117 files changed, 862 insertions, 713 deletions
diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index a4f30faa4f1f..1e359b62c40a 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -316,7 +316,7 @@ address           perms offset  dev   inode      pathname
 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test
 0804a000-0806b000 rw-p 00000000 00:00 0          [heap]
 a7cb1000-a7cb2000 ---p 00000000 00:00 0
-a7cb2000-a7eb2000 rw-p 00000000 00:00 0          [threadstack:001ff4b4]
+a7cb2000-a7eb2000 rw-p 00000000 00:00 0
 a7eb2000-a7eb3000 ---p 00000000 00:00 0
 a7eb3000-a7ed5000 rw-p 00000000 00:00 0
 a7ed5000-a8008000 r-xp 00000000 03:00 4222       /lib/libc.so.6
@@ -352,7 +352,6 @@ is not associated with a file:
 [stack]                  = the stack of the main process
 [vdso]                   = the "virtual dynamic shared object",
                            the kernel system call handler
- [threadstack:xxxxxxxx]   = the stack of the thread, xxxxxxxx is the stack size
 or if empty, the mapping is anonymous.
diff --git a/arch/microblaze/include/asm/uaccess.h b/arch/microblaze/include/asm/uaccess.h
index 446bec29b142..26460d15b338 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -182,6 +182,39 @@ extern long __user_bad(void);
 * Returns zero on success, or -EFAULT on error.
 * On error, the variable @x is set to zero.
 */
+#define get_user(x, ptr)                                                \
+        __get_user_check((x), (ptr), sizeof(*(ptr)))
+#define __get_user_check(x, ptr, size)                                  \
+({                                                                      \
+        unsigned long __gu_val = 0;                                     \
+        const typeof(*(ptr)) __user *__gu_addr = (ptr);                 \
+        int __gu_err = 0;                                               \
+                                                                        \
+        if (access_ok(VERIFY_READ, __gu_addr, size)) {                  \
+                switch (size) {                                         \
+                case 1:                                                 \
+                        __get_user_asm("lbu", __gu_addr, __gu_val,      \
+                                       __gu_err);                       \
+                        break;                                          \
+                case 2:                                                 \
+                        __get_user_asm("lhu", __gu_addr, __gu_val,      \
+                                       __gu_err);                       \
+                        break;                                          \
+                case 4:                                                 \
+                        __get_user_asm("lw", __gu_addr, __gu_val,       \
+                                       __gu_err);                       \
+                        break;                                          \
+                default:                                                \
+                        __gu_err = __user_bad();                        \
+                        break;                                          \
+                }                                                       \
+        } else {                                                        \
+                __gu_err = -EFAULT;                                     \
+        }                                                               \
+        x = (typeof(*(ptr)))__gu_val;                                   \
+        __gu_err;                                                       \
+})
 #define __get_user(x, ptr)                                              \
 ({                                                                      \
@@ -206,12 +239,6 @@ extern long __user_bad(void);
 })
-#define get_user(x, ptr)                                                \
-({                                                                      \
-        access_ok(VERIFY_READ, (ptr), sizeof(*(ptr)))                   \
-                ? __get_user((x), (ptr)) : -EFAULT;                     \
-})
 #define __put_user_asm(insn, __gu_ptr, __gu_val, __gu_err)      \
 ({                                                              \
        __asm__ __volatile__ (                                  \
@@ -266,6 +293,42 @@ extern long __user_bad(void);
 *
 * Returns zero on success, or -EFAULT on error.
 */
+#define put_user(x, ptr)                                                \
+        __put_user_check((x), (ptr), sizeof(*(ptr)))
+#define __put_user_check(x, ptr, size)                                  \
+({                                                                      \
+        typeof(*(ptr)) __pu_val;                                        \
+        typeof(*(ptr)) __user *__pu_addr = (ptr);                       \
+        int __pu_err = 0;                                               \
+                                                                        \
+        __pu_val = (x);                                                 \
+        if (access_ok(VERIFY_WRITE, __pu_addr, size)) {                 \
+                switch (size) {                                         \
+                case 1:                                                 \
+                        __put_user_asm("sb", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 2:                                                 \
+                        __put_user_asm("sh", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 4:                                                 \
+                        __put_user_asm("sw", __pu_addr, __pu_val,       \
+                                       __pu_err);                       \
+                        break;                                          \
+                case 8:                                                 \
+                        __put_user_asm_8(__pu_addr, __pu_val, __pu_err);\
+                        break;                                          \
+                default:                                                \
+                        __pu_err = __user_bad();                        \
+                        break;                                          \
+                }                                                       \
+        } else {                                                        \
+                __pu_err = -EFAULT;                                     \
+        }                                                               \
+        __pu_err;                                                       \
+})
 #define __put_user(x, ptr)                                              \
 ({                                                                      \
@@ -290,18 +353,6 @@ extern long __user_bad(void);
        __gu_err;                                                       \
 })
-#ifndef CONFIG_MMU
-#define put_user(x, ptr)        __put_user((x), (ptr))
-#else /* CONFIG_MMU */
-#define put_user(x, ptr)                                                \
-({                                                                      \
-        access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr)))                  \
-                ? __put_user((x), (ptr)) : -EFAULT;                     \
-})
-#endif /* CONFIG_MMU */
 /* copy_to_from_user */
 #define __copy_from_user(to, from, n)   \
diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
index 21c3a92394de..109876e8d643 100644
--- a/arch/microblaze/kernel/cpu/cache.c
+++ b/arch/microblaze/kernel/cpu/cache.c
@@ -137,8 +137,9 @@ do {									\
 do {                                                                    \
        int step = -line_length;                                        \
        int align = ~(line_length - 1);                                 \
+        int count;                                                      \
        end = ((end & align) == end) ? end - line_length : end & align; \
-        int count = end - start;                                        \
+        count = end - start;                                            \
        WARN_ON(count < 0);                                             \
                                                                        \
        __asm__ __volatile__ (" 1:      " #op " %0, %1;                 \
diff --git a/arch/microblaze/kernel/entry-nommu.S b/arch/microblaze/kernel/entry-nommu.S
index 391d6197fc3b..8cc18cd2cce6 100644
--- a/arch/microblaze/kernel/entry-nommu.S
+++ b/arch/microblaze/kernel/entry-nommu.S
@@ -476,6 +476,8 @@ ENTRY(ret_from_fork)
        nop
 work_pending:
+        enable_irq
        andi    r11, r19, _TIF_NEED_RESCHED
        beqi    r11, 1f
        bralid  r15, schedule
diff --git a/arch/microblaze/kernel/microblaze_ksyms.c b/arch/microblaze/kernel/microblaze_ksyms.c
index bc4dcb7d3861..ff85f7718035 100644
--- a/arch/microblaze/kernel/microblaze_ksyms.c
+++ b/arch/microblaze/kernel/microblaze_ksyms.c
@@ -52,3 +52,14 @@ EXPORT_SYMBOL_GPL(_ebss);
 extern void _mcount(void);
 EXPORT_SYMBOL(_mcount);
 #endif
+/*
+ * Assembly functions that may be used (directly or indirectly) by modules
+ */
+EXPORT_SYMBOL(__copy_tofrom_user);
+EXPORT_SYMBOL(__strncpy_user);
+#ifdef CONFIG_OPT_LIB_ASM
+EXPORT_SYMBOL(memcpy);
+EXPORT_SYMBOL(memmove);
+#endif
diff --git a/arch/microblaze/kernel/module.c b/arch/microblaze/kernel/module.c
index cbecf110dc30..0e73f6606547 100644
--- a/arch/microblaze/kernel/module.c
+++ b/arch/microblaze/kernel/module.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <asm/pgtable.h>
+#include <asm/cacheflush.h>
 void *module_alloc(unsigned long size)
 {
@@ -151,6 +152,7 @@ int apply_relocate_add(Elf32_Shdr *sechdrs, const char *strtab,
 int module_finalize(const Elf32_Ehdr *hdr, const Elf_Shdr *sechdrs,
                struct module *module)
 {
+        flush_dcache();
        return 0;
 }
diff --git a/arch/microblaze/mm/init.c b/arch/microblaze/mm/init.c
index f42c2dde8b1c..cca3579d4268 100644
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -47,6 +47,7 @@ unsigned long memory_start;
 EXPORT_SYMBOL(memory_start);
 unsigned long memory_end; /* due to mm/nommu.c */
 unsigned long memory_size;
+EXPORT_SYMBOL(memory_size);
 /*
 * paging_init() sets up the page tables - in fact we've already done this.
diff --git a/arch/microblaze/mm/pgtable.c b/arch/microblaze/mm/pgtable.c
index 784557fb28cf..59bf2335a4ce 100644
--- a/arch/microblaze/mm/pgtable.c
+++ b/arch/microblaze/mm/pgtable.c
@@ -42,6 +42,7 @@
 unsigned long ioremap_base;
 unsigned long ioremap_bot;
+EXPORT_SYMBOL(ioremap_bot);
 /* The maximum lowmem defaults to 768Mb, but this can be configured to
 * another value.
diff --git a/arch/microblaze/pci/pci-common.c b/arch/microblaze/pci/pci-common.c
index 01c8c97c15b7..9cb782b8e036 100644
--- a/arch/microblaze/pci/pci-common.c
+++ b/arch/microblaze/pci/pci-common.c
@@ -1507,7 +1507,7 @@ void pcibios_finish_adding_to_bus(struct pci_bus *bus)
        pci_bus_add_devices(bus);
        /* Fixup EEH */
-        eeh_add_device_tree_late(bus);
+        /* eeh_add_device_tree_late(bus); */
 }
 EXPORT_SYMBOL_GPL(pcibios_finish_adding_to_bus);
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index 9f4c9d4f5803..bd100fcf40d0 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -130,43 +130,5 @@ static inline int irqs_disabled_flags(unsigned long flags)
 */
 struct irq_chip;
-#ifdef CONFIG_PERF_EVENTS
-#ifdef CONFIG_PPC64
-static inline unsigned long test_perf_event_pending(void)
-{
-        unsigned long x;
-        asm volatile("lbz %0,%1(13)"
-                : "=r" (x)
-                : "i" (offsetof(struct paca_struct, perf_event_pending)));
-        return x;
-}
-static inline void set_perf_event_pending(void)
-{
-        asm volatile("stb %0,%1(13)" : :
-                "r" (1),
-                "i" (offsetof(struct paca_struct, perf_event_pending)));
-}
-static inline void clear_perf_event_pending(void)
-{
-        asm volatile("stb %0,%1(13)" : :
-                "r" (0),
-                "i" (offsetof(struct paca_struct, perf_event_pending)));
-}
-#endif /* CONFIG_PPC64 */
-#else  /* CONFIG_PERF_EVENTS */
-static inline unsigned long test_perf_event_pending(void)
-{
-        return 0;
-}
-static inline void clear_perf_event_pending(void) {}
-#endif /* CONFIG_PERF_EVENTS */
 #endif  /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_HW_IRQ_H */
diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c
index 957ceb7059c5..c09138d150d4 100644
--- a/arch/powerpc/kernel/asm-offsets.c
+++ b/arch/powerpc/kernel/asm-offsets.c
@@ -133,7 +133,6 @@ int main(void)
        DEFINE(PACAKMSR, offsetof(struct paca_struct, kernel_msr));
        DEFINE(PACASOFTIRQEN, offsetof(struct paca_struct, soft_enabled));
        DEFINE(PACAHARDIRQEN, offsetof(struct paca_struct, hard_enabled));
-        DEFINE(PACAPERFPEND, offsetof(struct paca_struct, perf_event_pending));
        DEFINE(PACACONTEXTID, offsetof(struct paca_struct, context.id));
 #ifdef CONFIG_PPC_MM_SLICES
        DEFINE(PACALOWSLICESPSIZE, offsetof(struct paca_struct,
diff --git a/arch/powerpc/kernel/dma-swiotlb.c b/arch/powerpc/kernel/dma-swiotlb.c
index 59c928564a03..4ff4da2c238b 100644
--- a/arch/powerpc/kernel/dma-swiotlb.c
+++ b/arch/powerpc/kernel/dma-swiotlb.c
@@ -1,7 +1,8 @@
 /*
 * Contains routines needed to support swiotlb for ppc.
 *
- * Copyright (C) 2009 Becky Bruce, Freescale Semiconductor
+ * Copyright (C) 2009-2010 Freescale Semiconductor, Inc.
+ * Author: Becky Bruce
 *
 * This program is free software; you can redistribute  it and/or modify it
 * under  the terms of  the GNU General  Public License as published by the
@@ -70,7 +71,7 @@ static int ppc_swiotlb_bus_notify(struct notifier_block *nb,
        sd->max_direct_dma_addr = 0;
        /* May need to bounce if the device can't address all of DRAM */
-        if (dma_get_mask(dev) < lmb_end_of_DRAM())
+        if ((dma_get_mask(dev) + 1) < lmb_end_of_DRAM())
                set_dma_ops(dev, &swiotlb_dma_ops);
        return NOTIFY_DONE;
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 07109d843787..42e9d908914a 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -556,15 +556,6 @@ ALT_FW_FTR_SECTION_END_IFCLR(FW_FEATURE_ISERIES)
 2:
        TRACE_AND_RESTORE_IRQ(r5);
-#ifdef CONFIG_PERF_EVENTS
-        /* check paca->perf_event_pending if we're enabling ints */
-        lbz     r3,PACAPERFPEND(r13)
-        and.    r3,r3,r5
-        beq     27f
-        bl      .perf_event_do_pending
-27:
-#endif /* CONFIG_PERF_EVENTS */
        /* extract EE bit and use it to restore paca->hard_enabled */
        ld      r3,_MSR(r1)
        rldicl  r4,r3,49,63             /* r0 = (r3 >> 15) & 1 */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 64f6f2031c22..066bd31551d5 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -53,7 +53,6 @@
 #include <linux/bootmem.h>
 #include <linux/pci.h>
 #include <linux/debugfs.h>
-#include <linux/perf_event.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -145,11 +144,6 @@ notrace void raw_local_irq_restore(unsigned long en)
        }
 #endif /* CONFIG_PPC_STD_MMU_64 */
-        if (test_perf_event_pending()) {
-                clear_perf_event_pending();
-                perf_event_do_pending();
-        }
        /*
         * if (get_paca()->hard_enabled) return;
         * But again we need to take care that gcc gets hard_enabled directly
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 1b16b9a3e49a..0441bbdadbd1 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -532,25 +532,60 @@ void __init iSeries_time_init_early(void)
 }
 #endif /* CONFIG_PPC_ISERIES */
-#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_PPC32)
+#ifdef CONFIG_PERF_EVENTS
-DEFINE_PER_CPU(u8, perf_event_pending);
-void set_perf_event_pending(void)
+/*
+ * 64-bit uses a byte in the PACA, 32-bit uses a per-cpu variable...
+ */
+#ifdef CONFIG_PPC64
+static inline unsigned long test_perf_event_pending(void)
 {
-        get_cpu_var(perf_event_pending) = 1;
+        unsigned long x;
-        set_dec(1);
-        put_cpu_var(perf_event_pending);
+        asm volatile("lbz %0,%1(13)"
+                : "=r" (x)
+                : "i" (offsetof(struct paca_struct, perf_event_pending)));
+        return x;
 }
+static inline void set_perf_event_pending_flag(void)
+{
+        asm volatile("stb %0,%1(13)" : :
+                "r" (1),
+                "i" (offsetof(struct paca_struct, perf_event_pending)));
+}
+static inline void clear_perf_event_pending(void)
+{
+        asm volatile("stb %0,%1(13)" : :
+                "r" (0),
+                "i" (offsetof(struct paca_struct, perf_event_pending)));
+}
+#else /* 32-bit */
+DEFINE_PER_CPU(u8, perf_event_pending);
+#define set_perf_event_pending_flag()   __get_cpu_var(perf_event_pending) = 1
 #define test_perf_event_pending()       __get_cpu_var(perf_event_pending)
 #define clear_perf_event_pending()      __get_cpu_var(perf_event_pending) = 0
-#else  /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
+#endif /* 32 vs 64 bit */
+void set_perf_event_pending(void)
+{
+        preempt_disable();
+        set_perf_event_pending_flag();
+        set_dec(1);
+        preempt_enable();
+}
+#else  /* CONFIG_PERF_EVENTS */
 #define test_perf_event_pending()       0
 #define clear_perf_event_pending()
-#endif /* CONFIG_PERF_EVENTS && CONFIG_PPC32 */
+#endif /* CONFIG_PERF_EVENTS */
 /*
 * For iSeries shared processors, we have to let the hypervisor
@@ -582,10 +617,6 @@ void timer_interrupt(struct pt_regs * regs)
        set_dec(DECREMENTER_MAX);
 #ifdef CONFIG_PPC32
-        if (test_perf_event_pending()) {
-                clear_perf_event_pending();
-                perf_event_do_pending();
-        }
        if (atomic_read(&ppc_n_lost_interrupts) != 0)
                do_IRQ(regs);
 #endif
@@ -604,6 +635,11 @@ void timer_interrupt(struct pt_regs * regs)
        calculate_steal_time();
+        if (test_perf_event_pending()) {
+                clear_perf_event_pending();
+                perf_event_do_pending();
+        }
 #ifdef CONFIG_PPC_ISERIES
        if (firmware_has_feature(FW_FEATURE_ISERIES))
                get_lppaca()->int_dword.fields.decr_int = 0;
diff --git a/arch/powerpc/kvm/44x_tlb.c b/arch/powerpc/kvm/44x_tlb.c
index 2570fcc7665d..812312542e50 100644
--- a/arch/powerpc/kvm/44x_tlb.c
+++ b/arch/powerpc/kvm/44x_tlb.c
@@ -440,7 +440,7 @@ int kvmppc_44x_emul_tlbwe(struct kvm_vcpu *vcpu, u8 ra, u8 rs, u8 ws)
        unsigned int gtlb_index;
        gtlb_index = kvmppc_get_gpr(vcpu, ra);
-        if (gtlb_index > KVM44x_GUEST_TLB_SIZE) {
+        if (gtlb_index >= KVM44x_GUEST_TLB_SIZE) {
                printk("%s: index %d\n", __func__, gtlb_index);
                kvmppc_dump_vcpu(vcpu);
                return EMULATE_FAIL;
diff --git a/arch/s390/kernel/head31.S b/arch/s390/kernel/head31.S
index 1bbcc499d455..b8f8dc126102 100644
--- a/arch/s390/kernel/head31.S
+++ b/arch/s390/kernel/head31.S
@@ -82,7 +82,7 @@ startup_continue:
 _ehead:
 #ifdef CONFIG_SHARED_KERNEL
-        .org    0x100000
+        .org    0x100000 - 0x11000      # head.o ends at 0x11000
 #endif
 #
diff --git a/arch/s390/kernel/head64.S b/arch/s390/kernel/head64.S
index 1f70970de0aa..cdef68717416 100644
--- a/arch/s390/kernel/head64.S
+++ b/arch/s390/kernel/head64.S
@@ -80,7 +80,7 @@ startup_continue:
 _ehead:
 #ifdef CONFIG_SHARED_KERNEL
-        .org    0x100000
+        .org    0x100000 - 0x11000      # head.o ends at 0x11000
 #endif
 #
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 33fdc5a79764..9f654da4cecc 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -640,7 +640,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
 asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
 {
-        long ret;
+        long ret = 0;
        /* Do the secure computing check first. */
        secure_computing(regs->gprs[2]);
@@ -649,7 +649,6 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
         * The sysc_tracesys code in entry.S stored the system
         * call number to gprs[2].
         */
-        ret = regs->gprs[2];
        if (test_thread_flag(TIF_SYSCALL_TRACE) &&
            (tracehook_report_syscall_entry(regs) ||
             regs->gprs[2] >= NR_syscalls)) {
@@ -671,7 +670,7 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                                    regs->gprs[2], regs->orig_gpr2,
                                    regs->gprs[3], regs->gprs[4],
                                    regs->gprs[5]);
-        return ret;
+        return ret ?: regs->gprs[2];
 }
 asmlinkage void do_syscall_trace_exit(struct pt_regs *regs)
diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
index b43bbaebe2c0..1658efdfb4e5 100644
--- a/arch/x86/kernel/kprobes.c
+++ b/arch/x86/kernel/kprobes.c
@@ -534,20 +534,6 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
        struct kprobe_ctlblk *kcb;
        addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-        if (*addr != BREAKPOINT_INSTRUCTION) {
-                /*
-                 * The breakpoint instruction was removed right
-                 * after we hit it.  Another cpu has removed
-                 * either a probepoint or a debugger breakpoint
-                 * at this address.  In either case, no further
-                 * handling of this interrupt is appropriate.
-                 * Back up over the (now missing) int3 and run
-                 * the original instruction.
-                 */
-                regs->ip = (unsigned long)addr;
-                return 1;
-        }
        /*
         * We don't want to be preempted for the entire
         * duration of kprobe processing. We conditionally
@@ -579,6 +565,19 @@ static int __kprobes kprobe_handler(struct pt_regs *regs)
                                setup_singlestep(p, regs, kcb, 0);
                        return 1;
                }
+        } else if (*addr != BREAKPOINT_INSTRUCTION) {
+                /*
+                 * The breakpoint instruction was removed right
+                 * after we hit it.  Another cpu has removed
+                 * either a probepoint or a debugger breakpoint
+                 * at this address.  In either case, no further
+                 * handling of this interrupt is appropriate.
+                 * Back up over the (now missing) int3 and run
+                 * the original instruction.
+                 */
+                regs->ip = (unsigned long)addr;
+                preempt_enable_no_resched();
+                return 1;
        } else if (kprobe_running()) {
                p = __get_cpu_var(current_kprobe);
                if (p->break_handler && p->break_handler(p, regs)) {
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 2ba58206812a..737361fcd503 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -2067,7 +2067,7 @@ static int cpuid_interception(struct vcpu_svm *svm)
 static int iret_interception(struct vcpu_svm *svm)
 {
        ++svm->vcpu.stat.nmi_window_exits;
-        svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
        svm->vcpu.arch.hflags |= HF_IRET_MASK;
        return 1;
 }
@@ -2479,7 +2479,7 @@ static void svm_inject_nmi(struct kvm_vcpu *vcpu)
        svm->vmcb->control.event_inj = SVM_EVTINJ_VALID | SVM_EVTINJ_TYPE_NMI;
        vcpu->arch.hflags |= HF_NMI_MASK;
-        svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+        svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
        ++vcpu->stat.nmi_injections;
 }
@@ -2539,10 +2539,10 @@ static void svm_set_nmi_mask(struct kvm_vcpu *vcpu, bool masked)
        if (masked) {
                svm->vcpu.arch.hflags |= HF_NMI_MASK;
-                svm->vmcb->control.intercept |= (1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept |= (1ULL << INTERCEPT_IRET);
        } else {
                svm->vcpu.arch.hflags &= ~HF_NMI_MASK;
-                svm->vmcb->control.intercept &= ~(1UL << INTERCEPT_IRET);
+                svm->vmcb->control.intercept &= ~(1ULL << INTERCEPT_IRET);
        }
 }
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index bc933cfb4e66..2f8db0ec8ae4 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2703,8 +2703,7 @@ static int vmx_nmi_allowed(struct kvm_vcpu *vcpu)
                return 0;
        return  !(vmcs_read32(GUEST_INTERRUPTIBILITY_INFO) &
-                        (GUEST_INTR_STATE_STI | GUEST_INTR_STATE_MOV_SS |
+                        (GUEST_INTR_STATE_MOV_SS | GUEST_INTR_STATE_NMI));
-                                GUEST_INTR_STATE_NMI));
 }
 static bool vmx_get_nmi_mask(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 3c4ca98ad27f..c4f35b545c1d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1712,6 +1712,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
        if (copy_from_user(cpuid_entries, entries,
                           cpuid->nent * sizeof(struct kvm_cpuid_entry)))
                goto out_free;
+        vcpu_load(vcpu);
        for (i = 0; i < cpuid->nent; i++) {
                vcpu->arch.cpuid_entries[i].function = cpuid_entries[i].function;
                vcpu->arch.cpuid_entries[i].eax = cpuid_entries[i].eax;
@@ -1729,6 +1730,7 @@ static int kvm_vcpu_ioctl_set_cpuid(struct kvm_vcpu *vcpu,
        r = 0;
        kvm_apic_set_version(vcpu);
        kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
 out_free:
        vfree(cpuid_entries);
@@ -1749,9 +1751,11 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
        if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
                           cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
                goto out;
+        vcpu_load(vcpu);
        vcpu->arch.cpuid_nent = cpuid->nent;
        kvm_apic_set_version(vcpu);
        kvm_x86_ops->cpuid_update(vcpu);
+        vcpu_put(vcpu);
        return 0;
 out:
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index e2e992599e68..baa76bbf244a 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -475,101 +475,13 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
        },
        {
        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
+        .ident = "Lenovo ThinkPad X201[s]",
        .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
                },
        },
        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T410",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad W510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T410",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T410"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad T510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad W510",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W510"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201"),
-                },
-        },
-        {
-        .callback = init_set_sci_en_on_resume,
-        .ident = "Lenovo ThinkPad X201",
-        .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-                DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X201s"),
-                },
-        },
-        {
        .callback = init_old_suspend_ordering,
        .ident = "Panasonic CF51-2L",
        .matches = {
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 6da962c9b21c..d71f0fc34b46 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1875,6 +1875,7 @@ got_driver:
                 */
                if (filp->f_op == &hung_up_tty_fops)
                        filp->f_op = &tty_fops;
+                unlock_kernel();
                goto retry_open;
        }
        unlock_kernel();
diff --git a/drivers/gpio/it8761e_gpio.c b/drivers/gpio/it8761e_gpio.c
index 753219cf993a..41a9388f2fde 100644
--- a/drivers/gpio/it8761e_gpio.c
+++ b/drivers/gpio/it8761e_gpio.c
@@ -80,8 +80,8 @@ static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
        u16 reg;
        u8 bit;
-        bit = gpio_num % 7;
+        bit = gpio_num % 8;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
        return !!(inb(reg) & (1 << bit));
 }
@@ -91,8 +91,8 @@ static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
        u8 curr_dirs;
        u8 io_reg, bit;
-        bit = gpio_num % 7;
+        bit = gpio_num % 8;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
        spin_lock(&sio_lock);
@@ -116,8 +116,8 @@ static void it8761e_gpio_set(struct gpio_chip *gc,
        u8 curr_vals, bit;
        u16 reg;
-        bit = gpio_num % 7;
+        bit = gpio_num % 8;
-        reg = (gpio_num >= 7) ? gpio_ba + 1 : gpio_ba;
+        reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
        spin_lock(&sio_lock);
@@ -135,8 +135,8 @@ static int it8761e_gpio_direction_out(struct gpio_chip *gc,
 {
        u8 curr_dirs, io_reg, bit;
-        bit = gpio_num % 7;
+        bit = gpio_num % 8;
-        io_reg = (gpio_num >= 7) ? GPIO2X_IO : GPIO1X_IO;
+        io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
        it8761e_gpio_set(gc, gpio_num, val);
@@ -200,7 +200,7 @@ static int __init it8761e_gpio_init(void)
                return -EBUSY;
        it8761e_gpio_chip.base = -1;
-        it8761e_gpio_chip.ngpio = 14;
+        it8761e_gpio_chip.ngpio = 16;
        err = gpiochip_add(&it8761e_gpio_chip);
        if (err < 0)
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2b8b969d0c15..df6a9cd82c4d 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -456,11 +456,15 @@ i915_error_object_create(struct drm_device *dev,
        for (page = 0; page < page_count; page++) {
                void *s, *d = kmalloc(PAGE_SIZE, GFP_ATOMIC);
+                unsigned long flags;
                if (d == NULL)
                        goto unwind;
-                s = kmap_atomic(src_priv->pages[page], KM_USER0);
+                local_irq_save(flags);
+                s = kmap_atomic(src_priv->pages[page], KM_IRQ0);
                memcpy(d, s, PAGE_SIZE);
-                kunmap_atomic(s, KM_USER0);
+                kunmap_atomic(s, KM_IRQ0);
+                local_irq_restore(flags);
                dst->pages[page] = d;
        }
        dst->page_count = page_count;
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 40ab6d9c3736..cc5316dcf580 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -424,7 +424,7 @@ static __inline__ int radeon_check_and_fixup_packet3(drm_radeon_private_t *
                if ((*cmd & RADEON_GMC_SRC_PITCH_OFFSET_CNTL) &&
                    (*cmd & RADEON_GMC_DST_PITCH_OFFSET_CNTL)) {
                        u32 *cmd3 = drm_buffer_pointer_to_dword(cmdbuf->buffer, 3);
-                        offset = *cmd << 10;
+                        offset = *cmd3 << 10;
                        if (radeon_check_and_fixup_offset
                            (dev_priv, file_priv, &offset)) {
                                DRM_ERROR("Invalid second packet offset\n");
@@ -2895,9 +2895,12 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                        return rv;
                rv = drm_buffer_copy_from_user(cmdbuf->buffer, buffer,
                                                cmdbuf->bufsz);
-                if (rv)
+                if (rv) {
+                        drm_buffer_free(cmdbuf->buffer);
                        return rv;
-        }
+                }
+        } else
+                goto done;
        orig_nbox = cmdbuf->nbox;
@@ -2905,8 +2908,7 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                int temp;
                temp = r300_do_cp_cmdbuf(dev, file_priv, cmdbuf);
-                if (cmdbuf->bufsz != 0)
+                drm_buffer_free(cmdbuf->buffer);
-                        drm_buffer_free(cmdbuf->buffer);
                return temp;
        }
@@ -3012,16 +3014,15 @@ static int radeon_cp_cmdbuf(struct drm_device *dev, void *data,
                }
        }
-        if (cmdbuf->bufsz != 0)
+        drm_buffer_free(cmdbuf->buffer);
-                drm_buffer_free(cmdbuf->buffer);
+      done:
        DRM_DEBUG("DONE\n");
        COMMIT_RING();
        return 0;
      err:
-        if (cmdbuf->bufsz != 0)
+        drm_buffer_free(cmdbuf->buffer);
-                drm_buffer_free(cmdbuf->buffer);
        return -EINVAL;
 }
diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
index 7e597d7f770f..24663a8717b1 100644
--- a/drivers/hid/hid-cherry.c
+++ b/drivers/hid/hid-cherry.c
@@ -59,6 +59,7 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 static const struct hid_device_id ch_devices[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, ch_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 2e2aa759d230..143e788b729b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1043,13 +1043,8 @@ void hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
        if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
                hid->hiddev_report_event(hid, report);
-        if (hid->claimed & HID_CLAIMED_HIDRAW) {
+        if (hid->claimed & HID_CLAIMED_HIDRAW)
-                /* numbered reports need to be passed with the report num */
+                hidraw_report_event(hid, data, size);
-                if (report_enum->numbered)
-                        hidraw_report_event(hid, data - 1, size + 1);
-                else
-                        hidraw_report_event(hid, data, size);
-        }
        for (a = 0; a < report->maxfield; a++)
                hid_input_field(hid, report->field[a], cdata, interrupt);
@@ -1296,6 +1291,7 @@ static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
        { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 797e06470356..09d27649a0f7 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -131,6 +131,7 @@
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
+#define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR     0x0027
 #define USB_VENDOR_ID_CHIC              0x05fe
 #define USB_DEVICE_ID_CHIC_GAMEPAD      0x0014
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index 9b24fc510712..4777bbfa1cc2 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -1,8 +1,8 @@
 /*
 *  HID driver for N-Trig touchscreens
 *
- *  Copyright (c) 2008 Rafi Rubin
+ *  Copyright (c) 2008-2010 Rafi Rubin
- *  Copyright (c) 2009 Stephane Chatty
+ *  Copyright (c) 2009-2010 Stephane Chatty
 *
 */
@@ -15,6 +15,8 @@
 #include <linux/device.h>
 #include <linux/hid.h>
+#include <linux/usb.h>
+#include "usbhid/usbhid.h"
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -22,17 +24,16 @@
 #define NTRIG_DUPLICATE_USAGES  0x001
-#define nt_map_key_clear(c)     hid_map_usage_clear(hi, usage, bit, max, \
-                                        EV_KEY, (c))
 struct ntrig_data {
        /* Incoming raw values for a single contact */
        __u16 x, y, w, h;
        __u16 id;
-        __u8 confidence;
+        bool tipswitch;
+        bool confidence;
+        bool first_contact_touch;
        bool reading_mt;
-        __u8 first_contact_confidence;
        __u8 mt_footer[4];
        __u8 mt_foot_count;
@@ -139,9 +140,10 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                case 0xff000001:
                        /* Tag indicating the start of a multitouch group */
                        nd->reading_mt = 1;
-                        nd->first_contact_confidence = 0;
+                        nd->first_contact_touch = 0;
                        break;
                case HID_DG_TIPSWITCH:
+                        nd->tipswitch = value;
                        /* Prevent emission of touch until validated */
                        return 1;
                case HID_DG_CONFIDENCE:
@@ -169,8 +171,14 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                         * to emit a normal (X, Y) position
                         */
                        if (!nd->reading_mt) {
+                                /*
+                                 * TipSwitch indicates the presence of a
+                                 * finger in single touch mode.
+                                 */
+                                input_report_key(input, BTN_TOUCH,
+                                                 nd->tipswitch);
                                input_report_key(input, BTN_TOOL_DOUBLETAP,
-                                                 (nd->confidence != 0));
+                                                 nd->tipswitch);
                                input_event(input, EV_ABS, ABS_X, nd->x);
                                input_event(input, EV_ABS, ABS_Y, nd->y);
                        }
@@ -209,7 +217,13 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                        /* emit a normal (X, Y) for the first point only */
                        if (nd->id == 0) {
-                                nd->first_contact_confidence = nd->confidence;
+                                /*
+                                 * TipSwitch is superfluous in multitouch
+                                 * mode.  The footer events tell us
+                                 * if there is a finger on the screen or
+                                 * not.
+                                 */
+                                nd->first_contact_touch = nd->confidence;
                                input_event(input, EV_ABS, ABS_X, nd->x);
                                input_event(input, EV_ABS, ABS_Y, nd->y);
                        }
@@ -239,30 +253,11 @@ static int ntrig_event (struct hid_device *hid, struct hid_field *field,
                        nd->reading_mt = 0;
-                        if (nd->first_contact_confidence) {
+                        if (nd->first_contact_touch) {
-                                switch (value) {
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 1);
-                                case 0: /* for single touch devices */
-                                case 1:
-                                        input_report_key(input,
-                                                        BTN_TOOL_DOUBLETAP, 1);
-                                        break;
-                                case 2:
-                                        input_report_key(input,
-                                                        BTN_TOOL_TRIPLETAP, 1);
-                                        break;
-                                case 3:
-                                default:
-                                        input_report_key(input,
-                                                        BTN_TOOL_QUADTAP, 1);
-                                }
                                input_report_key(input, BTN_TOUCH, 1);
                        } else {
-                                input_report_key(input,
+                                input_report_key(input, BTN_TOOL_DOUBLETAP, 0);
-                                                BTN_TOOL_DOUBLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_TRIPLETAP, 0);
-                                input_report_key(input,
-                                                BTN_TOOL_QUADTAP, 0);
                                input_report_key(input, BTN_TOUCH, 0);
                        }
                        break;
@@ -286,6 +281,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
        struct ntrig_data *nd;
        struct hid_input *hidinput;
        struct input_dev *input;
+        struct hid_report *report;
        if (id->driver_data)
                hdev->quirks |= HID_QUIRK_MULTI_INPUT;
@@ -327,13 +323,7 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                        __clear_bit(BTN_TOOL_PEN, input->keybit);
                        __clear_bit(BTN_TOOL_FINGER, input->keybit);
                        __clear_bit(BTN_0, input->keybit);
-                        /*
-                         * A little something special to enable
-                         * two and three finger taps.
-                         */
                        __set_bit(BTN_TOOL_DOUBLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_TRIPLETAP, input->keybit);
-                        __set_bit(BTN_TOOL_QUADTAP, input->keybit);
                        /*
                         * The physical touchscreen (single touch)
                         * input has a value for physical, whereas
@@ -349,6 +339,12 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
                }
        }
+        /* This is needed for devices with more recent firmware versions */
+        report = hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0x0a];
+        if (report)
+                usbhid_submit_report(hdev, report, USB_DIR_OUT);
        return 0;
 err_free:
        kfree(nd);
diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
index 7502a4b2fa86..402d5574b574 100644
--- a/drivers/hid/hid-sony.c
+++ b/drivers/hid/hid-sony.c
@@ -76,7 +76,7 @@ static int sony_set_operational_usb(struct hid_device *hdev)
 static int sony_set_operational_bt(struct hid_device *hdev)
 {
-        unsigned char buf[] = { 0x53, 0xf4,  0x42, 0x03, 0x00, 0x00 };
+        unsigned char buf[] = { 0xf4,  0x42, 0x03, 0x00, 0x00 };
        return hdev->hid_output_raw_report(hdev, buf, sizeof(buf), HID_FEATURE_REPORT);
 }
diff --git a/drivers/hid/hid-wacom.c b/drivers/hid/hid-wacom.c
index f7700cf49721..f947d8337e21 100644
--- a/drivers/hid/hid-wacom.c
+++ b/drivers/hid/hid-wacom.c
@@ -277,7 +277,6 @@ static int __init wacom_init(void)
        ret = hid_register_driver(&wacom_driver);
        if (ret)
                printk(KERN_ERR "can't register wacom driver\n");
-        printk(KERN_ERR "wacom driver registered\n");
        return ret;
 }
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 56d06cd8075b..7b85b696fdab 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -999,13 +999,6 @@ static int usbhid_start(struct hid_device *hid)
                }
        }
-        init_waitqueue_head(&usbhid->wait);
-        INIT_WORK(&usbhid->reset_work, hid_reset);
-        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
-        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
-        spin_lock_init(&usbhid->lock);
        usbhid->urbctrl = usb_alloc_urb(0, GFP_KERNEL);
        if (!usbhid->urbctrl) {
                ret = -ENOMEM;
@@ -1179,6 +1172,12 @@ static int usbhid_probe(struct usb_interface *intf, const struct usb_device_id *
        usbhid->intf = intf;
        usbhid->ifnum = interface->desc.bInterfaceNumber;
+        init_waitqueue_head(&usbhid->wait);
+        INIT_WORK(&usbhid->reset_work, hid_reset);
+        INIT_WORK(&usbhid->restart_work, __usbhid_restart_queues);
+        setup_timer(&usbhid->io_retry, hid_retry_timeout, (unsigned long) hid);
+        spin_lock_init(&usbhid->lock);
        ret = hid_add_device(hid);
        if (ret) {
                if (ret != -ENODEV)
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index 0f28d91f29d8..f085c18d2905 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -195,6 +195,9 @@ static unsigned int applesmc_accelerometer;
 /* Indicates whether this computer has light sensors and keyboard backlight. */
 static unsigned int applesmc_light;
+/* The number of fans handled by the driver */
+static unsigned int fans_handled;
 /* Indicates which temperature sensors set to use. */
 static unsigned int applesmc_temperature_set;
@@ -1492,39 +1495,24 @@ static int __init applesmc_init(void)
        /* create fan files */
        count = applesmc_get_fan_count();
-        if (count < 0) {
+        if (count < 0)
                printk(KERN_ERR "applesmc: Cannot get the number of fans.\n");
-        } else {
+        else
                printk(KERN_INFO "applesmc: %d fans found.\n", count);
-                switch (count) {
+        if (count > 4) {
-                default:
+                count = 4;
-                        printk(KERN_WARNING "applesmc: More than 4 fans found,"
+                printk(KERN_WARNING "applesmc: More than 4 fans found,"
-                                        " but at most 4 fans are supported"
+                       " but at most 4 fans are supported"
-                                                " by the driver.\n");
+                       " by the driver.\n");
-                case 4:
+        }
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[3]);
+        while (fans_handled < count) {
-                        if (ret)
+                ret = sysfs_create_group(&pdev->dev.kobj,
-                                goto out_key_enumeration;
+                                         &fan_attribute_groups[fans_handled]);
-                case 3:
+                if (ret)
-                        ret = sysfs_create_group(&pdev->dev.kobj,
+                        goto out_fans;
-                                                 &fan_attribute_groups[2]);
+                fans_handled++;
-                        if (ret)
-                                goto out_key_enumeration;
-                case 2:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[1]);
-                        if (ret)
-                                goto out_key_enumeration;
-                case 1:
-                        ret = sysfs_create_group(&pdev->dev.kobj,
-                                                 &fan_attribute_groups[0]);
-                        if (ret)
-                                goto out_fan_1;
-                case 0:
-                        ;
-                }
        }
        for (i = 0;
@@ -1593,10 +1581,10 @@ out_accelerometer:
                applesmc_release_accelerometer();
 out_temperature:
        sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
+out_fans:
-out_fan_1:
+        while (fans_handled)
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
+                sysfs_remove_group(&pdev->dev.kobj,
-out_key_enumeration:
+                                   &fan_attribute_groups[--fans_handled]);
        sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
 out_name:
        sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
@@ -1622,8 +1610,9 @@ static void __exit applesmc_exit(void)
        if (applesmc_accelerometer)
                applesmc_release_accelerometer();
        sysfs_remove_group(&pdev->dev.kobj, &temperature_attributes_group);
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[0]);
+        while (fans_handled)
-        sysfs_remove_group(&pdev->dev.kobj, &fan_attribute_groups[1]);
+                sysfs_remove_group(&pdev->dev.kobj,
+                                   &fan_attribute_groups[--fans_handled]);
        sysfs_remove_group(&pdev->dev.kobj, &key_enumeration_group);
        sysfs_remove_file(&pdev->dev.kobj, &dev_attr_name.attr);
        platform_device_unregister(pdev);
diff --git a/drivers/hwmon/asc7621.c b/drivers/hwmon/asc7621.c
index 7f948105d8ad..0f388adc6187 100644
--- a/drivers/hwmon/asc7621.c
+++ b/drivers/hwmon/asc7621.c
@@ -268,8 +268,11 @@ static ssize_t store_fan16(struct device *dev,
        if (strict_strtol(buf, 10, &reqval))
                return -EINVAL;
+        /* If a minimum RPM of zero is requested, then we set the register to
+           0xffff. This value allows the fan to be stopped completely without
+           generating an alarm. */
        reqval =
-            (SENSORS_LIMIT((reqval) <= 0 ? 0 : 5400000 / (reqval), 0, 65534));
+            (reqval <= 0 ? 0xffff : SENSORS_LIMIT(5400000 / reqval, 0, 0xfffe));
        mutex_lock(&data->update_lock);
        data->reg[param->msb[0]] = (reqval >> 8) & 0xff;
@@ -285,8 +288,9 @@ static ssize_t store_fan16(struct device *dev,
 * Voltages are scaled in the device so that the nominal voltage
 * is 3/4ths of the 0-255 range (i.e. 192).
 * If all voltages are 'normal' then all voltage registers will
- * read 0xC0.  This doesn't help us if we don't have a point of refernce.
+ * read 0xC0.
- * The data sheet however provides us with the full scale value for each
+ *
+ * The data sheet provides us with the 3/4 scale value for each voltage
 * which is stored in in_scaling.  The sda->index parameter value provides
 * the index into in_scaling.
 *
@@ -295,7 +299,7 @@ static ssize_t store_fan16(struct device *dev,
 */
 static int asc7621_in_scaling[] = {
-        3320, 3000, 4380, 6640, 16000
+        2500, 2250, 3300, 5000, 12000
 };
 static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
@@ -306,19 +310,12 @@ static ssize_t show_in10(struct device *dev, struct device_attribute *attr,
        u8 nr = sda->index;
        mutex_lock(&data->update_lock);
-        regval = (data->reg[param->msb[0]] * asc7621_in_scaling[nr]) / 256;
+        regval = (data->reg[param->msb[0]] << 8) | (data->reg[param->lsb[0]]);
-        /* The LSB value is a 2-bit scaling of the MSB's LSbit value.
-         * I.E.  If the maximim voltage for this input is 6640 millivolts then
-         * a MSB register value of 0 = 0mv and 255 = 6640mv.
-         * A 1 step change therefore represents 25.9mv (6640 / 256).
-         * The extra 2-bits therefore represent increments of 6.48mv.
-         */
-        regval += ((asc7621_in_scaling[nr] / 256) / 4) *
-            (data->reg[param->lsb[0]] >> 6);
        mutex_unlock(&data->update_lock);
+        /* The LSB value is a 2-bit scaling of the MSB's LSbit value. */
+        regval = (regval >> 6) * asc7621_in_scaling[nr] / (0xc0 << 2);
        return sprintf(buf, "%u\n", regval);
 }
@@ -331,7 +328,7 @@ static ssize_t show_in8(struct device *dev, struct device_attribute *attr,
        return sprintf(buf, "%u\n",
                       ((data->reg[param->msb[0]] *
-                         asc7621_in_scaling[nr]) / 256));
+                         asc7621_in_scaling[nr]) / 0xc0));
 }
 static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
@@ -344,9 +341,11 @@ static ssize_t store_in8(struct device *dev, struct device_attribute *attr,
        if (strict_strtol(buf, 10, &reqval))
                return -EINVAL;
-        reqval = SENSORS_LIMIT(reqval, 0, asc7621_in_scaling[nr]);
+        reqval = SENSORS_LIMIT(reqval, 0, 0xffff);
+        reqval = reqval * 0xc0 / asc7621_in_scaling[nr];
-        reqval = (reqval * 255 + 128) / asc7621_in_scaling[nr];
+        reqval = SENSORS_LIMIT(reqval, 0, 0xff);
        mutex_lock(&data->update_lock);
        data->reg[param->msb[0]] = reqval;
@@ -846,11 +845,11 @@ static struct asc7621_param asc7621_params[] = {
        PWRITE(in3_max, 3, PRI_LOW, 0x4b, 0, 0, 0, in8),
        PWRITE(in4_max, 4, PRI_LOW, 0x4d, 0, 0, 0, in8),
-        PREAD(in0_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 0, bitmask),
+        PREAD(in0_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 0, bitmask),
-        PREAD(in1_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 1, bitmask),
+        PREAD(in1_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 1, bitmask),
-        PREAD(in2_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 2, bitmask),
+        PREAD(in2_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 2, bitmask),
-        PREAD(in3_alarm, 3, PRI_LOW, 0x41, 0, 0x01, 3, bitmask),
+        PREAD(in3_alarm, 3, PRI_HIGH, 0x41, 0, 0x01, 3, bitmask),
-        PREAD(in4_alarm, 4, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
+        PREAD(in4_alarm, 4, PRI_HIGH, 0x42, 0, 0x01, 0, bitmask),
        PREAD(fan1_input, 0, PRI_HIGH, 0x29, 0x28, 0, 0, fan16),
        PREAD(fan2_input, 1, PRI_HIGH, 0x2b, 0x2a, 0, 0, fan16),
@@ -862,10 +861,10 @@ static struct asc7621_param asc7621_params[] = {
        PWRITE(fan3_min, 2, PRI_LOW, 0x59, 0x58, 0, 0, fan16),
        PWRITE(fan4_min, 3, PRI_LOW, 0x5b, 0x5a, 0, 0, fan16),
-        PREAD(fan1_alarm, 0, PRI_LOW, 0x42, 0, 0x01, 0, bitmask),
+        PREAD(fan1_alarm, 0, PRI_HIGH, 0x42, 0, 0x01, 2, bitmask),
-        PREAD(fan2_alarm, 1, PRI_LOW, 0x42, 0, 0x01, 1, bitmask),
+        PREAD(fan2_alarm, 1, PRI_HIGH, 0x42, 0, 0x01, 3, bitmask),
-        PREAD(fan3_alarm, 2, PRI_LOW, 0x42, 0, 0x01, 2, bitmask),
+        PREAD(fan3_alarm, 2, PRI_HIGH, 0x42, 0, 0x01, 4, bitmask),
-        PREAD(fan4_alarm, 3, PRI_LOW, 0x42, 0, 0x01, 3, bitmask),
+        PREAD(fan4_alarm, 3, PRI_HIGH, 0x42, 0, 0x01, 5, bitmask),
        PREAD(temp1_input, 0, PRI_HIGH, 0x25, 0x10, 0, 0, temp10),
        PREAD(temp2_input, 1, PRI_HIGH, 0x26, 0x15, 0, 0, temp10),
@@ -886,10 +885,10 @@ static struct asc7621_param asc7621_params[] = {
        PWRITE(temp3_max, 2, PRI_LOW, 0x53, 0, 0, 0, temp8),
        PWRITE(temp4_max, 3, PRI_LOW, 0x35, 0, 0, 0, temp8),
-        PREAD(temp1_alarm, 0, PRI_LOW, 0x41, 0, 0x01, 4, bitmask),
+        PREAD(temp1_alarm, 0, PRI_HIGH, 0x41, 0, 0x01, 4, bitmask),
-        PREAD(temp2_alarm, 1, PRI_LOW, 0x41, 0, 0x01, 5, bitmask),
+        PREAD(temp2_alarm, 1, PRI_HIGH, 0x41, 0, 0x01, 5, bitmask),
-        PREAD(temp3_alarm, 2, PRI_LOW, 0x41, 0, 0x01, 6, bitmask),
+        PREAD(temp3_alarm, 2, PRI_HIGH, 0x41, 0, 0x01, 6, bitmask),
-        PREAD(temp4_alarm, 3, PRI_LOW, 0x43, 0, 0x01, 0, bitmask),
+        PREAD(temp4_alarm, 3, PRI_HIGH, 0x43, 0, 0x01, 0, bitmask),
        PWRITE(temp1_source, 0, PRI_LOW, 0x02, 0, 0x07, 4, bitmask),
        PWRITE(temp2_source, 1, PRI_LOW, 0x02, 0, 0x07, 0, bitmask),
@@ -898,7 +897,7 @@ static struct asc7621_param asc7621_params[] = {
        PWRITE(temp1_smoothing_enable, 0, PRI_LOW, 0x62, 0, 0x01, 3, bitmask),
        PWRITE(temp2_smoothing_enable, 1, PRI_LOW, 0x63, 0, 0x01, 7, bitmask),
-        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x64, 0, 0x01, 3, bitmask),
+        PWRITE(temp3_smoothing_enable, 2, PRI_LOW, 0x63, 0, 0x01, 3, bitmask),
        PWRITE(temp4_smoothing_enable, 3, PRI_LOW, 0x3c, 0, 0x01, 3, bitmask),
        PWRITE(temp1_smoothing_time, 0, PRI_LOW, 0x62, 0, 0x07, 0, temp_st),
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index c8ab50516672..7580f55e67e3 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -328,8 +328,8 @@ static int lis3lv02d_remove(struct acpi_device *device, int type)
        lis3lv02d_joystick_disable();
        lis3lv02d_poweroff(&lis3_dev);
-        flush_work(&hpled_led.work);
        led_classdev_unregister(&hpled_led.led_classdev);
+        flush_work(&hpled_led.work);
        return lis3lv02d_remove_fs(&lis3_dev);
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b1edd778639c..405febd94f24 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -54,6 +54,9 @@ static signed short btn_avb_wheel[] =
 static signed short abs_joystick[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_HAT0X, ABS_HAT0Y, -1 };
+static signed short abs_joystick_rudder[] =
+{ ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y, -1 };
 static signed short abs_avb_pegasus[] =
 { ABS_X, ABS_Y, ABS_THROTTLE, ABS_RUDDER, ABS_HAT0X, ABS_HAT0Y,
  ABS_HAT1X, ABS_HAT1Y, -1 };
@@ -76,8 +79,9 @@ static struct iforce_device iforce_device[] = {
        { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
        { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
        { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x06f8, 0x0001, "Guillemot Jet Leader Force Feedback",        btn_joystick, abs_joystick_rudder, ff_iforce },
        { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
-        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
+        { 0x06f8, 0xa302, "Guillemot Jet Leader 3D",                    btn_joystick, abs_joystick, ff_iforce }, //?
        { 0x06d6, 0x29bc, "Trust Force Feedback Race Master",           btn_wheel, abs_wheel, ff_iforce },
        { 0x0000, 0x0000, "Unknown I-Force Device [%04x:%04x]",         btn_joystick, abs_joystick, ff_iforce }
 };
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index b41303d3ec54..6c96631ae5d9 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -212,6 +212,7 @@ static struct usb_device_id iforce_usb_ids [] = {
        { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
        { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
        { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
+        { USB_DEVICE(0x06f8, 0x0003) },         /* Guillemot Jet Leader Force Feedback */
        { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
        { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
        { }                                     /* Terminating entry */
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 0520c2e19927..112b4ee52ff2 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -185,7 +185,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
        int fingers;
        static int old_fingers;
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                /*
                 * byte 0:  D   U  p1  p2   1  p3   R   L
                 * byte 1:  f   0  th  tw  x9  x8  y9  y8
@@ -227,7 +227,7 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
        input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
        input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
-        if ((etd->fw_version_maj == 0x01) &&
+        if (etd->fw_version < 0x020000 &&
            (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                /* rocker up */
                input_report_key(dev, BTN_FORWARD, packet[0] & 0x40);
@@ -321,7 +321,7 @@ static int elantech_check_parity_v1(struct psmouse *psmouse)
        unsigned char p1, p2, p3;
        /* Parity bits are placed differently */
-        if (etd->fw_version_maj == 0x01) {
+        if (etd->fw_version < 0x020000) {
                /* byte 0:  D   U  p1  p2   1  p3   R   L */
                p1 = (packet[0] & 0x20) >> 5;
                p2 = (packet[0] & 0x10) >> 4;
@@ -457,7 +457,7 @@ static void elantech_set_input_params(struct psmouse *psmouse)
        switch (etd->hw_version) {
        case 1:
                /* Rocker button */
-                if ((etd->fw_version_maj == 0x01) &&
+                if (etd->fw_version < 0x020000 &&
                    (etd->capabilities & ETP_CAP_HAS_ROCKER)) {
                        __set_bit(BTN_FORWARD, dev->keybit);
                        __set_bit(BTN_BACK, dev->keybit);
@@ -686,15 +686,14 @@ int elantech_init(struct psmouse *psmouse)
                pr_err("elantech.c: failed to query firmware version.\n");
                goto init_fail;
        }
-        etd->fw_version_maj = param[0];
-        etd->fw_version_min = param[2];
+        etd->fw_version = (param[0] << 16) | (param[1] << 8) | param[2];
        /*
         * Assume every version greater than this is new EeePC style
         * hardware with 6 byte packets
         */
-        if ((etd->fw_version_maj == 0x02 && etd->fw_version_min >= 0x30) ||
+        if (etd->fw_version >= 0x020030) {
-            etd->fw_version_maj > 0x02) {
                etd->hw_version = 2;
                /* For now show extra debug information */
                etd->debug = 1;
@@ -704,8 +703,9 @@ int elantech_init(struct psmouse *psmouse)
                etd->hw_version = 1;
                etd->paritycheck = 1;
        }
-        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d\n",
-                etd->hw_version, etd->fw_version_maj, etd->fw_version_min);
+        pr_info("elantech.c: assuming hardware version %d, firmware version %d.%d.%d\n",
+                etd->hw_version, param[0], param[1], param[2]);
        if (synaptics_send_cmd(psmouse, ETP_CAPABILITIES_QUERY, param)) {
                pr_err("elantech.c: failed to query capabilities.\n");
@@ -720,8 +720,8 @@ int elantech_init(struct psmouse *psmouse)
         * a touch action starts causing the mouse cursor or scrolled page
         * to jump. Enable a workaround.
         */
-        if (etd->fw_version_maj == 0x02 && etd->fw_version_min == 0x22) {
+        if (etd->fw_version == 0x020022) {
-                pr_info("elantech.c: firmware version 2.34 detected, "
+                pr_info("elantech.c: firmware version 2.0.34 detected, "
                        "enabling jumpy cursor workaround\n");
                etd->jumpy_cursor = 1;
        }
diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
index feac5f7af966..ac57bde1bb9f 100644
--- a/drivers/input/mouse/elantech.h
+++ b/drivers/input/mouse/elantech.h
@@ -100,11 +100,10 @@ struct elantech_data {
        unsigned char reg_26;
        unsigned char debug;
        unsigned char capabilities;
-        unsigned char fw_version_maj;
-        unsigned char fw_version_min;
-        unsigned char hw_version;
        unsigned char paritycheck;
        unsigned char jumpy_cursor;
+        unsigned char hw_version;
+        unsigned int  fw_version;
        unsigned char parity[256];
 };
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index cbc807264940..a3c97315a473 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1394,6 +1394,7 @@ static int psmouse_reconnect(struct serio *serio)
        struct psmouse *psmouse = serio_get_drvdata(serio);
        struct psmouse *parent = NULL;
        struct serio_driver *drv = serio->drv;
+        unsigned char type;
        int rc = -1;
        if (!drv || !psmouse) {
@@ -1413,10 +1414,15 @@ static int psmouse_reconnect(struct serio *serio)
        if (psmouse->reconnect) {
                if (psmouse->reconnect(psmouse))
                        goto out;
-        } else if (psmouse_probe(psmouse) < 0 ||
+        } else {
-                   psmouse->type != psmouse_extensions(psmouse,
+                psmouse_reset(psmouse);
-                                                psmouse_max_proto, false)) {
-                goto out;
+                if (psmouse_probe(psmouse) < 0)
+                        goto out;
+                type = psmouse_extensions(psmouse, psmouse_max_proto, false);
+                if (psmouse->type != type)
+                        goto out;
        }
        /* ok, the device type (and capabilities) match the old one,
diff --git a/drivers/input/touchscreen/ad7877.c b/drivers/input/touchscreen/ad7877.c
index e019d53d1ab4..0d2d7e54b465 100644
--- a/drivers/input/touchscreen/ad7877.c
+++ b/drivers/input/touchscreen/ad7877.c
@@ -156,9 +156,14 @@ struct ser_req {
        u16                     reset;
        u16                     ref_on;
        u16                     command;
-        u16                     sample;
        struct spi_message      msg;
        struct spi_transfer     xfer[6];
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 sample ____cacheline_aligned;
 };
 struct ad7877 {
@@ -182,8 +187,6 @@ struct ad7877 {
        u8                      averaging;
        u8                      pen_down_acc_interval;
-        u16                     conversion_data[AD7877_NR_SENSE];
        struct spi_transfer     xfer[AD7877_NR_SENSE + 2];
        struct spi_message      msg;
@@ -195,6 +198,12 @@ struct ad7877 {
        spinlock_t              lock;
        struct timer_list       timer;          /* P: lock */
        unsigned                pending:1;      /* P: lock */
+        /*
+         * DMA (thus cache coherency maintenance) requires the
+         * transfer buffers to live in their own cache lines.
+         */
+        u16 conversion_data[AD7877_NR_SENSE] ____cacheline_aligned;
 };
 static int gpio3;
diff --git a/drivers/mfd/wm831x-core.c b/drivers/mfd/wm831x-core.c
index a3d5728b6449..f2ab025ad97a 100644
--- a/drivers/mfd/wm831x-core.c
+++ b/drivers/mfd/wm831x-core.c
@@ -349,6 +349,9 @@ int wm831x_auxadc_read(struct wm831x *wm831x, enum wm831x_auxadc input)
                goto disable;
        }
+        /* If an interrupt arrived late clean up after it */
+        try_wait_for_completion(&wm831x->auxadc_done);
        /* Ignore the result to allow us to soldier on without IRQ hookup */
        wait_for_completion_timeout(&wm831x->auxadc_done, msecs_to_jiffies(5));
diff --git a/drivers/mfd/wm8350-core.c b/drivers/mfd/wm8350-core.c
index e400a3bed063..b5807484b4c9 100644
--- a/drivers/mfd/wm8350-core.c
+++ b/drivers/mfd/wm8350-core.c
@@ -363,6 +363,10 @@ int wm8350_read_auxadc(struct wm8350 *wm8350, int channel, int scale, int vref)
        reg |= 1 << channel | WM8350_AUXADC_POLL;
        wm8350_reg_write(wm8350, WM8350_DIGITISER_CONTROL_1, reg);
+        /* If a late IRQ left the completion signalled then consume
+         * the completion. */
+        try_wait_for_completion(&wm8350->auxadc_done);
        /* We ignore the result of the completion and just check for a
         * conversion result, allowing us to soldier on if the IRQ
         * infrastructure is not set up for the chip. */
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 88be37d9e9a5..fb279f4ed8b3 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -266,7 +266,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                cmd->opcode, cmd->arg, cmd->flags,
                                cmd->resp[0], cmd->resp[1], cmd->resp[2],
-                                cmd->resp[2], cmd->error);
+                                cmd->resp[3], cmd->error);
                if (data)
                        seq_printf(s, "DATA %u / %u * %u flg %x err %d\n",
                                data->bytes_xfered, data->blocks,
@@ -276,7 +276,7 @@ static int atmci_req_show(struct seq_file *s, void *v)
                                "CMD%u(0x%x) flg %x rsp %x %x %x %x err %d\n",
                                stop->opcode, stop->arg, stop->flags,
                                stop->resp[0], stop->resp[1], stop->resp[2],
-                                stop->resp[2], stop->error);
+                                stop->resp[3], stop->error);
        }
        spin_unlock_bh(&slot->host->lock);
@@ -569,9 +569,10 @@ static void atmci_dma_cleanup(struct atmel_mci *host)
 {
        struct mmc_data                 *data = host->data;
-        dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
+        if (data)
-                     ((data->flags & MMC_DATA_WRITE)
+                dma_unmap_sg(&host->pdev->dev, data->sg, data->sg_len,
-                      ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
+                             ((data->flags & MMC_DATA_WRITE)
+                              ? DMA_TO_DEVICE : DMA_FROM_DEVICE));
 }
 static void atmci_stop_dma(struct atmel_mci *host)
@@ -1099,8 +1100,8 @@ static void atmci_command_complete(struct atmel_mci *host,
                        "command error: status=0x%08x\n", status);
                if (cmd->data) {
-                        host->data = NULL;
                        atmci_stop_dma(host);
+                        host->data = NULL;
                        mci_writel(host, IDR, MCI_NOTBUSY
                                        | MCI_TXRDY | MCI_RXRDY
                                        | ATMCI_DATA_ERROR_FLAGS);
@@ -1293,6 +1294,7 @@ static void atmci_tasklet_func(unsigned long priv)
                        } else {
                                data->bytes_xfered = data->blocks * data->blksz;
                                data->error = 0;
+                                mci_writel(host, IDR, ATMCI_DATA_ERROR_FLAGS);
                        }
                        if (!data->stop) {
@@ -1751,13 +1753,13 @@ static int __init atmci_probe(struct platform_device *pdev)
        ret = -ENODEV;
        if (pdata->slot[0].bus_width) {
                ret = atmci_init_slot(host, &pdata->slot[0],
-                                MCI_SDCSEL_SLOT_A, 0);
+                                0, MCI_SDCSEL_SLOT_A);
                if (!ret)
                        nr_slots++;
        }
        if (pdata->slot[1].bus_width) {
                ret = atmci_init_slot(host, &pdata->slot[1],
-                                MCI_SDCSEL_SLOT_B, 1);
+                                1, MCI_SDCSEL_SLOT_B);
                if (!ret)
                        nr_slots++;
        }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 4e97ca182997..5d3763fb3472 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -1649,6 +1649,7 @@ static void free_skb_resources(struct gfar_private *priv)
                        sizeof(struct rxbd8) * priv->total_rx_ring_size,
                        priv->tx_queue[0]->tx_bd_base,
                        priv->tx_queue[0]->tx_bd_dma_base);
+        skb_queue_purge(&priv->rx_recycle);
 }
 void gfar_start(struct net_device *dev)
@@ -2088,7 +2089,6 @@ static int gfar_close(struct net_device *dev)
        disable_napi(priv);
-        skb_queue_purge(&priv->rx_recycle);
        cancel_work_sync(&priv->reset_task);
        stop_gfar(dev);
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 0cd80e4d71d9..e67691dca4ab 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -32,6 +32,7 @@ static int kszphy_config_init(struct phy_device *phydev)
 static struct phy_driver ks8001_driver = {
        .phy_id         = PHY_ID_KS8001,
+        .name           = "Micrel KS8001",
        .phy_id_mask    = 0x00fffff0,
        .features       = PHY_BASIC_FEATURES,
        .flags          = PHY_POLL,
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index f9f0730b53d5..5ec542dd5b50 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -187,7 +187,6 @@ tx_drop:
        return NETDEV_TX_OK;
 rx_drop:
-        kfree_skb(skb);
        rcv_stats->rx_dropped++;
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 99a6da464bd3..e1c2fcaa8bed 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -727,12 +727,16 @@ static void ar9170_usb_firmware_failed(struct ar9170_usb *aru)
 {
        struct device *parent = aru->udev->dev.parent;
+        complete(&aru->firmware_loading_complete);
        /* unbind anything failed */
        if (parent)
                down(&parent->sem);
        device_release_driver(&aru->udev->dev);
        if (parent)
                up(&parent->sem);
+        usb_put_dev(aru->udev);
 }
 static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
@@ -761,6 +765,8 @@ static void ar9170_usb_firmware_finish(const struct firmware *fw, void *context)
        if (err)
                goto err_unrx;
+        complete(&aru->firmware_loading_complete);
+        usb_put_dev(aru->udev);
        return;
 err_unrx:
@@ -858,6 +864,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        init_usb_anchor(&aru->tx_pending);
        init_usb_anchor(&aru->tx_submitted);
        init_completion(&aru->cmd_wait);
+        init_completion(&aru->firmware_loading_complete);
        spin_lock_init(&aru->tx_urb_lock);
        aru->tx_pending_urbs = 0;
@@ -877,6 +884,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
        if (err)
                goto err_freehw;
+        usb_get_dev(aru->udev);
        return request_firmware_nowait(THIS_MODULE, 1, "ar9170.fw",
                                       &aru->udev->dev, GFP_KERNEL, aru,
                                       ar9170_usb_firmware_step2);
@@ -896,6 +904,9 @@ static void ar9170_usb_disconnect(struct usb_interface *intf)
                return;
        aru->common.state = AR9170_IDLE;
+        wait_for_completion(&aru->firmware_loading_complete);
        ar9170_unregister(&aru->common);
        ar9170_usb_cancel_urbs(aru);
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index a2ce3b169ceb..919b06046eb3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -71,6 +71,7 @@ struct ar9170_usb {
        unsigned int tx_pending_urbs;
        struct completion cmd_wait;
+        struct completion firmware_loading_complete;
        int readlen;
        u8 *readbuf;
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 6383d9f8c9b3..f4e59ae07f8e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -2621,7 +2621,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 12e455a4b90e..741e65ec8301 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -813,16 +813,29 @@ static void iwl_bg_request_scan(struct work_struct *data)
                        rate = IWL_RATE_1M_PLCP;
                        rate_flags = RATE_MCS_CCK_MSK;
                }
-                scan->good_CRC_th = 0;
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
                band = IEEE80211_BAND_5GHZ;
                rate = IWL_RATE_6M_PLCP;
                /*
-                 * If active scaning is requested but a certain channel
+                 * If active scanning is requested but a certain channel is
-                 * is marked passive, we can do active scanning if we
+                 * marked passive, we can do active scanning if we detect
-                 * detect transmissions.
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
                /* Force use of chains B and C (0x6) for scan Rx for 4965
                 * Avoid A (0x1) because of its off-channel reception on A-band.
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index b55e4f39a9e1..b74a56c48d26 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2967,7 +2967,8 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 * is marked passive, we can do active scanning if we
                 * detect transmissions.
                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                band = IEEE80211_BAND_5GHZ;
        } else {
                IWL_WARN(priv, "Invalid scan band count\n");
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 4fe36d2e1049..19b111383f62 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -838,65 +838,11 @@ static void pci_bus_dump_resources(struct pci_bus *bus)
        }
 }
-static int __init pci_bus_get_depth(struct pci_bus *bus)
-{
-        int depth = 0;
-        struct pci_dev *dev;
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                int ret;
-                struct pci_bus *b = dev->subordinate;
-                if (!b)
-                        continue;
-                ret = pci_bus_get_depth(b);
-                if (ret + 1 > depth)
-                        depth = ret + 1;
-        }
-        return depth;
-}
-static int __init pci_get_max_depth(void)
-{
-        int depth = 0;
-        struct pci_bus *bus;
-        list_for_each_entry(bus, &pci_root_buses, node) {
-                int ret;
-                ret = pci_bus_get_depth(bus);
-                if (ret > depth)
-                        depth = ret;
-        }
-        return depth;
-}
-/*
- * first try will not touch pci bridge res
- * second  and later try will clear small leaf bridge res
- * will stop till to the max  deepth if can not find good one
- */
 void __init
 pci_assign_unassigned_resources(void)
 {
        struct pci_bus *bus;
-        int tried_times = 0;
-        enum release_type rel_type = leaf_only;
-        struct resource_list_x head, *list;
-        unsigned long type_mask = IORESOURCE_IO | IORESOURCE_MEM |
-                                  IORESOURCE_PREFETCH;
-        unsigned long failed_type;
-        int max_depth = pci_get_max_depth();
-        int pci_try_num;
-        head.next = NULL;
-        pci_try_num = max_depth + 1;
-        printk(KERN_DEBUG "PCI: max bus depth: %d pci_try_num: %d\n",
-                 max_depth, pci_try_num);
-again:
        /* Depth first, calculate sizes and alignments of all
           subordinate buses. */
        list_for_each_entry(bus, &pci_root_buses, node) {
@@ -904,65 +850,9 @@ again:
        }
        /* Depth last, allocate resources and update the hardware. */
        list_for_each_entry(bus, &pci_root_buses, node) {
-                __pci_bus_assign_resources(bus, &head);
+                pci_bus_assign_resources(bus);
-        }
-        tried_times++;
-        /* any device complain? */
-        if (!head.next)
-                goto enable_and_dump;
-        failed_type = 0;
-        for (list = head.next; list;) {
-                failed_type |= list->flags;
-                list = list->next;
-        }
-        /*
-         * io port are tight, don't try extra
-         * or if reach the limit, don't want to try more
-         */
-        failed_type &= type_mask;
-        if ((failed_type == IORESOURCE_IO) || (tried_times >= pci_try_num)) {
-                free_failed_list(&head);
-                goto enable_and_dump;
-        }
-        printk(KERN_DEBUG "PCI: No. %d try to assign unassigned res\n",
-                         tried_times + 1);
-        /* third times and later will not check if it is leaf */
-        if ((tried_times + 1) > 2)
-                rel_type = whole_subtree;
-        /*
-         * Try to release leaf bridge's resources that doesn't fit resource of
-         * child device under that bridge
-         */
-        for (list = head.next; list;) {
-                bus = list->dev->bus;
-                pci_bus_release_bridge_resources(bus, list->flags & type_mask,
-                                                  rel_type);
-                list = list->next;
-        }
-        /* restore size and flags */
-        for (list = head.next; list;) {
-                struct resource *res = list->res;
-                res->start = list->start;
-                res->end = list->end;
-                res->flags = list->flags;
-                if (list->dev->subordinate)
-                        res->flags = 0;
-                list = list->next;
-        }
-        free_failed_list(&head);
-        goto again;
-enable_and_dump:
-        /* Depth last, update the hardware. */
-        list_for_each_entry(bus, &pci_root_buses, node)
                pci_enable_bridges(bus);
+        }
        /* dump the resource on buses */
        list_for_each_entry(bus, &pci_root_buses, node) {
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index acf222f91f5a..fa2339cb1681 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -37,6 +37,9 @@
 */
 #define DASD_CHANQ_MAX_SIZE 4
+#define DASD_SLEEPON_START_TAG  (void *) 1
+#define DASD_SLEEPON_END_TAG    (void *) 2
 /*
 * SECTION: exported variables of dasd.c
 */
@@ -1472,7 +1475,10 @@ void dasd_add_request_tail(struct dasd_ccw_req *cqr)
 */
 static void dasd_wakeup_cb(struct dasd_ccw_req *cqr, void *data)
 {
-        wake_up((wait_queue_head_t *) data);
+        spin_lock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        cqr->callback_data = DASD_SLEEPON_END_TAG;
+        spin_unlock_irq(get_ccwdev_lock(cqr->startdev->cdev));
+        wake_up(&generic_waitq);
 }
 static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
@@ -1482,10 +1488,7 @@ static inline int _wait_for_wakeup(struct dasd_ccw_req *cqr)
        device = cqr->startdev;
        spin_lock_irq(get_ccwdev_lock(device->cdev));
-        rc = ((cqr->status == DASD_CQR_DONE ||
+        rc = (cqr->callback_data == DASD_SLEEPON_END_TAG);
-               cqr->status == DASD_CQR_NEED_ERP ||
-               cqr->status == DASD_CQR_TERMINATED) &&
-              list_empty(&cqr->devlist));
        spin_unlock_irq(get_ccwdev_lock(device->cdev));
        return rc;
 }
@@ -1573,7 +1576,7 @@ static int _dasd_sleep_on(struct dasd_ccw_req *maincqr, int interruptible)
                        wait_event(generic_waitq, !(device->stopped));
                cqr->callback = dasd_wakeup_cb;
-                cqr->callback_data = (void *) &generic_waitq;
+                cqr->callback_data = DASD_SLEEPON_START_TAG;
                dasd_add_request_tail(cqr);
                if (interruptible) {
                        rc = wait_event_interruptible(
@@ -1652,7 +1655,7 @@ int dasd_sleep_on_immediatly(struct dasd_ccw_req *cqr)
        }
        cqr->callback = dasd_wakeup_cb;
-        cqr->callback_data = (void *) &generic_waitq;
+        cqr->callback_data = DASD_SLEEPON_START_TAG;
        cqr->status = DASD_CQR_QUEUED;
        list_add(&cqr->devlist, &device->ccw_queue);
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index 4315b23590bd..eacb588a9345 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -120,7 +120,8 @@
 #define  MX2_UCR3_RXDMUXSEL      (1<<2)  /* RXD Muxed Input Select, on mx2/mx3 */
 #define  UCR3_INVT       (1<<1)  /* Inverted Infrared transmission */
 #define  UCR3_BPEN       (1<<0)  /* Preset registers enable */
-#define  UCR4_CTSTL_32   (32<<10) /* CTS trigger level (32 chars) */
+#define  UCR4_CTSTL_SHF  10      /* CTS trigger level shift */
+#define  UCR4_CTSTL_MASK 0x3F    /* CTS trigger is 6 bits wide */
 #define  UCR4_INVR       (1<<9)  /* Inverted infrared reception */
 #define  UCR4_ENIRI      (1<<8)  /* Serial infrared interrupt enable */
 #define  UCR4_WKEN       (1<<7)  /* Wake interrupt enable */
@@ -591,6 +592,9 @@ static int imx_setup_ufcr(struct imx_port *sport, unsigned int mode)
        return 0;
 }
+/* half the RX buffer size */
+#define CTSTL 16
 static int imx_startup(struct uart_port *port)
 {
        struct imx_port *sport = (struct imx_port *)port;
@@ -607,6 +611,10 @@ static int imx_startup(struct uart_port *port)
        if (USE_IRDA(sport))
                temp |= UCR4_IRSC;
+        /* set the trigger level for CTS */
+        temp &= ~(UCR4_CTSTL_MASK<<  UCR4_CTSTL_SHF);
+        temp |= CTSTL<<  UCR4_CTSTL_SHF;
        writel(temp & ~UCR4_DREN, sport->port.membase + UCR4);
        if (USE_IRDA(sport)) {
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index a176ab4bd65b..02469c31bf0b 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -1467,7 +1467,7 @@ mpc52xx_uart_init(void)
        /*
         * Map the PSC FIFO Controller and init if on MPC512x.
         */
-        if (psc_ops->fifoc_init) {
+        if (psc_ops && psc_ops->fifoc_init) {
                ret = psc_ops->fifoc_init();
                if (ret)
                        return ret;
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index e69d238c5af0..49fa953aaf6e 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1035,7 +1035,12 @@ int vhost_add_used(struct vhost_virtqueue *vq, unsigned int head, int len)
 /* This actually signals the guest, using eventfd. */
 void vhost_signal(struct vhost_dev *dev, struct vhost_virtqueue *vq)
 {
-        __u16 flags = 0;
+        __u16 flags;
+        /* Flush out used index updates. This is paired
+         * with the barrier that the Guest executes when enabling
+         * interrupts. */
+        smp_mb();
        if (get_user(flags, &vq->avail->flags)) {
                vq_err(vq, "Failed to get flags");
                return;
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 44e49c28b2a7..c2ec3dcd4e91 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -488,9 +488,9 @@ static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
        fbinfo->fbops = &bfin_t350mcqb_fb_ops;
        fbinfo->flags = FBINFO_FLAG_DEFAULT;
-        info->fb_buffer =
+        info->fb_buffer = dma_alloc_coherent(NULL, fbinfo->fix.smem_len +
-            dma_alloc_coherent(NULL, fbinfo->fix.smem_len, &info->dma_handle,
+                                ACTIVE_VIDEO_MEM_OFFSET,
-                               GFP_KERNEL);
+                                &info->dma_handle, GFP_KERNEL);
        if (NULL == info->fb_buffer) {
                printk(KERN_ERR DRIVER_NAME
@@ -568,8 +568,8 @@ out7:
 out6:
        fb_dealloc_cmap(&fbinfo->cmap);
 out4:
-        dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+        dma_free_coherent(NULL, fbinfo->fix.smem_len + ACTIVE_VIDEO_MEM_OFFSET,
-                          info->dma_handle);
+                         info->fb_buffer, info->dma_handle);
 out3:
        framebuffer_release(fbinfo);
 out2:
@@ -592,8 +592,9 @@ static int __devexit bfin_t350mcqb_remove(struct platform_device *pdev)
        free_irq(info->irq, info);
        if (info->fb_buffer != NULL)
-                dma_free_coherent(NULL, fbinfo->fix.smem_len, info->fb_buffer,
+                dma_free_coherent(NULL, fbinfo->fix.smem_len +
-                                  info->dma_handle);
+                        ACTIVE_VIDEO_MEM_OFFSET, info->fb_buffer,
+                        info->dma_handle);
        fb_dealloc_cmap(&fbinfo->cmap);
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index 109a6c606d92..e8e5e63ac950 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -177,8 +177,7 @@ static int try_to_fill_dentry(struct dentry *dentry, int flags)
                }
        /* Trigger mount for path component or follow link */
        } else if (ino->flags & AUTOFS_INF_PENDING ||
-                        autofs4_need_mount(flags) ||
+                        autofs4_need_mount(flags)) {
-                        current->link_count) {
                DPRINTK("waiting for mount name=%.*s",
                        dentry->d_name.len, dentry->d_name.name);
@@ -262,7 +261,7 @@ static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
                spin_unlock(&dcache_lock);
                spin_unlock(&sbi->fs_lock);
-                status = try_to_fill_dentry(dentry, 0);
+                status = try_to_fill_dentry(dentry, nd->flags);
                if (status)
                        goto out_error;
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index f7c255f9c624..a8cd821226da 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -34,6 +34,7 @@ struct cachefiles_object {
        loff_t                          i_size;         /* object size */
        unsigned long                   flags;
 #define CACHEFILES_OBJECT_ACTIVE        0               /* T if marked active */
+#define CACHEFILES_OBJECT_BURIED        1               /* T if preemptively buried */
        atomic_t                        usage;          /* object usage count */
        uint8_t                         type;           /* object type */
        uint8_t                         new;            /* T if object new */
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index d5db84a1ee0d..f4a7840bf42c 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -93,6 +93,59 @@ static noinline void cachefiles_printk_object(struct cachefiles_object *object,
 }
 /*
+ * mark the owner of a dentry, if there is one, to indicate that that dentry
+ * has been preemptively deleted
+ * - the caller must hold the i_mutex on the dentry's parent as required to
+ *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
+ */
+static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
+                                          struct dentry *dentry)
+{
+        struct cachefiles_object *object;
+        struct rb_node *p;
+        _enter(",'%*.*s'",
+               dentry->d_name.len, dentry->d_name.len, dentry->d_name.name);
+        write_lock(&cache->active_lock);
+        p = cache->active_nodes.rb_node;
+        while (p) {
+                object = rb_entry(p, struct cachefiles_object, active_node);
+                if (object->dentry > dentry)
+                        p = p->rb_left;
+                else if (object->dentry < dentry)
+                        p = p->rb_right;
+                else
+                        goto found_dentry;
+        }
+        write_unlock(&cache->active_lock);
+        _leave(" [no owner]");
+        return;
+        /* found the dentry for  */
+found_dentry:
+        kdebug("preemptive burial: OBJ%x [%s] %p",
+               object->fscache.debug_id,
+               fscache_object_states[object->fscache.state],
+               dentry);
+        if (object->fscache.state < FSCACHE_OBJECT_DYING) {
+                printk(KERN_ERR "\n");
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Can't preemptively bury live object\n");
+                cachefiles_printk_object(object, NULL);
+        } else if (test_and_set_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Object already preemptively buried\n");
+        }
+        write_unlock(&cache->active_lock);
+        _leave(" [owner marked]");
+}
+/*
 * record the fact that an object is now active
 */
 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
@@ -219,7 +272,8 @@ requeue:
 */
 static int cachefiles_bury_object(struct cachefiles_cache *cache,
                                  struct dentry *dir,
-                                  struct dentry *rep)
+                                  struct dentry *rep,
+                                  bool preemptive)
 {
        struct dentry *grave, *trap;
        char nbuffer[8 + 8 + 1];
@@ -229,11 +283,16 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
               dir->d_name.len, dir->d_name.len, dir->d_name.name,
               rep->d_name.len, rep->d_name.len, rep->d_name.name);
+        _debug("remove %p from %p", rep, dir);
        /* non-directories can just be unlinked */
        if (!S_ISDIR(rep->d_inode->i_mode)) {
                _debug("unlink stale object");
                ret = vfs_unlink(dir->d_inode, rep);
+                if (preemptive)
+                        cachefiles_mark_object_buried(cache, rep);
                mutex_unlock(&dir->d_inode->i_mutex);
                if (ret == -EIO)
@@ -325,6 +384,9 @@ try_again:
        if (ret != 0 && ret != -ENOMEM)
                cachefiles_io_error(cache, "Rename failed with error %d", ret);
+        if (preemptive)
+                cachefiles_mark_object_buried(cache, rep);
        unlock_rename(cache->graveyard, dir);
        dput(grave);
        _leave(" = 0");
@@ -340,7 +402,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
        struct dentry *dir;
        int ret;
-        _enter(",{%p}", object->dentry);
+        _enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
        ASSERT(object->dentry);
        ASSERT(object->dentry->d_inode);
@@ -350,15 +412,25 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
        mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        /* we need to check that our parent is _still_ our parent - it may have
+        if (test_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
-         * been renamed */
+                /* object allocation for the same key preemptively deleted this
-        if (dir == object->dentry->d_parent) {
+                 * object's file so that it could create its own file */
-                ret = cachefiles_bury_object(cache, dir, object->dentry);
+                _debug("object preemptively buried");
-        } else {
-                /* it got moved, presumably by cachefilesd culling it, so it's
-                 * no longer in the key path and we can ignore it */
                mutex_unlock(&dir->d_inode->i_mutex);
                ret = 0;
+        } else {
+                /* we need to check that our parent is _still_ our parent - it
+                 * may have been renamed */
+                if (dir == object->dentry->d_parent) {
+                        ret = cachefiles_bury_object(cache, dir,
+                                                     object->dentry, false);
+                } else {
+                        /* it got moved, presumably by cachefilesd culling it,
+                         * so it's no longer in the key path and we can ignore
+                         * it */
+                        mutex_unlock(&dir->d_inode->i_mutex);
+                        ret = 0;
+                }
        }
        dput(dir);
@@ -381,7 +453,9 @@ int cachefiles_walk_to_object(struct cachefiles_object *parent,
        const char *name;
        int ret, nlen;
-        _enter("{%p},,%s,", parent->dentry, key);
+        _enter("OBJ%x{%p},OBJ%x,%s,",
+               parent->fscache.debug_id, parent->dentry,
+               object->fscache.debug_id, key);
        cache = container_of(parent->fscache.cache,
                             struct cachefiles_cache, cache);
@@ -509,7 +583,7 @@ lookup_again:
                         * mutex) */
                        object->dentry = NULL;
-                        ret = cachefiles_bury_object(cache, dir, next);
+                        ret = cachefiles_bury_object(cache, dir, next, true);
                        dput(next);
                        next = NULL;
@@ -828,7 +902,7 @@ int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
        /*  actually remove the victim (drops the dir mutex) */
        _debug("bury");
-        ret = cachefiles_bury_object(cache, dir, victim);
+        ret = cachefiles_bury_object(cache, dir, victim, false);
        if (ret < 0)
                goto error;
diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
index b5808cdb2232..039b5011d83b 100644
--- a/fs/cachefiles/security.c
+++ b/fs/cachefiles/security.c
@@ -77,6 +77,8 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
 /*
 * check the security details of the on-disk cache
 * - must be called with security override in force
+ * - must return with a security override in force - even in the case of an
+ *   error
 */
 int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
                                        struct dentry *root,
@@ -99,6 +101,8 @@ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
         * which create files */
        ret = set_create_files_as(new, root->d_inode);
        if (ret < 0) {
+                abort_creds(new);
+                cachefiles_begin_secure(cache, _saved_cred);
                _leave(" = %d [cfa]", ret);
                return ret;
        }
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index 4b42c2bb603f..a9005d862ed4 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -504,7 +504,6 @@ static void writepages_finish(struct ceph_osd_request *req,
        int i;
        struct ceph_snap_context *snapc = req->r_snapc;
        struct address_space *mapping = inode->i_mapping;
-        struct writeback_control *wbc = req->r_wbc;
        __s32 rc = -EIO;
        u64 bytes = 0;
        struct ceph_client *client = ceph_inode_to_client(inode);
@@ -546,10 +545,6 @@ static void writepages_finish(struct ceph_osd_request *req,
                        clear_bdi_congested(&client->backing_dev_info,
                                            BLK_RW_ASYNC);
-                if (i >= wrote) {
-                        dout("inode %p skipping page %p\n", inode, page);
-                        wbc->pages_skipped++;
-                }
                ceph_put_snap_context((void *)page->private);
                page->private = 0;
                ClearPagePrivate(page);
@@ -799,7 +794,6 @@ get_more_pages:
                                alloc_page_vec(client, req);
                                req->r_callback = writepages_finish;
                                req->r_inode = inode;
-                                req->r_wbc = wbc;
                        }
                        /* note position of first page in pvec */
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 0c1681806867..d9400534b279 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -858,6 +858,8 @@ static int __ceph_is_any_caps(struct ceph_inode_info *ci)
 }
 /*
+ * Remove a cap.  Take steps to deal with a racing iterate_session_caps.
+ *
 * caller should hold i_lock.
 * caller will not hold session s_mutex if called from destroy_inode.
 */
@@ -866,15 +868,10 @@ void __ceph_remove_cap(struct ceph_cap *cap)
        struct ceph_mds_session *session = cap->session;
        struct ceph_inode_info *ci = cap->ci;
        struct ceph_mds_client *mdsc = &ceph_client(ci->vfs_inode.i_sb)->mdsc;
+        int removed = 0;
        dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
-        /* remove from inode list */
-        rb_erase(&cap->ci_node, &ci->i_caps);
-        cap->ci = NULL;
-        if (ci->i_auth_cap == cap)
-                ci->i_auth_cap = NULL;
        /* remove from session list */
        spin_lock(&session->s_cap_lock);
        if (session->s_cap_iterator == cap) {
@@ -885,10 +882,18 @@ void __ceph_remove_cap(struct ceph_cap *cap)
                list_del_init(&cap->session_caps);
                session->s_nr_caps--;
                cap->session = NULL;
+                removed = 1;
        }
+        /* protect backpointer with s_cap_lock: see iterate_session_caps */
+        cap->ci = NULL;
        spin_unlock(&session->s_cap_lock);
-        if (cap->session == NULL)
+        /* remove from inode list */
+        rb_erase(&cap->ci_node, &ci->i_caps);
+        if (ci->i_auth_cap == cap)
+                ci->i_auth_cap = NULL;
+        if (removed)
                ceph_put_cap(cap);
        if (!__ceph_is_any_caps(ci) && ci->i_snap_realm) {
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 261f3e6c0bcf..85b4d2ffdeba 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -733,6 +733,10 @@ no_change:
                                __ceph_get_fmode(ci, cap_fmode);
                        spin_unlock(&inode->i_lock);
                }
+        } else if (cap_fmode >= 0) {
+                pr_warning("mds issued no caps on %llx.%llx\n",
+                           ceph_vinop(inode));
+                __ceph_get_fmode(ci, cap_fmode);
        }
        /* update delegation info? */
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 60a9a4ae47be..24561a557e01 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -736,9 +736,10 @@ static void cleanup_cap_releases(struct ceph_mds_session *session)
 }
 /*
- * Helper to safely iterate over all caps associated with a session.
+ * Helper to safely iterate over all caps associated with a session, with
+ * special care taken to handle a racing __ceph_remove_cap().
 *
- * caller must hold session s_mutex
+ * Caller must hold session s_mutex.
 */
 static int iterate_session_caps(struct ceph_mds_session *session,
                                 int (*cb)(struct inode *, struct ceph_cap *,
@@ -2136,7 +2137,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, int mds)
        struct ceph_mds_session *session = NULL;
        struct ceph_msg *reply;
        struct rb_node *p;
-        int err;
+        int err = -ENOMEM;
        struct ceph_pagelist *pagelist;
        pr_info("reconnect to recovering mds%d\n", mds);
@@ -2185,7 +2186,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, int mds)
                goto fail;
        err = iterate_session_caps(session, encode_caps_cb, pagelist);
        if (err < 0)
-                goto out;
+                goto fail;
        /*
         * snaprealms.  we provide mds with the ino, seq (version), and
@@ -2213,28 +2214,31 @@ send:
        reply->nr_pages = calc_pages_for(0, pagelist->length);
        ceph_con_send(&session->s_con, reply);
-        if (session) {
+        session->s_state = CEPH_MDS_SESSION_OPEN;
-                session->s_state = CEPH_MDS_SESSION_OPEN;
+        mutex_unlock(&session->s_mutex);
-                __wake_requests(mdsc, &session->s_waiting);
-        }
+        mutex_lock(&mdsc->mutex);
+        __wake_requests(mdsc, &session->s_waiting);
+        mutex_unlock(&mdsc->mutex);
+        ceph_put_mds_session(session);
-out:
        up_read(&mdsc->snap_rwsem);
-        if (session) {
-                mutex_unlock(&session->s_mutex);
-                ceph_put_mds_session(session);
-        }
        mutex_lock(&mdsc->mutex);
        return;
 fail:
        ceph_msg_put(reply);
+        up_read(&mdsc->snap_rwsem);
+        mutex_unlock(&session->s_mutex);
+        ceph_put_mds_session(session);
 fail_nomsg:
        ceph_pagelist_release(pagelist);
        kfree(pagelist);
 fail_nopagelist:
-        pr_err("ENOMEM preparing reconnect for mds%d\n", mds);
+        pr_err("error %d preparing reconnect for mds%d\n", err, mds);
-        goto out;
+        mutex_lock(&mdsc->mutex);
+        return;
 }
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 509f57d9ccb3..cd4fadb6491a 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -492,7 +492,14 @@ static void prepare_write_message(struct ceph_connection *con)
                list_move_tail(&m->list_head, &con->out_sent);
        }
-        m->hdr.seq = cpu_to_le64(++con->out_seq);
+        /*
+         * only assign outgoing seq # if we haven't sent this message
+         * yet.  if it is requeued, resend with it's original seq.
+         */
+        if (m->needs_out_seq) {
+                m->hdr.seq = cpu_to_le64(++con->out_seq);
+                m->needs_out_seq = false;
+        }
        dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
             m, con->out_seq, le16_to_cpu(m->hdr.type),
@@ -1986,6 +1993,8 @@ void ceph_con_send(struct ceph_connection *con, struct ceph_msg *msg)
        BUG_ON(msg->front.iov_len != le32_to_cpu(msg->hdr.front_len));
+        msg->needs_out_seq = true;
        /* queue */
        mutex_lock(&con->mutex);
        BUG_ON(!list_empty(&msg->list_head));
@@ -2085,15 +2094,19 @@ struct ceph_msg *ceph_msg_new(int type, int front_len,
        kref_init(&m->kref);
        INIT_LIST_HEAD(&m->list_head);
+        m->hdr.tid = 0;
        m->hdr.type = cpu_to_le16(type);
+        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->hdr.version = 0;
        m->hdr.front_len = cpu_to_le32(front_len);
        m->hdr.middle_len = 0;
        m->hdr.data_len = cpu_to_le32(page_len);
        m->hdr.data_off = cpu_to_le16(page_off);
-        m->hdr.priority = cpu_to_le16(CEPH_MSG_PRIO_DEFAULT);
+        m->hdr.reserved = 0;
        m->footer.front_crc = 0;
        m->footer.middle_crc = 0;
        m->footer.data_crc = 0;
+        m->footer.flags = 0;
        m->front_max = front_len;
        m->front_is_vmalloc = false;
        m->more_to_follow = false;
diff --git a/fs/ceph/messenger.h b/fs/ceph/messenger.h
index a343dae73cdc..a5caf91cc971 100644
--- a/fs/ceph/messenger.h
+++ b/fs/ceph/messenger.h
@@ -86,6 +86,7 @@ struct ceph_msg {
        struct kref kref;
        bool front_is_vmalloc;
        bool more_to_follow;
+        bool needs_out_seq;
        int front_max;
        struct ceph_msgpool *pool;
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index c7b4dedaace6..3514f71ff85f 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -565,7 +565,8 @@ static int __map_osds(struct ceph_osd_client *osdc,
 {
        struct ceph_osd_request_head *reqhead = req->r_request->front.iov_base;
        struct ceph_pg pgid;
-        int o = -1;
+        int acting[CEPH_PG_MAX_SIZE];
+        int o = -1, num = 0;
        int err;
        dout("map_osds %p tid %lld\n", req, req->r_tid);
@@ -576,10 +577,16 @@ static int __map_osds(struct ceph_osd_client *osdc,
        pgid = reqhead->layout.ol_pgid;
        req->r_pgid = pgid;
-        o = ceph_calc_pg_primary(osdc->osdmap, pgid);
+        err = ceph_calc_pg_acting(osdc->osdmap, pgid, acting);
+        if (err > 0) {
+                o = acting[0];
+                num = err;
+        }
        if ((req->r_osd && req->r_osd->o_osd == o &&
-             req->r_sent >= req->r_osd->o_incarnation) ||
+             req->r_sent >= req->r_osd->o_incarnation &&
+             req->r_num_pg_osds == num &&
+             memcmp(req->r_pg_osds, acting, sizeof(acting[0])*num) == 0) ||
            (req->r_osd == NULL && o == -1))
                return 0;  /* no change */
@@ -587,6 +594,10 @@ static int __map_osds(struct ceph_osd_client *osdc,
             req->r_tid, le32_to_cpu(pgid.pool), le16_to_cpu(pgid.ps), o,
             req->r_osd ? req->r_osd->o_osd : -1);
+        /* record full pg acting set */
+        memcpy(req->r_pg_osds, acting, sizeof(acting[0]) * num);
+        req->r_num_pg_osds = num;
        if (req->r_osd) {
                __cancel_request(req);
                list_del_init(&req->r_osd_item);
@@ -612,7 +623,7 @@ static int __map_osds(struct ceph_osd_client *osdc,
                __remove_osd_from_lru(req->r_osd);
                list_add(&req->r_osd_item, &req->r_osd->o_requests);
        }
-        err = 1;   /* osd changed */
+        err = 1;   /* osd or pg changed */
 out:
        return err;
@@ -779,16 +790,18 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
        struct ceph_osd_request *req;
        u64 tid;
        int numops, object_len, flags;
+        s32 result;
        tid = le64_to_cpu(msg->hdr.tid);
        if (msg->front.iov_len < sizeof(*rhead))
                goto bad;
        numops = le32_to_cpu(rhead->num_ops);
        object_len = le32_to_cpu(rhead->object_len);
+        result = le32_to_cpu(rhead->result);
        if (msg->front.iov_len != sizeof(*rhead) + object_len +
            numops * sizeof(struct ceph_osd_op))
                goto bad;
-        dout("handle_reply %p tid %llu\n", msg, tid);
+        dout("handle_reply %p tid %llu result %d\n", msg, tid, (int)result);
        /* lookup */
        mutex_lock(&osdc->request_mutex);
@@ -834,7 +847,8 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
        dout("handle_reply tid %llu flags %d\n", tid, flags);
        /* either this is a read, or we got the safe response */
-        if ((flags & CEPH_OSD_FLAG_ONDISK) ||
+        if (result < 0 ||
+            (flags & CEPH_OSD_FLAG_ONDISK) ||
            ((flags & CEPH_OSD_FLAG_WRITE) == 0))
                __unregister_request(osdc, req);
diff --git a/fs/ceph/osd_client.h b/fs/ceph/osd_client.h
index b0759911e7c3..ce776989ef6a 100644
--- a/fs/ceph/osd_client.h
+++ b/fs/ceph/osd_client.h
@@ -48,6 +48,8 @@ struct ceph_osd_request {
        struct list_head r_osd_item;
        struct ceph_osd *r_osd;
        struct ceph_pg   r_pgid;
+        int              r_pg_osds[CEPH_PG_MAX_SIZE];
+        int              r_num_pg_osds;
        struct ceph_connection *r_con_filling_msg;
@@ -66,7 +68,6 @@ struct ceph_osd_request {
        struct list_head  r_unsafe_item;
        struct inode *r_inode;                /* for use by callbacks */
-        struct writeback_control *r_wbc;      /* ditto */
        char              r_oid[40];          /* object name */
        int               r_oid_len;
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index 2e2c15eed82a..cfdd8f4388b7 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -1041,12 +1041,33 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
 }
 /*
+ * Return acting set for given pgid.
+ */
+int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                        int *acting)
+{
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
+        int i, o, num = CEPH_PG_MAX_SIZE;
+        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
+        if (!osds)
+                return -1;
+        /* primary is first up osd */
+        o = 0;
+        for (i = 0; i < num; i++)
+                if (ceph_osd_is_up(osdmap, osds[i]))
+                        acting[o++] = osds[i];
+        return o;
+}
+/*
 * Return primary osd for given pgid, or -1 if none.
 */
 int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
 {
-        int rawosds[10], *osds;
+        int rawosds[CEPH_PG_MAX_SIZE], *osds;
-        int i, num = ARRAY_SIZE(rawosds);
+        int i, num = CEPH_PG_MAX_SIZE;
        osds = calc_pg_raw(osdmap, pgid, rawosds, &num);
        if (!osds)
@@ -1054,9 +1075,7 @@ int ceph_calc_pg_primary(struct ceph_osdmap *osdmap, struct ceph_pg pgid)
        /* primary is first up osd */
        for (i = 0; i < num; i++)
-                if (ceph_osd_is_up(osdmap, osds[i])) {
+                if (ceph_osd_is_up(osdmap, osds[i]))
                        return osds[i];
-                        break;
-                }
        return -1;
 }
diff --git a/fs/ceph/osdmap.h b/fs/ceph/osdmap.h
index 8bc9f1e4f562..970b547e510d 100644
--- a/fs/ceph/osdmap.h
+++ b/fs/ceph/osdmap.h
@@ -120,6 +120,8 @@ extern int ceph_calc_object_layout(struct ceph_object_layout *ol,
                                   const char *oid,
                                   struct ceph_file_layout *fl,
                                   struct ceph_osdmap *osdmap);
+extern int ceph_calc_pg_acting(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
+                               int *acting);
 extern int ceph_calc_pg_primary(struct ceph_osdmap *osdmap,
                                struct ceph_pg pgid);
diff --git a/fs/ceph/rados.h b/fs/ceph/rados.h
index a1fc1d017b58..fd56451a871f 100644
--- a/fs/ceph/rados.h
+++ b/fs/ceph/rados.h
@@ -58,6 +58,7 @@ struct ceph_timespec {
 #define CEPH_PG_LAYOUT_LINEAR 2
 #define CEPH_PG_LAYOUT_HYBRID 3
+#define CEPH_PG_MAX_SIZE      16  /* max # osds in a single pg */
 /*
 * placement group.
diff --git a/fs/ceph/super.c b/fs/ceph/super.c
index f888cf487b7c..110857ba9269 100644
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -47,10 +47,20 @@ const char *ceph_file_part(const char *s, int len)
 */
 static void ceph_put_super(struct super_block *s)
 {
-        struct ceph_client *cl = ceph_client(s);
+        struct ceph_client *client = ceph_sb_to_client(s);
        dout("put_super\n");
-        ceph_mdsc_close_sessions(&cl->mdsc);
+        ceph_mdsc_close_sessions(&client->mdsc);
+        /*
+         * ensure we release the bdi before put_anon_super releases
+         * the device name.
+         */
+        if (s->s_bdi == &client->backing_dev_info) {
+                bdi_unregister(&client->backing_dev_info);
+                s->s_bdi = NULL;
+        }
        return;
 }
@@ -636,6 +646,8 @@ static void ceph_destroy_client(struct ceph_client *client)
        destroy_workqueue(client->pg_inv_wq);
        destroy_workqueue(client->trunc_wq);
+        bdi_destroy(&client->backing_dev_info);
        if (client->msgr)
                ceph_messenger_destroy(client->msgr);
        mempool_destroy(client->wb_pagevec_pool);
@@ -876,14 +888,14 @@ static int ceph_register_bdi(struct super_block *sb, struct ceph_client *client)
 {
        int err;
-        sb->s_bdi = &client->backing_dev_info;
        /* set ra_pages based on rsize mount option? */
        if (client->mount_args->rsize >= PAGE_CACHE_SIZE)
                client->backing_dev_info.ra_pages =
                        (client->mount_args->rsize + PAGE_CACHE_SIZE - 1)
                        >> PAGE_SHIFT;
        err = bdi_register_dev(&client->backing_dev_info, sb->s_dev);
+        if (!err)
+                sb->s_bdi = &client->backing_dev_info;
        return err;
 }
@@ -957,9 +969,6 @@ static void ceph_kill_sb(struct super_block *s)
        dout("kill_sb %p\n", s);
        ceph_mdsc_pre_umount(&client->mdsc);
        kill_anon_super(s);    /* will call put_super after sb is r/o */
-        if (s->s_bdi == &client->backing_dev_info)
-                bdi_unregister(&client->backing_dev_info);
-        bdi_destroy(&client->backing_dev_info);
        ceph_destroy_client(client);
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index ecf0ffbe2b64..0c2fd17439c8 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -502,6 +502,7 @@ struct dfs_info3_param {
 #define CIFS_FATTR_DFS_REFERRAL         0x1
 #define CIFS_FATTR_DELETE_PENDING       0x2
 #define CIFS_FATTR_NEED_REVAL           0x4
+#define CIFS_FATTR_INO_COLLISION        0x8
 struct cifs_fattr {
        u32             cf_flags;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 35ec11716213..29b9ea244c81 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -715,6 +715,16 @@ cifs_find_inode(struct inode *inode, void *opaque)
        if (CIFS_I(inode)->uniqueid != fattr->cf_uniqueid)
                return 0;
+        /*
+         * uh oh -- it's a directory. We can't use it since hardlinked dirs are
+         * verboten. Disable serverino and return it as if it were found, the
+         * caller can discard it, generate a uniqueid and retry the find
+         */
+        if (S_ISDIR(inode->i_mode) && !list_empty(&inode->i_dentry)) {
+                fattr->cf_flags |= CIFS_FATTR_INO_COLLISION;
+                cifs_autodisable_serverino(CIFS_SB(inode->i_sb));
+        }
        return 1;
 }
@@ -734,15 +744,22 @@ cifs_iget(struct super_block *sb, struct cifs_fattr *fattr)
        unsigned long hash;
        struct inode *inode;
+retry_iget5_locked:
        cFYI(1, ("looking for uniqueid=%llu", fattr->cf_uniqueid));
        /* hash down to 32-bits on 32-bit arch */
        hash = cifs_uniqueid_to_ino_t(fattr->cf_uniqueid);
        inode = iget5_locked(sb, hash, cifs_find_inode, cifs_init_inode, fattr);
-        /* we have fattrs in hand, update the inode */
        if (inode) {
+                /* was there a problematic inode number collision? */
+                if (fattr->cf_flags & CIFS_FATTR_INO_COLLISION) {
+                        iput(inode);
+                        fattr->cf_uniqueid = iunique(sb, ROOT_I);
+                        fattr->cf_flags &= ~CIFS_FATTR_INO_COLLISION;
+                        goto retry_iget5_locked;
+                }
                cifs_fattr_to_inode(inode, fattr);
                if (sb->s_flags & MS_NOATIME)
                        inode->i_flags |= S_NOATIME | S_NOCMTIME;
diff --git a/fs/compat.c b/fs/compat.c
index 4b6ed03cc478..05448730f840 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1531,8 +1531,6 @@ int compat_do_execve(char * filename,
        if (retval < 0)
                goto out;
-        current->stack_start = current->mm->start_stack;
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
diff --git a/fs/exec.c b/fs/exec.c
index 49cdaa19e5b9..e6e94c626c2c 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1387,8 +1387,6 @@ int do_execve(char * filename,
        if (retval < 0)
                goto out;
-        current->stack_start = current->mm->start_stack;
        /* execve succeeded */
        current->fs->in_exec = 0;
        current->in_execve = 0;
diff --git a/fs/namei.c b/fs/namei.c
index a7dce91a7e42..16df7277a92e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1641,7 +1641,7 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
        if (nd->last.name[nd->last.len]) {
                if (open_flag & O_CREAT)
                        goto exit;
-                nd->flags |= LOOKUP_DIRECTORY;
+                nd->flags |= LOOKUP_DIRECTORY | LOOKUP_FOLLOW;
        }
        /* just plain open? */
@@ -1830,6 +1830,8 @@ reval:
        }
        if (open_flag & O_DIRECTORY)
                nd.flags |= LOOKUP_DIRECTORY;
+        if (!(open_flag & O_NOFOLLOW))
+                nd.flags |= LOOKUP_FOLLOW;
        filp = do_last(&nd, &path, open_flag, acc_mode, mode, pathname);
        while (unlikely(!filp)) { /* trailing symlink */
                struct path holder;
@@ -1837,7 +1839,7 @@ reval:
                void *cookie;
                error = -ELOOP;
                /* S_ISDIR part is a temporary automount kludge */
-                if ((open_flag & O_NOFOLLOW) && !S_ISDIR(inode->i_mode))
+                if (!(nd.flags & LOOKUP_FOLLOW) && !S_ISDIR(inode->i_mode))
                        goto exit_dput;
                if (count++ == 32)
                        goto exit_dput;
diff --git a/fs/proc/array.c b/fs/proc/array.c
index e51f2ec2c5e5..885ab5513ac5 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -81,7 +81,6 @@
 #include <linux/pid_namespace.h>
 #include <linux/ptrace.h>
 #include <linux/tracehook.h>
-#include <linux/swapops.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -495,7 +494,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
                rsslim,
                mm ? mm->start_code : 0,
                mm ? mm->end_code : 0,
-                (permitted && mm) ? task->stack_start : 0,
+                (permitted && mm) ? mm->start_stack : 0,
                esp,
                eip,
                /* The signal information here is obsolete.
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 070553427dd5..47f5b145f56e 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -247,25 +247,6 @@ static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
                                } else if (vma->vm_start <= mm->start_stack &&
                                           vma->vm_end >= mm->start_stack) {
                                        name = "[stack]";
-                                } else {
-                                        unsigned long stack_start;
-                                        struct proc_maps_private *pmp;
-                                        pmp = m->private;
-                                        stack_start = pmp->task->stack_start;
-                                        if (vma->vm_start <= stack_start &&
-                                            vma->vm_end >= stack_start) {
-                                                pad_len_spaces(m, len);
-                                                seq_printf(m,
-                                                 "[threadstack:%08lx]",
-#ifdef CONFIG_STACK_GROWSUP
-                                                 vma->vm_end - stack_start
-#else
-                                                 stack_start - vma->vm_start
-#endif
-                                                );
-                                        }
                                }
                        } else {
                                name = "[vdso]";
diff --git a/include/asm-generic/dma-mapping-common.h b/include/asm-generic/dma-mapping-common.h
index e694263445f7..69206957b72c 100644
--- a/include/asm-generic/dma-mapping-common.h
+++ b/include/asm-generic/dma-mapping-common.h
@@ -131,7 +131,7 @@ static inline void dma_sync_single_range_for_cpu(struct device *dev,
                debug_dma_sync_single_range_for_cpu(dev, addr, offset, size, dir);
        } else
-                dma_sync_single_for_cpu(dev, addr, size, dir);
+                dma_sync_single_for_cpu(dev, addr + offset, size, dir);
 }
 static inline void dma_sync_single_range_for_device(struct device *dev,
@@ -148,7 +148,7 @@ static inline void dma_sync_single_range_for_device(struct device *dev,
                debug_dma_sync_single_range_for_device(dev, addr, offset, size, dir);
        } else
-                dma_sync_single_for_device(dev, addr, size, dir);
+                dma_sync_single_for_device(dev, addr + offset, size, dir);
 }
 static inline void
diff --git a/include/linux/sched.h b/include/linux/sched.h
index dad7f668ebf7..2b7b81df78b3 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1497,7 +1497,6 @@ struct task_struct {
        /* bitmask of trace recursion */
        unsigned long trace_recursion;
 #endif /* CONFIG_TRACING */
-        unsigned long stack_start;
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR /* memcg uses this to do batch job */
        struct memcg_batch_info {
                int do_batch;   /* incremented when batch uncharge started */
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 851c813adb3a..61d73e37d543 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -279,6 +279,7 @@ int sctp_do_sm(sctp_event_t event_type, sctp_subtype_t subtype,
 /* 2nd level prototypes */
 void sctp_generate_t3_rtx_event(unsigned long peer);
 void sctp_generate_heartbeat_event(unsigned long peer);
+void sctp_generate_proto_unreach_event(unsigned long peer);
 void sctp_ootb_pkt_free(struct sctp_packet *);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 597f8e27aaf6..219043a67bf7 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1010,6 +1010,9 @@ struct sctp_transport {
        /* Heartbeat timer is per destination. */
        struct timer_list hb_timer;
+        /* Timer to handle ICMP proto unreachable envets */
+        struct timer_list proto_unreach_timer;
        /* Since we're using per-destination retransmission timers
         * (see above), we're also using per-destination "transmitted"
         * queues.  This probably ought to be a private struct
diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index 722b0130aa94..59a009dc54a8 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -158,7 +158,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb,
                            u->mq_bytes + mq_bytes >
                            task_rlimit(p, RLIMIT_MSGQUEUE)) {
                                spin_unlock(&mq_lock);
-                                kfree(info->messages);
+                                /* mqueue_delete_inode() releases info->messages */
                                goto out_inode;
                        }
                        u->mq_bytes += mq_bytes;
diff --git a/kernel/acct.c b/kernel/acct.c
index 24f8c81fc48d..e4c0e1fee9b0 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -353,17 +353,18 @@ restart:
 void acct_exit_ns(struct pid_namespace *ns)
 {
-        struct bsd_acct_struct *acct;
+        struct bsd_acct_struct *acct = ns->bacct;
-        spin_lock(&acct_lock);
+        if (acct == NULL)
-        acct = ns->bacct;
+                return;
-        if (acct != NULL) {
-                if (acct->file != NULL)
-                        acct_file_reopen(acct, NULL, NULL);
-                kfree(acct);
+        del_timer_sync(&acct->timer);
-        }
+        spin_lock(&acct_lock);
+        if (acct->file != NULL)
+                acct_file_reopen(acct, NULL, NULL);
        spin_unlock(&acct_lock);
+        kfree(acct);
 }
 /*
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 3a53c771e503..6d870f2d1228 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4435,7 +4435,15 @@ __setup("cgroup_disable=", cgroup_disable);
 */
 unsigned short css_id(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+        /*
+         * This css_id() can return correct value when somone has refcnt
+         * on this or this is under rcu_read_lock(). Once css->id is allocated,
+         * it's unchanged until freed.
+         */
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
        if (cssid)
                return cssid->id;
@@ -4445,7 +4453,10 @@ EXPORT_SYMBOL_GPL(css_id);
 unsigned short css_depth(struct cgroup_subsys_state *css)
 {
-        struct css_id *cssid = rcu_dereference(css->id);
+        struct css_id *cssid;
+        cssid = rcu_dereference_check(css->id,
+                        rcu_read_lock_held() || atomic_read(&css->refcnt));
        if (cssid)
                return cssid->depth;
@@ -4453,15 +4464,36 @@ unsigned short css_depth(struct cgroup_subsys_state *css)
 }
 EXPORT_SYMBOL_GPL(css_depth);
+/**
+ *  css_is_ancestor - test "root" css is an ancestor of "child"
+ * @child: the css to be tested.
+ * @root: the css supporsed to be an ancestor of the child.
+ *
+ * Returns true if "root" is an ancestor of "child" in its hierarchy. Because
+ * this function reads css->id, this use rcu_dereference() and rcu_read_lock().
+ * But, considering usual usage, the csses should be valid objects after test.
+ * Assuming that the caller will do some action to the child if this returns
+ * returns true, the caller must take "child";s reference count.
+ * If "child" is valid object and this returns true, "root" is valid, too.
+ */
 bool css_is_ancestor(struct cgroup_subsys_state *child,
                    const struct cgroup_subsys_state *root)
 {
-        struct css_id *child_id = rcu_dereference(child->id);
+        struct css_id *child_id;
-        struct css_id *root_id = rcu_dereference(root->id);
+        struct css_id *root_id;
+        bool ret = true;
-        if (!child_id || !root_id || (child_id->depth < root_id->depth))
+        rcu_read_lock();
-                return false;
+        child_id  = rcu_dereference(child->id);
-        return child_id->stack[root_id->depth] == root_id->id;
+        root_id = rcu_dereference(root->id);
+        if (!child_id
+            || !root_id
+            || (child_id->depth < root_id->depth)
+            || (child_id->stack[root_id->depth] != root_id->id))
+                ret = false;
+        rcu_read_unlock();
+        return ret;
 }
 static void __free_css_id_cb(struct rcu_head *head)
diff --git a/kernel/fork.c b/kernel/fork.c
index 44b0791b0a2e..4c14942a0ee3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1114,8 +1114,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
        p->bts = NULL;
-        p->stack_start = stack_start;
        /* Perform scheduler related setup. Assign this task to a CPU. */
        sched_fork(p, clone_flags);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 87ebe8adc474..474a84715eac 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1134,11 +1134,9 @@ int crash_shrink_memory(unsigned long new_size)
        free_reserved_phys_range(end, crashk_res.end);
-        if (start == end) {
+        if (start == end)
-                crashk_res.end = end;
                release_resource(&crashk_res);
-        } else
+        crashk_res.end = end - 1;
-                crashk_res.end = end - 1;
 unlock:
        mutex_unlock(&kexec_mutex);
diff --git a/lib/rwsem.c b/lib/rwsem.c
index 3e3365e5665e..ceba8e28807a 100644
--- a/lib/rwsem.c
+++ b/lib/rwsem.c
@@ -136,9 +136,10 @@ __rwsem_do_wake(struct rw_semaphore *sem, int downgrading)
 out:
        return sem;
-        /* undo the change to count, but check for a transition 1->0 */
+        /* undo the change to the active count, but check for a transition
+         * 1->0 */
 undo:
-        if (rwsem_atomic_update(-RWSEM_ACTIVE_BIAS, sem) != 0)
+        if (rwsem_atomic_update(-RWSEM_ACTIVE_BIAS, sem) & RWSEM_ACTIVE_MASK)
                goto out;
        goto try_again;
 }
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index ffbdfc86aedf..4c9e6bbf3772 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1039,7 +1039,7 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
                page = alloc_buddy_huge_page(h, vma, addr);
                if (!page) {
                        hugetlb_put_quota(inode->i_mapping, chg);
-                        return ERR_PTR(-VM_FAULT_OOM);
+                        return ERR_PTR(-VM_FAULT_SIGBUS);
                }
        }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 0f711c213d2e..8a79a6f0f029 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -811,12 +811,10 @@ int task_in_mem_cgroup(struct task_struct *task, const struct mem_cgroup *mem)
         * enabled in "curr" and "curr" is a child of "mem" in *cgroup*
         * hierarchy(even if use_hierarchy is disabled in "mem").
         */
-        rcu_read_lock();
        if (mem->use_hierarchy)
                ret = css_is_ancestor(&curr->css, &mem->css);
        else
                ret = (curr == mem);
-        rcu_read_unlock();
        css_put(&curr->css);
        return ret;
 }
@@ -1603,7 +1601,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                         * There is a small race that "from" or "to" can be
                         * freed by rmdir, so we use css_tryget().
                         */
-                        rcu_read_lock();
                        from = mc.from;
                        to = mc.to;
                        if (from && css_tryget(&from->css)) {
@@ -1624,7 +1621,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
                                        do_continue = (to == mem_over_limit);
                                css_put(&to->css);
                        }
-                        rcu_read_unlock();
                        if (do_continue) {
                                DEFINE_WAIT(wait);
                                prepare_to_wait(&mc.waitq, &wait,
@@ -2314,9 +2310,7 @@ mem_cgroup_uncharge_swapcache(struct page *page, swp_entry_t ent, bool swapout)
        /* record memcg information */
        if (do_swap_account && swapout && memcg) {
-                rcu_read_lock();
                swap_cgroup_record(ent, css_id(&memcg->css));
-                rcu_read_unlock();
                mem_cgroup_get(memcg);
        }
        if (swapout && memcg)
@@ -2373,10 +2367,8 @@ static int mem_cgroup_move_swap_account(swp_entry_t entry,
 {
        unsigned short old_id, new_id;
-        rcu_read_lock();
        old_id = css_id(&from->css);
        new_id = css_id(&to->css);
-        rcu_read_unlock();
        if (swap_cgroup_cmpxchg(entry, old_id, new_id) == old_id) {
                mem_cgroup_swap_statistics(from, false);
@@ -4044,16 +4036,11 @@ static int is_target_pte_for_mc(struct vm_area_struct *vma,
                        put_page(page);
        }
        /* throught */
-        if (ent.val && do_swap_account && !ret) {
+        if (ent.val && do_swap_account && !ret &&
-                unsigned short id;
+                        css_id(&mc.from->css) == lookup_swap_cgroup(ent)) {
-                rcu_read_lock();
+                ret = MC_TARGET_SWAP;
-                id = css_id(&mc.from->css);
+                if (target)
-                rcu_read_unlock();
+                        target->ent = ent;
-                if (id == lookup_swap_cgroup(ent)) {
-                        ret = MC_TARGET_SWAP;
-                        if (target)
-                                target->ent = ent;
-                }
        }
        return ret;
 }
diff --git a/mm/rmap.c b/mm/rmap.c
index 07fc94758799..0feeef860a8f 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -336,14 +336,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 /*
 * At what user virtual address is page expected in vma?
- * checking that the page matches the vma.
+ * Caller should check the page is actually part of the vma.
 */
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
-        if (PageAnon(page)) {
+        if (PageAnon(page))
-                if (vma->anon_vma != page_anon_vma(page))
+                ;
-                        return -EFAULT;
+        else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
-        } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                if (!vma->vm_file ||
                    vma->vm_file->f_mapping != page->mapping)
                        return -EFAULT;
diff --git a/net/core/dev.c b/net/core/dev.c
index f769098774b7..264137fce3a2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
 *
 * return values:
 *      NET_RX_SUCCESS  (no congestion)
- *      NET_RX_DROP     (packet was dropped)
+ *      NET_RX_DROP     (packet was dropped, but freed)
 *
 * dev_forward_skb can be used for injecting an skb from the
 * start_xmit function of one device into the receive queue
@@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
        skb_orphan(skb);
-        if (!(dev->flags & IFF_UP))
+        if (!(dev->flags & IFF_UP) ||
-                return NET_RX_DROP;
+            (skb->len > (dev->mtu + dev->hard_header_len))) {
+                kfree_skb(skb);
-        if (skb->len > (dev->mtu + dev->hard_header_len))
                return NET_RX_DROP;
+        }
        skb_set_dev(skb, dev);
        skb->tstamp.tv64 = 0;
        skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 6e747065c202..80769f1f9fab 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -661,13 +661,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
        case ARPHRD_FDDI:
                arp->ar_hrd = htons(ARPHRD_ETHER);
                arp->ar_pro = htons(ETH_P_IP);
                break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
        case ARPHRD_IEEE802_TR:
                arp->ar_hrd = htons(ARPHRD_IEEE802);
                arp->ar_pro = htons(ETH_P_IP);
@@ -1051,7 +1051,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                        return -EINVAL;
        }
        switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
        case ARPHRD_FDDI:
                /*
                 * According to RFC 1390, FDDI devices should accept ARP
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 9d4f6d1340a4..ec19a890c9a0 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -754,7 +754,8 @@ ipmr_cache_unresolved(struct net *net, vifi_t vifi, struct sk_buff *skb)
                c->next = mfc_unres_queue;
                mfc_unres_queue = c;
-                mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&net->ipv4.cache_resolve_queue_len) == 1)
+                        mod_timer(&ipmr_expire_timer, c->mfc_un.unres.expires);
        }
        /*
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8fef859db35d..c36522a0f113 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1527,6 +1527,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        uh   = udp_hdr(skb);
        ulen = ntohs(uh->len);
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
        if (ulen > skb->len)
                goto short_packet;
@@ -1540,9 +1543,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (udp4_csum_init(skb, uh, proto))
                goto csum_error;
-        saddr = ip_hdr(skb)->saddr;
-        daddr = ip_hdr(skb)->daddr;
        if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                return __udp4_lib_mcast_deliver(net, skb, uh,
                                saddr, daddr, udptable);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 622dc7939a1b..61573885e451 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
        if (!skb)
                return;
+        skb->protocol = htons(ETH_P_IPV6);
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
        serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
        if (!skb)
                return;
+        skb->protocol = htons(ETH_P_IPV6);
        skb_put(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
@@ -319,7 +323,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_flowinfo = 0;
                sin->sin6_port = serr->port;
                sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr,
                                  (struct in6_addr *)(nh + serr->addr_offset));
                        if (np->sndflow)
@@ -341,7 +345,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
                sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                        if (np->rxopt.all)
                                datagram_recv_ctl(sk, msg, skb);
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index a432f0ec051c..94e7fca75b85 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -31,7 +31,7 @@ static int llc_mac_header_len(unsigned short devtype)
        case ARPHRD_ETHER:
        case ARPHRD_LOOPBACK:
                return sizeof(struct ethhdr);
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
        case ARPHRD_IEEE802_TR:
                return sizeof(struct trh_hdr);
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 4aefa6dc3091..875c8dec940a 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2030,7 +2030,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                continue;
                        if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH)
+                            wk->type != IEEE80211_WORK_AUTH &&
+                            wk->type != IEEE80211_WORK_ASSOC)
                                continue;
                        if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 2a570184e5a9..ea2192444ce6 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -440,11 +440,25 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 {
        SCTP_DEBUG_PRINTK("%s\n",  __func__);
-        sctp_do_sm(SCTP_EVENT_T_OTHER,
+        if (sock_owned_by_user(sk)) {
-                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                if (timer_pending(&t->proto_unreach_timer))
-                   asoc->state, asoc->ep, asoc, t,
+                        return;
-                   GFP_ATOMIC);
+                else {
+                        if (!mod_timer(&t->proto_unreach_timer,
+                                                jiffies + (HZ/20)))
+                                sctp_association_hold(asoc);
+                }
+                        
+        } else {
+                if (timer_pending(&t->proto_unreach_timer) &&
+                    del_timer(&t->proto_unreach_timer))
+                        sctp_association_put(asoc);
+                sctp_do_sm(SCTP_EVENT_T_OTHER,
+                           SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                           asoc->state, asoc->ep, asoc, t,
+                           GFP_ATOMIC);
+        }
 }
 /* Common lookup code for icmp/icmpv6 error handler. */
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index d5ae450b6f02..eb1f42f45fdd 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -397,6 +397,41 @@ out_unlock:
        sctp_transport_put(transport);
 }
+/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+        struct sctp_transport *transport = (struct sctp_transport *) data;
+        struct sctp_association *asoc = transport->asoc;
+        
+        sctp_bh_lock_sock(asoc->base.sk);
+        if (sock_owned_by_user(asoc->base.sk)) {
+                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+                /* Try again later.  */
+                if (!mod_timer(&transport->proto_unreach_timer,
+                                jiffies + (HZ/20)))
+                        sctp_association_hold(asoc);
+                goto out_unlock;
+        }
+        /* Is this structure just waiting around for us to actually
+         * get destroyed?
+         */
+        if (asoc->base.dead)
+                goto out_unlock;
+        sctp_do_sm(SCTP_EVENT_T_OTHER,
+                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+out_unlock:
+        sctp_bh_unlock_sock(asoc->base.sk);
+        sctp_association_put(asoc);
+}
 /* Inject a SACK Timeout event into the state machine.  */
 static void sctp_generate_sack_event(unsigned long data)
 {
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index be4d63d5a5cc..4a368038d46f 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -108,6 +108,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                        (unsigned long)peer);
        setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
                        (unsigned long)peer);
+        setup_timer(&peer->proto_unreach_timer,
+                    sctp_generate_proto_unreach_event, (unsigned long)peer);
        /* Initialize the 64-bit random nonce sent with heartbeat. */
        get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
diff --git a/security/min_addr.c b/security/min_addr.c
index e86f297522bf..f728728f193b 100644
--- a/security/min_addr.c
+++ b/security/min_addr.c
@@ -33,7 +33,7 @@ int mmap_min_addr_handler(struct ctl_table *table, int write,
 {
        int ret;
-        if (!capable(CAP_SYS_RAWIO))
+        if (write && !capable(CAP_SYS_RAWIO))
                return -EPERM;
        ret = proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 872887624030..20b5982c996b 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -36,6 +36,9 @@
 #include <sound/timer.h>
 #include <sound/minors.h>
 #include <asm/io.h>
+#if defined(CONFIG_MIPS) && defined(CONFIG_DMA_NONCOHERENT)
+#include <dma-coherence.h>
+#endif
 /*
 *  Compatibility
@@ -3184,6 +3187,10 @@ static int snd_pcm_default_mmap(struct snd_pcm_substream *substream,
                                         substream->runtime->dma_area,
                                         substream->runtime->dma_addr,
                                         area->vm_end - area->vm_start);
+#elif defined(CONFIG_MIPS) && defined(CONFIG_DMA_NONCOHERENT)
+        if (substream->dma_buffer.dev.type == SNDRV_DMA_TYPE_DEV &&
+            !plat_device_is_coherent(substream->dma_buffer.dev.dev))
+                area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
 #endif /* ARCH_HAS_DMA_MMAP_COHERENT */
        /* mmap with fault handler */
        area->vm_ops = &snd_pcm_vm_ops_data_fault;
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 56e52071c769..feabb44c7ca4 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -1197,9 +1197,10 @@ static int patch_cxt5045(struct hda_codec *codec)
        case 0x103c:
        case 0x1631:
        case 0x1734:
-                /* HP, Packard Bell, & Fujitsu-Siemens laptops have really bad
+        case 0x17aa:
-                 * sound over 0dB on NID 0x17. Fix max PCM level to 0 dB
+                /* HP, Packard Bell, Fujitsu-Siemens & Lenovo laptops have
-                 * (originally it has 0x2b steps with 0dB offset 0x14)
+                 * really bad sound over 0dB on NID 0x17. Fix max PCM level to
+                 * 0 dB (originally it has 0x2b steps with 0dB offset 0x14)
                 */
                snd_hda_override_amp_caps(codec, 0x17, HDA_INPUT,
                                          (0x14 << AC_AMPCAP_OFFSET_SHIFT) |
@@ -2846,6 +2847,7 @@ static struct snd_pci_quirk cxt5066_cfg_tbl[] = {
        SND_PCI_QUIRK(0x1028, 0x0408, "Dell Inspiron One 19T", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x1179, 0xff50, "Toshiba Satellite P500-PSPGSC-01800T", CXT5066_OLPC_XO_1_5),
        SND_PCI_QUIRK(0x1179, 0xffe0, "Toshiba Satellite Pro T130-15F", CXT5066_OLPC_XO_1_5),
+        SND_PCI_QUIRK(0x17aa, 0x21b2, "Thinkpad X100e", CXT5066_IDEAPAD),
        SND_PCI_QUIRK(0x17aa, 0x3a0d, "ideapad", CXT5066_IDEAPAD),
        {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7404dba16f83..886d8e46bb37 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -17871,7 +17871,6 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
                                        ALC662_3ST_6ch_DIG),
        SND_PCI_QUIRK_MASK(0x1854, 0xf000, 0x2000, "ASUS H13-200x",
                           ALC663_ASUS_H13),
-        SND_PCI_QUIRK(0x8086, 0xd604, "Intel mobo", ALC662_3ST_2ch_DIG),
        {}
 };
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 7fb7d017a347..a0e06d82da1f 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -104,6 +104,7 @@ enum {
        STAC_DELL_M4_2,
        STAC_DELL_M4_3,
        STAC_HP_M4,
+        STAC_HP_DV4,
        STAC_HP_DV5,
        STAC_HP_HDX,
        STAC_HP_DV4_1222NR,
@@ -1544,11 +1545,9 @@ static unsigned int alienware_m17x_pin_configs[13] = {
        0x904601b0,
 };
-static unsigned int intel_dg45id_pin_configs[14] = {
+static unsigned int intel_dg45id_pin_configs[13] = {
        0x02214230, 0x02A19240, 0x01013214, 0x01014210,
-        0x01A19250, 0x01011212, 0x01016211, 0x40f000f0,
+        0x01A19250, 0x01011212, 0x01016211
-        0x40f000f0, 0x40f000f0, 0x40f000f0, 0x014510A0,
-        0x074510B0, 0x40f000f0
 };
 static unsigned int *stac92hd73xx_brd_tbl[STAC_92HD73XX_MODELS] = {
@@ -1693,6 +1692,7 @@ static unsigned int *stac92hd71bxx_brd_tbl[STAC_92HD71BXX_MODELS] = {
        [STAC_DELL_M4_2]        = dell_m4_2_pin_configs,
        [STAC_DELL_M4_3]        = dell_m4_3_pin_configs,
        [STAC_HP_M4]            = NULL,
+        [STAC_HP_DV4]           = NULL,
        [STAC_HP_DV5]           = NULL,
        [STAC_HP_HDX]           = NULL,
        [STAC_HP_DV4_1222NR]    = NULL,
@@ -1705,6 +1705,7 @@ static const char *stac92hd71bxx_models[STAC_92HD71BXX_MODELS] = {
        [STAC_DELL_M4_2] = "dell-m4-2",
        [STAC_DELL_M4_3] = "dell-m4-3",
        [STAC_HP_M4] = "hp-m4",
+        [STAC_HP_DV4] = "hp-dv4",
        [STAC_HP_DV5] = "hp-dv5",
        [STAC_HP_HDX] = "hp-hdx",
        [STAC_HP_DV4_1222NR] = "hp-dv4-1222nr",
@@ -1723,7 +1724,7 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
        SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3080,
                      "HP", STAC_HP_DV5),
        SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x30f0,
-                      "HP dv4-7", STAC_HP_DV5),
+                      "HP dv4-7", STAC_HP_DV4),
        SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x3600,
                      "HP dv4-7", STAC_HP_DV5),
        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3610,
@@ -4768,6 +4769,9 @@ static void set_hp_led_gpio(struct hda_codec *codec)
        struct sigmatel_spec *spec = codec->spec;
        unsigned int gpio;
+        if (spec->gpio_led)
+                return;
        gpio = snd_hda_param_read(codec, codec->afg, AC_PAR_GPIO_CAP);
        gpio &= AC_GPIO_IO_COUNT;
        if (gpio > 3)
@@ -5677,6 +5681,9 @@ again:
                spec->num_smuxes = 1;
                spec->num_dmuxes = 1;
                /* fallthrough */
+        case STAC_HP_DV4:
+                spec->gpio_led = 0x01;
+                /* fallthrough */
        case STAC_HP_DV5:
                snd_hda_codec_set_pincfg(codec, 0x0d, 0x90170010);
                stac92xx_auto_set_pinctl(codec, 0x0d, AC_PINCTL_OUT_EN);
@@ -5690,6 +5697,7 @@ again:
                spec->num_dmics = 1;
                spec->num_dmuxes = 1;
                spec->num_smuxes = 1;
+                spec->gpio_led = 0x08;
                break;
        }
@@ -5746,7 +5754,8 @@ again:
        }
        /* enable bass on HP dv7 */
-        if (spec->board_config == STAC_HP_DV5) {
+        if (spec->board_config == STAC_HP_DV4 ||
+            spec->board_config == STAC_HP_DV5) {
                unsigned int cap;
                cap = snd_hda_param_read(codec, 0x1, AC_PAR_GPIO_CAP);
                cap &= AC_GPIO_IO_COUNT;
diff --git a/sound/pci/ice1712/maya44.c b/sound/pci/ice1712/maya44.c
index 3e1c20ae2f1c..726fd4b92e19 100644
--- a/sound/pci/ice1712/maya44.c
+++ b/sound/pci/ice1712/maya44.c
@@ -347,7 +347,7 @@ static int maya_gpio_sw_put(struct snd_kcontrol *kcontrol,
 /* known working input slots (0-4) */
 #define MAYA_LINE_IN    1       /* in-2 */
-#define MAYA_MIC_IN     4       /* in-5 */
+#define MAYA_MIC_IN     3       /* in-4 */
 static void wm8776_select_input(struct snd_maya44 *chip, int idx, int line)
 {
@@ -393,8 +393,8 @@ static int maya_rec_src_put(struct snd_kcontrol *kcontrol,
        int changed;
        mutex_lock(&chip->mutex);
-        changed = maya_set_gpio_bits(chip->ice, GPIO_MIC_RELAY,
+        changed = maya_set_gpio_bits(chip->ice, 1 << GPIO_MIC_RELAY,
-                                     sel ? GPIO_MIC_RELAY : 0);
+                                     sel ? (1 << GPIO_MIC_RELAY) : 0);
        wm8776_select_input(chip, 0, sel ? MAYA_MIC_IN : MAYA_LINE_IN);
        mutex_unlock(&chip->mutex);
        return changed;
diff --git a/sound/pci/oxygen/xonar_cs43xx.c b/sound/pci/oxygen/xonar_cs43xx.c
index 16c226bfcd2b..7c4986b27f2b 100644
--- a/sound/pci/oxygen/xonar_cs43xx.c
+++ b/sound/pci/oxygen/xonar_cs43xx.c
@@ -56,6 +56,7 @@
 #include <sound/pcm_params.h>
 #include <sound/tlv.h>
 #include "xonar.h"
+#include "cm9780.h"
 #include "cs4398.h"
 #include "cs4362a.h"
@@ -172,6 +173,8 @@ static void xonar_d1_init(struct oxygen *chip)
        oxygen_clear_bits16(chip, OXYGEN_GPIO_DATA,
                            GPIO_D1_FRONT_PANEL | GPIO_D1_INPUT_ROUTE);
+        oxygen_ac97_set_bits(chip, 0, CM9780_JACK, CM9780_FMIC2MIC);
        xonar_init_cs53x1(chip);
        xonar_enable_output(chip);
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 9b3c20f42f98..613c9cc90570 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -1925,7 +1925,7 @@ void *raw_field_ptr(struct event *event, const char *name, void *data)
        if (!field)
                return NULL;
-        if (field->flags & FIELD_IS_STRING) {
+        if (field->flags & FIELD_IS_DYNAMIC) {
                int offset;
                offset = *(int *)(data + field->offset);
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index 03a5eb22da2b..7c79c1d76d0c 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -197,7 +197,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
        union kvm_ioapic_redirect_entry entry;
        int ret = 1;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        if (irq >= 0 && irq < IOAPIC_NUM_PINS) {
                entry = ioapic->redirtbl[irq];
                level ^= entry.fields.polarity;
@@ -214,7 +214,7 @@ int kvm_ioapic_set_irq(struct kvm_ioapic *ioapic, int irq, int level)
                }
                trace_kvm_ioapic_set_irq(entry.bits, irq, ret == 0);
        }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
        return ret;
 }
@@ -238,9 +238,9 @@ static void __kvm_ioapic_update_eoi(struct kvm_ioapic *ioapic, int vector,
                 * is dropped it will be put into irr and will be delivered
                 * after ack notifier returns.
                 */
-                mutex_unlock(&ioapic->lock);
+                spin_unlock(&ioapic->lock);
                kvm_notify_acked_irq(ioapic->kvm, KVM_IRQCHIP_IOAPIC, i);
-                mutex_lock(&ioapic->lock);
+                spin_lock(&ioapic->lock);
                if (trigger_mode != IOAPIC_LEVEL_TRIG)
                        continue;
@@ -259,9 +259,9 @@ void kvm_ioapic_update_eoi(struct kvm *kvm, int vector, int trigger_mode)
        smp_rmb();
        if (!test_bit(vector, ioapic->handled_vectors))
                return;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        __kvm_ioapic_update_eoi(ioapic, vector, trigger_mode);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
 }
 static inline struct kvm_ioapic *to_ioapic(struct kvm_io_device *dev)
@@ -287,7 +287,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
        ASSERT(!(addr & 0xf));  /* check alignment */
        addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        switch (addr) {
        case IOAPIC_REG_SELECT:
                result = ioapic->ioregsel;
@@ -301,7 +301,7 @@ static int ioapic_mmio_read(struct kvm_io_device *this, gpa_t addr, int len,
                result = 0;
                break;
        }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
        switch (len) {
        case 8:
@@ -338,7 +338,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
        }
        addr &= 0xff;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        switch (addr) {
        case IOAPIC_REG_SELECT:
                ioapic->ioregsel = data;
@@ -356,7 +356,7 @@ static int ioapic_mmio_write(struct kvm_io_device *this, gpa_t addr, int len,
        default:
                break;
        }
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
        return 0;
 }
@@ -386,7 +386,7 @@ int kvm_ioapic_init(struct kvm *kvm)
        ioapic = kzalloc(sizeof(struct kvm_ioapic), GFP_KERNEL);
        if (!ioapic)
                return -ENOMEM;
-        mutex_init(&ioapic->lock);
+        spin_lock_init(&ioapic->lock);
        kvm->arch.vioapic = ioapic;
        kvm_ioapic_reset(ioapic);
        kvm_iodevice_init(&ioapic->dev, &ioapic_mmio_ops);
@@ -419,9 +419,9 @@ int kvm_get_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
        if (!ioapic)
                return -EINVAL;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        memcpy(state, ioapic, sizeof(struct kvm_ioapic_state));
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
        return 0;
 }
@@ -431,9 +431,9 @@ int kvm_set_ioapic(struct kvm *kvm, struct kvm_ioapic_state *state)
        if (!ioapic)
                return -EINVAL;
-        mutex_lock(&ioapic->lock);
+        spin_lock(&ioapic->lock);
        memcpy(ioapic, state, sizeof(struct kvm_ioapic_state));
        update_handled_vectors(ioapic);
-        mutex_unlock(&ioapic->lock);
+        spin_unlock(&ioapic->lock);
        return 0;
 }
diff --git a/virt/kvm/ioapic.h b/virt/kvm/ioapic.h
index 8a751b78a430..0b190c34ccc3 100644
--- a/virt/kvm/ioapic.h
+++ b/virt/kvm/ioapic.h
@@ -45,7 +45,7 @@ struct kvm_ioapic {
        struct kvm_io_device dev;
        struct kvm *kvm;
        void (*ack_notifier)(void *opaque, int irq);
-        struct mutex lock;
+        spinlock_t lock;
        DECLARE_BITMAP(handled_vectors, 256);
 };