116 files changed, 863 insertions, 354 deletions

diff --git a/Documentation/00-INDEX b/Documentation/00-INDEX
index dd10b51b4e65..5405f7aecefc 100644
--- a/Documentation/00-INDEX
+++ b/Documentation/00-INDEX
@@ -32,8 +32,6 @@ DocBook/
         - directory with DocBook templates etc. for kernel documentation.
 HOWTO
         - the process and procedures of how to do Linux kernel development.
-IO-mapping.txt
-        - how to access I/O mapped memory from within device drivers.
 IPMI.txt
         - info on Linux Intelligent Platform Management Interface (IPMI) Driver.
 IRQ-affinity.txt
@@ -84,6 +82,8 @@ blockdev/
         - info on block devices & drivers
 btmrvl.txt
         - info on Marvell Bluetooth driver usage.
+bus-virt-phys-mapping.txt
+        - how to access I/O mapped memory from within device drivers.
 cachetlb.txt
         - describes the cache/TLB flushing interfaces Linux uses.
 cdrom/
@@ -168,6 +168,8 @@ initrd.txt
         - how to use the RAM disk as an initial/temporary root filesystem.
 input/
         - info on Linux input device support.
+io-mapping.txt
+        - description of io_mapping functions in linux/io-mapping.h
 io_ordering.txt
         - info on ordering I/O writes to memory-mapped addresses.
 ioctl/
diff --git a/Documentation/IO-mapping.txt b/Documentation/bus-virt-phys-mapping.txt
index 1b5aa10df845..1b5aa10df845 100644
--- a/Documentation/IO-mapping.txt
+++ b/Documentation/bus-virt-phys-mapping.txt
diff --git a/MAINTAINERS b/MAINTAINERS
index 58848125b8bf..db3d0f5061f9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5336,6 +5336,7 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6.git
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6.git
 S:      Maintained
 F:      arch/sparc/
+F:      drivers/sbus
 
 SPARC SERIAL DRIVERS
 M:      "David S. Miller" <davem@davemloft.net>
diff --git a/arch/sparc/configs/sparc64_defconfig b/arch/sparc/configs/sparc64_defconfig
index 259e3fd50993..1dc07a0014c1 100644
--- a/arch/sparc/configs/sparc64_defconfig
+++ b/arch/sparc/configs/sparc64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.34-rc3
-# Sat Apr  3 15:49:56 2010
+# Linux kernel version: 2.6.34
+# Wed May 26 21:14:01 2010
 #
 CONFIG_64BIT=y
 CONFIG_SPARC=y
@@ -107,10 +107,9 @@ CONFIG_PERF_COUNTERS=y
 # CONFIG_DEBUG_PERF_USE_VMALLOC is not set
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_PCI_QUIRKS=y
-CONFIG_SLUB_DEBUG=y
 # CONFIG_COMPAT_BRK is not set
-# CONFIG_SLAB is not set
-CONFIG_SLUB=y
+CONFIG_SLAB=y
+# CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 CONFIG_PROFILING=y
 CONFIG_TRACEPOINTS=y
@@ -239,6 +238,7 @@ CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
 CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
+# CONFIG_COMPACTION is not set
 CONFIG_MIGRATION=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=0
@@ -351,6 +351,7 @@ CONFIG_IPV6_TUNNEL=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
+# CONFIG_L2TP is not set
 # CONFIG_BRIDGE is not set
 # CONFIG_NET_DSA is not set
 CONFIG_VLAN_8021Q=m
@@ -367,6 +368,7 @@ CONFIG_VLAN_8021Q=m
 # CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
 # CONFIG_DCB is not set
+CONFIG_RPS=y
 
 #
 # Network testing
@@ -386,9 +388,14 @@ CONFIG_WIRELESS=y
 #
 # CFG80211 needs to be enabled for MAC80211
 #
+
+#
+# Some wireless drivers require a rate control algorithm
+#
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
+# CONFIG_CAIF is not set
 
 #
 # Device Drivers
@@ -658,6 +665,7 @@ CONFIG_PHYLIB=m
 # CONFIG_NATIONAL_PHY is not set
 # CONFIG_STE10XP is not set
 # CONFIG_LSI_ET1011C_PHY is not set
+# CONFIG_MICREL_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=m
@@ -734,6 +742,8 @@ CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
 CONFIG_CHELSIO_T3_DEPENDS=y
 # CONFIG_CHELSIO_T3 is not set
+CONFIG_CHELSIO_T4_DEPENDS=y
+# CONFIG_CHELSIO_T4 is not set
 # CONFIG_ENIC is not set
 # CONFIG_IXGBE is not set
 # CONFIG_IXGBEVF is not set
@@ -766,6 +776,7 @@ CONFIG_NIU=m
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
 # CONFIG_USB_USBNET is not set
+# CONFIG_USB_IPHETH is not set
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
@@ -778,7 +789,6 @@ CONFIG_PPP_DEFLATE=m
 CONFIG_PPP_BSDCOMP=m
 CONFIG_PPP_MPPE=m
 CONFIG_PPPOE=m
-# CONFIG_PPPOL2TP is not set
 # CONFIG_SLIP is not set
 CONFIG_SLHC=m
 # CONFIG_NET_FC is not set
@@ -816,6 +826,7 @@ CONFIG_INPUT_KEYBOARD=y
 CONFIG_KEYBOARD_ATKBD=y
 # CONFIG_QT2160 is not set
 CONFIG_KEYBOARD_LKKBD=m
+# CONFIG_KEYBOARD_TCA6416 is not set
 # CONFIG_KEYBOARD_MAX7359 is not set
 # CONFIG_KEYBOARD_NEWTON is not set
 # CONFIG_KEYBOARD_OPENCORES is not set
@@ -840,6 +851,7 @@ CONFIG_MOUSE_SERIAL=y
 # CONFIG_INPUT_TABLET is not set
 # CONFIG_INPUT_TOUCHSCREEN is not set
 CONFIG_INPUT_MISC=y
+# CONFIG_INPUT_AD714X is not set
 CONFIG_INPUT_SPARCSPKR=y
 # CONFIG_INPUT_ATI_REMOTE is not set
 # CONFIG_INPUT_ATI_REMOTE2 is not set
@@ -848,6 +860,7 @@ CONFIG_INPUT_SPARCSPKR=y
 # CONFIG_INPUT_YEALINK is not set
 # CONFIG_INPUT_CM109 is not set
 # CONFIG_INPUT_UINPUT is not set
+# CONFIG_INPUT_PCF8574 is not set
 
 #
 # Hardware I/O ports
@@ -871,6 +884,7 @@ CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_DEVKMEM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
+# CONFIG_N_GSM is not set
 # CONFIG_NOZOMI is not set
 
 #
@@ -893,6 +907,8 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
 # CONFIG_SERIAL_TIMBERDALE is not set
 # CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
+# CONFIG_SERIAL_ALTERA_JTAGUART is not set
+# CONFIG_SERIAL_ALTERA_UART is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 # CONFIG_LEGACY_PTYS is not set
@@ -1306,11 +1322,14 @@ CONFIG_USB_HIDDEV=y
 CONFIG_HID_A4TECH=y
 CONFIG_HID_APPLE=y
 CONFIG_HID_BELKIN=y
+# CONFIG_HID_CANDO is not set
 CONFIG_HID_CHERRY=y
 CONFIG_HID_CHICONY=y
+# CONFIG_HID_PRODIKEYS is not set
 CONFIG_HID_CYPRESS=y
 CONFIG_HID_DRAGONRISE=y
 # CONFIG_DRAGONRISE_FF is not set
+# CONFIG_HID_EGALAX is not set
 CONFIG_HID_EZKEY=y
 CONFIG_HID_KYE=y
 CONFIG_HID_GYRATION=y
@@ -1328,7 +1347,9 @@ CONFIG_HID_ORTEK=y
 CONFIG_HID_PANTHERLORD=y
 # CONFIG_PANTHERLORD_FF is not set
 CONFIG_HID_PETALYNX=y
+# CONFIG_HID_PICOLCD is not set
 # CONFIG_HID_QUANTA is not set
+# CONFIG_HID_ROCCAT_KONE is not set
 CONFIG_HID_SAMSUNG=y
 CONFIG_HID_SONY=y
 # CONFIG_HID_STANTUM is not set
@@ -1342,6 +1363,7 @@ CONFIG_HID_THRUSTMASTER=y
 # CONFIG_THRUSTMASTER_FF is not set
 CONFIG_HID_ZEROPLUS=y
 # CONFIG_ZEROPLUS_FF is not set
+# CONFIG_HID_ZYDACRON is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
@@ -1356,7 +1378,6 @@ CONFIG_USB=y
 # CONFIG_USB_DEVICEFS is not set
 # CONFIG_USB_DEVICE_CLASS is not set
 # CONFIG_USB_DYNAMIC_MINORS is not set
-# CONFIG_USB_OTG is not set
 # CONFIG_USB_MON is not set
 # CONFIG_USB_WUSB is not set
 # CONFIG_USB_WUSB_CBAF is not set
@@ -1521,10 +1542,6 @@ CONFIG_RTC_DRV_STARFIRE=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
-
-#
-# TI VLYNQ
-#
 # CONFIG_STAGING is not set
 
 #
@@ -1706,8 +1723,8 @@ CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
 CONFIG_SCHEDSTATS=y
 # CONFIG_TIMER_STATS is not set
 # CONFIG_DEBUG_OBJECTS is not set
-# CONFIG_SLUB_DEBUG_ON is not set
-# CONFIG_SLUB_STATS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_KMEMLEAK is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
@@ -1742,6 +1759,9 @@ CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_DEBUG_PAGEALLOC is not set
 CONFIG_NOP_TRACER=y
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
 CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
@@ -1769,12 +1789,12 @@ CONFIG_BLK_DEV_IO_TRACE=y
 # CONFIG_RING_BUFFER_BENCHMARK is not set
 # CONFIG_DYNAMIC_DEBUG is not set
 # CONFIG_DMA_API_DEBUG is not set
+# CONFIG_ATOMIC64_SELFTEST is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_DCFLUSH is not set
-# CONFIG_STACK_DEBUG is not set
 # CONFIG_DEBUG_STRICT_USER_COPY_CHECKS is not set
 
 #
@@ -1895,6 +1915,7 @@ CONFIG_CRYPTO_DEFLATE=y
 #
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_HW=y
+# CONFIG_CRYPTO_DEV_NIAGARA2 is not set
 # CONFIG_CRYPTO_DEV_HIFN_795X is not set
 CONFIG_BINARY_PRINTF=y
 
diff --git a/arch/sparc/include/asm/cache.h b/arch/sparc/include/asm/cache.h
index 0588b8c7faa2..69358b590c91 100644
--- a/arch/sparc/include/asm/cache.h
+++ b/arch/sparc/include/asm/cache.h
@@ -11,7 +11,6 @@
 
 #define L1_CACHE_SHIFT 5
 #define L1_CACHE_BYTES 32
-#define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
 
 #ifdef CONFIG_SPARC32
 #define SMP_CACHE_BYTES_SHIFT 5
diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h
index 77f906d8cc21..0ece77f47753 100644
--- a/arch/sparc/include/asm/pgtable_32.h
+++ b/arch/sparc/include/asm/pgtable_32.h
@@ -142,13 +142,12 @@ BTFIXUPDEF_CALL_CONST(unsigned long, pgd_page_vaddr, pgd_t)
 #define pmd_page(pmd) BTFIXUP_CALL(pmd_page)(pmd)
 #define pgd_page_vaddr(pgd) BTFIXUP_CALL(pgd_page_vaddr)(pgd)
 
-BTFIXUPDEF_SETHI(none_mask)
 BTFIXUPDEF_CALL_CONST(int, pte_present, pte_t)
 BTFIXUPDEF_CALL(void, pte_clear, pte_t *)
 
 static inline int pte_none(pte_t pte)
 {
-        return !(pte_val(pte) & ~BTFIXUP_SETHI(none_mask));
+        return !pte_val(pte);
 }
 
 #define pte_present(pte) BTFIXUP_CALL(pte_present)(pte)
@@ -160,7 +159,7 @@ BTFIXUPDEF_CALL(void, pmd_clear, pmd_t *)
 
 static inline int pmd_none(pmd_t pmd)
 {
-        return !(pmd_val(pmd) & ~BTFIXUP_SETHI(none_mask));
+        return !pmd_val(pmd);
 }
 
 #define pmd_bad(pmd) BTFIXUP_CALL(pmd_bad)(pmd)
diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
index 0ec92c8861dd..44faabc3c02c 100644
--- a/arch/sparc/kernel/perf_event.c
+++ b/arch/sparc/kernel/perf_event.c
@@ -657,6 +657,7 @@ static u64 maybe_change_configuration(struct cpu_hw_events *cpuc, u64 pcr)
                 cpuc->current_idx[i] = idx;
 
                 enc = perf_event_get_enc(cpuc->events[i]);
+                pcr &= ~mask_for_index(idx);
                 pcr |= event_encoding(enc, idx);
         }
 out:
diff --git a/arch/sparc/kernel/sun4d_irq.c b/arch/sparc/kernel/sun4d_irq.c
index ab036a72de5a..e11b4612dabb 100644
--- a/arch/sparc/kernel/sun4d_irq.c
+++ b/arch/sparc/kernel/sun4d_irq.c
@@ -183,7 +183,7 @@ void sun4d_free_irq(unsigned int irq, void *dev_id)
                 goto out_unlock;
         }
         
-        if (action && tmp)
+        if (tmp)
                 tmp->next = action->next;
         else
                 *actionp = action->next;
diff --git a/arch/sparc/kernel/ttable.S b/arch/sparc/kernel/ttable.S
index 76d837fc47d3..c6dfdaa29e20 100644
--- a/arch/sparc/kernel/ttable.S
+++ b/arch/sparc/kernel/ttable.S
@@ -64,7 +64,7 @@ tl0_irq6:	TRAP_IRQ(smp_call_function_single_client, 6)
 tl0_irq6:       BTRAP(0x46)
 #endif
 tl0_irq7:       TRAP_IRQ(deferred_pcr_work_irq, 7)
-#ifdef CONFIG_KGDB
+#if defined(CONFIG_KGDB) && defined(CONFIG_SMP)
 tl0_irq8:       TRAP_IRQ(smp_kgdb_capture_client, 8)
 #else
 tl0_irq8:       BTRAP(0x48)
diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
index f5f75a58e0b3..b0b43aa5e45a 100644
--- a/arch/sparc/mm/srmmu.c
+++ b/arch/sparc/mm/srmmu.c
@@ -2215,8 +2215,6 @@ void __init ld_mmu_srmmu(void)
         BTFIXUPSET_CALL(pmd_page, srmmu_pmd_page, BTFIXUPCALL_NORM);
         BTFIXUPSET_CALL(pgd_page_vaddr, srmmu_pgd_page, BTFIXUPCALL_NORM);
 
-        BTFIXUPSET_SETHI(none_mask, 0xF0000000);
-
         BTFIXUPSET_CALL(pte_present, srmmu_pte_present, BTFIXUPCALL_NORM);
         BTFIXUPSET_CALL(pte_clear, srmmu_pte_clear, BTFIXUPCALL_SWAPO0G0);
 
diff --git a/arch/sparc/mm/sun4c.c b/arch/sparc/mm/sun4c.c
index cf38846753dd..4289f90f8697 100644
--- a/arch/sparc/mm/sun4c.c
+++ b/arch/sparc/mm/sun4c.c
@@ -2087,9 +2087,6 @@ void __init ld_mmu_sun4c(void)
 
         BTFIXUPSET_CALL(set_pte, sun4c_set_pte, BTFIXUPCALL_STO1O0);
 
-        /* The 2.4.18 code does not set this on sun4c, how does it work? XXX */
-        /* BTFIXUPSET_SETHI(none_mask, 0x00000000); */  /* Defaults to zero? */
-
         BTFIXUPSET_CALL(pte_pfn, sun4c_pte_pfn, BTFIXUPCALL_NORM);
 #if 0 /* PAGE_SHIFT <= 12 */ /* Eek. Investigate. XXX */
         BTFIXUPSET_CALL(pmd_page, sun4c_pmd_page, BTFIXUPCALL_ANDNINT(PAGE_SIZE - 1));
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index de3b63ae3da2..a60df9ae6454 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -238,6 +238,15 @@ void __init setup_per_cpu_areas(void)
 #ifdef CONFIG_NUMA
                 per_cpu(x86_cpu_to_node_map, cpu) =
                         early_per_cpu_map(x86_cpu_to_node_map, cpu);
+                /*
+                 * Ensure that the boot cpu numa_node is correct when the boot
+                 * cpu is on a node that doesn't have memory installed.
+                 * Also cpu_up() will call cpu_to_node() for APs when
+                 * MEMORY_HOTPLUG is defined, before per_cpu(numa_node) is set
+                 * up later with c_init aka intel_init/amd_init.
+                 * So set them all (boot cpu and all APs).
+                 */
+                set_cpu_numa_node(cpu, early_cpu_to_node(cpu));
 #endif
 #endif
                 /*
@@ -257,14 +266,6 @@ void __init setup_per_cpu_areas(void)
         early_per_cpu_ptr(x86_cpu_to_node_map) = NULL;
 #endif
 
-#if defined(CONFIG_X86_64) && defined(CONFIG_NUMA)
-        /*
-         * make sure boot cpu numa_node is right, when boot cpu is on the
-         * node that doesn't have mem installed
-         */
-        set_cpu_numa_node(boot_cpu_id, early_cpu_to_node(boot_cpu_id));
-#endif
-
         /* Setup node to cpumask map */
         setup_node_to_cpumask_map();
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 3699613e8830..b1ed0a1a5913 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2926,7 +2926,7 @@ static int kvm_mmu_remove_some_alloc_mmu_pages(struct kvm *kvm)
         return kvm_mmu_zap_page(kvm, page) + 1;
 }
 
-static int mmu_shrink(int nr_to_scan, gfp_t gfp_mask)
+static int mmu_shrink(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
         struct kvm *kvm;
         struct kvm *kvm_freed = NULL;
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index d7be69f13154..b7dab32ce63c 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -194,6 +194,6 @@ err_timer:
 
 module_init(cs5535_mfgpt_init);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_DESCRIPTION("CS5535/CS5536 MFGPT clock event driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index aedef7941b22..0d2f9dbb47e4 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -209,7 +209,7 @@ config EDAC_I5100
 
 config EDAC_MPC85XX
         tristate "Freescale MPC83xx / MPC85xx"
-        depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || MPC85xx)
+        depends on EDAC_MM_EDAC && FSL_SOC && (PPC_83xx || PPC_85xx)
         help
           Support for error detection and correction on the Freescale
           MPC8349, MPC8560, MPC8540, MPC8548
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 52ca09bf4726..f39b00a46eda 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -1120,6 +1120,7 @@ static struct of_device_id mpc85xx_mc_err_of_match[] = {
         { .compatible = "fsl,mpc8555-memory-controller", },
         { .compatible = "fsl,mpc8560-memory-controller", },
         { .compatible = "fsl,mpc8568-memory-controller", },
+        { .compatible = "fsl,mpc8569-memory-controller", },
         { .compatible = "fsl,mpc8572-memory-controller", },
         { .compatible = "fsl,mpc8349-memory-controller", },
         { .compatible = "fsl,p2020-memory-controller", },
diff --git a/drivers/gpio/cs5535-gpio.c b/drivers/gpio/cs5535-gpio.c
index f73a1555e49d..e23c06893d19 100644
--- a/drivers/gpio/cs5535-gpio.c
+++ b/drivers/gpio/cs5535-gpio.c
@@ -352,6 +352,6 @@ static void __exit cs5535_gpio_exit(void)
 module_init(cs5535_gpio_init);
 module_exit(cs5535_gpio_exit);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_DESCRIPTION("AMD CS5535/CS5536 GPIO driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 8757ecf6e96b..51bd301cf10d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -4742,6 +4742,16 @@ i915_gem_load(struct drm_device *dev)
         list_add(&dev_priv->mm.shrink_list, &shrink_list);
         spin_unlock(&shrink_list_lock);
 
+        /* On GEN3 we really need to make sure the ARB C3 LP bit is set */
+        if (IS_GEN3(dev)) {
+                u32 tmp = I915_READ(MI_ARB_STATE);
+                if (!(tmp & MI_ARB_C3_LP_WRITE_ENABLE)) {
+                        /* arb state is a masked write, so set bit + bit in mask */
+                        tmp = MI_ARB_C3_LP_WRITE_ENABLE | (MI_ARB_C3_LP_WRITE_ENABLE << MI_ARB_MASK_SHIFT);
+                        I915_WRITE(MI_ARB_STATE, tmp);
+                }
+        }
+
         /* Old X drivers will take 0-2 for front, back, depth buffers */
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 dev_priv->fence_reg_start = 3;
@@ -4978,7 +4988,7 @@ i915_gpu_is_active(struct drm_device *dev)
 }
 
 static int
-i915_gem_shrink(int nr_to_scan, gfp_t gfp_mask)
+i915_gem_shrink(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
         drm_i915_private_t *dev_priv, *next_dev;
         struct drm_i915_gem_object *obj_priv, *next_obj;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 150400f40534..6d9b0288272a 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -359,6 +359,70 @@
 #define LM_BURST_LENGTH     0x00000700
 #define LM_FIFO_WATERMARK   0x0000001F
 #define MI_ARB_STATE    0x020e4 /* 915+ only */
+#define   MI_ARB_MASK_SHIFT       16    /* shift for enable bits */
+
+/* Make render/texture TLB fetches lower priorty than associated data
+ *   fetches. This is not turned on by default
+ */
+#define   MI_ARB_RENDER_TLB_LOW_PRIORITY        (1 << 15)
+
+/* Isoch request wait on GTT enable (Display A/B/C streams).
+ * Make isoch requests stall on the TLB update. May cause
+ * display underruns (test mode only)
+ */
+#define   MI_ARB_ISOCH_WAIT_GTT                 (1 << 14)
+
+/* Block grant count for isoch requests when block count is
+ * set to a finite value.
+ */
+#define   MI_ARB_BLOCK_GRANT_MASK               (3 << 12)
+#define   MI_ARB_BLOCK_GRANT_8                  (0 << 12)       /* for 3 display planes */
+#define   MI_ARB_BLOCK_GRANT_4                  (1 << 12)       /* for 2 display planes */
+#define   MI_ARB_BLOCK_GRANT_2                  (2 << 12)       /* for 1 display plane */
+#define   MI_ARB_BLOCK_GRANT_0                  (3 << 12)       /* don't use */
+
+/* Enable render writes to complete in C2/C3/C4 power states.
+ * If this isn't enabled, render writes are prevented in low
+ * power states. That seems bad to me.
+ */
+#define   MI_ARB_C3_LP_WRITE_ENABLE             (1 << 11)
+
+/* This acknowledges an async flip immediately instead
+ * of waiting for 2TLB fetches.
+ */
+#define   MI_ARB_ASYNC_FLIP_ACK_IMMEDIATE       (1 << 10)
+
+/* Enables non-sequential data reads through arbiter
+ */
+#define   MI_ARB_DUAL_DATA_PHASE_DISABLE        (1 << 9)
+
+/* Disable FSB snooping of cacheable write cycles from binner/render
+ * command stream
+ */
+#define   MI_ARB_CACHE_SNOOP_DISABLE            (1 << 8)
+
+/* Arbiter time slice for non-isoch streams */
+#define   MI_ARB_TIME_SLICE_MASK                (7 << 5)
+#define   MI_ARB_TIME_SLICE_1                   (0 << 5)
+#define   MI_ARB_TIME_SLICE_2                   (1 << 5)
+#define   MI_ARB_TIME_SLICE_4                   (2 << 5)
+#define   MI_ARB_TIME_SLICE_6                   (3 << 5)
+#define   MI_ARB_TIME_SLICE_8                   (4 << 5)
+#define   MI_ARB_TIME_SLICE_10                  (5 << 5)
+#define   MI_ARB_TIME_SLICE_14                  (6 << 5)
+#define   MI_ARB_TIME_SLICE_16                  (7 << 5)
+
+/* Low priority grace period page size */
+#define   MI_ARB_LOW_PRIORITY_GRACE_4KB         (0 << 4)        /* default */
+#define   MI_ARB_LOW_PRIORITY_GRACE_8KB         (1 << 4)
+
+/* Disable display A/B trickle feed */
+#define   MI_ARB_DISPLAY_TRICKLE_FEED_DISABLE   (1 << 2)
+
+/* Set display plane priority */
+#define   MI_ARB_DISPLAY_PRIORITY_A_B           (0 << 0)        /* display A > display B */
+#define   MI_ARB_DISPLAY_PRIORITY_B_A           (1 << 0)        /* display B > display A */
+
 #define CACHE_MODE_0    0x02120 /* 915+ only */
 #define   CM0_MASK_SHIFT          16
 #define   CM0_IZ_OPT_DISABLE      (1<<6)
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index fc924b649195..e492919faf44 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -203,36 +203,26 @@ struct methods {
         const bool rw;
 };
 
-static struct methods nv04_methods[] = {
-        { "PROM", load_vbios_prom, false },
-        { "PRAMIN", load_vbios_pramin, true },
-        { "PCIROM", load_vbios_pci, true },
-};
-
-static struct methods nv50_methods[] = {
-        { "ACPI", load_vbios_acpi, true },
+static struct methods shadow_methods[] = {
         { "PRAMIN", load_vbios_pramin, true },
         { "PROM", load_vbios_prom, false },
         { "PCIROM", load_vbios_pci, true },
+        { "ACPI", load_vbios_acpi, true },
 };
 
-#define METHODCNT 3
-
 static bool NVShadowVBIOS(struct drm_device *dev, uint8_t *data)
 {
-        struct drm_nouveau_private *dev_priv = dev->dev_private;
-        struct methods *methods;
-        int i;
+        const int nr_methods = ARRAY_SIZE(shadow_methods);
+        struct methods *methods = shadow_methods;
         int testscore = 3;
-        int scores[METHODCNT];
+        int scores[nr_methods], i;
 
         if (nouveau_vbios) {
-                methods = nv04_methods;
-                for (i = 0; i < METHODCNT; i++)
+                for (i = 0; i < nr_methods; i++)
                         if (!strcasecmp(nouveau_vbios, methods[i].desc))
                                 break;
 
-                if (i < METHODCNT) {
+                if (i < nr_methods) {
                         NV_INFO(dev, "Attempting to use BIOS image from %s\n",
                                 methods[i].desc);
 
@@ -244,12 +234,7 @@ static bool NVShadowVBIOS(struct drm_device *dev, uint8_t *data)
                 NV_ERROR(dev, "VBIOS source \'%s\' invalid\n", nouveau_vbios);
         }
 
-        if (dev_priv->card_type < NV_50)
-                methods = nv04_methods;
-        else
-                methods = nv50_methods;
-
-        for (i = 0; i < METHODCNT; i++) {
+        for (i = 0; i < nr_methods; i++) {
                 NV_TRACE(dev, "Attempting to load BIOS image from %s\n",
                          methods[i].desc);
                 data[0] = data[1] = 0;  /* avoid reuse of previous image */
@@ -260,7 +245,7 @@ static bool NVShadowVBIOS(struct drm_device *dev, uint8_t *data)
         }
 
         while (--testscore > 0) {
-                for (i = 0; i < METHODCNT; i++) {
+                for (i = 0; i < nr_methods; i++) {
                         if (scores[i] == testscore) {
                                 NV_TRACE(dev, "Using BIOS image from %s\n",
                                          methods[i].desc);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index c9a4a0d2a115..257ea130ae13 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -387,7 +387,8 @@ int nouveau_fbcon_init(struct drm_device *dev)
         dev_priv->nfbdev = nfbdev;
         nfbdev->helper.funcs = &nouveau_fbcon_helper_funcs;
 
-        ret = drm_fb_helper_init(dev, &nfbdev->helper, 2, 4);
+        ret = drm_fb_helper_init(dev, &nfbdev->helper,
+                                 nv_two_heads(dev) ? 2 : 1, 4);
         if (ret) {
                 kfree(nfbdev);
                 return ret;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 3970e62eaab8..aab5ba040bd6 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2354,6 +2354,7 @@ void r100_mc_init(struct radeon_device *rdev)
         if (rdev->flags & RADEON_IS_IGP)
                 base = (RREG32(RADEON_NB_TOM) & 0xffff) << 16;
         radeon_vram_location(rdev, &rdev->mc, base);
+        rdev->mc.gtt_base_align = 0;
         if (!(rdev->flags & RADEON_IS_AGP))
                 radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 7e81db5eb804..19a7ef7ee344 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -481,6 +481,7 @@ void r300_mc_init(struct radeon_device *rdev)
         if (rdev->flags & RADEON_IS_IGP)
                 base = (RREG32(RADEON_NB_TOM) & 0xffff) << 16;
         radeon_vram_location(rdev, &rdev->mc, base);
+        rdev->mc.gtt_base_align = 0;
         if (!(rdev->flags & RADEON_IS_AGP))
                 radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
@@ -1176,6 +1177,8 @@ int r300_cs_parse(struct radeon_cs_parser *p)
         int r;
 
         track = kzalloc(sizeof(*track), GFP_KERNEL);
+        if (track == NULL)
+                return -ENOMEM;
         r100_cs_track_clear(p->rdev, track);
         p->track = track;
         do {
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 34330df28483..694af7cc23ac 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -125,6 +125,7 @@ void r520_mc_init(struct radeon_device *rdev)
         r520_vram_get_type(rdev);
         r100_vram_init_sizes(rdev);
         radeon_vram_location(rdev, &rdev->mc, 0);
+        rdev->mc.gtt_base_align = 0;
         if (!(rdev->flags & RADEON_IS_AGP))
                 radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 3d6645ce2151..e100f69faeec 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1179,6 +1179,7 @@ void r600_vram_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
                 if (rdev->flags & RADEON_IS_IGP)
                         base = (RREG32(MC_VM_FB_LOCATION) & 0xFFFF) << 24;
                 radeon_vram_location(rdev, &rdev->mc, base);
+                rdev->mc.gtt_base_align = 0;
                 radeon_gtt_location(rdev, mc);
         }
 }
diff --git a/drivers/gpu/drm/radeon/r600_blit.c b/drivers/gpu/drm/radeon/r600_blit.c
index f4fb88ece2bb..ca5c29f70779 100644
--- a/drivers/gpu/drm/radeon/r600_blit.c
+++ b/drivers/gpu/drm/radeon/r600_blit.c
@@ -538,9 +538,12 @@ int
 r600_prepare_blit_copy(struct drm_device *dev, struct drm_file *file_priv)
 {
         drm_radeon_private_t *dev_priv = dev->dev_private;
+        int ret;
         DRM_DEBUG("\n");
 
-        r600_nomm_get_vb(dev);
+        ret = r600_nomm_get_vb(dev);
+        if (ret)
+                return ret;
 
         dev_priv->blit_vb->file_priv = file_priv;
 
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index ab61aaa887bb..2f94dc66c183 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -351,6 +351,7 @@ struct radeon_mc {
         int                     vram_mtrr;
         bool                    vram_is_ddr;
         bool                    igp_sideport_enabled;
+        u64                     gtt_base_align;
 };
 
 bool radeon_combios_sideport_present(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 99bd8a9c56b3..10673ae59cfa 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -280,6 +280,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                 }
         }
 
+        /* ASUS HD 3600 board lists the DVI port as HDMI */
+        if ((dev->pdev->device == 0x9598) &&
+            (dev->pdev->subsystem_vendor == 0x1043) &&
+            (dev->pdev->subsystem_device == 0x01e4)) {
+                if (*connector_type == DRM_MODE_CONNECTOR_HDMIA) {
+                        *connector_type = DRM_MODE_CONNECTOR_DVII;
+                }
+        }
+
         /* ASUS HD 3450 board lists the DVI port as HDMI */
         if ((dev->pdev->device == 0x95C5) &&
             (dev->pdev->subsystem_vendor == 0x1043) &&
@@ -1029,8 +1038,15 @@ bool radeon_atombios_sideport_present(struct radeon_device *rdev)
                                       data_offset);
                 switch (crev) {
                 case 1:
-                        if (igp_info->info.ucMemoryType & 0xf0)
-                                return true;
+                        /* AMD IGPS */
+                        if ((rdev->family == CHIP_RS690) ||
+                            (rdev->family == CHIP_RS740)) {
+                                if (igp_info->info.ulBootUpMemoryClock)
+                                        return true;
+                        } else {
+                                if (igp_info->info.ucMemoryType & 0xf0)
+                                        return true;
+                        }
                         break;
                 case 2:
                         if (igp_info->info_2.ucMemoryType & 0x0f)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index f58f8bd8f77b..adccbc2c202c 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -771,14 +771,14 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                         } else
                                 ret = connector_status_connected;
 
-                        /* multiple connectors on the same encoder with the same ddc line
-                         * This tends to be HDMI and DVI on the same encoder with the
-                         * same ddc line.  If the edid says HDMI, consider the HDMI port
-                         * connected and the DVI port disconnected.  If the edid doesn't
-                         * say HDMI, vice versa.
+                        /* This gets complicated.  We have boards with VGA + HDMI with a
+                         * shared DDC line and we have boards with DVI-D + HDMI with a shared
+                         * DDC line.  The latter is more complex because with DVI<->HDMI adapters
+                         * you don't really know what's connected to which port as both are digital.
                          */
                         if (radeon_connector->shared_ddc && (ret == connector_status_connected)) {
                                 struct drm_device *dev = connector->dev;
+                                struct radeon_device *rdev = dev->dev_private;
                                 struct drm_connector *list_connector;
                                 struct radeon_connector *list_radeon_connector;
                                 list_for_each_entry(list_connector, &dev->mode_config.connector_list, head) {
@@ -788,15 +788,10 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                                         if (list_radeon_connector->shared_ddc &&
                                             (list_radeon_connector->ddc_bus->rec.i2c_id ==
                                              radeon_connector->ddc_bus->rec.i2c_id)) {
-                                                if (drm_detect_hdmi_monitor(radeon_connector->edid)) {
-                                                        if (connector->connector_type == DRM_MODE_CONNECTOR_DVID) {
-                                                                kfree(radeon_connector->edid);
-                                                                radeon_connector->edid = NULL;
-                                                                ret = connector_status_disconnected;
-                                                        }
-                                                } else {
-                                                        if ((connector->connector_type == DRM_MODE_CONNECTOR_HDMIA) ||
-                                                            (connector->connector_type == DRM_MODE_CONNECTOR_HDMIB)) {
+                                                /* cases where both connectors are digital */
+                                                if (list_connector->connector_type != DRM_MODE_CONNECTOR_VGA) {
+                                                        /* hpd is our only option in this case */
+                                                        if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
                                                                 kfree(radeon_connector->edid);
                                                                 radeon_connector->edid = NULL;
                                                                 ret = connector_status_disconnected;
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 5f317317aba2..dd279da90546 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -226,20 +226,20 @@ void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc)
 {
         u64 size_af, size_bf;
 
-        size_af = 0xFFFFFFFF - mc->vram_end;
-        size_bf = mc->vram_start;
+        size_af = ((0xFFFFFFFF - mc->vram_end) + mc->gtt_base_align) & ~mc->gtt_base_align;
+        size_bf = mc->vram_start & ~mc->gtt_base_align;
         if (size_bf > size_af) {
                 if (mc->gtt_size > size_bf) {
                         dev_warn(rdev->dev, "limiting GTT\n");
                         mc->gtt_size = size_bf;
                 }
-                mc->gtt_start = mc->vram_start - mc->gtt_size;
+                mc->gtt_start = (mc->vram_start & ~mc->gtt_base_align) - mc->gtt_size;
         } else {
                 if (mc->gtt_size > size_af) {
                         dev_warn(rdev->dev, "limiting GTT\n");
                         mc->gtt_size = size_af;
                 }
-                mc->gtt_start = mc->vram_end + 1;
+                mc->gtt_start = (mc->vram_end + 1 + mc->gtt_base_align) & ~mc->gtt_base_align;
         }
         mc->gtt_end = mc->gtt_start + mc->gtt_size - 1;
         dev_info(rdev->dev, "GTT: %lluM 0x%08llX - 0x%08llX\n",
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_tv.c b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
index f2ed27c8055b..032040397743 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_tv.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_tv.c
@@ -642,8 +642,8 @@ void radeon_legacy_tv_mode_set(struct drm_encoder *encoder,
         }
         flicker_removal = (tmp + 500) / 1000;
 
-        if (flicker_removal < 2)
-                flicker_removal = 2;
+        if (flicker_removal < 3)
+                flicker_removal = 3;
         for (i = 0; i < ARRAY_SIZE(SLOPE_limit); ++i) {
                 if (flicker_removal == SLOPE_limit[i])
                         break;
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 9e4240b3bf0b..f454c9a5e7f2 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -57,7 +57,9 @@ void rs400_gart_adjust_size(struct radeon_device *rdev)
         }
         if (rdev->family == CHIP_RS400 || rdev->family == CHIP_RS480) {
                 /* FIXME: RS400 & RS480 seems to have issue with GART size
-                 * if 4G of system memory (needs more testing) */
+                 * if 4G of system memory (needs more testing)
+                 */
+                /* XXX is this still an issue with proper alignment? */
                 rdev->mc.gtt_size = 32 * 1024 * 1024;
                 DRM_ERROR("Forcing to 32M GART size (because of ASIC bug ?)\n");
         }
@@ -263,6 +265,7 @@ void rs400_mc_init(struct radeon_device *rdev)
         r100_vram_init_sizes(rdev);
         base = (RREG32(RADEON_NB_TOM) & 0xffff) << 16;
         radeon_vram_location(rdev, &rdev->mc, base);
+        rdev->mc.gtt_base_align = rdev->mc.gtt_size - 1;
         radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 7bb4c3e52f3b..6dc15ea8ba33 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -698,6 +698,7 @@ void rs600_mc_init(struct radeon_device *rdev)
         base = G_000004_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         radeon_vram_location(rdev, &rdev->mc, base);
+        rdev->mc.gtt_base_align = 0;
         radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index f4f0a61bcdce..ce4ecbe10816 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -162,6 +162,7 @@ void rs690_mc_init(struct radeon_device *rdev)
         rs690_pm_info(rdev);
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         radeon_vram_location(rdev, &rdev->mc, base);
+        rdev->mc.gtt_base_align = rdev->mc.gtt_size - 1;
         radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 }
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 7d9a7b0a180a..0c9c169a6852 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -195,6 +195,7 @@ void rv515_mc_init(struct radeon_device *rdev)
         rv515_vram_get_type(rdev);
         r100_vram_init_sizes(rdev);
         radeon_vram_location(rdev, &rdev->mc, 0);
+        rdev->mc.gtt_base_align = 0;
         if (!(rdev->flags & RADEON_IS_AGP))
                 radeon_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index b1d67dc973dc..d233c65f3f7f 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -40,7 +40,9 @@
 #include <linux/slab.h>
 
 #include <asm/atomic.h>
+#ifdef TTM_HAS_AGP
 #include <asm/agp.h>
+#endif
 
 #include "ttm/ttm_bo_driver.h"
 #include "ttm/ttm_page_alloc.h"
@@ -392,7 +394,7 @@ static int ttm_pool_get_num_unused_pages(void)
 /**
  * Callback for mm to request pool to reduce number of page held.
  */
-static int ttm_pool_mm_shrink(int shrink_pages, gfp_t gfp_mask)
+static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
 {
         static atomic_t start_pool = ATOMIC_INIT(0);
         unsigned i;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index f1d626112415..437ac786277a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -972,6 +972,7 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
         ret = copy_from_user(rects, user_rects, rects_size);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Failed to get rects.\n");
+                ret = -EFAULT;
                 goto out_free;
         }
 
diff --git a/drivers/misc/cs5535-mfgpt.c b/drivers/misc/cs5535-mfgpt.c
index 9bec24db4d41..2d44b3300104 100644
--- a/drivers/misc/cs5535-mfgpt.c
+++ b/drivers/misc/cs5535-mfgpt.c
@@ -366,6 +366,6 @@ static int __init cs5535_mfgpt_init(void)
 
 module_init(cs5535_mfgpt_init);
 
-MODULE_AUTHOR("Andres Salomon <dilinger@collabora.co.uk>");
+MODULE_AUTHOR("Andres Salomon <dilinger@queued.net>");
 MODULE_DESCRIPTION("CS5535/CS5536 MFGPT timer driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index af217924a76e..ad30f074ee15 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -365,6 +365,26 @@ static int __devinit sdhci_s3c_probe(struct platform_device *pdev)
 
 static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
 {
+        struct sdhci_host *host =  platform_get_drvdata(pdev);
+        struct sdhci_s3c *sc = sdhci_priv(host);
+        int ptr;
+
+        sdhci_remove_host(host, 1);
+
+        for (ptr = 0; ptr < 3; ptr++) {
+                clk_disable(sc->clk_bus[ptr]);
+                clk_put(sc->clk_bus[ptr]);
+        }
+        clk_disable(sc->clk_io);
+        clk_put(sc->clk_io);
+
+        iounmap(host->ioaddr);
+        release_resource(sc->ioarea);
+        kfree(sc->ioarea);
+
+        sdhci_free_host(host);
+        platform_set_drvdata(pdev, NULL);
+
         return 0;
 }
 
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 7acb3edc47ef..2602852cc55a 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -677,7 +677,7 @@ static int ibmveth_close(struct net_device *netdev)
         if (!adapter->pool_config)
                 netif_stop_queue(netdev);
 
-        free_irq(netdev->irq, netdev);
+        h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
 
         do {
                 lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
@@ -689,6 +689,8 @@ static int ibmveth_close(struct net_device *netdev)
                                      lpar_rc);
         }
 
+        free_irq(netdev->irq, netdev);
+
         adapter->rx_no_buffer = *(u64*)(((char*)adapter->buffer_list_addr) + 4096 - 8);
 
         ibmveth_cleanup(adapter);
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 5b3dfb4ab279..33525bf2a3d3 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -1168,6 +1168,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
         int interrupts, nr_serviced = 0, i;
         struct ei_device *ei_local;
         int handled = 0;
+        unsigned long flags;
 
         e8390_base = dev->base_addr;
         ei_local = netdev_priv(dev);
@@ -1176,7 +1177,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
          *      Protect the irq test too.
          */
          
-        spin_lock(&ei_local->page_lock);
+        spin_lock_irqsave(&ei_local->page_lock, flags);
 
         if (ei_local->irqlock) 
         {
@@ -1188,7 +1189,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
                            dev->name, inb_p(e8390_base + EN0_ISR),
                            inb_p(e8390_base + EN0_IMR));
 #endif
-                spin_unlock(&ei_local->page_lock);
+                spin_unlock_irqrestore(&ei_local->page_lock, flags);
                 return IRQ_NONE;
         }
     
@@ -1261,7 +1262,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id)
         ei_local->irqlock = 0;
         outb_p(ENISR_ALL, e8390_base + EN0_IMR);
 
-        spin_unlock(&ei_local->page_lock);
+        spin_unlock_irqrestore(&ei_local->page_lock, flags);
         return IRQ_RETVAL(handled);
 }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 96b6cfbf0a3a..cdc6a5c2e70d 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1316,7 +1316,7 @@ static void rtl8169_get_mac_version(struct rtl8169_private *tp,
                 { 0x7c800000, 0x28000000,       RTL_GIGA_MAC_VER_26 },
 
                 /* 8168C family. */
-                { 0x7cf00000, 0x3ca00000,       RTL_GIGA_MAC_VER_24 },
+                { 0x7cf00000, 0x3cb00000,       RTL_GIGA_MAC_VER_24 },
                 { 0x7cf00000, 0x3c900000,       RTL_GIGA_MAC_VER_23 },
                 { 0x7cf00000, 0x3c800000,       RTL_GIGA_MAC_VER_18 },
                 { 0x7c800000, 0x3c800000,       RTL_GIGA_MAC_VER_24 },
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 77b359162d6c..23c15aa9fbd5 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -730,13 +730,17 @@ static int ath9k_hif_usb_alloc_urbs(struct hif_device_usb *hif_dev)
 
         /* RX */
         if (ath9k_hif_usb_alloc_rx_urbs(hif_dev) < 0)
-                goto err;
+                goto err_rx;
 
         /* Register Read */
         if (ath9k_hif_usb_alloc_reg_in_urb(hif_dev) < 0)
-                goto err;
+                goto err_reg;
 
         return 0;
+err_reg:
+        ath9k_hif_usb_dealloc_rx_urbs(hif_dev);
+err_rx:
+        ath9k_hif_usb_dealloc_tx_urbs(hif_dev);
 err:
         return -ENOMEM;
 }
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index d24dc7dc0723..972a9c3af39e 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -330,6 +330,7 @@ static int prism2_pci_probe(struct pci_dev *pdev,
 
         dev->irq = pdev->irq;
         hw_priv->mem_start = mem;
+        dev->base_addr = (unsigned long) mem;
 
         prism2_pci_cor_sreset(local);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index c2a453a1a991..dc43ebd1f1fd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -97,6 +97,17 @@ static inline void iwl_clear_driver_stations(struct iwl_priv *priv)
         spin_lock_irqsave(&priv->sta_lock, flags);
         memset(priv->stations, 0, sizeof(priv->stations));
         priv->num_stations = 0;
+
+        /*
+         * Remove all key information that is not stored as part of station
+         * information since mac80211 may not have had a
+         * chance to remove all the keys. When device is reconfigured by
+         * mac80211 after an error all keys will be reconfigured.
+         */
+        priv->ucode_key_table = 0;
+        priv->key_mapping_key = 0;
+        memset(priv->wep_keys, 0, sizeof(priv->wep_keys));
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 3ae468c4d760..f20d3eeeea7f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -854,6 +854,11 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                     BIT(NL80211_IFTYPE_WDS);
 
         /*
+         * Initialize configuration work.
+         */
+        INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
+
+        /*
          * Let the driver probe the device to detect the capabilities.
          */
         retval = rt2x00dev->ops->lib->probe_hw(rt2x00dev);
@@ -863,11 +868,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
         }
 
         /*
-         * Initialize configuration work.
-         */
-        INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
-
-        /*
          * Allocate queue array.
          */
         retval = rt2x00queue_allocate(rt2x00dev);
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 29f91fac1dff..a4cd9adfcbc0 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -857,8 +857,10 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev)
 {
         pcmcia_release_configuration(p_dev);
         pcmcia_release_io(p_dev, &p_dev->io);
-        if (p_dev->_irq)
+        if (p_dev->_irq) {
                 free_irq(p_dev->irq, p_dev->priv);
+                p_dev->_irq = 0;
+        }
         if (p_dev->win)
                 pcmcia_release_window(p_dev, p_dev->win);
 }
diff --git a/drivers/power/ds2782_battery.c b/drivers/power/ds2782_battery.c
index d762a0cbc6af..2afbeec8b791 100644
--- a/drivers/power/ds2782_battery.c
+++ b/drivers/power/ds2782_battery.c
@@ -163,7 +163,7 @@ static int ds2782_get_capacity(struct ds278x_info *info, int *capacity)
         if (err)
                 return err;
         *capacity = raw;
-        return raw;
+        return 0;
 }
 
 static int ds2786_get_current(struct ds278x_info *info, int *current_uA)
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index d53e62ab09da..aacbe14e2e7a 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -554,7 +554,7 @@ static int opiocgetnext(unsigned int cmd, void __user *argp)
 static int openprom_bsd_ioctl(struct file * file,
                               unsigned int cmd, unsigned long arg)
 {
-        DATA *data = (DATA *) file->private_data;
+        DATA *data = file->private_data;
         void __user *argp = (void __user *)arg;
         int err;
 
@@ -601,7 +601,7 @@ static int openprom_bsd_ioctl(struct file * file,
 static long openprom_ioctl(struct file * file,
                            unsigned int cmd, unsigned long arg)
 {
-        DATA *data = (DATA *) file->private_data;
+        DATA *data = file->private_data;
 
         switch (cmd) {
         case OPROMGETOPT:
diff --git a/drivers/serial/suncore.c b/drivers/serial/suncore.c
index ed7d958b0a01..544f2e25d0e5 100644
--- a/drivers/serial/suncore.c
+++ b/drivers/serial/suncore.c
@@ -71,7 +71,9 @@ int sunserial_console_match(struct console *con, struct device_node *dp,
 
         con->index = line;
         drv->cons = con;
-        add_preferred_console(con->name, line, NULL);
+
+        if (!console_set_on_cmdline)
+                add_preferred_console(con->name, line, NULL);
 
         return 1;
 }
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 234459c2f012..ffbf4553f665 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -1500,20 +1500,25 @@ out_unmap:
 static int __devexit su_remove(struct of_device *op)
 {
         struct uart_sunsu_port *up = dev_get_drvdata(&op->dev);
+        bool kbdms = false;
 
         if (up->su_type == SU_PORT_MS ||
-            up->su_type == SU_PORT_KBD) {
+            up->su_type == SU_PORT_KBD)
+                kbdms = true;
+
+        if (kbdms) {
 #ifdef CONFIG_SERIO
                 serio_unregister_port(&up->serio);
 #endif
-                kfree(up);
-        } else if (up->port.type != PORT_UNKNOWN) {
+        } else if (up->port.type != PORT_UNKNOWN)
                 uart_remove_one_port(&sunsu_reg, &up->port);
-        }
 
         if (up->port.membase)
                 of_iounmap(&op->resource[0], up->port.membase, up->reg_size);
 
+        if (kbdms)
+                kfree(up);
+
         dev_set_drvdata(&op->dev, NULL);
 
         return 0;
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index d69eccf5f197..2aaa0f75c6cf 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -136,7 +136,7 @@ struct ffs_data {
          * handling setup requests immidiatelly user space may be so
          * slow that another setup will be sent to the gadget but this
          * time not to us but another function and then there could be
-         * a race.  Is taht the case? Or maybe we can use cdev->req
+         * a race.  Is that the case? Or maybe we can use cdev->req
          * after all, maybe we just need some spinlock for that? */
         struct usb_request              *ep0req;                /* P: mutex */
         struct completion               ep0req_completion;      /* P: mutex */
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 57a593c58cf4..d219070fed3d 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -177,8 +177,8 @@ static void handle_tx(struct vhost_net *net)
                         break;
                 }
                 if (err != len)
-                        pr_err("Truncated TX packet: "
-                               " len %d != %zd\n", err, len);
+                        pr_debug("Truncated TX packet: "
+                                 " len %d != %zd\n", err, len);
                 vhost_add_used_and_signal(&net->dev, vq, head, 0);
                 total_len += len;
                 if (unlikely(total_len >= VHOST_NET_WEIGHT)) {
@@ -275,8 +275,8 @@ static void handle_rx(struct vhost_net *net)
                 }
                 /* TODO: Should check and handle checksum. */
                 if (err > len) {
-                        pr_err("Discarded truncated rx packet: "
-                               " len %d > %zd\n", err, len);
+                        pr_debug("Discarded truncated rx packet: "
+                                 " len %d > %zd\n", err, len);
                         vhost_discard_vq_desc(vq);
                         continue;
                 }
@@ -534,11 +534,16 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         rcu_assign_pointer(vq->private_data, sock);
         vhost_net_enable_vq(n, vq);
 done:
+        mutex_unlock(&vq->mutex);
+
         if (oldsock) {
                 vhost_net_flush_vq(n, index);
                 fput(oldsock->file);
         }
 
+        mutex_unlock(&n->dev.mutex);
+        return 0;
+
 err_vq:
         mutex_unlock(&vq->mutex);
 err:
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 515cf1978d19..c4e17642d9c5 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -2872,7 +2872,7 @@ void radeonfb_pm_init(struct radeonfb_info *rinfo, int dynclk, int ignore_devlis
                 }
 
 #if 0
-                /* Power down TV DAC, taht saves a significant amount of power,
+                /* Power down TV DAC, that saves a significant amount of power,
                  * we'll have something better once we actually have some TVOut
                  * support
                  */
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 0d1d966b0fe4..c3df14ce2cc2 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2304,12 +2304,17 @@ noinline int btrfs_leaf_free_space(struct btrfs_root *root,
         return ret;
 }
 
+/*
+ * min slot controls the lowest index we're willing to push to the
+ * right.  We'll push up to and including min_slot, but no lower
+ */
 static noinline int __push_leaf_right(struct btrfs_trans_handle *trans,
                                       struct btrfs_root *root,
                                       struct btrfs_path *path,
                                       int data_size, int empty,
                                       struct extent_buffer *right,
-                                      int free_space, u32 left_nritems)
+                                      int free_space, u32 left_nritems,
+                                      u32 min_slot)
 {
         struct extent_buffer *left = path->nodes[0];
         struct extent_buffer *upper = path->nodes[1];
@@ -2327,7 +2332,7 @@ static noinline int __push_leaf_right(struct btrfs_trans_handle *trans,
         if (empty)
                 nr = 0;
         else
-                nr = 1;
+                nr = max_t(u32, 1, min_slot);
 
         if (path->slots[0] >= left_nritems)
                 push_space += data_size;
@@ -2469,10 +2474,14 @@ out_unlock:
  *
  * returns 1 if the push failed because the other node didn't have enough
  * room, 0 if everything worked out and < 0 if there were major errors.
+ *
+ * this will push starting from min_slot to the end of the leaf.  It won't
+ * push any slot lower than min_slot
  */
 static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
-                           *root, struct btrfs_path *path, int data_size,
-                           int empty)
+                           *root, struct btrfs_path *path,
+                           int min_data_size, int data_size,
+                           int empty, u32 min_slot)
 {
         struct extent_buffer *left = path->nodes[0];
         struct extent_buffer *right;
@@ -2514,8 +2523,8 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
         if (left_nritems == 0)
                 goto out_unlock;
 
-        return __push_leaf_right(trans, root, path, data_size, empty,
-                                right, free_space, left_nritems);
+        return __push_leaf_right(trans, root, path, min_data_size, empty,
+                                right, free_space, left_nritems, min_slot);
 out_unlock:
         btrfs_tree_unlock(right);
         free_extent_buffer(right);
@@ -2525,12 +2534,17 @@ out_unlock:
 /*
  * push some data in the path leaf to the left, trying to free up at
  * least data_size bytes.  returns zero if the push worked, nonzero otherwise
+ *
+ * max_slot can put a limit on how far into the leaf we'll push items.  The
+ * item at 'max_slot' won't be touched.  Use (u32)-1 to make us do all the
+ * items
  */
 static noinline int __push_leaf_left(struct btrfs_trans_handle *trans,
                                      struct btrfs_root *root,
                                      struct btrfs_path *path, int data_size,
                                      int empty, struct extent_buffer *left,
-                                     int free_space, int right_nritems)
+                                     int free_space, u32 right_nritems,
+                                     u32 max_slot)
 {
         struct btrfs_disk_key disk_key;
         struct extent_buffer *right = path->nodes[0];
@@ -2549,9 +2563,9 @@ static noinline int __push_leaf_left(struct btrfs_trans_handle *trans,
         slot = path->slots[1];
 
         if (empty)
-                nr = right_nritems;
+                nr = min(right_nritems, max_slot);
         else
-                nr = right_nritems - 1;
+                nr = min(right_nritems - 1, max_slot);
 
         for (i = 0; i < nr; i++) {
                 item = btrfs_item_nr(right, i);
@@ -2712,10 +2726,14 @@ out:
 /*
  * push some data in the path leaf to the left, trying to free up at
  * least data_size bytes.  returns zero if the push worked, nonzero otherwise
+ *
+ * max_slot can put a limit on how far into the leaf we'll push items.  The
+ * item at 'max_slot' won't be touched.  Use (u32)-1 to make us push all the
+ * items
  */
 static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
-                          *root, struct btrfs_path *path, int data_size,
-                          int empty)
+                          *root, struct btrfs_path *path, int min_data_size,
+                          int data_size, int empty, u32 max_slot)
 {
         struct extent_buffer *right = path->nodes[0];
         struct extent_buffer *left;
@@ -2761,8 +2779,9 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
                 goto out;
         }
 
-        return __push_leaf_left(trans, root, path, data_size,
-                               empty, left, free_space, right_nritems);
+        return __push_leaf_left(trans, root, path, min_data_size,
+                               empty, left, free_space, right_nritems,
+                               max_slot);
 out:
         btrfs_tree_unlock(left);
         free_extent_buffer(left);
@@ -2855,6 +2874,64 @@ static noinline int copy_for_split(struct btrfs_trans_handle *trans,
 }
 
 /*
+ * double splits happen when we need to insert a big item in the middle
+ * of a leaf.  A double split can leave us with 3 mostly empty leaves:
+ * leaf: [ slots 0 - N] [ our target ] [ N + 1 - total in leaf ]
+ *          A                 B                 C
+ *
+ * We avoid this by trying to push the items on either side of our target
+ * into the adjacent leaves.  If all goes well we can avoid the double split
+ * completely.
+ */
+static noinline int push_for_double_split(struct btrfs_trans_handle *trans,
+                                          struct btrfs_root *root,
+                                          struct btrfs_path *path,
+                                          int data_size)
+{
+        int ret;
+        int progress = 0;
+        int slot;
+        u32 nritems;
+
+        slot = path->slots[0];
+
+        /*
+         * try to push all the items after our slot into the
+         * right leaf
+         */
+        ret = push_leaf_right(trans, root, path, 1, data_size, 0, slot);
+        if (ret < 0)
+                return ret;
+
+        if (ret == 0)
+                progress++;
+
+        nritems = btrfs_header_nritems(path->nodes[0]);
+        /*
+         * our goal is to get our slot at the start or end of a leaf.  If
+         * we've done so we're done
+         */
+        if (path->slots[0] == 0 || path->slots[0] == nritems)
+                return 0;
+
+        if (btrfs_leaf_free_space(root, path->nodes[0]) >= data_size)
+                return 0;
+
+        /* try to push all the items before our slot into the next leaf */
+        slot = path->slots[0];
+        ret = push_leaf_left(trans, root, path, 1, data_size, 0, slot);
+        if (ret < 0)
+                return ret;
+
+        if (ret == 0)
+                progress++;
+
+        if (progress)
+                return 0;
+        return 1;
+}
+
+/*
  * split the path's leaf in two, making sure there is at least data_size
  * available for the resulting leaf level of the path.
  *
@@ -2876,6 +2953,7 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
         int wret;
         int split;
         int num_doubles = 0;
+        int tried_avoid_double = 0;
 
         l = path->nodes[0];
         slot = path->slots[0];
@@ -2884,12 +2962,14 @@ static noinline int split_leaf(struct btrfs_trans_handle *trans,
                 return -EOVERFLOW;
 
         /* first try to make some room by pushing left and right */
-        if (data_size && ins_key->type != BTRFS_DIR_ITEM_KEY) {
-                wret = push_leaf_right(trans, root, path, data_size, 0);
+        if (data_size) {
+                wret = push_leaf_right(trans, root, path, data_size,
+                                       data_size, 0, 0);
                 if (wret < 0)
                         return wret;
                 if (wret) {
-                        wret = push_leaf_left(trans, root, path, data_size, 0);
+                        wret = push_leaf_left(trans, root, path, data_size,
+                                              data_size, 0, (u32)-1);
                         if (wret < 0)
                                 return wret;
                 }
@@ -2923,6 +3003,8 @@ again:
                                 if (mid != nritems &&
                                     leaf_space_used(l, mid, nritems - mid) +
                                     data_size > BTRFS_LEAF_DATA_SIZE(root)) {
+                                        if (data_size && !tried_avoid_double)
+                                                goto push_for_double;
                                         split = 2;
                                 }
                         }
@@ -2939,6 +3021,8 @@ again:
                                 if (mid != nritems &&
                                     leaf_space_used(l, mid, nritems - mid) +
                                     data_size > BTRFS_LEAF_DATA_SIZE(root)) {
+                                        if (data_size && !tried_avoid_double)
+                                                goto push_for_double;
                                         split = 2 ;
                                 }
                         }
@@ -3019,6 +3103,13 @@ again:
         }
 
         return ret;
+
+push_for_double:
+        push_for_double_split(trans, root, path, data_size);
+        tried_avoid_double = 1;
+        if (btrfs_leaf_free_space(root, path->nodes[0]) >= data_size)
+                return 0;
+        goto again;
 }
 
 static noinline int setup_leaf_for_split(struct btrfs_trans_handle *trans,
@@ -3915,13 +4006,15 @@ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                         extent_buffer_get(leaf);
 
                         btrfs_set_path_blocking(path);
-                        wret = push_leaf_left(trans, root, path, 1, 1);
+                        wret = push_leaf_left(trans, root, path, 1, 1,
+                                              1, (u32)-1);
                         if (wret < 0 && wret != -ENOSPC)
                                 ret = wret;
 
                         if (path->nodes[0] == leaf &&
                             btrfs_header_nritems(leaf)) {
-                                wret = push_leaf_right(trans, root, path, 1, 1);
+                                wret = push_leaf_right(trans, root, path, 1,
+                                                       1, 1, 0);
                                 if (wret < 0 && wret != -ENOSPC)
                                         ret = wret;
                         }
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 4dbaf89b1337..9254b3d58dbe 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -1458,7 +1458,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
          */
 
         /* the destination must be opened for writing */
-        if (!(file->f_mode & FMODE_WRITE))
+        if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND))
                 return -EINVAL;
 
         ret = mnt_want_write(file->f_path.mnt);
@@ -1511,7 +1511,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
 
         /* determine range to clone */
         ret = -EINVAL;
-        if (off >= src->i_size || off + len > src->i_size)
+        if (off + len > src->i_size || off + len < off)
                 goto out_unlock;
         if (len == 0)
                 olen = len = src->i_size - off;
@@ -1578,6 +1578,7 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         u64 disko = 0, diskl = 0;
                         u64 datao = 0, datal = 0;
                         u8 comp;
+                        u64 endoff;
 
                         size = btrfs_item_size_nr(leaf, slot);
                         read_extent_buffer(leaf, buf,
@@ -1712,9 +1713,18 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                         btrfs_release_path(root, path);
 
                         inode->i_mtime = inode->i_ctime = CURRENT_TIME;
-                        if (new_key.offset + datal > inode->i_size)
-                                btrfs_i_size_write(inode,
-                                                   new_key.offset + datal);
+
+                        /*
+                         * we round up to the block size at eof when
+                         * determining which extents to clone above,
+                         * but shouldn't round up the file size
+                         */
+                        endoff = new_key.offset + datal;
+                        if (endoff > off+olen)
+                                endoff = off+olen;
+                        if (endoff > inode->i_size)
+                                btrfs_i_size_write(inode, endoff);
+
                         BTRFS_I(inode)->flags = BTRFS_I(src)->flags;
                         ret = btrfs_update_inode(trans, root, inode);
                         BUG_ON(ret);
diff --git a/fs/ceph/auth_x.c b/fs/ceph/auth_x.c
index 3fe49042d8ad..6d44053ecff1 100644
--- a/fs/ceph/auth_x.c
+++ b/fs/ceph/auth_x.c
@@ -613,6 +613,9 @@ static void ceph_x_destroy(struct ceph_auth_client *ac)
                 remove_ticket_handler(ac, th);
         }
 
+        if (xi->auth_authorizer.buf)
+                ceph_buffer_put(xi->auth_authorizer.buf);
+
         kfree(ac->private);
         ac->private = NULL;
 }
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 3ab79f6c4ce8..416c08d315db 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1514,6 +1514,9 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
         ceph_encode_filepath(&p, end, ino1, path1);
         ceph_encode_filepath(&p, end, ino2, path2);
 
+        /* make note of release offset, in case we need to replay */
+        req->r_request_release_offset = p - msg->front.iov_base;
+
         /* cap releases */
         releases = 0;
         if (req->r_inode_drop)
@@ -1580,6 +1583,32 @@ static int __prepare_send_request(struct ceph_mds_client *mdsc,
         dout("prepare_send_request %p tid %lld %s (attempt %d)\n", req,
              req->r_tid, ceph_mds_op_name(req->r_op), req->r_attempts);
 
+        if (req->r_got_unsafe) {
+                /*
+                 * Replay.  Do not regenerate message (and rebuild
+                 * paths, etc.); just use the original message.
+                 * Rebuilding paths will break for renames because
+                 * d_move mangles the src name.
+                 */
+                msg = req->r_request;
+                rhead = msg->front.iov_base;
+
+                flags = le32_to_cpu(rhead->flags);
+                flags |= CEPH_MDS_FLAG_REPLAY;
+                rhead->flags = cpu_to_le32(flags);
+
+                if (req->r_target_inode)
+                        rhead->ino = cpu_to_le64(ceph_ino(req->r_target_inode));
+
+                rhead->num_retry = req->r_attempts - 1;
+
+                /* remove cap/dentry releases from message */
+                rhead->num_releases = 0;
+                msg->hdr.front_len = cpu_to_le32(req->r_request_release_offset);
+                msg->front.iov_len = req->r_request_release_offset;
+                return 0;
+        }
+
         if (req->r_request) {
                 ceph_msg_put(req->r_request);
                 req->r_request = NULL;
@@ -1601,13 +1630,9 @@ static int __prepare_send_request(struct ceph_mds_client *mdsc,
         rhead->flags = cpu_to_le32(flags);
         rhead->num_fwd = req->r_num_fwd;
         rhead->num_retry = req->r_attempts - 1;
+        rhead->ino = 0;
 
         dout(" r_locked_dir = %p\n", req->r_locked_dir);
-
-        if (req->r_target_inode && req->r_got_unsafe)
-                rhead->ino = cpu_to_le64(ceph_ino(req->r_target_inode));
-        else
-                rhead->ino = 0;
         return 0;
 }
 
diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h
index b292fa42a66d..952410c60d09 100644
--- a/fs/ceph/mds_client.h
+++ b/fs/ceph/mds_client.h
@@ -188,6 +188,7 @@ struct ceph_mds_request {
         int r_old_inode_drop, r_old_inode_unless;
 
         struct ceph_msg  *r_request;  /* original request */
+        int r_request_release_offset;
         struct ceph_msg  *r_reply;
         struct ceph_mds_reply_info_parsed r_reply_info;
         int r_err;
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 9ad43a310a41..15167b2daa55 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -43,7 +43,8 @@ static void ceph_fault(struct ceph_connection *con);
  * nicely render a sockaddr as a string.
  */
 #define MAX_ADDR_STR 20
-static char addr_str[MAX_ADDR_STR][40];
+#define MAX_ADDR_STR_LEN 60
+static char addr_str[MAX_ADDR_STR][MAX_ADDR_STR_LEN];
 static DEFINE_SPINLOCK(addr_str_lock);
 static int last_addr_str;
 
@@ -52,7 +53,6 @@ const char *pr_addr(const struct sockaddr_storage *ss)
         int i;
         char *s;
         struct sockaddr_in *in4 = (void *)ss;
-        unsigned char *quad = (void *)&in4->sin_addr.s_addr;
         struct sockaddr_in6 *in6 = (void *)ss;
 
         spin_lock(&addr_str_lock);
@@ -64,25 +64,13 @@ const char *pr_addr(const struct sockaddr_storage *ss)
 
         switch (ss->ss_family) {
         case AF_INET:
-                sprintf(s, "%u.%u.%u.%u:%u",
-                        (unsigned int)quad[0],
-                        (unsigned int)quad[1],
-                        (unsigned int)quad[2],
-                        (unsigned int)quad[3],
-                        (unsigned int)ntohs(in4->sin_port));
+                snprintf(s, MAX_ADDR_STR_LEN, "%pI4:%u", &in4->sin_addr,
+                         (unsigned int)ntohs(in4->sin_port));
                 break;
 
         case AF_INET6:
-                sprintf(s, "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x:%u",
-                        in6->sin6_addr.s6_addr16[0],
-                        in6->sin6_addr.s6_addr16[1],
-                        in6->sin6_addr.s6_addr16[2],
-                        in6->sin6_addr.s6_addr16[3],
-                        in6->sin6_addr.s6_addr16[4],
-                        in6->sin6_addr.s6_addr16[5],
-                        in6->sin6_addr.s6_addr16[6],
-                        in6->sin6_addr.s6_addr16[7],
-                        (unsigned int)ntohs(in6->sin6_port));
+                snprintf(s, MAX_ADDR_STR_LEN, "[%pI6c]:%u", &in6->sin6_addr,
+                         (unsigned int)ntohs(in6->sin6_port));
                 break;
 
         default:
@@ -215,12 +203,13 @@ static void set_sock_callbacks(struct socket *sock,
  */
 static struct socket *ceph_tcp_connect(struct ceph_connection *con)
 {
-        struct sockaddr *paddr = (struct sockaddr *)&con->peer_addr.in_addr;
+        struct sockaddr_storage *paddr = &con->peer_addr.in_addr;
         struct socket *sock;
         int ret;
 
         BUG_ON(con->sock);
-        ret = sock_create_kern(AF_INET, SOCK_STREAM, IPPROTO_TCP, &sock);
+        ret = sock_create_kern(con->peer_addr.in_addr.ss_family, SOCK_STREAM,
+                               IPPROTO_TCP, &sock);
         if (ret)
                 return ERR_PTR(ret);
         con->sock = sock;
@@ -234,7 +223,8 @@ static struct socket *ceph_tcp_connect(struct ceph_connection *con)
 
         dout("connect %s\n", pr_addr(&con->peer_addr.in_addr));
 
-        ret = sock->ops->connect(sock, paddr, sizeof(*paddr), O_NONBLOCK);
+        ret = sock->ops->connect(sock, (struct sockaddr *)paddr, sizeof(*paddr),
+                                 O_NONBLOCK);
         if (ret == -EINPROGRESS) {
                 dout("connect %s EINPROGRESS sk_state = %u\n",
                      pr_addr(&con->peer_addr.in_addr),
@@ -1009,19 +999,32 @@ int ceph_parse_ips(const char *c, const char *end,
                 struct sockaddr_in *in4 = (void *)ss;
                 struct sockaddr_in6 *in6 = (void *)ss;
                 int port;
+                char delim = ',';
+
+                if (*p == '[') {
+                        delim = ']';
+                        p++;
+                }
 
                 memset(ss, 0, sizeof(*ss));
                 if (in4_pton(p, end - p, (u8 *)&in4->sin_addr.s_addr,
-                             ',', &ipend)) {
+                             delim, &ipend))
                         ss->ss_family = AF_INET;
-                } else if (in6_pton(p, end - p, (u8 *)&in6->sin6_addr.s6_addr,
-                                    ',', &ipend)) {
+                else if (in6_pton(p, end - p, (u8 *)&in6->sin6_addr.s6_addr,
+                                  delim, &ipend))
                         ss->ss_family = AF_INET6;
-                } else {
+                else
                         goto bad;
-                }
                 p = ipend;
 
+                if (delim == ']') {
+                        if (*p != ']') {
+                                dout("missing matching ']'\n");
+                                goto bad;
+                        }
+                        p++;
+                }
+
                 /* port? */
                 if (p < end && *p == ':') {
                         port = 0;
@@ -1055,7 +1058,7 @@ int ceph_parse_ips(const char *c, const char *end,
         return 0;
 
 bad:
-        pr_err("parse_ips bad ip '%s'\n", c);
+        pr_err("parse_ips bad ip '%.*s'\n", (int)(end - c), c);
         return -EINVAL;
 }
 
@@ -2015,20 +2018,20 @@ void ceph_con_revoke(struct ceph_connection *con, struct ceph_msg *msg)
 {
         mutex_lock(&con->mutex);
         if (!list_empty(&msg->list_head)) {
-                dout("con_revoke %p msg %p\n", con, msg);
+                dout("con_revoke %p msg %p - was on queue\n", con, msg);
                 list_del_init(&msg->list_head);
                 ceph_msg_put(msg);
                 msg->hdr.seq = 0;
-                if (con->out_msg == msg) {
-                        ceph_msg_put(con->out_msg);
-                        con->out_msg = NULL;
-                }
+        }
+        if (con->out_msg == msg) {
+                dout("con_revoke %p msg %p - was sending\n", con, msg);
+                con->out_msg = NULL;
                 if (con->out_kvec_is_msg) {
                         con->out_skip = con->out_kvec_bytes;
                         con->out_kvec_is_msg = false;
                 }
-        } else {
-                dout("con_revoke %p msg %p - not queued (sent?)\n", con, msg);
+                ceph_msg_put(msg);
+                msg->hdr.seq = 0;
         }
         mutex_unlock(&con->mutex);
 }
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index 50ce64ebd330..277f8b339577 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -568,6 +568,7 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                 if (ev > CEPH_PG_POOL_VERSION) {
                         pr_warning("got unknown v %d > %d of ceph_pg_pool\n",
                                    ev, CEPH_PG_POOL_VERSION);
+                        kfree(pi);
                         goto bad;
                 }
                 __decode_pool(p, pi);
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 484e52bb40bb..2cb1a70214d7 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -923,7 +923,7 @@ init_cifs(void)
                 goto out_unregister_filesystem;
 #endif
 #ifdef CONFIG_CIFS_DFS_UPCALL
-        rc = register_key_type(&key_type_dns_resolver);
+        rc = cifs_init_dns_resolver();
         if (rc)
                 goto out_unregister_key_type;
 #endif
@@ -935,7 +935,7 @@ init_cifs(void)
 
  out_unregister_resolver_key:
 #ifdef CONFIG_CIFS_DFS_UPCALL
-        unregister_key_type(&key_type_dns_resolver);
+        cifs_exit_dns_resolver();
  out_unregister_key_type:
 #endif
 #ifdef CONFIG_CIFS_UPCALL
@@ -961,7 +961,7 @@ exit_cifs(void)
         cifs_proc_clean();
 #ifdef CONFIG_CIFS_DFS_UPCALL
         cifs_dfs_release_automount_timer();
-        unregister_key_type(&key_type_dns_resolver);
+        cifs_exit_dns_resolver();
 #endif
 #ifdef CONFIG_CIFS_UPCALL
         unregister_key_type(&cifs_spnego_key_type);
diff --git a/fs/cifs/dns_resolve.c b/fs/cifs/dns_resolve.c
index 4db2c5e7283f..49315cbf742d 100644
--- a/fs/cifs/dns_resolve.c
+++ b/fs/cifs/dns_resolve.c
@@ -24,12 +24,16 @@
  */
 
 #include <linux/slab.h>
+#include <linux/keyctl.h>
+#include <linux/key-type.h>
 #include <keys/user-type.h>
 #include "dns_resolve.h"
 #include "cifsglob.h"
 #include "cifsproto.h"
 #include "cifs_debug.h"
 
+static const struct cred *dns_resolver_cache;
+
 /* Checks if supplied name is IP address
  * returns:
  *              1 - name is IP
@@ -94,6 +98,7 @@ struct key_type key_type_dns_resolver = {
 int
 dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
 {
+        const struct cred *saved_cred;
         int rc = -EAGAIN;
         struct key *rkey = ERR_PTR(-EAGAIN);
         char *name;
@@ -133,8 +138,15 @@ dns_resolve_server_name_to_ip(const char *unc, char **ip_addr)
                 goto skip_upcall;
         }
 
+        saved_cred = override_creds(dns_resolver_cache);
         rkey = request_key(&key_type_dns_resolver, name, "");
+        revert_creds(saved_cred);
         if (!IS_ERR(rkey)) {
+                if (!(rkey->perm & KEY_USR_VIEW)) {
+                        down_read(&rkey->sem);
+                        rkey->perm |= KEY_USR_VIEW;
+                        up_read(&rkey->sem);
+                }
                 len = rkey->type_data.x[0];
                 data = rkey->payload.data;
         } else {
@@ -165,4 +177,61 @@ out:
         return rc;
 }
 
+int __init cifs_init_dns_resolver(void)
+{
+        struct cred *cred;
+        struct key *keyring;
+        int ret;
+
+        printk(KERN_NOTICE "Registering the %s key type\n",
+               key_type_dns_resolver.name);
+
+        /* create an override credential set with a special thread keyring in
+         * which DNS requests are cached
+         *
+         * this is used to prevent malicious redirections from being installed
+         * with add_key().
+         */
+        cred = prepare_kernel_cred(NULL);
+        if (!cred)
+                return -ENOMEM;
+
+        keyring = key_alloc(&key_type_keyring, ".dns_resolver", 0, 0, cred,
+                            (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                            KEY_USR_VIEW | KEY_USR_READ,
+                            KEY_ALLOC_NOT_IN_QUOTA);
+        if (IS_ERR(keyring)) {
+                ret = PTR_ERR(keyring);
+                goto failed_put_cred;
+        }
+
+        ret = key_instantiate_and_link(keyring, NULL, 0, NULL, NULL);
+        if (ret < 0)
+                goto failed_put_key;
+
+        ret = register_key_type(&key_type_dns_resolver);
+        if (ret < 0)
+                goto failed_put_key;
+
+        /* instruct request_key() to use this special keyring as a cache for
+         * the results it looks up */
+        cred->thread_keyring = keyring;
+        cred->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
+        dns_resolver_cache = cred;
+        return 0;
+
+failed_put_key:
+        key_put(keyring);
+failed_put_cred:
+        put_cred(cred);
+        return ret;
+}
 
+void __exit cifs_exit_dns_resolver(void)
+{
+        key_revoke(dns_resolver_cache->thread_keyring);
+        unregister_key_type(&key_type_dns_resolver);
+        put_cred(dns_resolver_cache);
+        printk(KERN_NOTICE "Unregistered %s key type\n",
+               key_type_dns_resolver.name);
+}
diff --git a/fs/cifs/dns_resolve.h b/fs/cifs/dns_resolve.h
index 966e9288930b..26b9eaa9f5ee 100644
--- a/fs/cifs/dns_resolve.h
+++ b/fs/cifs/dns_resolve.h
@@ -24,8 +24,8 @@
 #define _DNS_RESOLVE_H
 
 #ifdef __KERNEL__
-#include <linux/key-type.h>
-extern struct key_type key_type_dns_resolver;
+extern int __init cifs_init_dns_resolver(void);
+extern void __exit cifs_exit_dns_resolver(void);
 extern int dns_resolve_server_name_to_ip(const char *unc, char **ip_addr);
 #endif /* KERNEL */
 
diff --git a/fs/dcache.c b/fs/dcache.c
index c8c78ba07827..86d4db15473e 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -896,7 +896,7 @@ EXPORT_SYMBOL(shrink_dcache_parent);
  *
  * In this case we return -1 to tell the caller that we baled.
  */
-static int shrink_dcache_memory(int nr, gfp_t gfp_mask)
+static int shrink_dcache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 if (!(gfp_mask & __GFP_FS))
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index dbab3fdc2582..0898f3ec8212 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1358,7 +1358,7 @@ void gfs2_glock_complete(struct gfs2_glock *gl, int ret)
 }
 
 
-static int gfs2_shrink_glock_memory(int nr, gfp_t gfp_mask)
+static int gfs2_shrink_glock_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         struct gfs2_glock *gl;
         int may_demote;
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index b256d6f24288..8f02d3db8f42 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -77,7 +77,7 @@ static LIST_HEAD(qd_lru_list);
 static atomic_t qd_lru_count = ATOMIC_INIT(0);
 static DEFINE_SPINLOCK(qd_lru_lock);
 
-int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask)
+int gfs2_shrink_qd_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         struct gfs2_quota_data *qd;
         struct gfs2_sbd *sdp;
diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
index 195f60c8bd14..e7d236ca48bd 100644
--- a/fs/gfs2/quota.h
+++ b/fs/gfs2/quota.h
@@ -51,7 +51,7 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip)
         return ret;
 }
 
-extern int gfs2_shrink_qd_memory(int nr, gfp_t gfp_mask);
+extern int gfs2_shrink_qd_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask);
 extern const struct quotactl_ops gfs2_quotactl_ops;
 
 #endif /* __QUOTA_DOT_H__ */
diff --git a/fs/inode.c b/fs/inode.c
index 2bee20ae3d65..722860b323a9 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -512,7 +512,7 @@ static void prune_icache(int nr_to_scan)
  * This function is passed the number of inodes to scan, and it returns the
  * total number of remaining possibly-reclaimable inodes.
  */
-static int shrink_icache_memory(int nr, gfp_t gfp_mask)
+static int shrink_icache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 /*
diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
index a2d58c96f1b4..d258e261bdc7 100644
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c
@@ -626,7 +626,7 @@ void jffs2_xattr_free_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *i
 
 static int check_xattr_ref_inode(struct jffs2_sb_info *c, struct jffs2_inode_cache *ic)
 {
-        /* success of check_xattr_ref_inode() means taht inode (ic) dose not have
+        /* success of check_xattr_ref_inode() means that inode (ic) dose not have
          * duplicate name/value pairs. If duplicate name/value pair would be found,
          * one will be removed.
          */
diff --git a/fs/mbcache.c b/fs/mbcache.c
index ec88ff3d04a9..e28f21b95344 100644
--- a/fs/mbcache.c
+++ b/fs/mbcache.c
@@ -115,7 +115,7 @@ mb_cache_indexes(struct mb_cache *cache)
  * What the mbcache registers as to get shrunk dynamically.
  */
 
-static int mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask);
+static int mb_cache_shrink_fn(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask);
 
 static struct shrinker mb_cache_shrinker = {
         .shrink = mb_cache_shrink_fn,
@@ -191,13 +191,14 @@ forget:
  * This function is called by the kernel memory management when memory
  * gets low.
  *
+ * @shrink: (ignored)
  * @nr_to_scan: Number of objects to scan
  * @gfp_mask: (ignored)
  *
  * Returns the number of objects which are present in the cache.
  */
 static int
-mb_cache_shrink_fn(int nr_to_scan, gfp_t gfp_mask)
+mb_cache_shrink_fn(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
         LIST_HEAD(free_list);
         struct list_head *l, *ltmp;
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 782b431ef91c..e60416d3f818 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1710,7 +1710,7 @@ static void nfs_access_free_list(struct list_head *head)
         }
 }
 
-int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask)
+int nfs_access_cache_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
         LIST_HEAD(head);
         struct nfs_inode *nfsi;
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index d8bd619e386c..e70f44b9b3f4 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -205,7 +205,8 @@ extern struct rpc_procinfo nfs4_procedures[];
 void nfs_close_context(struct nfs_open_context *ctx, int is_sync);
 
 /* dir.c */
-extern int nfs_access_cache_shrinker(int nr_to_scan, gfp_t gfp_mask);
+extern int nfs_access_cache_shrinker(struct shrinker *shrink,
+                                        int nr_to_scan, gfp_t gfp_mask);
 
 /* inode.c */
 extern struct workqueue_struct *nfsiod_workqueue;
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 12c233da1b6b..437d2ca2de97 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -676,7 +676,7 @@ static void prune_dqcache(int count)
  * This is called from kswapd when we think we need some
  * more memory
  */
-static int shrink_dqcache_memory(int nr, gfp_t gfp_mask)
+static int shrink_dqcache_memory(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         if (nr) {
                 spin_lock(&dq_list_lock);
diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
index 02feb59cefca..0b201114a5ad 100644
--- a/fs/ubifs/shrinker.c
+++ b/fs/ubifs/shrinker.c
@@ -277,7 +277,7 @@ static int kick_a_thread(void)
         return 0;
 }
 
-int ubifs_shrinker(int nr, gfp_t gfp_mask)
+int ubifs_shrinker(struct shrinker *shrink, int nr, gfp_t gfp_mask)
 {
         int freed, contention = 0;
         long clean_zn_cnt = atomic_long_read(&ubifs_clean_zn_cnt);
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 2eef553d50c8..04310878f449 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -1575,7 +1575,7 @@ int ubifs_tnc_start_commit(struct ubifs_info *c, struct ubifs_zbranch *zroot);
 int ubifs_tnc_end_commit(struct ubifs_info *c);
 
 /* shrinker.c */
-int ubifs_shrinker(int nr_to_scan, gfp_t gfp_mask);
+int ubifs_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask);
 
 /* commit.c */
 int ubifs_bg_thread(void *info);
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 649ade8ef598..2ee3f7a60163 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -45,7 +45,7 @@
 
 static kmem_zone_t *xfs_buf_zone;
 STATIC int xfsbufd(void *);
-STATIC int xfsbufd_wakeup(int, gfp_t);
+STATIC int xfsbufd_wakeup(struct shrinker *, int, gfp_t);
 STATIC void xfs_buf_delwri_queue(xfs_buf_t *, int);
 static struct shrinker xfs_buf_shake = {
         .shrink = xfsbufd_wakeup,
@@ -340,7 +340,7 @@ _xfs_buf_lookup_pages(
                                         __func__, gfp_mask);
 
                         XFS_STATS_INC(xb_page_retries);
-                        xfsbufd_wakeup(0, gfp_mask);
+                        xfsbufd_wakeup(NULL, 0, gfp_mask);
                         congestion_wait(BLK_RW_ASYNC, HZ/50);
                         goto retry;
                 }
@@ -1762,6 +1762,7 @@ xfs_buf_runall_queues(
 
 STATIC int
 xfsbufd_wakeup(
+        struct shrinker         *shrink,
         int                     priority,
         gfp_t                   mask)
 {
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index f2d1718c9165..80938c736c27 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -1883,7 +1883,6 @@ init_xfs_fs(void)
                 goto out_cleanup_procfs;
 
         vfs_initquota();
-        xfs_inode_shrinker_init();
 
         error = register_filesystem(&xfs_fs_type);
         if (error)
@@ -1911,7 +1910,6 @@ exit_xfs_fs(void)
 {
         vfs_exitquota();
         unregister_filesystem(&xfs_fs_type);
-        xfs_inode_shrinker_destroy();
         xfs_sysctl_unregister();
         xfs_cleanup_procfs();
         xfs_buf_terminate();
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index ef7f0218bccb..a51a07c3a70c 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -144,6 +144,41 @@ restart:
         return last_error;
 }
 
+/*
+ * Select the next per-ag structure to iterate during the walk. The reclaim
+ * walk is optimised only to walk AGs with reclaimable inodes in them.
+ */
+static struct xfs_perag *
+xfs_inode_ag_iter_next_pag(
+        struct xfs_mount        *mp,
+        xfs_agnumber_t          *first,
+        int                     tag)
+{
+        struct xfs_perag        *pag = NULL;
+
+        if (tag == XFS_ICI_RECLAIM_TAG) {
+                int found;
+                int ref;
+
+                spin_lock(&mp->m_perag_lock);
+                found = radix_tree_gang_lookup_tag(&mp->m_perag_tree,
+                                (void **)&pag, *first, 1, tag);
+                if (found <= 0) {
+                        spin_unlock(&mp->m_perag_lock);
+                        return NULL;
+                }
+                *first = pag->pag_agno + 1;
+                /* open coded pag reference increment */
+                ref = atomic_inc_return(&pag->pag_ref);
+                spin_unlock(&mp->m_perag_lock);
+                trace_xfs_perag_get_reclaim(mp, pag->pag_agno, ref, _RET_IP_);
+        } else {
+                pag = xfs_perag_get(mp, *first);
+                (*first)++;
+        }
+        return pag;
+}
+
 int
 xfs_inode_ag_iterator(
         struct xfs_mount        *mp,
@@ -154,16 +189,15 @@ xfs_inode_ag_iterator(
         int                     exclusive,
         int                     *nr_to_scan)
 {
+        struct xfs_perag        *pag;
         int                     error = 0;
         int                     last_error = 0;
         xfs_agnumber_t          ag;
         int                     nr;
 
         nr = nr_to_scan ? *nr_to_scan : INT_MAX;
-        for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
-                struct xfs_perag        *pag;
-
-                pag = xfs_perag_get(mp, ag);
+        ag = 0;
+        while ((pag = xfs_inode_ag_iter_next_pag(mp, &ag, tag))) {
                 error = xfs_inode_ag_walk(mp, pag, execute, flags, tag,
                                                 exclusive, &nr);
                 xfs_perag_put(pag);
@@ -640,6 +674,17 @@ __xfs_inode_set_reclaim_tag(
         radix_tree_tag_set(&pag->pag_ici_root,
                            XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino),
                            XFS_ICI_RECLAIM_TAG);
+
+        if (!pag->pag_ici_reclaimable) {
+                /* propagate the reclaim tag up into the perag radix tree */
+                spin_lock(&ip->i_mount->m_perag_lock);
+                radix_tree_tag_set(&ip->i_mount->m_perag_tree,
+                                XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
+                                XFS_ICI_RECLAIM_TAG);
+                spin_unlock(&ip->i_mount->m_perag_lock);
+                trace_xfs_perag_set_reclaim(ip->i_mount, pag->pag_agno,
+                                                        -1, _RET_IP_);
+        }
         pag->pag_ici_reclaimable++;
 }
 
@@ -674,6 +719,16 @@ __xfs_inode_clear_reclaim_tag(
         radix_tree_tag_clear(&pag->pag_ici_root,
                         XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
         pag->pag_ici_reclaimable--;
+        if (!pag->pag_ici_reclaimable) {
+                /* clear the reclaim tag from the perag radix tree */
+                spin_lock(&ip->i_mount->m_perag_lock);
+                radix_tree_tag_clear(&ip->i_mount->m_perag_tree,
+                                XFS_INO_TO_AGNO(ip->i_mount, ip->i_ino),
+                                XFS_ICI_RECLAIM_TAG);
+                spin_unlock(&ip->i_mount->m_perag_lock);
+                trace_xfs_perag_clear_reclaim(ip->i_mount, pag->pag_agno,
+                                                        -1, _RET_IP_);
+        }
 }
 
 /*
@@ -828,83 +883,52 @@ xfs_reclaim_inodes(
 
 /*
  * Shrinker infrastructure.
- *
- * This is all far more complex than it needs to be. It adds a global list of
- * mounts because the shrinkers can only call a global context. We need to make
- * the shrinkers pass a context to avoid the need for global state.
  */
-static LIST_HEAD(xfs_mount_list);
-static struct rw_semaphore xfs_mount_list_lock;
-
 static int
 xfs_reclaim_inode_shrink(
+        struct shrinker *shrink,
         int             nr_to_scan,
         gfp_t           gfp_mask)
 {
         struct xfs_mount *mp;
         struct xfs_perag *pag;
         xfs_agnumber_t  ag;
-        int             reclaimable = 0;
+        int             reclaimable;
 
+        mp = container_of(shrink, struct xfs_mount, m_inode_shrink);
         if (nr_to_scan) {
                 if (!(gfp_mask & __GFP_FS))
                         return -1;
 
-                down_read(&xfs_mount_list_lock);
-                list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
-                        xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
+                xfs_inode_ag_iterator(mp, xfs_reclaim_inode, 0,
                                         XFS_ICI_RECLAIM_TAG, 1, &nr_to_scan);
-                        if (nr_to_scan <= 0)
-                                break;
-                }
-                up_read(&xfs_mount_list_lock);
-        }
+                /* if we don't exhaust the scan, don't bother coming back */
+                if (nr_to_scan > 0)
+                        return -1;
+       }
 
-        down_read(&xfs_mount_list_lock);
-        list_for_each_entry(mp, &xfs_mount_list, m_mplist) {
-                for (ag = 0; ag < mp->m_sb.sb_agcount; ag++) {
-                        pag = xfs_perag_get(mp, ag);
-                        reclaimable += pag->pag_ici_reclaimable;
-                        xfs_perag_put(pag);
-                }
+        reclaimable = 0;
+        ag = 0;
+        while ((pag = xfs_inode_ag_iter_next_pag(mp, &ag,
+                                        XFS_ICI_RECLAIM_TAG))) {
+                reclaimable += pag->pag_ici_reclaimable;
+                xfs_perag_put(pag);
         }
-        up_read(&xfs_mount_list_lock);
         return reclaimable;
 }
 
-static struct shrinker xfs_inode_shrinker = {
-        .shrink = xfs_reclaim_inode_shrink,
-        .seeks = DEFAULT_SEEKS,
-};
-
-void __init
-xfs_inode_shrinker_init(void)
-{
-        init_rwsem(&xfs_mount_list_lock);
-        register_shrinker(&xfs_inode_shrinker);
-}
-
-void
-xfs_inode_shrinker_destroy(void)
-{
-        ASSERT(list_empty(&xfs_mount_list));
-        unregister_shrinker(&xfs_inode_shrinker);
-}
-
 void
 xfs_inode_shrinker_register(
         struct xfs_mount        *mp)
 {
-        down_write(&xfs_mount_list_lock);
-        list_add_tail(&mp->m_mplist, &xfs_mount_list);
-        up_write(&xfs_mount_list_lock);
+        mp->m_inode_shrink.shrink = xfs_reclaim_inode_shrink;
+        mp->m_inode_shrink.seeks = DEFAULT_SEEKS;
+        register_shrinker(&mp->m_inode_shrink);
 }
 
 void
 xfs_inode_shrinker_unregister(
         struct xfs_mount        *mp)
 {
-        down_write(&xfs_mount_list_lock);
-        list_del(&mp->m_mplist);
-        up_write(&xfs_mount_list_lock);
+        unregister_shrinker(&mp->m_inode_shrink);
 }
diff --git a/fs/xfs/linux-2.6/xfs_sync.h b/fs/xfs/linux-2.6/xfs_sync.h
index cdcbaaca9880..e28139aaa4aa 100644
--- a/fs/xfs/linux-2.6/xfs_sync.h
+++ b/fs/xfs/linux-2.6/xfs_sync.h
@@ -55,8 +55,6 @@ int xfs_inode_ag_iterator(struct xfs_mount *mp,
         int (*execute)(struct xfs_inode *ip, struct xfs_perag *pag, int flags),
         int flags, int tag, int write_lock, int *nr_to_scan);
 
-void xfs_inode_shrinker_init(void);
-void xfs_inode_shrinker_destroy(void);
 void xfs_inode_shrinker_register(struct xfs_mount *mp);
 void xfs_inode_shrinker_unregister(struct xfs_mount *mp);
 
diff --git a/fs/xfs/linux-2.6/xfs_trace.h b/fs/xfs/linux-2.6/xfs_trace.h
index 73d5aa117384..302820690904 100644
--- a/fs/xfs/linux-2.6/xfs_trace.h
+++ b/fs/xfs/linux-2.6/xfs_trace.h
@@ -124,7 +124,10 @@ DEFINE_EVENT(xfs_perag_class, name,	\
                  unsigned long caller_ip),                                      \
         TP_ARGS(mp, agno, refcount, caller_ip))
 DEFINE_PERAG_REF_EVENT(xfs_perag_get);
+DEFINE_PERAG_REF_EVENT(xfs_perag_get_reclaim);
 DEFINE_PERAG_REF_EVENT(xfs_perag_put);
+DEFINE_PERAG_REF_EVENT(xfs_perag_set_reclaim);
+DEFINE_PERAG_REF_EVENT(xfs_perag_clear_reclaim);
 
 TRACE_EVENT(xfs_attr_list_node_descend,
         TP_PROTO(struct xfs_attr_list_context *ctx,
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 8c117ff2e3ab..67c018392d62 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -69,7 +69,7 @@ STATIC void	xfs_qm_list_destroy(xfs_dqlist_t *);
 
 STATIC int      xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int      xfs_qm_init_quotainfo(xfs_mount_t *);
-STATIC int      xfs_qm_shake(int, gfp_t);
+STATIC int      xfs_qm_shake(struct shrinker *, int, gfp_t);
 
 static struct shrinker xfs_qm_shaker = {
         .shrink = xfs_qm_shake,
@@ -2117,7 +2117,10 @@ xfs_qm_shake_freelist(
  */
 /* ARGSUSED */
 STATIC int
-xfs_qm_shake(int nr_to_scan, gfp_t gfp_mask)
+xfs_qm_shake(
+        struct shrinker *shrink,
+        int             nr_to_scan,
+        gfp_t           gfp_mask)
 {
         int     ndqused, nfree, n;
 
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 1d2c7eed4eda..5761087ee8ea 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -259,7 +259,7 @@ typedef struct xfs_mount {
         wait_queue_head_t       m_wait_single_sync_task;
         __int64_t               m_update_flags; /* sb flags we need to update
                                                    on the next remount,rw */
-        struct list_head        m_mplist;       /* inode shrinker mount list */
+        struct shrinker         m_inode_shrink; /* inode reclaim shrinker */
 } xfs_mount_t;
 
 /*
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 8e5a9dfb76bf..e7445df44d6c 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -873,6 +873,8 @@ struct fb_info {
 static inline struct apertures_struct *alloc_apertures(unsigned int max_num) {
         struct apertures_struct *a = kzalloc(sizeof(struct apertures_struct)
                         + max_num * sizeof(struct aperture), GFP_KERNEL);
+        if (!a)
+                return NULL;
         a->count = max_num;
         return a;
 }
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 013dc529e95f..d147461bc271 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -61,7 +61,8 @@ struct files_struct {
         (rcu_dereference_check((fdtfd), \
                                rcu_read_lock_held() || \
                                lockdep_is_held(&(files)->file_lock) || \
-                               atomic_read(&(files)->count) == 1))
+                               atomic_read(&(files)->count) == 1 || \
+                               rcu_my_thread_group_empty()))
 
 #define files_fdtable(files) \
                 (rcu_dereference_check_fdtable((files), (files)->fdt))
diff --git a/include/linux/mm.h b/include/linux/mm.h
index b969efb03787..a2b48041b910 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -999,7 +999,7 @@ static inline void sync_mm_rss(struct task_struct *task, struct mm_struct *mm)
  * querying the cache size, so a fastpath for that case is appropriate.
  */
 struct shrinker {
-        int (*shrink)(int nr_to_scan, gfp_t gfp_mask);
+        int (*shrink)(struct shrinker *, int nr_to_scan, gfp_t gfp_mask);
         int seeks;      /* seeks to recreate an obj */
 
         /* These are for internal use */
diff --git a/include/linux/vgaarb.h b/include/linux/vgaarb.h
index c9a975976995..814f294d4cd0 100644
--- a/include/linux/vgaarb.h
+++ b/include/linux/vgaarb.h
@@ -29,6 +29,7 @@
  */
 
 #ifndef LINUX_VGA_H
+#define LINUX_VGA_H
 
 #include <asm/vga.h>
 
diff --git a/include/math-emu/op-common.h b/include/math-emu/op-common.h
index fd882261225e..9696a5e2c437 100644
--- a/include/math-emu/op-common.h
+++ b/include/math-emu/op-common.h
@@ -799,7 +799,7 @@ do {									\
                 X##_e -= (_FP_W_TYPE_SIZE - rsize);                     \
         X##_e = rsize - X##_e - 1;                                      \
                                                                         \
-        if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs < X##_e)    \
+        if (_FP_FRACBITS_##fs < rsize && _FP_WFRACBITS_##fs <= X##_e)   \
           __FP_FRAC_SRS_1(ur_, (X##_e - _FP_WFRACBITS_##fs + 1), rsize);\
         _FP_FRAC_DISASSEMBLE_##wc(X, ur_, rsize);                       \
         if ((_FP_WFRACBITS_##fs - X##_e - 1) > 0)                       \
diff --git a/include/net/sock.h b/include/net/sock.h
index 731150d52799..0a691ea7654a 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1224,12 +1224,7 @@ static inline void sk_tx_queue_clear(struct sock *sk)
 
 static inline int sk_tx_queue_get(const struct sock *sk)
 {
-        return sk->sk_tx_queue_mapping;
-}
-
-static inline bool sk_tx_queue_recorded(const struct sock *sk)
-{
-        return (sk && sk->sk_tx_queue_mapping >= 0);
+        return sk ? sk->sk_tx_queue_mapping : -1;
 }
 
 static inline void sk_set_socket(struct sock *sk, struct socket *sock)
diff --git a/ipc/sem.c b/ipc/sem.c
index 506c8491a8d1..40a8f462a822 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1256,6 +1256,33 @@ out:
         return un;
 }
 
+
+/**
+ * get_queue_result - Retrieve the result code from sem_queue
+ * @q: Pointer to queue structure
+ *
+ * Retrieve the return code from the pending queue. If IN_WAKEUP is found in
+ * q->status, then we must loop until the value is replaced with the final
+ * value: This may happen if a task is woken up by an unrelated event (e.g.
+ * signal) and in parallel the task is woken up by another task because it got
+ * the requested semaphores.
+ *
+ * The function can be called with or without holding the semaphore spinlock.
+ */
+static int get_queue_result(struct sem_queue *q)
+{
+        int error;
+
+        error = q->status;
+        while (unlikely(error == IN_WAKEUP)) {
+                cpu_relax();
+                error = q->status;
+        }
+
+        return error;
+}
+
+
 SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
                 unsigned, nsops, const struct timespec __user *, timeout)
 {
@@ -1409,15 +1436,18 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
         else
                 schedule();
 
-        error = queue.status;
-        while(unlikely(error == IN_WAKEUP)) {
-                cpu_relax();
-                error = queue.status;
-        }
+        error = get_queue_result(&queue);
 
         if (error != -EINTR) {
                 /* fast path: update_queue already obtained all requested
-                 * resources */
+                 * resources.
+                 * Perform a smp_mb(): User space could assume that semop()
+                 * is a memory barrier: Without the mb(), the cpu could
+                 * speculatively read in user space stale data that was
+                 * overwritten by the previous owner of the semaphore.
+                 */
+                smp_mb();
+
                 goto out_free;
         }
 
@@ -1427,10 +1457,12 @@ SYSCALL_DEFINE4(semtimedop, int, semid, struct sembuf __user *, tsops,
                 goto out_free;
         }
 
+        error = get_queue_result(&queue);
+
         /*
          * If queue.status != -EINTR we are woken up by another process
          */
-        error = queue.status;
+
         if (error != -EINTR) {
                 goto out_unlock_free;
         }
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 58c66cc5056a..142c84a54993 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -833,15 +833,24 @@ static void * __init ___alloc_bootmem_node(bootmem_data_t *bdata,
 void * __init __alloc_bootmem_node(pg_data_t *pgdat, unsigned long size,
                                    unsigned long align, unsigned long goal)
 {
+        void *ptr;
+
         if (WARN_ON_ONCE(slab_is_available()))
                 return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
 
 #ifdef CONFIG_NO_BOOTMEM
-        return __alloc_memory_core_early(pgdat->node_id, size, align,
+        ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
+                                         goal, -1ULL);
+        if (ptr)
+                return ptr;
+
+        ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
                                          goal, -1ULL);
 #else
-        return ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
+        ptr = ___alloc_bootmem_node(pgdat->bdata, size, align, goal, 0);
 #endif
+
+        return ptr;
 }
 
 void * __init __alloc_bootmem_node_high(pg_data_t *pgdat, unsigned long size,
@@ -977,14 +986,21 @@ void * __init __alloc_bootmem_low(unsigned long size, unsigned long align,
 void * __init __alloc_bootmem_low_node(pg_data_t *pgdat, unsigned long size,
                                        unsigned long align, unsigned long goal)
 {
+        void *ptr;
+
         if (WARN_ON_ONCE(slab_is_available()))
                 return kzalloc_node(size, GFP_NOWAIT, pgdat->node_id);
 
 #ifdef CONFIG_NO_BOOTMEM
-        return __alloc_memory_core_early(pgdat->node_id, size, align,
+        ptr = __alloc_memory_core_early(pgdat->node_id, size, align,
+                                goal, ARCH_LOW_ADDRESS_LIMIT);
+        if (ptr)
+                return ptr;
+        ptr = __alloc_memory_core_early(MAX_NUMNODES, size, align,
                                 goal, ARCH_LOW_ADDRESS_LIMIT);
 #else
-        return ___alloc_bootmem_node(pgdat->bdata, size, align,
+        ptr = ___alloc_bootmem_node(pgdat->bdata, size, align,
                                 goal, ARCH_LOW_ADDRESS_LIMIT);
 #endif
+        return ptr;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 68319dd20bed..9bd339eb04c6 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3634,6 +3634,9 @@ void * __init __alloc_memory_core_early(int nid, u64 size, u64 align,
         int i;
         void *ptr;
 
+        if (limit > get_max_mapped())
+                limit = get_max_mapped();
+
         /* need to go over early_node_map to find out good range for node */
         for_each_active_range_index_in_nid(i, nid) {
                 u64 addr;
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 9c7e57cc63a3..b94fe1b3da43 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -213,8 +213,9 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask,
         list_for_each_entry(shrinker, &shrinker_list, list) {
                 unsigned long long delta;
                 unsigned long total_scan;
-                unsigned long max_pass = (*shrinker->shrink)(0, gfp_mask);
+                unsigned long max_pass;
 
+                max_pass = (*shrinker->shrink)(shrinker, 0, gfp_mask);
                 delta = (4 * scanned) / shrinker->seeks;
                 delta *= max_pass;
                 do_div(delta, lru_pages + 1);
@@ -242,8 +243,9 @@ unsigned long shrink_slab(unsigned long scanned, gfp_t gfp_mask,
                         int shrink_ret;
                         int nr_before;
 
-                        nr_before = (*shrinker->shrink)(0, gfp_mask);
-                        shrink_ret = (*shrinker->shrink)(this_scan, gfp_mask);
+                        nr_before = (*shrinker->shrink)(shrinker, 0, gfp_mask);
+                        shrink_ret = (*shrinker->shrink)(shrinker, this_scan,
+                                                                gfp_mask);
                         if (shrink_ret == -1)
                                 break;
                         if (shrink_ret < nr_before)
@@ -296,7 +298,7 @@ static int may_write_to_queue(struct backing_dev_info *bdi)
 static void handle_write_error(struct address_space *mapping,
                                 struct page *page, int error)
 {
-        lock_page(page);
+        lock_page_nosync(page);
         if (page_mapping(page) == mapping)
                 mapping_set_error(mapping, error);
         unlock_page(page);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b10e3cdb08f8..800b6b9fbbae 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -358,6 +358,11 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
                 acl->sec_level = sec_level;
                 acl->auth_type = auth_type;
                 hci_acl_connect(acl);
+        } else {
+                if (acl->sec_level < sec_level)
+                        acl->sec_level = sec_level;
+                if (acl->auth_type < auth_type)
+                        acl->auth_type = auth_type;
         }
 
         if (type == ACL_LINK)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 6c57fc71c7e2..786b5de0bac4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1049,6 +1049,8 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         if (conn) {
                 if (!ev->status)
                         conn->link_mode |= HCI_LM_AUTH;
+                else
+                        conn->sec_level = BT_SECURITY_LOW;
 
                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
 
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1b682a5aa061..cf3c4073a8a6 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -401,6 +401,11 @@ static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
         l2cap_send_sframe(pi, control);
 }
 
+static inline int __l2cap_no_conn_pending(struct sock *sk)
+{
+        return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
+}
+
 static void l2cap_do_start(struct sock *sk)
 {
         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
@@ -409,12 +414,13 @@ static void l2cap_do_start(struct sock *sk)
                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
                         return;
 
-                if (l2cap_check_security(sk)) {
+                if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
                         struct l2cap_conn_req req;
                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
                         req.psm  = l2cap_pi(sk)->psm;
 
                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                        l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
@@ -464,12 +470,14 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                 }
 
                 if (sk->sk_state == BT_CONNECT) {
-                        if (l2cap_check_security(sk)) {
+                        if (l2cap_check_security(sk) &&
+                                        __l2cap_no_conn_pending(sk)) {
                                 struct l2cap_conn_req req;
                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
                                 req.psm  = l2cap_pi(sk)->psm;
 
                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
@@ -2912,7 +2920,6 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
                 l2cap_pi(sk)->ident = 0;
                 l2cap_pi(sk)->dcid = dcid;
                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
-
                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
 
                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
@@ -4404,6 +4411,7 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 req.psm  = l2cap_pi(sk)->psm;
 
                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
+                                l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
 
                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
                                         L2CAP_CONN_REQ, sizeof(req), &req);
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index eedf2c94820e..753fc4221f3c 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -217,14 +217,6 @@ static bool br_devices_support_netpoll(struct net_bridge *br)
         return count != 0 && ret;
 }
 
-static void br_poll_controller(struct net_device *br_dev)
-{
-        struct netpoll *np = br_dev->npinfo->netpoll;
-
-        if (np->real_dev != br_dev)
-                netpoll_poll_dev(np->real_dev);
-}
-
 void br_netpoll_cleanup(struct net_device *dev)
 {
         struct net_bridge *br = netdev_priv(dev);
@@ -295,7 +287,6 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_do_ioctl            = br_dev_ioctl,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_netpoll_cleanup     = br_netpoll_cleanup,
-        .ndo_poll_controller     = br_poll_controller,
 #endif
 };
 
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index a4e72a89e4ff..595da45f9088 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -50,14 +50,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                         kfree_skb(skb);
                 else {
                         skb_push(skb, ETH_HLEN);
-
-#ifdef CONFIG_NET_POLL_CONTROLLER
-                        if (unlikely(skb->dev->priv_flags & IFF_IN_NETPOLL)) {
-                                netpoll_send_skb(skb->dev->npinfo->netpoll, skb);
-                                skb->dev->priv_flags &= ~IFF_IN_NETPOLL;
-                        } else
-#endif
-                                dev_queue_xmit(skb);
+                        dev_queue_xmit(skb);
                 }
         }
 
@@ -73,23 +66,9 @@ int br_forward_finish(struct sk_buff *skb)
 
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        struct net_bridge *br = to->br;
-        if (unlikely(br->dev->priv_flags & IFF_IN_NETPOLL)) {
-                struct netpoll *np;
-                to->dev->npinfo = skb->dev->npinfo;
-                np = skb->dev->npinfo->netpoll;
-                np->real_dev = np->dev = to->dev;
-                to->dev->priv_flags |= IFF_IN_NETPOLL;
-        }
-#endif
         skb->dev = to->dev;
         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                 br_forward_finish);
-#ifdef CONFIG_NET_POLL_CONTROLLER
-        if (skb->dev->npinfo)
-                skb->dev->npinfo->netpoll->dev = br->dev;
-#endif
 }
 
 static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
diff --git a/net/core/dev.c b/net/core/dev.c
index 723a34710ad4..0ea10f849be8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1911,8 +1911,16 @@ static int dev_gso_segment(struct sk_buff *skb)
  */
 static inline void skb_orphan_try(struct sk_buff *skb)
 {
-        if (!skb_tx(skb)->flags)
+        struct sock *sk = skb->sk;
+
+        if (sk && !skb_tx(skb)->flags) {
+                /* skb_tx_hash() wont be able to get sk.
+                 * We copy sk_hash into skb->rxhash
+                 */
+                if (!skb->rxhash)
+                        skb->rxhash = sk->sk_hash;
                 skb_orphan(skb);
+        }
 }
 
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
@@ -1998,8 +2006,7 @@ u16 skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb)
         if (skb->sk && skb->sk->sk_hash)
                 hash = skb->sk->sk_hash;
         else
-                hash = (__force u16) skb->protocol;
-
+                hash = (__force u16) skb->protocol ^ skb->rxhash;
         hash = jhash_1word(hash, hashrnd);
 
         return (u16) (((u64) hash * dev->real_num_tx_queues) >> 32);
@@ -2022,12 +2029,11 @@ static inline u16 dev_cap_txqueue(struct net_device *dev, u16 queue_index)
 static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                                         struct sk_buff *skb)
 {
-        u16 queue_index;
+        int queue_index;
         struct sock *sk = skb->sk;
 
-        if (sk_tx_queue_recorded(sk)) {
-                queue_index = sk_tx_queue_get(sk);
-        } else {
+        queue_index = sk_tx_queue_get(sk);
+        if (queue_index < 0) {
                 const struct net_device_ops *ops = dev->netdev_ops;
 
                 if (ops->ndo_select_queue) {
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 6ba1c0eece03..a4e0a7482c2b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -949,7 +949,10 @@ static void neigh_update_hhs(struct neighbour *neigh)
 {
         struct hh_cache *hh;
         void (*update)(struct hh_cache*, const struct net_device*, const unsigned char *)
-                = neigh->dev->header_ops->cache_update;
+                = NULL;
+
+        if (neigh->dev->header_ops)
+                update = neigh->dev->header_ops->cache_update;
 
         if (update) {
                 for (hh = neigh->hh; hh; hh = hh->hh_next) {
diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index c51b55400dc5..11201784d29a 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -1,7 +1,7 @@
 menuconfig NET_DSA
         bool "Distributed Switch Architecture support"
         default n
-        depends on EXPERIMENTAL && !S390
+        depends on EXPERIMENTAL && NET_ETHERNET && !S390
         select PHYLIB
         ---help---
           This allows you to use hardware switch chips that use
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 757f25eb9b4b..7f6273506eea 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -442,8 +442,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
         int err;
 
         err = ipmr_fib_lookup(net, &fl, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         read_lock(&mrt_lock);
         dev->stats.tx_bytes += skb->len;
@@ -1728,8 +1730,10 @@ int ip_mr_input(struct sk_buff *skb)
                 goto dont_forward;
 
         err = ipmr_fib_lookup(net, &skb_rtable(skb)->fl, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                 return err;
+        }
 
         if (!local) {
                     if (IPCB(skb)->opt.router_alert) {
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 6596b4feeddc..65afeaec15b7 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -608,6 +608,7 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
         ssize_t spliced;
         int ret;
 
+        sock_rps_record_flow(sk);
         /*
          * We can't seek on a socket input
          */
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index b4ed957f201a..7ed9dc1042d1 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2208,6 +2208,9 @@ void tcp_xmit_retransmit_queue(struct sock *sk)
         int mib_idx;
         int fwd_rexmitting = 0;
 
+        if (!tp->packets_out)
+                return;
+
         if (!tp->lost_out)
                 tp->retransmit_high = tp->snd_una;
 
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 2794b6002836..d6e9599d0705 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -347,11 +347,12 @@ static const struct xfrm_type mip6_destopt_type =
 
 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
 {
+        struct ipv6hdr *iph = ipv6_hdr(skb);
         struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
         int err = rt2->rt_hdr.nexthdr;
 
         spin_lock(&x->lock);
-        if (!ipv6_addr_equal(&rt2->addr, (struct in6_addr *)x->coaddr) &&
+        if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) &&
             !ipv6_addr_any((struct in6_addr *)x->coaddr))
                 err = -ENOENT;
         spin_unlock(&x->lock);
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 94d72e85a475..b2a3ae6cad78 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -698,6 +698,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp)
                 newsk = NULL;
                 goto out;
         }
+        kfree_skb(oskb);
 
         sock_hold(sk);
         pep_sk(newsk)->listener = sk;
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 570949417f38..724553e8ed7b 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -205,7 +205,7 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
         {
                 struct icmphdr *icmph;
 
-                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph)))
                         goto drop;
 
                 icmph = (void *)(skb_network_header(skb) + ihl);
@@ -215,6 +215,9 @@ static int tcf_nat(struct sk_buff *skb, struct tc_action *a,
                     (icmph->type != ICMP_PARAMETERPROB))
                         break;
 
+                if (!pskb_may_pull(skb, ihl + sizeof(*icmph) + sizeof(*iph)))
+                        goto drop;
+
                 iph = (void *)(icmph + 1);
                 if (egress)
                         addr = iph->daddr;
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 73affb8624fa..8dc47f1d0001 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -267,7 +267,7 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
  * Run memory cache shrinker.
  */
 static int
-rpcauth_cache_shrinker(int nr_to_scan, gfp_t gfp_mask)
+rpcauth_cache_shrinker(struct shrinker *shrink, int nr_to_scan, gfp_t gfp_mask)
 {
         LIST_HEAD(free);
         int res;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index af1c173be4ad..a7ec5a8a2380 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1594,8 +1594,8 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols,
 
         /* Try to instantiate a bundle */
         err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family);
-        if (err < 0) {
-                if (err != -EAGAIN)
+        if (err <= 0) {
+                if (err != 0 && err != -EAGAIN)
                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR);
                 return ERR_PTR(err);
         }
@@ -1678,6 +1678,13 @@ xfrm_bundle_lookup(struct net *net, struct flowi *fl, u16 family, u8 dir,
                         goto make_dummy_bundle;
                 dst_hold(&xdst->u.dst);
                 return oldflo;
+        } else if (new_xdst == NULL) {
+                num_xfrms = 0;
+                if (oldflo == NULL)
+                        goto make_dummy_bundle;
+                xdst->num_xfrms = 0;
+                dst_hold(&xdst->u.dst);
+                return oldflo;
         }
 
         /* Kill the previous bundle */
@@ -1760,6 +1767,10 @@ restart:
                                 xfrm_pols_put(pols, num_pols);
                                 err = PTR_ERR(xdst);
                                 goto dropdst;
+                        } else if (xdst == NULL) {
+                                num_xfrms = 0;
+                                drop_pols = num_pols;
+                                goto no_transform;
                         }
 
                         spin_lock_bh(&xfrm_policy_sk_bundle_lock);
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index 31ac5538fe7e..5da30eb6ad00 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -83,8 +83,8 @@ config SND_SOC_ALL_CODECS
 
 config SND_SOC_WM_HUBS
         tristate
-        default y if SND_SOC_WM8993=y
-        default m if SND_SOC_WM8993=m
+        default y if SND_SOC_WM8993=y || SND_SOC_WM8994=y
+        default m if SND_SOC_WM8993=m || SND_SOC_WM8994=m
 
 config SND_SOC_AC97_CODEC
         tristate
diff --git a/sound/soc/codecs/wm8727.c b/sound/soc/codecs/wm8727.c
index 1072621e93fd..9d1df2628136 100644
--- a/sound/soc/codecs/wm8727.c
+++ b/sound/soc/codecs/wm8727.c
@@ -127,6 +127,8 @@ static __devinit int wm8727_platform_probe(struct platform_device *pdev)
                 goto err_codec;
         }
 
+        return 0;
+
 err_codec:
         snd_soc_unregister_codec(codec);
 err:
diff --git a/sound/soc/codecs/wm8776.c b/sound/soc/codecs/wm8776.c
index 7e4a627b4c7e..4e212ed62ea6 100644
--- a/sound/soc/codecs/wm8776.c
+++ b/sound/soc/codecs/wm8776.c
@@ -94,7 +94,6 @@ SOC_DAPM_SINGLE("Bypass Switch", WM8776_OUTMUX, 2, 1, 0),
 
 static const struct snd_soc_dapm_widget wm8776_dapm_widgets[] = {
 SND_SOC_DAPM_INPUT("AUX"),
-SND_SOC_DAPM_INPUT("AUX"),
 
 SND_SOC_DAPM_INPUT("AIN1"),
 SND_SOC_DAPM_INPUT("AIN2"),
diff --git a/sound/soc/codecs/wm8988.c b/sound/soc/codecs/wm8988.c
index 0417dae32e6f..19ad590ca0b3 100644
--- a/sound/soc/codecs/wm8988.c
+++ b/sound/soc/codecs/wm8988.c
@@ -885,7 +885,6 @@ static int wm8988_register(struct wm8988_priv *wm8988,
         ret = snd_soc_register_dai(&wm8988_dai);
         if (ret != 0) {
                 dev_err(codec->dev, "Failed to register DAI: %d\n", ret);
-                snd_soc_unregister_codec(codec);
                 goto err_codec;
         }
 
diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
index 3396a0db06ba..ec4acac49ebd 100644
--- a/sound/soc/sh/fsi.c
+++ b/sound/soc/sh/fsi.c
@@ -683,20 +683,15 @@ static int fsi_dai_startup(struct snd_pcm_substream *substream,
 
         /* clock inversion (CKG2) */
         data = 0;
-        switch (SH_FSI_INVERSION_MASK & flags) {
-        case SH_FSI_LRM_INV:
-                data = 1 << 12;
-                break;
-        case SH_FSI_BRM_INV:
-                data = 1 << 8;
-                break;
-        case SH_FSI_LRS_INV:
-                data = 1 << 4;
-                break;
-        case SH_FSI_BRS_INV:
-                data = 1 << 0;
-                break;
-        }
+        if (SH_FSI_LRM_INV & flags)
+                data |= 1 << 12;
+        if (SH_FSI_BRM_INV & flags)
+                data |= 1 << 8;
+        if (SH_FSI_LRS_INV & flags)
+                data |= 1 << 4;
+        if (SH_FSI_BRS_INV & flags)
+                data |= 1 << 0;
+
         fsi_reg_write(fsi, CKG2, data);
 
         /* do fmt, di fmt */
@@ -726,15 +721,15 @@ static int fsi_dai_startup(struct snd_pcm_substream *substream,
                 break;
         case SH_FSI_FMT_TDM:
                 msg = "TDM";
-                data = CR_FMT(CR_TDM) | (fsi->chan - 1);
                 fsi->chan = is_play ?
                         SH_FSI_GET_CH_O(flags) : SH_FSI_GET_CH_I(flags);
+                data = CR_FMT(CR_TDM) | (fsi->chan - 1);
                 break;
         case SH_FSI_FMT_TDM_DELAY:
                 msg = "TDM Delay";
-                data = CR_FMT(CR_TDM_D) | (fsi->chan - 1);
                 fsi->chan = is_play ?
                         SH_FSI_GET_CH_O(flags) : SH_FSI_GET_CH_I(flags);
+                data = CR_FMT(CR_TDM_D) | (fsi->chan - 1);
                 break;
         default:
                 dev_err(dai->dev, "unknown format.\n");
diff --git a/tools/perf/arch/sparc/Makefile b/tools/perf/arch/sparc/Makefile
new file mode 100644
index 000000000000..15130b50dfe3
--- /dev/null
+++ b/tools/perf/arch/sparc/Makefile
@@ -0,0 +1,4 @@
+ifndef NO_DWARF
+PERF_HAVE_DWARF_REGS := 1
+LIB_OBJS += $(OUTPUT)arch/$(ARCH)/util/dwarf-regs.o
+endif
diff --git a/tools/perf/arch/sparc/util/dwarf-regs.c b/tools/perf/arch/sparc/util/dwarf-regs.c
new file mode 100644
index 000000000000..0ab88483720c
--- /dev/null
+++ b/tools/perf/arch/sparc/util/dwarf-regs.c
@@ -0,0 +1,43 @@
+/*
+ * Mapping of DWARF debug register numbers into register names.
+ *
+ * Copyright (C) 2010 David S. Miller <davem@davemloft.net>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <libio.h>
+#include <dwarf-regs.h>
+
+#define SPARC_MAX_REGS  96
+
+const char *sparc_regs_table[SPARC_MAX_REGS] = {
+        "%g0", "%g1", "%g2", "%g3", "%g4", "%g5", "%g6", "%g7",
+        "%o0", "%o1", "%o2", "%o3", "%o4", "%o5", "%sp", "%o7",
+        "%l0", "%l1", "%l2", "%l3", "%l4", "%l5", "%l6", "%l7",
+        "%i0", "%i1", "%i2", "%i3", "%i4", "%i5", "%fp", "%i7",
+        "%f0", "%f1", "%f2", "%f3", "%f4", "%f5", "%f6", "%f7",
+        "%f8", "%f9", "%f10", "%f11", "%f12", "%f13", "%f14", "%f15",
+        "%f16", "%f17", "%f18", "%f19", "%f20", "%f21", "%f22", "%f23",
+        "%f24", "%f25", "%f26", "%f27", "%f28", "%f29", "%f30", "%f31",
+        "%f32", "%f33", "%f34", "%f35", "%f36", "%f37", "%f38", "%f39",
+        "%f40", "%f41", "%f42", "%f43", "%f44", "%f45", "%f46", "%f47",
+        "%f48", "%f49", "%f50", "%f51", "%f52", "%f53", "%f54", "%f55",
+        "%f56", "%f57", "%f58", "%f59", "%f60", "%f61", "%f62", "%f63",
+};
+
+/**
+ * get_arch_regstr() - lookup register name from it's DWARF register number
+ * @n:  the DWARF register number
+ *
+ * get_arch_regstr() returns the name of the register in struct
+ * regdwarfnum_table from it's DWARF register number. If the register is not
+ * found in the table, this returns NULL;
+ */
+const char *get_arch_regstr(unsigned int n)
+{
+        return (n <= SPARC_MAX_REGS) ? sparc_regs_table[n] : NULL;
+}