187 files changed, 1272 insertions, 692 deletions

diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 736d45602886..e7848a0d99eb 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -199,6 +199,10 @@ and is between 256 and 4096 characters. It is defined in the file
                         acpi_display_output=video
                         See above.
 
+        acpi_early_pdc_eval     [HW,ACPI] Evaluate processor _PDC methods
+                                early. Needed on some platforms to properly
+                                initialize the EC.
+
         acpi_irq_balance [HW,ACPI]
                         ACPI will balance active IRQs
                         default in APIC mode
@@ -311,6 +315,11 @@ and is between 256 and 4096 characters. It is defined in the file
         aic79xx=        [HW,SCSI]
                         See Documentation/scsi/aic79xx.txt.
 
+        alignment=      [KNL,ARM]
+                        Allow the default userspace alignment fault handler
+                        behaviour to be specified.  Bit 0 enables warnings,
+                        bit 1 enables fixups, and bit 2 sends a segfault.
+
         amd_iommu=      [HW,X86-84]
                         Pass parameters to the AMD IOMMU driver in the system.
                         Possible values are:
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 006b39dec87d..e87f3cdc8a6a 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1074,10 +1074,10 @@ regen_max_retry - INTEGER
         Default: 5
 
 max_addresses - INTEGER
-        Number of maximum addresses per interface.  0 disables limitation.
-        It is recommended not set too large value (or 0) because it would
-        be too easy way to crash kernel to allow to create too much of
-        autoconfigured addresses.
+        Maximum number of autoconfigured addresses per interface.  Setting
+        to zero disables the limitation.  It is not recommended to set this
+        value too large (or to zero) because it would be an easy way to
+        crash the kernel by allowing too many addresses to be created.
         Default: 16
 
 disable_ipv6 - BOOLEAN
diff --git a/MAINTAINERS b/MAINTAINERS
index 412eff60c33d..2533fc45a44a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -616,10 +616,10 @@ M:	Richard Purdie <rpurdie@rpsys.net>
 S:      Maintained
 
 ARM/CORTINA SYSTEMS GEMINI ARM ARCHITECTURE
-M:      Paulius Zaleckas <paulius.zaleckas@teltonika.lt>
+M:      Paulius Zaleckas <paulius.zaleckas@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 T:      git git://gitorious.org/linux-gemini/mainline.git
-S:      Maintained
+S:      Odd Fixes
 F:      arch/arm/mach-gemini/
 
 ARM/EBSA110 MACHINE SUPPORT
@@ -641,9 +641,9 @@ T:	topgit git://git.openezx.org/openezx.git
 F:      arch/arm/mach-pxa/ezx.c
 
 ARM/FARADAY FA526 PORT
-M:      Paulius Zaleckas <paulius.zaleckas@teltonika.lt>
+M:      Paulius Zaleckas <paulius.zaleckas@gmail.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      Maintained
+S:      Odd Fixes
 F:      arch/arm/mm/*-fa*
 
 ARM/FOOTBRIDGE ARCHITECTURE
@@ -1733,10 +1733,9 @@ F:	include/linux/tfrc.h
 F:      net/dccp/
 
 DECnet NETWORK LAYER
-M:      Christine Caulfield <christine.caulfield@googlemail.com>
 W:      http://linux-decnet.sourceforge.net
 L:      linux-decnet-user@lists.sourceforge.net
-S:      Maintained
+S:      Orphan
 F:      Documentation/networking/decnet.txt
 F:      net/decnet/
 
@@ -3490,9 +3489,9 @@ S:	Maintained
 F:      drivers/net/wireless/libertas/
 
 MARVELL MV643XX ETHERNET DRIVER
-M:      Lennert Buytenhek <buytenh@marvell.com>
+M:      Lennert Buytenhek <buytenh@wantstofly.org>
 L:      netdev@vger.kernel.org
-S:      Supported
+S:      Maintained
 F:      drivers/net/mv643xx_eth.*
 F:      include/linux/mv643xx.h
 
diff --git a/Makefile b/Makefile
index 12b1aa1103ee..1b24895212d8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 33
-EXTRAVERSION = -rc8
+EXTRAVERSION =
 NAME = Man-Eating Seals of Antiquity
 
 # *DOCUMENTATION*
diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
index c77d2fa1f6e5..8113bb5fb66e 100644
--- a/arch/arm/include/asm/cacheflush.h
+++ b/arch/arm/include/asm/cacheflush.h
@@ -42,7 +42,8 @@
 #endif
 
 #if defined(CONFIG_CPU_ARM920T) || defined(CONFIG_CPU_ARM922T) || \
-    defined(CONFIG_CPU_ARM925T) || defined(CONFIG_CPU_ARM1020)
+    defined(CONFIG_CPU_ARM925T) || defined(CONFIG_CPU_ARM1020) || \
+    defined(CONFIG_CPU_ARM1026)
 # define MULTI_CACHE 1
 #endif
 
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index c6c57b640b6b..621acad8ea43 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -102,6 +102,7 @@ struct cpu_cache_fns cpu_cache;
 #endif
 #ifdef CONFIG_OUTER_CACHE
 struct outer_cache_fns outer_cache;
+EXPORT_SYMBOL(outer_cache);
 #endif
 
 struct stack {
diff --git a/arch/arm/mach-gemini/gpio.c b/arch/arm/mach-gemini/gpio.c
index e7263854bc7b..fe3bd5ac8b10 100644
--- a/arch/arm/mach-gemini/gpio.c
+++ b/arch/arm/mach-gemini/gpio.c
@@ -86,7 +86,7 @@ static int gpio_set_irq_type(unsigned int irq, unsigned int type)
         unsigned int reg_both, reg_level, reg_type;
 
         reg_type = __raw_readl(base + GPIO_INT_TYPE);
-        reg_level = __raw_readl(base + GPIO_INT_BOTH_EDGE);
+        reg_level = __raw_readl(base + GPIO_INT_LEVEL);
         reg_both = __raw_readl(base + GPIO_INT_BOTH_EDGE);
 
         switch (type) {
@@ -117,7 +117,7 @@ static int gpio_set_irq_type(unsigned int irq, unsigned int type)
         }
 
         __raw_writel(reg_type, base + GPIO_INT_TYPE);
-        __raw_writel(reg_level, base + GPIO_INT_BOTH_EDGE);
+        __raw_writel(reg_level, base + GPIO_INT_LEVEL);
         __raw_writel(reg_both, base + GPIO_INT_BOTH_EDGE);
 
         gpio_ack_irq(irq);
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 5fedc50c58e4..5fef73f4743d 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -961,16 +961,14 @@ static void __init omap_mux_init_list(struct omap_mux *superset)
         while (superset->reg_offset !=  OMAP_MUX_TERMINATOR) {
                 struct omap_mux *entry;
 
-#ifndef CONFIG_OMAP_MUX
-                /* Skip pins that are not muxed as GPIO by bootloader */
-                if (!OMAP_MODE_GPIO(omap_mux_read(superset->reg_offset))) {
+#ifdef CONFIG_OMAP_MUX
+                if (!superset->muxnames || !superset->muxnames[0]) {
                         superset++;
                         continue;
                 }
-#endif
-
-#if defined(CONFIG_OMAP_MUX) && defined(CONFIG_DEBUG_FS)
-                if (!superset->muxnames || !superset->muxnames[0]) {
+#else
+                /* Skip pins that are not muxed as GPIO by bootloader */
+                if (!OMAP_MODE_GPIO(omap_mux_read(superset->reg_offset))) {
                         superset++;
                         continue;
                 }
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index b270d6228fe2..62820eda84d9 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -11,6 +11,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#include <linux/moduleparam.h>
 #include <linux/compiler.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
@@ -77,6 +78,8 @@ static unsigned long ai_dword;
 static unsigned long ai_multi;
 static int ai_usermode;
 
+core_param(alignment, ai_usermode, int, 0600);
+
 #define UM_WARN         (1 << 0)
 #define UM_FIXUP        (1 << 1)
 #define UM_SIGNAL       (1 << 2)
diff --git a/arch/arm/tools/mach-types b/arch/arm/tools/mach-types
index 5a79fc6ee818..31c2f4c30a95 100644
--- a/arch/arm/tools/mach-types
+++ b/arch/arm/tools/mach-types
@@ -12,7 +12,7 @@
 #
 #   http://www.arm.linux.org.uk/developer/machines/?action=new
 #
-# Last update: Thu Jan 28 22:15:54 2010
+# Last update: Sat Feb 20 14:16:15 2010
 #
 # machine_is_xxx        CONFIG_xxxx             MACH_TYPE_xxx           number
 #
@@ -2257,7 +2257,7 @@ oratisalog		MACH_ORATISALOG		ORATISALOG		2268
 oratismadi              MACH_ORATISMADI         ORATISMADI              2269
 oratisot16              MACH_ORATISOT16         ORATISOT16              2270
 oratisdesk              MACH_ORATISDESK         ORATISDESK              2271
-v2_ca9                  MACH_V2P_CA9            V2P_CA9                 2272
+vexpress                MACH_VEXPRESS           VEXPRESS                2272
 sintexo                 MACH_SINTEXO            SINTEXO                 2273
 cm3389                  MACH_CM3389             CM3389                  2274
 omap3_cio               MACH_OMAP3_CIO          OMAP3_CIO               2275
@@ -2636,3 +2636,45 @@ hw90240			MACH_HW90240		HW90240			2648
 dm365_leopard           MACH_DM365_LEOPARD      DM365_LEOPARD           2649
 mityomapl138            MACH_MITYOMAPL138       MITYOMAPL138            2650
 scat110                 MACH_SCAT110            SCAT110                 2651
+acer_a1                 MACH_ACER_A1            ACER_A1                 2652
+cmcontrol               MACH_CMCONTROL          CMCONTROL               2653
+pelco_lamar             MACH_PELCO_LAMAR        PELCO_LAMAR             2654
+rfp43                   MACH_RFP43              RFP43                   2655
+sk86r0301               MACH_SK86R0301          SK86R0301               2656
+ctpxa                   MACH_CTPXA              CTPXA                   2657
+epb_arm9_a              MACH_EPB_ARM9_A         EPB_ARM9_A              2658
+guruplug                MACH_GURUPLUG           GURUPLUG                2659
+spear310                MACH_SPEAR310           SPEAR310                2660
+spear320                MACH_SPEAR320           SPEAR320                2661
+robotx                  MACH_ROBOTX             ROBOTX                  2662
+lsxhl                   MACH_LSXHL              LSXHL                   2663
+smartlite               MACH_SMARTLITE          SMARTLITE               2664
+cws2                    MACH_CWS2               CWS2                    2665
+m619                    MACH_M619               M619                    2666
+smartview               MACH_SMARTVIEW          SMARTVIEW               2667
+lsa_salsa               MACH_LSA_SALSA          LSA_SALSA               2668
+kizbox                  MACH_KIZBOX             KIZBOX                  2669
+htccharmer              MACH_HTCCHARMER         HTCCHARMER              2670
+guf_neso_lt             MACH_GUF_NESO_LT        GUF_NESO_LT             2671
+pm9g45                  MACH_PM9G45             PM9G45                  2672
+htcpanther              MACH_HTCPANTHER         HTCPANTHER              2673
+htcpanther_cdma         MACH_HTCPANTHER_CDMA    HTCPANTHER_CDMA         2674
+reb01                   MACH_REB01              REB01                   2675
+aquila                  MACH_AQUILA             AQUILA                  2676
+spark_sls_hw2           MACH_SPARK_SLS_HW2      SPARK_SLS_HW2           2677
+sheeva_esata            MACH_ESATA_SHEEVAPLUG   ESATA_SHEEVAPLUG        2678
+surf7x30                MACH_SURF7X30           SURF7X30                2679
+micro2440               MACH_MICRO2440          MICRO2440               2680
+am2440                  MACH_AM2440             AM2440                  2681
+tq2440                  MACH_TQ2440             TQ2440                  2682
+lpc2478oem              MACH_LPC2478OEM         LPC2478OEM              2683
+ak880x                  MACH_AK880X             AK880X                  2684
+cobra3530               MACH_COBRA3530          COBRA3530               2685
+pmppb                   MACH_PMPPB              PMPPB                   2686
+u6715                   MACH_U6715              U6715                   2687
+axar1500_sender         MACH_AXAR1500_SENDER    AXAR1500_SENDER         2688
+g30_dvb                 MACH_G30_DVB            G30_DVB                 2689
+vc088x                  MACH_VC088X             VC088X                  2690
+mioa702                 MACH_MIOA702            MIOA702                 2691
+hpmin                   MACH_HPMIN              HPMIN                   2692
+ak880xak                MACH_AK880XAK           AK880XAK                2693
diff --git a/arch/ia64/include/asm/acpi.h b/arch/ia64/include/asm/acpi.h
index 7ae58892ba8d..e97b255d97bc 100644
--- a/arch/ia64/include/asm/acpi.h
+++ b/arch/ia64/include/asm/acpi.h
@@ -94,6 +94,7 @@ ia64_acpi_release_global_lock (unsigned int *lock)
 #define acpi_noirq 0    /* ACPI always enabled on IA64 */
 #define acpi_pci_disabled 0 /* ACPI PCI always enabled on IA64 */
 #define acpi_strict 1   /* no ACPI spec workarounds on IA64 */
+#define acpi_ht 0       /* no HT-only mode on IA64 */
 #endif
 #define acpi_processor_cstate_check(x) (x) /* no idle limits on IA64 :) */
 static inline void disable_acpi(void) { }
diff --git a/arch/ia64/include/asm/elf.h b/arch/ia64/include/asm/elf.h
index e14108b19c09..4c41656ede87 100644
--- a/arch/ia64/include/asm/elf.h
+++ b/arch/ia64/include/asm/elf.h
@@ -201,7 +201,9 @@ extern void ia64_elf_core_copy_regs (struct pt_regs *src, elf_gregset_t dst);
    relevant until we have real hardware to play with... */
 #define ELF_PLATFORM    NULL
 
-#define SET_PERSONALITY(ex)     set_personality(PER_LINUX)
+#define SET_PERSONALITY(ex)     \
+        set_personality((current->personality & ~PER_MASK) | PER_LINUX)
+
 #define elf_read_implies_exec(ex, executable_stack)                                     \
         ((executable_stack!=EXSTACK_DISABLE_X) && ((ex).e_flags & EF_IA_64_LINUX_EXECUTABLE_STACK) != 0)
 
diff --git a/arch/ia64/sn/kernel/setup.c b/arch/ia64/sn/kernel/setup.c
index ece1bf994499..e456f062f241 100644
--- a/arch/ia64/sn/kernel/setup.c
+++ b/arch/ia64/sn/kernel/setup.c
@@ -71,7 +71,7 @@ EXPORT_SYMBOL(sn_rtc_cycles_per_second);
 DEFINE_PER_CPU(struct sn_hub_info_s, __sn_hub_info);
 EXPORT_PER_CPU_SYMBOL(__sn_hub_info);
 
-DEFINE_PER_CPU(short [MAX_COMPACT_NODES], __sn_cnodeid_to_nasid);
+DEFINE_PER_CPU(short, __sn_cnodeid_to_nasid[MAX_COMPACT_NODES]);
 EXPORT_PER_CPU_SYMBOL(__sn_cnodeid_to_nasid);
 
 DEFINE_PER_CPU(struct nodepda_s *, __sn_nodepda);
diff --git a/arch/microblaze/include/asm/io.h b/arch/microblaze/include/asm/io.h
index fc9997b73c09..267c7c779e53 100644
--- a/arch/microblaze/include/asm/io.h
+++ b/arch/microblaze/include/asm/io.h
@@ -217,7 +217,7 @@ static inline void __iomem *__ioremap(phys_addr_t address, unsigned long size,
  * Little endian
  */
 
-#define out_le32(a, v) __raw_writel(__cpu_to_le32(v), (a));
+#define out_le32(a, v) __raw_writel(__cpu_to_le32(v), (a))
 #define out_le16(a, v) __raw_writew(__cpu_to_le16(v), (a))
 
 #define in_le32(a) __le32_to_cpu(__raw_readl(a))
diff --git a/arch/microblaze/kernel/cpu/cache.c b/arch/microblaze/kernel/cpu/cache.c
index d9d63831cc2f..2a56bccce4e0 100644
--- a/arch/microblaze/kernel/cpu/cache.c
+++ b/arch/microblaze/kernel/cpu/cache.c
@@ -172,16 +172,15 @@ do {									\
 /* It is used only first parameter for OP - for wic, wdc */
 #define CACHE_RANGE_LOOP_1(start, end, line_length, op)                 \
 do {                                                                    \
-        int step = -line_length;                                        \
-        int count = end - start;                                        \
-        BUG_ON(count <= 0);                                             \
+        int volatile temp;                                              \
+        BUG_ON(end - start <= 0);                                       \
                                                                         \
-        __asm__ __volatile__ (" 1:      addk    %0, %0, %1;             \
-                                        " #op " %0, r0;                 \
-                                        bgtid   %1, 1b;                 \
-                                        addk    %1, %1, %2;             \
-                                        " : : "r" (start), "r" (count), \
-                                        "r" (step) : "memory");         \
+        __asm__ __volatile__ (" 1:      " #op " %1, r0;                 \
+                                        cmpu    %0, %1, %2;             \
+                                        bgtid   %0, 1b;                 \
+                                        addk    %1, %1, %3;             \
+                                " : : "r" (temp), "r" (start), "r" (end),\
+                                        "r" (line_length) : "memory");  \
 } while (0);
 
 static void __flush_icache_range_msr_irq(unsigned long start, unsigned long end)
@@ -313,16 +312,6 @@ static void __invalidate_dcache_all_wb(void)
         pr_debug("%s\n", __func__);
         CACHE_ALL_LOOP2(cpuinfo.dcache_size, cpuinfo.dcache_line_length,
                                         wdc.clear)
-
-#if 0
-        unsigned int i;
-
-        pr_debug("%s\n", __func__);
-
-        /* Just loop through cache size and invalidate it */
-        for (i = 0; i < cpuinfo.dcache_size; i += cpuinfo.dcache_line_length)
-                        __invalidate_dcache(0, i);
-#endif
 }
 
 static void __invalidate_dcache_range_wb(unsigned long start,
diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c
index c51405e57921..29d3cbf9555f 100644
--- a/arch/mips/bcm47xx/prom.c
+++ b/arch/mips/bcm47xx/prom.c
@@ -141,6 +141,14 @@ static __init void prom_init_mem(void)
                         break;
         }
 
+        /* Ignoring the last page when ddr size is 128M. Cached
+         * accesses to last page is causing the processor to prefetch
+         * using address above 128M stepping out of the ddr address
+         * space.
+         */
+        if (mem == 0x8000000)
+                mem -= 0x1000;
+
         add_memory_region(0, mem, BOOT_MEM_RAM);
 }
 
diff --git a/arch/mips/mm/highmem.c b/arch/mips/mm/highmem.c
index e274fda329f4..127d732474bf 100644
--- a/arch/mips/mm/highmem.c
+++ b/arch/mips/mm/highmem.c
@@ -1,5 +1,6 @@
 #include <linux/module.h>
 #include <linux/highmem.h>
+#include <linux/sched.h>
 #include <linux/smp.h>
 #include <asm/fixmap.h>
 #include <asm/tlbflush.h>
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 524d9352f17e..f388dc68f605 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -18,7 +18,6 @@ config PARISC
         select BUG
         select HAVE_PERF_EVENTS
         select GENERIC_ATOMIC64 if !64BIT
-        select HAVE_ARCH_TRACEHOOK
         help
           The PA-RISC microprocessor is designed by Hewlett-Packard and used
           in many of their workstations & servers (HP9000 700 and 800 series,
diff --git a/arch/parisc/kernel/pci.c b/arch/parisc/kernel/pci.c
index f7064abc3bb6..9e74bfe071dc 100644
--- a/arch/parisc/kernel/pci.c
+++ b/arch/parisc/kernel/pci.c
@@ -18,7 +18,6 @@
 
 #include <asm/io.h>
 #include <asm/system.h>
-#include <asm/cache.h>          /* for L1_CACHE_BYTES */
 #include <asm/superio.h>
 
 #define DEBUG_RESOURCES 0
@@ -123,6 +122,10 @@ static int __init pcibios_init(void)
         } else {
                 printk(KERN_WARNING "pci_bios != NULL but init() is!\n");
         }
+
+        /* Set the CLS for PCI as early as possible. */
+        pci_cache_line_size = pci_dfl_cache_line_size;
+
         return 0;
 }
 
@@ -171,7 +174,7 @@ void pcibios_set_master(struct pci_dev *dev)
         ** upper byte is PCI_LATENCY_TIMER.
         */
         pci_write_config_word(dev, PCI_CACHE_LINE_SIZE,
-                                (0x80 << 8) | (L1_CACHE_BYTES / sizeof(u32)));
+                              (0x80 << 8) | pci_cache_line_size);
 }
 
 
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_mds.c b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
index 21f61b8c445b..cc29c0f5300d 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_mds.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_mds.c
@@ -338,7 +338,8 @@ static void __init mpc85xx_mds_pic_init(void)
         }
 
         mpic = mpic_alloc(np, r.start,
-                        MPIC_PRIMARY | MPIC_WANTS_RESET | MPIC_BIG_ENDIAN,
+                        MPIC_PRIMARY | MPIC_WANTS_RESET | MPIC_BIG_ENDIAN |
+                        MPIC_BROKEN_FRR_NIRQS,
                         0, 256, " OpenPIC  ");
         BUG_ON(mpic == NULL);
         of_node_put(np);
diff --git a/arch/powerpc/platforms/85xx/smp.c b/arch/powerpc/platforms/85xx/smp.c
index 04160a4cc699..a15f582300d8 100644
--- a/arch/powerpc/platforms/85xx/smp.c
+++ b/arch/powerpc/platforms/85xx/smp.c
@@ -46,6 +46,7 @@ smp_85xx_kick_cpu(int nr)
         __iomem u32 *bptr_vaddr;
         struct device_node *np;
         int n = 0;
+        int ioremappable;
 
         WARN_ON (nr < 0 || nr >= NR_CPUS);
 
@@ -59,21 +60,37 @@ smp_85xx_kick_cpu(int nr)
                 return;
         }
 
+        /*
+         * A secondary core could be in a spinloop in the bootpage
+         * (0xfffff000), somewhere in highmem, or somewhere in lowmem.
+         * The bootpage and highmem can be accessed via ioremap(), but
+         * we need to directly access the spinloop if its in lowmem.
+         */
+        ioremappable = *cpu_rel_addr > virt_to_phys(high_memory);
+
         /* Map the spin table */
-        bptr_vaddr = ioremap(*cpu_rel_addr, SIZE_BOOT_ENTRY);
+        if (ioremappable)
+                bptr_vaddr = ioremap(*cpu_rel_addr, SIZE_BOOT_ENTRY);
+        else
+                bptr_vaddr = phys_to_virt(*cpu_rel_addr);
 
         local_irq_save(flags);
 
         out_be32(bptr_vaddr + BOOT_ENTRY_PIR, nr);
         out_be32(bptr_vaddr + BOOT_ENTRY_ADDR_LOWER, __pa(__early_start));
 
+        if (!ioremappable)
+                flush_dcache_range((ulong)bptr_vaddr,
+                                (ulong)(bptr_vaddr + SIZE_BOOT_ENTRY));
+
         /* Wait a bit for the CPU to ack. */
         while ((__secondary_hold_acknowledge != nr) && (++n < 1000))
                 mdelay(1);
 
         local_irq_restore(flags);
 
-        iounmap(bptr_vaddr);
+        if (ioremappable)
+                iounmap(bptr_vaddr);
 
         pr_debug("waited %d msecs for CPU #%d.\n", n, nr);
 }
diff --git a/arch/sh/kernel/ptrace_64.c b/arch/sh/kernel/ptrace_64.c
index 873ebdc4f98e..b063eb8b18e3 100644
--- a/arch/sh/kernel/ptrace_64.c
+++ b/arch/sh/kernel/ptrace_64.c
@@ -133,6 +133,8 @@ void user_enable_single_step(struct task_struct *child)
         struct pt_regs *regs = child->thread.uregs;
 
         regs->sr |= SR_SSTEP;   /* auto-resetting upon exception */
+
+        set_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 void user_disable_single_step(struct task_struct *child)
@@ -140,6 +142,8 @@ void user_disable_single_step(struct task_struct *child)
         struct pt_regs *regs = child->thread.uregs;
 
         regs->sr &= ~SR_SSTEP;
+
+        clear_tsk_thread_flag(child, TIF_SINGLESTEP);
 }
 
 static int genregs_get(struct task_struct *target,
@@ -454,6 +458,8 @@ asmlinkage long long do_syscall_trace_enter(struct pt_regs *regs)
 
 asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
+        int step;
+
         if (unlikely(current->audit_context))
                 audit_syscall_exit(AUDITSC_RESULT(regs->regs[9]),
                                    regs->regs[9]);
@@ -461,8 +467,9 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
         if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
                 trace_sys_exit(regs, regs->regs[9]);
 
-        if (test_thread_flag(TIF_SYSCALL_TRACE))
-                tracehook_report_syscall_exit(regs, 0);
+        step = test_thread_flag(TIF_SINGLESTEP);
+        if (step || test_thread_flag(TIF_SYSCALL_TRACE))
+                tracehook_report_syscall_exit(regs, step);
 }
 
 /* Called with interrupts disabled */
diff --git a/arch/sh/kernel/signal_64.c b/arch/sh/kernel/signal_64.c
index ce76dbdef294..580e97d46ca5 100644
--- a/arch/sh/kernel/signal_64.c
+++ b/arch/sh/kernel/signal_64.c
@@ -118,7 +118,9 @@ static int do_signal(struct pt_regs *regs, sigset_t *oldset)
                          * clear the TS_RESTORE_SIGMASK flag.
                          */
                         current_thread_info()->status &= ~TS_RESTORE_SIGMASK;
-                        tracehook_signal_handler(signr, &info, &ka, regs, 0);
+
+                        tracehook_signal_handler(signr, &info, &ka, regs,
+                                        test_thread_flag(TIF_SINGLESTEP));
                         return 1;
                 }
         }
diff --git a/arch/sparc/include/asm/stat.h b/arch/sparc/include/asm/stat.h
index 55db5eca08e2..39327d6a57eb 100644
--- a/arch/sparc/include/asm/stat.h
+++ b/arch/sparc/include/asm/stat.h
@@ -53,8 +53,8 @@ struct stat {
         ino_t           st_ino;
         mode_t          st_mode;
         short           st_nlink;
-        uid_t           st_uid;
-        gid_t           st_gid;
+        uid16_t         st_uid;
+        gid16_t         st_gid;
         unsigned short  st_rdev;
         off_t           st_size;
         time_t          st_atime;
diff --git a/arch/sparc/kernel/kstack.h b/arch/sparc/kernel/kstack.h
index 4248d969272f..5247283d1c03 100644
--- a/arch/sparc/kernel/kstack.h
+++ b/arch/sparc/kernel/kstack.h
@@ -11,6 +11,10 @@ static inline bool kstack_valid(struct thread_info *tp, unsigned long sp)
 {
         unsigned long base = (unsigned long) tp;
 
+        /* Stack pointer must be 16-byte aligned.  */
+        if (sp & (16UL - 1))
+                return false;
+
         if (sp >= (base + sizeof(struct thread_info)) &&
             sp <= (base + THREAD_SIZE - sizeof(struct sparc_stackf)))
                 return true;
diff --git a/arch/sparc/kernel/of_device_32.c b/arch/sparc/kernel/of_device_32.c
index 4c26eb59e742..53a58b349849 100644
--- a/arch/sparc/kernel/of_device_32.c
+++ b/arch/sparc/kernel/of_device_32.c
@@ -105,7 +105,7 @@ static unsigned long of_bus_sbus_get_flags(const u32 *addr, unsigned long flags)
 
 static int of_bus_ambapp_match(struct device_node *np)
 {
-        return !strcmp(np->name, "ambapp");
+        return !strcmp(np->type, "ambapp");
 }
 
 static void of_bus_ambapp_count_cells(struct device_node *child,
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index 539e83f8e087..592b03d85167 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -247,6 +247,7 @@ static struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
                                          struct pci_bus *bus, int devfn)
 {
         struct dev_archdata *sd;
+        struct pci_slot *slot;
         struct of_device *op;
         struct pci_dev *dev;
         const char *type;
@@ -286,6 +287,11 @@ static struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
         dev->dev.bus = &pci_bus_type;
         dev->devfn = devfn;
         dev->multifunction = 0;         /* maybe a lie? */
+        set_pcie_port_type(dev);
+
+        list_for_each_entry(slot, &dev->bus->slots, list)
+                if (PCI_SLOT(dev->devfn) == slot->number)
+                        dev->slot = slot;
 
         dev->vendor = of_getintprop_default(node, "vendor-id", 0xffff);
         dev->device = of_getintprop_default(node, "device-id", 0xffff);
@@ -322,6 +328,7 @@ static struct pci_dev *of_create_pci_dev(struct pci_pbm_info *pbm,
 
         dev->current_state = 4;         /* unknown power state */
         dev->error_state = pci_channel_io_normal;
+        dev->dma_mask = 0xffffffff;
 
         if (!strcmp(node->name, "pci")) {
                 /* a PCI-PCI bridge */
diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
index 8c91d9b29a2f..db15d123f054 100644
--- a/arch/sparc/kernel/tsb.S
+++ b/arch/sparc/kernel/tsb.S
@@ -191,10 +191,12 @@ tsb_dtlb_load:
 
 tsb_itlb_load:
         /* Executable bit must be set.  */
-661:    andcc           %g5, _PAGE_EXEC_4U, %g0
-        .section        .sun4v_1insn_patch, "ax"
+661:    sethi           %hi(_PAGE_EXEC_4U), %g4
+        andcc           %g5, %g4, %g0
+        .section        .sun4v_2insn_patch, "ax"
         .word           661b
         andcc           %g5, _PAGE_EXEC_4V, %g0
+        nop
         .previous
 
         be,pn           %xcc, tsb_do_fault
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 1994d3f58443..f2ad2163109d 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -170,10 +170,7 @@ static inline void elf_common_init(struct thread_struct *t,
 }
 
 #define ELF_PLAT_INIT(_r, load_addr)                    \
-do {                                                    \
-        elf_common_init(&current->thread, _r, 0);       \
-        clear_thread_flag(TIF_IA32);                    \
-} while (0)
+        elf_common_init(&current->thread, _r, 0)
 
 #define COMPAT_ELF_PLAT_INIT(regs, load_addr)           \
         elf_common_init(&current->thread, regs, __USER_DS)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index fc801bab1b3b..b753ea59703a 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -450,6 +450,8 @@ struct thread_struct {
         struct perf_event       *ptrace_bps[HBP_NUM];
         /* Debug status used for traps, single steps, etc... */
         unsigned long           debugreg6;
+        /* Keep track of the exact dr7 value set by the user */
+        unsigned long           ptrace_dr7;
         /* Fault info: */
         unsigned long           cr2;
         unsigned long           trap_no;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index 0acbcdfa5ca4..af1c5833ff23 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -1344,14 +1344,6 @@ static struct dmi_system_id __initdata acpi_dmi_table[] = {
          },
         {
          .callback = force_acpi_ht,
-         .ident = "ASUS P2B-DS",
-         .matches = {
-                     DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
-                     DMI_MATCH(DMI_BOARD_NAME, "P2B-DS"),
-                     },
-         },
-        {
-         .callback = force_acpi_ht,
          .ident = "ASUS CUR-DLS",
          .matches = {
                      DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index 05d5fec64a94..bb6006e3e295 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -212,25 +212,6 @@ static int arch_check_va_in_kernelspace(unsigned long va, u8 hbp_len)
         return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
 }
 
-/*
- * Store a breakpoint's encoded address, length, and type.
- */
-static int arch_store_info(struct perf_event *bp)
-{
-        struct arch_hw_breakpoint *info = counter_arch_bp(bp);
-        /*
-         * For kernel-addresses, either the address or symbol name can be
-         * specified.
-         */
-        if (info->name)
-                info->address = (unsigned long)
-                                kallsyms_lookup_name(info->name);
-        if (info->address)
-                return 0;
-
-        return -EINVAL;
-}
-
 int arch_bp_generic_fields(int x86_len, int x86_type,
                            int *gen_len, int *gen_type)
 {
@@ -362,10 +343,13 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp,
                 return ret;
         }
 
-        ret = arch_store_info(bp);
-
-        if (ret < 0)
-                return ret;
+        /*
+         * For kernel-addresses, either the address or symbol name can be
+         * specified.
+         */
+        if (info->name)
+                info->address = (unsigned long)
+                                kallsyms_lookup_name(info->name);
         /*
          * Check that the low-order bits of the address are appropriate
          * for the alignment implied by len.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 41a26a82470a..126f0b493d04 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -527,6 +527,7 @@ void set_personality_ia32(void)
 
         /* Make sure to be in 32bit mode */
         set_thread_flag(TIF_IA32);
+        current->personality |= force_personality32;
 
         /* Prepare the first "return" to user space */
         current_thread_info()->status |= TS_COMPAT;
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 017d937639fe..0c1033d61e59 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -702,7 +702,7 @@ static unsigned long ptrace_get_debugreg(struct task_struct *tsk, int n)
         } else if (n == 6) {
                 val = thread->debugreg6;
          } else if (n == 7) {
-                val = ptrace_get_dr7(thread->ptrace_bps);
+                val = thread->ptrace_dr7;
         }
         return val;
 }
@@ -778,8 +778,11 @@ int ptrace_set_debugreg(struct task_struct *tsk, int n, unsigned long val)
                         return rc;
         }
         /* All that's left is DR7 */
-        if (n == 7)
+        if (n == 7) {
                 rc = ptrace_write_dr7(tsk, val);
+                if (!rc)
+                        thread->ptrace_dr7 = val;
+        }
 
 ret_path:
         return rc;
diff --git a/block/blk-core.c b/block/blk-core.c
index 718897e6d37f..d1a9a0a64f95 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1147,7 +1147,7 @@ void init_request_from_bio(struct request *req, struct bio *bio)
  */
 static inline bool queue_should_plug(struct request_queue *q)
 {
-        return !(blk_queue_nonrot(q) && blk_queue_queuing(q));
+        return !(blk_queue_nonrot(q) && blk_queue_tagged(q));
 }
 
 static int __make_request(struct request_queue *q, struct bio *bio)
@@ -1859,15 +1859,8 @@ void blk_dequeue_request(struct request *rq)
          * and to it is freed is accounted as io that is in progress at
          * the driver side.
          */
-        if (blk_account_rq(rq)) {
+        if (blk_account_rq(rq))
                 q->in_flight[rq_is_sync(rq)]++;
-                /*
-                 * Mark this device as supporting hardware queuing, if
-                 * we have more IOs in flight than 4.
-                 */
-                if (!blk_queue_queuing(q) && queue_in_flight(q) > 4)
-                        set_bit(QUEUE_FLAG_CQ, &q->queue_flags);
-        }
 }
 
 /**
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index bbc2c1315c47..b2586f57e1f5 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -935,6 +935,7 @@ static int dock_add(acpi_handle handle)
         struct platform_device *dd;
 
         id = dock_station_count;
+        memset(&ds, 0, sizeof(ds));
         dd = platform_device_register_data(NULL, "dock", id, &ds, sizeof(ds));
         if (IS_ERR(dd))
                 return PTR_ERR(dd);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 7c0441f63b39..cc978a8c00b7 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -110,6 +110,14 @@ static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
           DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
           DMI_MATCH(DMI_BIOS_VERSION,"SHE845M0.86C.0013.D.0302131307")},
          (void *)2},
+        { set_max_cstate, "Pavilion zv5000", {
+          DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+          DMI_MATCH(DMI_PRODUCT_NAME,"Pavilion zv5000 (DS502A#ABA)")},
+         (void *)1},
+        { set_max_cstate, "Asus L8400B", {
+          DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
+         (void *)1},
         {},
 };
 
@@ -872,12 +880,14 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
                 return(acpi_idle_enter_c1(dev, state));
 
         local_irq_disable();
-        current_thread_info()->status &= ~TS_POLLING;
-        /*
-         * TS_POLLING-cleared state must be visible before we test
-         * NEED_RESCHED:
-         */
-        smp_mb();
+        if (cx->entry_method != ACPI_CSTATE_FFH) {
+                current_thread_info()->status &= ~TS_POLLING;
+                /*
+                 * TS_POLLING-cleared state must be visible before we test
+                 * NEED_RESCHED:
+                 */
+                smp_mb();
+        }
 
         if (unlikely(need_resched())) {
                 current_thread_info()->status |= TS_POLLING;
@@ -957,12 +967,14 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
         }
 
         local_irq_disable();
-        current_thread_info()->status &= ~TS_POLLING;
-        /*
-         * TS_POLLING-cleared state must be visible before we test
-         * NEED_RESCHED:
-         */
-        smp_mb();
+        if (cx->entry_method != ACPI_CSTATE_FFH) {
+                current_thread_info()->status &= ~TS_POLLING;
+                /*
+                 * TS_POLLING-cleared state must be visible before we test
+                 * NEED_RESCHED:
+                 */
+                smp_mb();
+        }
 
         if (unlikely(need_resched())) {
                 current_thread_info()->status |= TS_POLLING;
diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
index 7247819dbd80..e306ba9aa34e 100644
--- a/drivers/acpi/processor_pdc.c
+++ b/drivers/acpi/processor_pdc.c
@@ -125,6 +125,8 @@ acpi_processor_eval_pdc(acpi_handle handle, struct acpi_object_list *pdc_in)
         return status;
 }
 
+static int early_pdc_done;
+
 void acpi_processor_set_pdc(acpi_handle handle)
 {
         struct acpi_object_list *obj_list;
@@ -132,6 +134,9 @@ void acpi_processor_set_pdc(acpi_handle handle)
         if (arch_has_acpi_pdc() == false)
                 return;
 
+        if (early_pdc_done)
+                return;
+
         obj_list = acpi_processor_alloc_pdc();
         if (!obj_list)
                 return;
@@ -151,6 +156,13 @@ static int set_early_pdc_optin(const struct dmi_system_id *id)
         return 0;
 }
 
+static int param_early_pdc_optin(char *s)
+{
+        early_pdc_optin = 1;
+        return 1;
+}
+__setup("acpi_early_pdc_eval", param_early_pdc_optin);
+
 static struct dmi_system_id __cpuinitdata early_pdc_optin_table[] = {
         {
         set_early_pdc_optin, "HP Envy", {
@@ -192,4 +204,6 @@ void __init acpi_early_processor_set_pdc(void)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             early_init_pdc, NULL, NULL, NULL);
+
+        early_pdc_done = 1;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 2cabadcc4d8c..a959f6a07508 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -413,7 +413,11 @@ static int acpi_processor_get_performance_info(struct acpi_processor *pr)
         if (result)
                 goto update_bios;
 
-        return 0;
+        /* We need to call _PPC once when cpufreq starts */
+        if (ignore_ppc != 1)
+                result = acpi_processor_get_platform_limit(pr);
+
+        return result;
 
         /*
          * Having _PPC but missing frequencies (_PSS, _PCT) is a very good hint that
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ff9f6226085d..3e009674f333 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1336,9 +1336,25 @@ static int acpi_bus_scan(acpi_handle handle, struct acpi_bus_ops *ops,
 
         if (child)
                 *child = device;
-        return 0;
+
+        if (device)
+                return 0;
+        else
+                return -ENODEV;
 }
 
+/*
+ * acpi_bus_add and acpi_bus_start
+ *
+ * scan a given ACPI tree and (probably recently hot-plugged)
+ * create and add or starts found devices.
+ *
+ * If no devices were found -ENODEV is returned which does not
+ * mean that this is a real error, there just have been no suitable
+ * ACPI objects in the table trunk from which the kernel could create
+ * a device and add/start an appropriate driver.
+ */
+
 int
 acpi_bus_add(struct acpi_device **child,
              struct acpi_device *parent, acpi_handle handle, int type)
@@ -1348,8 +1364,7 @@ acpi_bus_add(struct acpi_device **child,
         memset(&ops, 0, sizeof(ops));
         ops.acpi_op_add = 1;
 
-        acpi_bus_scan(handle, &ops, child);
-        return 0;
+        return acpi_bus_scan(handle, &ops, child);
 }
 EXPORT_SYMBOL(acpi_bus_add);
 
@@ -1357,11 +1372,13 @@ int acpi_bus_start(struct acpi_device *device)
 {
         struct acpi_bus_ops ops;
 
+        if (!device)
+                return -EINVAL;
+
         memset(&ops, 0, sizeof(ops));
         ops.acpi_op_start = 1;
 
-        acpi_bus_scan(device->handle, &ops, NULL);
-        return 0;
+        return acpi_bus_scan(device->handle, &ops, NULL);
 }
 EXPORT_SYMBOL(acpi_bus_start);
 
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index f336bca7c450..8a0ed2800e63 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -213,7 +213,7 @@ acpi_table_parse_entries(char *id,
         unsigned long table_end;
         acpi_size tbl_size;
 
-        if (acpi_disabled)
+        if (acpi_disabled && !acpi_ht)
                 return -ENODEV;
 
         if (!handler)
@@ -280,7 +280,7 @@ int __init acpi_table_parse(char *id, acpi_table_handler handler)
         struct acpi_table_header *table = NULL;
         acpi_size tbl_size;
 
-        if (acpi_disabled)
+        if (acpi_disabled && !acpi_ht)
                 return -ENODEV;
 
         if (!handler)
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 161746deab4b..6e2c3b064f53 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -59,6 +59,8 @@ static void class_release(struct kobject *kobj)
         else
                 pr_debug("class '%s' does not have a release() function, "
                          "be careful\n", class->name);
+
+        kfree(cp);
 }
 
 static struct sysfs_ops class_sysfs_ops = {
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index 27d20fac19d1..b314a999aabe 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -21,7 +21,7 @@
 
 #define DRV_NAME "cs5535-clockevt"
 
-static int timer_irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+static int timer_irq;
 module_param_named(irq, timer_irq, int, 0644);
 MODULE_PARM_DESC(irq, "Which IRQ to use for the clock source MFGPT ticks.");
 
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index cbaf420c36c5..2d3dc7ded0a9 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -893,20 +893,31 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
 
 static struct kmem_cache *fwnet_packet_task_cache;
 
+static void fwnet_free_ptask(struct fwnet_packet_task *ptask)
+{
+        dev_kfree_skb_any(ptask->skb);
+        kmem_cache_free(fwnet_packet_task_cache, ptask);
+}
+
 static int fwnet_send_packet(struct fwnet_packet_task *ptask);
 
 static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 {
-        struct fwnet_device *dev;
+        struct fwnet_device *dev = ptask->dev;
         unsigned long flags;
-
-        dev = ptask->dev;
+        bool free;
 
         spin_lock_irqsave(&dev->lock, flags);
-        list_del(&ptask->pt_link);
-        spin_unlock_irqrestore(&dev->lock, flags);
 
-        ptask->outstanding_pkts--; /* FIXME access inside lock */
+        ptask->outstanding_pkts--;
+
+        /* Check whether we or the networking TX soft-IRQ is last user. */
+        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+
+        if (ptask->outstanding_pkts == 0)
+                list_del(&ptask->pt_link);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
 
         if (ptask->outstanding_pkts > 0) {
                 u16 dg_size;
@@ -951,10 +962,10 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                         ptask->max_payload = skb->len + RFC2374_FRAG_HDR_SIZE;
                 }
                 fwnet_send_packet(ptask);
-        } else {
-                dev_kfree_skb_any(ptask->skb);
-                kmem_cache_free(fwnet_packet_task_cache, ptask);
         }
+
+        if (free)
+                fwnet_free_ptask(ptask);
 }
 
 static void fwnet_write_complete(struct fw_card *card, int rcode,
@@ -977,6 +988,7 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
         unsigned tx_len;
         struct rfc2734_header *bufhdr;
         unsigned long flags;
+        bool free;
 
         dev = ptask->dev;
         tx_len = ptask->max_payload;
@@ -1022,12 +1034,16 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                                 generation, SCODE_100, 0ULL, ptask->skb->data,
                                 tx_len + 8, fwnet_write_complete, ptask);
 
-                /* FIXME race? */
                 spin_lock_irqsave(&dev->lock, flags);
-                list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+
+                /* If the AT tasklet already ran, we may be last user. */
+                free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+                if (!free)
+                        list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+
                 spin_unlock_irqrestore(&dev->lock, flags);
 
-                return 0;
+                goto out;
         }
 
         fw_send_request(dev->card, &ptask->transaction,
@@ -1035,12 +1051,19 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                         ptask->generation, ptask->speed, ptask->fifo_addr,
                         ptask->skb->data, tx_len, fwnet_write_complete, ptask);
 
-        /* FIXME race? */
         spin_lock_irqsave(&dev->lock, flags);
-        list_add_tail(&ptask->pt_link, &dev->sent_list);
+
+        /* If the AT tasklet already ran, we may be last user. */
+        free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+        if (!free)
+                list_add_tail(&ptask->pt_link, &dev->sent_list);
+
         spin_unlock_irqrestore(&dev->lock, flags);
 
         dev->netdev->trans_start = jiffies;
+ out:
+        if (free)
+                fwnet_free_ptask(ptask);
 
         return 0;
 }
@@ -1298,6 +1321,8 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         spin_unlock_irqrestore(&dev->lock, flags);
 
         ptask->max_payload = max_payload;
+        INIT_LIST_HEAD(&ptask->pt_link);
+
         fwnet_send_packet(ptask);
 
         return NETDEV_TX_OK;
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 2345d4103fe6..43ebf337b131 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2101,11 +2101,6 @@ static int ohci_queue_iso_transmit(struct fw_iso_context *base,
         u32 payload_index, payload_end_index, next_page_index;
         int page, end_page, i, length, offset;
 
-        /*
-         * FIXME: Cycle lost behavior should be configurable: lose
-         * packet, retransmit or terminate..
-         */
-
         p = packet;
         payload_index = payload;
 
@@ -2135,6 +2130,14 @@ static int ohci_queue_iso_transmit(struct fw_iso_context *base,
         if (!p->skip) {
                 d[0].control   = cpu_to_le16(DESCRIPTOR_KEY_IMMEDIATE);
                 d[0].req_count = cpu_to_le16(8);
+                /*
+                 * Link the skip address to this descriptor itself.  This causes
+                 * a context to skip a cycle whenever lost cycles or FIFO
+                 * overruns occur, without dropping the data.  The application
+                 * should then decide whether this is an error condition or not.
+                 * FIXME:  Make the context's cycle-lost behaviour configurable?
+                 */
+                d[0].branch_address = cpu_to_le32(d_bus | z);
 
                 header = (__le32 *) &d[1];
                 header[0] = cpu_to_le32(IT_HEADER_SY(p->sy) |
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index f665b05592f3..ab6c97330412 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -598,6 +598,50 @@ struct drm_display_mode *drm_mode_std(struct drm_device *dev,
         return mode;
 }
 
+/*
+ * EDID is delightfully ambiguous about how interlaced modes are to be
+ * encoded.  Our internal representation is of frame height, but some
+ * HDTV detailed timings are encoded as field height.
+ *
+ * The format list here is from CEA, in frame size.  Technically we
+ * should be checking refresh rate too.  Whatever.
+ */
+static void
+drm_mode_do_interlace_quirk(struct drm_display_mode *mode,
+                            struct detailed_pixel_timing *pt)
+{
+        int i;
+        static const struct {
+                int w, h;
+        } cea_interlaced[] = {
+                { 1920, 1080 },
+                {  720,  480 },
+                { 1440,  480 },
+                { 2880,  480 },
+                {  720,  576 },
+                { 1440,  576 },
+                { 2880,  576 },
+        };
+        static const int n_sizes =
+                sizeof(cea_interlaced)/sizeof(cea_interlaced[0]);
+
+        if (!(pt->misc & DRM_EDID_PT_INTERLACED))
+                return;
+
+        for (i = 0; i < n_sizes; i++) {
+                if ((mode->hdisplay == cea_interlaced[i].w) &&
+                    (mode->vdisplay == cea_interlaced[i].h / 2)) {
+                        mode->vdisplay *= 2;
+                        mode->vsync_start *= 2;
+                        mode->vsync_end *= 2;
+                        mode->vtotal *= 2;
+                        mode->vtotal |= 1;
+                }
+        }
+
+        mode->flags |= DRM_MODE_FLAG_INTERLACE;
+}
+
 /**
  * drm_mode_detailed - create a new mode from an EDID detailed timing section
  * @dev: DRM device (needed to create new mode)
@@ -680,8 +724,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
 
         drm_mode_set_name(mode);
 
-        if (pt->misc & DRM_EDID_PT_INTERLACED)
-                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+        drm_mode_do_interlace_quirk(mode, pt);
 
         if (quirks & EDID_QUIRK_DETAILED_SYNC_PP) {
                 pt->misc |= DRM_EDID_PT_HSYNC_POSITIVE | DRM_EDID_PT_VSYNC_POSITIVE;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index cdec32977129..2ac074c8f5d2 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -405,7 +405,8 @@ struct drm_mm_node *drm_mm_search_free_in_range(const struct drm_mm *mm,
                                 wasted += alignment - tmp;
                 }
 
-                if (entry->size >= size + wasted) {
+                if (entry->size >= size + wasted &&
+                    (entry->start + wasted + size) <= end) {
                         if (!best_match)
                                 return entry;
                         if (entry->size < best_size) {
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 79beffcf5936..cf4cb3e9a0c2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -176,6 +176,8 @@ MODULE_DEVICE_TABLE(pci, pciidlist);
 
 static int i915_drm_freeze(struct drm_device *dev)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
         pci_save_state(dev->pdev);
 
         /* If KMS is active, we do the leavevt stuff here */
@@ -191,17 +193,12 @@ static int i915_drm_freeze(struct drm_device *dev)
 
         i915_save_state(dev);
 
-        return 0;
-}
-
-static void i915_drm_suspend(struct drm_device *dev)
-{
-        struct drm_i915_private *dev_priv = dev->dev_private;
-
         intel_opregion_free(dev, 1);
 
         /* Modeset on resume, not lid events */
         dev_priv->modeset_on_lid = 0;
+
+        return 0;
 }
 
 static int i915_suspend(struct drm_device *dev, pm_message_t state)
@@ -221,8 +218,6 @@ static int i915_suspend(struct drm_device *dev, pm_message_t state)
         if (error)
                 return error;
 
-        i915_drm_suspend(dev);
-
         if (state.event == PM_EVENT_SUSPEND) {
                 /* Shut down the device */
                 pci_disable_device(dev->pdev);
@@ -237,6 +232,10 @@ static int i915_drm_thaw(struct drm_device *dev)
         struct drm_i915_private *dev_priv = dev->dev_private;
         int error = 0;
 
+        i915_restore_state(dev);
+
+        intel_opregion_init(dev, 1);
+
         /* KMS EnterVT equivalent */
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                 mutex_lock(&dev->struct_mutex);
@@ -263,10 +262,6 @@ static int i915_resume(struct drm_device *dev)
 
         pci_set_master(dev->pdev);
 
-        i915_restore_state(dev);
-
-        intel_opregion_init(dev, 1);
-
         return i915_drm_thaw(dev);
 }
 
@@ -423,8 +418,6 @@ static int i915_pm_suspend(struct device *dev)
         if (error)
                 return error;
 
-        i915_drm_suspend(drm_dev);
-
         pci_disable_device(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
@@ -464,13 +457,8 @@ static int i915_pm_poweroff(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
         struct drm_device *drm_dev = pci_get_drvdata(pdev);
-        int error;
-
-        error = i915_drm_freeze(drm_dev);
-        if (!error)
-                i915_drm_suspend(drm_dev);
 
-        return error;
+        return i915_drm_freeze(drm_dev);
 }
 
 const struct dev_pm_ops i915_pm_ops = {
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b1d0acbae4e4..c2e8a45780d5 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -636,6 +636,13 @@ static const struct dmi_system_id bad_lid_status[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
                 },
         },
+        {
+                .ident = "Clevo M5x0N",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
+                        DMI_MATCH(DMI_BOARD_NAME, "M5x0N"),
+                },
+        },
         { }
 };
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 2cd0fad17dac..0e9cd1d49130 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -5861,13 +5861,12 @@ nouveau_bios_run_init_table(struct drm_device *dev, uint16_t table,
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nvbios *bios = &dev_priv->VBIOS;
         struct init_exec iexec = { true, false };
-        unsigned long flags;
 
-        spin_lock_irqsave(&bios->lock, flags);
+        mutex_lock(&bios->lock);
         bios->display.output = dcbent;
         parse_init_table(bios, table, &iexec);
         bios->display.output = NULL;
-        spin_unlock_irqrestore(&bios->lock, flags);
+        mutex_unlock(&bios->lock);
 }
 
 static bool NVInitVBIOS(struct drm_device *dev)
@@ -5876,7 +5875,7 @@ static bool NVInitVBIOS(struct drm_device *dev)
         struct nvbios *bios = &dev_priv->VBIOS;
 
         memset(bios, 0, sizeof(struct nvbios));
-        spin_lock_init(&bios->lock);
+        mutex_init(&bios->lock);
         bios->dev = dev;
 
         if (!NVShadowVBIOS(dev, bios->data))
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
index 68446fd4146b..fd94bd6dc264 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
@@ -205,7 +205,7 @@ struct nvbios {
         struct drm_device *dev;
         struct nouveau_bios_info pub;
 
-        spinlock_t lock;
+        struct mutex lock;
 
         uint8_t data[NV_PROM_SIZE];
         unsigned int length;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 5445cefdd03e..1c15ef37b71c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -583,6 +583,7 @@ struct drm_nouveau_private {
         uint64_t vm_end;
         struct nouveau_gpuobj *vm_vram_pt[NV50_VM_VRAM_NR];
         int vm_vram_pt_nr;
+        uint64_t vram_sys_base;
 
         /* the mtrr covering the FB */
         int fb_mtrr;
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 8f3a12f614ed..2dc09dbd817d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -285,53 +285,50 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
                         uint32_t flags, uint64_t phys)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
-        struct nouveau_gpuobj **pgt;
-        unsigned psz, pfl, pages;
-
-        if (virt >= dev_priv->vm_gart_base &&
-            (virt + size) < (dev_priv->vm_gart_base + dev_priv->vm_gart_size)) {
-                psz = 12;
-                pgt = &dev_priv->gart_info.sg_ctxdma;
-                pfl = 0x21;
-                virt -= dev_priv->vm_gart_base;
-        } else
-        if (virt >= dev_priv->vm_vram_base &&
-            (virt + size) < (dev_priv->vm_vram_base + dev_priv->vm_vram_size)) {
-                psz = 16;
-                pgt = dev_priv->vm_vram_pt;
-                pfl = 0x01;
-                virt -= dev_priv->vm_vram_base;
-        } else {
-                NV_ERROR(dev, "Invalid address: 0x%16llx-0x%16llx\n",
-                         virt, virt + size - 1);
-                return -EINVAL;
-        }
+        struct nouveau_gpuobj *pgt;
+        unsigned block;
+        int i;
 
-        pages = size >> psz;
+        virt = ((virt - dev_priv->vm_vram_base) >> 16) << 1;
+        size = (size >> 16) << 1;
+
+        phys |= ((uint64_t)flags << 32);
+        phys |= 1;
+        if (dev_priv->vram_sys_base) {
+                phys += dev_priv->vram_sys_base;
+                phys |= 0x30;
+        }
 
         dev_priv->engine.instmem.prepare_access(dev, true);
-        if (flags & 0x80000000) {
-                while (pages--) {
-                        struct nouveau_gpuobj *pt = pgt[virt >> 29];
-                        unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
+        while (size) {
+                unsigned offset_h = upper_32_bits(phys);
+                unsigned offset_l = lower_32_bits(phys);
+                unsigned pte, end;
+
+                for (i = 7; i >= 0; i--) {
+                        block = 1 << (i + 1);
+                        if (size >= block && !(virt & (block - 1)))
+                                break;
+                }
+                offset_l |= (i << 7);
 
-                        nv_wo32(dev, pt, pte++, 0x00000000);
-                        nv_wo32(dev, pt, pte++, 0x00000000);
+                phys += block << 15;
+                size -= block;
 
-                        virt += (1 << psz);
-                }
-        } else {
-                while (pages--) {
-                        struct nouveau_gpuobj *pt = pgt[virt >> 29];
-                        unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
-                        unsigned offset_h = upper_32_bits(phys) & 0xff;
-                        unsigned offset_l = lower_32_bits(phys);
+                while (block) {
+                        pgt = dev_priv->vm_vram_pt[virt >> 14];
+                        pte = virt & 0x3ffe;
 
-                        nv_wo32(dev, pt, pte++, offset_l | pfl);
-                        nv_wo32(dev, pt, pte++, offset_h | flags);
+                        end = pte + block;
+                        if (end > 16384)
+                                end = 16384;
+                        block -= (end - pte);
+                        virt  += (end - pte);
 
-                        phys += (1 << psz);
-                        virt += (1 << psz);
+                        while (pte < end) {
+                                nv_wo32(dev, pgt, pte++, offset_l);
+                                nv_wo32(dev, pgt, pte++, offset_h);
+                        }
                 }
         }
         dev_priv->engine.instmem.finish_access(dev);
@@ -356,7 +353,41 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
 void
 nv50_mem_vm_unbind(struct drm_device *dev, uint64_t virt, uint32_t size)
 {
-        nv50_mem_vm_bind_linear(dev, virt, size, 0x80000000, 0);
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        struct nouveau_gpuobj *pgt;
+        unsigned pages, pte, end;
+
+        virt -= dev_priv->vm_vram_base;
+        pages = (size >> 16) << 1;
+
+        dev_priv->engine.instmem.prepare_access(dev, true);
+        while (pages) {
+                pgt = dev_priv->vm_vram_pt[virt >> 29];
+                pte = (virt & 0x1ffe0000ULL) >> 15;
+
+                end = pte + pages;
+                if (end > 16384)
+                        end = 16384;
+                pages -= (end - pte);
+                virt  += (end - pte) << 15;
+
+                while (pte < end)
+                        nv_wo32(dev, pgt, pte++, 0);
+        }
+        dev_priv->engine.instmem.finish_access(dev);
+
+        nv_wr32(dev, 0x100c80, 0x00050001);
+        if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+                NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+                NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+                return;
+        }
+
+        nv_wr32(dev, 0x100c80, 0x00000001);
+        if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+                NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+                NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+        }
 }
 
 /*
diff --git a/drivers/gpu/drm/nouveau/nv04_dac.c b/drivers/gpu/drm/nouveau/nv04_dac.c
index d0e038d28948..1d73b15d70da 100644
--- a/drivers/gpu/drm/nouveau/nv04_dac.c
+++ b/drivers/gpu/drm/nouveau/nv04_dac.c
@@ -119,7 +119,7 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
                                                  struct drm_connector *connector)
 {
         struct drm_device *dev = encoder->dev;
-        uint8_t saved_seq1, saved_pi, saved_rpc1;
+        uint8_t saved_seq1, saved_pi, saved_rpc1, saved_cr_mode;
         uint8_t saved_palette0[3], saved_palette_mask;
         uint32_t saved_rtest_ctrl, saved_rgen_ctrl;
         int i;
@@ -135,6 +135,9 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
                 /* only implemented for head A for now */
                 NVSetOwner(dev, 0);
 
+        saved_cr_mode = NVReadVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX);
+        NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode | 0x80);
+
         saved_seq1 = NVReadVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX);
         NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1 & ~0x20);
 
@@ -203,6 +206,7 @@ out:
         NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX, saved_pi);
         NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX, saved_rpc1);
         NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1);
+        NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode);
 
         if (blue == 0x18) {
                 NV_INFO(dev, "Load detected on head A\n");
diff --git a/drivers/gpu/drm/nouveau/nv17_tv.c b/drivers/gpu/drm/nouveau/nv17_tv.c
index 58b917c3341b..21ac6e49b6ee 100644
--- a/drivers/gpu/drm/nouveau/nv17_tv.c
+++ b/drivers/gpu/drm/nouveau/nv17_tv.c
@@ -579,6 +579,8 @@ static void nv17_tv_restore(struct drm_encoder *encoder)
                                 nouveau_encoder(encoder)->restore.output);
 
         nv17_tv_state_load(dev, &to_tv_enc(encoder)->saved_state);
+
+        nouveau_encoder(encoder)->last_dpms = NV_DPMS_CLEARED;
 }
 
 static int nv17_tv_create_resources(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index 94400f777e7f..f0dc4e36ef05 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -76,6 +76,11 @@ nv50_instmem_init(struct drm_device *dev)
         for (i = 0x1700; i <= 0x1710; i += 4)
                 priv->save1700[(i-0x1700)/4] = nv_rd32(dev, i);
 
+        if (dev_priv->chipset == 0xaa || dev_priv->chipset == 0xac)
+                dev_priv->vram_sys_base = nv_rd32(dev, 0x100e10) << 12;
+        else
+                dev_priv->vram_sys_base = 0;
+
         /* Reserve the last MiB of VRAM, we should probably try to avoid
          * setting up the below tables over the top of the VBIOS image at
          * some point.
@@ -172,16 +177,28 @@ nv50_instmem_init(struct drm_device *dev)
          * We map the entire fake channel into the start of the PRAMIN BAR
          */
         ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, pt_size, 0x1000,
-                                                        0, &priv->pramin_pt);
+                                     0, &priv->pramin_pt);
         if (ret)
                 return ret;
 
-        for (i = 0, v = c_offset; i < pt_size; i += 8, v += 0x1000) {
-                if (v < (c_offset + c_size))
-                        BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v | 1);
-                else
-                        BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000009);
+        v = c_offset | 1;
+        if (dev_priv->vram_sys_base) {
+                v += dev_priv->vram_sys_base;
+                v |= 0x30;
+        }
+
+        i = 0;
+        while (v < dev_priv->vram_sys_base + c_offset + c_size) {
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v);
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
+                v += 0x1000;
+                i += 8;
+        }
+
+        while (i < pt_size) {
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000000);
                 BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
+                i += 8;
         }
 
         BAR0_WI32(chan->vm_pd, 0x00, priv->pramin_pt->instance | 0x63);
@@ -416,7 +433,9 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
-        uint32_t pte, pte_end, vram;
+        struct nouveau_gpuobj *pramin_pt = priv->pramin_pt->gpuobj;
+        uint32_t pte, pte_end;
+        uint64_t vram;
 
         if (!gpuobj->im_backing || !gpuobj->im_pramin || gpuobj->im_bound)
                 return -EINVAL;
@@ -424,20 +443,24 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
         NV_DEBUG(dev, "st=0x%0llx sz=0x%0llx\n",
                  gpuobj->im_pramin->start, gpuobj->im_pramin->size);
 
-        pte     = (gpuobj->im_pramin->start >> 12) << 3;
-        pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+        pte     = (gpuobj->im_pramin->start >> 12) << 1;
+        pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
         vram    = gpuobj->im_backing_start;
 
         NV_DEBUG(dev, "pramin=0x%llx, pte=%d, pte_end=%d\n",
                  gpuobj->im_pramin->start, pte, pte_end);
         NV_DEBUG(dev, "first vram page: 0x%08x\n", gpuobj->im_backing_start);
 
+        vram |= 1;
+        if (dev_priv->vram_sys_base) {
+                vram += dev_priv->vram_sys_base;
+                vram |= 0x30;
+        }
+
         dev_priv->engine.instmem.prepare_access(dev, true);
         while (pte < pte_end) {
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, vram | 1);
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
-
-                pte += 8;
+                nv_wo32(dev, pramin_pt, pte++, lower_32_bits(vram));
+                nv_wo32(dev, pramin_pt, pte++, upper_32_bits(vram));
                 vram += NV50_INSTMEM_PAGE_SIZE;
         }
         dev_priv->engine.instmem.finish_access(dev);
@@ -470,14 +493,13 @@ nv50_instmem_unbind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
         if (gpuobj->im_bound == 0)
                 return -EINVAL;
 
-        pte     = (gpuobj->im_pramin->start >> 12) << 3;
-        pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+        pte     = (gpuobj->im_pramin->start >> 12) << 1;
+        pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
 
         dev_priv->engine.instmem.prepare_access(dev, true);
         while (pte < pte_end) {
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, 0x00000009);
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
-                pte += 8;
+                nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
+                nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
         }
         dev_priv->engine.instmem.finish_access(dev);
 
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e3b44562d265..7f152f66f196 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -24,6 +24,7 @@
 
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #define ATOM_DEBUG
 
@@ -212,7 +213,9 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
         case ATOM_ARG_PS:
                 idx = U8(*ptr);
                 (*ptr)++;
-                val = le32_to_cpu(ctx->ps[idx]);
+                /* get_unaligned_le32 avoids unaligned accesses from atombios
+                 * tables, noticed on a DEC Alpha. */
+                val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
                 if (print)
                         DEBUG("PS[0x%02X,0x%04X]", idx, val);
                 break;
@@ -640,7 +643,7 @@ static void atom_op_delay(atom_exec_context *ctx, int *ptr, int arg)
         uint8_t count = U8((*ptr)++);
         SDEBUG("   count: %d\n", count);
         if (arg == ATOM_UNIT_MICROSEC)
-                schedule_timeout_uninterruptible(usecs_to_jiffies(count));
+                udelay(count);
         else
                 schedule_timeout_uninterruptible(msecs_to_jiffies(count));
 }
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index b32eeea5bb8b..99915a682d59 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -350,7 +350,7 @@ retry:
         atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         if (args.ucReplyStatus && !args.ucDataOutLen) {
-                if (args.ucReplyStatus == 0x20 && retry_count < 10)
+                if (args.ucReplyStatus == 0x20 && retry_count++ < 10)
                         goto retry;
                 DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x after %d retries\n",
                           req_bytes[1], req_bytes[0], req_bytes[2], req_bytes[3],
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index af1c3ca8a4cb..446b765ac72a 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -543,9 +543,6 @@ int r600_vb_ib_get(struct radeon_device *rdev)
 void r600_vb_ib_put(struct radeon_device *rdev)
 {
         radeon_fence_emit(rdev, rdev->r600_blit.vb_ib->fence);
-        mutex_lock(&rdev->ib_pool.mutex);
-        list_add_tail(&rdev->r600_blit.vb_ib->list, &rdev->ib_pool.scheduled_ibs);
-        mutex_unlock(&rdev->ib_pool.mutex);
         radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 6d5a711c2e91..75bcf35a0931 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -1428,9 +1428,12 @@ static void r700_gfx_init(struct drm_device *dev,
 
         gb_tiling_config |= R600_BANK_SWAPS(1);
 
-        backend_map = r700_get_tile_pipe_to_backend_map(dev_priv->r600_max_tile_pipes,
-                                                        dev_priv->r600_max_backends,
-                                                        (0xff << dev_priv->r600_max_backends) & 0xff);
+        if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV740)
+                backend_map = 0x28;
+        else
+                backend_map = r700_get_tile_pipe_to_backend_map(dev_priv->r600_max_tile_pipes,
+                                                                dev_priv->r600_max_backends,
+                                                                (0xff << dev_priv->r600_max_backends) & 0xff);
         gb_tiling_config |= R600_BACKEND_MAP(backend_map);
 
         cc_gc_shader_pipe_config =
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index f57480ba1355..c0356bb193e5 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -96,6 +96,7 @@ extern int radeon_audio;
  * symbol;
  */
 #define RADEON_MAX_USEC_TIMEOUT         100000  /* 100 ms */
+/* RADEON_IB_POOL_SIZE must be a power of 2 */
 #define RADEON_IB_POOL_SIZE             16
 #define RADEON_DEBUGFS_MAX_NUM_FILES    32
 #define RADEONFB_CONN_LIMIT             4
@@ -363,11 +364,12 @@ void radeon_irq_kms_sw_irq_put(struct radeon_device *rdev);
  */
 struct radeon_ib {
         struct list_head        list;
-        unsigned long           idx;
+        unsigned                idx;
         uint64_t                gpu_addr;
         struct radeon_fence     *fence;
-        uint32_t        *ptr;
+        uint32_t                *ptr;
         uint32_t                length_dw;
+        bool                    free;
 };
 
 /*
@@ -377,10 +379,9 @@ struct radeon_ib {
 struct radeon_ib_pool {
         struct mutex            mutex;
         struct radeon_bo        *robj;
-        struct list_head        scheduled_ibs;
         struct radeon_ib        ibs[RADEON_IB_POOL_SIZE];
         bool                    ready;
-        DECLARE_BITMAP(alloc_bm, RADEON_IB_POOL_SIZE);
+        unsigned                head_id;
 };
 
 struct radeon_cp {
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 2dcda6115874..4d8831548a5f 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -206,6 +206,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
         }
 
+        /* Asrock RS600 board lists the DVI port as HDMI */
+        if ((dev->pdev->device == 0x7941) &&
+            (dev->pdev->subsystem_vendor == 0x1849) &&
+            (dev->pdev->subsystem_device == 0x7941)) {
+                if ((*connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        *connector_type = DRM_MODE_CONNECTOR_DVID;
+        }
+
         /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
         if ((dev->pdev->device == 0x7941) &&
             (dev->pdev->subsystem_vendor == 0x147b) &&
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 238188540017..65f81942f399 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -780,7 +780,7 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                          * connected and the DVI port disconnected.  If the edid doesn't
                          * say HDMI, vice versa.
                          */
-                        if (radeon_connector->shared_ddc && connector_status_connected) {
+                        if (radeon_connector->shared_ddc && (ret == connector_status_connected)) {
                                 struct drm_device *dev = connector->dev;
                                 struct drm_connector *list_connector;
                                 struct radeon_connector *list_radeon_connector;
@@ -1060,8 +1060,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                         return;
                 }
                 if (radeon_connector->ddc_bus && i2c_bus->valid) {
-                        if (memcmp(&radeon_connector->ddc_bus->rec, i2c_bus,
-                                    sizeof(struct radeon_i2c_bus_rec)) == 0) {
+                        if (radeon_connector->ddc_bus->rec.i2c_id == i2c_bus->i2c_id) {
                                 radeon_connector->shared_ddc = true;
                                 shared_ddc = true;
                         }
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 1190148cf5e6..e9d085021c1f 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -86,7 +86,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                                                 &p->validated);
                 }
         }
-        return radeon_bo_list_validate(&p->validated, p->ib->fence);
+        return radeon_bo_list_validate(&p->validated);
 }
 
 int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
@@ -189,12 +189,10 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
 {
         unsigned i;
 
-        if (error && parser->ib) {
-                radeon_bo_list_unvalidate(&parser->validated,
-                                                parser->ib->fence);
-        } else {
-                radeon_bo_list_unreserve(&parser->validated);
+        if (!error && parser->ib) {
+                radeon_bo_list_fence(&parser->validated, parser->ib->fence);
         }
+        radeon_bo_list_unreserve(&parser->validated);
         for (i = 0; i < parser->nrelocs; i++) {
                 if (parser->relocs[i].gobj) {
                         mutex_lock(&parser->rdev->ddev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index e13785282a82..c57ad606504d 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -106,9 +106,10 @@
  * 1.29- R500 3D cmd buffer support
  * 1.30- Add support for occlusion queries
  * 1.31- Add support for num Z pipes from GET_PARAM
+ * 1.32- fixes for rv740 setup
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            31
+#define DRIVER_MINOR            32
 #define DRIVER_PATCHLEVEL       0
 
 enum radeon_cp_microcode_version {
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index d72a71bff218..f1da370928eb 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -306,11 +306,10 @@ void radeon_bo_list_unreserve(struct list_head *head)
         }
 }
 
-int radeon_bo_list_validate(struct list_head *head, void *fence)
+int radeon_bo_list_validate(struct list_head *head)
 {
         struct radeon_bo_list *lobj;
         struct radeon_bo *bo;
-        struct radeon_fence *old_fence = NULL;
         int r;
 
         r = radeon_bo_list_reserve(head);
@@ -334,32 +333,27 @@ int radeon_bo_list_validate(struct list_head *head, void *fence)
                 }
                 lobj->gpu_offset = radeon_bo_gpu_offset(bo);
                 lobj->tiling_flags = bo->tiling_flags;
-                if (fence) {
-                        old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
-                        bo->tbo.sync_obj = radeon_fence_ref(fence);
-                        bo->tbo.sync_obj_arg = NULL;
-                }
-                if (old_fence) {
-                        radeon_fence_unref(&old_fence);
-                }
         }
         return 0;
 }
 
-void radeon_bo_list_unvalidate(struct list_head *head, void *fence)
+void radeon_bo_list_fence(struct list_head *head, void *fence)
 {
         struct radeon_bo_list *lobj;
-        struct radeon_fence *old_fence;
-
-        if (fence)
-                list_for_each_entry(lobj, head, list) {
-                        old_fence = to_radeon_fence(lobj->bo->tbo.sync_obj);
-                        if (old_fence == fence) {
-                                lobj->bo->tbo.sync_obj = NULL;
-                                radeon_fence_unref(&old_fence);
-                        }
+        struct radeon_bo *bo;
+        struct radeon_fence *old_fence = NULL;
+
+        list_for_each_entry(lobj, head, list) {
+                bo = lobj->bo;
+                spin_lock(&bo->tbo.lock);
+                old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
+                bo->tbo.sync_obj = radeon_fence_ref(fence);
+                bo->tbo.sync_obj_arg = NULL;
+                spin_unlock(&bo->tbo.lock);
+                if (old_fence) {
+                        radeon_fence_unref(&old_fence);
                 }
-        radeon_bo_list_unreserve(head);
+        }
 }
 
 int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index a02f18011ad1..7ab43de1e244 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -156,8 +156,8 @@ extern void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
                                 struct list_head *head);
 extern int radeon_bo_list_reserve(struct list_head *head);
 extern void radeon_bo_list_unreserve(struct list_head *head);
-extern int radeon_bo_list_validate(struct list_head *head, void *fence);
-extern void radeon_bo_list_unvalidate(struct list_head *head, void *fence);
+extern int radeon_bo_list_validate(struct list_head *head);
+extern void radeon_bo_list_fence(struct list_head *head, void *fence);
 extern int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
                                 struct vm_area_struct *vma);
 extern int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 4d12b2d17b4d..6579eb4c1f28 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -41,68 +41,55 @@ int radeon_ib_get(struct radeon_device *rdev, struct radeon_ib **ib)
 {
         struct radeon_fence *fence;
         struct radeon_ib *nib;
-        unsigned long i;
-        int r = 0;
+        int r = 0, i, c;
 
         *ib = NULL;
         r = radeon_fence_create(rdev, &fence);
         if (r) {
-                DRM_ERROR("failed to create fence for new IB\n");
+                dev_err(rdev->dev, "failed to create fence for new IB\n");
                 return r;
         }
         mutex_lock(&rdev->ib_pool.mutex);
-        i = find_first_zero_bit(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
-        if (i < RADEON_IB_POOL_SIZE) {
-                set_bit(i, rdev->ib_pool.alloc_bm);
-                rdev->ib_pool.ibs[i].length_dw = 0;
-                *ib = &rdev->ib_pool.ibs[i];
-                mutex_unlock(&rdev->ib_pool.mutex);
-                goto out;
+        for (i = rdev->ib_pool.head_id, c = 0, nib = NULL; c < RADEON_IB_POOL_SIZE; c++, i++) {
+                i &= (RADEON_IB_POOL_SIZE - 1);
+                if (rdev->ib_pool.ibs[i].free) {
+                        nib = &rdev->ib_pool.ibs[i];
+                        break;
+                }
         }
-        if (list_empty(&rdev->ib_pool.scheduled_ibs)) {
-                /* we go do nothings here */
+        if (nib == NULL) {
+                /* This should never happen, it means we allocated all
+                 * IB and haven't scheduled one yet, return EBUSY to
+                 * userspace hoping that on ioctl recall we get better
+                 * luck
+                 */
+                dev_err(rdev->dev, "no free indirect buffer !\n");
                 mutex_unlock(&rdev->ib_pool.mutex);
-                DRM_ERROR("all IB allocated none scheduled.\n");
-                r = -EINVAL;
-                goto out;
+                radeon_fence_unref(&fence);
+                return -EBUSY;
         }
-        /* get the first ib on the scheduled list */
-        nib = list_entry(rdev->ib_pool.scheduled_ibs.next,
-                         struct radeon_ib, list);
-        if (nib->fence == NULL) {
-                /* we go do nothings here */
+        rdev->ib_pool.head_id = (nib->idx + 1) & (RADEON_IB_POOL_SIZE - 1);
+        nib->free = false;
+        if (nib->fence) {
                 mutex_unlock(&rdev->ib_pool.mutex);
-                DRM_ERROR("IB %lu scheduled without a fence.\n", nib->idx);
-                r = -EINVAL;
-                goto out;
-        }
-        mutex_unlock(&rdev->ib_pool.mutex);
-
-        r = radeon_fence_wait(nib->fence, false);
-        if (r) {
-                DRM_ERROR("radeon: IB(%lu:0x%016lX:%u)\n", nib->idx,
-                          (unsigned long)nib->gpu_addr, nib->length_dw);
-                DRM_ERROR("radeon: GPU lockup detected, fail to get a IB\n");
-                goto out;
+                r = radeon_fence_wait(nib->fence, false);
+                if (r) {
+                        dev_err(rdev->dev, "error waiting fence of IB(%u:0x%016lX:%u)\n",
+                                nib->idx, (unsigned long)nib->gpu_addr, nib->length_dw);
+                        mutex_lock(&rdev->ib_pool.mutex);
+                        nib->free = true;
+                        mutex_unlock(&rdev->ib_pool.mutex);
+                        radeon_fence_unref(&fence);
+                        return r;
+                }
+                mutex_lock(&rdev->ib_pool.mutex);
         }
         radeon_fence_unref(&nib->fence);
-
+        nib->fence = fence;
         nib->length_dw = 0;
-
-        /* scheduled list is accessed here */
-        mutex_lock(&rdev->ib_pool.mutex);
-        list_del(&nib->list);
-        INIT_LIST_HEAD(&nib->list);
         mutex_unlock(&rdev->ib_pool.mutex);
-
         *ib = nib;
-out:
-        if (r) {
-                radeon_fence_unref(&fence);
-        } else {
-                (*ib)->fence = fence;
-        }
-        return r;
+        return 0;
 }
 
 void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib **ib)
@@ -113,19 +100,10 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib **ib)
         if (tmp == NULL) {
                 return;
         }
-        mutex_lock(&rdev->ib_pool.mutex);
-        if (!list_empty(&tmp->list) && !radeon_fence_signaled(tmp->fence)) {
-                /* IB is scheduled & not signaled don't do anythings */
-                mutex_unlock(&rdev->ib_pool.mutex);
-                return;
-        }
-        list_del(&tmp->list);
-        INIT_LIST_HEAD(&tmp->list);
-        if (tmp->fence)
+        if (!tmp->fence->emited)
                 radeon_fence_unref(&tmp->fence);
-
-        tmp->length_dw = 0;
-        clear_bit(tmp->idx, rdev->ib_pool.alloc_bm);
+        mutex_lock(&rdev->ib_pool.mutex);
+        tmp->free = true;
         mutex_unlock(&rdev->ib_pool.mutex);
 }
 
@@ -135,7 +113,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
 
         if (!ib->length_dw || !rdev->cp.ready) {
                 /* TODO: Nothings in the ib we should report. */
-                DRM_ERROR("radeon: couldn't schedule IB(%lu).\n", ib->idx);
+                DRM_ERROR("radeon: couldn't schedule IB(%u).\n", ib->idx);
                 return -EINVAL;
         }
 
@@ -148,7 +126,8 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
         radeon_ring_ib_execute(rdev, ib);
         radeon_fence_emit(rdev, ib->fence);
         mutex_lock(&rdev->ib_pool.mutex);
-        list_add_tail(&ib->list, &rdev->ib_pool.scheduled_ibs);
+        /* once scheduled IB is considered free and protected by the fence */
+        ib->free = true;
         mutex_unlock(&rdev->ib_pool.mutex);
         radeon_ring_unlock_commit(rdev);
         return 0;
@@ -164,7 +143,6 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
         if (rdev->ib_pool.robj)
                 return 0;
         /* Allocate 1M object buffer */
-        INIT_LIST_HEAD(&rdev->ib_pool.scheduled_ibs);
         r = radeon_bo_create(rdev, NULL,  RADEON_IB_POOL_SIZE*64*1024,
                                 true, RADEON_GEM_DOMAIN_GTT,
                                 &rdev->ib_pool.robj);
@@ -195,9 +173,9 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
                 rdev->ib_pool.ibs[i].ptr = ptr + offset;
                 rdev->ib_pool.ibs[i].idx = i;
                 rdev->ib_pool.ibs[i].length_dw = 0;
-                INIT_LIST_HEAD(&rdev->ib_pool.ibs[i].list);
+                rdev->ib_pool.ibs[i].free = true;
         }
-        bitmap_zero(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
+        rdev->ib_pool.head_id = 0;
         rdev->ib_pool.ready = true;
         DRM_INFO("radeon: ib pool ready.\n");
         if (radeon_debugfs_ib_init(rdev)) {
@@ -214,7 +192,6 @@ void radeon_ib_pool_fini(struct radeon_device *rdev)
                 return;
         }
         mutex_lock(&rdev->ib_pool.mutex);
-        bitmap_zero(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
         if (rdev->ib_pool.robj) {
                 r = radeon_bo_reserve(rdev->ib_pool.robj, false);
                 if (likely(r == 0)) {
@@ -363,7 +340,7 @@ static int radeon_debugfs_ib_info(struct seq_file *m, void *data)
         if (ib == NULL) {
                 return 0;
         }
-        seq_printf(m, "IB %04lu\n", ib->idx);
+        seq_printf(m, "IB %04u\n", ib->idx);
         seq_printf(m, "IB fence %p\n", ib->fence);
         seq_printf(m, "IB size %05u dwords\n", ib->length_dw);
         for (i = 0; i < ib->length_dw; i++) {
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 5943d561fd1e..03021674d097 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -549,9 +549,12 @@ static void rv770_gpu_init(struct radeon_device *rdev)
 
         gb_tiling_config |= BANK_SWAPS(1);
 
-        backend_map = r700_get_tile_pipe_to_backend_map(rdev->config.rv770.max_tile_pipes,
-                                                        rdev->config.rv770.max_backends,
-                                                        (0xff << rdev->config.rv770.max_backends) & 0xff);
+        if (rdev->family == CHIP_RV740)
+                backend_map = 0x28;
+        else
+                backend_map = r700_get_tile_pipe_to_backend_map(rdev->config.rv770.max_tile_pipes,
+                                                                rdev->config.rv770.max_backends,
+                                                                (0xff << rdev->config.rv770.max_backends) & 0xff);
         gb_tiling_config |= BACKEND_MAP(backend_map);
 
         cc_gc_shader_pipe_config =
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 1a3e909b7bba..c7320ce4567d 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1020,6 +1020,12 @@ static int ttm_bo_mem_compat(struct ttm_placement *placement,
                              struct ttm_mem_reg *mem)
 {
         int i;
+        struct drm_mm_node *node = mem->mm_node;
+
+        if (node && placement->lpfn != 0 &&
+            (node->start < placement->fpfn ||
+             node->start + node->size > placement->lpfn))
+                return -1;
 
         for (i = 0; i < placement->num_placement; i++) {
                 if ((placement->placement[i] & mem->placement &
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index e2123af7775a..3d47a2c12322 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -196,14 +196,15 @@ EXPORT_SYMBOL(ttm_tt_populate);
 
 #ifdef CONFIG_X86
 static inline int ttm_tt_set_page_caching(struct page *p,
-                                          enum ttm_caching_state c_state)
+                                          enum ttm_caching_state c_old,
+                                          enum ttm_caching_state c_new)
 {
         int ret = 0;
 
         if (PageHighMem(p))
                 return 0;
 
-        if (get_page_memtype(p) != -1) {
+        if (c_old != tt_cached) {
                 /* p isn't in the default caching state, set it to
                  * writeback first to free its current memtype. */
 
@@ -212,16 +213,17 @@ static inline int ttm_tt_set_page_caching(struct page *p,
                         return ret;
         }
 
-        if (c_state == tt_wc)
+        if (c_new == tt_wc)
                 ret = set_memory_wc((unsigned long) page_address(p), 1);
-        else if (c_state == tt_uncached)
+        else if (c_new == tt_uncached)
                 ret = set_pages_uc(p, 1);
 
         return ret;
 }
 #else /* CONFIG_X86 */
 static inline int ttm_tt_set_page_caching(struct page *p,
-                                          enum ttm_caching_state c_state)
+                                          enum ttm_caching_state c_old,
+                                          enum ttm_caching_state c_new)
 {
         return 0;
 }
@@ -254,7 +256,9 @@ static int ttm_tt_set_caching(struct ttm_tt *ttm,
         for (i = 0; i < ttm->num_pages; ++i) {
                 cur_page = ttm->pages[i];
                 if (likely(cur_page != NULL)) {
-                        ret = ttm_tt_set_page_caching(cur_page, c_state);
+                        ret = ttm_tt_set_page_caching(cur_page,
+                                                      ttm->caching_state,
+                                                      c_state);
                         if (unlikely(ret != 0))
                                 goto out_err;
                 }
@@ -268,7 +272,7 @@ out_err:
         for (j = 0; j < i; ++j) {
                 cur_page = ttm->pages[j];
                 if (likely(cur_page != NULL)) {
-                        (void)ttm_tt_set_page_caching(cur_page,
+                        (void)ttm_tt_set_page_caching(cur_page, c_state,
                                                       ttm->caching_state);
                 }
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index a6e8f687fa64..0c9c0811f42d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -348,22 +348,19 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                  */
 
                 DRM_INFO("It appears like vesafb is loaded. "
-                         "Ignore above error if any. Entering stealth mode.\n");
+                         "Ignore above error if any.\n");
                 ret = pci_request_region(dev->pdev, 2, "vmwgfx stealth probe");
                 if (unlikely(ret != 0)) {
                         DRM_ERROR("Failed reserving the SVGA MMIO resource.\n");
                         goto out_no_device;
                 }
-                vmw_kms_init(dev_priv);
-                vmw_overlay_init(dev_priv);
-        } else {
-                ret = vmw_request_device(dev_priv);
-                if (unlikely(ret != 0))
-                        goto out_no_device;
-                vmw_kms_init(dev_priv);
-                vmw_overlay_init(dev_priv);
-                vmw_fb_init(dev_priv);
         }
+        ret = vmw_request_device(dev_priv);
+        if (unlikely(ret != 0))
+                goto out_no_device;
+        vmw_kms_init(dev_priv);
+        vmw_overlay_init(dev_priv);
+        vmw_fb_init(dev_priv);
 
         dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
         register_pm_notifier(&dev_priv->pm_nb);
@@ -406,17 +403,15 @@ static int vmw_driver_unload(struct drm_device *dev)
 
         unregister_pm_notifier(&dev_priv->pm_nb);
 
-        if (!dev_priv->stealth) {
-                vmw_fb_close(dev_priv);
-                vmw_kms_close(dev_priv);
-                vmw_overlay_close(dev_priv);
-                vmw_release_device(dev_priv);
-                pci_release_regions(dev->pdev);
-        } else {
-                vmw_kms_close(dev_priv);
-                vmw_overlay_close(dev_priv);
+        vmw_fb_close(dev_priv);
+        vmw_kms_close(dev_priv);
+        vmw_overlay_close(dev_priv);
+        vmw_release_device(dev_priv);
+        if (dev_priv->stealth)
                 pci_release_region(dev->pdev, 2);
-        }
+        else
+                pci_release_regions(dev->pdev);
+
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                 drm_irq_uninstall(dev_priv->dev);
         if (dev->devname == vmw_devname)
@@ -585,11 +580,6 @@ static int vmw_master_set(struct drm_device *dev,
         int ret = 0;
 
         DRM_INFO("Master set.\n");
-        if (dev_priv->stealth) {
-                ret = vmw_request_device(dev_priv);
-                if (unlikely(ret != 0))
-                        return ret;
-        }
 
         if (active) {
                 BUG_ON(active != &dev_priv->fbdev_master);
@@ -649,18 +639,11 @@ static void vmw_master_drop(struct drm_device *dev,
 
         ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
 
-        if (dev_priv->stealth) {
-                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
-                if (unlikely(ret != 0))
-                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
-                vmw_release_device(dev_priv);
-        }
         dev_priv->active_master = &dev_priv->fbdev_master;
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         ttm_vt_unlock(&dev_priv->fbdev_master.lock);
 
-        if (!dev_priv->stealth)
-                vmw_fb_on(dev_priv);
+        vmw_fb_on(dev_priv);
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index d69caf92ffe7..0897359b3e4e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -182,25 +182,19 @@ static int vmw_cmd_present_check(struct vmw_private *dev_priv,
         return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.sid);
 }
 
-static int vmw_cmd_dma(struct vmw_private *dev_priv,
-                       struct vmw_sw_context *sw_context,
-                       SVGA3dCmdHeader *header)
+static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
+                                   struct vmw_sw_context *sw_context,
+                                   SVGAGuestPtr *ptr,
+                                   struct vmw_dma_buffer **vmw_bo_p)
 {
-        uint32_t handle;
         struct vmw_dma_buffer *vmw_bo = NULL;
         struct ttm_buffer_object *bo;
-        struct vmw_surface *srf = NULL;
-        struct vmw_dma_cmd {
-                SVGA3dCmdHeader header;
-                SVGA3dCmdSurfaceDMA dma;
-        } *cmd;
+        uint32_t handle = ptr->gmrId;
         struct vmw_relocation *reloc;
-        int ret;
         uint32_t cur_validate_node;
         struct ttm_validate_buffer *val_buf;
+        int ret;
 
-        cmd = container_of(header, struct vmw_dma_cmd, header);
-        handle = cmd->dma.guest.ptr.gmrId;
         ret = vmw_user_dmabuf_lookup(sw_context->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
@@ -209,14 +203,14 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
         bo = &vmw_bo->base;
 
         if (unlikely(sw_context->cur_reloc >= VMWGFX_MAX_RELOCATIONS)) {
-                DRM_ERROR("Max number of DMA commands per submission"
+                DRM_ERROR("Max number relocations per submission"
                           " exceeded\n");
                 ret = -EINVAL;
                 goto out_no_reloc;
         }
 
         reloc = &sw_context->relocs[sw_context->cur_reloc++];
-        reloc->location = &cmd->dma.guest.ptr;
+        reloc->location = ptr;
 
         cur_validate_node = vmw_dmabuf_validate_node(bo, sw_context->cur_val_buf);
         if (unlikely(cur_validate_node >= VMWGFX_MAX_GMRS)) {
@@ -234,7 +228,89 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
                 list_add_tail(&val_buf->head, &sw_context->validate_nodes);
                 ++sw_context->cur_val_buf;
         }
+        *vmw_bo_p = vmw_bo;
+        return 0;
+
+out_no_reloc:
+        vmw_dmabuf_unreference(&vmw_bo);
+        vmw_bo_p = NULL;
+        return ret;
+}
+
+static int vmw_cmd_end_query(struct vmw_private *dev_priv,
+                             struct vmw_sw_context *sw_context,
+                             SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo;
+        struct vmw_query_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdEndQuery q;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_query_cmd, header);
+        ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+        if (unlikely(ret != 0))
+                return ret;
+
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->q.guestResult,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        vmw_dmabuf_unreference(&vmw_bo);
+        return 0;
+}
 
+static int vmw_cmd_wait_query(struct vmw_private *dev_priv,
+                              struct vmw_sw_context *sw_context,
+                              SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo;
+        struct vmw_query_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdWaitForQuery q;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_query_cmd, header);
+        ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+        if (unlikely(ret != 0))
+                return ret;
+
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->q.guestResult,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        vmw_dmabuf_unreference(&vmw_bo);
+        return 0;
+}
+
+
+static int vmw_cmd_dma(struct vmw_private *dev_priv,
+                       struct vmw_sw_context *sw_context,
+                       SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo = NULL;
+        struct ttm_buffer_object *bo;
+        struct vmw_surface *srf = NULL;
+        struct vmw_dma_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdSurfaceDMA dma;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_dma_cmd, header);
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->dma.guest.ptr,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        bo = &vmw_bo->base;
         ret = vmw_user_surface_lookup_handle(dev_priv, sw_context->tfile,
                                              cmd->dma.host.sid, &srf);
         if (ret) {
@@ -379,8 +455,8 @@ static vmw_cmd_func vmw_cmd_funcs[SVGA_3D_CMD_MAX] = {
         VMW_CMD_DEF(SVGA_3D_CMD_DRAW_PRIMITIVES, &vmw_cmd_draw),
         VMW_CMD_DEF(SVGA_3D_CMD_SETSCISSORRECT, &vmw_cmd_cid_check),
         VMW_CMD_DEF(SVGA_3D_CMD_BEGIN_QUERY, &vmw_cmd_cid_check),
-        VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_cid_check),
-        VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_cid_check),
+        VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_end_query),
+        VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_wait_query),
         VMW_CMD_DEF(SVGA_3D_CMD_PRESENT_READBACK, &vmw_cmd_ok),
         VMW_CMD_DEF(SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN,
                     &vmw_cmd_blt_surf_screen_check)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 4f4f6432be8b..a93367041cdc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -559,6 +559,9 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
         info->pixmap.scan_align = 1;
 #endif
 
+        info->aperture_base = vmw_priv->vram_start;
+        info->aperture_size = vmw_priv->vram_size;
+
         /*
          * Dirty & Deferred IO
          */
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 24b56dc54597..2f6cf69ecb39 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -961,7 +961,7 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
                 remaining -= 7;
                 pr_devel("client 0x%p called 'target'\n", priv);
                 /* if target is default */
-                if (!strncmp(kbuf, "default", 7))
+                if (!strncmp(curr_pos, "default", 7))
                         pdev = pci_dev_get(vga_default_device());
                 else {
                         if (!vga_pci_str_to_vars(curr_pos, remaining,
diff --git a/drivers/input/input-polldev.c b/drivers/input/input-polldev.c
index aa6713b4a988..291d9393d359 100644
--- a/drivers/input/input-polldev.c
+++ b/drivers/input/input-polldev.c
@@ -100,6 +100,12 @@ static void input_close_polled_device(struct input_dev *input)
         struct input_polled_dev *dev = input_get_drvdata(input);
 
         cancel_delayed_work_sync(&dev->work);
+        /*
+         * Clean up work struct to remove references to the workqueue.
+         * It may be destroyed by the next call. This causes problems
+         * at next device open-close in case of poll_interval == 0.
+         */
+        INIT_DELAYED_WORK(&dev->work, dev->work.work.func);
         input_polldev_stop_workqueue();
 
         if (dev->close)
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index d84a36e545f6..b54aee7cd9e3 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1161,9 +1161,17 @@ static int i8042_pm_restore(struct device *dev)
         return 0;
 }
 
+static int i8042_pm_thaw(struct device *dev)
+{
+        i8042_interrupt(0, NULL);
+
+        return 0;
+}
+
 static const struct dev_pm_ops i8042_pm_ops = {
         .suspend        = i8042_pm_reset,
         .resume         = i8042_pm_restore,
+        .thaw           = i8042_pm_thaw,
         .poweroff       = i8042_pm_reset,
         .restore        = i8042_pm_restore,
 };
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 09a5e7341bd5..5256123a5228 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -618,8 +618,8 @@ static int idealtek_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 #ifdef CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH
 static int general_touch_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
-        dev->x = ((pkt[2] & 0x0F) << 8) | pkt[1] ;
-        dev->y = ((pkt[4] & 0x0F) << 8) | pkt[3] ;
+        dev->x = (pkt[2] << 8) | pkt[1];
+        dev->y = (pkt[4] << 8) | pkt[3];
         dev->press = pkt[5] & 0xff;
         dev->touch = pkt[0] & 0x01;
 
@@ -809,9 +809,9 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
 #ifdef CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH
         [DEVTYPE_GENERAL_TOUCH] = {
                 .min_xc         = 0x0,
-                .max_xc         = 0x0500,
+                .max_xc         = 0x7fff,
                 .min_yc         = 0x0,
-                .max_yc         = 0x0500,
+                .max_yc         = 0x7fff,
                 .rept_size      = 7,
                 .read_data      = general_touch_read_data,
         },
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 54abf9e303b7..f1c8cae70b4b 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -172,11 +172,15 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
 {
         int r = 0;
         size_t dummy = 0;
-        int overhead_size =
-                sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
+        int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
         struct dm_ulog_request *tfr = prealloced_ulog_tfr;
         struct receiving_pkg pkg;
 
+        /*
+         * Given the space needed to hold the 'struct cn_msg' and
+         * 'struct dm_ulog_request' - do we have enough payload
+         * space remaining?
+         */
         if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
                 DMINFO("Size of tfr exceeds preallocated size");
                 return -EINVAL;
@@ -191,7 +195,7 @@ resend:
          */
         mutex_lock(&dm_ulog_lock);
 
-        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
+        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
         memcpy(tfr->uuid, uuid, DM_UUID_LEN);
         tfr->luid = luid;
         tfr->seq = dm_ulog_seq++;
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index ad779bd13aec..6c1046df81f6 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -724,7 +724,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         /*
          * Dispatch io.
          */
-        if (unlikely(ms->log_failure)) {
+        if (unlikely(ms->log_failure) && errors_handled(ms)) {
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->failures, &sync);
                 spin_unlock_irq(&ms->lock);
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 5f19ceb6fe91..168bd38f5006 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -660,10 +660,9 @@ void dm_rh_recovery_end(struct dm_region *reg, int success)
         spin_lock_irq(&rh->region_lock);
         if (success)
                 list_add(&reg->list, &reg->rh->recovered_regions);
-        else {
-                reg->state = DM_RH_NOSYNC;
+        else
                 list_add(&reg->list, &reg->rh->failed_recovered_regions);
-        }
+
         spin_unlock_irq(&rh->region_lock);
 
         rh->wakeup_workers(rh->context);
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 7d08879689ac..c097d8a4823d 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -254,7 +254,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
          * Issue the synchronous I/O from a different thread
          * to avoid generic_make_request recursion.
          */
-        INIT_WORK(&req.work, do_metadata);
+        INIT_WORK_ON_STACK(&req.work, do_metadata);
         queue_work(ps->metadata_wq, &req.work);
         flush_workqueue(ps->metadata_wq);
 
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index e0efc1adcaff..bd58703ee8f6 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
 
         stripes = simple_strtoul(argv[0], &end, 10);
-        if (*end) {
+        if (!stripes || *end) {
                 ti->error = "Invalid stripe count";
                 return -EINVAL;
         }
diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
index f53392df7b97..f91b40942e07 100644
--- a/drivers/md/dm-sysfs.c
+++ b/drivers/md/dm-sysfs.c
@@ -80,20 +80,12 @@ static struct sysfs_ops dm_sysfs_ops = {
 };
 
 /*
- * The sysfs structure is embedded in md struct, nothing to do here
- */
-static void dm_sysfs_release(struct kobject *kobj)
-{
-}
-
-/*
  * dm kobject is embedded in mapped_device structure
  * no need to define release function here
  */
 static struct kobj_type dm_ktype = {
         .sysfs_ops      = &dm_sysfs_ops,
         .default_attrs  = dm_attrs,
-        .release        = dm_sysfs_release
 };
 
 /*
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 3167480b532c..aa4e2aa86d49 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1595,10 +1595,15 @@ static int dm_prep_fn(struct request_queue *q, struct request *rq)
         return BLKPREP_OK;
 }
 
-static void map_request(struct dm_target *ti, struct request *clone,
-                        struct mapped_device *md)
+/*
+ * Returns:
+ * 0  : the request has been processed (not requeued)
+ * !0 : the request has been requeued
+ */
+static int map_request(struct dm_target *ti, struct request *clone,
+                       struct mapped_device *md)
 {
-        int r;
+        int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
         /*
@@ -1625,6 +1630,7 @@ static void map_request(struct dm_target *ti, struct request *clone,
         case DM_MAPIO_REQUEUE:
                 /* The target wants to requeue the I/O */
                 dm_requeue_unmapped_request(clone);
+                requeued = 1;
                 break;
         default:
                 if (r > 0) {
@@ -1636,6 +1642,8 @@ static void map_request(struct dm_target *ti, struct request *clone,
                 dm_kill_unmapped_request(clone, r);
                 break;
         }
+
+        return requeued;
 }
 
 /*
@@ -1677,12 +1685,17 @@ static void dm_request_fn(struct request_queue *q)
                 atomic_inc(&md->pending[rq_data_dir(clone)]);
 
                 spin_unlock(q->queue_lock);
-                map_request(ti, clone, md);
+                if (map_request(ti, clone, md))
+                        goto requeued;
+
                 spin_lock_irq(q->queue_lock);
         }
 
         goto out;
 
+requeued:
+        spin_lock_irq(q->queue_lock);
+
 plug_and_out:
         if (!elv_queue_empty(q))
                 /* Some requests still remain, retry later */
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 1b249897c9fb..465295b1d14b 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -112,11 +112,13 @@ config DVB_USB_CXUSB
         select DVB_MT352 if !DVB_FE_CUSTOMISE
         select DVB_ZL10353 if !DVB_FE_CUSTOMISE
         select DVB_DIB7000P if !DVB_FE_CUSTOMISE
-        select DVB_LGS8GL5 if !DVB_FE_CUSTOMISE
         select DVB_TUNER_DIB0070 if !DVB_FE_CUSTOMISE
+        select DVB_ATBM8830 if !DVB_FE_CUSTOMISE
+        select DVB_LGS8GXX if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_SIMPLE if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_MXL5005S if !MEDIA_TUNER_CUSTOMISE
+        select MEDIA_TUNER_MAX2165 if !MEDIA_TUNER_CUSTOMISE
         help
           Say Y here to support the Conexant USB2.0 hybrid reference design.
           Currently, only DVB and ATSC modes are supported, analog mode
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index 3051b64aa17c..445fa1068064 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -192,8 +192,8 @@ static int apply_frontend_param (struct dvb_frontend* fe, struct dvb_frontend_pa
         spi_bias *= qam_tab[p->constellation];
         spi_bias /= p->code_rate_HP + 1;
         spi_bias /= (guard_tab[p->guard_interval] + 32);
-        spi_bias *= 1000ULL;
-        spi_bias /= 1000ULL + ppm/1000;
+        spi_bias *= 1000;
+        spi_bias /= 1000 + ppm/1000;
         spi_bias *= p->code_rate_HP;
 
         val0x04 = (p->transmission_mode << 2) | p->guard_interval;
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 3182a406bdd1..ae08b077fd04 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -4461,6 +4461,7 @@ static int __devinit bttv_probe(struct pci_dev *dev,
                 request_modules(btv);
         }
 
+        init_bttv_i2c_ir(btv);
         bttv_input_init(btv);
 
         /* everything is fine */
diff --git a/drivers/media/video/bt8xx/bttv-i2c.c b/drivers/media/video/bt8xx/bttv-i2c.c
index 63aa31a041e8..407fa61e4cda 100644
--- a/drivers/media/video/bt8xx/bttv-i2c.c
+++ b/drivers/media/video/bt8xx/bttv-i2c.c
@@ -388,7 +388,12 @@ int __devinit init_bttv_i2c(struct bttv *btv)
         if (0 == btv->i2c_rc && i2c_scan)
                 do_i2c_scan(btv->c.v4l2_dev.name, &btv->i2c_client);
 
-        /* Instantiate the IR receiver device, if present */
+        return btv->i2c_rc;
+}
+
+/* Instantiate the I2C IR receiver device, if present */
+void __devinit init_bttv_i2c_ir(struct bttv *btv)
+{
         if (0 == btv->i2c_rc) {
                 struct i2c_board_info info;
                 /* The external IR receiver is at i2c address 0x34 (0x35 for
@@ -408,7 +413,6 @@ int __devinit init_bttv_i2c(struct bttv *btv)
                 strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
                 i2c_new_probed_device(&btv->c.i2c_adap, &info, addr_list);
         }
-        return btv->i2c_rc;
 }
 
 int __devexit fini_bttv_i2c(struct bttv *btv)
diff --git a/drivers/media/video/bt8xx/bttvp.h b/drivers/media/video/bt8xx/bttvp.h
index a1d0e9c9f286..6cccc2a17eee 100644
--- a/drivers/media/video/bt8xx/bttvp.h
+++ b/drivers/media/video/bt8xx/bttvp.h
@@ -279,6 +279,7 @@ extern unsigned int bttv_debug;
 extern unsigned int bttv_gpio;
 extern void bttv_gpio_tracking(struct bttv *btv, char *comment);
 extern int init_bttv_i2c(struct bttv *btv);
+extern void init_bttv_i2c_ir(struct bttv *btv);
 extern int fini_bttv_i2c(struct bttv *btv);
 
 #define bttv_printk if (bttv_verbose) printk
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c
index fc4dd6045720..7438f8d775ba 100644
--- a/drivers/media/video/mt9t112.c
+++ b/drivers/media/video/mt9t112.c
@@ -514,7 +514,7 @@ static int mt9t112_init_pll(const struct i2c_client *client)
         /* poll to verify out of standby. Must Poll this bit */
         for (i = 0; i < 100; i++) {
                 mt9t112_reg_read(data, client, 0x0018);
-                if (0x4000 & data)
+                if (!(0x4000 & data))
                         break;
 
                 mdelay(10);
diff --git a/drivers/media/video/pwc/pwc-ctrl.c b/drivers/media/video/pwc/pwc-ctrl.c
index 50b415e07eda..f7f7e04cf485 100644
--- a/drivers/media/video/pwc/pwc-ctrl.c
+++ b/drivers/media/video/pwc/pwc-ctrl.c
@@ -753,7 +753,7 @@ int pwc_set_shutter_speed(struct pwc_device *pdev, int mode, int value)
                 buf[0] = 0xff; /* fixed */
 
         ret = send_control_msg(pdev,
-                SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, sizeof(buf));
+                SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, 1);
 
         if (!mode && ret >= 0) {
                 if (value < 0)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index fee6eee7ae5b..006cb2efcd22 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -296,6 +296,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
         req_hdr->opcode = opcode;
         req_hdr->subsystem = subsystem;
         req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
+        req_hdr->version = 0;
 }
 
 static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index d29bb532eccf..765543663a4f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -4006,11 +4006,21 @@ check_page:
                         }
                 }
 
-                if (!buffer_info->dma)
+                if (!buffer_info->dma) {
                         buffer_info->dma = pci_map_page(pdev,
                                                         buffer_info->page, 0,
                                                         buffer_info->length,
                                                         PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                put_page(buffer_info->page);
+                                dev_kfree_skb(skb);
+                                buffer_info->page = NULL;
+                                buffer_info->skb = NULL;
+                                buffer_info->dma = 0;
+                                adapter->alloc_rx_buff_failed++;
+                                break; /* while !buffer_info->skb */
+                        }
+                }
 
                 rx_desc = E1000_RX_DESC(*rx_ring, i);
                 rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -4101,6 +4111,13 @@ map_skb:
                                                   skb->data,
                                                   buffer_info->length,
                                                   PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->dma = 0;
+                        adapter->alloc_rx_buff_failed++;
+                        break; /* while !buffer_info->skb */
+                }
 
                 /*
                  * XXX if it was allocated cleanly it will never map to a
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 3103f4165311..35a06b47587b 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -357,12 +357,34 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 fctrl_reg;
         u32 rmcs_reg;
         u32 reg;
+        u32 link_speed = 0;
+        bool link_up;
 
 #ifdef CONFIG_DCB
         if (hw->fc.requested_mode == ixgbe_fc_pfc)
                 goto out;
 
 #endif /* CONFIG_DCB */
+        /*
+         * On 82598 having Rx FC on causes resets while doing 1G
+         * so if it's on turn it off once we know link_speed. For
+         * more details see 82598 Specification update.
+         */
+        hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
+        if (link_up && link_speed == IXGBE_LINK_SPEED_1GB_FULL) {
+                switch (hw->fc.requested_mode) {
+                case ixgbe_fc_full:
+                        hw->fc.requested_mode = ixgbe_fc_tx_pause;
+                        break;
+                case ixgbe_fc_rx_pause:
+                        hw->fc.requested_mode = ixgbe_fc_none;
+                        break;
+                default:
+                        /* no change */
+                        break;
+                }
+        }
+
         /* Negotiate the fc mode to use */
         ret_val = ixgbe_fc_autoneg(hw);
         if (ret_val)
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 7b7c8486c0bf..951b73cf5ca2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5763,6 +5763,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (err)
                 goto err_sw_init;
 
+        /* Make it possible the adapter to be woken up via WOL */
+        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
+
         /*
          * If there is a fan on this device and it has failed log the
          * failure.
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 103e8b0e2a0d..46997e177ee3 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -2284,6 +2284,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
         efx_fini_struct(efx);
  fail1:
+        WARN_ON(rc > 0);
         EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
         free_netdev(net_dev);
         return rc;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index bf0b96af5334..5712fddd72f2 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -29,6 +29,15 @@
 #define FALCON_BOARD_SFN4111T 0x51
 #define FALCON_BOARD_SFN4112F 0x52
 
+/* Board temperature is about 15°C above ambient when air flow is
+ * limited. */
+#define FALCON_BOARD_TEMP_BIAS  15
+
+/* SFC4000 datasheet says: 'The maximum permitted junction temperature
+ * is 125°C; the thermal design of the environment for the SFC4000
+ * should aim to keep this well below 100°C.' */
+#define FALCON_JUNC_TEMP_MAX    90
+
 /*****************************************************************************
  * Support for LM87 sensor chip used on several boards
  */
@@ -548,16 +557,16 @@ fail_hwmon:
 static u8 sfe4002_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfe4002_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(3, 0xb0, 0xc9),          /* 5V:    4.6-5.2V */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(0, 0xa0, 0xb2),         /* AIN1:  1.66V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(3, 0xac, 0xd4),          /* 5V:    5.0V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(0, 0x98, 0xbb),         /* AIN1:  1.66V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 80 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
@@ -619,14 +628,14 @@ static int sfe4002_init(struct efx_nic *efx)
 static u8 sfn4112f_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfn4112f_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 60 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 9f035b9f0350..f66b3da6ddff 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -127,7 +127,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         efx_dword_t reg;
 
         /* Check for a reboot atomically with respect to efx_mcdi_copyout() */
-        rc = efx_mcdi_poll_reboot(efx);
+        rc = -efx_mcdi_poll_reboot(efx);
         if (rc)
                 goto out;
 
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index e0d13a451019..67eec7a6e487 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -320,7 +320,7 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
         falcon_board(efx)->type->init_phy(efx);
 
-        return rc;
+        return 0;
 
  fail:
         EFX_ERR(efx, "PHY reset timed out\n");
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 75a669d48e5e..d71c1976072e 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1437,7 +1437,6 @@ static int tc35815_do_interrupt(struct net_device *dev, u32 status, int limit)
                 /* Transmit complete. */
                 lp->lstats.tx_ints++;
                 tc35815_txdone(dev);
-                netif_wake_queue(dev);
                 if (ret < 0)
                         ret = 0;
         }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 4f27f022fbf7..5f3b9eaeb04f 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -584,6 +584,11 @@ static const struct usb_device_id	products [] = {
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &mbm_info,
 }, {
+        /* Ericsson C3607w ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190b, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &mbm_info,
+}, {
         /* Toshiba F3507g */
         USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index c93f58f5c6f2..317aa34b21cf 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1877,13 +1877,12 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *      tx_srv          -       transmit interrupt service
  *      @vptr; Velocity
- *      @status:
  *
  *      Scan the queues looking for transmitted packets that
  *      we can complete and clean up. Update any statistics as
  *      necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
+static int velocity_tx_srv(struct velocity_info *vptr)
 {
         struct tx_desc *td;
         int qnum;
@@ -2090,14 +2089,12 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *      velocity_rx_srv         -       service RX interrupt
  *      @vptr: velocity
- *      @status: adapter status (unused)
  *
  *      Walk the receive ring of the velocity adapter and remove
  *      any received packets from the receive queue. Hand the ring
  *      slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int status,
-                int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
 {
         struct net_device_stats *stats = &vptr->dev->stats;
         int rd_curr = vptr->rx.curr;
@@ -2151,32 +2148,24 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         struct velocity_info *vptr = container_of(napi,
                         struct velocity_info, napi);
         unsigned int rx_done;
-        u32 isr_status;
-
-        spin_lock(&vptr->lock);
-        isr_status = mac_read_isr(vptr->mac_regs);
-
-        /* Ack the interrupt */
-        mac_write_isr(vptr->mac_regs, isr_status);
-        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-                velocity_error(vptr, isr_status);
+        unsigned long flags;
 
+        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
-        velocity_tx_srv(vptr, isr_status);
-        rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
-        velocity_tx_srv(vptr, isr_status);
-
-        spin_unlock(&vptr->lock);
+        rx_done = velocity_rx_srv(vptr, budget / 2);
+        velocity_tx_srv(vptr);
+        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        velocity_tx_srv(vptr);
 
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
                 mac_enable_int(vptr->mac_regs);
         }
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return rx_done;
 }
@@ -2206,10 +2195,17 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
                 return IRQ_NONE;
         }
 
+        /* Ack the interrupt */
+        mac_write_isr(vptr->mac_regs, isr_status);
+
         if (likely(napi_schedule_prep(&vptr->napi))) {
                 mac_disable_int(vptr->mac_regs);
                 __napi_schedule(&vptr->napi);
         }
+
+        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+                velocity_error(vptr, isr_status);
+
         spin_unlock(&vptr->lock);
 
         return IRQ_HANDLED;
@@ -3100,7 +3096,7 @@ static int velocity_resume(struct pci_dev *pdev)
         velocity_init_registers(vptr, VELOCITY_INIT_WOL);
         mac_disable_int(vptr->mac_regs);
 
-        velocity_tx_srv(vptr, 0);
+        velocity_tx_srv(vptr);
 
         for (i = 0; i < vptr->tx.numq; i++) {
                 if (vptr->tx.used[i])
@@ -3344,6 +3340,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
         struct velocity_info *vptr = netdev_priv(dev);
         int max_us = 0x3f * 64;
+        unsigned long flags;
 
         /* 6 bits of  */
         if (ecmd->tx_coalesce_usecs > max_us)
@@ -3365,6 +3362,7 @@ static int velocity_set_coalesce(struct net_device *dev,
                         ecmd->tx_coalesce_usecs);
 
         /* Setup the interrupt suppression and queue timers */
+        spin_lock_irqsave(&vptr->lock, flags);
         mac_disable_int(vptr->mac_regs);
         setup_adaptive_interrupts(vptr);
         setup_queue_timers(vptr);
@@ -3372,6 +3370,7 @@ static int velocity_set_coalesce(struct net_device *dev,
         mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
         mac_clear_isr(vptr->mac_regs);
         mac_enable_int(vptr->mac_regs);
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index fa12b9060b0b..29bf33692f71 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1615,7 +1615,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf) && !is_pae(skb))
+        if (conf_is_ht(&hw->conf))
                 bf->bf_state.bf_type |= BUF_HT;
 
         bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1701,7 +1701,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fe3bf9491997..c484cc253892 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -115,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4c41cfe44f26..490fb45d1d05 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -628,10 +628,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 9b4b8b5c7574..31462813bac0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2008,7 +2008,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index de45f308b744..cffaae772d51 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1125,7 +1125,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                         scd_ssn , index, txq_id, txq->swq_id);
 
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -1153,16 +1153,14 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                    tx_resp->failure_frame);
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
 
-        if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5461f105bd2d..f36f804804fc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2745,6 +2745,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         priv->staging_rxon.flags = 0;
 
                 iwl_set_rxon_channel(priv, conf->channel);
+                iwl_set_rxon_ht(priv, ht_conf);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
                 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 27ca859e7453..b69e972671b2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -446,6 +446,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
 int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 6f36b6e79f5e..2dbce85404aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -928,7 +928,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
         if (ieee80211_is_mgmt(fc) ||
             ieee80211_has_protected(fc) ||
             ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
+            (ieee80211_is_data_qos(fc) &&
+             *ieee80211_get_qos_ctl(hdr) &
+             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
                 ret = skb_linearize(skb);
         else
                 ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 87ce2bd292c7..8f4071562857 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -120,6 +120,20 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
 
 
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed)
+{
+        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+        else {
+                IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
+                        priv->stations[sta_id].tid[tid].tfds_in_queue,
+                        freed);
+                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+        }
+}
+EXPORT_SYMBOL(iwl_free_tfds_in_queue);
+
 /**
  * iwl_tx_queue_free - Deallocate DMA queue.
  * @txq: Transmit queue to deallocate.
@@ -1131,6 +1145,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
         struct iwl_queue *q = &txq->q;
         struct iwl_tx_info *tx_info;
         int nfreed = 0;
+        struct ieee80211_hdr *hdr;
 
         if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
@@ -1145,13 +1160,16 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
 
                 tx_info = &txq->txb[txq->q.read_ptr];
                 iwl_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
                 tx_info->skb[0] = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
                         priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-                nfreed++;
         }
         return nfreed;
 }
@@ -1559,7 +1577,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
         if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
                 /* calculate mac80211 ampdu sw queue to wake */
                 int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 6d6ed7485175..f727b4a83196 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -794,7 +794,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         }
 
         bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss) {
+        if (!bss->bss) {
                 kfree(bss);
                 IWM_ERR(iwm, "Couldn't allocate bss\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index bc5726dd5fe4..7ba3052b0708 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -65,6 +65,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
         /* Sphairon Access Systems GmbH */
         {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
         /* Dick Smith Electronics */
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 8e952fdab764..cb2fd01eddae 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -720,12 +720,6 @@ static int acpiphp_bus_add(struct acpiphp_func *func)
                         -ret_val);
                 goto acpiphp_bus_add_out;
         }
-        /*
-         * try to start anyway.  We could have failed to add
-         * simply because this bus had previously been added
-         * on another add.  Don't bother with the return value
-         * we just keep going.
-         */
         ret_val = acpi_bus_start(device);
 
 acpiphp_bus_add_out:
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 07d14dfdf0b4..226b3e93498c 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -934,7 +934,7 @@ static int __devinit acer_backlight_init(struct device *dev)
         acer_backlight_device = bd;
 
         bd->props.power = FB_BLANK_UNBLANK;
-        bd->props.brightness = max_brightness;
+        bd->props.brightness = read_brightness(bd);
         bd->props.max_brightness = max_brightness;
         backlight_update_status(bd);
         return 0;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index e67e4feb35cb..eb603f1d55ca 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -5771,7 +5771,7 @@ static void thermal_exit(void)
         case TPACPI_THERMAL_ACPI_TMP07:
         case TPACPI_THERMAL_ACPI_UPDT:
                 sysfs_remove_group(&tpacpi_sensors_pdev->dev.kobj,
-                                   &thermal_temp_input16_group);
+                                   &thermal_temp_input8_group);
                 break;
         case TPACPI_THERMAL_NONE:
         default:
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 477542602284..9e71ac611146 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2516,7 +2516,7 @@ int fas216_eh_device_reset(struct scsi_cmnd *SCpnt)
                 if (info->scsi.phase == PHASE_IDLE)
                         fas216_kick(info);
 
-                mod_timer(&info->eh_timer, 30 * HZ);
+                mod_timer(&info->eh_timer, jiffies + 30 * HZ);
                 spin_unlock_irqrestore(&info->host_lock, flags);
 
                 /*
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 10be9f36a4cc..2f47ae7cce91 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -2009,6 +2009,8 @@ static int fcoe_destroy(const char *buffer, struct kernel_param *kp)
         fcoe_interface_cleanup(fcoe);
         rtnl_unlock();
         fcoe_if_destroy(fcoe->ctlr.lp);
+        module_put(THIS_MODULE);
+
 out_putdev:
         dev_put(netdev);
 out_nodev:
@@ -2059,6 +2061,11 @@ static int fcoe_create(const char *buffer, struct kernel_param *kp)
         }
 #endif
 
+        if (!try_module_get(THIS_MODULE)) {
+                rc = -EINVAL;
+                goto out_nomod;
+        }
+
         rtnl_lock();
         netdev = fcoe_if_to_netdev(buffer);
         if (!netdev) {
@@ -2099,17 +2106,24 @@ static int fcoe_create(const char *buffer, struct kernel_param *kp)
         if (!fcoe_link_ok(lport))
                 fcoe_ctlr_link_up(&fcoe->ctlr);
 
-        rc = 0;
-out_free:
         /*
          * Release from init in fcoe_interface_create(), on success lport
          * should be holding a reference taken in fcoe_if_create().
          */
         fcoe_interface_put(fcoe);
+        dev_put(netdev);
+        rtnl_unlock();
+        mutex_unlock(&fcoe_config_mutex);
+
+        return 0;
+out_free:
+        fcoe_interface_put(fcoe);
 out_putdev:
         dev_put(netdev);
 out_nodev:
         rtnl_unlock();
+        module_put(THIS_MODULE);
+out_nomod:
         mutex_unlock(&fcoe_config_mutex);
         return rc;
 }
diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
index 9823291395ad..511cb6b371ee 100644
--- a/drivers/scsi/fcoe/libfcoe.c
+++ b/drivers/scsi/fcoe/libfcoe.c
@@ -1187,7 +1187,7 @@ static void fcoe_ctlr_timeout(unsigned long arg)
                         next_timer = fip->ctlr_ka_time;
 
                 if (time_after_eq(jiffies, fip->port_ka_time)) {
-                        fip->port_ka_time += jiffies +
+                        fip->port_ka_time = jiffies +
                                 msecs_to_jiffies(FIP_VN_KA_PERIOD);
                         fip->send_port_ka = 1;
                 }
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 19d711cb938c..7f4364770e4a 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -1890,7 +1890,7 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
         fc_exch_setup_hdr(ep, fp, ep->f_ctl);
         sp->cnt++;
 
-        if (ep->xid <= lport->lro_xid)
+        if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD)
                 fc_fcp_ddp_setup(fr_fsp(fp), ep->xid);
 
         if (unlikely(lport->tt.frame_send(lport, fp)))
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 881d5dfe8c74..6fde2fabfd9b 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -298,9 +298,6 @@ void fc_fcp_ddp_setup(struct fc_fcp_pkt *fsp, u16 xid)
 {
         struct fc_lport *lport;
 
-        if (!fsp)
-                return;
-
         lport = fsp->lp;
         if ((fsp->req_flags & FC_SRB_READ) &&
             (lport->lro_enabled) && (lport->tt.ddp_setup)) {
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 0b165024a219..7ec8ce75007c 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1800,7 +1800,8 @@ int fc_lport_bsg_request(struct fc_bsg_job *job)
         u32 did;
 
         job->reply->reply_payload_rcv_len = 0;
-        rsp->resid_len = job->reply_payload.payload_len;
+        if (rsp)
+                rsp->resid_len = job->reply_payload.payload_len;
 
         mutex_lock(&lport->lp_mutex);
 
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 02300523b234..97923bb07765 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -623,7 +623,7 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
                 tov = ntohl(plp->fl_csp.sp_e_d_tov);
                 if (ntohs(plp->fl_csp.sp_features) & FC_SP_FT_EDTR)
-                        tov /= 1000;
+                        tov /= 1000000;
                 if (tov > rdata->e_d_tov)
                         rdata->e_d_tov = tov;
                 csp_seq = ntohs(plp->fl_csp.sp_tot_seq);
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index db6856c138fc..4ad87fd74ddd 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -992,12 +992,10 @@ static struct iscsi_r2t_info *iscsi_tcp_get_curr_r2t(struct iscsi_task *task)
                 if (r2t == NULL) {
                         if (kfifo_out(&tcp_task->r2tqueue,
                             (void *)&tcp_task->r2t, sizeof(void *)) !=
-                            sizeof(void *)) {
-                                WARN_ONCE(1, "unexpected fifo state");
+                            sizeof(void *))
                                 r2t = NULL;
-                        }
-
-                        r2t = tcp_task->r2t;
+                        else
+                                r2t = tcp_task->r2t;
                 }
                 spin_unlock_bh(&session->lock);
         }
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index 708ea3157b60..d9b8ca5116bc 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -3781,6 +3781,7 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
             compat_alloc_user_space(sizeof(struct megasas_iocpacket));
         int i;
         int error = 0;
+        compat_uptr_t ptr;
 
         if (clear_user(ioc, sizeof(*ioc)))
                 return -EFAULT;
@@ -3793,9 +3794,22 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
             copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))
                 return -EFAULT;
 
-        for (i = 0; i < MAX_IOCTL_SGE; i++) {
-                compat_uptr_t ptr;
+        /*
+         * The sense_ptr is used in megasas_mgmt_fw_ioctl only when
+         * sense_len is not null, so prepare the 64bit value under
+         * the same condition.
+         */
+        if (ioc->sense_len) {
+                void __user **sense_ioc_ptr =
+                        (void __user **)(ioc->frame.raw + ioc->sense_off);
+                compat_uptr_t *sense_cioc_ptr =
+                        (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
+                if (get_user(ptr, sense_cioc_ptr) ||
+                    put_user(compat_ptr(ptr), sense_ioc_ptr))
+                        return -EFAULT;
+        }
 
+        for (i = 0; i < MAX_IOCTL_SGE; i++) {
                 if (get_user(ptr, &cioc->sgl[i].iov_base) ||
                     put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||
                     copy_in_user(&ioc->sgl[i].iov_len,
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index c3e37c8e7e26..e9b15c3746fa 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -83,6 +83,9 @@ static unsigned int skip_txen_test; /* force skip of txen test at init time */
 
 #define PASS_LIMIT      256
 
+#define BOTH_EMPTY      (UART_LSR_TEMT | UART_LSR_THRE)
+
+
 /*
  * We default to IRQ0 for the "no irq" hack.   Some
  * machine types want others as well - they're free
@@ -1792,7 +1795,7 @@ static unsigned int serial8250_tx_empty(struct uart_port *port)
         up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
         spin_unlock_irqrestore(&up->port.lock, flags);
 
-        return lsr & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
+        return (lsr & BOTH_EMPTY) == BOTH_EMPTY ? TIOCSER_TEMT : 0;
 }
 
 static unsigned int serial8250_get_mctrl(struct uart_port *port)
@@ -1850,8 +1853,6 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
-#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
-
 /*
  *      Wait for transmitter & holding register to empty
  */
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 5681ebed9c65..03dfd27c4bfb 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -494,8 +494,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
                         break;
                 case SSB_BUSTYPE_SDIO:
-#ifdef CONFIG_SSB_SDIO
-                        sdev->irq = bus->host_sdio->dev.irq;
+#ifdef CONFIG_SSB_SDIOHOST
                         dev->parent = &bus->host_sdio->dev;
 #endif
                         break;
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6e8bcdfd23b4..a678186f218f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg)
         void __user *addr = as->userurb;
         unsigned int i;
 
-        if (as->userbuffer)
+        if (as->userbuffer && urb->actual_length)
                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
-                                 urb->transfer_buffer_length))
+                                 urb->actual_length))
                         goto err_out;
         if (put_user(as->status, &userurb->status))
                 goto err_out;
@@ -1334,14 +1334,11 @@ static int processcompl(struct async *as, void __user * __user *arg)
                 }
         }
 
-        free_async(as);
-
         if (put_user(addr, (void __user * __user *)arg))
                 return -EFAULT;
         return 0;
 
 err_out:
-        free_async(as);
         return -EFAULT;
 }
 
@@ -1371,8 +1368,11 @@ static struct async *reap_as(struct dev_state *ps)
 static int proc_reapurb(struct dev_state *ps, void __user *arg)
 {
         struct async *as = reap_as(ps);
-        if (as)
-                return processcompl(as, (void __user * __user *)arg);
+        if (as) {
+                int retval = processcompl(as, (void __user * __user *)arg);
+                free_async(as);
+                return retval;
+        }
         if (signal_pending(current))
                 return -EINTR;
         return -EIO;
@@ -1380,11 +1380,16 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
 
 static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
 {
+        int retval;
         struct async *as;
 
-        if (!(as = async_getcompleted(ps)))
-                return -EAGAIN;
-        return processcompl(as, (void __user * __user *)arg);
+        as = async_getcompleted(ps);
+        retval = -EAGAIN;
+        if (as) {
+                retval = processcompl(as, (void __user * __user *)arg);
+                free_async(as);
+        }
+        return retval;
 }
 
 #ifdef CONFIG_COMPAT
@@ -1475,9 +1480,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
         void __user *addr = as->userurb;
         unsigned int i;
 
-        if (as->userbuffer)
+        if (as->userbuffer && urb->actual_length)
                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
-                                 urb->transfer_buffer_length))
+                                 urb->actual_length))
                         return -EFAULT;
         if (put_user(as->status, &userurb->status))
                 return -EFAULT;
@@ -1497,7 +1502,6 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
                 }
         }
 
-        free_async(as);
         if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
                 return -EFAULT;
         return 0;
@@ -1506,8 +1510,11 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
 static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
 {
         struct async *as = reap_as(ps);
-        if (as)
-                return processcompl_compat(as, (void __user * __user *)arg);
+        if (as) {
+                int retval = processcompl_compat(as, (void __user * __user *)arg);
+                free_async(as);
+                return retval;
+        }
         if (signal_pending(current))
                 return -EINTR;
         return -EIO;
@@ -1515,11 +1522,16 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
 
 static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
 {
+        int retval;
         struct async *as;
 
-        if (!(as = async_getcompleted(ps)))
-                return -EAGAIN;
-        return processcompl_compat(as, (void __user * __user *)arg);
+        retval = -EAGAIN;
+        as = async_getcompleted(ps);
+        if (as) {
+                retval = processcompl_compat(as, (void __user * __user *)arg);
+                free_async(as);
+        }
+        return retval;
 }
 
 
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 0a577d5694fd..d4f0db58a8ad 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -358,7 +358,7 @@ done:
          * b15:         bmType (0 == data)
          */
         len = skb->len;
-        put_unaligned_le16((len & 0x3FFF) | BIT(14), skb_push(skb, 2));
+        put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2));
 
         /* add a zero-length EEM packet, if needed */
         if (padlen)
@@ -464,7 +464,6 @@ static int eem_unwrap(struct gether *port,
                         }
 
                         /* validate CRC */
-                        crc = get_unaligned_le32(skb->data + len - ETH_FCS_LEN);
                         if (header & BIT(14)) {
                                 crc = get_unaligned_le32(skb->data + len
                                                         - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 429560100b10..76496f5d272c 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -29,7 +29,7 @@
 #if defined USB_ETH_RNDIS
 #  undef USB_ETH_RNDIS
 #endif
-#ifdef CONFIG_USB_ETH_RNDIS
+#ifdef CONFIG_USB_G_MULTI_RNDIS
 #  define USB_ETH_RNDIS y
 #endif
 
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index e220fb8091a3..8b45145b9136 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -26,6 +26,7 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/err.h>
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 4b5dbd0127f5..5fc80a104150 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2582,6 +2582,7 @@ err:
         hsotg->gadget.dev.driver = NULL;
         return ret;
 }
+EXPORT_SYMBOL(usb_gadget_register_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index c75d9270c752..19372673bf09 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -196,7 +196,9 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                         if (hostpc_reg) {
                                 u32     t3;
 
+                                spin_unlock_irq(&ehci->lock);
                                 msleep(5);/* 5ms for HCD enter low pwr mode */
+                                spin_lock_irq(&ehci->lock);
                                 t3 = ehci_readl(ehci, hostpc_reg);
                                 ehci_writel(ehci, t3 | HOSTPC_PHCD, hostpc_reg);
                                 t3 = ehci_readl(ehci, hostpc_reg);
@@ -904,17 +906,18 @@ static int ehci_hub_control (
                         if ((temp & PORT_PE) == 0
                                         || (temp & PORT_RESET) != 0)
                                 goto error;
-                        ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
+
                         /* After above check the port must be connected.
                          * Set appropriate bit thus could put phy into low power
                          * mode if we have hostpc feature
                          */
+                        temp &= ~PORT_WKCONN_E;
+                        temp |= PORT_WKDISC_E | PORT_WKOC_E;
+                        ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
                         if (hostpc_reg) {
-                                temp &= ~PORT_WKCONN_E;
-                                temp |= (PORT_WKDISC_E | PORT_WKOC_E);
-                                ehci_writel(ehci, temp | PORT_SUSPEND,
-                                                        status_reg);
+                                spin_unlock_irqrestore(&ehci->lock, flags);
                                 msleep(5);/* 5ms for HCD enter low pwr mode */
+                                spin_lock_irqsave(&ehci->lock, flags);
                                 temp1 = ehci_readl(ehci, hostpc_reg);
                                 ehci_writel(ehci, temp1 | HOSTPC_PHCD,
                                         hostpc_reg);
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
index d224ab467a40..e1232890c78b 100644
--- a/drivers/usb/host/fhci-tds.c
+++ b/drivers/usb/host/fhci-tds.c
@@ -105,7 +105,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                 if (ep->td_base)
                         cpm_muram_free(cpm_muram_offset(ep->td_base));
 
-                if (ep->conf_frame_Q) {
+                if (kfifo_initialized(&ep->conf_frame_Q)) {
                         size = cq_howmany(&ep->conf_frame_Q);
                         for (; size; size--) {
                                 struct packet *pkt = cq_get(&ep->conf_frame_Q);
@@ -115,7 +115,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                         cq_delete(&ep->conf_frame_Q);
                 }
 
-                if (ep->empty_frame_Q) {
+                if (kfifo_initialized(&ep->empty_frame_Q)) {
                         size = cq_howmany(&ep->empty_frame_Q);
                         for (; size; size--) {
                                 struct packet *pkt = cq_get(&ep->empty_frame_Q);
@@ -125,7 +125,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                         cq_delete(&ep->empty_frame_Q);
                 }
 
-                if (ep->dummy_packets_Q) {
+                if (kfifo_initialized(&ep->dummy_packets_Q)) {
                         size = cq_howmany(&ep->dummy_packets_Q);
                         for (; size; size--) {
                                 u8 *buff = cq_get(&ep->dummy_packets_Q);
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 0025847743f3..8b37a4b9839e 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3245,6 +3245,7 @@ static struct usb_device_id sisusb_table [] = {
         { USB_DEVICE(0x0711, 0x0902) },
         { USB_DEVICE(0x0711, 0x0903) },
         { USB_DEVICE(0x0711, 0x0918) },
+        { USB_DEVICE(0x0711, 0x0920) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
         { }
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index de56b3d743d7..3d2d3e549bd1 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -44,6 +44,7 @@ config ISP1301_OMAP
 config USB_ULPI
         bool "Generic ULPI Transceiver Driver"
         depends on ARM
+        select USB_OTG_UTILS
         help
           Enable this to support ULPI connected USB OTG transceivers which
           are likely found on embedded boards.
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 216f187582ab..7638828e7317 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -50,7 +50,7 @@
  * Version Information
  */
 #define DRIVER_VERSION "v1.5.0"
-#define DRIVER_AUTHOR "Greg Kroah-Hartman <greg@kroah.com>, Bill Ryder <bryder@sgi.com>, Kuba Ober <kuba@mareimbrium.org>"
+#define DRIVER_AUTHOR "Greg Kroah-Hartman <greg@kroah.com>, Bill Ryder <bryder@sgi.com>, Kuba Ober <kuba@mareimbrium.org>, Andreas Mohr"
 #define DRIVER_DESC "USB FTDI Serial Converters Driver"
 
 static int debug;
@@ -145,10 +145,15 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 
 
+/*
+ * Device ID not listed? Test via module params product/vendor or
+ * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
+ */
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
@@ -552,9 +557,16 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
         /*
-         * Due to many user requests for multiple ELV devices we enable
-         * them by default.
+         * ELV devices:
          */
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS550_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_EC3000_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS888_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_TWS550_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_FEM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) },
@@ -571,11 +583,17 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_UTP8_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS444PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_HS485_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_UMS100_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
         { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
@@ -697,6 +715,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
         { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AD4USB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index da92b4952ffb..c8951aeed983 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,8 @@
 /* www.candapter.com Ewert Energy Systems CANdapter device */
 #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
 
+#define FTDI_NXTCAM_PID         0xABB8 /* NXTCam for Mindstorms NXT */
+
 /* OOCDlink by Joern Kaipf <joernk@web.de>
  * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
 #define FTDI_OOCDLINK_PID       0xbaf8  /* Amontec JTAGkey */
@@ -161,22 +163,37 @@
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
  * All of these devices use FTDI's vendor ID (0x0403).
+ * Further IDs taken from ELV Windows .inf file.
  *
  * The previously included PID for the UO 100 module was incorrect.
  * In fact, that PID was for ELV's UR 100 USB-RS232 converter (0xFB58).
  *
  * Armin Laeuger originally sent the PID for the UM 100 module.
  */
+#define FTDI_ELV_USR_PID        0xE000  /* ELV Universal-Sound-Recorder */
+#define FTDI_ELV_MSM1_PID       0xE001  /* ELV Mini-Sound-Modul */
+#define FTDI_ELV_KL100_PID      0xE002  /* ELV Kfz-Leistungsmesser KL 100 */
+#define FTDI_ELV_WS550_PID      0xE004  /* WS 550 */
+#define FTDI_ELV_EC3000_PID     0xE006  /* ENERGY CONTROL 3000 USB */
+#define FTDI_ELV_WS888_PID      0xE008  /* WS 888 */
+#define FTDI_ELV_TWS550_PID     0xE009  /* Technoline WS 550 */
+#define FTDI_ELV_FEM_PID        0xE00A  /* Funk Energie Monitor */
 #define FTDI_ELV_FHZ1300PC_PID  0xE0E8  /* FHZ 1300 PC */
 #define FTDI_ELV_WS500_PID      0xE0E9  /* PC-Wetterstation (WS 500) */
 #define FTDI_ELV_HS485_PID      0xE0EA  /* USB to RS-485 adapter */
+#define FTDI_ELV_UMS100_PID     0xE0EB  /* ELV USB Master-Slave Schaltsteckdose UMS 100 */
+#define FTDI_ELV_TFD128_PID     0xE0EC  /* ELV Temperatur-Feuchte-Datenlogger TFD 128 */
+#define FTDI_ELV_FM3RX_PID      0xE0ED  /* ELV Messwertuebertragung FM3 RX */
+#define FTDI_ELV_WS777_PID      0xE0EE  /* Conrad WS 777 */
 #define FTDI_ELV_EM1010PC_PID   0xE0EF  /* Engery monitor EM 1010 PC */
 #define FTDI_ELV_CSI8_PID       0xE0F0  /* Computer-Schalt-Interface (CSI 8) */
 #define FTDI_ELV_EM1000DL_PID   0xE0F1  /* PC-Datenlogger fuer Energiemonitor (EM 1000 DL) */
 #define FTDI_ELV_PCK100_PID     0xE0F2  /* PC-Kabeltester (PCK 100) */
 #define FTDI_ELV_RFP500_PID     0xE0F3  /* HF-Leistungsmesser (RFP 500) */
 #define FTDI_ELV_FS20SIG_PID    0xE0F4  /* Signalgeber (FS 20 SIG) */
+#define FTDI_ELV_UTP8_PID       0xE0F5  /* ELV UTP 8 */
 #define FTDI_ELV_WS300PC_PID    0xE0F6  /* PC-Wetterstation (WS 300 PC) */
+#define FTDI_ELV_WS444PC_PID    0xE0F7  /* Conrad WS 444 PC */
 #define FTDI_PHI_FISCO_PID      0xE40B  /* PHI Fisco USB to Serial cable */
 #define FTDI_ELV_UAD8_PID       0xF068  /* USB-AD-Wandler (UAD 8) */
 #define FTDI_ELV_UDA7_PID       0xF069  /* USB-DA-Wandler (UDA 7) */
@@ -968,6 +985,7 @@
 #define PAPOUCH_VID                     0x5050  /* Vendor ID */
 #define PAPOUCH_TMU_PID                 0x0400  /* TMU USB Thermometer */
 #define PAPOUCH_QUIDO4x4_PID            0x0900  /* Quido 4/4 Module */
+#define PAPOUCH_AD4USB_PID              0x8003  /* AD4USB Measurement Module */
 
 /*
  * Marvell SheevaPlug
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ac1b6449fb6a..3eb6143bb646 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -298,6 +298,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
+       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
 
         { }
 };
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c932f9053188..49575fba3756 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -941,7 +941,7 @@ UNUSUAL_DEV(  0x07ab, 0xfccd, 0x0000, 0x9999,
 UNUSUAL_DEV(  0x07af, 0x0004, 0x0100, 0x0133,
                 "Microtech",
                 "USB-SCSI-DB25",
-                US_SC_SCSI, US_PR_BULK, usb_stor_euscsi_init,
+                US_SC_DEVICE, US_PR_DEVICE, usb_stor_euscsi_init,
                 US_FL_SCM_MULT_TARG ), 
 
 UNUSUAL_DEV(  0x07af, 0x0005, 0x0100, 0x0100,
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index eb12182b2059..d25df51bb0d2 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -161,8 +161,17 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
         return 0;
 }
 
+static void efifb_destroy(struct fb_info *info)
+{
+        if (info->screen_base)
+                iounmap(info->screen_base);
+        release_mem_region(info->aperture_base, info->aperture_size);
+        framebuffer_release(info);
+}
+
 static struct fb_ops efifb_ops = {
         .owner          = THIS_MODULE,
+        .fb_destroy     = efifb_destroy,
         .fb_setcolreg   = efifb_setcolreg,
         .fb_fillrect    = cfb_fillrect,
         .fb_copyarea    = cfb_copyarea,
@@ -281,7 +290,7 @@ static int __init efifb_probe(struct platform_device *dev)
         info->par = NULL;
 
         info->aperture_base = efifb_fix.smem_start;
-        info->aperture_size = size_total;
+        info->aperture_size = size_remap;
 
         info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
         if (!info->screen_base) {
diff --git a/drivers/watchdog/bfin_wdt.c b/drivers/watchdog/bfin_wdt.c
index c7b3f9df2317..2159e668751c 100644
--- a/drivers/watchdog/bfin_wdt.c
+++ b/drivers/watchdog/bfin_wdt.c
@@ -1,9 +1,8 @@
 /*
  * Blackfin On-Chip Watchdog Driver
- *  Supports BF53[123]/BF53[467]/BF54[2489]/BF561
  *
  * Originally based on softdog.c
- * Copyright 2006-2007 Analog Devices Inc.
+ * Copyright 2006-2010 Analog Devices Inc.
  * Copyright 2006-2007 Michele d'Amico
  * Copyright 1996 Alan Cox <alan@lxorguk.ukuu.org.uk>
  *
@@ -137,13 +136,15 @@ static int bfin_wdt_running(void)
  */
 static int bfin_wdt_set_timeout(unsigned long t)
 {
-        u32 cnt;
+        u32 cnt, max_t, sclk;
         unsigned long flags;
 
-        stampit();
+        sclk = get_sclk();
+        max_t = -1 / sclk;
+        cnt = t * sclk;
+        stamp("maxtimeout=%us newtimeout=%lus (cnt=%#x)", max_t, t, cnt);
 
-        cnt = t * get_sclk();
-        if (cnt < get_sclk()) {
+        if (t > max_t) {
                 printk(KERN_WARNING PFX "timeout value is too large\n");
                 return -EINVAL;
         }
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 9d0809629967..6ed434ac037f 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -720,13 +720,15 @@ again:
                                         inode->i_ino, orig_offset);
                 BUG_ON(ret);
         }
-        fi = btrfs_item_ptr(leaf, path->slots[0],
-                           struct btrfs_file_extent_item);
         if (del_nr == 0) {
+                fi = btrfs_item_ptr(leaf, path->slots[0],
+                           struct btrfs_file_extent_item);
                 btrfs_set_file_extent_type(leaf, fi,
                                            BTRFS_FILE_EXTENT_REG);
                 btrfs_mark_buffer_dirty(leaf);
         } else {
+                fi = btrfs_item_ptr(leaf, del_slot - 1,
+                           struct btrfs_file_extent_item);
                 btrfs_set_file_extent_type(leaf, fi,
                                            BTRFS_FILE_EXTENT_REG);
                 btrfs_set_file_extent_num_bytes(leaf, fi,
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 14ac4806e291..eeb4986ea7db 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -348,7 +348,17 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
         dir = dget_parent(object->dentry);
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        ret = cachefiles_bury_object(cache, dir, object->dentry);
+
+        /* we need to check that our parent is _still_ our parent - it may have
+         * been renamed */
+        if (dir == object->dentry->d_parent) {
+                ret = cachefiles_bury_object(cache, dir, object->dentry);
+        } else {
+                /* it got moved, presumably by cachefilesd culling it, so it's
+                 * no longer in the key path and we can ignore it */
+                mutex_unlock(&dir->d_inode->i_mutex);
+                ret = 0;
+        }
 
         dput(dir);
         _leave(" = %d", ret);
diff --git a/fs/exec.c b/fs/exec.c
index e95c692ef0e4..cce6bbdbdbb1 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -637,7 +637,6 @@ int setup_arg_pages(struct linux_binprm *bprm,
          * will align it up.
          */
         rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
-        rlim_stack = min(rlim_stack, stack_size);
 #ifdef CONFIG_STACK_GROWSUP
         if (stack_size + stack_expand > rlim_stack)
                 stack_base = vma->vm_start + rlim_stack;
diff --git a/fs/namei.c b/fs/namei.c
index d62fdc875f22..a4855af776a8 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -823,6 +823,17 @@ fail:
 }
 
 /*
+ * This is a temporary kludge to deal with "automount" symlinks; proper
+ * solution is to trigger them on follow_mount(), so that do_lookup()
+ * would DTRT.  To be killed before 2.6.34-final.
+ */
+static inline int follow_on_final(struct inode *inode, unsigned lookup_flags)
+{
+        return inode && unlikely(inode->i_op->follow_link) &&
+                ((lookup_flags & LOOKUP_FOLLOW) || S_ISDIR(inode->i_mode));
+}
+
+/*
  * Name resolution.
  * This is the basic name resolution function, turning a pathname into
  * the final dentry. We expect 'base' to be positive and a directory.
@@ -942,8 +953,7 @@ last_component:
                 if (err)
                         break;
                 inode = next.dentry->d_inode;
-                if ((lookup_flags & LOOKUP_FOLLOW)
-                    && inode && inode->i_op->follow_link) {
+                if (follow_on_final(inode, lookup_flags)) {
                         err = do_follow_link(&next, nd);
                         if (err)
                                 goto return_err;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index e1d415e97849..0d289823e856 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -342,6 +342,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.eof = 0;
                 data->res.count = bytes;
+                nfs_fattr_init(&data->fattr);
                 msg.rpc_argp = &data->args;
                 msg.rpc_resp = &data->res;
 
@@ -575,6 +576,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
         data->res.count = 0;
         data->res.fattr = &data->fattr;
         data->res.verf = &data->verf;
+        nfs_fattr_init(&data->fattr);
 
         NFS_PROTO(data->inode)->commit_setup(data, &msg);
 
@@ -766,6 +768,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
                 data->res.fattr = &data->fattr;
                 data->res.count = bytes;
                 data->res.verf = &data->verf;
+                nfs_fattr_init(&data->fattr);
 
                 task_setup_data.task = &data->task;
                 task_setup_data.callback_data = data;
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 97d79eff6b7f..8715d194561a 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -752,7 +752,8 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                             flags, current_cred());
         if (IS_ERR(*filp))
                 host_err = PTR_ERR(*filp);
-        host_err = ima_file_check(*filp, access);
+        else
+                host_err = ima_file_check(*filp, access);
 out_nfserr:
         err = nfserrno(host_err);
 out:
diff --git a/fs/proc/base.c b/fs/proc/base.c
index e42bbd843ed1..58324c299165 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2369,16 +2369,30 @@ static void *proc_self_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct pid_namespace *ns = dentry->d_sb->s_fs_info;
         pid_t tgid = task_tgid_nr_ns(current, ns);
-        char tmp[PROC_NUMBUF];
-        if (!tgid)
-                return ERR_PTR(-ENOENT);
-        sprintf(tmp, "%d", task_tgid_nr_ns(current, ns));
-        return ERR_PTR(vfs_follow_link(nd,tmp));
+        char *name = ERR_PTR(-ENOENT);
+        if (tgid) {
+                name = __getname();
+                if (!name)
+                        name = ERR_PTR(-ENOMEM);
+                else
+                        sprintf(name, "%d", tgid);
+        }
+        nd_set_link(nd, name);
+        return NULL;
+}
+
+static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
+                                void *cookie)
+{
+        char *s = nd_get_link(nd);
+        if (!IS_ERR(s))
+                __putname(s);
 }
 
 static const struct inode_operations proc_self_inode_operations = {
         .readlink       = proc_self_readlink,
         .follow_link    = proc_self_follow_link,
+        .put_link       = proc_self_put_link,
 };
 
 /*
diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
index 9087b10209e6..2df0f5c7c60b 100644
--- a/fs/reiserfs/inode.c
+++ b/fs/reiserfs/inode.c
@@ -1497,9 +1497,11 @@ struct inode *reiserfs_iget(struct super_block *s, const struct cpu_key *key)
 
         args.objectid = key->on_disk_key.k_objectid;
         args.dirid = key->on_disk_key.k_dir_id;
+        reiserfs_write_unlock(s);
         inode = iget5_locked(s, key->on_disk_key.k_objectid,
                              reiserfs_find_actor, reiserfs_init_locked_inode,
                              (void *)(&args));
+        reiserfs_write_lock(s);
         if (!inode)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 220b758523ae..6a06a1d1ea7b 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -81,24 +81,23 @@ int sysfs_sd_setattr(struct sysfs_dirent *sd, struct iattr * iattr)
                 if (!sd_attrs)
                         return -ENOMEM;
                 sd->s_iattr = sd_attrs;
-        } else {
-                /* attributes were changed at least once in past */
-                iattrs = &sd_attrs->ia_iattr;
-
-                if (ia_valid & ATTR_UID)
-                        iattrs->ia_uid = iattr->ia_uid;
-                if (ia_valid & ATTR_GID)
-                        iattrs->ia_gid = iattr->ia_gid;
-                if (ia_valid & ATTR_ATIME)
-                        iattrs->ia_atime = iattr->ia_atime;
-                if (ia_valid & ATTR_MTIME)
-                        iattrs->ia_mtime = iattr->ia_mtime;
-                if (ia_valid & ATTR_CTIME)
-                        iattrs->ia_ctime = iattr->ia_ctime;
-                if (ia_valid & ATTR_MODE) {
-                        umode_t mode = iattr->ia_mode;
-                        iattrs->ia_mode = sd->s_mode = mode;
-                }
+        }
+        /* attributes were changed at least once in past */
+        iattrs = &sd_attrs->ia_iattr;
+
+        if (ia_valid & ATTR_UID)
+                iattrs->ia_uid = iattr->ia_uid;
+        if (ia_valid & ATTR_GID)
+                iattrs->ia_gid = iattr->ia_gid;
+        if (ia_valid & ATTR_ATIME)
+                iattrs->ia_atime = iattr->ia_atime;
+        if (ia_valid & ATTR_MTIME)
+                iattrs->ia_mtime = iattr->ia_mtime;
+        if (ia_valid & ATTR_CTIME)
+                iattrs->ia_ctime = iattr->ia_ctime;
+        if (ia_valid & ATTR_MODE) {
+                umode_t mode = iattr->ia_mode;
+                iattrs->ia_mode = sd->s_mode = mode;
         }
         return 0;
 }
diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h
index ab94335b4bb9..6816be6c3f77 100644
--- a/include/linux/amba/bus.h
+++ b/include/linux/amba/bus.h
@@ -1,5 +1,9 @@
 /*
- *  linux/include/asm-arm/hardware/amba.h
+ *  linux/include/amba/bus.h
+ *
+ *  This device type deals with ARM PrimeCells and anything else that
+ *  presents a proper CID (0xB105F00D) at the end of the I/O register
+ *  region or that is derived from a PrimeCell.
  *
  *  Copyright (C) 2003 Deep Blue Solutions Ltd, All Rights Reserved.
  *
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 5c8018977efa..1896e868854f 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -461,8 +461,7 @@ struct request_queue
 #define QUEUE_FLAG_NONROT      14       /* non-rotational device (SSD) */
 #define QUEUE_FLAG_VIRT        QUEUE_FLAG_NONROT /* paravirt device */
 #define QUEUE_FLAG_IO_STAT     15       /* do IO stats */
-#define QUEUE_FLAG_CQ          16       /* hardware does queuing */
-#define QUEUE_FLAG_DISCARD     17       /* supports DISCARD */
+#define QUEUE_FLAG_DISCARD     16       /* supports DISCARD */
 
 #define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
                                  (1 << QUEUE_FLAG_CLUSTER) |            \
@@ -586,7 +585,6 @@ enum {
 
 #define blk_queue_plugged(q)    test_bit(QUEUE_FLAG_PLUGGED, &(q)->queue_flags)
 #define blk_queue_tagged(q)     test_bit(QUEUE_FLAG_QUEUED, &(q)->queue_flags)
-#define blk_queue_queuing(q)    test_bit(QUEUE_FLAG_CQ, &(q)->queue_flags)
 #define blk_queue_stopped(q)    test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags)
 #define blk_queue_nomerges(q)   test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags)
 #define blk_queue_nonrot(q)     test_bit(QUEUE_FLAG_NONROT, &(q)->queue_flags)
diff --git a/include/linux/fs.h b/include/linux/fs.h
index b1bcb275b596..ebb1cd5bc241 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -729,6 +729,7 @@ struct inode {
         uid_t                   i_uid;
         gid_t                   i_gid;
         dev_t                   i_rdev;
+        unsigned int            i_blkbits;
         u64                     i_version;
         loff_t                  i_size;
 #ifdef __NEED_I_SIZE_ORDERED
@@ -738,7 +739,6 @@ struct inode {
         struct timespec         i_mtime;
         struct timespec         i_ctime;
         blkcnt_t                i_blocks;
-        unsigned int            i_blkbits;
         unsigned short          i_bytes;
         umode_t                 i_mode;
         spinlock_t              i_lock; /* i_blocks, i_bytes, maybe i_size */
diff --git a/include/linux/hw_breakpoint.h b/include/linux/hw_breakpoint.h
index 070ba0621738..5977b724f7c6 100644
--- a/include/linux/hw_breakpoint.h
+++ b/include/linux/hw_breakpoint.h
@@ -44,7 +44,7 @@ static inline int hw_breakpoint_type(struct perf_event *bp)
         return bp->attr.bp_type;
 }
 
-static inline int hw_breakpoint_len(struct perf_event *bp)
+static inline unsigned long hw_breakpoint_len(struct perf_event *bp)
 {
         return bp->attr.bp_len;
 }
diff --git a/include/linux/input.h b/include/linux/input.h
index 735ceaf1bc2d..663208afb64c 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -376,6 +376,7 @@ struct input_absinfo {
 #define KEY_DISPLAY_OFF         245     /* display device to off state */
 
 #define KEY_WIMAX               246
+#define KEY_RFKILL              247     /* Key that controls all radios */
 
 /* Range 248 - 255 is reserved for special needs of AT keyboard driver */
 
diff --git a/include/linux/kfifo.h b/include/linux/kfifo.h
index 6f6c5f300af6..bc0fc795bd35 100644
--- a/include/linux/kfifo.h
+++ b/include/linux/kfifo.h
@@ -124,7 +124,7 @@ extern __must_check unsigned int kfifo_out_peek(struct kfifo *fifo,
  */
 static inline bool kfifo_initialized(struct kfifo *fifo)
 {
-        return fifo->buffer != 0;
+        return fifo->buffer != NULL;
 }
 
 /**
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 8fa71874113f..a177698d95e2 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -211,11 +211,9 @@ struct perf_event_attr {
                 __u32           wakeup_watermark; /* bytes before wakeup   */
         };
 
-        __u32                   __reserved_2;
-
-        __u64                   bp_addr;
         __u32                   bp_type;
-        __u32                   bp_len;
+        __u64                   bp_addr;
+        __u64                   bp_len;
 };
 
 /*
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
index 8a5c7d55ac9f..967e66143e11 100644
--- a/kernel/hw_breakpoint.c
+++ b/kernel/hw_breakpoint.c
@@ -360,8 +360,8 @@ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
 int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr)
 {
         u64 old_addr = bp->attr.bp_addr;
+        u64 old_len = bp->attr.bp_len;
         int old_type = bp->attr.bp_type;
-        int old_len = bp->attr.bp_len;
         int err = 0;
 
         perf_event_disable(bp);
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 498cabba225e..35edbe22e9a9 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -80,7 +80,7 @@ int kfifo_alloc(struct kfifo *fifo, unsigned int size, gfp_t gfp_mask)
 
         buffer = kmalloc(size, gfp_mask);
         if (!buffer) {
-                _kfifo_init(fifo, 0, 0);
+                _kfifo_init(fifo, NULL, 0);
                 return -ENOMEM;
         }
 
@@ -97,6 +97,7 @@ EXPORT_SYMBOL(kfifo_alloc);
 void kfifo_free(struct kfifo *fifo)
 {
         kfree(fifo->buffer);
+        _kfifo_init(fifo, NULL, 0);
 }
 EXPORT_SYMBOL(kfifo_free);
 
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index d27746bd3a06..2ae7409bf38f 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -3259,8 +3259,6 @@ static void perf_event_task_output(struct perf_event *event,
         task_event->event_id.tid = perf_event_tid(event, task);
         task_event->event_id.ptid = perf_event_tid(event, current);
 
-        task_event->event_id.time = perf_clock();
-
         perf_output_put(&handle, task_event->event_id);
 
         perf_output_end(&handle);
@@ -3268,7 +3266,7 @@ static void perf_event_task_output(struct perf_event *event,
 
 static int perf_event_task_match(struct perf_event *event)
 {
-        if (event->state != PERF_EVENT_STATE_ACTIVE)
+        if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
         if (event->cpu != -1 && event->cpu != smp_processor_id())
@@ -3300,7 +3298,7 @@ static void perf_event_task_event(struct perf_task_event *task_event)
         cpuctx = &get_cpu_var(perf_cpu_context);
         perf_event_task_ctx(&cpuctx->ctx, task_event);
         if (!ctx)
-                ctx = rcu_dereference(task_event->task->perf_event_ctxp);
+                ctx = rcu_dereference(current->perf_event_ctxp);
         if (ctx)
                 perf_event_task_ctx(ctx, task_event);
         put_cpu_var(perf_cpu_context);
@@ -3331,6 +3329,7 @@ static void perf_event_task(struct task_struct *task,
                         /* .ppid */
                         /* .tid  */
                         /* .ptid */
+                        .time = perf_clock(),
                 },
         };
 
@@ -3380,7 +3379,7 @@ static void perf_event_comm_output(struct perf_event *event,
 
 static int perf_event_comm_match(struct perf_event *event)
 {
-        if (event->state != PERF_EVENT_STATE_ACTIVE)
+        if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
         if (event->cpu != -1 && event->cpu != smp_processor_id())
@@ -3500,7 +3499,7 @@ static void perf_event_mmap_output(struct perf_event *event,
 static int perf_event_mmap_match(struct perf_event *event,
                                    struct perf_mmap_event *mmap_event)
 {
-        if (event->state != PERF_EVENT_STATE_ACTIVE)
+        if (event->state < PERF_EVENT_STATE_INACTIVE)
                 return 0;
 
         if (event->cpu != -1 && event->cpu != smp_processor_id())
@@ -4580,7 +4579,7 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr,
         if (attr->type >= PERF_TYPE_MAX)
                 return -EINVAL;
 
-        if (attr->__reserved_1 || attr->__reserved_2)
+        if (attr->__reserved_1)
                 return -EINVAL;
 
         if (attr->sample_type & ~(PERF_SAMPLE_MAX-1))
diff --git a/kernel/softirq.c b/kernel/softirq.c
index a09502e2ef75..7c1a67ef0274 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -500,22 +500,17 @@ EXPORT_SYMBOL(tasklet_kill);
  */
 
 /*
- * The trampoline is called when the hrtimer expires. If this is
- * called from the hrtimer interrupt then we schedule the tasklet as
- * the timer callback function expects to run in softirq context. If
- * it's called in softirq context anyway (i.e. high resolution timers
- * disabled) then the hrtimer callback is called right away.
+ * The trampoline is called when the hrtimer expires. It schedules a tasklet
+ * to run __tasklet_hrtimer_trampoline() which in turn will call the intended
+ * hrtimer callback, but from softirq context.
  */
 static enum hrtimer_restart __hrtimer_tasklet_trampoline(struct hrtimer *timer)
 {
         struct tasklet_hrtimer *ttimer =
                 container_of(timer, struct tasklet_hrtimer, timer);
 
-        if (hrtimer_is_hres_active(timer)) {
-                tasklet_hi_schedule(&ttimer->tasklet);
-                return HRTIMER_NORESTART;
-        }
-        return ttimer->function(timer);
+        tasklet_hi_schedule(&ttimer->tasklet);
+        return HRTIMER_NORESTART;
 }
 
 /*
diff --git a/kernel/sys.c b/kernel/sys.c
index 26a6b73a6b85..18bde979f346 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -222,6 +222,7 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
         if (which > PRIO_USER || which < PRIO_PROCESS)
                 return -EINVAL;
 
+        rcu_read_lock();
         read_lock(&tasklist_lock);
         switch (which) {
                 case PRIO_PROCESS:
@@ -267,6 +268,7 @@ SYSCALL_DEFINE2(getpriority, int, which, int, who)
         }
 out_unlock:
         read_unlock(&tasklist_lock);
+        rcu_read_unlock();
 
         return retval;
 }
diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
index 6ea90c0e2c96..50b1b8239806 100644
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -689,7 +689,7 @@ static int create_trace_probe(int argc, char **argv)
                         return -EINVAL;
                 }
                 /* an address specified */
-                ret = strict_strtoul(&argv[0][2], 0, (unsigned long *)&addr);
+                ret = strict_strtoul(&argv[1][0], 0, (unsigned long *)&addr);
                 if (ret) {
                         pr_info("Failed to parse address.\n");
                         return ret;
diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
index 678a5120ee30..f4bc9b27de5f 100644
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -157,6 +157,7 @@ stack_max_size_write(struct file *filp, const char __user *ubuf,
         unsigned long val, flags;
         char buf[64];
         int ret;
+        int cpu;
 
         if (count >= sizeof(buf))
                 return -EINVAL;
@@ -171,9 +172,20 @@ stack_max_size_write(struct file *filp, const char __user *ubuf,
                 return ret;
 
         local_irq_save(flags);
+
+        /*
+         * In case we trace inside arch_spin_lock() or after (NMI),
+         * we will cause circular lock, so we also need to increase
+         * the percpu trace_active here.
+         */
+        cpu = smp_processor_id();
+        per_cpu(trace_active, cpu)++;
+
         arch_spin_lock(&max_stack_lock);
         *ptr = val;
         arch_spin_unlock(&max_stack_lock);
+
+        per_cpu(trace_active, cpu)--;
         local_irq_restore(flags);
 
         return count;
@@ -206,7 +218,13 @@ t_next(struct seq_file *m, void *v, loff_t *pos)
 
 static void *t_start(struct seq_file *m, loff_t *pos)
 {
+        int cpu;
+
         local_irq_disable();
+
+        cpu = smp_processor_id();
+        per_cpu(trace_active, cpu)++;
+
         arch_spin_lock(&max_stack_lock);
 
         if (*pos == 0)
@@ -217,7 +235,13 @@ static void *t_start(struct seq_file *m, loff_t *pos)
 
 static void t_stop(struct seq_file *m, void *p)
 {
+        int cpu;
+
         arch_spin_unlock(&max_stack_lock);
+
+        cpu = smp_processor_id();
+        per_cpu(trace_active, cpu)--;
+
         local_irq_enable();
 }
 
diff --git a/lib/idr.c b/lib/idr.c
index 1cac726c44bc..0dc782216d4b 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -156,10 +156,12 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                         id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
                         /* if already at the top layer, we need to grow */
-                        if (!(p = pa[l])) {
+                        if (id >= 1 << (idp->layers * IDR_BITS)) {
                                 *starting_id = id;
                                 return IDR_NEED_TO_GROW;
                         }
+                        p = pa[l];
+                        BUG_ON(!p);
 
                         /* If we need to go up one layer, continue the
                          * loop; otherwise, restart from the top.
diff --git a/mm/migrate.c b/mm/migrate.c
index 9a0db5bbabe4..880bd592d38e 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1002,33 +1002,27 @@ static int do_pages_stat(struct mm_struct *mm, unsigned long nr_pages,
 #define DO_PAGES_STAT_CHUNK_NR 16
         const void __user *chunk_pages[DO_PAGES_STAT_CHUNK_NR];
         int chunk_status[DO_PAGES_STAT_CHUNK_NR];
-        unsigned long i, chunk_nr = DO_PAGES_STAT_CHUNK_NR;
-        int err;
 
-        for (i = 0; i < nr_pages; i += chunk_nr) {
-                if (chunk_nr > nr_pages - i)
-                        chunk_nr = nr_pages - i;
+        while (nr_pages) {
+                unsigned long chunk_nr;
 
-                err = copy_from_user(chunk_pages, &pages[i],
-                                     chunk_nr * sizeof(*chunk_pages));
-                if (err) {
-                        err = -EFAULT;
-                        goto out;
-                }
+                chunk_nr = nr_pages;
+                if (chunk_nr > DO_PAGES_STAT_CHUNK_NR)
+                        chunk_nr = DO_PAGES_STAT_CHUNK_NR;
+
+                if (copy_from_user(chunk_pages, pages, chunk_nr * sizeof(*chunk_pages)))
+                        break;
 
                 do_pages_stat_array(mm, chunk_nr, chunk_pages, chunk_status);
 
-                err = copy_to_user(&status[i], chunk_status,
-                                   chunk_nr * sizeof(*chunk_status));
-                if (err) {
-                        err = -EFAULT;
-                        goto out;
-                }
-        }
-        err = 0;
+                if (copy_to_user(status, chunk_status, chunk_nr * sizeof(*status)))
+                        break;
 
-out:
-        return err;
+                pages += chunk_nr;
+                status += chunk_nr;
+                nr_pages -= chunk_nr;
+        }
+        return nr_pages ? -EFAULT : 0;
 }
 
 /*
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index f52481b1c1e5..237050478f28 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -459,6 +459,8 @@ static int oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
         list_for_each_entry(c, &p->children, sibling) {
                 if (c->mm == p->mm)
                         continue;
+                if (mem && !task_in_mem_cgroup(c, mem))
+                        continue;
                 if (!oom_kill_task(c))
                         return 0;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index be9924f60ec3..ec874218b206 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2761,7 +2761,7 @@ gro_result_t napi_frags_finish(struct napi_struct *napi, struct sk_buff *skb,
         switch (ret) {
         case GRO_NORMAL:
         case GRO_HELD:
-                skb->protocol = eth_type_trans(skb, napi->dev);
+                skb->protocol = eth_type_trans(skb, skb->dev);
 
                 if (ret == GRO_HELD)
                         skb_gro_pull(skb, -ETH_HLEN);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index d8aee584e8d1..236a9988ea91 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -927,6 +927,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GPERMADDR:
         case ETHTOOL_GUFO:
         case ETHTOOL_GGSO:
+        case ETHTOOL_GGRO:
         case ETHTOOL_GFLAGS:
         case ETHTOOL_GPFLAGS:
         case ETHTOOL_GRXFH:
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index fbc1c7472c5e..099c753c4213 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -410,7 +410,8 @@ static ssize_t wireless_show(struct device *d, char *buf,
         const struct iw_statistics *iw;
         ssize_t ret = -EINVAL;
 
-        rtnl_lock();
+        if (!rtnl_trylock())
+                return restart_syscall();
         if (dev_isalive(dev)) {
                 iw = get_wireless_stats(dev);
                 if (iw)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 040c4f05b653..26dec2be9615 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1317,14 +1317,19 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *valp != val) {
                 struct net *net = ctl->extra2;
 
                 if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        if (!rtnl_trylock())
+                        if (!rtnl_trylock()) {
+                                /* Restore the original values before restarting */
+                                *valp = val;
+                                *ppos = pos;
                                 return restart_syscall();
+                        }
                         if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                 inet_forward_change(net);
                         } else if (*valp) {
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 76c08402c933..a42f658e756a 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -946,7 +946,6 @@ int igmp_rcv(struct sk_buff *skb)
                 break;
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
-        case IGMPV3_HOST_MEMBERSHIP_REPORT:
                 /* Is it our report looped back? */
                 if (skb_rtable(skb)->fl.iif == 0)
                         break;
@@ -960,6 +959,7 @@ int igmp_rcv(struct sk_buff *skb)
                 in_dev_put(in_dev);
                 return pim_rcv_v1(skb);
 #endif
+        case IGMPV3_HOST_MEMBERSHIP_REPORT:
         case IGMP_DVMRP:
         case IGMP_TRACE:
         case IGMP_HOST_LEAVE_MESSAGE:
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 38fbf04150ae..544ce0876f12 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -124,16 +124,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 28e029632493..3fddc69ccccc 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5783,11 +5783,9 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
 
                                 /* tcp_ack considers this ACK as duplicate
                                  * and does not calculate rtt.
-                                 * Fix it at least with timestamps.
+                                 * Force it here.
                                  */
-                                if (tp->rx_opt.saw_tstamp &&
-                                    tp->rx_opt.rcv_tsecr && !tp->srtt)
-                                        tcp_ack_saw_tstamp(sk, 0);
+                                tcp_ack_update_rtt(sk, 0, 0);
 
                                 if (tp->rx_opt.tstamp_ok)
                                         tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index de7a194a64ab..143791da062c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -502,8 +502,11 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
         if (p == &net->ipv6.devconf_dflt->forwarding)
                 return 0;
 
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                 return restart_syscall();
+        }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
                 __s32 newf = net->ipv6.devconf_all->forwarding;
@@ -4028,12 +4031,15 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret;
 
         ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
         return ret;
 }
 
@@ -4075,8 +4081,11 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
         if (p == &net->ipv6.devconf_dflt->disable_ipv6)
                 return 0;
 
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                 return restart_syscall();
+        }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
                 __s32 newf = net->ipv6.devconf_all->disable_ipv6;
@@ -4095,12 +4104,15 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret;
 
         ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
         return ret;
 }
 
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2f2a5ca2c878..002e6eef9120 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -154,16 +154,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-error_tunnel:
-        ipcomp_destroy(x);
-
-        goto out;
 }
 
 static const struct xfrm_type ipcomp6_type =
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 1f2db647bb5c..22f0c2aa7a89 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -647,7 +647,7 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         }
         if (pos[1] != 0 &&
             (pos[1] != ifibss->ssid_len ||
-             !memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
+             memcmp(pos + 2, ifibss->ssid, ifibss->ssid_len))) {
                 /* Ignore ProbeReq for foreign SSID */
                 return;
         }
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index b9007f80cb92..12a2bff7dcdb 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -245,6 +245,9 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
                 info->control.rates[i].count = 1;
         }
 
+        if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
+                return;
+
         if (sta && sdata->force_unicast_rateidx > -1) {
                 info->control.rates[0].idx = sdata->force_unicast_rateidx;
         } else {
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index f934c9620b73..bc17cf7d68db 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -439,6 +439,16 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 return -EBUSY;
 
+        if (req != local->int_scan_req &&
+            sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !list_empty(&ifmgd->work_list)) {
+                /* actually wait for the work it's doing to finish/time out */
+                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
+                local->scan_req = req;
+                local->scan_sdata = sdata;
+                return 0;
+        }
+
         if (local->ops->hw_scan) {
                 u8 *ies;
 
@@ -463,14 +473,6 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
         local->scan_req = req;
         local->scan_sdata = sdata;
 
-        if (req != local->int_scan_req &&
-            sdata->vif.type == NL80211_IFTYPE_STATION &&
-            !list_empty(&ifmgd->work_list)) {
-                /* actually wait for the work it's doing to finish/time out */
-                set_bit(IEEE80211_STA_REQ_SCAN, &ifmgd->request);
-                return 0;
-        }
-
         if (local->ops->hw_scan)
                 __set_bit(SCAN_HW_SCANNING, &local->scanning);
         else
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index b36cc344474b..f445ea1c5f52 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1102,7 +1102,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         int err = -ENOMEM;
         struct xfrm_state *x = xfrm_state_alloc(net);
         if (!x)
-                goto error;
+                goto out;
 
         memcpy(&x->id, &orig->id, sizeof(x->id));
         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
@@ -1160,16 +1160,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         return x;
 
  error:
+        xfrm_state_put(x);
+out:
         if (errp)
                 *errp = err;
-        if (x) {
-                kfree(x->aalg);
-                kfree(x->ealg);
-                kfree(x->calg);
-                kfree(x->encap);
-                kfree(x->coaddr);
-        }
-        kfree(x);
         return NULL;
 }
 
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 8d8e0b5aa248..9925055608b1 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2350,7 +2350,7 @@ static void __devinit check_probe_mask(struct azx *chip, int dev)
  */
 static struct snd_pci_quirk msi_black_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
-        SND_PCI_QUIRK(0x1043, 0x829c, "ASUS", 0), /* nvidia */
+        SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
         {}
 };
 
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index 9595b5b535f3..7e494b6a1d0e 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -1791,6 +1791,12 @@ static struct ac97_quirk ac97_quirks[] = {
                 .type = AC97_TUNE_HP_ONLY
         },
         {
+                .subvendor = 0x110a,
+                .subdevice = 0x0079,
+                .name = "Fujitsu Siemens D1289",
+                .type = AC97_TUNE_HP_ONLY
+        },
+        {
                 .subvendor = 0x1019,
                 .subdevice = 0x0a81,
                 .name = "ECS K7VTA3",
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index ddc584b64871..4b91d8cf00ec 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -705,7 +705,7 @@ static void print_mapped_keys(void)
                 fprintf(stdout, "\t[w]     toggle display weighted/count[E]r. \t(%d)\n", display_weighted ? 1 : 0);
 
         fprintf(stdout,
-                "\t[K]     hide kernel_symbols symbols.             \t(%s)\n",
+                "\t[K]     hide kernel_symbols symbols.     \t(%s)\n",
                 hide_kernel_symbols ? "yes" : "no");
         fprintf(stdout,
                 "\t[U]     hide user symbols.               \t(%s)\n",
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index bb0fd6da2d56..8a9e6baa3099 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -295,10 +295,10 @@ void thread__find_addr_location(struct thread *self,
         al->thread = self;
         al->addr = addr;
 
-        if (cpumode & PERF_RECORD_MISC_KERNEL) {
+        if (cpumode == PERF_RECORD_MISC_KERNEL) {
                 al->level = 'k';
                 mg = &session->kmaps;
-        } else if (cpumode & PERF_RECORD_MISC_USER)
+        } else if (cpumode == PERF_RECORD_MISC_USER)
                 al->level = '.';
         else {
                 al->level = 'H';
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 29465d440043..fde17b090a47 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -272,6 +272,7 @@ int synthesize_perf_probe_point(struct probe_point *pp)
         int ret;
 
         pp->probes[0] = buf = zalloc(MAX_CMDLEN);
+        pp->found = 1;
         if (!buf)
                 die("Failed to allocate memory by zalloc.");
         if (pp->offset) {
@@ -294,6 +295,7 @@ int synthesize_perf_probe_point(struct probe_point *pp)
 error:
                 free(pp->probes[0]);
                 pp->probes[0] = NULL;
+                pp->found = 0;
         }
         return ret;
 }
@@ -455,6 +457,7 @@ void show_perf_probe_events(void)
         struct strlist *rawlist;
         struct str_node *ent;
 
+        memset(&pp, 0, sizeof(pp));
         fd = open_kprobe_events(O_RDONLY, 0);
         rawlist = get_trace_kprobe_event_rawlist(fd);
         close(fd);