244 files changed, 1866 insertions, 1260 deletions
diff --git a/MAINTAINERS b/MAINTAINERS
index ed48d55662c1..3b5fe0c09c23 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -269,7 +269,6 @@ S:	Orphan
 F:      drivers/platform/x86/wmi.c
 AD1889 ALSA SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 M:      Thibaut Varene <T-Bone@parisc-linux.org>
 W:      http://wiki.parisc-linux.org/AD1889
 L:      linux-parisc@vger.kernel.org
@@ -3049,7 +3048,6 @@ F:	drivers/hwspinlock/hwspinlock_*
 F:      include/linux/hwspinlock.h
 HARMONY SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 L:      linux-parisc@vger.kernel.org
 S:      Maintained
 F:      sound/parisc/harmony.*
@@ -5000,9 +4998,8 @@ F:	Documentation/blockdev/paride.txt
 F:      drivers/block/paride/
 PARISC ARCHITECTURE
-M:      Kyle McMartin <kyle@mcmartin.ca>
-M:      Helge Deller <deller@gmx.de>
 M:      "James E.J. Bottomley" <jejb@parisc-linux.org>
+M:      Helge Deller <deller@gmx.de>
 L:      linux-parisc@vger.kernel.org
 W:      http://www.parisc-linux.org/
 Q:      http://patchwork.kernel.org/project/linux-parisc/list/
@@ -5861,7 +5858,7 @@ S:	Maintained
 F:      drivers/mmc/host/sdhci-spear.c
 SECURITY SUBSYSTEM
-M:      James Morris <jmorris@namei.org>
+M:      James Morris <james.l.morris@oracle.com>
 L:      linux-security-module@vger.kernel.org (suggested Cc:)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git
 W:      http://security.wiki.kernel.org/
@@ -5874,7 +5871,7 @@ S:	Supported
 SELINUX SECURITY MODULE
 M:      Stephen Smalley <sds@tycho.nsa.gov>
-M:      James Morris <jmorris@namei.org>
+M:      James Morris <james.l.morris@oracle.com>
 M:      Eric Paris <eparis@parisplace.org>
 L:      selinux@tycho.nsa.gov (subscribers-only, general discussion)
 W:      http://selinuxproject.org
diff --git a/Makefile b/Makefile
index 4ddd641ab615..b61a9638b6fc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/arm/common/it8152.c b/arch/arm/common/it8152.c
index d1bcd7b13ebc..fb1f1cfce60c 100644
--- a/arch/arm/common/it8152.c
+++ b/arch/arm/common/it8152.c
@@ -320,13 +320,6 @@ err0:
        return -EBUSY;
 }
-/*
- * If we set up a device for bus mastering, we need to check the latency
- * timer as we don't have even crappy BIOSes to set it properly.
- * The implementation is from arch/i386/pci/i386.c
- */
-unsigned int pcibios_max_latency = 255;
 /* ITE bridge requires setting latency timer to avoid early bus access
   termination by PCI bus master devices
 */
diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index d8e44a43047c..ff3ad2244824 100644
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -1502,12 +1502,13 @@ int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op)
        struct pl330_thread *thrd = ch_id;
        struct pl330_dmac *pl330;
        unsigned long flags;
-        int ret = 0, active = thrd->req_running;
+        int ret = 0, active;
        if (!thrd || thrd->free || thrd->dmac->state == DYING)
                return -EINVAL;
        pl330 = thrd->dmac;
+        active = thrd->req_running;
        spin_lock_irqsave(&pl330->lock, flags);
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 62f8095d46de..23371b17b23e 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -137,6 +137,11 @@
        disable_irq
        .endm
+        .macro  save_and_disable_irqs_notrace, oldcpsr
+        mrs     \oldcpsr, cpsr
+        disable_irq_notrace
+        .endm
 /*
 * Restore interrupt state previously stored in a register.  We don't
 * guarantee that this will preserve the flags.
diff --git a/arch/arm/include/asm/hardware/pl330.h b/arch/arm/include/asm/hardware/pl330.h
index 575fa8186ca0..c1821385abfa 100644
--- a/arch/arm/include/asm/hardware/pl330.h
+++ b/arch/arm/include/asm/hardware/pl330.h
@@ -41,7 +41,7 @@ enum pl330_dstcachectrl {
        DCCTRL1, /* Bufferable only */
        DCCTRL2, /* Cacheable, but do not allocate */
        DCCTRL3, /* Cacheable and bufferable, but do not allocate */
-        DINVALID1 = 8,
+        DINVALID1,              /* AWCACHE = 0x1000 */
        DINVALID2,
        DCCTRL6, /* Cacheable write-through, allocate on writes only */
        DCCTRL7, /* Cacheable write-back, allocate on writes only */
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index ce280b8d613c..cb8d638924fd 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -22,6 +22,7 @@
 #include <asm/hw_breakpoint.h>
 #include <asm/ptrace.h>
 #include <asm/types.h>
+#include <asm/system.h>
 #ifdef __KERNEL__
 #define STACK_TOP       ((current->personality & ADDR_LIMIT_32BIT) ? \
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index e33870ff0ac0..ede6443c34d9 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -23,6 +23,7 @@
 #include <linux/perf_event.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/regset.h>
+#include <linux/audit.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -904,6 +905,12 @@ long arch_ptrace(struct task_struct *child, long request,
        return ret;
 }
+#ifdef __ARMEB__
+#define AUDIT_ARCH_NR AUDIT_ARCH_ARMEB
+#else
+#define AUDIT_ARCH_NR AUDIT_ARCH_ARM
+#endif
 asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
 {
        unsigned long ip;
@@ -918,7 +925,7 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
        if (!ip)
                audit_syscall_exit(regs);
        else
-                audit_syscall_entry(AUDIT_ARCH_ARMEB, scno, regs->ARM_r0,
+                audit_syscall_entry(AUDIT_ARCH_NR, scno, regs->ARM_r0,
                                    regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
        if (!test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index 4285daa077b0..7a79b24597b2 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -129,7 +129,7 @@ static struct notifier_block twd_cpufreq_nb = {
 static int twd_cpufreq_init(void)
 {
-        if (!IS_ERR(twd_clk))
+        if (twd_evt && *__this_cpu_ptr(twd_evt) && !IS_ERR(twd_clk))
                return cpufreq_register_notifier(&twd_cpufreq_nb,
                        CPUFREQ_TRANSITION_NOTIFIER);
diff --git a/arch/arm/mach-omap2/voltagedomains3xxx_data.c b/arch/arm/mach-omap2/voltagedomains3xxx_data.c
index c005e2f5e383..57db2038b23c 100644
--- a/arch/arm/mach-omap2/voltagedomains3xxx_data.c
+++ b/arch/arm/mach-omap2/voltagedomains3xxx_data.c
@@ -108,6 +108,7 @@ void __init omap3xxx_voltagedomains_init(void)
         * XXX Will depend on the process, validation, and binning
         * for the currently-running IC
         */
+#ifdef CONFIG_PM_OPP
        if (cpu_is_omap3630()) {
                omap3_voltdm_mpu.volt_data = omap36xx_vddmpu_volt_data;
                omap3_voltdm_core.volt_data = omap36xx_vddcore_volt_data;
@@ -115,6 +116,7 @@ void __init omap3xxx_voltagedomains_init(void)
                omap3_voltdm_mpu.volt_data = omap34xx_vddmpu_volt_data;
                omap3_voltdm_core.volt_data = omap34xx_vddcore_volt_data;
        }
+#endif
        if (cpu_is_omap3517() || cpu_is_omap3505())
                voltdms = voltagedomains_am35xx;
diff --git a/arch/arm/mach-omap2/voltagedomains44xx_data.c b/arch/arm/mach-omap2/voltagedomains44xx_data.c
index 4e11d022595d..c3115f6853d4 100644
--- a/arch/arm/mach-omap2/voltagedomains44xx_data.c
+++ b/arch/arm/mach-omap2/voltagedomains44xx_data.c
@@ -100,9 +100,11 @@ void __init omap44xx_voltagedomains_init(void)
         * XXX Will depend on the process, validation, and binning
         * for the currently-running IC
         */
+#ifdef CONFIG_PM_OPP
        omap4_voltdm_mpu.volt_data = omap44xx_vdd_mpu_volt_data;
        omap4_voltdm_iva.volt_data = omap44xx_vdd_iva_volt_data;
        omap4_voltdm_core.volt_data = omap44xx_vdd_core_volt_data;
+#endif
        for (i = 0; voltdm = voltagedomains_omap4[i], voltdm; i++)
                voltdm->sys_clk.name = sys_clk_name;
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index eff8a96c75ee..068b754bc348 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -30,6 +30,7 @@
 #include <linux/serial_sci.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/mmc/host.h>
@@ -37,7 +38,6 @@
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/mfd/tmio.h>
 #include <linux/sh_clk.h>
-#include <linux/dma-mapping.h>
 #include <video/sh_mobile_lcdc.h>
 #include <video/sh_mipi_dsi.h>
 #include <sound/sh_fsi.h>
@@ -159,19 +159,12 @@ static struct resource sh_mmcif_resources[] = {
        },
 };
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
 static struct sh_mmcif_plat_data sh_mmcif_platdata = {
        .sup_pclk       = 0,
        .ocr            = MMC_VDD_165_195,
        .caps           = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 static struct platform_device mmc_device = {
@@ -321,12 +314,11 @@ static struct resource mipidsi0_resources[] = {
        },
 };
-#define DSI0PHYCR       0xe615006c
 static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                                 void __iomem *base,
                                 int enable)
 {
-        struct clk *pck;
+        struct clk *pck, *phy;
        int ret;
        pck = clk_get(&pdev->dev, "dsip_clk");
@@ -335,18 +327,27 @@ static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                goto sh_mipi_set_dot_clock_pck_err;
        }
+        phy = clk_get(&pdev->dev, "dsiphy_clk");
+        if (IS_ERR(phy)) {
+                ret = PTR_ERR(phy);
+                goto sh_mipi_set_dot_clock_phy_err;
+        }
        if (enable) {
                clk_set_rate(pck, clk_round_rate(pck,  24000000));
-                __raw_writel(0x2a809010, DSI0PHYCR);
+                clk_set_rate(phy, clk_round_rate(pck, 510000000));
                clk_enable(pck);
+                clk_enable(phy);
        } else {
                clk_disable(pck);
+                clk_disable(phy);
        }
        ret = 0;
+        clk_put(phy);
+sh_mipi_set_dot_clock_phy_err:
        clk_put(pck);
 sh_mipi_set_dot_clock_pck_err:
        return ret;
 }
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index aab0a349f759..eeb4d9664584 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -295,15 +295,6 @@ static struct resource sh_mmcif_resources[] = {
        },
 };
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
        .sup_pclk       = 0,
        .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -311,7 +302,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                          MMC_CAP_8_BIT_DATA |
                          MMC_CAP_NEEDS_POLL,
        .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/arm/mach-shmobile/board-kota2.c b/arch/arm/mach-shmobile/board-kota2.c
index 857ceeec1bb0..c8e7ca23fc06 100644
--- a/arch/arm/mach-shmobile/board-kota2.c
+++ b/arch/arm/mach-shmobile/board-kota2.c
@@ -143,11 +143,10 @@ static struct gpio_keys_button gpio_buttons[] = {
 static struct gpio_keys_platform_data gpio_key_info = {
        .buttons        = gpio_buttons,
        .nbuttons       = ARRAY_SIZE(gpio_buttons),
-        .poll_interval  = 250, /* polled for now */
 };
 static struct platform_device gpio_keys_device = {
-        .name   = "gpio-keys-polled", /* polled for now */
+        .name   = "gpio-keys",
        .id     = -1,
        .dev    = {
                .platform_data  = &gpio_key_info,
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 9b42fbd10f8e..a2813247b455 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -43,7 +43,6 @@
 #include <linux/smsc911x.h>
 #include <linux/sh_intc.h>
 #include <linux/tca6416_keypad.h>
-#include <linux/usb/r8a66597.h>
 #include <linux/usb/renesas_usbhs.h>
 #include <linux/dma-mapping.h>
@@ -145,11 +144,6 @@
 * 1-2 short | VBUS 5V       | Host
 * open      | external VBUS | Function
 *
- * *1
- * CN31 is used as
- * CONFIG_USB_R8A66597_HCD      Host
- * CONFIG_USB_RENESAS_USBHS     Function
- *
 * CAUTION
 *
 * renesas_usbhs driver can use external interrupt mode
@@ -161,15 +155,6 @@
 * mackerel can not use external interrupt (IRQ7-PORT167) mode on "USB0",
 * because Touchscreen is using IRQ7-PORT40.
 * It is impossible to use IRQ7 demux on this board.
- *
- * We can use external interrupt mode USB-Function on "USB1".
- * USB1 can become Host by r8a66597, and become Function by renesas_usbhs.
- * But don't select both drivers in same time.
- * These uses same IRQ number for request_irq(), and aren't supporting
- * IRQF_SHARED / IORESOURCE_IRQ_SHAREABLE.
- *
- * Actually these are old/new version of USB driver.
- * This mean its register will be broken if it supports shared IRQ,
 */
 /*
@@ -208,6 +193,16 @@
 */
 /*
+ * FSI - AK4642
+ *
+ * it needs amixer settings for playing
+ *
+ * amixer set "Headphone" on
+ * amixer set "HPOUTL Mixer DACH" on
+ * amixer set "HPOUTR Mixer DACH" on
+ */
+/*
 * FIXME !!
 *
 * gpio_no_direction
@@ -676,51 +671,16 @@ static struct platform_device usbhs0_device = {
 * Use J30 to select between Host and Function. This setting
 * can however not be detected by software. Hotplug of USBHS1
 * is provided via IRQ8.
+ *
+ * Current USB1 works as "USB Host".
+ *  - set J30 "short"
+ *
+ * If you want to use it as "USB gadget",
+ *  - J30 "open"
+ *  - modify usbhs1_get_id() USBHS_HOST -> USBHS_GADGET
+ *  - add .get_vbus = usbhs_get_vbus in usbhs1_private
 */
 #define IRQ8 evt2irq(0x0300)
-/* USBHS1 USB Host support via r8a66597_hcd */
-static void usb1_host_port_power(int port, int power)
-{
-        if (!power) /* only power-on is supported for now */
-                return;
-        /* set VBOUT/PWEN and EXTLP1 in DVSTCTR */
-        __raw_writew(__raw_readw(0xE68B0008) | 0x600, 0xE68B0008);
-}
-static struct r8a66597_platdata usb1_host_data = {
-        .on_chip        = 1,
-        .port_power     = usb1_host_port_power,
-};
-static struct resource usb1_host_resources[] = {
-        [0] = {
-                .name   = "USBHS1",
-                .start  = 0xe68b0000,
-                .end    = 0xe68b00e6 - 1,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = evt2irq(0x1ce0) /* USB1_USB1I0 */,
-                .flags  = IORESOURCE_IRQ,
-        },
-};
-static struct platform_device usb1_host_device = {
-        .name   = "r8a66597_hcd",
-        .id     = 1,
-        .dev = {
-                .dma_mask               = NULL,         /*  not use dma */
-                .coherent_dma_mask      = 0xffffffff,
-                .platform_data          = &usb1_host_data,
-        },
-        .num_resources  = ARRAY_SIZE(usb1_host_resources),
-        .resource       = usb1_host_resources,
-};
-/* USBHS1 USB Function support via renesas_usbhs */
 #define USB_PHY_MODE            (1 << 4)
 #define USB_PHY_INT_EN          ((1 << 3) | (1 << 2))
 #define USB_PHY_ON              (1 << 1)
@@ -776,7 +736,7 @@ static void usbhs1_hardware_exit(struct platform_device *pdev)
 static int usbhs1_get_id(struct platform_device *pdev)
 {
-        return USBHS_GADGET;
+        return USBHS_HOST;
 }
 static u32 usbhs1_pipe_cfg[] = {
@@ -807,7 +767,6 @@ static struct usbhs_private usbhs1_private = {
                        .hardware_exit  = usbhs1_hardware_exit,
                        .get_id         = usbhs1_get_id,
                        .phy_reset      = usbhs_phy_reset,
-                        .get_vbus       = usbhs_get_vbus,
                },
                .driver_param = {
                        .buswait_bwait  = 4,
@@ -1184,15 +1143,6 @@ static struct resource sh_mmcif_resources[] = {
        },
 };
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
        .sup_pclk       = 0,
        .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -1200,7 +1150,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                          MMC_CAP_8_BIT_DATA |
                          MMC_CAP_NEEDS_POLL,
        .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 static struct platform_device sh_mmcif_device = {
@@ -1311,7 +1262,6 @@ static struct platform_device *mackerel_devices[] __initdata = {
        &nor_flash_device,
        &smc911x_device,
        &lcdc_device,
-        &usb1_host_device,
        &usbhs1_device,
        &usbhs0_device,
        &leds_device,
@@ -1473,9 +1423,6 @@ static void __init mackerel_init(void)
        gpio_pull_down(GPIO_PORT167CR); /* VBUS0_1 pull down */
        gpio_request(GPIO_FN_IDIN_1_113, NULL);
-        /* USB phy tweak to make the r8a66597_hcd host driver work */
-        __raw_writew(0x8a0a, 0xe6058130);       /* USBCR4 */
        /* enable FSI2 port A (ak4643) */
        gpio_request(GPIO_FN_FSIAIBT,   NULL);
        gpio_request(GPIO_FN_FSIAILR,   NULL);
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index afbead6a6e17..7727cca6136c 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -365,6 +365,114 @@ static struct clk div6_clks[DIV6_NR] = {
                        dsi_parent, ARRAY_SIZE(dsi_parent), 12, 3),
 };
+/* DSI DIV */
+static unsigned long dsiphy_recalc(struct clk *clk)
+{
+        u32 value;
+        value = __raw_readl(clk->mapping->base);
+        /* FIXME */
+        if (!(value & 0x000B8000))
+                return clk->parent->rate;
+        value &= 0x3f;
+        value += 1;
+        if ((value < 12) ||
+            (value > 33)) {
+                pr_err("DSIPHY has wrong value (%d)", value);
+                return 0;
+        }
+        return clk->parent->rate / value;
+}
+static long dsiphy_round_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_rate_mult_range_round(clk, 12, 33, rate);
+}
+static void dsiphy_disable(struct clk *clk)
+{
+        u32 value;
+        value = __raw_readl(clk->mapping->base);
+        value &= ~0x000B8000;
+        __raw_writel(value , clk->mapping->base);
+}
+static int dsiphy_enable(struct clk *clk)
+{
+        u32 value;
+        int multi;
+        value = __raw_readl(clk->mapping->base);
+        multi = (value & 0x3f) + 1;
+        if ((multi < 12) || (multi > 33))
+                return -EIO;
+        __raw_writel(value | 0x000B8000, clk->mapping->base);
+        return 0;
+}
+static int dsiphy_set_rate(struct clk *clk, unsigned long rate)
+{
+        u32 value;
+        int idx;
+        idx = rate / clk->parent->rate;
+        if ((idx < 12) || (idx > 33))
+                return -EINVAL;
+        idx += -1;
+        value = __raw_readl(clk->mapping->base);
+        value = (value & ~0x3f) + idx;
+        __raw_writel(value, clk->mapping->base);
+        return 0;
+}
+static struct clk_ops dsiphy_clk_ops = {
+        .recalc         = dsiphy_recalc,
+        .round_rate     = dsiphy_round_rate,
+        .set_rate       = dsiphy_set_rate,
+        .enable         = dsiphy_enable,
+        .disable        = dsiphy_disable,
+};
+static struct clk_mapping dsi0phy_clk_mapping = {
+        .phys   = DSI0PHYCR,
+        .len    = 4,
+};
+static struct clk_mapping dsi1phy_clk_mapping = {
+        .phys   = DSI1PHYCR,
+        .len    = 4,
+};
+static struct clk dsi0phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI0P], /* late install */
+        .mapping        = &dsi0phy_clk_mapping,
+};
+static struct clk dsi1phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI1P], /* late install */
+        .mapping        = &dsi1phy_clk_mapping,
+};
+static struct clk *late_main_clks[] = {
+        &dsi0phy_clk,
+        &dsi1phy_clk,
+};
 enum { MSTP001,
        MSTP129, MSTP128, MSTP127, MSTP126, MSTP125, MSTP118, MSTP116, MSTP100,
        MSTP219,
@@ -429,6 +537,8 @@ static struct clk_lookup lookups[] = {
        CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSIT]),
        CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSI0P]),
        CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSI1P]),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.0", &dsi0phy_clk),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.1", &dsi1phy_clk),
        /* MSTP32 clocks */
        CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* I2C2 */
@@ -504,6 +614,9 @@ void __init sh73a0_clock_init(void)
        if (!ret)
                ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
+        for (k = 0; !ret && (k < ARRAY_SIZE(late_main_clks)); k++)
+                ret = clk_register(late_main_clks[k]);
        clkdev_add_table(lookups, ARRAY_SIZE(lookups));
        if (!ret)
diff --git a/arch/arm/mach-shmobile/include/mach/sh73a0.h b/arch/arm/mach-shmobile/include/mach/sh73a0.h
index 881d515a9686..cad57578ceed 100644
--- a/arch/arm/mach-shmobile/include/mach/sh73a0.h
+++ b/arch/arm/mach-shmobile/include/mach/sh73a0.h
@@ -515,8 +515,8 @@ enum {
        SHDMA_SLAVE_MMCIF_RX,
 };
-/* PINT interrupts are located at Linux IRQ 768 and up */
+/* PINT interrupts are located at Linux IRQ 800 and up */
-#define SH73A0_PINT0_IRQ(irq) ((irq) + 768)
+#define SH73A0_PINT0_IRQ(irq) ((irq) + 800)
-#define SH73A0_PINT1_IRQ(irq) ((irq) + 800)
+#define SH73A0_PINT1_IRQ(irq) ((irq) + 832)
 #endif /* __ASM_SH73A0_H__ */
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index 1eda6b0b69e3..9857595eaa79 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/sh_intc.h>
@@ -445,6 +446,7 @@ void __init sh73a0_init_irq(void)
                setup_irq(gic_spi(1 + k), &sh73a0_irq_pin_cascade[k]);
                n = intcs_evt2irq(to_intc_vect(gic_spi(1 + k)));
+                WARN_ON(irq_alloc_desc_at(n, numa_node_id()) != n);
                irq_set_chip_and_handler_name(n, &intca_gic_irq_chip,
                                              handle_level_irq, "level");
                set_irq_flags(n, IRQF_VALID); /* yuck */
diff --git a/arch/arm/mach-shmobile/pfc-r8a7779.c b/arch/arm/mach-shmobile/pfc-r8a7779.c
index 963532f2b2c4..d14c9b048077 100644
--- a/arch/arm/mach-shmobile/pfc-r8a7779.c
+++ b/arch/arm/mach-shmobile/pfc-r8a7779.c
@@ -2120,7 +2120,7 @@ static struct pinmux_cfg_reg pinmux_config_regs[] = {
            FN_AUDATA3, 0, 0, 0 }
        },
        { PINMUX_CFG_REG_VAR("IPSR4", 0xfffc0030, 32,
-                             3, 1, 1, 1, 1, 1, 1, 3, 3, 1,
+                             3, 1, 1, 1, 1, 1, 1, 3, 3,
                             1, 1, 1, 1, 1, 1, 3, 3, 3, 2) {
            /* IP4_31_29 [3] */
            FN_DU1_DB0, FN_VI2_DATA4_VI2_B4, FN_SCL2_B, FN_SD3_DAT0,
diff --git a/arch/arm/mach-shmobile/pfc-sh7372.c b/arch/arm/mach-shmobile/pfc-sh7372.c
index 1bd6585a6acf..336093f9210a 100644
--- a/arch/arm/mach-shmobile/pfc-sh7372.c
+++ b/arch/arm/mach-shmobile/pfc-sh7372.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/gpio.h>
+#include <mach/irqs.h>
 #include <mach/sh7372.h>
 #define CPU_ALL_PORT(fn, pfx, sfx) \
@@ -1594,6 +1595,43 @@ static struct pinmux_data_reg pinmux_data_regs[] = {
        { },
 };
+#define EXT_IRQ16L(n) evt2irq(0x200 + ((n) << 5))
+#define EXT_IRQ16H(n) evt2irq(0x3200 + (((n) - 16) << 5))
+static struct pinmux_irq pinmux_irqs[] = {
+        PINMUX_IRQ(EXT_IRQ16L(0), PORT6_FN0, PORT162_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(1), PORT12_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(2), PORT4_FN0, PORT5_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(3), PORT8_FN0, PORT16_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(4), PORT17_FN0, PORT163_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(5), PORT18_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(6), PORT39_FN0, PORT164_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(7), PORT40_FN0, PORT167_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(8), PORT41_FN0, PORT168_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(9), PORT42_FN0, PORT169_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(10), PORT65_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(11), PORT67_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(12), PORT80_FN0, PORT137_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(13), PORT81_FN0, PORT145_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(14), PORT82_FN0, PORT146_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(15), PORT83_FN0, PORT147_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(16), PORT84_FN0, PORT170_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(17), PORT85_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(18), PORT86_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(19), PORT87_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(20), PORT92_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(21), PORT93_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(22), PORT94_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(23), PORT95_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(24), PORT112_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(25), PORT119_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(26), PORT121_FN0, PORT172_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(27), PORT122_FN0, PORT180_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(28), PORT123_FN0, PORT181_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(29), PORT129_FN0, PORT182_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(30), PORT130_FN0, PORT183_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(31), PORT138_FN0, PORT184_FN0),
+};
 static struct pinmux_info sh7372_pinmux_info = {
        .name = "sh7372_pfc",
        .reserved_id = PINMUX_RESERVED,
@@ -1614,6 +1652,9 @@ static struct pinmux_info sh7372_pinmux_info = {
        .gpio_data = pinmux_data,
        .gpio_data_size = ARRAY_SIZE(pinmux_data),
+        .gpio_irq = pinmux_irqs,
+        .gpio_irq_size = ARRAY_SIZE(pinmux_irqs),
 };
 void sh7372_pinmux_init(void)
diff --git a/arch/arm/mach-shmobile/smp-sh73a0.c b/arch/arm/mach-shmobile/smp-sh73a0.c
index 0d159d64a345..2d0d4212be41 100644
--- a/arch/arm/mach-shmobile/smp-sh73a0.c
+++ b/arch/arm/mach-shmobile/smp-sh73a0.c
@@ -80,7 +80,7 @@ int __cpuinit sh73a0_boot_secondary(unsigned int cpu)
        /* enable cache coherency */
        modify_scu_cpu_psr(0, 3 << (cpu * 8));
-        if (((__raw_readw(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
+        if (((__raw_readl(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
                __raw_writel(1 << cpu, __io(WUPCR));    /* wake up */
        else
                __raw_writel(1 << cpu, __io(SRESCR));   /* reset */
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 1a3ca2488164..7edef9121632 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -631,7 +631,8 @@ comment "Processor Features"
 config ARM_LPAE
        bool "Support for the Large Physical Address Extension"
-        depends on MMU && CPU_V7
+        depends on MMU && CPU_32v7 && !CPU_32v6 && !CPU_32v5 && \
+                !CPU_32v4 && !CPU_32v3
        help
          Say Y if you have an ARMv7 processor supporting the LPAE page
          table format and you would like to access memory beyond the
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 7a24d39661f0..a655d3da386d 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -55,7 +55,7 @@ loop1:
        cmp     r1, #2                          @ see what cache we have at this level
        blt     skip                            @ skip if no cache, or just i-cache
 #ifdef CONFIG_PREEMPT
-        save_and_disable_irqs r9                @ make cssr&csidr read atomic
+        save_and_disable_irqs_notrace r9        @ make cssr&csidr read atomic
 #endif
        mcr     p15, 2, r10, c0, c0, 0          @ select current cache level in cssr
        isb                                     @ isb to sych the new cssr&csidr
diff --git a/arch/c6x/boot/Makefile b/arch/c6x/boot/Makefile
index ecca820e6041..6891257d514c 100644
--- a/arch/c6x/boot/Makefile
+++ b/arch/c6x/boot/Makefile
@@ -13,7 +13,7 @@ obj-y += linked_dtb.o
 endif
 $(obj)/%.dtb: $(src)/dts/%.dts FORCE
-        $(call cmd,dtc)
+        $(call if_changed_dep,dtc)
 quiet_cmd_cp = CP      $< $@$2
        cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
diff --git a/arch/m68k/include/asm/mcf_pgtable.h b/arch/m68k/include/asm/mcf_pgtable.h
index 756bde4fb4f8..3c793682e5d9 100644
--- a/arch/m68k/include/asm/mcf_pgtable.h
+++ b/arch/m68k/include/asm/mcf_pgtable.h
@@ -78,7 +78,8 @@
                                 | CF_PAGE_READABLE \
                                 | CF_PAGE_WRITABLE \
                                 | CF_PAGE_EXEC \
-                                 | CF_PAGE_SYSTEM)
+                                 | CF_PAGE_SYSTEM \
+                                 | CF_PAGE_SHARED)
 #define PAGE_COPY       __pgprot(CF_PAGE_VALID \
                                 | CF_PAGE_ACCESSED \
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index babd5a97cdcb..875b800ef0dd 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -87,7 +87,7 @@ void __init paging_init(void)
 int cf_tlb_miss(struct pt_regs *regs, int write, int dtlb, int extension_word)
 {
-        unsigned long flags, mmuar;
+        unsigned long flags, mmuar, mmutr;
        struct mm_struct *mm;
        pgd_t *pgd;
        pmd_t *pmd;
@@ -137,9 +137,10 @@ int cf_tlb_miss(struct pt_regs *regs, int write, int dtlb, int extension_word)
        if (!pte_dirty(*pte) && !KMAPAREA(mmuar))
                set_pte(pte, pte_wrprotect(*pte));
-        mmu_write(MMUTR, (mmuar & PAGE_MASK) | (asid << MMUTR_IDN) |
+        mmutr = (mmuar & PAGE_MASK) | (asid << MMUTR_IDN) | MMUTR_V;
-                (((int)(pte->pte) & (int)CF_PAGE_MMUTR_MASK)
+        if ((mmuar < TASK_UNMAPPED_BASE) || (mmuar >= TASK_SIZE))
-                >> CF_PAGE_MMUTR_SHIFT) | MMUTR_V);
+                mmutr |= (pte->pte & CF_PAGE_MMUTR_MASK) >> CF_PAGE_MMUTR_SHIFT;
+        mmu_write(MMUTR, mmutr);
        mmu_write(MMUDR, (pte_val(*pte) & PAGE_MASK) |
                ((pte->pte) & CF_PAGE_MMUDR_MASK) | MMUDR_SZ_8KB | MMUDR_X);
diff --git a/arch/m68k/platform/coldfire/entry.S b/arch/m68k/platform/coldfire/entry.S
index 863889fc31c9..281e38c2b6c7 100644
--- a/arch/m68k/platform/coldfire/entry.S
+++ b/arch/m68k/platform/coldfire/entry.S
@@ -136,7 +136,7 @@ Luser_return:
        movel   %sp,%d1                 /* get thread_info pointer */
        andl    #-THREAD_SIZE,%d1       /* at base of kernel stack */
        movel   %d1,%a0
-        movel   %a0@(TINFO_FLAGS),%d1   /* get thread_info->flags */
+        moveb   %a0@(TINFO_FLAGS+3),%d1 /* thread_info->flags (low 8 bits) */
        jne     Lwork_to_do             /* still work to do */
 Lreturn:
@@ -148,8 +148,6 @@ Lwork_to_do:
        btst    #TIF_NEED_RESCHED,%d1
        jne     reschedule
-        /* GERG: do we need something here for TRACEing?? */
 Lsignal_return:
        subql   #4,%sp                  /* dummy return address */
        SAVE_SWITCH_STACK
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 4f80cf1ce77b..3e57a00b8cba 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -1213,7 +1213,7 @@ do_user_signal:			/* r10 contains MSR_KERNEL here */
        stw     r3,_TRAP(r1)
 2:      addi    r3,r1,STACK_FRAME_OVERHEAD
        mr      r4,r9
-        bl      do_signal
+        bl      do_notify_resume
        REST_NVGPRS(r1)
        b       recheck
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index d834425186ae..866462cbe2d8 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -751,12 +751,16 @@ user_work:
        andi.   r0,r4,_TIF_NEED_RESCHED
        beq     1f
+        li      r5,1
+        TRACE_AND_RESTORE_IRQ(r5);
        bl      .schedule
        b       .ret_from_except_lite
 1:      bl      .save_nvgprs
+        li      r5,1
+        TRACE_AND_RESTORE_IRQ(r5);
        addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .do_signal
+        bl      .do_notify_resume
        b       .ret_from_except
 unrecov_restore:
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3844ca7c5099..15c5a4f6de01 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -774,8 +774,8 @@ alignment_common:
 program_check_common:
        EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
        bl      .save_nvgprs
-        addi    r3,r1,STACK_FRAME_OVERHEAD
        DISABLE_INTS
+        addi    r3,r1,STACK_FRAME_OVERHEAD
        bl      .program_check_exception
        b       .ret_from_except
diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
index 2300426e531a..ac6e437b1021 100644
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -11,6 +11,7 @@
 #include <linux/tracehook.h>
 #include <linux/signal.h>
+#include <linux/key.h>
 #include <asm/hw_breakpoint.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -113,8 +114,9 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka,
        }
 }
-static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
+static int do_signal(struct pt_regs *regs)
 {
+        sigset_t *oldset;
        siginfo_t info;
        int signr;
        struct k_sigaction ka;
@@ -123,7 +125,7 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
        if (current_thread_info()->local_flags & _TLF_RESTORE_SIGMASK)
                oldset = &current->saved_sigmask;
-        else if (!oldset)
+        else
                oldset = &current->blocked;
        signr = get_signal_to_deliver(&info, &ka, regs, NULL);
@@ -191,14 +193,16 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
        return ret;
 }
-void do_signal(struct pt_regs *regs, unsigned long thread_info_flags)
+void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
 {
        if (thread_info_flags & _TIF_SIGPENDING)
-                do_signal_pending(NULL, regs);
+                do_signal(regs);
        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                clear_thread_flag(TIF_NOTIFY_RESUME);
                tracehook_notify_resume(regs);
+                if (current->replacement_session_keyring)
+                        key_replace_session_keyring();
        }
 }
diff --git a/arch/powerpc/kernel/signal.h b/arch/powerpc/kernel/signal.h
index 6c0ddfc0603e..8dde973aaaf5 100644
--- a/arch/powerpc/kernel/signal.h
+++ b/arch/powerpc/kernel/signal.h
@@ -12,7 +12,7 @@
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
-extern void do_signal(struct pt_regs *regs, unsigned long thread_info_flags);
+extern void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags);
 extern void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
                                  size_t frame_size, int is_32);
diff --git a/arch/powerpc/platforms/wsp/smp.c b/arch/powerpc/platforms/wsp/smp.c
index 71bd105f3863..0ba103ae83a5 100644
--- a/arch/powerpc/platforms/wsp/smp.c
+++ b/arch/powerpc/platforms/wsp/smp.c
@@ -71,7 +71,7 @@ int __devinit smp_a2_kick_cpu(int nr)
 static int __init smp_a2_probe(void)
 {
-        return cpus_weight(cpu_possible_map);
+        return num_possible_cpus();
 }
 static struct smp_ops_t a2_smp_ops = {
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 18c51df9fe06..ff605a39cf43 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -662,7 +662,7 @@ ENTRY(sys32_getresuid16_wrapper)
 ENTRY(sys32_poll_wrapper)
        llgtr   %r2,%r2                 # struct pollfd *
        llgfr   %r3,%r3                 # unsigned int
-        lgfr    %r4,%r4                 # long
+        lgfr    %r4,%r4                 # int
        jg      sys_poll                # branch to system call
 ENTRY(sys32_setresgid16_wrapper)
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 3201ae447990..4261aa799774 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -76,7 +76,6 @@ static void default_idle(void)
        if (test_thread_flag(TIF_MCCK_PENDING)) {
                local_mcck_enable();
                local_irq_enable();
-                s390_handle_mcck();
                return;
        }
        trace_hardirqs_on();
@@ -93,10 +92,12 @@ void cpu_idle(void)
        for (;;) {
                tick_nohz_idle_enter();
                rcu_idle_enter();
-                while (!need_resched())
+                while (!need_resched() && !test_thread_flag(TIF_MCCK_PENDING))
                        default_idle();
                rcu_idle_exit();
                tick_nohz_idle_exit();
+                if (test_thread_flag(TIF_MCCK_PENDING))
+                        s390_handle_mcck();
                preempt_enable_no_resched();
                schedule();
                preempt_disable();
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index fa02f443f5f6..14da278febbf 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -113,11 +113,14 @@ static void fixup_clock_comparator(unsigned long long delta)
 static int s390_next_ktime(ktime_t expires,
                           struct clock_event_device *evt)
 {
+        struct timespec ts;
        u64 nsecs;
-        nsecs = ktime_to_ns(ktime_sub(expires, ktime_get_monotonic_offset()));
+        ts.tv_sec = ts.tv_nsec = 0;
+        monotonic_to_bootbased(&ts);
+        nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
        do_div(nsecs, 125);
-        S390_lowcore.clock_comparator = TOD_UNIX_EPOCH + (nsecs << 9);
+        S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
        set_clock_comparator(S390_lowcore.clock_comparator);
        return 0;
 }
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 9a4d02f64f16..51b0738e13d1 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -574,7 +574,7 @@ static inline void page_table_free_pgste(unsigned long *table)
        page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
        mp = (struct gmap_pgtable *) page->index;
        BUG_ON(!list_empty(&mp->mapper));
-        pgtable_page_ctor(page);
+        pgtable_page_dtor(page);
        atomic_set(&page->_mapcount, -1);
        kfree(mp);
        __free_page(page);
diff --git a/arch/sh/boards/board-sh7757lcr.c b/arch/sh/boards/board-sh7757lcr.c
index 0838154dd216..24b1ee410daa 100644
--- a/arch/sh/boards/board-sh7757lcr.c
+++ b/arch/sh/boards/board-sh7757lcr.c
@@ -169,6 +169,11 @@ static struct resource sh_eth_giga1_resources[] = {
                .end    = 0xfee00fff,
                .flags  = IORESOURCE_MEM,
        }, {
+                /* TSU */
+                .start  = 0xfee01800,
+                .end    = 0xfee01fff,
+                .flags  = IORESOURCE_MEM,
+        }, {
                .start  = 316,
                .end    = 316,
                .flags  = IORESOURCE_IRQ,
@@ -210,20 +215,13 @@ static struct resource sh_mmcif_resources[] = {
        },
 };
-static struct sh_mmcif_dma sh7757lcr_mmcif_dma = {
-        .chan_priv_tx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_TX,
-        },
-        .chan_priv_rx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_RX,
-        }
-};
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
-        .dma            = &sh7757lcr_mmcif_dma,
        .sup_pclk       = 0x0f,
-        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA,
+        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA |
+                          MMC_CAP_NONREMOVABLE,
        .ocr            = MMC_VDD_32_33 | MMC_VDD_33_34,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/sh/boards/mach-ap325rxa/setup.c b/arch/sh/boards/mach-ap325rxa/setup.c
index 6418e95c2b6b..ebd0f818a25f 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -22,6 +22,7 @@
 #include <linux/i2c.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <media/ov772x.h>
 #include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 033ef2ba621f..cde7c0085ced 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -29,9 +29,11 @@
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <sound/sh_fsi.h>
 #include <media/sh_mobile_ceu.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <media/mt9t112.h>
 #include <asm/heartbeat.h>
diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index 2a18b06abdaf..5b382e1afaea 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -22,6 +22,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/i2c.h>
 #include <linux/usb/r8a66597.h>
+#include <linux/videodev2.h>
 #include <media/rj54n1cb0c.h>
 #include <media/soc_camera.h>
 #include <media/sh_mobile_ceu.h>
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index 68c3d6f42896..d37ba2720527 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -21,9 +21,11 @@
 #include <linux/delay.h>
 #include <linux/clk.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <media/ov772x.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <asm/clock.h>
 #include <asm/machvec.h>
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 036fe1adaef1..2b07fc016950 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -24,6 +24,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/usb/r8a66597.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <sound/sh_fsi.h>
diff --git a/arch/sh/drivers/pci/pci-sh7780.c b/arch/sh/drivers/pci/pci-sh7780.c
index fa7b978cc727..fb8f14990743 100644
--- a/arch/sh/drivers/pci/pci-sh7780.c
+++ b/arch/sh/drivers/pci/pci-sh7780.c
@@ -74,7 +74,7 @@ struct pci_errors {
        { SH4_PCIINT_MLCK,      "master lock error" },
        { SH4_PCIINT_TABT,      "target-target abort" },
        { SH4_PCIINT_TRET,      "target retry time out" },
-        { SH4_PCIINT_MFDE,      "master function disable erorr" },
+        { SH4_PCIINT_MFDE,      "master function disable error" },
        { SH4_PCIINT_PRTY,      "address parity error" },
        { SH4_PCIINT_SERR,      "SERR" },
        { SH4_PCIINT_TWDP,      "data parity error for target write" },
diff --git a/arch/sh/include/asm/device.h b/arch/sh/include/asm/device.h
index a1c9c0daec10..071bcb4d4bfd 100644
--- a/arch/sh/include/asm/device.h
+++ b/arch/sh/include/asm/device.h
@@ -3,9 +3,10 @@
 *
 * This file is released under the GPLv2
 */
+#ifndef __ASM_SH_DEVICE_H
+#define __ASM_SH_DEVICE_H
-struct dev_archdata {
+#include <asm-generic/device.h>
-};
 struct platform_device;
 /* allocate contiguous memory chunk and fill in struct resource */
@@ -14,5 +15,4 @@ int platform_resource_setup_memory(struct platform_device *pdev,
 void plat_early_device_setup(void);
-struct pdev_archdata {
+#endif /* __ASM_SH_DEVICE_H */
-};
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
index b3c039a5064a..70bd96646f42 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
@@ -343,7 +343,7 @@ static struct clk_lookup lookups[] = {
        CLKDEV_DEV_ID("sh_mobile_ceu.1", &mstp_clks[HWBLK_CEU1]),
        CLKDEV_CON_ID("beu1", &mstp_clks[HWBLK_BEU1]),
        CLKDEV_CON_ID("2ddmac0", &mstp_clks[HWBLK_2DDMAC]),
-        CLKDEV_CON_ID("spu0", &mstp_clks[HWBLK_SPU]),
+        CLKDEV_DEV_ID("sh_fsi.0", &mstp_clks[HWBLK_SPU]),
        CLKDEV_CON_ID("jpu0", &mstp_clks[HWBLK_JPU]),
        CLKDEV_DEV_ID("sh-vou.0", &mstp_clks[HWBLK_VOU]),
        CLKDEV_CON_ID("beu0", &mstp_clks[HWBLK_BEU0]),
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
index a7b2da6b3a1a..2875e8be4f72 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
@@ -133,7 +133,7 @@ static struct resource spi0_resources[] = {
        [0] = {
                .start  = 0xfe002000,
                .end    = 0xfe0020ff,
-                .flags  = IORESOURCE_MEM,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_32BIT,
        },
        [1] = {
                .start  = 86,
@@ -661,6 +661,25 @@ static struct platform_device spi0_device = {
        .resource       = spi0_resources,
 };
+static struct resource spi1_resources[] = {
+        {
+                .start  = 0xffd8ee70,
+                .end    = 0xffd8eeff,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_8BIT,
+        },
+        {
+                .start  = 54,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device spi1_device = {
+        .name   = "sh_spi",
+        .id     = 1,
+        .num_resources  = ARRAY_SIZE(spi1_resources),
+        .resource       = spi1_resources,
+};
 static struct resource usb_ehci_resources[] = {
        [0] = {
                .start  = 0xfe4f1000,
@@ -720,6 +739,7 @@ static struct platform_device *sh7757_devices[] __initdata = {
        &dma2_device,
        &dma3_device,
        &spi0_device,
+        &spi1_device,
        &usb_ehci_device,
        &usb_ohci_device,
 };
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index 3147a9a6fb8b..f624174bf239 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -63,7 +63,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
        mp_ops->prepare_cpus(max_cpus);
 #ifndef CONFIG_HOTPLUG_CPU
-        init_cpu_present(&cpu_possible_map);
+        init_cpu_present(cpu_possible_mask);
 #endif
 }
diff --git a/arch/sh/kernel/topology.c b/arch/sh/kernel/topology.c
index 4649a6ff0cfe..772caffba22f 100644
--- a/arch/sh/kernel/topology.c
+++ b/arch/sh/kernel/topology.c
@@ -27,7 +27,7 @@ static cpumask_t cpu_coregroup_map(unsigned int cpu)
         * Presently all SH-X3 SMP cores are multi-cores, so just keep it
         * simple until we have a method for determining topology..
         */
-        return cpu_possible_map;
+        return *cpu_possible_mask;
 }
 const struct cpumask *cpu_coregroup_mask(unsigned int cpu)
diff --git a/arch/sh/mm/cache-sh2a.c b/arch/sh/mm/cache-sh2a.c
index ae08cbbfa569..949e2d3138a0 100644
--- a/arch/sh/mm/cache-sh2a.c
+++ b/arch/sh/mm/cache-sh2a.c
@@ -23,6 +23,7 @@
 #define MAX_OCACHE_PAGES        32
 #define MAX_ICACHE_PAGES        32
+#ifdef CONFIG_CACHE_WRITEBACK
 static void sh2a_flush_oc_line(unsigned long v, int way)
 {
        unsigned long addr = (v & 0x000007f0) | (way << 11);
@@ -34,6 +35,7 @@ static void sh2a_flush_oc_line(unsigned long v, int way)
                __raw_writel(data, CACHE_OC_ADDRESS_ARRAY | addr);
        }
 }
+#endif
 static void sh2a_invalidate_line(unsigned long cache_addr, unsigned long v)
 {
diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
index a850b4d8d14d..247904945d3f 100644
--- a/arch/x86/include/asm/i387.h
+++ b/arch/x86/include/asm/i387.h
@@ -29,10 +29,11 @@ extern unsigned int sig_xstate_size;
 extern void fpu_init(void);
 extern void mxcsr_feature_mask_init(void);
 extern int init_fpu(struct task_struct *child);
-extern void __math_state_restore(struct task_struct *);
 extern void math_state_restore(void);
 extern int dump_fpu(struct pt_regs *, struct user_i387_struct *);
+DECLARE_PER_CPU(struct task_struct *, fpu_owner_task);
 extern user_regset_active_fn fpregs_active, xfpregs_active;
 extern user_regset_get_fn fpregs_get, xfpregs_get, fpregs_soft_get,
                                xstateregs_get;
@@ -269,6 +270,16 @@ static inline int fpu_restore_checking(struct fpu *fpu)
 static inline int restore_fpu_checking(struct task_struct *tsk)
 {
+        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+           is pending.  Clear the x87 state here by setting it to fixed
+           values. "m" is a random variable that should be in L1 */
+        alternative_input(
+                ASM_NOP8 ASM_NOP2,
+                "emms\n\t"              /* clear stack tags */
+                "fildl %P[addr]",       /* set F?P to defined value */
+                X86_FEATURE_FXSAVE_LEAK,
+                [addr] "m" (tsk->thread.fpu.has_fpu));
        return fpu_restore_checking(&tsk->thread.fpu);
 }
@@ -279,19 +290,21 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
 */
 static inline int __thread_has_fpu(struct task_struct *tsk)
 {
-        return tsk->thread.has_fpu;
+        return tsk->thread.fpu.has_fpu;
 }
 /* Must be paired with an 'stts' after! */
 static inline void __thread_clear_has_fpu(struct task_struct *tsk)
 {
-        tsk->thread.has_fpu = 0;
+        tsk->thread.fpu.has_fpu = 0;
+        percpu_write(fpu_owner_task, NULL);
 }
 /* Must be paired with a 'clts' before! */
 static inline void __thread_set_has_fpu(struct task_struct *tsk)
 {
-        tsk->thread.has_fpu = 1;
+        tsk->thread.fpu.has_fpu = 1;
+        percpu_write(fpu_owner_task, tsk);
 }
 /*
@@ -336,30 +349,36 @@ typedef struct { int preload; } fpu_switch_t;
 * We don't do that yet, so "fpu_lazy_restore()" always returns
 * false, but some day..
 */
-#define fpu_lazy_restore(tsk) (0)
+static inline int fpu_lazy_restore(struct task_struct *new, unsigned int cpu)
-#define fpu_lazy_state_intact(tsk) do { } while (0)
+{
+        return new == percpu_read_stable(fpu_owner_task) &&
+                cpu == new->thread.fpu.last_cpu;
+}
-static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct task_struct *new)
+static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct task_struct *new, int cpu)
 {
        fpu_switch_t fpu;
        fpu.preload = tsk_used_math(new) && new->fpu_counter > 5;
        if (__thread_has_fpu(old)) {
-                if (__save_init_fpu(old))
+                if (!__save_init_fpu(old))
-                        fpu_lazy_state_intact(old);
+                        cpu = ~0;
-                __thread_clear_has_fpu(old);
+                old->thread.fpu.last_cpu = cpu;
-                old->fpu_counter++;
+                old->thread.fpu.has_fpu = 0;    /* But leave fpu_owner_task! */
                /* Don't change CR0.TS if we just switch! */
                if (fpu.preload) {
+                        new->fpu_counter++;
                        __thread_set_has_fpu(new);
                        prefetch(new->thread.fpu.state);
                } else
                        stts();
        } else {
                old->fpu_counter = 0;
+                old->thread.fpu.last_cpu = ~0;
                if (fpu.preload) {
-                        if (fpu_lazy_restore(new))
+                        new->fpu_counter++;
+                        if (fpu_lazy_restore(new, cpu))
                                fpu.preload = 0;
                        else
                                prefetch(new->thread.fpu.state);
@@ -377,8 +396,10 @@ static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct ta
 */
 static inline void switch_fpu_finish(struct task_struct *new, fpu_switch_t fpu)
 {
-        if (fpu.preload)
+        if (fpu.preload) {
-                __math_state_restore(new);
+                if (unlikely(restore_fpu_checking(new)))
+                        __thread_fpu_end(new);
+        }
 }
 /*
@@ -451,8 +472,10 @@ static inline void kernel_fpu_begin(void)
                __save_init_fpu(me);
                __thread_clear_has_fpu(me);
                /* We do 'stts()' in kernel_fpu_end() */
-        } else
+        } else {
+                percpu_write(fpu_owner_task, NULL);
                clts();
+        }
 }
 static inline void kernel_fpu_end(void)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index f7c89e231c6c..58545c97d071 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -374,6 +374,8 @@ union thread_xstate {
 };
 struct fpu {
+        unsigned int last_cpu;
+        unsigned int has_fpu;
        union thread_xstate *state;
 };
@@ -454,7 +456,6 @@ struct thread_struct {
        unsigned long           trap_no;
        unsigned long           error_code;
        /* floating point and extended processor state */
-        unsigned long           has_fpu;
        struct fpu              fpu;
 #ifdef CONFIG_X86_32
        /* Virtual 86 mode info */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d43cad74f166..c0f7d68d318f 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1044,6 +1044,9 @@ DEFINE_PER_CPU(char *, irq_stack_ptr) =
 DEFINE_PER_CPU(unsigned int, irq_count) = -1;
+DEFINE_PER_CPU(struct task_struct *, fpu_owner_task);
+EXPORT_PER_CPU_SYMBOL(fpu_owner_task);
 /*
 * Special IST stacks which the CPU switches to when it calls
 * an IST-marked descriptor entry. Up to 7 stacks (hardware
@@ -1111,6 +1114,8 @@ void debug_stack_reset(void)
 DEFINE_PER_CPU(struct task_struct *, current_task) = &init_task;
 EXPORT_PER_CPU_SYMBOL(current_task);
+DEFINE_PER_CPU(struct task_struct *, fpu_owner_task);
+EXPORT_PER_CPU_SYMBOL(fpu_owner_task);
 #ifdef CONFIG_CC_STACKPROTECTOR
 DEFINE_PER_CPU_ALIGNED(struct stack_canary, stack_canary);
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 80bfe1ab0031..c08d1ff12b7c 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -214,6 +214,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
        task_user_gs(p) = get_user_gs(regs);
+        p->fpu_counter = 0;
        p->thread.io_bitmap_ptr = NULL;
        tsk = current;
        err = -ENOMEM;
@@ -303,7 +304,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-        fpu = switch_fpu_prepare(prev_p, next_p);
+        fpu = switch_fpu_prepare(prev_p, next_p, cpu);
        /*
         * Reload esp0.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 1fd94bc4279d..cfa5c90c01db 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -286,6 +286,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
        set_tsk_thread_flag(p, TIF_FORK);
+        p->fpu_counter = 0;
        p->thread.io_bitmap_ptr = NULL;
        savesegment(gs, p->thread.gsindex);
@@ -388,7 +389,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        unsigned fsindex, gsindex;
        fpu_switch_t fpu;
-        fpu = switch_fpu_prepare(prev_p, next_p);
+        fpu = switch_fpu_prepare(prev_p, next_p, cpu);
        /*
         * Reload esp0, LDT and the page table pointer:
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 77da5b475ad2..4bbe04d96744 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -571,37 +571,6 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
 }
 /*
- * This gets called with the process already owning the
- * FPU state, and with CR0.TS cleared. It just needs to
- * restore the FPU register state.
- */
-void __math_state_restore(struct task_struct *tsk)
-{
-        /* We need a safe address that is cheap to find and that is already
-           in L1. We've just brought in "tsk->thread.has_fpu", so use that */
-#define safe_address (tsk->thread.has_fpu)
-        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
-           is pending.  Clear the x87 state here by setting it to fixed
-           values. safe_address is a random variable that should be in L1 */
-        alternative_input(
-                ASM_NOP8 ASM_NOP2,
-                "emms\n\t"              /* clear stack tags */
-                "fildl %P[addr]",       /* set F?P to defined value */
-                X86_FEATURE_FXSAVE_LEAK,
-                [addr] "m" (safe_address));
-        /*
-         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-         */
-        if (unlikely(restore_fpu_checking(tsk))) {
-                __thread_fpu_end(tsk);
-                force_sig(SIGSEGV, tsk);
-                return;
-        }
-}
-/*
 * 'math_state_restore()' saves the current math information in the
 * old math state array, and gets the new ones from the current task
 *
@@ -631,7 +600,14 @@ void math_state_restore(void)
        }
        __thread_fpu_begin(tsk);
-        __math_state_restore(tsk);
+        /*
+         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
+         */
+        if (unlikely(restore_fpu_checking(tsk))) {
+                __thread_fpu_end(tsk);
+                force_sig(SIGSEGV, tsk);
+                return;
+        }
        tsk->fpu_counter++;
 }
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 5d1d07645132..e8cd652d2017 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1206,9 +1206,9 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
        
 out_unmap_both:
        pci_set_drvdata(dev, NULL);
-        pci_iounmap(dev, card->config_regs);
- out_unmap_config:
        pci_iounmap(dev, card->buffers);
+ out_unmap_config:
+        pci_iounmap(dev, card->config_regs);
 out_release_regions:
        pci_release_regions(dev);
 out:
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index c1dc4d86c221..1f3c1a7d132a 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -41,6 +41,8 @@
 #include <linux/types.h>
 #include <linux/version.h>
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
 #define NVME_Q_DEPTH 1024
 #define SQ_SIZE(depth)          (depth * sizeof(struct nvme_command))
 #define CQ_SIZE(depth)          (depth * sizeof(struct nvme_completion))
diff --git a/drivers/cpuidle/Kconfig b/drivers/cpuidle/Kconfig
index 7dbc4a83c45c..78a666d1e5f5 100644
--- a/drivers/cpuidle/Kconfig
+++ b/drivers/cpuidle/Kconfig
@@ -1,7 +1,7 @@
 config CPU_IDLE
        bool "CPU idle PM support"
-        default ACPI
+        default y if ACPI || PPC_PSERIES
        help
          CPU idle is a generic framework for supporting software-controlled
          idle processor power management.  It includes modular cross-platform
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index aa08497a075a..73f55e2008c2 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -15,6 +15,8 @@
 #include <linux/io.h>
 #include "edac_core.h"
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
 #define I3200_REVISION        "1.1"
 #define EDAC_MOD_STR        "i3200_edac"
@@ -101,19 +103,6 @@ struct i3200_priv {
 static int nr_channels;
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-        low = readl(p);
-        high = readl(p + 1);
-        return low + ((u64)high << 32);
-}
-#endif
 static int how_many_channels(struct pci_dev *pdev)
 {
        unsigned char capid0_8b; /* 8th byte of CAPID0 */
diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
index 661a03571d0c..d08a55896d50 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
@@ -193,6 +193,9 @@ int exynos_drm_subdrv_register(struct exynos_drm_subdrv *subdrv)
                        return err;
                }
+                /* setup possible_clones. */
+                exynos_drm_encoder_setup(drm_dev);
                /*
                 * if any specific driver such as fimd or hdmi driver called
                 * exynos_drm_subdrv_register() later than drm_load(),
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index e3861ac49295..de818831a511 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -307,9 +307,6 @@ static int exynos_drm_crtc_page_flip(struct drm_crtc *crtc,
                 */
                event->pipe = exynos_crtc->pipe;
-                list_add_tail(&event->base.link,
-                                &dev_priv->pageflip_event_list);
                ret = drm_vblank_get(dev, exynos_crtc->pipe);
                if (ret) {
                        DRM_DEBUG("failed to acquire vblank counter\n");
@@ -318,6 +315,9 @@ static int exynos_drm_crtc_page_flip(struct drm_crtc *crtc,
                        goto out;
                }
+                list_add_tail(&event->base.link,
+                                &dev_priv->pageflip_event_list);
                crtc->fb = fb;
                ret = exynos_drm_crtc_update(crtc);
                if (ret) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 35889ca255e9..58820ebd3558 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -33,6 +33,7 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_crtc.h"
+#include "exynos_drm_encoder.h"
 #include "exynos_drm_fbdev.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_gem.h"
@@ -99,6 +100,9 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
        if (ret)
                goto err_vblank;
+        /* setup possible_clones. */
+        exynos_drm_encoder_setup(dev);
        /*
         * create and configure fb helper and also exynos specific
         * fbdev object.
@@ -141,16 +145,21 @@ static int exynos_drm_unload(struct drm_device *dev)
 }
 static void exynos_drm_preclose(struct drm_device *dev,
-                                        struct drm_file *file_priv)
+                                        struct drm_file *file)
 {
-        struct exynos_drm_private *dev_priv = dev->dev_private;
+        DRM_DEBUG_DRIVER("%s\n", __FILE__);
-        /*
+}
-         * drm framework frees all events at release time,
-         * so private event list should be cleared.
+static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
-         */
+{
-        if (!list_empty(&dev_priv->pageflip_event_list))
+        DRM_DEBUG_DRIVER("%s\n", __FILE__);
-                INIT_LIST_HEAD(&dev_priv->pageflip_event_list);
+        if (!file->driver_priv)
+                return;
+        kfree(file->driver_priv);
+        file->driver_priv = NULL;
 }
 static void exynos_drm_lastclose(struct drm_device *dev)
@@ -195,6 +204,7 @@ static struct drm_driver exynos_drm_driver = {
        .unload                 = exynos_drm_unload,
        .preclose               = exynos_drm_preclose,
        .lastclose              = exynos_drm_lastclose,
+        .postclose              = exynos_drm_postclose,
        .get_vblank_counter     = drm_vblank_count,
        .enable_vblank          = exynos_drm_crtc_enable_vblank,
        .disable_vblank         = exynos_drm_crtc_disable_vblank,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 86b93dde219a..ef4754f1519b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -195,6 +195,40 @@ static struct drm_encoder_funcs exynos_encoder_funcs = {
        .destroy = exynos_drm_encoder_destroy,
 };
+static unsigned int exynos_drm_encoder_clones(struct drm_encoder *encoder)
+{
+        struct drm_encoder *clone;
+        struct drm_device *dev = encoder->dev;
+        struct exynos_drm_encoder *exynos_encoder = to_exynos_encoder(encoder);
+        struct exynos_drm_display_ops *display_ops =
+                                exynos_encoder->manager->display_ops;
+        unsigned int clone_mask = 0;
+        int cnt = 0;
+        list_for_each_entry(clone, &dev->mode_config.encoder_list, head) {
+                switch (display_ops->type) {
+                case EXYNOS_DISPLAY_TYPE_LCD:
+                case EXYNOS_DISPLAY_TYPE_HDMI:
+                        clone_mask |= (1 << (cnt++));
+                        break;
+                default:
+                        continue;
+                }
+        }
+        return clone_mask;
+}
+void exynos_drm_encoder_setup(struct drm_device *dev)
+{
+        struct drm_encoder *encoder;
+        DRM_DEBUG_KMS("%s\n", __FILE__);
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
+                encoder->possible_clones = exynos_drm_encoder_clones(encoder);
+}
 struct drm_encoder *
 exynos_drm_encoder_create(struct drm_device *dev,
                           struct exynos_drm_manager *manager,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.h b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
index 97b087a51cb6..eb7d2316847e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
@@ -30,6 +30,7 @@
 struct exynos_drm_manager;
+void exynos_drm_encoder_setup(struct drm_device *dev);
 struct drm_encoder *exynos_drm_encoder_create(struct drm_device *dev,
                                               struct exynos_drm_manager *mgr,
                                               unsigned int possible_crtcs);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index d7ae29d2f3d6..3508700e529b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -195,66 +195,6 @@ out:
        return ret;
 }
-static bool
-exynos_drm_fbdev_is_samefb(struct drm_framebuffer *fb,
-                            struct drm_fb_helper_surface_size *sizes)
-{
-        if (fb->width != sizes->surface_width)
-                return false;
-        if (fb->height != sizes->surface_height)
-                return false;
-        if (fb->bits_per_pixel != sizes->surface_bpp)
-                return false;
-        if (fb->depth != sizes->surface_depth)
-                return false;
-        return true;
-}
-static int exynos_drm_fbdev_recreate(struct drm_fb_helper *helper,
-                                      struct drm_fb_helper_surface_size *sizes)
-{
-        struct drm_device *dev = helper->dev;
-        struct exynos_drm_fbdev *exynos_fbdev = to_exynos_fbdev(helper);
-        struct exynos_drm_gem_obj *exynos_gem_obj;
-        struct drm_framebuffer *fb = helper->fb;
-        struct drm_mode_fb_cmd2 mode_cmd = { 0 };
-        unsigned long size;
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-        if (exynos_drm_fbdev_is_samefb(fb, sizes))
-                return 0;
-        mode_cmd.width = sizes->surface_width;
-        mode_cmd.height = sizes->surface_height;
-        mode_cmd.pitches[0] = sizes->surface_width * (sizes->surface_bpp >> 3);
-        mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
-                                                          sizes->surface_depth);
-        if (exynos_fbdev->exynos_gem_obj)
-                exynos_drm_gem_destroy(exynos_fbdev->exynos_gem_obj);
-        if (fb->funcs->destroy)
-                fb->funcs->destroy(fb);
-        size = mode_cmd.pitches[0] * mode_cmd.height;
-        exynos_gem_obj = exynos_drm_gem_create(dev, size);
-        if (IS_ERR(exynos_gem_obj))
-                return PTR_ERR(exynos_gem_obj);
-        exynos_fbdev->exynos_gem_obj = exynos_gem_obj;
-        helper->fb = exynos_drm_framebuffer_init(dev, &mode_cmd,
-                        &exynos_gem_obj->base);
-        if (IS_ERR_OR_NULL(helper->fb)) {
-                DRM_ERROR("failed to create drm framebuffer.\n");
-                return PTR_ERR(helper->fb);
-        }
-        return exynos_drm_fbdev_update(helper, helper->fb);
-}
 static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
                                   struct drm_fb_helper_surface_size *sizes)
 {
@@ -262,6 +202,10 @@ static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
        DRM_DEBUG_KMS("%s\n", __FILE__);
+        /*
+         * with !helper->fb, it means that this funcion is called first time
+         * and after that, the helper->fb would be used as clone mode.
+         */
        if (!helper->fb) {
                ret = exynos_drm_fbdev_create(helper, sizes);
                if (ret < 0) {
@@ -274,12 +218,6 @@ static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
                 * because register_framebuffer() should be called.
                 */
                ret = 1;
-        } else {
-                ret = exynos_drm_fbdev_recreate(helper, sizes);
-                if (ret < 0) {
-                        DRM_ERROR("failed to reconfigure fbdev\n");
-                        return ret;
-                }
        }
        return ret;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index b6a737d196ae..0dbb32bb18a3 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -604,7 +604,12 @@ static void fimd_finish_pageflip(struct drm_device *drm_dev, int crtc)
        }
        if (is_checked) {
-                drm_vblank_put(drm_dev, crtc);
+                /*
+                 * call drm_vblank_put only in case that drm_vblank_get was
+                 * called.
+                 */
+                if (atomic_read(&drm_dev->vblank_refcount[crtc]) > 0)
+                        drm_vblank_put(drm_dev, crtc);
                /*
                 * don't off vblank if vblank_disable_allowed is 1,
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index ac24cff39775..93846e810e38 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -712,7 +712,12 @@ static void mixer_finish_pageflip(struct drm_device *drm_dev, int crtc)
        }
        if (is_checked)
-                drm_vblank_put(drm_dev, crtc);
+                /*
+                 * call drm_vblank_put only in case that drm_vblank_get was
+                 * called.
+                 */
+                if (atomic_read(&drm_dev->vblank_refcount[crtc]) > 0)
+                        drm_vblank_put(drm_dev, crtc);
        spin_unlock_irqrestore(&drm_dev->event_lock, flags);
 }
@@ -779,15 +784,15 @@ static void mixer_win_reset(struct mixer_context *ctx)
        mixer_reg_writemask(res, MXR_STATUS, MXR_STATUS_16_BURST,
                MXR_STATUS_BURST_MASK);
-        /* setting default layer priority: layer1 > video > layer0
+        /* setting default layer priority: layer1 > layer0 > video
         * because typical usage scenario would be
+         * layer1 - OSD
         * layer0 - framebuffer
         * video - video overlay
-         * layer1 - OSD
         */
-        val  = MXR_LAYER_CFG_GRP0_VAL(1);
+        val = MXR_LAYER_CFG_GRP1_VAL(3);
-        val |= MXR_LAYER_CFG_VP_VAL(2);
+        val |= MXR_LAYER_CFG_GRP0_VAL(2);
-        val |= MXR_LAYER_CFG_GRP1_VAL(3);
+        val |= MXR_LAYER_CFG_VP_VAL(1);
        mixer_reg_write(res, MXR_LAYER_CFG, val);
        /* setting background color */
@@ -1044,7 +1049,7 @@ static int mixer_remove(struct platform_device *pdev)
                                        platform_get_drvdata(pdev);
        struct mixer_context *ctx = (struct mixer_context *)drm_hdmi_ctx->ctx;
-        dev_info(dev, "remove sucessful\n");
+        dev_info(dev, "remove successful\n");
        mixer_resource_poweroff(ctx);
        mixer_resources_cleanup(ctx);
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index c3afb783cb9d..03c53fcf8653 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3028,6 +3028,20 @@
 #define  DISP_TILE_SURFACE_SWIZZLING    (1<<13)
 #define  DISP_FBC_WM_DIS                (1<<15)
+/* GEN7 chicken */
+#define GEN7_COMMON_SLICE_CHICKEN1              0x7010
+# define GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC      ((1<<10) | (1<<26))
+#define GEN7_L3CNTLREG1                         0xB01C
+#define  GEN7_WA_FOR_GEN7_L3_CONTROL                    0x3C4FFF8C
+#define GEN7_L3_CHICKEN_MODE_REGISTER           0xB030
+#define  GEN7_WA_L3_CHICKEN_MODE                                0x20000000
+/* WaCatErrorRejectionIssue */
+#define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          0x9030
+#define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
 /* PCH */
 /* south display engine interrupt */
@@ -3618,6 +3632,7 @@
 #define    GT_FIFO_NUM_RESERVED_ENTRIES         20
 #define GEN6_UCGCTL2                            0x9404
+# define GEN6_RCZUNIT_CLOCK_GATE_DISABLE                (1 << 13)
 # define GEN6_RCPBUNIT_CLOCK_GATE_DISABLE               (1 << 12)
 # define GEN6_RCCUNIT_CLOCK_GATE_DISABLE                (1 << 11)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 00fbff5ddd81..f425b23e3803 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8184,8 +8184,8 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
        I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
        if (intel_enable_rc6(dev_priv->dev))
-                rc6_mask = GEN6_RC_CTL_RC6p_ENABLE |
+                rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        GEN6_RC_CTL_RC6_ENABLE;
+                        (IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0;
        I915_WRITE(GEN6_RC_CONTROL,
                   rc6_mask |
@@ -8463,12 +8463,32 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
        I915_WRITE(WM2_LP_ILK, 0);
        I915_WRITE(WM1_LP_ILK, 0);
+        /* According to the spec, bit 13 (RCZUNIT) must be set on IVB.
+         * This implements the WaDisableRCZUnitClockGating workaround.
+         */
+        I915_WRITE(GEN6_UCGCTL2, GEN6_RCZUNIT_CLOCK_GATE_DISABLE);
        I915_WRITE(ILK_DSPCLK_GATE, IVB_VRHUNIT_CLK_GATE);
        I915_WRITE(IVB_CHICKEN3,
                   CHICKEN3_DGMG_REQ_OUT_FIX_DISABLE |
                   CHICKEN3_DGMG_DONE_FIX_DISABLE);
+        /* Apply the WaDisableRHWOOptimizationForRenderHang workaround. */
+        I915_WRITE(GEN7_COMMON_SLICE_CHICKEN1,
+                   GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC);
+        /* WaApplyL3ControlAndL3ChickenMode requires those two on Ivy Bridge */
+        I915_WRITE(GEN7_L3CNTLREG1,
+                        GEN7_WA_FOR_GEN7_L3_CONTROL);
+        I915_WRITE(GEN7_L3_CHICKEN_MODE_REGISTER,
+                        GEN7_WA_L3_CHICKEN_MODE);
+        /* This is required by WaCatErrorRejectionIssue */
+        I915_WRITE(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG,
+                        I915_READ(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG) |
+                        GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB);
        for_each_pipe(pipe) {
                I915_WRITE(DSPCNTR(pipe),
                           I915_READ(DSPCNTR(pipe)) |
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 9be353b894cc..f58254a3fb01 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3223,6 +3223,7 @@ int evergreen_resume(struct radeon_device *rdev)
        r = evergreen_startup(rdev);
        if (r) {
                DRM_ERROR("evergreen startup failed on resume\n");
+                rdev->accel_working = false;
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index db09065e68fd..2509c505acb8 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1547,6 +1547,7 @@ int cayman_resume(struct radeon_device *rdev)
        r = cayman_startup(rdev);
        if (r) {
                DRM_ERROR("cayman startup failed on resume\n");
+                rdev->accel_working = false;
                return r;
        }
        return r;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 18cd84fae99c..333cde9d4e7b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3928,6 +3928,8 @@ static int r100_startup(struct radeon_device *rdev)
 int r100_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        if (rdev->flags & RADEON_IS_PCI)
                r100_pci_gart_disable(rdev);
@@ -3947,7 +3949,11 @@ int r100_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return r100_startup(rdev);
+        r = r100_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int r100_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 3fc0d29a5f39..6829638cca40 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1431,6 +1431,8 @@ static int r300_startup(struct radeon_device *rdev)
 int r300_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        if (rdev->flags & RADEON_IS_PCIE)
                rv370_pcie_gart_disable(rdev);
@@ -1452,7 +1454,11 @@ int r300_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return r300_startup(rdev);
+        r = r300_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int r300_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 666e28fe509c..b14323053bad 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -291,6 +291,8 @@ static int r420_startup(struct radeon_device *rdev)
 int r420_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        if (rdev->flags & RADEON_IS_PCIE)
                rv370_pcie_gart_disable(rdev);
@@ -316,7 +318,11 @@ int r420_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return r420_startup(rdev);
+        r = r420_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int r420_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 4ae1615e752f..25084e824dbc 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -218,6 +218,8 @@ static int r520_startup(struct radeon_device *rdev)
 int r520_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        if (rdev->flags & RADEON_IS_PCIE)
                rv370_pcie_gart_disable(rdev);
@@ -237,7 +239,11 @@ int r520_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return r520_startup(rdev);
+        r = r520_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int r520_init(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 4f08e5e6ee9d..fbcd84803b60 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2529,6 +2529,7 @@ int r600_resume(struct radeon_device *rdev)
        r = r600_startup(rdev);
        if (r) {
                DRM_ERROR("r600 startup failed on resume\n");
+                rdev->accel_working = false;
                return r;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 9e72daeeddc6..1f53ae74ada1 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -3020,6 +3020,9 @@ radeon_atombios_encoder_dpms_scratch_regs(struct drm_encoder *encoder, bool on)
        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
        uint32_t bios_2_scratch;
+        if (ASIC_IS_DCE4(rdev))
+                return;
        if (rdev->family >= CHIP_R600)
                bios_2_scratch = RREG32(R600_BIOS_2_SCRATCH);
        else
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 435a3d970ab8..e64bec488ed8 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -453,6 +453,10 @@ int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
        int r;
        radeon_mutex_lock(&rdev->cs_mutex);
+        if (!rdev->accel_working) {
+                radeon_mutex_unlock(&rdev->cs_mutex);
+                return -EBUSY;
+        }
        /* initialize parser */
        memset(&parser, 0, sizeof(struct radeon_cs_parser));
        parser.filp = filp;
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 30a4c5014c8b..92c9ea4751fb 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -500,8 +500,11 @@ static char radeon_debugfs_ib_names[RADEON_IB_POOL_SIZE][32];
 int radeon_debugfs_ring_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-        return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list,
+        if (rdev->family >= CHIP_CAYMAN)
-                                        ARRAY_SIZE(radeon_debugfs_ring_info_list));
+                return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list,
+                                                ARRAY_SIZE(radeon_debugfs_ring_info_list));
+        else
+                return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list, 1);
 #else
        return 0;
 #endif
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b0ce84a20a68..866a05be75f2 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -442,6 +442,8 @@ static int rs400_startup(struct radeon_device *rdev)
 int rs400_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        rs400_gart_disable(rdev);
        /* Resume clock before doing reset */
@@ -462,7 +464,11 @@ int rs400_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return rs400_startup(rdev);
+        r = rs400_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int rs400_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index c05865e5521f..4fc700684dcd 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -876,6 +876,8 @@ static int rs600_startup(struct radeon_device *rdev)
 int rs600_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        rs600_gart_disable(rdev);
        /* Resume clock before doing reset */
@@ -894,7 +896,11 @@ int rs600_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return rs600_startup(rdev);
+        r = rs600_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int rs600_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 4f24a0fa8c82..f68dff2fadcb 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -659,6 +659,8 @@ static int rs690_startup(struct radeon_device *rdev)
 int rs690_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        rs400_gart_disable(rdev);
        /* Resume clock before doing reset */
@@ -677,7 +679,11 @@ int rs690_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return rs690_startup(rdev);
+        r = rs690_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int rs690_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 880637fd1946..959bf4483bea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -424,6 +424,8 @@ static int rv515_startup(struct radeon_device *rdev)
 int rv515_resume(struct radeon_device *rdev)
 {
+        int r;
        /* Make sur GART are not working */
        if (rdev->flags & RADEON_IS_PCIE)
                rv370_pcie_gart_disable(rdev);
@@ -443,7 +445,11 @@ int rv515_resume(struct radeon_device *rdev)
        radeon_surface_init(rdev);
        rdev->accel_working = true;
-        return rv515_startup(rdev);
+        r =  rv515_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 int rv515_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index a1668b659ddd..c049c0c51841 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1139,6 +1139,7 @@ int rv770_resume(struct radeon_device *rdev)
        r = rv770_startup(rdev);
        if (r) {
                DRM_ERROR("r600 startup failed on resume\n");
+                rdev->accel_working = false;
                return r;
        }
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index eedca3cf9968..dd87ae96c262 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_client *client,
                        continue;
                err = device_create_file(&client->dev, &ads1015_in[k].dev_attr);
                if (err)
-                        goto exit_free;
+                        goto exit_remove;
        }
        data->hwmon_dev = hwmon_device_register(&client->dev);
@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_client *client,
 exit_remove:
        for (k = 0; k < ADS1015_CHANNELS; ++k)
                device_remove_file(&client->dev, &ads1015_in[k].dev_attr);
-exit_free:
        kfree(data);
 exit:
        return err;
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index f609b5727ba9..6bab2001ef3b 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -340,8 +340,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                        fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
                        data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                        break;
                case 1: /* PWM */
                        fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
@@ -361,8 +359,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                case 0: /* full speed */
                        fanmode  |= (3 << FAN_CTRL_MODE(nr));
                        data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                        break;
                case 1: /* PWM */
                        fanmode  |= (3 << FAN_CTRL_MODE(nr));
@@ -377,6 +373,9 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
        f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
        data->pwm_enable[nr] = val;
+        if (val == 0)
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                                data->pwm[nr]);
        return 0;
 }
diff --git a/drivers/hwmon/max6639.c b/drivers/hwmon/max6639.c
index e10a092c603c..a6760bacd915 100644
--- a/drivers/hwmon/max6639.c
+++ b/drivers/hwmon/max6639.c
@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0x2c, 0x2e, 0x2f, I2C_CLIENT_END };
 static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 };
-#define FAN_FROM_REG(val, div, rpm_range)       ((val) == 0 ? -1 : \
+#define FAN_FROM_REG(val, rpm_range)    ((val) == 0 || (val) == 255 ? \
-        (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val)))
+                                0 : (rpm_ranges[rpm_range] * 30) / (val))
 #define TEMP_LIMIT_TO_REG(val)  SENSORS_LIMIT((val) / 1000, 0, 255)
 /*
@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct device *dev,
                return PTR_ERR(data);
        return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index],
-                       data->ppr, data->rpm_range));
+                       data->rpm_range));
 }
 static ssize_t show_alarm(struct device *dev,
@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2c_client *client)
        struct max6639_data *data = i2c_get_clientdata(client);
        struct max6639_platform_data *max6639_info =
                client->dev.platform_data;
-        int i = 0;
+        int i;
        int rpm_range = 1; /* default: 4000 RPM */
-        int err = 0;
+        int err;
        /* Reset chip to default values, see below for GCONFIG setup */
        err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2c_client *client)
        else
                data->ppr = 2;
        data->ppr -= 1;
-        err = i2c_smbus_write_byte_data(client,
-                        MAX6639_REG_FAN_PPR(i),
-                        data->ppr << 5);
-        if (err)
-                goto exit;
        if (max6639_info)
                rpm_range = rpm_range_to_reg(max6639_info->rpm_range);
@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2c_client *client)
        for (i = 0; i < 2; i++) {
+                /* Set Fan pulse per revolution */
+                err = i2c_smbus_write_byte_data(client,
+                                MAX6639_REG_FAN_PPR(i),
+                                data->ppr << 6);
+                if (err)
+                        goto exit;
                /* Fans config PWM, RPM */
                err = i2c_smbus_write_byte_data(client,
                        MAX6639_REG_FAN_CONFIG1(i),
diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c
index beaf5a8d9c45..9b97a5b3cf3d 100644
--- a/drivers/hwmon/pmbus/max34440.c
+++ b/drivers/hwmon/pmbus/max34440.c
@@ -82,7 +82,7 @@ static int max34440_write_word_data(struct i2c_client *client, int page,
        case PMBUS_VIRT_RESET_TEMP_HISTORY:
                ret = pmbus_write_word_data(client, page,
                                            MAX34440_MFR_TEMPERATURE_PEAK,
-                                            0xffff);
+                                            0x8000);
                break;
        default:
                ret = -ENODATA;
diff --git a/drivers/media/radio/wl128x/Kconfig b/drivers/media/radio/wl128x/Kconfig
index 86b28579f0c7..ea1e6545df36 100644
--- a/drivers/media/radio/wl128x/Kconfig
+++ b/drivers/media/radio/wl128x/Kconfig
@@ -4,8 +4,8 @@
 menu "Texas Instruments WL128x FM driver (ST based)"
 config RADIO_WL128X
        tristate "Texas Instruments WL128x FM Radio"
-        depends on VIDEO_V4L2 && RFKILL
+        depends on VIDEO_V4L2 && RFKILL && GPIOLIB
-        select TI_ST if NET && GPIOLIB
+        select TI_ST if NET
        help
        Choose Y here if you have this FM radio chip.
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 3aeb29a7ce11..7f26fdf2e54e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -47,7 +47,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.3"
+#define MOD_VERSION     "0.9.4"
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct urb *urb)
                return;
        ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf0)
+        if (!ictx)
                return;
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf0)
+                goto out;
        switch (urb->status) {
        case -ENOENT:           /* usbcore unlink successful! */
                return;
@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct urb *urb)
                break;
        }
+out:
        usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
 }
@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct urb *urb)
                return;
        ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf1)
+        if (!ictx)
                return;
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf1)
+                goto out;
        switch (urb->status) {
        case -ENOENT:           /* usbcore unlink successful! */
                return;
@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct urb *urb)
                break;
        }
+out:
        usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
 }
@@ -2242,7 +2260,7 @@ find_endpoint_failed:
        mutex_unlock(&ictx->lock);
        usb_free_urb(rx_urb);
 rx_urb_alloc_failed:
-        dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret);
+        dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
        return NULL;
 }
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index e5eb56a5b618..6510110f53d0 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -154,10 +154,20 @@ static int device_authorization(struct hdpvr_device *dev)
        }
 #endif
+        dev->fw_ver = dev->usbc_buf[1];
        v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
-                          dev->usbc_buf[1], &dev->usbc_buf[2]);
+                          dev->fw_ver, &dev->usbc_buf[2]);
+        if (dev->fw_ver > 0x15) {
+                dev->options.brightness = 0x80;
+                dev->options.contrast   = 0x40;
+                dev->options.hue        = 0xf;
+                dev->options.saturation = 0x40;
+                dev->options.sharpness  = 0x80;
+        }
-        switch (dev->usbc_buf[1]) {
+        switch (dev->fw_ver) {
        case HDPVR_FIRMWARE_VERSION:
                dev->flags &= ~HDPVR_FLAG_AC3_CAP;
                break;
@@ -169,7 +179,7 @@ static int device_authorization(struct hdpvr_device *dev)
        default:
                v4l2_info(&dev->v4l2_dev, "untested firmware, the driver might"
                          " not work.\n");
-                if (dev->usbc_buf[1] >= HDPVR_FIRMWARE_VERSION_AC3)
+                if (dev->fw_ver >= HDPVR_FIRMWARE_VERSION_AC3)
                        dev->flags |= HDPVR_FLAG_AC3_CAP;
                else
                        dev->flags &= ~HDPVR_FLAG_AC3_CAP;
@@ -270,6 +280,8 @@ static const struct hdpvr_options hdpvr_default_options = {
        .bitrate_mode   = HDPVR_CONSTANT,
        .gop_mode       = HDPVR_SIMPLE_IDR_GOP,
        .audio_codec    = V4L2_MPEG_AUDIO_ENCODING_AAC,
+        /* original picture controls for firmware version <= 0x15 */
+        /* updated in device_authorization() for newer firmware */
        .brightness     = 0x86,
        .contrast       = 0x80,
        .hue            = 0x80,
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index 087f7c08cb85..11ffe9cc1780 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
                hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
+                dev->status = STATUS_STREAMING;
                INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
                queue_work(dev->workqueue, &dev->worker);
                v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
                         "streaming started\n");
-                dev->status = STATUS_STREAMING;
                return 0;
        }
@@ -722,21 +723,39 @@ static const s32 supported_v4l2_ctrls[] = {
 };
 static int fill_queryctrl(struct hdpvr_options *opt, struct v4l2_queryctrl *qc,
-                          int ac3)
+                          int ac3, int fw_ver)
 {
        int err;
+        if (fw_ver > 0x15) {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0x1e, 1, 0xf);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        } else {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        }
        switch (qc->id) {
-        case V4L2_CID_BRIGHTNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
-        case V4L2_CID_CONTRAST:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SATURATION:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_HUE:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SHARPNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
        case V4L2_CID_MPEG_AUDIO_ENCODING:
                return v4l2_ctrl_query_fill(
                        qc, V4L2_MPEG_AUDIO_ENCODING_AAC,
@@ -794,7 +813,8 @@ static int vidioc_queryctrl(struct file *file, void *private_data,
                if (qc->id == supported_v4l2_ctrls[i])
                        return fill_queryctrl(&dev->options, qc,
-                                              dev->flags & HDPVR_FLAG_AC3_CAP);
+                                              dev->flags & HDPVR_FLAG_AC3_CAP,
+                                              dev->fw_ver);
                if (qc->id < supported_v4l2_ctrls[i])
                        break;
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index d6439db1d18b..fea3c6926997 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -113,6 +113,7 @@ struct hdpvr_device {
        /* usb control transfer buffer and lock */
        struct mutex            usbc_mutex;
        u8                      *usbc_buf;
+        u8                      fw_ver;
 };
 static inline struct hdpvr_device *to_hdpvr_dev(struct v4l2_device *v4l2_dev)
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index a74a79701d34..eaabc27f0fa2 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1407,7 +1407,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
        struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
-        struct video_device *vdev = &ccdc->subdev.devnode;
+        struct video_device *vdev = ccdc->subdev.devnode;
        struct v4l2_event event;
        memset(&event, 0, sizeof(event));
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index ebbcfcafe29b..5e10472371ed 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
        spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
+static int sja1000_is_absent(struct sja1000_priv *priv)
+{
+        return (priv->read_reg(priv, REG_MOD) == 0xFF);
+}
 static int sja1000_probe_chip(struct net_device *dev)
 {
        struct sja1000_priv *priv = netdev_priv(dev);
-        if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
+        if (priv->reg_base && sja1000_is_absent(priv)) {
                printk(KERN_INFO "%s: probing @0x%lX failed\n",
                       DRV_NAME, dev->base_addr);
                return 0;
@@ -492,6 +497,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
        while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                n++;
                status = priv->read_reg(priv, REG_SR);
+                /* check for absent controller due to hw unplug */
+                if (status == 0xFF && sja1000_is_absent(priv))
+                        return IRQ_NONE;
                if (isrc & IRQ_WUI)
                        netdev_warn(dev, "wakeup interrupt\n");
@@ -508,6 +516,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                        while (status & SR_RBS) {
                                sja1000_rx(dev);
                                status = priv->read_reg(priv, REG_SR);
+                                /* check for absent controller */
+                                if (status == 0xFF && sja1000_is_absent(priv))
+                                        return IRQ_NONE;
                        }
                }
                if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index ccdf1f6e2f9f..0f21a9b4cdd4 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -2245,10 +2245,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                        dev_info(&adapter->pdev->dev, "tx locked\n");
                return NETDEV_TX_LOCKED;
        }
-        if (skb->mark == 0x01)
-                type = atl1c_trans_high;
-        else
-                type = atl1c_trans_normal;
        if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 66f53c797e3a..46b8b7d81633 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2338,7 +2338,7 @@ static inline int __init b44_pci_init(void)
        return err;
 }
-static inline void __exit b44_pci_exit(void)
+static inline void b44_pci_exit(void)
 {
 #ifdef CONFIG_B44_PCI
        ssb_pcihost_unregister(&b44_pci_driver);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index df429959abdd..7b65716b8734 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3616,7 +3616,11 @@ static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                fl6.flowi6_oif = dst_addr->sin6_scope_id;
        *dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (*dst)
+        if ((*dst)->error) {
+                dst_release(*dst);
+                *dst = NULL;
+                return -ENETUNREACH;
+        } else
                return 0;
 #endif
diff --git a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
index c2c0680a1146..ac37cacc6136 100644
--- a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
+++ b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
@@ -157,7 +157,7 @@ static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
                        CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
                *fcoe_enc_error = (desc->flags &
                        CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
-                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                *fcoe_eof = (u8)((le16_to_cpu(desc->checksum_fcoe) >>
                        CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
                        CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
                *checksum = 0;
diff --git a/drivers/net/ethernet/cisco/enic/enic_pp.c b/drivers/net/ethernet/cisco/enic/enic_pp.c
index c758674643ce..dafea1ecb7b1 100644
--- a/drivers/net/ethernet/cisco/enic/enic_pp.c
+++ b/drivers/net/ethernet/cisco/enic/enic_pp.c
@@ -72,7 +72,7 @@ static int enic_set_port_profile(struct enic *enic, int vf)
        struct enic_port_profile *pp;
        struct vic_provinfo *vp;
        const u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        const u16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
+        const __be16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
        char uuid_str[38];
        char client_mac_str[18];
        u8 *client_mac;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 1b86d0b45f3c..4ea6580d3ae8 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
                ((new_mtu) < IPV6_MIN_MTU))
                return -EINVAL;
-        if (new_mtu > 4000) {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
-                jme_restart_rx_engine(jme);
-        } else {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
-                jme_restart_rx_engine(jme);
-        }
        netdev->mtu = new_mtu;
        netdev_update_features(netdev);
+        jme_restart_rx_engine(jme);
        jme_reset_link(jme);
        return 0;
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 4304072bd3c5..3efc897c9913 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -730,7 +730,7 @@ enum jme_rxcs_values {
        RXCS_RETRYCNT_60        = 0x00000F00,
        RXCS_DEFAULT            = RXCS_FIFOTHTP_128T |
-                                  RXCS_FIFOTHNP_128QW |
+                                  RXCS_FIFOTHNP_16QW |
                                  RXCS_DMAREQSZ_128B |
                                  RXCS_RETRYGAP_256ns |
                                  RXCS_RETRYCNT_32,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8fa41f3082cf..9129ace02560 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1036,7 +1036,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
        struct mlx4_priv *priv = mlx4_priv(dev);
        int vec = 0, err = 0, i;
-        spin_lock(&priv->msix_ctl.pool_lock);
+        mutex_lock(&priv->msix_ctl.pool_lock);
        for (i = 0; !vec && i < dev->caps.comp_pool; i++) {
                if (~priv->msix_ctl.pool_bm & 1ULL << i) {
                        priv->msix_ctl.pool_bm |= 1ULL << i;
@@ -1058,7 +1058,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
                        eq_set_ci(&priv->eq_table.eq[vec], 1);
                }
        }
-        spin_unlock(&priv->msix_ctl.pool_lock);
+        mutex_unlock(&priv->msix_ctl.pool_lock);
        if (vec) {
                *vector = vec;
@@ -1079,13 +1079,13 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
        if (likely(i >= 0)) {
                /*sanity check , making sure were not trying to free irq's
                  Belonging to a legacy EQ*/
-                spin_lock(&priv->msix_ctl.pool_lock);
+                mutex_lock(&priv->msix_ctl.pool_lock);
                if (priv->msix_ctl.pool_bm & 1ULL << i) {
                        free_irq(priv->eq_table.eq[vec].irq,
                                 &priv->eq_table.eq[vec]);
                        priv->msix_ctl.pool_bm &= ~(1ULL << i);
                }
-                spin_unlock(&priv->msix_ctl.pool_lock);
+                mutex_unlock(&priv->msix_ctl.pool_lock);
        }
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 8a21e10952ea..9ea7cabcaf3c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -685,7 +685,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
        return err;
 }
-static int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
+int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
 {
        struct mlx4_cmd_mailbox *outbox = ptr;
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 0809b7c3905c..5f15014713bc 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -531,15 +531,14 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
        for (port = 0; port <  dev->caps.num_ports; port++) {
                /* Change the port type only if the new type is different
                 * from the current, and not set to Auto */
-                if (port_types[port] != dev->caps.port_type[port + 1]) {
+                if (port_types[port] != dev->caps.port_type[port + 1])
                        change = 1;
-                        dev->caps.port_type[port + 1] = port_types[port];
-                }
        }
        if (change) {
                mlx4_unregister_device(dev);
                for (port = 1; port <= dev->caps.num_ports; port++) {
                        mlx4_CLOSE_PORT(dev, port);
+                        dev->caps.port_type[port] = port_types[port - 1];
                        err = mlx4_SET_PORT(dev, port);
                        if (err) {
                                mlx4_err(dev, "Failed to set port %d, "
@@ -986,6 +985,9 @@ static int map_bf_area(struct mlx4_dev *dev)
        resource_size_t bf_len;
        int err = 0;
+        if (!dev->caps.bf_reg_size)
+                return -ENXIO;
        bf_start = pci_resource_start(dev->pdev, 2) +
                        (dev->caps.num_uars << PAGE_SHIFT);
        bf_len = pci_resource_len(dev->pdev, 2) -
@@ -1823,7 +1825,7 @@ slave_start:
                goto err_master_mfunc;
        priv->msix_ctl.pool_bm = 0;
-        spin_lock_init(&priv->msix_ctl.pool_lock);
+        mutex_init(&priv->msix_ctl.pool_lock);
        mlx4_enable_msi_x(dev);
        if ((mlx4_is_mfunc(dev)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index 276c7f72bd83..5da51b99dbb8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -697,7 +697,7 @@ struct mlx4_sense {
 struct mlx4_msix_ctl {
        u64             pool_bm;
-        spinlock_t      pool_lock;
+        struct mutex    pool_lock;
 };
 struct mlx4_steer {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 8deeef98280c..25a80d71fb2a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -304,7 +304,7 @@ static int mlx4_HW2SW_MPT(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox
                            MLX4_CMD_TIME_CLASS_B, MLX4_CMD_WRAPPED);
 }
-static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
+int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
                          u32 *base_mridx)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
@@ -320,14 +320,14 @@ static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_reserve_range);
-static void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
+void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
 {
        struct mlx4_priv *priv = mlx4_priv(dev);
        mlx4_bitmap_free_range(&priv->mr_table.mpt_bitmap, base_mridx, cnt);
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_release_range);
-static int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
+int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
                           u64 iova, u64 size, u32 access, int npages,
                           int page_shift, struct mlx4_mr *mr)
 {
@@ -457,7 +457,7 @@ int mlx4_mr_alloc(struct mlx4_dev *dev, u32 pd, u64 iova, u64 size, u32 access,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_alloc);
-static void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
+void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
        int err;
@@ -852,7 +852,7 @@ err_free:
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_alloc);
-static int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
+int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
                            u32 pd, u32 access, int max_pages,
                            int max_maps, u8 page_shift, struct mlx4_fmr *fmr)
 {
@@ -954,7 +954,7 @@ int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_free);
-static int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
+int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 {
        if (fmr->maps)
                return -EBUSY;
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 10d57983df05..b8104d9f4081 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1544,7 +1544,7 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
        netdev->irq = platform_get_irq(pdev, 0);
-        if (netdev->irq < 0) {
+        if ((int)netdev->irq < 0) {
                err = netdev->irq;
                goto err_get_irq;
        }
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 506d24669956..1ba290d0c21c 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -155,11 +155,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
                if (unlikely(!skb))
                        return -ENOMEM;
-                /* Adjust the SKB for padding and checksum */
+                /* Adjust the SKB for padding */
                skb_reserve(skb, NET_IP_ALIGN);
                rx_buf->len = skb_len - NET_IP_ALIGN;
                rx_buf->flags = 0;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
                rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                  skb->data, rx_buf->len,
@@ -496,6 +495,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
                EFX_BUG_ON_PARANOID(!(rx_buf->flags & EFX_RX_PKT_CSUMMED));
                rx_buf->u.skb = NULL;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
                gro_result = napi_gro_receive(napi, skb);
        }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 6d74cb7aaae8..174a3348f676 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1008,7 +1008,7 @@ static void emac_rx_handler(void *token, int len, int status)
        int                     ret;
        /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
+        if (unlikely(!netif_running(ndev))) {
                dev_kfree_skb_any(skb);
                return;
        }
@@ -1037,7 +1037,9 @@ static void emac_rx_handler(void *token, int len, int status)
 recycle:
        ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
                        skb_tailroom(skb), GFP_KERNEL);
-        if (WARN_ON(ret < 0))
+        WARN_ON(ret == -ENOMEM);
+        if (unlikely(ret < 0))
                dev_kfree_skb_any(skb);
 }
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c81f136ae670..0856e1b7a849 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,16 +30,16 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
-MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IC1001 PHY drivers");
+MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IP101G/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
-/* IP101A/IP1001 */
+/* IP101A/G - IP1001 */
-#define IP10XX_SPEC_CTRL_STATUS         16  /* Spec. Control Register */
+#define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
-#define IP1001_SPEC_CTRL_STATUS_2       20  /* IP1001 Spec. Control Reg 2 */
+#define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3 /* IP1001 RX/TXPHASE_SEL */
+#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
-#define IP1001_APS_ON                   11  /* IP1001 APS Mode  bit */
+#define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
-#define IP101A_APS_ON                   2   /* IP101A APS Mode bit */
+#define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -98,20 +98,24 @@ static int ip175c_config_init(struct phy_device *phydev)
 static int ip1xx_reset(struct phy_device *phydev)
 {
-        int err, bmcr;
+        int bmcr;
        /* Software Reset PHY */
        bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
        bmcr |= BMCR_RESET;
-        err = phy_write(phydev, MII_BMCR, bmcr);
+        bmcr = phy_write(phydev, MII_BMCR, bmcr);
-        if (err < 0)
+        if (bmcr < 0)
-                return err;
+                return bmcr;
        do {
                bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
        } while (bmcr & BMCR_RESET);
-        return err;
+        return 0;
 }
 static int ip1001_config_init(struct phy_device *phydev)
@@ -124,7 +128,10 @@ static int ip1001_config_init(struct phy_device *phydev)
        /* Enable Auto Power Saving mode */
        c = phy_read(phydev, IP1001_SPEC_CTRL_STATUS_2);
+        if (c < 0)
+                return c;
        c |= IP1001_APS_ON;
+        c = phy_write(phydev, IP1001_SPEC_CTRL_STATUS_2, c);
        if (c < 0)
                return c;
@@ -132,14 +139,19 @@ static int ip1001_config_init(struct phy_device *phydev)
                /* Additional delay (2ns) used to adjust RX clock phase
                 * at RGMII interface */
                c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+                if (c < 0)
+                        return c;
                c |= IP1001_PHASE_SEL_MASK;
                c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+                if (c < 0)
+                        return c;
        }
-        return c;
+        return 0;
 }
-static int ip101a_config_init(struct phy_device *phydev)
+static int ip101a_g_config_init(struct phy_device *phydev)
 {
        int c;
@@ -149,7 +161,7 @@ static int ip101a_config_init(struct phy_device *phydev)
        /* Enable Auto Power Saving mode */
        c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
-        c |= IP101A_APS_ON;
+        c |= IP101A_G_APS_ON;
        return c;
 }
@@ -191,6 +203,7 @@ static struct phy_driver ip1001_driver = {
        .phy_id_mask    = 0x0ffffff0,
        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                          SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_INTERRUPT,
        .config_init    = &ip1001_config_init,
        .config_aneg    = &genphy_config_aneg,
        .read_status    = &genphy_read_status,
@@ -199,13 +212,14 @@ static struct phy_driver ip1001_driver = {
        .driver         = { .owner = THIS_MODULE,},
 };
-static struct phy_driver ip101a_driver = {
+static struct phy_driver ip101a_g_driver = {
        .phy_id         = 0x02430c54,
-        .name           = "ICPlus IP101A",
+        .name           = "ICPlus IP101A/G",
        .phy_id_mask    = 0x0ffffff0,
        .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                          SUPPORTED_Asym_Pause,
-        .config_init    = &ip101a_config_init,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &ip101a_g_config_init,
        .config_aneg    = &genphy_config_aneg,
        .read_status    = &genphy_read_status,
        .suspend        = genphy_suspend,
@@ -221,7 +235,7 @@ static int __init icplus_init(void)
        if (ret < 0)
                return -ENODEV;
-        ret = phy_driver_register(&ip101a_driver);
+        ret = phy_driver_register(&ip101a_g_driver);
        if (ret < 0)
                return -ENODEV;
@@ -231,7 +245,7 @@ static int __init icplus_init(void)
 static void __exit icplus_exit(void)
 {
        phy_driver_unregister(&ip1001_driver);
-        phy_driver_unregister(&ip101a_driver);
+        phy_driver_unregister(&ip101a_g_driver);
        phy_driver_unregister(&ip175c_driver);
 }
@@ -241,6 +255,7 @@ module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
        { 0x02430d80, 0x0ffffff0 },
        { 0x02430d90, 0x0ffffff0 },
+        { 0x02430c54, 0x0ffffff0 },
        { }
 };
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 93a86397af36..6d4d2ebb0a8a 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                        continue;
                }
                if (PPP_MP_CB(p)->sequence != seq) {
+                        u32 oldseq;
                        /* Fragment `seq' is missing.  If it is after
                           minseq, it might arrive later, so stop here. */
                        if (seq_after(seq, minseq))
                                break;
                        /* Fragment `seq' is lost, keep going. */
                        lost = 1;
+                        oldseq = seq;
                        seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                minseq + 1: PPP_MP_CB(p)->sequence;
+                        if (ppp->debug & 1)
+                                netdev_printk(KERN_DEBUG, ppp->dev,
+                                              "lost frag %u..%u\n",
+                                              oldseq, seq-1);
                        goto again;
                }
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                        struct sk_buff *tmp2;
                        skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
                                __skb_unlink(p, list);
                                kfree_skb(p);
                        }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                /* If we have discarded any fragments,
                   signal a receive error. */
                if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                        skb_queue_walk_safe(list, p, tmp) {
+                                if (p == head)
+                                        break;
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
+                                __skb_unlink(p, list);
+                                kfree_skb(p);
+                        }
                        if (ppp->debug & 1)
                                netdev_printk(KERN_DEBUG, ppp->dev,
                                              "  missed pkts %u..%u\n",
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 41a61efc331e..90a30026a931 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -573,6 +573,13 @@ static const struct usb_device_id	products [] = {
        .driver_info = 0,
 },
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
 /*
 * WHITELIST!!!
 *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 304fe78ff60e..e1324b4a0f66 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1632,7 +1632,7 @@ static int hso_get_count(struct tty_struct *tty,
        struct hso_serial *serial = get_serial_by_tty(tty);
        struct hso_tiocmget  *tiocmget = serial->tiocmget;
-        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+        memset(icount, 0, sizeof(struct serial_icounter_struct));
        if (!tiocmget)
                 return -ENOENT;
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index f701d4127087..c3197ce0e2ad 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -316,6 +316,11 @@ static const struct usb_device_id	products [] = {
        ZAURUS_MASTER_INTERFACE,
        .driver_info = ZAURUS_PXA_INFO,
 }, {
+        /* C-750/C-760/C-860/SL-C3000 PDA in MDLM mode */
+        USB_DEVICE_AND_INTERFACE_INFO(0x04DD, 0x9031, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
        .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
                 | USB_DEVICE_ID_MATCH_DEVICE,
        .idVendor               = 0x04DD,
@@ -349,6 +354,13 @@ static const struct usb_device_id	products [] = {
        ZAURUS_MASTER_INTERFACE,
        .driver_info = OLYMPUS_MXL_INFO,
 },
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+},
        { },            // END
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index e1562e8acba5..adf527e27583 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -837,8 +837,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                /* for simplicity, don't copy L4 headers */
                                ctx->l4_hdr_size = 0;
                        }
-                        ctx->copy_size = ctx->eth_ip_hdr_size +
+                        ctx->copy_size = min(ctx->eth_ip_hdr_size +
-                                         ctx->l4_hdr_size;
+                                         ctx->l4_hdr_size, skb->len);
                } else {
                        ctx->eth_ip_hdr_size = 0;
                        ctx->l4_hdr_size = 0;
diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 42a7d603c870..7481146a5b47 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -33,6 +33,8 @@
 #include <linux/mutex.h>
 #include <asm/bios_ebda.h>
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
 static bool force;
 module_param(force, bool, 0);
 MODULE_PARM_DESC(force, "Force driver load, ignore DMI data");
@@ -83,19 +85,6 @@ static void __iomem *rtl_cmd_addr;
 static u8 rtl_cmd_type;
 static u8 rtl_cmd_width;
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-        low = readl(p);
-        high = readl(p + 1);
-        return low + ((u64)high << 32);
-}
-#endif
 static void __iomem *rtl_port_map(phys_addr_t addr, unsigned long len)
 {
        if (rtl_cmd_type == RTL_ADDR_TYPE_MMIO)
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 809a3ae943c6..88a98cff5a44 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -77,6 +77,8 @@
 #include <asm/processor.h>
 #include "intel_ips.h"
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
 #define PCI_DEVICE_ID_INTEL_THERMAL_SENSOR 0x3b32
 /*
@@ -344,19 +346,6 @@ struct ips_driver {
 static bool
 ips_gpu_turbo_enabled(struct ips_driver *ips);
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-        low = readl(p);
-        high = readl(p + 1);
-        return low + ((u64)high << 32);
-}
-#endif
 /**
 * ips_cpu_busy - is CPU busy?
 * @ips: IPS driver struct
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 934458ad55e5..e71a50d4b221 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -87,6 +87,7 @@ struct raw3215_info {
        struct tty_struct *tty;       /* pointer to tty structure if present */
        struct raw3215_req *queued_read; /* pointer to queued read requests */
        struct raw3215_req *queued_write;/* pointer to queued write requests */
+        struct tasklet_struct tlet;   /* tasklet to invoke tty_wakeup */
        wait_queue_head_t empty_wait; /* wait queue for flushing */
        struct timer_list timer;      /* timer for delayed output */
        int line_pos;                 /* position on the line (for tabs) */
@@ -334,19 +335,23 @@ static inline void raw3215_try_io(struct raw3215_info *raw)
 }
 /*
+ * Call tty_wakeup from tasklet context
+ */
+static void raw3215_wakeup(unsigned long data)
+{
+        struct raw3215_info *raw = (struct raw3215_info *) data;
+        tty_wakeup(raw->tty);
+}
+/*
 * Try to start the next IO and wake up processes waiting on the tty.
 */
 static void raw3215_next_io(struct raw3215_info *raw)
 {
-        struct tty_struct *tty;
        raw3215_mk_write_req(raw);
        raw3215_try_io(raw);
-        tty = raw->tty;
+        if (raw->tty && RAW3215_BUFFER_SIZE - raw->count >= RAW3215_MIN_SPACE)
-        if (tty != NULL &&
+                tasklet_schedule(&raw->tlet);
-            RAW3215_BUFFER_SIZE - raw->count >= RAW3215_MIN_SPACE) {
-                tty_wakeup(tty);
-        }
 }
 /*
@@ -682,6 +687,7 @@ static int raw3215_probe (struct ccw_device *cdev)
                return -ENOMEM;
        }
        init_waitqueue_head(&raw->empty_wait);
+        tasklet_init(&raw->tlet, raw3215_wakeup, (unsigned long) raw);
        dev_set_drvdata(&cdev->dev, raw);
        cdev->handler = raw3215_irq;
@@ -901,6 +907,7 @@ static int __init con3215_init(void)
        raw->flags |= RAW3215_FIXED;
        init_waitqueue_head(&raw->empty_wait);
+        tasklet_init(&raw->tlet, raw3215_wakeup, (unsigned long) raw);
        /* Request the console irq */
        if (raw3215_startup(raw) != 0) {
@@ -966,6 +973,7 @@ static void tty3215_close(struct tty_struct *tty, struct file * filp)
        tty->closing = 1;
        /* Shutdown the terminal */
        raw3215_shutdown(raw);
+        tasklet_kill(&raw->tlet);
        tty->closing = 0;
        raw->tty = NULL;
 }
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 53a31c753cb1..20c4557f5abd 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -364,10 +364,7 @@ static void release_controller(struct kref *kref)
        struct rdac_controller *ctlr;
        ctlr = container_of(kref, struct rdac_controller, kref);
-        flush_workqueue(kmpath_rdacd);
-        spin_lock(&list_lock);
        list_del(&ctlr->node);
-        spin_unlock(&list_lock);
        kfree(ctlr);
 }
@@ -376,20 +373,17 @@ static struct rdac_controller *get_controller(int index, char *array_name,
 {
        struct rdac_controller *ctlr, *tmp;
-        spin_lock(&list_lock);
        list_for_each_entry(tmp, &ctlr_list, node) {
                if ((memcmp(tmp->array_id, array_id, UNIQUE_ID_LEN) == 0) &&
                          (tmp->index == index) &&
                          (tmp->host == sdev->host)) {
                        kref_get(&tmp->kref);
-                        spin_unlock(&list_lock);
                        return tmp;
                }
        }
        ctlr = kmalloc(sizeof(*ctlr), GFP_ATOMIC);
        if (!ctlr)
-                goto done;
+                return NULL;
        /* initialize fields of controller */
        memcpy(ctlr->array_id, array_id, UNIQUE_ID_LEN);
@@ -405,8 +399,7 @@ static struct rdac_controller *get_controller(int index, char *array_name,
        INIT_WORK(&ctlr->ms_work, send_mode_select);
        INIT_LIST_HEAD(&ctlr->ms_head);
        list_add(&ctlr->node, &ctlr_list);
-done:
-        spin_unlock(&list_lock);
        return ctlr;
 }
@@ -517,9 +510,12 @@ static int initialize_controller(struct scsi_device *sdev,
                        index = 0;
                else
                        index = 1;
+                spin_lock(&list_lock);
                h->ctlr = get_controller(index, array_name, array_id, sdev);
                if (!h->ctlr)
                        err = SCSI_DH_RES_TEMP_UNAVAIL;
+                spin_unlock(&list_lock);
        }
        return err;
 }
@@ -906,7 +902,9 @@ static int rdac_bus_attach(struct scsi_device *sdev)
        return 0;
 clean_ctlr:
+        spin_lock(&list_lock);
        kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
 failed:
        kfree(scsi_dh_data);
@@ -921,14 +919,19 @@ static void rdac_bus_detach( struct scsi_device *sdev )
        struct rdac_dh_data *h;
        unsigned long flags;
-        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
        scsi_dh_data = sdev->scsi_dh_data;
+        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        if (h->ctlr && h->ctlr->ms_queued)
+                flush_workqueue(kmpath_rdacd);
+        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
        sdev->scsi_dh_data = NULL;
        spin_unlock_irqrestore(sdev->request_queue->queue_lock, flags);
-        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        spin_lock(&list_lock);
        if (h->ctlr)
                kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
        kfree(scsi_dh_data);
        module_put(THIS_MODULE);
        sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", RDAC_NAME);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 67b169b7a5be..b538f0883fd2 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4613,11 +4613,13 @@ static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
        ENTER;
        ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
-        dev_err(&ioa_cfg->pdev->dev,
+        if (!ioa_cfg->in_reset_reload) {
-                "Adapter being reset as a result of error recovery.\n");
+                dev_err(&ioa_cfg->pdev->dev,
+                        "Adapter being reset as a result of error recovery.\n");
-        if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
+                if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
-                ioa_cfg->sdt_state = GET_DUMP;
+                        ioa_cfg->sdt_state = GET_DUMP;
+        }
        rc = ipr_reset_reload(ioa_cfg, IPR_SHUTDOWN_ABBREV);
@@ -4907,7 +4909,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
        struct ipr_ioa_cfg *ioa_cfg;
        struct ipr_resource_entry *res;
        struct ipr_cmd_pkt *cmd_pkt;
-        u32 ioasc;
+        u32 ioasc, int_reg;
        int op_found = 0;
        ENTER;
@@ -4920,7 +4922,17 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
         */
        if (ioa_cfg->in_reset_reload || ioa_cfg->ioa_is_dead)
                return FAILED;
-        if (!res || !ipr_is_gscsi(res))
+        if (!res)
+                return FAILED;
+        /*
+         * If we are aborting a timed out op, chances are that the timeout was caused
+         * by a still not detected EEH error. In such cases, reading a register will
+         * trigger the EEH recovery infrastructure.
+         */
+        int_reg = readl(ioa_cfg->regs.sense_interrupt_reg);
+        if (!ipr_is_gscsi(res))
                return FAILED;
        list_for_each_entry(ipr_cmd, &ioa_cfg->pending_q, queue) {
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 1a65d6514237..418391b1c361 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -1848,9 +1848,11 @@ static enum sci_status sci_oem_parameters_set(struct isci_host *ihost)
        if (state == SCIC_RESET ||
            state == SCIC_INITIALIZING ||
            state == SCIC_INITIALIZED) {
+                u8 oem_version = pci_info->orom ? pci_info->orom->hdr.version :
+                        ISCI_ROM_VER_1_0;
                if (sci_oem_parameters_validate(&ihost->oem_parameters,
-                                                pci_info->orom->hdr.version))
+                                                oem_version))
                        return SCI_FAILURE_INVALID_PARAMETER_VALUE;
                return SCI_SUCCESS;
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 0b2c95583660..a78036f5e1a6 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -4548,7 +4548,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
                printk(MPT2SAS_ERR_FMT "%s: pci error recovery reset\n",
                    ioc->name, __func__);
                r = 0;
-                goto out;
+                goto out_unlocked;
        }
        if (mpt2sas_fwfault_debug)
@@ -4604,6 +4604,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
        mutex_unlock(&ioc->reset_in_progress_mutex);
+ out_unlocked:
        dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: exit\n", ioc->name,
            __func__));
        return r;
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a2f1b3043dfb..9f41b3b4358f 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1036,8 +1036,7 @@ qla2x00_link_state_show(struct device *dev, struct device_attribute *attr,
            vha->device_flags & DFLG_NO_CABLE)
                len = snprintf(buf, PAGE_SIZE, "Link Down\n");
        else if (atomic_read(&vha->loop_state) != LOOP_READY ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
+            qla2x00_reset_active(vha))
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
                len = snprintf(buf, PAGE_SIZE, "Unknown Link State\n");
        else {
                len = snprintf(buf, PAGE_SIZE, "Link Up - ");
@@ -1359,8 +1358,7 @@ qla2x00_thermal_temp_show(struct device *dev,
                return snprintf(buf, PAGE_SIZE, "\n");
        temp = frac = 0;
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
+        if (qla2x00_reset_active(vha))
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
                ql_log(ql_log_warn, vha, 0x707b,
                    "ISP reset active.\n");
        else if (!vha->hw->flags.eeh_busy)
@@ -1379,8 +1377,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr,
        int rval = QLA_FUNCTION_FAILED;
        uint16_t state[5];
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
+        if (qla2x00_reset_active(vha))
-                test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
                ql_log(ql_log_warn, vha, 0x707c,
                    "ISP reset active.\n");
        else if (!vha->hw->flags.eeh_busy)
@@ -1693,9 +1690,7 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
        if (IS_FWI2_CAPABLE(ha)) {
                rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma);
        } else if (atomic_read(&base_vha->loop_state) == LOOP_READY &&
-                    !test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) &&
+            !qla2x00_reset_active(vha) && !ha->dpc_active) {
-                    !test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
-                    !ha->dpc_active) {
                /* Must be in a 'READY' state for statistics retrieval. */
                rval = qla2x00_get_link_status(base_vha, base_vha->loop_id,
                                                stats, stats_dma);
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index b1d0f936bf2d..1682e2e4201d 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -108,13 +108,6 @@ qla24xx_proc_fcp_prio_cfg_cmd(struct fc_bsg_job *bsg_job)
                goto exit_fcp_prio_cfg;
        }
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ret = -EBUSY;
-                goto exit_fcp_prio_cfg;
-        }
        /* Get the sub command */
        oper = bsg_job->request->rqst_data.h_vendor.vendor_cmd[1];
@@ -646,13 +639,6 @@ qla2x00_process_loopback(struct fc_bsg_job *bsg_job)
        dma_addr_t rsp_data_dma;
        uint32_t rsp_data_len;
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7018, "Abort active or needed.\n");
-                return -EBUSY;
-        }
        if (!vha->flags.online) {
                ql_log(ql_log_warn, vha, 0x7019, "Host is not online.\n");
                return -EIO;
@@ -874,13 +860,6 @@ qla84xx_reset(struct fc_bsg_job *bsg_job)
        int rval = 0;
        uint32_t flag;
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x702e, "Abort active or needed.\n");
-                return -EBUSY;
-        }
        if (!IS_QLA84XX(ha)) {
                ql_dbg(ql_dbg_user, vha, 0x702f, "Not 84xx, exiting.\n");
                return -EINVAL;
@@ -922,11 +901,6 @@ qla84xx_updatefw(struct fc_bsg_job *bsg_job)
        uint32_t flag;
        uint32_t fw_ver;
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags))
-                return -EBUSY;
        if (!IS_QLA84XX(ha)) {
                ql_dbg(ql_dbg_user, vha, 0x7032,
                    "Not 84xx, exiting.\n");
@@ -1036,14 +1010,6 @@ qla84xx_mgmt_cmd(struct fc_bsg_job *bsg_job)
        uint32_t data_len = 0;
        uint32_t dma_direction = DMA_NONE;
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7039,
-                    "Abort active or needed.\n");
-                return -EBUSY;
-        }
        if (!IS_QLA84XX(ha)) {
                ql_log(ql_log_warn, vha, 0x703a,
                    "Not 84xx, exiting.\n");
@@ -1246,13 +1212,6 @@ qla24xx_iidma(struct fc_bsg_job *bsg_job)
        bsg_job->reply->reply_payload_rcv_len = 0;
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7045, "abort active or needed.\n");
-                return -EBUSY;
-        }
        if (!IS_IIDMA_CAPABLE(vha->hw)) {
                ql_log(ql_log_info, vha, 0x7046, "iiDMA not supported.\n");
                return -EINVAL;
@@ -1668,6 +1627,15 @@ qla24xx_bsg_request(struct fc_bsg_job *bsg_job)
                vha = shost_priv(host);
        }
+        if (qla2x00_reset_active(vha)) {
+                ql_dbg(ql_dbg_user, vha, 0x709f,
+                    "BSG: ISP abort active/needed -- cmd=%d.\n",
+                    bsg_job->request->msgcode);
+                bsg_job->reply->result = (DID_ERROR << 16);
+                bsg_job->job_done(bsg_job);
+                return -EBUSY;
+        }
        ql_dbg(ql_dbg_user, vha, 0x7000,
            "Entered %s msgcode=0x%x.\n", __func__, bsg_job->request->msgcode);
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 7c54624b5b13..45cbf0ba624d 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -19,7 +19,8 @@
 * | DPC Thread                   |       0x401c       |                |
 * | Async Events                 |       0x5057       | 0x5052         |
 * | Timer Routines               |       0x6011       | 0x600e,0x600f  |
- * | User Space Interactions      |       0x709e       |                |
+ * | User Space Interactions      |       0x709e       | 0x7018,0x702e  |
+ * |                              |                    | 0x7039,0x7045  |
 * | Task Management              |       0x803c       | 0x8025-0x8026  |
 * |                              |                    | 0x800b,0x8039  |
 * | AER/EEH                      |       0x900f       |                |
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index a6a4eebce4a8..af1003f9de1e 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -44,6 +44,7 @@
 * ISP2100 HBAs.
 */
 #define MAILBOX_REGISTER_COUNT_2100     8
+#define MAILBOX_REGISTER_COUNT_2200     24
 #define MAILBOX_REGISTER_COUNT          32
 #define QLA2200A_RISC_ROM_VER   4
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 9902834e0b74..7cc4f36cd539 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -131,3 +131,16 @@ qla2x00_hba_err_chk_enabled(srb_t *sp)
        }
        return 0;
 }
+static inline int
+qla2x00_reset_active(scsi_qla_host_t *vha)
+{
+        scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
+        /* Test appropriate base-vha and vha flags. */
+        return test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_RETRY, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
+}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index e804585cc59c..349843ea32f6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2090,7 +2090,6 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
                        break;
                case CT_IOCB_TYPE:
                        qla24xx_els_ct_entry(vha, rsp->req, pkt, CT_IOCB_TYPE);
-                        clear_bit(MBX_INTERRUPT, &vha->hw->mbx_cmd_flags);
                        break;
                case ELS_IOCB_TYPE:
                        qla24xx_els_ct_entry(vha, rsp->req, pkt, ELS_IOCB_TYPE);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 34344d3f8658..08f1d01bdc1c 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -342,6 +342,8 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                set_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                clear_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+                                /* Allow next mbx cmd to come in. */
+                                complete(&ha->mbx_cmd_comp);
                                if (ha->isp_ops->abort_isp(vha)) {
                                        /* Failed. retry later. */
                                        set_bit(ISP_ABORT_NEEDED,
@@ -350,6 +352,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                clear_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                ql_dbg(ql_dbg_mbx, base_vha, 0x101f,
                                    "Finished abort_isp.\n");
+                                goto mbx_done;
                        }
                }
        }
@@ -358,6 +361,7 @@ premature_exit:
        /* Allow next mbx cmd to come in. */
        complete(&ha->mbx_cmd_comp);
+mbx_done:
        if (rval) {
                ql_dbg(ql_dbg_mbx, base_vha, 0x1020,
                    "**** Failed mbx[0]=%x, mb[1]=%x, mb[2]=%x, cmd=%x ****.\n",
@@ -2581,7 +2585,8 @@ qla2x00_stop_firmware(scsi_qla_host_t *vha)
        ql_dbg(ql_dbg_mbx, vha, 0x10a1, "Entered %s.\n", __func__);
        mcp->mb[0] = MBC_STOP_FIRMWARE;
-        mcp->out_mb = MBX_0;
+        mcp->mb[1] = 0;
+        mcp->out_mb = MBX_1|MBX_0;
        mcp->in_mb = MBX_0;
        mcp->tov = 5;
        mcp->flags = 0;
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 1cd46cd7ff90..270ba3130fde 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1165,19 +1165,6 @@ qla82xx_pinit_from_rom(scsi_qla_host_t *vha)
                qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xfeffffff);
        else
                qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xffffffff);
-        /* reset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val |= (1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
-        /* unreset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val &= ~(1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
        qla82xx_rom_unlock(ha);
        /* Read the signature value from the flash.
@@ -3392,7 +3379,7 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                            QLA82XX_CRB_PEG_NET_3 + 0x3c),
                                    qla82xx_rd_32(ha,
                                            QLA82XX_CRB_PEG_NET_4 + 0x3c));
-                                if (LSW(MSB(halt_status)) == 0x67)
+                                if (((halt_status & 0x1fffff00) >> 8) == 0x67)
                                        ql_log(ql_log_warn, vha, 0xb052,
                                            "Firmware aborted with "
                                            "error code 0x00006700. Device is "
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4ed1e4a96b95..036030c95339 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -625,6 +625,12 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
                        cmd->result = DID_NO_CONNECT << 16;
                        goto qc24_fail_command;
        }
+        if (!fcport) {
+                cmd->result = DID_NO_CONNECT << 16;
+                goto qc24_fail_command;
+        }
        if (atomic_read(&fcport->state) != FCS_ONLINE) {
                if (atomic_read(&fcport->state) == FCS_DEVICE_DEAD ||
                        atomic_read(&base_vha->loop_state) == LOOP_DEAD) {
@@ -877,6 +883,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        if (ha->isp_ops->abort_command(sp)) {
+                ret = FAILED;
                ql_dbg(ql_dbg_taskm, vha, 0x8003,
                    "Abort command mbx failed cmd=%p.\n", cmd);
        } else {
@@ -1124,7 +1131,6 @@ static int
 qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
 {
        scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-        fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
        struct qla_hw_data *ha = vha->hw;
        int ret = FAILED;
        unsigned int id, lun;
@@ -1133,15 +1139,6 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
        id = cmd->device->id;
        lun = cmd->device->lun;
-        if (!fcport) {
-                return ret;
-        }
-        ret = fc_block_scsi_eh(cmd);
-        if (ret != 0)
-                return ret;
-        ret = FAILED;
        ql_log(ql_log_info, vha, 0x8018,
            "ADAPTER RESET ISSUED nexus=%ld:%d:%d.\n", vha->host_no, id, lun);
@@ -2047,7 +2044,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                ha->nvram_data_off = ~0;
                ha->isp_ops = &qla2100_isp_ops;
        } else if (IS_QLA2200(ha)) {
-                ha->mbx_count = MAILBOX_REGISTER_COUNT;
+                ha->mbx_count = MAILBOX_REGISTER_COUNT_2200;
                req_length = REQUEST_ENTRY_CNT_2200;
                rsp_length = RESPONSE_ENTRY_CNT_2100;
                ha->max_loop_id = SNS_LAST_LOOP_ID_2100;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 23f33a6d52d7..29d780c38040 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
 * Driver version
 */
-#define QLA2XXX_VERSION      "8.03.07.12-k"
+#define QLA2XXX_VERSION      "8.03.07.13-k"
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
index 78f1111158d7..65253dfbe962 100644
--- a/drivers/scsi/qla4xxx/ql4_nx.c
+++ b/drivers/scsi/qla4xxx/ql4_nx.c
@@ -10,6 +10,8 @@
 #include "ql4_def.h"
 #include "ql4_glbl.h"
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
 #define MASK(n)         DMA_BIT_MASK(n)
 #define MN_WIN(addr)    (((addr & 0x1fc0000) >> 1) | ((addr >> 25) & 0x3ff))
 #define OCM_WIN(addr)   (((addr & 0x1ff0000) >> 1) | ((addr >> 25) & 0x3ff))
@@ -655,27 +657,6 @@ static int qla4_8xxx_pci_is_same_window(struct scsi_qla_host *ha,
        return 0;
 }
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-        low = readl(p);
-        high = readl(p + 1);
-        return low + ((u64)high << 32);
-}
-#endif
-#ifndef writeq
-static inline void writeq(__u64 val, volatile void __iomem *addr)
-{
-        writel(val, addr);
-        writel(val >> 32, addr+4);
-}
-#endif
 static int qla4_8xxx_pci_mem_read_direct(struct scsi_qla_host *ha,
                u64 off, void *data, int size)
 {
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index bf8bf79e6a1f..c4670642d023 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -7,6 +7,7 @@
 #include <linux/pm_runtime.h>
 #include <linux/export.h>
+#include <linux/async.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -92,6 +93,19 @@ static int scsi_bus_resume_common(struct device *dev)
        return err;
 }
+static int scsi_bus_prepare(struct device *dev)
+{
+        if (scsi_is_sdev_device(dev)) {
+                /* sd probing uses async_schedule.  Wait until it finishes. */
+                async_synchronize_full();
+        } else if (scsi_is_host_device(dev)) {
+                /* Wait until async scanning is finished */
+                scsi_complete_async_scans();
+        }
+        return 0;
+}
 static int scsi_bus_suspend(struct device *dev)
 {
        return scsi_bus_suspend_common(dev, PMSG_SUSPEND);
@@ -110,6 +124,7 @@ static int scsi_bus_poweroff(struct device *dev)
 #else /* CONFIG_PM_SLEEP */
 #define scsi_bus_resume_common          NULL
+#define scsi_bus_prepare                NULL
 #define scsi_bus_suspend                NULL
 #define scsi_bus_freeze                 NULL
 #define scsi_bus_poweroff               NULL
@@ -218,6 +233,7 @@ void scsi_autopm_put_host(struct Scsi_Host *shost)
 #endif /* CONFIG_PM_RUNTIME */
 const struct dev_pm_ops scsi_bus_pm_ops = {
+        .prepare =              scsi_bus_prepare,
        .suspend =              scsi_bus_suspend,
        .resume =               scsi_bus_resume_common,
        .freeze =               scsi_bus_freeze,
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 68eadd1c67fd..be4fa6d179b1 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -109,6 +109,7 @@ extern void scsi_exit_procfs(void);
 #endif /* CONFIG_PROC_FS */
 /* scsi_scan.c */
+extern int scsi_complete_async_scans(void);
 extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
                                   unsigned int, unsigned int, int);
 extern void scsi_forget_host(struct Scsi_Host *);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 89da43f73c00..29c4c0480976 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struct async_scan_data *data)
        }
        spin_unlock(&async_scan_lock);
+        scsi_autopm_put_host(shost);
        scsi_host_put(shost);
        kfree(data);
 }
@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)
        do_scsi_scan_host(shost);
        scsi_finish_async_scan(data);
-        scsi_autopm_put_host(shost);
        return 0;
 }
@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *shost)
        p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no);
        if (IS_ERR(p))
                do_scan_async(data);
-        /* scsi_autopm_put_host(shost) is called in do_scan_async() */
+        /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */
 }
 EXPORT_SYMBOL(scsi_scan_host);
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 45fee368b092..92d314a73f69 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -190,7 +190,7 @@ static int __init sh_clk_init_parent(struct clk *clk)
                return -EINVAL;
        }
-        clk->parent = clk->parent_table[val];
+        clk_reparent(clk, clk->parent_table[val]);
        if (!clk->parent) {
                pr_err("sh_clk_init_parent: unable to set parent");
                return -EINVAL;
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index d136b8f4c8a7..81e2c0d9c17d 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -187,7 +187,10 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                return -ENODEV;
        dev->current_state = PCI_D0;
-        if (!dev->irq) {
+        /* The xHCI driver supports MSI and MSI-X,
+         * so don't fail if the BIOS doesn't provide a legacy IRQ.
+         */
+        if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
                dev_err(&dev->dev,
                        "Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
                        pci_name(dev));
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index eb19cba34ac9..e1282328fc27 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2447,8 +2447,10 @@ int usb_add_hcd(struct usb_hcd *hcd,
                        && device_can_wakeup(&hcd->self.root_hub->dev))
                dev_dbg(hcd->self.controller, "supports USB remote wakeup\n");
-        /* enable irqs just before we start the controller */
+        /* enable irqs just before we start the controller,
-        if (usb_hcd_is_primary_hcd(hcd)) {
+         * if the BIOS provides legacy PCI irqs.
+         */
+        if (usb_hcd_is_primary_hcd(hcd) && irqnum) {
                retval = usb_hcd_request_irqs(hcd, irqnum, irqflags);
                if (retval)
                        goto err_request_irq;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a0613d8f9be7..265c2f675d04 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -705,10 +705,26 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
        if (type == HUB_INIT3)
                goto init3;
-        /* After a resume, port power should still be on.
+        /* The superspeed hub except for root hub has to use Hub Depth
+         * value as an offset into the route string to locate the bits
+         * it uses to determine the downstream port number. So hub driver
+         * should send a set hub depth request to superspeed hub after
+         * the superspeed hub is set configuration in initialization or
+         * reset procedure.
+         *
+         * After a resume, port power should still be on.
         * For any other type of activation, turn it on.
         */
        if (type != HUB_RESUME) {
+                if (hdev->parent && hub_is_superspeed(hdev)) {
+                        ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+                                        HUB_SET_DEPTH, USB_RT_HUB,
+                                        hdev->level - 1, 0, NULL, 0,
+                                        USB_CTRL_SET_TIMEOUT);
+                        if (ret < 0)
+                                dev_err(hub->intfdev,
+                                                "set hub depth failed\n");
+                }
                /* Speed up system boot by using a delayed_work for the
                 * hub's initial power-up delays.  This is pretty awkward
@@ -987,18 +1003,6 @@ static int hub_configure(struct usb_hub *hub,
                goto fail;
        }
-        if (hub_is_superspeed(hdev) && (hdev->parent != NULL)) {
-                ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
-                                HUB_SET_DEPTH, USB_RT_HUB,
-                                hdev->level - 1, 0, NULL, 0,
-                                USB_CTRL_SET_TIMEOUT);
-                if (ret < 0) {
-                        message = "can't set hub depth";
-                        goto fail;
-                }
-        }
        /* Request the entire hub descriptor.
         * hub->descriptor can handle USB_MAXCHILDREN ports,
         * but the hub can/will return fewer bytes here.
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index ac53a662a6a3..7732d69e49e0 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -872,7 +872,17 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
         */
        if (pdev->vendor == 0x184e)     /* vendor Netlogic */
                return;
+        if (pdev->class != PCI_CLASS_SERIAL_USB_UHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_OHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_EHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_XHCI)
+                return;
+        if (pci_enable_device(pdev) < 0) {
+                dev_warn(&pdev->dev, "Can't enable PCI device, "
+                                "BIOS handoff failed.\n");
+                return;
+        }
        if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
                quirk_usb_handoff_uhci(pdev);
        else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
@@ -881,5 +891,6 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
                quirk_usb_disable_ehci(pdev);
        else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI)
                quirk_usb_handoff_xhci(pdev);
+        pci_disable_device(pdev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 35e257f79c7b..557b6f32db86 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -93,7 +93,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
         */
        memset(port_removable, 0, sizeof(port_removable));
        for (i = 0; i < ports; i++) {
-                portsc = xhci_readl(xhci, xhci->usb3_ports[i]);
+                portsc = xhci_readl(xhci, xhci->usb2_ports[i]);
                /* If a device is removable, PORTSC reports a 0, same as in the
                 * hub descriptor DeviceRemovable bits.
                 */
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 36cbe2226a44..383fc857491c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1126,26 +1126,42 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
 }
 /*
- * Convert bInterval expressed in frames (in 1-255 range) to exponent of
+ * Convert bInterval expressed in microframes (in 1-255 range) to exponent of
 * microframes, rounded down to nearest power of 2.
 */
-static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
-                struct usb_host_endpoint *ep)
+                struct usb_host_endpoint *ep, unsigned int desc_interval,
+                unsigned int min_exponent, unsigned int max_exponent)
 {
        unsigned int interval;
-        interval = fls(8 * ep->desc.bInterval) - 1;
+        interval = fls(desc_interval) - 1;
-        interval = clamp_val(interval, 3, 10);
+        interval = clamp_val(interval, min_exponent, max_exponent);
-        if ((1 << interval) != 8 * ep->desc.bInterval)
+        if ((1 << interval) != desc_interval)
                dev_warn(&udev->dev,
                         "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
                         ep->desc.bEndpointAddress,
                         1 << interval,
-                         8 * ep->desc.bInterval);
+                         desc_interval);
        return interval;
 }
+static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        return xhci_microframes_to_exponent(udev, ep,
+                        ep->desc.bInterval, 0, 15);
+}
+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        return xhci_microframes_to_exponent(udev, ep,
+                        ep->desc.bInterval * 8, 3, 10);
+}
 /* Return the polling or NAK interval.
 *
 * The polling interval is expressed in "microframes".  If xHCI's Interval field
@@ -1164,7 +1180,7 @@ static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
                /* Max NAK rate */
                if (usb_endpoint_xfer_control(&ep->desc) ||
                    usb_endpoint_xfer_bulk(&ep->desc)) {
-                        interval = ep->desc.bInterval;
+                        interval = xhci_parse_microframe_interval(udev, ep);
                        break;
                }
                /* Fall through - SS and HS isoc/int have same decoding */
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6bbe3c3a7111..c939f5fdef9e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -352,6 +352,11 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                /* hcd->irq is -1, we have MSI */
                return 0;
+        if (!pdev->irq) {
+                xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
+                return -EINVAL;
+        }
        /* fall back to legacy interrupt*/
        ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
                        hcd->irq_descr, hcd);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 8dbf51a43c45..08a5575724cd 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -136,6 +136,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
        { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
        { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
+        { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
+        { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
        { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
        { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
        { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 39ed1f46cec0..b54afceb9611 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -788,7 +788,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
@@ -803,7 +802,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
-        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
@@ -828,7 +826,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -836,7 +833,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff),
@@ -846,7 +842,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
@@ -865,8 +860,6 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0095, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0098, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0099, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff),
                .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
@@ -887,28 +880,18 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
@@ -1083,127 +1066,27 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff) },
+          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1403, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1404, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1405, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1406, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1407, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1408, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1409, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1410, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1411, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1412, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1413, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1414, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1415, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1416, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1417, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1418, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1419, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1420, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1421, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1422, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1423, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1427, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1429, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1430, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1431, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1432, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1433, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1434, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1435, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1436, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1437, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1438, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1439, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1440, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1441, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1442, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1443, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1444, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1445, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1446, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1447, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1448, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1449, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1450, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1451, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1452, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1453, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1454, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1455, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1456, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1457, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1458, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1459, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1460, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1461, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1462, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1463, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1464, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1465, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1466, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1467, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1468, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1469, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1470, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1471, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1472, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1473, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1474, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1475, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1476, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1477, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1478, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1479, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1480, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1482, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1483, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1484, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1486, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1487, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1488, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1489, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1490, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1491, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1492, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1493, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1494, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1495, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1496, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1497, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1498, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1499, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1500, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1501, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1502, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1503, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1504, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1505, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1506, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1507, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1508, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1509, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1510, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
-          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 8468eb769a29..75b838eff178 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -179,6 +179,7 @@ static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
 };
 static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
@@ -188,7 +189,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
 };
-static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -206,6 +207,7 @@ static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1]
        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
        { }
 };
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index 2aac1953993b..f140f1b9d5c0 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -49,6 +49,10 @@
 #define MTS_MT9234ZBA_PRODUCT_ID        0xF115
 #define MTS_MT9234ZBAOLD_PRODUCT_ID     0x0319
+/* Abbott Diabetics vendor and product ids */
+#define ABBOTT_VENDOR_ID                0x1a61
+#define ABBOTT_PRODUCT_ID               0x3410
 /* Commands */
 #define TI_GET_VERSION                  0x01
 #define TI_GET_PORT_STATUS              0x02
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 3dd7da9fd504..db51ba16dc07 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -788,15 +788,19 @@ static void quiesce_and_remove_host(struct us_data *us)
        struct Scsi_Host *host = us_to_host(us);
        /* If the device is really gone, cut short reset delays */
-        if (us->pusb_dev->state == USB_STATE_NOTATTACHED)
+        if (us->pusb_dev->state == USB_STATE_NOTATTACHED) {
                set_bit(US_FLIDX_DISCONNECTING, &us->dflags);
+                wake_up(&us->delay_wait);
+        }
-        /* Prevent SCSI-scanning (if it hasn't started yet)
+        /* Prevent SCSI scanning (if it hasn't started yet)
-         * and wait for the SCSI-scanning thread to stop.
+         * or wait for the SCSI-scanning routine to stop.
         */
-        set_bit(US_FLIDX_DONT_SCAN, &us->dflags);
+        cancel_delayed_work_sync(&us->scan_dwork);
-        wake_up(&us->delay_wait);
-        wait_for_completion(&us->scanning_done);
+        /* Balance autopm calls if scanning was cancelled */
+        if (test_bit(US_FLIDX_SCAN_PENDING, &us->dflags))
+                usb_autopm_put_interface_no_suspend(us->pusb_intf);
        /* Removing the host will perform an orderly shutdown: caches
         * synchronized, disks spun down, etc.
@@ -823,53 +827,28 @@ static void release_everything(struct us_data *us)
        scsi_host_put(us_to_host(us));
 }
-/* Thread to carry out delayed SCSI-device scanning */
+/* Delayed-work routine to carry out SCSI-device scanning */
-static int usb_stor_scan_thread(void * __us)
+static void usb_stor_scan_dwork(struct work_struct *work)
 {
-        struct us_data *us = (struct us_data *)__us;
+        struct us_data *us = container_of(work, struct us_data,
+                        scan_dwork.work);
        struct device *dev = &us->pusb_intf->dev;
-        dev_dbg(dev, "device found\n");
+        dev_dbg(dev, "starting scan\n");
-        set_freezable();
-        /*
+        /* For bulk-only devices, determine the max LUN value */
-         * Wait for the timeout to expire or for a disconnect
+        if (us->protocol == USB_PR_BULK && !(us->fflags & US_FL_SINGLE_LUN)) {
-         *
+                mutex_lock(&us->dev_mutex);
-         * We can't freeze in this thread or we risk causing khubd to
+                us->max_lun = usb_stor_Bulk_max_lun(us);
-         * fail to freeze, but we can't be non-freezable either. Nor can
+                mutex_unlock(&us->dev_mutex);
-         * khubd freeze while waiting for scanning to complete as it may
-         * hold the device lock, causing a hang when suspending devices.
-         * So instead of using wait_event_freezable(), explicitly test
-         * for (DONT_SCAN || freezing) in interruptible wait and proceed
-         * if any of DONT_SCAN, freezing or timeout has happened.
-         */
-        if (delay_use > 0) {
-                dev_dbg(dev, "waiting for device to settle "
-                                "before scanning\n");
-                wait_event_interruptible_timeout(us->delay_wait,
-                                test_bit(US_FLIDX_DONT_SCAN, &us->dflags) ||
-                                freezing(current), delay_use * HZ);
        }
+        scsi_scan_host(us_to_host(us));
+        dev_dbg(dev, "scan complete\n");
-        /* If the device is still connected, perform the scanning */
+        /* Should we unbind if no devices were detected? */
-        if (!test_bit(US_FLIDX_DONT_SCAN, &us->dflags)) {
-                /* For bulk-only devices, determine the max LUN value */
-                if (us->protocol == USB_PR_BULK &&
-                                !(us->fflags & US_FL_SINGLE_LUN)) {
-                        mutex_lock(&us->dev_mutex);
-                        us->max_lun = usb_stor_Bulk_max_lun(us);
-                        mutex_unlock(&us->dev_mutex);
-                }
-                scsi_scan_host(us_to_host(us));
-                dev_dbg(dev, "scan complete\n");
-                /* Should we unbind if no devices were detected? */
-        }
        usb_autopm_put_interface(us->pusb_intf);
-        complete_and_exit(&us->scanning_done, 0);
+        clear_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
 }
 static unsigned int usb_stor_sg_tablesize(struct usb_interface *intf)
@@ -916,7 +895,7 @@ int usb_stor_probe1(struct us_data **pus,
        init_completion(&us->cmnd_ready);
        init_completion(&(us->notify));
        init_waitqueue_head(&us->delay_wait);
-        init_completion(&us->scanning_done);
+        INIT_DELAYED_WORK(&us->scan_dwork, usb_stor_scan_dwork);
        /* Associate the us_data structure with the USB device */
        result = associate_dev(us, intf);
@@ -947,7 +926,6 @@ EXPORT_SYMBOL_GPL(usb_stor_probe1);
 /* Second part of general USB mass-storage probing */
 int usb_stor_probe2(struct us_data *us)
 {
-        struct task_struct *th;
        int result;
        struct device *dev = &us->pusb_intf->dev;
@@ -988,20 +966,14 @@ int usb_stor_probe2(struct us_data *us)
                goto BadDevice;
        }
-        /* Start up the thread for delayed SCSI-device scanning */
+        /* Submit the delayed_work for SCSI-device scanning */
-        th = kthread_create(usb_stor_scan_thread, us, "usb-stor-scan");
-        if (IS_ERR(th)) {
-                dev_warn(dev,
-                                "Unable to start the device-scanning thread\n");
-                complete(&us->scanning_done);
-                quiesce_and_remove_host(us);
-                result = PTR_ERR(th);
-                goto BadDevice;
-        }
        usb_autopm_get_interface_no_resume(us->pusb_intf);
-        wake_up_process(th);
+        set_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
+        if (delay_use > 0)
+                dev_dbg(dev, "waiting for device to settle before scanning\n");
+        queue_delayed_work(system_freezable_wq, &us->scan_dwork,
+                        delay_use * HZ);
        return 0;
        /* We come here if there are any problems */
diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
index 7b0f2113632e..75f70f04f37b 100644
--- a/drivers/usb/storage/usb.h
+++ b/drivers/usb/storage/usb.h
@@ -47,6 +47,7 @@
 #include <linux/blkdev.h>
 #include <linux/completion.h>
 #include <linux/mutex.h>
+#include <linux/workqueue.h>
 #include <scsi/scsi_host.h>
 struct us_data;
@@ -72,7 +73,7 @@ struct us_unusual_dev {
 #define US_FLIDX_DISCONNECTING  3       /* disconnect in progress   */
 #define US_FLIDX_RESETTING      4       /* device reset in progress */
 #define US_FLIDX_TIMED_OUT      5       /* SCSI midlayer timed out  */
-#define US_FLIDX_DONT_SCAN      6       /* don't scan (disconnect)  */
+#define US_FLIDX_SCAN_PENDING   6       /* scanning not yet done    */
 #define US_FLIDX_REDO_READ10    7       /* redo READ(10) command    */
 #define US_FLIDX_READ10_WORKED  8       /* previous READ(10) succeeded */
@@ -147,8 +148,8 @@ struct us_data {
        /* mutual exclusion and synchronization structures */
        struct completion       cmnd_ready;      /* to sleep thread on      */
        struct completion       notify;          /* thread begin/end        */
-        wait_queue_head_t       delay_wait;      /* wait during scan, reset */
+        wait_queue_head_t       delay_wait;      /* wait during reset       */
-        struct completion       scanning_done;   /* wait for scan thread    */
+        struct delayed_work     scan_dwork;      /* for async scanning      */
        /* subdriver information */
        void                    *extra;          /* Any extra data          */
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index f9975100d56d..3a3fdc62c75b 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -1061,7 +1061,7 @@ static struct pvr2_board {
        int (*init)(void);
        void (*exit)(void);
        char name[16];
-} board_driver[] = {
+} board_driver[] __refdata = {
 #ifdef CONFIG_SH_DREAMCAST
        { pvr2fb_dc_init, pvr2fb_dc_exit, "Sega DC PVR2" },
 #endif
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index d8d8e7ba6a1e..eb1cc92cd67d 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,6 +110,7 @@ struct autofs_sb_info {
        int sub_version;
        int min_proto;
        int max_proto;
+        int compat_daemon;
        unsigned long exp_timeout;
        unsigned int type;
        int reghost_enabled;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 76741d8d7786..85f1fcdb30e7 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -385,6 +385,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                sbi->pipefd = pipefd;
                sbi->pipe = pipe;
                sbi->catatonic = 0;
+                sbi->compat_daemon = is_compat_task();
        }
 out:
        mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 450f529a4eae..1feb68ecef95 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -124,6 +124,7 @@ start:
        /* Negative dentry - try next */
        if (!simple_positive(q)) {
                spin_unlock(&p->d_lock);
+                lock_set_subclass(&q->d_lock.dep_map, 0, _RET_IP_);
                p = q;
                goto again;
        }
@@ -186,6 +187,7 @@ again:
        /* Negative dentry - try next */
        if (!simple_positive(ret)) {
                spin_unlock(&p->d_lock);
+                lock_set_subclass(&ret->d_lock.dep_map, 0, _RET_IP_);
                p = ret;
                goto again;
        }
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index e16980b00b8d..06858d955120 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,6 +19,7 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
+#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
@@ -224,6 +225,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
        set_autofs_type_indirect(&sbi->type);
        sbi->min_proto = 0;
        sbi->max_proto = 0;
+        sbi->compat_daemon = is_compat_task();
        mutex_init(&sbi->wq_mutex);
        mutex_init(&sbi->pipe_mutex);
        spin_lock_init(&sbi->fs_lock);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index da8876d38a7b..9c098db43344 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,7 +91,24 @@ static int autofs4_write(struct autofs_sb_info *sbi,
        return (bytes > 0);
 }
-        
+/*
+ * The autofs_v5 packet was misdesigned.
+ *
+ * The packets are identical on x86-32 and x86-64, but have different
+ * alignment. Which means that 'sizeof()' will give different results.
+ * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+ */
+static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+{
+        size_t pktsz = sizeof(struct autofs_v5_packet);
+#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+        if (sbi->compat_daemon > 0)
+                pktsz -= 4;
+#endif
+        return pktsz;
+}
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                 struct autofs_wait_queue *wq,
                                 int type)
@@ -155,8 +172,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
        {
                struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
-                pktsz = sizeof(*packet);
+                pktsz = autofs_v5_packet_size(sbi);
                packet->wait_queue_token = wq->wait_queue_token;
                packet->len = wq->name.len;
                memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 633c701a287d..98f6bf10bbd4 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -892,6 +892,8 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                if (eb != eb_in)
                        free_extent_buffer(eb);
                ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
+                if (ret > 0)
+                        ret = -ENOENT;
                if (ret)
                        break;
                next_inum = found_key.offset;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index b669a7d8e499..d986824bb2b4 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -644,7 +644,7 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
 static int btrfsic_process_superblock(struct btrfsic_state *state,
                                      struct btrfs_fs_devices *fs_devices)
 {
-        int ret;
+        int ret = 0;
        struct btrfs_super_block *selected_super;
        struct list_head *dev_head = &fs_devices->devices;
        struct btrfs_device *device;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 14f1c5a0b2d2..d02c27cd14c7 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -588,6 +588,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                   page_offset(bio->bi_io_vec->bv_page),
                                   PAGE_CACHE_SIZE);
        read_unlock(&em_tree->lock);
+        if (!em)
+                return -EIO;
        compressed_len = em->block_len;
        cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 27ebe61d3ccc..80b6486fd5e6 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -886,7 +886,7 @@ struct btrfs_block_rsv {
        u64 reserved;
        struct btrfs_space_info *space_info;
        spinlock_t lock;
-        unsigned int full:1;
+        unsigned int full;
 };
 /*
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 811d9f918b1c..534266fe505f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2260,6 +2260,12 @@ int open_ctree(struct super_block *sb,
                goto fail_sb_buffer;
        }
+        if (sectorsize < PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size "
+                       "found on %s\n", sb->s_id);
+                goto fail_sb_buffer;
+        }
        mutex_lock(&fs_info->chunk_mutex);
        ret = btrfs_read_sys_array(tree_root);
        mutex_unlock(&fs_info->chunk_mutex);
@@ -2301,6 +2307,12 @@ int open_ctree(struct super_block *sb,
        btrfs_close_extra_devices(fs_devices);
+        if (!fs_devices->latest_bdev) {
+                printk(KERN_CRIT "btrfs: failed to read devices on %s\n",
+                       sb->s_id);
+                goto fail_tree_roots;
+        }
 retry_root_backup:
        blocksize = btrfs_level_size(tree_root,
                                     btrfs_super_root_level(disk_super));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 283af7a676a3..37e0a800d34e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3312,7 +3312,8 @@ commit_trans:
        }
        data_sinfo->bytes_may_use += bytes;
        trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 1);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 1);
        spin_unlock(&data_sinfo->lock);
        return 0;
@@ -3333,7 +3334,8 @@ void btrfs_free_reserved_data_space(struct inode *inode, u64 bytes)
        spin_lock(&data_sinfo->lock);
        data_sinfo->bytes_may_use -= bytes;
        trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 0);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 0);
        spin_unlock(&data_sinfo->lock);
 }
@@ -3611,12 +3613,15 @@ static int may_commit_transaction(struct btrfs_root *root,
        if (space_info != delayed_rsv->space_info)
                return -ENOSPC;
+        spin_lock(&space_info->lock);
        spin_lock(&delayed_rsv->lock);
-        if (delayed_rsv->size < bytes) {
+        if (space_info->bytes_pinned + delayed_rsv->size < bytes) {
                spin_unlock(&delayed_rsv->lock);
+                spin_unlock(&space_info->lock);
                return -ENOSPC;
        }
        spin_unlock(&delayed_rsv->lock);
+        spin_unlock(&space_info->lock);
 commit:
        trans = btrfs_join_transaction(root);
@@ -3695,9 +3700,9 @@ again:
                if (used + orig_bytes <= space_info->total_bytes) {
                        space_info->bytes_may_use += orig_bytes;
                        trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
+                                              "space_info",
-                                                      (u64)space_info,
+                                              (u64)(unsigned long)space_info,
-                                                      orig_bytes, 1);
+                                              orig_bytes, 1);
                        ret = 0;
                } else {
                        /*
@@ -3766,9 +3771,9 @@ again:
                if (used + num_bytes < space_info->total_bytes + avail) {
                        space_info->bytes_may_use += orig_bytes;
                        trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
+                                              "space_info",
-                                                      (u64)space_info,
+                                              (u64)(unsigned long)space_info,
-                                                      orig_bytes, 1);
+                                              orig_bytes, 1);
                        ret = 0;
                } else {
                        wait_ordered = true;
@@ -3913,8 +3918,8 @@ static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
                        spin_lock(&space_info->lock);
                        space_info->bytes_may_use -= num_bytes;
                        trace_btrfs_space_reservation(fs_info, "space_info",
-                                                      (u64)space_info,
+                                              (u64)(unsigned long)space_info,
-                                                      num_bytes, 0);
+                                              num_bytes, 0);
                        space_info->reservation_progress++;
                        spin_unlock(&space_info->lock);
                }
@@ -4105,7 +4110,7 @@ static u64 calc_global_metadata_size(struct btrfs_fs_info *fs_info)
        num_bytes += div64_u64(data_used + meta_used, 50);
        if (num_bytes * 3 > meta_used)
-                num_bytes = div64_u64(meta_used, 3);
+                num_bytes = div64_u64(meta_used, 3) * 2;
        return ALIGN(num_bytes, fs_info->extent_root->leafsize << 10);
 }
@@ -4132,14 +4137,14 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                block_rsv->reserved += num_bytes;
                sinfo->bytes_may_use += num_bytes;
                trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 1);
+                                      (u64)(unsigned long)sinfo, num_bytes, 1);
        }
        if (block_rsv->reserved >= block_rsv->size) {
                num_bytes = block_rsv->reserved - block_rsv->size;
                sinfo->bytes_may_use -= num_bytes;
                trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 0);
+                                      (u64)(unsigned long)sinfo, num_bytes, 0);
                sinfo->reservation_progress++;
                block_rsv->reserved = block_rsv->size;
                block_rsv->full = 1;
@@ -4192,7 +4197,8 @@ void btrfs_trans_release_metadata(struct btrfs_trans_handle *trans,
        if (!trans->bytes_reserved)
                return;
-        trace_btrfs_space_reservation(root->fs_info, "transaction", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "transaction",
+                                      (u64)(unsigned long)trans,
                                      trans->bytes_reserved, 0);
        btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
        trans->bytes_reserved = 0;
@@ -4710,9 +4716,9 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                        space_info->bytes_reserved += num_bytes;
                        if (reserve == RESERVE_ALLOC) {
                                trace_btrfs_space_reservation(cache->fs_info,
-                                                              "space_info",
+                                              "space_info",
-                                                              (u64)space_info,
+                                              (u64)(unsigned long)space_info,
-                                                              num_bytes, 0);
+                                              num_bytes, 0);
                                space_info->bytes_may_use -= num_bytes;
                        }
                }
@@ -7886,9 +7892,16 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
        u64 start;
        u64 end;
        u64 trimmed = 0;
+        u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
        int ret = 0;
-        cache = btrfs_lookup_block_group(fs_info, range->start);
+        /*
+         * try to trim all FS space, our block group may start from non-zero.
+         */
+        if (range->len == total_bytes)
+                cache = btrfs_lookup_first_block_group(fs_info, range->start);
+        else
+                cache = btrfs_lookup_block_group(fs_info, range->start);
        while (cache) {
                if (cache->key.objectid >= (range->start + range->len)) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index fcf77e1ded40..a55fbe6252de 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -513,6 +513,15 @@ hit_next:
        WARN_ON(state->end < start);
        last_end = state->end;
+        if (state->end < end && !need_resched())
+                next_node = rb_next(&state->rb_node);
+        else
+                next_node = NULL;
+        /* the state doesn't have the wanted bits, go ahead */
+        if (!(state->state & bits))
+                goto next;
        /*
         *     | ---- desired range ---- |
         *  | state | or
@@ -565,20 +574,15 @@ hit_next:
                goto out;
        }
-        if (state->end < end && prealloc && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
        set |= clear_state_bit(tree, state, &bits, wake);
+next:
        if (last_end == (u64)-1)
                goto out;
        start = last_end + 1;
        if (start <= end && next_node) {
                state = rb_entry(next_node, struct extent_state,
                                 rb_node);
-                if (state->start == start)
+                goto hit_next;
-                        goto hit_next;
        }
        goto search_again;
@@ -961,8 +965,6 @@ hit_next:
                set_state_bits(tree, state, &bits);
                clear_state_bit(tree, state, &clear_bits, 0);
-                merge_state(tree, state);
                if (last_end == (u64)-1)
                        goto out;
@@ -1007,7 +1009,6 @@ hit_next:
                if (state->end <= end) {
                        set_state_bits(tree, state, &bits);
                        clear_state_bit(tree, state, &clear_bits, 0);
-                        merge_state(tree, state);
                        if (last_end == (u64)-1)
                                goto out;
                        start = last_end + 1;
@@ -1068,8 +1069,6 @@ hit_next:
                set_state_bits(tree, prealloc, &bits);
                clear_state_bit(tree, prealloc, &clear_bits, 0);
-                merge_state(tree, prealloc);
                prealloc = NULL;
                goto out;
        }
@@ -2154,13 +2153,46 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
                 "this_mirror=%d, num_copies=%d, in_validation=%d\n", read_mode,
                 failrec->this_mirror, num_copies, failrec->in_validation);
-        tree->ops->submit_bio_hook(inode, read_mode, bio, failrec->this_mirror,
+        ret = tree->ops->submit_bio_hook(inode, read_mode, bio,
-                                        failrec->bio_flags, 0);
+                                         failrec->this_mirror,
-        return 0;
+                                         failrec->bio_flags, 0);
+        return ret;
 }
 /* lots and lots of room for performance fixes in the end_bio funcs */
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+{
+        int uptodate = (err == 0);
+        struct extent_io_tree *tree;
+        int ret;
+        tree = &BTRFS_I(page->mapping->host)->io_tree;
+        if (tree->ops && tree->ops->writepage_end_io_hook) {
+                ret = tree->ops->writepage_end_io_hook(page, start,
+                                               end, NULL, uptodate);
+                if (ret)
+                        uptodate = 0;
+        }
+        if (!uptodate && tree->ops &&
+            tree->ops->writepage_io_failed_hook) {
+                ret = tree->ops->writepage_io_failed_hook(NULL, page,
+                                                 start, end, NULL);
+                /* Writeback already completed */
+                if (ret == 0)
+                        return 1;
+        }
+        if (!uptodate) {
+                clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
+                ClearPageUptodate(page);
+                SetPageError(page);
+        }
+        return 0;
+}
 /*
 * after a writepage IO is done, we need to:
 * clear the uptodate bits on error
@@ -2172,13 +2204,11 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
 */
 static void end_bio_extent_writepage(struct bio *bio, int err)
 {
-        int uptodate = err == 0;
        struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
        struct extent_io_tree *tree;
        u64 start;
        u64 end;
        int whole_page;
-        int ret;
        do {
                struct page *page = bvec->bv_page;
@@ -2195,28 +2225,9 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
                if (--bvec >= bio->bi_io_vec)
                        prefetchw(&bvec->bv_page->flags);
-                if (tree->ops && tree->ops->writepage_end_io_hook) {
-                        ret = tree->ops->writepage_end_io_hook(page, start,
-                                                       end, NULL, uptodate);
-                        if (ret)
-                                uptodate = 0;
-                }
-                if (!uptodate && tree->ops &&
-                    tree->ops->writepage_io_failed_hook) {
-                        ret = tree->ops->writepage_io_failed_hook(bio, page,
-                                                         start, end, NULL);
-                        if (ret == 0) {
-                                uptodate = (err == 0);
-                                continue;
-                        }
-                }
-                if (!uptodate) {
+                if (end_extent_writepage(page, err, start, end))
-                        clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
+                        continue;
-                        ClearPageUptodate(page);
-                        SetPageError(page);
-                }
                if (whole_page)
                        end_page_writeback(page);
@@ -2779,9 +2790,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                                delalloc_start = delalloc_end + 1;
                                continue;
                        }
-                        tree->ops->fill_delalloc(inode, page, delalloc_start,
+                        ret = tree->ops->fill_delalloc(inode, page,
-                                                 delalloc_end, &page_started,
+                                                       delalloc_start,
-                                                 &nr_written);
+                                                       delalloc_end,
+                                                       &page_started,
+                                                       &nr_written);
+                        BUG_ON(ret);
                        /*
                         * delalloc_end is already one less than the total
                         * length, so we don't subtract one from
@@ -2818,8 +2832,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
        if (tree->ops && tree->ops->writepage_start_hook) {
                ret = tree->ops->writepage_start_hook(page, start,
                                                      page_end);
-                if (ret == -EAGAIN) {
+                if (ret) {
-                        redirty_page_for_writepage(wbc, page);
+                        /* Fixup worker will requeue */
+                        if (ret == -EBUSY)
+                                wbc->pages_skipped++;
+                        else
+                                redirty_page_for_writepage(wbc, page);
                        update_nr_written(page, wbc, nr_written);
                        unlock_page(page);
                        ret = 0;
@@ -3289,7 +3307,7 @@ int try_release_extent_mapping(struct extent_map_tree *map,
                        len = end - start + 1;
                        write_lock(&map->lock);
                        em = lookup_extent_mapping(map, start, len);
-                        if (IS_ERR_OR_NULL(em)) {
+                        if (!em) {
                                write_unlock(&map->lock);
                                break;
                        }
@@ -3853,10 +3871,9 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
        num_pages = num_extent_pages(eb->start, eb->len);
        clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
-        if (eb_straddles_pages(eb)) {
+        clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
+                              cached_state, GFP_NOFS);
-                                      cached_state, GFP_NOFS);
-        }
        for (i = 0; i < num_pages; i++) {
                page = extent_buffer_page(eb, i);
                if (page)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc6a042cb6fc..cecc3518c121 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -319,4 +319,5 @@ struct btrfs_mapping_tree;
 int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                        u64 length, u64 logical, struct page *page,
                        int mirror_num);
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end);
 #endif
diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h
index 33a7890b1f40..1195f09761fe 100644
--- a/fs/btrfs/extent_map.h
+++ b/fs/btrfs/extent_map.h
@@ -26,8 +26,8 @@ struct extent_map {
        unsigned long flags;
        struct block_device *bdev;
        atomic_t refs;
-        unsigned int in_tree:1;
+        unsigned int in_tree;
-        unsigned int compress_type:4;
+        unsigned int compress_type;
 };
 struct extent_map_tree {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 859ba2dd8890..e8d06b6b9194 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1605,6 +1605,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                return -EOPNOTSUPP;
        /*
+         * Make sure we have enough space before we do the
+         * allocation.
+         */
+        ret = btrfs_check_data_free_space(inode, len);
+        if (ret)
+                return ret;
+        /*
         * wait for ordered IO before we have any locks.  We'll loop again
         * below with the locks held.
         */
@@ -1667,27 +1675,12 @@ static long btrfs_fallocate(struct file *file, int mode,
                if (em->block_start == EXTENT_MAP_HOLE ||
                    (cur_offset >= inode->i_size &&
                     !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-                        /*
-                         * Make sure we have enough space before we do the
-                         * allocation.
-                         */
-                        ret = btrfs_check_data_free_space(inode, last_byte -
-                                                          cur_offset);
-                        if (ret) {
-                                free_extent_map(em);
-                                break;
-                        }
                        ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                        last_byte - cur_offset,
                                                        1 << inode->i_blkbits,
                                                        offset + len,
                                                        &alloc_hint);
-                        /* Let go of our reservation. */
-                        btrfs_free_reserved_data_space(inode, last_byte -
-                                                       cur_offset);
                        if (ret < 0) {
                                free_extent_map(em);
                                break;
@@ -1715,6 +1708,8 @@ static long btrfs_fallocate(struct file *file, int mode,
                             &cached_state, GFP_NOFS);
 out:
        mutex_unlock(&inode->i_mutex);
+        /* Let go of our reservation. */
+        btrfs_free_reserved_data_space(inode, len);
        return ret;
 }
@@ -1761,7 +1756,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
                                                     start - root->sectorsize,
                                                     root->sectorsize, 0);
                if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                        goto out;
                }
                last_end = em->start + em->len;
@@ -1773,7 +1768,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
        while (1) {
                em = btrfs_get_extent_fiemap(inode, NULL, 0, start, len, 0);
                if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                        break;
                }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c2f20594c9f7..710ea380c7ed 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -777,6 +777,7 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
        spin_lock(&block_group->lock);
        if (block_group->disk_cache_state != BTRFS_DC_WRITTEN) {
                spin_unlock(&block_group->lock);
+                btrfs_free_path(path);
                goto out;
        }
        spin_unlock(&block_group->lock);
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 213ffa86ce1b..ee15d88b33d2 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -438,7 +438,8 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
                                          trans->bytes_reserved);
        if (ret)
                goto out;
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                      trans->bytes_reserved, 1);
 again:
        inode = lookup_free_ino_inode(root, path);
@@ -500,7 +501,8 @@ again:
 out_put:
        iput(inode);
 out_release:
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                      trans->bytes_reserved, 0);
        btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
 out:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 32214fe0f7e3..892b34785ccc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1555,6 +1555,7 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
        struct inode *inode;
        u64 page_start;
        u64 page_end;
+        int ret;
        fixup = container_of(work, struct btrfs_writepage_fixup, work);
        page = fixup->page;
@@ -1582,12 +1583,21 @@ again:
                                     page_end, &cached_state, GFP_NOFS);
                unlock_page(page);
                btrfs_start_ordered_extent(inode, ordered, 1);
+                btrfs_put_ordered_extent(ordered);
                goto again;
        }
-        BUG();
+        ret = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
+        if (ret) {
+                mapping_set_error(page->mapping, ret);
+                end_extent_writepage(page, ret, page_start, page_end);
+                ClearPageChecked(page);
+                goto out;
+         }
        btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state);
        ClearPageChecked(page);
+        set_page_dirty(page);
 out:
        unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
                             &cached_state, GFP_NOFS);
@@ -1630,7 +1640,7 @@ static int btrfs_writepage_start_hook(struct page *page, u64 start, u64 end)
        fixup->work.func = btrfs_writepage_fixup_worker;
        fixup->page = page;
        btrfs_queue_worker(&root->fs_info->fixup_workers, &fixup->work);
-        return -EAGAIN;
+        return -EBUSY;
 }
 static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
@@ -4575,7 +4585,8 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                ret = btrfs_insert_dir_item(trans, root, name, name_len,
                                            parent_inode, &key,
                                            btrfs_inode_type(inode), index);
-                BUG_ON(ret);
+                if (ret)
+                        goto fail_dir_item;
                btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                   name_len * 2);
@@ -4583,6 +4594,23 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                ret = btrfs_update_inode(trans, root, parent_inode);
        }
        return ret;
+fail_dir_item:
+        if (unlikely(ino == BTRFS_FIRST_FREE_OBJECTID)) {
+                u64 local_index;
+                int err;
+                err = btrfs_del_root_ref(trans, root->fs_info->tree_root,
+                                 key.objectid, root->root_key.objectid,
+                                 parent_ino, &local_index, name, name_len);
+        } else if (add_backref) {
+                u64 local_index;
+                int err;
+                err = btrfs_del_inode_ref(trans, root, name, name_len,
+                                          ino, parent_ino, &local_index);
+        }
+        return ret;
 }
 static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
@@ -6696,8 +6724,10 @@ int btrfs_create_subvol_root(struct btrfs_trans_handle *trans,
        int err;
        u64 index = 0;
-        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2, new_dirid,
+        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2,
-                                new_dirid, S_IFDIR | 0700, &index);
+                                new_dirid, new_dirid,
+                                S_IFDIR | (~current_umask() & S_IRWXUGO),
+                                &index);
        if (IS_ERR(inode))
                return PTR_ERR(inode);
        inode->i_op = &btrfs_dir_inode_operations;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 03bb62a9ee24..d8b54715c2de 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -861,6 +861,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
        int i_done;
        struct btrfs_ordered_extent *ordered;
        struct extent_state *cached_state = NULL;
+        struct extent_io_tree *tree;
        gfp_t mask = btrfs_alloc_write_mask(inode->i_mapping);
        if (isize == 0)
@@ -871,18 +872,34 @@ static int cluster_pages_for_defrag(struct inode *inode,
                                           num_pages << PAGE_CACHE_SHIFT);
        if (ret)
                return ret;
-again:
-        ret = 0;
        i_done = 0;
+        tree = &BTRFS_I(inode)->io_tree;
        /* step one, lock all the pages */
        for (i = 0; i < num_pages; i++) {
                struct page *page;
+again:
                page = find_or_create_page(inode->i_mapping,
-                                            start_index + i, mask);
+                                           start_index + i, mask);
                if (!page)
                        break;
+                page_start = page_offset(page);
+                page_end = page_start + PAGE_CACHE_SIZE - 1;
+                while (1) {
+                        lock_extent(tree, page_start, page_end, GFP_NOFS);
+                        ordered = btrfs_lookup_ordered_extent(inode,
+                                                              page_start);
+                        unlock_extent(tree, page_start, page_end, GFP_NOFS);
+                        if (!ordered)
+                                break;
+                        unlock_page(page);
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                        lock_page(page);
+                }
                if (!PageUptodate(page)) {
                        btrfs_readpage(NULL, page);
                        lock_page(page);
@@ -893,15 +910,22 @@ again:
                                break;
                        }
                }
                isize = i_size_read(inode);
                file_end = (isize - 1) >> PAGE_CACHE_SHIFT;
-                if (!isize || page->index > file_end ||
+                if (!isize || page->index > file_end) {
-                    page->mapping != inode->i_mapping) {
                        /* whoops, we blew past eof, skip this page */
                        unlock_page(page);
                        page_cache_release(page);
                        break;
                }
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto again;
+                }
                pages[i] = page;
                i_done++;
        }
@@ -924,25 +948,6 @@ again:
        lock_extent_bits(&BTRFS_I(inode)->io_tree,
                         page_start, page_end - 1, 0, &cached_state,
                         GFP_NOFS);
-        ordered = btrfs_lookup_first_ordered_extent(inode, page_end - 1);
-        if (ordered &&
-            ordered->file_offset + ordered->len > page_start &&
-            ordered->file_offset < page_end) {
-                btrfs_put_ordered_extent(ordered);
-                unlock_extent_cached(&BTRFS_I(inode)->io_tree,
-                                     page_start, page_end - 1,
-                                     &cached_state, GFP_NOFS);
-                for (i = 0; i < i_done; i++) {
-                        unlock_page(pages[i]);
-                        page_cache_release(pages[i]);
-                }
-                btrfs_wait_ordered_range(inode, page_start,
-                                         page_end - page_start);
-                goto again;
-        }
-        if (ordered)
-                btrfs_put_ordered_extent(ordered);
        clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start,
                          page_end - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
                          EXTENT_DO_ACCOUNTING, 0, 0, &cached_state,
@@ -1327,6 +1332,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                goto out;
        }
+        if (name[0] == '.' &&
+           (namelen == 1 || (name[1] == '.' && namelen == 2))) {
+                ret = -EEXIST;
+                goto out;
+        }
        if (subvol) {
                ret = btrfs_mksubvol(&file->f_path, name, namelen,
                                     NULL, transid, readonly);
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9770cc5bfb76..abc0fbffa510 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1367,7 +1367,8 @@ out:
 }
 static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
-        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length)
+        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length,
+        u64 dev_offset)
 {
        struct btrfs_mapping_tree *map_tree =
                &sdev->dev->dev_root->fs_info->mapping_tree;
@@ -1391,7 +1392,8 @@ static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
                goto out;
        for (i = 0; i < map->num_stripes; ++i) {
-                if (map->stripes[i].dev == sdev->dev) {
+                if (map->stripes[i].dev == sdev->dev &&
+                    map->stripes[i].physical == dev_offset) {
                        ret = scrub_stripe(sdev, map, i, chunk_offset, length);
                        if (ret)
                                goto out;
@@ -1487,7 +1489,7 @@ int scrub_enumerate_chunks(struct scrub_dev *sdev, u64 start, u64 end)
                        break;
                }
                ret = scrub_chunk(sdev, chunk_tree, chunk_objectid,
-                                  chunk_offset, length);
+                                  chunk_offset, length, found_key.offset);
                btrfs_put_block_group(cache);
                if (ret)
                        break;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 287a6728b1ad..04b77e3ceb7a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -327,7 +327,8 @@ again:
        if (num_bytes) {
                trace_btrfs_space_reservation(root->fs_info, "transaction",
-                                              (u64)h, num_bytes, 1);
+                                              (u64)(unsigned long)h,
+                                              num_bytes, 1);
                h->block_rsv = &root->fs_info->trans_block_rsv;
                h->bytes_reserved = num_bytes;
        }
@@ -915,7 +916,11 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
                                dentry->d_name.name, dentry->d_name.len,
                                parent_inode, &key,
                                BTRFS_FT_DIR, index);
-        BUG_ON(ret);
+        if (ret) {
+                pending->error = -EEXIST;
+                dput(parent);
+                goto fail;
+        }
        btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                         dentry->d_name.len * 2);
@@ -993,12 +998,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
        struct btrfs_pending_snapshot *pending;
        struct list_head *head = &trans->transaction->pending_snapshots;
-        int ret;
-        list_for_each_entry(pending, head, list) {
+        list_for_each_entry(pending, head, list)
-                ret = create_pending_snapshot(trans, fs_info, pending);
+                create_pending_snapshot(trans, fs_info, pending);
-                BUG_ON(ret);
-        }
        return 0;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0b4e2af7954d..ef41f285a475 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -459,12 +459,23 @@ int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
        struct btrfs_device *device, *next;
+        struct block_device *latest_bdev = NULL;
+        u64 latest_devid = 0;
+        u64 latest_transid = 0;
        mutex_lock(&uuid_mutex);
 again:
        /* This is the initialized path, it is safe to release the devices. */
        list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
-                if (device->in_fs_metadata)
+                if (device->in_fs_metadata) {
+                        if (!latest_transid ||
+                            device->generation > latest_transid) {
+                                latest_devid = device->devid;
+                                latest_transid = device->generation;
+                                latest_bdev = device->bdev;
+                        }
                        continue;
+                }
                if (device->bdev) {
                        blkdev_put(device->bdev, device->mode);
@@ -487,6 +498,10 @@ again:
                goto again;
        }
+        fs_devices->latest_bdev = latest_bdev;
+        fs_devices->latest_devid = latest_devid;
+        fs_devices->latest_trans = latest_transid;
        mutex_unlock(&uuid_mutex);
        return 0;
 }
@@ -1953,7 +1968,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
        em = lookup_extent_mapping(em_tree, chunk_offset, 1);
        read_unlock(&em_tree->lock);
-        BUG_ON(em->start > chunk_offset ||
+        BUG_ON(!em || em->start > chunk_offset ||
               em->start + em->len < chunk_offset);
        map = (struct map_lookup *)em->bdev;
@@ -4356,6 +4371,20 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                return -ENOMEM;
        btrfs_set_buffer_uptodate(sb);
        btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
+        /*
+         * The sb extent buffer is artifical and just used to read the system array.
+         * btrfs_set_buffer_uptodate() call does not properly mark all it's
+         * pages up-to-date when the page is larger: extent does not cover the
+         * whole page and consequently check_page_uptodate does not find all
+         * the page's extents up-to-date (the hole beyond sb),
+         * write_extent_buffer then triggers a WARN_ON.
+         *
+         * Regular short extents go through mark_extent_buffer_dirty/writeback cycle,
+         * but sb spans only this function. Add an explicit SetPageUptodate call
+         * to silence the warning eg. on PowerPC 64.
+         */
+        if (PAGE_CACHE_SIZE > BTRFS_SUPER_INFO_SIZE)
+                SetPageUptodate(sb->first_page);
        write_extent_buffer(sb, super_copy, 0, BTRFS_SUPER_INFO_SIZE);
        array_size = btrfs_super_sys_array_size(super_copy);
diff --git a/fs/compat.c b/fs/compat.c
index fa9d721ecfee..07880bae28a9 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -131,41 +131,35 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
 {
-        compat_ino_t ino = stat->ino;
+        struct compat_stat tmp;
-        typeof(ubuf->st_uid) uid = 0;
-        typeof(ubuf->st_gid) gid = 0;
-        int err;
-        SET_UID(uid, stat->uid);
+        if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
-        SET_GID(gid, stat->gid);
+                return -EOVERFLOW;
-        if ((u64) stat->size > MAX_NON_LFS ||
+        memset(&tmp, 0, sizeof(tmp));
-            !old_valid_dev(stat->dev) ||
+        tmp.st_dev = old_encode_dev(stat->dev);
-            !old_valid_dev(stat->rdev))
+        tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
                return -EOVERFLOW;
-        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+        tmp.st_mode = stat->mode;
+        tmp.st_nlink = stat->nlink;
+        if (tmp.st_nlink != stat->nlink)
                return -EOVERFLOW;
+        SET_UID(tmp.st_uid, stat->uid);
-        if (clear_user(ubuf, sizeof(*ubuf)))
+        SET_GID(tmp.st_gid, stat->gid);
-                return -EFAULT;
+        tmp.st_rdev = old_encode_dev(stat->rdev);
+        if ((u64) stat->size > MAX_NON_LFS)
-        err  = __put_user(old_encode_dev(stat->dev), &ubuf->st_dev);
+                return -EOVERFLOW;
-        err |= __put_user(ino, &ubuf->st_ino);
+        tmp.st_size = stat->size;
-        err |= __put_user(stat->mode, &ubuf->st_mode);
+        tmp.st_atime = stat->atime.tv_sec;
-        err |= __put_user(stat->nlink, &ubuf->st_nlink);
+        tmp.st_atime_nsec = stat->atime.tv_nsec;
-        err |= __put_user(uid, &ubuf->st_uid);
+        tmp.st_mtime = stat->mtime.tv_sec;
-        err |= __put_user(gid, &ubuf->st_gid);
+        tmp.st_mtime_nsec = stat->mtime.tv_nsec;
-        err |= __put_user(old_encode_dev(stat->rdev), &ubuf->st_rdev);
+        tmp.st_ctime = stat->ctime.tv_sec;
-        err |= __put_user(stat->size, &ubuf->st_size);
+        tmp.st_ctime_nsec = stat->ctime.tv_nsec;
-        err |= __put_user(stat->atime.tv_sec, &ubuf->st_atime);
+        tmp.st_blocks = stat->blocks;
-        err |= __put_user(stat->atime.tv_nsec, &ubuf->st_atime_nsec);
+        tmp.st_blksize = stat->blksize;
-        err |= __put_user(stat->mtime.tv_sec, &ubuf->st_mtime);
+        return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
-        err |= __put_user(stat->mtime.tv_nsec, &ubuf->st_mtime_nsec);
-        err |= __put_user(stat->ctime.tv_sec, &ubuf->st_ctime);
-        err |= __put_user(stat->ctime.tv_nsec, &ubuf->st_ctime_nsec);
-        err |= __put_user(stat->blksize, &ubuf->st_blksize);
-        err |= __put_user(stat->blocks, &ubuf->st_blocks);
-        return err;
 }
 asmlinkage long compat_sys_newstat(const char __user * filename,
diff --git a/fs/dcache.c b/fs/dcache.c
index 16a53cc2cc02..fe19ac13f75f 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2968,7 +2968,7 @@ __setup("dhash_entries=", set_dhash_entries);
 static void __init dcache_init_early(void)
 {
-        int loop;
+        unsigned int loop;
        /* If hashes are distributed across NUMA nodes, defer
         * hash allocation until vmalloc space is available.
@@ -2986,13 +2986,13 @@ static void __init dcache_init_early(void)
                                        &d_hash_mask,
                                        0);
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 static void __init dcache_init(void)
 {
-        int loop;
+        unsigned int loop;
        /* 
         * A constructor could be added for stable state like the lists,
@@ -3016,7 +3016,7 @@ static void __init dcache_init(void)
                                        &d_hash_mask,
                                        0);
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 4a588dbd11bf..f4aadd15b613 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -173,7 +173,7 @@ void inode_dio_wait(struct inode *inode)
        if (atomic_read(&inode->i_dio_count))
                __inode_dio_wait(inode);
 }
-EXPORT_SYMBOL_GPL(inode_dio_wait);
+EXPORT_SYMBOL(inode_dio_wait);
 /*
 * inode_dio_done - signal finish of a direct I/O requests
@@ -187,7 +187,7 @@ void inode_dio_done(struct inode *inode)
        if (atomic_dec_and_test(&inode->i_dio_count))
                wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
 }
-EXPORT_SYMBOL_GPL(inode_dio_done);
+EXPORT_SYMBOL(inode_dio_done);
 /*
 * How many pages are in the queue?
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index aabdfc38cf24..ea54cdef04dd 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -320,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
        return !list_empty(p);
 }
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+{
+        return container_of(p, struct eppoll_entry, wait);
+}
 /* Get the "struct epitem" from a wait queue pointer */
 static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
 {
@@ -467,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
        put_cpu();
 }
+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+        rcu_read_lock();
+        /* If it is cleared by POLLFREE, it should be rcu-safe */
+        whead = rcu_dereference(pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        rcu_read_unlock();
+}
 /*
 * This function unregisters poll callbacks from the associated file
 * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
@@ -481,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
                pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
                list_del(&pwq->llink);
-                remove_wait_queue(pwq->whead, &pwq->wait);
+                ep_remove_wait_queue(pwq);
                kmem_cache_free(pwq_cache, pwq);
        }
 }
@@ -842,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
        struct epitem *epi = ep_item_from_wait(wait);
        struct eventpoll *ep = epi->ep;
+        if ((unsigned long)key & POLLFREE) {
+                ep_pwq_from_wait(wait)->whead = NULL;
+                /*
+                 * whead = NULL above can race with ep_remove_wait_queue()
+                 * which can do another remove_wait_queue() after us, so we
+                 * can't use __remove_wait_queue(). whead->lock is held by
+                 * the caller.
+                 */
+                list_del_init(&wait->task_list);
+        }
        spin_lock_irqsave(&ep->lock, flags);
        /*
diff --git a/fs/inode.c b/fs/inode.c
index fb10d86ffad7..d3ebdbe723d0 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1651,7 +1651,7 @@ __setup("ihash_entries=", set_ihash_entries);
 */
 void __init inode_init_early(void)
 {
-        int loop;
+        unsigned int loop;
        /* If hashes are distributed across NUMA nodes, defer
         * hash allocation until vmalloc space is available.
@@ -1669,13 +1669,13 @@ void __init inode_init_early(void)
                                        &i_hash_mask,
                                        0);
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
 void __init inode_init(void)
 {
-        int loop;
+        unsigned int loop;
        /* inode slab cache */
        inode_cachep = kmem_cache_create("inode_cache",
@@ -1699,7 +1699,7 @@ void __init inode_init(void)
                                        &i_hash_mask,
                                        0);
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
diff --git a/fs/namei.c b/fs/namei.c
index 208c6aa4a989..a780ea515c47 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1095,8 +1095,10 @@ static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentr
        struct dentry *old;
        /* Don't create child dentry for a dead directory. */
-        if (unlikely(IS_DEADDIR(inode)))
+        if (unlikely(IS_DEADDIR(inode))) {
+                dput(dentry);
                return ERR_PTR(-ENOENT);
+        }
        old = inode->i_op->lookup(inode, dentry, nd);
        if (unlikely(old)) {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f0c849c98fe4..ec9f6ef6c5dd 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3575,8 +3575,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
        }
        if (npages > 1) {
                /* for decoding across pages */
-                args.acl_scratch = alloc_page(GFP_KERNEL);
+                res.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!args.acl_scratch)
+                if (!res.acl_scratch)
                        goto out_free;
        }
        args.acl_len = npages * PAGE_SIZE;
@@ -3612,8 +3612,8 @@ out_free:
        for (i = 0; i < npages; i++)
                if (pages[i])
                        __free_page(pages[i]);
-        if (args.acl_scratch)
+        if (res.acl_scratch)
-                __free_page(args.acl_scratch);
+                __free_page(res.acl_scratch);
        return ret;
 }
@@ -4883,8 +4883,10 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                clp->cl_rpcclient->cl_auth->au_flavor);
        res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
-        if (unlikely(!res.server_scope))
+        if (unlikely(!res.server_scope)) {
-                return -ENOMEM;
+                status = -ENOMEM;
+                goto out;
+        }
        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
        if (!status)
@@ -4901,12 +4903,13 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                        clp->server_scope = NULL;
                }
-                if (!clp->server_scope)
+                if (!clp->server_scope) {
                        clp->server_scope = res.server_scope;
-                else
+                        goto out;
-                        kfree(res.server_scope);
+                }
        }
+        kfree(res.server_scope);
+out:
        dprintk("<-- %s status= %d\n", __func__, status);
        return status;
 }
@@ -5008,37 +5011,53 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
        return status;
 }
+static struct nfs4_slot *nfs4_alloc_slots(u32 max_slots, gfp_t gfp_flags)
+{
+        return kcalloc(max_slots, sizeof(struct nfs4_slot), gfp_flags);
+}
+static void nfs4_add_and_init_slots(struct nfs4_slot_table *tbl,
+                struct nfs4_slot *new,
+                u32 max_slots,
+                u32 ivalue)
+{
+        struct nfs4_slot *old = NULL;
+        u32 i;
+        spin_lock(&tbl->slot_tbl_lock);
+        if (new) {
+                old = tbl->slots;
+                tbl->slots = new;
+                tbl->max_slots = max_slots;
+        }
+        tbl->highest_used_slotid = -1;  /* no slot is currently used */
+        for (i = 0; i < tbl->max_slots; i++)
+                tbl->slots[i].seq_nr = ivalue;
+        spin_unlock(&tbl->slot_tbl_lock);
+        kfree(old);
+}
 /*
- * Reset a slot table
+ * (re)Initialise a slot table
 */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+static int nfs4_realloc_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
-                                 int ivalue)
+                                 u32 ivalue)
 {
        struct nfs4_slot *new = NULL;
-        int i;
+        int ret = -ENOMEM;
-        int ret = 0;
        dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
                max_reqs, tbl->max_slots);
        /* Does the newly negotiated max_reqs match the existing slot table? */
        if (max_reqs != tbl->max_slots) {
-                ret = -ENOMEM;
+                new = nfs4_alloc_slots(max_reqs, GFP_NOFS);
-                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
-                              GFP_NOFS);
                if (!new)
                        goto out;
-                ret = 0;
-                kfree(tbl->slots);
        }
-        spin_lock(&tbl->slot_tbl_lock);
+        ret = 0;
-        if (new) {
-                tbl->slots = new;
+        nfs4_add_and_init_slots(tbl, new, max_reqs, ivalue);
-                tbl->max_slots = max_reqs;
-        }
-        for (i = 0; i < tbl->max_slots; ++i)
-                tbl->slots[i].seq_nr = ivalue;
-        spin_unlock(&tbl->slot_tbl_lock);
        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
                tbl, tbl->slots, tbl->max_slots);
 out:
@@ -5061,36 +5080,6 @@ static void nfs4_destroy_slot_tables(struct nfs4_session *session)
 }
 /*
- * Initialize slot table
- */
-static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
-                int max_slots, int ivalue)
-{
-        struct nfs4_slot *slot;
-        int ret = -ENOMEM;
-        BUG_ON(max_slots > NFS4_MAX_SLOT_TABLE);
-        dprintk("--> %s: max_reqs=%u\n", __func__, max_slots);
-        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_NOFS);
-        if (!slot)
-                goto out;
-        ret = 0;
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->max_slots = max_slots;
-        tbl->slots = slot;
-        tbl->highest_used_slotid = -1;  /* no slot is currently used */
-        spin_unlock(&tbl->slot_tbl_lock);
-        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
-                tbl, tbl->slots, tbl->max_slots);
-out:
-        dprintk("<-- %s: return %d\n", __func__, ret);
-        return ret;
-}
-/*
 * Initialize or reset the forechannel and backchannel tables
 */
 static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
@@ -5101,25 +5090,16 @@ static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
        dprintk("--> %s\n", __func__);
        /* Fore channel */
        tbl = &ses->fc_slot_table;
-        if (tbl->slots == NULL) {
+        status = nfs4_realloc_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                status = nfs4_init_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
+        if (status) /* -ENOMEM */
-                if (status) /* -ENOMEM */
+                return status;
-                        return status;
-        } else {
-                status = nfs4_reset_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status)
-                        return status;
-        }
        /* Back channel */
        tbl = &ses->bc_slot_table;
-        if (tbl->slots == NULL) {
+        status = nfs4_realloc_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
-                status = nfs4_init_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        if (status && tbl->slots == NULL)
-                if (status)
+                /* Fore and back channel share a connection so get
-                        /* Fore and back channel share a connection so get
+                 * both slot tables or neither */
-                         * both slot tables or neither */
+                nfs4_destroy_slot_tables(ses);
-                        nfs4_destroy_slot_tables(ses);
-        } else
-                status = nfs4_reset_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
        return status;
 }
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a53f33b4ac3a..45392032e7bd 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1132,6 +1132,8 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
 {
        struct nfs_client *clp = server->nfs_client;
+        if (test_and_clear_bit(NFS_DELEGATED_STATE, &state->flags))
+                nfs_async_inode_return_delegation(state->inode, &state->stateid);
        nfs4_state_mark_reclaim_nograce(clp, state);
        nfs4_schedule_state_manager(clp);
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 95e92e438407..33bd8d0f745d 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
        xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                args->acl_pages, args->acl_pgbase, args->acl_len);
-        xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
        encode_nops(&hdr);
 }
@@ -6032,6 +6031,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
        struct compound_hdr hdr;
        int status;
+        if (res->acl_scratch != NULL) {
+                void *p = page_address(res->acl_scratch);
+                xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
+        }
        status = decode_compound_hdr(xdr, &hdr);
        if (status)
                goto out;
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index be244692550d..a9856e3eaaf0 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1053,7 +1053,7 @@ static int ocfs2_rename(struct inode *old_dir,
        handle_t *handle = NULL;
        struct buffer_head *old_dir_bh = NULL;
        struct buffer_head *new_dir_bh = NULL;
-        nlink_t old_dir_nlink = old_dir->i_nlink;
+        u32 old_dir_nlink = old_dir->i_nlink;
        struct ocfs2_dinode *old_di;
        struct ocfs2_dir_lookup_result old_inode_dot_dot_res = { NULL, };
        struct ocfs2_dir_lookup_result target_lookup_res = { NULL, };
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 7898cd688a00..fc2c4388d126 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -292,11 +292,26 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
        }
 }
+/* Return 1 if 'cmd' will block on frozen filesystem */
+static int quotactl_cmd_write(int cmd)
+{
+        switch (cmd) {
+        case Q_GETFMT:
+        case Q_GETINFO:
+        case Q_SYNC:
+        case Q_XGETQSTAT:
+        case Q_XGETQUOTA:
+        case Q_XQUOTASYNC:
+                return 0;
+        }
+        return 1;
+}
 /*
 * look up a superblock on which quota ops will be performed
 * - use the name of a block device to find the superblock thereon
 */
-static struct super_block *quotactl_block(const char __user *special)
+static struct super_block *quotactl_block(const char __user *special, int cmd)
 {
 #ifdef CONFIG_BLOCK
        struct block_device *bdev;
@@ -309,7 +324,10 @@ static struct super_block *quotactl_block(const char __user *special)
        putname(tmp);
        if (IS_ERR(bdev))
                return ERR_CAST(bdev);
-        sb = get_super(bdev);
+        if (quotactl_cmd_write(cmd))
+                sb = get_super_thawed(bdev);
+        else
+                sb = get_super(bdev);
        bdput(bdev);
        if (!sb)
                return ERR_PTR(-ENODEV);
@@ -361,7 +379,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
                        pathp = &path;
        }
-        sb = quotactl_block(special);
+        sb = quotactl_block(special, cmds);
        if (IS_ERR(sb)) {
                ret = PTR_ERR(sb);
                goto out;
diff --git a/fs/select.c b/fs/select.c
index d33418fdc858..e782258d0de3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -912,7 +912,7 @@ static long do_restart_poll(struct restart_block *restart_block)
 }
 SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
-                long, timeout_msecs)
+                int, timeout_msecs)
 {
        struct timespec end_time, *to = NULL;
        int ret;
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 492465b451dd..7ae2a574cb25 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -30,6 +30,21 @@
 #include <linux/signalfd.h>
 #include <linux/syscalls.h>
+void signalfd_cleanup(struct sighand_struct *sighand)
+{
+        wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+        /*
+         * The lockless check can race with remove_wait_queue() in progress,
+         * but in this case its caller should run under rcu_read_lock() and
+         * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
+         */
+        if (likely(!waitqueue_active(wqh)))
+                return;
+        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        wake_up_poll(wqh, POLLHUP | POLLFREE);
+}
 struct signalfd_ctx {
        sigset_t sigmask;
 };
diff --git a/fs/super.c b/fs/super.c
index 6015c02296b7..6277ec6cb60a 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -634,6 +634,28 @@ rescan:
 EXPORT_SYMBOL(get_super);
 /**
+ *      get_super_thawed - get thawed superblock of a device
+ *      @bdev: device to get the superblock for
+ *
+ *      Scans the superblock list and finds the superblock of the file system
+ *      mounted on the device. The superblock is returned once it is thawed
+ *      (or immediately if it was not frozen). %NULL is returned if no match
+ *      is found.
+ */
+struct super_block *get_super_thawed(struct block_device *bdev)
+{
+        while (1) {
+                struct super_block *s = get_super(bdev);
+                if (!s || s->s_frozen == SB_UNFROZEN)
+                        return s;
+                up_read(&s->s_umount);
+                vfs_check_frozen(s, SB_FREEZE_WRITE);
+                put_super(s);
+        }
+}
+EXPORT_SYMBOL(get_super_thawed);
+/**
 * get_active_super - get an active reference to the superblock of a device
 * @bdev: device to get the superblock for
 *
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index cbcb7bea38e2..53db20ee3e77 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -139,10 +139,10 @@ xfs_qm_adjust_dqtimers(
        if (!d->d_btimer) {
                if ((d->d_blk_softlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                      be64_to_cpu(d->d_blk_softlimit))) ||
                    (d->d_blk_hardlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                      be64_to_cpu(d->d_blk_hardlimit)))) {
                        d->d_btimer = cpu_to_be32(get_seconds() +
                                        mp->m_quotainfo->qi_btimelimit);
@@ -151,10 +151,10 @@ xfs_qm_adjust_dqtimers(
                }
        } else {
                if ((!d->d_blk_softlimit ||
-                     (be64_to_cpu(d->d_bcount) <
+                     (be64_to_cpu(d->d_bcount) <=
                      be64_to_cpu(d->d_blk_softlimit))) &&
                    (!d->d_blk_hardlimit ||
-                    (be64_to_cpu(d->d_bcount) <
+                    (be64_to_cpu(d->d_bcount) <=
                     be64_to_cpu(d->d_blk_hardlimit)))) {
                        d->d_btimer = 0;
                }
@@ -162,10 +162,10 @@ xfs_qm_adjust_dqtimers(
        if (!d->d_itimer) {
                if ((d->d_ino_softlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                      be64_to_cpu(d->d_ino_softlimit))) ||
                    (d->d_ino_hardlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                      be64_to_cpu(d->d_ino_hardlimit)))) {
                        d->d_itimer = cpu_to_be32(get_seconds() +
                                        mp->m_quotainfo->qi_itimelimit);
@@ -174,10 +174,10 @@ xfs_qm_adjust_dqtimers(
                }
        } else {
                if ((!d->d_ino_softlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                      be64_to_cpu(d->d_ino_softlimit)))  &&
                    (!d->d_ino_hardlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                      be64_to_cpu(d->d_ino_hardlimit)))) {
                        d->d_itimer = 0;
                }
@@ -185,10 +185,10 @@ xfs_qm_adjust_dqtimers(
        if (!d->d_rtbtimer) {
                if ((d->d_rtb_softlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                      be64_to_cpu(d->d_rtb_softlimit))) ||
                    (d->d_rtb_hardlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                      be64_to_cpu(d->d_rtb_hardlimit)))) {
                        d->d_rtbtimer = cpu_to_be32(get_seconds() +
                                        mp->m_quotainfo->qi_rtbtimelimit);
@@ -197,10 +197,10 @@ xfs_qm_adjust_dqtimers(
                }
        } else {
                if ((!d->d_rtb_softlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                      be64_to_cpu(d->d_rtb_softlimit))) &&
                    (!d->d_rtb_hardlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                      be64_to_cpu(d->d_rtb_hardlimit)))) {
                        d->d_rtbtimer = 0;
                }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 15ff5392fb65..0ed9ee77937c 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1981,7 +1981,7 @@ xfs_qm_dqcheck(
        if (!errs && ddq->d_id) {
                if (ddq->d_blk_softlimit &&
-                    be64_to_cpu(ddq->d_bcount) >=
+                    be64_to_cpu(ddq->d_bcount) >
                                be64_to_cpu(ddq->d_blk_softlimit)) {
                        if (!ddq->d_btimer) {
                                if (flags & XFS_QMOPT_DOWARN)
@@ -1992,7 +1992,7 @@ xfs_qm_dqcheck(
                        }
                }
                if (ddq->d_ino_softlimit &&
-                    be64_to_cpu(ddq->d_icount) >=
+                    be64_to_cpu(ddq->d_icount) >
                                be64_to_cpu(ddq->d_ino_softlimit)) {
                        if (!ddq->d_itimer) {
                                if (flags & XFS_QMOPT_DOWARN)
@@ -2003,7 +2003,7 @@ xfs_qm_dqcheck(
                        }
                }
                if (ddq->d_rtb_softlimit &&
-                    be64_to_cpu(ddq->d_rtbcount) >=
+                    be64_to_cpu(ddq->d_rtbcount) >
                                be64_to_cpu(ddq->d_rtb_softlimit)) {
                        if (!ddq->d_rtbtimer) {
                                if (flags & XFS_QMOPT_DOWARN)
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index eafbcff81f3a..711a86e39ff0 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -813,11 +813,11 @@ xfs_qm_export_dquot(
             (XFS_IS_OQUOTA_ENFORCED(mp) &&
                        (dst->d_flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)))) &&
            dst->d_id != 0) {
-                if (((int) dst->d_bcount >= (int) dst->d_blk_softlimit) &&
+                if (((int) dst->d_bcount > (int) dst->d_blk_softlimit) &&
                    (dst->d_blk_softlimit > 0)) {
                        ASSERT(dst->d_btimer != 0);
                }
-                if (((int) dst->d_icount >= (int) dst->d_ino_softlimit) &&
+                if (((int) dst->d_icount > (int) dst->d_ino_softlimit) &&
                    (dst->d_ino_softlimit > 0)) {
                        ASSERT(dst->d_itimer != 0);
                }
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 329b06aba1c2..7adcdf15ae0c 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1151,8 +1151,8 @@ xfs_trans_add_item(
 {
        struct xfs_log_item_desc *lidp;
-        ASSERT(lip->li_mountp = tp->t_mountp);
+        ASSERT(lip->li_mountp == tp->t_mountp);
-        ASSERT(lip->li_ailp = tp->t_mountp->m_ail);
+        ASSERT(lip->li_ailp == tp->t_mountp->m_ail);
        lidp = kmem_zone_zalloc(xfs_log_item_desc_zone, KM_SLEEP | KM_NOFS);
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 4d00ee67792d..c4ba366d24e6 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -649,12 +649,12 @@ xfs_trans_dqresv(
                         * nblks.
                         */
                        if (hardlimit > 0ULL &&
-                            hardlimit <= nblks + *resbcountp) {
+                            hardlimit < nblks + *resbcountp) {
                                xfs_quota_warn(mp, dqp, QUOTA_NL_BHARDWARN);
                                goto error_return;
                        }
                        if (softlimit > 0ULL &&
-                            softlimit <= nblks + *resbcountp) {
+                            softlimit < nblks + *resbcountp) {
                                if ((timer != 0 && get_seconds() > timer) ||
                                    (warns != 0 && warns >= warnlimit)) {
                                        xfs_quota_warn(mp, dqp,
@@ -677,11 +677,13 @@ xfs_trans_dqresv(
                        if (!softlimit)
                                softlimit = q->qi_isoftlimit;
-                        if (hardlimit > 0ULL && count >= hardlimit) {
+                        if (hardlimit > 0ULL &&
+                            hardlimit < ninos + count) {
                                xfs_quota_warn(mp, dqp, QUOTA_NL_IHARDWARN);
                                goto error_return;
                        }
-                        if (softlimit > 0ULL && count >= softlimit) {
+                        if (softlimit > 0ULL &&
+                            softlimit < ninos + count) {
                                if  ((timer != 0 && get_seconds() > timer) ||
                                     (warns != 0 && warns >= warnlimit)) {
                                        xfs_quota_warn(mp, dqp,
diff --git a/include/asm-generic/io-64-nonatomic-hi-lo.h b/include/asm-generic/io-64-nonatomic-hi-lo.h
new file mode 100644
index 000000000000..a6806a94250d
--- /dev/null
+++ b/include/asm-generic/io-64-nonatomic-hi-lo.h
@@ -0,0 +1,28 @@
+#ifndef _ASM_IO_64_NONATOMIC_HI_LO_H_
+#define _ASM_IO_64_NONATOMIC_HI_LO_H_
+#include <linux/io.h>
+#include <asm-generic/int-ll64.h>
+#ifndef readq
+static inline __u64 readq(const volatile void __iomem *addr)
+{
+        const volatile u32 __iomem *p = addr;
+        u32 low, high;
+        high = readl(p + 1);
+        low = readl(p);
+        return low + ((u64)high << 32);
+}
+#endif
+#ifndef writeq
+static inline void writeq(__u64 val, volatile void __iomem *addr)
+{
+        writel(val >> 32, addr + 4);
+        writel(val, addr);
+}
+#endif
+#endif  /* _ASM_IO_64_NONATOMIC_HI_LO_H_ */
diff --git a/include/asm-generic/io-64-nonatomic-lo-hi.h b/include/asm-generic/io-64-nonatomic-lo-hi.h
new file mode 100644
index 000000000000..ca546b1ff8b5
--- /dev/null
+++ b/include/asm-generic/io-64-nonatomic-lo-hi.h
@@ -0,0 +1,28 @@
+#ifndef _ASM_IO_64_NONATOMIC_LO_HI_H_
+#define _ASM_IO_64_NONATOMIC_LO_HI_H_
+#include <linux/io.h>
+#include <asm-generic/int-ll64.h>
+#ifndef readq
+static inline __u64 readq(const volatile void __iomem *addr)
+{
+        const volatile u32 __iomem *p = addr;
+        u32 low, high;
+        low = readl(p);
+        high = readl(p + 1);
+        return low + ((u64)high << 32);
+}
+#endif
+#ifndef writeq
+static inline void writeq(__u64 val, volatile void __iomem *addr)
+{
+        writel(val, addr);
+        writel(val >> 32, addr + 4);
+}
+#endif
+#endif  /* _ASM_IO_64_NONATOMIC_LO_HI_H_ */
diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
index 44bce836d350..9ce7f44aebd2 100644
--- a/include/asm-generic/poll.h
+++ b/include/asm-generic/poll.h
@@ -28,6 +28,8 @@
 #define POLLRDHUP       0x2000
 #endif
+#define POLLFREE        0x4000  /* currently only for epoll */
 struct pollfd {
        int fd;
        short events;
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f6515f46..7e05fcee75a1 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -561,5 +561,9 @@ asmlinkage ssize_t compat_sys_process_vm_writev(compat_pid_t pid,
                unsigned long liovcnt, const struct compat_iovec __user *rvec,
                unsigned long riovcnt, unsigned long flags);
+#else
+#define is_compat_task() (0)
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/digsig.h b/include/linux/digsig.h
index b01558b15814..6f85a070bb45 100644
--- a/include/linux/digsig.h
+++ b/include/linux/digsig.h
@@ -30,7 +30,7 @@ enum digest_algo {
 struct pubkey_hdr {
        uint8_t         version;        /* key format version */
-        time_t          timestamp;      /* key made, always 0 for now */
+        uint32_t        timestamp;      /* key made, always 0 for now */
        uint8_t         algo;
        uint8_t         nmpi;
        char            mpi[0];
@@ -38,7 +38,7 @@ struct pubkey_hdr {
 struct signature_hdr {
        uint8_t         version;        /* signature format version */
-        time_t          timestamp;      /* signature made */
+        uint32_t        timestamp;      /* signature made */
        uint8_t         algo;
        uint8_t         hash;
        uint8_t         keyid[8];
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 386da09f229d..69cd5bb640f5 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2496,6 +2496,7 @@ extern void get_filesystem(struct file_system_type *fs);
 extern void put_filesystem(struct file_system_type *fs);
 extern struct file_system_type *get_fs_type(const char *name);
 extern struct super_block *get_super(struct block_device *);
+extern struct super_block *get_super_thawed(struct block_device *);
 extern struct super_block *get_active_super(struct block_device *bdev);
 extern void drop_super(struct super_block *sb);
 extern void iterate_supers(void (*)(struct super_block *, void *), void *);
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c52d4b5f872a..4b24ff453aee 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -137,6 +137,7 @@ enum {
        IFLA_AF_SPEC,
        IFLA_GROUP,             /* Group the device belongs to */
        IFLA_NET_NS_FD,
+        IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
        __IFLA_MAX
 };
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 8797ed16feb2..4dd5bd6994a8 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -285,8 +285,8 @@ struct ebt_table {
        struct module *me;
 };
-#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
+#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
-                     ~(__alignof__(struct ebt_replace)-1))
+                     ~(__alignof__(struct _xt_align)-1))
 extern struct ebt_table *ebt_register_table(struct net *net,
                                            const struct ebt_table *table);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index a764cef06b73..d6ba9a12591e 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -614,7 +614,6 @@ struct nfs_getaclargs {
        size_t                          acl_len;
        unsigned int                    acl_pgbase;
        struct page **                  acl_pages;
-        struct page *                   acl_scratch;
        struct nfs4_sequence_args       seq_args;
 };
@@ -624,6 +623,7 @@ struct nfs_getaclres {
        size_t                          acl_len;
        size_t                          acl_data_offset;
        int                             acl_flags;
+        struct page *                   acl_scratch;
        struct nfs4_sequence_res        seq_res;
 };
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 8e872ead88b5..577592ea0ea0 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -602,6 +602,9 @@ struct tcamsg {
 #define TCA_ACT_TAB 1 /* attr type must be >=1 */       
 #define TCAA_MAX 1
+/* New extended info filters for IFLA_EXT_MASK */
+#define RTEXT_FILTER_VF         (1 << 0)
 /* End of information exported to user level */
 #ifdef __KERNEL__
diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
index 3ff4961da9b5..247399b2979a 100644
--- a/include/linux/signalfd.h
+++ b/include/linux/signalfd.h
@@ -61,13 +61,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
                wake_up(&tsk->sighand->signalfd_wqh);
 }
+extern void signalfd_cleanup(struct sighand_struct *sighand);
 #else /* CONFIG_SIGNALFD */
 static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
+static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
 #endif /* CONFIG_SIGNALFD */
 #endif /* __KERNEL__ */
 #endif /* _LINUX_SIGNALFD_H */
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 06a4c0fd7bef..79ef8209bbb7 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1486,6 +1486,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
+{
+        if (skb_mac_header_was_set(skb)) {
+                const unsigned char *old_mac = skb_mac_header(skb);
+                skb_set_mac_header(skb, -skb->mac_len);
+                memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        }
+}
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
        return skb->csum_start - skb_headroom(skb);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 515669fa3c1d..8ec1153ff57b 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -624,7 +624,7 @@ asmlinkage long sys_socketpair(int, int, int, int __user *);
 asmlinkage long sys_socketcall(int call, unsigned long __user *args);
 asmlinkage long sys_listen(int, int);
 asmlinkage long sys_poll(struct pollfd __user *ufds, unsigned int nfds,
-                                long timeout);
+                                int timeout);
 asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
                        fd_set __user *exp, struct timeval __user *tvp);
 asmlinkage long sys_old_select(struct sel_arg_struct __user *arg);
diff --git a/include/linux/usb/ch11.h b/include/linux/usb/ch11.h
index 31fdb4c6ee3d..0b83acd3360a 100644
--- a/include/linux/usb/ch11.h
+++ b/include/linux/usb/ch11.h
@@ -61,12 +61,6 @@
 #define USB_PORT_FEAT_TEST              21
 #define USB_PORT_FEAT_INDICATOR         22
 #define USB_PORT_FEAT_C_PORT_L1         23
-#define USB_PORT_FEAT_C_PORT_LINK_STATE 25
-#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26
-#define USB_PORT_FEAT_PORT_REMOTE_WAKE_MASK 27
-#define USB_PORT_FEAT_BH_PORT_RESET     28
-#define USB_PORT_FEAT_C_BH_PORT_RESET   29
-#define USB_PORT_FEAT_FORCE_LINKPM_ACCEPT 30
 /*
 * Port feature selectors added by USB 3.0 spec.
@@ -75,8 +69,8 @@
 #define USB_PORT_FEAT_LINK_STATE                5
 #define USB_PORT_FEAT_U1_TIMEOUT                23
 #define USB_PORT_FEAT_U2_TIMEOUT                24
-#define USB_PORT_FEAT_C_LINK_STATE              25
+#define USB_PORT_FEAT_C_PORT_LINK_STATE         25
-#define USB_PORT_FEAT_C_CONFIG_ERR              26
+#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR       26
 #define USB_PORT_FEAT_REMOTE_WAKE_MASK          27
 #define USB_PORT_FEAT_BH_PORT_RESET             28
 #define USB_PORT_FEAT_C_BH_PORT_RESET           29
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 8a2b0ae7dbd2..ab86036bbf0c 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -209,7 +209,7 @@ extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
                    const struct nf_conntrack_tuple *tuple);
-extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_insert_dying_list(struct nf_conn *ct);
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 678f1ffaf843..370293901971 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,7 +6,7 @@
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
-typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 extern int      __rtnl_register(int protocol, int msgtype,
                                rtnl_doit_func, rtnl_dumpit_func,
diff --git a/kernel/fork.c b/kernel/fork.c
index b77fd559c78e..e2cd3e2a5ae8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -66,6 +66,7 @@
 #include <linux/user-return-notifier.h>
 #include <linux/oom.h>
 #include <linux/khugepaged.h>
+#include <linux/signalfd.h>
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -935,8 +936,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
 void __cleanup_sighand(struct sighand_struct *sighand)
 {
-        if (atomic_dec_and_test(&sighand->count))
+        if (atomic_dec_and_test(&sighand->count)) {
+                signalfd_cleanup(sighand);
                kmem_cache_free(sighand_cachep, sighand);
+        }
 }
diff --git a/kernel/pid.c b/kernel/pid.c
index ce8e00deaccb..9f08dfabaf13 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -543,12 +543,12 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
 */
 void __init pidhash_init(void)
 {
-        int i, pidhash_size;
+        unsigned int i, pidhash_size;
        pid_hash = alloc_large_system_hash("PID", sizeof(*pid_hash), 0, 18,
                                           HASH_EARLY | HASH_SMALL,
                                           &pidhash_shift, NULL, 4096);
-        pidhash_size = 1 << pidhash_shift;
+        pidhash_size = 1U << pidhash_shift;
        for (i = 0; i < pidhash_size; i++)
                INIT_HLIST_HEAD(&pid_hash[i]);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6728a7ae6f2d..228d6461c12a 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4414,6 +4414,9 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
         */
        BUG_ON(!thresholds);
+        if (!thresholds->primary)
+                goto unlock;
        usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
        /* Check if a threshold crossed before removing */
@@ -4462,7 +4465,7 @@ swap_buffers:
        /* To be sure that nobody uses thresholds */
        synchronize_rcu();
+unlock:
        mutex_unlock(&memcg->thresholds_lock);
 }
diff --git a/mm/nommu.c b/mm/nommu.c
index b982290fd962..f59e170fceb4 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
        if (vma->vm_file) {
                mapping = vma->vm_file->f_mapping;
+                mutex_lock(&mapping->i_mmap_mutex);
                flush_dcache_mmap_lock(mapping);
                vma_prio_tree_insert(vma, &mapping->i_mmap);
                flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
        }
        /* add the VMA to the tree */
@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
        if (vma->vm_file) {
                mapping = vma->vm_file->f_mapping;
+                mutex_lock(&mapping->i_mmap_mutex);
                flush_dcache_mmap_lock(mapping);
                vma_prio_tree_remove(vma, &mapping->i_mmap);
                flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
        }
        /* remove from the MM's tree and list */
@@ -775,8 +779,6 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
        if (vma->vm_next)
                vma->vm_next->vm_prev = vma->vm_prev;
-        vma->vm_mm = NULL;
 }
 /*
@@ -2052,6 +2054,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
        high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
        down_write(&nommu_region_sem);
+        mutex_lock(&inode->i_mapping->i_mmap_mutex);
        /* search for VMAs that fall within the dead zone */
        vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
@@ -2059,6 +2062,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                /* found one - only interested if it's shared out of the page
                 * cache */
                if (vma->vm_flags & VM_SHARED) {
+                        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
                        up_write(&nommu_region_sem);
                        return -ETXTBSY; /* not quite true, but near enough */
                }
@@ -2086,6 +2090,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                }
        }
+        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
        up_write(&nommu_region_sem);
        return 0;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d2186ecb36f7..a13ded1938f0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5236,6 +5236,7 @@ void *__init alloc_large_system_hash(const char *tablename,
                max = ((unsigned long long)nr_all_pages << PAGE_SHIFT) >> 4;
                do_div(max, bucketsize);
        }
+        max = min(max, 0x80000000ULL);
        if (numentries > max)
                numentries = max;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index ef95a30306fa..5de42ea309bc 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -46,8 +46,8 @@
 static struct net_device *clip_devs;
 static struct atm_vcc *atmarpd;
-static struct neigh_table clip_tbl;
 static struct timer_list idle_timer;
+static const struct neigh_ops clip_neigh_ops;
 static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 {
@@ -123,6 +123,8 @@ static int neigh_check_cb(struct neighbour *n)
        struct atmarp_entry *entry = neighbour_priv(n);
        struct clip_vcc *cv;
+        if (n->ops != &clip_neigh_ops)
+                return 0;
        for (cv = entry->vccs; cv; cv = cv->next) {
                unsigned long exp = cv->last_use + cv->idle_timeout;
@@ -154,10 +156,10 @@ static int neigh_check_cb(struct neighbour *n)
 static void idle_timer_check(unsigned long dummy)
 {
-        write_lock(&clip_tbl.lock);
+        write_lock(&arp_tbl.lock);
-        __neigh_for_each_release(&clip_tbl, neigh_check_cb);
+        __neigh_for_each_release(&arp_tbl, neigh_check_cb);
        mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
-        write_unlock(&clip_tbl.lock);
+        write_unlock(&arp_tbl.lock);
 }
 static int clip_arp_rcv(struct sk_buff *skb)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f98ec444133a..0a68045782d1 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -826,6 +826,8 @@ next_elt:
                write_unlock_bh(&tbl->lock);
                cond_resched();
                write_lock_bh(&tbl->lock);
+                nht = rcu_dereference_protected(tbl->nht,
+                                                lockdep_is_held(&tbl->lock));
        }
        /* Cycle through all hash buckets every base_reachable_time/2 ticks.
         * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7aef62e53113..5cf39cd7da85 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -60,7 +60,6 @@ struct rtnl_link {
 };
 static DEFINE_MUTEX(rtnl_mutex);
-static u16 min_ifinfo_dump_size;
 void rtnl_lock(void)
 {
@@ -724,10 +723,11 @@ static void copy_rtnl_link_stats64(void *v, const struct rtnl_link_stats64 *b)
 }
 /* All VF info */
-static inline int rtnl_vfinfo_size(const struct net_device *dev)
+static inline int rtnl_vfinfo_size(const struct net_device *dev,
+                                   u32 ext_filter_mask)
 {
-        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent) &&
+            (ext_filter_mask & RTEXT_FILTER_VF)) {
                int num_vfs = dev_num_vf(dev->dev.parent);
                size_t size = nla_total_size(sizeof(struct nlattr));
                size += nla_total_size(num_vfs * sizeof(struct nlattr));
@@ -766,7 +766,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
                return port_self_size;
 }
-static noinline size_t if_nlmsg_size(const struct net_device *dev)
+static noinline size_t if_nlmsg_size(const struct net_device *dev,
+                                     u32 ext_filter_mask)
 {
        return NLMSG_ALIGN(sizeof(struct ifinfomsg))
               + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
@@ -784,8 +785,9 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev)
               + nla_total_size(4) /* IFLA_MASTER */
               + nla_total_size(1) /* IFLA_OPERSTATE */
               + nla_total_size(1) /* IFLA_LINKMODE */
-               + nla_total_size(4) /* IFLA_NUM_VF */
+               + nla_total_size(ext_filter_mask
-               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
+                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
               + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
               + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
               + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
@@ -868,7 +870,7 @@ static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                            int type, u32 pid, u32 seq, u32 change,
-                            unsigned int flags)
+                            unsigned int flags, u32 ext_filter_mask)
 {
        struct ifinfomsg *ifm;
        struct nlmsghdr *nlh;
@@ -941,10 +943,11 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                goto nla_put_failure;
        copy_rtnl_link_stats64(nla_data(attr), stats);
-        if (dev->dev.parent)
+        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF))
                NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
+            && (ext_filter_mask & RTEXT_FILTER_VF)) {
                int i;
                struct nlattr *vfinfo, *vf;
@@ -1048,6 +1051,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        struct net_device *dev;
        struct hlist_head *head;
        struct hlist_node *node;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
        s_h = cb->args[0];
        s_idx = cb->args[1];
@@ -1055,6 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        cb->seq = net->dev_base_seq;
+        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                    ifla_policy);
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                idx = 0;
                head = &net->dev_index_head[h];
@@ -1064,7 +1075,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                        if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
                                             NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI) <= 0)
+                                             NLM_F_MULTI,
+                                             ext_filter_mask) <= 0)
                                goto out;
                        nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -1100,6 +1112,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
        [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
        [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
        [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
+        [IFLA_EXT_MASK]         = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL(ifla_policy);
@@ -1509,8 +1522,6 @@ errout:
        if (send_addr_notify)
                call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
-                                     min_ifinfo_dump_size);
        return err;
 }
@@ -1842,6 +1853,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        struct net_device *dev = NULL;
        struct sk_buff *nskb;
        int err;
+        u32 ext_filter_mask = 0;
        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
        if (err < 0)
@@ -1850,6 +1862,9 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        if (tb[IFLA_IFNAME])
                nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
        ifm = nlmsg_data(nlh);
        if (ifm->ifi_index > 0)
                dev = __dev_get_by_index(net, ifm->ifi_index);
@@ -1861,12 +1876,12 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        if (dev == NULL)
                return -ENODEV;
-        nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
+        nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL);
        if (nskb == NULL)
                return -ENOBUFS;
        err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
-                               nlh->nlmsg_seq, 0, 0);
+                               nlh->nlmsg_seq, 0, 0, ext_filter_mask);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size */
                WARN_ON(err == -EMSGSIZE);
@@ -1877,8 +1892,31 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        return err;
 }
-static u16 rtnl_calcit(struct sk_buff *skb)
+static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
+        u16 min_ifinfo_dump_size = 0;
+        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        if (!ext_filter_mask)
+                return NLMSG_GOODSIZE;
+        /*
+         * traverse the list of net devices and compute the minimum
+         * buffer size based upon the filter mask.
+         */
+        list_for_each_entry(dev, &net->dev_base_head, dev_list) {
+                min_ifinfo_dump_size = max_t(u16, min_ifinfo_dump_size,
+                                             if_nlmsg_size(dev,
+                                                           ext_filter_mask));
+        }
        return min_ifinfo_dump_size;
 }
@@ -1913,13 +1951,11 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
        int err = -ENOBUFS;
        size_t if_info_size;
-        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev)), GFP_KERNEL);
+        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), GFP_KERNEL);
        if (skb == NULL)
                goto errout;
-        min_ifinfo_dump_size = max_t(u16, if_info_size, min_ifinfo_dump_size);
+        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0, 0);
-        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0);
        if (err < 0) {
                /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                WARN_ON(err == -EMSGSIZE);
@@ -1977,7 +2013,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                        return -EOPNOTSUPP;
                calcit = rtnl_get_calcit(family, type);
                if (calcit)
-                        min_dump_alloc = calcit(skb);
+                        min_dump_alloc = calcit(skb, nlh);
                __rtnl_unlock();
                rtnl = net->rtnl;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b59414a0c1ee..6ef66af12291 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -65,7 +65,7 @@
   it is infeasible task. The most general solutions would be
   to keep skb->encapsulation counter (sort of local ttl),
   and silently drop packet when it expires. It is a good
-   solution, but it supposes maintaing new variable in ALL
+   solution, but it supposes maintaining new variable in ALL
   skb, even if no tunneling is used.
   Current solution: xmit_recursion breaks dead loops. This is a percpu
@@ -91,14 +91,14 @@
   One of them is to parse packet trying to detect inner encapsulation
   made by our node. It is difficult or even impossible, especially,
-   taking into account fragmentation. TO be short, tt is not solution at all.
+   taking into account fragmentation. TO be short, ttl is not solution at all.
   Current solution: The solution was UNEXPECTEDLY SIMPLE.
   We force DF flag on tunnels with preconfigured hop limit,
   that is ALL. :-) Well, it does not remove the problem completely,
   but exponential growth of network traffic is changed to linear
   (branches, that exceed pmtu are pruned) and tunnel mtu
-   fastly degrades to value <68, where looping stops.
+   rapidly degrades to value <68, where looping stops.
   Yes, it is not good if there exists a router in the loop,
   which does not force DF, even when encapsulating packets have DF set.
   But it is not our problem! Nobody could accuse us, we made
@@ -457,8 +457,8 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
   GRE tunnels with enabled checksum. Tell them "thank you".
   Well, I wonder, rfc1812 was written by Cisco employee,
-   what the hell these idiots break standrads established
+   what the hell these idiots break standards established
-   by themself???
+   by themselves???
 */
        const struct iphdr *iph = (const struct iphdr *)skb->data;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index cfc82cf339f6..4398a45a9600 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -631,6 +631,7 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        pr_debug("ping_recvmsg(sk=%p,sk->num=%u)\n", isk, isk->inet_num);
+        err = -EOPNOTSUPP;
        if (flags & MSG_OOB)
                goto out;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 37755ccc0e96..22ef5f9fd2ff 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3240,7 +3240,8 @@ void __init tcp_init(void)
 {
        struct sk_buff *skb = NULL;
        unsigned long limit;
-        int i, max_share, cnt;
+        int max_share, cnt;
+        unsigned int i;
        unsigned long jiffy = jiffies;
        BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3283,7 +3284,7 @@ void __init tcp_init(void)
                                        &tcp_hashinfo.bhash_size,
                                        NULL,
                                        64 * 1024);
-        tcp_hashinfo.bhash_size = 1 << tcp_hashinfo.bhash_size;
+        tcp_hashinfo.bhash_size = 1U << tcp_hashinfo.bhash_size;
        for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
                spin_lock_init(&tcp_hashinfo.bhash[i].lock);
                INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 63418185f524..e3db3f915114 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
        skb_push(skb, sizeof(*iph));
        skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
-        memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-                skb->mac_len);
-        skb_set_mac_header(skb, -skb->mac_len);
        xfrm4_beet_make_header(skb);
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e114ac..ed4bf11ef9f4 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        const unsigned char *old_mac;
        int err = -EINVAL;
        if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!(x->props.flags & XFRM_STATE_NOECN))
                ipip_ecn_decapsulate(skb);
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
        skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
        err = 0;
 out:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c7e95c8c579f..5aa3981a3922 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1926,8 +1926,10 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
        };
        dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst)
+        if (dst->error) {
+                dst_release(dst);
                goto out_free;
+        }
        skb_dst_drop(skb);
        skb_dst_set(skb, dst);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 8d817018c188..3dcdb81ec3e8 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1550,9 +1550,10 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
                         &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
        dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                return;
+        }
        dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
        if (IS_ERR(dst))
                return;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index a81ce9450750..9949a356d62c 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
        int size = sizeof(struct ipv6hdr);
        int err;
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
        __skb_push(skb, size);
        skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
        xfrm6_beet_make_header(skb);
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 261e6e6f487e..9f2095b19ad0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        int err = -EINVAL;
-        const unsigned char *old_mac;
        if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!(x->props.flags & XFRM_STATE_NOECN))
                ipip6_ecn_decapsulate(skb);
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
        skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
        err = 0;
 out:
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 611c3359b94d..2555816e7788 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
        __be16 dport = 0;               /* destination port to forward */
        unsigned int flags;
        struct ip_vs_conn_param param;
+        const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
        union nf_inet_addr snet;        /* source network of the client,
                                           after masking */
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
        {
                int protocol = iph.protocol;
                const union nf_inet_addr *vaddr = &iph.daddr;
-                const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
                __be16 vport = 0;
                if (dst_port == svc->port) {
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 76613f5a55c0..ed86a3be678e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -404,19 +404,49 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                           &net->ct.hash[repl_hash]);
 }
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+int
+nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
        struct net *net = nf_ct_net(ct);
        unsigned int hash, repl_hash;
+        struct nf_conntrack_tuple_hash *h;
+        struct hlist_nulls_node *n;
        u16 zone;
        zone = nf_ct_zone(ct);
-        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        hash = hash_conntrack(net, zone,
-        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone,
+                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        spin_lock_bh(&nf_conntrack_lock);
+        /* See if there's one in the list already, including reverse */
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+        add_timer(&ct->timeout);
+        nf_conntrack_get(&ct->ct_general);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        NF_CT_STAT_INC(net, insert);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return 0;
+out:
+        NF_CT_STAT_INC(net, insert_failed);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return -EEXIST;
 }
-EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 /* Confirm a connection given skb; places it in hash table */
 int
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 28d0312d890a..04fb409623d2 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1404,15 +1404,12 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                    nf_ct_protonum(ct));
                if (helper == NULL) {
                        rcu_read_unlock();
-                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                        if (request_module("nfct-helper-%s", helpname) < 0) {
-                                spin_lock_bh(&nf_conntrack_lock);
                                err = -EOPNOTSUPP;
                                goto err1;
                        }
-                        spin_lock_bh(&nf_conntrack_lock);
                        rcu_read_lock();
                        helper = __nf_conntrack_helper_find(helpname,
                                                            nf_ct_l3num(ct),
@@ -1505,8 +1502,10 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
        if (tstamp)
                tstamp->start = ktime_to_ns(ktime_get_real());
-        add_timer(&ct->timeout);
+        err = nf_conntrack_hash_check_insert(ct);
-        nf_conntrack_hash_insert(ct);
+        if (err < 0)
+                goto err2;
        rcu_read_unlock();
        return ct;
@@ -1527,6 +1526,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
        struct nf_conntrack_tuple otuple, rtuple;
        struct nf_conntrack_tuple_hash *h = NULL;
        struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+        struct nf_conn *ct;
        u_int8_t u3 = nfmsg->nfgen_family;
        u16 zone;
        int err;
@@ -1547,27 +1547,22 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                        return err;
        }
-        spin_lock_bh(&nf_conntrack_lock);
        if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(net, zone, &otuple);
+                h = nf_conntrack_find_get(net, zone, &otuple);
        else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(net, zone, &rtuple);
+                h = nf_conntrack_find_get(net, zone, &rtuple);
        if (h == NULL) {
                err = -ENOENT;
                if (nlh->nlmsg_flags & NLM_F_CREATE) {
-                        struct nf_conn *ct;
                        enum ip_conntrack_events events;
                        ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                        &rtuple, u3);
-                        if (IS_ERR(ct)) {
+                        if (IS_ERR(ct))
-                                err = PTR_ERR(ct);
+                                return PTR_ERR(ct);
-                                goto out_unlock;
-                        }
                        err = 0;
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                        if (test_bit(IPS_EXPECTED_BIT, &ct->status))
                                events = IPCT_RELATED;
                        else
@@ -1582,23 +1577,19 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                      ct, NETLINK_CB(skb).pid,
                                                      nlmsg_report(nlh));
                        nf_ct_put(ct);
-                } else
+                }
-                        spin_unlock_bh(&nf_conntrack_lock);
                return err;
        }
        /* implicit 'else' */
-        /* We manipulate the conntrack inside the global conntrack table lock,
-         * so there's no need to increase the refcount */
        err = -EEXIST;
+        ct = nf_ct_tuplehash_to_ctrack(h);
        if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
-                struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
+                spin_lock_bh(&nf_conntrack_lock);
                err = ctnetlink_change_conntrack(ct, cda);
+                spin_unlock_bh(&nf_conntrack_lock);
                if (err == 0) {
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                        nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                      (1 << IPCT_ASSURED) |
                                                      (1 << IPCT_HELPER) |
@@ -1607,15 +1598,10 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                      (1 << IPCT_MARK),
                                                      ct, NETLINK_CB(skb).pid,
                                                      nlmsg_report(nlh));
-                        nf_ct_put(ct);
+                }
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
-                return err;
        }
-out_unlock:
+        nf_ct_put(ct);
-        spin_unlock_bh(&nf_conntrack_lock);
        return err;
 }
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index b3a7db678b8d..ce60cf0f6c11 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -203,6 +203,27 @@ err:
        return status;
 }
+#ifdef CONFIG_BRIDGE_NETFILTER
+/* When called from bridge netfilter, skb->data must point to MAC header
+ * before calling skb_gso_segment(). Else, original MAC header is lost
+ * and segmented skbs will be sent to wrong destination.
+ */
+static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_push(skb, skb->network_header - skb->mac_header);
+}
+static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_pull(skb, skb->network_header - skb->mac_header);
+}
+#else
+#define nf_bridge_adjust_skb_data(s) do {} while (0)
+#define nf_bridge_adjust_segmented_data(s) do {} while (0)
+#endif
 int nf_queue(struct sk_buff *skb,
             struct list_head *elem,
             u_int8_t pf, unsigned int hook,
@@ -212,7 +233,7 @@ int nf_queue(struct sk_buff *skb,
             unsigned int queuenum)
 {
        struct sk_buff *segs;
-        int err;
+        int err = -EINVAL;
        unsigned int queued;
        if (!skb_is_gso(skb))
@@ -228,23 +249,25 @@ int nf_queue(struct sk_buff *skb,
                break;
        }
+        nf_bridge_adjust_skb_data(skb);
        segs = skb_gso_segment(skb, 0);
        /* Does not use PTR_ERR to limit the number of error codes that can be
         * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean
         * 'ignore this hook'.
         */
        if (IS_ERR(segs))
-                return -EINVAL;
+                goto out_err;
        queued = 0;
        err = 0;
        do {
                struct sk_buff *nskb = segs->next;
                segs->next = NULL;
-                if (err == 0)
+                if (err == 0) {
+                        nf_bridge_adjust_segmented_data(segs);
                        err = __nf_queue(segs, elem, pf, hook, indev,
                                           outdev, okfn, queuenum);
+                }
                if (err == 0)
                        queued++;
                else
@@ -252,11 +275,12 @@ int nf_queue(struct sk_buff *skb,
                segs = nskb;
        } while (segs);
-        /* also free orig skb if only some segments were queued */
+        if (queued) {
-        if (unlikely(err && queued))
-                err = 0;
-        if (err == 0)
                kfree_skb(skb);
+                return 0;
+        }
+  out_err:
+        nf_bridge_adjust_segmented_data(skb);
        return err;
 }
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 3aae66facf9f..4d5057902839 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -152,9 +152,10 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
        fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
                           (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
        dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                return false;
+        }
        skb_dst_drop(skb);
        skb_dst_set(skb, dst);
        skb->dev      = dst->dev;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e83d61ca78ca..5da548fa7ae9 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -501,9 +501,8 @@ tfifo_dequeue:
                /* if more time remaining? */
                if (cb->time_to_send <= psched_get_time()) {
-                        skb = qdisc_dequeue_tail(sch);
+                        __skb_unlink(skb, &sch->q);
-                        if (unlikely(!skb))
+                        sch->qstats.backlog -= qdisc_pkt_len(skb);
-                                goto qdisc_dequeue;
 #ifdef CONFIG_NET_CLS_ACT
                        /*
@@ -539,7 +538,6 @@ deliver:
                qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
        }
-qdisc_dequeue:
        if (q->qdisc) {
                skb = q->qdisc->ops->dequeue(q->qdisc);
                if (skb)
diff --git a/scripts/coccicheck b/scripts/coccicheck
index 3c2776466d87..823e972149e5 100755
--- a/scripts/coccicheck
+++ b/scripts/coccicheck
@@ -9,15 +9,10 @@ if [ "$C" = "1" -o "$C" = "2" ]; then
 #    FLAGS="-ignore_unknown_options -very_quiet"
 #    OPTIONS=$*
-    if [ "$KBUILD_EXTMOD" = "" ] ; then
+# Workaround for Coccinelle < 0.2.3
-        # Workaround for Coccinelle < 0.2.3
+        FLAGS="-I $srctree/include -very_quiet"
-        FLAGS="-I $srctree/include -very_quiet"
+        shift $(( $# - 1 ))
-        shift $(( $# - 1 ))
+        OPTIONS=$1
-        OPTIONS=$1
-    else
-        echo M= is not currently supported when C=1 or C=2
-        exit 1
-    fi
 else
    ONLINE=0
    FLAGS="-very_quiet"
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index a27235685949..2ae481703141 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -9,12 +9,6 @@ fi
 DEPMOD=$1
 KERNELRELEASE=$2
-if ! "$DEPMOD" -V 2>/dev/null | grep -q module-init-tools; then
-        echo "Warning: you may need to install module-init-tools" >&2
-        echo "See http://www.codemonkey.org.uk/docs/post-halloween-2.6.txt" >&2
-        sleep 1
-fi
 if ! test -r System.map -a -x "$DEPMOD"; then
        exit 0
 fi
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 2bd594e6d1b4..9adb667dd31a 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1494,6 +1494,13 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
        return 0;
 }
+#ifndef R_ARM_CALL
+#define R_ARM_CALL      28
+#endif
+#ifndef R_ARM_JUMP24
+#define R_ARM_JUMP24    29
+#endif
 static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 {
        unsigned int r_typ = ELF_R_TYPE(r->r_info);
@@ -1505,6 +1512,8 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
                              (elf->symtab_start + ELF_R_SYM(r->r_info));
                break;
        case R_ARM_PC24:
+        case R_ARM_CALL:
+        case R_ARM_JUMP24:
                /* From ARM ABI: ((S + A) | T) - P */
                r->r_addend = (int)(long)(elf->hdr +
                              sechdr->sh_offset +
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index f6cbc3ddb68b..3c6c0b14c807 100644
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -238,14 +238,14 @@ EOF
 fi
 # Build header package
-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$)
+(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$)
+(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$)
+(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -)
+(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -)
+(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -)
-rm -f /tmp/files$$ /tmp/objfiles$$
+rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
 arch=$(dpkg --print-architecture)
 cat <<EOF >> debian/control
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 1358987c49d8..3647baa9bfed 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -80,6 +80,8 @@ enum {
        ALC_AUTOMUTE_MIXER,     /* mute/unmute mixer widget AMP */
 };
+#define MAX_VOL_NIDS    0x40
 struct alc_spec {
        /* codec parameterization */
        const struct snd_kcontrol_new *mixers[5];       /* mixer arrays */
@@ -118,8 +120,8 @@ struct alc_spec {
        const hda_nid_t *capsrc_nids;
        hda_nid_t dig_in_nid;           /* digital-in NID; optional */
        hda_nid_t mixer_nid;            /* analog-mixer NID */
-        DECLARE_BITMAP(vol_ctls, 0x20 << 1);
+        DECLARE_BITMAP(vol_ctls, MAX_VOL_NIDS << 1);
-        DECLARE_BITMAP(sw_ctls, 0x20 << 1);
+        DECLARE_BITMAP(sw_ctls, MAX_VOL_NIDS << 1);
        /* capture setup for dynamic dual-adc switch */
        hda_nid_t cur_adc;
@@ -3149,7 +3151,10 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
 static inline unsigned int get_ctl_pos(unsigned int data)
 {
        hda_nid_t nid = get_amp_nid_(data);
-        unsigned int dir = get_amp_direction_(data);
+        unsigned int dir;
+        if (snd_BUG_ON(nid >= MAX_VOL_NIDS))
+                return 0;
+        dir = get_amp_direction_(data);
        return (nid << 1) | dir;
 }
@@ -4436,12 +4441,20 @@ static void alc889_fixup_dac_route(struct hda_codec *codec,
                                   const struct alc_fixup *fix, int action)
 {
        if (action == ALC_FIXUP_ACT_PRE_PROBE) {
+                /* fake the connections during parsing the tree */
                hda_nid_t conn1[2] = { 0x0c, 0x0d };
                hda_nid_t conn2[2] = { 0x0e, 0x0f };
                snd_hda_override_conn_list(codec, 0x14, 2, conn1);
                snd_hda_override_conn_list(codec, 0x15, 2, conn1);
                snd_hda_override_conn_list(codec, 0x18, 2, conn2);
                snd_hda_override_conn_list(codec, 0x1a, 2, conn2);
+        } else if (action == ALC_FIXUP_ACT_PROBE) {
+                /* restore the connections */
+                hda_nid_t conn[5] = { 0x0c, 0x0d, 0x0e, 0x0f, 0x26 };
+                snd_hda_override_conn_list(codec, 0x14, 5, conn);
+                snd_hda_override_conn_list(codec, 0x15, 5, conn);
+                snd_hda_override_conn_list(codec, 0x18, 5, conn);
+                snd_hda_override_conn_list(codec, 0x1a, 5, conn);
        }
 }
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index 5ef70b5d27e4..278c0a0575f5 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -146,13 +146,10 @@ static const struct snd_kcontrol_new ak4642_snd_controls[] = {
        SOC_DOUBLE_R_TLV("Digital Playback Volume", L_DVC, R_DVC,
                         0, 0xFF, 1, out_tlv),
-        SOC_SINGLE("Headphone Switch", PW_MGMT2, 6, 1, 0),
 };
-static const struct snd_kcontrol_new ak4642_hpout_mixer_controls[] = {
+static const struct snd_kcontrol_new ak4642_headphone_control =
-        SOC_DAPM_SINGLE("DACH", MD_CTL4, 0, 1, 0),
+        SOC_DAPM_SINGLE("Switch", PW_MGMT2, 6, 1, 0);
-};
 static const struct snd_kcontrol_new ak4642_lout_mixer_controls[] = {
        SOC_DAPM_SINGLE("DACL", SG_SL1, 4, 1, 0),
@@ -165,13 +162,12 @@ static const struct snd_soc_dapm_widget ak4642_dapm_widgets[] = {
        SND_SOC_DAPM_OUTPUT("HPOUTR"),
        SND_SOC_DAPM_OUTPUT("LINEOUT"),
-        SND_SOC_DAPM_MIXER("HPOUTL Mixer", PW_MGMT2, 5, 0,
+        SND_SOC_DAPM_PGA("HPL Out", PW_MGMT2, 5, 0, NULL, 0),
-                           &ak4642_hpout_mixer_controls[0],
+        SND_SOC_DAPM_PGA("HPR Out", PW_MGMT2, 4, 0, NULL, 0),
-                           ARRAY_SIZE(ak4642_hpout_mixer_controls)),
+        SND_SOC_DAPM_SWITCH("Headphone Enable", SND_SOC_NOPM, 0, 0,
+                            &ak4642_headphone_control),
-        SND_SOC_DAPM_MIXER("HPOUTR Mixer", PW_MGMT2, 4, 0,
+        SND_SOC_DAPM_PGA("DACH", MD_CTL4, 0, 0, NULL, 0),
-                           &ak4642_hpout_mixer_controls[0],
-                           ARRAY_SIZE(ak4642_hpout_mixer_controls)),
        SND_SOC_DAPM_MIXER("LINEOUT Mixer", PW_MGMT1, 3, 0,
                           &ak4642_lout_mixer_controls[0],
@@ -184,12 +180,17 @@ static const struct snd_soc_dapm_widget ak4642_dapm_widgets[] = {
 static const struct snd_soc_dapm_route ak4642_intercon[] = {
        /* Outputs */
-        {"HPOUTL", NULL, "HPOUTL Mixer"},
+        {"HPOUTL", NULL, "HPL Out"},
-        {"HPOUTR", NULL, "HPOUTR Mixer"},
+        {"HPOUTR", NULL, "HPR Out"},
        {"LINEOUT", NULL, "LINEOUT Mixer"},
-        {"HPOUTL Mixer", "DACH", "DAC"},
+        {"HPL Out", NULL, "Headphone Enable"},
-        {"HPOUTR Mixer", "DACH", "DAC"},
+        {"HPR Out", NULL, "Headphone Enable"},
+        {"Headphone Enable", "Switch", "DACH"},
+        {"DACH", NULL, "DAC"},
        {"LINEOUT Mixer", "DACL", "DAC"},
 };
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 29c4b02c4790..0ac228b7dc04 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2564,7 +2564,7 @@ static int dsp2_event(struct snd_soc_dapm_widget *w,
        return 0;
 }
-static const char *st_text[] = { "None", "Right", "Left" };
+static const char *st_text[] = { "None", "Left", "Right" };
 static const struct soc_enum str_enum =
        SOC_ENUM_SINGLE(WM8962_DAC_DSP_MIXING_1, 2, 3, st_text);
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 2cf87f5afed4..fde9a7a29cb6 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -311,8 +311,10 @@ snd_usb_caiaq_pcm_pointer(struct snd_pcm_substream *sub)
        spin_lock(&dev->spinlock);
-        if (dev->input_panic || dev->output_panic)
+        if (dev->input_panic || dev->output_panic) {
                ptr = SNDRV_PCM_POS_XRUN;
+                goto unlock;
+        }
        if (sub->stream == SNDRV_PCM_STREAM_PLAYBACK)
                ptr = bytes_to_frames(sub->runtime,
@@ -321,6 +323,7 @@ snd_usb_caiaq_pcm_pointer(struct snd_pcm_substream *sub)
                ptr = bytes_to_frames(sub->runtime,
                                        dev->audio_in_buf_pos[index]);
+unlock:
        spin_unlock(&dev->spinlock);
        return ptr;
 }
diff --git a/sound/usb/card.h b/sound/usb/card.h
index a39edcc32a93..da5fa1ac4eda 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -1,6 +1,7 @@
 #ifndef __USBAUDIO_CARD_H
 #define __USBAUDIO_CARD_H
+#define MAX_NR_RATES    1024
 #define MAX_PACKS       20
 #define MAX_PACKS_HS    (MAX_PACKS * 8) /* in high speed mode */
 #define MAX_URBS        8
diff --git a/sound/usb/format.c b/sound/usb/format.c
index e09aba19375c..ddfef57c4c9f 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -209,8 +209,6 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
        return 0;
 }
-#define MAX_UAC2_NR_RATES 1024
 /*
 * Helper function to walk the array of sample rate triplets reported by
 * the device. The problem is that we need to parse whole array first to
@@ -255,7 +253,7 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets,
                        fp->rates |= snd_pcm_rate_to_rate_bit(rate);
                        nr_rates++;
-                        if (nr_rates >= MAX_UAC2_NR_RATES) {
+                        if (nr_rates >= MAX_NR_RATES) {
                                snd_printk(KERN_ERR "invalid uac2 rates\n");
                                break;
                        }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a3ddac0deffd..27817266867a 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -132,10 +132,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
        unsigned *rate_table = NULL;
        fp = kmemdup(quirk->data, sizeof(*fp), GFP_KERNEL);
-        if (! fp) {
+        if (!fp) {
                snd_printk(KERN_ERR "cannot memdup\n");
                return -ENOMEM;
        }
+        if (fp->nr_rates > MAX_NR_RATES) {
+                kfree(fp);
+                return -EINVAL;
+        }
        if (fp->nr_rates > 0) {
                rate_table = kmemdup(fp->rate_table,
                                     sizeof(int) * fp->nr_rates, GFP_KERNEL);