183ca01..77e6eff41cae 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -740,8 +740,14 @@ static void rq_completed(struct mapped_device *md, int rw, int run_queue)
        if (!md_in_flight(md))
                wake_up(&md->wait);
+        /*
+         * Run this off this callpath, as drivers could invoke end_io while
+         * inside their request_fn (and holding the queue lock). Calling
+         * back into ->request_fn() could deadlock attempting to grab the
+         * queue lock again.
+         */
        if (run_queue)
-                blk_run_queue(md->queue);
+                blk_run_queue_async(md->queue);
        /*
         * dm_put() must be at the end of this function. See the comment above
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 9ab768acfb62..61200717687b 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1817,10 +1817,10 @@ retry:
                        memset(bbp, 0xff, PAGE_SIZE);
                        for (i = 0 ; i < bb->count ; i++) {
-                                u64 internal_bb = *p++;
+                                u64 internal_bb = p[i];
                                u64 store_bb = ((BB_OFFSET(internal_bb) << 10)
                                                | BB_LEN(internal_bb));
-                                *bbp++ = cpu_to_le64(store_bb);
+                                bbp[i] = cpu_to_le64(store_bb);
                        }
                        bb->changed = 0;
                        if (read_seqretry(&bb->lock, seq))
@@ -5294,7 +5294,7 @@ void md_stop_writes(struct mddev *mddev)
 }
 EXPORT_SYMBOL_GPL(md_stop_writes);
-void md_stop(struct mddev *mddev)
+static void __md_stop(struct mddev *mddev)
 {
        mddev->ready = 0;
        mddev->pers->stop(mddev);
@@ -5304,6 +5304,18 @@ void md_stop(struct mddev *mddev)
        mddev->pers = NULL;
        clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
 }
+void md_stop(struct mddev *mddev)
+{
+        /* stop the array and free an attached data structures.
+         * This is called from dm-raid
+         */
+        __md_stop(mddev);
+        bitmap_destroy(mddev);
+        if (mddev->bio_set)
+                bioset_free(mddev->bio_set);
+}
 EXPORT_SYMBOL_GPL(md_stop);
 static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
@@ -5364,7 +5376,7 @@ static int do_md_stop(struct mddev * mddev, int mode,
                        set_disk_ro(disk, 0);
                __md_stop_writes(mddev);
-                md_stop(mddev);
+                __md_stop(mddev);
                mddev->queue->merge_bvec_fn = NULL;
                mddev->queue->backing_dev_info.congested_fn = NULL;
@@ -7936,9 +7948,9 @@ int md_is_badblock(struct badblocks *bb, sector_t s, int sectors,
                   sector_t *first_bad, int *bad_sectors)
 {
        int hi;
-        int lo = 0;
+        int lo;
        u64 *p = bb->page;
-        int rv = 0;
+        int rv;
        sector_t target = s + sectors;
        unsigned seq;
@@ -7953,7 +7965,8 @@ int md_is_badblock(struct badblocks *bb, sector_t s, int sectors,
 retry:
        seq = read_seqbegin(&bb->lock);
+        lo = 0;
+        rv = 0;
        hi = bb->count;
        /* Binary search between lo and hi for 'target'
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index d1295aff4173..0d5d0ff2c0f7 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -499,7 +499,7 @@ static void raid10_end_write_request(struct bio *bio, int error)
         */
        one_write_done(r10_bio);
        if (dec_rdev)
-                rdev_dec_pending(conf->mirrors[dev].rdev, conf->mddev);
+                rdev_dec_pending(rdev, conf->mddev);
 }
 /*
@@ -1334,18 +1334,21 @@ retry_write:
                        blocked_rdev = rrdev;
                        break;
                }
+                if (rdev && (test_bit(Faulty, &rdev->flags)
+                             || test_bit(Unmerged, &rdev->flags)))
+                        rdev = NULL;
                if (rrdev && (test_bit(Faulty, &rrdev->flags)
                              || test_bit(Unmerged, &rrdev->flags)))
                        rrdev = NULL;
                r10_bio->devs[i].bio = NULL;
                r10_bio->devs[i].repl_bio = NULL;
-                if (!rdev || test_bit(Faulty, &rdev->flags) ||
-                    test_bit(Unmerged, &rdev->flags)) {
+                if (!rdev && !rrdev) {
                        set_bit(R10BIO_Degraded, &r10_bio->state);
                        continue;
                }
-                if (test_bit(WriteErrorSeen, &rdev->flags)) {
+                if (rdev && test_bit(WriteErrorSeen, &rdev->flags)) {
                        sector_t first_bad;
                        sector_t dev_sector = r10_bio->devs[i].addr;
                        int bad_sectors;
@@ -1387,8 +1390,10 @@ retry_write:
                                        max_sectors = good_sectors;
                        }
                }
-                r10_bio->devs[i].bio = bio;
+                if (rdev) {
-                atomic_inc(&rdev->nr_pending);
+                        r10_bio->devs[i].bio = bio;
+                        atomic_inc(&rdev->nr_pending);
+                }
                if (rrdev) {
                        r10_bio->devs[i].repl_bio = bio;
                        atomic_inc(&rrdev->nr_pending);
@@ -1444,69 +1449,71 @@ retry_write:
        for (i = 0; i < conf->copies; i++) {
                struct bio *mbio;
                int d = r10_bio->devs[i].devnum;
-                if (!r10_bio->devs[i].bio)
+                if (r10_bio->devs[i].bio) {
-                        continue;
+                        struct md_rdev *rdev = conf->mirrors[d].rdev;
+                        mbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
+                        md_trim_bio(mbio, r10_bio->sector - bio->bi_sector,
+                                    max_sectors);
+                        r10_bio->devs[i].bio = mbio;
+                        mbio->bi_sector = (r10_bio->devs[i].addr+
+                                           choose_data_offset(r10_bio,
+                                                              rdev));
+                        mbio->bi_bdev = rdev->bdev;
+                        mbio->bi_end_io = raid10_end_write_request;
+                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_private = r10_bio;
-                mbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
+                        atomic_inc(&r10_bio->remaining);
-                md_trim_bio(mbio, r10_bio->sector - bio->bi_sector,
-                            max_sectors);
-                r10_bio->devs[i].bio = mbio;
-                mbio->bi_sector = (r10_bio->devs[i].addr+
+                        cb = blk_check_plugged(raid10_unplug, mddev,
-                                   choose_data_offset(r10_bio,
+                                               sizeof(*plug));
-                                                      conf->mirrors[d].rdev));
+                        if (cb)
-                mbio->bi_bdev = conf->mirrors[d].rdev->bdev;
+                                plug = container_of(cb, struct raid10_plug_cb,
-                mbio->bi_end_io = raid10_end_write_request;
+                                                    cb);
-                mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        else
-                mbio->bi_private = r10_bio;
+                                plug = NULL;
+                        spin_lock_irqsave(&conf->device_lock, flags);
+                        if (plug) {
+                                bio_list_add(&plug->pending, mbio);
+                                plug->pending_cnt++;
+                        } else {
+                                bio_list_add(&conf->pending_bio_list, mbio);
+                                conf->pending_count++;
+                        }
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
+                        if (!plug)
+                                md_wakeup_thread(mddev->thread);
+                }
-                atomic_inc(&r10_bio->remaining);
+                if (r10_bio->devs[i].repl_bio) {
+                        struct md_rdev *rdev = conf->mirrors[d].replacement;
+                        if (rdev == NULL) {
+                                /* Replacement just got moved to main 'rdev' */
+                                smp_mb();
+                                rdev = conf->mirrors[d].rdev;
+                        }
+                        mbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
+                        md_trim_bio(mbio, r10_bio->sector - bio->bi_sector,
+                                    max_sectors);
+                        r10_bio->devs[i].repl_bio = mbio;
+                        mbio->bi_sector = (r10_bio->devs[i].addr +
+                                           choose_data_offset(
+                                                   r10_bio, rdev));
+                        mbio->bi_bdev = rdev->bdev;
+                        mbio->bi_end_io = raid10_end_write_request;
+                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_private = r10_bio;
-                cb = blk_check_plugged(raid10_unplug, mddev, sizeof(*plug));
+                        atomic_inc(&r10_bio->remaining);
-                if (cb)
+                        spin_lock_irqsave(&conf->device_lock, flags);
-                        plug = container_of(cb, struct raid10_plug_cb, cb);
-                else
-                        plug = NULL;
-                spin_lock_irqsave(&conf->device_lock, flags);
-                if (plug) {
-                        bio_list_add(&plug->pending, mbio);
-                        plug->pending_cnt++;
-                } else {
                        bio_list_add(&conf->pending_bio_list, mbio);
                        conf->pending_count++;
+                        spin_unlock_irqrestore(&conf->device_lock, flags);
+                        if (!mddev_check_plugged(mddev))
+                                md_wakeup_thread(mddev->thread);
                }
-                spin_unlock_irqrestore(&conf->device_lock, flags);
-                if (!plug)
-                        md_wakeup_thread(mddev->thread);
-                if (!r10_bio->devs[i].repl_bio)
-                        continue;
-                mbio = bio_clone_mddev(bio, GFP_NOIO, mddev);
-                md_trim_bio(mbio, r10_bio->sector - bio->bi_sector,
-                            max_sectors);
-                r10_bio->devs[i].repl_bio = mbio;
-                /* We are actively writing to the original device
-                 * so it cannot disappear, so the replacement cannot
-                 * become NULL here
-                 */
-                mbio->bi_sector = (r10_bio->devs[i].addr +
-                                   choose_data_offset(
-                                           r10_bio,
-                                           conf->mirrors[d].replacement));
-                mbio->bi_bdev = conf->mirrors[d].replacement->bdev;
-                mbio->bi_end_io = raid10_end_write_request;
-                mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
-                mbio->bi_private = r10_bio;
-                atomic_inc(&r10_bio->remaining);
-                spin_lock_irqsave(&conf->device_lock, flags);
-                bio_list_add(&conf->pending_bio_list, mbio);
-                conf->pending_count++;
-                spin_unlock_irqrestore(&conf->device_lock, flags);
-                if (!mddev_check_plugged(mddev))
-                        md_wakeup_thread(mddev->thread);
        }
        /* Don't remove the bias on 'remaining' (one_write_done) until
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index c5439dce0295..a4502686e7a8 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -2774,10 +2774,12 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                        dev = &sh->dev[i];
                        if (!test_bit(R5_LOCKED, &dev->flags) &&
                            (test_bit(R5_UPTODATE, &dev->flags) ||
-                             test_and_clear_bit(R5_Discard, &dev->flags))) {
+                             test_bit(R5_Discard, &dev->flags))) {
                                /* We can return any write requests */
                                struct bio *wbi, *wbi2;
                                pr_debug("Return write for disc %d\n", i);
+                                if (test_and_clear_bit(R5_Discard, &dev->flags))
+                                        clear_bit(R5_UPTODATE, &dev->flags);
                                wbi = dev->written;
                                dev->written = NULL;
                                while (wbi && wbi->bi_sector <
@@ -2795,7 +2797,8 @@ static void handle_stripe_clean_event(struct r5conf *conf,
                                         !test_bit(STRIPE_DEGRADED, &sh->state),
                                                0);
                        }
-                }
+                } else if (test_bit(R5_Discard, &sh->dev[i].flags))
+                        clear_bit(R5_Discard, &sh->dev[i].flags);
        if (test_and_clear_bit(STRIPE_FULL_WRITE, &sh->state))
                if (atomic_dec_and_test(&conf->pending_full_writes))
@@ -3490,40 +3493,6 @@ static void handle_stripe(struct stripe_head *sh)
                        handle_failed_sync(conf, sh, &s);
        }
-        /*
-         * might be able to return some write requests if the parity blocks
-         * are safe, or on a failed drive
-         */
-        pdev = &sh->dev[sh->pd_idx];
-        s.p_failed = (s.failed >= 1 && s.failed_num[0] == sh->pd_idx)
-                || (s.failed >= 2 && s.failed_num[1] == sh->pd_idx);
-        qdev = &sh->dev[sh->qd_idx];
-        s.q_failed = (s.failed >= 1 && s.failed_num[0] == sh->qd_idx)
-                || (s.failed >= 2 && s.failed_num[1] == sh->qd_idx)
-                || conf->level < 6;
-        if (s.written &&
-            (s.p_failed || ((test_bit(R5_Insync, &pdev->flags)
-                             && !test_bit(R5_LOCKED, &pdev->flags)
-                             && (test_bit(R5_UPTODATE, &pdev->flags) ||
-                                 test_bit(R5_Discard, &pdev->flags))))) &&
-            (s.q_failed || ((test_bit(R5_Insync, &qdev->flags)
-                             && !test_bit(R5_LOCKED, &qdev->flags)
-                             && (test_bit(R5_UPTODATE, &qdev->flags) ||
-                                 test_bit(R5_Discard, &qdev->flags))))))
-                handle_stripe_clean_event(conf, sh, disks, &s.return_bi);
-        /* Now we might consider reading some blocks, either to check/generate
-         * parity, or to satisfy requests
-         * or to load a block that is being partially written.
-         */
-        if (s.to_read || s.non_overwrite
-            || (conf->level == 6 && s.to_write && s.failed)
-            || (s.syncing && (s.uptodate + s.compute < disks))
-            || s.replacing
-            || s.expanding)
-                handle_stripe_fill(sh, &s, disks);
        /* Now we check to see if any write operations have recently
         * completed
         */
@@ -3561,6 +3530,40 @@ static void handle_stripe(struct stripe_head *sh)
                        s.dec_preread_active = 1;
        }
+        /*
+         * might be able to return some write requests if the parity blocks
+         * are safe, or on a failed drive
+         */
+        pdev = &sh->dev[sh->pd_idx];
+        s.p_failed = (s.failed >= 1 && s.failed_num[0] == sh->pd_idx)
+                || (s.failed >= 2 && s.failed_num[1] == sh->pd_idx);
+        qdev = &sh->dev[sh->qd_idx];
+        s.q_failed = (s.failed >= 1 && s.failed_num[0] == sh->qd_idx)
+                || (s.failed >= 2 && s.failed_num[1] == sh->qd_idx)
+                || conf->level < 6;
+        if (s.written &&
+            (s.p_failed || ((test_bit(R5_Insync, &pdev->flags)
+                             && !test_bit(R5_LOCKED, &pdev->flags)
+                             && (test_bit(R5_UPTODATE, &pdev->flags) ||
+                                 test_bit(R5_Discard, &pdev->flags))))) &&
+            (s.q_failed || ((test_bit(R5_Insync, &qdev->flags)
+                             && !test_bit(R5_LOCKED, &qdev->flags)
+                             && (test_bit(R5_UPTODATE, &qdev->flags) ||
+                                 test_bit(R5_Discard, &qdev->flags))))))
+                handle_stripe_clean_event(conf, sh, disks, &s.return_bi);
+        /* Now we might consider reading some blocks, either to check/generate
+         * parity, or to satisfy requests
+         * or to load a block that is being partially written.
+         */
+        if (s.to_read || s.non_overwrite
+            || (conf->level == 6 && s.to_write && s.failed)
+            || (s.syncing && (s.uptodate + s.compute < disks))
+            || s.replacing
+            || s.expanding)
+                handle_stripe_fill(sh, &s, disks);
        /* Now to consider new write requests and what else, if anything
         * should be read.  We do not handle new writes when:
         * 1/ A 'write' operation (copy+xor) is already in flight.
@@ -5529,6 +5532,10 @@ static int run(struct mddev *mddev)
                 * discard data disk but write parity disk
                 */
                stripe = stripe * PAGE_SIZE;
+                /* Round up to power of 2, as discard handling
+                 * currently assumes that */
+                while ((stripe-1) & stripe)
+                        stripe = (stripe | (stripe-1)) + 1;
                mddev->queue->limits.discard_alignment = stripe;
                mddev->queue->limits.discard_granularity = stripe;
                /*
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 8f52fc858e48..5a5cd2ace4a6 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -240,7 +240,7 @@ static int parse_cmdline(char *devname, char *szstart, char *szlength)
        if (*(szlength) != '+') {
                devlength = simple_strtoul(szlength, &buffer, 0);
-                devlength = handle_unit(devlength, buffer) - devstart;
+                devlength = handle_unit(devlength, buffer);
                if (devlength < devstart)
                        goto err_out;
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index ec6841d8e956..1a03b7f673ce 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2983,13 +2983,15 @@ static void nand_decode_ext_id(struct mtd_info *mtd, struct nand_chip *chip,
        /*
         * Field definitions are in the following datasheets:
         * Old style (4,5 byte ID): Samsung K9GAG08U0M (p.32)
-         * New style   (6 byte ID): Samsung K9GAG08U0F (p.44)
+         * New Samsung (6 byte ID): Samsung K9GAG08U0F (p.44)
         * Hynix MLC   (6 byte ID): Hynix H27UBG8T2B (p.22)
         *
-         * Check for ID length, cell type, and Hynix/Samsung ID to decide what
+         * Check for ID length, non-zero 6th byte, cell type, and Hynix/Samsung
-         * to do.
+         * ID to decide what to do.
         */
-        if (id_len == 6 && id_data[0] == NAND_MFR_SAMSUNG) {
+        if (id_len == 6 && id_data[0] == NAND_MFR_SAMSUNG &&
+                        (chip->cellinfo & NAND_CI_CELLTYPE_MSK) &&
+                        id_data[5] != 0x00) {
                /* Calc pagesize */
                mtd->writesize = 2048 << (extid & 0x03);
                extid >>= 2;
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 64be8f0848b0..d9127e2ed808 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -121,7 +121,7 @@ static int parse_ofoldpart_partitions(struct mtd_info *master,
        nr_parts = plen / sizeof(part[0]);
        *pparts = kzalloc(nr_parts * sizeof(*(*pparts)), GFP_KERNEL);
-        if (!pparts)
+        if (!*pparts)
                return -ENOMEM;
        names = of_get_property(dp, "partition-names", &plen);
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 7153e0d27101..b3f41f200622 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -3694,7 +3694,7 @@ static int flexonenand_check_blocks_erased(struct mtd_info *mtd, int start, int
 * flexonenand_set_boundary     - Writes the SLC boundary
 * @param mtd                   - mtd info structure
 */
-int flexonenand_set_boundary(struct mtd_info *mtd, int die,
+static int flexonenand_set_boundary(struct mtd_info *mtd, int die,
                                    int boundary, int lock)
 {
        struct onenand_chip *this = mtd->priv;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b2530b002125..5f5b69f37d2e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1379,6 +1379,8 @@ static void bond_compute_features(struct bonding *bond)
        struct net_device *bond_dev = bond->dev;
        netdev_features_t vlan_features = BOND_VLAN_FEATURES;
        unsigned short max_hard_header_len = ETH_HLEN;
+        unsigned int gso_max_size = GSO_MAX_SIZE;
+        u16 gso_max_segs = GSO_MAX_SEGS;
        int i;
        unsigned int flags, dst_release_flag = IFF_XMIT_DST_RELEASE;
@@ -1394,11 +1396,16 @@ static void bond_compute_features(struct bonding *bond)
                dst_release_flag &= slave->dev->priv_flags;
                if (slave->dev->hard_header_len > max_hard_header_len)
                        max_hard_header_len = slave->dev->hard_header_len;
+                gso_max_size = min(gso_max_size, slave->dev->gso_max_size);
+                gso_max_segs = min(gso_max_segs, slave->dev->gso_max_segs);
        }
 done:
        bond_dev->vlan_features = vlan_features;
        bond_dev->hard_header_len = max_hard_header_len;
+        bond_dev->gso_max_segs = gso_max_segs;
+        netif_set_gso_max_size(bond_dev, gso_max_size);
        flags = bond_dev->priv_flags & ~IFF_XMIT_DST_RELEASE;
        bond_dev->priv_flags = flags | dst_release_flag;
diff --git a/drivers/net/ethernet/8390/ne.c b/drivers/net/ethernet/8390/ne.c
index d04911d33b64..47618e505355 100644
--- a/drivers/net/ethernet/8390/ne.c
+++ b/drivers/net/ethernet/8390/ne.c
@@ -813,6 +813,7 @@ static int __init ne_drv_probe(struct platform_device *pdev)
                dev->irq = irq[this_dev];
                dev->mem_end = bad[this_dev];
        }
+        SET_NETDEV_DEV(dev, &pdev->dev);
        err = do_ne_probe(dev);
        if (err) {
                free_netdev(dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index bd1fd3d87c24..01611b33a93d 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -9545,10 +9545,13 @@ static int __devinit bnx2x_prev_unload_common(struct bnx2x *bp)
 */
 static void __devinit bnx2x_prev_interrupted_dmae(struct bnx2x *bp)
 {
-        u32 val = REG_RD(bp, PGLUE_B_REG_PGLUE_B_INT_STS);
+        if (!CHIP_IS_E1x(bp)) {
-        if (val & PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN) {
+                u32 val = REG_RD(bp, PGLUE_B_REG_PGLUE_B_INT_STS);
-                BNX2X_ERR("was error bit was found to be set in pglueb upon startup. Clearing");
+                if (val & PGLUE_B_PGLUE_B_INT_STS_REG_WAS_ERROR_ATTN) {
-                REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR, 1 << BP_FUNC(bp));
+                        BNX2X_ERR("was error bit was found to be set in pglueb upon startup. Clearing");
+                        REG_WR(bp, PGLUE_B_REG_WAS_ERROR_PF_7_0_CLR,
+                               1 << BP_FUNC(bp));
+                }
        }
 }
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 92317e9c0f73..60ac46f4ac08 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -1860,10 +1860,14 @@ jme_open(struct net_device *netdev)
        jme_clear_pm(jme);
        JME_NAPI_ENABLE(jme);
-        tasklet_enable(&jme->linkch_task);
+        tasklet_init(&jme->linkch_task, jme_link_change_tasklet,
-        tasklet_enable(&jme->txclean_task);
+                     (unsigned long) jme);
-        tasklet_hi_enable(&jme->rxclean_task);
+        tasklet_init(&jme->txclean_task, jme_tx_clean_tasklet,
-        tasklet_hi_enable(&jme->rxempty_task);
+                     (unsigned long) jme);
+        tasklet_init(&jme->rxclean_task, jme_rx_clean_tasklet,
+                     (unsigned long) jme);
+        tasklet_init(&jme->rxempty_task, jme_rx_empty_tasklet,
+                     (unsigned long) jme);
        rc = jme_request_irq(jme);
        if (rc)
@@ -3079,22 +3083,6 @@ jme_init_one(struct pci_dev *pdev,
        tasklet_init(&jme->pcc_task,
                     jme_pcc_tasklet,
                     (unsigned long) jme);
-        tasklet_init(&jme->linkch_task,
-                     jme_link_change_tasklet,
-                     (unsigned long) jme);
-        tasklet_init(&jme->txclean_task,
-                     jme_tx_clean_tasklet,
-                     (unsigned long) jme);
-        tasklet_init(&jme->rxclean_task,
-                     jme_rx_clean_tasklet,
-                     (unsigned long) jme);
-        tasklet_init(&jme->rxempty_task,
-                     jme_rx_empty_tasklet,
-                     (unsigned long) jme);
-        tasklet_disable_nosync(&jme->linkch_task);
-        tasklet_disable_nosync(&jme->txclean_task);
-        tasklet_disable_nosync(&jme->rxclean_task);
-        tasklet_disable_nosync(&jme->rxempty_task);
        jme->dpi.cur = PCC_P1;
        jme->reg_ghc = 0;
diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
index e558edd1cb6c..69e01977a1dd 100644
--- a/drivers/net/ethernet/micrel/ksz884x.c
+++ b/drivers/net/ethernet/micrel/ksz884x.c
@@ -5459,8 +5459,10 @@ static int prepare_hardware(struct net_device *dev)
        rc = request_irq(dev->irq, netdev_intr, IRQF_SHARED, dev->name, dev);
        if (rc)
                return rc;
-        tasklet_enable(&hw_priv->rx_tasklet);
+        tasklet_init(&hw_priv->rx_tasklet, rx_proc_task,
-        tasklet_enable(&hw_priv->tx_tasklet);
+                     (unsigned long) hw_priv);
+        tasklet_init(&hw_priv->tx_tasklet, tx_proc_task,
+                     (unsigned long) hw_priv);
        hw->promiscuous = 0;
        hw->all_multi = 0;
@@ -7033,16 +7035,6 @@ static int __devinit pcidev_init(struct pci_dev *pdev,
        spin_lock_init(&hw_priv->hwlock);
        mutex_init(&hw_priv->lock);
-        /* tasklet is enabled. */
-        tasklet_init(&hw_priv->rx_tasklet, rx_proc_task,
-                (unsigned long) hw_priv);
-        tasklet_init(&hw_priv->tx_tasklet, tx_proc_task,
-                (unsigned long) hw_priv);
-        /* tasklet_enable will decrement the atomic counter. */
-        tasklet_disable(&hw_priv->rx_tasklet);
-        tasklet_disable(&hw_priv->tx_tasklet);
        for (i = 0; i < TOTAL_PORT_NUM; i++)
                init_waitqueue_head(&hw_priv->counter[i].counter);
diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
index 1c818254b7be..b01f83a044c4 100644
--- a/drivers/net/ethernet/realtek/8139cp.c
+++ b/drivers/net/ethernet/realtek/8139cp.c
@@ -979,17 +979,6 @@ static void cp_init_hw (struct cp_private *cp)
        cpw32_f (MAC0 + 0, le32_to_cpu (*(__le32 *) (dev->dev_addr + 0)));
        cpw32_f (MAC0 + 4, le32_to_cpu (*(__le32 *) (dev->dev_addr + 4)));
-        cpw32_f(HiTxRingAddr, 0);
-        cpw32_f(HiTxRingAddr + 4, 0);
-        ring_dma = cp->ring_dma;
-        cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
-        cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
-        ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
-        cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
-        cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
        cp_start_hw(cp);
        cpw8(TxThresh, 0x06); /* XXX convert magic num to a constant */
@@ -1003,6 +992,17 @@ static void cp_init_hw (struct cp_private *cp)
        cpw8(Config5, cpr8(Config5) & PMEStatus);
+        cpw32_f(HiTxRingAddr, 0);
+        cpw32_f(HiTxRingAddr + 4, 0);
+        ring_dma = cp->ring_dma;
+        cpw32_f(RxRingAddr, ring_dma & 0xffffffff);
+        cpw32_f(RxRingAddr + 4, (ring_dma >> 16) >> 16);
+        ring_dma += sizeof(struct cp_desc) * CP_RX_RING_SIZE;
+        cpw32_f(TxRingAddr, ring_dma & 0xffffffff);
+        cpw32_f(TxRingAddr + 4, (ring_dma >> 16) >> 16);
        cpw16(MultiIntr, 0);
        cpw8_f(Cfg9346, Cfg9346_Lock);
diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
index fb9f6b38511f..edf5edb13140 100644
--- a/drivers/net/ethernet/sis/sis900.c
+++ b/drivers/net/ethernet/sis/sis900.c
@@ -2479,7 +2479,7 @@ static int sis900_resume(struct pci_dev *pci_dev)
        netif_start_queue(net_dev);
        /* Workaround for EDB */
-        sis900_set_mode(ioaddr, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
+        sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
        /* Enable all known interrupts by setting the interrupt mask. */
        sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index 62d1baf111ea..c53c0f4e2ce3 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2110,7 +2110,7 @@ static void __devinit smsc911x_read_mac_address(struct net_device *dev)
 static int __devinit smsc911x_init(struct net_device *dev)
 {
        struct smsc911x_data *pdata = netdev_priv(dev);
-        unsigned int byte_test;
+        unsigned int byte_test, mask;
        unsigned int to = 100;
        SMSC_TRACE(pdata, probe, "Driver Parameters:");
@@ -2130,9 +2130,22 @@ static int __devinit smsc911x_init(struct net_device *dev)
        /*
         * poll the READY bit in PMT_CTRL. Any other access to the device is
         * forbidden while this bit isn't set. Try for 100ms
+         *
+         * Note that this test is done before the WORD_SWAP register is
+         * programmed. So in some configurations the READY bit is at 16 before
+         * WORD_SWAP is written to. This issue is worked around by waiting
+         * until either bit 0 or bit 16 gets set in PMT_CTRL.
+         *
+         * SMSC has confirmed that checking bit 16 (marked as reserved in
+         * the datasheet) is fine since these bits "will either never be set
+         * or can only go high after READY does (so also indicate the device
+         * is ready)".
         */
-        while (!(smsc911x_reg_read(pdata, PMT_CTRL) & PMT_CTRL_READY_) && --to)
+        mask = PMT_CTRL_READY_ | swahw32(PMT_CTRL_READY_);
+        while (!(smsc911x_reg_read(pdata, PMT_CTRL) & mask) && --to)
                udelay(1000);
        if (to == 0) {
                pr_err("Device not READY in 100ms aborting\n");
                return -ENODEV;
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 4e9810013850..66e025ad5df1 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -917,7 +917,7 @@ static int tile_net_setup_interrupts(struct net_device *dev)
        ingress_irq = rc;
        tile_irq_activate(ingress_irq, TILE_IRQ_PERCPU);
        rc = request_irq(ingress_irq, tile_net_handle_ingress_irq,
-                         0, NULL, NULL);
+                         0, "tile_net", NULL);
        if (rc != 0) {
                netdev_err(dev, "request_irq failed: %d\n", rc);
                destroy_irq(ingress_irq);
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index 1d04754a6637..a788501e978e 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -894,6 +894,8 @@ out:
        return IRQ_HANDLED;
 }
+static void axienet_dma_err_handler(unsigned long data);
 /**
 * axienet_open - Driver open routine.
 * @ndev:       Pointer to net_device structure
@@ -942,6 +944,10 @@ static int axienet_open(struct net_device *ndev)
                phy_start(lp->phy_dev);
        }
+        /* Enable tasklets for Axi DMA error handling */
+        tasklet_init(&lp->dma_err_tasklet, axienet_dma_err_handler,
+                     (unsigned long) lp);
        /* Enable interrupts for Axi DMA Tx */
        ret = request_irq(lp->tx_irq, axienet_tx_irq, 0, ndev->name, ndev);
        if (ret)
@@ -950,8 +956,7 @@ static int axienet_open(struct net_device *ndev)
        ret = request_irq(lp->rx_irq, axienet_rx_irq, 0, ndev->name, ndev);
        if (ret)
                goto err_rx_irq;
-        /* Enable tasklets for Axi DMA error handling */
-        tasklet_enable(&lp->dma_err_tasklet);
        return 0;
 err_rx_irq:
@@ -960,6 +965,7 @@ err_tx_irq:
        if (lp->phy_dev)
                phy_disconnect(lp->phy_dev);
        lp->phy_dev = NULL;
+        tasklet_kill(&lp->dma_err_tasklet);
        dev_err(lp->dev, "request_irq() failed\n");
        return ret;
 }
@@ -1613,10 +1619,6 @@ static int __devinit axienet_of_probe(struct platform_device *op)
                goto err_iounmap_2;
        }
-        tasklet_init(&lp->dma_err_tasklet, axienet_dma_err_handler,
-                     (unsigned long) lp);
-        tasklet_disable(&lp->dma_err_tasklet);
        return 0;
 err_iounmap_2:
diff --git a/drivers/net/ethernet/xscale/ixp4xx_eth.c b/drivers/net/ethernet/xscale/ixp4xx_eth.c
index 98934bdf6acf..477d6729b17f 100644
--- a/drivers/net/ethernet/xscale/ixp4xx_eth.c
+++ b/drivers/net/ethernet/xscale/ixp4xx_eth.c
@@ -1102,10 +1102,12 @@ static int init_queues(struct port *port)
 {
        int i;
-        if (!ports_open)
+        if (!ports_open) {
-                if (!(dma_pool = dma_pool_create(DRV_NAME, NULL,
+                dma_pool = dma_pool_create(DRV_NAME, &port->netdev->dev,
-                                                 POOL_ALLOC_SIZE, 32, 0)))
+                                           POOL_ALLOC_SIZE, 32, 0);
+                if (!dma_pool)
                        return -ENOMEM;
+        }
        if (!(port->desc_tab = dma_pool_alloc(dma_pool, GFP_KERNEL,
                                              &port->desc_tab_phys)))
diff --git a/drivers/net/irda/sir_dev.c b/drivers/net/irda/sir_dev.c
index 5039f08f5a5b..43e9ab4f4d7e 100644
--- a/drivers/net/irda/sir_dev.c
+++ b/drivers/net/irda/sir_dev.c
@@ -222,7 +222,7 @@ static void sirdev_config_fsm(struct work_struct *work)
                        break;
                case SIRDEV_STATE_DONGLE_SPEED:
-                        if (dev->dongle_drv->reset) {
+                        if (dev->dongle_drv->set_speed) {
                                ret = dev->dongle_drv->set_speed(dev, fsm->param);
                                if (ret < 0) {
                                        fsm->result = ret;
diff --git a/drivers/net/phy/mdio-bitbang.c b/drivers/net/phy/mdio-bitbang.c
index 6428fcbbdd4b..daec9b05d168 100644
--- a/drivers/net/phy/mdio-bitbang.c
+++ b/drivers/net/phy/mdio-bitbang.c
@@ -234,7 +234,6 @@ void free_mdio_bitbang(struct mii_bus *bus)
        struct mdiobb_ctrl *ctrl = bus->priv;
        module_put(ctrl->ops->owner);
-        mdiobus_unregister(bus);
        mdiobus_free(bus);
 }
 EXPORT_SYMBOL(free_mdio_bitbang);
diff --git a/drivers/net/phy/mdio-gpio.c b/drivers/net/phy/mdio-gpio.c
index 899274f2f9b1..2ed1140df3e9 100644
--- a/drivers/net/phy/mdio-gpio.c
+++ b/drivers/net/phy/mdio-gpio.c
@@ -185,17 +185,20 @@ static int __devinit mdio_gpio_probe(struct platform_device *pdev)
 {
        struct mdio_gpio_platform_data *pdata;
        struct mii_bus *new_bus;
-        int ret;
+        int ret, bus_id;
-        if (pdev->dev.of_node)
+        if (pdev->dev.of_node) {
                pdata = mdio_gpio_of_get_data(pdev);
-        else
+                bus_id = of_alias_get_id(pdev->dev.of_node, "mdio-gpio");
+        } else {
                pdata = pdev->dev.platform_data;
+                bus_id = pdev->id;
+        }
        if (!pdata)
                return -ENODEV;
-        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, pdev->id);
+        new_bus = mdio_gpio_bus_init(&pdev->dev, pdata, bus_id);
        if (!new_bus)
                return -ENODEV;
diff --git a/drivers/net/team/team_mode_broadcast.c b/drivers/net/team/team_mode_broadcast.c
index 9db0171e9366..c5db428e73fa 100644
--- a/drivers/net/team/team_mode_broadcast.c
+++ b/drivers/net/team/team_mode_broadcast.c
@@ -29,8 +29,8 @@ static bool bc_transmit(struct team *team, struct sk_buff *skb)
                        if (last) {
                                skb2 = skb_clone(skb, GFP_ATOMIC);
                                if (skb2) {
-                                        ret = team_dev_queue_xmit(team, last,
+                                        ret = !team_dev_queue_xmit(team, last,
-                                                                  skb2);
+                                                                   skb2);
                                        if (!sum_ret)
                                                sum_ret = ret;
                                }
@@ -39,7 +39,7 @@ static bool bc_transmit(struct team *team, struct sk_buff *skb)
                }
        }
        if (last) {
-                ret = team_dev_queue_xmit(team, last, skb);
+                ret = !team_dev_queue_xmit(team, last, skb);
                if (!sum_ret)
                        sum_ret = ret;
        }
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 4cd582a4f625..74fab1a40156 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -540,10 +540,12 @@ advance:
            (ctx->ether_desc == NULL) || (ctx->control != intf))
                goto error;
-        /* claim interfaces, if any */
+        /* claim data interface, if different from control */
-        temp = usb_driver_claim_interface(driver, ctx->data, dev);
+        if (ctx->data != ctx->control) {
-        if (temp)
+                temp = usb_driver_claim_interface(driver, ctx->data, dev);
-                goto error;
+                if (temp)
+                        goto error;
+        }
        iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
@@ -623,6 +625,10 @@ static void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
        tasklet_kill(&ctx->bh);
+        /* handle devices with combined control and data interface */
+        if (ctx->control == ctx->data)
+                ctx->data = NULL;
        /* disconnect master --> disconnect slave */
        if (intf == ctx->control && ctx->data) {
                usb_set_intfdata(ctx->data, NULL);
@@ -1245,6 +1251,14 @@ static const struct usb_device_id cdc_devs[] = {
          .driver_info = (unsigned long) &wwan_info,
        },
+        /* Huawei NCM devices disguised as vendor specific */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x16),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
+          .driver_info = (unsigned long)&wwan_info,
+        },
        /* Generic CDC-NCM devices */
        { USB_INTERFACE_INFO(USB_CLASS_COMM,
                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 3286166415b4..362cb8cfeb92 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -184,7 +184,7 @@ static int smsc95xx_mdio_read(struct net_device *netdev, int phy_id, int idx)
        /* set the address, index & direction (read from PHY) */
        phy_id &= dev->mii.phy_id_mask;
        idx &= dev->mii.reg_num_mask;
-        addr = (phy_id << 11) | (idx << 6) | MII_READ_;
+        addr = (phy_id << 11) | (idx << 6) | MII_READ_ | MII_BUSY_;
        ret = smsc95xx_write_reg(dev, MII_ADDR, addr);
        check_warn_goto_done(ret, "Error writing MII_ADDR");
@@ -221,7 +221,7 @@ static void smsc95xx_mdio_write(struct net_device *netdev, int phy_id, int idx,
        /* set the address, index & direction (write to PHY) */
        phy_id &= dev->mii.phy_id_mask;
        idx &= dev->mii.reg_num_mask;
-        addr = (phy_id << 11) | (idx << 6) | MII_WRITE_;
+        addr = (phy_id << 11) | (idx << 6) | MII_WRITE_ | MII_BUSY_;
        ret = smsc95xx_write_reg(dev, MII_ADDR, addr);
        check_warn_goto_done(ret, "Error writing MII_ADDR");
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 7b4adde93c01..8b5c61917076 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1,5 +1,5 @@
 /*
- * VXLAN: Virtual eXtensiable Local Area Network
+ * VXLAN: Virtual eXtensible Local Area Network
 *
 * Copyright (c) 2012 Vyatta Inc.
 *
@@ -50,8 +50,8 @@
 #define VXLAN_N_VID     (1u << 24)
 #define VXLAN_VID_MASK  (VXLAN_N_VID - 1)
-/* VLAN + IP header + UDP + VXLAN */
+/* IP header + UDP + VXLAN + Ethernet header */
-#define VXLAN_HEADROOM (4 + 20 + 8 + 8)
+#define VXLAN_HEADROOM (20 + 8 + 8 + 14)
 #define VXLAN_FLAGS 0x08000000  /* struct vxlanhdr.vx_flags required value. */
@@ -1102,6 +1102,10 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
                if (!tb[IFLA_MTU])
                        dev->mtu = lowerdev->mtu - VXLAN_HEADROOM;
+                /* update header length based on lower device */
+                dev->hard_header_len = lowerdev->hard_header_len +
+                                       VXLAN_HEADROOM;
        }
        if (data[IFLA_VXLAN_TOS])
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3f575afd8cfc..e9a3da588e95 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -969,10 +969,12 @@ static int init_hdlc_queues(struct port *port)
 {
        int i;
-        if (!ports_open)
+        if (!ports_open) {
-                if (!(dma_pool = dma_pool_create(DRV_NAME, NULL,
+                dma_pool = dma_pool_create(DRV_NAME, &port->netdev->dev,
-                                                 POOL_ALLOC_SIZE, 32, 0)))
+                                           POOL_ALLOC_SIZE, 32, 0);
+                if (!dma_pool)
                        return -ENOMEM;
+        }
        if (!(port->desc_tab = dma_pool_alloc(dma_pool, GFP_KERNEL,
                                              &port->desc_tab_phys)))
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8e1559aba495..1829b445d0b0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1456,7 +1456,7 @@ static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type)
        switch (type) {
        case ATH9K_RESET_POWER_ON:
                ret = ath9k_hw_set_reset_power_on(ah);
-                if (!ret)
+                if (ret)
                        ah->reset_power_on = true;
                break;
        case ATH9K_RESET_WARM:
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index a6f1e8166008..481345c23ded 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -4401,7 +4401,7 @@ static s32 brcmf_mode_to_nl80211_iftype(s32 mode)
 static void brcmf_wiphy_pno_params(struct wiphy *wiphy)
 {
-#ifndef CONFIG_BRCMFISCAN
+#ifndef CONFIG_BRCMISCAN
        /* scheduled scan settings */
        wiphy->max_sched_scan_ssids = BRCMF_PNO_MAX_PFN_COUNT;
        wiphy->max_match_sets = BRCMF_PNO_MAX_PFN_COUNT;
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index ff8162d4c454..2d9eee93c743 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -521,7 +521,7 @@ static void iwlagn_mac_tx(struct ieee80211_hw *hw,
                     ieee80211_get_tx_rate(hw, IEEE80211_SKB_CB(skb))->bitrate);
        if (iwlagn_tx_skb(priv, control->sta, skb))
-                dev_kfree_skb_any(skb);
+                ieee80211_free_txskb(hw, skb);
 }
 static void iwlagn_mac_update_tkip_key(struct ieee80211_hw *hw,
@@ -1354,6 +1354,20 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
        vif_priv->ctx = ctx;
        ctx->vif = vif;
+        /*
+         * In SNIFFER device type, the firmware reports the FCS to
+         * the host, rather than snipping it off. Unfortunately,
+         * mac80211 doesn't (yet) provide a per-packet flag for
+         * this, so that we have to set the hardware flag based
+         * on the interfaces added. As the monitor interface can
+         * only be present by itself, and will be removed before
+         * other interfaces are added, this is safe.
+         */
+        if (vif->type == NL80211_IFTYPE_MONITOR)
+                priv->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS;
+        else
+                priv->hw->flags &= ~IEEE80211_HW_RX_INCLUDES_FCS;
        err = iwl_setup_interface(priv, ctx);
        if (!err || reset)
                goto out;
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 7ff3f1430678..408132cf83c1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -2114,7 +2114,7 @@ static void iwl_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
        info = IEEE80211_SKB_CB(skb);
        iwl_trans_free_tx_cmd(priv->trans, info->driver_data[1]);
-        dev_kfree_skb_any(skb);
+        ieee80211_free_txskb(priv->hw, skb);
 }
 static void iwl_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 17c8e5d82681..bb69f8f90b3b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -321,6 +321,14 @@ static void iwl_rx_allocate(struct iwl_trans *trans, gfp_t priority)
                        dma_map_page(trans->dev, page, 0,
                                     PAGE_SIZE << trans_pcie->rx_page_order,
                                     DMA_FROM_DEVICE);
+                if (dma_mapping_error(trans->dev, rxb->page_dma)) {
+                        rxb->page = NULL;
+                        spin_lock_irqsave(&rxq->lock, flags);
+                        list_add(&rxb->list, &rxq->rx_used);
+                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        __free_pages(page, trans_pcie->rx_page_order);
+                        return;
+                }
                /* dma address must be no more than 36 bits */
                BUG_ON(rxb->page_dma & ~DMA_BIT_MASK(36));
                /* and also 256 byte aligned! */
@@ -488,8 +496,19 @@ static void iwl_rx_handle_rxbuf(struct iwl_trans *trans,
                        dma_map_page(trans->dev, rxb->page, 0,
                                     PAGE_SIZE << trans_pcie->rx_page_order,
                                     DMA_FROM_DEVICE);
-                list_add_tail(&rxb->list, &rxq->rx_free);
+                if (dma_mapping_error(trans->dev, rxb->page_dma)) {
-                rxq->free_count++;
+                        /*
+                         * free the page(s) as well to not break
+                         * the invariant that the items on the used
+                         * list have no page(s)
+                         */
+                        __free_pages(rxb->page, trans_pcie->rx_page_order);
+                        rxb->page = NULL;
+                        list_add_tail(&rxb->list, &rxq->rx_used);
+                } else {
+                        list_add_tail(&rxb->list, &rxq->rx_free);
+                        rxq->free_count++;
+                }
        } else
                list_add_tail(&rxb->list, &rxq->rx_used);
        spin_unlock_irqrestore(&rxq->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 105e3af3c621..79a4ddc002d3 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -480,20 +480,12 @@ void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
 void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        u16 rd_ptr, wr_ptr;
-        int n_bd = trans_pcie->txq[txq_id].q.n_bd;
        if (!test_and_clear_bit(txq_id, trans_pcie->queue_used)) {
                WARN_ONCE(1, "queue %d not used", txq_id);
                return;
        }
-        rd_ptr = iwl_read_prph(trans, SCD_QUEUE_RDPTR(txq_id)) & (n_bd - 1);
-        wr_ptr = iwl_read_prph(trans, SCD_QUEUE_WRPTR(txq_id));
-        WARN_ONCE(rd_ptr != wr_ptr, "queue %d isn't empty: [%d,%d]",
-                  txq_id, rd_ptr, wr_ptr);
        iwl_txq_set_inactive(trans, txq_id);
        IWL_DEBUG_TX_QUEUES(trans, "Deactivate queue %d\n", txq_id);
 }
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 8d465107f52b..ae9010ed58de 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -890,9 +890,6 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
                return;
        }
        cmd_node = adapter->curr_cmd;
-        if (cmd_node->wait_q_enabled)
-                adapter->cmd_wait_q.status = -ETIMEDOUT;
        if (cmd_node) {
                adapter->dbg.timeout_cmd_id =
                        adapter->dbg.last_cmd_id[adapter->dbg.last_cmd_index];
@@ -938,6 +935,14 @@ mwifiex_cmd_timeout_func(unsigned long function_context)
                dev_err(adapter->dev, "ps_mode=%d ps_state=%d\n",
                        adapter->ps_mode, adapter->ps_state);
+                if (cmd_node->wait_q_enabled) {
+                        adapter->cmd_wait_q.status = -ETIMEDOUT;
+                        wake_up_interruptible(&adapter->cmd_wait_q.wait);
+                        mwifiex_cancel_pending_ioctl(adapter);
+                        /* reset cmd_sent flag to unblock new commands */
+                        adapter->cmd_sent = false;
+                }
        }
        if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
                mwifiex_init_fw_complete(adapter);
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index fc8a9bfa1248..82cf0fa2d9f6 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -161,7 +161,6 @@ static int mwifiex_sdio_suspend(struct device *dev)
        struct sdio_mmc_card *card;
        struct mwifiex_adapter *adapter;
        mmc_pm_flag_t pm_flag = 0;
-        int hs_actived = 0;
        int i;
        int ret = 0;
@@ -188,12 +187,14 @@ static int mwifiex_sdio_suspend(struct device *dev)
        adapter = card->adapter;
        /* Enable the Host Sleep */
-        hs_actived = mwifiex_enable_hs(adapter);
+        if (!mwifiex_enable_hs(adapter)) {
-        if (hs_actived) {
+                dev_err(adapter->dev, "cmd: failed to suspend\n");
-                pr_debug("cmd: suspend with MMC_PM_KEEP_POWER\n");
+                return -EFAULT;
-                ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
        }
+        dev_dbg(adapter->dev, "cmd: suspend with MMC_PM_KEEP_POWER\n");
+        ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
        /* Indicate device suspended */
        adapter->is_suspended = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 9970c2b1b199..b7e6607e6b6d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -297,6 +297,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        /*=== Customer ID ===*/
        /****** 8188CU ********/
        {RTL_USB_DEVICE(0x050d, 0x1102, rtl92cu_hal_cfg)}, /*Belkin - Edimax*/
+        {RTL_USB_DEVICE(0x050d, 0x11f2, rtl92cu_hal_cfg)}, /*Belkin - ISY*/
        {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/
        {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
        {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index caa011008cd0..fc24eb9b3948 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -452,29 +452,85 @@ static void xennet_make_frags(struct sk_buff *skb, struct net_device *dev,
        /* Grant backend access to each skb fragment page. */
        for (i = 0; i < frags; i++) {
                skb_frag_t *frag = skb_shinfo(skb)->frags + i;
+                struct page *page = skb_frag_page(frag);
-                tx->flags |= XEN_NETTXF_more_data;
+                len = skb_frag_size(frag);
+                offset = frag->page_offset;
-                id = get_id_from_freelist(&np->tx_skb_freelist, np->tx_skbs);
+                /* Data must not cross a page boundary. */
-                np->tx_skbs[id].skb = skb_get(skb);
+                BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
-                tx = RING_GET_REQUEST(&np->tx, prod++);
-                tx->id = id;
-                ref = gnttab_claim_grant_reference(&np->gref_tx_head);
-                BUG_ON((signed short)ref < 0);
-                mfn = pfn_to_mfn(page_to_pfn(skb_frag_page(frag)));
+                /* Skip unused frames from start of page */
-                gnttab_grant_foreign_access_ref(ref, np->xbdev->otherend_id,
+                page += offset >> PAGE_SHIFT;
-                                                mfn, GNTMAP_readonly);
+                offset &= ~PAGE_MASK;
-                tx->gref = np->grant_tx_ref[id] = ref;
+                while (len > 0) {
-                tx->offset = frag->page_offset;
+                        unsigned long bytes;
-                tx->size = skb_frag_size(frag);
-                tx->flags = 0;
+                        BUG_ON(offset >= PAGE_SIZE);
+                        bytes = PAGE_SIZE - offset;
+                        if (bytes > len)
+                                bytes = len;
+                        tx->flags |= XEN_NETTXF_more_data;
+                        id = get_id_from_freelist(&np->tx_skb_freelist,
+                                                  np->tx_skbs);
+                        np->tx_skbs[id].skb = skb_get(skb);
+                        tx = RING_GET_REQUEST(&np->tx, prod++);
+                        tx->id = id;
+                        ref = gnttab_claim_grant_reference(&np->gref_tx_head);
+                        BUG_ON((signed short)ref < 0);
+                        mfn = pfn_to_mfn(page_to_pfn(page));
+                        gnttab_grant_foreign_access_ref(ref,
+                                                        np->xbdev->otherend_id,
+                                                        mfn, GNTMAP_readonly);
+                        tx->gref = np->grant_tx_ref[id] = ref;
+                        tx->offset = offset;
+                        tx->size = bytes;
+                        tx->flags = 0;
+                        offset += bytes;
+                        len -= bytes;
+                        /* Next frame */
+                        if (offset == PAGE_SIZE && len) {
+                                BUG_ON(!PageCompound(page));
+                                page++;
+                                offset = 0;
+                        }
+                }
        }
        np->tx.req_prod_pvt = prod;
 }
+/*
+ * Count how many ring slots are required to send the frags of this
+ * skb. Each frag might be a compound page.
+ */
+static int xennet_count_skb_frag_slots(struct sk_buff *skb)
+{
+        int i, frags = skb_shinfo(skb)->nr_frags;
+        int pages = 0;
+        for (i = 0; i < frags; i++) {
+                skb_frag_t *frag = skb_shinfo(skb)->frags + i;
+                unsigned long size = skb_frag_size(frag);
+                unsigned long offset = frag->page_offset;
+                /* Skip unused frames from start of page */
+                offset &= ~PAGE_MASK;
+                pages += PFN_UP(offset + size);
+        }
+        return pages;
+}
 static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        unsigned short id;
@@ -487,23 +543,23 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        grant_ref_t ref;
        unsigned long mfn;
        int notify;
-        int frags = skb_shinfo(skb)->nr_frags;
+        int slots;
        unsigned int offset = offset_in_page(data);
        unsigned int len = skb_headlen(skb);
        unsigned long flags;
-        frags += DIV_ROUND_UP(offset + len, PAGE_SIZE);
+        slots = DIV_ROUND_UP(offset + len, PAGE_SIZE) +
-        if (unlikely(frags > MAX_SKB_FRAGS + 1)) {
+                xennet_count_skb_frag_slots(skb);
-                printk(KERN_ALERT "xennet: skb rides the rocket: %d frags\n",
+        if (unlikely(slots > MAX_SKB_FRAGS + 1)) {
-                       frags);
+                net_alert_ratelimited(
-                dump_stack();
+                        "xennet: skb rides the rocket: %d slots\n", slots);
                goto drop;
        }
        spin_lock_irqsave(&np->tx_lock, flags);
        if (unlikely(!netif_carrier_ok(dev) ||
-                     (frags > 1 && !xennet_can_sg(dev)) ||
+                     (slots > 1 && !xennet_can_sg(dev)) ||
                     netif_needs_gso(skb, netif_skb_features(skb)))) {
                spin_unlock_irqrestore(&np->tx_lock, flags);
                goto drop;
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index 97c440a8cd61..30ae18a03a9c 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -698,13 +698,14 @@ static void pn533_wq_cmd(struct work_struct *work)
        cmd = list_first_entry(&dev->cmd_queue, struct pn533_cmd, queue);
+        list_del(&cmd->queue);
        mutex_unlock(&dev->cmd_lock);
        __pn533_send_cmd_frame_async(dev, cmd->out_frame, cmd->in_frame,
                                     cmd->in_frame_len, cmd->cmd_complete,
                                     cmd->arg, cmd->flags);
-        list_del(&cmd->queue);
        kfree(cmd);
 }
@@ -1678,11 +1679,14 @@ static void pn533_deactivate_target(struct nfc_dev *nfc_dev,
 static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
                                                u8 *params, int params_len)
 {
-        struct pn533_cmd_jump_dep *cmd;
        struct pn533_cmd_jump_dep_response *resp;
        struct nfc_target nfc_target;
        u8 target_gt_len;
        int rc;
+        struct pn533_cmd_jump_dep *cmd = (struct pn533_cmd_jump_dep *)arg;
+        u8 active = cmd->active;
+        kfree(arg);
        if (params_len == -ENOENT) {
                nfc_dev_dbg(&dev->interface->dev, "");
@@ -1704,7 +1708,6 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
        }
        resp = (struct pn533_cmd_jump_dep_response *) params;
-        cmd = (struct pn533_cmd_jump_dep *) arg;
        rc = resp->status & PN533_CMD_RET_MASK;
        if (rc != PN533_CMD_RET_SUCCESS) {
                nfc_dev_err(&dev->interface->dev,
@@ -1734,7 +1737,7 @@ static int pn533_in_dep_link_up_complete(struct pn533 *dev, void *arg,
        if (rc == 0)
                rc = nfc_dep_link_is_up(dev->nfc_dev,
                                                dev->nfc_dev->targets[0].idx,
-                                                !cmd->active, NFC_RF_INITIATOR);
+                                                !active, NFC_RF_INITIATOR);
        return 0;
 }
@@ -1819,12 +1822,8 @@ static int pn533_dep_link_up(struct nfc_dev *nfc_dev, struct nfc_target *target,
        rc = pn533_send_cmd_frame_async(dev, dev->out_frame, dev->in_frame,
                                dev->in_maxlen, pn533_in_dep_link_up_complete,
                                cmd, GFP_KERNEL);
-        if (rc)
+        if (rc < 0)
-                goto out;
+                kfree(cmd);
-out:
-        kfree(cmd);
        return rc;
 }
@@ -2078,8 +2077,12 @@ error:
 static int pn533_tm_send_complete(struct pn533 *dev, void *arg,
                                  u8 *params, int params_len)
 {
+        struct sk_buff *skb_out = arg;
        nfc_dev_dbg(&dev->interface->dev, "%s", __func__);
+        dev_kfree_skb(skb_out);
        if (params_len < 0) {
                nfc_dev_err(&dev->interface->dev,
                            "Error %d when sending data",
@@ -2117,7 +2120,7 @@ static int pn533_tm_send(struct nfc_dev *nfc_dev, struct sk_buff *skb)
        rc = pn533_send_cmd_frame_async(dev, out_frame, dev->in_frame,
                                        dev->in_maxlen, pn533_tm_send_complete,
-                                        NULL, GFP_KERNEL);
+                                        skb, GFP_KERNEL);
        if (rc) {
                nfc_dev_err(&dev->interface->dev,
                            "Error %d when trying to send data", rc);
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index d96caefd914a..aeecf0f72cad 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -178,7 +178,7 @@ config PINCTRL_COH901
          ports of 8 GPIO pins each.
 config PINCTRL_SAMSUNG
-        bool "Samsung pinctrl driver"
+        bool
        depends on OF && GPIOLIB
        select PINMUX
        select PINCONF
diff --git a/drivers/rapidio/rio.c b/drivers/rapidio/rio.c
index c17ae22567e0..0c6fcb461faf 100644
--- a/drivers/rapidio/rio.c
+++ b/drivers/rapidio/rio.c
@@ -401,7 +401,7 @@ EXPORT_SYMBOL_GPL(rio_release_inb_pwrite);
 /**
 * rio_map_inb_region -- Map inbound memory region.
 * @mport: Master port.
- * @lstart: physical address of memory region to be mapped
+ * @local: physical address of memory region to be mapped
 * @rbase: RIO base address assigned to this window
 * @size: Size of the memory region
 * @rflags: Flags for mapping.
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 5c4829cba6a6..e872c8be080e 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1381,22 +1381,14 @@ struct regulator *regulator_get_exclusive(struct device *dev, const char *id)
 }
 EXPORT_SYMBOL_GPL(regulator_get_exclusive);
-/**
+/* Locks held by regulator_put() */
- * regulator_put - "free" the regulator source
+static void _regulator_put(struct regulator *regulator)
- * @regulator: regulator source
- *
- * Note: drivers must ensure that all regulator_enable calls made on this
- * regulator source are balanced by regulator_disable calls prior to calling
- * this function.
- */
-void regulator_put(struct regulator *regulator)
 {
        struct regulator_dev *rdev;
        if (regulator == NULL || IS_ERR(regulator))
                return;
-        mutex_lock(&regulator_list_mutex);
        rdev = regulator->rdev;
        debugfs_remove_recursive(regulator->debugfs);
@@ -1412,6 +1404,20 @@ void regulator_put(struct regulator *regulator)
        rdev->exclusive = 0;
        module_put(rdev->owner);
+}
+/**
+ * regulator_put - "free" the regulator source
+ * @regulator: regulator source
+ *
+ * Note: drivers must ensure that all regulator_enable calls made on this
+ * regulator source are balanced by regulator_disable calls prior to calling
+ * this function.
+ */
+void regulator_put(struct regulator *regulator)
+{
+        mutex_lock(&regulator_list_mutex);
+        _regulator_put(regulator);
        mutex_unlock(&regulator_list_mutex);
 }
 EXPORT_SYMBOL_GPL(regulator_put);
@@ -1974,7 +1980,7 @@ int regulator_is_supported_voltage(struct regulator *regulator,
        if (!(rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
                ret = regulator_get_voltage(regulator);
                if (ret >= 0)
-                        return (min_uV >= ret && ret <= max_uV);
+                        return (min_uV <= ret && ret <= max_uV);
                else
                        return ret;
        }
@@ -3365,7 +3371,7 @@ regulator_register(const struct regulator_desc *regulator_desc,
                if (ret != 0) {
                        rdev_err(rdev, "Failed to request enable GPIO%d: %d\n",
                                 config->ena_gpio, ret);
-                        goto clean;
+                        goto wash;
                }
                rdev->ena_gpio = config->ena_gpio;
@@ -3445,10 +3451,11 @@ unset_supplies:
 scrub:
        if (rdev->supply)
-                regulator_put(rdev->supply);
+                _regulator_put(rdev->supply);
        if (rdev->ena_gpio)
                gpio_free(rdev->ena_gpio);
        kfree(rdev->constraints);
+wash:
        device_unregister(&rdev->dev);
        /* device core frees rdev */
        rdev = ERR_PTR(ret);
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 9ffb6d5f17aa..4ed343e4eb41 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -44,7 +44,6 @@
 #define RAW3215_NR_CCWS     3
 #define RAW3215_TIMEOUT     HZ/10     /* time for delayed output */
-#define RAW3215_FIXED       1         /* 3215 console device is not be freed */
 #define RAW3215_WORKING     4         /* set if a request is being worked on */
 #define RAW3215_THROTTLED   8         /* set if reading is disabled */
 #define RAW3215_STOPPED     16        /* set if writing is disabled */
@@ -339,8 +338,10 @@ static void raw3215_wakeup(unsigned long data)
        struct tty_struct *tty;
        tty = tty_port_tty_get(&raw->port);
-        tty_wakeup(tty);
+        if (tty) {
-        tty_kref_put(tty);
+                tty_wakeup(tty);
+                tty_kref_put(tty);
+        }
 }
 /*
@@ -629,8 +630,7 @@ static void raw3215_shutdown(struct raw3215_info *raw)
        DECLARE_WAITQUEUE(wait, current);
        unsigned long flags;
-        if (!(raw->port.flags & ASYNC_INITIALIZED) ||
+        if (!(raw->port.flags & ASYNC_INITIALIZED))
-                        (raw->flags & RAW3215_FIXED))
                return;
        /* Wait for outstanding requests, then free irq */
        spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags);
@@ -926,8 +926,6 @@ static int __init con3215_init(void)
        dev_set_drvdata(&cdev->dev, raw);
        cdev->handler = raw3215_irq;
-        raw->flags |= RAW3215_FIXED;
        /* Request the console irq */
        if (raw3215_startup(raw) != 0) {
                raw3215_free_info(raw);
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 3e25d3150456..4d6ba00d0047 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -2942,13 +2942,33 @@ static int qeth_query_ipassists_cb(struct qeth_card *card,
        QETH_DBF_TEXT(SETUP, 2, "qipasscb");
        cmd = (struct qeth_ipa_cmd *) data;
+        switch (cmd->hdr.return_code) {
+        case IPA_RC_NOTSUPP:
+        case IPA_RC_L2_UNSUPPORTED_CMD:
+                QETH_DBF_TEXT(SETUP, 2, "ipaunsup");
+                card->options.ipa4.supported_funcs |= IPA_SETADAPTERPARMS;
+                card->options.ipa6.supported_funcs |= IPA_SETADAPTERPARMS;
+                return -0;
+        default:
+                if (cmd->hdr.return_code) {
+                        QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Unhandled "
+                                                "rc=%d\n",
+                                                dev_name(&card->gdev->dev),
+                                                cmd->hdr.return_code);
+                        return 0;
+                }
+        }
        if (cmd->hdr.prot_version == QETH_PROT_IPV4) {
                card->options.ipa4.supported_funcs = cmd->hdr.ipa_supported;
                card->options.ipa4.enabled_funcs = cmd->hdr.ipa_enabled;
-        } else {
+        } else if (cmd->hdr.prot_version == QETH_PROT_IPV6) {
                card->options.ipa6.supported_funcs = cmd->hdr.ipa_supported;
                card->options.ipa6.enabled_funcs = cmd->hdr.ipa_enabled;
-        }
+        } else
+                QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Flawed LIC detected"
+                                        "\n", dev_name(&card->gdev->dev));
        QETH_DBF_TEXT(SETUP, 2, "suppenbl");
        QETH_DBF_TEXT_(SETUP, 2, "%08x", (__u32)cmd->hdr.ipa_supported);
        QETH_DBF_TEXT_(SETUP, 2, "%08x", (__u32)cmd->hdr.ipa_enabled);
diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
index e67e0258aec5..fddb62654b6a 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -626,10 +626,13 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
        QETH_DBF_TEXT(SETUP, 2, "doL2init");
        QETH_DBF_TEXT_(SETUP, 2, "doL2%s", CARD_BUS_ID(card));
-        rc = qeth_query_setadapterparms(card);
+        if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) {
-        if (rc) {
+                rc = qeth_query_setadapterparms(card);
-                QETH_DBF_MESSAGE(2, "could not query adapter parameters on "
+                if (rc) {
-                        "device %s: x%x\n", CARD_BUS_ID(card), rc);
+                        QETH_DBF_MESSAGE(2, "could not query adapter "
+                                "parameters on device %s: x%x\n",
+                                CARD_BUS_ID(card), rc);
+                }
        }
        if (card->info.type == QETH_CARD_TYPE_IQD ||
@@ -676,7 +679,7 @@ static int qeth_l2_set_mac_address(struct net_device *dev, void *p)
                return -ERESTARTSYS;
        }
        rc = qeth_l2_send_delmac(card, &card->dev->dev_addr[0]);
-        if (!rc)
+        if (!rc || (rc == IPA_RC_L2_MAC_NOT_FOUND))
                rc = qeth_l2_send_setmac(card, addr->sa_data);
        return rc ? -EINVAL : 0;
 }
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index c1bafc3f3fb1..9594ab62702b 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -1972,7 +1972,7 @@ sci_io_request_frame_handler(struct isci_request *ireq,
                                                                      frame_index,
                                                                      (void **)&frame_buffer);
-                        sci_controller_copy_sata_response(&ireq->stp.req,
+                        sci_controller_copy_sata_response(&ireq->stp.rsp,
                                                               frame_header,
                                                               frame_buffer);
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 2936b447cae9..2c0d0ec8150b 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -55,6 +55,7 @@
 #include <linux/cpu.h>
 #include <linux/mutex.h>
 #include <linux/async.h>
+#include <asm/unaligned.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
@@ -1062,6 +1063,50 @@ int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
 EXPORT_SYMBOL_GPL(scsi_get_vpd_page);
 /**
+ * scsi_report_opcode - Find out if a given command opcode is supported
+ * @sdev:       scsi device to query
+ * @buffer:     scratch buffer (must be at least 20 bytes long)
+ * @len:        length of buffer
+ * @opcode:     opcode for command to look up
+ *
+ * Uses the REPORT SUPPORTED OPERATION CODES to look up the given
+ * opcode. Returns 0 if RSOC fails or if the command opcode is
+ * unsupported. Returns 1 if the device claims to support the command.
+ */
+int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+                       unsigned int len, unsigned char opcode)
+{
+        unsigned char cmd[16];
+        struct scsi_sense_hdr sshdr;
+        int result;
+        if (sdev->no_report_opcodes || sdev->scsi_level < SCSI_SPC_3)
+                return 0;
+        memset(cmd, 0, 16);
+        cmd[0] = MAINTENANCE_IN;
+        cmd[1] = MI_REPORT_SUPPORTED_OPERATION_CODES;
+        cmd[2] = 1;             /* One command format */
+        cmd[3] = opcode;
+        put_unaligned_be32(len, &cmd[6]);
+        memset(buffer, 0, len);
+        result = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buffer, len,
+                                  &sshdr, 30 * HZ, 3, NULL);
+        if (result && scsi_sense_valid(&sshdr) &&
+            sshdr.sense_key == ILLEGAL_REQUEST &&
+            (sshdr.asc == 0x20 || sshdr.asc == 0x24) && sshdr.ascq == 0x00)
+                return 0;
+        if ((buffer[1] & 3) == 3) /* Command supported */
+                return 1;
+        return 0;
+}
+EXPORT_SYMBOL(scsi_report_opcode);
+/**
 * scsi_device_get  -  get an additional reference to a scsi_device
 * @sdev:       device to get a reference to
 *
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index da36a3a81a9e..9032e910bca3 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -900,11 +900,23 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                                action = ACTION_FAIL;
                                error = -EILSEQ;
                        /* INVALID COMMAND OPCODE or INVALID FIELD IN CDB */
-                        } else if ((sshdr.asc == 0x20 || sshdr.asc == 0x24) &&
+                        } else if (sshdr.asc == 0x20 || sshdr.asc == 0x24) {
-                                   (cmd->cmnd[0] == UNMAP ||
+                                switch (cmd->cmnd[0]) {
-                                    cmd->cmnd[0] == WRITE_SAME_16 ||
+                                case UNMAP:
-                                    cmd->cmnd[0] == WRITE_SAME)) {
+                                        description = "Discard failure";
-                                description = "Discard failure";
+                                        break;
+                                case WRITE_SAME:
+                                case WRITE_SAME_16:
+                                        if (cmd->cmnd[1] & 0x8)
+                                                description = "Discard failure";
+                                        else
+                                                description =
+                                                        "Write same failure";
+                                        break;
+                                default:
+                                        description = "Invalid command failure";
+                                        break;
+                                }
                                action = ACTION_FAIL;
                                error = -EREMOTEIO;
                        } else
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 12f6fdfc1147..352bc77b7c88 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -99,6 +99,7 @@ MODULE_ALIAS_SCSI_DEVICE(TYPE_RBC);
 #endif
 static void sd_config_discard(struct scsi_disk *, unsigned int);
+static void sd_config_write_same(struct scsi_disk *);
 static int  sd_revalidate_disk(struct gendisk *);
 static void sd_unlock_native_capacity(struct gendisk *disk);
 static int  sd_probe(struct device *);
@@ -395,6 +396,45 @@ sd_store_max_medium_access_timeouts(struct device *dev,
        return err ? err : count;
 }
+static ssize_t
+sd_show_write_same_blocks(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        struct scsi_disk *sdkp = to_scsi_disk(dev);
+        return snprintf(buf, 20, "%u\n", sdkp->max_ws_blocks);
+}
+static ssize_t
+sd_store_write_same_blocks(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
+{
+        struct scsi_disk *sdkp = to_scsi_disk(dev);
+        struct scsi_device *sdp = sdkp->device;
+        unsigned long max;
+        int err;
+        if (!capable(CAP_SYS_ADMIN))
+                return -EACCES;
+        if (sdp->type != TYPE_DISK)
+                return -EINVAL;
+        err = kstrtoul(buf, 10, &max);
+        if (err)
+                return err;
+        if (max == 0)
+                sdp->no_write_same = 1;
+        else if (max <= SD_MAX_WS16_BLOCKS)
+                sdkp->max_ws_blocks = max;
+        sd_config_write_same(sdkp);
+        return count;
+}
 static struct device_attribute sd_disk_attrs[] = {
        __ATTR(cache_type, S_IRUGO|S_IWUSR, sd_show_cache_type,
               sd_store_cache_type),
@@ -410,6 +450,8 @@ static struct device_attribute sd_disk_attrs[] = {
        __ATTR(thin_provisioning, S_IRUGO, sd_show_thin_provisioning, NULL),
        __ATTR(provisioning_mode, S_IRUGO|S_IWUSR, sd_show_provisioning_mode,
               sd_store_provisioning_mode),
+        __ATTR(max_write_same_blocks, S_IRUGO|S_IWUSR,
+               sd_show_write_same_blocks, sd_store_write_same_blocks),
        __ATTR(max_medium_access_timeouts, S_IRUGO|S_IWUSR,
               sd_show_max_medium_access_timeouts,
               sd_store_max_medium_access_timeouts),
@@ -561,19 +603,23 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
                return;
        case SD_LBP_UNMAP:
-                max_blocks = min_not_zero(sdkp->max_unmap_blocks, 0xffffffff);
+                max_blocks = min_not_zero(sdkp->max_unmap_blocks,
+                                          (u32)SD_MAX_WS16_BLOCKS);
                break;
        case SD_LBP_WS16:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks, 0xffffffff);
+                max_blocks = min_not_zero(sdkp->max_ws_blocks,
+                                          (u32)SD_MAX_WS16_BLOCKS);
                break;
        case SD_LBP_WS10:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks, (u32)0xffff);
+                max_blocks = min_not_zero(sdkp->max_ws_blocks,
+                                          (u32)SD_MAX_WS10_BLOCKS);
                break;
        case SD_LBP_ZERO:
-                max_blocks = min_not_zero(sdkp->max_ws_blocks, (u32)0xffff);
+                max_blocks = min_not_zero(sdkp->max_ws_blocks,
+                                          (u32)SD_MAX_WS10_BLOCKS);
                q->limits.discard_zeroes_data = 1;
                break;
        }
@@ -583,29 +629,26 @@ static void sd_config_discard(struct scsi_disk *sdkp, unsigned int mode)
 }
 /**
- * scsi_setup_discard_cmnd - unmap blocks on thinly provisioned device
+ * sd_setup_discard_cmnd - unmap blocks on thinly provisioned device
 * @sdp: scsi device to operate one
 * @rq: Request to prepare
 *
 * Will issue either UNMAP or WRITE SAME(16) depending on preference
 * indicated by target device.
 **/
-static int scsi_setup_discard_cmnd(struct scsi_device *sdp, struct request *rq)
+static int sd_setup_discard_cmnd(struct scsi_device *sdp, struct request *rq)
 {
        struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
-        struct bio *bio = rq->bio;
+        sector_t sector = blk_rq_pos(rq);
-        sector_t sector = bio->bi_sector;
+        unsigned int nr_sectors = blk_rq_sectors(rq);
-        unsigned int nr_sectors = bio_sectors(bio);
+        unsigned int nr_bytes = blk_rq_bytes(rq);
        unsigned int len;
        int ret;
        char *buf;
        struct page *page;
-        if (sdkp->device->sector_size == 4096) {
+        sector >>= ilog2(sdp->sector_size) - 9;
-                sector >>= 3;
+        nr_sectors >>= ilog2(sdp->sector_size) - 9;
-                nr_sectors >>= 3;
-        }
        rq->timeout = SD_TIMEOUT;
        memset(rq->cmd, 0, rq->cmd_len);
@@ -660,6 +703,7 @@ static int scsi_setup_discard_cmnd(struct scsi_device *sdp, struct request *rq)
        blk_add_request_payload(rq, page, len);
        ret = scsi_setup_blk_pc_cmnd(sdp, rq);
        rq->buffer = page_address(page);
+        rq->__data_len = nr_bytes;
 out:
        if (ret != BLKPREP_OK) {
@@ -669,6 +713,83 @@ out:
        return ret;
 }
+static void sd_config_write_same(struct scsi_disk *sdkp)
+{
+        struct request_queue *q = sdkp->disk->queue;
+        unsigned int logical_block_size = sdkp->device->sector_size;
+        unsigned int blocks = 0;
+        if (sdkp->device->no_write_same) {
+                sdkp->max_ws_blocks = 0;
+                goto out;
+        }
+        /* Some devices can not handle block counts above 0xffff despite
+         * supporting WRITE SAME(16). Consequently we default to 64k
+         * blocks per I/O unless the device explicitly advertises a
+         * bigger limit.
+         */
+        if (sdkp->max_ws_blocks == 0)
+                sdkp->max_ws_blocks = SD_MAX_WS10_BLOCKS;
+        if (sdkp->ws16 || sdkp->max_ws_blocks > SD_MAX_WS10_BLOCKS)
+                blocks = min_not_zero(sdkp->max_ws_blocks,
+                                      (u32)SD_MAX_WS16_BLOCKS);
+        else
+                blocks = min_not_zero(sdkp->max_ws_blocks,
+                                      (u32)SD_MAX_WS10_BLOCKS);
+out:
+        blk_queue_max_write_same_sectors(q, blocks * (logical_block_size >> 9));
+}
+/**
+ * sd_setup_write_same_cmnd - write the same data to multiple blocks
+ * @sdp: scsi device to operate one
+ * @rq: Request to prepare
+ *
+ * Will issue either WRITE SAME(10) or WRITE SAME(16) depending on
+ * preference indicated by target device.
+ **/
+static int sd_setup_write_same_cmnd(struct scsi_device *sdp, struct request *rq)
+{
+        struct scsi_disk *sdkp = scsi_disk(rq->rq_disk);
+        struct bio *bio = rq->bio;
+        sector_t sector = blk_rq_pos(rq);
+        unsigned int nr_sectors = blk_rq_sectors(rq);
+        unsigned int nr_bytes = blk_rq_bytes(rq);
+        int ret;
+        if (sdkp->device->no_write_same)
+                return BLKPREP_KILL;
+        BUG_ON(bio_offset(bio) || bio_iovec(bio)->bv_len != sdp->sector_size);
+        sector >>= ilog2(sdp->sector_size) - 9;
+        nr_sectors >>= ilog2(sdp->sector_size) - 9;
+        rq->__data_len = sdp->sector_size;
+        rq->timeout = SD_WRITE_SAME_TIMEOUT;
+        memset(rq->cmd, 0, rq->cmd_len);
+        if (sdkp->ws16 || sector > 0xffffffff || nr_sectors > 0xffff) {
+                rq->cmd_len = 16;
+                rq->cmd[0] = WRITE_SAME_16;
+                put_unaligned_be64(sector, &rq->cmd[2]);
+                put_unaligned_be32(nr_sectors, &rq->cmd[10]);
+        } else {
+                rq->cmd_len = 10;
+                rq->cmd[0] = WRITE_SAME;
+                put_unaligned_be32(sector, &rq->cmd[2]);
+                put_unaligned_be16(nr_sectors, &rq->cmd[7]);
+        }
+        ret = scsi_setup_blk_pc_cmnd(sdp, rq);
+        rq->__data_len = nr_bytes;
+        return ret;
+}
 static int scsi_setup_flush_cmnd(struct scsi_device *sdp, struct request *rq)
 {
        rq->timeout = SD_FLUSH_TIMEOUT;
@@ -712,7 +833,10 @@ static int sd_prep_fn(struct request_queue *q, struct request *rq)
         * block PC requests to make life easier.
         */
        if (rq->cmd_flags & REQ_DISCARD) {
-                ret = scsi_setup_discard_cmnd(sdp, rq);
+                ret = sd_setup_discard_cmnd(sdp, rq);
+                goto out;
+        } else if (rq->cmd_flags & REQ_WRITE_SAME) {
+                ret = sd_setup_write_same_cmnd(sdp, rq);
                goto out;
        } else if (rq->cmd_flags & REQ_FLUSH) {
                ret = scsi_setup_flush_cmnd(sdp, rq);
@@ -1482,12 +1606,21 @@ static int sd_done(struct scsi_cmnd *SCpnt)
        unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
        struct scsi_sense_hdr sshdr;
        struct scsi_disk *sdkp = scsi_disk(SCpnt->request->rq_disk);
+        struct request *req = SCpnt->request;
        int sense_valid = 0;
        int sense_deferred = 0;
        unsigned char op = SCpnt->cmnd[0];
+        unsigned char unmap = SCpnt->cmnd[1] & 8;
-        if ((SCpnt->request->cmd_flags & REQ_DISCARD) && !result)
+        if (req->cmd_flags & REQ_DISCARD || req->cmd_flags & REQ_WRITE_SAME) {
-                scsi_set_resid(SCpnt, 0);
+                if (!result) {
+                        good_bytes = blk_rq_bytes(req);
+                        scsi_set_resid(SCpnt, 0);
+                } else {
+                        good_bytes = 0;
+                        scsi_set_resid(SCpnt, blk_rq_bytes(req));
+                }
+        }
        if (result) {
                sense_valid = scsi_command_normalize_sense(SCpnt, &sshdr);
@@ -1536,9 +1669,25 @@ static int sd_done(struct scsi_cmnd *SCpnt)
                if (sshdr.asc == 0x10)  /* DIX: Host detected corruption */
                        good_bytes = sd_completed_bytes(SCpnt);
                /* INVALID COMMAND OPCODE or INVALID FIELD IN CDB */
-                if ((sshdr.asc == 0x20 || sshdr.asc == 0x24) &&
+                if (sshdr.asc == 0x20 || sshdr.asc == 0x24) {
-                    (op == UNMAP || op == WRITE_SAME_16 || op == WRITE_SAME))
+                        switch (op) {
-                        sd_config_discard(sdkp, SD_LBP_DISABLE);
+                        case UNMAP:
+                                sd_config_discard(sdkp, SD_LBP_DISABLE);
+                                break;
+                        case WRITE_SAME_16:
+                        case WRITE_SAME:
+                                if (unmap)
+                                        sd_config_discard(sdkp, SD_LBP_DISABLE);
+                                else {
+                                        sdkp->device->no_write_same = 1;
+                                        sd_config_write_same(sdkp);
+                                        good_bytes = 0;
+                                        req->__data_len = blk_rq_bytes(req);
+                                        req->cmd_flags |= REQ_QUIET;
+                                }
+                        }
+                }
                break;
        default:
                break;
@@ -2374,9 +2523,7 @@ static void sd_read_block_limits(struct scsi_disk *sdkp)
        if (buffer[3] == 0x3c) {
                unsigned int lba_count, desc_count;
-                sdkp->max_ws_blocks =
+                sdkp->max_ws_blocks = (u32)get_unaligned_be64(&buffer[36]);
-                        (u32) min_not_zero(get_unaligned_be64(&buffer[36]),
-                                           (u64)0xffffffff);
                if (!sdkp->lbpme)
                        goto out;
@@ -2469,6 +2616,13 @@ static void sd_read_block_provisioning(struct scsi_disk *sdkp)
        kfree(buffer);
 }
+static void sd_read_write_same(struct scsi_disk *sdkp, unsigned char *buffer)
+{
+        if (scsi_report_opcode(sdkp->device, buffer, SD_BUF_SIZE,
+                               WRITE_SAME_16))
+                sdkp->ws16 = 1;
+}
 static int sd_try_extended_inquiry(struct scsi_device *sdp)
 {
        /*
@@ -2528,6 +2682,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
                sd_read_write_protect_flag(sdkp, buffer);
                sd_read_cache_type(sdkp, buffer);
                sd_read_app_tag_own(sdkp, buffer);
+                sd_read_write_same(sdkp, buffer);
        }
        sdkp->first_scan = 0;
@@ -2545,6 +2700,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
        blk_queue_flush(sdkp->disk->queue, flush);
        set_capacity(disk, sdkp->capacity);
+        sd_config_write_same(sdkp);
        kfree(buffer);
 out:
diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
index 47c52a6d733c..74a1e4ca5401 100644
--- a/drivers/scsi/sd.h
+++ b/drivers/scsi/sd.h
@@ -14,6 +14,7 @@
 #define SD_TIMEOUT              (30 * HZ)
 #define SD_MOD_TIMEOUT          (75 * HZ)
 #define SD_FLUSH_TIMEOUT        (60 * HZ)
+#define SD_WRITE_SAME_TIMEOUT   (120 * HZ)
 /*
 * Number of allowed retries
@@ -39,6 +40,11 @@ enum {
 };
 enum {
+        SD_MAX_WS10_BLOCKS = 0xffff,
+        SD_MAX_WS16_BLOCKS = 0x7fffff,
+};
+enum {
        SD_LBP_FULL = 0,        /* Full logical block provisioning */
        SD_LBP_UNMAP,           /* Use UNMAP command */
        SD_LBP_WS16,            /* Use WRITE SAME(16) with UNMAP bit */
@@ -77,6 +83,7 @@ struct scsi_disk {
        unsigned        lbpws : 1;
        unsigned        lbpws10 : 1;
        unsigned        lbpvpd : 1;
+        unsigned        ws16 : 1;
 };
 #define to_scsi_disk(obj) container_of(obj,struct scsi_disk,dev)
diff --git a/drivers/staging/android/android_alarm.h b/drivers/staging/android/android_alarm.h
index f2ffd963f1c3..d0cafd637199 100644
--- a/drivers/staging/android/android_alarm.h
+++ b/drivers/staging/android/android_alarm.h
@@ -51,12 +51,10 @@ enum android_alarm_return_flags {
 #define ANDROID_ALARM_WAIT                  _IO('a', 1)
 #define ALARM_IOW(c, type, size)            _IOW('a', (c) | ((type) << 4), size)
-#define ALARM_IOR(c, type, size)            _IOR('a', (c) | ((type) << 4), size)
 /* Set alarm */
 #define ANDROID_ALARM_SET(type)             ALARM_IOW(2, type, struct timespec)
 #define ANDROID_ALARM_SET_AND_WAIT(type)    ALARM_IOW(3, type, struct timespec)
-#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOR(4, type, struct timespec)
+#define ANDROID_ALARM_GET_TIME(type)        ALARM_IOW(4, type, struct timespec)
 #define ANDROID_ALARM_SET_RTC               _IOW('a', 5, struct timespec)
 #define ANDROID_ALARM_BASE_CMD(cmd)         (cmd & ~(_IOC(0, 0, 0xf0, 0)))
 #define ANDROID_ALARM_IOCTL_TO_TYPE(cmd)    (_IOC_NR(cmd) >> 4)
diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
index a5dec1ca1b82..13ee53bd0bf6 100644
--- a/drivers/tty/hvc/hvc_console.c
+++ b/drivers/tty/hvc/hvc_console.c
@@ -424,7 +424,6 @@ static void hvc_hangup(struct tty_struct *tty)
 {
        struct hvc_struct *hp = tty->driver_data;
        unsigned long flags;
-        int temp_open_count;
        if (!hp)
                return;
@@ -444,7 +443,6 @@ static void hvc_hangup(struct tty_struct *tty)
                return;
        }
-        temp_open_count = hp->port.count;
        hp->port.count = 0;
        spin_unlock_irqrestore(&hp->port.lock, flags);
        tty_port_tty_set(&hp->port, NULL);
@@ -453,11 +451,6 @@ static void hvc_hangup(struct tty_struct *tty)
        if (hp->ops->notifier_hangup)
                hp->ops->notifier_hangup(hp, hp->data);
-        while(temp_open_count) {
-                --temp_open_count;
-                tty_port_put(&hp->port);
-        }
 }
 /*
diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c
index 2bc28a59d385..1ab1d2c66de4 100644
--- a/drivers/tty/serial/max310x.c
+++ b/drivers/tty/serial/max310x.c
@@ -1239,6 +1239,7 @@ static int __devexit max310x_remove(struct spi_device *spi)
 static const struct spi_device_id max310x_id_table[] = {
        { "max3107",    MAX310X_TYPE_MAX3107 },
        { "max3108",    MAX310X_TYPE_MAX3108 },
+        { }
 };
 MODULE_DEVICE_TABLE(spi, max310x_id_table);
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 1e741bca0265..f034716190ff 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2151,8 +2151,15 @@ EXPORT_SYMBOL_GPL(usb_bus_start_enum);
 irqreturn_t usb_hcd_irq (int irq, void *__hcd)
 {
        struct usb_hcd          *hcd = __hcd;
+        unsigned long           flags;
        irqreturn_t             rc;
+        /* IRQF_DISABLED doesn't work correctly with shared IRQs
+         * when the first handler doesn't use it.  So let's just
+         * assume it's never used.
+         */
+        local_irq_save(flags);
        if (unlikely(HCD_DEAD(hcd) || !HCD_HW_ACCESSIBLE(hcd)))
                rc = IRQ_NONE;
        else if (hcd->driver->irq(hcd) == IRQ_NONE)
@@ -2160,6 +2167,7 @@ irqreturn_t usb_hcd_irq (int irq, void *__hcd)
        else
                rc = IRQ_HANDLED;
+        local_irq_restore(flags);
        return rc;
 }
 EXPORT_SYMBOL_GPL(usb_hcd_irq);
@@ -2347,6 +2355,14 @@ static int usb_hcd_request_irqs(struct usb_hcd *hcd,
        int retval;
        if (hcd->driver->irq) {
+                /* IRQF_DISABLED doesn't work as advertised when used together
+                 * with IRQF_SHARED. As usb_hcd_irq() will always disable
+                 * interrupts we can remove it here.
+                 */
+                if (irqflags & IRQF_SHARED)
+                        irqflags &= ~IRQF_DISABLED;
                snprintf(hcd->irq_descr, sizeof(hcd->irq_descr), "%s:usb%d",
                                hcd->driver->description, hcd->self.busnum);
                retval = request_irq(irqnum, &usb_hcd_irq, irqflags,
diff --git a/drivers/usb/early/ehci-dbgp.c b/drivers/usb/early/ehci-dbgp.c
index e426ad626d74..4bfa78af379c 100644
--- a/drivers/usb/early/ehci-dbgp.c
+++ b/drivers/usb/early/ehci-dbgp.c
@@ -20,6 +20,7 @@
 #include <linux/usb/ehci_def.h>
 #include <linux/delay.h>
 #include <linux/serial_core.h>
+#include <linux/kconfig.h>
 #include <linux/kgdb.h>
 #include <linux/kthread.h>
 #include <asm/io.h>
@@ -614,12 +615,6 @@ err:
        return -ENODEV;
 }
-int dbgp_external_startup(struct usb_hcd *hcd)
-{
-        return xen_dbgp_external_startup(hcd) ?: _dbgp_external_startup();
-}
-EXPORT_SYMBOL_GPL(dbgp_external_startup);
 static int ehci_reset_port(int port)
 {
        u32 portsc;
@@ -979,6 +974,7 @@ struct console early_dbgp_console = {
        .index =        -1,
 };
+#if IS_ENABLED(CONFIG_USB_EHCI_HCD)
 int dbgp_reset_prep(struct usb_hcd *hcd)
 {
        int ret = xen_dbgp_reset_prep(hcd);
@@ -1007,6 +1003,13 @@ int dbgp_reset_prep(struct usb_hcd *hcd)
 }
 EXPORT_SYMBOL_GPL(dbgp_reset_prep);
+int dbgp_external_startup(struct usb_hcd *hcd)
+{
+        return xen_dbgp_external_startup(hcd) ?: _dbgp_external_startup();
+}
+EXPORT_SYMBOL_GPL(dbgp_external_startup);
+#endif /* USB_EHCI_HCD */
 #ifdef CONFIG_KGDB
 static char kgdbdbgp_buf[DBGP_MAX_PACKET];
diff --git a/drivers/usb/host/ehci-ls1x.c b/drivers/usb/host/ehci-ls1x.c
index ca759652626b..aa0f328922df 100644
--- a/drivers/usb/host/ehci-ls1x.c
+++ b/drivers/usb/host/ehci-ls1x.c
@@ -113,7 +113,7 @@ static int ehci_hcd_ls1x_probe(struct platform_device *pdev)
                goto err_put_hcd;
        }
-        ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
        if (ret)
                goto err_put_hcd;
diff --git a/drivers/usb/host/ohci-xls.c b/drivers/usb/host/ohci-xls.c
index 84201cd1a472..41e378f17c66 100644
--- a/drivers/usb/host/ohci-xls.c
+++ b/drivers/usb/host/ohci-xls.c
@@ -56,7 +56,7 @@ static int ohci_xls_probe_internal(const struct hc_driver *driver,
                goto err3;
        }
-        retval = usb_add_hcd(hcd, irq, IRQF_SHARED);
+        retval = usb_add_hcd(hcd, irq, IRQF_DISABLED | IRQF_SHARED);
        if (retval != 0)
                goto err4;
        return retval;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index d0b87e7b4abf..b6b84dacc791 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -707,11 +707,12 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                fifo_count = musb_readw(epio, MUSB_RXCOUNT);
                /*
-                 *  use mode 1 only if we expect data of at least ep packet_sz
+                 * Enable Mode 1 on RX transfers only when short_not_ok flag
-                 *  and have not yet received a short packet
+                 * is set. Currently short_not_ok flag is set only from
+                 * file_storage and f_mass_storage drivers
                 */
-                if ((request->length - request->actual >= musb_ep->packet_sz) &&
-                        (fifo_count >= musb_ep->packet_sz))
+                if (request->short_not_ok && fifo_count == musb_ep->packet_sz)
                        use_mode_1 = 1;
                else
                        use_mode_1 = 0;
@@ -727,6 +728,27 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                c = musb->dma_controller;
                                channel = musb_ep->dma;
+        /* We use DMA Req mode 0 in rx_csr, and DMA controller operates in
+         * mode 0 only. So we do not get endpoint interrupts due to DMA
+         * completion. We only get interrupts from DMA controller.
+         *
+         * We could operate in DMA mode 1 if we knew the size of the tranfer
+         * in advance. For mass storage class, request->length = what the host
+         * sends, so that'd work.  But for pretty much everything else,
+         * request->length is routinely more than what the host sends. For
+         * most these gadgets, end of is signified either by a short packet,
+         * or filling the last byte of the buffer.  (Sending extra data in
+         * that last pckate should trigger an overflow fault.)  But in mode 1,
+         * we don't get DMA completion interrupt for short packets.
+         *
+         * Theoretically, we could enable DMAReq irq (MUSB_RXCSR_DMAMODE = 1),
+         * to get endpoint interrupt on every DMA req, but that didn't seem
+         * to work reliably.
+         *
+         * REVISIT an updated g_file_storage can set req->short_not_ok, which
+         * then becomes usable as a runtime "use mode 1" hint...
+         */
                                /* Experimental: Mode1 works with mass storage use cases */
                                if (use_mode_1) {
                                        csr |= MUSB_RXCSR_AUTOCLEAR;
diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c
index d62a91fedc22..0e62f504410e 100644
--- a/drivers/usb/musb/ux500.c
+++ b/drivers/usb/musb/ux500.c
@@ -65,7 +65,7 @@ static int __devinit ux500_probe(struct platform_device *pdev)
        struct platform_device          *musb;
        struct ux500_glue               *glue;
        struct clk                      *clk;
+        int                             musbid;
        int                             ret = -ENOMEM;
        glue = kzalloc(sizeof(*glue), GFP_KERNEL);
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index d8c8a42bff3e..6223062d5d1b 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -58,7 +58,7 @@ config USB_ULPI_VIEWPORT
 config TWL4030_USB
        tristate "TWL4030 USB Transceiver Driver"
-        depends on TWL4030_CORE && REGULATOR_TWL4030
+        depends on TWL4030_CORE && REGULATOR_TWL4030 && USB_MUSB_OMAP2PLUS
        select USB_OTG_UTILS
        help
          Enable this to support the USB OTG transceiver on TWL4030
@@ -68,7 +68,7 @@ config TWL4030_USB
 config TWL6030_USB
        tristate "TWL6030 USB Transceiver Driver"
-        depends on TWL4030_CORE && OMAP_USB2
+        depends on TWL4030_CORE && OMAP_USB2 && USB_MUSB_OMAP2PLUS
        select USB_OTG_UTILS
        help
          Enable this to support the USB OTG transceiver on TWL6030
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 7179b0c5f814..cff8dd5b462d 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -2430,7 +2430,7 @@ static void keyspan_release(struct usb_serial *serial)
 static int keyspan_port_probe(struct usb_serial_port *port)
 {
        struct usb_serial *serial = port->serial;
-        struct keyspan_port_private *s_priv;
+        struct keyspan_serial_private *s_priv;
        struct keyspan_port_private *p_priv;
        const struct keyspan_device_details *d_details;
        struct callbacks *cback;
@@ -2445,7 +2445,6 @@ static int keyspan_port_probe(struct usb_serial_port *port)
        if (!p_priv)
                return -ENOMEM;
-        s_priv = usb_get_serial_data(port->serial);
        p_priv->device_details = d_details;
        /* Setup values for the various callback routines */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5dee7d61241e..edc64bb6f457 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -158,6 +158,7 @@ static void option_instat_callback(struct urb *urb);
 #define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED 0x8001
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0x9000
 #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
+#define NOVATELWIRELESS_PRODUCT_E362            0x9010
 #define NOVATELWIRELESS_PRODUCT_G1              0xA001
 #define NOVATELWIRELESS_PRODUCT_G1_M            0xA002
 #define NOVATELWIRELESS_PRODUCT_G2              0xA010
@@ -193,6 +194,9 @@ static void option_instat_callback(struct urb *urb);
 #define DELL_PRODUCT_5730_MINICARD_TELUS        0x8181
 #define DELL_PRODUCT_5730_MINICARD_VZW          0x8182
+#define DELL_PRODUCT_5800_MINICARD_VZW          0x8195  /* Novatel E362 */
+#define DELL_PRODUCT_5800_V2_MINICARD_VZW       0x8196  /* Novatel E362 */
 #define KYOCERA_VENDOR_ID                       0x0c88
 #define KYOCERA_PRODUCT_KPC650                  0x17da
 #define KYOCERA_PRODUCT_KPC680                  0x180a
@@ -283,6 +287,7 @@ static void option_instat_callback(struct urb *urb);
 /* ALCATEL PRODUCTS */
 #define ALCATEL_VENDOR_ID                       0x1bbb
 #define ALCATEL_PRODUCT_X060S_X200              0x0000
+#define ALCATEL_PRODUCT_X220_X500D              0x0017
 #define PIRELLI_VENDOR_ID                       0x1266
 #define PIRELLI_PRODUCT_C100_1                  0x1002
@@ -706,6 +711,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_G2) },
        /* Novatel Ovation MC551 a.k.a. Verizon USB551L */
        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
        { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
@@ -728,6 +734,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) },      /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) },       /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) },         /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+        { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) },
        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
        { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
@@ -1157,6 +1165,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
          .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
        },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
        { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
        { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
        { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 61a73ad1a187..a3e9c095f0d8 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -455,9 +455,6 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port,
        struct usb_serial *serial = port->serial;
        struct urb *urb;
-        if (endpoint == -1)
-                return NULL;    /* endpoint not needed */
        urb = usb_alloc_urb(0, GFP_KERNEL);     /* No ISO */
        if (urb == NULL) {
                dev_dbg(&serial->interface->dev,
@@ -489,6 +486,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        init_usb_anchor(&portdata->delayed);
        for (i = 0; i < N_IN_URB; i++) {
+                if (!port->bulk_in_size)
+                        break;
                buffer = (u8 *)__get_free_page(GFP_KERNEL);
                if (!buffer)
                        goto bail_out_error;
@@ -502,8 +502,8 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
        }
        for (i = 0; i < N_OUT_URB; i++) {
-                if (port->bulk_out_endpointAddress == -1)
+                if (!port->bulk_out_size)
-                        continue;
+                        break;
                buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
                if (!buffer)
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index a3d54366afcc..92f35abee92d 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -186,6 +186,12 @@ static int slave_configure(struct scsi_device *sdev)
                /* Some devices don't handle VPD pages correctly */
                sdev->skip_vpd_pages = 1;
+                /* Do not attempt to use REPORT SUPPORTED OPERATION CODES */
+                sdev->no_report_opcodes = 1;
+                /* Do not attempt to use WRITE SAME */
+                sdev->no_write_same = 1;
                /* Some disks return the total number of blocks in response
                 * to READ CAPACITY rather than the highest block number.
                 * If this device makes that mistake, tell the sd driver. */
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/omap2/dss/dsi.c
index d64ac3842884..bee92846cfab 100644
--- a/drivers/video/omap2/dss/dsi.c
+++ b/drivers/video/omap2/dss/dsi.c
@@ -365,11 +365,20 @@ struct platform_device *dsi_get_dsidev_from_id(int module)
        struct omap_dss_output *out;
        enum omap_dss_output_id id;
-        id = module == 0 ? OMAP_DSS_OUTPUT_DSI1 : OMAP_DSS_OUTPUT_DSI2;
+        switch (module) {
+        case 0:
+                id = OMAP_DSS_OUTPUT_DSI1;
+                break;
+        case 1:
+                id = OMAP_DSS_OUTPUT_DSI2;
+                break;
+        default:
+                return NULL;
+        }
        out = omap_dss_get_output(id);
-        return out->pdev;
+        return out ? out->pdev : NULL;
 }
 static inline void dsi_write_reg(struct platform_device *dsidev,
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
index 363852a0f764..602102cebcbf 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/omap2/dss/dss.c
@@ -695,11 +695,15 @@ static int dss_get_clocks(void)
        dss.dss_clk = clk;
-        clk = clk_get(NULL, dss.feat->clk_name);
+        if (dss.feat->clk_name) {
-        if (IS_ERR(clk)) {
+                clk = clk_get(NULL, dss.feat->clk_name);
-                DSSERR("Failed to get %s\n", dss.feat->clk_name);
+                if (IS_ERR(clk)) {
-                r = PTR_ERR(clk);
+                        DSSERR("Failed to get %s\n", dss.feat->clk_name);
-                goto err;
+                        r = PTR_ERR(clk);
+                        goto err;
+                }
+        } else {
+                clk = NULL;
        }
        dss.dpll4_m4_ck = clk;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index adcc906d12f8..0d6d7213a858 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -645,8 +645,10 @@ static void hdmi_dump_regs(struct seq_file *s)
 {
        mutex_lock(&hdmi.lock);
-        if (hdmi_runtime_get())
+        if (hdmi_runtime_get()) {
+                mutex_unlock(&hdmi.lock);
                return;
+        }
        hdmi.ip_data.ops->dump_wrapper(&hdmi.ip_data, s);
        hdmi.ip_data.ops->dump_pll(&hdmi.ip_data, s);
diff --git a/drivers/video/omap2/omapfb/omapfb-ioctl.c b/drivers/video/omap2/omapfb/omapfb-ioctl.c
index 55a39be694a5..532a31b3d96b 100644
--- a/drivers/video/omap2/omapfb/omapfb-ioctl.c
+++ b/drivers/video/omap2/omapfb/omapfb-ioctl.c
@@ -787,7 +787,7 @@ int omapfb_ioctl(struct fb_info *fbi, unsigned int cmd, unsigned long arg)
        case OMAPFB_WAITFORVSYNC:
                DBG("ioctl WAITFORVSYNC\n");
-                if (!display && !display->output && !display->output->manager) {
+                if (!display || !display->output || !display->output->manager) {
                        r = -EINVAL;
                        break;
                }
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 8adb9cc267f9..71f5c459b088 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -361,13 +361,13 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
        down_write(&mm->mmap_sem);
        vma = find_vma(mm, m.addr);
-        ret = -EINVAL;
        if (!vma ||
            vma->vm_ops != &privcmd_vm_ops ||
            (m.addr != vma->vm_start) ||
            ((m.addr + (nr_pages << PAGE_SHIFT)) != vma->vm_end) ||
            !privcmd_enforce_singleshot_mapping(vma)) {
                up_write(&mm->mmap_sem);
+                ret = -EINVAL;
                goto out;
        }
@@ -383,12 +383,16 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
        up_write(&mm->mmap_sem);
-        if (state.global_error && (version == 1)) {
+        if (version == 1) {
-                /* Write back errors in second pass. */
+                if (state.global_error) {
-                state.user_mfn = (xen_pfn_t *)m.arr;
+                        /* Write back errors in second pass. */
-                state.err      = err_array;
+                        state.user_mfn = (xen_pfn_t *)m.arr;
-                ret = traverse_pages(m.num, sizeof(xen_pfn_t),
+                        state.err      = err_array;
-                                     &pagelist, mmap_return_errors_v1, &state);
+                        ret = traverse_pages(m.num, sizeof(xen_pfn_t),
+                                             &pagelist, mmap_return_errors_v1, &state);
+                } else
+                        ret = 0;
        } else if (version == 2) {
                ret = __copy_to_user(m.err, err_array, m.num * sizeof(int));
                if (ret)
diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c
index 7320a66e958f..22548f56197b 100644
--- a/fs/ext3/balloc.c
+++ b/fs/ext3/balloc.c
@@ -2101,8 +2101,9 @@ int ext3_trim_fs(struct super_block *sb, struct fstrim_range *range)
        end = start + (range->len >> sb->s_blocksize_bits) - 1;
        minlen = range->minlen >> sb->s_blocksize_bits;
-        if (unlikely(minlen > EXT3_BLOCKS_PER_GROUP(sb)) ||
+        if (minlen > EXT3_BLOCKS_PER_GROUP(sb) ||
-            unlikely(start >= max_blks))
+            start >= max_blks ||
+            range->len < sb->s_blocksize)
                return -EINVAL;
        if (end >= max_blks)
                end = max_blks - 1;
diff --git a/fs/file.c b/fs/file.c
index 708d997a7748..7cb71b992603 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -685,7 +685,6 @@ void do_close_on_exec(struct files_struct *files)
        struct fdtable *fdt;
        /* exec unshares first */
-        BUG_ON(atomic_read(&files->count) != 1);
        spin_lock(&files->file_lock);
        for (i = 0; ; i++) {
                unsigned long set;
diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c
index 60ef3fb707ff..1506673c087e 100644
--- a/fs/jffs2/file.c
+++ b/fs/jffs2/file.c
@@ -138,33 +138,39 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
        struct page *pg;
        struct inode *inode = mapping->host;
        struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
+        struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
+        struct jffs2_raw_inode ri;
+        uint32_t alloc_len = 0;
        pgoff_t index = pos >> PAGE_CACHE_SHIFT;
        uint32_t pageofs = index << PAGE_CACHE_SHIFT;
        int ret = 0;
+        jffs2_dbg(1, "%s()\n", __func__);
+        if (pageofs > inode->i_size) {
+                ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
+                                          ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
+                if (ret)
+                        return ret;
+        }
+        mutex_lock(&f->sem);
        pg = grab_cache_page_write_begin(mapping, index, flags);
-        if (!pg)
+        if (!pg) {
+                if (alloc_len)
+                        jffs2_complete_reservation(c);
+                mutex_unlock(&f->sem);
                return -ENOMEM;
+        }
        *pagep = pg;
-        jffs2_dbg(1, "%s()\n", __func__);
+        if (alloc_len) {
-        if (pageofs > inode->i_size) {
                /* Make new hole frag from old EOF to new page */
-                struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb);
-                struct jffs2_raw_inode ri;
                struct jffs2_full_dnode *fn;
-                uint32_t alloc_len;
                jffs2_dbg(1, "Writing new hole frag 0x%x-0x%x between current EOF and new page\n",
                          (unsigned int)inode->i_size, pageofs);
-                ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len,
-                                          ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
-                if (ret)
-                        goto out_page;
-                mutex_lock(&f->sem);
                memset(&ri, 0, sizeof(ri));
                ri.magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
@@ -191,7 +197,6 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
                if (IS_ERR(fn)) {
                        ret = PTR_ERR(fn);
                        jffs2_complete_reservation(c);
-                        mutex_unlock(&f->sem);
                        goto out_page;
                }
                ret = jffs2_add_full_dnode_to_inode(c, f, fn);
@@ -206,12 +211,10 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
                        jffs2_mark_node_obsolete(c, fn->raw);
                        jffs2_free_full_dnode(fn);
                        jffs2_complete_reservation(c);
-                        mutex_unlock(&f->sem);
                        goto out_page;
                }
                jffs2_complete_reservation(c);
                inode->i_size = pageofs;
-                mutex_unlock(&f->sem);
        }
        /*
@@ -220,18 +223,18 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping,
         * case of a short-copy.
         */
        if (!PageUptodate(pg)) {
-                mutex_lock(&f->sem);
                ret = jffs2_do_readpage_nolock(inode, pg);
-                mutex_unlock(&f->sem);
                if (ret)
                        goto out_page;
        }
+        mutex_unlock(&f->sem);
        jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags);
        return ret;
 out_page:
        unlock_page(pg);
        page_cache_release(pg);
+        mutex_unlock(&f->sem);
        return ret;
 }
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 721d692fa8d4..6fcaeb8c902e 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -258,7 +258,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
        if (ret)
                goto out_close_fd;
-        fd_install(fd, f);
+        if (fd != FAN_NOFD)
+                fd_install(fd, f);
        return fanotify_event_metadata.event_len;
 out_close_fd:
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 144a96732dd7..3c231adf8450 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -873,6 +873,113 @@ static const struct file_operations proc_environ_operations = {
        .release        = mem_release,
 };
+static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
+                            loff_t *ppos)
+{
+        struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode);
+        char buffer[PROC_NUMBUF];
+        int oom_adj = OOM_ADJUST_MIN;
+        size_t len;
+        unsigned long flags;
+        if (!task)
+                return -ESRCH;
+        if (lock_task_sighand(task, &flags)) {
+                if (task->signal->oom_score_adj == OOM_SCORE_ADJ_MAX)
+                        oom_adj = OOM_ADJUST_MAX;
+                else
+                        oom_adj = (task->signal->oom_score_adj * -OOM_DISABLE) /
+                                  OOM_SCORE_ADJ_MAX;
+                unlock_task_sighand(task, &flags);
+        }
+        put_task_struct(task);
+        len = snprintf(buffer, sizeof(buffer), "%d\n", oom_adj);
+        return simple_read_from_buffer(buf, count, ppos, buffer, len);
+}
+static ssize_t oom_adj_write(struct file *file, const char __user *buf,
+                             size_t count, loff_t *ppos)
+{
+        struct task_struct *task;
+        char buffer[PROC_NUMBUF];
+        int oom_adj;
+        unsigned long flags;
+        int err;
+        memset(buffer, 0, sizeof(buffer));
+        if (count > sizeof(buffer) - 1)
+                count = sizeof(buffer) - 1;
+        if (copy_from_user(buffer, buf, count)) {
+                err = -EFAULT;
+                goto out;
+        }
+        err = kstrtoint(strstrip(buffer), 0, &oom_adj);
+        if (err)
+                goto out;
+        if ((oom_adj < OOM_ADJUST_MIN || oom_adj > OOM_ADJUST_MAX) &&
+             oom_adj != OOM_DISABLE) {
+                err = -EINVAL;
+                goto out;
+        }
+        task = get_proc_task(file->f_path.dentry->d_inode);
+        if (!task) {
+                err = -ESRCH;
+                goto out;
+        }
+        task_lock(task);
+        if (!task->mm) {
+                err = -EINVAL;
+                goto err_task_lock;
+        }
+        if (!lock_task_sighand(task, &flags)) {
+                err = -ESRCH;
+                goto err_task_lock;
+        }
+        /*
+         * Scale /proc/pid/oom_score_adj appropriately ensuring that a maximum
+         * value is always attainable.
+         */
+        if (oom_adj == OOM_ADJUST_MAX)
+                oom_adj = OOM_SCORE_ADJ_MAX;
+        else
+                oom_adj = (oom_adj * OOM_SCORE_ADJ_MAX) / -OOM_DISABLE;
+        if (oom_adj < task->signal->oom_score_adj &&
+            !capable(CAP_SYS_RESOURCE)) {
+                err = -EACCES;
+                goto err_sighand;
+        }
+        /*
+         * /proc/pid/oom_adj is provided for legacy purposes, ask users to use
+         * /proc/pid/oom_score_adj instead.
+         */
+        printk_once(KERN_WARNING "%s (%d): /proc/%d/oom_adj is deprecated, please use /proc/%d/oom_score_adj instead.\n",
+                  current->comm, task_pid_nr(current), task_pid_nr(task),
+                  task_pid_nr(task));
+        task->signal->oom_score_adj = oom_adj;
+        trace_oom_score_adj_update(task);
+err_sighand:
+        unlock_task_sighand(task, &flags);
+err_task_lock:
+        task_unlock(task);
+        put_task_struct(task);
+out:
+        return err < 0 ? err : count;
+}
+static const struct file_operations proc_oom_adj_operations = {
+        .read           = oom_adj_read,
+        .write          = oom_adj_write,
+        .llseek         = generic_file_llseek,
+};
 static ssize_t oom_score_adj_read(struct file *file, char __user *buf,
                                        size_t count, loff_t *ppos)
 {
@@ -2598,6 +2705,7 @@ static const struct pid_entry tgid_base_stuff[] = {
        REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
        INF("oom_score",  S_IRUGO, proc_oom_score),
+        REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adj_operations),
        REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
 #ifdef CONFIG_AUDITSYSCALL
        REG("loginuid",   S_IWUSR|S_IRUGO, proc_loginuid_operations),
@@ -2964,6 +3072,7 @@ static const struct pid_entry tid_base_stuff[] = {
        REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
        INF("oom_score", S_IRUGO, proc_oom_score),
+        REG("oom_adj",   S_IRUGO|S_IWUSR, proc_oom_adj_operations),
        REG("oom_score_adj", S_IRUGO|S_IWUSR, proc_oom_score_adj_operations),
 #ifdef CONFIG_AUDITSYSCALL
        REG("loginuid",  S_IWUSR|S_IRUGO, proc_loginuid_operations),
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index a40da07e93d6..947fbe06c3b1 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -161,6 +161,7 @@ static void pstore_console_write(struct console *con, const char *s, unsigned c)
        while (s < e) {
                unsigned long flags;
+                u64 id;
                if (c > psinfo->bufsize)
                        c = psinfo->bufsize;
@@ -172,7 +173,7 @@ static void pstore_console_write(struct console *con, const char *s, unsigned c)
                        spin_lock_irqsave(&psinfo->buf_lock, flags);
                }
                memcpy(psinfo->buf, s, c);
-                psinfo->write(PSTORE_TYPE_CONSOLE, 0, NULL, 0, c, psinfo);
+                psinfo->write(PSTORE_TYPE_CONSOLE, 0, &id, 0, c, psinfo);
                spin_unlock_irqrestore(&psinfo->buf_lock, flags);
                s += c;
                c = e - s;
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index f27f01a98aa2..d83736fbc26c 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1782,8 +1782,9 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
        BUG_ON(!th->t_trans_id);
-        dquot_initialize(inode);
+        reiserfs_write_unlock(inode->i_sb);
        err = dquot_alloc_inode(inode);
+        reiserfs_write_lock(inode->i_sb);
        if (err)
                goto out_end_trans;
        if (!dir->i_nlink) {
@@ -1979,8 +1980,10 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th,
      out_end_trans:
        journal_end(th, th->t_super, th->t_blocks_allocated);
+        reiserfs_write_unlock(inode->i_sb);
        /* Drop can be outside and it needs more credits so it's better to have it outside */
        dquot_drop(inode);
+        reiserfs_write_lock(inode->i_sb);
        inode->i_flags |= S_NOQUOTA;
        make_bad_inode(inode);
@@ -3103,10 +3106,9 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
        /* must be turned off for recursive notify_change calls */
        ia_valid = attr->ia_valid &= ~(ATTR_KILL_SUID|ATTR_KILL_SGID);
-        depth = reiserfs_write_lock_once(inode->i_sb);
        if (is_quota_modification(inode, attr))
                dquot_initialize(inode);
+        depth = reiserfs_write_lock_once(inode->i_sb);
        if (attr->ia_valid & ATTR_SIZE) {
                /* version 2 items will be caught by the s_maxbytes check
                 ** done for us in vmtruncate
@@ -3170,7 +3172,9 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
                error = journal_begin(&th, inode->i_sb, jbegin_count);
                if (error)
                        goto out;
+                reiserfs_write_unlock_once(inode->i_sb, depth);
                error = dquot_transfer(inode, attr);
+                depth = reiserfs_write_lock_once(inode->i_sb);
                if (error) {
                        journal_end(&th, inode->i_sb, jbegin_count);
                        goto out;
diff --git a/fs/reiserfs/stree.c b/fs/reiserfs/stree.c
index f8afa4b162b8..2f40a4c70a4d 100644
--- a/fs/reiserfs/stree.c
+++ b/fs/reiserfs/stree.c
@@ -1968,7 +1968,9 @@ int reiserfs_paste_into_item(struct reiserfs_transaction_handle *th, struct tree
                       key2type(&(key->on_disk_key)));
 #endif
+        reiserfs_write_unlock(inode->i_sb);
        retval = dquot_alloc_space_nodirty(inode, pasted_size);
+        reiserfs_write_lock(inode->i_sb);
        if (retval) {
                pathrelse(search_path);
                return retval;
@@ -2061,9 +2063,11 @@ int reiserfs_insert_item(struct reiserfs_transaction_handle *th,
                               "reiserquota insert_item(): allocating %u id=%u type=%c",
                               quota_bytes, inode->i_uid, head2type(ih));
 #endif
+                reiserfs_write_unlock(inode->i_sb);
                /* We can't dirty inode here. It would be immediately written but
                 * appropriate stat item isn't inserted yet... */
                retval = dquot_alloc_space_nodirty(inode, quota_bytes);
+                reiserfs_write_lock(inode->i_sb);
                if (retval) {
                        pathrelse(path);
                        return retval;
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 1078ae179993..418bdc3a57da 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -298,7 +298,9 @@ static int finish_unfinished(struct super_block *s)
                        retval = remove_save_link_only(s, &save_link_key, 0);
                        continue;
                }
+                reiserfs_write_unlock(s);
                dquot_initialize(inode);
+                reiserfs_write_lock(s);
                if (truncate && S_ISDIR(inode->i_mode)) {
                        /* We got a truncate request for a dir which is impossible.
@@ -1335,7 +1337,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
                                kfree(qf_names[i]);
 #endif
                err = -EINVAL;
-                goto out_err;
+                goto out_unlock;
        }
 #ifdef CONFIG_QUOTA
        handle_quota_files(s, qf_names, &qfmt);
@@ -1379,7 +1381,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
        if (blocks) {
                err = reiserfs_resize(s, blocks);
                if (err != 0)
-                        goto out_err;
+                        goto out_unlock;
        }
        if (*mount_flags & MS_RDONLY) {
@@ -1389,9 +1391,15 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
                        /* it is read-only already */
                        goto out_ok;
+                /*
+                 * Drop write lock. Quota will retake it when needed and lock
+                 * ordering requires calling dquot_suspend() without it.
+                 */
+                reiserfs_write_unlock(s);
                err = dquot_suspend(s, -1);
                if (err < 0)
                        goto out_err;
+                reiserfs_write_lock(s);
                /* try to remount file system with read-only permissions */
                if (sb_umount_state(rs) == REISERFS_VALID_FS
@@ -1401,7 +1409,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
                err = journal_begin(&th, s, 10);
                if (err)
-                        goto out_err;
+                        goto out_unlock;
                /* Mounting a rw partition read-only. */
                reiserfs_prepare_for_journal(s, SB_BUFFER_WITH_SB(s), 1);
@@ -1416,7 +1424,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
                if (reiserfs_is_journal_aborted(journal)) {
                        err = journal->j_errno;
-                        goto out_err;
+                        goto out_unlock;
                }
                handle_data_mode(s, mount_options);
@@ -1425,7 +1433,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
                s->s_flags &= ~MS_RDONLY;       /* now it is safe to call journal_begin */
                err = journal_begin(&th, s, 10);
                if (err)
-                        goto out_err;
+                        goto out_unlock;
                /* Mount a partition which is read-only, read-write */
                reiserfs_prepare_for_journal(s, SB_BUFFER_WITH_SB(s), 1);
@@ -1442,10 +1450,16 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
        SB_JOURNAL(s)->j_must_wait = 1;
        err = journal_end(&th, s, 10);
        if (err)
-                goto out_err;
+                goto out_unlock;
        if (!(*mount_flags & MS_RDONLY)) {
+                /*
+                 * Drop write lock. Quota will retake it when needed and lock
+                 * ordering requires calling dquot_resume() without it.
+                 */
+                reiserfs_write_unlock(s);
                dquot_resume(s, -1);
+                reiserfs_write_lock(s);
                finish_unfinished(s);
                reiserfs_xattr_init(s, *mount_flags);
        }
@@ -1455,9 +1469,10 @@ out_ok:
        reiserfs_write_unlock(s);
        return 0;
+out_unlock:
+        reiserfs_write_unlock(s);
 out_err:
        kfree(new_opts);
-        reiserfs_write_unlock(s);
        return err;
 }
@@ -2095,13 +2110,15 @@ static int reiserfs_write_dquot(struct dquot *dquot)
                          REISERFS_QUOTA_TRANS_BLOCKS(dquot->dq_sb));
        if (ret)
                goto out;
+        reiserfs_write_unlock(dquot->dq_sb);
        ret = dquot_commit(dquot);
+        reiserfs_write_lock(dquot->dq_sb);
        err =
            journal_end(&th, dquot->dq_sb,
                        REISERFS_QUOTA_TRANS_BLOCKS(dquot->dq_sb));
        if (!ret && err)
                ret = err;
-      out:
+out:
        reiserfs_write_unlock(dquot->dq_sb);
        return ret;
 }
@@ -2117,13 +2134,15 @@ static int reiserfs_acquire_dquot(struct dquot *dquot)
                          REISERFS_QUOTA_INIT_BLOCKS(dquot->dq_sb));
        if (ret)
                goto out;
+        reiserfs_write_unlock(dquot->dq_sb);
        ret = dquot_acquire(dquot);
+        reiserfs_write_lock(dquot->dq_sb);
        err =
            journal_end(&th, dquot->dq_sb,
                        REISERFS_QUOTA_INIT_BLOCKS(dquot->dq_sb));
        if (!ret && err)
                ret = err;
-      out:
+out:
        reiserfs_write_unlock(dquot->dq_sb);
        return ret;
 }
@@ -2137,19 +2156,21 @@ static int reiserfs_release_dquot(struct dquot *dquot)
        ret =
            journal_begin(&th, dquot->dq_sb,
                          REISERFS_QUOTA_DEL_BLOCKS(dquot->dq_sb));
+        reiserfs_write_unlock(dquot->dq_sb);
        if (ret) {
                /* Release dquot anyway to avoid endless cycle in dqput() */
                dquot_release(dquot);
                goto out;
        }
        ret = dquot_release(dquot);
+        reiserfs_write_lock(dquot->dq_sb);
        err =
            journal_end(&th, dquot->dq_sb,
                        REISERFS_QUOTA_DEL_BLOCKS(dquot->dq_sb));
        if (!ret && err)
                ret = err;
-      out:
        reiserfs_write_unlock(dquot->dq_sb);
+out:
        return ret;
 }
@@ -2174,11 +2195,13 @@ static int reiserfs_write_info(struct super_block *sb, int type)
        ret = journal_begin(&th, sb, 2);
        if (ret)
                goto out;
+        reiserfs_write_unlock(sb);
        ret = dquot_commit_info(sb, type);
+        reiserfs_write_lock(sb);
        err = journal_end(&th, sb, 2);
        if (!ret && err)
                ret = err;
-      out:
+out:
        reiserfs_write_unlock(sb);
        return ret;
 }
@@ -2203,8 +2226,11 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
        struct reiserfs_transaction_handle th;
        int opt = type == USRQUOTA ? REISERFS_USRQUOTA : REISERFS_GRPQUOTA;
-        if (!(REISERFS_SB(sb)->s_mount_opt & (1 << opt)))
+        reiserfs_write_lock(sb);
-                return -EINVAL;
+        if (!(REISERFS_SB(sb)->s_mount_opt & (1 << opt))) {
+                err = -EINVAL;
+                goto out;
+        }
        /* Quotafile not on the same filesystem? */
        if (path->dentry->d_sb != sb) {
@@ -2246,8 +2272,10 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
                if (err)
                        goto out;
        }
-        err = dquot_quota_on(sb, type, format_id, path);
+        reiserfs_write_unlock(sb);
+        return dquot_quota_on(sb, type, format_id, path);
 out:
+        reiserfs_write_unlock(sb);
        return err;
 }
@@ -2320,7 +2348,9 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
                tocopy = sb->s_blocksize - offset < towrite ?
                    sb->s_blocksize - offset : towrite;
                tmp_bh.b_state = 0;
+                reiserfs_write_lock(sb);
                err = reiserfs_get_block(inode, blk, &tmp_bh, GET_BLOCK_CREATE);
+                reiserfs_write_unlock(sb);
                if (err)
                        goto out;
                if (offset || tocopy != sb->s_blocksize)
@@ -2336,10 +2366,12 @@ static ssize_t reiserfs_quota_write(struct super_block *sb, int type,
                flush_dcache_page(bh->b_page);
                set_buffer_uptodate(bh);
                unlock_buffer(bh);
+                reiserfs_write_lock(sb);
                reiserfs_prepare_for_journal(sb, bh, 1);
                journal_mark_dirty(current->journal_info, sb, bh);
                if (!journal_quota)
                        reiserfs_add_ordered_list(inode, bh);
+                reiserfs_write_unlock(sb);
                brelse(bh);
                offset = 0;
                towrite -= tocopy;
diff --git a/fs/ubifs/find.c b/fs/ubifs/find.c
index 28ec13af28d9..2dcf3d473fec 100644
--- a/fs/ubifs/find.c
+++ b/fs/ubifs/find.c
@@ -681,8 +681,16 @@ int ubifs_find_free_leb_for_idx(struct ubifs_info *c)
        if (!lprops) {
                lprops = ubifs_fast_find_freeable(c);
                if (!lprops) {
-                        ubifs_assert(c->freeable_cnt == 0);
+                        /*
-                        if (c->lst.empty_lebs - c->lst.taken_empty_lebs > 0) {
+                         * The first condition means the following: go scan the
+                         * LPT if there are uncategorized lprops, which means
+                         * there may be freeable LEBs there (UBIFS does not
+                         * store the information about freeable LEBs in the
+                         * master node).
+                         */
+                        if (c->in_a_category_cnt != c->main_lebs ||
+                            c->lst.empty_lebs - c->lst.taken_empty_lebs > 0) {
+                                ubifs_assert(c->freeable_cnt == 0);
                                lprops = scan_for_leb_for_idx(c);
                                if (IS_ERR(lprops)) {
                                        err = PTR_ERR(lprops);
diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
index e5a2a35a46dc..46190a7c42a6 100644
--- a/fs/ubifs/lprops.c
+++ b/fs/ubifs/lprops.c
@@ -300,8 +300,11 @@ void ubifs_add_to_cat(struct ubifs_info *c, struct ubifs_lprops *lprops,
        default:
                ubifs_assert(0);
        }
        lprops->flags &= ~LPROPS_CAT_MASK;
        lprops->flags |= cat;
+        c->in_a_category_cnt += 1;
+        ubifs_assert(c->in_a_category_cnt <= c->main_lebs);
 }
 /**
@@ -334,6 +337,9 @@ static void ubifs_remove_from_cat(struct ubifs_info *c,
        default:
                ubifs_assert(0);
        }
+        c->in_a_category_cnt -= 1;
+        ubifs_assert(c->in_a_category_cnt >= 0);
 }
 /**
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 5486346d0a3f..d133c276fe05 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -1183,6 +1183,8 @@ struct ubifs_debug_info;
 * @freeable_list: list of freeable non-index LEBs (free + dirty == @leb_size)
 * @frdi_idx_list: list of freeable index LEBs (free + dirty == @leb_size)
 * @freeable_cnt: number of freeable LEBs in @freeable_list
+ * @in_a_category_cnt: count of lprops which are in a certain category, which
+ *                     basically meants that they were loaded from the flash
 *
 * @ltab_lnum: LEB number of LPT's own lprops table
 * @ltab_offs: offset of LPT's own lprops table
@@ -1412,6 +1414,7 @@ struct ubifs_info {
        struct list_head freeable_list;
        struct list_head frdi_idx_list;
        int freeable_cnt;
+        int in_a_category_cnt;
        int ltab_lnum;
        int ltab_offs;
diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
index e562dd43f41f..e57e2daa357c 100644
--- a/fs/xfs/xfs_aops.c
+++ b/fs/xfs/xfs_aops.c
@@ -481,11 +481,17 @@ static inline int bio_add_buffer(struct bio *bio, struct buffer_head *bh)
 *
 * The fix is two passes across the ioend list - one to start writeback on the
 * buffer_heads, and then submit them for I/O on the second pass.
+ *
+ * If @fail is non-zero, it means that we have a situation where some part of
+ * the submission process has failed after we have marked paged for writeback
+ * and unlocked them. In this situation, we need to fail the ioend chain rather
+ * than submit it to IO. This typically only happens on a filesystem shutdown.
 */
 STATIC void
 xfs_submit_ioend(
        struct writeback_control *wbc,
-        xfs_ioend_t             *ioend)
+        xfs_ioend_t             *ioend,
+        int                     fail)
 {
        xfs_ioend_t             *head = ioend;
        xfs_ioend_t             *next;
@@ -506,6 +512,18 @@ xfs_submit_ioend(
                next = ioend->io_list;
                bio = NULL;
+                /*
+                 * If we are failing the IO now, just mark the ioend with an
+                 * error and finish it. This will run IO completion immediately
+                 * as there is only one reference to the ioend at this point in
+                 * time.
+                 */
+                if (fail) {
+                        ioend->io_error = -fail;
+                        xfs_finish_ioend(ioend);
+                        continue;
+                }
                for (bh = ioend->io_buffer_head; bh; bh = bh->b_private) {
                        if (!bio) {
@@ -1060,7 +1078,18 @@ xfs_vm_writepage(
        xfs_start_page_writeback(page, 1, count);
-        if (ioend && imap_valid) {
+        /* if there is no IO to be submitted for this page, we are done */
+        if (!ioend)
+                return 0;
+        ASSERT(iohead);
+        /*
+         * Any errors from this point onwards need tobe reported through the IO
+         * completion path as we have marked the initial page as under writeback
+         * and unlocked it.
+         */
+        if (imap_valid) {
                xfs_off_t               end_index;
                end_index = imap.br_startoff + imap.br_blockcount;
@@ -1079,20 +1108,15 @@ xfs_vm_writepage(
                                  wbc, end_index);
        }
-        if (iohead) {
-                /*
-                 * Reserve log space if we might write beyond the on-disk
-                 * inode size.
-                 */
-                if (ioend->io_type != XFS_IO_UNWRITTEN &&
-                    xfs_ioend_is_append(ioend)) {
-                        err = xfs_setfilesize_trans_alloc(ioend);
-                        if (err)
-                                goto error;
-                }
-                xfs_submit_ioend(wbc, iohead);
+        /*
-        }
+         * Reserve log space if we might write beyond the on-disk inode size.
+         */
+        err = 0;
+        if (ioend->io_type != XFS_IO_UNWRITTEN && xfs_ioend_is_append(ioend))
+                err = xfs_setfilesize_trans_alloc(ioend);
+        xfs_submit_ioend(wbc, iohead, err);
        return 0;
diff --git a/fs/xfs/xfs_attr_leaf.c b/fs/xfs/xfs_attr_leaf.c
index d330111ca738..70eec1829776 100644
--- a/fs/xfs/xfs_attr_leaf.c
+++ b/fs/xfs/xfs_attr_leaf.c
@@ -1291,6 +1291,7 @@ xfs_attr_leaf_rebalance(xfs_da_state_t *state, xfs_da_state_blk_t *blk1,
        leaf2 = blk2->bp->b_addr;
        ASSERT(leaf1->hdr.info.magic == cpu_to_be16(XFS_ATTR_LEAF_MAGIC));
        ASSERT(leaf2->hdr.info.magic == cpu_to_be16(XFS_ATTR_LEAF_MAGIC));
+        ASSERT(leaf2->hdr.count == 0);
        args = state->args;
        trace_xfs_attr_leaf_rebalance(args);
@@ -1361,6 +1362,7 @@ xfs_attr_leaf_rebalance(xfs_da_state_t *state, xfs_da_state_blk_t *blk1,
                 * I assert that since all callers pass in an empty
                 * second buffer, this code should never execute.
                 */
+                ASSERT(0);
                /*
                 * Figure the total bytes to be added to the destination leaf.
@@ -1422,10 +1424,24 @@ xfs_attr_leaf_rebalance(xfs_da_state_t *state, xfs_da_state_blk_t *blk1,
                        args->index2 = 0;
                        args->blkno2 = blk2->blkno;
                } else {
+                        /*
+                         * On a double leaf split, the original attr location
+                         * is already stored in blkno2/index2, so don't
+                         * overwrite it overwise we corrupt the tree.
+                         */
                        blk2->index = blk1->index
                                    - be16_to_cpu(leaf1->hdr.count);
-                        args->index = args->index2 = blk2->index;
+                        args->index = blk2->index;
-                        args->blkno = args->blkno2 = blk2->blkno;
+                        args->blkno = blk2->blkno;
+                        if (!state->extravalid) {
+                                /*
+                                 * set the new attr location to match the old
+                                 * one and let the higher level split code
+                                 * decide where in the leaf to place it.
+                                 */
+                                args->index2 = blk2->index;
+                                args->blkno2 = blk2->blkno;
+                        }
                }
        } else {
                ASSERT(state->inleaf == 1);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 933b7930b863..4b0b8dd1b7b0 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -1197,9 +1197,14 @@ xfs_buf_bio_end_io(
 {
        xfs_buf_t               *bp = (xfs_buf_t *)bio->bi_private;
-        xfs_buf_ioerror(bp, -error);
+        /*
+         * don't overwrite existing errors - otherwise we can lose errors on
+         * buffers that require multiple bios to complete.
+         */
+        if (!bp->b_error)
+                xfs_buf_ioerror(bp, -error);
-        if (!error && xfs_buf_is_vmapped(bp) && (bp->b_flags & XBF_READ))
+        if (!bp->b_error && xfs_buf_is_vmapped(bp) && (bp->b_flags & XBF_READ))
                invalidate_kernel_vmap_range(bp->b_addr, xfs_buf_vmap_len(bp));
        _xfs_buf_ioend(bp, 1);
@@ -1279,6 +1284,11 @@ next_chunk:
                if (size)
                        goto next_chunk;
        } else {
+                /*
+                 * This is guaranteed not to be the last io reference count
+                 * because the caller (xfs_buf_iorequest) holds a count itself.
+                 */
+                atomic_dec(&bp->b_io_remaining);
                xfs_buf_ioerror(bp, EIO);
                bio_put(bio);
        }
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index af1cbaf535ed..c5c35e629426 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -210,6 +210,7 @@
        {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x679B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x679E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x679F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6800, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index c12731582920..f9f5e9eeb9dd 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -335,8 +335,8 @@ const char *__clk_get_name(struct clk *clk);
 struct clk_hw *__clk_get_hw(struct clk *clk);
 u8 __clk_get_num_parents(struct clk *clk);
 struct clk *__clk_get_parent(struct clk *clk);
-inline int __clk_get_enable_count(struct clk *clk);
+int __clk_get_enable_count(struct clk *clk);
-inline int __clk_get_prepare_count(struct clk *clk);
+int __clk_get_prepare_count(struct clk *clk);
 unsigned long __clk_get_rate(struct clk *clk);
 unsigned long __clk_get_flags(struct clk *clk);
 int __clk_is_enabled(struct clk *clk);
diff --git a/include/linux/i2c-omap.h b/include/linux/i2c-omap.h
index df804ba73e0b..92a0dc75bc74 100644
--- a/include/linux/i2c-omap.h
+++ b/include/linux/i2c-omap.h
@@ -34,6 +34,7 @@ struct omap_i2c_bus_platform_data {
        u32             clkrate;
        u32             rev;
        u32             flags;
+        void            (*set_mpu_wkup_lat)(struct device *dev, long set);
 };
 #endif
diff --git a/include/linux/mm.h b/include/linux/mm.h
index fa0680402738..bcaab4e6fe91 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1684,9 +1684,5 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
 static inline bool page_is_guard(struct page *page) { return false; }
 #endif /* CONFIG_DEBUG_PAGEALLOC */
-extern void reset_zone_present_pages(void);
-extern void fixup_zone_present_pages(int nid, unsigned long start_pfn,
-                                unsigned long end_pfn);
 #endif /* __KERNEL__ */
 #endif /* _LINUX_MM_H */
diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h
index 50aaca81f63d..a23923ba8263 100644
--- a/include/linux/mmzone.h
+++ b/include/linux/mmzone.h
@@ -752,7 +752,7 @@ extern int init_currently_empty_zone(struct zone *zone, unsigned long start_pfn,
                                     unsigned long size,
                                     enum memmap_context context);
-extern void lruvec_init(struct lruvec *lruvec, struct zone *zone);
+extern void lruvec_init(struct lruvec *lruvec);
 static inline struct zone *lruvec_zone(struct lruvec *lruvec)
 {
diff --git a/include/linux/of_address.h b/include/linux/of_address.h
index e20e3af68fb6..0506eb53519b 100644
--- a/include/linux/of_address.h
+++ b/include/linux/of_address.h
@@ -42,10 +42,12 @@ static inline struct device_node *of_find_matching_node_by_address(
 {
        return NULL;
 }
+#ifndef of_iomap
 static inline void __iomem *of_iomap(struct device_node *device, int index)
 {
        return NULL;
 }
+#endif
 static inline const __be32 *of_get_address(struct device_node *dev, int index,
                                        u64 *size, unsigned int *flags)
 {
diff --git a/include/linux/platform_data/omap_ocp2scp.h b/include/linux/platform_data/omap_ocp2scp.h
new file mode 100644
index 000000000000..5c6c3939355f
--- /dev/null
+++ b/include/linux/platform_data/omap_ocp2scp.h
@@ -0,0 +1,31 @@
+/*
+ * omap_ocp2scp.h -- ocp2scp header file
+ *
+ * Copyright (C) 2012 Texas Instruments Incorporated - http://www.ti.com
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Author: Kishon Vijay Abraham I <kishon@ti.com>
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+#ifndef __DRIVERS_OMAP_OCP2SCP_H
+#define __DRIVERS_OMAP_OCP2SCP_H
+struct omap_ocp2scp_dev {
+        const char                      *drv_name;
+        struct resource                 *res;
+};
+struct omap_ocp2scp_platform_data {
+        int                             dev_cnt;
+        struct omap_ocp2scp_dev         **devices;
+};
+#endif /* __DRIVERS_OMAP_OCP2SCP_H */
diff --git a/include/linux/rio.h b/include/linux/rio.h
index 4187da511006..a3e784278667 100644
--- a/include/linux/rio.h
+++ b/include/linux/rio.h
@@ -275,9 +275,11 @@ struct rio_id_table {
 * struct rio_net - RIO network info
 * @node: Node in global list of RIO networks
 * @devices: List of devices in this network
+ * @switches: List of switches in this netowrk
 * @mports: List of master ports accessing this network
 * @hport: Default port for accessing this network
 * @id: RIO network ID
+ * @destid_table: destID allocation table
 */
 struct rio_net {
        struct list_head node;  /* node in list of networks */
diff --git a/include/linux/spi/ads7846.h b/include/linux/spi/ads7846.h
index c64de9dd7631..2f694f3846a9 100644
--- a/include/linux/spi/ads7846.h
+++ b/include/linux/spi/ads7846.h
@@ -46,8 +46,9 @@ struct ads7846_platform_data {
        u16     debounce_rep;           /* additional consecutive good readings
                                         * required after the first two */
        int     gpio_pendown;           /* the GPIO used to decide the pendown
-                                         * state if get_pendown_state == NULL
+                                         * state if get_pendown_state == NULL */
-                                         */
+        int     gpio_pendown_debounce;  /* platform specific debounce time for
+                                         * the gpio_pendown */
        int     (*get_pendown_state)(void);
        int     (*filter_init)  (const struct ads7846_platform_data *pdata,
                                 void **filter_data);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 6f0ba01afe73..63445ede48bb 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1351,7 +1351,7 @@ struct xfrm6_tunnel {
 };
 extern void xfrm_init(void);
-extern void xfrm4_init(int rt_hash_size);
+extern void xfrm4_init(void);
 extern int xfrm_state_init(struct net *net);
 extern void xfrm_state_fini(struct net *net);
 extern void xfrm4_state_init(void);
diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
index 88fae8d20154..55367b04dc94 100644
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -135,6 +135,8 @@ struct scsi_device {
                                     * because we did a bus reset. */
        unsigned use_10_for_rw:1; /* first try 10-byte read / write */
        unsigned use_10_for_ms:1; /* first try 10-byte mode sense/select */
+        unsigned no_report_opcodes:1;   /* no REPORT SUPPORTED OPERATION CODES */
+        unsigned no_write_same:1;       /* no WRITE SAME command */
        unsigned skip_ms_page_8:1;      /* do not use MODE SENSE page 0x08 */
        unsigned skip_ms_page_3f:1;     /* do not use MODE SENSE page 0x3f */
        unsigned skip_vpd_pages:1;      /* do not read VPD pages */
@@ -362,6 +364,8 @@ extern int scsi_test_unit_ready(struct scsi_device *sdev, int timeout,
                                int retries, struct scsi_sense_hdr *sshdr);
 extern int scsi_get_vpd_page(struct scsi_device *, u8 page, unsigned char *buf,
                             int buf_len);
+extern int scsi_report_opcode(struct scsi_device *sdev, unsigned char *buffer,
+                              unsigned int len, unsigned char opcode);
 extern int scsi_device_set_state(struct scsi_device *sdev,
                                 enum scsi_device_state state);
 extern struct scsi_event *sdev_evt_alloc(enum scsi_device_event evt_type,
diff --git a/include/uapi/linux/oom.h b/include/uapi/linux/oom.h
index a49c4afc7060..b29272d621ce 100644
--- a/include/uapi/linux/oom.h
+++ b/include/uapi/linux/oom.h
@@ -8,4 +8,13 @@
 #define OOM_SCORE_ADJ_MIN       (-1000)
 #define OOM_SCORE_ADJ_MAX       1000
+/*
+ * /proc/<pid>/oom_adj set to -17 protects from the oom killer for legacy
+ * purposes.
+ */
+#define OOM_DISABLE (-17)
+/* inclusive */
+#define OOM_ADJUST_MIN (-16)
+#define OOM_ADJUST_MAX 15
 #endif /* _UAPI__INCLUDE_LINUX_OOM_H */
diff --git a/kernel/futex.c b/kernel/futex.c
index 3717e7b306e0..20ef219bbe9b 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -716,7 +716,7 @@ static int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
                                struct futex_pi_state **ps,
                                struct task_struct *task, int set_waiters)
 {
-        int lock_taken, ret, ownerdied = 0;
+        int lock_taken, ret, force_take = 0;
        u32 uval, newval, curval, vpid = task_pid_vnr(task);
 retry:
@@ -755,17 +755,15 @@ retry:
        newval = curval | FUTEX_WAITERS;
        /*
-         * There are two cases, where a futex might have no owner (the
+         * Should we force take the futex? See below.
-         * owner TID is 0): OWNER_DIED. We take over the futex in this
-         * case. We also do an unconditional take over, when the owner
-         * of the futex died.
-         *
-         * This is safe as we are protected by the hash bucket lock !
         */
-        if (unlikely(ownerdied || !(curval & FUTEX_TID_MASK))) {
+        if (unlikely(force_take)) {
-                /* Keep the OWNER_DIED bit */
+                /*
+                 * Keep the OWNER_DIED and the WAITERS bit and set the
+                 * new TID value.
+                 */
                newval = (curval & ~FUTEX_TID_MASK) | vpid;
-                ownerdied = 0;
+                force_take = 0;
                lock_taken = 1;
        }
@@ -775,7 +773,7 @@ retry:
                goto retry;
        /*
-         * We took the lock due to owner died take over.
+         * We took the lock due to forced take over.
         */
        if (unlikely(lock_taken))
                return 1;
@@ -790,20 +788,25 @@ retry:
                switch (ret) {
                case -ESRCH:
                        /*
-                         * No owner found for this futex. Check if the
+                         * We failed to find an owner for this
-                         * OWNER_DIED bit is set to figure out whether
+                         * futex. So we have no pi_state to block
-                         * this is a robust futex or not.
+                         * on. This can happen in two cases:
+                         *
+                         * 1) The owner died
+                         * 2) A stale FUTEX_WAITERS bit
+                         *
+                         * Re-read the futex value.
                         */
                        if (get_futex_value_locked(&curval, uaddr))
                                return -EFAULT;
                        /*
-                         * We simply start over in case of a robust
+                         * If the owner died or we have a stale
-                         * futex. The code above will take the futex
+                         * WAITERS bit the owner TID in the user space
-                         * and return happy.
+                         * futex is 0.
                         */
-                        if (curval & FUTEX_OWNER_DIED) {
+                        if (!(curval & FUTEX_TID_MASK)) {
-                                ownerdied = 1;
+                                force_take = 1;
                                goto retry;
                        }
                default:
diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
index 678ce4f1e124..095ab157a521 100644
--- a/lib/mpi/longlong.h
+++ b/lib/mpi/longlong.h
@@ -641,7 +641,14 @@ do { \
        **************  MIPS  *****************
        ***************************************/
 #if defined(__mips__) && W_TYPE_SIZE == 32
-#if __GNUC__ > 2 || __GNUC_MINOR__ >= 7
+#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
+#define umul_ppmm(w1, w0, u, v)                 \
+do {                                            \
+        UDItype __ll = (UDItype)(u) * (v);      \
+        w1 = __ll >> 32;                        \
+        w0 = __ll;                              \
+} while (0)
+#elif __GNUC__ > 2 || __GNUC_MINOR__ >= 7
 #define umul_ppmm(w1, w0, u, v) \
        __asm__ ("multu %2,%3" \
        : "=l" ((USItype)(w0)), \
@@ -666,7 +673,15 @@ do { \
        **************  MIPS/64  **************
        ***************************************/
 #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
-#if __GNUC__ > 2 || __GNUC_MINOR__ >= 7
+#if __GNUC__ >= 4 && __GNUC_MINOR__ >= 4
+#define umul_ppmm(w1, w0, u, v) \
+do {                                                                    \
+        typedef unsigned int __ll_UTItype __attribute__((mode(TI)));    \
+        __ll_UTItype __ll = (__ll_UTItype)(u) * (v);                    \
+        w1 = __ll >> 64;                                                \
+        w0 = __ll;                                                      \
+} while (0)
+#elif __GNUC__ > 2 || __GNUC_MINOR__ >= 7
 #define umul_ppmm(w1, w0, u, v) \
        __asm__ ("dmultu %2,%3" \
        : "=l" ((UDItype)(w0)), \
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 434be4ae7a04..f468185b3b28 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -198,8 +198,6 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
                        int order = ilog2(BITS_PER_LONG);
                        __free_pages_bootmem(pfn_to_page(start), order);
-                        fixup_zone_present_pages(page_to_nid(pfn_to_page(start)),
-                                        start, start + BITS_PER_LONG);
                        count += BITS_PER_LONG;
                        start += BITS_PER_LONG;
                } else {
@@ -210,9 +208,6 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
                                if (vec & 1) {
                                        page = pfn_to_page(start + off);
                                        __free_pages_bootmem(page, 0);
-                                        fixup_zone_present_pages(
-                                                page_to_nid(page),
-                                                start + off, start + off + 1);
                                        count++;
                                }
                                vec >>= 1;
@@ -226,11 +221,8 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
        pages = bdata->node_low_pfn - bdata->node_min_pfn;
        pages = bootmem_bootmap_pages(pages);
        count += pages;
-        while (pages--) {
+        while (pages--)
-                fixup_zone_present_pages(page_to_nid(page),
-                                page_to_pfn(page), page_to_pfn(page) + 1);
                __free_pages_bootmem(page++, 0);
-        }
        bdebug("nid=%td released=%lx\n", bdata - bootmem_node_data, count);
diff --git a/mm/highmem.c b/mm/highmem.c
index d517cd16a6eb..2da13a5c50e2 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -98,7 +98,7 @@ struct page *kmap_to_page(void *vaddr)
 {
        unsigned long addr = (unsigned long)vaddr;
-        if (addr >= PKMAP_ADDR(0) && addr <= PKMAP_ADDR(LAST_PKMAP)) {
+        if (addr >= PKMAP_ADDR(0) && addr < PKMAP_ADDR(LAST_PKMAP)) {
                int i = (addr - PKMAP_ADDR(0)) >> PAGE_SHIFT;
                return pte_page(pkmap_page_table[i]);
        }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 7acf43bf04a2..dd39ba000b31 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1055,12 +1055,24 @@ struct lruvec *mem_cgroup_zone_lruvec(struct zone *zone,
                                      struct mem_cgroup *memcg)
 {
        struct mem_cgroup_per_zone *mz;
+        struct lruvec *lruvec;
-        if (mem_cgroup_disabled())
+        if (mem_cgroup_disabled()) {
-                return &zone->lruvec;
+                lruvec = &zone->lruvec;
+                goto out;
+        }
        mz = mem_cgroup_zoneinfo(memcg, zone_to_nid(zone), zone_idx(zone));
-        return &mz->lruvec;
+        lruvec = &mz->lruvec;
+out:
+        /*
+         * Since a node can be onlined after the mem_cgroup was created,
+         * we have to be prepared to initialize lruvec->zone here;
+         * and if offlined then reonlined, we need to reinitialize it.
+         */
+        if (unlikely(lruvec->zone != zone))
+                lruvec->zone = zone;
+        return lruvec;
 }
 /*
@@ -1087,9 +1099,12 @@ struct lruvec *mem_cgroup_page_lruvec(struct page *page, struct zone *zone)
        struct mem_cgroup_per_zone *mz;
        struct mem_cgroup *memcg;
        struct page_cgroup *pc;
+        struct lruvec *lruvec;
-        if (mem_cgroup_disabled())
+        if (mem_cgroup_disabled()) {
-                return &zone->lruvec;
+                lruvec = &zone->lruvec;
+                goto out;
+        }
        pc = lookup_page_cgroup(page);
        memcg = pc->mem_cgroup;
@@ -1107,7 +1122,16 @@ struct lruvec *mem_cgroup_page_lruvec(struct page *page, struct zone *zone)
                pc->mem_cgroup = memcg = root_mem_cgroup;
        mz = page_cgroup_zoneinfo(memcg, page);
-        return &mz->lruvec;
+        lruvec = &mz->lruvec;
+out:
+        /*
+         * Since a node can be onlined after the mem_cgroup was created,
+         * we have to be prepared to initialize lruvec->zone here;
+         * and if offlined then reonlined, we need to reinitialize it.
+         */
+        if (unlikely(lruvec->zone != zone))
+                lruvec->zone = zone;
+        return lruvec;
 }
 /**
@@ -1452,17 +1476,26 @@ static int mem_cgroup_count_children(struct mem_cgroup *memcg)
 static u64 mem_cgroup_get_limit(struct mem_cgroup *memcg)
 {
        u64 limit;
-        u64 memsw;
        limit = res_counter_read_u64(&memcg->res, RES_LIMIT);
-        limit += total_swap_pages << PAGE_SHIFT;
-        memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
        /*
-         * If memsw is finite and limits the amount of swap space available
+         * Do not consider swap space if we cannot swap due to swappiness
-         * to this memcg, return that limit.
         */
-        return min(limit, memsw);
+        if (mem_cgroup_swappiness(memcg)) {
+                u64 memsw;
+                limit += total_swap_pages << PAGE_SHIFT;
+                memsw = res_counter_read_u64(&memcg->memsw, RES_LIMIT);
+                /*
+                 * If memsw is finite and limits the amount of swap space
+                 * available to this memcg, return that limit.
+                 */
+                limit = min(limit, memsw);
+        }
+        return limit;
 }
 void mem_cgroup_out_of_memory(struct mem_cgroup *memcg, gfp_t gfp_mask,
@@ -3688,17 +3721,17 @@ unsigned long mem_cgroup_soft_limit_reclaim(struct zone *zone, int order,
 static bool mem_cgroup_force_empty_list(struct mem_cgroup *memcg,
                                int node, int zid, enum lru_list lru)
 {
-        struct mem_cgroup_per_zone *mz;
+        struct lruvec *lruvec;
        unsigned long flags, loop;
        struct list_head *list;
        struct page *busy;
        struct zone *zone;
        zone = &NODE_DATA(node)->node_zones[zid];
-        mz = mem_cgroup_zoneinfo(memcg, node, zid);
+        lruvec = mem_cgroup_zone_lruvec(zone, memcg);
-        list = &mz->lruvec.lists[lru];
+        list = &lruvec->lists[lru];
-        loop = mz->lru_size[lru];
+        loop = mem_cgroup_get_lru_size(lruvec, lru);
        /* give some margin against EBUSY etc...*/
        loop += 256;
        busy = NULL;
@@ -4736,7 +4769,7 @@ static int alloc_mem_cgroup_per_zone_info(struct mem_cgroup *memcg, int node)
        for (zone = 0; zone < MAX_NR_ZONES; zone++) {
                mz = &pn->zoneinfo[zone];
-                lruvec_init(&mz->lruvec, &NODE_DATA(node)->node_zones[zone]);
+                lruvec_init(&mz->lruvec);
                mz->usage_in_excess = 0;
                mz->on_tree = false;
                mz->memcg = memcg;
diff --git a/mm/memory.c b/mm/memory.c
index fb135ba4aba9..221fc9ffcab1 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2527,9 +2527,8 @@ static int do_wp_page(struct mm_struct *mm, struct vm_area_struct *vma,
        int ret = 0;
        int page_mkwrite = 0;
        struct page *dirty_page = NULL;
-        unsigned long mmun_start;       /* For mmu_notifiers */
+        unsigned long mmun_start = 0;   /* For mmu_notifiers */
-        unsigned long mmun_end;         /* For mmu_notifiers */
+        unsigned long mmun_end = 0;     /* For mmu_notifiers */
-        bool mmun_called = false;       /* For mmu_notifiers */
        old_page = vm_normal_page(vma, address, orig_pte);
        if (!old_page) {
@@ -2708,8 +2707,7 @@ gotten:
                goto oom_free_new;
        mmun_start  = address & PAGE_MASK;
-        mmun_end    = (address & PAGE_MASK) + PAGE_SIZE;
+        mmun_end    = mmun_start + PAGE_SIZE;
-        mmun_called = true;
        mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
        /*
@@ -2778,7 +2776,7 @@ gotten:
                page_cache_release(new_page);
 unlock:
        pte_unmap_unlock(page_table, ptl);
-        if (mmun_called)
+        if (mmun_end > mmun_start)
                mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
        if (old_page) {
                /*
diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
index 56b758ae57d2..e4eeacae2b91 100644
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -106,7 +106,6 @@ static void get_page_bootmem(unsigned long info,  struct page *page,
 void __ref put_page_bootmem(struct page *page)
 {
        unsigned long type;
-        struct zone *zone;
        type = (unsigned long) page->lru.next;
        BUG_ON(type < MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE ||
@@ -117,12 +116,6 @@ void __ref put_page_bootmem(struct page *page)
                set_page_private(page, 0);
                INIT_LIST_HEAD(&page->lru);
                __free_pages_bootmem(page, 0);
-                zone = page_zone(page);
-                zone_span_writelock(zone);
-                zone->present_pages++;
-                zone_span_writeunlock(zone);
-                totalram_pages++;
        }
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index 2d942353d681..9a796c41e7d9 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -334,8 +334,10 @@ void validate_mm(struct mm_struct *mm)
        struct vm_area_struct *vma = mm->mmap;
        while (vma) {
                struct anon_vma_chain *avc;
+                vma_lock_anon_vma(vma);
                list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
                        anon_vma_interval_tree_verify(avc);
+                vma_unlock_anon_vma(vma);
                vma = vma->vm_next;
                i++;
        }
diff --git a/mm/mmzone.c b/mm/mmzone.c
index 3cef80f6ac79..4596d81b89b1 100644
--- a/mm/mmzone.c
+++ b/mm/mmzone.c
@@ -87,7 +87,7 @@ int memmap_valid_within(unsigned long pfn,
 }
 #endif /* CONFIG_ARCH_HAS_HOLES_MEMORYMODEL */
-void lruvec_init(struct lruvec *lruvec, struct zone *zone)
+void lruvec_init(struct lruvec *lruvec)
 {
        enum lru_list lru;
@@ -95,8 +95,4 @@ void lruvec_init(struct lruvec *lruvec, struct zone *zone)
        for_each_lru(lru)
                INIT_LIST_HEAD(&lruvec->lists[lru]);
-#ifdef CONFIG_MEMCG
-        lruvec->zone = zone;
-#endif
 }
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index 714d5d650470..bd82f6b31411 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -116,8 +116,6 @@ static unsigned long __init __free_memory_core(phys_addr_t start,
                return 0;
        __free_pages_memory(start_pfn, end_pfn);
-        fixup_zone_present_pages(pfn_to_nid(start >> PAGE_SHIFT),
-                        start_pfn, end_pfn);
        return end_pfn - start_pfn;
 }
@@ -128,7 +126,6 @@ unsigned long __init free_low_memory_core_early(int nodeid)
        phys_addr_t start, end, size;
        u64 i;
-        reset_zone_present_pages();
        for_each_free_mem_range(i, MAX_NUMNODES, &start, &end, NULL)
                count += __free_memory_core(start, end);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 5b74de6702e0..bcb72c6e2b2d 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1405,7 +1405,7 @@ int capture_free_page(struct page *page, int alloc_order, int migratetype)
        mt = get_pageblock_migratetype(page);
        if (unlikely(mt != MIGRATE_ISOLATE))
-                __mod_zone_freepage_state(zone, -(1UL << order), mt);
+                __mod_zone_freepage_state(zone, -(1UL << alloc_order), mt);
        if (alloc_order != order)
                expand(zone, page, alloc_order, order,
@@ -4505,7 +4505,7 @@ static void __paginginit free_area_init_core(struct pglist_data *pgdat,
                zone->zone_pgdat = pgdat;
                zone_pcp_init(zone);
-                lruvec_init(&zone->lruvec, zone);
+                lruvec_init(&zone->lruvec);
                if (!size)
                        continue;
@@ -6098,37 +6098,3 @@ void dump_page(struct page *page)
        dump_page_flags(page->flags);
        mem_cgroup_print_bad_page(page);
 }
-/* reset zone->present_pages */
-void reset_zone_present_pages(void)
-{
-        struct zone *z;
-        int i, nid;
-        for_each_node_state(nid, N_HIGH_MEMORY) {
-                for (i = 0; i < MAX_NR_ZONES; i++) {
-                        z = NODE_DATA(nid)->node_zones + i;
-                        z->present_pages = 0;
-                }
-        }
-}
-/* calculate zone's present pages in buddy system */
-void fixup_zone_present_pages(int nid, unsigned long start_pfn,
-                                unsigned long end_pfn)
-{
-        struct zone *z;
-        unsigned long zone_start_pfn, zone_end_pfn;
-        int i;
-        for (i = 0; i < MAX_NR_ZONES; i++) {
-                z = NODE_DATA(nid)->node_zones + i;
-                zone_start_pfn = z->zone_start_pfn;
-                zone_end_pfn = zone_start_pfn + z->spanned_pages;
-                /* if the two regions intersect */
-                if (!(zone_start_pfn >= end_pfn || zone_end_pfn <= start_pfn))
-                        z->present_pages += min(end_pfn, zone_end_pfn) -
-                                            max(start_pfn, zone_start_pfn);
-        }
-}
diff --git a/mm/shmem.c b/mm/shmem.c
index 67afba5117f2..89341b658bd0 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -643,7 +643,7 @@ static void shmem_evict_inode(struct inode *inode)
                kfree(info->symlink);
        simple_xattrs_free(&info->xattrs);
-        BUG_ON(inode->i_blocks);
+        WARN_ON(inode->i_blocks);
        shmem_free_inode(inode->i_sb);
        clear_inode(inode);
 }
@@ -1145,8 +1145,20 @@ repeat:
                if (!error) {
                        error = shmem_add_to_page_cache(page, mapping, index,
                                                gfp, swp_to_radix_entry(swap));
-                        /* We already confirmed swap, and make no allocation */
+                        /*
-                        VM_BUG_ON(error);
+                         * We already confirmed swap under page lock, and make
+                         * no memory allocation here, so usually no possibility
+                         * of error; but free_swap_and_cache() only trylocks a
+                         * page, so it is just possible that the entry has been
+                         * truncated or holepunched since swap was confirmed.
+                         * shmem_undo_range() will have done some of the
+                         * unaccounting, now delete_from_swap_cache() will do
+                         * the rest (including mem_cgroup_uncharge_swapcache).
+                         * Reset swap.val? No, leave it so "failed" goes back to
+                         * "repeat": reading a hole and writing should succeed.
+                         */
+                        if (error)
+                                delete_from_swap_cache(page);
                }
                if (error)
                        goto failed;
diff --git a/mm/swapfile.c b/mm/swapfile.c
index 71cd288b2001..f91a25547ffe 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1494,9 +1494,8 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
        BUG_ON(!current->mm);
        pathname = getname(specialfile);
-        err = PTR_ERR(pathname);
        if (IS_ERR(pathname))
-                goto out;
+                return PTR_ERR(pathname);
        victim = file_open_name(pathname, O_RDWR|O_LARGEFILE, 0);
        err = PTR_ERR(victim);
@@ -1608,6 +1607,7 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile)
 out_dput:
        filp_close(victim, NULL);
 out:
+        putname(pathname);
        return err;
 }
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 8b055e9379bc..48550c66f1f2 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -1760,28 +1760,6 @@ static bool in_reclaim_compaction(struct scan_control *sc)
        return false;
 }
-#ifdef CONFIG_COMPACTION
-/*
- * If compaction is deferred for sc->order then scale the number of pages
- * reclaimed based on the number of consecutive allocation failures
- */
-static unsigned long scale_for_compaction(unsigned long pages_for_compaction,
-                        struct lruvec *lruvec, struct scan_control *sc)
-{
-        struct zone *zone = lruvec_zone(lruvec);
-        if (zone->compact_order_failed <= sc->order)
-                pages_for_compaction <<= zone->compact_defer_shift;
-        return pages_for_compaction;
-}
-#else
-static unsigned long scale_for_compaction(unsigned long pages_for_compaction,
-                        struct lruvec *lruvec, struct scan_control *sc)
-{
-        return pages_for_compaction;
-}
-#endif
 /*
 * Reclaim/compaction is used for high-order allocation requests. It reclaims
 * order-0 pages before compacting the zone. should_continue_reclaim() returns
@@ -1829,9 +1807,6 @@ static inline bool should_continue_reclaim(struct lruvec *lruvec,
         * inactive lists are large enough, continue reclaiming
         */
        pages_for_compaction = (2UL << sc->order);
-        pages_for_compaction = scale_for_compaction(pages_for_compaction,
-                                                    lruvec, sc);
        inactive_lru_pages = get_lru_size(lruvec, LRU_INACTIVE_FILE);
        if (nr_swap_pages > 0)
                inactive_lru_pages += get_lru_size(lruvec, LRU_INACTIVE_ANON);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index b9a28d2dd3e8..ce0684a1fc83 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -325,6 +325,12 @@ void batadv_interface_rx(struct net_device *soft_iface,
        soft_iface->last_rx = jiffies;
+        /* Let the bridge loop avoidance check the packet. If will
+         * not handle it, we can safely push it up.
+         */
+        if (batadv_bla_rx(bat_priv, skb, vid, is_bcast))
+                goto out;
        if (orig_node)
                batadv_tt_add_temporary_global_entry(bat_priv, orig_node,
                                                     ethhdr->h_source);
@@ -332,12 +338,6 @@ void batadv_interface_rx(struct net_device *soft_iface,
        if (batadv_is_ap_isolated(bat_priv, ethhdr->h_source, ethhdr->h_dest))
                goto dropped;
-        /* Let the bridge loop avoidance check the packet. If will
-         * not handle it, we can safely push it up.
-         */
-        if (batadv_bla_rx(bat_priv, skb, vid, is_bcast))
-                goto out;
        netif_rx(skb);
        goto out;
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 112edd371b2f..baae71585804 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -769,6 +769,12 @@ int batadv_tt_global_add(struct batadv_priv *bat_priv,
                 */
                tt_global_entry->common.flags &= ~BATADV_TT_CLIENT_TEMP;
+                /* the change can carry possible "attribute" flags like the
+                 * TT_CLIENT_WIFI, therefore they have to be copied in the
+                 * client entry
+                 */
+                tt_global_entry->common.flags |= flags;
                /* If there is the BATADV_TT_CLIENT_ROAM flag set, there is only
                 * one originator left in the list and we previously received a
                 * delete + roaming change for this originator.
@@ -1496,7 +1502,7 @@ batadv_tt_response_fill_table(uint16_t tt_len, uint8_t ttvn,
                        memcpy(tt_change->addr, tt_common_entry->addr,
                               ETH_ALEN);
-                        tt_change->flags = BATADV_NO_FLAGS;
+                        tt_change->flags = tt_common_entry->flags;
                        tt_count++;
                        tt_change++;
@@ -2450,6 +2456,13 @@ bool batadv_tt_add_temporary_global_entry(struct batadv_priv *bat_priv,
 {
        bool ret = false;
+        /* if the originator is a backbone node (meaning it belongs to the same
+         * LAN of this node) the temporary client must not be added because to
+         * reach such destination the node must use the LAN instead of the mesh
+         */
+        if (batadv_bla_is_backbone_gw_orig(bat_priv, orig_node->orig))
+                goto out;
        if (!batadv_tt_global_add(bat_priv, orig_node, addr,
                                  BATADV_TT_CLIENT_TEMP,
                                  atomic_read(&orig_node->last_ttvn)))
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 8a0ce706aebd..a0a2f97b9c62 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1754,11 +1754,11 @@ int hci_register_dev(struct hci_dev *hdev)
        if (hdev->dev_type != HCI_AMP)
                set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
-        schedule_work(&hdev->power_on);
        hci_notify(hdev, HCI_DEV_REG);
        hci_dev_hold(hdev);
+        schedule_work(&hdev->power_on);
        return id;
 err_wqueue:
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index aa2ea0a8142c..91de4239da66 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -326,7 +326,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
        struct hci_dev *d;
        size_t rp_len;
        u16 count;
-        int i, err;
+        int err;
        BT_DBG("sock %p", sk);
@@ -347,9 +347,7 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                return -ENOMEM;
        }
-        rp->num_controllers = cpu_to_le16(count);
+        count = 0;
-        i = 0;
        list_for_each_entry(d, &hci_dev_list, list) {
                if (test_bit(HCI_SETUP, &d->dev_flags))
                        continue;
@@ -357,10 +355,13 @@ static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data,
                if (!mgmt_valid_hdev(d))
                        continue;
-                rp->index[i++] = cpu_to_le16(d->id);
+                rp->index[count++] = cpu_to_le16(d->id);
                BT_DBG("Added hci%u", d->id);
        }
+        rp->num_controllers = cpu_to_le16(count);
+        rp_len = sizeof(*rp) + (2 * count);
        read_unlock(&hci_dev_list_lock);
        err = cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 0, rp,
@@ -1366,6 +1367,7 @@ static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data,
                        continue;
                list_del(&match->list);
+                kfree(match);
                found++;
        }
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 2ac8d50861e0..a5923378bdf0 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -267,7 +267,7 @@ static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send)
        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags);
        mgmt_auth_failed(conn->hcon->hdev, conn->dst, hcon->type,
-                         hcon->dst_type, reason);
+                         hcon->dst_type, HCI_ERROR_AUTH_FAILURE);
        cancel_delayed_work_sync(&conn->security_timer);
diff --git a/net/core/dev.c b/net/core/dev.c
index bda6d004f9f0..c0946cb2b354 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2818,8 +2818,10 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
                if (unlikely(tcpu != next_cpu) &&
                    (tcpu == RPS_NO_CPU || !cpu_online(tcpu) ||
                     ((int)(per_cpu(softnet_data, tcpu).input_queue_head -
-                      rflow->last_qtail)) >= 0))
+                      rflow->last_qtail)) >= 0)) {
+                        tcpu = next_cpu;
                        rflow = set_rps_cpu(dev, skb, rflow, next_cpu);
+                }
                if (tcpu != RPS_NO_CPU && cpu_online(tcpu)) {
                        *rflowp = rflow;
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 87cc17db2d56..b079c7bbc157 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -319,7 +319,8 @@ int dev_addr_del(struct net_device *dev, const unsigned char *addr,
         */
        ha = list_first_entry(&dev->dev_addrs.list,
                              struct netdev_hw_addr, list);
-        if (ha->addr == dev->dev_addr && ha->refcount == 1)
+        if (!memcmp(ha->addr, addr, dev->addr_len) &&
+            ha->type == addr_type && ha->refcount == 1)
                return -ENOENT;
        err = __hw_addr_del(&dev->dev_addrs, addr, dev->addr_len,
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index bcf02f608cbf..017a8bacfb27 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -429,6 +429,17 @@ static struct attribute_group netstat_group = {
        .name  = "statistics",
        .attrs  = netstat_attrs,
 };
+#if IS_ENABLED(CONFIG_WIRELESS_EXT) || IS_ENABLED(CONFIG_CFG80211)
+static struct attribute *wireless_attrs[] = {
+        NULL
+};
+static struct attribute_group wireless_group = {
+        .name = "wireless",
+        .attrs = wireless_attrs,
+};
+#endif
 #endif /* CONFIG_SYSFS */
 #ifdef CONFIG_RPS
@@ -1409,6 +1420,15 @@ int netdev_register_kobject(struct net_device *net)
                groups++;
        *groups++ = &netstat_group;
+#if IS_ENABLED(CONFIG_WIRELESS_EXT) || IS_ENABLED(CONFIG_CFG80211)
+        if (net->ieee80211_ptr)
+                *groups++ = &wireless_group;
+#if IS_ENABLED(CONFIG_WIRELESS_EXT)
+        else if (net->wireless_handlers)
+                *groups++ = &wireless_group;
+#endif
+#endif
 #endif /* CONFIG_SYSFS */
        error = device_add(dev);
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 5eea4a811042..14bbfcf717ac 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -457,19 +457,28 @@ static int do_ip_setsockopt(struct sock *sk, int level,
        struct inet_sock *inet = inet_sk(sk);
        int val = 0, err;
-        if (((1<<optname) & ((1<<IP_PKTINFO) | (1<<IP_RECVTTL) |
+        switch (optname) {
-                             (1<<IP_RECVOPTS) | (1<<IP_RECVTOS) |
+        case IP_PKTINFO:
-                             (1<<IP_RETOPTS) | (1<<IP_TOS) |
+        case IP_RECVTTL:
-                             (1<<IP_TTL) | (1<<IP_HDRINCL) |
+        case IP_RECVOPTS:
-                             (1<<IP_MTU_DISCOVER) | (1<<IP_RECVERR) |
+        case IP_RECVTOS:
-                             (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) |
+        case IP_RETOPTS:
-                             (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT) |
+        case IP_TOS:
-                             (1<<IP_MINTTL) | (1<<IP_NODEFRAG))) ||
+        case IP_TTL:
-            optname == IP_UNICAST_IF ||
+        case IP_HDRINCL:
-            optname == IP_MULTICAST_TTL ||
+        case IP_MTU_DISCOVER:
-            optname == IP_MULTICAST_ALL ||
+        case IP_RECVERR:
-            optname == IP_MULTICAST_LOOP ||
+        case IP_ROUTER_ALERT:
-            optname == IP_RECVORIGDSTADDR) {
+        case IP_FREEBIND:
+        case IP_PASSSEC:
+        case IP_TRANSPARENT:
+        case IP_MINTTL:
+        case IP_NODEFRAG:
+        case IP_UNICAST_IF:
+        case IP_MULTICAST_TTL:
+        case IP_MULTICAST_ALL:
+        case IP_MULTICAST_LOOP:
+        case IP_RECVORIGDSTADDR:
                if (optlen >= sizeof(int)) {
                        if (get_user(val, (int __user *) optval))
                                return -EFAULT;
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 1831092f999f..858fddf6482a 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -338,12 +338,17 @@ static int vti_rcv(struct sk_buff *skb)
        if (tunnel != NULL) {
                struct pcpu_tstats *tstats;
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        return -1;
                tstats = this_cpu_ptr(tunnel->dev->tstats);
                u64_stats_update_begin(&tstats->syncp);
                tstats->rx_packets++;
                tstats->rx_bytes += skb->len;
                u64_stats_update_end(&tstats->syncp);
+                skb->mark = 0;
+                secpath_reset(skb);
                skb->dev = tunnel->dev;
                return 1;
        }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a8c651216fa6..df251424d816 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1785,6 +1785,7 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
        if (dev_out->flags & IFF_LOOPBACK)
                flags |= RTCF_LOCAL;
+        do_cache = true;
        if (type == RTN_BROADCAST) {
                flags |= RTCF_BROADCAST | RTCF_LOCAL;
                fi = NULL;
@@ -1793,6 +1794,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
                                     fl4->flowi4_proto))
                        flags &= ~RTCF_LOCAL;
+                else
+                        do_cache = false;
                /* If multicast route do not exist use
                 * default one, but do not gateway in this case.
                 * Yes, it is hack.
@@ -1802,8 +1805,8 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
        }
        fnhe = NULL;
-        do_cache = fi != NULL;
+        do_cache &= fi != NULL;
-        if (fi) {
+        if (do_cache) {
                struct rtable __rcu **prth;
                struct fib_nh *nh = &FIB_RES_NH(*res);
@@ -2597,7 +2600,7 @@ int __init ip_rt_init(void)
                pr_err("Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
        xfrm_init();
-        xfrm4_init(ip_rt_max_size);
+        xfrm4_init();
 #endif
        rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 197c0008503c..083092e3aed6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1212,7 +1212,7 @@ new_segment:
 wait_for_sndbuf:
                        set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
 wait_for_memory:
-                        if (copied && likely(!tp->repair))
+                        if (copied)
                                tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
                        if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
@@ -1223,7 +1223,7 @@ wait_for_memory:
        }
 out:
-        if (copied && likely(!tp->repair))
+        if (copied)
                tcp_push(sk, flags, mss_now, tp->nonagle);
        release_sock(sk);
        return copied + copied_syn;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2c2b13a999ea..609ff98aeb47 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5313,11 +5313,6 @@ static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
                goto discard;
        }
-        /* ts_recent update must be made after we are sure that the packet
-         * is in window.
-         */
-        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
        /* step 3: check security and precedence [ignored] */
        /* step 4: Check for a SYN
@@ -5552,6 +5547,11 @@ step5:
        if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
                goto discard;
+        /* ts_recent update must be made after we are sure that the packet
+         * is in window.
+         */
+        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
        tcp_rcv_rtt_measure_ts(sk, skb);
        /* Process urgent data. */
@@ -6130,6 +6130,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
        } else
                goto discard;
+        /* ts_recent update must be made after we are sure that the packet
+         * is in window.
+         */
+        tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
        /* step 6: check the URG bit */
        tcp_urg(sk, skb, th);
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 53bc5847bfa8..f696d7c2e9fa 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -1,7 +1,6 @@
 #include <linux/rcupdate.h>
 #include <linux/spinlock.h>
 #include <linux/jiffies.h>
-#include <linux/bootmem.h>
 #include <linux/module.h>
 #include <linux/cache.h>
 #include <linux/slab.h>
@@ -9,6 +8,7 @@
 #include <linux/tcp.h>
 #include <linux/hash.h>
 #include <linux/tcp_metrics.h>
+#include <linux/vmalloc.h>
 #include <net/inet_connection_sock.h>
 #include <net/net_namespace.h>
@@ -1034,7 +1034,10 @@ static int __net_init tcp_net_metrics_init(struct net *net)
        net->ipv4.tcp_metrics_hash_log = order_base_2(slots);
        size = sizeof(struct tcpm_hash_bucket) << net->ipv4.tcp_metrics_hash_log;
-        net->ipv4.tcp_metrics_hash = kzalloc(size, GFP_KERNEL);
+        net->ipv4.tcp_metrics_hash = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
+        if (!net->ipv4.tcp_metrics_hash)
+                net->ipv4.tcp_metrics_hash = vzalloc(size);
        if (!net->ipv4.tcp_metrics_hash)
                return -ENOMEM;
@@ -1055,7 +1058,10 @@ static void __net_exit tcp_net_metrics_exit(struct net *net)
                        tm = next;
                }
        }
-        kfree(net->ipv4.tcp_metrics_hash);
+        if (is_vmalloc_addr(net->ipv4.tcp_metrics_hash))
+                vfree(net->ipv4.tcp_metrics_hash);
+        else
+                kfree(net->ipv4.tcp_metrics_hash);
 }
 static __net_initdata struct pernet_operations tcp_net_metrics_ops = {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index cfe6ffe1c177..2798706cb063 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1986,6 +1986,9 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                BUG_ON(!tso_segs);
+                if (unlikely(tp->repair) && tp->repair_queue == TCP_SEND_QUEUE)
+                        goto repair; /* Skip network transmission */
                cwnd_quota = tcp_cwnd_test(tp, skb);
                if (!cwnd_quota)
                        break;
@@ -2026,6 +2029,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                if (unlikely(tcp_transmit_skb(sk, skb, 1, gfp)))
                        break;
+repair:
                /* Advance the send_head.  This one is sent out.
                 * This call will increment packets_out.
                 */
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 05c5ab8d983c..3be0ac2c1920 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -279,19 +279,8 @@ static void __exit xfrm4_policy_fini(void)
        xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 }
-void __init xfrm4_init(int rt_max_size)
+void __init xfrm4_init(void)
 {
-        /*
-         * Select a default value for the gc_thresh based on the main route
-         * table hash size.  It seems to me the worst case scenario is when
-         * we have ipsec operating in transport mode, in which we create a
-         * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
-         * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
-         * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
-         * That will let us store an ipsec connection per route table entry,
-         * and start cleaning when were 1/2 full
-         */
-        xfrm4_dst_ops.gc_thresh = rt_max_size/2;
        dst_entries_init(&xfrm4_dst_ops);
        xfrm4_state_init();
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index c4f934176cab..30647857a375 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -252,6 +252,7 @@ struct dst_entry *inet6_csk_update_pmtu(struct sock *sk, u32 mtu)
                return NULL;
        dst->ops->update_pmtu(dst, sk, NULL, mtu);
-        return inet6_csk_route_socket(sk, &fl6);
+        dst = inet6_csk_route_socket(sk, &fl6);
+        return IS_ERR(dst) ? NULL : dst;
 }
 EXPORT_SYMBOL_GPL(inet6_csk_update_pmtu);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ba6d13d1f1e1..e02faed6d17e 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -827,6 +827,7 @@ pref_skip_coa:
                if (val < 0 || val > 255)
                        goto e_inval;
                np->min_hopcount = val;
+                retv = 0;
                break;
        case IPV6_DONTFRAG:
                np->dontfrag = valbool;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 05f3a313db88..7371f676cf41 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2594,6 +2594,9 @@ static void ieee80211_mgmt_frame_register(struct wiphy *wiphy,
                else
                        local->probe_req_reg--;
+                if (!local->open_count)
+                        break;
                ieee80211_queue_work(&local->hw, &local->reconfig_filter);
                break;
        default:
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index bf87c70ac6c5..c21e33d1abd0 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -1151,10 +1151,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
        mutex_lock(&sdata->u.ibss.mtx);
-        sdata->u.ibss.state = IEEE80211_IBSS_MLME_SEARCH;
-        memset(sdata->u.ibss.bssid, 0, ETH_ALEN);
-        sdata->u.ibss.ssid_len = 0;
        active_ibss = ieee80211_sta_active_ibss(sdata);
        if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
@@ -1175,6 +1171,10 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
                }
        }
+        ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
+        memset(ifibss->bssid, 0, ETH_ALEN);
+        ifibss->ssid_len = 0;
        sta_info_flush(sdata->local, sdata);
        spin_lock_bh(&ifibss->incomplete_lock);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 8c804550465b..156e5835e37f 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1314,6 +1314,8 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
                                         struct net_device *dev);
 netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                                       struct net_device *dev);
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+                              struct sk_buff_head *skbs);
 /* HT */
 void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index c80c4490351c..f57f597972f8 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -871,8 +871,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                                local->hw.wiphy->cipher_suites,
                                sizeof(u32) * local->hw.wiphy->n_cipher_suites,
                                GFP_KERNEL);
-                        if (!suites)
+                        if (!suites) {
-                                return -ENOMEM;
+                                result = -ENOMEM;
+                                goto fail_wiphy_register;
+                        }
                        for (r = 0; r < local->hw.wiphy->n_cipher_suites; r++) {
                                u32 suite = local->hw.wiphy->cipher_suites[r];
                                if (suite == WLAN_CIPHER_SUITE_WEP40 ||
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index c4cdbde24fd3..43e60b5a7546 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -917,7 +917,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
                                       struct cfg80211_sched_scan_request *req)
 {
        struct ieee80211_local *local = sdata->local;
-        struct ieee80211_sched_scan_ies sched_scan_ies;
+        struct ieee80211_sched_scan_ies sched_scan_ies = {};
        int ret, i;
        mutex_lock(&local->mtx);
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 0a4e4c04db89..d2eb64e12353 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -117,8 +117,8 @@ static void free_sta_work(struct work_struct *wk)
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                local->total_ps_buffered -= skb_queue_len(&sta->ps_tx_buf[ac]);
-                __skb_queue_purge(&sta->ps_tx_buf[ac]);
+                ieee80211_purge_tx_queue(&local->hw, &sta->ps_tx_buf[ac]);
-                __skb_queue_purge(&sta->tx_filtered[ac]);
+                ieee80211_purge_tx_queue(&local->hw, &sta->tx_filtered[ac]);
        }
 #ifdef CONFIG_MAC80211_MESH
@@ -141,7 +141,7 @@ static void free_sta_work(struct work_struct *wk)
                tid_tx = rcu_dereference_raw(sta->ampdu_mlme.tid_tx[i]);
                if (!tid_tx)
                        continue;
-                __skb_queue_purge(&tid_tx->pending);
+                ieee80211_purge_tx_queue(&local->hw, &tid_tx->pending);
                kfree(tid_tx);
        }
@@ -961,6 +961,7 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
        struct ieee80211_local *local = sdata->local;
        struct sk_buff_head pending;
        int filtered = 0, buffered = 0, ac;
+        unsigned long flags;
        clear_sta_flag(sta, WLAN_STA_SP);
@@ -976,12 +977,16 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                int count = skb_queue_len(&pending), tmp;
+                spin_lock_irqsave(&sta->tx_filtered[ac].lock, flags);
                skb_queue_splice_tail_init(&sta->tx_filtered[ac], &pending);
+                spin_unlock_irqrestore(&sta->tx_filtered[ac].lock, flags);
                tmp = skb_queue_len(&pending);
                filtered += tmp - count;
                count = tmp;
+                spin_lock_irqsave(&sta->ps_tx_buf[ac].lock, flags);
                skb_queue_splice_tail_init(&sta->ps_tx_buf[ac], &pending);
+                spin_unlock_irqrestore(&sta->ps_tx_buf[ac].lock, flags);
                tmp = skb_queue_len(&pending);
                buffered += tmp - count;
        }
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 3af0cc4130f1..101eb88a2b78 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -668,3 +668,12 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb)
        dev_kfree_skb_any(skb);
 }
 EXPORT_SYMBOL(ieee80211_free_txskb);
+void ieee80211_purge_tx_queue(struct ieee80211_hw *hw,
+                              struct sk_buff_head *skbs)
+{
+        struct sk_buff *skb;
+        while ((skb = __skb_dequeue(skbs)))
+                ieee80211_free_txskb(hw, skb);
+}
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c9bf83f36657..b858ebe41fda 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1358,7 +1358,7 @@ static int invoke_tx_handlers(struct ieee80211_tx_data *tx)
                if (tx->skb)
                        ieee80211_free_txskb(&tx->local->hw, tx->skb);
                else
-                        __skb_queue_purge(&tx->skbs);
+                        ieee80211_purge_tx_queue(&tx->local->hw, &tx->skbs);
                return -1;
        } else if (unlikely(res == TX_QUEUED)) {
                I802_DEBUG_INC(tx->local->tx_handlers_queued);
@@ -2120,10 +2120,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
 */
 void ieee80211_clear_tx_pending(struct ieee80211_local *local)
 {
+        struct sk_buff *skb;
        int i;
-        for (i = 0; i < local->hw.queues; i++)
+        for (i = 0; i < local->hw.queues; i++) {
-                skb_queue_purge(&local->pending[i]);
+                while ((skb = skb_dequeue(&local->pending[i])) != NULL)
+                        ieee80211_free_txskb(&local->hw, skb);
+        }
 }
 /*
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 239391807ca9..0151ae33c4cd 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1491,6 +1491,8 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                list_for_each_entry(sdata, &local->interfaces, list) {
                        if (sdata->vif.type != NL80211_IFTYPE_STATION)
                                continue;
+                        if (!sdata->u.mgd.associated)
+                                continue;
                        ieee80211_send_nullfunc(local, sdata, 0);
                }
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index ec3dba5dcd62..5c0b78528e55 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -173,6 +173,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
                return adtfn(set, &nip, timeout, flags);
        }
+        ip_to = ip;
        if (tb[IPSET_ATTR_IP_TO]) {
                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
                if (ret)
@@ -185,8 +186,7 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (!cidr || cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
                ip_set_mask_from_to(ip, ip_to, cidr);
-        } else
+        }
-                ip_to = ip;
        hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index 0171f7502fa5..6283351f4eeb 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -162,7 +162,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
        const struct ip_set_hash *h = set->data;
        ipset_adtfn adtfn = set->variant->adt[adt];
        struct hash_ipport4_elem data = { };
-        u32 ip, ip_to = 0, p = 0, port, port_to;
+        u32 ip, ip_to, p = 0, port, port_to;
        u32 timeout = h->timeout;
        bool with_ports = false;
        int ret;
@@ -210,7 +210,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
                return ip_set_eexist(ret, flags) ? 0 : ret;
        }
-        ip = ntohl(data.ip);
+        ip_to = ip = ntohl(data.ip);
        if (tb[IPSET_ATTR_IP_TO]) {
                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
                if (ret)
@@ -223,8 +223,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (!cidr || cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
                ip_set_mask_from_to(ip, ip_to, cidr);
-        } else
+        }
-                ip_to = ip;
        port_to = port = ntohs(data.port);
        if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 6344ef551ec8..6a21271c8d5a 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -166,7 +166,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
        const struct ip_set_hash *h = set->data;
        ipset_adtfn adtfn = set->variant->adt[adt];
        struct hash_ipportip4_elem data = { };
-        u32 ip, ip_to = 0, p = 0, port, port_to;
+        u32 ip, ip_to, p = 0, port, port_to;
        u32 timeout = h->timeout;
        bool with_ports = false;
        int ret;
@@ -218,7 +218,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
                return ip_set_eexist(ret, flags) ? 0 : ret;
        }
-        ip = ntohl(data.ip);
+        ip_to = ip = ntohl(data.ip);
        if (tb[IPSET_ATTR_IP_TO]) {
                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
                if (ret)
@@ -231,8 +231,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (!cidr || cidr > 32)
                        return -IPSET_ERR_INVALID_CIDR;
                ip_set_mask_from_to(ip, ip_to, cidr);
-        } else
+        }
-                ip_to = ip;
        port_to = port = ntohs(data.port);
        if (with_ports && tb[IPSET_ATTR_PORT_TO]) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index cb71f9a774e7..2d5cd4ee30eb 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -215,8 +215,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
        const struct ip_set_hash *h = set->data;
        ipset_adtfn adtfn = set->variant->adt[adt];
        struct hash_ipportnet4_elem data = { .cidr = HOST_MASK - 1 };
-        u32 ip, ip_to = 0, p = 0, port, port_to;
+        u32 ip, ip_to, p = 0, port, port_to;
-        u32 ip2_from = 0, ip2_to, ip2_last, ip2;
+        u32 ip2_from, ip2_to, ip2_last, ip2;
        u32 timeout = h->timeout;
        bool with_ports = false;
        u8 cidr;
@@ -286,6 +286,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                return ip_set_eexist(ret, flags) ? 0 : ret;
        }
+        ip_to = ip;
        if (tb[IPSET_ATTR_IP_TO]) {
                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP_TO], &ip_to);
                if (ret)
@@ -306,6 +307,8 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                if (port > port_to)
                        swap(port, port_to);
        }
+        ip2_to = ip2_from;
        if (tb[IPSET_ATTR_IP2_TO]) {
                ret = ip_set_get_hostipaddr4(tb[IPSET_ATTR_IP2_TO], &ip2_to);
                if (ret)
diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
index 8847b4d8be06..701c88a20fea 100644
--- a/net/netfilter/nfnetlink_cttimeout.c
+++ b/net/netfilter/nfnetlink_cttimeout.c
@@ -41,7 +41,8 @@ MODULE_DESCRIPTION("cttimeout: Extended Netfilter Connection Tracking timeout tu
 static LIST_HEAD(cttimeout_list);
 static const struct nla_policy cttimeout_nla_policy[CTA_TIMEOUT_MAX+1] = {
-        [CTA_TIMEOUT_NAME]      = { .type = NLA_NUL_STRING },
+        [CTA_TIMEOUT_NAME]      = { .type = NLA_NUL_STRING,
+                                    .len  = CTNL_TIMEOUT_NAME_MAX - 1},
        [CTA_TIMEOUT_L3PROTO]   = { .type = NLA_U16 },
        [CTA_TIMEOUT_L4PROTO]   = { .type = NLA_U8 },
        [CTA_TIMEOUT_DATA]      = { .type = NLA_NESTED },
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index cc10d073c338..9e8f4b2801f6 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -1210,7 +1210,7 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
        local->remote_miu = LLCP_DEFAULT_MIU;
        local->remote_lto = LLCP_DEFAULT_LTO;
-        list_add(&llcp_devices, &local->list);
+        list_add(&local->list, &llcp_devices);
        return 0;
 }
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index c3bea269faf4..9966e7b16451 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -102,7 +102,7 @@ static const struct file_operations sctp_snmp_seq_fops = {
        .open    = sctp_snmp_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = single_release,
+        .release = single_release_net,
 };
 /* Set up the proc fs entry for 'snmp' object. */
@@ -251,7 +251,7 @@ static const struct file_operations sctp_eps_seq_fops = {
        .open    = sctp_eps_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 /* Set up the proc fs entry for 'eps' object. */
@@ -372,7 +372,7 @@ static const struct file_operations sctp_assocs_seq_fops = {
        .open    = sctp_assocs_seq_open,
        .read    = seq_read,
        .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 /* Set up the proc fs entry for 'assocs' object. */
@@ -517,7 +517,7 @@ static const struct file_operations sctp_remaddr_seq_fops = {
        .open = sctp_remaddr_seq_open,
        .read = seq_read,
        .llseek = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_net,
 };
 int __net_init sctp_remaddr_proc_init(struct net *net)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index bcc7d7ee5a51..b75756b05af7 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -141,9 +141,8 @@ static const struct ieee80211_regdomain world_regdom = {
        .reg_rules = {
                /* IEEE 802.11b/g, channels 1..11 */
                REG_RULE(2412-10, 2462+10, 40, 6, 20, 0),
-                /* IEEE 802.11b/g, channels 12..13. No HT40
+                /* IEEE 802.11b/g, channels 12..13. */
-                 * channel fits here. */
+                REG_RULE(2467-10, 2472+10, 40, 6, 20,
-                REG_RULE(2467-10, 2472+10, 20, 6, 20,
                        NL80211_RRF_PASSIVE_SCAN |
                        NL80211_RRF_NO_IBSS),
                /* IEEE 802.11 channel 14 - Only JP enables
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index bd2e09895553..cdd48600e02a 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -12,7 +12,7 @@ extern "C" {
 #include <assert.h>
 #include <stdio.h>
-#include <sys/queue.h>
+#include "list.h"
 #ifndef __cplusplus
 #include <stdbool.h>
 #endif
@@ -175,12 +175,11 @@ struct menu {
 #define MENU_ROOT               0x0002
 struct jump_key {
-        CIRCLEQ_ENTRY(jump_key) entries;
+        struct list_head entries;
        size_t offset;
        struct menu *target;
        int index;
 };
-CIRCLEQ_HEAD(jk_head, jump_key);
 #define JUMP_NB                 9
diff --git a/scripts/kconfig/list.h b/scripts/kconfig/list.h
new file mode 100644
index 000000000000..0ae730be5f49
--- /dev/null
+++ b/scripts/kconfig/list.h
@@ -0,0 +1,91 @@
+#ifndef LIST_H
+#define LIST_H
+/*
+ * Copied from include/linux/...
+ */
+#undef offsetof
+#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+/**
+ * container_of - cast a member of a structure out to the containing structure
+ * @ptr:        the pointer to the member.
+ * @type:       the type of the container struct this is embedded in.
+ * @member:     the name of the member within the struct.
+ *
+ */
+#define container_of(ptr, type, member) ({                      \
+        const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
+        (type *)( (char *)__mptr - offsetof(type,member) );})
+struct list_head {
+        struct list_head *next, *prev;
+};
+#define LIST_HEAD_INIT(name) { &(name), &(name) }
+#define LIST_HEAD(name) \
+        struct list_head name = LIST_HEAD_INIT(name)
+/**
+ * list_entry - get the struct for this entry
+ * @ptr:        the &struct list_head pointer.
+ * @type:       the type of the struct this is embedded in.
+ * @member:     the name of the list_struct within the struct.
+ */
+#define list_entry(ptr, type, member) \
+        container_of(ptr, type, member)
+/**
+ * list_for_each_entry  -       iterate over list of given type
+ * @pos:        the type * to use as a loop cursor.
+ * @head:       the head for your list.
+ * @member:     the name of the list_struct within the struct.
+ */
+#define list_for_each_entry(pos, head, member)                          \
+        for (pos = list_entry((head)->next, typeof(*pos), member);      \
+             &pos->member != (head);    \
+             pos = list_entry(pos->member.next, typeof(*pos), member))
+/**
+ * list_empty - tests whether a list is empty
+ * @head: the list to test.
+ */
+static inline int list_empty(const struct list_head *head)
+{
+        return head->next == head;
+}
+/*
+ * Insert a new entry between two known consecutive entries.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __list_add(struct list_head *_new,
+                              struct list_head *prev,
+                              struct list_head *next)
+{
+        next->prev = _new;
+        _new->next = next;
+        _new->prev = prev;
+        prev->next = _new;
+}
+/**
+ * list_add_tail - add a new entry
+ * @new: new entry to be added
+ * @head: list head to add it before
+ *
+ * Insert a new entry before the specified head.
+ * This is useful for implementing queues.
+ */
+static inline void list_add_tail(struct list_head *_new, struct list_head *head)
+{
+        __list_add(_new, head->prev, head);
+}
+#endif
diff --git a/scripts/kconfig/lkc_proto.h b/scripts/kconfig/lkc_proto.h
index 1d1c08537f1e..ef1a7381f956 100644
--- a/scripts/kconfig/lkc_proto.h
+++ b/scripts/kconfig/lkc_proto.h
@@ -21,9 +21,9 @@ P(menu_get_root_menu,struct menu *,(struct menu *menu));
 P(menu_get_parent_menu,struct menu *,(struct menu *menu));
 P(menu_has_help,bool,(struct menu *menu));
 P(menu_get_help,const char *,(struct menu *menu));
-P(get_symbol_str, void, (struct gstr *r, struct symbol *sym, struct jk_head
+P(get_symbol_str, void, (struct gstr *r, struct symbol *sym, struct list_head
                         *head));
-P(get_relations_str, struct gstr, (struct symbol **sym_arr, struct jk_head
+P(get_relations_str, struct gstr, (struct symbol **sym_arr, struct list_head
                                   *head));
 P(menu_get_ext_help,void,(struct menu *menu, struct gstr *help));
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 48f67448af7b..53975cf87608 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -312,7 +312,7 @@ static void set_config_filename(const char *config_filename)
 struct search_data {
-        struct jk_head *head;
+        struct list_head *head;
        struct menu **targets;
        int *keys;
 };
@@ -323,7 +323,7 @@ static void update_text(char *buf, size_t start, size_t end, void *_data)
        struct jump_key *pos;
        int k = 0;
-        CIRCLEQ_FOREACH(pos, data->head, entries) {
+        list_for_each_entry(pos, data->head, entries) {
                if (pos->offset >= start && pos->offset < end) {
                        char header[4];
@@ -375,7 +375,7 @@ again:
        sym_arr = sym_re_search(dialog_input);
        do {
-                struct jk_head head = CIRCLEQ_HEAD_INITIALIZER(head);
+                LIST_HEAD(head);
                struct menu *targets[JUMP_NB];
                int keys[JUMP_NB + 1], i;
                struct search_data data = {
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index a3cade659f89..e98a05c8e508 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -508,7 +508,7 @@ const char *menu_get_help(struct menu *menu)
 }
 static void get_prompt_str(struct gstr *r, struct property *prop,
-                           struct jk_head *head)
+                           struct list_head *head)
 {
        int i, j;
        struct menu *submenu[8], *menu, *location = NULL;
@@ -544,12 +544,13 @@ static void get_prompt_str(struct gstr *r, struct property *prop,
                } else
                        jump->target = location;
-                if (CIRCLEQ_EMPTY(head))
+                if (list_empty(head))
                        jump->index = 0;
                else
-                        jump->index = CIRCLEQ_LAST(head)->index + 1;
+                        jump->index = list_entry(head->prev, struct jump_key,
+                                                 entries)->index + 1;
-                CIRCLEQ_INSERT_TAIL(head, jump, entries);
+                list_add_tail(&jump->entries, head);
        }
        if (i > 0) {
@@ -573,7 +574,8 @@ static void get_prompt_str(struct gstr *r, struct property *prop,
 /*
 * head is optional and may be NULL
 */
-void get_symbol_str(struct gstr *r, struct symbol *sym, struct jk_head *head)
+void get_symbol_str(struct gstr *r, struct symbol *sym,
+                    struct list_head *head)
 {
        bool hit;
        struct property *prop;
@@ -612,7 +614,7 @@ void get_symbol_str(struct gstr *r, struct symbol *sym, struct jk_head *head)
        str_append(r, "\n\n");
 }
-struct gstr get_relations_str(struct symbol **sym_arr, struct jk_head *head)
+struct gstr get_relations_str(struct symbol **sym_arr, struct list_head *head)
 {
        struct symbol *sym;
        struct gstr res = str_new();
diff --git a/scripts/sign-file b/scripts/sign-file
index 87ca59d36e7e..974a20b661b7 100755
--- a/scripts/sign-file
+++ b/scripts/sign-file
@@ -156,12 +156,12 @@ sub asn1_extract($$@)
        if ($l == 0x1) {
            $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1));
-        } elsif ($l = 0x2) {
+        } elsif ($l == 0x2) {
            $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0], 2));
-        } elsif ($l = 0x3) {
+        } elsif ($l == 0x3) {
            $len = unpack("C", substr(${$cursor->[2]}, $cursor->[0], 1)) << 16;
            $len = unpack("n", substr(${$cursor->[2]}, $cursor->[0] + 1, 2));
-        } elsif ($l = 0x4) {
+        } elsif ($l == 0x4) {
            $len = unpack("N", substr(${$cursor->[2]}, $cursor->[0], 4));
        } else {
            die $x509, ": ", $cursor->[0], ": ASN.1 element too long (", $l, ")\n";
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 842c254396db..b08d20c66c2e 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -164,8 +164,8 @@ static void dev_exception_clean(struct dev_cgroup *dev_cgroup)
        struct dev_exception_item *ex, *tmp;
        list_for_each_entry_safe(ex, tmp, &dev_cgroup->exceptions, list) {
-                list_del(&ex->list);
+                list_del_rcu(&ex->list);
-                kfree(ex);
+                kfree_rcu(ex, rcu);
        }
 }
@@ -298,7 +298,7 @@ static int may_access(struct dev_cgroup *dev_cgroup,
        struct dev_exception_item *ex;
        bool match = false;
-        list_for_each_entry(ex, &dev_cgroup->exceptions, list) {
+        list_for_each_entry_rcu(ex, &dev_cgroup->exceptions, list) {
                if ((refex->type & DEV_BLOCK) && !(ex->type & DEV_BLOCK))
                        continue;
                if ((refex->type & DEV_CHAR) && !(ex->type & DEV_CHAR))
@@ -352,6 +352,8 @@ static int parent_has_perm(struct dev_cgroup *childcg,
 */
 static inline int may_allow_all(struct dev_cgroup *parent)
 {
+        if (!parent)
+                return 1;
        return parent->behavior == DEVCG_DEFAULT_ALLOW;
 }
@@ -376,11 +378,14 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
        int count, rc;
        struct dev_exception_item ex;
        struct cgroup *p = devcgroup->css.cgroup;
-        struct dev_cgroup *parent = cgroup_to_devcgroup(p->parent);
+        struct dev_cgroup *parent = NULL;
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
+        if (p->parent)
+                parent = cgroup_to_devcgroup(p->parent);
        memset(&ex, 0, sizeof(ex));
        b = buffer;
@@ -391,11 +396,14 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup,
                        if (!may_allow_all(parent))
                                return -EPERM;
                        dev_exception_clean(devcgroup);
+                        devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
+                        if (!parent)
+                                break;
                        rc = dev_exceptions_copy(&devcgroup->exceptions,
                                                 &parent->exceptions);
                        if (rc)
                                return rc;
-                        devcgroup->behavior = DEVCG_DEFAULT_ALLOW;
                        break;
                case DEVCG_DENY:
                        dev_exception_clean(devcgroup);
diff --git a/security/selinux/netnode.c b/security/selinux/netnode.c
index 28f911cdd7c7..c5454c0477c3 100644
--- a/security/selinux/netnode.c
+++ b/security/selinux/netnode.c
@@ -174,7 +174,8 @@ static void sel_netnode_insert(struct sel_netnode *node)
        if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) {
                struct sel_netnode *tail;
                tail = list_entry(
-                        rcu_dereference(sel_netnode_hash[idx].list.prev),
+                        rcu_dereference_protected(sel_netnode_hash[idx].list.prev,
+                                                  lockdep_is_held(&sel_netnode_lock)),
                        struct sel_netnode, list);
                list_del_rcu(&tail->list);
                kfree_rcu(tail, rcu);
diff --git a/sound/pci/es1968.c b/sound/pci/es1968.c
index 50169bcfd903..7266020c16cb 100644
--- a/sound/pci/es1968.c
+++ b/sound/pci/es1968.c
@@ -2581,9 +2581,14 @@ static u8 snd_es1968_tea575x_get_pins(struct snd_tea575x *tea)
        struct es1968 *chip = tea->private_data;
        unsigned long io = chip->io_port + GPIO_DATA;
        u16 val = inw(io);
+        u8 ret;
-        return  (val & STR_DATA) ? TEA575X_DATA : 0 |
-                (val & STR_MOST) ? TEA575X_MOST : 0;
+        ret = 0;
+        if (val & STR_DATA)
+                ret |= TEA575X_DATA;
+        if (val & STR_MOST)
+                ret |= TEA575X_MOST;
+        return ret;
 }
 static void snd_es1968_tea575x_set_direction(struct snd_tea575x *tea, bool output)
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index cc2e91d15538..c5806f89be1e 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -767,9 +767,14 @@ static u8 snd_fm801_tea575x_get_pins(struct snd_tea575x *tea)
        struct fm801 *chip = tea->private_data;
        unsigned short reg = inw(FM801_REG(chip, GPIO_CTRL));
        struct snd_fm801_tea575x_gpio gpio = *get_tea575x_gpio(chip);
+        u8 ret;
-        return  (reg & FM801_GPIO_GP(gpio.data)) ? TEA575X_DATA : 0 |
-                (reg & FM801_GPIO_GP(gpio.most)) ? TEA575X_MOST : 0;
+        ret = 0;
+        if (reg & FM801_GPIO_GP(gpio.data))
+                ret |= TEA575X_DATA;
+        if (reg & FM801_GPIO_GP(gpio.most))
+                ret |= TEA575X_MOST;
+        return ret;
 }
 static void snd_fm801_tea575x_set_direction(struct snd_tea575x *tea, bool output)
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 70d4848b5cd0..d010de12335e 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -95,6 +95,7 @@ int snd_hda_delete_codec_preset(struct hda_codec_preset_list *preset)
 EXPORT_SYMBOL_HDA(snd_hda_delete_codec_preset);
 #ifdef CONFIG_PM
+#define codec_in_pm(codec)      ((codec)->in_pm)
 static void hda_power_work(struct work_struct *work);
 static void hda_keep_power_on(struct hda_codec *codec);
 #define hda_codec_is_power_on(codec)    ((codec)->power_on)
@@ -104,6 +105,7 @@ static inline void hda_call_pm_notify(struct hda_bus *bus, bool power_up)
                bus->ops.pm_notify(bus, power_up);
 }
 #else
+#define codec_in_pm(codec)      0
 static inline void hda_keep_power_on(struct hda_codec *codec) {}
 #define hda_codec_is_power_on(codec)    1
 #define hda_call_pm_notify(bus, state) {}
@@ -228,7 +230,7 @@ static int codec_exec_verb(struct hda_codec *codec, unsigned int cmd,
        }
        mutex_unlock(&bus->cmd_mutex);
        snd_hda_power_down(codec);
-        if (res && *res == -1 && bus->rirb_error) {
+        if (!codec_in_pm(codec) && res && *res == -1 && bus->rirb_error) {
                if (bus->response_reset) {
                        snd_printd("hda_codec: resetting BUS due to "
                                   "fatal communication error\n");
@@ -238,7 +240,7 @@ static int codec_exec_verb(struct hda_codec *codec, unsigned int cmd,
                goto again;
        }
        /* clear reset-flag when the communication gets recovered */
-        if (!err)
+        if (!err || codec_in_pm(codec))
                bus->response_reset = 0;
        return err;
 }
@@ -3616,6 +3618,8 @@ static unsigned int hda_call_codec_suspend(struct hda_codec *codec, bool in_wq)
 {
        unsigned int state;
+        codec->in_pm = 1;
        if (codec->patch_ops.suspend)
                codec->patch_ops.suspend(codec);
        hda_cleanup_all_streams(codec);
@@ -3630,6 +3634,7 @@ static unsigned int hda_call_codec_suspend(struct hda_codec *codec, bool in_wq)
        codec->power_transition = 0;
        codec->power_jiffies = jiffies;
        spin_unlock(&codec->power_lock);
+        codec->in_pm = 0;
        return state;
 }
@@ -3638,6 +3643,8 @@ static unsigned int hda_call_codec_suspend(struct hda_codec *codec, bool in_wq)
 */
 static void hda_call_codec_resume(struct hda_codec *codec)
 {
+        codec->in_pm = 1;
        /* set as if powered on for avoiding re-entering the resume
         * in the resume / power-save sequence
         */
@@ -3656,6 +3663,8 @@ static void hda_call_codec_resume(struct hda_codec *codec)
                snd_hda_codec_resume_cache(codec);
        }
        snd_hda_jack_report_sync(codec);
+        codec->in_pm = 0;
        snd_hda_power_down(codec); /* flag down before returning */
 }
 #endif /* CONFIG_PM */
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 507fe8a917b6..4f4e545c0f4b 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -869,6 +869,7 @@ struct hda_codec {
        unsigned int power_on :1;       /* current (global) power-state */
        unsigned int d3_stop_clk:1;     /* support D3 operation without BCLK */
        unsigned int pm_down_notified:1; /* PM notified to controller */
+        unsigned int in_pm:1;           /* suspend/resume being performed */
        int power_transition;   /* power-state in transition */
        int power_count;        /* current (global) power refcount */
        struct delayed_work power_work; /* delayed task for powerdown */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index cd2dbaf1be78..f9d870e554d9 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -556,6 +556,12 @@ enum {
 #define AZX_DCAPS_ALIGN_BUFSIZE (1 << 22)       /* buffer size alignment */
 #define AZX_DCAPS_4K_BDLE_BOUNDARY (1 << 23)    /* BDLE in 4k boundary */
 #define AZX_DCAPS_COUNT_LPIB_DELAY  (1 << 25)   /* Take LPIB as delay */
+#define AZX_DCAPS_PM_RUNTIME    (1 << 26)       /* runtime PM support */
+/* quirks for Intel PCH */
+#define AZX_DCAPS_INTEL_PCH \
+        (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_BUFSIZE | \
+         AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_PM_RUNTIME)
 /* quirks for ATI SB / AMD Hudson */
 #define AZX_DCAPS_PRESET_ATI_SB \
@@ -2433,6 +2439,9 @@ static void azx_power_notify(struct hda_bus *bus, bool power_up)
 {
        struct azx *chip = bus->private_data;
+        if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
+                return;
        if (power_up)
                pm_runtime_get_sync(&chip->pci->dev);
        else
@@ -2548,7 +2557,8 @@ static int azx_runtime_suspend(struct device *dev)
        struct snd_card *card = dev_get_drvdata(dev);
        struct azx *chip = card->private_data;
-        if (!power_save_controller)
+        if (!power_save_controller ||
+            !(chip->driver_caps & AZX_DCAPS_PM_RUNTIME))
                return -EAGAIN;
        azx_stop_chip(chip);
@@ -3429,39 +3439,30 @@ static void __devexit azx_remove(struct pci_dev *pci)
 static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
        /* CPT */
        { PCI_DEVICE(0x8086, 0x1c20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* PBG */
        { PCI_DEVICE(0x8086, 0x1d20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE},
        /* Panther Point */
        { PCI_DEVICE(0x8086, 0x1e20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* Lynx Point */
        { PCI_DEVICE(0x8086, 0x8c20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* Lynx Point-LP */
        { PCI_DEVICE(0x8086, 0x9c20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* Lynx Point-LP */
        { PCI_DEVICE(0x8086, 0x9c21),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* Haswell */
        { PCI_DEVICE(0x8086, 0x0c0c),
-          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        { PCI_DEVICE(0x8086, 0x0d0c),
-          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* 5 Series/3400 */
        { PCI_DEVICE(0x8086, 0x3b56),
-          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
+          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH },
-          AZX_DCAPS_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY },
        /* SCH */
        { PCI_DEVICE(0x8086, 0x811b),
          .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_SCH_SNOOP |
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index d5f3a26d608d..3bcb67172358 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -466,6 +466,7 @@ static int parse_output(struct hda_codec *codec)
                memcpy(cfg->speaker_pins, cfg->line_out_pins,
                       sizeof(cfg->speaker_pins));
                cfg->line_outs = 0;
+                memset(cfg->line_out_pins, 0, sizeof(cfg->line_out_pins));
        }
        return 0;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c0ce3b1f04b4..ad68d223f8af 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5407,6 +5407,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
        SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF),
        SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF),
        SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO),
+        SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
        SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
        SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
        SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
@@ -7064,6 +7065,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
        { .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 },
        { .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
        { .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
+        { .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
        { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
          .patch = patch_alc861 },
        { .id = 0x10ec0660, .name = "ALC660-VD", .patch = patch_alc861vd },
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index c03b65af3059..054967d8bac2 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -268,7 +268,7 @@ EXPORT_SYMBOL_GPL(arizona_out_ev);
 static unsigned int arizona_sysclk_48k_rates[] = {
        6144000,
        12288000,
-        22579200,
+        24576000,
        49152000,
        73728000,
        98304000,
@@ -278,7 +278,7 @@ static unsigned int arizona_sysclk_48k_rates[] = {
 static unsigned int arizona_sysclk_44k1_rates[] = {
        5644800,
        11289600,
-        24576000,
+        22579200,
        45158400,
        67737600,
        90316800,
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index f994af34f552..e3f0a7f3131e 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -485,7 +485,7 @@ static int cs4271_probe(struct snd_soc_codec *codec)
                gpio_nreset = cs4271plat->gpio_nreset;
        if (gpio_nreset >= 0)
-                if (gpio_request(gpio_nreset, "CS4271 Reset"))
+                if (devm_gpio_request(codec->dev, gpio_nreset, "CS4271 Reset"))
                        gpio_nreset = -EINVAL;
        if (gpio_nreset >= 0) {
                /* Reset codec */
@@ -535,15 +535,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
 static int cs4271_remove(struct snd_soc_codec *codec)
 {
        struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
-        int gpio_nreset;
-        gpio_nreset = cs4271->gpio_nreset;
+        if (gpio_is_valid(cs4271->gpio_nreset))
-        if (gpio_is_valid(gpio_nreset)) {
                /* Set codec to the reset state */
-                gpio_set_value(gpio_nreset, 0);
+                gpio_set_value(cs4271->gpio_nreset, 0);
-                gpio_free(gpio_nreset);
-        }
        return 0;
 };
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 4d8db3685e96..97a81051e88d 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -773,7 +773,6 @@ static int cs42l52_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
 {
        struct snd_soc_codec *codec = codec_dai->codec;
        struct cs42l52_private *cs42l52 = snd_soc_codec_get_drvdata(codec);
-        int ret = 0;
        u8 iface = 0;
        switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
@@ -822,7 +821,7 @@ static int cs42l52_set_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
        case SND_SOC_DAIFMT_NB_IF:
                break;
        default:
-                ret = -EINVAL;
+                return -EINVAL;
        }
        cs42l52->config.format = iface;
        snd_soc_write(codec, CS42L52_IFACE_CTL1, cs42l52->config.format);
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index 1722b586bdba..7394e73fa43c 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -42,6 +42,556 @@ static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
 static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
 static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
+static const struct reg_default wm5102_sysclk_reva_patch[] = {
+        { 0x3000, 0x2225 },
+        { 0x3001, 0x3a03 },
+        { 0x3002, 0x0225 },
+        { 0x3003, 0x0801 },
+        { 0x3004, 0x6249 },
+        { 0x3005, 0x0c04 },
+        { 0x3006, 0x0225 },
+        { 0x3007, 0x5901 },
+        { 0x3008, 0xe249 },
+        { 0x3009, 0x030d },
+        { 0x300a, 0x0249 },
+        { 0x300b, 0x2c01 },
+        { 0x300c, 0xe249 },
+        { 0x300d, 0x4342 },
+        { 0x300e, 0xe249 },
+        { 0x300f, 0x73c0 },
+        { 0x3010, 0x4249 },
+        { 0x3011, 0x0c00 },
+        { 0x3012, 0x0225 },
+        { 0x3013, 0x1f01 },
+        { 0x3014, 0x0225 },
+        { 0x3015, 0x1e01 },
+        { 0x3016, 0x0225 },
+        { 0x3017, 0xfa00 },
+        { 0x3018, 0x0000 },
+        { 0x3019, 0xf000 },
+        { 0x301a, 0x0000 },
+        { 0x301b, 0xf000 },
+        { 0x301c, 0x0000 },
+        { 0x301d, 0xf000 },
+        { 0x301e, 0x0000 },
+        { 0x301f, 0xf000 },
+        { 0x3020, 0x0000 },
+        { 0x3021, 0xf000 },
+        { 0x3022, 0x0000 },
+        { 0x3023, 0xf000 },
+        { 0x3024, 0x0000 },
+        { 0x3025, 0xf000 },
+        { 0x3026, 0x0000 },
+        { 0x3027, 0xf000 },
+        { 0x3028, 0x0000 },
+        { 0x3029, 0xf000 },
+        { 0x302a, 0x0000 },
+        { 0x302b, 0xf000 },
+        { 0x302c, 0x0000 },
+        { 0x302d, 0xf000 },
+        { 0x302e, 0x0000 },
+        { 0x302f, 0xf000 },
+        { 0x3030, 0x0225 },
+        { 0x3031, 0x1a01 },
+        { 0x3032, 0x0225 },
+        { 0x3033, 0x1e00 },
+        { 0x3034, 0x0225 },
+        { 0x3035, 0x1f00 },
+        { 0x3036, 0x6225 },
+        { 0x3037, 0xf800 },
+        { 0x3038, 0x0000 },
+        { 0x3039, 0xf000 },
+        { 0x303a, 0x0000 },
+        { 0x303b, 0xf000 },
+        { 0x303c, 0x0000 },
+        { 0x303d, 0xf000 },
+        { 0x303e, 0x0000 },
+        { 0x303f, 0xf000 },
+        { 0x3040, 0x2226 },
+        { 0x3041, 0x3a03 },
+        { 0x3042, 0x0226 },
+        { 0x3043, 0x0801 },
+        { 0x3044, 0x6249 },
+        { 0x3045, 0x0c06 },
+        { 0x3046, 0x0226 },
+        { 0x3047, 0x5901 },
+        { 0x3048, 0xe249 },
+        { 0x3049, 0x030d },
+        { 0x304a, 0x0249 },
+        { 0x304b, 0x2c01 },
+        { 0x304c, 0xe249 },
+        { 0x304d, 0x4342 },
+        { 0x304e, 0xe249 },
+        { 0x304f, 0x73c0 },
+        { 0x3050, 0x4249 },
+        { 0x3051, 0x0c00 },
+        { 0x3052, 0x0226 },
+        { 0x3053, 0x1f01 },
+        { 0x3054, 0x0226 },
+        { 0x3055, 0x1e01 },
+        { 0x3056, 0x0226 },
+        { 0x3057, 0xfa00 },
+        { 0x3058, 0x0000 },
+        { 0x3059, 0xf000 },
+        { 0x305a, 0x0000 },
+        { 0x305b, 0xf000 },
+        { 0x305c, 0x0000 },
+        { 0x305d, 0xf000 },
+        { 0x305e, 0x0000 },
+        { 0x305f, 0xf000 },
+        { 0x3060, 0x0000 },
+        { 0x3061, 0xf000 },
+        { 0x3062, 0x0000 },
+        { 0x3063, 0xf000 },
+        { 0x3064, 0x0000 },
+        { 0x3065, 0xf000 },
+        { 0x3066, 0x0000 },
+        { 0x3067, 0xf000 },
+        { 0x3068, 0x0000 },
+        { 0x3069, 0xf000 },
+        { 0x306a, 0x0000 },
+        { 0x306b, 0xf000 },
+        { 0x306c, 0x0000 },
+        { 0x306d, 0xf000 },
+        { 0x306e, 0x0000 },
+        { 0x306f, 0xf000 },
+        { 0x3070, 0x0226 },
+        { 0x3071, 0x1a01 },
+        { 0x3072, 0x0226 },
+        { 0x3073, 0x1e00 },
+        { 0x3074, 0x0226 },
+        { 0x3075, 0x1f00 },
+        { 0x3076, 0x6226 },
+        { 0x3077, 0xf800 },
+        { 0x3078, 0x0000 },
+        { 0x3079, 0xf000 },
+        { 0x307a, 0x0000 },
+        { 0x307b, 0xf000 },
+        { 0x307c, 0x0000 },
+        { 0x307d, 0xf000 },
+        { 0x307e, 0x0000 },
+        { 0x307f, 0xf000 },
+        { 0x3080, 0x2227 },
+        { 0x3081, 0x3a03 },
+        { 0x3082, 0x0227 },
+        { 0x3083, 0x0801 },
+        { 0x3084, 0x6255 },
+        { 0x3085, 0x0c04 },
+        { 0x3086, 0x0227 },
+        { 0x3087, 0x5901 },
+        { 0x3088, 0xe255 },
+        { 0x3089, 0x030d },
+        { 0x308a, 0x0255 },
+        { 0x308b, 0x2c01 },
+        { 0x308c, 0xe255 },
+        { 0x308d, 0x4342 },
+        { 0x308e, 0xe255 },
+        { 0x308f, 0x73c0 },
+        { 0x3090, 0x4255 },
+        { 0x3091, 0x0c00 },
+        { 0x3092, 0x0227 },
+        { 0x3093, 0x1f01 },
+        { 0x3094, 0x0227 },
+        { 0x3095, 0x1e01 },
+        { 0x3096, 0x0227 },
+        { 0x3097, 0xfa00 },
+        { 0x3098, 0x0000 },
+        { 0x3099, 0xf000 },
+        { 0x309a, 0x0000 },
+        { 0x309b, 0xf000 },
+        { 0x309c, 0x0000 },
+        { 0x309d, 0xf000 },
+        { 0x309e, 0x0000 },
+        { 0x309f, 0xf000 },
+        { 0x30a0, 0x0000 },
+        { 0x30a1, 0xf000 },
+        { 0x30a2, 0x0000 },
+        { 0x30a3, 0xf000 },
+        { 0x30a4, 0x0000 },
+        { 0x30a5, 0xf000 },
+        { 0x30a6, 0x0000 },
+        { 0x30a7, 0xf000 },
+        { 0x30a8, 0x0000 },
+        { 0x30a9, 0xf000 },
+        { 0x30aa, 0x0000 },
+        { 0x30ab, 0xf000 },
+        { 0x30ac, 0x0000 },
+        { 0x30ad, 0xf000 },
+        { 0x30ae, 0x0000 },
+        { 0x30af, 0xf000 },
+        { 0x30b0, 0x0227 },
+        { 0x30b1, 0x1a01 },
+        { 0x30b2, 0x0227 },
+        { 0x30b3, 0x1e00 },
+        { 0x30b4, 0x0227 },
+        { 0x30b5, 0x1f00 },
+        { 0x30b6, 0x6227 },
+        { 0x30b7, 0xf800 },
+        { 0x30b8, 0x0000 },
+        { 0x30b9, 0xf000 },
+        { 0x30ba, 0x0000 },
+        { 0x30bb, 0xf000 },
+        { 0x30bc, 0x0000 },
+        { 0x30bd, 0xf000 },
+        { 0x30be, 0x0000 },
+        { 0x30bf, 0xf000 },
+        { 0x30c0, 0x2228 },
+        { 0x30c1, 0x3a03 },
+        { 0x30c2, 0x0228 },
+        { 0x30c3, 0x0801 },
+        { 0x30c4, 0x6255 },
+        { 0x30c5, 0x0c06 },
+        { 0x30c6, 0x0228 },
+        { 0x30c7, 0x5901 },
+        { 0x30c8, 0xe255 },
+        { 0x30c9, 0x030d },
+        { 0x30ca, 0x0255 },
+        { 0x30cb, 0x2c01 },
+        { 0x30cc, 0xe255 },
+        { 0x30cd, 0x4342 },
+        { 0x30ce, 0xe255 },
+        { 0x30cf, 0x73c0 },
+        { 0x30d0, 0x4255 },
+        { 0x30d1, 0x0c00 },
+        { 0x30d2, 0x0228 },
+        { 0x30d3, 0x1f01 },
+        { 0x30d4, 0x0228 },
+        { 0x30d5, 0x1e01 },
+        { 0x30d6, 0x0228 },
+        { 0x30d7, 0xfa00 },
+        { 0x30d8, 0x0000 },
+        { 0x30d9, 0xf000 },
+        { 0x30da, 0x0000 },
+        { 0x30db, 0xf000 },
+        { 0x30dc, 0x0000 },
+        { 0x30dd, 0xf000 },
+        { 0x30de, 0x0000 },
+        { 0x30df, 0xf000 },
+        { 0x30e0, 0x0000 },
+        { 0x30e1, 0xf000 },
+        { 0x30e2, 0x0000 },
+        { 0x30e3, 0xf000 },
+        { 0x30e4, 0x0000 },
+        { 0x30e5, 0xf000 },
+        { 0x30e6, 0x0000 },
+        { 0x30e7, 0xf000 },
+        { 0x30e8, 0x0000 },
+        { 0x30e9, 0xf000 },
+        { 0x30ea, 0x0000 },
+        { 0x30eb, 0xf000 },
+        { 0x30ec, 0x0000 },
+        { 0x30ed, 0xf000 },
+        { 0x30ee, 0x0000 },
+        { 0x30ef, 0xf000 },
+        { 0x30f0, 0x0228 },
+        { 0x30f1, 0x1a01 },
+        { 0x30f2, 0x0228 },
+        { 0x30f3, 0x1e00 },
+        { 0x30f4, 0x0228 },
+        { 0x30f5, 0x1f00 },
+        { 0x30f6, 0x6228 },
+        { 0x30f7, 0xf800 },
+        { 0x30f8, 0x0000 },
+        { 0x30f9, 0xf000 },
+        { 0x30fa, 0x0000 },
+        { 0x30fb, 0xf000 },
+        { 0x30fc, 0x0000 },
+        { 0x30fd, 0xf000 },
+        { 0x30fe, 0x0000 },
+        { 0x30ff, 0xf000 },
+        { 0x3100, 0x222b },
+        { 0x3101, 0x3a03 },
+        { 0x3102, 0x222b },
+        { 0x3103, 0x5803 },
+        { 0x3104, 0xe26f },
+        { 0x3105, 0x030d },
+        { 0x3106, 0x626f },
+        { 0x3107, 0x2c01 },
+        { 0x3108, 0xe26f },
+        { 0x3109, 0x4342 },
+        { 0x310a, 0xe26f },
+        { 0x310b, 0x73c0 },
+        { 0x310c, 0x026f },
+        { 0x310d, 0x0c00 },
+        { 0x310e, 0x022b },
+        { 0x310f, 0x1f01 },
+        { 0x3110, 0x022b },
+        { 0x3111, 0x1e01 },
+        { 0x3112, 0x022b },
+        { 0x3113, 0xfa00 },
+        { 0x3114, 0x0000 },
+        { 0x3115, 0xf000 },
+        { 0x3116, 0x0000 },
+        { 0x3117, 0xf000 },
+        { 0x3118, 0x0000 },
+        { 0x3119, 0xf000 },
+        { 0x311a, 0x0000 },
+        { 0x311b, 0xf000 },
+        { 0x311c, 0x0000 },
+        { 0x311d, 0xf000 },
+        { 0x311e, 0x0000 },
+        { 0x311f, 0xf000 },
+        { 0x3120, 0x022b },
+        { 0x3121, 0x0a01 },
+        { 0x3122, 0x022b },
+        { 0x3123, 0x1e00 },
+        { 0x3124, 0x022b },
+        { 0x3125, 0x1f00 },
+        { 0x3126, 0x622b },
+        { 0x3127, 0xf800 },
+        { 0x3128, 0x0000 },
+        { 0x3129, 0xf000 },
+        { 0x312a, 0x0000 },
+        { 0x312b, 0xf000 },
+        { 0x312c, 0x0000 },
+        { 0x312d, 0xf000 },
+        { 0x312e, 0x0000 },
+        { 0x312f, 0xf000 },
+        { 0x3130, 0x0000 },
+        { 0x3131, 0xf000 },
+        { 0x3132, 0x0000 },
+        { 0x3133, 0xf000 },
+        { 0x3134, 0x0000 },
+        { 0x3135, 0xf000 },
+        { 0x3136, 0x0000 },
+        { 0x3137, 0xf000 },
+        { 0x3138, 0x0000 },
+        { 0x3139, 0xf000 },
+        { 0x313a, 0x0000 },
+        { 0x313b, 0xf000 },
+        { 0x313c, 0x0000 },
+        { 0x313d, 0xf000 },
+        { 0x313e, 0x0000 },
+        { 0x313f, 0xf000 },
+        { 0x3140, 0x0000 },
+        { 0x3141, 0xf000 },
+        { 0x3142, 0x0000 },
+        { 0x3143, 0xf000 },
+        { 0x3144, 0x0000 },
+        { 0x3145, 0xf000 },
+        { 0x3146, 0x0000 },
+        { 0x3147, 0xf000 },
+        { 0x3148, 0x0000 },
+        { 0x3149, 0xf000 },
+        { 0x314a, 0x0000 },
+        { 0x314b, 0xf000 },
+        { 0x314c, 0x0000 },
+        { 0x314d, 0xf000 },
+        { 0x314e, 0x0000 },
+        { 0x314f, 0xf000 },
+        { 0x3150, 0x0000 },
+        { 0x3151, 0xf000 },
+        { 0x3152, 0x0000 },
+        { 0x3153, 0xf000 },
+        { 0x3154, 0x0000 },
+        { 0x3155, 0xf000 },
+        { 0x3156, 0x0000 },
+        { 0x3157, 0xf000 },
+        { 0x3158, 0x0000 },
+        { 0x3159, 0xf000 },
+        { 0x315a, 0x0000 },
+        { 0x315b, 0xf000 },
+        { 0x315c, 0x0000 },
+        { 0x315d, 0xf000 },
+        { 0x315e, 0x0000 },
+        { 0x315f, 0xf000 },
+        { 0x3160, 0x0000 },
+        { 0x3161, 0xf000 },
+        { 0x3162, 0x0000 },
+        { 0x3163, 0xf000 },
+        { 0x3164, 0x0000 },
+        { 0x3165, 0xf000 },
+        { 0x3166, 0x0000 },
+        { 0x3167, 0xf000 },
+        { 0x3168, 0x0000 },
+        { 0x3169, 0xf000 },
+        { 0x316a, 0x0000 },
+        { 0x316b, 0xf000 },
+        { 0x316c, 0x0000 },
+        { 0x316d, 0xf000 },
+        { 0x316e, 0x0000 },
+        { 0x316f, 0xf000 },
+        { 0x3170, 0x0000 },
+        { 0x3171, 0xf000 },
+        { 0x3172, 0x0000 },
+        { 0x3173, 0xf000 },
+        { 0x3174, 0x0000 },
+        { 0x3175, 0xf000 },
+        { 0x3176, 0x0000 },
+        { 0x3177, 0xf000 },
+        { 0x3178, 0x0000 },
+        { 0x3179, 0xf000 },
+        { 0x317a, 0x0000 },
+        { 0x317b, 0xf000 },
+        { 0x317c, 0x0000 },
+        { 0x317d, 0xf000 },
+        { 0x317e, 0x0000 },
+        { 0x317f, 0xf000 },
+        { 0x3180, 0x2001 },
+        { 0x3181, 0xf101 },
+        { 0x3182, 0x0000 },
+        { 0x3183, 0xf000 },
+        { 0x3184, 0x0000 },
+        { 0x3185, 0xf000 },
+        { 0x3186, 0x0000 },
+        { 0x3187, 0xf000 },
+        { 0x3188, 0x0000 },
+        { 0x3189, 0xf000 },
+        { 0x318a, 0x0000 },
+        { 0x318b, 0xf000 },
+        { 0x318c, 0x0000 },
+        { 0x318d, 0xf000 },
+        { 0x318e, 0x0000 },
+        { 0x318f, 0xf000 },
+        { 0x3190, 0x0000 },
+        { 0x3191, 0xf000 },
+        { 0x3192, 0x0000 },
+        { 0x3193, 0xf000 },
+        { 0x3194, 0x0000 },
+        { 0x3195, 0xf000 },
+        { 0x3196, 0x0000 },
+        { 0x3197, 0xf000 },
+        { 0x3198, 0x0000 },
+        { 0x3199, 0xf000 },
+        { 0x319a, 0x0000 },
+        { 0x319b, 0xf000 },
+        { 0x319c, 0x0000 },
+        { 0x319d, 0xf000 },
+        { 0x319e, 0x0000 },
+        { 0x319f, 0xf000 },
+        { 0x31a0, 0x0000 },
+        { 0x31a1, 0xf000 },
+        { 0x31a2, 0x0000 },
+        { 0x31a3, 0xf000 },
+        { 0x31a4, 0x0000 },
+        { 0x31a5, 0xf000 },
+        { 0x31a6, 0x0000 },
+        { 0x31a7, 0xf000 },
+        { 0x31a8, 0x0000 },
+        { 0x31a9, 0xf000 },
+        { 0x31aa, 0x0000 },
+        { 0x31ab, 0xf000 },
+        { 0x31ac, 0x0000 },
+        { 0x31ad, 0xf000 },
+        { 0x31ae, 0x0000 },
+        { 0x31af, 0xf000 },
+        { 0x31b0, 0x0000 },
+        { 0x31b1, 0xf000 },
+        { 0x31b2, 0x0000 },
+        { 0x31b3, 0xf000 },
+        { 0x31b4, 0x0000 },
+        { 0x31b5, 0xf000 },
+        { 0x31b6, 0x0000 },
+        { 0x31b7, 0xf000 },
+        { 0x31b8, 0x0000 },
+        { 0x31b9, 0xf000 },
+        { 0x31ba, 0x0000 },
+        { 0x31bb, 0xf000 },
+        { 0x31bc, 0x0000 },
+        { 0x31bd, 0xf000 },
+        { 0x31be, 0x0000 },
+        { 0x31bf, 0xf000 },
+        { 0x31c0, 0x0000 },
+        { 0x31c1, 0xf000 },
+        { 0x31c2, 0x0000 },
+        { 0x31c3, 0xf000 },
+        { 0x31c4, 0x0000 },
+        { 0x31c5, 0xf000 },
+        { 0x31c6, 0x0000 },
+        { 0x31c7, 0xf000 },
+        { 0x31c8, 0x0000 },
+        { 0x31c9, 0xf000 },
+        { 0x31ca, 0x0000 },
+        { 0x31cb, 0xf000 },
+        { 0x31cc, 0x0000 },
+        { 0x31cd, 0xf000 },
+        { 0x31ce, 0x0000 },
+        { 0x31cf, 0xf000 },
+        { 0x31d0, 0x0000 },
+        { 0x31d1, 0xf000 },
+        { 0x31d2, 0x0000 },
+        { 0x31d3, 0xf000 },
+        { 0x31d4, 0x0000 },
+        { 0x31d5, 0xf000 },
+        { 0x31d6, 0x0000 },
+        { 0x31d7, 0xf000 },
+        { 0x31d8, 0x0000 },
+        { 0x31d9, 0xf000 },
+        { 0x31da, 0x0000 },
+        { 0x31db, 0xf000 },
+        { 0x31dc, 0x0000 },
+        { 0x31dd, 0xf000 },
+        { 0x31de, 0x0000 },
+        { 0x31df, 0xf000 },
+        { 0x31e0, 0x0000 },
+        { 0x31e1, 0xf000 },
+        { 0x31e2, 0x0000 },
+        { 0x31e3, 0xf000 },
+        { 0x31e4, 0x0000 },
+        { 0x31e5, 0xf000 },
+        { 0x31e6, 0x0000 },
+        { 0x31e7, 0xf000 },
+        { 0x31e8, 0x0000 },
+        { 0x31e9, 0xf000 },
+        { 0x31ea, 0x0000 },
+        { 0x31eb, 0xf000 },
+        { 0x31ec, 0x0000 },
+        { 0x31ed, 0xf000 },
+        { 0x31ee, 0x0000 },
+        { 0x31ef, 0xf000 },
+        { 0x31f0, 0x0000 },
+        { 0x31f1, 0xf000 },
+        { 0x31f2, 0x0000 },
+        { 0x31f3, 0xf000 },
+        { 0x31f4, 0x0000 },
+        { 0x31f5, 0xf000 },
+        { 0x31f6, 0x0000 },
+        { 0x31f7, 0xf000 },
+        { 0x31f8, 0x0000 },
+        { 0x31f9, 0xf000 },
+        { 0x31fa, 0x0000 },
+        { 0x31fb, 0xf000 },
+        { 0x31fc, 0x0000 },
+        { 0x31fd, 0xf000 },
+        { 0x31fe, 0x0000 },
+        { 0x31ff, 0xf000 },
+        { 0x024d, 0xff50 },
+        { 0x0252, 0xff50 },
+        { 0x0259, 0x0112 },
+        { 0x025e, 0x0112 },
+};
+static int wm5102_sysclk_ev(struct snd_soc_dapm_widget *w,
+                            struct snd_kcontrol *kcontrol, int event)
+{
+        struct snd_soc_codec *codec = w->codec;
+        struct arizona *arizona = dev_get_drvdata(codec->dev);
+        struct regmap *regmap = codec->control_data;
+        const struct reg_default *patch = NULL;
+        int i, patch_size;
+        switch (arizona->rev) {
+        case 0:
+                patch = wm5102_sysclk_reva_patch;
+                patch_size = ARRAY_SIZE(wm5102_sysclk_reva_patch);
+                break;
+        }
+        switch (event) {
+        case SND_SOC_DAPM_POST_PMU:
+                if (patch)
+                        for (i = 0; i < patch_size; i++)
+                                regmap_write(regmap, patch[i].reg,
+                                             patch[i].def);
+                break;
+        default:
+                break;
+        }
+        return 0;
+}
 static const struct snd_kcontrol_new wm5102_snd_controls[] = {
 SOC_SINGLE("IN1 High Performance Switch", ARIZONA_IN1L_CONTROL,
           ARIZONA_IN1_OSR_SHIFT, 1, 0),
@@ -297,7 +847,7 @@ static const struct snd_kcontrol_new wm5102_aec_loopback_mux =
 static const struct snd_soc_dapm_widget wm5102_dapm_widgets[] = {
 SND_SOC_DAPM_SUPPLY("SYSCLK", ARIZONA_SYSTEM_CLOCK_1, ARIZONA_SYSCLK_ENA_SHIFT,
-                    0, NULL, 0),
+                    0, wm5102_sysclk_ev, SND_SOC_DAPM_POST_PMU),
 SND_SOC_DAPM_SUPPLY("ASYNCCLK", ARIZONA_ASYNC_CLOCK_1,
                    ARIZONA_ASYNC_CLK_ENA_SHIFT, 0, NULL, 0),
 SND_SOC_DAPM_SUPPLY("OPCLK", ARIZONA_OUTPUT_SYSTEM_CLOCK,
diff --git a/sound/soc/codecs/wm8978.c b/sound/soc/codecs/wm8978.c
index 5421fd9fbcb5..4c0a8e496131 100644
--- a/sound/soc/codecs/wm8978.c
+++ b/sound/soc/codecs/wm8978.c
@@ -782,7 +782,7 @@ static int wm8978_hw_params(struct snd_pcm_substream *substream,
                wm8978->mclk_idx = -1;
                f_sel = wm8978->f_mclk;
        } else {
-                if (!wm8978->f_pllout) {
+                if (!wm8978->f_opclk) {
                        /* We only enter here, if OPCLK is not used */
                        int ret = wm8978_configure_pll(codec);
                        if (ret < 0)
diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
index b9f16598324c..2ba08148655f 100644
--- a/sound/soc/kirkwood/kirkwood-dma.c
+++ b/sound/soc/kirkwood/kirkwood-dma.c
@@ -71,7 +71,6 @@ static irqreturn_t kirkwood_dma_irq(int irq, void *dev_id)
                printk(KERN_WARNING "%s: got err interrupt 0x%lx\n",
                                __func__, cause);
                writel(cause, priv->io + KIRKWOOD_ERR_CAUSE);
-                return IRQ_HANDLED;
        }
        /* we've enabled only bytes interrupts ... */
@@ -178,7 +177,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream)
        }
        dram = mv_mbus_dram_info();
-        addr = virt_to_phys(substream->dma_buffer.area);
+        addr = substream->dma_buffer.addr;
        if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                prdata->play_stream = substream;
                kirkwood_dma_conf_mbus_windows(priv->io,
diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c
index 542538d10ab7..1d5db484d2df 100644
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -95,7 +95,7 @@ static inline void kirkwood_set_dco(void __iomem *io, unsigned long rate)
        do {
                cpu_relax();
                value = readl(io + KIRKWOOD_DCO_SPCR_STATUS);
-                value &= KIRKWOOD_DCO_SPCR_STATUS;
+                value &= KIRKWOOD_DCO_SPCR_STATUS_DCO_LOCK;
        } while (value == 0);
 }
@@ -180,67 +180,72 @@ static int kirkwood_i2s_play_trigger(struct snd_pcm_substream *substream,
                                int cmd, struct snd_soc_dai *dai)
 {
        struct kirkwood_dma_data *priv = snd_soc_dai_get_drvdata(dai);
-        unsigned long value;
+        uint32_t ctl, value;
-        /*
+        ctl = readl(priv->io + KIRKWOOD_PLAYCTL);
-         * specs says KIRKWOOD_PLAYCTL must be read 2 times before
+        if (ctl & KIRKWOOD_PLAYCTL_PAUSE) {
-         * changing it. So read 1 time here and 1 later.
+                unsigned timeout = 5000;
-         */
+                /*
-        value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                 * The Armada510 spec says that if we enter pause mode, the
+                 * busy bit must be read back as clear _twice_.  Make sure
+                 * we respect that otherwise we get DMA underruns.
+                 */
+                do {
+                        value = ctl;
+                        ctl = readl(priv->io + KIRKWOOD_PLAYCTL);
+                        if (!((ctl | value) & KIRKWOOD_PLAYCTL_PLAY_BUSY))
+                                break;
+                        udelay(1);
+                } while (timeout--);
+                if ((ctl | value) & KIRKWOOD_PLAYCTL_PLAY_BUSY)
+                        dev_notice(dai->dev, "timed out waiting for busy to deassert: %08x\n",
+                                   ctl);
+        }
        switch (cmd) {
        case SNDRV_PCM_TRIGGER_START:
-                /* stop audio, enable interrupts */
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
-                value |= KIRKWOOD_PLAYCTL_PAUSE;
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
                value = readl(priv->io + KIRKWOOD_INT_MASK);
                value |= KIRKWOOD_INT_CAUSE_PLAY_BYTES;
                writel(value, priv->io + KIRKWOOD_INT_MASK);
                /* configure audio & enable i2s playback */
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                ctl &= ~KIRKWOOD_PLAYCTL_BURST_MASK;
-                value &= ~KIRKWOOD_PLAYCTL_BURST_MASK;
+                ctl &= ~(KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE
-                value &= ~(KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE
                                | KIRKWOOD_PLAYCTL_SPDIF_EN);
                if (priv->burst == 32)
-                        value |= KIRKWOOD_PLAYCTL_BURST_32;
+                        ctl |= KIRKWOOD_PLAYCTL_BURST_32;
                else
-                        value |= KIRKWOOD_PLAYCTL_BURST_128;
+                        ctl |= KIRKWOOD_PLAYCTL_BURST_128;
-                value |= KIRKWOOD_PLAYCTL_I2S_EN;
+                ctl |= KIRKWOOD_PLAYCTL_I2S_EN;
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
+                writel(ctl, priv->io + KIRKWOOD_PLAYCTL);
                break;
        case SNDRV_PCM_TRIGGER_STOP:
                /* stop audio, disable interrupts */
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                ctl |= KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE;
-                value |= KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE;
+                writel(ctl, priv->io + KIRKWOOD_PLAYCTL);
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
                value = readl(priv->io + KIRKWOOD_INT_MASK);
                value &= ~KIRKWOOD_INT_CAUSE_PLAY_BYTES;
                writel(value, priv->io + KIRKWOOD_INT_MASK);
                /* disable all playbacks */
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                ctl &= ~(KIRKWOOD_PLAYCTL_I2S_EN | KIRKWOOD_PLAYCTL_SPDIF_EN);
-                value &= ~(KIRKWOOD_PLAYCTL_I2S_EN | KIRKWOOD_PLAYCTL_SPDIF_EN);
+                writel(ctl, priv->io + KIRKWOOD_PLAYCTL);
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
                break;
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
        case SNDRV_PCM_TRIGGER_SUSPEND:
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                ctl |= KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE;
-                value |= KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE;
+                writel(ctl, priv->io + KIRKWOOD_PLAYCTL);
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
                break;
        case SNDRV_PCM_TRIGGER_RESUME:
        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                value = readl(priv->io + KIRKWOOD_PLAYCTL);
+                ctl &= ~(KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE);
-                value &= ~(KIRKWOOD_PLAYCTL_PAUSE | KIRKWOOD_PLAYCTL_I2S_MUTE);
+                writel(ctl, priv->io + KIRKWOOD_PLAYCTL);
-                writel(value, priv->io + KIRKWOOD_PLAYCTL);
                break;
        default:
@@ -260,11 +265,6 @@ static int kirkwood_i2s_rec_trigger(struct snd_pcm_substream *substream,
        switch (cmd) {
        case SNDRV_PCM_TRIGGER_START:
-                /* stop audio, enable interrupts */
-                value = readl(priv->io + KIRKWOOD_RECCTL);
-                value |= KIRKWOOD_RECCTL_PAUSE;
-                writel(value, priv->io + KIRKWOOD_RECCTL);
                value = readl(priv->io + KIRKWOOD_INT_MASK);
                value |= KIRKWOOD_INT_CAUSE_REC_BYTES;
                writel(value, priv->io + KIRKWOOD_INT_MASK);
diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c
index aa037b292f3d..c294fbb523fc 100644
--- a/sound/soc/mxs/mxs-saif.c
+++ b/sound/soc/mxs/mxs-saif.c
@@ -523,16 +523,24 @@ static int mxs_saif_trigger(struct snd_pcm_substream *substream, int cmd,
                if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
                        /*
-                         * write a data to saif data register to trigger
+                         * write data to saif data register to trigger
-                         * the transfer
+                         * the transfer.
+                         * For 24-bit format the 32-bit FIFO register stores
+                         * only one channel, so we need to write twice.
+                         * This is also safe for the other non 24-bit formats.
                         */
                        __raw_writel(0, saif->base + SAIF_DATA);
+                        __raw_writel(0, saif->base + SAIF_DATA);
                } else {
                        /*
-                         * read a data from saif data register to trigger
+                         * read data from saif data register to trigger
-                         * the receive
+                         * the receive.
+                         * For 24-bit format the 32-bit FIFO register stores
+                         * only one channel, so we need to read twice.
+                         * This is also safe for the other non 24-bit formats.
                         */
                        __raw_readl(saif->base + SAIF_DATA);
+                        __raw_readl(saif->base + SAIF_DATA);
                }
                master_saif->ongoing = 1;
@@ -812,3 +820,4 @@ module_platform_driver(mxs_saif_driver);
 MODULE_AUTHOR("Freescale Semiconductor, Inc.");
 MODULE_DESCRIPTION("MXS ASoC SAIF driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:mxs-saif");
diff --git a/sound/soc/samsung/Kconfig b/sound/soc/samsung/Kconfig
index e7b83179aca2..3c7c3a59ed39 100644
--- a/sound/soc/samsung/Kconfig
+++ b/sound/soc/samsung/Kconfig
@@ -207,6 +207,8 @@ config SND_SOC_BELLS
        select SND_SOC_WM5102
        select SND_SOC_WM5110
        select SND_SOC_WM9081
+        select SND_SOC_WM0010
+        select SND_SOC_WM1250_EV1
 config SND_SOC_LOWLAND
        tristate "Audio support for Wolfson Lowland"
diff --git a/sound/soc/samsung/bells.c b/sound/soc/samsung/bells.c
index b0d46d63d55e..a2ca1567b9e4 100644
--- a/sound/soc/samsung/bells.c
+++ b/sound/soc/samsung/bells.c
@@ -212,7 +212,7 @@ static struct snd_soc_dai_link bells_dai_wm5102[] = {
        {
                .name = "Sub",
                .stream_name = "Sub",
-                .cpu_dai_name = "wm5110-aif3",
+                .cpu_dai_name = "wm5102-aif3",
                .codec_dai_name = "wm9081-hifi",
                .codec_name = "wm9081.1-006c",
                .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d1198627fc40..10d21be383f6 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2786,8 +2786,9 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
        val = (ucontrol->value.integer.value[0] + min) & mask;
        val = val << shift;
-        if (snd_soc_update_bits_locked(codec, reg, val_mask, val))
+        err = snd_soc_update_bits_locked(codec, reg, val_mask, val);
-                        return err;
+        if (err < 0)
+                return err;
        if (snd_soc_volsw_is_stereo(mc)) {
                val_mask = mask << rshift;
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index d0a4be38dc0f..6e35bcae02df 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3745,7 +3745,7 @@ void snd_soc_dapm_shutdown(struct snd_soc_card *card)
 {
        struct snd_soc_codec *codec;
-        list_for_each_entry(codec, &card->codec_dev_list, list) {
+        list_for_each_entry(codec, &card->codec_dev_list, card_list) {
                soc_dapm_shutdown_codec(&codec->dapm);
                if (codec->dapm.bias_level == SND_SOC_BIAS_STANDBY)
                        snd_soc_dapm_set_bias_level(&codec->dapm,
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 282f0fc9fed1..dbf7999d18b4 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -559,9 +559,11 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                return;
        card = chip->card;
-        mutex_lock(&register_mutex);
        down_write(&chip->shutdown_rwsem);
        chip->shutdown = 1;
+        up_write(&chip->shutdown_rwsem);
+        mutex_lock(&register_mutex);
        chip->num_interfaces--;
        if (chip->num_interfaces <= 0) {
                snd_card_disconnect(card);
@@ -582,11 +584,9 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
                        snd_usb_mixer_disconnect(p);
                }
                usb_chip[chip->index] = NULL;
-                up_write(&chip->shutdown_rwsem);
                mutex_unlock(&register_mutex);
                snd_card_free_when_closed(card);
        } else {
-                up_write(&chip->shutdown_rwsem);
                mutex_unlock(&register_mutex);
        }
 }
diff --git a/sound/usb/midi.c b/sound/usb/midi.c
index c83f6143c0eb..eeefbce3873c 100644
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -148,6 +148,7 @@ struct snd_usb_midi_out_endpoint {
                struct snd_usb_midi_out_endpoint* ep;
                struct snd_rawmidi_substream *substream;
                int active;
+                bool autopm_reference;
                uint8_t cable;          /* cable number << 4 */
                uint8_t state;
 #define STATE_UNKNOWN   0
@@ -1076,7 +1077,8 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream)
                return -ENXIO;
        }
        err = usb_autopm_get_interface(umidi->iface);
-        if (err < 0)
+        port->autopm_reference = err >= 0;
+        if (err < 0 && err != -EACCES)
                return -EIO;
        substream->runtime->private_data = port;
        port->state = STATE_UNKNOWN;
@@ -1087,9 +1089,11 @@ static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream)
 static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
 {
        struct snd_usb_midi* umidi = substream->rmidi->private_data;
+        struct usbmidi_out_port *port = substream->runtime->private_data;
        substream_open(substream, 0);
-        usb_autopm_put_interface(umidi->iface);
+        if (port->autopm_reference)
+                usb_autopm_put_interface(umidi->iface);
        return 0;
 }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 5c12a3fe8c3e..ef6fa24fc473 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -459,7 +459,7 @@ static int configure_endpoint(struct snd_usb_substream *subs)
                return ret;
        if (subs->sync_endpoint)
-                ret = snd_usb_endpoint_set_params(subs->data_endpoint,
+                ret = snd_usb_endpoint_set_params(subs->sync_endpoint,
                                                  subs->pcm_format,
                                                  subs->channels,
                                                  subs->period_bytes,
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 2655ae9a3ad8..ea095abbe97e 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -206,8 +206,10 @@ int get_msr(int cpu, off_t offset, unsigned long long *msr)
        retval = pread(fd, msr, sizeof *msr, offset);
        close(fd);
-        if (retval != sizeof *msr)
+        if (retval != sizeof *msr) {
+                fprintf(stderr, "%s offset 0x%zx read failed\n", pathname, offset);
                return -1;
+        }
        return 0;
 }
@@ -1101,7 +1103,9 @@ void turbostat_loop()
 restart:
        retval = for_all_cpus(get_counters, EVEN_COUNTERS);
-        if (retval) {
+        if (retval < -1) {
+                exit(retval);
+        } else if (retval == -1) {
                re_initialize();
                goto restart;
        }
@@ -1114,7 +1118,9 @@ restart:
                }
                sleep(interval_sec);
                retval = for_all_cpus(get_counters, ODD_COUNTERS);
-                if (retval) {
+                if (retval < -1) {
+                        exit(retval);
+                } else if (retval == -1) {
                        re_initialize();
                        goto restart;
                }
@@ -1126,7 +1132,9 @@ restart:
                flush_stdout();
                sleep(interval_sec);
                retval = for_all_cpus(get_counters, EVEN_COUNTERS);
-                if (retval) {
+                if (retval < -1) {
+                        exit(retval);
+                } else if (retval == -1) {
                        re_initialize();
                        goto restart;
                }
@@ -1545,8 +1553,11 @@ void turbostat_init()
 int fork_it(char **argv)
 {
        pid_t child_pid;
+        int status;
-        for_all_cpus(get_counters, EVEN_COUNTERS);
+        status = for_all_cpus(get_counters, EVEN_COUNTERS);
+        if (status)
+                exit(status);
        /* clear affinity side-effect of get_counters() */
        sched_setaffinity(0, cpu_present_setsize, cpu_present_set);
        gettimeofday(&tv_even, (struct timezone *)NULL);
@@ -1556,7 +1567,6 @@ int fork_it(char **argv)
                /* child */
                execvp(argv[0], argv);
        } else {
-                int status;
                /* parent */
                if (child_pid == -1) {
@@ -1568,7 +1578,7 @@ int fork_it(char **argv)
                signal(SIGQUIT, SIG_IGN);
                if (waitpid(child_pid, &status, 0) == -1) {
                        perror("wait");
-                        exit(1);
+                        exit(status);
                }
        }
        /*
@@ -1585,7 +1595,7 @@ int fork_it(char **argv)
        fprintf(stderr, "%.6f sec\n", tv_delta.tv_sec + tv_delta.tv_usec/1000000.0);
-        return 0;
+        return status;
 }
 void cmdline(int argc, char **argv)
@@ -1594,7 +1604,7 @@ void cmdline(int argc, char **argv)
        progname = argv[0];
-        while ((opt = getopt(argc, argv, "+pPSvisc:sC:m:M:")) != -1) {
+        while ((opt = getopt(argc, argv, "+pPSvi:sc:sC:m:M:")) != -1) {
                switch (opt) {
                case 'p':
                        show_core_only++;