205 files changed, 1733 insertions, 651 deletions

diff --git a/Documentation/devicetree/bindings/arm/mrvl.txt b/Documentation/devicetree/bindings/arm/mrvl.txt
new file mode 100644
index 000000000000..d8de933e9d81
--- /dev/null
+++ b/Documentation/devicetree/bindings/arm/mrvl.txt
@@ -0,0 +1,6 @@
+Marvell Platforms Device Tree Bindings
+----------------------------------------------------
+
+PXA168 Aspenite Board
+Required root node properties:
+        - compatible = "mrvl,pxa168-aspenite", "mrvl,pxa168";
diff --git a/Documentation/devicetree/bindings/gpio/mrvl-gpio.txt b/Documentation/devicetree/bindings/gpio/mrvl-gpio.txt
new file mode 100644
index 000000000000..1e34cfe5ebea
--- /dev/null
+++ b/Documentation/devicetree/bindings/gpio/mrvl-gpio.txt
@@ -0,0 +1,23 @@
+* Marvell PXA GPIO controller
+
+Required properties:
+- compatible : Should be "mrvl,pxa-gpio" or "mrvl,mmp-gpio"
+- reg : Address and length of the register set for the device
+- interrupts : Should be the port interrupt shared by all gpio pins, if
+- interrupt-name : Should be the name of irq resource.
+  one number.
+- gpio-controller : Marks the device node as a gpio controller.
+- #gpio-cells : Should be one.  It is the pin number.
+
+Example:
+
+        gpio: gpio@d4019000 {
+                compatible = "mrvl,mmp-gpio", "mrvl,pxa-gpio";
+                reg = <0xd4019000 0x1000>;
+                interrupts = <49>, <17>, <18>;
+                interrupt-name = "gpio_mux", "gpio0", "gpio1";
+                gpio-controller;
+                #gpio-cells = <1>;
+                interrupt-controller;
+                #interrupt-cells = <1>;
+      };
diff --git a/Documentation/devicetree/bindings/i2c/mrvl-i2c.txt b/Documentation/devicetree/bindings/i2c/mrvl-i2c.txt
new file mode 100644
index 000000000000..071eb3caae91
--- /dev/null
+++ b/Documentation/devicetree/bindings/i2c/mrvl-i2c.txt
@@ -0,0 +1,37 @@
+* I2C
+
+Required properties :
+
+ - reg : Offset and length of the register set for the device
+ - compatible : should be "mrvl,mmp-twsi" where CHIP is the name of a
+   compatible processor, e.g. pxa168, pxa910, mmp2, mmp3.
+   For the pxa2xx/pxa3xx, an additional node "mrvl,pxa-i2c" is required
+   as shown in the example below.
+
+Recommended properties :
+
+ - interrupts : <a b> where a is the interrupt number and b is a
+   field that represents an encoding of the sense and level
+   information for the interrupt.  This should be encoded based on
+   the information in section 2) depending on the type of interrupt
+   controller you have.
+ - interrupt-parent : the phandle for the interrupt controller that
+   services interrupts for this device.
+ - mrvl,i2c-polling : Disable interrupt of i2c controller. Polling
+   status register of i2c controller instead.
+ - mrvl,i2c-fast-mode : Enable fast mode of i2c controller.
+
+Examples:
+        twsi1: i2c@d4011000 {
+                compatible = "mrvl,mmp-twsi", "mrvl,pxa-i2c";
+                reg = <0xd4011000 0x1000>;
+                interrupts = <7>;
+                mrvl,i2c-fast-mode;
+        };
+        
+        twsi2: i2c@d4025000 {
+                compatible = "mrvl,mmp-twsi", "mrvl,pxa-i2c";
+                reg = <0xd4025000 0x1000>;
+                interrupts = <58>;
+        };
+
diff --git a/Documentation/devicetree/bindings/rtc/sa1100-rtc.txt b/Documentation/devicetree/bindings/rtc/sa1100-rtc.txt
new file mode 100644
index 000000000000..0cda19ad4859
--- /dev/null
+++ b/Documentation/devicetree/bindings/rtc/sa1100-rtc.txt
@@ -0,0 +1,17 @@
+* Marvell Real Time Clock controller
+
+Required properties:
+- compatible: should be "mrvl,sa1100-rtc"
+- reg: physical base address of the controller and length of memory mapped
+  region.
+- interrupts: Should be two. The first interrupt number is the rtc alarm
+  interrupt and the second interrupt number is the rtc hz interrupt.
+- interrupt-names: Assign name of irq resource.
+
+Example:
+        rtc: rtc@d4010000 {
+                compatible = "mrvl,mmp-rtc";
+                reg = <0xd4010000 0x1000>;
+                interrupts = <5>, <6>;
+                interrupt-name = "rtc 1Hz", "rtc alarm";
+        };
diff --git a/Documentation/devicetree/bindings/serial/mrvl-serial.txt b/Documentation/devicetree/bindings/serial/mrvl-serial.txt
new file mode 100644
index 000000000000..d744340de887
--- /dev/null
+++ b/Documentation/devicetree/bindings/serial/mrvl-serial.txt
@@ -0,0 +1,4 @@
+PXA UART controller
+
+Required properties:
+- compatible : should be "mrvl,mmp-uart" or "mrvl,pxa-uart".
diff --git a/MAINTAINERS b/MAINTAINERS
index 09a04b4141a8..f096b0d8e973 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3789,7 +3789,7 @@ F:	Documentation/kdump/
 
 KERNEL AUTOMOUNTER v4 (AUTOFS4)
 M:      Ian Kent <raven@themaw.net>
-L:      autofs@linux.kernel.org
+L:      autofs@vger.kernel.org
 S:      Maintained
 F:      fs/autofs4/
 
@@ -4694,7 +4694,7 @@ NTFS FILESYSTEM
 M:      Anton Altaparmakov <anton@tuxera.com>
 L:      linux-ntfs-dev@lists.sourceforge.net
 W:      http://www.tuxera.com/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs.git
 S:      Supported
 F:      Documentation/filesystems/ntfs.txt
 F:      fs/ntfs/
@@ -7280,7 +7280,7 @@ WATCHDOG DEVICE DRIVERS
 M:      Wim Van Sebroeck <wim@iguana.be>
 L:      linux-watchdog@vger.kernel.org
 W:      http://www.linux-watchdog.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog.git
+T:      git git://www.linux-watchdog.org/linux-watchdog.git
 S:      Maintained
 F:      Documentation/watchdog/
 F:      drivers/watchdog/
diff --git a/Makefile b/Makefile
index b61a9638b6fc..66d13c917bc7 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/pxa168-aspenite.dts b/arch/arm/boot/dts/pxa168-aspenite.dts
new file mode 100644
index 000000000000..e762facb3fa4
--- /dev/null
+++ b/arch/arm/boot/dts/pxa168-aspenite.dts
@@ -0,0 +1,38 @@
+/*
+ *  Copyright (C) 2012 Marvell Technology Group Ltd.
+ *  Author: Haojian Zhuang <haojian.zhuang@marvell.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  publishhed by the Free Software Foundation.
+ */
+
+/dts-v1/;
+/include/ "pxa168.dtsi"
+
+/ {
+        model = "Marvell PXA168 Aspenite Development Board";
+        compatible = "mrvl,pxa168-aspenite", "mrvl,pxa168";
+
+        chosen {
+                bootargs = "console=ttyS0,115200 root=/dev/nfs nfsroot=192.168.1.100:/nfsroot/ ip=192.168.1.101:192.168.1.100::255.255.255.0::eth0:on";
+        };
+
+        memory {
+                reg = <0x00000000 0x04000000>;
+        };
+
+        soc {
+                apb@d4000000 {
+                        uart1: uart@d4017000 {
+                                status = "okay";
+                        };
+                        twsi1: i2c@d4011000 {
+                                status = "okay";
+                        };
+                        rtc: rtc@d4010000 {
+                                status = "okay";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/boot/dts/pxa168.dtsi b/arch/arm/boot/dts/pxa168.dtsi
new file mode 100644
index 000000000000..d32d5128f225
--- /dev/null
+++ b/arch/arm/boot/dts/pxa168.dtsi
@@ -0,0 +1,98 @@
+/*
+ *  Copyright (C) 2012 Marvell Technology Group Ltd.
+ *  Author: Haojian Zhuang <haojian.zhuang@marvell.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  publishhed by the Free Software Foundation.
+ */
+
+/include/ "skeleton.dtsi"
+
+/ {
+        aliases {
+                serial0 = &uart1;
+                serial1 = &uart2;
+                serial2 = &uart3;
+                i2c0 = &twsi1;
+                i2c1 = &twsi2;
+        };
+
+        intc: intc-interrupt-controller@d4282000 {
+                compatible = "mrvl,mmp-intc", "mrvl,intc";
+                interrupt-controller;
+                #interrupt-cells = <1>;
+                reg = <0xd4282000 0x1000>;
+        };
+
+        soc {
+                #address-cells = <1>;
+                #size-cells = <1>;
+                compatible = "simple-bus";
+                interrupt-parent = <&intc>;
+                ranges;
+
+                apb@d4000000 {  /* APB */
+                        compatible = "mrvl,apb-bus", "simple-bus";
+                        #address-cells = <1>;
+                        #size-cells = <1>;
+                        reg = <0xd4000000 0x00200000>;
+                        ranges;
+
+                        uart1: uart@d4017000 {
+                                compatible = "mrvl,mmp-uart", "mrvl,pxa-uart";
+                                reg = <0xd4017000 0x1000>;
+                                interrupts = <27>;
+                                status = "disabled";
+                        };
+
+                        uart2: uart@d4018000 {
+                                compatible = "mrvl,mmp-uart", "mrvl,pxa-uart";
+                                reg = <0xd4018000 0x1000>;
+                                interrupts = <28>;
+                                status = "disabled";
+                        };
+
+                        uart3: uart@d4026000 {
+                                compatible = "mrvl,mmp-uart", "mrvl,pxa-uart";
+                                reg = <0xd4026000 0x1000>;
+                                interrupts = <29>;
+                                status = "disabled";
+                        };
+
+                        gpio: gpio@d4019000 {
+                                compatible = "mrvl,mmp-gpio", "mrvl,pxa-gpio";
+                                reg = <0xd4019000 0x1000>;
+                                interrupts = <49>;
+                                interrupt-names = "gpio_mux";
+                                gpio-controller;
+                                #gpio-cells = <1>;
+                                interrupt-controller;
+                                #interrupt-cells = <1>;
+                        };
+
+                        twsi1: i2c@d4011000 {
+                                compatible = "mrvl,mmp-twsi", "mrvl,pxa-i2c";
+                                reg = <0xd4011000 0x1000>;
+                                interrupts = <7>;
+                                mrvl,i2c-fast-mode;
+                                status = "disabled";
+                        };
+
+                        twsi2: i2c@d4025000 {
+                                compatible = "mrvl,mmp-twsi", "mrvl,pxa-i2c";
+                                reg = <0xd4025000 0x1000>;
+                                interrupts = <58>;
+                                status = "disabled";
+                        };
+
+                        rtc: rtc@d4010000 {
+                                compatible = "mrvl,mmp-rtc";
+                                reg = <0xd4010000 0x1000>;
+                                interrupts = <5 6>;
+                                interrupt-names = "rtc 1Hz", "rtc alarm";
+                                status = "disabled";
+                        };
+                };
+        };
+};
diff --git a/arch/arm/mach-lpc32xx/include/mach/irqs.h b/arch/arm/mach-lpc32xx/include/mach/irqs.h
index 2667f52e3b04..9e3b90df32e1 100644
--- a/arch/arm/mach-lpc32xx/include/mach/irqs.h
+++ b/arch/arm/mach-lpc32xx/include/mach/irqs.h
@@ -61,7 +61,7 @@
  */
 #define IRQ_LPC32XX_JTAG_COMM_TX        LPC32XX_SIC1_IRQ(1)
 #define IRQ_LPC32XX_JTAG_COMM_RX        LPC32XX_SIC1_IRQ(2)
-#define IRQ_LPC32XX_GPI_11              LPC32XX_SIC1_IRQ(4)
+#define IRQ_LPC32XX_GPI_28              LPC32XX_SIC1_IRQ(4)
 #define IRQ_LPC32XX_TS_P                LPC32XX_SIC1_IRQ(6)
 #define IRQ_LPC32XX_TS_IRQ              LPC32XX_SIC1_IRQ(7)
 #define IRQ_LPC32XX_TS_AUX              LPC32XX_SIC1_IRQ(8)
diff --git a/arch/arm/mach-lpc32xx/irq.c b/arch/arm/mach-lpc32xx/irq.c
index 4eae566dfdc7..c74de01ab5b6 100644
--- a/arch/arm/mach-lpc32xx/irq.c
+++ b/arch/arm/mach-lpc32xx/irq.c
@@ -118,6 +118,10 @@ static const struct lpc32xx_event_info lpc32xx_events[NR_IRQS] = {
                 .event_group = &lpc32xx_event_pin_regs,
                 .mask = LPC32XX_CLKPWR_EXTSRC_GPI_06_BIT,
         },
+        [IRQ_LPC32XX_GPI_28] = {
+                .event_group = &lpc32xx_event_pin_regs,
+                .mask = LPC32XX_CLKPWR_EXTSRC_GPI_28_BIT,
+        },
         [IRQ_LPC32XX_GPIO_00] = {
                 .event_group = &lpc32xx_event_int_regs,
                 .mask = LPC32XX_CLKPWR_INTSRC_GPIO_00_BIT,
@@ -305,9 +309,18 @@ static int lpc32xx_irq_wake(struct irq_data *d, unsigned int state)
 
                 if (state)
                         eventreg |= lpc32xx_events[d->irq].mask;
-                else
+                else {
                         eventreg &= ~lpc32xx_events[d->irq].mask;
 
+                        /*
+                         * When disabling the wakeup, clear the latched
+                         * event
+                         */
+                        __raw_writel(lpc32xx_events[d->irq].mask,
+                                lpc32xx_events[d->irq].
+                                event_group->rawstat_reg);
+                }
+
                 __raw_writel(eventreg,
                         lpc32xx_events[d->irq].event_group->enab_reg);
 
@@ -380,13 +393,15 @@ void __init lpc32xx_init_irq(void)
 
         /* Setup SIC1 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
 
         /* Setup SIC2 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
 
         /* Configure supported IRQ's */
         for (i = 0; i < NR_IRQS; i++) {
diff --git a/arch/arm/mach-lpc32xx/serial.c b/arch/arm/mach-lpc32xx/serial.c
index 429cfdbb2b3d..f2735281616a 100644
--- a/arch/arm/mach-lpc32xx/serial.c
+++ b/arch/arm/mach-lpc32xx/serial.c
@@ -88,6 +88,7 @@ struct uartinit {
         char *uart_ck_name;
         u32 ck_mode_mask;
         void __iomem *pdiv_clk_reg;
+        resource_size_t mapbase;
 };
 
 static struct uartinit uartinit_data[] __initdata = {
@@ -97,6 +98,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 5),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART5_CLK_CTRL,
+                .mapbase = LPC32XX_UART5_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART3_SELECT
@@ -105,6 +107,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 3),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART3_CLK_CTRL,
+                .mapbase = LPC32XX_UART3_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART4_SELECT
@@ -113,6 +116,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 4),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART4_CLK_CTRL,
+                .mapbase = LPC32XX_UART4_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART6_SELECT
@@ -121,6 +125,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 6),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART6_CLK_CTRL,
+                .mapbase = LPC32XX_UART6_BASE,
         },
 #endif
 };
@@ -165,11 +170,24 @@ void __init lpc32xx_serial_init(void)
 
                 /* pre-UART clock divider set to 1 */
                 __raw_writel(0x0101, uartinit_data[i].pdiv_clk_reg);
+
+                /*
+                 * Force a flush of the RX FIFOs to work around a
+                 * HW bug
+                 */
+                puart = uartinit_data[i].mapbase;
+                __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
+                __raw_writel(0x00, LPC32XX_UART_DLL_FIFO(puart));
+                j = LPC32XX_SUART_FIFO_SIZE;
+                while (j--)
+                        tmp = __raw_readl(
+                                LPC32XX_UART_DLL_FIFO(puart));
+                __raw_writel(0, LPC32XX_UART_IIR_FCR(puart));
         }
 
         /* This needs to be done after all UART clocks are setup */
         __raw_writel(clkmodes, LPC32XX_UARTCTL_CLKMODE);
-        for (i = 0; i < ARRAY_SIZE(uartinit_data) - 1; i++) {
+        for (i = 0; i < ARRAY_SIZE(uartinit_data); i++) {
                 /* Force a flush of the RX FIFOs to work around a HW bug */
                 puart = serial_std_platform_data[i].mapbase;
                 __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
diff --git a/arch/arm/mach-mmp/Kconfig b/arch/arm/mach-mmp/Kconfig
index 323d4c9e9f44..5a90b9a3ab6e 100644
--- a/arch/arm/mach-mmp/Kconfig
+++ b/arch/arm/mach-mmp/Kconfig
@@ -2,6 +2,16 @@ if ARCH_MMP
 
 menu "Marvell PXA168/910/MMP2 Implmentations"
 
+config MACH_MMP_DT
+        bool "Support MMP2 platforms from device tree"
+        select CPU_PXA168
+        select CPU_PXA910
+        select USE_OF
+        help
+          Include support for Marvell MMP2 based platforms using
+          the device tree. Needn't select any other machine while
+          MACH_MMP_DT is enabled.
+
 config MACH_ASPENITE
         bool "Marvell's PXA168 Aspenite Development Board"
         select CPU_PXA168
diff --git a/arch/arm/mach-mmp/Makefile b/arch/arm/mach-mmp/Makefile
index ba254a71691a..4fc0ff5dc96d 100644
--- a/arch/arm/mach-mmp/Makefile
+++ b/arch/arm/mach-mmp/Makefile
@@ -18,5 +18,6 @@ obj-$(CONFIG_MACH_TTC_DKB)	+= ttc_dkb.o
 obj-$(CONFIG_MACH_BROWNSTONE)   += brownstone.o
 obj-$(CONFIG_MACH_FLINT)        += flint.o
 obj-$(CONFIG_MACH_MARVELL_JASPER) += jasper.o
+obj-$(CONFIG_MACH_MMP_DT)       += mmp-dt.o
 obj-$(CONFIG_MACH_TETON_BGA)    += teton_bga.o
 obj-$(CONFIG_MACH_GPLUGD)       += gplugd.o
diff --git a/arch/arm/mach-mmp/aspenite.c b/arch/arm/mach-mmp/aspenite.c
index 17cb76060125..3588a5584153 100644
--- a/arch/arm/mach-mmp/aspenite.c
+++ b/arch/arm/mach-mmp/aspenite.c
@@ -17,7 +17,6 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/nand.h>
 #include <linux/interrupt.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-mmp/mmp-dt.c b/arch/arm/mach-mmp/mmp-dt.c
new file mode 100644
index 000000000000..67075395e400
--- /dev/null
+++ b/arch/arm/mach-mmp/mmp-dt.c
@@ -0,0 +1,75 @@
+/*
+ *  linux/arch/arm/mach-mmp/mmp-dt.c
+ *
+ *  Copyright (C) 2012 Marvell Technology Group Ltd.
+ *  Author: Haojian Zhuang <haojian.zhuang@marvell.com>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 as
+ *  publishhed by the Free Software Foundation.
+ */
+
+#include <linux/irq.h>
+#include <linux/irqdomain.h>
+#include <linux/of_irq.h>
+#include <linux/of_platform.h>
+#include <asm/mach/arch.h>
+#include <mach/irqs.h>
+
+#include "common.h"
+
+extern struct sys_timer pxa168_timer;
+extern void __init icu_init_irq(void);
+
+static const struct of_dev_auxdata mmp_auxdata_lookup[] __initconst = {
+        OF_DEV_AUXDATA("mrvl,mmp-uart", 0xd4017000, "pxa2xx-uart.0", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-uart", 0xd4018000, "pxa2xx-uart.1", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-uart", 0xd4026000, "pxa2xx-uart.2", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-twsi", 0xd4011000, "pxa2xx-i2c.0", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-twsi", 0xd4025000, "pxa2xx-i2c.1", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-gpio", 0xd4019000, "pxa-gpio", NULL),
+        OF_DEV_AUXDATA("mrvl,mmp-rtc", 0xd4010000, "sa1100-rtc", NULL),
+        {}
+};
+
+static int __init mmp_intc_add_irq_domain(struct device_node *np,
+                                           struct device_node *parent)
+{
+        irq_domain_add_simple(np, 0);
+        return 0;
+}
+
+static int __init mmp_gpio_add_irq_domain(struct device_node *np,
+                                           struct device_node *parent)
+{
+        irq_domain_add_simple(np, IRQ_GPIO_START);
+        return 0;
+}
+
+static const struct of_device_id mmp_irq_match[] __initconst = {
+        { .compatible = "mrvl,mmp-intc", .data = mmp_intc_add_irq_domain, },
+        { .compatible = "mrvl,mmp-gpio", .data = mmp_gpio_add_irq_domain, },
+        {}
+};
+
+static void __init mmp_dt_init(void)
+{
+
+        of_irq_init(mmp_irq_match);
+
+        of_platform_populate(NULL, of_default_bus_match_table,
+                             mmp_auxdata_lookup, NULL);
+}
+
+static const char *pxa168_dt_board_compat[] __initdata = {
+        "mrvl,pxa168-aspenite",
+        NULL,
+};
+
+DT_MACHINE_START(PXA168_DT, "Marvell PXA168 (Device Tree Support)")
+        .map_io         = mmp_map_io,
+        .init_irq       = icu_init_irq,
+        .timer          = &pxa168_timer,
+        .init_machine   = mmp_dt_init,
+        .dt_compat      = pxa168_dt_board_compat,
+MACHINE_END
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 7bc17eaa12eb..e3d3533a5a3b 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -24,7 +24,6 @@
 #include <mach/dma.h>
 #include <mach/devices.h>
 #include <mach/mfp.h>
-#include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <mach/pxa168.h>
 
@@ -65,6 +64,7 @@ static APBC_CLK(ssp4, PXA168_SSP4, 4, 0);
 static APBC_CLK(ssp5, PXA168_SSP5, 4, 0);
 static APBC_CLK(gpio, PXA168_GPIO, 0, 13000000);
 static APBC_CLK(keypad, PXA168_KPC, 0, 32000);
+static APBC_CLK(rtc, PXA168_RTC, 8, 32768);
 
 static APMU_CLK(nand, NAND, 0x19b, 156000000);
 static APMU_CLK(lcd, LCD, 0x7f, 312000000);
@@ -93,6 +93,7 @@ static struct clk_lookup pxa168_clkregs[] = {
         INIT_CLKREG(&clk_keypad, "pxa27x-keypad", NULL),
         INIT_CLKREG(&clk_eth, "pxa168-eth", "MFUCLK"),
         INIT_CLKREG(&clk_usb, "pxa168-ehci", "PXA168-USBCLK"),
+        INIT_CLKREG(&clk_rtc, "sa1100-rtc", NULL),
 };
 
 static int __init pxa168_init(void)
diff --git a/arch/arm/mach-mmp/tavorevb.c b/arch/arm/mach-mmp/tavorevb.c
index 8e3b5af04a57..bc97170125bf 100644
--- a/arch/arm/mach-mmp/tavorevb.c
+++ b/arch/arm/mach-mmp/tavorevb.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/smc91x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index 309369ea6978..be2002f42dea 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -416,13 +416,13 @@ static void __init innovator_init(void)
 #ifdef CONFIG_ARCH_OMAP15XX
         if (cpu_is_omap1510()) {
                 omap1_usb_init(&innovator1510_usb_config);
-                innovator_config[1].data = &innovator1510_lcd_config;
+                innovator_config[0].data = &innovator1510_lcd_config;
         }
 #endif
 #ifdef CONFIG_ARCH_OMAP16XX
         if (cpu_is_omap1610()) {
                 omap1_usb_init(&h2_usb_config);
-                innovator_config[1].data = &innovator1610_lcd_config;
+                innovator_config[0].data = &innovator1610_lcd_config;
         }
 #endif
         omap_board_config = innovator_config;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 72ce50ecf328..3fdfaeb4ce20 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -363,8 +363,8 @@ config OMAP3_SDRC_AC_TIMING
           going on could result in system crashes;
 
 config OMAP4_ERRATA_I688
-        bool "OMAP4 errata: Async Bridge Corruption (BROKEN)"
-        depends on ARCH_OMAP4 && BROKEN
+        bool "OMAP4 errata: Async Bridge Corruption"
+        depends on ARCH_OMAP4
         select ARCH_HAS_BARRIERS
         help
           If a data is stalled inside asynchronous bridge because of back
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index 42a4d11fad23..672262717601 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -371,7 +371,11 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
         else
                 *openp = 0;
 
+#ifdef CONFIG_MMC_OMAP
         omap_mmc_notify_cover_event(mmc_device, index, *openp);
+#else
+        pr_warn("MMC: notify cover event not available\n");
+#endif
 }
 
 static int n8x0_mmc_late_init(struct device *dev)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index c775bead1497..c877236a8442 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -381,7 +381,7 @@ static int omap3evm_twl_gpio_setup(struct device *dev,
         gpio_request_one(gpio + 7, GPIOF_OUT_INIT_LOW, "EN_DVI");
 
         /* TWL4030_GPIO_MAX + 1 == ledB (out, active low LED) */
-        gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
+        gpio_leds[0].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
         platform_device_register(&leds_gpio);
 
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index febffde2ff10..7e9338e8d684 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -132,6 +132,7 @@ void omap3_map_io(void);
 void am33xx_map_io(void);
 void omap4_map_io(void);
 void ti81xx_map_io(void);
+void omap_barriers_init(void);
 
 /**
  * omap_test_timeout - busy-loop, testing a condition
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index cfdbb86bc84e..72e018b9b260 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -65,7 +65,6 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
         struct timespec ts_preidle, ts_postidle, ts_idle;
         u32 cpu1_state;
         int idle_time;
-        int new_state_idx;
         int cpu_id = smp_processor_id();
 
         /* Used to keep track of the total time in idle */
@@ -84,8 +83,8 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
          */
         cpu1_state = pwrdm_read_pwrst(cpu1_pd);
         if (cpu1_state != PWRDM_POWER_OFF) {
-                new_state_idx = drv->safe_state_index;
-                cx = cpuidle_get_statedata(&dev->states_usage[new_state_idx]);
+                index = drv->safe_state_index;
+                cx = cpuidle_get_statedata(&dev->states_usage[index]);
         }
 
         if (index > 0)
diff --git a/arch/arm/mach-omap2/gpmc-smsc911x.c b/arch/arm/mach-omap2/gpmc-smsc911x.c
index 997033129d26..bbb870c04a5e 100644
--- a/arch/arm/mach-omap2/gpmc-smsc911x.c
+++ b/arch/arm/mach-omap2/gpmc-smsc911x.c
@@ -19,6 +19,8 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 
 #include <plat/board.h>
 #include <plat/gpmc.h>
@@ -42,6 +44,50 @@ static struct smsc911x_platform_config gpmc_smsc911x_config = {
         .flags          = SMSC911X_USE_16BIT,
 };
 
+static struct regulator_consumer_supply gpmc_smsc911x_supply[] = {
+        REGULATOR_SUPPLY("vddvario", "smsc911x.0"),
+        REGULATOR_SUPPLY("vdd33a", "smsc911x.0"),
+};
+
+/* Generic regulator definition to satisfy smsc911x */
+static struct regulator_init_data gpmc_smsc911x_reg_init_data = {
+        .constraints = {
+                .min_uV                 = 3300000,
+                .max_uV                 = 3300000,
+                .valid_modes_mask       = REGULATOR_MODE_NORMAL
+                                        | REGULATOR_MODE_STANDBY,
+                .valid_ops_mask         = REGULATOR_CHANGE_MODE
+                                        | REGULATOR_CHANGE_STATUS,
+        },
+        .num_consumer_supplies  = ARRAY_SIZE(gpmc_smsc911x_supply),
+        .consumer_supplies      = gpmc_smsc911x_supply,
+};
+
+static struct fixed_voltage_config gpmc_smsc911x_fixed_reg_data = {
+        .supply_name            = "gpmc_smsc911x",
+        .microvolts             = 3300000,
+        .gpio                   = -EINVAL,
+        .startup_delay          = 0,
+        .enable_high            = 0,
+        .enabled_at_boot        = 1,
+        .init_data              = &gpmc_smsc911x_reg_init_data,
+};
+
+/*
+ * Platform device id of 42 is a temporary fix to avoid conflicts
+ * with other reg-fixed-voltage devices. The real fix should
+ * involve the driver core providing a way of dynamically
+ * assigning a unique id on registration for platform devices
+ * in the same name space.
+ */
+static struct platform_device gpmc_smsc911x_regulator = {
+        .name           = "reg-fixed-voltage",
+        .id             = 42,
+        .dev = {
+                .platform_data  = &gpmc_smsc911x_fixed_reg_data,
+        },
+};
+
 /*
  * Initialize smsc911x device connected to the GPMC. Note that we
  * assume that pin multiplexing is done in the board-*.c file,
@@ -55,6 +101,12 @@ void __init gpmc_smsc911x_init(struct omap_smsc911x_platform_data *board_data)
 
         gpmc_cfg = board_data;
 
+        ret = platform_device_register(&gpmc_smsc911x_regulator);
+        if (ret < 0) {
+                pr_err("Unable to register smsc911x regulators: %d\n", ret);
+                return;
+        }
+
         if (gpmc_cs_request(gpmc_cfg->cs, SZ_16M, &cs_mem_base) < 0) {
                 pr_err("Failed to request GPMC mem region\n");
                 return;
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index b40c28895298..19dd1657245c 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -428,6 +428,7 @@ static int omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
         return 0;
 }
 
+static int omap_hsmmc_done;
 #define MAX_OMAP_MMC_HWMOD_NAME_LEN             16
 
 void omap_init_hsmmc(struct omap2_hsmmc_info *hsmmcinfo, int ctrl_nr)
@@ -491,6 +492,11 @@ void omap2_hsmmc_init(struct omap2_hsmmc_info *controllers)
 {
         u32 reg;
 
+        if (omap_hsmmc_done)
+                return;
+
+        omap_hsmmc_done = 1;
+
         if (!cpu_is_omap44xx()) {
                 if (cpu_is_omap2430()) {
                         control_pbias_offset = OMAP243X_CONTROL_PBIAS_LITE;
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index eb50c29fb644..fb11b44fbdec 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -307,6 +307,7 @@ void __init omapam33xx_map_common_io(void)
 void __init omap44xx_map_common_io(void)
 {
         iotable_init(omap44xx_io_desc, ARRAY_SIZE(omap44xx_io_desc));
+        omap_barriers_init();
 }
 #endif
 
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index 609ea2ded7e3..2cc1aa004b94 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -281,8 +281,16 @@ static struct omap_mbox mbox_iva_info = {
         .ops    = &omap2_mbox_ops,
         .priv   = &omap2_mbox_iva_priv,
 };
+#endif
 
-struct omap_mbox *omap2_mboxes[] = { &mbox_dsp_info, &mbox_iva_info, NULL };
+#ifdef CONFIG_ARCH_OMAP2
+struct omap_mbox *omap2_mboxes[] = {
+        &mbox_dsp_info,
+#ifdef CONFIG_SOC_OMAP2420
+        &mbox_iva_info,
+#endif
+        NULL
+};
 #endif
 
 #if defined(CONFIG_ARCH_OMAP4)
@@ -412,7 +420,8 @@ static void __exit omap2_mbox_exit(void)
         platform_driver_unregister(&omap2_mbox_driver);
 }
 
-module_init(omap2_mbox_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap2_mbox_init);
 module_exit(omap2_mbox_exit);
 
 MODULE_LICENSE("GPL v2");
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fb8bc9fa43b1..611a0e3d54ca 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -218,7 +218,7 @@ static int _omap_mux_get_by_name(struct omap_mux_partition *partition,
         return -ENODEV;
 }
 
-static int __init
+static int
 omap_mux_get_by_name(const char *muxname,
                         struct omap_mux_partition **found_partition,
                         struct omap_mux **found_mux)
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 40a8fbc07e4b..ebc595091312 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -24,6 +24,7 @@
 
 #include <plat/irqs.h>
 #include <plat/sram.h>
+#include <plat/omap-secure.h>
 
 #include <mach/hardware.h>
 #include <mach/omap-wakeupgen.h>
@@ -43,6 +44,9 @@ static void __iomem *sar_ram_base;
 
 void __iomem *dram_sync, *sram_sync;
 
+static phys_addr_t paddr;
+static u32 size;
+
 void omap_bus_sync(void)
 {
         if (dram_sync && sram_sync) {
@@ -52,18 +56,20 @@ void omap_bus_sync(void)
         }
 }
 
-static int __init omap_barriers_init(void)
+/* Steal one page physical memory for barrier implementation */
+int __init omap_barrier_reserve_memblock(void)
 {
-        struct map_desc dram_io_desc[1];
-        phys_addr_t paddr;
-        u32 size;
-
-        if (!cpu_is_omap44xx())
-                return -ENODEV;
 
         size = ALIGN(PAGE_SIZE, SZ_1M);
         paddr = arm_memblock_steal(size, SZ_1M);
 
+        return 0;
+}
+
+void __init omap_barriers_init(void)
+{
+        struct map_desc dram_io_desc[1];
+
         dram_io_desc[0].virtual = OMAP4_DRAM_BARRIER_VA;
         dram_io_desc[0].pfn = __phys_to_pfn(paddr);
         dram_io_desc[0].length = size;
@@ -75,9 +81,10 @@ static int __init omap_barriers_init(void)
         pr_info("OMAP4: Map 0x%08llx to 0x%08lx for dram barrier\n",
                 (long long) paddr, dram_io_desc[0].virtual);
 
-        return 0;
 }
-core_initcall(omap_barriers_init);
+#else
+void __init omap_barriers_init(void)
+{}
 #endif
 
 void __init gic_init_irq(void)
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index ad4f69394166..44551edd8351 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -174,14 +174,17 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
         freq = clk->rate;
         clk_put(clk);
 
+        rcu_read_lock();
         opp = opp_find_freq_ceil(dev, &freq);
         if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 pr_err("%s: unable to find boot up OPP for vdd_%s\n",
                         __func__, vdd_name);
                 goto exit;
         }
 
         bootup_volt = opp_get_voltage(opp);
+        rcu_read_unlock();
         if (!bootup_volt) {
                 pr_err("%s: unable to find voltage corresponding "
                         "to the bootup OPP for vdd_%s\n", __func__, vdd_name);
diff --git a/arch/arm/mach-omap2/usb-host.c b/arch/arm/mach-omap2/usb-host.c
index 771dc781b746..f51348dafafd 100644
--- a/arch/arm/mach-omap2/usb-host.c
+++ b/arch/arm/mach-omap2/usb-host.c
@@ -486,7 +486,7 @@ static void setup_4430ohci_io_mux(const enum usbhs_omap_port_mode *port_mode)
 void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
 {
         struct omap_hwmod       *oh[2];
-        struct omap_device      *od;
+        struct platform_device  *pdev;
         int                     bus_id = -1;
         int                     i;
 
@@ -522,11 +522,11 @@ void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
                 return;
         }
 
-        od = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
+        pdev = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
                                 (void *)&usbhs_data, sizeof(usbhs_data),
                                 omap_uhhtll_latency,
                                 ARRAY_SIZE(omap_uhhtll_latency), false);
-        if (IS_ERR(od)) {
+        if (IS_ERR(pdev)) {
                 pr_err("Could not build hwmod devices %s,%s\n",
                         USBHS_UHH_HWMODNAME, USBHS_TLL_HWMODNAME);
                 return;
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index fb9b62dcf4ca..208eef1c0485 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -45,6 +45,7 @@
 #include <mach/hx4700.h>
 #include <mach/irda.h>
 
+#include <sound/ak4641.h>
 #include <video/platform_lcd.h>
 #include <video/w100fb.h>
 
@@ -765,6 +766,28 @@ static struct i2c_board_info __initdata pi2c_board_info[] = {
 };
 
 /*
+ * Asahi Kasei AK4641 on I2C
+ */
+
+static struct ak4641_platform_data ak4641_info = {
+        .gpio_power = GPIO27_HX4700_CODEC_ON,
+        .gpio_npdn  = GPIO109_HX4700_CODEC_nPDN,
+};
+
+static struct i2c_board_info i2c_board_info[] __initdata = {
+        {
+                I2C_BOARD_INFO("ak4641", 0x12),
+                .platform_data = &ak4641_info,
+        },
+};
+
+static struct platform_device audio = {
+        .name   = "hx4700-audio",
+        .id     = -1,
+};
+
+
+/*
  * PCMCIA
  */
 
@@ -790,6 +813,7 @@ static struct platform_device *devices[] __initdata = {
         &gpio_vbus,
         &power_supply,
         &strataflash,
+        &audio,
         &pcmcia,
 };
 
@@ -827,6 +851,7 @@ static void __init hx4700_init(void)
         pxa_set_ficp_info(&ficp_info);
         pxa27x_set_i2c_power_info(NULL);
         pxa_set_i2c_info(NULL);
+        i2c_register_board_info(0, ARRAY_AND_SIZE(i2c_board_info));
         i2c_register_board_info(1, ARRAY_AND_SIZE(pi2c_board_info));
         pxa2xx_set_spi_info(2, &pxa_ssp2_master_info);
         spi_register_board_info(ARRAY_AND_SIZE(tsc2046_board_info));
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 91e4f6c03766..00d6eacab8e4 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -25,7 +25,6 @@
 #include <linux/suspend.h>
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <asm/suspend.h>
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index aed6cbcf3866..c1673b3441d4 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/i2c/pxa-i2c.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <mach/hardware.h>
diff --git a/arch/arm/mach-pxa/saarb.c b/arch/arm/mach-pxa/saarb.c
index febc809ed5a6..5aded5e6148f 100644
--- a/arch/arm/mach-pxa/saarb.c
+++ b/arch/arm/mach-pxa/saarb.c
@@ -15,7 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <linux/mfd/88pm860x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
index 8d5168d253a9..30989baf7f2a 100644
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -168,6 +168,7 @@ struct battery_thresh sharpsl_battery_levels_noac[] = {
 #define MAXCTRL_SEL_SH   4
 #define MAXCTRL_STR      (1u << 7)
 
+extern int max1111_read_channel(int);
 /*
  * Read MAX1111 ADC
  */
@@ -177,8 +178,6 @@ int sharpsl_pm_pxa_read_max1111(int channel)
         if (machine_is_tosa())
             return 0;
 
-        extern int max1111_read_channel(int);
-
         /* max1111 accepts channels from 0-3, however,
          * it is encoded from 0-7 here in the code.
          */
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 34cbdac51525..438f02fe122a 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -172,10 +172,9 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
 static unsigned long spitz_charger_wakeup(void)
 {
         unsigned long ret;
-        ret = (!gpio_get_value(SPITZ_GPIO_KEY_INT)
+        ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
                 << GPIO_bit(SPITZ_GPIO_KEY_INT))
-                | (!gpio_get_value(SPITZ_GPIO_SYNC)
-                << GPIO_bit(SPITZ_GPIO_SYNC));
+                | gpio_get_value(SPITZ_GPIO_SYNC));
         return ret;
 }
 
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index 06383b51e655..4de7d1e79e73 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -69,6 +69,7 @@ void __init omap_reserve(void)
         omap_vram_reserve_sdram_memblock();
         omap_dsp_reserve_sdram_memblock();
         omap_secure_ram_reserve_memblock();
+        omap_barrier_reserve_memblock();
 }
 
 void __init omap_init_consistent_dma_size(void)
diff --git a/arch/arm/plat-omap/include/plat/omap-secure.h b/arch/arm/plat-omap/include/plat/omap-secure.h
index 3047ff923a63..8c7994ce9869 100644
--- a/arch/arm/plat-omap/include/plat/omap-secure.h
+++ b/arch/arm/plat-omap/include/plat/omap-secure.h
@@ -10,4 +10,10 @@ static inline void omap_secure_ram_reserve_memblock(void)
 { }
 #endif
 
+#ifdef CONFIG_OMAP4_ERRATA_I688
+extern int omap_barrier_reserve_memblock(void);
+#else
+static inline void omap_barrier_reserve_memblock(void)
+{ }
+#endif
 #endif /* __OMAP_SECURE_H__ */
diff --git a/arch/openrisc/include/asm/ptrace.h b/arch/openrisc/include/asm/ptrace.h
index 054537c5f9c9..e612ce4512c7 100644
--- a/arch/openrisc/include/asm/ptrace.h
+++ b/arch/openrisc/include/asm/ptrace.h
@@ -77,7 +77,6 @@ struct pt_regs {
         long  syscallno;        /* Syscall number (used by strace) */
         long dummy;             /* Cheap alignment fix */
 };
-#endif /* __ASSEMBLY__ */
 
 /* TODO: Rename this to REDZONE because that's what it is */
 #define STACK_FRAME_OVERHEAD  128  /* size of minimum stack frame */
@@ -87,6 +86,13 @@ struct pt_regs {
 #define user_stack_pointer(regs)        ((unsigned long)(regs)->sp)
 #define profile_pc(regs)                instruction_pointer(regs)
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->gpr[11];
+}
+
+#endif /* __ASSEMBLY__ */
+
 /*
  * Offsets used by 'ptrace' system call interface.
  */
diff --git a/arch/openrisc/kernel/init_task.c b/arch/openrisc/kernel/init_task.c
index 45744a384927..ca534082d5f3 100644
--- a/arch/openrisc/kernel/init_task.c
+++ b/arch/openrisc/kernel/init_task.c
@@ -17,6 +17,7 @@
 
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/export.h>
 
 static struct signal_struct init_signals = INIT_SIGNALS(init_signals);
 static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
index 59b302338331..4bfead220956 100644
--- a/arch/openrisc/kernel/irq.c
+++ b/arch/openrisc/kernel/irq.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/kernel_stat.h>
+#include <linux/export.h>
 
 #include <linux/irqflags.h>
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 656b94beab89..7259047d5f9d 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -188,11 +188,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                  */
                 ret = -1L;
 
-        /* Are these regs right??? */
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->syscallno,
-                                    regs->gpr[3], regs->gpr[4],
-                                    regs->gpr[5], regs->gpr[6]);
+        audit_syscall_entry(audit_arch(), regs->syscallno,
+                            regs->gpr[3], regs->gpr[4],
+                            regs->gpr[5], regs->gpr[6]);
 
         return ret ? : regs->syscallno;
 }
@@ -201,9 +199,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->gpr[11]),
-                                   regs->gpr[11]);
+        audit_syscall_exit(regs);
 
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 55cca1dac431..19ab7b2ea1cd 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -31,7 +31,11 @@ ifdef CONFIG_64BIT
 UTS_MACHINE     := parisc64
 CHECKFLAGS      += -D__LP64__=1 -m64
 WIDTH           := 64
+
+# FIXME: if no default set, should really try to locate dynamically
+ifeq ($(CROSS_COMPILE),)
 CROSS_COMPILE   := hppa64-linux-gnu-
+endif
 else # 32-bit
 WIDTH           :=
 endif
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index d1727584230a..6d99a5fcc090 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -227,6 +227,9 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
+config KEYS_COMPAT
+        def_bool y if COMPAT && KEYS
+
 config AUDIT_ARCH
         def_bool y
 
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index 2e49748b27da..234f1d859cea 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -172,13 +172,6 @@ static inline int is_compat_task(void)
         return is_32bit_task();
 }
 
-#else
-
-static inline int is_compat_task(void)
-{
-        return 0;
-}
-
 #endif
 
 static inline void __user *arch_compat_alloc_user_space(long len)
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 39f8fd4438fc..c383ce440d99 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
-#include <linux/crash_dump.h>
 #include <linux/bootmem.h>
 #include <linux/elf.h>
 #include <asm/ipl.h>
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 4261aa799774..e795933eb2cb 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -29,7 +29,6 @@
 #include <asm/irq.h>
 #include <asm/timer.h>
 #include <asm/nmi.h>
-#include <asm/compat.h>
 #include <asm/smp.h>
 #include "entry.h"
 
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 9d82ed4bcb27..61f95489d70c 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -20,8 +20,8 @@
 #include <linux/regset.h>
 #include <linux/tracehook.h>
 #include <linux/seccomp.h>
+#include <linux/compat.h>
 #include <trace/syscall.h>
-#include <asm/compat.h>
 #include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 354de0763eff..3b2efc81f34e 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -46,6 +46,7 @@
 #include <linux/kexec.h>
 #include <linux/crash_dump.h>
 #include <linux/memory.h>
+#include <linux/compat.h>
 
 #include <asm/ipl.h>
 #include <asm/uaccess.h>
@@ -59,7 +60,6 @@
 #include <asm/ptrace.h>
 #include <asm/sections.h>
 #include <asm/ebcdic.h>
-#include <asm/compat.h>
 #include <asm/kvm_virtio.h>
 #include <asm/diag.h>
 
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index a8ba840294ff..2d421d90fada 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -30,7 +30,6 @@
 #include <asm/ucontext.h>
 #include <asm/uaccess.h>
 #include <asm/lowcore.h>
-#include <asm/compat.h>
 #include "entry.h"
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 354dd39073ef..e8fcd928dc78 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -36,7 +36,6 @@
 #include <asm/pgtable.h>
 #include <asm/irq.h>
 #include <asm/mmu_context.h>
-#include <asm/compat.h>
 #include "../kernel/entry.h"
 
 #ifndef CONFIG_64BIT
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 5d633019d8f3..50236610de83 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -223,16 +223,38 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 #ifdef CONFIG_MEMORY_HOTPLUG
 int arch_add_memory(int nid, u64 start, u64 size)
 {
-        struct pglist_data *pgdat;
+        unsigned long zone_start_pfn, zone_end_pfn, nr_pages;
+        unsigned long start_pfn = PFN_DOWN(start);
+        unsigned long size_pages = PFN_DOWN(size);
         struct zone *zone;
         int rc;
 
-        pgdat = NODE_DATA(nid);
-        zone = pgdat->node_zones + ZONE_MOVABLE;
         rc = vmem_add_mapping(start, size);
         if (rc)
                 return rc;
-        rc = __add_pages(nid, zone, PFN_DOWN(start), PFN_DOWN(size));
+        for_each_zone(zone) {
+                if (zone_idx(zone) != ZONE_MOVABLE) {
+                        /* Add range within existing zone limits */
+                        zone_start_pfn = zone->zone_start_pfn;
+                        zone_end_pfn = zone->zone_start_pfn +
+                                       zone->spanned_pages;
+                } else {
+                        /* Add remaining range to ZONE_MOVABLE */
+                        zone_start_pfn = start_pfn;
+                        zone_end_pfn = start_pfn + size_pages;
+                }
+                if (start_pfn < zone_start_pfn || start_pfn >= zone_end_pfn)
+                        continue;
+                nr_pages = (start_pfn + size_pages > zone_end_pfn) ?
+                           zone_end_pfn - start_pfn : size_pages;
+                rc = __add_pages(nid, zone, start_pfn, nr_pages);
+                if (rc)
+                        break;
+                start_pfn += nr_pages;
+                size_pages -= nr_pages;
+                if (!size_pages)
+                        break;
+        }
         if (rc)
                 vmem_remove_mapping(start, size);
         return rc;
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index f09c74881b7e..a0155c02e324 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -29,8 +29,8 @@
 #include <linux/mman.h>
 #include <linux/module.h>
 #include <linux/random.h>
+#include <linux/compat.h>
 #include <asm/pgalloc.h>
-#include <asm/compat.h>
 
 static unsigned long stack_maxrandom_size(void)
 {
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 096c975e099f..461ce432b1c2 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -242,4 +242,12 @@ static inline void perf_get_x86_pmu_capability(struct x86_pmu_capability *cap)
 static inline void perf_events_lapic_init(void) { }
 #endif
 
+#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_AMD)
+ extern void amd_pmu_enable_virt(void);
+ extern void amd_pmu_disable_virt(void);
+#else
+ static inline void amd_pmu_enable_virt(void) { }
+ static inline void amd_pmu_disable_virt(void) { }
+#endif
+
 #endif /* _ASM_X86_PERF_EVENT_H */
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 6b45e5e7a901..73d08ed98a64 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indices(struct amd_northbridge *nb)
         l3->indices = (max(max3(sc0, sc1, sc2), sc3) << 10) - 1;
 }
 
-static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf,
-                                        int index)
+static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, int index)
 {
         int node;
 
@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_info *, ici_cpuid4_info);
 #define CPUID4_INFO_IDX(x, y)   (&((per_cpu(ici_cpuid4_info, x))[y]))
 
 #ifdef CONFIG_SMP
-static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
+
+static int __cpuinit cache_shared_amd_cpu_map_setup(unsigned int cpu, int index)
 {
-        struct _cpuid4_info     *this_leaf, *sibling_leaf;
-        unsigned long num_threads_sharing;
-        int index_msb, i, sibling;
+        struct _cpuid4_info *this_leaf;
+        int ret, i, sibling;
         struct cpuinfo_x86 *c = &cpu_data(cpu);
 
-        if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) {
+        ret = 0;
+        if (index == 3) {
+                ret = 1;
                 for_each_cpu(i, cpu_llc_shared_mask(cpu)) {
                         if (!per_cpu(ici_cpuid4_info, i))
                                 continue;
@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
                                 set_bit(sibling, this_leaf->shared_cpu_map);
                         }
                 }
-                return;
+        } else if ((c->x86 == 0x15) && ((index == 1) || (index == 2))) {
+                ret = 1;
+                for_each_cpu(i, cpu_sibling_mask(cpu)) {
+                        if (!per_cpu(ici_cpuid4_info, i))
+                                continue;
+                        this_leaf = CPUID4_INFO_IDX(i, index);
+                        for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
+                                if (!cpu_online(sibling))
+                                        continue;
+                                set_bit(sibling, this_leaf->shared_cpu_map);
+                        }
+                }
         }
+
+        return ret;
+}
+
+static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
+{
+        struct _cpuid4_info *this_leaf, *sibling_leaf;
+        unsigned long num_threads_sharing;
+        int index_msb, i;
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+        if (c->x86_vendor == X86_VENDOR_AMD) {
+                if (cache_shared_amd_cpu_map_setup(cpu, index))
+                        return;
+        }
+
         this_leaf = CPUID4_INFO_IDX(cpu, index);
         num_threads_sharing = 1 + this_leaf->base.eax.split.num_threads_sharing;
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 786e76a86322..e4eeaaf58a47 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -528,6 +528,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
         sprintf(name, "threshold_bank%i", bank);
 
+#ifdef CONFIG_SMP
         if (cpu_data(cpu).cpu_core_id && shared_bank[bank]) {   /* symlink */
                 i = cpumask_first(cpu_llc_shared_mask(cpu));
 
@@ -553,6 +554,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
                 goto out;
         }
+#endif
 
         b = kzalloc(sizeof(struct threshold_bank), GFP_KERNEL);
         if (!b) {
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 8944062f46e2..c30c807ddc72 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -147,7 +147,9 @@ struct cpu_hw_events {
         /*
          * AMD specific bits
          */
-        struct amd_nb           *amd_nb;
+        struct amd_nb                   *amd_nb;
+        /* Inverted mask of bits to clear in the perf_ctr ctrl registers */
+        u64                             perf_ctr_virt_mask;
 
         void                            *kfree_on_online;
 };
@@ -417,9 +419,11 @@ void x86_pmu_disable_all(void);
 static inline void __x86_pmu_enable_event(struct hw_perf_event *hwc,
                                           u64 enable_mask)
 {
+        u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask);
+
         if (hwc->extra_reg.reg)
                 wrmsrl(hwc->extra_reg.reg, hwc->extra_reg.config);
-        wrmsrl(hwc->config_base, hwc->config | enable_mask);
+        wrmsrl(hwc->config_base, (hwc->config | enable_mask) & ~disable_mask);
 }
 
 void x86_pmu_enable_all(int added);
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 0397b23be8e9..67250a52430b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -1,4 +1,5 @@
 #include <linux/perf_event.h>
+#include <linux/export.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -357,7 +358,9 @@ static void amd_pmu_cpu_starting(int cpu)
         struct amd_nb *nb;
         int i, nb_id;
 
-        if (boot_cpu_data.x86_max_cores < 2)
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+
+        if (boot_cpu_data.x86_max_cores < 2 || boot_cpu_data.x86 == 0x15)
                 return;
 
         nb_id = amd_get_nb_id(cpu);
@@ -587,9 +590,9 @@ static __initconst const struct x86_pmu amd_pmu_f15h = {
         .put_event_constraints  = amd_put_event_constraints,
 
         .cpu_prepare            = amd_pmu_cpu_prepare,
-        .cpu_starting           = amd_pmu_cpu_starting,
         .cpu_dead               = amd_pmu_cpu_dead,
 #endif
+        .cpu_starting           = amd_pmu_cpu_starting,
 };
 
 __init int amd_pmu_init(void)
@@ -621,3 +624,33 @@ __init int amd_pmu_init(void)
 
         return 0;
 }
+
+void amd_pmu_enable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+
+        cpuc->perf_ctr_virt_mask = 0;
+
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
+
+void amd_pmu_disable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+
+        /*
+         * We only mask out the Host-only bit so that host-only counting works
+         * when SVM is disabled. If someone sets up a guest-only counter when
+         * SVM is disabled the Guest-only bits still gets set and the counter
+         * will not count anything.
+         */
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 3fe8239fd8fb..1333d9851778 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1532,10 +1532,17 @@ ENTRY(nmi)
         pushq_cfi %rdx
 
         /*
+         * If %cs was not the kernel segment, then the NMI triggered in user
+         * space, which means it is definitely not nested.
+         */
+        cmpl $__KERNEL_CS, 16(%rsp)
+        jne first_nmi
+
+        /*
          * Check the special variable on the stack to see if NMIs are
          * executing.
          */
-        cmp $1, -8(%rsp)
+        cmpl $1, -8(%rsp)
         je nested_nmi
 
         /*
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index ac0417be9131..73465aab28f8 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -360,7 +360,6 @@ out:
 static enum ucode_state
 request_microcode_user(int cpu, const void __user *buf, size_t size)
 {
-        pr_info("AMD microcode update via /dev/cpu/microcode not supported\n");
         return UCODE_ERROR;
 }
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 5fa553babe56..e385214711cb 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -29,6 +29,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
 
+#include <asm/perf_event.h>
 #include <asm/tlbflush.h>
 #include <asm/desc.h>
 #include <asm/kvm_para.h>
@@ -575,6 +576,8 @@ static void svm_hardware_disable(void *garbage)
                 wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
 
         cpu_svm_disable();
+
+        amd_pmu_disable_virt();
 }
 
 static int svm_hardware_enable(void *garbage)
@@ -622,6 +625,8 @@ static int svm_hardware_enable(void *garbage)
 
         svm_init_erratum_383();
 
+        amd_pmu_enable_virt();
+
         return 0;
 }
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 12eb07bfb267..4172af8ceeb3 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1141,7 +1141,9 @@ asmlinkage void __init xen_start_kernel(void)
 
         /* Prevent unwanted bits from being set in PTEs. */
         __supported_pte_mask &= ~_PAGE_GLOBAL;
+#if 0
         if (!xen_initial_domain())
+#endif
                 __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
 
         __supported_pte_mask |= _PAGE_IOMAP;
@@ -1204,10 +1206,6 @@ asmlinkage void __init xen_start_kernel(void)
 
         pgd = (pgd_t *)xen_start_info->pt_base;
 
-        if (!xen_initial_domain())
-                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
-        __supported_pte_mask |= _PAGE_IOMAP;
         /* Don't do the full vcpu_info placement stuff until we have a
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 58a0e46c404d..95c1cf60c669 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -415,13 +415,13 @@ static pteval_t iomap_pte(pteval_t val)
 static pteval_t xen_pte_val(pte_t pte)
 {
         pteval_t pteval = pte.pte;
-
+#if 0
         /* If this is a WC pte, convert back from Xen WC to Linux WC */
         if ((pteval & (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)) == _PAGE_PAT) {
                 WARN_ON(!pat_enabled);
                 pteval = (pteval & ~_PAGE_PAT) | _PAGE_PWT;
         }
-
+#endif
         if (xen_initial_domain() && (pteval & _PAGE_IOMAP))
                 return pteval;
 
@@ -463,7 +463,7 @@ void xen_set_pat(u64 pat)
 static pte_t xen_make_pte(pteval_t pte)
 {
         phys_addr_t addr = (pte & PTE_PFN_MASK);
-
+#if 0
         /* If Linux is trying to set a WC pte, then map to the Xen WC.
          * If _PAGE_PAT is set, then it probably means it is really
          * _PAGE_PSE, so avoid fiddling with the PAT mapping and hope
@@ -476,7 +476,7 @@ static pte_t xen_make_pte(pteval_t pte)
                 if ((pte & (_PAGE_PCD | _PAGE_PWT)) == _PAGE_PWT)
                         pte = (pte & ~(_PAGE_PCD | _PAGE_PWT)) | _PAGE_PAT;
         }
-
+#endif
         /*
          * Unprivileged domains are allowed to do IOMAPpings for
          * PCI passthrough, but not map ISA space.  The ISA
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index bd8ae788f689..e507cfbd044e 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -2,7 +2,7 @@
  * ldm - Support for Windows Logical Disk Manager (Dynamic Disks)
  *
  * Copyright (C) 2001,2002 Richard Russon <ldm@flatcap.org>
- * Copyright (c) 2001-2007 Anton Altaparmakov
+ * Copyright (c) 2001-2012 Anton Altaparmakov
  * Copyright (C) 2001,2002 Jakob Kemi <jakob.kemi@telia.com>
  *
  * Documentation is available at http://www.linux-ntfs.org/doku.php?id=downloads 
@@ -1341,20 +1341,17 @@ found:
                 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
                 return false;
         }
-
         if (f->map & (1 << rec)) {
                 ldm_error ("Duplicate VBLK, part %d.", rec);
                 f->map &= 0x7F;                 /* Mark the group as broken */
                 return false;
         }
-
         f->map |= (1 << rec);
-
+        if (!rec)
+                memcpy(f->data, data, VBLK_SIZE_HEAD);
         data += VBLK_SIZE_HEAD;
         size -= VBLK_SIZE_HEAD;
-
-        memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
-
+        memcpy(f->data + VBLK_SIZE_HEAD + rec * size, data, size);
         return true;
 }
 
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 5d1d07645132..e8cd652d2017 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1206,9 +1206,9 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         
  out_unmap_both:
         pci_set_drvdata(dev, NULL);
-        pci_iounmap(dev, card->config_regs);
- out_unmap_config:
         pci_iounmap(dev, card->buffers);
+ out_unmap_config:
+        pci_iounmap(dev, card->config_regs);
  out_release_regions:
         pci_release_regions(dev);
  out:
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f00f596c1029..789c9b579aea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0a5c, 0x21e3) },
+        { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         { }     /* Terminating entry */
@@ -726,9 +727,6 @@ static int btusb_send_frame(struct sk_buff *skb)
                 usb_fill_bulk_urb(urb, data->udev, pipe,
                                 skb->data, skb->len, btusb_tx_complete, skb);
 
-                if (skb->priority >= HCI_PRIO_MAX - 1)
-                        urb->transfer_flags  = URB_ISO_ASAP;
-
                 hdev->stat.acl_tx++;
                 break;
 
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 597235a2f8f9..0d40cf66b3cc 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -714,6 +714,7 @@ static int mv_hash_final(struct ahash_request *req)
 {
         struct mv_req_hash_ctx *ctx = ahash_request_ctx(req);
 
+        ahash_request_set_crypt(req, NULL, req->result, 0);
         mv_update_hash_req_ctx(ctx, 1, 0);
         return mv_handle_req(&req->base);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index d620b0784257..618bd4d87d28 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
 
+#include <drm/exynos_drm.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
@@ -44,8 +45,9 @@ struct exynos_drm_connector {
 /* convert exynos_video_timings to drm_display_mode */
 static inline void
 convert_to_display_mode(struct drm_display_mode *mode,
-                        struct fb_videomode *timing)
+                        struct exynos_drm_panel_info *panel)
 {
+        struct fb_videomode *timing = &panel->timing;
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         mode->clock = timing->pixclock / 1000;
@@ -60,6 +62,8 @@ convert_to_display_mode(struct drm_display_mode *mode,
         mode->vsync_start = mode->vdisplay + timing->upper_margin;
         mode->vsync_end = mode->vsync_start + timing->vsync_len;
         mode->vtotal = mode->vsync_end + timing->lower_margin;
+        mode->width_mm = panel->width_mm;
+        mode->height_mm = panel->height_mm;
 
         if (timing->vmode & FB_VMODE_INTERLACED)
                 mode->flags |= DRM_MODE_FLAG_INTERLACE;
@@ -148,16 +152,18 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 connector->display_info.raw_edid = edid;
         } else {
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                struct fb_videomode *timing;
+                struct exynos_drm_panel_info *panel;
 
-                if (display_ops->get_timing)
-                        timing = display_ops->get_timing(manager->dev);
+                if (display_ops->get_panel)
+                        panel = display_ops->get_panel(manager->dev);
                 else {
                         drm_mode_destroy(connector->dev, mode);
                         return 0;
                 }
 
-                convert_to_display_mode(mode, timing);
+                convert_to_display_mode(mode, panel);
+                connector->display_info.width_mm = mode->width_mm;
+                connector->display_info.height_mm = mode->height_mm;
 
                 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
                 drm_mode_set_name(mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index e685e1e33055..13540de90bfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -136,7 +136,7 @@ struct exynos_drm_overlay {
  * @type: one of EXYNOS_DISPLAY_TYPE_LCD and HDMI.
  * @is_connected: check for that display is connected or not.
  * @get_edid: get edid modes from display driver.
- * @get_timing: get timing object from display driver.
+ * @get_panel: get panel object from display driver.
  * @check_timing: check if timing is valid or not.
  * @power_on: display device on or off.
  */
@@ -145,7 +145,7 @@ struct exynos_drm_display_ops {
         bool (*is_connected)(struct device *dev);
         int (*get_edid)(struct device *dev, struct drm_connector *connector,
                                 u8 *edid, int len);
-        void *(*get_timing)(struct device *dev);
+        void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 0dbb32bb18a3..360adf2bba04 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -89,7 +89,7 @@ struct fimd_context {
         bool                            suspended;
         struct mutex                    lock;
 
-        struct fb_videomode             *timing;
+        struct exynos_drm_panel_info *panel;
 };
 
 static bool fimd_display_is_connected(struct device *dev)
@@ -101,13 +101,13 @@ static bool fimd_display_is_connected(struct device *dev)
         return true;
 }
 
-static void *fimd_get_timing(struct device *dev)
+static void *fimd_get_panel(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        return ctx->timing;
+        return ctx->panel;
 }
 
 static int fimd_check_timing(struct device *dev, void *timing)
@@ -131,7 +131,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
 static struct exynos_drm_display_ops fimd_display_ops = {
         .type = EXYNOS_DISPLAY_TYPE_LCD,
         .is_connected = fimd_display_is_connected,
-        .get_timing = fimd_get_timing,
+        .get_panel = fimd_get_panel,
         .check_timing = fimd_check_timing,
         .power_on = fimd_display_power_on,
 };
@@ -193,7 +193,8 @@ static void fimd_apply(struct device *subdrv_dev)
 static void fimd_commit(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
-        struct fb_videomode *timing = ctx->timing;
+        struct exynos_drm_panel_info *panel = ctx->panel;
+        struct fb_videomode *timing = &panel->timing;
         u32 val;
 
         if (ctx->suspended)
@@ -786,7 +787,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         struct fimd_context *ctx;
         struct exynos_drm_subdrv *subdrv;
         struct exynos_drm_fimd_pdata *pdata;
-        struct fb_videomode *timing;
+        struct exynos_drm_panel_info *panel;
         struct resource *res;
         int win;
         int ret = -EINVAL;
@@ -799,9 +800,9 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        timing = &pdata->timing;
-        if (!timing) {
-                dev_err(dev, "timing is null.\n");
+        panel = &pdata->panel;
+        if (!panel) {
+                dev_err(dev, "panel is null.\n");
                 return -EINVAL;
         }
 
@@ -863,16 +864,16 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_req_irq;
         }
 
-        ctx->clkdiv = fimd_calc_clkdiv(ctx, timing);
+        ctx->clkdiv = fimd_calc_clkdiv(ctx, &panel->timing);
         ctx->vidcon0 = pdata->vidcon0;
         ctx->vidcon1 = pdata->vidcon1;
         ctx->default_win = pdata->default_win;
-        ctx->timing = timing;
+        ctx->panel = panel;
 
-        timing->pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
+        panel->timing.pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
 
         DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
-                        timing->pixclock, ctx->clkdiv);
+                        panel->timing.pixclock, ctx->clkdiv);
 
         subdrv = &ctx->subdrv;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f425b23e3803..f851db7be2cc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4680,8 +4680,17 @@ sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
 
         crtc = intel_get_crtc_for_plane(dev, plane);
         clock = crtc->mode.clock;
+        if (!clock) {
+                *sprite_wm = 0;
+                return false;
+        }
 
         line_time_us = (sprite_width * 1000) / clock;
+        if (!line_time_us) {
+                *sprite_wm = 0;
+                return false;
+        }
+
         line_count = (latency_ns / line_time_us + 1000) / 1000;
         line_size = sprite_width * pixel_size;
 
@@ -6175,7 +6184,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
         int i;
 
         /* The clocks have to be on to load the palette. */
-        if (!crtc->enabled)
+        if (!crtc->enabled || !intel_crtc->active)
                 return;
 
         /* use legacy palette for Ironlake */
@@ -6561,7 +6570,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
         mode_cmd.height = mode->vdisplay;
         mode_cmd.pitches[0] = intel_framebuffer_pitch_for_width(mode_cmd.width,
                                                                 bpp);
-        mode_cmd.pixel_format = 0;
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
 
         return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
@@ -8185,7 +8194,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
 
         if (intel_enable_rc6(dev_priv->dev))
                 rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        (IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0;
+                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
 
         I915_WRITE(GEN6_RC_CONTROL,
                    rc6_mask |
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 1ab842c6032e..536191540b03 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -301,7 +301,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
 
         I915_WRITE_CTL(ring,
                         ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
-                        | RING_REPORT_64K | RING_VALID);
+                        | RING_VALID);
 
         /* If the head is still not zero, the ring is dead */
         if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
@@ -1132,18 +1132,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
         struct drm_device *dev = ring->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long end;
-        u32 head;
-
-        /* If the reported head position has wrapped or hasn't advanced,
-         * fallback to the slow and accurate path.
-         */
-        head = intel_read_status_page(ring, 4);
-        if (head > ring->head) {
-                ring->head = head;
-                ring->space = ring_space(ring);
-                if (ring->space >= n)
-                        return 0;
-        }
 
         trace_i915_ring_wait_begin(ring);
         if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 38ce5d0427e3..387fcc9f03ef 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1304,6 +1304,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
         h0 = G_038004_TEX_HEIGHT(word1) + 1;
         d0 = G_038004_TEX_DEPTH(word1);
         nfaces = 1;
+        array = 0;
         switch (G_038000_DIM(word0)) {
         case V_038000_SQ_TEX_DIM_1D:
         case V_038000_SQ_TEX_DIM_2D:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e7cb3ab09243..8b3d8ed52ff6 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1117,13 +1117,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
             (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                 struct drm_display_mode *mode;
 
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_ON);
-                ret = radeon_ddc_get_modes(radeon_connector);
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_ON);
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                } else {
+                        /* need to setup ddc on the bridge */
+                        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
+                            ENCODER_OBJECT_ID_NONE) {
+                                if (encoder)
+                                        radeon_atom_ext_encoder_setup_ddc(encoder);
+                        }
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                }
 
                 if (ret > 0) {
                         if (encoder) {
@@ -1134,7 +1144,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                         return ret;
                 }
 
-                encoder = radeon_best_single_encoder(connector);
                 if (!encoder)
                         return 0;
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae..c58a036233fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        list_del(&bo_va->bo_list);
         mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
         mutex_unlock(&vm->mutex);
+        list_del(&bo_va->bo_list);
 
         kfree(bo_va);
         return 0;
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 6bab2001ef3b..6aa5a9fad879 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -178,6 +178,16 @@ static inline void f75375_write16(struct i2c_client *client, u8 reg,
         i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
 }
 
+static void f75375_write_pwm(struct i2c_client *client, int nr)
+{
+        struct f75375_data *data = i2c_get_clientdata(client);
+        if (data->kind == f75387)
+                f75375_write16(client, F75375_REG_FAN_EXP(nr), data->pwm[nr]);
+        else
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                              data->pwm[nr]);
+}
+
 static struct f75375_data *f75375_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -254,6 +264,36 @@ static inline u16 rpm_to_reg(int rpm)
         return 1500000 / rpm;
 }
 
+static bool duty_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        case 2: /* Auto, speed mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        default:
+                BUG();
+        }
+}
+
+static bool auto_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        case 2: /* Auto, speed mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        default:
+                BUG();
+        }
+}
+
 static ssize_t set_fan_min(struct device *dev, struct device_attribute *attr,
                 const char *buf, size_t count)
 {
@@ -287,6 +327,11 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+        if (data->kind == f75387 && duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->fan_target[nr] = rpm_to_reg(val);
         f75375_write16(client, F75375_REG_FAN_EXP(nr), data->fan_target[nr]);
@@ -307,9 +352,13 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]) ||
+            !duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->pwm[nr] = SENSORS_LIMIT(val, 0, 255);
-        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr), data->pwm[nr]);
+        f75375_write_pwm(client, nr);
         mutex_unlock(&data->update_lock);
         return count;
 }
@@ -327,11 +376,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
         struct f75375_data *data = i2c_get_clientdata(client);
         u8 fanmode;
 
-        if (val < 0 || val > 3)
+        if (val < 0 || val > 4)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
         if (data->kind == f75387) {
+                /* For now, deny dangerous toggling of duty mode */
+                if (duty_mode_enabled(data->pwm_enable[nr]) !=
+                                duty_mode_enabled(val))
+                        return -EOPNOTSUPP;
                 /* clear each fanX_mode bit before setting them properly */
                 fanmode &= ~(1 << F75387_FAN_DUTY_MODE(nr));
                 fanmode &= ~(1 << F75387_FAN_MANU_MODE(nr));
@@ -345,12 +398,14 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode  |= (1 << F75387_FAN_DUTY_MODE(nr));
                         break;
-                case 2: /* AUTOMATIC*/
-                        fanmode  |=  (1 << F75387_FAN_DUTY_MODE(nr));
+                case 2: /* Automatic, speed mode */
                         break;
                 case 3: /* fan speed */
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         break;
+                case 4: /* Automatic, pwm */
+                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
+                        break;
                 }
         } else {
                 /* clear each fanX_mode bit before setting them properly */
@@ -368,14 +423,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         break;
                 case 3: /* fan speed */
                         break;
+                case 4: /* Automatic pwm */
+                        return -EINVAL;
                 }
         }
 
         f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
         data->pwm_enable[nr] = val;
         if (val == 0)
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         return 0;
 }
 
@@ -726,14 +782,17 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 
                                 manu = ((mode >> F75387_FAN_MANU_MODE(nr)) & 1);
                                 duty = ((mode >> F75387_FAN_DUTY_MODE(nr)) & 1);
-                                if (manu && duty)
-                                        /* speed */
+                                if (!manu && duty)
+                                        /* auto, pwm */
+                                        data->pwm_enable[nr] = 4;
+                                else if (manu && !duty)
+                                        /* manual, speed */
                                         data->pwm_enable[nr] = 3;
-                                else if (!manu && duty)
-                                        /* automatic */
+                                else if (!manu && !duty)
+                                        /* automatic, speed */
                                         data->pwm_enable[nr] = 2;
                                 else
-                                        /* manual */
+                                        /* manual, pwm */
                                         data->pwm_enable[nr] = 1;
                         } else {
                                 if (!(conf & (1 << F75375_FAN_CTRL_LINEAR(nr))))
@@ -758,9 +817,11 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
         set_pwm_enable_direct(client, 0, f75375s_pdata->pwm_enable[0]);
         set_pwm_enable_direct(client, 1, f75375s_pdata->pwm_enable[1]);
         for (nr = 0; nr < 2; nr++) {
+                if (auto_mode_enabled(f75375s_pdata->pwm_enable[nr]) ||
+                    !duty_mode_enabled(f75375s_pdata->pwm_enable[nr]))
+                        continue;
                 data->pwm[nr] = SENSORS_LIMIT(f75375s_pdata->pwm[nr], 0, 255);
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                        data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         }
 
 }
@@ -787,7 +848,7 @@ static int f75375_probe(struct i2c_client *client,
         if (err)
                 goto exit_free;
 
-        if (data->kind == f75375) {
+        if (data->kind != f75373) {
                 err = sysfs_chmod_file(&client->dev.kobj,
                         &sensor_dev_attr_pwm1_mode.dev_attr.attr,
                         S_IRUGO | S_IWUSR);
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 7e78f7c87857..3d471d56bf15 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -72,6 +72,7 @@
 
 #define MXS_I2C_QUEUESTAT       (0x70)
 #define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
+#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
 
 #define MXS_I2C_QUEUECMD        (0x80)
 
@@ -219,14 +220,14 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         int ret;
         int flags;
 
-        init_completion(&i2c->cmd_complete);
-
         dev_dbg(i2c->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
                 msg->addr, msg->len, msg->flags, stop);
 
         if (msg->len == 0)
                 return -EINVAL;
 
+        init_completion(&i2c->cmd_complete);
+
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
         if (msg->flags & I2C_M_RD)
@@ -286,6 +287,7 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
         struct mxs_i2c_dev *i2c = dev_id;
         u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
+        bool is_last_cmd;
 
         if (!stat)
                 return IRQ_NONE;
@@ -300,9 +302,14 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
         else
                 i2c->cmd_err = 0;
 
-        complete(&i2c->cmd_complete);
+        is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
+                MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
+
+        if (is_last_cmd || i2c->cmd_err)
+                complete(&i2c->cmd_complete);
 
         writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index d60364650990..f6733267fa9c 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -29,6 +29,8 @@
 #include <linux/errno.h>
 #include <linux/interrupt.h>
 #include <linux/i2c-pxa.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/of_i2c.h>
 #include <linux/platform_device.h>
 #include <linux/err.h>
@@ -1044,23 +1046,60 @@ static const struct i2c_algorithm i2c_pxa_pio_algorithm = {
         .functionality  = i2c_pxa_functionality,
 };
 
-static int i2c_pxa_probe(struct platform_device *dev)
+static struct of_device_id i2c_pxa_dt_ids[] = {
+        { .compatible = "mrvl,pxa-i2c", .data = (void *)REGS_PXA2XX },
+        { .compatible = "mrvl,pwri2c", .data = (void *)REGS_PXA3XX },
+        { .compatible = "mrvl,mmp-twsi", .data = (void *)REGS_PXA2XX },
+        {}
+};
+MODULE_DEVICE_TABLE(of, i2c_pxa_dt_ids);
+
+static int i2c_pxa_probe_dt(struct platform_device *pdev, struct pxa_i2c *i2c,
+                            enum pxa_i2c_types *i2c_types)
 {
-        struct pxa_i2c *i2c;
-        struct resource *res;
-        struct i2c_pxa_platform_data *plat = dev->dev.platform_data;
-        const struct platform_device_id *id = platform_get_device_id(dev);
-        enum pxa_i2c_types i2c_type = id->driver_data;
+        struct device_node *np = pdev->dev.of_node;
+        const struct of_device_id *of_id =
+                        of_match_device(i2c_pxa_dt_ids, &pdev->dev);
         int ret;
-        int irq;
 
-        res = platform_get_resource(dev, IORESOURCE_MEM, 0);
-        irq = platform_get_irq(dev, 0);
-        if (res == NULL || irq < 0)
-                return -ENODEV;
+        if (!of_id)
+                return 1;
+        ret = of_alias_get_id(np, "i2c");
+        if (ret < 0) {
+                dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret);
+                return ret;
+        }
+        pdev->id = ret;
+        if (of_get_property(np, "mrvl,i2c-polling", NULL))
+                i2c->use_pio = 1;
+        if (of_get_property(np, "mrvl,i2c-fast-mode", NULL))
+                i2c->fast_mode = 1;
+        *i2c_types = (u32)(of_id->data);
+        return 0;
+}
 
-        if (!request_mem_region(res->start, resource_size(res), res->name))
-                return -ENOMEM;
+static int i2c_pxa_probe_pdata(struct platform_device *pdev,
+                               struct pxa_i2c *i2c,
+                               enum pxa_i2c_types *i2c_types)
+{
+        struct i2c_pxa_platform_data *plat = pdev->dev.platform_data;
+        const struct platform_device_id *id = platform_get_device_id(pdev);
+
+        *i2c_types = id->driver_data;
+        if (plat) {
+                i2c->use_pio = plat->use_pio;
+                i2c->fast_mode = plat->fast_mode;
+        }
+        return 0;
+}
+
+static int i2c_pxa_probe(struct platform_device *dev)
+{
+        struct i2c_pxa_platform_data *plat = dev->dev.platform_data;
+        enum pxa_i2c_types i2c_type;
+        struct pxa_i2c *i2c;
+        struct resource *res = NULL;
+        int ret, irq;
 
         i2c = kzalloc(sizeof(struct pxa_i2c), GFP_KERNEL);
         if (!i2c) {
@@ -1068,6 +1107,24 @@ static int i2c_pxa_probe(struct platform_device *dev)
                 goto emalloc;
         }
 
+        ret = i2c_pxa_probe_dt(dev, i2c, &i2c_type);
+        if (ret > 0)
+                ret = i2c_pxa_probe_pdata(dev, i2c, &i2c_type);
+        if (ret < 0)
+                goto eclk;
+
+        res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(dev, 0);
+        if (res == NULL || irq < 0) {
+                ret = -ENODEV;
+                goto eclk;
+        }
+
+        if (!request_mem_region(res->start, resource_size(res), res->name)) {
+                ret = -ENOMEM;
+                goto eclk;
+        }
+
         i2c->adap.owner   = THIS_MODULE;
         i2c->adap.retries = 5;
 
@@ -1109,21 +1166,16 @@ static int i2c_pxa_probe(struct platform_device *dev)
 
         i2c->slave_addr = I2C_PXA_SLAVE_ADDR;
 
-#ifdef CONFIG_I2C_PXA_SLAVE
         if (plat) {
+#ifdef CONFIG_I2C_PXA_SLAVE
                 i2c->slave_addr = plat->slave_addr;
                 i2c->slave = plat->slave;
-        }
 #endif
-
-        clk_enable(i2c->clk);
-
-        if (plat) {
                 i2c->adap.class = plat->class;
-                i2c->use_pio = plat->use_pio;
-                i2c->fast_mode = plat->fast_mode;
         }
 
+        clk_enable(i2c->clk);
+
         if (i2c->use_pio) {
                 i2c->adap.algo = &i2c_pxa_pio_algorithm;
         } else {
@@ -1234,6 +1286,7 @@ static struct platform_driver i2c_pxa_driver = {
                 .name   = "pxa2xx-i2c",
                 .owner  = THIS_MODULE,
                 .pm     = I2C_PXA_DEV_PM_OPS,
+                .of_match_table = i2c_pxa_dt_ids,
         },
         .id_table       = i2c_pxa_id_table,
 };
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 288da5c1499d..103dbd92e256 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -44,7 +44,8 @@ static ssize_t debug_read_ver(struct file *file, char __user *userbuf,
 static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes;
 
@@ -67,7 +68,8 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes, rest;
 
@@ -97,7 +99,8 @@ static ssize_t debug_write_pagetable(struct file *file,
         struct iotlb_entry e;
         struct cr_regs cr;
         int err;
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char buf[MAXCOLUMN], *p = buf;
 
         count = min(count, sizeof(buf));
@@ -184,7 +187,8 @@ out:
 static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         size_t bytes;
 
@@ -212,7 +216,8 @@ static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         struct iovm_struct *tmp;
         int uninitialized_var(i);
@@ -254,7 +259,7 @@ static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         char *p, *buf;
         struct iovm_struct *area;
         ssize_t bytes;
@@ -268,8 +273,8 @@ static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
 
         mutex_lock(&iommu_debug_lock);
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 bytes = -EINVAL;
                 goto err_out;
         }
@@ -287,7 +292,7 @@ err_out:
 static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         struct iovm_struct *area;
         char *p, *buf;
 
@@ -305,8 +310,8 @@ static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                 goto err_out;
         }
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 count = -EINVAL;
                 goto err_out;
         }
@@ -350,7 +355,7 @@ DEBUG_FOPS(mem);
         {                                                               \
                 struct dentry *dent;                                    \
                 dent = debugfs_create_file(#attr, mode, parent,         \
-                                           obj, &debug_##attr##_fops);  \
+                                           dev, &debug_##attr##_fops);  \
                 if (!dent)                                              \
                         return -ENOMEM;                                 \
         }
@@ -362,20 +367,29 @@ static int iommu_debug_register(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_iommu *obj = platform_get_drvdata(pdev);
+        struct omap_iommu_arch_data *arch_data;
         struct dentry *d, *parent;
 
         if (!obj || !obj->dev)
                 return -EINVAL;
 
+        arch_data = kzalloc(sizeof(*arch_data), GFP_KERNEL);
+        if (!arch_data)
+                return -ENOMEM;
+
+        arch_data->iommu_dev = obj;
+
+        dev->archdata.iommu = arch_data;
+
         d = debugfs_create_dir(obj->name, iommu_debug_root);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
         parent = d;
 
         d = debugfs_create_u8("nr_tlb_entries", 400, parent,
                               (u8 *)&obj->nr_tlb_entries);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
 
         DEBUG_ADD_FILE_RO(ver);
         DEBUG_ADD_FILE_RO(regs);
@@ -385,6 +399,22 @@ static int iommu_debug_register(struct device *dev, void *data)
         DEBUG_ADD_FILE(mem);
 
         return 0;
+
+nomem:
+        kfree(arch_data);
+        return -ENOMEM;
+}
+
+static int iommu_debug_unregister(struct device *dev, void *data)
+{
+        if (!dev->archdata.iommu)
+                return 0;
+
+        kfree(dev->archdata.iommu);
+
+        dev->archdata.iommu = NULL;
+
+        return 0;
 }
 
 static int __init iommu_debug_init(void)
@@ -411,6 +441,7 @@ module_init(iommu_debug_init)
 static void __exit iommu_debugfs_exit(void)
 {
         debugfs_remove_recursive(iommu_debug_root);
+        omap_foreach_iommu_device(NULL, iommu_debug_unregister);
 }
 module_exit(iommu_debugfs_exit)
 
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index d8edd979d01b..6899dcd02dfa 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1223,7 +1223,8 @@ static int __init omap_iommu_init(void)
 
         return platform_driver_register(&omap_iommu_driver);
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 04a3f1b756a8..192b0d118df4 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
+static int sja1000_is_absent(struct sja1000_priv *priv)
+{
+        return (priv->read_reg(priv, REG_MOD) == 0xFF);
+}
+
 static int sja1000_probe_chip(struct net_device *dev)
 {
         struct sja1000_priv *priv = netdev_priv(dev);
 
-        if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
+        if (priv->reg_base && sja1000_is_absent(priv)) {
                 printk(KERN_INFO "%s: probing @0x%lX failed\n",
                        DRV_NAME, dev->base_addr);
                 return 0;
@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
                 status = priv->read_reg(priv, REG_SR);
+                /* check for absent controller due to hw unplug */
+                if (status == 0xFF && sja1000_is_absent(priv))
+                        return IRQ_NONE;
 
                 if (isrc & IRQ_WUI)
                         dev_warn(dev->dev.parent, "wakeup interrupt\n");
@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
                                 status = priv->read_reg(priv, REG_SR);
+                                /* check for absent controller */
+                                if (status == 0xFF && sja1000_is_absent(priv))
+                                        return IRQ_NONE;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index b8591246eb4c..1ff3c6df35a2 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -2244,10 +2244,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                         dev_info(&adapter->pdev->dev, "tx locked\n");
                 return NETDEV_TX_LOCKED;
         }
-        if (skb->mark == 0x01)
-                type = atl1c_trans_high;
-        else
-                type = atl1c_trans_normal;
 
         if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                 /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 3fb66d09ece5..cab87456a34a 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2339,7 +2339,7 @@ static inline int __init b44_pci_init(void)
         return err;
 }
 
-static inline void __exit b44_pci_exit(void)
+static inline void b44_pci_exit(void)
 {
 #ifdef CONFIG_B44_PCI
         ssb_pcihost_unregister(&b44_pci_driver);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index dd3a0a232ea0..818a573669e6 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3584,7 +3584,11 @@ static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                 fl6.flowi6_oif = dst_addr->sin6_scope_id;
 
         *dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (*dst)
+        if ((*dst)->error) {
+                dst_release(*dst);
+                *dst = NULL;
+                return -ENETUNREACH;
+        } else
                 return 0;
 #endif
 
diff --git a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
index c2c0680a1146..ac37cacc6136 100644
--- a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
+++ b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
@@ -157,7 +157,7 @@ static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
                         CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
                 *fcoe_enc_error = (desc->flags &
                         CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
-                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                *fcoe_eof = (u8)((le16_to_cpu(desc->checksum_fcoe) >>
                         CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
                         CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
                 *checksum = 0;
diff --git a/drivers/net/ethernet/cisco/enic/enic_pp.c b/drivers/net/ethernet/cisco/enic/enic_pp.c
index 22bf03a1829e..c347b6236f8f 100644
--- a/drivers/net/ethernet/cisco/enic/enic_pp.c
+++ b/drivers/net/ethernet/cisco/enic/enic_pp.c
@@ -72,7 +72,7 @@ static int enic_set_port_profile(struct enic *enic, int vf)
         struct enic_port_profile *pp;
         struct vic_provinfo *vp;
         const u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        const u16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
+        const __be16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
         char uuid_str[38];
         char client_mac_str[18];
         u8 *client_mac;
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 27d651a80f3f..55cbf65512c3 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
                 ((new_mtu) < IPV6_MIN_MTU))
                 return -EINVAL;
 
-        if (new_mtu > 4000) {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
-                jme_restart_rx_engine(jme);
-        } else {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
-                jme_restart_rx_engine(jme);
-        }
 
         netdev->mtu = new_mtu;
         netdev_update_features(netdev);
 
+        jme_restart_rx_engine(jme);
         jme_reset_link(jme);
 
         return 0;
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 4304072bd3c5..3efc897c9913 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -730,7 +730,7 @@ enum jme_rxcs_values {
         RXCS_RETRYCNT_60        = 0x00000F00,
 
         RXCS_DEFAULT            = RXCS_FIFOTHTP_128T |
-                                  RXCS_FIFOTHNP_128QW |
+                                  RXCS_FIFOTHNP_16QW |
                                   RXCS_DMAREQSZ_128B |
                                   RXCS_RETRYGAP_256ns |
                                   RXCS_RETRYCNT_32,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8fa41f3082cf..9129ace02560 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1036,7 +1036,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int vec = 0, err = 0, i;
 
-        spin_lock(&priv->msix_ctl.pool_lock);
+        mutex_lock(&priv->msix_ctl.pool_lock);
         for (i = 0; !vec && i < dev->caps.comp_pool; i++) {
                 if (~priv->msix_ctl.pool_bm & 1ULL << i) {
                         priv->msix_ctl.pool_bm |= 1ULL << i;
@@ -1058,7 +1058,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
                         eq_set_ci(&priv->eq_table.eq[vec], 1);
                 }
         }
-        spin_unlock(&priv->msix_ctl.pool_lock);
+        mutex_unlock(&priv->msix_ctl.pool_lock);
 
         if (vec) {
                 *vector = vec;
@@ -1079,13 +1079,13 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
         if (likely(i >= 0)) {
                 /*sanity check , making sure were not trying to free irq's
                   Belonging to a legacy EQ*/
-                spin_lock(&priv->msix_ctl.pool_lock);
+                mutex_lock(&priv->msix_ctl.pool_lock);
                 if (priv->msix_ctl.pool_bm & 1ULL << i) {
                         free_irq(priv->eq_table.eq[vec].irq,
                                  &priv->eq_table.eq[vec]);
                         priv->msix_ctl.pool_bm &= ~(1ULL << i);
                 }
-                spin_unlock(&priv->msix_ctl.pool_lock);
+                mutex_unlock(&priv->msix_ctl.pool_lock);
         }
 
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 678558b502fc..d498f049c74e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -531,15 +531,14 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
         for (port = 0; port <  dev->caps.num_ports; port++) {
                 /* Change the port type only if the new type is different
                  * from the current, and not set to Auto */
-                if (port_types[port] != dev->caps.port_type[port + 1]) {
+                if (port_types[port] != dev->caps.port_type[port + 1])
                         change = 1;
-                        dev->caps.port_type[port + 1] = port_types[port];
-                }
         }
         if (change) {
                 mlx4_unregister_device(dev);
                 for (port = 1; port <= dev->caps.num_ports; port++) {
                         mlx4_CLOSE_PORT(dev, port);
+                        dev->caps.port_type[port] = port_types[port - 1];
                         err = mlx4_SET_PORT(dev, port);
                         if (err) {
                                 mlx4_err(dev, "Failed to set port %d, "
@@ -986,6 +985,9 @@ static int map_bf_area(struct mlx4_dev *dev)
         resource_size_t bf_len;
         int err = 0;
 
+        if (!dev->caps.bf_reg_size)
+                return -ENXIO;
+
         bf_start = pci_resource_start(dev->pdev, 2) +
                         (dev->caps.num_uars << PAGE_SHIFT);
         bf_len = pci_resource_len(dev->pdev, 2) -
@@ -1825,7 +1827,7 @@ slave_start:
                 goto err_master_mfunc;
 
         priv->msix_ctl.pool_bm = 0;
-        spin_lock_init(&priv->msix_ctl.pool_lock);
+        mutex_init(&priv->msix_ctl.pool_lock);
 
         mlx4_enable_msi_x(dev);
         if ((mlx4_is_mfunc(dev)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index c92269f8c057..28f8251561f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -697,7 +697,7 @@ struct mlx4_sense {
 
 struct mlx4_msix_ctl {
         u64             pool_bm;
-        spinlock_t      pool_lock;
+        struct mutex    pool_lock;
 };
 
 struct mlx4_steer {
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 231176fcd2ba..2784bc706f1e 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1545,7 +1545,7 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
 
         netdev->irq = platform_get_irq(pdev, 0);
 
-        if (netdev->irq < 0) {
+        if ((int)netdev->irq < 0) {
                 err = netdev->irq;
                 goto err_get_irq;
         }
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index aca349861767..fc52fca74193 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
                 if (unlikely(!skb))
                         return -ENOMEM;
 
-                /* Adjust the SKB for padding and checksum */
+                /* Adjust the SKB for padding */
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_buf->len = skb_len - NET_IP_ALIGN;
                 rx_buf->is_page = false;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                   skb->data, rx_buf->len,
@@ -496,6 +495,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
 
                 EFX_BUG_ON_PARANOID(!checksummed);
                 rx_buf->u.skb = NULL;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 gro_result = napi_gro_receive(napi, skb);
         }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 4fa0bcb25dfc..4b2f54565f64 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1009,7 +1009,7 @@ static void emac_rx_handler(void *token, int len, int status)
         int                     ret;
 
         /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
+        if (unlikely(!netif_running(ndev))) {
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -1038,7 +1038,9 @@ static void emac_rx_handler(void *token, int len, int status)
 recycle:
         ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
                         skb_tailroom(skb), GFP_KERNEL);
-        if (WARN_ON(ret < 0))
+
+        WARN_ON(ret == -ENOMEM);
+        if (unlikely(ret < 0))
                 dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c81f136ae670..0856e1b7a849 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,16 +30,16 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
-MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IC1001 PHY drivers");
+MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IP101G/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
 
-/* IP101A/IP1001 */
-#define IP10XX_SPEC_CTRL_STATUS         16  /* Spec. Control Register */
-#define IP1001_SPEC_CTRL_STATUS_2       20  /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3 /* IP1001 RX/TXPHASE_SEL */
-#define IP1001_APS_ON                   11  /* IP1001 APS Mode  bit */
-#define IP101A_APS_ON                   2   /* IP101A APS Mode bit */
+/* IP101A/G - IP1001 */
+#define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
+#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
+#define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
+#define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -98,20 +98,24 @@ static int ip175c_config_init(struct phy_device *phydev)
 
 static int ip1xx_reset(struct phy_device *phydev)
 {
-        int err, bmcr;
+        int bmcr;
 
         /* Software Reset PHY */
         bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
         bmcr |= BMCR_RESET;
-        err = phy_write(phydev, MII_BMCR, bmcr);
-        if (err < 0)
-                return err;
+        bmcr = phy_write(phydev, MII_BMCR, bmcr);
+        if (bmcr < 0)
+                return bmcr;
 
         do {
                 bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
         } while (bmcr & BMCR_RESET);
 
-        return err;
+        return 0;
 }
 
 static int ip1001_config_init(struct phy_device *phydev)
@@ -124,7 +128,10 @@ static int ip1001_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP1001_SPEC_CTRL_STATUS_2);
+        if (c < 0)
+                return c;
         c |= IP1001_APS_ON;
+        c = phy_write(phydev, IP1001_SPEC_CTRL_STATUS_2, c);
         if (c < 0)
                 return c;
 
@@ -132,14 +139,19 @@ static int ip1001_config_init(struct phy_device *phydev)
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+                if (c < 0)
+                        return c;
+
                 c |= IP1001_PHASE_SEL_MASK;
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+                if (c < 0)
+                        return c;
         }
 
-        return c;
+        return 0;
 }
 
-static int ip101a_config_init(struct phy_device *phydev)
+static int ip101a_g_config_init(struct phy_device *phydev)
 {
         int c;
 
@@ -149,7 +161,7 @@ static int ip101a_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
-        c |= IP101A_APS_ON;
+        c |= IP101A_G_APS_ON;
         return c;
 }
 
@@ -191,6 +203,7 @@ static struct phy_driver ip1001_driver = {
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &ip1001_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
@@ -199,13 +212,14 @@ static struct phy_driver ip1001_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
-static struct phy_driver ip101a_driver = {
+static struct phy_driver ip101a_g_driver = {
         .phy_id         = 0x02430c54,
-        .name           = "ICPlus IP101A",
+        .name           = "ICPlus IP101A/G",
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
-        .config_init    = &ip101a_config_init,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &ip101a_g_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
         .suspend        = genphy_suspend,
@@ -221,7 +235,7 @@ static int __init icplus_init(void)
         if (ret < 0)
                 return -ENODEV;
 
-        ret = phy_driver_register(&ip101a_driver);
+        ret = phy_driver_register(&ip101a_g_driver);
         if (ret < 0)
                 return -ENODEV;
 
@@ -231,7 +245,7 @@ static int __init icplus_init(void)
 static void __exit icplus_exit(void)
 {
         phy_driver_unregister(&ip1001_driver);
-        phy_driver_unregister(&ip101a_driver);
+        phy_driver_unregister(&ip101a_g_driver);
         phy_driver_unregister(&ip175c_driver);
 }
 
@@ -241,6 +255,7 @@ module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
         { 0x02430d80, 0x0ffffff0 },
         { 0x02430d90, 0x0ffffff0 },
+        { 0x02430c54, 0x0ffffff0 },
         { }
 };
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index edfa15d2e795..486b4048850d 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         continue;
                 }
                 if (PPP_MP_CB(p)->sequence != seq) {
+                        u32 oldseq;
                         /* Fragment `seq' is missing.  If it is after
                            minseq, it might arrive later, so stop here. */
                         if (seq_after(seq, minseq))
                                 break;
                         /* Fragment `seq' is lost, keep going. */
                         lost = 1;
+                        oldseq = seq;
                         seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                 minseq + 1: PPP_MP_CB(p)->sequence;
+
+                        if (ppp->debug & 1)
+                                netdev_printk(KERN_DEBUG, ppp->dev,
+                                              "lost frag %u..%u\n",
+                                              oldseq, seq-1);
+
                         goto again;
                 }
 
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         struct sk_buff *tmp2;
 
                         skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
                                 __skb_unlink(p, list);
                                 kfree_skb(p);
                         }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                 /* If we have discarded any fragments,
                    signal a receive error. */
                 if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                        skb_queue_walk_safe(list, p, tmp) {
+                                if (p == head)
+                                        break;
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
+                                __skb_unlink(p, list);
+                                kfree_skb(p);
+                        }
+
                         if (ppp->debug & 1)
                                 netdev_printk(KERN_DEBUG, ppp->dev,
                                               "  missed pkts %u..%u\n",
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 41a61efc331e..90a30026a931 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -573,6 +573,13 @@ static const struct usb_device_id	products [] = {
         .driver_info = 0,
 },
 
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 304fe78ff60e..e1324b4a0f66 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1632,7 +1632,7 @@ static int hso_get_count(struct tty_struct *tty,
         struct hso_serial *serial = get_serial_by_tty(tty);
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
-        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+        memset(icount, 0, sizeof(struct serial_icounter_struct));
 
         if (!tiocmget)
                  return -ENOENT;
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index f701d4127087..c3197ce0e2ad 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -316,6 +316,11 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = ZAURUS_PXA_INFO,
 }, {
+        /* C-750/C-760/C-860/SL-C3000 PDA in MDLM mode */
+        USB_DEVICE_AND_INTERFACE_INFO(0x04DD, 0x9031, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
                  | USB_DEVICE_ID_MATCH_DEVICE,
         .idVendor               = 0x04DD,
@@ -349,6 +354,13 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = OLYMPUS_MXL_INFO,
 },
+
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+},
         { },            // END
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index de7fc345148a..3dcd3857a36c 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -843,8 +843,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                 /* for simplicity, don't copy L4 headers */
                                 ctx->l4_hdr_size = 0;
                         }
-                        ctx->copy_size = ctx->eth_ip_hdr_size +
-                                         ctx->l4_hdr_size;
+                        ctx->copy_size = min(ctx->eth_ip_hdr_size +
+                                         ctx->l4_hdr_size, skb->len);
                 } else {
                         ctx->eth_ip_hdr_size = 0;
                         ctx->l4_hdr_size = 0;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 635b592ad961..a427a16bb739 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1346,7 +1346,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         fc = hdr->frame_control;
         for (i = 0; i < sc->hw->max_rates; i++) {
                 struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
-                if (!rate->count)
+                if (rate->idx < 0 || !rate->count)
                         break;
 
                 final_ts_idx = i;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c3b6c4652cd6..5b2972b43b0e 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -841,7 +841,12 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                 ret = mwifiex_set_rf_channel(priv, channel,
                                                 priv->adapter->channel_type);
 
-        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);  /* Disable keys */
+        /* As this is new association, clear locally stored
+         * keys and security related flags */
+        priv->sec_info.wpa_enabled = false;
+        priv->sec_info.wpa2_enabled = false;
+        priv->wep_key_curr_index = 0;
+        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
 
         if (mode == NL80211_IFTYPE_ADHOC) {
                 /* "privacy" is set only for ad-hoc mode */
@@ -886,6 +891,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                         dev_dbg(priv->adapter->dev,
                                 "info: setting wep encryption"
                                 " with key len %d\n", sme->key_len);
+                        priv->wep_key_curr_index = sme->key_idx;
                         ret = mwifiex_set_encode(priv, sme->key, sme->key_len,
                                                         sme->key_idx, 0);
                 }
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index a9c46cc2db37..8c33491b21fe 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -1,3 +1,5 @@
+#include <linux/prefetch.h>
+
 /**
  * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
  * @ioc: The I/O Controller.
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index a87e2728b2c3..64d433ec4fc6 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -328,21 +328,15 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        if (ret) {
-                while (--i >= 0)
-                        soc_pcmcia_remove_one(&sinfo->skt[i]);
-                kfree(sinfo);
-                clk_put(clk);
-        } else {
-                pxa2xx_configure_sockets(&dev->dev);
-                dev_set_drvdata(&dev->dev, sinfo);
-        }
+        pxa2xx_configure_sockets(&dev->dev);
+        dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
 
 err1:
         while (--i >= 0)
                 soc_pcmcia_remove_one(&sinfo->skt[i]);
+        clk_put(clk);
         kfree(sinfo);
 err0:
         return ret;
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index df33530cec4a..28b81ae4cf7f 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -196,7 +196,7 @@ static const unsigned int LDO12_suspend_table[] = {
 };
 
 static const unsigned int LDO13_table[] = {
-        1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0, 0,
+        1200000, 1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0,
 };
 
 static const unsigned int LDO13_suspend_table[] = {
@@ -389,10 +389,10 @@ static struct pm8607_regulator_info pm8607_regulator_info[] = {
         PM8607_LDO( 7,         LDO7, 0, 3, SUPPLIES_EN12, 1),
         PM8607_LDO( 8,         LDO8, 0, 3, SUPPLIES_EN12, 2),
         PM8607_LDO( 9,         LDO9, 0, 3, SUPPLIES_EN12, 3),
-        PM8607_LDO(10,        LDO10, 0, 3, SUPPLIES_EN12, 4),
+        PM8607_LDO(10,        LDO10, 0, 4, SUPPLIES_EN12, 4),
         PM8607_LDO(12,        LDO12, 0, 4, SUPPLIES_EN12, 5),
         PM8607_LDO(13, VIBRATOR_SET, 1, 3,  VIBRATOR_SET, 0),
-        PM8607_LDO(14,        LDO14, 0, 4, SUPPLIES_EN12, 6),
+        PM8607_LDO(14,        LDO14, 0, 3, SUPPLIES_EN12, 6),
 };
 
 static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 70880be26015..2617b1ed4709 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -18,12 +18,12 @@
 #include <linux/hdreg.h>        /* HDIO_GETGEO                      */
 #include <linux/bio.h>
 #include <linux/module.h>
+#include <linux/compat.h>
 #include <linux/init.h>
 
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
-#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index f1a2016829fc..792c69e78fe2 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -13,6 +13,7 @@
 #define KMSG_COMPONENT "dasd"
 
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/blkpg.h>
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index e71298158f9e..911704571b9c 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -11,6 +11,7 @@
 #include <linux/console.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/module.h>
 #include <linux/list.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 75bde6a8b7dc..89c03e6b1c0c 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -13,6 +13,7 @@
 
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 0c87b0fc7714..8f9a1a384496 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 303dde09d294..fab2c2592a97 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -11,6 +11,7 @@
 #define KMSG_COMPONENT "zfcp"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/compat.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index b31a8e3841d7..d4ed9eb52657 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -69,10 +69,10 @@
 #ifndef SCSI_OSD_MAJOR
 #  define SCSI_OSD_MAJOR 260
 #endif
-#define SCSI_OSD_MAX_MINOR 64
+#define SCSI_OSD_MAX_MINOR MINORMASK
 
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.2.0";
+static const char *osd_version_string = "open-osd 0.2.1";
 
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
diff --git a/drivers/tty/serial/pxa.c b/drivers/tty/serial/pxa.c
index 5c8e3bba6c84..cdf4b2bfad80 100644
--- a/drivers/tty/serial/pxa.c
+++ b/drivers/tty/serial/pxa.c
@@ -36,6 +36,7 @@
 #include <linux/circ_buf.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
+#include <linux/of.h>
 #include <linux/platform_device.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
@@ -44,6 +45,8 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 
+#define PXA_NAME_LEN            8
+
 struct uart_pxa_port {
         struct uart_port        port;
         unsigned char           ier;
@@ -51,7 +54,7 @@ struct uart_pxa_port {
         unsigned char           mcr;
         unsigned int            lsr_break_flag;
         struct clk              *clk;
-        char                    *name;
+        char                    name[PXA_NAME_LEN];
 };
 
 static inline unsigned int serial_in(struct uart_pxa_port *up, int offset)
@@ -781,6 +784,31 @@ static const struct dev_pm_ops serial_pxa_pm_ops = {
 };
 #endif
 
+static struct of_device_id serial_pxa_dt_ids[] = {
+        { .compatible = "mrvl,pxa-uart", },
+        { .compatible = "mrvl,mmp-uart", },
+        {}
+};
+MODULE_DEVICE_TABLE(of, serial_pxa_dt_ids);
+
+static int serial_pxa_probe_dt(struct platform_device *pdev,
+                               struct uart_pxa_port *sport)
+{
+        struct device_node *np = pdev->dev.of_node;
+        int ret;
+
+        if (!np)
+                return 1;
+
+        ret = of_alias_get_id(np, "serial");
+        if (ret < 0) {
+                dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret);
+                return ret;
+        }
+        sport->port.line = ret;
+        return 0;
+}
+
 static int serial_pxa_probe(struct platform_device *dev)
 {
         struct uart_pxa_port *sport;
@@ -808,20 +836,16 @@ static int serial_pxa_probe(struct platform_device *dev)
         sport->port.irq = irqres->start;
         sport->port.fifosize = 64;
         sport->port.ops = &serial_pxa_pops;
-        sport->port.line = dev->id;
         sport->port.dev = &dev->dev;
         sport->port.flags = UPF_IOREMAP | UPF_BOOT_AUTOCONF;
         sport->port.uartclk = clk_get_rate(sport->clk);
 
-        switch (dev->id) {
-        case 0: sport->name = "FFUART"; break;
-        case 1: sport->name = "BTUART"; break;
-        case 2: sport->name = "STUART"; break;
-        case 3: sport->name = "HWUART"; break;
-        default:
-                sport->name = "???";
-                break;
-        }
+        ret = serial_pxa_probe_dt(dev, sport);
+        if (ret > 0)
+                sport->port.line = dev->id;
+        else if (ret < 0)
+                goto err_clk;
+        snprintf(sport->name, PXA_NAME_LEN - 1, "UART%d", sport->port.line + 1);
 
         sport->port.membase = ioremap(mmres->start, resource_size(mmres));
         if (!sport->port.membase) {
@@ -829,7 +853,7 @@ static int serial_pxa_probe(struct platform_device *dev)
                 goto err_clk;
         }
 
-        serial_pxa_ports[dev->id] = sport;
+        serial_pxa_ports[sport->port.line] = sport;
 
         uart_add_one_port(&serial_pxa_reg, &sport->port);
         platform_set_drvdata(dev, sport);
@@ -866,6 +890,7 @@ static struct platform_driver serial_pxa_driver = {
 #ifdef CONFIG_PM
                 .pm     = &serial_pxa_pm_ops,
 #endif
+                .of_match_table = serial_pxa_dt_ids,
         },
 };
 
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
index 74d29b552901..408a9927be92 100644
--- a/drivers/video/omap2/displays/Kconfig
+++ b/drivers/video/omap2/displays/Kconfig
@@ -12,7 +12,7 @@ config PANEL_GENERIC_DPI
 
 config PANEL_DVI
         tristate "DVI output"
-        depends on OMAP2_DSS_DPI
+        depends on OMAP2_DSS_DPI && I2C
         help
           Driver for external monitors, connected via DVI. The driver uses i2c
           to read EDID information from the monitor.
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/omap2/dss/apply.c
index 052dc874cd3d..87b3e25294cf 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -1276,6 +1276,9 @@ int dss_ovl_enable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for overlay to be enabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
@@ -1313,6 +1316,9 @@ int dss_ovl_disable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for the overlay to be disabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index d7aa3b056529..a36b934b2db4 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -165,9 +165,25 @@ static int hdmi_runtime_get(void)
 
         DSSDBG("hdmi_runtime_get\n");
 
+        /*
+         * HACK: Add dss_runtime_get() to ensure DSS clock domain is enabled.
+         * This should be removed later.
+         */
+        r = dss_runtime_get();
+        if (r < 0)
+                goto err_get_dss;
+
         r = pm_runtime_get_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
-        return r < 0 ? r : 0;
+        if (r < 0)
+                goto err_get_hdmi;
+
+        return 0;
+
+err_get_hdmi:
+        dss_runtime_put();
+err_get_dss:
+        return r;
 }
 
 static void hdmi_runtime_put(void)
@@ -178,6 +194,12 @@ static void hdmi_runtime_put(void)
 
         r = pm_runtime_put_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
+
+        /*
+         * HACK: This is added to complement the dss_runtime_get() call in
+         * hdmi_runtime_get(). This should be removed later.
+         */
+        dss_runtime_put();
 }
 
 int hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
index 2d72334ca3da..6847a478b459 100644
--- a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
+++ b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
@@ -479,14 +479,7 @@ int ti_hdmi_4xxx_read_edid(struct hdmi_ip_data *ip_data,
 
 bool ti_hdmi_4xxx_detect(struct hdmi_ip_data *ip_data)
 {
-        int r;
-
-        void __iomem *base = hdmi_core_sys_base(ip_data);
-
-        /* HPD */
-        r = REG_GET(base, HDMI_CORE_SYS_SYS_STAT, 1, 1);
-
-        return r == 1;
+        return gpio_get_value(ip_data->hpd_gpio);
 }
 
 static void hdmi_core_init(struct hdmi_core_video_config *video_cfg,
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index d5aaca9cfa7e..8497727d66de 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -1810,7 +1810,11 @@ static void hw_init(void)
                 break;
         }
 
+        /* magic required on VX900 for correct modesetting on IGA1 */
+        via_write_reg_mask(VIACR, 0x45, 0x00, 0x01);
+
         /* probably this should go to the scaling code one day */
+        via_write_reg_mask(VIACR, 0xFD, 0, 0x80); /* VX900 hw scale on IGA2 */
         viafb_write_regx(scaling_parameters, ARRAY_SIZE(scaling_parameters));
 
         /* Fill VPIT Parameters */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 95aeedf198f8..958e5129c601 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -367,29 +367,45 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 #ifdef CONFIG_PM
 static int virtballoon_freeze(struct virtio_device *vdev)
 {
+        struct virtio_balloon *vb = vdev->priv;
+
         /*
          * The kthread is already frozen by the PM core before this
          * function is called.
          */
 
+        while (vb->num_pages)
+                leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
+
         /* Ensure we don't get any more requests from the host */
         vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
         return 0;
 }
 
+static int restore_common(struct virtio_device *vdev)
+{
+        struct virtio_balloon *vb = vdev->priv;
+        int ret;
+
+        ret = init_vqs(vdev->priv);
+        if (ret)
+                return ret;
+
+        fill_balloon(vb, towards_target(vb));
+        update_balloon_size(vb);
+        return 0;
+}
+
 static int virtballoon_thaw(struct virtio_device *vdev)
 {
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 
 static int virtballoon_restore(struct virtio_device *vdev)
 {
         struct virtio_balloon *vb = vdev->priv;
-        struct page *page, *page2;
-
-        /* We're starting from a clean slate */
-        vb->num_pages = 0;
 
         /*
          * If a request wasn't complete at the time of freezing, this
@@ -397,12 +413,7 @@ static int virtballoon_restore(struct virtio_device *vdev)
          */
         vb->need_stats_update = 0;
 
-        /* We don't have these pages in the balloon anymore! */
-        list_for_each_entry_safe(page, page2, &vb->pages, lru) {
-                list_del(&page->lru);
-                totalram_pages++;
-        }
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 #endif
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 877b107f77a7..df9e8f0e327d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1098,7 +1098,7 @@ config BOOKE_WDT_DEFAULT_TIMEOUT
           For Freescale Book-E processors, this is a number between 0 and 63.
           For other Book-E processors, this is a number between 0 and 3.
 
-          The value can be overidden by the wdt_period command-line parameter.
+          The value can be overridden by the wdt_period command-line parameter.
 
 # PPC64 Architecture
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 337265b47305..7c0fdfca2646 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -198,9 +198,13 @@ static long booke_wdt_ioctl(struct file *file,
                 booke_wdt_period = tmp;
 #endif
                 booke_wdt_set();
-                return 0;
+                /* Fall */
         case WDIOC_GETTIMEOUT:
+#ifdef  CONFIG_FSL_BOOKE
+                return put_user(period_to_sec(booke_wdt_period), p);
+#else
                 return put_user(booke_wdt_period, p);
+#endif
         default:
                 return -ENOTTY;
         }
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8464ea1c36a1..3c166d3f4e55 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,7 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
 
         cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
 
-        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
+        set_memory_x((unsigned long)bios32_map, 2);
         asminline_call(&cmn_regs, bios32_entrypoint);
 
         if (cmn_regs.u1.ral != 0) {
@@ -250,7 +250,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                         cru_rom_addr =
                                 ioremap(cru_physical_address, cru_length);
                         if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
+                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
+                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
                                 retval = 0;
                         }
                 }
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 8e210aafdfd0..dfae030a7ef2 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 printk(KERN_INFO MODULE_NAME
-                        "failed to get memory region resouce\n");
+                        "failed to get memory region resource\n");
                 return -ENOENT;
         }
 
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 4bc3744e14e4..404172f02c9b 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -312,18 +312,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
         dev = &pdev->dev;
         wdt_dev = &pdev->dev;
 
-        /* get the memory region for the watchdog timer */
-
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 dev_err(dev, "no memory resource specified\n");
                 return -ENOENT;
         }
 
+        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (wdt_irq == NULL) {
+                dev_err(dev, "no irq resource specified\n");
+                ret = -ENOENT;
+                goto err;
+        }
+
+        /* get the memory region for the watchdog timer */
+
         size = resource_size(wdt_mem);
         if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
                 dev_err(dev, "failed to get memory region\n");
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         wdt_base = ioremap(wdt_mem->start, size);
@@ -335,29 +343,17 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         DBG("probe: mapped wdt_base=%p\n", wdt_base);
 
-        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (wdt_irq == NULL) {
-                dev_err(dev, "no irq resource specified\n");
-                ret = -ENOENT;
-                goto err_map;
-        }
-
-        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
-        if (ret != 0) {
-                dev_err(dev, "failed to install irq (%d)\n", ret);
-                goto err_map;
-        }
-
         wdt_clock = clk_get(&pdev->dev, "watchdog");
         if (IS_ERR(wdt_clock)) {
                 dev_err(dev, "failed to find watchdog clock source\n");
                 ret = PTR_ERR(wdt_clock);
-                goto err_irq;
+                goto err_map;
         }
 
         clk_enable(wdt_clock);
 
-        if (s3c2410wdt_cpufreq_register() < 0) {
+        ret = s3c2410wdt_cpufreq_register();
+        if (ret < 0) {
                 printk(KERN_ERR PFX "failed to register cpufreq\n");
                 goto err_clk;
         }
@@ -378,12 +374,18 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
                                                         "cannot start\n");
         }
 
+        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
+        if (ret != 0) {
+                dev_err(dev, "failed to install irq (%d)\n", ret);
+                goto err_cpufreq;
+        }
+
         watchdog_set_nowayout(&s3c2410_wdd, nowayout);
 
         ret = watchdog_register_device(&s3c2410_wdd);
         if (ret) {
                 dev_err(dev, "cannot register watchdog (%d)\n", ret);
-                goto err_cpufreq;
+                goto err_irq;
         }
 
         if (tmr_atboot && started == 0) {
@@ -408,23 +410,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         return 0;
 
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
+
  err_cpufreq:
         s3c2410wdt_cpufreq_deregister();
 
  err_clk:
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
-
- err_irq:
-        free_irq(wdt_irq->start, pdev);
+        wdt_clock = NULL;
 
  err_map:
         iounmap(wdt_base);
 
  err_req:
         release_mem_region(wdt_mem->start, size);
-        wdt_mem = NULL;
 
+ err:
+        wdt_irq = NULL;
+        wdt_mem = NULL;
         return ret;
 }
 
@@ -432,18 +437,18 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
         watchdog_unregister_device(&s3c2410_wdd);
 
+        free_irq(wdt_irq->start, dev);
+
         s3c2410wdt_cpufreq_deregister();
 
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
         wdt_clock = NULL;
 
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
-
         iounmap(wdt_base);
 
         release_mem_region(wdt_mem->start, resource_size(wdt_mem));
+        wdt_irq = NULL;
         wdt_mem = NULL;
         return 0;
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bcb884e2d613..07d096c49920 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1421,7 +1421,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
         for (i = 1; i < view->n; ++i) {
                 const struct user_regset *regset = &view->regsets[i];
                 do_thread_regset_writeback(t->task, regset);
-                if (regset->core_note_type &&
+                if (regset->core_note_type && regset->get &&
                     (!regset->active || regset->active(t->task, regset))) {
                         int ret;
                         size_t size = regset->n * regset->size;
diff --git a/fs/dcache.c b/fs/dcache.c
index fe19ac13f75f..138be96e25b6 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -104,7 +104,7 @@ static unsigned int d_hash_shift __read_mostly;
 
 static struct hlist_bl_head *dentry_hashtable __read_mostly;
 
-static inline struct hlist_bl_head *d_hash(struct dentry *parent,
+static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
                                         unsigned long hash)
 {
         hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
@@ -1717,8 +1717,9 @@ EXPORT_SYMBOL(d_add_ci);
  * child is looked up. Thus, an interlocking stepping of sequence lock checks
  * is formed, giving integrity down the path walk.
  */
-struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
-                                unsigned *seq, struct inode **inode)
+struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
+                                unsigned *seqp, struct inode **inode)
 {
         unsigned int len = name->len;
         unsigned int hash = name->hash;
@@ -1748,6 +1749,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
          * See Documentation/filesystems/path-lookup.txt for more details.
          */
         hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
+                unsigned seq;
                 struct inode *i;
                 const char *tname;
                 int tlen;
@@ -1756,7 +1758,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
                         continue;
 
 seqretry:
-                *seq = read_seqcount_begin(&dentry->d_seq);
+                seq = read_seqcount_begin(&dentry->d_seq);
                 if (dentry->d_parent != parent)
                         continue;
                 if (d_unhashed(dentry))
@@ -1771,7 +1773,7 @@ seqretry:
                  * edge of memory when walking. If we could load this
                  * atomically some other way, we could drop this check.
                  */
-                if (read_seqcount_retry(&dentry->d_seq, *seq))
+                if (read_seqcount_retry(&dentry->d_seq, seq))
                         goto seqretry;
                 if (unlikely(parent->d_flags & DCACHE_OP_COMPARE)) {
                         if (parent->d_op->d_compare(parent, *inode,
@@ -1788,6 +1790,7 @@ seqretry:
                  * order to do anything useful with the returned dentry
                  * anyway.
                  */
+                *seqp = seq;
                 *inode = i;
                 return dentry;
         }
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 349209dc6a91..3a06f4043df4 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -429,7 +429,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 goto memdup;
         } else if (count < MIN_MSG_PKT_SIZE || count > MAX_MSG_PKT_SIZE) {
                 printk(KERN_WARNING "%s: Acceptable packet size range is "
-                       "[%d-%lu], but amount of data written is [%zu].",
+                       "[%d-%zu], but amount of data written is [%zu].",
                        __func__, MIN_MSG_PKT_SIZE, MAX_MSG_PKT_SIZE, count);
                 return -EINVAL;
         }
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 376816fcd040..351a3e797789 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -167,14 +167,19 @@ void gfs2_glock_add_to_lru(struct gfs2_glock *gl)
         spin_unlock(&lru_lock);
 }
 
-static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+static void __gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 {
-        spin_lock(&lru_lock);
         if (!list_empty(&gl->gl_lru)) {
                 list_del_init(&gl->gl_lru);
                 atomic_dec(&lru_count);
                 clear_bit(GLF_LRU, &gl->gl_flags);
         }
+}
+
+static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+{
+        spin_lock(&lru_lock);
+        __gfs2_glock_remove_from_lru(gl);
         spin_unlock(&lru_lock);
 }
 
@@ -217,11 +222,12 @@ void gfs2_glock_put(struct gfs2_glock *gl)
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct address_space *mapping = gfs2_glock2aspace(gl);
 
-        if (atomic_dec_and_test(&gl->gl_ref)) {
+        if (atomic_dec_and_lock(&gl->gl_ref, &lru_lock)) {
+                __gfs2_glock_remove_from_lru(gl);
+                spin_unlock(&lru_lock);
                 spin_lock_bucket(gl->gl_hash);
                 hlist_bl_del_rcu(&gl->gl_list);
                 spin_unlock_bucket(gl->gl_hash);
-                gfs2_glock_remove_from_lru(gl);
                 GLOCK_BUG_ON(gl, !list_empty(&gl->gl_holders));
                 GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
                 trace_gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index a7d611b93f0f..56987460cdae 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -391,10 +391,6 @@ static int alloc_dinode(struct gfs2_inode *dip, u64 *no_addr, u64 *generation)
         int error;
         int dblocks = 1;
 
-        error = gfs2_rindex_update(sdp);
-        if (error)
-                fs_warn(sdp, "rindex update returns %d\n", error);
-
         error = gfs2_inplace_reserve(dip, RES_DINODE);
         if (error)
                 goto out;
@@ -1043,6 +1039,7 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
         rgd = gfs2_blk2rgrpd(sdp, ip->i_no_addr);
         if (!rgd)
                 goto out_inodes;
+
         gfs2_holder_init(rgd->rd_gl, LM_ST_EXCLUSIVE, 0, ghs + 2);
 
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 6aacf3f230a2..24f609c9ef91 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -800,6 +800,11 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo)
                 fs_err(sdp, "can't get quota file inode: %d\n", error);
                 goto fail_rindex;
         }
+
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                goto fail_qinode;
+
         return 0;
 
 fail_qinode:
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 981bfa32121a..49ada95209d0 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -683,16 +683,21 @@ int gfs2_rindex_update(struct gfs2_sbd *sdp)
         struct gfs2_glock *gl = ip->i_gl;
         struct gfs2_holder ri_gh;
         int error = 0;
+        int unlock_required = 0;
 
         /* Read new copy from disk if we don't have the latest */
         if (!sdp->sd_rindex_uptodate) {
                 mutex_lock(&sdp->sd_rindex_mutex);
-                error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
-                if (error)
-                        return error;
+                if (!gfs2_glock_is_locked_by_me(gl)) {
+                        error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
+                        if (error)
+                                return error;
+                        unlock_required = 1;
+                }
                 if (!sdp->sd_rindex_uptodate)
                         error = gfs2_ri_update(ip);
-                gfs2_glock_dq_uninit(&ri_gh);
+                if (unlock_required)
+                        gfs2_glock_dq_uninit(&ri_gh);
                 mutex_unlock(&sdp->sd_rindex_mutex);
         }
 
diff --git a/fs/namei.c b/fs/namei.c
index a780ea515c47..e2ba62820a0f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1374,6 +1374,34 @@ static inline int can_lookup(struct inode *inode)
         return 1;
 }
 
+unsigned int full_name_hash(const unsigned char *name, unsigned int len)
+{
+        unsigned long hash = init_name_hash();
+        while (len--)
+                hash = partial_name_hash(*name++, hash);
+        return end_name_hash(hash);
+}
+EXPORT_SYMBOL(full_name_hash);
+
+/*
+ * We know there's a real path component here of at least
+ * one character.
+ */
+static inline unsigned long hash_name(const char *name, unsigned int *hashp)
+{
+        unsigned long hash = init_name_hash();
+        unsigned long len = 0, c;
+
+        c = (unsigned char)*name;
+        do {
+                len++;
+                hash = partial_name_hash(c, hash);
+                c = (unsigned char)name[len];
+        } while (c && c != '/');
+        *hashp = end_name_hash(hash);
+        return len;
+}
+
 /*
  * Name resolution.
  * This is the basic name resolution function, turning a pathname into
@@ -1394,31 +1422,22 @@ static int link_path_walk(const char *name, struct nameidata *nd)
 
         /* At this point we know we have a real path component. */
         for(;;) {
-                unsigned long hash;
                 struct qstr this;
-                unsigned int c;
+                long len;
                 int type;
 
                 err = may_lookup(nd);
                 if (err)
                         break;
 
+                len = hash_name(name, &this.hash);
                 this.name = name;
-                c = *(const unsigned char *)name;
-
-                hash = init_name_hash();
-                do {
-                        name++;
-                        hash = partial_name_hash(c, hash);
-                        c = *(const unsigned char *)name;
-                } while (c && (c != '/'));
-                this.len = name - (const char *) this.name;
-                this.hash = end_name_hash(hash);
+                this.len = len;
 
                 type = LAST_NORM;
-                if (this.name[0] == '.') switch (this.len) {
+                if (name[0] == '.') switch (len) {
                         case 2:
-                                if (this.name[1] == '.') {
+                                if (name[1] == '.') {
                                         type = LAST_DOTDOT;
                                         nd->flags |= LOOKUP_JUMPED;
                                 }
@@ -1437,12 +1456,18 @@ static int link_path_walk(const char *name, struct nameidata *nd)
                         }
                 }
 
-                /* remove trailing slashes? */
-                if (!c)
+                if (!name[len])
                         goto last_component;
-                while (*++name == '/');
-                if (!*name)
+                /*
+                 * If it wasn't NUL, we know it was '/'. Skip that
+                 * slash, and continue until no more slashes.
+                 */
+                do {
+                        len++;
+                } while (unlikely(name[len] == '/'));
+                if (!name[len])
                         goto last_component;
+                name += len;
 
                 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
                 if (err < 0)
@@ -1775,24 +1800,21 @@ static struct dentry *lookup_hash(struct nameidata *nd)
 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 {
         struct qstr this;
-        unsigned long hash;
         unsigned int c;
 
         WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
 
         this.name = name;
         this.len = len;
+        this.hash = full_name_hash(name, len);
         if (!len)
                 return ERR_PTR(-EACCES);
 
-        hash = init_name_hash();
         while (len--) {
                 c = *(const unsigned char *)name++;
                 if (c == '/' || c == '\0')
                         return ERR_PTR(-EACCES);
-                hash = partial_name_hash(c, hash);
         }
-        this.hash = end_name_hash(hash);
         /*
          * See if the low-level filesystem might want
          * to use its own hash..
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index f14fde2b03d6..e0281992ddc3 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -1,7 +1,7 @@
 /**
  * attrib.c - NTFS attribute operations.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2007 Anton Altaparmakov
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -345,10 +345,10 @@ LCN ntfs_attr_vcn_to_lcn_nolock(ntfs_inode *ni, const VCN vcn,
         unsigned long flags;
         bool is_retry = false;
 
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, vcn 0x%llx, %s_locked.",
                         ni->mft_no, (unsigned long long)vcn,
                         write_locked ? "write" : "read");
-        BUG_ON(!ni);
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(vcn < 0);
         if (!ni->runlist.rl) {
@@ -469,9 +469,9 @@ runlist_element *ntfs_attr_find_vcn_nolock(ntfs_inode *ni, const VCN vcn,
         int err = 0;
         bool is_retry = false;
 
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, vcn 0x%llx, with%s ctx.",
                         ni->mft_no, (unsigned long long)vcn, ctx ? "" : "out");
-        BUG_ON(!ni);
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(vcn < 0);
         if (!ni->runlist.rl) {
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 382857f9c7db..3014a36a255b 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -1367,7 +1367,7 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(ntfs_volume *vol)
                         ntfs_error(vol->sb, "Failed to merge runlists for mft "
                                         "bitmap.");
                         if (ntfs_cluster_free_from_rl(vol, rl2)) {
-                                ntfs_error(vol->sb, "Failed to dealocate "
+                                ntfs_error(vol->sb, "Failed to deallocate "
                                                 "allocated cluster.%s", es);
                                 NVolSetErrors(vol);
                         }
@@ -1805,7 +1805,7 @@ static int ntfs_mft_data_extend_allocation_nolock(ntfs_volume *vol)
                 ntfs_error(vol->sb, "Failed to merge runlists for mft data "
                                 "attribute.");
                 if (ntfs_cluster_free_from_rl(vol, rl2)) {
-                        ntfs_error(vol->sb, "Failed to dealocate clusters "
+                        ntfs_error(vol->sb, "Failed to deallocate clusters "
                                         "from the mft data attribute.%s", es);
                         NVolSetErrors(vol);
                 }
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 5a4a8af5c406..f907611cca73 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1,7 +1,7 @@
 /*
  * super.c - NTFS kernel super block handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2001,2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -1239,7 +1239,6 @@ static int check_windows_hibernation_status(ntfs_volume *vol)
 {
         MFT_REF mref;
         struct inode *vi;
-        ntfs_inode *ni;
         struct page *page;
         u32 *kaddr, *kend;
         ntfs_name *name = NULL;
@@ -1290,7 +1289,6 @@ static int check_windows_hibernation_status(ntfs_volume *vol)
                                 "is not the system volume.", i_size_read(vi));
                 goto iput_out;
         }
-        ni = NTFS_I(vi);
         page = ntfs_map_page(vi->i_mapping, 0);
         if (IS_ERR(page)) {
                 ntfs_error(vol->sb, "Failed to read from hiberfil.sys.");
diff --git a/include/asm-generic/iomap.h b/include/asm-generic/iomap.h
index 8a3d4fde2604..6afd7d6a9899 100644
--- a/include/asm-generic/iomap.h
+++ b/include/asm-generic/iomap.h
@@ -70,7 +70,7 @@ extern void ioport_unmap(void __iomem *);
 /* Destroy a virtual mapping cookie for a PCI BAR (memory or IO) */
 struct pci_dev;
 extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
-#else
+#elif defined(CONFIG_GENERIC_IOMAP)
 struct pci_dev;
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 { }
diff --git a/include/asm-generic/pci_iomap.h b/include/asm-generic/pci_iomap.h
index e58fcf891370..ce37349860fe 100644
--- a/include/asm-generic/pci_iomap.h
+++ b/include/asm-generic/pci_iomap.h
@@ -25,7 +25,7 @@ extern void __iomem *__pci_ioport_map(struct pci_dev *dev, unsigned long port,
 #define __pci_ioport_map(dev, port, nr) ioport_map((port), (nr))
 #endif
 
-#else
+#elif defined(CONFIG_GENERIC_PCI_IOMAP)
 static inline void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
         return NULL;
diff --git a/include/drm/Kbuild b/include/drm/Kbuild
index a5c0e10fd47d..1e38a19d68f6 100644
--- a/include/drm/Kbuild
+++ b/include/drm/Kbuild
@@ -2,6 +2,7 @@ header-y += drm.h
 header-y += drm_fourcc.h
 header-y += drm_mode.h
 header-y += drm_sarea.h
+header-y += exynos_drm.h
 header-y += i810_drm.h
 header-y += i915_drm.h
 header-y += mga_drm.h
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 5e120f1c5cd9..1ed3aae893a5 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -97,15 +97,30 @@ struct drm_exynos_plane_set_zpos {
 #define DRM_IOCTL_EXYNOS_PLANE_SET_ZPOS DRM_IOWR(DRM_COMMAND_BASE + \
                 DRM_EXYNOS_PLANE_SET_ZPOS, struct drm_exynos_plane_set_zpos)
 
+#ifdef __KERNEL__
+
 /**
- * Platform Specific Structure for DRM based FIMD.
+ * A structure for lcd panel information.
  *
  * @timing: default video mode for initializing
+ * @width_mm: physical size of lcd width.
+ * @height_mm: physical size of lcd height.
+ */
+struct exynos_drm_panel_info {
+        struct fb_videomode timing;
+        u32 width_mm;
+        u32 height_mm;
+};
+
+/**
+ * Platform Specific Structure for DRM based FIMD.
+ *
+ * @panel: default panel info for initializing
  * @default_win: default window layer number to be used for UI.
  * @bpp: default bit per pixel.
  */
 struct exynos_drm_fimd_pdata {
-        struct fb_videomode             timing;
+        struct exynos_drm_panel_info panel;
         u32                             vidcon0;
         u32                             vidcon1;
         unsigned int                    default_win;
@@ -139,4 +154,5 @@ struct exynos_drm_hdmi_pdata {
         unsigned int                    bpp;
 };
 
-#endif
+#endif  /* __KERNEL__ */
+#endif  /* _EXYNOS_DRM_H_ */
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f6515f46..7e05fcee75a1 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -561,5 +561,9 @@ asmlinkage ssize_t compat_sys_process_vm_writev(compat_pid_t pid,
                 unsigned long liovcnt, const struct compat_iovec __user *rvec,
                 unsigned long riovcnt, unsigned long flags);
 
+#else
+
+#define is_compat_task() (0)
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d64a55b23afd..4270bedd2308 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -54,18 +54,17 @@ extern struct dentry_stat_t dentry_stat;
 static inline int dentry_cmp(const unsigned char *cs, size_t scount,
                                 const unsigned char *ct, size_t tcount)
 {
-        int ret;
         if (scount != tcount)
                 return 1;
+
         do {
-                ret = (*cs != *ct);
-                if (ret)
-                        break;
+                if (*cs != *ct)
+                        return 1;
                 cs++;
                 ct++;
                 tcount--;
         } while (tcount);
-        return ret;
+        return 0;
 }
 
 /* Name hashing routines. Initial hash value */
@@ -89,14 +88,7 @@ static inline unsigned long end_name_hash(unsigned long hash)
 }
 
 /* Compute the hash for a name string. */
-static inline unsigned int
-full_name_hash(const unsigned char *name, unsigned int len)
-{
-        unsigned long hash = init_name_hash();
-        while (len--)
-                hash = partial_name_hash(*name++, hash);
-        return end_name_hash(hash);
-}
+extern unsigned int full_name_hash(const unsigned char *, unsigned int);
 
 /*
  * Try to keep struct dentry aligned on 64 byte cachelines (this will
@@ -309,7 +301,8 @@ extern struct dentry *d_ancestor(struct dentry *, struct dentry *);
 extern struct dentry *d_lookup(struct dentry *, struct qstr *);
 extern struct dentry *d_hash_and_lookup(struct dentry *, struct qstr *);
 extern struct dentry *__d_lookup(struct dentry *, struct qstr *);
-extern struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
+extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
                                 unsigned *seq, struct inode **inode);
 
 /**
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c52d4b5f872a..4b24ff453aee 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -137,6 +137,7 @@ enum {
         IFLA_AF_SPEC,
         IFLA_GROUP,             /* Group the device belongs to */
         IFLA_NET_NS_FD,
+        IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
         __IFLA_MAX
 };
 
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 8797ed16feb2..4dd5bd6994a8 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -285,8 +285,8 @@ struct ebt_table {
         struct module *me;
 };
 
-#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
-                     ~(__alignof__(struct ebt_replace)-1))
+#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
+                     ~(__alignof__(struct _xt_align)-1))
 extern struct ebt_table *ebt_register_table(struct net *net,
                                             const struct ebt_table *table);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
diff --git a/include/linux/regset.h b/include/linux/regset.h
index 8abee6556223..686f37327a49 100644
--- a/include/linux/regset.h
+++ b/include/linux/regset.h
@@ -335,8 +335,11 @@ static inline int copy_regset_to_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->get)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_WRITE, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->get(target, regset, offset, size, NULL, data);
 }
@@ -358,8 +361,11 @@ static inline int copy_regset_from_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->set)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_READ, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->set(target, regset, offset, size, NULL, data);
 }
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 8e872ead88b5..577592ea0ea0 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -602,6 +602,9 @@ struct tcamsg {
 #define TCA_ACT_TAB 1 /* attr type must be >=1 */       
 #define TCAA_MAX 1
 
+/* New extended info filters for IFLA_EXT_MASK */
+#define RTEXT_FILTER_VF         (1 << 0)
+
 /* End of information exported to user level */
 
 #ifdef __KERNEL__
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 50db9b04a552..ae86adee3746 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1465,6 +1465,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
 
+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
+{
+        if (skb_mac_header_was_set(skb)) {
+                const unsigned char *old_mac = skb_mac_header(skb);
+
+                skb_set_mac_header(skb, -skb->mac_len);
+                memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        }
+}
+
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
         return skb->csum_start - skb_headroom(skb);
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index abaad6ed9b83..4a82ca0bb0b2 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -256,4 +256,6 @@ void l2cap_exit(void);
 int sco_init(void);
 void sco_exit(void);
 
+void bt_sock_reclassify_lock(struct sock *sk, int proto);
+
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea9231f4935f..453893b3120e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -540,7 +540,7 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
-        cancel_delayed_work_sync(&conn->disc_work);
+        cancel_delayed_work(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
@@ -559,9 +559,9 @@ static inline void hci_conn_put(struct hci_conn *conn)
                 } else {
                         timeo = msecs_to_jiffies(10);
                 }
-                cancel_delayed_work_sync(&conn->disc_work);
+                cancel_delayed_work(&conn->disc_work);
                 queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, jiffies + timeo);
+                                        &conn->disc_work, timeo);
         }
 }
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 68f589150692..b1664ed884e6 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -611,7 +611,7 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 {
         BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
 
-        if (!__cancel_delayed_work(work))
+        if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
         schedule_delayed_work(work, timeout);
 }
@@ -619,20 +619,20 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 static inline void l2cap_clear_timer(struct l2cap_chan *chan,
                                         struct delayed_work *work)
 {
-        if (__cancel_delayed_work(work))
+        if (cancel_delayed_work(work))
                 l2cap_chan_put(chan);
 }
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
 #define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                L2CAP_DEFAULT_RETRANS_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
 #define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                L2CAP_DEFAULT_MONITOR_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
-                L2CAP_DEFAULT_ACK_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
 #define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 
 static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
@@ -834,7 +834,7 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                                                                 bdaddr_t *dst);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 8a2b0ae7dbd2..ab86036bbf0c 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -209,7 +209,7 @@ extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple);
 
-extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_insert_dying_list(struct nf_conn *ct);
 
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 678f1ffaf843..370293901971 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,7 +6,7 @@
 
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
-typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 
 extern int      __rtnl_register(int protocol, int msgtype,
                                 rtnl_doit_func, rtnl_dumpit_func,
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 6ba596b07a72..e33ed1bfa113 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -370,56 +370,6 @@ TRACE_EVENT(sched_stat_runtime,
                         (unsigned long long)__entry->vruntime)
 );
 
-#ifdef CREATE_TRACE_POINTS
-static inline u64 trace_get_sleeptime(struct task_struct *tsk)
-{
-#ifdef CONFIG_SCHEDSTATS
-        u64 block, sleep;
-
-        block = tsk->se.statistics.block_start;
-        sleep = tsk->se.statistics.sleep_start;
-        tsk->se.statistics.block_start = 0;
-        tsk->se.statistics.sleep_start = 0;
-
-        return block ? block : sleep ? sleep : 0;
-#else
-        return 0;
-#endif
-}
-#endif
-
-/*
- * Tracepoint for accounting sleeptime (time the task is sleeping
- * or waiting for I/O).
- */
-TRACE_EVENT(sched_stat_sleeptime,
-
-        TP_PROTO(struct task_struct *tsk, u64 now),
-
-        TP_ARGS(tsk, now),
-
-        TP_STRUCT__entry(
-                __array( char,  comm,   TASK_COMM_LEN   )
-                __field( pid_t, pid                     )
-                __field( u64,   sleeptime               )
-        ),
-
-        TP_fast_assign(
-                memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN);
-                __entry->pid            = tsk->pid;
-                __entry->sleeptime = trace_get_sleeptime(tsk);
-                __entry->sleeptime = __entry->sleeptime ?
-                                now - __entry->sleeptime : 0;
-        )
-        TP_perf_assign(
-                __perf_count(__entry->sleeptime);
-        ),
-
-        TP_printk("comm=%s pid=%d sleeptime=%Lu [ns]",
-                        __entry->comm, __entry->pid,
-                        (unsigned long long)__entry->sleeptime)
-);
-
 /*
  * Tracepoint for showing priority inheritance modifying a tasks
  * priority.
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index b7971d6f38bf..ee706ce44aa0 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -651,10 +651,10 @@ int __init init_hw_breakpoint(void)
 
  err_alloc:
         for_each_possible_cpu(err_cpu) {
-                if (err_cpu == cpu)
-                        break;
                 for (i = 0; i < TYPE_MAX; i++)
                         kfree(per_cpu(nr_task_bp_pinned[i], cpu));
+                if (err_cpu == cpu)
+                        break;
         }
 
         return -ENOMEM;
diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 342d8f44e401..0119b9d467ae 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void)
                         if (desc->irq_data.chip->irq_set_type)
                                 desc->irq_data.chip->irq_set_type(&desc->irq_data,
                                                          IRQ_TYPE_PROBE);
-                        irq_startup(desc);
+                        irq_startup(desc, false);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void)
                 raw_spin_lock_irq(&desc->lock);
                 if (!desc->action && irq_settings_can_probe(desc)) {
                         desc->istate |= IRQS_AUTODETECT | IRQS_WAITING;
-                        if (irq_startup(desc))
+                        if (irq_startup(desc, false))
                                 desc->istate |= IRQS_PENDING;
                 }
                 raw_spin_unlock_irq(&desc->lock);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index f7c543a801d9..fb7db75ee0c8 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -157,19 +157,22 @@ static void irq_state_set_masked(struct irq_desc *desc)
         irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
 }
 
-int irq_startup(struct irq_desc *desc)
+int irq_startup(struct irq_desc *desc, bool resend)
 {
+        int ret = 0;
+
         irq_state_clr_disabled(desc);
         desc->depth = 0;
 
         if (desc->irq_data.chip->irq_startup) {
-                int ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
+                ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
                 irq_state_clr_masked(desc);
-                return ret;
+        } else {
+                irq_enable(desc);
         }
-
-        irq_enable(desc);
-        return 0;
+        if (resend)
+                check_irq_resend(desc, desc->irq_data.irq);
+        return ret;
 }
 
 void irq_shutdown(struct irq_desc *desc)
@@ -330,6 +333,24 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(handle_simple_irq);
 
+/*
+ * Called unconditionally from handle_level_irq() and only for oneshot
+ * interrupts from handle_fasteoi_irq()
+ */
+static void cond_unmask_irq(struct irq_desc *desc)
+{
+        /*
+         * We need to unmask in the following cases:
+         * - Standard level irq (IRQF_ONESHOT is not set)
+         * - Oneshot irq which did not wake the thread (caused by a
+         *   spurious interrupt or a primary handler handling it
+         *   completely).
+         */
+        if (!irqd_irq_disabled(&desc->irq_data) &&
+            irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot)
+                unmask_irq(desc);
+}
+
 /**
  *      handle_level_irq - Level type irq handler
  *      @irq:   the interrupt number
@@ -362,8 +383,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
 
         handle_irq_event(desc);
 
-        if (!irqd_irq_disabled(&desc->irq_data) && !(desc->istate & IRQS_ONESHOT))
-                unmask_irq(desc);
+        cond_unmask_irq(desc);
+
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -417,6 +438,9 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         preflow_handler(desc);
         handle_irq_event(desc);
 
+        if (desc->istate & IRQS_ONESHOT)
+                cond_unmask_irq(desc);
+
 out_eoi:
         desc->irq_data.chip->irq_eoi(&desc->irq_data);
 out_unlock:
@@ -625,7 +649,7 @@ __irq_set_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
                 irq_settings_set_noprobe(desc);
                 irq_settings_set_norequest(desc);
                 irq_settings_set_nothread(desc);
-                irq_startup(desc);
+                irq_startup(desc, true);
         }
 out:
         irq_put_desc_busunlock(desc, flags);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index b7952316016a..40378ff877e7 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -67,7 +67,7 @@ extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
 extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
 extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
 
-extern int irq_startup(struct irq_desc *desc);
+extern int irq_startup(struct irq_desc *desc, bool resend);
 extern void irq_shutdown(struct irq_desc *desc);
 extern void irq_enable(struct irq_desc *desc);
 extern void irq_disable(struct irq_desc *desc);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index a9a9dbe49fea..32313c084442 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1027,7 +1027,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                         desc->istate |= IRQS_ONESHOT;
 
                 if (irq_settings_can_autoenable(desc))
-                        irq_startup(desc);
+                        irq_startup(desc, true);
                 else
                         /* Undo nested disables: */
                         desc->depth = 1;
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 5255c9d2e053..33a0676ea744 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1932,7 +1932,6 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
         local_irq_enable();
 #endif /* __ARCH_WANT_INTERRUPTS_ON_CTXSW */
         finish_lock_switch(rq, prev);
-        trace_sched_stat_sleeptime(current, rq->clock);
 
         fire_sched_in_preempt_notifiers(current);
         if (mm)
@@ -6729,7 +6728,7 @@ int __init sched_create_sysfs_power_savings_entries(struct device *dev)
 static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
                              void *hcpu)
 {
-        switch (action & ~CPU_TASKS_FROZEN) {
+        switch (action) {
         case CPU_ONLINE:
         case CPU_DOWN_FAILED:
                 cpuset_update_active_cpus();
@@ -6742,7 +6741,7 @@ static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action,
 static int cpuset_cpu_inactive(struct notifier_block *nfb, unsigned long action,
                                void *hcpu)
 {
-        switch (action & ~CPU_TASKS_FROZEN) {
+        switch (action) {
         case CPU_DOWN_PREPARE:
                 cpuset_update_active_cpus();
                 return NOTIFY_OK;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7c6414fc669d..aca16b843b7e 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1003,6 +1003,7 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 if (unlikely(delta > se->statistics.sleep_max))
                         se->statistics.sleep_max = delta;
 
+                se->statistics.sleep_start = 0;
                 se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
@@ -1019,6 +1020,7 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 if (unlikely(delta > se->statistics.block_max))
                         se->statistics.block_max = delta;
 
+                se->statistics.block_start = 0;
                 se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
diff --git a/mm/memblock.c b/mm/memblock.c
index 77b5f227e1d8..99f285599501 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -99,9 +99,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
         phys_addr_t this_start, this_end, cand;
         u64 i;
 
-        /* align @size to avoid excessive fragmentation on reserved array */
-        size = round_up(size, align);
-
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
                 end = memblock.current_limit;
@@ -731,6 +728,9 @@ static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
 {
         phys_addr_t found;
 
+        /* align @size to avoid excessive fragmentation on reserved array */
+        size = round_up(size, align);
+
         found = memblock_find_in_range_node(0, max_addr, size, align, nid);
         if (found && !memblock_reserve(found, size))
                 return found;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index c12c2582457c..127fe70a1baa 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -46,8 +46,8 @@
 
 static struct net_device *clip_devs;
 static struct atm_vcc *atmarpd;
-static struct neigh_table clip_tbl;
 static struct timer_list idle_timer;
+static const struct neigh_ops clip_neigh_ops;
 
 static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 {
@@ -123,6 +123,8 @@ static int neigh_check_cb(struct neighbour *n)
         struct atmarp_entry *entry = neighbour_priv(n);
         struct clip_vcc *cv;
 
+        if (n->ops != &clip_neigh_ops)
+                return 0;
         for (cv = entry->vccs; cv; cv = cv->next) {
                 unsigned long exp = cv->last_use + cv->idle_timeout;
 
@@ -154,10 +156,10 @@ static int neigh_check_cb(struct neighbour *n)
 
 static void idle_timer_check(unsigned long dummy)
 {
-        write_lock(&clip_tbl.lock);
-        __neigh_for_each_release(&clip_tbl, neigh_check_cb);
+        write_lock(&arp_tbl.lock);
+        __neigh_for_each_release(&arp_tbl, neigh_check_cb);
         mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
-        write_unlock(&clip_tbl.lock);
+        write_unlock(&arp_tbl.lock);
 }
 
 static int clip_arp_rcv(struct sk_buff *skb)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ef92864ac625..72eb187a5f60 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -71,19 +71,16 @@ static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
         "slock-AF_BLUETOOTH-BTPROTO_AVDTP",
 };
 
-static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
+void bt_sock_reclassify_lock(struct sock *sk, int proto)
 {
-        struct sock *sk = sock->sk;
-
-        if (!sk)
-                return;
-
+        BUG_ON(!sk);
         BUG_ON(sock_owned_by_user(sk));
 
         sock_lock_init_class_and_name(sk,
                         bt_slock_key_strings[proto], &bt_slock_key[proto],
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
+EXPORT_SYMBOL(bt_sock_reclassify_lock);
 
 int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
@@ -145,7 +142,8 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto,
 
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                 err = bt_proto[proto]->create(net, sock, proto, kern);
-                bt_sock_reclassify_lock(sock, proto);
+                if (!err)
+                        bt_sock_reclassify_lock(sock->sk, proto);
                 module_put(bt_proto[proto]->owner);
         }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3db432473ad5..07bc69ed9498 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -635,6 +635,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
+
+                /* encrypt must be pending if auth is also pending */
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 9de93714213a..5aeb62491198 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -640,7 +640,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         /* Reset device */
         skb_queue_purge(&hdev->cmd_q);
         atomic_set(&hdev->cmd_cnt, 1);
-        if (!test_bit(HCI_RAW, &hdev->flags)) {
+        if (!test_bit(HCI_RAW, &hdev->flags) &&
+                                test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
                                         msecs_to_jiffies(250));
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index faf0b11ac1d3..32d338c30e65 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         hci_chan_del(conn->hchan);
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work_sync(&conn->info_timer);
 
         if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work_sync(&conn->security_timer);
                 smp_chan_destroy(conn);
         }
 
@@ -1120,7 +1120,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
         return c1;
 }
 
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
 {
         struct sock *sk = chan->sk;
         bdaddr_t *src = &bt_sk(sk)->src;
@@ -2574,7 +2574,7 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
                                         cmd->ident == conn->info_ident) {
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work(&conn->info_timer);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
                 conn->info_ident = 0;
@@ -2970,7 +2970,8 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         default:
                 sk->sk_err = ECONNRESET;
-                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
+                __set_chan_timer(chan,
+                                msecs_to_jiffies(L2CAP_DISC_REJ_TIMEOUT));
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -3120,7 +3121,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
                         conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
                 return 0;
 
-        __cancel_delayed_work(&conn->info_timer);
+        cancel_delayed_work(&conn->info_timer);
 
         if (result != L2CAP_IR_SUCCESS) {
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
@@ -4478,7 +4479,8 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         __clear_chan_timer(chan);
-                        __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
+                        __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_ENC_TIMEOUT));
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
@@ -4499,7 +4501,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
         if (hcon->type == LE_LINK) {
                 smp_distribute_keys(conn, 0);
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work(&conn->security_timer);
         }
 
         rcu_read_lock();
@@ -4546,7 +4548,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
                                 __clear_chan_timer(chan);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                         }
                 } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
@@ -4566,7 +4569,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 }
                         } else {
                                 l2cap_state_change(chan, BT_DISCONN);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c61d967012b2..401d9428ae4c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -849,6 +849,8 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
         if (!sk)
                 return NULL;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
+
         l2cap_sock_init(sk, parent);
 
         return l2cap_pi(sk)->chan;
@@ -1002,7 +1004,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
+        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 501649bf5596..8a602388f1e7 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,12 +1164,18 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        /* When socket is closed and we are not RFCOMM
-                         * initiator rfcomm_process_rx already calls
-                         * rfcomm_session_put() */
-                        if (s->sock->sk->sk_state != BT_CLOSED)
-                                if (list_empty(&s->dlcs))
-                                        rfcomm_session_put(s);
+                        /* rfcomm_session_put is called later so don't do
+                         * anything here otherwise we will mess up the session
+                         * reference counter:
+                         *
+                         * (a) when we are the initiator dlc_unlink will drive
+                         * the reference counter to 0 (there is no initial put
+                         * after session_add)
+                         *
+                         * (b) when we are not the initiator rfcomm_rx_process
+                         * will explicitly call put to balance the initial hold
+                         * done after session add.
+                         */
                         break;
                 }
         }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index f066678faeee..22169c3f1482 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -956,6 +956,8 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
         if (!sk)
                 goto done;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
+
         rfcomm_sock_init(sk, parent);
         bacpy(&bt_sk(sk)->src, &src);
         bacpy(&bt_sk(sk)->dst, &dst);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e287346e0934..2a83914b0277 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -826,6 +826,8 @@ next_elt:
                 write_unlock_bh(&tbl->lock);
                 cond_resched();
                 write_lock_bh(&tbl->lock);
+                nht = rcu_dereference_protected(tbl->nht,
+                                                lockdep_is_held(&tbl->lock));
         }
         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 65aebd450027..606a6e8f3671 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -60,7 +60,6 @@ struct rtnl_link {
 };
 
 static DEFINE_MUTEX(rtnl_mutex);
-static u16 min_ifinfo_dump_size;
 
 void rtnl_lock(void)
 {
@@ -724,10 +723,11 @@ static void copy_rtnl_link_stats64(void *v, const struct rtnl_link_stats64 *b)
 }
 
 /* All VF info */
-static inline int rtnl_vfinfo_size(const struct net_device *dev)
+static inline int rtnl_vfinfo_size(const struct net_device *dev,
+                                   u32 ext_filter_mask)
 {
-        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
-
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent) &&
+            (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int num_vfs = dev_num_vf(dev->dev.parent);
                 size_t size = nla_total_size(sizeof(struct nlattr));
                 size += nla_total_size(num_vfs * sizeof(struct nlattr));
@@ -766,7 +766,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
                 return port_self_size;
 }
 
-static noinline size_t if_nlmsg_size(const struct net_device *dev)
+static noinline size_t if_nlmsg_size(const struct net_device *dev,
+                                     u32 ext_filter_mask)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
                + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
@@ -784,8 +785,9 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(4) /* IFLA_MASTER */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
-               + nla_total_size(4) /* IFLA_NUM_VF */
-               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
+               + nla_total_size(ext_filter_mask
+                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
                + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
                + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
                + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
@@ -868,7 +870,7 @@ static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
 
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
-                            unsigned int flags)
+                            unsigned int flags, u32 ext_filter_mask)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
@@ -941,10 +943,11 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                 goto nla_put_failure;
         copy_rtnl_link_stats64(nla_data(attr), stats);
 
-        if (dev->dev.parent)
+        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF))
                 NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
 
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
+            && (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int i;
 
                 struct nlattr *vfinfo, *vf;
@@ -1048,6 +1051,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct hlist_head *head;
         struct hlist_node *node;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
 
         s_h = cb->args[0];
         s_idx = cb->args[1];
@@ -1055,6 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
+        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                    ifla_policy);
+
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
@@ -1064,7 +1075,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
                                              NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI) <= 0)
+                                             NLM_F_MULTI,
+                                             ext_filter_mask) <= 0)
                                 goto out;
 
                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -1100,6 +1112,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
         [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
+        [IFLA_EXT_MASK]         = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -1509,8 +1522,6 @@ errout:
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
-                                     min_ifinfo_dump_size);
 
         return err;
 }
@@ -1842,6 +1853,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
         int err;
+        u32 ext_filter_mask = 0;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
         if (err < 0)
@@ -1850,6 +1862,9 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
 
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
                 dev = __dev_get_by_index(net, ifm->ifi_index);
@@ -1861,12 +1876,12 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (dev == NULL)
                 return -ENODEV;
 
-        nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
+        nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL);
         if (nskb == NULL)
                 return -ENOBUFS;
 
         err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
-                               nlh->nlmsg_seq, 0, 0);
+                               nlh->nlmsg_seq, 0, 0, ext_filter_mask);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
@@ -1877,8 +1892,31 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         return err;
 }
 
-static u16 rtnl_calcit(struct sk_buff *skb)
+static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
+        u16 min_ifinfo_dump_size = 0;
+
+        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
+
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
+        if (!ext_filter_mask)
+                return NLMSG_GOODSIZE;
+        /*
+         * traverse the list of net devices and compute the minimum
+         * buffer size based upon the filter mask.
+         */
+        list_for_each_entry(dev, &net->dev_base_head, dev_list) {
+                min_ifinfo_dump_size = max_t(u16, min_ifinfo_dump_size,
+                                             if_nlmsg_size(dev,
+                                                           ext_filter_mask));
+        }
+
         return min_ifinfo_dump_size;
 }
 
@@ -1913,13 +1951,11 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
         int err = -ENOBUFS;
         size_t if_info_size;
 
-        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev)), GFP_KERNEL);
+        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), GFP_KERNEL);
         if (skb == NULL)
                 goto errout;
 
-        min_ifinfo_dump_size = max_t(u16, if_info_size, min_ifinfo_dump_size);
-
-        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0);
+        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -1977,7 +2013,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
                 calcit = rtnl_get_calcit(family, type);
                 if (calcit)
-                        min_dump_alloc = calcit(skb);
+                        min_dump_alloc = calcit(skb, nlh);
 
                 __rtnl_unlock();
                 rtnl = net->rtnl;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 6b3ca5ba4450..38673d2860e2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -65,7 +65,7 @@
    it is infeasible task. The most general solutions would be
    to keep skb->encapsulation counter (sort of local ttl),
    and silently drop packet when it expires. It is a good
-   solution, but it supposes maintaing new variable in ALL
+   solution, but it supposes maintaining new variable in ALL
    skb, even if no tunneling is used.
 
    Current solution: xmit_recursion breaks dead loops. This is a percpu
@@ -91,14 +91,14 @@
 
    One of them is to parse packet trying to detect inner encapsulation
    made by our node. It is difficult or even impossible, especially,
-   taking into account fragmentation. TO be short, tt is not solution at all.
+   taking into account fragmentation. TO be short, ttl is not solution at all.
 
    Current solution: The solution was UNEXPECTEDLY SIMPLE.
    We force DF flag on tunnels with preconfigured hop limit,
    that is ALL. :-) Well, it does not remove the problem completely,
    but exponential growth of network traffic is changed to linear
    (branches, that exceed pmtu are pruned) and tunnel mtu
-   fastly degrades to value <68, where looping stops.
+   rapidly degrades to value <68, where looping stops.
    Yes, it is not good if there exists a router in the loop,
    which does not force DF, even when encapsulating packets have DF set.
    But it is not our problem! Nobody could accuse us, we made
@@ -457,8 +457,8 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
    GRE tunnels with enabled checksum. Tell them "thank you".
 
    Well, I wonder, rfc1812 was written by Cisco employee,
-   what the hell these idiots break standrads established
-   by themself???
+   what the hell these idiots break standards established
+   by themselves???
  */
 
         const struct iphdr *iph = (const struct iphdr *)skb->data;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index aea5a199c37a..b072386cee21 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -630,6 +630,7 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         pr_debug("ping_recvmsg(sk=%p,sk->num=%u)\n", isk, isk->inet_num);
 
+        err = -EOPNOTSUPP;
         if (flags & MSG_OOB)
                 goto out;
 
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 63418185f524..e3db3f915114 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, sizeof(*iph));
         skb_reset_network_header(skb);
-
-        memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-                skb->mac_len);
-        skb_set_mac_header(skb, -skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm4_beet_make_header(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e114ac..ed4bf11ef9f4 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        const unsigned char *old_mac;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c7e95c8c579f..5aa3981a3922 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1926,8 +1926,10 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
         };
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst)
+        if (dst->error) {
+                dst_release(dst);
                 goto out_free;
+        }
 
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8f02ef88e59..c964958ac470 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1545,9 +1545,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return;
-
+        }
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst))
                 return;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index a81ce9450750..9949a356d62c 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 261e6e6f487e..9f2095b19ad0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
-        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 2406b3e7393f..d86217d56bd7 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,14 +63,14 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
                             TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                            TEST(TDLS_PEER_AUTH));
+                            TEST(TDLS_PEER_AUTH), TEST(RATE_CONTROL));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5a5a7767d541..ad64f4d5271a 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -336,7 +336,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         int i;
         u32 mask;
 
-        if (sta) {
+        if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 168427b0ffdc..80cfc006dd74 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -41,7 +41,7 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
 
-        if (!ref)
+        if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
                 return;
 
         ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
@@ -62,6 +62,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
+        set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6f77f12dc3fc..bfed851d0d36 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -52,6 +52,7 @@
  * @WLAN_STA_SP: Station is in a service period, so don't try to
  *      reply to other uAPSD trigger frames or PS-Poll.
  * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
+ * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -71,6 +72,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_UAPSD,
         WLAN_STA_SP,
         WLAN_STA_4ADDR_EVENT,
+        WLAN_STA_RATE_CONTROL,
 };
 
 enum ieee80211_sta_state {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 611c3359b94d..2555816e7788 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         __be16 dport = 0;               /* destination port to forward */
         unsigned int flags;
         struct ip_vs_conn_param param;
+        const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
         union nf_inet_addr snet;        /* source network of the client,
                                            after masking */
 
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         {
                 int protocol = iph.protocol;
                 const union nf_inet_addr *vaddr = &iph.daddr;
-                const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
                 __be16 vport = 0;
 
                 if (dst_port == svc->port) {
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 76613f5a55c0..ed86a3be678e 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -404,19 +404,49 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                            &net->ct.hash[repl_hash]);
 }
 
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+int
+nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
         unsigned int hash, repl_hash;
+        struct nf_conntrack_tuple_hash *h;
+        struct hlist_nulls_node *n;
         u16 zone;
 
         zone = nf_ct_zone(ct);
-        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        hash = hash_conntrack(net, zone,
+                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone,
+                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+
+        spin_lock_bh(&nf_conntrack_lock);
 
+        /* See if there's one in the list already, including reverse */
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+
+        add_timer(&ct->timeout);
+        nf_conntrack_get(&ct->ct_general);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        NF_CT_STAT_INC(net, insert);
+        spin_unlock_bh(&nf_conntrack_lock);
+
+        return 0;
+
+out:
+        NF_CT_STAT_INC(net, insert_failed);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return -EEXIST;
 }
-EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
 /* Confirm a connection given skb; places it in hash table */
 int
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9307b033c0c9..30c9d4ca0218 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1367,15 +1367,12 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
                         rcu_read_unlock();
-                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
-                                spin_lock_bh(&nf_conntrack_lock);
                                 err = -EOPNOTSUPP;
                                 goto err1;
                         }
 
-                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname,
                                                             nf_ct_l3num(ct),
@@ -1468,8 +1465,10 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
         if (tstamp)
                 tstamp->start = ktime_to_ns(ktime_get_real());
 
-        add_timer(&ct->timeout);
-        nf_conntrack_hash_insert(ct);
+        err = nf_conntrack_hash_check_insert(ct);
+        if (err < 0)
+                goto err2;
+
         rcu_read_unlock();
 
         return ct;
@@ -1490,6 +1489,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct nf_conntrack_tuple otuple, rtuple;
         struct nf_conntrack_tuple_hash *h = NULL;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+        struct nf_conn *ct;
         u_int8_t u3 = nfmsg->nfgen_family;
         u16 zone;
         int err;
@@ -1510,27 +1510,22 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         return err;
         }
 
-        spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(net, zone, &otuple);
+                h = nf_conntrack_find_get(net, zone, &otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(net, zone, &rtuple);
+                h = nf_conntrack_find_get(net, zone, &rtuple);
 
         if (h == NULL) {
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
-                        struct nf_conn *ct;
                         enum ip_conntrack_events events;
 
                         ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
-                        if (IS_ERR(ct)) {
-                                err = PTR_ERR(ct);
-                                goto out_unlock;
-                        }
+                        if (IS_ERR(ct))
+                                return PTR_ERR(ct);
+
                         err = 0;
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
                                 events = IPCT_RELATED;
                         else
@@ -1545,23 +1540,19 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
                         nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
+                }
 
                 return err;
         }
         /* implicit 'else' */
 
-        /* We manipulate the conntrack inside the global conntrack table lock,
-         * so there's no need to increase the refcount */
         err = -EEXIST;
+        ct = nf_ct_tuplehash_to_ctrack(h);
         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
-                struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
-
+                spin_lock_bh(&nf_conntrack_lock);
                 err = ctnetlink_change_conntrack(ct, cda);
+                spin_unlock_bh(&nf_conntrack_lock);
                 if (err == 0) {
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                       (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
@@ -1570,15 +1561,10 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       (1 << IPCT_MARK),
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
-                        nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
-
-                return err;
+                }
         }
 
-out_unlock:
-        spin_unlock_bh(&nf_conntrack_lock);
+        nf_ct_put(ct);
         return err;
 }
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index b3a7db678b8d..ce60cf0f6c11 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -203,6 +203,27 @@ err:
         return status;
 }
 
+#ifdef CONFIG_BRIDGE_NETFILTER
+/* When called from bridge netfilter, skb->data must point to MAC header
+ * before calling skb_gso_segment(). Else, original MAC header is lost
+ * and segmented skbs will be sent to wrong destination.
+ */
+static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_push(skb, skb->network_header - skb->mac_header);
+}
+
+static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_pull(skb, skb->network_header - skb->mac_header);
+}
+#else
+#define nf_bridge_adjust_skb_data(s) do {} while (0)
+#define nf_bridge_adjust_segmented_data(s) do {} while (0)
+#endif
+
 int nf_queue(struct sk_buff *skb,
              struct list_head *elem,
              u_int8_t pf, unsigned int hook,
@@ -212,7 +233,7 @@ int nf_queue(struct sk_buff *skb,
              unsigned int queuenum)
 {
         struct sk_buff *segs;
-        int err;
+        int err = -EINVAL;
         unsigned int queued;
 
         if (!skb_is_gso(skb))
@@ -228,23 +249,25 @@ int nf_queue(struct sk_buff *skb,
                 break;
         }
 
+        nf_bridge_adjust_skb_data(skb);
         segs = skb_gso_segment(skb, 0);
         /* Does not use PTR_ERR to limit the number of error codes that can be
          * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean
          * 'ignore this hook'.
          */
         if (IS_ERR(segs))
-                return -EINVAL;
-
+                goto out_err;
         queued = 0;
         err = 0;
         do {
                 struct sk_buff *nskb = segs->next;
 
                 segs->next = NULL;
-                if (err == 0)
+                if (err == 0) {
+                        nf_bridge_adjust_segmented_data(segs);
                         err = __nf_queue(segs, elem, pf, hook, indev,
                                            outdev, okfn, queuenum);
+                }
                 if (err == 0)
                         queued++;
                 else
@@ -252,11 +275,12 @@ int nf_queue(struct sk_buff *skb,
                 segs = nskb;
         } while (segs);
 
-        /* also free orig skb if only some segments were queued */
-        if (unlikely(err && queued))
-                err = 0;
-        if (err == 0)
+        if (queued) {
                 kfree_skb(skb);
+                return 0;
+        }
+  out_err:
+        nf_bridge_adjust_segmented_data(skb);
         return err;
 }
 
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 3aae66facf9f..4d5057902839 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -152,9 +152,10 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
         fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
                            (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return false;
-
+        }
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
         skb->dev      = dst->dev;
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e83d61ca78ca..5da548fa7ae9 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -501,9 +501,8 @@ tfifo_dequeue:
 
                 /* if more time remaining? */
                 if (cb->time_to_send <= psched_get_time()) {
-                        skb = qdisc_dequeue_tail(sch);
-                        if (unlikely(!skb))
-                                goto qdisc_dequeue;
+                        __skb_unlink(skb, &sch->q);
+                        sch->qstats.backlog -= qdisc_pkt_len(skb);
 
 #ifdef CONFIG_NET_CLS_ACT
                         /*
@@ -539,7 +538,6 @@ deliver:
                 qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
         }
 
-qdisc_dequeue:
         if (q->qdisc) {
                 skb = q->qdisc->ops->dequeue(q->qdisc);
                 if (skb)
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index d0de2a2c3a2d..b89efe6e4c85 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -46,11 +46,37 @@ struct devtable {
         void *function;
 };
 
+#define ___cat(a,b) a ## b
+#define __cat(a,b) ___cat(a,b)
+
+/* we need some special handling for this host tool running eventually on
+ * Darwin. The Mach-O section handling is a bit different than ELF section
+ * handling. The differnces in detail are:
+ *  a) we have segments which have sections
+ *  b) we need a API call to get the respective section symbols */
+#if defined(__MACH__)
+#include <mach-o/getsect.h>
+
+#define INIT_SECTION(name)  do {                                        \
+                unsigned long name ## _len;                             \
+                char *__cat(pstart_,name) = getsectdata("__TEXT",       \
+                        #name, &__cat(name,_len));                      \
+                char *__cat(pstop_,name) = __cat(pstart_,name) +        \
+                        __cat(name, _len);                              \
+                __cat(__start_,name) = (void *)__cat(pstart_,name);     \
+                __cat(__stop_,name) = (void *)__cat(pstop_,name);       \
+        } while (0)
+#define SECTION(name)   __attribute__((section("__TEXT, " #name)))
+
+struct devtable **__start___devtable, **__stop___devtable;
+#else
+#define INIT_SECTION(name) /* no-op for ELF */
+#define SECTION(name)   __attribute__((section(#name)))
+
 /* We construct a table of pointers in an ELF section (pointers generally
  * go unpadded by gcc).  ld creates boundary syms for us. */
 extern struct devtable *__start___devtable[], *__stop___devtable[];
-#define ___cat(a,b) a ## b
-#define __cat(a,b) ___cat(a,b)
+#endif /* __MACH__ */
 
 #if __GNUC__ == 3 && __GNUC_MINOR__ < 3
 # define __used                 __attribute__((__unused__))
@@ -65,8 +91,8 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
                                                 (type *)NULL,           \
                                                 (char *)NULL)),         \
                 sizeof(type), (function) };                             \
-        static struct devtable *__attribute__((section("__devtable"))) \
-                __used __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
+        static struct devtable *SECTION(__devtable) __used \
+                __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
 
 #define ADD(str, sep, cond, field)                              \
 do {                                                            \
@@ -1080,6 +1106,7 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
                 do_pnp_card_entries(symval, sym->st_size, mod);
         else {
                 struct devtable **p;
+                INIT_SECTION(__devtable);
 
                 for (p = __start___devtable; p < __stop___devtable; p++) {
                         if (sym_is(name, namelen, (*p)->device_id)) {
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 95ffa6a9db6e..496f14c1a731 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2684,10 +2684,9 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
                 err = snd_opl3_hwdep_new(opl3, 0, 1, NULL);
                 if (err < 0)
                         goto out_err;
+                opl3->private_data = chip;
         }
 
-        opl3->private_data = chip;
-
         sprintf(card->longname, "%s at 0x%lx, irq %i",
                 card->shortname, chip->ctrl_io, chip->irq);
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index c2c65f63bf06..684307372d73 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1759,7 +1759,11 @@ static void put_vol_mute(struct hda_codec *codec, struct hda_amp_info *info,
         parm = ch ? AC_AMP_SET_RIGHT : AC_AMP_SET_LEFT;
         parm |= direction == HDA_OUTPUT ? AC_AMP_SET_OUTPUT : AC_AMP_SET_INPUT;
         parm |= index << AC_AMP_SET_INDEX_SHIFT;
-        parm |= val;
+        if ((val & HDA_AMP_MUTE) && !(info->amp_caps & AC_AMPCAP_MUTE) &&
+            (info->amp_caps & AC_AMPCAP_MIN_MUTE))
+                ; /* set the zero value as a fake mute */
+        else
+                parm |= val;
         snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm);
         info->vol[ch] = val;
 }
@@ -2026,7 +2030,7 @@ int snd_hda_mixer_amp_tlv(struct snd_kcontrol *kcontrol, int op_flag,
         val1 = -((caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT);
         val1 += ofs;
         val1 = ((int)val1) * ((int)val2);
-        if (min_mute)
+        if (min_mute || (caps & AC_AMPCAP_MIN_MUTE))
                 val2 |= TLV_DB_SCALE_MUTE;
         if (put_user(SNDRV_CTL_TLVT_DB_SCALE, _tlv))
                 return -EFAULT;
@@ -5114,7 +5118,7 @@ static int fill_audio_out_name(struct hda_codec *codec, hda_nid_t nid,
         const char *pfx = "", *sfx = "";
 
         /* handle as a speaker if it's a fixed line-out */
-        if (!strcmp(name, "Line-Out") && attr == INPUT_PIN_ATTR_INT)
+        if (!strcmp(name, "Line Out") && attr == INPUT_PIN_ATTR_INT)
                 name = "Speaker";
         /* check the location */
         switch (attr) {
@@ -5173,7 +5177,7 @@ int snd_hda_get_pin_label(struct hda_codec *codec, hda_nid_t nid,
 
         switch (get_defcfg_device(def_conf)) {
         case AC_JACK_LINE_OUT:
-                return fill_audio_out_name(codec, nid, cfg, "Line-Out",
+                return fill_audio_out_name(codec, nid, cfg, "Line Out",
                                            label, maxlen, indexp);
         case AC_JACK_SPEAKER:
                 return fill_audio_out_name(codec, nid, cfg, "Speaker",
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index e9f71dc0d464..f0f1943a4b2c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -298,6 +298,9 @@ enum {
 #define AC_AMPCAP_MUTE                  (1<<31)    /* mute capable */
 #define AC_AMPCAP_MUTE_SHIFT            31
 
+/* driver-specific amp-caps: using bits 24-30 */
+#define AC_AMPCAP_MIN_MUTE              (1 << 30) /* min-volume = mute */
+
 /* Connection list */
 #define AC_CLIST_LENGTH                 (0x7f<<0)
 #define AC_CLIST_LONG                   (1<<7)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bc5a993d1146..c83ccdba1e5a 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -609,7 +609,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 "Front Speaker", "Surround Speaker", "Bass Speaker"
         };
         static const char * const line_outs[] = {
-                "Front Line-Out", "Surround Line-Out", "Bass Line-Out"
+                "Front Line Out", "Surround Line Out", "Bass Line Out"
         };
 
         fix_volume_caps(codec, dac);
@@ -635,7 +635,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 if (num_ctls > 1)
                         name = line_outs[idx];
                 else
-                        name = "Line-Out";
+                        name = "Line Out";
                 break;
         }
 
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a7a5733aa4d2..d29d6d377904 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3482,7 +3482,7 @@ static int cx_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -4079,7 +4079,8 @@ static int cx_auto_add_volume_idx(struct hda_codec *codec, const char *basename,
                 err = snd_hda_ctl_add(codec, nid, kctl);
                 if (err < 0)
                         return err;
-                if (!(query_amp_caps(codec, nid, hda_dir) & AC_AMPCAP_MUTE))
+                if (!(query_amp_caps(codec, nid, hda_dir) &
+                      (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)))
                         break;
         }
         return 0;
@@ -4379,6 +4380,22 @@ static const struct snd_pci_quirk cxt_fixups[] = {
         {}
 };
 
+/* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+ * can be created (bko#42825)
+ */
+static void add_cx5051_fake_mutes(struct hda_codec *codec)
+{
+        static hda_nid_t out_nids[] = {
+                0x10, 0x11, 0
+        };
+        hda_nid_t *p;
+
+        for (p = out_nids; *p; p++)
+                snd_hda_override_amp_caps(codec, *p, HDA_OUTPUT,
+                                          AC_AMPCAP_MIN_MUTE |
+                                          query_amp_caps(codec, *p, HDA_OUTPUT));
+}
+
 static int patch_conexant_auto(struct hda_codec *codec)
 {
         struct conexant_spec *spec;
@@ -4397,6 +4414,9 @@ static int patch_conexant_auto(struct hda_codec *codec)
         case 0x14f15045:
                 spec->single_adc_amp = 1;
                 break;
+        case 0x14f15051:
+                add_cx5051_fake_mutes(codec);
+                break;
         }
 
         apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3647baa9bfed..f286bb8fda13 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -802,7 +802,7 @@ static int alc_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -1856,7 +1856,7 @@ static const char * const alc_slave_vols[] = {
         "Headphone Playback Volume",
         "Speaker Playback Volume",
         "Mono Playback Volume",
-        "Line-Out Playback Volume",
+        "Line Out Playback Volume",
         "CLFE Playback Volume",
         "Bass Speaker Playback Volume",
         "PCM Playback Volume",
@@ -1873,7 +1873,7 @@ static const char * const alc_slave_sws[] = {
         "Speaker Playback Switch",
         "Mono Playback Switch",
         "IEC958 Playback Switch",
-        "Line-Out Playback Switch",
+        "Line Out Playback Switch",
         "CLFE Playback Switch",
         "Bass Speaker Playback Switch",
         "PCM Playback Switch",
@@ -3797,7 +3797,7 @@ static void alc_auto_init_input_src(struct hda_codec *codec)
         else
                 nums = spec->num_adc_nids;
         for (c = 0; c < nums; c++)
-                alc_mux_select(codec, 0, spec->cur_mux[c], true);
+                alc_mux_select(codec, c, spec->cur_mux[c], true);
 }
 
 /* add mic boosts if needed */
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6345df131a00..9dbb5735d778 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4629,7 +4629,7 @@ static void stac92xx_hp_detect(struct hda_codec *codec)
                 unsigned int val = AC_PINCTL_OUT_EN | AC_PINCTL_HP_EN;
                 if (no_hp_sensing(spec, i))
                         continue;
-                if (presence)
+                if (1 /*presence*/)
                         stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
 #if 0 /* FIXME */
 /* Resetting the pinctl like below may lead to (a sort of) regressions
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 01d1f749cf02..b6adbed6e506 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -112,7 +112,7 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
                 break;
         case SND_SOC_DAIFMT_DSP_A:
                 /* data on rising edge of bclk, frame high 1clk before data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TEFS;
+                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0 | SSI_STCR_TEFS;
                 break;
         }
 
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1f55ded4047f..1315663c1c09 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3068,9 +3068,13 @@ static void soc_dapm_shutdown_codec(struct snd_soc_dapm_context *dapm)
          * standby.
          */
         if (powerdown) {
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_PREPARE);
+                if (dapm->bias_level == SND_SOC_BIAS_ON)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_PREPARE);
                 dapm_seq_run(dapm, &down_list, 0, false);
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_STANDBY);
+                if (dapm->bias_level == SND_SOC_BIAS_PREPARE)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_STANDBY);
         }
 }
 
@@ -3083,7 +3087,9 @@ void snd_soc_dapm_shutdown(struct snd_soc_card *card)
 
         list_for_each_entry(codec, &card->codec_dev_list, list) {
                 soc_dapm_shutdown_codec(&codec->dapm);
-                snd_soc_dapm_set_bias_level(&codec->dapm, SND_SOC_BIAS_OFF);
+                if (codec->dapm.bias_level == SND_SOC_BIAS_STANDBY)
+                        snd_soc_dapm_set_bias_level(&codec->dapm,
+                                                    SND_SOC_BIAS_OFF);
         }
 }
 
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 2044324b755a..2a6f33cd888c 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -74,6 +74,7 @@ static pid_t perf_event__get_comm_tgid(pid_t pid, char *comm, size_t len)
                         if (size >= len)
                                 size = len - 1;
                         memcpy(comm, name, size);
+                        comm[size] = '\0';
 
                 } else if (memcmp(bf, "Tgid:", 5) == 0) {
                         char *tgids = bf + 5;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 3f16e08a5c8d..ea32a061f1c8 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -349,6 +349,10 @@ struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
         hlist_for_each_entry(sid, pos, head, node)
                 if (sid->id == id)
                         return sid->evsel;
+
+        if (!perf_evlist__sample_id_all(evlist))
+                return list_entry(evlist->entries.next, struct perf_evsel, node);
+
         return NULL;
 }
 
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 29cb65459811..e33554a562b3 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -1867,6 +1867,12 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                            tev->point.symbol);
                 ret = -ENOENT;
                 goto error;
+        } else if (tev->point.offset > sym->end - sym->start) {
+                pr_warning("Offset specified is greater than size of %s\n",
+                           tev->point.symbol);
+                ret = -ENOENT;
+                goto error;
+
         }
 
         return 1;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 5d732621a462..74bd2e63c4b4 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -672,7 +672,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                   bool retprobe, struct probe_trace_point *tp)
 {
-        Dwarf_Addr eaddr;
+        Dwarf_Addr eaddr, highaddr;
         const char *name;
 
         /* Copy the name of probe point */
@@ -683,6 +683,16 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                    dwarf_diename(sp_die));
                         return -ENOENT;
                 }
+                if (dwarf_highpc(sp_die, &highaddr) != 0) {
+                        pr_warning("Failed to get end address of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -ENOENT;
+                }
+                if (paddr > highaddr) {
+                        pr_warning("Offset specified is greater than size of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -EINVAL;
+                }
                 tp->symbol = strdup(name);
                 if (tp->symbol == NULL)
                         return -ENOMEM;
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 62a134dc421a..9507c4b251a8 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -3244,9 +3244,11 @@ sub make_min_config {
         $in_bisect = 1;
 
         my $failed = 0;
-        build "oldconfig";
-        start_monitor_and_boot or $failed = 1;
-        end_monitor;
+        build "oldconfig" or $failed = 1;
+        if (!$failed) {
+                start_monitor_and_boot or $failed = 1;
+                end_monitor;
+        }
 
         $in_bisect = 0;