134 files changed, 941 insertions, 548 deletions
diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
index d5c0cef38a71..873a2ab2e9f8 100644
--- a/Documentation/filesystems/nilfs2.txt
+++ b/Documentation/filesystems/nilfs2.txt
@@ -40,7 +40,6 @@ Features which NILFS2 does not support yet:
        - POSIX ACLs
        - quotas
        - fsck
-        - resize
        - defragmentation
 Mount options
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d3d653a5f9b9..bfe924217f24 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -346,7 +346,7 @@ tcp_orphan_retries - INTEGER
        when RTO retransmissions remain unacknowledged.
        See tcp_retries2 for more details.
-        The default value is 7.
+        The default value is 8.
        If your machine is a loaded WEB server,
        you should think about lowering this value, such sockets
        may consume significant resources. Cf. tcp_max_orphans.
diff --git a/arch/arm/mach-davinci/irq.c b/arch/arm/mach-davinci/irq.c
index 85e77fd9d56a..952dc126c390 100644
--- a/arch/arm/mach-davinci/irq.c
+++ b/arch/arm/mach-davinci/irq.c
@@ -59,7 +59,7 @@ davinci_alloc_gc(void __iomem *base, unsigned int irq_start, unsigned int num)
        }
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 74ed81a3cb1a..07772575d7ab 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -419,14 +419,20 @@ static void notrace ixp4xx_update_sched_clock(void)
 /*
 * clocksource
 */
+static cycle_t ixp4xx_clocksource_read(struct clocksource *c)
+{
+        return *IXP4XX_OSTS;
+}
 unsigned long ixp4xx_timer_freq = IXP4XX_TIMER_FREQ;
 EXPORT_SYMBOL(ixp4xx_timer_freq);
 static void __init ixp4xx_clocksource_init(void)
 {
        init_sched_clock(&cd, ixp4xx_update_sched_clock, 32, ixp4xx_timer_freq);
-        clocksource_mmio_init(&IXP4XX_OSTS, "OSTS", ixp4xx_timer_freq, 200, 32,
+        clocksource_mmio_init(NULL, "OSTS", ixp4xx_timer_freq, 200, 32,
-                        clocksource_mmio_readl_up);
+                        ixp4xx_clocksource_read);
 }
 /*
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 72b4e7631583..ab9f999106c7 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -79,7 +79,7 @@ static APBC_CLK(ssp4, PXA168_SSP4, 4, 0);
 static APBC_CLK(ssp5, PXA168_SSP5, 4, 0);
 static APBC_CLK(keypad, PXA168_KPC, 0, 32000);
-static APMU_CLK(nand, NAND, 0x01db, 208000000);
+static APMU_CLK(nand, NAND, 0x19b, 156000000);
 static APMU_CLK(lcd, LCD, 0x7f, 312000000);
 /* device and clock bindings */
diff --git a/arch/arm/mach-mmp/pxa910.c b/arch/arm/mach-mmp/pxa910.c
index 8f92ccd26edf..1464607aa60d 100644
--- a/arch/arm/mach-mmp/pxa910.c
+++ b/arch/arm/mach-mmp/pxa910.c
@@ -110,7 +110,7 @@ static APBC_CLK(pwm2, PXA910_PWM2, 1, 13000000);
 static APBC_CLK(pwm3, PXA910_PWM3, 1, 13000000);
 static APBC_CLK(pwm4, PXA910_PWM4, 1, 13000000);
-static APMU_CLK(nand, NAND, 0x01db, 208000000);
+static APMU_CLK(nand, NAND, 0x19b, 156000000);
 static APMU_CLK(u2o, USB, 0x1b, 480000000);
 /* device and clock bindings */
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index 87ae3129f4f7..b27544bcafcb 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -347,9 +347,9 @@ static int pxa2xx_mfp_suspend(void)
                if ((gpio_desc[i].config & MFP_LPM_KEEP_OUTPUT) &&
                    (GPDR(i) & GPIO_bit(i))) {
                        if (GPLR(i) & GPIO_bit(i))
-                                PGSR(i) |= GPIO_bit(i);
+                                PGSR(gpio_to_bank(i)) |= GPIO_bit(i);
                        else
-                                PGSR(i) &= ~GPIO_bit(i);
+                                PGSR(gpio_to_bank(i)) &= ~GPIO_bit(i);
                }
        }
diff --git a/arch/arm/mach-pxa/raumfeld.c b/arch/arm/mach-pxa/raumfeld.c
index d130f77b6d11..2f37d43f51b6 100644
--- a/arch/arm/mach-pxa/raumfeld.c
+++ b/arch/arm/mach-pxa/raumfeld.c
@@ -573,10 +573,10 @@ static struct pxafb_mode_info sharp_lq043t3dx02_mode = {
        .xres           = 480,
        .yres           = 272,
        .bpp            = 16,
-        .hsync_len      = 4,
+        .hsync_len      = 41,
        .left_margin    = 2,
        .right_margin   = 1,
-        .vsync_len      = 1,
+        .vsync_len      = 10,
        .upper_margin   = 3,
        .lower_margin   = 1,
        .sync           = 0,
@@ -596,29 +596,31 @@ static void __init raumfeld_lcd_init(void)
 {
        int ret;
-        pxa_set_fb_info(NULL, &raumfeld_sharp_lcd_info);
-        /* Earlier devices had the backlight regulator controlled
-         * via PWM, later versions use another controller for that */
-        if ((system_rev & 0xff) < 2) {
-                mfp_cfg_t raumfeld_pwm_pin_config = GPIO17_PWM0_OUT;
-                pxa3xx_mfp_config(&raumfeld_pwm_pin_config, 1);
-                platform_device_register(&raumfeld_pwm_backlight_device);
-        } else
-                platform_device_register(&raumfeld_lt3593_device);
        ret = gpio_request(GPIO_TFT_VA_EN, "display VA enable");
        if (ret < 0)
                pr_warning("Unable to request GPIO_TFT_VA_EN\n");
        else
                gpio_direction_output(GPIO_TFT_VA_EN, 1);
+        msleep(100);
        ret = gpio_request(GPIO_DISPLAY_ENABLE, "display enable");
        if (ret < 0)
                pr_warning("Unable to request GPIO_DISPLAY_ENABLE\n");
        else
                gpio_direction_output(GPIO_DISPLAY_ENABLE, 1);
+        /* Hardware revision 2 has the backlight regulator controlled
+         * by an LT3593, earlier and later devices use PWM for that. */
+        if ((system_rev & 0xff) == 2) {
+                platform_device_register(&raumfeld_lt3593_device);
+        } else {
+                mfp_cfg_t raumfeld_pwm_pin_config = GPIO17_PWM0_OUT;
+                pxa3xx_mfp_config(&raumfeld_pwm_pin_config, 1);
+                platform_device_register(&raumfeld_pwm_backlight_device);
+        }
+        pxa_set_fb_info(NULL, &raumfeld_sharp_lcd_info);
        platform_device_register(&pxa3xx_device_gcu);
 }
@@ -657,10 +659,10 @@ static struct lis3lv02d_platform_data lis3_pdata = {
 #define SPI_AK4104      \
 {                       \
-        .modalias       = "ak4104",     \
+        .modalias       = "ak4104-codec",       \
-        .max_speed_hz   = 10000,        \
+        .max_speed_hz   = 10000,                \
-        .bus_num        = 0,            \
+        .bus_num        = 0,                    \
-        .chip_select    = 0,            \
+        .chip_select    = 0,                    \
        .controller_data = (void *) GPIO_SPDIF_CS,      \
 }
diff --git a/arch/arm/mach-s3c64xx/dma.c b/arch/arm/mach-s3c64xx/dma.c
index b197171e7d03..204bfafe4bfc 100644
--- a/arch/arm/mach-s3c64xx/dma.c
+++ b/arch/arm/mach-s3c64xx/dma.c
@@ -113,7 +113,7 @@ found:
        return chan;
 }
-int s3c2410_dma_config(unsigned int channel, int xferunit)
+int s3c2410_dma_config(enum dma_ch channel, int xferunit)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -297,7 +297,7 @@ static int s3c64xx_dma_flush(struct s3c2410_dma_chan *chan)
        return 0;
 }
-int s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op)
+int s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -331,7 +331,7 @@ EXPORT_SYMBOL(s3c2410_dma_ctrl);
 *
 */
-int s3c2410_dma_enqueue(unsigned int channel, void *id,
+int s3c2410_dma_enqueue(enum dma_ch channel, void *id,
                        dma_addr_t data, int size)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -415,7 +415,7 @@ err_buff:
 EXPORT_SYMBOL(s3c2410_dma_enqueue);
-int s3c2410_dma_devconfig(unsigned int channel,
+int s3c2410_dma_devconfig(enum dma_ch channel,
                          enum s3c2410_dmasrc source,
                          unsigned long devaddr)
 {
@@ -463,7 +463,7 @@ int s3c2410_dma_devconfig(unsigned int channel,
 EXPORT_SYMBOL(s3c2410_dma_devconfig);
-int s3c2410_dma_getposition(unsigned int channel,
+int s3c2410_dma_getposition(enum dma_ch channel,
                            dma_addr_t *src, dma_addr_t *dst)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -487,7 +487,7 @@ EXPORT_SYMBOL(s3c2410_dma_getposition);
 * get control of an dma channel
 */
-int s3c2410_dma_request(unsigned int channel,
+int s3c2410_dma_request(enum dma_ch channel,
                        struct s3c2410_dma_client *client,
                        void *dev)
 {
@@ -533,7 +533,7 @@ EXPORT_SYMBOL(s3c2410_dma_request);
 * allowed to go through.
 */
-int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *client)
+int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *client)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
        unsigned long flags;
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index 5b4fffab1eb4..41ab97ebe4cf 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -432,7 +432,7 @@ void __init orion_gpio_init(int gpio_base, int ngpio,
        ct->regs.mask = ochip->mask_offset + GPIO_EDGE_MASK_OFF;
        ct->regs.ack = GPIO_EDGE_CAUSE_OFF;
        ct->type = IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_clr_bit;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
        ct->chip.irq_set_type = gpio_irq_set_type;
diff --git a/arch/arm/plat-pxa/gpio.c b/arch/arm/plat-pxa/gpio.c
index 48ebb9479b61..a11dc3670505 100644
--- a/arch/arm/plat-pxa/gpio.c
+++ b/arch/arm/plat-pxa/gpio.c
@@ -50,7 +50,7 @@ static inline void __iomem *gpio_chip_base(struct gpio_chip *c)
        return container_of(c, struct pxa_gpio_chip, chip)->regbase;
 }
-static inline struct pxa_gpio_chip *gpio_to_chip(unsigned gpio)
+static inline struct pxa_gpio_chip *gpio_to_pxachip(unsigned gpio)
 {
        return &pxa_gpio_chips[gpio_to_bank(gpio)];
 }
@@ -161,7 +161,7 @@ static int pxa_gpio_irq_type(struct irq_data *d, unsigned int type)
        int gpio = irq_to_gpio(d->irq);
        unsigned long gpdr, mask = GPIO_bit(gpio);
-        c = gpio_to_chip(gpio);
+        c = gpio_to_pxachip(gpio);
        if (type == IRQ_TYPE_PROBE) {
                /* Don't mess with enabled GPIOs using preconfigured edges or
@@ -230,7 +230,7 @@ static void pxa_gpio_demux_handler(unsigned int irq, struct irq_desc *desc)
 static void pxa_ack_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        __raw_writel(GPIO_bit(gpio), c->regbase + GEDR_OFFSET);
 }
@@ -238,7 +238,7 @@ static void pxa_ack_muxed_gpio(struct irq_data *d)
 static void pxa_mask_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        uint32_t grer, gfer;
        c->irq_mask &= ~GPIO_bit(gpio);
@@ -252,7 +252,7 @@ static void pxa_mask_muxed_gpio(struct irq_data *d)
 static void pxa_unmask_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        c->irq_mask |= GPIO_bit(gpio);
        update_edge_detect(c);
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index a79a8ccd25f6..539bd0e3defd 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -712,7 +712,7 @@ static struct s3c2410_dma_chan *s3c2410_dma_map_channel(int channel);
 * get control of an dma channel
 */
-int s3c2410_dma_request(unsigned int channel,
+int s3c2410_dma_request(enum dma_ch channel,
                        struct s3c2410_dma_client *client,
                        void *dev)
 {
@@ -783,7 +783,7 @@ EXPORT_SYMBOL(s3c2410_dma_request);
 * allowed to go through.
 */
-int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *client)
+int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *client)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
        unsigned long flags;
@@ -974,7 +974,7 @@ static int s3c2410_dma_started(struct s3c2410_dma_chan *chan)
 }
 int
-s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op)
+s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -1021,7 +1021,7 @@ EXPORT_SYMBOL(s3c2410_dma_ctrl);
 * xfersize:     size of unit in bytes (1,2,4)
 */
-int s3c2410_dma_config(unsigned int channel,
+int s3c2410_dma_config(enum dma_ch channel,
                       int xferunit)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -1100,7 +1100,7 @@ EXPORT_SYMBOL(s3c2410_dma_config);
 * devaddr:   physical address of the source
 */
-int s3c2410_dma_devconfig(unsigned int channel,
+int s3c2410_dma_devconfig(enum dma_ch channel,
                          enum s3c2410_dmasrc source,
                          unsigned long devaddr)
 {
@@ -1173,7 +1173,7 @@ EXPORT_SYMBOL(s3c2410_dma_devconfig);
 * returns the current transfer points for the dma source and destination
 */
-int s3c2410_dma_getposition(unsigned int channel, dma_addr_t *src, dma_addr_t *dst)
+int s3c2410_dma_getposition(enum dma_ch channel, dma_addr_t *src, dma_addr_t *dst)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index 135abda31c9a..327ab9f662e8 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -152,7 +152,7 @@ static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
        if (!gc)
                return -ENOMEM;
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
        ct->chip.irq_set_type = s5p_gpioint_set_type,
diff --git a/arch/arm/plat-samsung/dma.c b/arch/arm/plat-samsung/dma.c
index cb459dd95459..6143aa147688 100644
--- a/arch/arm/plat-samsung/dma.c
+++ b/arch/arm/plat-samsung/dma.c
@@ -41,7 +41,7 @@ struct s3c2410_dma_chan *s3c_dma_lookup_channel(unsigned int channel)
 * irq?
 */
-int s3c2410_dma_set_opfn(unsigned int channel, s3c2410_dma_opfn_t rtn)
+int s3c2410_dma_set_opfn(enum dma_ch channel, s3c2410_dma_opfn_t rtn)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -56,7 +56,7 @@ int s3c2410_dma_set_opfn(unsigned int channel, s3c2410_dma_opfn_t rtn)
 }
 EXPORT_SYMBOL(s3c2410_dma_set_opfn);
-int s3c2410_dma_set_buffdone_fn(unsigned int channel, s3c2410_dma_cbfn_t rtn)
+int s3c2410_dma_set_buffdone_fn(enum dma_ch channel, s3c2410_dma_cbfn_t rtn)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -71,7 +71,7 @@ int s3c2410_dma_set_buffdone_fn(unsigned int channel, s3c2410_dma_cbfn_t rtn)
 }
 EXPORT_SYMBOL(s3c2410_dma_set_buffdone_fn);
-int s3c2410_dma_setflags(unsigned int channel, unsigned int flags)
+int s3c2410_dma_setflags(enum dma_ch channel, unsigned int flags)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
diff --git a/arch/arm/plat-samsung/include/plat/dma.h b/arch/arm/plat-samsung/include/plat/dma.h
index 2e8f8c6560d7..8c273b7a6f56 100644
--- a/arch/arm/plat-samsung/include/plat/dma.h
+++ b/arch/arm/plat-samsung/include/plat/dma.h
@@ -42,6 +42,7 @@ struct s3c2410_dma_client {
 };
 struct s3c2410_dma_chan;
+enum dma_ch;
 /* s3c2410_dma_cbfn_t
 *
@@ -62,7 +63,7 @@ typedef int  (*s3c2410_dma_opfn_t)(struct s3c2410_dma_chan *,
 * request a dma channel exclusivley
 */
-extern int s3c2410_dma_request(unsigned int channel,
+extern int s3c2410_dma_request(enum dma_ch channel,
                               struct s3c2410_dma_client *, void *dev);
@@ -71,14 +72,14 @@ extern int s3c2410_dma_request(unsigned int channel,
 * change the state of the dma channel
 */
-extern int s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op);
+extern int s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op);
 /* s3c2410_dma_setflags
 *
 * set the channel's flags to a given state
 */
-extern int s3c2410_dma_setflags(unsigned int channel,
+extern int s3c2410_dma_setflags(enum dma_ch channel,
                                unsigned int flags);
 /* s3c2410_dma_free
@@ -86,7 +87,7 @@ extern int s3c2410_dma_setflags(unsigned int channel,
 * free the dma channel (will also abort any outstanding operations)
 */
-extern int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *);
+extern int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *);
 /* s3c2410_dma_enqueue
 *
@@ -95,7 +96,7 @@ extern int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *);
 * drained before the buffer is given to the DMA system.
 */
-extern int s3c2410_dma_enqueue(unsigned int channel, void *id,
+extern int s3c2410_dma_enqueue(enum dma_ch channel, void *id,
                               dma_addr_t data, int size);
 /* s3c2410_dma_config
@@ -103,14 +104,14 @@ extern int s3c2410_dma_enqueue(unsigned int channel, void *id,
 * configure the dma channel
 */
-extern int s3c2410_dma_config(unsigned int channel, int xferunit);
+extern int s3c2410_dma_config(enum dma_ch channel, int xferunit);
 /* s3c2410_dma_devconfig
 *
 * configure the device we're talking to
 */
-extern int s3c2410_dma_devconfig(unsigned int channel,
+extern int s3c2410_dma_devconfig(enum dma_ch channel,
                enum s3c2410_dmasrc source, unsigned long devaddr);
 /* s3c2410_dma_getposition
@@ -118,10 +119,10 @@ extern int s3c2410_dma_devconfig(unsigned int channel,
 * get the position that the dma transfer is currently at
 */
-extern int s3c2410_dma_getposition(unsigned int channel,
+extern int s3c2410_dma_getposition(enum dma_ch channel,
                                   dma_addr_t *src, dma_addr_t *dest);
-extern int s3c2410_dma_set_opfn(unsigned int, s3c2410_dma_opfn_t rtn);
+extern int s3c2410_dma_set_opfn(enum dma_ch, s3c2410_dma_opfn_t rtn);
-extern int s3c2410_dma_set_buffdone_fn(unsigned int, s3c2410_dma_cbfn_t rtn);
+extern int s3c2410_dma_set_buffdone_fn(enum dma_ch, s3c2410_dma_cbfn_t rtn);
diff --git a/arch/arm/plat-samsung/irq-uart.c b/arch/arm/plat-samsung/irq-uart.c
index 32582c0958e3..657405c481d0 100644
--- a/arch/arm/plat-samsung/irq-uart.c
+++ b/arch/arm/plat-samsung/irq-uart.c
@@ -54,8 +54,15 @@ static void __init s3c_init_uart_irq(struct s3c_uart_irq *uirq)
        gc = irq_alloc_generic_chip("s3c-uart", 1, uirq->base_irq, reg_base,
                                    handle_level_irq);
+        if (!gc) {
+                pr_err("%s: irq_alloc_generic_chip for IRQ %u failed\n",
+                       __func__, uirq->base_irq);
+                return;
+        }
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
        ct->regs.ack = S3C64XX_UINTP;
diff --git a/arch/arm/plat-samsung/irq-vic-timer.c b/arch/arm/plat-samsung/irq-vic-timer.c
index a607546ddbd0..f714d060370d 100644
--- a/arch/arm/plat-samsung/irq-vic-timer.c
+++ b/arch/arm/plat-samsung/irq-vic-timer.c
@@ -54,6 +54,13 @@ void __init s3c_init_vic_timer_irq(unsigned int num, unsigned int timer_irq)
        s3c_tgc = irq_alloc_generic_chip("s3c-timer", 1, timer_irq,
                                         S3C64XX_TINT_CSTAT, handle_level_irq);
+        if (!s3c_tgc) {
+                pr_err("%s: irq_alloc_generic_chip for IRQ %d failed\n",
+                       __func__, timer_irq);
+                return;
+        }
        ct = s3c_tgc->chip_types;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
index c018696765d4..5c74eb797f08 100644
--- a/arch/mips/kernel/i8259.c
+++ b/arch/mips/kernel/i8259.c
@@ -14,7 +14,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
-#include <linux/sysdev.h>
+#include <linux/syscore_ops.h>
 #include <linux/irq.h>
 #include <asm/i8259.h>
@@ -215,14 +215,13 @@ spurious_8259A_irq:
        }
 }
-static int i8259A_resume(struct sys_device *dev)
+static void i8259A_resume(void)
 {
        if (i8259A_auto_eoi >= 0)
                init_8259A(i8259A_auto_eoi);
-        return 0;
 }
-static int i8259A_shutdown(struct sys_device *dev)
+static void i8259A_shutdown(void)
 {
        /* Put the i8259A into a quiescent state that
         * the kernel initialization code can get it
@@ -232,26 +231,17 @@ static int i8259A_shutdown(struct sys_device *dev)
                outb(0xff, PIC_MASTER_IMR);     /* mask all of 8259A-1 */
                outb(0xff, PIC_SLAVE_IMR);      /* mask all of 8259A-1 */
        }
-        return 0;
 }
-static struct sysdev_class i8259_sysdev_class = {
+static struct syscore_ops i8259_syscore_ops = {
-        .name = "i8259",
        .resume = i8259A_resume,
        .shutdown = i8259A_shutdown,
 };
-static struct sys_device device_i8259A = {
-        .id     = 0,
-        .cls    = &i8259_sysdev_class,
-};
 static int __init i8259A_init_sysfs(void)
 {
-        int error = sysdev_class_register(&i8259_sysdev_class);
+        register_syscore_ops(&i8259_syscore_ops);
-        if (!error)
+        return 0;
-                error = sysdev_register(&device_i8259A);
-        return error;
 }
 device_initcall(i8259A_init_sysfs);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 33867ec4a234..9d6a8effeda2 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -12,6 +12,8 @@
 #include <linux/of.h>
 #include <linux/memblock.h>
 #include <linux/vmalloc.h>
+#include <linux/memory.h>
 #include <asm/firmware.h>
 #include <asm/machdep.h>
 #include <asm/pSeries_reconfig.h>
@@ -20,24 +22,25 @@
 static unsigned long get_memblock_size(void)
 {
        struct device_node *np;
-        unsigned int memblock_size = 0;
+        unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE;
+        struct resource r;
        np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
        if (np) {
-                const unsigned long *size;
+                const __be64 *size;
                size = of_get_property(np, "ibm,lmb-size", NULL);
-                memblock_size = size ? *size : 0;
+                if (size)
+                        memblock_size = be64_to_cpup(size);
                of_node_put(np);
-        } else {
+        } else  if (machine_is(pseries)) {
+                /* This fallback really only applies to pseries */
                unsigned int memzero_size = 0;
-                const unsigned int *regs;
                np = of_find_node_by_path("/memory@0");
                if (np) {
-                        regs = of_get_property(np, "reg", NULL);
+                        if (!of_address_to_resource(np, 0, &r))
-                        memzero_size = regs ? regs[3] : 0;
+                                memzero_size = resource_size(&r);
                        of_node_put(np);
                }
@@ -50,16 +53,21 @@ static unsigned long get_memblock_size(void)
                        sprintf(buf, "/memory@%x", memzero_size);
                        np = of_find_node_by_path(buf);
                        if (np) {
-                                regs = of_get_property(np, "reg", NULL);
+                                if (!of_address_to_resource(np, 0, &r))
-                                memblock_size = regs ? regs[3] : 0;
+                                        memblock_size = resource_size(&r);
                                of_node_put(np);
                        }
                }
        }
        return memblock_size;
 }
+/* WARNING: This is going to override the generic definition whenever
+ * pseries is built-in regardless of what platform is active at boot
+ * time. This is fine for now as this is the only "option" and it
+ * should work everywhere. If not, we'll have to turn this into a
+ * ppc_md. callback
+ */
 unsigned long memory_block_size_bytes(void)
 {
        return get_memblock_size();
diff --git a/arch/sparc/include/asm/irqflags_32.h b/arch/sparc/include/asm/irqflags_32.h
index d4d0711de0f9..14848909e0de 100644
--- a/arch/sparc/include/asm/irqflags_32.h
+++ b/arch/sparc/include/asm/irqflags_32.h
@@ -18,7 +18,7 @@ extern void arch_local_irq_restore(unsigned long);
 extern unsigned long arch_local_irq_save(void);
 extern void arch_local_irq_enable(void);
-static inline unsigned long arch_local_save_flags(void)
+static inline notrace unsigned long arch_local_save_flags(void)
 {
        unsigned long flags;
@@ -26,17 +26,17 @@ static inline unsigned long arch_local_save_flags(void)
        return flags;
 }
-static inline void arch_local_irq_disable(void)
+static inline notrace void arch_local_irq_disable(void)
 {
        arch_local_irq_save();
 }
-static inline bool arch_irqs_disabled_flags(unsigned long flags)
+static inline notrace bool arch_irqs_disabled_flags(unsigned long flags)
 {
        return (flags & PSR_PIL) != 0;
 }
-static inline bool arch_irqs_disabled(void)
+static inline notrace bool arch_irqs_disabled(void)
 {
        return arch_irqs_disabled_flags(arch_local_save_flags());
 }
diff --git a/arch/sparc/include/asm/irqflags_64.h b/arch/sparc/include/asm/irqflags_64.h
index aab969c82c2b..23cd27f6beb4 100644
--- a/arch/sparc/include/asm/irqflags_64.h
+++ b/arch/sparc/include/asm/irqflags_64.h
@@ -14,7 +14,7 @@
 #ifndef __ASSEMBLY__
-static inline unsigned long arch_local_save_flags(void)
+static inline notrace unsigned long arch_local_save_flags(void)
 {
        unsigned long flags;
@@ -26,7 +26,7 @@ static inline unsigned long arch_local_save_flags(void)
        return flags;
 }
-static inline void arch_local_irq_restore(unsigned long flags)
+static inline notrace void arch_local_irq_restore(unsigned long flags)
 {
        __asm__ __volatile__(
                "wrpr   %0, %%pil"
@@ -36,7 +36,7 @@ static inline void arch_local_irq_restore(unsigned long flags)
        );
 }
-static inline void arch_local_irq_disable(void)
+static inline notrace void arch_local_irq_disable(void)
 {
        __asm__ __volatile__(
                "wrpr   %0, %%pil"
@@ -46,7 +46,7 @@ static inline void arch_local_irq_disable(void)
        );
 }
-static inline void arch_local_irq_enable(void)
+static inline notrace void arch_local_irq_enable(void)
 {
        __asm__ __volatile__(
                "wrpr   0, %%pil"
@@ -56,17 +56,17 @@ static inline void arch_local_irq_enable(void)
        );
 }
-static inline int arch_irqs_disabled_flags(unsigned long flags)
+static inline notrace int arch_irqs_disabled_flags(unsigned long flags)
 {
        return (flags > 0);
 }
-static inline int arch_irqs_disabled(void)
+static inline notrace int arch_irqs_disabled(void)
 {
        return arch_irqs_disabled_flags(arch_local_save_flags());
 }
-static inline unsigned long arch_local_irq_save(void)
+static inline notrace unsigned long arch_local_irq_save(void)
 {
        unsigned long flags, tmp;
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index 9fe08a1ea6c6..f445e98463e6 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -293,7 +293,7 @@ maybe_smp4m_msg:
        WRITE_PAUSE
        wr      %l4, PSR_ET, %psr
        WRITE_PAUSE
-        sll     %o3, 28, %o2            ! shift for simpler checks below
+        srl     %o3, 28, %o2            ! shift for simpler checks below
 maybe_smp4m_msg_check_single:
        andcc   %o2, 0x1, %g0
        beq,a   maybe_smp4m_msg_check_mask
diff --git a/arch/sparc/mm/leon_mm.c b/arch/sparc/mm/leon_mm.c
index c0e01297e64e..e485a6804998 100644
--- a/arch/sparc/mm/leon_mm.c
+++ b/arch/sparc/mm/leon_mm.c
@@ -226,7 +226,7 @@ void leon3_getCacheRegs(struct leon3_cacheregs *regs)
 * Leon2 and Leon3 differ in their way of telling cache information
 *
 */
-int leon_flush_needed(void)
+int __init leon_flush_needed(void)
 {
        int flush_needed = -1;
        unsigned int ssize, sets;
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index d865c4aeec55..bbaaa005bf0e 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -28,6 +28,7 @@
 #include <linux/poison.h>
 #include <linux/dma-mapping.h>
 #include <linux/module.h>
+#include <linux/memory.h>
 #include <linux/memory_hotplug.h>
 #include <linux/nmi.h>
 #include <linux/gfp.h>
@@ -895,8 +896,6 @@ const char *arch_vma_name(struct vm_area_struct *vma)
 }
 #ifdef CONFIG_X86_UV
-#define MIN_MEMORY_BLOCK_SIZE   (1 << SECTION_SIZE_BITS)
 unsigned long memory_block_size_bytes(void)
 {
        if (is_uv_system()) {
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index abda3786a5d7..181bc2f7bb74 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -139,13 +139,23 @@ static int __init hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
        struct platform_device *ghes_dev;
        struct ghes_arr *ghes_arr = data;
-        int rc;
+        int rc, i;
        if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                return 0;
        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                return 0;
+        for (i = 0; i < ghes_arr->count; i++) {
+                struct acpi_hest_header *hdr;
+                ghes_dev = ghes_arr->ghes_devs[i];
+                hdr = *(struct acpi_hest_header **)ghes_dev->dev.platform_data;
+                if (hdr->source_id == hest_hdr->source_id) {
+                        pr_warning(FW_WARN HEST_PFX "Duplicated hardware error source ID: %d.\n",
+                                   hdr->source_id);
+                        return -EIO;
+                }
+        }
        ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
        if (!ghes_dev)
                return -ENOMEM;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 52ca9649d769..372f9b70f7f4 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1333,23 +1333,6 @@ int acpi_resources_are_enforced(void)
 EXPORT_SYMBOL(acpi_resources_are_enforced);
 /*
- * Create and initialize a spinlock.
- */
-acpi_status
-acpi_os_create_lock(acpi_spinlock *out_handle)
-{
-        spinlock_t *lock;
-        lock = ACPI_ALLOCATE(sizeof(spinlock_t));
-        if (!lock)
-                return AE_NO_MEMORY;
-        spin_lock_init(lock);
-        *out_handle = lock;
-        return AE_OK;
-}
-/*
 * Deallocate the memory for a spinlock.
 */
 void acpi_os_delete_lock(acpi_spinlock handle)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 9f9b2359f718..45d7c8fc73bd 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -30,7 +30,6 @@
 static DEFINE_MUTEX(mem_sysfs_mutex);
 #define MEMORY_CLASS_NAME       "memory"
-#define MIN_MEMORY_BLOCK_SIZE   (1 << SECTION_SIZE_BITS)
 static int sections_per_block;
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index 999803ce10dc..5da67f165afa 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -90,9 +90,10 @@
 #define G4x_GMCH_SIZE_MASK      (0xf << 8)
 #define G4x_GMCH_SIZE_1M        (0x1 << 8)
 #define G4x_GMCH_SIZE_2M        (0x3 << 8)
-#define G4x_GMCH_SIZE_VT_1M     (0x9 << 8)
+#define G4x_GMCH_SIZE_VT_EN     (0x8 << 8)
-#define G4x_GMCH_SIZE_VT_1_5M   (0xa << 8)
+#define G4x_GMCH_SIZE_VT_1M     (G4x_GMCH_SIZE_1M | G4x_GMCH_SIZE_VT_EN)
-#define G4x_GMCH_SIZE_VT_2M     (0xc << 8)
+#define G4x_GMCH_SIZE_VT_1_5M   ((0x2 << 8) | G4x_GMCH_SIZE_VT_EN)
+#define G4x_GMCH_SIZE_VT_2M     (G4x_GMCH_SIZE_2M | G4x_GMCH_SIZE_VT_EN)
 #define GFX_FLSH_CNTL           0x2170 /* 915+ */
diff --git a/drivers/gpio/wm831x-gpio.c b/drivers/gpio/wm831x-gpio.c
index 309644cf4d9b..2bcfb0be09ff 100644
--- a/drivers/gpio/wm831x-gpio.c
+++ b/drivers/gpio/wm831x-gpio.c
@@ -180,6 +180,7 @@ static void wm831x_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
                        break;
                case WM831X_GPIO_PULL_UP:
                        pull = "pullup";
+                        break;
                default:
                        pull = "INVALID PULL";
                        break;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index e1787022d6c8..296fbd66f0e1 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1943,7 +1943,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (!dev_priv->mm.gtt) {
                DRM_ERROR("Failed to initialize GTT\n");
                ret = -ENODEV;
-                goto out_iomapfree;
+                goto out_rmmap;
        }
        agp_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
@@ -1987,7 +1987,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (dev_priv->wq == NULL) {
                DRM_ERROR("Failed to create our workqueue.\n");
                ret = -ENOMEM;
-                goto out_iomapfree;
+                goto out_mtrrfree;
        }
        /* enable GEM by default */
@@ -2074,13 +2074,21 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        return 0;
 out_gem_unload:
+        if (dev_priv->mm.inactive_shrinker.shrink)
+                unregister_shrinker(&dev_priv->mm.inactive_shrinker);
        if (dev->pdev->msi_enabled)
                pci_disable_msi(dev->pdev);
        intel_teardown_gmbus(dev);
        intel_teardown_mchbar(dev);
        destroy_workqueue(dev_priv->wq);
-out_iomapfree:
+out_mtrrfree:
+        if (dev_priv->mm.gtt_mtrr >= 0) {
+                mtrr_del(dev_priv->mm.gtt_mtrr, dev->agp->base,
+                         dev->agp->agp_info.aper_size * 1024 * 1024);
+                dev_priv->mm.gtt_mtrr = -1;
+        }
        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
        pci_iounmap(dev->pdev, dev_priv->regs);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 013d304455b9..eb91e2dd7914 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -52,7 +52,7 @@ module_param_named(powersave, i915_powersave, int, 0600);
 unsigned int i915_semaphores = 0;
 module_param_named(semaphores, i915_semaphores, int, 0600);
-unsigned int i915_enable_rc6 = 1;
+unsigned int i915_enable_rc6 = 0;
 module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 unsigned int i915_enable_fbc = 0;
@@ -577,6 +577,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
        if (get_seconds() - dev_priv->last_gpu_reset < 5) {
                DRM_ERROR("GPU hanging too fast, declaring wedged!\n");
        } else switch (INTEL_INFO(dev)->gen) {
+        case 7:
        case 6:
                ret = gen6_do_reset(dev, flags);
                /* If reset with a user forcewake, try to restore */
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 391b55f1cc74..e2aced6eec4c 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -50,7 +50,6 @@ struct intel_dp {
        bool has_audio;
        int force_audio;
        uint32_t color_range;
-        int dpms_mode;
        uint8_t link_bw;
        uint8_t lane_count;
        uint8_t dpcd[4];
@@ -138,8 +137,8 @@ intel_dp_max_lane_count(struct intel_dp *intel_dp)
 {
        int max_lane_count = 4;
-        if (intel_dp->dpcd[0] >= 0x11) {
+        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11) {
-                max_lane_count = intel_dp->dpcd[2] & 0x1f;
+                max_lane_count = intel_dp->dpcd[DP_MAX_LANE_COUNT] & 0x1f;
                switch (max_lane_count) {
                case 1: case 2: case 4:
                        break;
@@ -153,7 +152,7 @@ intel_dp_max_lane_count(struct intel_dp *intel_dp)
 static int
 intel_dp_max_link_bw(struct intel_dp *intel_dp)
 {
-        int max_link_bw = intel_dp->dpcd[1];
+        int max_link_bw = intel_dp->dpcd[DP_MAX_LINK_RATE];
        switch (max_link_bw) {
        case DP_LINK_BW_1_62:
@@ -774,7 +773,8 @@ intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
        /*
         * Check for DPCD version > 1.1 and enhanced framing support
         */
-        if (intel_dp->dpcd[0] >= 0x11 && (intel_dp->dpcd[2] & DP_ENHANCED_FRAME_CAP)) {
+        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11 &&
+            (intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_ENHANCED_FRAME_CAP)) {
                intel_dp->link_configuration[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
                intel_dp->DP |= DP_ENHANCED_FRAMING;
        }
@@ -942,11 +942,44 @@ static void ironlake_edp_pll_off(struct drm_encoder *encoder)
        udelay(200);
 }
+/* If the sink supports it, try to set the power state appropriately */
+static void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode)
+{
+        int ret, i;
+        /* Should have a valid DPCD by this point */
+        if (intel_dp->dpcd[DP_DPCD_REV] < 0x11)
+                return;
+        if (mode != DRM_MODE_DPMS_ON) {
+                ret = intel_dp_aux_native_write_1(intel_dp, DP_SET_POWER,
+                                                  DP_SET_POWER_D3);
+                if (ret != 1)
+                        DRM_DEBUG_DRIVER("failed to write sink power state\n");
+        } else {
+                /*
+                 * When turning on, we need to retry for 1ms to give the sink
+                 * time to wake up.
+                 */
+                for (i = 0; i < 3; i++) {
+                        ret = intel_dp_aux_native_write_1(intel_dp,
+                                                          DP_SET_POWER,
+                                                          DP_SET_POWER_D0);
+                        if (ret == 1)
+                                break;
+                        msleep(1);
+                }
+        }
+}
 static void intel_dp_prepare(struct drm_encoder *encoder)
 {
        struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
        struct drm_device *dev = encoder->dev;
+        /* Wake up the sink first */
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
        if (is_edp(intel_dp)) {
                ironlake_edp_backlight_off(dev);
                ironlake_edp_panel_off(dev);
@@ -990,6 +1023,7 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
        if (mode != DRM_MODE_DPMS_ON) {
                if (is_edp(intel_dp))
                        ironlake_edp_backlight_off(dev);
+                intel_dp_sink_dpms(intel_dp, mode);
                intel_dp_link_down(intel_dp);
                if (is_edp(intel_dp))
                        ironlake_edp_panel_off(dev);
@@ -998,6 +1032,7 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
        } else {
                if (is_edp(intel_dp))
                        ironlake_edp_panel_vdd_on(intel_dp);
+                intel_dp_sink_dpms(intel_dp, mode);
                if (!(dp_reg & DP_PORT_EN)) {
                        intel_dp_start_link_train(intel_dp);
                        if (is_edp(intel_dp)) {
@@ -1009,7 +1044,31 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
                if (is_edp(intel_dp))
                        ironlake_edp_backlight_on(dev);
        }
-        intel_dp->dpms_mode = mode;
+}
+/*
+ * Native read with retry for link status and receiver capability reads for
+ * cases where the sink may still be asleep.
+ */
+static bool
+intel_dp_aux_native_read_retry(struct intel_dp *intel_dp, uint16_t address,
+                               uint8_t *recv, int recv_bytes)
+{
+        int ret, i;
+        /*
+         * Sinks are *supposed* to come up within 1ms from an off state,
+         * but we're also supposed to retry 3 times per the spec.
+         */
+        for (i = 0; i < 3; i++) {
+                ret = intel_dp_aux_native_read(intel_dp, address, recv,
+                                               recv_bytes);
+                if (ret == recv_bytes)
+                        return true;
+                msleep(1);
+        }
+        return false;
 }
 /*
@@ -1019,14 +1078,10 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
 static bool
 intel_dp_get_link_status(struct intel_dp *intel_dp)
 {
-        int ret;
+        return intel_dp_aux_native_read_retry(intel_dp,
+                                              DP_LANE0_1_STATUS,
-        ret = intel_dp_aux_native_read(intel_dp,
+                                              intel_dp->link_status,
-                                       DP_LANE0_1_STATUS,
+                                              DP_LINK_STATUS_SIZE);
-                                       intel_dp->link_status, DP_LINK_STATUS_SIZE);
-        if (ret != DP_LINK_STATUS_SIZE)
-                return false;
-        return true;
 }
 static uint8_t
@@ -1515,6 +1570,8 @@ intel_dp_link_down(struct intel_dp *intel_dp)
 static void
 intel_dp_check_link_status(struct intel_dp *intel_dp)
 {
+        int ret;
        if (!intel_dp->base.base.crtc)
                return;
@@ -1523,6 +1580,15 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
                return;
        }
+        /* Try to read receiver status if the link appears to be up */
+        ret = intel_dp_aux_native_read(intel_dp,
+                                       0x000, intel_dp->dpcd,
+                                       sizeof (intel_dp->dpcd));
+        if (ret != sizeof(intel_dp->dpcd)) {
+                intel_dp_link_down(intel_dp);
+                return;
+        }
        if (!intel_channel_eq_ok(intel_dp)) {
                intel_dp_start_link_train(intel_dp);
                intel_dp_complete_link_train(intel_dp);
@@ -1533,6 +1599,7 @@ static enum drm_connector_status
 ironlake_dp_detect(struct intel_dp *intel_dp)
 {
        enum drm_connector_status status;
+        bool ret;
        /* Can't disconnect eDP, but you can close the lid... */
        if (is_edp(intel_dp)) {
@@ -1543,13 +1610,11 @@ ironlake_dp_detect(struct intel_dp *intel_dp)
        }
        status = connector_status_disconnected;
-        if (intel_dp_aux_native_read(intel_dp,
+        ret = intel_dp_aux_native_read_retry(intel_dp,
-                                     0x000, intel_dp->dpcd,
+                                             0x000, intel_dp->dpcd,
-                                     sizeof (intel_dp->dpcd))
+                                             sizeof (intel_dp->dpcd));
-            == sizeof(intel_dp->dpcd)) {
+        if (ret && intel_dp->dpcd[DP_DPCD_REV] != 0)
-                if (intel_dp->dpcd[0] != 0)
+                status = connector_status_connected;
-                        status = connector_status_connected;
-        }
        DRM_DEBUG_KMS("DPCD: %hx%hx%hx%hx\n", intel_dp->dpcd[0],
                      intel_dp->dpcd[1], intel_dp->dpcd[2], intel_dp->dpcd[3]);
        return status;
@@ -1586,7 +1651,7 @@ g4x_dp_detect(struct intel_dp *intel_dp)
        if (intel_dp_aux_native_read(intel_dp, 0x000, intel_dp->dpcd,
                                     sizeof (intel_dp->dpcd)) == sizeof (intel_dp->dpcd))
        {
-                if (intel_dp->dpcd[0] != 0)
+                if (intel_dp->dpcd[DP_DPCD_REV] != 0)
                        status = connector_status_connected;
        }
@@ -1790,8 +1855,7 @@ intel_dp_hot_plug(struct intel_encoder *intel_encoder)
 {
        struct intel_dp *intel_dp = container_of(intel_encoder, struct intel_dp, base);
-        if (intel_dp->dpms_mode == DRM_MODE_DPMS_ON)
+        intel_dp_check_link_status(intel_dp);
-                intel_dp_check_link_status(intel_dp);
 }
 /* Return which DP Port should be selected for Transcoder DP control */
@@ -1859,7 +1923,6 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                return;
        intel_dp->output_reg = output_reg;
-        intel_dp->dpms_mode = -1;
        intel_connector = kzalloc(sizeof(struct intel_connector), GFP_KERNEL);
        if (!intel_connector) {
@@ -1954,8 +2017,9 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                                               sizeof(intel_dp->dpcd));
                ironlake_edp_panel_vdd_off(intel_dp);
                if (ret == sizeof(intel_dp->dpcd)) {
-                        if (intel_dp->dpcd[0] >= 0x11)
+                        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11)
-                                dev_priv->no_aux_handshake = intel_dp->dpcd[3] &
+                                dev_priv->no_aux_handshake =
+                                        intel_dp->dpcd[DP_MAX_DOWNSPREAD] &
                                        DP_NO_AUX_HANDSHAKE_LINK_TRAINING;
                } else {
                        /* if this fails, presume the device is a ghost */
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index c0e0ee63fbf4..39ac2b634ae5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -165,7 +165,7 @@ void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring);
 int __must_check intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n);
 static inline int intel_wait_ring_idle(struct intel_ring_buffer *ring)
 {
-        return intel_wait_ring_buffer(ring, ring->space - 8);
+        return intel_wait_ring_buffer(ring, ring->size - 8);
 }
 int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 660f96401a05..15bd0477a3e8 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2000,7 +2000,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                        gb_backend_map = 0x66442200;
                        break;
                case CHIP_JUNIPER:
-                        gb_backend_map = 0x00006420;
+                        gb_backend_map = 0x00002200;
                        break;
                default:
                        gb_backend_map =
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index 57f3bc17b87e..2eb251858e72 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -252,7 +252,7 @@ draw_auto(struct radeon_device *rdev)
 }
-/* emits 36 */
+/* emits 39 */
 static void
 set_default_state(struct radeon_device *rdev)
 {
@@ -531,6 +531,11 @@ set_default_state(struct radeon_device *rdev)
                radeon_ring_write(rdev, (SQ_DYN_GPR_CNTL_PS_FLUSH_REQ - PACKET3_SET_CONFIG_REG_START) >> 2);
                radeon_ring_write(rdev, 0);
+                /* setup LDS */
+                radeon_ring_write(rdev, PACKET3(PACKET3_SET_CONFIG_REG, 1));
+                radeon_ring_write(rdev, (SQ_LDS_RESOURCE_MGMT - PACKET3_SET_CONFIG_REG_START) >> 2);
+                radeon_ring_write(rdev, 0x10001000);
                /* SQ config */
                radeon_ring_write(rdev, PACKET3(PACKET3_SET_CONFIG_REG, 11));
                radeon_ring_write(rdev, (SQ_CONFIG - PACKET3_SET_CONFIG_REG_START) >> 2);
@@ -773,7 +778,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
        /* calculate number of loops correctly */
        ring_size = num_loops * dwords_per_loop;
        /* set default  + shaders */
-        ring_size += 52; /* shaders + def state */
+        ring_size += 55; /* shaders + def state */
        ring_size += 10; /* fence emit for VB IB */
        ring_size += 5; /* done copy */
        ring_size += 10; /* fence emit for done copy */
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 3fc5fa1aefd0..229a20f10e2b 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -331,7 +331,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        seprom_cntl1 = RREG32(RADEON_SEPROM_CNTL1);
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(RV370_BUS_CNTL);
        d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
        d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
        vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -350,7 +350,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(RV370_BUS_CNTL, (bus_cntl & ~RV370_BUS_BIOS_DIS_ROM));
        /* Disable VGA mode */
        WREG32(AVIVO_D1VGA_CONTROL,
@@ -367,7 +367,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        /* restore regs */
        WREG32(RADEON_SEPROM_CNTL1, seprom_cntl1);
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(RV370_BUS_CNTL, bus_cntl);
        WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
        WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
        WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
@@ -390,7 +390,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        seprom_cntl1 = RREG32(RADEON_SEPROM_CNTL1);
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        if (rdev->flags & RADEON_IS_PCIE)
+                bus_cntl = RREG32(RV370_BUS_CNTL);
+        else
+                bus_cntl = RREG32(RADEON_BUS_CNTL);
        crtc_gen_cntl = RREG32(RADEON_CRTC_GEN_CNTL);
        crtc2_gen_cntl = 0;
        crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
@@ -412,7 +415,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        if (rdev->flags & RADEON_IS_PCIE)
+                WREG32(RV370_BUS_CNTL, (bus_cntl & ~RV370_BUS_BIOS_DIS_ROM));
+        else
+                WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
        /* Turn off mem requests and CRTC for both controllers */
        WREG32(RADEON_CRTC_GEN_CNTL,
@@ -439,7 +445,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        /* restore regs */
        WREG32(RADEON_SEPROM_CNTL1, seprom_cntl1);
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        if (rdev->flags & RADEON_IS_PCIE)
+                WREG32(RV370_BUS_CNTL, bus_cntl);
+        else
+                WREG32(RADEON_BUS_CNTL, bus_cntl);
        WREG32(RADEON_CRTC_GEN_CNTL, crtc_gen_cntl);
        if (!(rdev->flags & RADEON_SINGLE_CRTC)) {
                WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index cbfca3a24fdf..9792d4ffdc86 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -52,6 +52,12 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        /* bail if the connector does not have hpd pin, e.g.,
+         * VGA, TV, etc.
+         */
+        if (radeon_connector->hpd.hpd == RADEON_HPD_NONE)
+                return;
        radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
        /* powering up/down the eDP panel generates hpd events which
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index ec93a75369e6..bc44a3d35ec6 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -300,6 +300,8 @@
 #       define RADEON_BUS_READ_BURST         (1 << 30)
 #define RADEON_BUS_CNTL1                    0x0034
 #       define RADEON_BUS_WAIT_ON_LOCK_EN    (1 << 4)
+#define RV370_BUS_CNTL                      0x004c
+#       define RV370_BUS_BIOS_DIS_ROM        (1 << 2)
 /* rv370/rv380, rv410, r423/r430/r480, r5xx */
 #define RADEON_MSI_REARM_EN                 0x0160
 #       define RV370_MSI_REARM_EN            (1 << 0)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 6e3b11e5abbe..1f5850e473cc 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -426,7 +426,7 @@ int rs600_gart_init(struct radeon_device *rdev)
        return radeon_gart_table_vram_alloc(rdev);
 }
-int rs600_gart_enable(struct radeon_device *rdev)
+static int rs600_gart_enable(struct radeon_device *rdev)
 {
        u32 tmp;
        int r, i;
@@ -440,8 +440,8 @@ int rs600_gart_enable(struct radeon_device *rdev)
                return r;
        radeon_gart_restore(rdev);
        /* Enable bus master */
-        tmp = RREG32(R_00004C_BUS_CNTL) & C_00004C_BUS_MASTER_DIS;
+        tmp = RREG32(RADEON_BUS_CNTL) & ~RS600_BUS_MASTER_DIS;
-        WREG32(R_00004C_BUS_CNTL, tmp);
+        WREG32(RADEON_BUS_CNTL, tmp);
        /* FIXME: setup default page */
        WREG32_MC(R_000100_MC_PT0_CNTL,
                  (S_000100_EFFECTIVE_L2_CACHE_SIZE(6) |
diff --git a/drivers/hwmon/adm1275.c b/drivers/hwmon/adm1275.c
index b9b7caf4a1d2..8bc1bd663721 100644
--- a/drivers/hwmon/adm1275.c
+++ b/drivers/hwmon/adm1275.c
@@ -53,23 +53,23 @@ static int adm1275_probe(struct i2c_client *client,
        info->direct[PSC_VOLTAGE_IN] = true;
        info->direct[PSC_VOLTAGE_OUT] = true;
        info->direct[PSC_CURRENT_OUT] = true;
-        info->m[PSC_CURRENT_OUT] = 800;
+        info->m[PSC_CURRENT_OUT] = 807;
        info->b[PSC_CURRENT_OUT] = 20475;
        info->R[PSC_CURRENT_OUT] = -1;
        info->func[0] = PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT;
        if (config & ADM1275_VRANGE) {
-                info->m[PSC_VOLTAGE_IN] = 19045;
+                info->m[PSC_VOLTAGE_IN] = 19199;
                info->b[PSC_VOLTAGE_IN] = 0;
                info->R[PSC_VOLTAGE_IN] = -2;
-                info->m[PSC_VOLTAGE_OUT] = 19045;
+                info->m[PSC_VOLTAGE_OUT] = 19199;
                info->b[PSC_VOLTAGE_OUT] = 0;
                info->R[PSC_VOLTAGE_OUT] = -2;
        } else {
-                info->m[PSC_VOLTAGE_IN] = 6666;
+                info->m[PSC_VOLTAGE_IN] = 6720;
                info->b[PSC_VOLTAGE_IN] = 0;
                info->R[PSC_VOLTAGE_IN] = -1;
-                info->m[PSC_VOLTAGE_OUT] = 6666;
+                info->m[PSC_VOLTAGE_OUT] = 6720;
                info->b[PSC_VOLTAGE_OUT] = 0;
                info->R[PSC_VOLTAGE_OUT] = -1;
        }
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index dcb78a7a8047..00e98517f94c 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -674,6 +674,7 @@ static int atk_debugfs_gitm_get(void *p, u64 *val)
        else
                err = -EIO;
+        ACPI_FREE(ret);
        return err;
 }
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index bb6405b92007..5f5247750430 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -1538,7 +1538,7 @@ static struct attribute *it87_attributes_label[] = {
 };
 static const struct attribute_group it87_group_label = {
-        .attrs = it87_attributes_vid,
+        .attrs = it87_attributes_label,
 };
 /* SuperIO detection - will change isa_address if a chip is found */
diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
index 12a54aa29776..14335bbc9bdc 100644
--- a/drivers/hwmon/max1111.c
+++ b/drivers/hwmon/max1111.c
@@ -40,6 +40,8 @@ struct max1111_data {
        struct spi_transfer     xfer[2];
        uint8_t *tx_buf;
        uint8_t *rx_buf;
+        struct mutex            drvdata_lock;
+        /* protect msg, xfer and buffers from multiple access */
 };
 static int max1111_read(struct device *dev, int channel)
@@ -48,6 +50,9 @@ static int max1111_read(struct device *dev, int channel)
        uint8_t v1, v2;
        int err;
+        /* writing to drvdata struct is not thread safe, wait on mutex */
+        mutex_lock(&data->drvdata_lock);
        data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
                MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
                MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
@@ -55,12 +60,15 @@ static int max1111_read(struct device *dev, int channel)
        err = spi_sync(data->spi, &data->msg);
        if (err < 0) {
                dev_err(dev, "spi_sync failed with %d\n", err);
+                mutex_unlock(&data->drvdata_lock);
                return err;
        }
        v1 = data->rx_buf[0];
        v2 = data->rx_buf[1];
+        mutex_unlock(&data->drvdata_lock);
        if ((v1 & 0xc0) || (v2 & 0x3f))
                return -EINVAL;
@@ -176,6 +184,8 @@ static int __devinit max1111_probe(struct spi_device *spi)
        if (err)
                goto err_free_data;
+        mutex_init(&data->drvdata_lock);
        data->spi = spi;
        spi_set_drvdata(spi, data);
@@ -213,6 +223,7 @@ static int __devexit max1111_remove(struct spi_device *spi)
        hwmon_device_unregister(data->hwmon_dev);
        sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
+        mutex_destroy(&data->drvdata_lock);
        kfree(data->rx_buf);
        kfree(data->tx_buf);
        kfree(data);
diff --git a/drivers/hwmon/pmbus_core.c b/drivers/hwmon/pmbus_core.c
index 744672c1f26d..8e31a8e2c746 100644
--- a/drivers/hwmon/pmbus_core.c
+++ b/drivers/hwmon/pmbus_core.c
@@ -362,8 +362,8 @@ static struct pmbus_data *pmbus_update_device(struct device *dev)
 * Convert linear sensor values to milli- or micro-units
 * depending on sensor type.
 */
-static int pmbus_reg2data_linear(struct pmbus_data *data,
+static long pmbus_reg2data_linear(struct pmbus_data *data,
-                                 struct pmbus_sensor *sensor)
+                                  struct pmbus_sensor *sensor)
 {
        s16 exponent;
        s32 mantissa;
@@ -397,15 +397,15 @@ static int pmbus_reg2data_linear(struct pmbus_data *data,
        else
                val >>= -exponent;
-        return (int)val;
+        return val;
 }
 /*
 * Convert direct sensor values to milli- or micro-units
 * depending on sensor type.
 */
-static int pmbus_reg2data_direct(struct pmbus_data *data,
+static long pmbus_reg2data_direct(struct pmbus_data *data,
-                                 struct pmbus_sensor *sensor)
+                                  struct pmbus_sensor *sensor)
 {
        long val = (s16) sensor->data;
        long m, b, R;
@@ -440,12 +440,12 @@ static int pmbus_reg2data_direct(struct pmbus_data *data,
                R++;
        }
-        return (int)((val - b) / m);
+        return (val - b) / m;
 }
-static int pmbus_reg2data(struct pmbus_data *data, struct pmbus_sensor *sensor)
+static long pmbus_reg2data(struct pmbus_data *data, struct pmbus_sensor *sensor)
 {
-        int val;
+        long val;
        if (data->info->direct[sensor->class])
                val = pmbus_reg2data_direct(data, sensor);
@@ -619,7 +619,7 @@ static int pmbus_get_boolean(struct pmbus_data *data, int index, int *val)
        if (!s1 && !s2)
                *val = !!regval;
        else {
-                int v1, v2;
+                long v1, v2;
                struct pmbus_sensor *sensor1, *sensor2;
                sensor1 = &data->sensors[s1];
@@ -661,7 +661,7 @@ static ssize_t pmbus_show_sensor(struct device *dev,
        if (sensor->data < 0)
                return sensor->data;
-        return snprintf(buf, PAGE_SIZE, "%d\n", pmbus_reg2data(data, sensor));
+        return snprintf(buf, PAGE_SIZE, "%ld\n", pmbus_reg2data(data, sensor));
 }
 static ssize_t pmbus_set_sensor(struct device *dev,
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 98278041d75f..5b6b451d4694 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -1988,6 +1988,14 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
        if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl) {
                if ((ret = fe->ops.ts_bus_ctrl(fe, 1)) < 0)
                        goto err0;
+                /* If we took control of the bus, we need to force
+                   reinitialization.  This is because many ts_bus_ctrl()
+                   functions strobe the RESET pin on the demod, and if the
+                   frontend thread already exists then the dvb_init() routine
+                   won't get called (which is what usually does initial
+                   register configuration). */
+                fepriv->reinitialise = 1;
        }
        if ((ret = dvb_generic_open (inode, file)) < 0)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index e4c97fd6f05a..52798a111e16 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -168,7 +168,7 @@ config RADIO_MAXIRADIO
 config RADIO_MIROPCM20
        tristate "miroSOUND PCM20 radio"
-        depends on ISA && VIDEO_V4L2 && SND
+        depends on ISA && ISA_DMA_API && VIDEO_V4L2 && SND
        select SND_ISA
        select SND_MIRO
        ---help---
@@ -201,7 +201,7 @@ config RADIO_SF16FMI
 config RADIO_SF16FMR2
        tristate "SF16FMR2 Radio"
-        depends on ISA && VIDEO_V4L2
+        depends on ISA && VIDEO_V4L2 && SND
        ---help---
          Choose Y here if you have one of these FM radio cards.
diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c
index deca2e06ff22..c9f4a8e65dc4 100644
--- a/drivers/media/radio/si4713-i2c.c
+++ b/drivers/media/radio/si4713-i2c.c
@@ -1033,7 +1033,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
                char ps_name[MAX_RDS_PS_NAME + 1];
                len = control->size - 1;
-                if (len > MAX_RDS_PS_NAME) {
+                if (len < 0 || len > MAX_RDS_PS_NAME) {
                        rval = -ERANGE;
                        goto exit;
                }
@@ -1057,7 +1057,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
                char radio_text[MAX_RDS_RADIO_TEXT + 1];
                len = control->size - 1;
-                if (len > MAX_RDS_RADIO_TEXT) {
+                if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
                        rval = -ERANGE;
                        goto exit;
                }
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 06dfe0957b5e..ec972dc25790 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -558,9 +558,10 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, char *buf,
                                 inout, data1);
                        break;
                case MCE_CMD_S_TIMEOUT:
-                        /* value is in units of 50us, so x*50/100 or x/2 ms */
+                        /* value is in units of 50us, so x*50/1000 ms */
                        dev_info(dev, "%s receive timeout of %d ms\n",
-                                 inout, ((data1 << 8) | data2) / 2);
+                                 inout,
+                                 ((data1 << 8) | data2) * MCE_TIME_UNIT / 1000);
                        break;
                case MCE_CMD_G_TIMEOUT:
                        dev_info(dev, "Get receive timeout\n");
@@ -847,7 +848,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
        switch (ir->buf_in[index]) {
        /* 2-byte return value commands */
        case MCE_CMD_S_TIMEOUT:
-                ir->rc->timeout = US_TO_NS((hi << 8 | lo) / 2);
+                ir->rc->timeout = US_TO_NS((hi << 8 | lo) * MCE_TIME_UNIT);
                break;
        /* 1-byte return value commands */
@@ -1078,7 +1079,7 @@ static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir)
        rc->priv = ir;
        rc->driver_type = RC_DRIVER_IR_RAW;
        rc->allowed_protos = RC_TYPE_ALL;
-        rc->timeout = US_TO_NS(1000);
+        rc->timeout = MS_TO_NS(100);
        if (!ir->flags.no_tx) {
                rc->s_tx_mask = mceusb_set_tx_mask;
                rc->s_tx_carrier = mceusb_set_tx_carrier;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 565f24c20d77..ce595f9ab4c7 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -1110,7 +1110,7 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
        rdev->dev.parent = &pdev->dev;
        rdev->driver_name = NVT_DRIVER_NAME;
        rdev->map_name = RC_MAP_RC6_MCE;
-        rdev->timeout = US_TO_NS(1000);
+        rdev->timeout = MS_TO_NS(100);
        /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
        rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
 #if 0
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index 64d9b2136ff6..419777a832ee 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -2060,12 +2060,8 @@ static int __devinit cx23885_initdev(struct pci_dev *pci_dev,
                goto fail_irq;
        }
-        if (!pci_enable_msi(pci_dev))
+        err = request_irq(pci_dev->irq, cx23885_irq,
-                err = request_irq(pci_dev->irq, cx23885_irq,
+                          IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
-                                  IRQF_DISABLED, dev->name, dev);
-        else
-                err = request_irq(pci_dev->irq, cx23885_irq,
-                                  IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
        if (err < 0) {
                printk(KERN_ERR "%s: can't get IRQ %d\n",
                       dev->name, pci_dev->irq);
@@ -2114,7 +2110,6 @@ static void __devexit cx23885_finidev(struct pci_dev *pci_dev)
        /* unregister stuff */
        free_irq(pci_dev->irq, dev);
-        pci_disable_msi(pci_dev);
        cx23885_dev_unregister(dev);
        v4l2_device_unregister(v4l2_dev);
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index cfa9f7efe93d..a03945ab9f08 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -714,10 +714,19 @@ static int tuner_remove(struct i2c_client *client)
 * returns 0.
 * This function is needed for boards that have a separate tuner for
 * radio (like devices with tea5767).
+ * NOTE: mt20xx uses V4L2_TUNER_DIGITAL_TV and calls set_tv_freq to
+ *       select a TV frequency. So, t_mode = T_ANALOG_TV could actually
+ *       be used to represent a Digital TV too.
 */
 static inline int check_mode(struct tuner *t, enum v4l2_tuner_type mode)
 {
-        if ((1 << mode & t->mode_mask) == 0)
+        int t_mode;
+        if (mode == V4L2_TUNER_RADIO)
+                t_mode = T_RADIO;
+        else
+                t_mode = T_ANALOG_TV;
+        if ((t_mode & t->mode_mask) == 0)
                return -EINVAL;
        return 0;
@@ -984,7 +993,7 @@ static void tuner_status(struct dvb_frontend *fe)
        case V4L2_TUNER_RADIO:
                p = "radio";
                break;
-        case V4L2_TUNER_DIGITAL_TV:
+        case V4L2_TUNER_DIGITAL_TV: /* Used by mt20xx */
                p = "digital TV";
                break;
        case V4L2_TUNER_ANALOG_TV:
@@ -1135,9 +1144,8 @@ static int tuner_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
                return 0;
        if (vt->type == t->mode && analog_ops->get_afc)
                vt->afc = analog_ops->get_afc(&t->fe);
-        if (vt->type == V4L2_TUNER_ANALOG_TV)
+        if (t->mode != V4L2_TUNER_RADIO) {
                vt->capability |= V4L2_TUNER_CAP_NORM;
-        if (vt->type != V4L2_TUNER_RADIO) {
                vt->rangelow = tv_range[0] * 16;
                vt->rangehigh = tv_range[1] * 16;
                return 0;
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 2a7e43bc796d..aa7d1d79b8c5 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -247,12 +247,12 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                return 0;
        /* Version is coded in the CSD_STRUCTURE byte in the EXT_CSD register */
+        card->ext_csd.raw_ext_csd_structure = ext_csd[EXT_CSD_STRUCTURE];
        if (card->csd.structure == 3) {
-                int ext_csd_struct = ext_csd[EXT_CSD_STRUCTURE];
+                if (card->ext_csd.raw_ext_csd_structure > 2) {
-                if (ext_csd_struct > 2) {
                        printk(KERN_ERR "%s: unrecognised EXT_CSD structure "
                                "version %d\n", mmc_hostname(card->host),
-                                        ext_csd_struct);
+                                        card->ext_csd.raw_ext_csd_structure);
                        err = -EINVAL;
                        goto out;
                }
@@ -266,6 +266,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                goto out;
        }
+        card->ext_csd.raw_sectors[0] = ext_csd[EXT_CSD_SEC_CNT + 0];
+        card->ext_csd.raw_sectors[1] = ext_csd[EXT_CSD_SEC_CNT + 1];
+        card->ext_csd.raw_sectors[2] = ext_csd[EXT_CSD_SEC_CNT + 2];
+        card->ext_csd.raw_sectors[3] = ext_csd[EXT_CSD_SEC_CNT + 3];
        if (card->ext_csd.rev >= 2) {
                card->ext_csd.sectors =
                        ext_csd[EXT_CSD_SEC_CNT + 0] << 0 |
@@ -277,7 +281,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                if (card->ext_csd.sectors > (2u * 1024 * 1024 * 1024) / 512)
                        mmc_card_set_blockaddr(card);
        }
+        card->ext_csd.raw_card_type = ext_csd[EXT_CSD_CARD_TYPE];
        switch (ext_csd[EXT_CSD_CARD_TYPE] & EXT_CSD_CARD_TYPE_MASK) {
        case EXT_CSD_CARD_TYPE_DDR_52 | EXT_CSD_CARD_TYPE_52 |
             EXT_CSD_CARD_TYPE_26:
@@ -307,6 +311,11 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                        mmc_hostname(card->host));
        }
+        card->ext_csd.raw_s_a_timeout = ext_csd[EXT_CSD_S_A_TIMEOUT];
+        card->ext_csd.raw_erase_timeout_mult =
+                ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT];
+        card->ext_csd.raw_hc_erase_grp_size =
+                ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE];
        if (card->ext_csd.rev >= 3) {
                u8 sa_shift = ext_csd[EXT_CSD_S_A_TIMEOUT];
                card->ext_csd.part_config = ext_csd[EXT_CSD_PART_CONFIG];
@@ -334,6 +343,16 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                card->ext_csd.boot_size = ext_csd[EXT_CSD_BOOT_MULT] << 17;
        }
+        card->ext_csd.raw_hc_erase_gap_size =
+                ext_csd[EXT_CSD_PARTITION_ATTRIBUTE];
+        card->ext_csd.raw_sec_trim_mult =
+                ext_csd[EXT_CSD_SEC_TRIM_MULT];
+        card->ext_csd.raw_sec_erase_mult =
+                ext_csd[EXT_CSD_SEC_ERASE_MULT];
+        card->ext_csd.raw_sec_feature_support =
+                ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT];
+        card->ext_csd.raw_trim_mult =
+                ext_csd[EXT_CSD_TRIM_MULT];
        if (card->ext_csd.rev >= 4) {
                /*
                 * Enhanced area feature support -- check whether the eMMC
@@ -341,7 +360,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                 * area offset and size to user by adding sysfs interface.
                 */
                if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) &&
-                                (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
+                    (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
                        u8 hc_erase_grp_sz =
                                ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE];
                        u8 hc_wp_grp_sz =
@@ -401,17 +420,17 @@ static inline void mmc_free_ext_csd(u8 *ext_csd)
 }
-static int mmc_compare_ext_csds(struct mmc_card *card, u8 *ext_csd,
+static int mmc_compare_ext_csds(struct mmc_card *card, unsigned bus_width)
-                        unsigned bus_width)
 {
        u8 *bw_ext_csd;
        int err;
+        if (bus_width == MMC_BUS_WIDTH_1)
+                return 0;
        err = mmc_get_ext_csd(card, &bw_ext_csd);
-        if (err)
-                return err;
-        if ((ext_csd == NULL || bw_ext_csd == NULL)) {
+        if (err || bw_ext_csd == NULL) {
                if (bus_width != MMC_BUS_WIDTH_1)
                        err = -EINVAL;
                goto out;
@@ -421,35 +440,40 @@ static int mmc_compare_ext_csds(struct mmc_card *card, u8 *ext_csd,
                goto out;
        /* only compare read only fields */
-        err = (!(ext_csd[EXT_CSD_PARTITION_SUPPORT] ==
+        err = (!(card->ext_csd.raw_partition_support ==
                        bw_ext_csd[EXT_CSD_PARTITION_SUPPORT]) &&
-                (ext_csd[EXT_CSD_ERASED_MEM_CONT] ==
+                (card->ext_csd.raw_erased_mem_count ==
                        bw_ext_csd[EXT_CSD_ERASED_MEM_CONT]) &&
-                (ext_csd[EXT_CSD_REV] ==
+                (card->ext_csd.rev ==
                        bw_ext_csd[EXT_CSD_REV]) &&
-                (ext_csd[EXT_CSD_STRUCTURE] ==
+                (card->ext_csd.raw_ext_csd_structure ==
                        bw_ext_csd[EXT_CSD_STRUCTURE]) &&
-                (ext_csd[EXT_CSD_CARD_TYPE] ==
+                (card->ext_csd.raw_card_type ==
                        bw_ext_csd[EXT_CSD_CARD_TYPE]) &&
-                (ext_csd[EXT_CSD_S_A_TIMEOUT] ==
+                (card->ext_csd.raw_s_a_timeout ==
                        bw_ext_csd[EXT_CSD_S_A_TIMEOUT]) &&
-                (ext_csd[EXT_CSD_HC_WP_GRP_SIZE] ==
+                (card->ext_csd.raw_hc_erase_gap_size ==
                        bw_ext_csd[EXT_CSD_HC_WP_GRP_SIZE]) &&
-                (ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT] ==
+                (card->ext_csd.raw_erase_timeout_mult ==
                        bw_ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT]) &&
-                (ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE] ==
+                (card->ext_csd.raw_hc_erase_grp_size ==
                        bw_ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE]) &&
-                (ext_csd[EXT_CSD_SEC_TRIM_MULT] ==
+                (card->ext_csd.raw_sec_trim_mult ==
                        bw_ext_csd[EXT_CSD_SEC_TRIM_MULT]) &&
-                (ext_csd[EXT_CSD_SEC_ERASE_MULT] ==
+                (card->ext_csd.raw_sec_erase_mult ==
                        bw_ext_csd[EXT_CSD_SEC_ERASE_MULT]) &&
-                (ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT] ==
+                (card->ext_csd.raw_sec_feature_support ==
                        bw_ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT]) &&
-                (ext_csd[EXT_CSD_TRIM_MULT] ==
+                (card->ext_csd.raw_trim_mult ==
                        bw_ext_csd[EXT_CSD_TRIM_MULT]) &&
-                memcmp(&ext_csd[EXT_CSD_SEC_CNT],
+                (card->ext_csd.raw_sectors[0] ==
-                       &bw_ext_csd[EXT_CSD_SEC_CNT],
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 0]) &&
-                       4) != 0);
+                (card->ext_csd.raw_sectors[1] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 1]) &&
+                (card->ext_csd.raw_sectors[2] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 2]) &&
+                (card->ext_csd.raw_sectors[3] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 3]));
        if (err)
                err = -EINVAL;
@@ -770,7 +794,6 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                                 */
                                if (!(host->caps & MMC_CAP_BUS_WIDTH_TEST))
                                        err = mmc_compare_ext_csds(card,
-                                                ext_csd,
                                                bus_width);
                                else
                                        err = mmc_bus_test(card, bus_width);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index eafe44a528ac..63c22b0bb5ad 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1428,9 +1428,9 @@ out:
        return features;
 }
-#define BOND_VLAN_FEATURES      (NETIF_F_ALL_TX_OFFLOADS | \
+#define BOND_VLAN_FEATURES      (NETIF_F_ALL_CSUM | NETIF_F_SG | \
-                                 NETIF_F_SOFT_FEATURES | \
+                                 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
-                                 NETIF_F_LRO)
+                                 NETIF_F_HIGHDMA | NETIF_F_LRO)
 static void bond_compute_features(struct bonding *bond)
 {
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2dfcc8047847..dfa55f94ba7f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2289,6 +2289,23 @@ static int gfar_set_mac_address(struct net_device *dev)
        return 0;
 }
+/* Check if rx parser should be activated */
+void gfar_check_rx_parser_mode(struct gfar_private *priv)
+{
+        struct gfar __iomem *regs;
+        u32 tempval;
+        regs = priv->gfargrp[0].regs;
+        tempval = gfar_read(&regs->rctrl);
+        /* If parse is no longer required, then disable parser */
+        if (tempval & RCTRL_REQ_PARSER)
+                tempval |= RCTRL_PRSDEP_INIT;
+        else
+                tempval &= ~RCTRL_PRSDEP_INIT;
+        gfar_write(&regs->rctrl, tempval);
+}
 /* Enables and disables VLAN insertion/extraction */
 static void gfar_vlan_rx_register(struct net_device *dev,
@@ -2325,12 +2342,9 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                /* Disable VLAN tag extraction */
                tempval = gfar_read(&regs->rctrl);
                tempval &= ~RCTRL_VLEX;
-                /* If parse is no longer required, then disable parser */
-                if (tempval & RCTRL_REQ_PARSER)
-                        tempval |= RCTRL_PRSDEP_INIT;
-                else
-                        tempval &= ~RCTRL_PRSDEP_INIT;
                gfar_write(&regs->rctrl, tempval);
+                gfar_check_rx_parser_mode(priv);
        }
        gfar_change_mtu(dev, dev->mtu);
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index ba36dc7a3435..440e69d8beff 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -274,7 +274,7 @@ extern const char gfar_driver_version[];
 #define RCTRL_PROM              0x00000008
 #define RCTRL_EMEN              0x00000002
 #define RCTRL_REQ_PARSER        (RCTRL_VLEX | RCTRL_IPCSEN | \
-                                 RCTRL_TUCSEN)
+                                 RCTRL_TUCSEN | RCTRL_FILREN)
 #define RCTRL_CHECKSUMMING      (RCTRL_IPCSEN | RCTRL_TUCSEN | \
                                RCTRL_PRSDEP_INIT)
 #define RCTRL_EXTHASH           (RCTRL_GHTX)
@@ -1156,6 +1156,7 @@ extern void gfar_configure_coalescing(struct gfar_private *priv,
                unsigned long tx_mask, unsigned long rx_mask);
 void gfar_init_sysfs(struct net_device *dev);
 int gfar_set_features(struct net_device *dev, u32 features);
+extern void gfar_check_rx_parser_mode(struct gfar_private *priv);
 extern const struct ethtool_ops gfar_ethtool_ops;
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 8f8b65af9ed5..60f46bc2bf64 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -140,7 +140,7 @@ MODULE_LICENSE("GPL");
 module_param(mtu, int, 0);
 module_param(debug, int, 0);
 module_param(rx_copybreak, int, 0);
-module_param(dspcfg_workaround, int, 1);
+module_param(dspcfg_workaround, int, 0);
 module_param_array(options, int, NULL, 0);
 module_param_array(full_duplex, int, NULL, 0);
 MODULE_PARM_DESC(mtu, "DP8381x MTU (all boards)");
@@ -2028,8 +2028,8 @@ static void drain_rx(struct net_device *dev)
                np->rx_ring[i].cmd_status = 0;
                np->rx_ring[i].addr = cpu_to_le32(0xBADF00D0); /* An invalid address. */
                if (np->rx_skbuff[i]) {
-                        pci_unmap_single(np->pci_dev,
+                        pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                                np->rx_dma[i], buflen,
+                                buflen + NATSEMI_PADDING,
                                PCI_DMA_FROMDEVICE);
                        dev_kfree_skb(np->rx_skbuff[i]);
                }
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 718879b35b7d..bc9a4bb31980 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -348,8 +348,9 @@ static int pppoe_device_event(struct notifier_block *this,
        /* Only look at sockets that are using this specific device. */
        switch (event) {
+        case NETDEV_CHANGEADDR:
        case NETDEV_CHANGEMTU:
-                /* A change in mtu is a bad thing, requiring
+                /* A change in mtu or address is a bad thing, requiring
                 * LCP re-negotiation.
                 */
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 200a363c3bf5..0ffec4608441 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -677,9 +677,11 @@ static irqreturn_t r6040_interrupt(int irq, void *dev_id)
                if (status & RX_FIFO_FULL)
                        dev->stats.rx_fifo_errors++;
-                /* Mask off RX interrupt */
+                if (likely(napi_schedule_prep(&lp->napi))) {
-                misr &= ~RX_INTS;
+                        /* Mask off RX interrupt */
-                napi_schedule(&lp->napi);
+                        misr &= ~RX_INTS;
+                        __napi_schedule(&lp->napi);
+                }
        }
        /* TX interrupt request */
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 8ec1a9a0bb9a..2f110fb30daa 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -182,11 +182,11 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
 #ifdef SL_INCLUDE_CSLIP
        cbuff = xchg(&sl->cbuff, cbuff);
        slcomp = xchg(&sl->slcomp, slcomp);
+#endif
 #ifdef CONFIG_SLIP_MODE_SLIP6
        sl->xdata    = 0;
        sl->xbits    = 0;
 #endif
-#endif
        spin_unlock_bh(&sl->lock);
        err = 0;
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 468512731966..9a21ca3873fc 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -879,7 +879,6 @@ static void dmfe_free_tx_pkt(struct DEVICE *dev, struct dmfe_board_info * db)
        txptr = db->tx_remove_ptr;
        while(db->tx_packet_cnt) {
                tdes0 = le32_to_cpu(txptr->tdes0);
-                pr_debug("tdes0=%x\n", tdes0);
                if (tdes0 & 0x80000000)
                        break;
@@ -889,7 +888,6 @@ static void dmfe_free_tx_pkt(struct DEVICE *dev, struct dmfe_board_info * db)
                /* Transmit statistic counter */
                if ( tdes0 != 0x7fffffff ) {
-                        pr_debug("tdes0=%x\n", tdes0);
                        dev->stats.collisions += (tdes0 >> 3) & 0xf;
                        dev->stats.tx_bytes += le32_to_cpu(txptr->tdes1) & 0x7ff;
                        if (tdes0 & TDES0_ERR_MASK) {
@@ -986,7 +984,6 @@ static void dmfe_rx_packet(struct DEVICE *dev, struct dmfe_board_info * db)
                        /* error summary bit check */
                        if (rdes0 & 0x8000) {
                                /* This is a error packet */
-                                pr_debug("rdes0: %x\n", rdes0);
                                dev->stats.rx_errors++;
                                if (rdes0 & 1)
                                        dev->stats.rx_fifo_errors++;
@@ -1638,7 +1635,6 @@ static u8 dmfe_sense_speed(struct dmfe_board_info * db)
                else                            /* DM9102/DM9102A */
                        phy_mode = phy_read(db->ioaddr,
                                    db->phy_addr, 17, db->chip_id) & 0xf000;
-                pr_debug("Phy_mode %x\n", phy_mode);
                switch (phy_mode) {
                case 0x1000: db->op_mode = DMFE_10MHF; break;
                case 0x2000: db->op_mode = DMFE_10MFD; break;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 387ca43f26f4..304fe78ff60e 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2421,10 +2421,8 @@ static void hso_free_net_device(struct hso_device *hso_dev)
        remove_net_device(hso_net->parent);
-        if (hso_net->net) {
+        if (hso_net->net)
                unregister_netdev(hso_net->net);
-                free_netdev(hso_net->net);
-        }
        /* start freeing */
        for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
@@ -2436,6 +2434,9 @@ static void hso_free_net_device(struct hso_device *hso_dev)
        kfree(hso_net->mux_bulk_tx_buf);
        hso_net->mux_bulk_tx_buf = NULL;
+        if (hso_net->net)
+                free_netdev(hso_net->net);
        kfree(hso_dev);
 }
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index 296c316a8341..f2c0c236392f 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -297,7 +297,9 @@ ath5k_pci_remove(struct pci_dev *pdev)
 #ifdef CONFIG_PM_SLEEP
 static int ath5k_pci_suspend(struct device *dev)
 {
-        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+        struct ath5k_softc *sc = hw->priv;
        ath5k_led_off(sc);
        return 0;
@@ -306,7 +308,8 @@ static int ath5k_pci_suspend(struct device *dev)
 static int ath5k_pci_resume(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+        struct ath5k_softc *sc = hw->priv;
        /*
         * Suspend/Resume resets the PCI configuration space, so we have to
diff --git a/drivers/net/wireless/ath/ath5k/sysfs.c b/drivers/net/wireless/ath/ath5k/sysfs.c
index 929c68cdf8ab..a073cdce1f15 100644
--- a/drivers/net/wireless/ath/ath5k/sysfs.c
+++ b/drivers/net/wireless/ath/ath5k/sysfs.c
@@ -10,7 +10,8 @@ static ssize_t ath5k_attr_show_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        char *buf)                                      \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
 }                                                                       \
                                                                        \
@@ -18,7 +19,8 @@ static ssize_t ath5k_attr_store_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        const char *buf, size_t count)                  \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        int val;                                                        \
                                                                        \
        val = (int)simple_strtoul(buf, NULL, 10);                       \
@@ -33,7 +35,8 @@ static ssize_t ath5k_attr_show_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        char *buf)                                      \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
 }                                                                       \
 static DEVICE_ATTR(name, S_IRUGO, ath5k_attr_show_##name, NULL)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 3779b8977d47..33443bcaa8d9 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -671,7 +671,8 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         * TODO - this could be improved to be dependent on the rate.
         *      The hardware can keep up at lower rates, but not higher rates
         */
-        if (fi->keyix != ATH9K_TXKEYIX_INVALID)
+        if ((fi->keyix != ATH9K_TXKEYIX_INVALID) &&
+            !(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA))
                ndelim += ATH_AGGR_ENCRYPTDELIM;
        /*
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 2fb53d067512..333b69ef2ae2 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -112,6 +112,8 @@ static struct usb_device_id carl9170_usb_ids[] = {
        { USB_DEVICE(0x04bb, 0x093f) },
        /* NEC WL300NU-G */
        { USB_DEVICE(0x0409, 0x0249) },
+        /* NEC WL300NU-AG */
+        { USB_DEVICE(0x0409, 0x02b4) },
        /* AVM FRITZ!WLAN USB Stick N */
        { USB_DEVICE(0x057c, 0x8401) },
        /* AVM FRITZ!WLAN USB Stick N 2.4 */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 092e342c19df..942f7a3969a7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -298,6 +298,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/
        {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
        {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
+        {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
        {RTL_USB_DEVICE(0x0Df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
        {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
        /* HP - Lite-On ,8188CUS Slim Combo */
diff --git a/drivers/pcmcia/pxa2xx_vpac270.c b/drivers/pcmcia/pxa2xx_vpac270.c
index 712baab3c83d..e956f659089a 100644
--- a/drivers/pcmcia/pxa2xx_vpac270.c
+++ b/drivers/pcmcia/pxa2xx_vpac270.c
@@ -76,10 +76,10 @@ static int vpac270_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 static void vpac270_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
 {
        if (skt->nr == 0)
-                gpio_request_array(vpac270_pcmcia_gpios,
+                gpio_free_array(vpac270_pcmcia_gpios,
                                        ARRAY_SIZE(vpac270_pcmcia_gpios));
        else
-                gpio_request_array(vpac270_cf_gpios,
+                gpio_free_array(vpac270_cf_gpios,
                                        ARRAY_SIZE(vpac270_cf_gpios));
 }
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 2a20dabec76d..d6620ad309ce 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -516,8 +516,17 @@ static void ssb_pcicore_pcie_setup_workarounds(struct ssb_pcicore *pc)
 static void ssb_pcicore_init_clientmode(struct ssb_pcicore *pc)
 {
+        ssb_pcicore_fix_sprom_core_index(pc);
        /* Disable PCI interrupts. */
        ssb_write32(pc->dev, SSB_INTVEC, 0);
+        /* Additional PCIe always once-executed workarounds */
+        if (pc->dev->id.coreid == SSB_DEV_PCIE) {
+                ssb_pcicore_serdes_workaround(pc);
+                /* TODO: ASPM */
+                /* TODO: Clock Request Update */
+        }
 }
 void ssb_pcicore_init(struct ssb_pcicore *pc)
@@ -529,8 +538,6 @@ void ssb_pcicore_init(struct ssb_pcicore *pc)
        if (!ssb_device_is_enabled(dev))
                ssb_device_enable(dev, 0);
-        ssb_pcicore_fix_sprom_core_index(pc);
 #ifdef CONFIG_SSB_PCICORE_HOSTMODE
        pc->hostmode = pcicore_is_in_hostmode(pc);
        if (pc->hostmode)
@@ -538,13 +545,6 @@ void ssb_pcicore_init(struct ssb_pcicore *pc)
 #endif /* CONFIG_SSB_PCICORE_HOSTMODE */
        if (!pc->hostmode)
                ssb_pcicore_init_clientmode(pc);
-        /* Additional PCIe always once-executed workarounds */
-        if (dev->id.coreid == SSB_DEV_PCIE) {
-                ssb_pcicore_serdes_workaround(pc);
-                /* TODO: ASPM */
-                /* TODO: Clock Request Update */
-        }
 }
 static u32 ssb_pcie_read(struct ssb_pcicore *pc, u32 address)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 9536d386bb38..21d816e9dfa5 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -599,8 +599,7 @@ config IT87_WDT
 config HP_WATCHDOG
        tristate "HP ProLiant iLO2+ Hardware Watchdog Timer"
-        depends on X86
+        depends on X86 && PCI
-        default m
        help
          A software monitoring watchdog and NMI sourcing driver. This driver
          will detect lockups and provide a stack trace. This is a driver that
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 79743d146be6..0c1d91756528 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1438,12 +1438,15 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
        struct dentry *temp;
        char *path;
        int len, pos;
+        unsigned seq;
        if (dentry == NULL)
                return ERR_PTR(-EINVAL);
 retry:
        len = 0;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
        for (temp = dentry; !IS_ROOT(temp);) {
                struct inode *inode = temp->d_inode;
                if (inode && ceph_snap(inode) == CEPH_SNAPDIR)
@@ -1455,10 +1458,12 @@ retry:
                        len += 1 + temp->d_name.len;
                temp = temp->d_parent;
                if (temp == NULL) {
+                        rcu_read_unlock();
                        pr_err("build_path corrupt dentry %p\n", dentry);
                        return ERR_PTR(-EINVAL);
                }
        }
+        rcu_read_unlock();
        if (len)
                len--;  /* no leading '/' */
@@ -1467,9 +1472,12 @@ retry:
                return ERR_PTR(-ENOMEM);
        pos = len;
        path[pos] = 0;  /* trailing null */
+        rcu_read_lock();
        for (temp = dentry; !IS_ROOT(temp) && pos != 0; ) {
-                struct inode *inode = temp->d_inode;
+                struct inode *inode;
+                spin_lock(&temp->d_lock);
+                inode = temp->d_inode;
                if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
                        dout("build_path path+%d: %p SNAPDIR\n",
                             pos, temp);
@@ -1478,21 +1486,26 @@ retry:
                        break;
                } else {
                        pos -= temp->d_name.len;
-                        if (pos < 0)
+                        if (pos < 0) {
+                                spin_unlock(&temp->d_lock);
                                break;
+                        }
                        strncpy(path + pos, temp->d_name.name,
                                temp->d_name.len);
                }
+                spin_unlock(&temp->d_lock);
                if (pos)
                        path[--pos] = '/';
                temp = temp->d_parent;
                if (temp == NULL) {
+                        rcu_read_unlock();
                        pr_err("build_path corrupt dentry\n");
                        kfree(path);
                        return ERR_PTR(-EINVAL);
                }
        }
-        if (pos != 0) {
+        rcu_read_unlock();
+        if (pos != 0 || read_seqretry(&rename_lock, seq)) {
                pr_err("build_path did not end path lookup where "
                       "expected, namelen is %d, pos is %d\n", len, pos);
                /* presumably this is only possible if racing with a
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 3e2989976297..bc4b12ca537b 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -35,6 +35,7 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/freezer.h>
+#include <linux/namei.h>
 #include <net/ipv6.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
@@ -542,14 +543,12 @@ static const struct super_operations cifs_super_ops = {
 static struct dentry *
 cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 {
-        int xid, rc;
+        struct dentry *dentry;
-        struct inode *inode;
-        struct qstr name;
-        struct dentry *dparent = NULL, *dchild = NULL, *alias;
        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        unsigned int i, full_len, len;
+        char *full_path = NULL;
-        char *full_path = NULL, *pstart;
+        char *s, *p;
        char sep;
+        int xid;
        full_path = cifs_build_path_to_root(vol, cifs_sb,
                                            cifs_sb_master_tcon(cifs_sb));
@@ -560,73 +559,32 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
        xid = GetXid();
        sep = CIFS_DIR_SEP(cifs_sb);
-        dparent = dget(sb->s_root);
+        dentry = dget(sb->s_root);
-        full_len = strlen(full_path);
+        p = s = full_path;
-        full_path[full_len] = sep;
-        pstart = full_path + 1;
+        do {
+                struct inode *dir = dentry->d_inode;
-        for (i = 1, len = 0; i <= full_len; i++) {
+                struct dentry *child;
-                if (full_path[i] != sep || !len) {
-                        len++;
+                /* skip separators */
-                        continue;
+                while (*s == sep)
-                }
+                        s++;
+                if (!*s)
-                full_path[i] = 0;
+                        break;
-                cFYI(1, "get dentry for %s", pstart);
+                p = s++;
+                /* next separator */
-                name.name = pstart;
+                while (*s && *s != sep)
-                name.len = len;
+                        s++;
-                name.hash = full_name_hash(pstart, len);
-                dchild = d_lookup(dparent, &name);
+                mutex_lock(&dir->i_mutex);
-                if (dchild == NULL) {
+                child = lookup_one_len(p, dentry, s - p);
-                        cFYI(1, "not exists");
+                mutex_unlock(&dir->i_mutex);
-                        dchild = d_alloc(dparent, &name);
+                dput(dentry);
-                        if (dchild == NULL) {
+                dentry = child;
-                                dput(dparent);
+        } while (!IS_ERR(dentry));
-                                dparent = ERR_PTR(-ENOMEM);
-                                goto out;
-                        }
-                }
-                cFYI(1, "get inode");
-                if (dchild->d_inode == NULL) {
-                        cFYI(1, "not exists");
-                        inode = NULL;
-                        if (cifs_sb_master_tcon(CIFS_SB(sb))->unix_ext)
-                                rc = cifs_get_inode_info_unix(&inode, full_path,
-                                                              sb, xid);
-                        else
-                                rc = cifs_get_inode_info(&inode, full_path,
-                                                         NULL, sb, xid, NULL);
-                        if (rc) {
-                                dput(dchild);
-                                dput(dparent);
-                                dparent = ERR_PTR(rc);
-                                goto out;
-                        }
-                        alias = d_materialise_unique(dchild, inode);
-                        if (alias != NULL) {
-                                dput(dchild);
-                                if (IS_ERR(alias)) {
-                                        dput(dparent);
-                                        dparent = ERR_PTR(-EINVAL); /* XXX */
-                                        goto out;
-                                }
-                                dchild = alias;
-                        }
-                }
-                cFYI(1, "parent %p, child %p", dparent, dchild);
-                dput(dparent);
-                dparent = dchild;
-                len = 0;
-                pstart = full_path + i + 1;
-                full_path[i] = sep;
-        }
-out:
        _FreeXid(xid);
        kfree(full_path);
-        return dparent;
+        return dentry;
 }
 static int cifs_set_super(struct super_block *sb, void *data)
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 0900e1658c96..036ca83e5f46 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -129,5 +129,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "1.73"
+#define CIFS_VERSION   "1.74"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index dbd669cc5bc7..ccc1afa0bf3b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3485,7 +3485,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
                goto out;
        }
-        snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
+        snprintf(username, sizeof(username), "krb50x%x", fsuid);
        vol_info->username = username;
        vol_info->local_nls = cifs_sb->local_nls;
        vol_info->linux_uid = fsuid;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 81914df47ef1..fa8c21d913bc 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -55,6 +55,7 @@ build_path_from_dentry(struct dentry *direntry)
        char dirsep;
        struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
        struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+        unsigned seq;
        if (direntry == NULL)
                return NULL;  /* not much we can do if dentry is freed and
@@ -68,22 +69,29 @@ build_path_from_dentry(struct dentry *direntry)
                dfsplen = 0;
 cifs_bp_rename_retry:
        namelen = dfsplen;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
        for (temp = direntry; !IS_ROOT(temp);) {
                namelen += (1 + temp->d_name.len);
                temp = temp->d_parent;
                if (temp == NULL) {
                        cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                        return NULL;
                }
        }
+        rcu_read_unlock();
        full_path = kmalloc(namelen+1, GFP_KERNEL);
        if (full_path == NULL)
                return full_path;
        full_path[namelen] = 0; /* trailing null */
+        rcu_read_lock();
        for (temp = direntry; !IS_ROOT(temp);) {
+                spin_lock(&temp->d_lock);
                namelen -= 1 + temp->d_name.len;
                if (namelen < 0) {
+                        spin_unlock(&temp->d_lock);
                        break;
                } else {
                        full_path[namelen] = dirsep;
@@ -91,14 +99,17 @@ cifs_bp_rename_retry:
                                temp->d_name.len);
                        cFYI(0, "name: %s", full_path + namelen);
                }
+                spin_unlock(&temp->d_lock);
                temp = temp->d_parent;
                if (temp == NULL) {
                        cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                        kfree(full_path);
                        return NULL;
                }
        }
-        if (namelen != dfsplen) {
+        rcu_read_unlock();
+        if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
                cERROR(1, "did not end path lookup where expected namelen is %d",
                        namelen);
                /* presumably this is only possible if racing with a rename
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 3892ab817a36..d3e619692ee0 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -428,8 +428,7 @@ static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
                        (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                flags |= NTLMSSP_NEGOTIATE_SIGN;
                if (!ses->server->session_estab)
-                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH |
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
-                                NTLMSSP_NEGOTIATE_EXTENDED_SEC;
        }
        sec_blob->NegotiateFlags = cpu_to_le32(flags);
@@ -465,10 +464,11 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
                NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;
        if (ses->server->sec_mode &
-           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                flags |= NTLMSSP_NEGOTIATE_SIGN;
-        if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
+                if (!ses->server->session_estab)
-                flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
+        }
        tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
        sec_blob->NegotiateFlags = cpu_to_le32(flags);
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index e141939080f0..739fb59bcdc2 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -37,7 +37,7 @@ static DEFINE_MUTEX(read_mutex);
 /* These macros may change in future, to provide better st_ino semantics. */
 #define OFFSET(x)       ((x)->i_ino)
-static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
+static unsigned long cramino(const struct cramfs_inode *cino, unsigned int offset)
 {
        if (!cino->offset)
                return offset + 1;
@@ -61,7 +61,7 @@ static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
 }
 static struct inode *get_cramfs_inode(struct super_block *sb,
-        struct cramfs_inode *cramfs_inode, unsigned int offset)
+        const struct cramfs_inode *cramfs_inode, unsigned int offset)
 {
        struct inode *inode;
        static struct timespec zerotime;
@@ -317,7 +317,7 @@ static int cramfs_fill_super(struct super_block *sb, void *data, int silent)
        /* Set it all up.. */
        sb->s_op = &cramfs_ops;
        root = get_cramfs_inode(sb, &super.root, 0);
-        if (!root)
+        if (IS_ERR(root))
                goto out;
        sb->s_root = d_alloc_root(root);
        if (!sb->s_root) {
@@ -423,6 +423,7 @@ static int cramfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
        unsigned int offset = 0;
+        struct inode *inode = NULL;
        int sorted;
        mutex_lock(&read_mutex);
@@ -449,8 +450,8 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
                for (;;) {
                        if (!namelen) {
-                                mutex_unlock(&read_mutex);
+                                inode = ERR_PTR(-EIO);
-                                return ERR_PTR(-EIO);
+                                goto out;
                        }
                        if (name[namelen-1])
                                break;
@@ -462,17 +463,18 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
                if (retval > 0)
                        continue;
                if (!retval) {
-                        struct cramfs_inode entry = *de;
+                        inode = get_cramfs_inode(dir->i_sb, de, dir_off);
-                        mutex_unlock(&read_mutex);
+                        break;
-                        d_add(dentry, get_cramfs_inode(dir->i_sb, &entry, dir_off));
-                        return NULL;
                }
                /* else (retval < 0) */
                if (sorted)
                        break;
        }
+out:
        mutex_unlock(&read_mutex);
-        d_add(dentry, NULL);
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
+        d_add(dentry, inode);
        return NULL;
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 37f72ee5bf7c..6e4ea6d87774 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2213,14 +2213,15 @@ static void dentry_unlock_parents_for_move(struct dentry *dentry,
 * The hash value has to match the hash queue that the dentry is on..
 */
 /*
- * d_move - move a dentry
+ * __d_move - move a dentry
 * @dentry: entry to move
 * @target: new dentry
 *
 * Update the dcache to reflect the move of a file name. Negative
- * dcache entries should not be moved in this way.
+ * dcache entries should not be moved in this way.  Caller hold
+ * rename_lock.
 */
-void d_move(struct dentry * dentry, struct dentry * target)
+static void __d_move(struct dentry * dentry, struct dentry * target)
 {
        if (!dentry->d_inode)
                printk(KERN_WARNING "VFS: moving negative dcache entry\n");
@@ -2228,8 +2229,6 @@ void d_move(struct dentry * dentry, struct dentry * target)
        BUG_ON(d_ancestor(dentry, target));
        BUG_ON(d_ancestor(target, dentry));
-        write_seqlock(&rename_lock);
        dentry_lock_for_move(dentry, target);
        write_seqcount_begin(&dentry->d_seq);
@@ -2275,6 +2274,20 @@ void d_move(struct dentry * dentry, struct dentry * target)
        spin_unlock(&target->d_lock);
        fsnotify_d_move(dentry);
        spin_unlock(&dentry->d_lock);
+}
+/*
+ * d_move - move a dentry
+ * @dentry: entry to move
+ * @target: new dentry
+ *
+ * Update the dcache to reflect the move of a file name. Negative
+ * dcache entries should not be moved in this way.
+ */
+void d_move(struct dentry *dentry, struct dentry *target)
+{
+        write_seqlock(&rename_lock);
+        __d_move(dentry, target);
        write_sequnlock(&rename_lock);
 }
 EXPORT_SYMBOL(d_move);
@@ -2302,7 +2315,7 @@ struct dentry *d_ancestor(struct dentry *p1, struct dentry *p2)
 * This helper attempts to cope with remotely renamed directories
 *
 * It assumes that the caller is already holding
- * dentry->d_parent->d_inode->i_mutex and the inode->i_lock
+ * dentry->d_parent->d_inode->i_mutex, inode->i_lock and rename_lock
 *
 * Note: If ever the locking in lock_rename() changes, then please
 * remember to update this too...
@@ -2317,11 +2330,6 @@ static struct dentry *__d_unalias(struct inode *inode,
        if (alias->d_parent == dentry->d_parent)
                goto out_unalias;
-        /* Check for loops */
-        ret = ERR_PTR(-ELOOP);
-        if (d_ancestor(alias, dentry))
-                goto out_err;
        /* See lock_rename() */
        ret = ERR_PTR(-EBUSY);
        if (!mutex_trylock(&dentry->d_sb->s_vfs_rename_mutex))
@@ -2331,7 +2339,7 @@ static struct dentry *__d_unalias(struct inode *inode,
                goto out_err;
        m2 = &alias->d_parent->d_inode->i_mutex;
 out_unalias:
-        d_move(alias, dentry);
+        __d_move(alias, dentry);
        ret = alias;
 out_err:
        spin_unlock(&inode->i_lock);
@@ -2416,15 +2424,24 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                alias = __d_find_alias(inode, 0);
                if (alias) {
                        actual = alias;
-                        /* Is this an anonymous mountpoint that we could splice
+                        write_seqlock(&rename_lock);
-                         * into our tree? */
-                        if (IS_ROOT(alias)) {
+                        if (d_ancestor(alias, dentry)) {
+                                /* Check for loops */
+                                actual = ERR_PTR(-ELOOP);
+                        } else if (IS_ROOT(alias)) {
+                                /* Is this an anonymous mountpoint that we
+                                 * could splice into our tree? */
                                __d_materialise_dentry(dentry, alias);
+                                write_sequnlock(&rename_lock);
                                __d_drop(alias);
                                goto found;
+                        } else {
+                                /* Nope, but we must(!) avoid directory
+                                 * aliasing */
+                                actual = __d_unalias(inode, dentry, alias);
                        }
-                        /* Nope, but we must(!) avoid directory aliasing */
+                        write_sequnlock(&rename_lock);
-                        actual = __d_unalias(inode, dentry, alias);
                        if (IS_ERR(actual))
                                dput(alias);
                        goto out_nolock;
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 06065bd37fc3..c57beddcc217 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -913,7 +913,7 @@ struct dentry *exofs_get_parent(struct dentry *child)
        unsigned long ino = exofs_parent_ino(child);
        if (!ino)
-                return NULL;
+                return ERR_PTR(-ESTALE);
        return d_obtain_alias(exofs_iget(child->d_inode->i_sb, ino));
 }
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 802ac5eeba28..f9fbbe96c222 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1069,6 +1069,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                return 0;
        gfs2_log_lock(sdp);
+        spin_lock(&sdp->sd_ail_lock);
        head = bh = page_buffers(page);
        do {
                if (atomic_read(&bh->b_count))
@@ -1080,6 +1081,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                        goto not_possible;
                bh = bh->b_this_page;
        } while(bh != head);
+        spin_unlock(&sdp->sd_ail_lock);
        gfs2_log_unlock(sdp);
        head = bh = page_buffers(page);
@@ -1112,6 +1114,7 @@ not_possible: /* Should never happen */
        WARN_ON(buffer_dirty(bh));
        WARN_ON(buffer_pinned(bh));
 cannot_release:
+        spin_unlock(&sdp->sd_ail_lock);
        gfs2_log_unlock(sdp);
        return 0;
 }
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 8ef70f464731..2cca29316bd6 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -47,10 +47,10 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl)
                                bd_ail_gl_list);
                bh = bd->bd_bh;
                gfs2_remove_from_ail(bd);
-                spin_unlock(&sdp->sd_ail_lock);
                bd->bd_bh = NULL;
                bh->b_private = NULL;
+                spin_unlock(&sdp->sd_ail_lock);
                bd->bd_blkno = bh->b_blocknr;
                gfs2_log_lock(sdp);
                gfs2_assert_withdraw(sdp, !buffer_busy(bh));
@@ -221,8 +221,10 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
                }
        }
-        if (ip == GFS2_I(gl->gl_sbd->sd_rindex))
+        if (ip == GFS2_I(gl->gl_sbd->sd_rindex)) {
+                gfs2_log_flush(gl->gl_sbd, NULL);
                gl->gl_sbd->sd_rindex_uptodate = 0;
+        }
        if (ip && S_ISREG(ip->i_inode.i_mode))
                truncate_inode_pages(ip->i_inode.i_mapping, 0);
 }
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 0a064e91ac70..81206e70cbf6 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -17,6 +17,7 @@
 #include <linux/buffer_head.h>
 #include <linux/rcupdate.h>
 #include <linux/rculist_bl.h>
+#include <linux/completion.h>
 #define DIO_WAIT        0x00000010
 #define DIO_METADATA    0x00000020
@@ -546,6 +547,7 @@ struct gfs2_sbd {
        struct gfs2_glock *sd_trans_gl;
        wait_queue_head_t sd_glock_wait;
        atomic_t sd_glock_disposal;
+        struct completion sd_locking_init;
        /* Inode Stuff */
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 903115f2bb34..85c62923ee29 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -903,6 +903,7 @@ void gfs2_meta_syncfs(struct gfs2_sbd *sdp)
                if (gfs2_ail1_empty(sdp))
                        break;
        }
+        gfs2_log_flush(sdp, NULL);
 }
 static inline int gfs2_jrnl_flush_reqd(struct gfs2_sbd *sdp)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 8ac9ae189b53..2a77071fb7b6 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -72,6 +72,7 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
        init_waitqueue_head(&sdp->sd_glock_wait);
        atomic_set(&sdp->sd_glock_disposal, 0);
+        init_completion(&sdp->sd_locking_init);
        spin_lock_init(&sdp->sd_statfs_spin);
        spin_lock_init(&sdp->sd_rindex_spin);
@@ -1017,11 +1018,13 @@ hostdata_error:
                fsname++;
        if (lm->lm_mount == NULL) {
                fs_info(sdp, "Now mounting FS...\n");
+                complete(&sdp->sd_locking_init);
                return 0;
        }
        ret = lm->lm_mount(sdp, fsname);
        if (ret == 0)
                fs_info(sdp, "Joined cluster. Now mounting FS...\n");
+        complete(&sdp->sd_locking_init);
        return ret;
 }
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index ed540e7018be..fb0edf735483 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -757,13 +757,17 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
        struct timespec atime;
        struct gfs2_dinode *di;
        int ret = -EAGAIN;
+        int unlock_required = 0;
        /* Skip timestamp update, if this is from a memalloc */
        if (current->flags & PF_MEMALLOC)
                goto do_flush;
-        ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
+        if (!gfs2_glock_is_locked_by_me(ip->i_gl)) {
-        if (ret)
+                ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
-                goto do_flush;
+                if (ret)
+                        goto do_flush;
+                unlock_required = 1;
+        }
        ret = gfs2_trans_begin(sdp, RES_DINODE, 0);
        if (ret)
                goto do_unlock;
@@ -780,7 +784,8 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
        }
        gfs2_trans_end(sdp);
 do_unlock:
-        gfs2_glock_dq_uninit(&gh);
+        if (unlock_required)
+                gfs2_glock_dq_uninit(&gh);
 do_flush:
        if (wbc->sync_mode == WB_SYNC_ALL)
                gfs2_log_flush(GFS2_SB(inode), ip->i_gl);
@@ -1427,7 +1432,20 @@ out:
        return error;
 }
-/*
+/**
+ * gfs2_evict_inode - Remove an inode from cache
+ * @inode: The inode to evict
+ *
+ * There are three cases to consider:
+ * 1. i_nlink == 0, we are final opener (and must deallocate)
+ * 2. i_nlink == 0, we are not the final opener (and cannot deallocate)
+ * 3. i_nlink > 0
+ *
+ * If the fs is read only, then we have to treat all cases as per #3
+ * since we are unable to do any deallocation. The inode will be
+ * deallocated by the next read/write node to attempt an allocation
+ * in the same resource group
+ *
 * We have to (at the moment) hold the inodes main lock to cover
 * the gap between unlocking the shared lock on the iopen lock and
 * taking the exclusive lock. I'd rather do a shared -> exclusive
@@ -1470,6 +1488,8 @@ static void gfs2_evict_inode(struct inode *inode)
        if (error)
                goto out_truncate;
+        /* Case 1 starts here */
        if (S_ISDIR(inode->i_mode) &&
            (ip->i_diskflags & GFS2_DIF_EXHASH)) {
                error = gfs2_dir_exhash_dealloc(ip);
@@ -1493,13 +1513,16 @@ static void gfs2_evict_inode(struct inode *inode)
        goto out_unlock;
 out_truncate:
+        /* Case 2 starts here */
        error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
        if (error)
                goto out_unlock;
-        gfs2_final_release_pages(ip);
+        /* Needs to be done before glock release & also in a transaction */
+        truncate_inode_pages(&inode->i_data, 0);
        gfs2_trans_end(sdp);
 out_unlock:
+        /* Error path for case 1 */
        if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags))
                gfs2_glock_dq(&ip->i_iopen_gh);
        gfs2_holder_uninit(&ip->i_iopen_gh);
@@ -1507,6 +1530,7 @@ out_unlock:
        if (error && error != GLR_TRYFAILED && error != -EROFS)
                fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
 out:
+        /* Case 3 starts here */
        truncate_inode_pages(&inode->i_data, 0);
        end_writeback(inode);
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index e20eab37bc80..443cabcfcd23 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -338,6 +338,9 @@ static ssize_t lkfirst_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
        rv = sscanf(buf, "%u", &first);
        if (rv != 1 || first > 1)
                return -EINVAL;
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
        spin_lock(&sdp->sd_jindex_spin);
        rv = -EBUSY;
        if (test_bit(SDF_NOJOURNALID, &sdp->sd_flags) == 0)
@@ -414,7 +417,9 @@ static ssize_t jid_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
        rv = sscanf(buf, "%d", &jid);
        if (rv != 1)
                return -EINVAL;
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
        spin_lock(&sdp->sd_jindex_spin);
        rv = -EINVAL;
        if (sdp->sd_lockstruct.ls_ops->lm_mount == NULL)
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 87ed48e0343d..85c098a499f3 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -139,7 +139,8 @@ static int file_removed(struct dentry *dentry, const char *file)
 static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
                                   struct nameidata *nd)
 {
-        struct dentry *proc_dentry, *new, *parent;
+        struct dentry *proc_dentry, *parent;
+        struct qstr *name = &dentry->d_name;
        struct inode *inode;
        int err, deleted;
@@ -149,23 +150,9 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
        else if (deleted)
                return ERR_PTR(-ENOENT);
-        err = -ENOMEM;
        parent = HPPFS_I(ino)->proc_dentry;
        mutex_lock(&parent->d_inode->i_mutex);
-        proc_dentry = d_lookup(parent, &dentry->d_name);
+        proc_dentry = lookup_one_len(name->name, parent, name->len);
-        if (proc_dentry == NULL) {
-                proc_dentry = d_alloc(parent, &dentry->d_name);
-                if (proc_dentry == NULL) {
-                        mutex_unlock(&parent->d_inode->i_mutex);
-                        goto out;
-                }
-                new = (*parent->d_inode->i_op->lookup)(parent->d_inode,
-                                                       proc_dentry, NULL);
-                if (new) {
-                        dput(proc_dentry);
-                        proc_dentry = new;
-                }
-        }
        mutex_unlock(&parent->d_inode->i_mutex);
        if (IS_ERR(proc_dentry))
@@ -174,13 +161,11 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
        err = -ENOMEM;
        inode = get_inode(ino->i_sb, proc_dentry);
        if (!inode)
-                goto out_dput;
+                goto out;
        d_add(dentry, inode);
        return NULL;
- out_dput:
-        dput(proc_dentry);
 out:
        return ERR_PTR(err);
 }
@@ -690,8 +675,10 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
        struct inode *proc_ino = dentry->d_inode;
        struct inode *inode = new_inode(sb);
-        if (!inode)
+        if (!inode) {
+                dput(dentry);
                return ERR_PTR(-ENOMEM);
+        }
        if (S_ISDIR(dentry->d_inode->i_mode)) {
                inode->i_op = &hppfs_dir_iops;
@@ -704,7 +691,7 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
                inode->i_fop = &hppfs_file_fops;
        }
-        HPPFS_I(inode)->proc_dentry = dget(dentry);
+        HPPFS_I(inode)->proc_dentry = dentry;
        inode->i_uid = proc_ino->i_uid;
        inode->i_gid = proc_ino->i_gid;
@@ -737,7 +724,7 @@ static int hppfs_fill_super(struct super_block *sb, void *d, int silent)
        sb->s_fs_info = proc_mnt;
        err = -ENOMEM;
-        root_inode = get_inode(sb, proc_mnt->mnt_sb->s_root);
+        root_inode = get_inode(sb, dget(proc_mnt->mnt_sb->s_root));
        if (!root_inode)
                goto out_mntput;
diff --git a/fs/libfs.c b/fs/libfs.c
index c88eab55aec9..275ca4749a2e 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -822,7 +822,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
                goto out;
        attr->set_buf[size] = '\0';
-        val = simple_strtol(attr->set_buf, NULL, 0);
+        val = simple_strtoll(attr->set_buf, NULL, 0);
        ret = attr->set(attr->data, val);
        if (ret == 0)
                ret = len; /* on success, claim we got the whole input */
diff --git a/fs/namei.c b/fs/namei.c
index 0223c41fb114..14ab8d3f2f0c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -433,6 +433,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                        goto err_parent;
                BUG_ON(nd->inode != parent->d_inode);
        } else {
+                if (dentry->d_parent != parent)
+                        goto err_parent;
                spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
                if (!__d_rcu_to_refcount(dentry, nd->seq))
                        goto err_child;
@@ -940,7 +942,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 * Don't forget we might have a non-mountpoint managed dentry
                 * that wants to block transit.
                 */
-                *inode = path->dentry->d_inode;
                if (unlikely(managed_dentry_might_block(path->dentry)))
                        return false;
@@ -953,6 +954,12 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                path->mnt = mounted;
                path->dentry = mounted->mnt_root;
                nd->seq = read_seqcount_begin(&path->dentry->d_seq);
+                /*
+                 * Update the inode too. We don't need to re-check the
+                 * dentry sequence number here after this d_inode read,
+                 * because a mount-point is always pinned.
+                 */
+                *inode = path->dentry->d_inode;
        }
        return true;
 }
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 0bafcc91c27f..f9d03abcd04c 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -398,7 +398,6 @@ filelayout_write_pagelist(struct nfs_write_data *data, int sync)
         * this offset and save the original offset.
         */
        data->args.offset = filelayout_get_dserver_offset(lseg, offset);
-        data->mds_offset = offset;
        /* Perform an asynchronous write */
        status = nfs_initiate_write(data, ds->ds_clp->cl_rpcclient,
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 6870bc61ceec..e6e8f3b9a1de 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -91,7 +91,7 @@ static int nfs4_stat_to_errno(int);
 #define encode_getfh_maxsz      (op_encode_hdr_maxsz)
 #define decode_getfh_maxsz      (op_decode_hdr_maxsz + 1 + \
                                ((3+NFS4_FHSIZE) >> 2))
-#define nfs4_fattr_bitmap_maxsz 3
+#define nfs4_fattr_bitmap_maxsz 4
 #define encode_getattr_maxsz    (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz)
 #define nfs4_name_maxsz         (1 + ((3 + NFS4_MAXNAMLEN) >> 2))
 #define nfs4_path_maxsz         (1 + ((3 + NFS4_MAXPATHLEN) >> 2))
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e268e3b23497..727168059684 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -864,6 +864,8 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
        data->args.fh     = NFS_FH(inode);
        data->args.offset = req_offset(req) + offset;
+        /* pnfs_set_layoutcommit needs this */
+        data->mds_offset = data->args.offset;
        data->args.pgbase = req->wb_pgbase + offset;
        data->args.pages  = data->pagevec;
        data->args.count  = count;
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 29309e25417f..b57aab9a1184 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -56,16 +56,12 @@ static struct dentry *ufs_lookup(struct inode * dir, struct dentry *dentry, stru
        lock_ufs(dir->i_sb);
        ino = ufs_inode_by_name(dir, &dentry->d_name);
-        if (ino) {
+        if (ino)
                inode = ufs_iget(dir->i_sb, ino);
-                if (IS_ERR(inode)) {
-                        unlock_ufs(dir->i_sb);
-                        return ERR_CAST(inode);
-                }
-        }
        unlock_ufs(dir->i_sb);
-        d_add(dentry, inode);
+        if (IS_ERR(inode))
-        return NULL;
+                return ERR_CAST(inode);
+        return d_splice_alias(inode, dentry);
 }
 /*
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 3a10ef5914eb..6cd5b6403a7b 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -210,7 +210,7 @@ struct acpi_device_power_state {
 struct acpi_device_power {
        int state;              /* Current state */
        struct acpi_device_power_flags flags;
-        struct acpi_device_power_state states[4];       /* Power states (D0-D3) */
+        struct acpi_device_power_state states[ACPI_D_STATE_COUNT];      /* Power states (D0-D3Cold) */
 };
 /* Performance Management */
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index a756bc8d866d..4543b6f75867 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -98,8 +98,11 @@ acpi_os_table_override(struct acpi_table_header *existing_table,
 /*
 * Spinlock primitives
 */
+#ifndef acpi_os_create_lock
 acpi_status
 acpi_os_create_lock(acpi_spinlock *out_handle);
+#endif
 void acpi_os_delete_lock(acpi_spinlock handle);
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 5d2a5e9544d9..2ce1be9f6291 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -159,6 +159,24 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
        } while (0)
 #endif
+/*
+ * When lockdep is enabled, the spin_lock_init() macro stringifies it's
+ * argument and uses that as a name for the lock in debugging.
+ * By executing spin_lock_init() in a macro the key changes from "lock" for
+ * all locks to the name of the argument of acpi_os_create_lock(), which
+ * prevents lockdep from reporting false positives for ACPICA locks.
+ */
+#define acpi_os_create_lock(__handle)                           \
+({                                                              \
+        spinlock_t *lock = ACPI_ALLOCATE(sizeof(*lock));        \
+                                                                \
+        if (lock) {                                             \
+                *(__handle) = lock;                             \
+                spin_lock_init(*(__handle));                    \
+        }                                                       \
+        lock ? AE_OK : AE_NO_MEMORY;                            \
+})
 #endif /* __KERNEL__ */
 #endif /* __ACLINUX_H__ */
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index e08f344c6cff..3d53efd25ab9 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -182,6 +182,7 @@
        {0x1002, 0x6750, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6758, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6759, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x675F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6760, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6761, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6762, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
@@ -192,6 +193,7 @@
        {0x1002, 0x6767, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6768, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 8b4538446636..baa397eb9c33 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -676,7 +676,8 @@ void irq_gc_mask_disable_reg(struct irq_data *d);
 void irq_gc_mask_set_bit(struct irq_data *d);
 void irq_gc_mask_clr_bit(struct irq_data *d);
 void irq_gc_unmask_enable_reg(struct irq_data *d);
-void irq_gc_ack(struct irq_data *d);
+void irq_gc_ack_set_bit(struct irq_data *d);
+void irq_gc_ack_clr_bit(struct irq_data *d);
 void irq_gc_mask_disable_reg_and_ack(struct irq_data *d);
 void irq_gc_eoi(struct irq_data *d);
 int irq_gc_set_wake(struct irq_data *d, unsigned int on);
diff --git a/include/linux/memory.h b/include/linux/memory.h
index e1e3b2b84f85..935699b30b7c 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -20,6 +20,8 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
+#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
 struct memory_block {
        unsigned long start_section_nr;
        unsigned long end_section_nr;
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index c6927a4d157f..6ad43554ac05 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -64,6 +64,19 @@ struct mmc_ext_csd {
        unsigned long long      enhanced_area_offset;   /* Units: Byte */
        unsigned int            enhanced_area_size;     /* Units: KB */
        unsigned int            boot_size;              /* in bytes */
+        u8                      raw_partition_support;  /* 160 */
+        u8                      raw_erased_mem_count;   /* 181 */
+        u8                      raw_ext_csd_structure;  /* 194 */
+        u8                      raw_card_type;          /* 196 */
+        u8                      raw_s_a_timeout;                /* 217 */
+        u8                      raw_hc_erase_gap_size;  /* 221 */
+        u8                      raw_erase_timeout_mult; /* 223 */
+        u8                      raw_hc_erase_grp_size;  /* 224 */
+        u8                      raw_sec_trim_mult;      /* 229 */
+        u8                      raw_sec_erase_mult;     /* 230 */
+        u8                      raw_sec_feature_support;/* 231 */
+        u8                      raw_trim_mult;          /* 232 */
+        u8                      raw_sectors[4];         /* 212 - 4 bytes */
 };
 struct sd_scr {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 54b8b4d7b68f..9e19477991ad 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1097,12 +1097,6 @@ struct net_device {
 #define NETIF_F_ALL_FCOE        (NETIF_F_FCOE_CRC | NETIF_F_FCOE_MTU | \
                                 NETIF_F_FSO)
-#define NETIF_F_ALL_TX_OFFLOADS (NETIF_F_ALL_CSUM | NETIF_F_SG | \
-                                 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
-                                 NETIF_F_HIGHDMA | \
-                                 NETIF_F_SCTP_CSUM | \
-                                 NETIF_F_ALL_FCOE)
        /*
         * If one device supports one of these features, then enable them
         * for all in netdev_increment_features.
diff --git a/include/linux/sdla.h b/include/linux/sdla.h
index 564acd3a71c1..9995c7fc3f60 100644
--- a/include/linux/sdla.h
+++ b/include/linux/sdla.h
@@ -112,11 +112,7 @@ struct sdla_dlci_conf {
   short Tb_max;
 };
-#ifndef __KERNEL__
+#ifdef __KERNEL__
-void sdla(void *cfg_info, char *dev, struct frad_conf *conf, int quiet);
-#else
 /* important Z80 window addresses */
 #define SDLA_CONTROL_WND                0xE000
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index dd6847e5d6e4..6506458ccd33 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -63,6 +63,7 @@ typedef enum {
        SCTP_CMD_ECN_ECNE,      /* Do delayed ECNE processing. */
        SCTP_CMD_ECN_CWR,       /* Do delayed CWR processing.  */
        SCTP_CMD_TIMER_START,   /* Start a timer.  */
+        SCTP_CMD_TIMER_START_ONCE, /* Start a timer once */
        SCTP_CMD_TIMER_RESTART, /* Restart a timer. */
        SCTP_CMD_TIMER_STOP,    /* Stop a timer. */
        SCTP_CMD_INIT_CHOOSE_TRANSPORT, /* Choose transport for an INIT. */
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 99b027b2adce..ca4693b4e09e 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -80,7 +80,7 @@ static inline struct sctp_ulpevent *sctp_skb2event(struct sk_buff *skb)
 void sctp_ulpevent_free(struct sctp_ulpevent *);
 int sctp_ulpevent_is_notification(const struct sctp_ulpevent *);
-void sctp_queue_purge_ulpevents(struct sk_buff_head *list);
+unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list);
 struct sctp_ulpevent *sctp_ulpevent_make_assoc_change(
        const struct sctp_association *asoc,
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index 31a9db711906..3a2cab407b93 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -101,10 +101,10 @@ void irq_gc_unmask_enable_reg(struct irq_data *d)
 }
 /**
- * irq_gc_ack - Ack pending interrupt
+ * irq_gc_ack_set_bit - Ack pending interrupt via setting bit
 * @d: irq_data
 */
-void irq_gc_ack(struct irq_data *d)
+void irq_gc_ack_set_bit(struct irq_data *d)
 {
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        u32 mask = 1 << (d->irq - gc->irq_base);
@@ -115,6 +115,20 @@ void irq_gc_ack(struct irq_data *d)
 }
 /**
+ * irq_gc_ack_clr_bit - Ack pending interrupt via clearing bit
+ * @d: irq_data
+ */
+void irq_gc_ack_clr_bit(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 mask = ~(1 << (d->irq - gc->irq_base));
+        irq_gc_lock(gc);
+        irq_reg_writel(mask, gc->reg_base + cur_regs(d)->ack);
+        irq_gc_unlock(gc);
+}
+/**
 * irq_gc_mask_disable_reg_and_ack- Mask and ack pending interrupt
 * @d: irq_data
 */
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 7e59ffb3d0ba..ba06207b1dd3 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -84,9 +84,32 @@ DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
 static struct rcu_state *rcu_state;
+/*
+ * The rcu_scheduler_active variable transitions from zero to one just
+ * before the first task is spawned.  So when this variable is zero, RCU
+ * can assume that there is but one task, allowing RCU to (for example)
+ * optimized synchronize_sched() to a simple barrier().  When this variable
+ * is one, RCU must actually do all the hard work required to detect real
+ * grace periods.  This variable is also used to suppress boot-time false
+ * positives from lockdep-RCU error checking.
+ */
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+/*
+ * The rcu_scheduler_fully_active variable transitions from zero to one
+ * during the early_initcall() processing, which is after the scheduler
+ * is capable of creating new tasks.  So RCU processing (for example,
+ * creating tasks for RCU priority boosting) must be delayed until after
+ * rcu_scheduler_fully_active transitions from zero to one.  We also
+ * currently delay invocation of any RCU callbacks until after this point.
+ *
+ * It might later prove better for people registering RCU callbacks during
+ * early boot to take responsibility for these callbacks, but one step at
+ * a time.
+ */
+static int rcu_scheduler_fully_active __read_mostly;
 #ifdef CONFIG_RCU_BOOST
 /*
@@ -98,7 +121,6 @@ DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_status);
 DEFINE_PER_CPU(int, rcu_cpu_kthread_cpu);
 DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
 DEFINE_PER_CPU(char, rcu_cpu_has_work);
-static char rcu_kthreads_spawnable;
 #endif /* #ifdef CONFIG_RCU_BOOST */
@@ -1467,6 +1489,8 @@ static void rcu_process_callbacks(struct softirq_action *unused)
 */
 static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
 {
+        if (unlikely(!ACCESS_ONCE(rcu_scheduler_fully_active)))
+                return;
        if (likely(!rsp->boost)) {
                rcu_do_batch(rsp, rdp);
                return;
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 14dc7dd00902..75113cb7c4fb 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -1532,7 +1532,7 @@ static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
        struct sched_param sp;
        struct task_struct *t;
-        if (!rcu_kthreads_spawnable ||
+        if (!rcu_scheduler_fully_active ||
            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
                return 0;
        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
@@ -1639,7 +1639,7 @@ static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
        struct sched_param sp;
        struct task_struct *t;
-        if (!rcu_kthreads_spawnable ||
+        if (!rcu_scheduler_fully_active ||
            rnp->qsmaskinit == 0)
                return 0;
        if (rnp->node_kthread_task == NULL) {
@@ -1665,7 +1665,7 @@ static int __init rcu_spawn_kthreads(void)
        int cpu;
        struct rcu_node *rnp;
-        rcu_kthreads_spawnable = 1;
+        rcu_scheduler_fully_active = 1;
        for_each_possible_cpu(cpu) {
                per_cpu(rcu_cpu_has_work, cpu) = 0;
                if (cpu_online(cpu))
@@ -1687,7 +1687,7 @@ static void __cpuinit rcu_prepare_kthreads(int cpu)
        struct rcu_node *rnp = rdp->mynode;
        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
-        if (rcu_kthreads_spawnable) {
+        if (rcu_scheduler_fully_active) {
                (void)rcu_spawn_one_cpu_kthread(cpu);
                if (rnp->node_kthread_task == NULL)
                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
@@ -1726,6 +1726,13 @@ static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
 {
 }
+static int __init rcu_scheduler_really_started(void)
+{
+        rcu_scheduler_fully_active = 1;
+        return 0;
+}
+early_initcall(rcu_scheduler_really_started);
 static void __cpuinit rcu_prepare_kthreads(int cpu)
 {
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index 9769c756ad66..3dc716f6d8ad 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -7757,6 +7757,9 @@ static void init_cfs_rq(struct cfs_rq *cfs_rq, struct rq *rq)
 #endif
 #endif
        cfs_rq->min_vruntime = (u64)(-(1LL << 20));
+#ifndef CONFIG_64BIT
+        cfs_rq->min_vruntime_copy = cfs_rq->min_vruntime;
+#endif
 }
 static void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5ed24b94c5e6..d036e59d302b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2310,7 +2310,8 @@ static bool pgdat_balanced(pg_data_t *pgdat, unsigned long balanced_pages,
        for (i = 0; i <= classzone_idx; i++)
                present_pages += pgdat->node_zones[i].present_pages;
-        return balanced_pages > (present_pages >> 2);
+        /* A special case here: if zone has no page, we think it's balanced */
+        return balanced_pages >= (present_pages >> 2);
 }
 /* is kswapd sleeping prematurely? */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 86bff9b1ac47..6e82148edfc8 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -528,7 +528,11 @@ static int vlan_dev_init(struct net_device *dev)
                                          (1<<__LINK_STATE_DORMANT))) |
                      (1<<__LINK_STATE_PRESENT);
-        dev->hw_features = NETIF_F_ALL_TX_OFFLOADS;
+        dev->hw_features = NETIF_F_ALL_CSUM | NETIF_F_SG |
+                           NETIF_F_FRAGLIST | NETIF_F_ALL_TSO |
+                           NETIF_F_HIGHDMA | NETIF_F_SCTP_CSUM |
+                           NETIF_F_ALL_FCOE;
        dev->features |= real_dev->vlan_features | NETIF_F_LLTX;
        dev->gso_max_size = real_dev->gso_max_size;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d3a05b9ade7a..bcd158f40bb9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -393,6 +393,9 @@ int hci_conn_del(struct hci_conn *conn)
        hci_dev_put(hdev);
+        if (conn->handle == 0)
+                kfree(conn);
        return 0;
 }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index c405a954a603..43b4c2deb7cc 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -464,7 +464,8 @@ static void hidp_idle_timeout(unsigned long arg)
 {
        struct hidp_session *session = (struct hidp_session *) arg;
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 }
 static void hidp_set_timer(struct hidp_session *session)
@@ -535,7 +536,8 @@ static void hidp_process_hid_control(struct hidp_session *session,
                skb_queue_purge(&session->ctrl_transmit);
                skb_queue_purge(&session->intr_transmit);
-                kthread_stop(session->task);
+                atomic_inc(&session->terminate);
+                wake_up_process(current);
        }
 }
@@ -706,9 +708,8 @@ static int hidp_session(void *arg)
        add_wait_queue(sk_sleep(intr_sk), &intr_wait);
        session->waiting_for_startup = 0;
        wake_up_interruptible(&session->startup_queue);
-        while (!kthread_should_stop()) {
+        set_current_state(TASK_INTERRUPTIBLE);
-                set_current_state(TASK_INTERRUPTIBLE);
+        while (!atomic_read(&session->terminate)) {
                if (ctrl_sk->sk_state != BT_CONNECTED ||
                                intr_sk->sk_state != BT_CONNECTED)
                        break;
@@ -726,6 +727,7 @@ static int hidp_session(void *arg)
                hidp_process_transmit(session);
                schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
@@ -1060,7 +1062,8 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 err_add_device:
        hid_destroy_device(session->hid);
        session->hid = NULL;
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 unlink:
        hidp_del_timer(session);
@@ -1111,7 +1114,8 @@ int hidp_del_connection(struct hidp_conndel_req *req)
                        skb_queue_purge(&session->ctrl_transmit);
                        skb_queue_purge(&session->intr_transmit);
-                        kthread_stop(session->task);
+                        atomic_inc(&session->terminate);
+                        wake_up_process(session->task);
                }
        } else
                err = -ENOENT;
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 19e95004b286..af1bcc823f26 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -142,6 +142,7 @@ struct hidp_session {
        uint ctrl_mtu;
        uint intr_mtu;
+        atomic_t terminate;
        struct task_struct *task;
        unsigned char keys[8];
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 56fdd9162da9..7705e26e699f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -620,7 +620,8 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                        struct sock *parent = bt_sk(sk)->parent;
                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
-                                        parent->sk_data_ready(parent, 0);
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
                                } else {
                                        sk->sk_state = BT_CONFIG;
@@ -2323,7 +2324,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        sk = chan->sk;
-        if (sk->sk_state != BT_CONFIG) {
+        if (sk->sk_state != BT_CONFIG && sk->sk_state != BT_CONNECT2) {
                struct l2cap_cmd_rej rej;
                rej.reason = cpu_to_le16(0x0002);
@@ -2334,7 +2335,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        /* Reject if config buffer is too small. */
        len = cmd_len - sizeof(*req);
-        if (chan->conf_len + len > sizeof(chan->conf_req)) {
+        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                l2cap_build_conf_rsp(chan, rsp,
                                        L2CAP_CONF_REJECT, flags), rsp);
@@ -4009,7 +4010,8 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                        struct sock *parent = bt_sk(sk)->parent;
                                        res = L2CAP_CR_PEND;
                                        stat = L2CAP_CS_AUTHOR_PEND;
-                                        parent->sk_data_ready(parent, 0);
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
                                } else {
                                        sk->sk_state = BT_CONFIG;
                                        res = L2CAP_CR_SUCCESS;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 58ffa7d069c7..669d2e32efb6 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                      IEEE80211_MAX_SSID_LEN +
-                                                      local->scan_ies_len,
+                                                      local->scan_ies_len +
+                                                      req->ie_len,
                                                      GFP_KERNEL);
                if (!local->sched_scan_ies.ie[i]) {
                        ret = -ENOMEM;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index d91c1a26630d..8f6a302d2ac3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -86,6 +86,11 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int queue = rx->queue;
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
        /*
         * it makes no sense to check for MIC errors on anything other
@@ -148,8 +153,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 update_iv:
        /* update IV in key information to be able to detect replays */
-        rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
+        rx->key->u.tkip.rx[queue].iv32 = rx->tkip_iv32;
-        rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
+        rx->key->u.tkip.rx[queue].iv16 = rx->tkip_iv16;
        return RX_CONTINUE;
@@ -241,6 +246,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
        struct ieee80211_key *key = rx->key;
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        int queue = rx->queue;
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -261,7 +271,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
        res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
                                          key, skb->data + hdrlen,
                                          skb->len - hdrlen, rx->sta->sta.addr,
-                                          hdr->addr1, hwaccel, rx->queue,
+                                          hdr->addr1, hwaccel, queue,
                                          &rx->tkip_iv32,
                                          &rx->tkip_iv16);
        if (res != TKIP_DECRYPT_OK)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index b4f3cf06d8da..08b3cead6503 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -500,23 +500,20 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: Adler-32 is no longer applicable, as has been replaced
         * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
         */
-        if (!sctp_checksum_disable &&
+        if (!sctp_checksum_disable) {
-            !(dst->dev->features & (NETIF_F_NO_CSUM | NETIF_F_SCTP_CSUM))) {
+                if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
-                __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
+                        __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
-                /* 3) Put the resultant value into the checksum field in the
+                        /* 3) Put the resultant value into the checksum field in the
-                 *    common header, and leave the rest of the bits unchanged.
+                         *    common header, and leave the rest of the bits unchanged.
-                 */
+                         */
-                sh->checksum = sctp_end_cksum(crc32);
+                        sh->checksum = sctp_end_cksum(crc32);
-        } else {
+                } else {
-                if (dst->dev->features & NETIF_F_SCTP_CSUM) {
                        /* no need to seed pseudo checksum for SCTP */
                        nskb->ip_summed = CHECKSUM_PARTIAL;
                        nskb->csum_start = (skb_transport_header(nskb) -
                                            nskb->head);
                        nskb->csum_offset = offsetof(struct sctphdr, checksum);
-                } else {
-                        nskb->ip_summed = CHECKSUM_UNNECESSARY;
                }
        }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1c88c8911dc5..d03682109b7a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1582,6 +1582,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 #endif /* SCTP_DEBUG */
        if (transport) {
                if (bytes_acked) {
+                        struct sctp_association *asoc = transport->asoc;
                        /* We may have counted DATA that was migrated
                         * to this transport due to DEL-IP operation.
                         * Subtract those bytes, since the were never
@@ -1600,6 +1602,17 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                        transport->error_count = 0;
                        transport->asoc->overall_error_count = 0;
+                        /*
+                         * While in SHUTDOWN PENDING, we may have started
+                         * the T5 shutdown guard timer after reaching the
+                         * retransmission limit. Stop that timer as soon
+                         * as the receiver acknowledged any data.
+                         */
+                        if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING &&
+                            del_timer(&asoc->timers
+                                [SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]))
+                                        sctp_association_put(asoc);
                        /* Mark the destination transport address as
                         * active if it is not so marked.
                         */
@@ -1629,10 +1642,15 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         * A sender is doing zero window probing when the
                         * receiver's advertised window is zero, and there is
                         * only one data chunk in flight to the receiver.
+                         *
+                         * Allow the association to timeout while in SHUTDOWN
+                         * PENDING or SHUTDOWN RECEIVED in case the receiver
+                         * stays in zero window mode forever.
                         */
                        if (!q->asoc->peer.rwnd &&
                            !list_empty(&tlist) &&
-                            (sack_ctsn+2 == q->asoc->next_tsn)) {
+                            (sack_ctsn+2 == q->asoc->next_tsn) &&
+                            q->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) {
                                SCTP_DEBUG_PRINTK("%s: SACK received for zero "
                                                  "window probe: %u\n",
                                                  __func__, sack_ctsn);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 534c2e5feb05..6e0f88295aaf 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -670,10 +670,19 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
        /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
         * HEARTBEAT should clear the error counter of the destination
         * transport address to which the HEARTBEAT was sent.
-         * The association's overall error count is also cleared.
         */
        t->error_count = 0;
-        t->asoc->overall_error_count = 0;
+        /*
+         * Although RFC4960 specifies that the overall error count must
+         * be cleared when a HEARTBEAT ACK is received, we make an
+         * exception while in SHUTDOWN PENDING. If the peer keeps its
+         * window shut forever, we may never be able to transmit our
+         * outstanding data and rely on the retransmission limit be reached
+         * to shutdown the association.
+         */
+        if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
+                t->asoc->overall_error_count = 0;
        /* Clear the hb_sent flag to signal that we had a good
         * acknowledgement.
@@ -1437,6 +1446,13 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                        sctp_cmd_setup_t2(commands, asoc, cmd->obj.ptr);
                        break;
+                case SCTP_CMD_TIMER_START_ONCE:
+                        timer = &asoc->timers[cmd->obj.to];
+                        if (timer_pending(timer))
+                                break;
+                        /* fall through */
                case SCTP_CMD_TIMER_START:
                        timer = &asoc->timers[cmd->obj.to];
                        timeout = asoc->timeouts[cmd->obj.to];
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a297283154d5..246117142b5c 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5154,7 +5154,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
         * The sender of the SHUTDOWN MAY also start an overall guard timer
         * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
         */
-        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
+        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
        if (asoc->autoclose)
@@ -5299,14 +5299,28 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
        SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
        if (asoc->overall_error_count >= asoc->max_retrans) {
-                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
-                                SCTP_ERROR(ETIMEDOUT));
+                        /*
-                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
+                         * We are here likely because the receiver had its rwnd
-                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                         * closed for a while and we have not been able to
-                                SCTP_PERR(SCTP_ERROR_NO_ERROR));
+                         * transmit the locally queued data within the maximum
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                         * retransmission attempts limit.  Start the T5
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                         * shutdown guard timer to give the receiver one last
-                return SCTP_DISPOSITION_DELETE_TCB;
+                         * chance and some additional time to recover before
+                         * aborting.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
+                                SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
+                } else {
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                        SCTP_ERROR(ETIMEDOUT));
+                        /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                                        SCTP_PERR(SCTP_ERROR_NO_ERROR));
+                        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                        return SCTP_DISPOSITION_DELETE_TCB;
+                }
        }
        /* E1) For the destination address for which the timer
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 0338dc6fdc9d..7c211a7f90f4 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -827,7 +827,7 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
        /* SCTP_STATE_ESTABLISHED */ \
        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
        /* SCTP_STATE_SHUTDOWN_PENDING */ \
-        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
+        TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
        /* SCTP_STATE_SHUTDOWN_SENT */ \
        TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
        /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 08c6238802de..d3ccf7973c59 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1384,6 +1384,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
        struct sctp_endpoint *ep;
        struct sctp_association *asoc;
        struct list_head *pos, *temp;
+        unsigned int data_was_unread;
        SCTP_DEBUG_PRINTK("sctp_close(sk: 0x%p, timeout:%ld)\n", sk, timeout);
@@ -1393,6 +1394,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
        ep = sctp_sk(sk)->ep;
+        /* Clean up any skbs sitting on the receive queue.  */
+        data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
+        data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
        /* Walk all associations on an endpoint.  */
        list_for_each_safe(pos, temp, &ep->asocs) {
                asoc = list_entry(pos, struct sctp_association, asocs);
@@ -1410,7 +1415,9 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                        }
                }
-                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
+                if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
+                    !skb_queue_empty(&asoc->ulpq.reasm) ||
+                    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
                        struct sctp_chunk *chunk;
                        chunk = sctp_make_abort_user(asoc, NULL, 0);
@@ -1420,10 +1427,6 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                        sctp_primitive_SHUTDOWN(asoc, NULL);
        }
-        /* Clean up any skbs sitting on the receive queue.  */
-        sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
-        sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
        /* On a TCP-style socket, block for at most linger_time if set. */
        if (sctp_style(sk, TCP) && timeout)
                sctp_wait_for_close(sk, timeout);
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index e70e5fc87890..8a84017834c2 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -1081,9 +1081,19 @@ void sctp_ulpevent_free(struct sctp_ulpevent *event)
 }
 /* Purge the skb lists holding ulpevents. */
-void sctp_queue_purge_ulpevents(struct sk_buff_head *list)
+unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list)
 {
        struct sk_buff *skb;
-        while ((skb = skb_dequeue(list)) != NULL)
+        unsigned int data_unread = 0;
-                sctp_ulpevent_free(sctp_skb2event(skb));
+        while ((skb = skb_dequeue(list)) != NULL) {
+                struct sctp_ulpevent *event = sctp_skb2event(skb);
+                if (!sctp_ulpevent_is_notification(event))
+                        data_unread += skb->len;
+                sctp_ulpevent_free(event);
+        }
+        return data_unread;
 }
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 9a80a922c527..e45d2fbbe5a8 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -597,7 +597,7 @@ void rpcb_getport_async(struct rpc_task *task)
        u32 bind_version;
        struct rpc_xprt *xprt;
        struct rpc_clnt *rpcb_clnt;
-        static struct rpcbind_args *map;
+        struct rpcbind_args *map;
        struct rpc_task *child;
        struct sockaddr_storage addr;
        struct sockaddr *sap = (struct sockaddr *)&addr;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index a27406b1654f..4814e246a874 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -616,30 +616,25 @@ static void __rpc_execute(struct rpc_task *task)
        BUG_ON(RPC_IS_QUEUED(task));
        for (;;) {
+                void (*do_action)(struct rpc_task *);
                /*
-                 * Execute any pending callback.
+                 * Execute any pending callback first.
                 */
-                if (task->tk_callback) {
+                do_action = task->tk_callback;
-                        void (*save_callback)(struct rpc_task *);
+                task->tk_callback = NULL;
+                if (do_action == NULL) {
-                        /*
-                         * We set tk_callback to NULL before calling it,
-                         * in case it sets the tk_callback field itself:
-                         */
-                        save_callback = task->tk_callback;
-                        task->tk_callback = NULL;
-                        save_callback(task);
-                } else {
                        /*
                         * Perform the next FSM step.
-                         * tk_action may be NULL when the task has been killed
+                         * tk_action may be NULL if the task has been killed.
-                         * by someone else.
+                         * In particular, note that rpc_killall_tasks may
+                         * do this at any time, so beware when dereferencing.
                         */
-                        if (task->tk_action == NULL)
+                        do_action = task->tk_action;
+                        if (do_action == NULL)
                                break;
-                        task->tk_action(task);
                }
+                do_action(task);
                /*
                 * Lockless check for whether task is sleeping or not.
diff --git a/net/wireless/core.c b/net/wireless/core.c
index c22ef3492ee6..880dbe2e6f94 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -366,6 +366,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
        mutex_init(&rdev->mtx);
        mutex_init(&rdev->devlist_mtx);
+        mutex_init(&rdev->sched_scan_mtx);
        INIT_LIST_HEAD(&rdev->netdev_list);
        spin_lock_init(&rdev->bss_lock);
        INIT_LIST_HEAD(&rdev->bss_list);
@@ -701,6 +702,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
        rfkill_destroy(rdev->rfkill);
        mutex_destroy(&rdev->mtx);
        mutex_destroy(&rdev->devlist_mtx);
+        mutex_destroy(&rdev->sched_scan_mtx);
        list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                cfg80211_put_bss(&scan->pub);
        cfg80211_rdev_free_wowlan(rdev);
@@ -737,12 +739,16 @@ static void wdev_cleanup_work(struct work_struct *work)
                ___cfg80211_scan_done(rdev, true);
        }
+        cfg80211_unlock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        if (WARN_ON(rdev->sched_scan_req &&
                    rdev->sched_scan_req->dev == wdev->netdev)) {
                __cfg80211_stop_sched_scan(rdev, false);
        }
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
        mutex_lock(&rdev->devlist_mtx);
        rdev->opencount--;
@@ -830,9 +836,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                        break;
                case NL80211_IFTYPE_P2P_CLIENT:
                case NL80211_IFTYPE_STATION:
-                        cfg80211_lock_rdev(rdev);
+                        mutex_lock(&rdev->sched_scan_mtx);
                        __cfg80211_stop_sched_scan(rdev, false);
-                        cfg80211_unlock_rdev(rdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
                        wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3dce1f167eba..a570ff9214ec 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -65,6 +65,8 @@ struct cfg80211_registered_device {
        struct work_struct scan_done_wk;
        struct work_struct sched_scan_results_wk;
+        struct mutex sched_scan_mtx;
 #ifdef CONFIG_NL80211_TESTMODE
        struct genl_info *testmode_info;
 #endif
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f07602d7bf68..cea338150d05 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3461,9 +3461,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                return -EINVAL;
-        if (rdev->sched_scan_req)
-                return -EINPROGRESS;
        if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
                return -EINVAL;
@@ -3502,12 +3499,21 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        if (ie_len > wiphy->max_scan_ie_len)
                return -EINVAL;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->sched_scan_req) {
+                err = -EINPROGRESS;
+                goto out;
+        }
        request = kzalloc(sizeof(*request)
                        + sizeof(*request->ssids) * n_ssids
                        + sizeof(*request->channels) * n_channels
                        + ie_len, GFP_KERNEL);
-        if (!request)
+        if (!request) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
+        }
        if (n_ssids)
                request->ssids = (void *)&request->channels[n_channels];
@@ -3605,6 +3611,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
        kfree(request);
 out:
+        mutex_unlock(&rdev->sched_scan_mtx);
        return err;
 }
@@ -3612,12 +3619,17 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                   struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
            !rdev->ops->sched_scan_stop)
                return -EOPNOTSUPP;
-        return __cfg80211_stop_sched_scan(rdev, false);
+        mutex_lock(&rdev->sched_scan_mtx);
+        err = __cfg80211_stop_sched_scan(rdev, false);
+        mutex_unlock(&rdev->sched_scan_mtx);
+        return err;
 }
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 7a6c67667d70..ae0c2256ba3b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -100,14 +100,14 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
        rdev = container_of(wk, struct cfg80211_registered_device,
                            sched_scan_results_wk);
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        /* we don't have sched_scan_req anymore if the scan is stopping */
        if (rdev->sched_scan_req)
                nl80211_send_sched_scan_results(rdev,
                                                rdev->sched_scan_req->dev);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 void cfg80211_sched_scan_results(struct wiphy *wiphy)
@@ -123,9 +123,9 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
 {
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        __cfg80211_stop_sched_scan(rdev, true);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
@@ -135,7 +135,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
        int err;
        struct net_device *dev;
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
        if (!rdev->sched_scan_req)
                return 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d70f85eb7864..9414b9c5b1e4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1345,6 +1345,8 @@ out:
                        xfrm_state_check_expire(x1);
                err = 0;
+                x->km.state = XFRM_STATE_DEAD;
+                __xfrm_state_put(x);
        }
        spin_unlock_bh(&x1->lock);
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index 3b029cba2baf..a27235685949 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -21,13 +21,15 @@ fi
 # older versions of depmod require the version string to start with three
 # numbers, so we cheat with a symlink here
 depmod_hack_needed=true
-mkdir -p .tmp_depmod/lib/modules/$KERNELRELEASE
+tmp_dir=$(mktemp -d ${TMPDIR:-/tmp}/depmod.XXXXXX)
-if "$DEPMOD" -b .tmp_depmod $KERNELRELEASE 2>/dev/null; then
+mkdir -p "$tmp_dir/lib/modules/$KERNELRELEASE"
-        if test -e .tmp_depmod/lib/modules/$KERNELRELEASE/modules.dep -o \
+if "$DEPMOD" -b "$tmp_dir" $KERNELRELEASE 2>/dev/null; then
-                -e .tmp_depmod/lib/modules/$KERNELRELEASE/modules.dep.bin; then
+        if test -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep" -o \
+                -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep.bin"; then
                depmod_hack_needed=false
        fi
 fi
+rm -rf "$tmp_dir"
 if $depmod_hack_needed; then
        symlink="$INSTALL_MOD_PATH/lib/modules/99.98.$KERNELRELEASE"
        ln -s "$KERNELRELEASE" "$symlink"
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index c2fc0356c2a4..83014a7c2e14 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1190,7 +1190,6 @@ SND_SOC_DAPM_INPUT("DMIC1DAT"),
 SND_SOC_DAPM_INPUT("DMIC2DAT"),
 SND_SOC_DAPM_INPUT("Clock"),
-SND_SOC_DAPM_MICBIAS("MICBIAS", WM8994_MICBIAS, 2, 0),
 SND_SOC_DAPM_SUPPLY_S("MICBIAS Supply", 1, SND_SOC_NOPM, 0, 0, micbias_ev,
                      SND_SOC_DAPM_PRE_PMU),
@@ -1509,8 +1508,10 @@ static const struct snd_soc_dapm_route wm8994_revd_intercon[] = {
        { "AIF2DACDAT", NULL, "AIF1DACDAT" },
        { "AIF1ADCDAT", NULL, "AIF2ADCDAT" },
        { "AIF2ADCDAT", NULL, "AIF1ADCDAT" },
-        { "MICBIAS", NULL, "CLK_SYS" },
+        { "MICBIAS1", NULL, "CLK_SYS" },
-        { "MICBIAS", NULL, "MICBIAS Supply" },
+        { "MICBIAS1", NULL, "MICBIAS Supply" },
+        { "MICBIAS2", NULL, "CLK_SYS" },
+        { "MICBIAS2", NULL, "MICBIAS Supply" },
 };
 static const struct snd_soc_dapm_route wm8994_intercon[] = {
@@ -2763,7 +2764,7 @@ static void wm8958_default_micdet(u16 status, void *data)
        report = SND_JACK_MICROPHONE;
        /* Everything else is buttons; just assign slots */
-        if (status & 0x1c0)
+        if (status & 0x1c)
                report |= SND_JACK_BTN_0;
 done:
diff --git a/sound/soc/sh/fsi-ak4642.c b/sound/soc/sh/fsi-ak4642.c
index d6f4703b3c07..770a71a15366 100644
--- a/sound/soc/sh/fsi-ak4642.c
+++ b/sound/soc/sh/fsi-ak4642.c
@@ -97,7 +97,7 @@ static int fsi_ak4642_remove(struct platform_device *pdev)
 static struct fsi_ak4642_data fsi_a_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSIA (AK4642)",
+        .card           = "FSIA-AK4642",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi.0",
@@ -106,7 +106,7 @@ static struct fsi_ak4642_data fsi_a_ak4642 = {
 static struct fsi_ak4642_data fsi_b_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSIB (AK4642)",
+        .card           = "FSIB-AK4642",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi.0",
@@ -115,7 +115,7 @@ static struct fsi_ak4642_data fsi_b_ak4642 = {
 static struct fsi_ak4642_data fsi_a_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSIA (AK4643)",
+        .card           = "FSIA-AK4643",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi.0",
@@ -124,7 +124,7 @@ static struct fsi_ak4642_data fsi_a_ak4643 = {
 static struct fsi_ak4642_data fsi_b_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSIB (AK4643)",
+        .card           = "FSIB-AK4643",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi.0",
@@ -133,7 +133,7 @@ static struct fsi_ak4642_data fsi_b_ak4643 = {
 static struct fsi_ak4642_data fsi2_a_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSI2A (AK4642)",
+        .card           = "FSI2A-AK4642",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi2",
@@ -142,7 +142,7 @@ static struct fsi_ak4642_data fsi2_a_ak4642 = {
 static struct fsi_ak4642_data fsi2_b_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSI2B (AK4642)",
+        .card           = "FSI2B-AK4642",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi2",
@@ -151,7 +151,7 @@ static struct fsi_ak4642_data fsi2_b_ak4642 = {
 static struct fsi_ak4642_data fsi2_a_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSI2A (AK4643)",
+        .card           = "FSI2A-AK4643",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi2",
@@ -160,7 +160,7 @@ static struct fsi_ak4642_data fsi2_a_ak4643 = {
 static struct fsi_ak4642_data fsi2_b_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSI2B (AK4643)",
+        .card           = "FSI2B-AK4643",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi2",
diff --git a/sound/soc/sh/fsi-da7210.c b/sound/soc/sh/fsi-da7210.c
index dbafd7ac5590..59553fd8c2fb 100644
--- a/sound/soc/sh/fsi-da7210.c
+++ b/sound/soc/sh/fsi-da7210.c
@@ -42,7 +42,7 @@ static struct snd_soc_dai_link fsi_da7210_dai = {
 };
 static struct snd_soc_card fsi_soc_card = {
-        .name           = "FSI (DA7210)",
+        .name           = "FSI-DA7210",
        .dai_link       = &fsi_da7210_dai,
        .num_links      = 1,
 };
diff --git a/sound/soc/sh/fsi-hdmi.c b/sound/soc/sh/fsi-hdmi.c
index 9719985eb82d..d3d9fd880680 100644
--- a/sound/soc/sh/fsi-hdmi.c
+++ b/sound/soc/sh/fsi-hdmi.c
@@ -83,13 +83,13 @@ static int fsi_hdmi_remove(struct platform_device *pdev)
 static struct fsi_hdmi_data fsi2_a_hdmi = {
        .cpu_dai        = "fsia-dai",
-        .card           = "FSI2A (SH MOBILE HDMI)",
+        .card           = "FSI2A-HDMI",
        .id             = FSI_PORT_A,
 };
 static struct fsi_hdmi_data fsi2_b_hdmi = {
        .cpu_dai        = "fsib-dai",
-        .card           = "FSI2B (SH MOBILE HDMI)",
+        .card           = "FSI2B-HDMI",
        .id             = FSI_PORT_B,
 };