156 files changed, 1803 insertions, 667 deletions
diff --git a/Documentation/DocBook/media-entities.tmpl b/Documentation/DocBook/media-entities.tmpl
index 5d259c632cdf..fea63b45471a 100644
--- a/Documentation/DocBook/media-entities.tmpl
+++ b/Documentation/DocBook/media-entities.tmpl
@@ -294,6 +294,7 @@
 <!ENTITY sub-srggb10 SYSTEM "v4l/pixfmt-srggb10.xml">
 <!ENTITY sub-srggb8 SYSTEM "v4l/pixfmt-srggb8.xml">
 <!ENTITY sub-y10 SYSTEM "v4l/pixfmt-y10.xml">
+<!ENTITY sub-y12 SYSTEM "v4l/pixfmt-y12.xml">
 <!ENTITY sub-pixfmt SYSTEM "v4l/pixfmt.xml">
 <!ENTITY sub-cropcap SYSTEM "v4l/vidioc-cropcap.xml">
 <!ENTITY sub-dbg-g-register SYSTEM "v4l/vidioc-dbg-g-register.xml">
diff --git a/Documentation/DocBook/v4l/media-ioc-setup-link.xml b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
index 2331e76ded17..cec97af4dab4 100644
--- a/Documentation/DocBook/v4l/media-ioc-setup-link.xml
+++ b/Documentation/DocBook/v4l/media-ioc-setup-link.xml
@@ -34,7 +34,7 @@
      <varlistentry>
        <term><parameter>request</parameter></term>
        <listitem>
-          <para>MEDIA_IOC_ENUM_LINKS</para>
+          <para>MEDIA_IOC_SETUP_LINK</para>
        </listitem>
      </varlistentry>
      <varlistentry>
diff --git a/Documentation/DocBook/v4l/pixfmt-y12.xml b/Documentation/DocBook/v4l/pixfmt-y12.xml
new file mode 100644
index 000000000000..ff417b858cc9
--- /dev/null
+++ b/Documentation/DocBook/v4l/pixfmt-y12.xml
@@ -0,0 +1,79 @@
+<refentry id="V4L2-PIX-FMT-Y12">
+  <refmeta>
+    <refentrytitle>V4L2_PIX_FMT_Y12 ('Y12 ')</refentrytitle>
+    &manvol;
+  </refmeta>
+  <refnamediv>
+    <refname><constant>V4L2_PIX_FMT_Y12</constant></refname>
+    <refpurpose>Grey-scale image</refpurpose>
+  </refnamediv>
+  <refsect1>
+    <title>Description</title>
+    <para>This is a grey-scale image with a depth of 12 bits per pixel. Pixels
+are stored in 16-bit words with unused high bits padded with 0. The least
+significant byte is stored at lower memory addresses (little-endian).</para>
+    <example>
+      <title><constant>V4L2_PIX_FMT_Y12</constant> 4 &times; 4
+pixel image</title>
+      <formalpara>
+        <title>Byte Order.</title>
+        <para>Each cell is one byte.
+          <informaltable frame="none">
+            <tgroup cols="9" align="center">
+              <colspec align="left" colwidth="2*" />
+              <tbody valign="top">
+                <row>
+                  <entry>start&nbsp;+&nbsp;0:</entry>
+                  <entry>Y'<subscript>00low</subscript></entry>
+                  <entry>Y'<subscript>00high</subscript></entry>
+                  <entry>Y'<subscript>01low</subscript></entry>
+                  <entry>Y'<subscript>01high</subscript></entry>
+                  <entry>Y'<subscript>02low</subscript></entry>
+                  <entry>Y'<subscript>02high</subscript></entry>
+                  <entry>Y'<subscript>03low</subscript></entry>
+                  <entry>Y'<subscript>03high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;8:</entry>
+                  <entry>Y'<subscript>10low</subscript></entry>
+                  <entry>Y'<subscript>10high</subscript></entry>
+                  <entry>Y'<subscript>11low</subscript></entry>
+                  <entry>Y'<subscript>11high</subscript></entry>
+                  <entry>Y'<subscript>12low</subscript></entry>
+                  <entry>Y'<subscript>12high</subscript></entry>
+                  <entry>Y'<subscript>13low</subscript></entry>
+                  <entry>Y'<subscript>13high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;16:</entry>
+                  <entry>Y'<subscript>20low</subscript></entry>
+                  <entry>Y'<subscript>20high</subscript></entry>
+                  <entry>Y'<subscript>21low</subscript></entry>
+                  <entry>Y'<subscript>21high</subscript></entry>
+                  <entry>Y'<subscript>22low</subscript></entry>
+                  <entry>Y'<subscript>22high</subscript></entry>
+                  <entry>Y'<subscript>23low</subscript></entry>
+                  <entry>Y'<subscript>23high</subscript></entry>
+                </row>
+                <row>
+                  <entry>start&nbsp;+&nbsp;24:</entry>
+                  <entry>Y'<subscript>30low</subscript></entry>
+                  <entry>Y'<subscript>30high</subscript></entry>
+                  <entry>Y'<subscript>31low</subscript></entry>
+                  <entry>Y'<subscript>31high</subscript></entry>
+                  <entry>Y'<subscript>32low</subscript></entry>
+                  <entry>Y'<subscript>32high</subscript></entry>
+                  <entry>Y'<subscript>33low</subscript></entry>
+                  <entry>Y'<subscript>33high</subscript></entry>
+                </row>
+              </tbody>
+            </tgroup>
+          </informaltable>
+        </para>
+      </formalpara>
+    </example>
+  </refsect1>
+</refentry>
diff --git a/Documentation/DocBook/v4l/pixfmt.xml b/Documentation/DocBook/v4l/pixfmt.xml
index c6fdcbbd1b41..40af4beb48b9 100644
--- a/Documentation/DocBook/v4l/pixfmt.xml
+++ b/Documentation/DocBook/v4l/pixfmt.xml
@@ -696,6 +696,7 @@ information.</para>
    &sub-packed-yuv;
    &sub-grey;
    &sub-y10;
+    &sub-y12;
    &sub-y16;
    &sub-yuyv;
    &sub-uyvy;
diff --git a/Documentation/DocBook/v4l/subdev-formats.xml b/Documentation/DocBook/v4l/subdev-formats.xml
index 7041127d6dfc..d7ccd25edcc1 100644
--- a/Documentation/DocBook/v4l/subdev-formats.xml
+++ b/Documentation/DocBook/v4l/subdev-formats.xml
@@ -456,6 +456,23 @@
              <entry>b<subscript>1</subscript></entry>
              <entry>b<subscript>0</subscript></entry>
            </row>
+            <row id="V4L2-MBUS-FMT-SGBRG8-1X8">
+              <entry>V4L2_MBUS_FMT_SGBRG8_1X8</entry>
+              <entry>0x3013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>g<subscript>7</subscript></entry>
+              <entry>g<subscript>6</subscript></entry>
+              <entry>g<subscript>5</subscript></entry>
+              <entry>g<subscript>4</subscript></entry>
+              <entry>g<subscript>3</subscript></entry>
+              <entry>g<subscript>2</subscript></entry>
+              <entry>g<subscript>1</subscript></entry>
+              <entry>g<subscript>0</subscript></entry>
+            </row>
            <row id="V4L2-MBUS-FMT-SGRBG8-1X8">
              <entry>V4L2_MBUS_FMT_SGRBG8_1X8</entry>
              <entry>0x3002</entry>
@@ -473,6 +490,23 @@
              <entry>g<subscript>1</subscript></entry>
              <entry>g<subscript>0</subscript></entry>
            </row>
+            <row id="V4L2-MBUS-FMT-SRGGB8-1X8">
+              <entry>V4L2_MBUS_FMT_SRGGB8_1X8</entry>
+              <entry>0x3014</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>r<subscript>7</subscript></entry>
+              <entry>r<subscript>6</subscript></entry>
+              <entry>r<subscript>5</subscript></entry>
+              <entry>r<subscript>4</subscript></entry>
+              <entry>r<subscript>3</subscript></entry>
+              <entry>r<subscript>2</subscript></entry>
+              <entry>r<subscript>1</subscript></entry>
+              <entry>r<subscript>0</subscript></entry>
+            </row>
            <row id="V4L2-MBUS-FMT-SBGGR10-DPCM8-1X8">
              <entry>V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8</entry>
              <entry>0x300b</entry>
@@ -2159,6 +2193,31 @@
              <entry>u<subscript>1</subscript></entry>
              <entry>u<subscript>0</subscript></entry>
            </row>
+            <row id="V4L2-MBUS-FMT-Y12-1X12">
+              <entry>V4L2_MBUS_FMT_Y12_1X12</entry>
+              <entry>0x2013</entry>
+              <entry></entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>-</entry>
+              <entry>y<subscript>11</subscript></entry>
+              <entry>y<subscript>10</subscript></entry>
+              <entry>y<subscript>9</subscript></entry>
+              <entry>y<subscript>8</subscript></entry>
+              <entry>y<subscript>7</subscript></entry>
+              <entry>y<subscript>6</subscript></entry>
+              <entry>y<subscript>5</subscript></entry>
+              <entry>y<subscript>4</subscript></entry>
+              <entry>y<subscript>3</subscript></entry>
+              <entry>y<subscript>2</subscript></entry>
+              <entry>y<subscript>1</subscript></entry>
+              <entry>y<subscript>0</subscript></entry>
+            </row>
            <row id="V4L2-MBUS-FMT-UYVY8-1X16">
              <entry>V4L2_MBUS_FMT_UYVY8_1X16</entry>
              <entry>0x200f</entry>
diff --git a/Documentation/cgroups/memory.txt b/Documentation/cgroups/memory.txt
index b6ed61c95856..7c163477fcd8 100644
--- a/Documentation/cgroups/memory.txt
+++ b/Documentation/cgroups/memory.txt
@@ -52,8 +52,10 @@ Brief summary of control files.
 tasks                           # attach a task(thread) and show list of threads
 cgroup.procs                    # show list of processes
 cgroup.event_control            # an interface for event_fd()
- memory.usage_in_bytes           # show current memory(RSS+Cache) usage.
+ memory.usage_in_bytes           # show current res_counter usage for memory
- memory.memsw.usage_in_bytes     # show current memory+Swap usage
+                                 (See 5.5 for details)
+ memory.memsw.usage_in_bytes     # show current res_counter usage for memory+Swap
+                                 (See 5.5 for details)
 memory.limit_in_bytes           # set/show limit of memory usage
 memory.memsw.limit_in_bytes     # set/show limit of memory+Swap usage
 memory.failcnt                  # show the number of memory usage hits limits
@@ -453,6 +455,15 @@ memory under it will be reclaimed.
 You can reset failcnt by writing 0 to failcnt file.
 # echo 0 > .../memory.failcnt
+5.5 usage_in_bytes
+For efficiency, as other kernel components, memory cgroup uses some optimization
+to avoid unnecessary cacheline false sharing. usage_in_bytes is affected by the
+method and doesn't show 'exact' value of memory(and swap) usage, it's an fuzz
+value for efficient access. (Of course, when necessary, it's synchronized.)
+If you want to know more exact memory usage, you should use RSS+CACHE(+SWAP)
+value in memory.stat(see 5.2).
 6. Hierarchy support
 The memory controller supports a deep hierarchy and hierarchical accounting.
diff --git a/Documentation/hwmon/adm1021 b/Documentation/hwmon/adm1021
index 03d02bfb3df1..02ad96cf9b2b 100644
--- a/Documentation/hwmon/adm1021
+++ b/Documentation/hwmon/adm1021
@@ -14,10 +14,6 @@ Supported chips:
    Prefix: 'gl523sm'
    Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
    Datasheet:
-  * Intel Xeon Processor
-    Prefix: - any other - may require 'force_adm1021' parameter
-    Addresses scanned: none
-    Datasheet: Publicly available at Intel website
  * Maxim MAX1617
    Prefix: 'max1617'
    Addresses scanned: I2C 0x18 - 0x1a, 0x29 - 0x2b, 0x4c - 0x4e
@@ -91,21 +87,27 @@ will do no harm, but will return 'old' values. It is possible to make
 ADM1021-clones do faster measurements, but there is really no good reason
 for that.
-Xeon support
------------
-Some Xeon processors have real max1617, adm1021, or compatible chips
+Netburst-based Xeon support
-within them, with two temperature sensors.
+---------------------------
-Other Xeons have chips with only one sensor.
+Some Xeon processors based on the Netburst (early Pentium 4, from 2001 to
+2003) microarchitecture had real MAX1617, ADM1021, or compatible chips
+within them, with two temperature sensors. Other Xeon processors of this
+era (with 400 MHz FSB) had chips with only one temperature sensor.
-If you have a Xeon, and the adm1021 module loads, and both temperatures
+If you have such an old Xeon, and you get two valid temperatures when
-appear valid, then things are good.
+loading the adm1021 module, then things are good.
-If the adm1021 module doesn't load, you should try this:
+If nothing happens when loading the adm1021 module, and you are certain
-        modprobe adm1021 force_adm1021=BUS,ADDRESS
+that your specific Xeon processor model includes compatible sensors, you
-        ADDRESS can only be 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e.
+will have to explicitly instantiate the sensor chips from user-space. See
+method 4 in Documentation/i2c/instantiating-devices. Possible slave
+addresses are 0x18, 0x1a, 0x29, 0x2b, 0x4c, or 0x4e. It is likely that
+only temp2 will be correct and temp1 will have to be ignored.
-If you have dual Xeons you may have appear to have two separate
+Previous generations of the Xeon processor (based on Pentium II/III)
-adm1021-compatible chips, or two single-temperature sensors, at distinct
+didn't have these sensors. Next generations of Xeon processors (533 MHz
-addresses.
+FSB and faster) lost them, until the Core-based generation which
+introduced integrated digital thermal sensors. These are supported by
+the coretemp driver.
diff --git a/Documentation/hwmon/lm90 b/Documentation/hwmon/lm90
index fa475c0a48a3..f3efd18e87f4 100644
--- a/Documentation/hwmon/lm90
+++ b/Documentation/hwmon/lm90
@@ -32,6 +32,16 @@ Supported chips:
    Addresses scanned: I2C 0x4c and 0x4d
    Datasheet: Publicly available at the ON Semiconductor website
               http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461
+  * Analog Devices ADT7461A
+    Prefix: 'adt7461a'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=ADT7461A
+  * ON Semiconductor NCT1008
+    Prefix: 'nct1008'
+    Addresses scanned: I2C 0x4c and 0x4d
+    Datasheet: Publicly available at the ON Semiconductor website
+               http://www.onsemi.com/PowerSolutions/product.do?id=NCT1008
  * Maxim MAX6646
    Prefix: 'max6646'
    Addresses scanned: I2C 0x4d
@@ -149,7 +159,7 @@ ADM1032:
  * ALERT is triggered by open remote sensor.
  * SMBus PEC support for Write Byte and Receive Byte transactions.
-ADT7461:
+ADT7461, ADT7461A, NCT1008:
  * Extended temperature range (breaks compatibility)
  * Lower resolution for remote temperature
@@ -195,9 +205,9 @@ are exported, one for each channel, but these values are of course linked.
 Only the local hysteresis can be set from user-space, and the same delta
 applies to the remote hysteresis.
-The lm90 driver will not update its values more frequently than every
+The lm90 driver will not update its values more frequently than configured with
-other second; reading them more often will do no harm, but will return
+the update_interval attribute; reading them more often will do no harm, but will
-'old' values.
+return 'old' values.
 SMBus Alert Support
 -------------------
@@ -205,11 +215,12 @@ SMBus Alert Support
 This driver has basic support for SMBus alert. When an alert is received,
 the status register is read and the faulty temperature channel is logged.
-The Analog Devices chips (ADM1032 and ADT7461) do not implement the SMBus
+The Analog Devices chips (ADM1032, ADT7461 and ADT7461A) and ON
-alert protocol properly so additional care is needed: the ALERT output is
+Semiconductor chips (NCT1008) do not implement the SMBus alert protocol
-disabled when an alert is received, and is re-enabled only when the alarm
+properly so additional care is needed: the ALERT output is disabled when
-is gone. Otherwise the chip would block alerts from other chips in the bus
+an alert is received, and is re-enabled only when the alarm is gone.
-as long as the alarm is active.
+Otherwise the chip would block alerts from other chips in the bus as long
+as the alarm is active.
 PEC Support
 -----------
diff --git a/Documentation/video4linux/sh_mobile_ceu_camera.txt b/Documentation/video4linux/sh_mobile_ceu_camera.txt
index cb47e723af74..1e96ce6e2d2f 100644
--- a/Documentation/video4linux/sh_mobile_ceu_camera.txt
+++ b/Documentation/video4linux/sh_mobile_ceu_camera.txt
@@ -37,7 +37,7 @@ Generic scaling / cropping scheme
 -1'-
 In the above chart minuses and slashes represent "real" data amounts, points and
-accents represent "useful" data, basically, CEU scaled amd cropped output,
+accents represent "useful" data, basically, CEU scaled and cropped output,
 mapped back onto the client's source plane.
 Such a configuration can be produced by user requests:
@@ -65,7 +65,7 @@ Do not touch input rectangle - it is already optimal.
 1. Calculate current sensor scales:
-        scale_s = ((3') - (3)) / ((2') - (2))
+        scale_s = ((2') - (2)) / ((3') - (3))
 2. Calculate "effective" input crop (sensor subwindow) - CEU crop scaled back at
 current sensor scales onto input window - this is user S_CROP:
@@ -80,7 +80,7 @@ window:
 4. Calculate sensor output window by applying combined scales to real input
 window:
-        width_s_out = ((2') - (2)) / scale_comb
+        width_s_out = ((7') - (7)) = ((2') - (2)) / scale_comb
 5. Apply iterative sensor S_FMT for sensor output window.
diff --git a/MAINTAINERS b/MAINTAINERS
index 13803127b68f..2199ba1323d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1032,12 +1032,13 @@ W:	http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/mach-s3c64xx/
-ARM/S5P ARM ARCHITECTURES
+ARM/S5P EXYNOS ARM ARCHITECTURES
 M:      Kukjin Kim <kgene.kim@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-s5p*/
+F:      arch/arm/mach-exynos*/
 ARM/SAMSUNG MOBILE MACHINE SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
@@ -2808,7 +2809,7 @@ GPIO SUBSYSTEM
 M:      Grant Likely <grant.likely@secretlab.ca>
 S:      Maintained
 T:      git git://git.secretlab.ca/git/linux-2.6.git
-F:      Documentation/gpio/gpio.txt
+F:      Documentation/gpio.txt
 F:      drivers/gpio/
 F:      include/linux/gpio*
@@ -6921,6 +6922,18 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.
 S:      Maintained
 F:      drivers/platform/x86
+XEN HYPERVISOR INTERFACE
+M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
+L:      virtualization@lists.linux-foundation.org
+S:      Supported
+F:      arch/x86/xen/
+F:      drivers/*/xen-*front.c
+F:      drivers/xen/
+F:      arch/x86/include/asm/xen/
+F:      include/xen/
 XEN NETWORK BACKEND DRIVER
 M:      Ian Campbell <ian.campbell@citrix.com>
 L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
@@ -6942,18 +6955,6 @@ S:	Supported
 F:      arch/x86/xen/*swiotlb*
 F:      drivers/xen/*swiotlb*
-XEN HYPERVISOR INTERFACE
-M:      Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
-M:      Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-L:      xen-devel@lists.xensource.com (moderated for non-subscribers)
-L:      virtualization@lists.linux-foundation.org
-S:      Supported
-F:      arch/x86/xen/
-F:      drivers/*/xen-*front.c
-F:      drivers/xen/
-F:      arch/x86/include/asm/xen/
-F:      include/xen/
 XFS FILESYSTEM
 P:      Silicon Graphics Inc
 M:      Alex Elder <aelder@sgi.com>
diff --git a/Makefile b/Makefile
index b967b967572b..5a7a2e4f5c0b 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 39
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 NAME = Flesh-Eating Bats with Fangs
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-davinci/dm355.c b/arch/arm/mach-davinci/dm355.c
index f68012239641..a3a94e9c9378 100644
--- a/arch/arm/mach-davinci/dm355.c
+++ b/arch/arm/mach-davinci/dm355.c
@@ -314,7 +314,7 @@ static struct clk timer2_clk = {
        .name = "timer2",
        .parent = &pll1_aux_clk,
        .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 static struct clk timer3_clk = {
diff --git a/arch/arm/mach-davinci/dm644x.c b/arch/arm/mach-davinci/dm644x.c
index 5f8a65424184..4c82c2716293 100644
--- a/arch/arm/mach-davinci/dm644x.c
+++ b/arch/arm/mach-davinci/dm644x.c
@@ -274,7 +274,7 @@ static struct clk timer2_clk = {
        .name = "timer2",
        .parent = &pll1_aux_clk,
        .lpsc = DAVINCI_LPSC_TIMER2,
-        .usecount = 1,              /* REVISIT: why can't' this be disabled? */
+        .usecount = 1,              /* REVISIT: why can't this be disabled? */
 };
 static struct clk_lookup dm644x_clks[] = {
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index a45cd6409686..512b15204450 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -68,7 +68,7 @@ obj-$(CONFIG_OMAP_SMARTREFLEX)          += sr_device.o smartreflex.o
 obj-$(CONFIG_OMAP_SMARTREFLEX_CLASS3)   += smartreflex-class3.o
 AFLAGS_sleep24xx.o                      :=-Wa,-march=armv6
-AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a
+AFLAGS_sleep34xx.o                      :=-Wa,-march=armv7-a$(plus_sec)
 ifeq ($(CONFIG_PM_VERBOSE),y)
 CFLAGS_pm_bus.o                         += -DDEBUG
diff --git a/arch/arm/mach-omap2/board-rx51.c b/arch/arm/mach-omap2/board-rx51.c
index e964895b80e8..f8ba20a14e62 100644
--- a/arch/arm/mach-omap2/board-rx51.c
+++ b/arch/arm/mach-omap2/board-rx51.c
@@ -141,14 +141,19 @@ static void __init rx51_init(void)
 static void __init rx51_map_io(void)
 {
        omap2_set_globals_3xxx();
-        rx51_video_mem_init();
        omap34xx_map_common_io();
 }
+static void __init rx51_reserve(void)
+{
+        rx51_video_mem_init();
+        omap_reserve();
+}
 MACHINE_START(NOKIA_RX51, "Nokia RX-51 board")
        /* Maintainer: Lauri Leukkunen <lauri.leukkunen@nokia.com> */
        .boot_params    = 0x80000100,
-        .reserve        = omap_reserve,
+        .reserve        = rx51_reserve,
        .map_io         = rx51_map_io,
        .init_early     = rx51_init_early,
        .init_irq       = omap_init_irq,
diff --git a/arch/arm/mach-omap2/clock44xx_data.c b/arch/arm/mach-omap2/clock44xx_data.c
index 276992d3b7fb..8c965671b4d4 100644
--- a/arch/arm/mach-omap2/clock44xx_data.c
+++ b/arch/arm/mach-omap2/clock44xx_data.c
@@ -3116,14 +3116,9 @@ static struct omap_clk omap44xx_clks[] = {
        CLK(NULL,       "dsp_fck",                      &dsp_fck,       CK_443X),
        CLK("omapdss_dss",      "sys_clk",                      &dss_sys_clk,   CK_443X),
        CLK("omapdss_dss",      "tv_clk",                       &dss_tv_clk,    CK_443X),
-        CLK("omapdss_dss",      "dss_clk",                      &dss_dss_clk,   CK_443X),
        CLK("omapdss_dss",      "video_clk",                    &dss_48mhz_clk, CK_443X),
-        CLK("omapdss_dss",      "fck",                          &dss_fck,       CK_443X),
+        CLK("omapdss_dss",      "fck",                          &dss_dss_clk,   CK_443X),
-        /*
+        CLK("omapdss_dss",      "ick",                          &dss_fck,       CK_443X),
-         * On OMAP4, DSS ick is a dummy clock; this is needed for compatibility
-         * with OMAP2/3.
-         */
-        CLK("omapdss_dss",      "ick",                          &dummy_ck,      CK_443X),
        CLK(NULL,       "efuse_ctrl_cust_fck",          &efuse_ctrl_cust_fck,   CK_443X),
        CLK(NULL,       "emif1_fck",                    &emif1_fck,     CK_443X),
        CLK(NULL,       "emif2_fck",                    &emif2_fck,     CK_443X),
diff --git a/arch/arm/mach-omap2/cm2xxx_3xxx.c b/arch/arm/mach-omap2/cm2xxx_3xxx.c
index 9d0dec806e92..38830d8d4783 100644
--- a/arch/arm/mach-omap2/cm2xxx_3xxx.c
+++ b/arch/arm/mach-omap2/cm2xxx_3xxx.c
@@ -247,6 +247,7 @@ struct omap3_cm_regs {
        u32 per_cm_clksel;
        u32 emu_cm_clksel;
        u32 emu_cm_clkstctrl;
+        u32 pll_cm_autoidle;
        u32 pll_cm_autoidle2;
        u32 pll_cm_clksel4;
        u32 pll_cm_clksel5;
@@ -319,6 +320,15 @@ void omap3_cm_save_context(void)
                omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, CM_CLKSEL1);
        cm_context.emu_cm_clkstctrl =
                omap2_cm_read_mod_reg(OMAP3430_EMU_MOD, OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, even though this register has been saved in
+         * scratchpad contents, we need to restore AUTO_PERIPH_DPLL
+         * by ourselves. So, we need to save it anyway.
+         */
+        cm_context.pll_cm_autoidle =
+                omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE);
        cm_context.pll_cm_autoidle2 =
                omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE2);
        cm_context.pll_cm_clksel4 =
@@ -441,6 +451,13 @@ void omap3_cm_restore_context(void)
                               CM_CLKSEL1);
        omap2_cm_write_mod_reg(cm_context.emu_cm_clkstctrl, OMAP3430_EMU_MOD,
                               OMAP2_CM_CLKSTCTRL);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL.AUTO_PERIPH_DPLL == 1.
+         * In this case, we need to restore AUTO_PERIPH_DPLL by ourselves.
+         */
+        omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle, PLL_MOD,
+                               CM_AUTOIDLE);
        omap2_cm_write_mod_reg(cm_context.pll_cm_autoidle2, PLL_MOD,
                               CM_AUTOIDLE2);
        omap2_cm_write_mod_reg(cm_context.pll_cm_clksel4, PLL_MOD,
diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
index 695279419020..da53ba3917ca 100644
--- a/arch/arm/mach-omap2/control.c
+++ b/arch/arm/mach-omap2/control.c
@@ -316,8 +316,14 @@ void omap3_save_scratchpad_contents(void)
                        omap2_cm_read_mod_reg(WKUP_MOD, CM_CLKSEL);
        prcm_block_contents.cm_clken_pll =
                        omap2_cm_read_mod_reg(PLL_MOD, CM_CLKEN);
+        /*
+         * As per erratum i671, ROM code does not respect the PER DPLL
+         * programming scheme if CM_AUTOIDLE_PLL..AUTO_PERIPH_DPLL == 1.
+         * Then,  in anycase, clear these bits to avoid extra latencies.
+         */
        prcm_block_contents.cm_autoidle_pll =
-                        omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_AUTOIDLE_PLL);
+                        omap2_cm_read_mod_reg(PLL_MOD, CM_AUTOIDLE) &
+                        ~OMAP3430_AUTO_PERIPH_DPLL_MASK;
        prcm_block_contents.cm_clksel1_pll =
                        omap2_cm_read_mod_reg(PLL_MOD, OMAP3430_CM_CLKSEL1_PLL);
        prcm_block_contents.cm_clksel2_pll =
diff --git a/arch/arm/mach-omap2/omap_hwmod_2420_data.c b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
index 8eb3ce1bbfbe..c4d0ae87d62a 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2420_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2420_data.c
@@ -1639,6 +1639,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio1_slaves[] = {
 static struct omap_hwmod omap2420_gpio1_hwmod = {
        .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap242x_gpio1_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio1_irqs),
        .main_clk       = "gpios_fck",
@@ -1669,6 +1670,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio2_slaves[] = {
 static struct omap_hwmod omap2420_gpio2_hwmod = {
        .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap242x_gpio2_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio2_irqs),
        .main_clk       = "gpios_fck",
@@ -1699,6 +1701,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio3_slaves[] = {
 static struct omap_hwmod omap2420_gpio3_hwmod = {
        .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap242x_gpio3_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio3_irqs),
        .main_clk       = "gpios_fck",
@@ -1729,6 +1732,7 @@ static struct omap_hwmod_ocp_if *omap2420_gpio4_slaves[] = {
 static struct omap_hwmod omap2420_gpio4_hwmod = {
        .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap242x_gpio4_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap242x_gpio4_irqs),
        .main_clk       = "gpios_fck",
@@ -1782,7 +1786,7 @@ static struct omap_hwmod_irq_info omap2420_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2420_dma_system_addrs[] = {
        {
                .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                .flags          = ADDR_TYPE_RT
        },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_2430_data.c b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
index e6e3810db77f..9682dd519f8d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2430_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2430_data.c
@@ -1742,6 +1742,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio1_slaves[] = {
 static struct omap_hwmod omap2430_gpio1_hwmod = {
        .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap243x_gpio1_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio1_irqs),
        .main_clk       = "gpios_fck",
@@ -1772,6 +1773,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio2_slaves[] = {
 static struct omap_hwmod omap2430_gpio2_hwmod = {
        .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap243x_gpio2_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio2_irqs),
        .main_clk       = "gpios_fck",
@@ -1802,6 +1804,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio3_slaves[] = {
 static struct omap_hwmod omap2430_gpio3_hwmod = {
        .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap243x_gpio3_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio3_irqs),
        .main_clk       = "gpios_fck",
@@ -1832,6 +1835,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio4_slaves[] = {
 static struct omap_hwmod omap2430_gpio4_hwmod = {
        .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap243x_gpio4_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio4_irqs),
        .main_clk       = "gpios_fck",
@@ -1862,6 +1866,7 @@ static struct omap_hwmod_ocp_if *omap2430_gpio5_slaves[] = {
 static struct omap_hwmod omap2430_gpio5_hwmod = {
        .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap243x_gpio5_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap243x_gpio5_irqs),
        .main_clk       = "gpio5_fck",
@@ -1915,7 +1920,7 @@ static struct omap_hwmod_irq_info omap2430_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap2430_dma_system_addrs[] = {
        {
                .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                .flags          = ADDR_TYPE_RT
        },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index b98e2dfcba28..909a84de6682 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2141,6 +2141,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio1_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio1_hwmod = {
        .name           = "gpio1",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio1_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio1_irqs),
        .main_clk       = "gpio1_ick",
@@ -2177,6 +2178,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio2_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio2_hwmod = {
        .name           = "gpio2",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio2_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio2_irqs),
        .main_clk       = "gpio2_ick",
@@ -2213,6 +2215,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio3_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio3_hwmod = {
        .name           = "gpio3",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio3_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio3_irqs),
        .main_clk       = "gpio3_ick",
@@ -2249,6 +2252,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio4_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio4_hwmod = {
        .name           = "gpio4",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio4_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio4_irqs),
        .main_clk       = "gpio4_ick",
@@ -2285,6 +2289,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio5_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio5_hwmod = {
        .name           = "gpio5",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio5_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio5_irqs),
        .main_clk       = "gpio5_ick",
@@ -2321,6 +2326,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_gpio6_slaves[] = {
 static struct omap_hwmod omap3xxx_gpio6_hwmod = {
        .name           = "gpio6",
+        .flags          = HWMOD_CONTROL_OPT_CLKS_IN_RESET,
        .mpu_irqs       = omap3xxx_gpio6_irqs,
        .mpu_irqs_cnt   = ARRAY_SIZE(omap3xxx_gpio6_irqs),
        .main_clk       = "gpio6_ick",
@@ -2386,7 +2392,7 @@ static struct omap_hwmod_irq_info omap3xxx_dma_system_irqs[] = {
 static struct omap_hwmod_addr_space omap3xxx_dma_system_addrs[] = {
        {
                .pa_start       = 0x48056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x48056fff,
                .flags          = ADDR_TYPE_RT
        },
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
index 3e88dd3f8ef3..abc548a0c98d 100644
--- a/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_44xx_data.c
@@ -885,7 +885,7 @@ static struct omap_hwmod_ocp_if *omap44xx_dma_system_masters[] = {
 static struct omap_hwmod_addr_space omap44xx_dma_system_addrs[] = {
        {
                .pa_start       = 0x4a056000,
-                .pa_end         = 0x4a0560ff,
+                .pa_end         = 0x4a056fff,
                .flags          = ADDR_TYPE_RT
        },
 };
diff --git a/arch/arm/mach-omap2/omap_l3_smx.c b/arch/arm/mach-omap2/omap_l3_smx.c
index 5f2da7565b68..4321e7938929 100644
--- a/arch/arm/mach-omap2/omap_l3_smx.c
+++ b/arch/arm/mach-omap2/omap_l3_smx.c
@@ -196,11 +196,11 @@ static irqreturn_t omap3_l3_app_irq(int irq, void *_l3)
                /* No timeout error for debug sources */
        }
-        base = ((l3->rt) + (*(omap3_l3_bases[int_type] + err_source)));
        /* identify the error source */
        for (err_source = 0; !(status & (1 << err_source)); err_source++)
                                                                        ;
+        base = l3->rt + *(omap3_l3_bases[int_type] + err_source);
        error = omap3_l3_readll(base, L3_ERROR_LOG);
        if (error) {
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 30af3351c2d6..49486f522dca 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -89,6 +89,7 @@ static void omap2_init_processor_devices(void)
        if (cpu_is_omap44xx()) {
                _init_omap_device("l3_main_1", &l3_dev);
                _init_omap_device("dsp", &dsp_dev);
+                _init_omap_device("iva", &iva_dev);
        } else {
                _init_omap_device("l3_main", &l3_dev);
        }
diff --git a/arch/arm/mach-omap2/voltage.c b/arch/arm/mach-omap2/voltage.c
index 6fb520999b6e..0c1552d9d995 100644
--- a/arch/arm/mach-omap2/voltage.c
+++ b/arch/arm/mach-omap2/voltage.c
@@ -114,7 +114,6 @@ static int __init _config_common_vdd_data(struct omap_vdd_info *vdd)
        sys_clk_speed /= 1000;
        /* Generic voltage parameters */
-        vdd->curr_volt = 1200000;
        vdd->volt_scale = vp_forceupdate_scale_voltage;
        vdd->vp_enabled = false;
diff --git a/arch/arm/mach-ux500/board-mop500.c b/arch/arm/mach-ux500/board-mop500.c
index af913741e6ec..6e1907fa94f0 100644
--- a/arch/arm/mach-ux500/board-mop500.c
+++ b/arch/arm/mach-ux500/board-mop500.c
@@ -178,16 +178,15 @@ static struct i2c_board_info __initdata mop500_i2c0_devices[] = {
                .irq            = NOMADIK_GPIO_TO_IRQ(217),
                .platform_data  = &mop500_tc35892_data,
        },
-};
+        /* I2C0 devices only available prior to HREFv60 */
-/* I2C0 devices only available prior to HREFv60 */
-static struct i2c_board_info __initdata mop500_i2c0_old_devices[] = {
        {
                I2C_BOARD_INFO("tps61052", 0x33),
                .platform_data  = &mop500_tps61052_data,
        },
 };
+#define NUM_PRE_V60_I2C0_DEVICES 1
 static struct i2c_board_info __initdata mop500_i2c2_devices[] = {
        {
                /* lp5521 LED driver, 1st device */
@@ -425,6 +424,8 @@ static void __init mop500_uart_init(void)
 static void __init mop500_init_machine(void)
 {
+        int i2c0_devs;
        /*
         * The HREFv60 board removed a GPIO expander and routed
         * all these GPIO pins to the internal GPIO controller
@@ -448,11 +449,11 @@ static void __init mop500_init_machine(void)
        platform_device_register(&ab8500_device);
-        i2c_register_board_info(0, mop500_i2c0_devices,
+        i2c0_devs = ARRAY_SIZE(mop500_i2c0_devices);
-                                ARRAY_SIZE(mop500_i2c0_devices));
+        if (machine_is_hrefv60())
-        if (!machine_is_hrefv60())
+                i2c0_devs -= NUM_PRE_V60_I2C0_DEVICES;
-                i2c_register_board_info(0, mop500_i2c0_old_devices,
-                                        ARRAY_SIZE(mop500_i2c0_old_devices));
+        i2c_register_board_info(0, mop500_i2c0_devices, i2c0_devs);
        i2c_register_board_info(2, mop500_i2c2_devices,
                                ARRAY_SIZE(mop500_i2c2_devices));
 }
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index 02b7a03e4226..8b3db1c587fc 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -300,6 +300,8 @@ void __init paging_init(void)
                zones_size[ZONE_DMA] = m68k_memory[i].size >> PAGE_SHIFT;
                free_area_init_node(i, zones_size,
                                    m68k_memory[i].addr >> PAGE_SHIFT, NULL);
+                if (node_present_pages(i))
+                        node_set_state(i, N_NORMAL_MEMORY);
        }
 }
diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
index b7ed8d7a9b33..b1d126258dee 100644
--- a/arch/parisc/mm/init.c
+++ b/arch/parisc/mm/init.c
@@ -266,8 +266,10 @@ static void __init setup_bootmem(void)
        }
        memset(pfnnid_map, 0xff, sizeof(pfnnid_map));
-        for (i = 0; i < npmem_ranges; i++)
+        for (i = 0; i < npmem_ranges; i++) {
+                node_set_state(i, N_NORMAL_MEMORY);
                node_set_online(i);
+        }
 #endif
        /*
diff --git a/arch/powerpc/include/asm/uninorth.h b/arch/powerpc/include/asm/uninorth.h
index ae9c899c8a6d..d12b11d7641e 100644
--- a/arch/powerpc/include/asm/uninorth.h
+++ b/arch/powerpc/include/asm/uninorth.h
@@ -60,7 +60,7 @@
 *
 * Obviously, the GART is not cache coherent and so any change to it
 * must be flushed to memory (or maybe just make the GART space non
- * cachable). AGP memory itself does't seem to be cache coherent neither.
+ * cachable). AGP memory itself doesn't seem to be cache coherent neither.
 *
 * In order to invalidate the GART (which is probably necessary to inval
 * the bridge internal TLBs), the following sequence has to be written,
diff --git a/arch/s390/crypto/prng.c b/arch/s390/crypto/prng.c
index 975e3ab13cb5..44bca3f994b0 100644
--- a/arch/s390/crypto/prng.c
+++ b/arch/s390/crypto/prng.c
@@ -76,7 +76,7 @@ static void prng_seed(int nbytes)
        /* Add the entropy */
        while (nbytes >= 8) {
-                *((__u64 *)parm_block) ^= *((__u64 *)buf+i*8);
+                *((__u64 *)parm_block) ^= *((__u64 *)buf+i);
                prng_add_entropy();
                i += 8;
                nbytes -= 8;
diff --git a/arch/s390/kvm/sie64a.S b/arch/s390/kvm/sie64a.S
index 7e9d30d567b0..ab0e041ac54c 100644
--- a/arch/s390/kvm/sie64a.S
+++ b/arch/s390/kvm/sie64a.S
@@ -48,10 +48,10 @@ sie_irq_handler:
        tm      __TI_flags+7(%r2),_TIF_EXIT_SIE
        jz      0f
        larl    %r2,sie_exit                    # work pending, leave sie
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
        br      %r14
 0:      larl    %r2,sie_reenter                 # re-enter with guest id
-        stg     %r2,__LC_RETURN_PSW+8
+        stg     %r2,SPI_PSW+8(0,%r15)
 1:      br      %r14
 /*
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 9217e332b118..4cf85fef407c 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -558,9 +558,9 @@ static void pfault_interrupt(unsigned int ext_int_code,
         * Get the token (= address of the task structure of the affected task).
         */
 #ifdef CONFIG_64BIT
-        tsk = *(struct task_struct **) param64;
+        tsk = (struct task_struct *) param64;
 #else
-        tsk = *(struct task_struct **) param32;
+        tsk = (struct task_struct *) param32;
 #endif
        if (subcode & 0x0080) {
diff --git a/arch/s390/mm/pageattr.c b/arch/s390/mm/pageattr.c
index 122ffbd08ce0..0607e4b14b27 100644
--- a/arch/s390/mm/pageattr.c
+++ b/arch/s390/mm/pageattr.c
@@ -24,12 +24,13 @@ static void change_page_attr(unsigned long addr, int numpages,
                        WARN_ON_ONCE(1);
                        continue;
                }
-                ptep = pte_offset_kernel(pmdp, addr + i * PAGE_SIZE);
+                ptep = pte_offset_kernel(pmdp, addr);
                pte = *ptep;
                pte = set(pte);
-                ptep_invalidate(&init_mm, addr + i * PAGE_SIZE, ptep);
+                ptep_invalidate(&init_mm, addr, ptep);
                *ptep = pte;
+                addr += PAGE_SIZE;
        }
 }
diff --git a/arch/um/Kconfig.um b/arch/um/Kconfig.um
index 90a438acbfaf..b5e675e370c6 100644
--- a/arch/um/Kconfig.um
+++ b/arch/um/Kconfig.um
@@ -47,7 +47,7 @@ config HOSTFS
 config HPPFS
        tristate "HoneyPot ProcFS (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && PROC_FS
        help
          hppfs (HoneyPot ProcFS) is a filesystem which allows UML /proc
          entries to be overridden, removed, or fabricated from the host.
diff --git a/arch/um/include/asm/thread_info.h b/arch/um/include/asm/thread_info.h
index e2cf786bda0a..5bd1bad33fab 100644
--- a/arch/um/include/asm/thread_info.h
+++ b/arch/um/include/asm/thread_info.h
@@ -49,7 +49,10 @@ static inline struct thread_info *current_thread_info(void)
 {
        struct thread_info *ti;
        unsigned long mask = THREAD_SIZE - 1;
-        ti = (struct thread_info *) (((unsigned long) &ti) & ~mask);
+        void *p;
+        asm volatile ("" : "=r" (p) : "0" (&ti));
+        ti = (struct thread_info *) (((unsigned long)p) & ~mask);
        return ti;
 }
diff --git a/arch/um/sys-i386/Makefile b/arch/um/sys-i386/Makefile
index 804b28dd0328..b1da91c1b200 100644
--- a/arch/um/sys-i386/Makefile
+++ b/arch/um/sys-i386/Makefile
@@ -4,7 +4,7 @@
 obj-y = bug.o bugs.o checksum.o delay.o fault.o ksyms.o ldt.o ptrace.o \
        ptrace_user.o setjmp.o signal.o stub.o stub_segv.o syscalls.o sysrq.o \
-        sys_call_table.o tls.o
+        sys_call_table.o tls.o atomic64_cx8_32.o
 obj-$(CONFIG_BINFMT_ELF) += elfcore.o
diff --git a/arch/um/sys-i386/atomic64_cx8_32.S b/arch/um/sys-i386/atomic64_cx8_32.S
new file mode 100644
index 000000000000..1e901d3d4a95
--- /dev/null
+++ b/arch/um/sys-i386/atomic64_cx8_32.S
@@ -0,0 +1,225 @@
+/*
+ * atomic64_t for 586+
+ *
+ * Copied from arch/x86/lib/atomic64_cx8_32.S
+ *
+ * Copyright © 2010  Luca Barbieri
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+#include <linux/linkage.h>
+#include <asm/alternative-asm.h>
+#include <asm/dwarf2.h>
+.macro SAVE reg
+        pushl_cfi %\reg
+        CFI_REL_OFFSET \reg, 0
+.endm
+.macro RESTORE reg
+        popl_cfi %\reg
+        CFI_RESTORE \reg
+.endm
+.macro read64 reg
+        movl %ebx, %eax
+        movl %ecx, %edx
+/* we need LOCK_PREFIX since otherwise cmpxchg8b always does the write */
+        LOCK_PREFIX
+        cmpxchg8b (\reg)
+.endm
+ENTRY(atomic64_read_cx8)
+        CFI_STARTPROC
+        read64 %ecx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_read_cx8)
+ENTRY(atomic64_set_cx8)
+        CFI_STARTPROC
+1:
+/* we don't need LOCK_PREFIX since aligned 64-bit writes
+ * are atomic on 586 and newer */
+        cmpxchg8b (%esi)
+        jne 1b
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_set_cx8)
+ENTRY(atomic64_xchg_cx8)
+        CFI_STARTPROC
+        movl %ebx, %eax
+        movl %ecx, %edx
+1:
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_xchg_cx8)
+.macro addsub_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+        SAVE esi
+        SAVE edi
+        movl %eax, %esi
+        movl %edx, %edi
+        movl %ecx, %ebp
+        read64 %ebp
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l %esi, %ebx
+        \insc\()l %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE edi
+        RESTORE esi
+        RESTORE ebx
+        RESTORE ebp
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+addsub_return add add adc
+addsub_return sub sub sbb
+.macro incdec_return func ins insc
+ENTRY(atomic64_\func\()_return_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        \ins\()l $1, %ebx
+        \insc\()l $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+10:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_\func\()_return_cx8)
+.endm
+incdec_return inc add adc
+incdec_return dec sub sbb
+ENTRY(atomic64_dec_if_positive_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+        read64 %esi
+1:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        subl $1, %ebx
+        sbb $0, %ecx
+        js 2f
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+2:
+        movl %ebx, %eax
+        movl %ecx, %edx
+        RESTORE ebx
+        ret
+        CFI_ENDPROC
+ENDPROC(atomic64_dec_if_positive_cx8)
+ENTRY(atomic64_add_unless_cx8)
+        CFI_STARTPROC
+        SAVE ebp
+        SAVE ebx
+/* these just push these two parameters on the stack */
+        SAVE edi
+        SAVE esi
+        movl %ecx, %ebp
+        movl %eax, %esi
+        movl %edx, %edi
+        read64 %ebp
+1:
+        cmpl %eax, 0(%esp)
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl %esi, %ebx
+        adcl %edi, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%ebp)
+        jne 1b
+        movl $1, %eax
+3:
+        addl $8, %esp
+        CFI_ADJUST_CFA_OFFSET -8
+        RESTORE ebx
+        RESTORE ebp
+        ret
+4:
+        cmpl %edx, 4(%esp)
+        jne 2b
+        xorl %eax, %eax
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_add_unless_cx8)
+ENTRY(atomic64_inc_not_zero_cx8)
+        CFI_STARTPROC
+        SAVE ebx
+        read64 %esi
+1:
+        testl %eax, %eax
+        je 4f
+2:
+        movl %eax, %ebx
+        movl %edx, %ecx
+        addl $1, %ebx
+        adcl $0, %ecx
+        LOCK_PREFIX
+        cmpxchg8b (%esi)
+        jne 1b
+        movl $1, %eax
+3:
+        RESTORE ebx
+        ret
+4:
+        testl %edx, %edx
+        jne 2b
+        jmp 3b
+        CFI_ENDPROC
+ENDPROC(atomic64_inc_not_zero_cx8)
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index b136c9c1e531..449c556274c0 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -943,6 +943,10 @@ static int acpi_bus_get_flags(struct acpi_device *device)
        if (ACPI_SUCCESS(status))
                device->flags.lockable = 1;
+        /* Power resources cannot be power manageable. */
+        if (device->device_type == ACPI_BUS_TYPE_POWER)
+                return 0;
        /* Presence of _PS0|_PR0 indicates 'power manageable' */
        status = acpi_get_handle(device->handle, "_PS0", &temp);
        if (ACPI_FAILURE(status))
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index fbc5b6e7c591..abe3ab709e87 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -63,6 +63,7 @@ void device_pm_init(struct device *dev)
        dev->power.wakeup = NULL;
        spin_lock_init(&dev->power.lock);
        pm_runtime_init(dev);
+        INIT_LIST_HEAD(&dev->power.entry);
 }
 /**
diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c
index 4573c83df6dd..abbbd33e8d8a 100644
--- a/drivers/base/power/wakeup.c
+++ b/drivers/base/power/wakeup.c
@@ -258,7 +258,7 @@ void device_set_wakeup_capable(struct device *dev, bool capable)
        if (!!dev->power.can_wakeup == !!capable)
                return;
-        if (device_is_registered(dev)) {
+        if (device_is_registered(dev) && !list_empty(&dev->power.entry)) {
                if (capable) {
                        if (wakeup_sysfs_add(dev))
                                return;
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 31e71c4fc831..9a8bebcf6b17 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -211,8 +211,6 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
        scrubval = scrubval & 0x001F;
-        amd64_debug("pci-read, sdram scrub control value: %d\n", scrubval);
        for (i = 0; i < ARRAY_SIZE(scrubrates); i++) {
                if (scrubrates[i].scrubval == scrubval) {
                        retval = scrubrates[i].bandwidth;
@@ -933,25 +931,74 @@ static int k8_early_channel_count(struct amd64_pvt *pvt)
 /* On F10h and later ErrAddr is MC4_ADDR[47:1] */
 static u64 get_error_address(struct mce *m)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
+        u64 addr;
        u8 start_bit = 1;
        u8 end_bit   = 47;
-        if (boot_cpu_data.x86 == 0xf) {
+        if (c->x86 == 0xf) {
                start_bit = 3;
                end_bit   = 39;
        }
-        return m->addr & GENMASK(start_bit, end_bit);
+        addr = m->addr & GENMASK(start_bit, end_bit);
+        /*
+         * Erratum 637 workaround
+         */
+        if (c->x86 == 0x15) {
+                struct amd64_pvt *pvt;
+                u64 cc6_base, tmp_addr;
+                u32 tmp;
+                u8 mce_nid, intlv_en;
+                if ((addr & GENMASK(24, 47)) >> 24 != 0x00fdf7)
+                        return addr;
+                mce_nid = amd_get_nb_id(m->extcpu);
+                pvt     = mcis[mce_nid]->pvt_info;
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_LIM, &tmp);
+                intlv_en = tmp >> 21 & 0x7;
+                /* add [47:27] + 3 trailing bits */
+                cc6_base  = (tmp & GENMASK(0, 20)) << 3;
+                /* reverse and add DramIntlvEn */
+                cc6_base |= intlv_en ^ 0x7;
+                /* pin at [47:24] */
+                cc6_base <<= 24;
+                if (!intlv_en)
+                        return cc6_base | (addr & GENMASK(0, 23));
+                amd64_read_pci_cfg(pvt->F1, DRAM_LOCAL_NODE_BASE, &tmp);
+                                                        /* faster log2 */
+                tmp_addr  = (addr & GENMASK(12, 23)) << __fls(intlv_en + 1);
+                /* OR DramIntlvSel into bits [14:12] */
+                tmp_addr |= (tmp & GENMASK(21, 23)) >> 9;
+                /* add remaining [11:0] bits from original MC4_ADDR */
+                tmp_addr |= addr & GENMASK(0, 11);
+                return cc6_base | tmp_addr;
+        }
+        return addr;
 }
 static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 {
+        struct cpuinfo_x86 *c = &boot_cpu_data;
        int off = range << 3;
        amd64_read_pci_cfg(pvt->F1, DRAM_BASE_LO + off,  &pvt->ranges[range].base.lo);
        amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_LO + off, &pvt->ranges[range].lim.lo);
-        if (boot_cpu_data.x86 == 0xf)
+        if (c->x86 == 0xf)
                return;
        if (!dram_rw(pvt, range))
@@ -959,6 +1006,31 @@ static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
        amd64_read_pci_cfg(pvt->F1, DRAM_BASE_HI + off,  &pvt->ranges[range].base.hi);
        amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_HI + off, &pvt->ranges[range].lim.hi);
+        /* Factor in CC6 save area by reading dst node's limit reg */
+        if (c->x86 == 0x15) {
+                struct pci_dev *f1 = NULL;
+                u8 nid = dram_dst_node(pvt, range);
+                u32 llim;
+                f1 = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x18 + nid, 1));
+                if (WARN_ON(!f1))
+                        return;
+                amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
+                pvt->ranges[range].lim.lo &= GENMASK(0, 15);
+                                            /* {[39:27],111b} */
+                pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
+                pvt->ranges[range].lim.hi &= GENMASK(0, 7);
+                                            /* [47:40] */
+                pvt->ranges[range].lim.hi |= llim >> 13;
+                pci_dev_put(f1);
+        }
 }
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
@@ -1403,12 +1475,8 @@ static int f1x_match_to_this_node(struct amd64_pvt *pvt, unsigned range,
                return -EINVAL;
        }
-        if (intlv_en &&
+        if (intlv_en && (intlv_sel != ((sys_addr >> 12) & intlv_en)))
-            (intlv_sel != ((sys_addr >> 12) & intlv_en))) {
-                amd64_warn("Botched intlv bits, en: 0x%x, sel: 0x%x\n",
-                           intlv_en, intlv_sel);
                return -EINVAL;
-        }
        sys_addr = f1x_swap_interleaved_region(pvt, sys_addr);
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 11be36a311eb..9a666cb985b2 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -196,6 +196,9 @@
 #define DCT_CFG_SEL                     0x10C
+#define DRAM_LOCAL_NODE_BASE            0x120
+#define DRAM_LOCAL_NODE_LIM             0x124
 #define DRAM_BASE_HI                    0x140
 #define DRAM_LIMIT_HI                   0x144
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 26343fd46596..29ffa350bfbe 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -458,13 +458,13 @@ static ssize_t mci_sdram_scrub_rate_store(struct mem_ctl_info *mci,
                return -EINVAL;
        new_bw = mci->set_sdram_scrub_rate(mci, bandwidth);
-        if (new_bw >= 0) {
+        if (new_bw < 0) {
-                edac_printk(KERN_DEBUG, EDAC_MC, "Scrub rate set to %d\n", new_bw);
+                edac_printk(KERN_WARNING, EDAC_MC,
-                return count;
+                            "Error setting scrub rate to: %lu\n", bandwidth);
+                return -EINVAL;
        }
-        edac_printk(KERN_DEBUG, EDAC_MC, "Error setting scrub rate to: %lu\n", bandwidth);
+        return count;
-        return -EINVAL;
 }
 /*
@@ -483,7 +483,6 @@ static ssize_t mci_sdram_scrub_rate_show(struct mem_ctl_info *mci, char *data)
                return bandwidth;
        }
-        edac_printk(KERN_DEBUG, EDAC_MC, "Read scrub rate: %d\n", bandwidth);
        return sprintf(data, "%d\n", bandwidth);
 }
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index c58f691ec3ce..b493663c7ba7 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -24,6 +24,7 @@ config DRM_KMS_HELPER
        depends on DRM
        select FB
        select FRAMEBUFFER_CONSOLE if !EXPERT
+        select FRAMEBUFFER_CONSOLE_DETECT_PRIMARY if FRAMEBUFFER_CONSOLE
        help
          FB and CRTC helpers for KMS drivers.
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 950720473967..11d7a72c22d9 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -342,9 +342,22 @@ int drm_fb_helper_debug_leave(struct fb_info *info)
 }
 EXPORT_SYMBOL(drm_fb_helper_debug_leave);
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
+{
+        bool error = false;
+        int i, ret;
+        for (i = 0; i < fb_helper->crtc_count; i++) {
+                struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
+                ret = drm_crtc_helper_set_config(mode_set);
+                if (ret)
+                        error = true;
+        }
+        return error;
+}
+EXPORT_SYMBOL(drm_fb_helper_restore_fbdev_mode);
 bool drm_fb_helper_force_kernel_mode(void)
 {
-        int i = 0;
        bool ret, error = false;
        struct drm_fb_helper *helper;
@@ -352,12 +365,12 @@ bool drm_fb_helper_force_kernel_mode(void)
                return false;
        list_for_each_entry(helper, &kernel_fb_helper_list, kernel_fb_list) {
-                for (i = 0; i < helper->crtc_count; i++) {
+                if (helper->dev->switch_power_state == DRM_SWITCH_POWER_OFF)
-                        struct drm_mode_set *mode_set = &helper->crtc_info[i].mode_set;
+                        continue;
-                        ret = drm_crtc_helper_set_config(mode_set);
-                        if (ret)
+                ret = drm_fb_helper_restore_fbdev_mode(helper);
-                                error = true;
+                if (ret)
-                }
+                        error = true;
        }
        return error;
 }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 72730377a01b..12876f2795d2 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2207,7 +2207,7 @@ void i915_driver_lastclose(struct drm_device * dev)
        drm_i915_private_t *dev_priv = dev->dev_private;
        if (!dev_priv || drm_core_check_feature(dev, DRIVER_MODESET)) {
-                drm_fb_helper_restore();
+                intel_fb_restore_mode(dev);
                vga_switcheroo_process_delayed_switch();
                return;
        }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index f5b0d8306d83..1d20712d527f 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -338,4 +338,5 @@ extern int intel_overlay_attrs(struct drm_device *dev, void *data,
                               struct drm_file *file_priv);
 extern void intel_fb_output_poll_changed(struct drm_device *dev);
+extern void intel_fb_restore_mode(struct drm_device *dev);
 #endif /* __INTEL_DRV_H__ */
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 512782728e51..ec49bae73382 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -264,3 +264,13 @@ void intel_fb_output_poll_changed(struct drm_device *dev)
        drm_i915_private_t *dev_priv = dev->dev_private;
        drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
 }
+void intel_fb_restore_mode(struct drm_device *dev)
+{
+        int ret;
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+}
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index bf7d4c061451..871df0376b1c 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -221,6 +221,19 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                        return -EINVAL;
                }
                break;
+        case RADEON_INFO_NUM_TILE_PIPES:
+                if (rdev->family >= CHIP_CAYMAN)
+                        value = rdev->config.cayman.max_tile_pipes;
+                else if (rdev->family >= CHIP_CEDAR)
+                        value = rdev->config.evergreen.max_tile_pipes;
+                else if (rdev->family >= CHIP_RV770)
+                        value = rdev->config.rv770.max_tile_pipes;
+                else if (rdev->family >= CHIP_R600)
+                        value = rdev->config.r600.max_tile_pipes;
+                else {
+                        return -EINVAL;
+                }
+                break;
        default:
                DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r600 b/drivers/gpu/drm/radeon/reg_srcs/r600
index af0da4ae3f55..92f1900dc7ca 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r600
+++ b/drivers/gpu/drm/radeon/reg_srcs/r600
@@ -708,6 +708,7 @@ r600 0x9400
 0x00028D0C DB_RENDER_CONTROL
 0x00028D10 DB_RENDER_OVERRIDE
 0x0002880C DB_SHADER_CONTROL
+0x00028D28 DB_SRESULTS_COMPARE_STATE0
 0x00028D2C DB_SRESULTS_COMPARE_STATE1
 0x00028430 DB_STENCILREFMASK
 0x00028434 DB_STENCILREFMASK_BF
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 060ef6327876..50e40dbd8bb6 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -110,8 +110,7 @@ config SENSORS_ADM1021
        help
          If you say yes here you get support for Analog Devices ADM1021
          and ADM1023 sensor chips and clones: Maxim MAX1617 and MAX1617A,
-          Genesys Logic GL523SM, National Semiconductor LM84, TI THMC10,
+          Genesys Logic GL523SM, National Semiconductor LM84 and TI THMC10.
-          and the XEON processor built-in sensor.
          This driver can also be built as a module.  If so, the module
          will be called adm1021.
@@ -618,10 +617,10 @@ config SENSORS_LM90
        depends on I2C
        help
          If you say yes here you get support for National Semiconductor LM90,
-          LM86, LM89 and LM99, Analog Devices ADM1032 and ADT7461, Maxim
+          LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
-          MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
+          Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
-          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, and Winbond/Nuvoton
+          MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
-          W83L771W/G/AWG/ASG sensor chips.
+          and Winbond/Nuvoton W83L771W/G/AWG/ASG sensor chips.
          This driver can also be built as a module.  If so, the module
          will be called lm90.
diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
index 250d099ca398..da72dc12068c 100644
--- a/drivers/hwmon/lm85.c
+++ b/drivers/hwmon/lm85.c
@@ -1094,6 +1094,7 @@ static struct attribute *lm85_attributes_minctl[] = {
        &sensor_dev_attr_pwm1_auto_pwm_minctl.dev_attr.attr,
        &sensor_dev_attr_pwm2_auto_pwm_minctl.dev_attr.attr,
        &sensor_dev_attr_pwm3_auto_pwm_minctl.dev_attr.attr,
+        NULL
 };
 static const struct attribute_group lm85_group_minctl = {
@@ -1104,6 +1105,7 @@ static struct attribute *lm85_attributes_temp_off[] = {
        &sensor_dev_attr_temp1_auto_temp_off.dev_attr.attr,
        &sensor_dev_attr_temp2_auto_temp_off.dev_attr.attr,
        &sensor_dev_attr_temp3_auto_temp_off.dev_attr.attr,
+        NULL
 };
 static const struct attribute_group lm85_group_temp_off = {
@@ -1329,11 +1331,11 @@ static int lm85_probe(struct i2c_client *client,
        if (data->type != emc6d103s) {
                err = sysfs_create_group(&client->dev.kobj, &lm85_group_minctl);
                if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
                err = sysfs_create_group(&client->dev.kobj,
                                         &lm85_group_temp_off);
                if (err)
-                        goto err_kfree;
+                        goto err_remove_files;
        }
        /* The ADT7463/68 have an optional VRM 10 mode where pin 21 is used
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index c43b4e9f96a9..2f94f9504804 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -49,10 +49,10 @@
 * chips, but support three temperature sensors instead of two. MAX6695
 * and MAX6696 only differ in the pinout so they can be treated identically.
 *
- * This driver also supports the ADT7461 chip from Analog Devices.
+ * This driver also supports ADT7461 and ADT7461A from Analog Devices as well as
- * It's supported in both compatibility and extended mode. It is mostly
+ * NCT1008 from ON Semiconductor. The chips are supported in both compatibility
- * compatible with LM90 except for a data format difference for the
+ * and extended mode. They are mostly compatible with LM90 except for a data
- * temperature value registers.
+ * format difference for the temperature value registers.
 *
 * Since the LM90 was the first chipset supported by this driver, most
 * comments will refer to this chipset, but are actually general and
@@ -88,9 +88,10 @@
 * Addresses to scan
 * Address is fully defined internally and cannot be changed except for
 * MAX6659, MAX6680 and MAX6681.
- * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, MAX6649, MAX6657,
+ * LM86, LM89, LM90, LM99, ADM1032, ADM1032-1, ADT7461, ADT7461A, MAX6649,
- * MAX6658 and W83L771 have address 0x4c.
+ * MAX6657, MAX6658, NCT1008 and W83L771 have address 0x4c.
- * ADM1032-2, ADT7461-2, LM89-1, LM99-1 and MAX6646 have address 0x4d.
+ * ADM1032-2, ADT7461-2, ADT7461A-2, LM89-1, LM99-1, MAX6646, and NCT1008D
+ * have address 0x4d.
 * MAX6647 has address 0x4e.
 * MAX6659 can have address 0x4c, 0x4d or 0x4e.
 * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
@@ -174,6 +175,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
 static const struct i2c_device_id lm90_id[] = {
        { "adm1032", adm1032 },
        { "adt7461", adt7461 },
+        { "adt7461a", adt7461 },
        { "lm90", lm90 },
        { "lm86", lm86 },
        { "lm89", lm86 },
@@ -188,6 +190,7 @@ static const struct i2c_device_id lm90_id[] = {
        { "max6681", max6680 },
        { "max6695", max6696 },
        { "max6696", max6696 },
+        { "nct1008", adt7461 },
        { "w83l771", w83l771 },
        { }
 };
@@ -1153,6 +1156,11 @@ static int lm90_detect(struct i2c_client *new_client,
                 && (reg_config1 & 0x1B) == 0x00
                 && reg_convrate <= 0x0A) {
                        name = "adt7461";
+                } else
+                if (chip_id == 0x57 /* ADT7461A, NCT1008 */
+                 && (reg_config1 & 0x1B) == 0x00
+                 && reg_convrate <= 0x0A) {
+                        name = "adt7461a";
                }
        } else
        if (man_id == 0x4D) { /* Maxim */
diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
index 7de4b7ebffc5..d8ca0a0b970d 100644
--- a/drivers/infiniband/hw/qib/qib_iba6120.c
+++ b/drivers/infiniband/hw/qib/qib_iba6120.c
@@ -1799,7 +1799,7 @@ static int qib_6120_setup_reset(struct qib_devdata *dd)
        /*
         * Keep chip from being accessed until we are ready.  Use
         * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
         */
        dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
        dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
index 74fe0360bec7..c765a2eb04cf 100644
--- a/drivers/infiniband/hw/qib/qib_iba7220.c
+++ b/drivers/infiniband/hw/qib/qib_iba7220.c
@@ -2111,7 +2111,7 @@ static int qib_setup_7220_reset(struct qib_devdata *dd)
        /*
         * Keep chip from being accessed until we are ready.  Use
         * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
         */
        dd->flags &= ~(QIB_INITTED | QIB_PRESENT);
        dd->int_counter = 0; /* so we check interrupts work again */
diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
index 55de3cf3441c..6bab3eaea70f 100644
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -3299,7 +3299,7 @@ static int qib_do_7322_reset(struct qib_devdata *dd)
        /*
         * Keep chip from being accessed until we are ready.  Use
         * writeq() directly, to allow the write even though QIB_PRESENT
-         * isn't' set.
+         * isn't set.
         */
        dd->flags &= ~(QIB_INITTED | QIB_PRESENT | QIB_BADINTR);
        dd->flags |= QIB_DOING_RESET;
diff --git a/drivers/media/common/tuners/tda18271-common.c b/drivers/media/common/tuners/tda18271-common.c
index 5466d47db899..aae40e52af5b 100644
--- a/drivers/media/common/tuners/tda18271-common.c
+++ b/drivers/media/common/tuners/tda18271-common.c
@@ -533,16 +533,7 @@ int tda18271_calc_main_pll(struct dvb_frontend *fe, u32 freq)
        if (tda_fail(ret))
                goto fail;
-        regs[R_MPD]   = (0x77 & pd);
+        regs[R_MPD]   = (0x7f & pd);
-        switch (priv->mode) {
-        case TDA18271_ANALOG:
-                regs[R_MPD]  &= ~0x08;
-                break;
-        case TDA18271_DIGITAL:
-                regs[R_MPD]  |=  0x08;
-                break;
-        }
        div =  ((d * (freq / 1000)) << 7) / 125;
diff --git a/drivers/media/common/tuners/tda18271-fe.c b/drivers/media/common/tuners/tda18271-fe.c
index 9ad4454a148d..d884f5eee73c 100644
--- a/drivers/media/common/tuners/tda18271-fe.c
+++ b/drivers/media/common/tuners/tda18271-fe.c
@@ -579,8 +579,8 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
 #define RF3 2
        u32 rf_default[3];
        u32 rf_freq[3];
-        u8 prog_cal[3];
+        s32 prog_cal[3];
-        u8 prog_tab[3];
+        s32 prog_tab[3];
        i = tda18271_lookup_rf_band(fe, &freq, NULL);
@@ -602,32 +602,33 @@ static int tda18271_rf_tracking_filters_init(struct dvb_frontend *fe, u32 freq)
                        return bcal;
                tda18271_calc_rf_cal(fe, &rf_freq[rf]);
-                prog_tab[rf] = regs[R_EB14];
+                prog_tab[rf] = (s32)regs[R_EB14];
                if (1 == bcal)
-                        prog_cal[rf] = tda18271_calibrate_rf(fe, rf_freq[rf]);
+                        prog_cal[rf] =
+                                (s32)tda18271_calibrate_rf(fe, rf_freq[rf]);
                else
                        prog_cal[rf] = prog_tab[rf];
                switch (rf) {
                case RF1:
                        map[i].rf_a1 = 0;
-                        map[i].rf_b1 = (s32)(prog_cal[RF1] - prog_tab[RF1]);
+                        map[i].rf_b1 = (prog_cal[RF1] - prog_tab[RF1]);
                        map[i].rf1   = rf_freq[RF1] / 1000;
                        break;
                case RF2:
-                        dividend = (s32)(prog_cal[RF2] - prog_tab[RF2]) -
+                        dividend = (prog_cal[RF2] - prog_tab[RF2] -
-                                   (s32)(prog_cal[RF1] + prog_tab[RF1]);
+                                    prog_cal[RF1] + prog_tab[RF1]);
                        divisor = (s32)(rf_freq[RF2] - rf_freq[RF1]) / 1000;
                        map[i].rf_a1 = (dividend / divisor);
                        map[i].rf2   = rf_freq[RF2] / 1000;
                        break;
                case RF3:
-                        dividend = (s32)(prog_cal[RF3] - prog_tab[RF3]) -
+                        dividend = (prog_cal[RF3] - prog_tab[RF3] -
-                                   (s32)(prog_cal[RF2] + prog_tab[RF2]);
+                                    prog_cal[RF2] + prog_tab[RF2]);
                        divisor = (s32)(rf_freq[RF3] - rf_freq[RF2]) / 1000;
                        map[i].rf_a2 = (dividend / divisor);
-                        map[i].rf_b2 = (s32)(prog_cal[RF2] - prog_tab[RF2]);
+                        map[i].rf_b2 = (prog_cal[RF2] - prog_tab[RF2]);
                        map[i].rf3   = rf_freq[RF3] / 1000;
                        break;
                default:
diff --git a/drivers/media/common/tuners/tda18271-maps.c b/drivers/media/common/tuners/tda18271-maps.c
index e7f84c705da8..3d5b6ab7e332 100644
--- a/drivers/media/common/tuners/tda18271-maps.c
+++ b/drivers/media/common/tuners/tda18271-maps.c
@@ -229,8 +229,7 @@ static struct tda18271_map tda18271c2_km[] = {
 static struct tda18271_map tda18271_rf_band[] = {
        { .rfmax =  47900, .val = 0x00 },
        { .rfmax =  61100, .val = 0x01 },
-/*      { .rfmax = 152600, .val = 0x02 }, */
+        { .rfmax = 152600, .val = 0x02 },
-        { .rfmax = 121200, .val = 0x02 },
        { .rfmax = 164700, .val = 0x03 },
        { .rfmax = 203500, .val = 0x04 },
        { .rfmax = 457800, .val = 0x05 },
@@ -448,7 +447,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
        { .rfmax = 150000, .val = 0xb0 },
        { .rfmax = 151000, .val = 0xb1 },
        { .rfmax = 152000, .val = 0xb7 },
-        { .rfmax = 153000, .val = 0xbd },
+        { .rfmax = 152600, .val = 0xbd },
        { .rfmax = 154000, .val = 0x20 },
        { .rfmax = 155000, .val = 0x22 },
        { .rfmax = 156000, .val = 0x24 },
@@ -459,7 +458,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
        { .rfmax = 161000, .val = 0x2d },
        { .rfmax = 163000, .val = 0x2e },
        { .rfmax = 164000, .val = 0x2f },
-        { .rfmax = 165000, .val = 0x30 },
+        { .rfmax = 164700, .val = 0x30 },
        { .rfmax = 166000, .val = 0x11 },
        { .rfmax = 167000, .val = 0x12 },
        { .rfmax = 168000, .val = 0x13 },
@@ -510,7 +509,8 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
        { .rfmax = 236000, .val = 0x1b },
        { .rfmax = 237000, .val = 0x1c },
        { .rfmax = 240000, .val = 0x1d },
-        { .rfmax = 242000, .val = 0x1f },
+        { .rfmax = 242000, .val = 0x1e },
+        { .rfmax = 244000, .val = 0x1f },
        { .rfmax = 247000, .val = 0x20 },
        { .rfmax = 249000, .val = 0x21 },
        { .rfmax = 252000, .val = 0x22 },
@@ -624,7 +624,7 @@ static struct tda18271_map tda18271c2_rf_cal[] = {
        { .rfmax = 453000, .val = 0x93 },
        { .rfmax = 454000, .val = 0x94 },
        { .rfmax = 456000, .val = 0x96 },
-        { .rfmax = 457000, .val = 0x98 },
+        { .rfmax = 457800, .val = 0x98 },
        { .rfmax = 461000, .val = 0x11 },
        { .rfmax = 468000, .val = 0x12 },
        { .rfmax = 472000, .val = 0x13 },
diff --git a/drivers/media/dvb/b2c2/flexcop-pci.c b/drivers/media/dvb/b2c2/flexcop-pci.c
index 955254090a0e..03f96d6ca894 100644
--- a/drivers/media/dvb/b2c2/flexcop-pci.c
+++ b/drivers/media/dvb/b2c2/flexcop-pci.c
@@ -38,7 +38,7 @@ MODULE_PARM_DESC(debug,
        DEBSTATUS);
 #define DRIVER_VERSION "0.1"
-#define DRIVER_NAME "Technisat/B2C2 FlexCop II/IIb/III Digital TV PCI Driver"
+#define DRIVER_NAME "flexcop-pci"
 #define DRIVER_AUTHOR "Patrick Boettcher <patrick.boettcher@desy.de>"
 struct flexcop_pci {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index fe4f894183ff..ccbd39a38c46 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -362,7 +362,7 @@ config DVB_USB_LME2510
 config DVB_USB_TECHNISAT_USB2
        tristate "Technisat DVB-S/S2 USB2.0 support"
        depends on DVB_USB
-        select DVB_STB0899 if !DVB_FE_CUSTOMISE
+        select DVB_STV090x if !DVB_FE_CUSTOMISE
-        select DVB_STB6100 if !DVB_FE_CUSTOMISE
+        select DVB_STV6110x if !DVB_FE_CUSTOMISE
        help
          Say Y here to support the Technisat USB2 DVB-S/S2 device
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 97af266d7f1d..65214af5cd74 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -2162,7 +2162,7 @@ struct dibx000_agc_config dib7090_agc_config[2] = {
                .agc1_pt3       = 98,
                .agc1_slope1    = 0,
                .agc1_slope2    = 167,
-                .agc1_pt1       = 98,
+                .agc2_pt1       = 98,
                .agc2_pt2       = 255,
                .agc2_slope1    = 104,
                .agc2_slope2    = 0,
@@ -2440,11 +2440,11 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap)
        dib0700_set_i2c_speed(adap->dev, 340);
        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x90, &tfe7090pvr_dib7000p_config[0]);
-        dib7090_slave_reset(adap->fe);
        if (adap->fe == NULL)
                return -ENODEV;
+        dib7090_slave_reset(adap->fe);
        return 0;
 }
diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
index 23640ed44d85..056138f63c7d 100644
--- a/drivers/media/media-entity.c
+++ b/drivers/media/media-entity.c
@@ -378,7 +378,6 @@ EXPORT_SYMBOL_GPL(media_entity_create_link);
 static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 {
-        const u32 mask = MEDIA_LNK_FL_ENABLED;
        int ret;
        /* Notify both entities. */
@@ -395,7 +394,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
                return ret;
        }
-        link->flags = (link->flags & ~mask) | (flags & mask);
+        link->flags = flags;
        link->reverse->flags = link->flags;
        return 0;
@@ -417,6 +416,7 @@ static int __media_entity_setup_link_notify(struct media_link *link, u32 flags)
 */
 int __media_entity_setup_link(struct media_link *link, u32 flags)
 {
+        const u32 mask = MEDIA_LNK_FL_ENABLED;
        struct media_device *mdev;
        struct media_entity *source, *sink;
        int ret = -EBUSY;
@@ -424,6 +424,10 @@ int __media_entity_setup_link(struct media_link *link, u32 flags)
        if (link == NULL)
                return -EINVAL;
+        /* The non-modifiable link flags must not be modified. */
+        if ((link->flags & ~mask) != (flags & ~mask))
+                return -EINVAL;
        if (link->flags & MEDIA_LNK_FL_IMMUTABLE)
                return link->flags == flags ? 0 : -EINVAL;
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index dc3f04c52d5e..87bad7678d92 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -170,7 +170,7 @@ static int fmr2_setfreq(struct fmr2 *dev)
        return 0;
 }
-/* !!! not tested, in my card this does't work !!! */
+/* !!! not tested, in my card this doesn't work !!! */
 static int fmr2_setvolume(struct fmr2 *dev)
 {
        int vol[16] = { 0x021, 0x084, 0x090, 0x104,
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 4498b944dec8..00f51dd121f3 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -875,7 +875,7 @@ config MX3_VIDEO
 config VIDEO_MX3
        tristate "i.MX3x Camera Sensor Interface driver"
        depends on VIDEO_DEV && MX3_IPU && SOC_CAMERA
-        select VIDEOBUF_DMA_CONTIG
+        select VIDEOBUF2_DMA_CONTIG
        select MX3_VIDEO
        ---help---
          This is a v4l2 driver for the i.MX3x Camera Sensor Interface
diff --git a/drivers/media/video/cx18/cx18-streams.c b/drivers/media/video/cx18/cx18-streams.c
index c6e2ca3b1149..6fbc356113c1 100644
--- a/drivers/media/video/cx18/cx18-streams.c
+++ b/drivers/media/video/cx18/cx18-streams.c
@@ -350,9 +350,17 @@ void cx18_streams_cleanup(struct cx18 *cx, int unregister)
                /* No struct video_device, but can have buffers allocated */
                if (type == CX18_ENC_STREAM_TYPE_IDX) {
+                        /* If the module params didn't inhibit IDX ... */
                        if (cx->stream_buffers[type] != 0) {
                                cx->stream_buffers[type] = 0;
-                                cx18_stream_free(&cx->streams[type]);
+                                /*
+                                 * Before calling cx18_stream_free(),
+                                 * check if the IDX stream was actually set up.
+                                 * Needed, since the cx18_probe() error path
+                                 * exits through here as well as normal clean up
+                                 */
+                                if (cx->streams[type].buffers != 0)
+                                        cx18_stream_free(&cx->streams[type]);
                        }
                        continue;
                }
diff --git a/drivers/media/video/cx23885/Kconfig b/drivers/media/video/cx23885/Kconfig
index 3b6e7f28568e..caab1bfb79e2 100644
--- a/drivers/media/video/cx23885/Kconfig
+++ b/drivers/media/video/cx23885/Kconfig
@@ -22,6 +22,7 @@ config VIDEO_CX23885
        select DVB_CX24116 if !DVB_FE_CUSTOMISE
        select DVB_STV0900 if !DVB_FE_CUSTOMISE
        select DVB_DS3000 if !DVB_FE_CUSTOMISE
+        select DVB_STV0367 if !DVB_FE_CUSTOMISE
        select MEDIA_TUNER_MT2131 if !MEDIA_TUNER_CUSTOMISE
        select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
        select MEDIA_TUNER_TDA8290 if !MEDIA_TUNER_CUSTOMISE
diff --git a/drivers/media/video/imx074.c b/drivers/media/video/imx074.c
index 1a1169115716..0382ea752e6f 100644
--- a/drivers/media/video/imx074.c
+++ b/drivers/media/video/imx074.c
@@ -298,7 +298,7 @@ static unsigned long imx074_query_bus_param(struct soc_camera_device *icd)
 static int imx074_set_bus_param(struct soc_camera_device *icd,
                                 unsigned long flags)
 {
-        return -1;
+        return -EINVAL;
 }
 static struct soc_camera_ops imx074_ops = {
diff --git a/drivers/media/video/omap3isp/isp.c b/drivers/media/video/omap3isp/isp.c
index 503bd7922bd6..472a69359e60 100644
--- a/drivers/media/video/omap3isp/isp.c
+++ b/drivers/media/video/omap3isp/isp.c
@@ -215,20 +215,21 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
        }
        switch (xclksel) {
-        case 0:
+        case ISP_XCLK_A:
                isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                ISPTCTRL_CTRL_DIVA_MASK,
                                divisor << ISPTCTRL_CTRL_DIVA_SHIFT);
                dev_dbg(isp->dev, "isp_set_xclk(): cam_xclka set to %d Hz\n",
                        currentxclk);
                break;
-        case 1:
+        case ISP_XCLK_B:
                isp_reg_clr_set(isp, OMAP3_ISP_IOMEM_MAIN, ISP_TCTRL_CTRL,
                                ISPTCTRL_CTRL_DIVB_MASK,
                                divisor << ISPTCTRL_CTRL_DIVB_SHIFT);
                dev_dbg(isp->dev, "isp_set_xclk(): cam_xclkb set to %d Hz\n",
                        currentxclk);
                break;
+        case ISP_XCLK_NONE:
        default:
                omap3isp_put(isp);
                dev_dbg(isp->dev, "ISP_ERR: isp_set_xclk(): Invalid requested "
@@ -237,13 +238,13 @@ static u32 isp_set_xclk(struct isp_device *isp, u32 xclk, u8 xclksel)
        }
        /* Do we go from stable whatever to clock? */
-        if (divisor >= 2 && isp->xclk_divisor[xclksel] < 2)
+        if (divisor >= 2 && isp->xclk_divisor[xclksel - 1] < 2)
                omap3isp_get(isp);
        /* Stopping the clock. */
-        else if (divisor < 2 && isp->xclk_divisor[xclksel] >= 2)
+        else if (divisor < 2 && isp->xclk_divisor[xclksel - 1] >= 2)
                omap3isp_put(isp);
-        isp->xclk_divisor[xclksel] = divisor;
+        isp->xclk_divisor[xclksel - 1] = divisor;
        omap3isp_put(isp);
@@ -285,7 +286,8 @@ static void isp_power_settings(struct isp_device *isp, int idle)
 */
 void omap3isp_configure_bridge(struct isp_device *isp,
                               enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata)
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift)
 {
        u32 ispctrl_val;
@@ -298,9 +300,9 @@ void omap3isp_configure_bridge(struct isp_device *isp,
        switch (input) {
        case CCDC_INPUT_PARALLEL:
                ispctrl_val |= ISPCTRL_PAR_SER_CLK_SEL_PARALLEL;
-                ispctrl_val |= pdata->data_lane_shift << ISPCTRL_SHIFT_SHIFT;
                ispctrl_val |= pdata->clk_pol << ISPCTRL_PAR_CLK_POL_SHIFT;
                ispctrl_val |= pdata->bridge << ISPCTRL_PAR_BRIDGE_SHIFT;
+                shift += pdata->data_lane_shift * 2;
                break;
        case CCDC_INPUT_CSI2A:
@@ -319,6 +321,8 @@ void omap3isp_configure_bridge(struct isp_device *isp,
                return;
        }
+        ispctrl_val |= ((shift/2) << ISPCTRL_SHIFT_SHIFT) & ISPCTRL_SHIFT_MASK;
        ispctrl_val &= ~ISPCTRL_SYNC_DETECT_MASK;
        ispctrl_val |= ISPCTRL_SYNC_DETECT_VSRISE;
@@ -658,6 +662,8 @@ int omap3isp_pipeline_pm_use(struct media_entity *entity, int use)
        /* Apply power change to connected non-nodes. */
        ret = isp_pipeline_pm_power(entity, change);
+        if (ret < 0)
+                entity->use_count -= change;
        mutex_unlock(&entity->parent->graph_mutex);
@@ -872,6 +878,9 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
                }
        }
+        if (failure < 0)
+                isp->needs_reset = true;
        return failure;
 }
@@ -884,7 +893,8 @@ static int isp_pipeline_disable(struct isp_pipeline *pipe)
 * single-shot or continuous mode.
 *
 * Return 0 if successful, or the return value of the failed video::s_stream
- * operation otherwise.
+ * operation otherwise. The pipeline state is not updated when the operation
+ * fails, except when stopping the pipeline.
 */
 int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                 enum isp_pipeline_stream_state state)
@@ -895,7 +905,9 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                ret = isp_pipeline_disable(pipe);
        else
                ret = isp_pipeline_enable(pipe, state);
-        pipe->stream_state = state;
+        if (ret == 0 || state == ISP_PIPELINE_STREAM_STOPPED)
+                pipe->stream_state = state;
        return ret;
 }
@@ -1481,6 +1493,10 @@ void omap3isp_put(struct isp_device *isp)
        if (--isp->ref_count == 0) {
                isp_disable_interrupts(isp);
                isp_save_ctx(isp);
+                if (isp->needs_reset) {
+                        isp_reset(isp);
+                        isp->needs_reset = false;
+                }
                isp_disable_clocks(isp);
        }
        mutex_unlock(&isp->isp_mutex);
diff --git a/drivers/media/video/omap3isp/isp.h b/drivers/media/video/omap3isp/isp.h
index cf5214e95a92..2620c405f5e4 100644
--- a/drivers/media/video/omap3isp/isp.h
+++ b/drivers/media/video/omap3isp/isp.h
@@ -132,7 +132,6 @@ struct isp_reg {
 /**
 * struct isp_parallel_platform_data - Parallel interface platform data
- * @width: Parallel bus width in bits (8, 10, 11 or 12)
 * @data_lane_shift: Data lane shifter
 *              0 - CAMEXT[13:0] -> CAM[13:0]
 *              1 - CAMEXT[13:2] -> CAM[11:0]
@@ -146,7 +145,6 @@ struct isp_reg {
 *              ISPCTRL_PAR_BRIDGE_BENDIAN - Big endian
 */
 struct isp_parallel_platform_data {
-        unsigned int width;
        unsigned int data_lane_shift:2;
        unsigned int clk_pol:1;
        unsigned int bridge:4;
@@ -262,6 +260,7 @@ struct isp_device {
        /* ISP Obj */
        spinlock_t stat_lock;   /* common lock for statistic drivers */
        struct mutex isp_mutex; /* For handling ref_count field */
+        bool needs_reset;
        int has_context;
        int ref_count;
        unsigned int autoidle;
@@ -311,11 +310,12 @@ int omap3isp_pipeline_set_stream(struct isp_pipeline *pipe,
                                 enum isp_pipeline_stream_state state);
 void omap3isp_configure_bridge(struct isp_device *isp,
                               enum ccdc_input_entity input,
-                               const struct isp_parallel_platform_data *pdata);
+                               const struct isp_parallel_platform_data *pdata,
+                               unsigned int shift);
-#define ISP_XCLK_NONE                   -1
+#define ISP_XCLK_NONE                   0
-#define ISP_XCLK_A                      0
+#define ISP_XCLK_A                      1
-#define ISP_XCLK_B                      1
+#define ISP_XCLK_B                      2
 struct isp_device *omap3isp_get(struct isp_device *isp);
 void omap3isp_put(struct isp_device *isp);
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 5ff9d14ce710..39d501bda636 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -43,6 +43,12 @@ __ccdc_get_format(struct isp_ccdc_device *ccdc, struct v4l2_subdev_fh *fh,
 static const unsigned int ccdc_fmts[] = {
        V4L2_MBUS_FMT_Y8_1X8,
+        V4L2_MBUS_FMT_Y10_1X10,
+        V4L2_MBUS_FMT_Y12_1X12,
+        V4L2_MBUS_FMT_SGRBG8_1X8,
+        V4L2_MBUS_FMT_SRGGB8_1X8,
+        V4L2_MBUS_FMT_SBGGR8_1X8,
+        V4L2_MBUS_FMT_SGBRG8_1X8,
        V4L2_MBUS_FMT_SGRBG10_1X10,
        V4L2_MBUS_FMT_SRGGB10_1X10,
        V4L2_MBUS_FMT_SBGGR10_1X10,
@@ -1110,21 +1116,38 @@ static void ccdc_configure(struct isp_ccdc_device *ccdc)
        struct isp_parallel_platform_data *pdata = NULL;
        struct v4l2_subdev *sensor;
        struct v4l2_mbus_framefmt *format;
+        const struct isp_format_info *fmt_info;
+        struct v4l2_subdev_format fmt_src;
+        unsigned int depth_out;
+        unsigned int depth_in = 0;
        struct media_pad *pad;
        unsigned long flags;
+        unsigned int shift;
        u32 syn_mode;
        u32 ccdc_pattern;
-        if (ccdc->input == CCDC_INPUT_PARALLEL) {
+        pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
-                pad = media_entity_remote_source(&ccdc->pads[CCDC_PAD_SINK]);
+        sensor = media_entity_to_v4l2_subdev(pad->entity);
-                sensor = media_entity_to_v4l2_subdev(pad->entity);
+        if (ccdc->input == CCDC_INPUT_PARALLEL)
                pdata = &((struct isp_v4l2_subdevs_group *)sensor->host_priv)
                        ->bus.parallel;
+        /* Compute shift value for lane shifter to configure the bridge. */
+        fmt_src.pad = pad->index;
+        fmt_src.which = V4L2_SUBDEV_FORMAT_ACTIVE;
+        if (!v4l2_subdev_call(sensor, pad, get_fmt, NULL, &fmt_src)) {
+                fmt_info = omap3isp_video_format_info(fmt_src.format.code);
+                depth_in = fmt_info->bpp;
        }
-        omap3isp_configure_bridge(isp, ccdc->input, pdata);
+        fmt_info = omap3isp_video_format_info
+                (isp->isp_ccdc.formats[CCDC_PAD_SINK].code);
+        depth_out = fmt_info->bpp;
+        shift = depth_in - depth_out;
+        omap3isp_configure_bridge(isp, ccdc->input, pdata, shift);
-        ccdc->syncif.datsz = pdata ? pdata->width : 10;
+        ccdc->syncif.datsz = depth_out;
        ccdc_config_sync_if(ccdc, &ccdc->syncif);
        /* CCDC_PAD_SINK */
@@ -1338,7 +1361,7 @@ static int ccdc_sbl_wait_idle(struct isp_ccdc_device *ccdc,
 * @ccdc: Pointer to ISP CCDC device.
 * @event: Pointing which event trigger handler
 *
- * Return 1 when the event and stopping request combination is satisfyied,
+ * Return 1 when the event and stopping request combination is satisfied,
 * zero otherwise.
 */
 static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
@@ -1618,7 +1641,7 @@ static int ccdc_video_queue(struct isp_video *video, struct isp_buffer *buffer)
        ccdc_set_outaddr(ccdc, buffer->isp_addr);
-        /* We now have a buffer queued on the output, restart the pipeline in
+        /* We now have a buffer queued on the output, restart the pipeline
         * on the next CCDC interrupt if running in continuous mode (or when
         * starting the stream).
         */
diff --git a/drivers/media/video/omap3isp/isppreview.c b/drivers/media/video/omap3isp/isppreview.c
index 2b16988a501d..aba537af87e4 100644
--- a/drivers/media/video/omap3isp/isppreview.c
+++ b/drivers/media/video/omap3isp/isppreview.c
@@ -755,7 +755,7 @@ static struct preview_update update_attrs[] = {
 * @configs - pointer to update config structure.
 * @config - return pointer to appropriate structure field.
 * @bit - for which feature to return pointers.
- * Return size of coresponding prev_params member
+ * Return size of corresponding prev_params member
 */
 static u32
 __preview_get_ptrs(struct prev_params *params, void **param,
diff --git a/drivers/media/video/omap3isp/ispqueue.c b/drivers/media/video/omap3isp/ispqueue.c
index 8fddc5806b0d..9c317148205f 100644
--- a/drivers/media/video/omap3isp/ispqueue.c
+++ b/drivers/media/video/omap3isp/ispqueue.c
@@ -339,7 +339,7 @@ static int isp_video_buffer_prepare_user(struct isp_video_buffer *buf)
        up_read(&current->mm->mmap_sem);
        if (ret != buf->npages) {
-                buf->npages = ret;
+                buf->npages = ret < 0 ? 0 : ret;
                isp_video_buffer_cleanup(buf);
                return -EFAULT;
        }
@@ -408,8 +408,8 @@ done:
 * isp_video_buffer_prepare_vm_flags - Get VMA flags for a userspace address
 *
 * This function locates the VMAs for the buffer's userspace address and checks
- * that their flags match. The onlflag that we need to care for at the moment is
+ * that their flags match. The only flag that we need to care for at the moment
- * VM_PFNMAP.
+ * is VM_PFNMAP.
 *
 * The buffer vm_flags field is set to the first VMA flags.
 *
diff --git a/drivers/media/video/omap3isp/ispresizer.c b/drivers/media/video/omap3isp/ispresizer.c
index 653f88ba56db..0bb0f8cd36f5 100644
--- a/drivers/media/video/omap3isp/ispresizer.c
+++ b/drivers/media/video/omap3isp/ispresizer.c
@@ -714,19 +714,50 @@ static void resizer_print_status(struct isp_res_device *res)
 * iw and ih are the input width and height after cropping. Those equations need
 * to be satisfied exactly for the resizer to work correctly.
 *
- * Reverting the equations, we can compute the resizing ratios with
+ * The equations can't be easily reverted, as the >> 8 operation is not linear.
+ * In addition, not all input sizes can be achieved for a given output size. To
+ * get the highest input size lower than or equal to the requested input size,
+ * we need to compute the highest resizing ratio that satisfies the following
+ * inequality (taking the 4-tap mode width equation as an example)
+ *
+ *      iw >= (32 * sph + (ow - 1) * hrsz + 16) >> 8 - 7
+ *
+ * (where iw is the requested input width) which can be rewritten as
+ *
+ *        iw - 7            >= (32 * sph + (ow - 1) * hrsz + 16) >> 8
+ *       (iw - 7) << 8      >=  32 * sph + (ow - 1) * hrsz + 16 - b
+ *      ((iw - 7) << 8) + b >=  32 * sph + (ow - 1) * hrsz + 16
+ *
+ * where b is the value of the 8 least significant bits of the right hand side
+ * expression of the last inequality. The highest resizing ratio value will be
+ * achieved when b is equal to its maximum value of 255. That resizing ratio
+ * value will still satisfy the original inequality, as b will disappear when
+ * the expression will be shifted right by 8.
+ *
+ * The reverted the equations thus become
 *
 * - 8-phase, 4-tap mode
- *      hrsz = ((iw - 7) * 256 - 16 - 32 * sph) / (ow - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 16 - 32 * sph) / (ow - 1)
- *      vrsz = ((ih - 4) * 256 - 16 - 32 * spv) / (oh - 1)
+ *      vrsz = ((ih - 4) * 256 + 255 - 16 - 32 * spv) / (oh - 1)
 * - 4-phase, 7-tap mode
- *      hrsz = ((iw - 7) * 256 - 32 - 64 * sph) / (ow - 1)
+ *      hrsz = ((iw - 7) * 256 + 255 - 32 - 64 * sph) / (ow - 1)
- *      vrsz = ((ih - 7) * 256 - 32 - 64 * spv) / (oh - 1)
+ *      vrsz = ((ih - 7) * 256 + 255 - 32 - 64 * spv) / (oh - 1)
 *
- * The ratios are integer values, and must be rounded down to ensure that the
+ * The ratios are integer values, and are rounded down to ensure that the
- * cropped input size is not bigger than the uncropped input size. As the ratio
+ * cropped input size is not bigger than the uncropped input size.
- * in 7-tap mode is always smaller than the ratio in 4-tap mode, we can use the
+ *
- * 7-tap mode equations to compute a ratio approximation.
+ * As the number of phases/taps, used to select the correct equations to compute
+ * the ratio, depends on the ratio, we start with the 4-tap mode equations to
+ * compute an approximation of the ratio, and switch to the 7-tap mode equations
+ * if the approximation is higher than the ratio threshold.
+ *
+ * As the 7-tap mode equations will return a ratio smaller than or equal to the
+ * 4-tap mode equations, the resulting ratio could become lower than or equal to
+ * the ratio threshold. This 'equations loop' isn't an issue as long as the
+ * correct equations are used to compute the final input size. Starting with the
+ * 4-tap mode equations ensure that, in case of values resulting in a 'ratio
+ * loop', the smallest of the ratio values will be used, never exceeding the
+ * requested input size.
 *
 * We first clamp the output size according to the hardware capabilitie to avoid
 * auto-cropping the input more than required to satisfy the TRM equations. The
@@ -775,6 +806,8 @@ static void resizer_calc_ratios(struct isp_res_device *res,
        unsigned int max_width;
        unsigned int max_height;
        unsigned int width_alignment;
+        unsigned int width;
+        unsigned int height;
        /*
         * Clamp the output height based on the hardware capabilities and
@@ -786,19 +819,22 @@ static void resizer_calc_ratios(struct isp_res_device *res,
        max_height = min_t(unsigned int, max_height, MAX_OUT_HEIGHT);
        output->height = clamp(output->height, min_height, max_height);
-        ratio->vert = ((input->height - 7) * 256 - 32 - 64 * spv)
+        ratio->vert = ((input->height - 4) * 256 + 255 - 16 - 32 * spv)
                    / (output->height - 1);
+        if (ratio->vert > MID_RESIZE_VALUE)
+                ratio->vert = ((input->height - 7) * 256 + 255 - 32 - 64 * spv)
+                            / (output->height - 1);
        ratio->vert = clamp_t(unsigned int, ratio->vert,
                              MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
        if (ratio->vert <= MID_RESIZE_VALUE) {
                upscaled_height = (output->height - 1) * ratio->vert
                                + 32 * spv + 16;
-                input->height = (upscaled_height >> 8) + 4;
+                height = (upscaled_height >> 8) + 4;
        } else {
                upscaled_height = (output->height - 1) * ratio->vert
                                + 64 * spv + 32;
-                input->height = (upscaled_height >> 8) + 7;
+                height = (upscaled_height >> 8) + 7;
        }
        /*
@@ -854,20 +890,29 @@ static void resizer_calc_ratios(struct isp_res_device *res,
                              max_width & ~(width_alignment - 1));
        output->width = ALIGN(output->width, width_alignment);
-        ratio->horz = ((input->width - 7) * 256 - 32 - 64 * sph)
+        ratio->horz = ((input->width - 7) * 256 + 255 - 16 - 32 * sph)
                    / (output->width - 1);
+        if (ratio->horz > MID_RESIZE_VALUE)
+                ratio->horz = ((input->width - 7) * 256 + 255 - 32 - 64 * sph)
+                            / (output->width - 1);
        ratio->horz = clamp_t(unsigned int, ratio->horz,
                              MIN_RESIZE_VALUE, MAX_RESIZE_VALUE);
        if (ratio->horz <= MID_RESIZE_VALUE) {
                upscaled_width = (output->width - 1) * ratio->horz
                               + 32 * sph + 16;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
        } else {
                upscaled_width = (output->width - 1) * ratio->horz
                               + 64 * sph + 32;
-                input->width = (upscaled_width >> 8) + 7;
+                width = (upscaled_width >> 8) + 7;
        }
+        /* Center the new crop rectangle. */
+        input->left += (input->width - width) / 2;
+        input->top += (input->height - height) / 2;
+        input->width = width;
+        input->height = height;
 }
 /*
diff --git a/drivers/media/video/omap3isp/ispstat.h b/drivers/media/video/omap3isp/ispstat.h
index 820950c9ef46..d86da94fa50d 100644
--- a/drivers/media/video/omap3isp/ispstat.h
+++ b/drivers/media/video/omap3isp/ispstat.h
@@ -131,9 +131,9 @@ struct ispstat {
 struct ispstat_generic_config {
        /*
         * Fields must be in the same order as in:
-         *  - isph3a_aewb_config
+         *  - omap3isp_h3a_aewb_config
-         *  - isph3a_af_config
+         *  - omap3isp_h3a_af_config
-         *  - isphist_config
+         *  - omap3isp_hist_config
         */
        u32 buf_size;
        u16 config_counter;
diff --git a/drivers/media/video/omap3isp/ispvideo.c b/drivers/media/video/omap3isp/ispvideo.c
index 208a7ec739d7..9cd8f1aa567b 100644
--- a/drivers/media/video/omap3isp/ispvideo.c
+++ b/drivers/media/video/omap3isp/ispvideo.c
@@ -47,29 +47,59 @@
 static struct isp_format_info formats[] = {
        { V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
-          V4L2_MBUS_FMT_Y8_1X8, V4L2_PIX_FMT_GREY, 8, },
+          V4L2_MBUS_FMT_Y8_1X8, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_GREY, 8, },
+        { V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y10_1X10, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y10, 10, },
+        { V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y10_1X10,
+          V4L2_MBUS_FMT_Y12_1X12, V4L2_MBUS_FMT_Y8_1X8,
+          V4L2_PIX_FMT_Y12, 12, },
+        { V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_MBUS_FMT_SBGGR8_1X8, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR8, 8, },
+        { V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_MBUS_FMT_SGBRG8_1X8, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG8, 8, },
+        { V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_MBUS_FMT_SGRBG8_1X8, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG8, 8, },
+        { V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_MBUS_FMT_SRGGB8_1X8, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB8, 8, },
        { V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8, V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, 0,
+          V4L2_PIX_FMT_SGRBG10DPCM8, 8, },
        { V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_PIX_FMT_SBGGR10, 10, },
+          V4L2_MBUS_FMT_SBGGR10_1X10, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR10, 10, },
        { V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_PIX_FMT_SGBRG10, 10, },
+          V4L2_MBUS_FMT_SGBRG10_1X10, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG10, 10, },
        { V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_PIX_FMT_SGRBG10, 10, },
+          V4L2_MBUS_FMT_SGRBG10_1X10, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG10, 10, },
        { V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_PIX_FMT_SRGGB10, 10, },
+          V4L2_MBUS_FMT_SRGGB10_1X10, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB10, 10, },
        { V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR10_1X10,
-          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_PIX_FMT_SBGGR12, 12, },
+          V4L2_MBUS_FMT_SBGGR12_1X12, V4L2_MBUS_FMT_SBGGR8_1X8,
+          V4L2_PIX_FMT_SBGGR12, 12, },
        { V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG10_1X10,
-          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_PIX_FMT_SGBRG12, 12, },
+          V4L2_MBUS_FMT_SGBRG12_1X12, V4L2_MBUS_FMT_SGBRG8_1X8,
+          V4L2_PIX_FMT_SGBRG12, 12, },
        { V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG10_1X10,
-          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_PIX_FMT_SGRBG12, 12, },
+          V4L2_MBUS_FMT_SGRBG12_1X12, V4L2_MBUS_FMT_SGRBG8_1X8,
+          V4L2_PIX_FMT_SGRBG12, 12, },
        { V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB10_1X10,
-          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_PIX_FMT_SRGGB12, 12, },
+          V4L2_MBUS_FMT_SRGGB12_1X12, V4L2_MBUS_FMT_SRGGB8_1X8,
+          V4L2_PIX_FMT_SRGGB12, 12, },
        { V4L2_MBUS_FMT_UYVY8_1X16, V4L2_MBUS_FMT_UYVY8_1X16,
-          V4L2_MBUS_FMT_UYVY8_1X16, V4L2_PIX_FMT_UYVY, 16, },
+          V4L2_MBUS_FMT_UYVY8_1X16, 0,
+          V4L2_PIX_FMT_UYVY, 16, },
        { V4L2_MBUS_FMT_YUYV8_1X16, V4L2_MBUS_FMT_YUYV8_1X16,
-          V4L2_MBUS_FMT_YUYV8_1X16, V4L2_PIX_FMT_YUYV, 16, },
+          V4L2_MBUS_FMT_YUYV8_1X16, 0,
+          V4L2_PIX_FMT_YUYV, 16, },
 };
 const struct isp_format_info *
@@ -86,6 +116,37 @@ omap3isp_video_format_info(enum v4l2_mbus_pixelcode code)
 }
 /*
+ * Decide whether desired output pixel code can be obtained with
+ * the lane shifter by shifting the input pixel code.
+ * @in: input pixelcode to shifter
+ * @out: output pixelcode from shifter
+ * @additional_shift: # of bits the sensor's LSB is offset from CAMEXT[0]
+ *
+ * return true if the combination is possible
+ * return false otherwise
+ */
+static bool isp_video_is_shiftable(enum v4l2_mbus_pixelcode in,
+                enum v4l2_mbus_pixelcode out,
+                unsigned int additional_shift)
+{
+        const struct isp_format_info *in_info, *out_info;
+        if (in == out)
+                return true;
+        in_info = omap3isp_video_format_info(in);
+        out_info = omap3isp_video_format_info(out);
+        if ((in_info->flavor == 0) || (out_info->flavor == 0))
+                return false;
+        if (in_info->flavor != out_info->flavor)
+                return false;
+        return in_info->bpp - out_info->bpp + additional_shift <= 6;
+}
+/*
 * isp_video_mbus_to_pix - Convert v4l2_mbus_framefmt to v4l2_pix_format
 * @video: ISP video instance
 * @mbus: v4l2_mbus_framefmt format (input)
@@ -235,6 +296,7 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                return -EPIPE;
        while (1) {
+                unsigned int shifter_link;
                /* Retrieve the sink format */
                pad = &subdev->entity.pads[0];
                if (!(pad->flags & MEDIA_PAD_FL_SINK))
@@ -263,6 +325,10 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                                return -ENOSPC;
                }
+                /* If sink pad is on CCDC, the link has the lane shifter
+                 * in the middle of it. */
+                shifter_link = subdev == &isp->isp_ccdc.subdev;
                /* Retrieve the source format */
                pad = media_entity_remote_source(pad);
                if (pad == NULL ||
@@ -278,10 +344,24 @@ static int isp_video_validate_pipeline(struct isp_pipeline *pipe)
                        return -EPIPE;
                /* Check if the two ends match */
-                if (fmt_source.format.code != fmt_sink.format.code ||
+                if (fmt_source.format.width != fmt_sink.format.width ||
-                    fmt_source.format.width != fmt_sink.format.width ||
                    fmt_source.format.height != fmt_sink.format.height)
                        return -EPIPE;
+                if (shifter_link) {
+                        unsigned int parallel_shift = 0;
+                        if (isp->isp_ccdc.input == CCDC_INPUT_PARALLEL) {
+                                struct isp_parallel_platform_data *pdata =
+                                        &((struct isp_v4l2_subdevs_group *)
+                                              subdev->host_priv)->bus.parallel;
+                                parallel_shift = pdata->data_lane_shift * 2;
+                        }
+                        if (!isp_video_is_shiftable(fmt_source.format.code,
+                                                fmt_sink.format.code,
+                                                parallel_shift))
+                                return -EPIPE;
+                } else if (fmt_source.format.code != fmt_sink.format.code)
+                        return -EPIPE;
        }
        return 0;
diff --git a/drivers/media/video/omap3isp/ispvideo.h b/drivers/media/video/omap3isp/ispvideo.h
index 524a1acd0906..911bea64e78a 100644
--- a/drivers/media/video/omap3isp/ispvideo.h
+++ b/drivers/media/video/omap3isp/ispvideo.h
@@ -49,6 +49,8 @@ struct v4l2_pix_format;
 *      bits. Identical to @code if the format is 10 bits wide or less.
 * @uncompressed: V4L2 media bus format code for the corresponding uncompressed
 *      format. Identical to @code if the format is not DPCM compressed.
+ * @flavor: V4L2 media bus format code for the same pixel layout but
+ *      shifted to be 8 bits per pixel. =0 if format is not shiftable.
 * @pixelformat: V4L2 pixel format FCC identifier
 * @bpp: Bits per pixel
 */
@@ -56,6 +58,7 @@ struct isp_format_info {
        enum v4l2_mbus_pixelcode code;
        enum v4l2_mbus_pixelcode truncated;
        enum v4l2_mbus_pixelcode uncompressed;
+        enum v4l2_mbus_pixelcode flavor;
        u32 pixelformat;
        unsigned int bpp;
 };
diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
index 95f8b4e11e46..d142b40ea64e 100644
--- a/drivers/media/video/s5p-fimc/fimc-capture.c
+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
@@ -527,7 +527,7 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
        if (ret)
                return ret;
-        if (vb2_is_streaming(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
+        if (vb2_is_busy(&fimc->vid_cap.vbq) || fimc_capture_active(fimc))
                return -EBUSY;
        frame = &ctx->d_frame;
@@ -539,8 +539,10 @@ static int fimc_cap_s_fmt_mplane(struct file *file, void *priv,
                return -EINVAL;
        }
-        for (i = 0; i < frame->fmt->colplanes; i++)
+        for (i = 0; i < frame->fmt->colplanes; i++) {
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) >> 3;
+        }
        /* Output DMA frame pixel size and offsets. */
        frame->f_width = pix->plane_fmt[0].bytesperline * 8
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index 6c919b38a3d8..dc91a8511af6 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -361,10 +361,20 @@ static void fimc_capture_irq_handler(struct fimc_dev *fimc)
 {
        struct fimc_vid_cap *cap = &fimc->vid_cap;
        struct fimc_vid_buffer *v_buf;
+        struct timeval *tv;
+        struct timespec ts;
        if (!list_empty(&cap->active_buf_q) &&
            test_bit(ST_CAPT_RUN, &fimc->state)) {
+                ktime_get_real_ts(&ts);
                v_buf = active_queue_pop(cap);
+                tv = &v_buf->vb.v4l2_buf.timestamp;
+                tv->tv_sec = ts.tv_sec;
+                tv->tv_usec = ts.tv_nsec / NSEC_PER_USEC;
+                v_buf->vb.v4l2_buf.sequence = cap->frame_count++;
                vb2_buffer_done(&v_buf->vb, VB2_BUF_STATE_DONE);
        }
@@ -758,7 +768,7 @@ static void fimc_unlock(struct vb2_queue *vq)
        mutex_unlock(&ctx->fimc_dev->lock);
 }
-struct vb2_ops fimc_qops = {
+static struct vb2_ops fimc_qops = {
        .queue_setup     = fimc_queue_setup,
        .buf_prepare     = fimc_buf_prepare,
        .buf_queue       = fimc_buf_queue,
@@ -927,23 +937,23 @@ int fimc_vidioc_try_fmt_mplane(struct file *file, void *priv,
        pix->num_planes = fmt->memplanes;
        pix->colorspace = V4L2_COLORSPACE_JPEG;
-        for (i = 0; i < pix->num_planes; ++i) {
-                int bpl = pix->plane_fmt[i].bytesperline;
-                dbg("[%d] bpl: %d, depth: %d, w: %d, h: %d",
+        for (i = 0; i < pix->num_planes; ++i) {
-                    i, bpl, fmt->depth[i], pix->width, pix->height);
+                u32 bpl = pix->plane_fmt[i].bytesperline;
+                u32 *sizeimage = &pix->plane_fmt[i].sizeimage;
-                if (!bpl || (bpl * 8 / fmt->depth[i]) > pix->width)
+                if (fmt->colplanes > 1 && (bpl == 0 || bpl < pix->width))
-                        bpl = (pix->width * fmt->depth[0]) >> 3;
+                        bpl = pix->width; /* Planar */
-                if (!pix->plane_fmt[i].sizeimage)
+                if (fmt->colplanes == 1 && /* Packed */
-                        pix->plane_fmt[i].sizeimage = pix->height * bpl;
+                    (bpl == 0 || ((bpl * 8) / fmt->depth[i]) < pix->width))
+                        bpl = (pix->width * fmt->depth[0]) / 8;
-                pix->plane_fmt[i].bytesperline = bpl;
+                if (i == 0) /* Same bytesperline for each plane. */
+                        mod_x = bpl;
-                dbg("[%d]: bpl: %d, sizeimage: %d",
+                pix->plane_fmt[i].bytesperline = mod_x;
-                    i, pix->plane_fmt[i].bytesperline,
+                *sizeimage = (pix->width * pix->height * fmt->depth[i]) / 8;
-                    pix->plane_fmt[i].sizeimage);
        }
        return 0;
@@ -965,7 +975,7 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
        vq = v4l2_m2m_get_vq(ctx->m2m_ctx, f->type);
-        if (vb2_is_streaming(vq)) {
+        if (vb2_is_busy(vq)) {
                v4l2_err(&fimc->m2m.v4l2_dev, "queue (%d) busy\n", f->type);
                return -EBUSY;
        }
@@ -985,8 +995,10 @@ static int fimc_m2m_s_fmt_mplane(struct file *file, void *priv,
        if (!frame->fmt)
                return -EINVAL;
-        for (i = 0; i < frame->fmt->colplanes; i++)
+        for (i = 0; i < frame->fmt->colplanes; i++) {
-                frame->payload[i] = pix->plane_fmt[i].bytesperline * pix->height;
+                frame->payload[i] =
+                        (pix->width * pix->height * frame->fmt->depth[i]) / 8;
+        }
        frame->f_width  = pix->plane_fmt[0].bytesperline * 8 /
                frame->fmt->depth[0];
@@ -1750,7 +1762,7 @@ static int __devexit fimc_remove(struct platform_device *pdev)
 }
 /* Image pixel limits, similar across several FIMC HW revisions. */
-static struct fimc_pix_limit s5p_pix_limit[3] = {
+static struct fimc_pix_limit s5p_pix_limit[4] = {
        [0] = {
                .scaler_en_w    = 3264,
                .scaler_dis_w   = 8192,
@@ -1775,6 +1787,14 @@ static struct fimc_pix_limit s5p_pix_limit[3] = {
                .out_rot_en_w   = 1280,
                .out_rot_dis_w  = 1920,
        },
+        [3] = {
+                .scaler_en_w    = 1920,
+                .scaler_dis_w   = 8192,
+                .in_rot_en_h    = 1366,
+                .in_rot_dis_w   = 8192,
+                .out_rot_en_w   = 1366,
+                .out_rot_dis_w  = 1920,
+        },
 };
 static struct samsung_fimc_variant fimc0_variant_s5p = {
@@ -1827,7 +1847,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
        .pix_limit       = &s5p_pix_limit[2],
 };
-static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc0_variant_exynos4 = {
        .pix_hoff        = 1,
        .has_inp_rot     = 1,
        .has_out_rot     = 1,
@@ -1840,7 +1860,7 @@ static struct samsung_fimc_variant fimc0_variant_s5pv310 = {
        .pix_limit       = &s5p_pix_limit[1],
 };
-static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
+static struct samsung_fimc_variant fimc2_variant_exynos4 = {
        .pix_hoff        = 1,
        .has_cistatus2   = 1,
        .has_mainscaler_ext = 1,
@@ -1848,7 +1868,7 @@ static struct samsung_fimc_variant fimc2_variant_s5pv310 = {
        .min_out_pixsize = 16,
        .hor_offs_align  = 1,
        .out_buf_count   = 32,
-        .pix_limit       = &s5p_pix_limit[2],
+        .pix_limit       = &s5p_pix_limit[3],
 };
 /* S5PC100 */
@@ -1874,12 +1894,12 @@ static struct samsung_fimc_driverdata fimc_drvdata_s5pv210 = {
 };
 /* S5PV310, S5PC210 */
-static struct samsung_fimc_driverdata fimc_drvdata_s5pv310 = {
+static struct samsung_fimc_driverdata fimc_drvdata_exynos4 = {
        .variant = {
-                [0] = &fimc0_variant_s5pv310,
+                [0] = &fimc0_variant_exynos4,
-                [1] = &fimc0_variant_s5pv310,
+                [1] = &fimc0_variant_exynos4,
-                [2] = &fimc0_variant_s5pv310,
+                [2] = &fimc0_variant_exynos4,
-                [3] = &fimc2_variant_s5pv310,
+                [3] = &fimc2_variant_exynos4,
        },
        .num_entities = 4,
        .lclk_frequency = 166000000UL,
@@ -1893,8 +1913,8 @@ static struct platform_device_id fimc_driver_ids[] = {
                .name           = "s5pv210-fimc",
                .driver_data    = (unsigned long)&fimc_drvdata_s5pv210,
        }, {
-                .name           = "s5pv310-fimc",
+                .name           = "exynos4-fimc",
-                .driver_data    = (unsigned long)&fimc_drvdata_s5pv310,
+                .driver_data    = (unsigned long)&fimc_drvdata_exynos4,
        },
        {},
 };
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 3fe54bf41142..134e86bf6d97 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -922,7 +922,7 @@ static int sh_mobile_ceu_get_formats(struct soc_camera_device *icd, unsigned int
                        /* Try 2560x1920, 1280x960, 640x480, 320x240 */
                        mf.width        = 2560 >> shift;
                        mf.height       = 1920 >> shift;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                         s_mbus_fmt, &mf);
                        if (ret < 0)
                                return ret;
@@ -1224,7 +1224,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
        struct v4l2_cropcap cap;
        int ret;
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                         s_mbus_fmt, mf);
        if (ret < 0)
                return ret;
@@ -1254,7 +1254,7 @@ static int client_s_fmt(struct soc_camera_device *icd,
                tmp_h = min(2 * tmp_h, max_height);
                mf->width = tmp_w;
                mf->height = tmp_h;
-                ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                 s_mbus_fmt, mf);
                dev_geo(dev, "Camera scaled to %ux%u\n",
                        mf->width, mf->height);
@@ -1658,7 +1658,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
        mf.code         = xlate->code;
        mf.colorspace   = pix->colorspace;
-        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video, try_mbus_fmt, &mf);
+        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video, try_mbus_fmt, &mf);
        if (ret < 0)
                return ret;
@@ -1682,7 +1682,7 @@ static int sh_mobile_ceu_try_fmt(struct soc_camera_device *icd,
                         */
                        mf.width = 2560;
                        mf.height = 1920;
-                        ret = v4l2_device_call_until_err(sd->v4l2_dev, 0, video,
+                        ret = v4l2_device_call_until_err(sd->v4l2_dev, (long)icd, video,
                                                         try_mbus_fmt, &mf);
                        if (ret < 0) {
                                /* Shouldn't actually happen... */
diff --git a/drivers/media/video/sh_mobile_csi2.c b/drivers/media/video/sh_mobile_csi2.c
index dd1b81b1442b..98b87481fa94 100644
--- a/drivers/media/video/sh_mobile_csi2.c
+++ b/drivers/media/video/sh_mobile_csi2.c
@@ -38,6 +38,8 @@ struct sh_csi2 {
        void __iomem                    *base;
        struct platform_device          *pdev;
        struct sh_csi2_client_config    *client;
+        unsigned long (*query_bus_param)(struct soc_camera_device *);
+        int (*set_bus_param)(struct soc_camera_device *, unsigned long);
 };
 static int sh_csi2_try_fmt(struct v4l2_subdev *sd,
@@ -208,6 +210,7 @@ static int sh_csi2_notify(struct notifier_block *nb,
        case BUS_NOTIFY_BOUND_DRIVER:
                snprintf(priv->subdev.name, V4L2_SUBDEV_NAME_SIZE, "%s%s",
                         dev_name(v4l2_dev->dev), ".mipi-csi");
+                priv->subdev.grp_id = (long)icd;
                ret = v4l2_device_register_subdev(v4l2_dev, &priv->subdev);
                dev_dbg(dev, "%s(%p): ret(register_subdev) = %d\n", __func__, priv, ret);
                if (ret < 0)
@@ -215,6 +218,8 @@ static int sh_csi2_notify(struct notifier_block *nb,
                priv->client = pdata->clients + i;
+                priv->set_bus_param             = icd->ops->set_bus_param;
+                priv->query_bus_param           = icd->ops->query_bus_param;
                icd->ops->set_bus_param         = sh_csi2_set_bus_param;
                icd->ops->query_bus_param       = sh_csi2_query_bus_param;
@@ -226,8 +231,10 @@ static int sh_csi2_notify(struct notifier_block *nb,
                priv->client = NULL;
                /* Driver is about to be unbound */
-                icd->ops->set_bus_param         = NULL;
+                icd->ops->set_bus_param         = priv->set_bus_param;
-                icd->ops->query_bus_param       = NULL;
+                icd->ops->query_bus_param       = priv->query_bus_param;
+                priv->set_bus_param             = NULL;
+                priv->query_bus_param           = NULL;
                v4l2_device_unregister_subdev(&priv->subdev);
diff --git a/drivers/media/video/soc_camera.c b/drivers/media/video/soc_camera.c
index 46284489e4eb..3973f9a94753 100644
--- a/drivers/media/video/soc_camera.c
+++ b/drivers/media/video/soc_camera.c
@@ -996,10 +996,11 @@ static void soc_camera_free_i2c(struct soc_camera_device *icd)
 {
        struct i2c_client *client =
                to_i2c_client(to_soc_camera_control(icd));
+        struct i2c_adapter *adap = client->adapter;
        dev_set_drvdata(&icd->dev, NULL);
        v4l2_device_unregister_subdev(i2c_get_clientdata(client));
        i2c_unregister_device(client);
-        i2c_put_adapter(client->adapter);
+        i2c_put_adapter(adap);
 }
 #else
 #define soc_camera_init_i2c(icd, icl)   (-ENODEV)
@@ -1071,6 +1072,9 @@ static int soc_camera_probe(struct device *dev)
                }
        }
+        sd = soc_camera_to_subdev(icd);
+        sd->grp_id = (long)icd;
        /* At this point client .probe() should have run already */
        ret = soc_camera_init_user_formats(icd);
        if (ret < 0)
@@ -1092,7 +1096,6 @@ static int soc_camera_probe(struct device *dev)
                goto evidstart;
        /* Try to improve our guess of a reasonable window format */
-        sd = soc_camera_to_subdev(icd);
        if (!v4l2_subdev_call(sd, video, g_mbus_fmt, &mf)) {
                icd->user_width         = mf.width;
                icd->user_height        = mf.height;
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 498e6742579e..6dc7196296b3 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -389,7 +389,8 @@ static int v4l2_open(struct inode *inode, struct file *filp)
        video_get(vdev);
        mutex_unlock(&videodev_lock);
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                entity = media_entity_get(&vdev->entity);
                if (!entity) {
                        ret = -EBUSY;
@@ -415,7 +416,8 @@ err:
        /* decrease the refcount in case of an error */
        if (ret) {
 #if defined(CONFIG_MEDIA_CONTROLLER)
-                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+                if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+                    vdev->vfl_type != VFL_TYPE_SUBDEV)
                        media_entity_put(entity);
 #endif
                video_put(vdev);
@@ -437,7 +439,8 @@ static int v4l2_release(struct inode *inode, struct file *filp)
                        mutex_unlock(vdev->lock);
        }
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                media_entity_put(&vdev->entity);
 #endif
        /* decrease the refcount unconditionally since the release()
@@ -686,7 +689,8 @@ int __video_register_device(struct video_device *vdev, int type, int nr,
 #if defined(CONFIG_MEDIA_CONTROLLER)
        /* Part 5: Register the entity. */
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev) {
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV) {
                vdev->entity.type = MEDIA_ENT_T_DEVNODE_V4L;
                vdev->entity.name = vdev->name;
                vdev->entity.v4l.major = VIDEO_MAJOR;
@@ -733,7 +737,8 @@ void video_unregister_device(struct video_device *vdev)
                return;
 #if defined(CONFIG_MEDIA_CONTROLLER)
-        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev)
+        if (vdev->v4l2_dev && vdev->v4l2_dev->mdev &&
+            vdev->vfl_type != VFL_TYPE_SUBDEV)
                media_device_unregister_entity(&vdev->entity);
 #endif
diff --git a/drivers/media/video/videobuf2-core.c b/drivers/media/video/videobuf2-core.c
index 6698c77e0f64..6ba1461d51ef 100644
--- a/drivers/media/video/videobuf2-core.c
+++ b/drivers/media/video/videobuf2-core.c
@@ -37,6 +37,9 @@ module_param(debug, int, 0644);
 #define call_qop(q, op, args...)                                        \
        (((q)->ops->op) ? ((q)->ops->op(args)) : 0)
+#define V4L2_BUFFER_STATE_FLAGS (V4L2_BUF_FLAG_MAPPED | V4L2_BUF_FLAG_QUEUED | \
+                                 V4L2_BUF_FLAG_DONE | V4L2_BUF_FLAG_ERROR)
 /**
 * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
 */
@@ -51,7 +54,7 @@ static int __vb2_buf_mem_alloc(struct vb2_buffer *vb,
        for (plane = 0; plane < vb->num_planes; ++plane) {
                mem_priv = call_memop(q, plane, alloc, q->alloc_ctx[plane],
                                        plane_sizes[plane]);
-                if (!mem_priv)
+                if (IS_ERR_OR_NULL(mem_priv))
                        goto free;
                /* Associate allocator private data with this plane */
@@ -284,7 +287,7 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
        struct vb2_queue *q = vb->vb2_queue;
        int ret = 0;
-        /* Copy back data such as timestamp, input, etc. */
+        /* Copy back data such as timestamp, flags, input, etc. */
        memcpy(b, &vb->v4l2_buf, offsetof(struct v4l2_buffer, m));
        b->input = vb->v4l2_buf.input;
        b->reserved = vb->v4l2_buf.reserved;
@@ -313,7 +316,10 @@ static int __fill_v4l2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b)
                        b->m.userptr = vb->v4l2_planes[0].m.userptr;
        }
-        b->flags = 0;
+        /*
+         * Clear any buffer state related flags.
+         */
+        b->flags &= ~V4L2_BUFFER_STATE_FLAGS;
        switch (vb->state) {
        case VB2_BUF_STATE_QUEUED:
@@ -519,6 +525,7 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
        num_buffers = min_t(unsigned int, req->count, VIDEO_MAX_FRAME);
        memset(plane_sizes, 0, sizeof(plane_sizes));
        memset(q->alloc_ctx, 0, sizeof(q->alloc_ctx));
+        q->memory = req->memory;
        /*
         * Ask the driver how many buffers and planes per buffer it requires.
@@ -560,8 +567,6 @@ int vb2_reqbufs(struct vb2_queue *q, struct v4l2_requestbuffers *req)
                ret = num_buffers;
        }
-        q->memory = req->memory;
        /*
         * Return the number of successfully allocated buffers
         * to the userspace.
@@ -715,6 +720,8 @@ static int __fill_vb2_buffer(struct vb2_buffer *vb, struct v4l2_buffer *b,
        vb->v4l2_buf.field = b->field;
        vb->v4l2_buf.timestamp = b->timestamp;
+        vb->v4l2_buf.input = b->input;
+        vb->v4l2_buf.flags = b->flags & ~V4L2_BUFFER_STATE_FLAGS;
        return 0;
 }
diff --git a/drivers/media/video/videobuf2-dma-contig.c b/drivers/media/video/videobuf2-dma-contig.c
index 58205d596138..a790a5f8c06f 100644
--- a/drivers/media/video/videobuf2-dma-contig.c
+++ b/drivers/media/video/videobuf2-dma-contig.c
@@ -46,7 +46,7 @@ static void *vb2_dma_contig_alloc(void *alloc_ctx, unsigned long size)
                                        GFP_KERNEL);
        if (!buf->vaddr) {
                dev_err(conf->dev, "dma_alloc_coherent of size %ld failed\n",
-                        buf->size);
+                        size);
                kfree(buf);
                return ERR_PTR(-ENOMEM);
        }
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 96c0b34ba8db..657b9f4b6f9b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -400,7 +400,7 @@ static uint16_t __init doc200x_ident_chip(struct mtd_info *mtd, int nr)
        doc200x_hwcontrol(mtd, 0, NAND_CTRL_ALE | NAND_CTRL_CHANGE);
        doc200x_hwcontrol(mtd, NAND_CMD_NONE, NAND_NCE | NAND_CTRL_CHANGE);
-        /* We can't' use dev_ready here, but at least we wait for the
+        /* We can't use dev_ready here, but at least we wait for the
         * command to complete
         */
        udelay(50);
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index fe77e8223841..e8c19def1b0f 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -173,7 +173,7 @@ static int pcmcia_access_config(struct pcmcia_device *p_dev,
        c = p_dev->function_config;
        if (!(c->state & CONFIG_LOCKED)) {
-                dev_dbg(&p_dev->dev, "Configuration isn't't locked\n");
+                dev_dbg(&p_dev->dev, "Configuration isn't locked\n");
                mutex_unlock(&s->ops_mutex);
                return -EACCES;
        }
diff --git a/drivers/rtc/rtc-coh901331.c b/drivers/rtc/rtc-coh901331.c
index 316f484999b5..80f9c88214c5 100644
--- a/drivers/rtc/rtc-coh901331.c
+++ b/drivers/rtc/rtc-coh901331.c
@@ -220,6 +220,7 @@ static int __init coh901331_probe(struct platform_device *pdev)
        }
        clk_disable(rtap->clk);
+        platform_set_drvdata(pdev, rtap);
        rtap->rtc = rtc_device_register("coh901331", &pdev->dev, &coh901331_ops,
                                         THIS_MODULE);
        if (IS_ERR(rtap->rtc)) {
@@ -227,11 +228,10 @@ static int __init coh901331_probe(struct platform_device *pdev)
                goto out_no_rtc;
        }
-        platform_set_drvdata(pdev, rtap);
        return 0;
 out_no_rtc:
+        platform_set_drvdata(pdev, NULL);
 out_no_clk_enable:
        clk_put(rtap->clk);
 out_no_clk:
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 4d2df2f76ea0..475e603fc584 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2314,15 +2314,14 @@ static void dasd_flush_request_queue(struct dasd_block *block)
 static int dasd_open(struct block_device *bdev, fmode_t mode)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
        struct dasd_device *base;
        int rc;
-        if (!block)
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
                return -ENODEV;
-        base = block->base;
+        atomic_inc(&base->block->open_count);
-        atomic_inc(&block->open_count);
        if (test_bit(DASD_FLAG_OFFLINE, &base->flags)) {
                rc = -ENODEV;
                goto unlock;
@@ -2355,21 +2354,28 @@ static int dasd_open(struct block_device *bdev, fmode_t mode)
                goto out;
        }
+        dasd_put_device(base);
        return 0;
 out:
        module_put(base->discipline->owner);
 unlock:
-        atomic_dec(&block->open_count);
+        atomic_dec(&base->block->open_count);
+        dasd_put_device(base);
        return rc;
 }
 static int dasd_release(struct gendisk *disk, fmode_t mode)
 {
-        struct dasd_block *block = disk->private_data;
+        struct dasd_device *base;
-        atomic_dec(&block->open_count);
+        base = dasd_device_from_gendisk(disk);
-        module_put(block->base->discipline->owner);
+        if (!base)
+                return -ENODEV;
+        atomic_dec(&base->block->open_count);
+        module_put(base->discipline->owner);
+        dasd_put_device(base);
        return 0;
 }
@@ -2378,20 +2384,20 @@ static int dasd_release(struct gendisk *disk, fmode_t mode)
 */
 static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
 {
-        struct dasd_block *block;
        struct dasd_device *base;
-        block = bdev->bd_disk->private_data;
+        base = dasd_device_from_gendisk(bdev->bd_disk);
-        if (!block)
+        if (!base)
                return -ENODEV;
-        base = block->base;
        if (!base->discipline ||
-            !base->discipline->fill_geometry)
+            !base->discipline->fill_geometry) {
+                dasd_put_device(base);
                return -EINVAL;
+        }
-        base->discipline->fill_geometry(block, geo);
+        base->discipline->fill_geometry(base->block, geo);
-        geo->start = get_start_sect(bdev) >> block->s2b_shift;
+        geo->start = get_start_sect(bdev) >> base->block->s2b_shift;
+        dasd_put_device(base);
        return 0;
 }
@@ -2528,7 +2534,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
        dasd_set_target_state(device, DASD_STATE_NEW);
        /* dasd_delete_device destroys the device reference. */
        block = device->block;
-        device->block = NULL;
        dasd_delete_device(device);
        /*
         * life cycle of block is bound to device, so delete it after
@@ -2650,7 +2655,6 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
        dasd_set_target_state(device, DASD_STATE_NEW);
        /* dasd_delete_device destroys the device reference. */
        block = device->block;
-        device->block = NULL;
        dasd_delete_device(device);
        /*
         * life cycle of block is bound to device, so delete it after
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 42e1bf35f689..d71511c7850a 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -674,6 +674,36 @@ dasd_device_from_cdev(struct ccw_device *cdev)
        return device;
 }
+void dasd_add_link_to_gendisk(struct gendisk *gdp, struct dasd_device *device)
+{
+        struct dasd_devmap *devmap;
+        devmap = dasd_find_busid(dev_name(&device->cdev->dev));
+        if (IS_ERR(devmap))
+                return;
+        spin_lock(&dasd_devmap_lock);
+        gdp->private_data = devmap;
+        spin_unlock(&dasd_devmap_lock);
+}
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *gdp)
+{
+        struct dasd_device *device;
+        struct dasd_devmap *devmap;
+        if (!gdp->private_data)
+                return NULL;
+        device = NULL;
+        spin_lock(&dasd_devmap_lock);
+        devmap = gdp->private_data;
+        if (devmap && devmap->device) {
+                device = devmap->device;
+                dasd_get_device(device);
+        }
+        spin_unlock(&dasd_devmap_lock);
+        return device;
+}
 /*
 * SECTION: files in sysfs
 */
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index db8005d9f2fd..3ebdf5f92f8f 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -2037,7 +2037,7 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
                return;
        /* summary unit check */
-        if ((sense[7] == 0x0D) &&
+        if ((sense[27] & DASD_SENSE_BIT_0) && (sense[7] == 0x0D) &&
            (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK)) {
                dasd_alias_handle_summary_unit_check(device, irb);
                return;
@@ -2053,7 +2053,8 @@ static void dasd_eckd_check_for_device_change(struct dasd_device *device,
        /* loss of device reservation is handled via base devices only
         * as alias devices may be used with several bases
         */
-        if (device->block && (sense[7] == 0x3F) &&
+        if (device->block && (sense[27] & DASD_SENSE_BIT_0) &&
+            (sense[7] == 0x3F) &&
            (scsw_dstat(&irb->scsw) & DEV_STAT_UNIT_CHECK) &&
            test_bit(DASD_FLAG_IS_RESERVED, &device->flags)) {
                if (device->features & DASD_FEATURE_FAILONSLCK)
diff --git a/drivers/s390/block/dasd_genhd.c b/drivers/s390/block/dasd_genhd.c
index 5505bc07e1e7..19a1ff03d65e 100644
--- a/drivers/s390/block/dasd_genhd.c
+++ b/drivers/s390/block/dasd_genhd.c
@@ -73,7 +73,7 @@ int dasd_gendisk_alloc(struct dasd_block *block)
        if (base->features & DASD_FEATURE_READONLY ||
            test_bit(DASD_FLAG_DEVICE_RO, &base->flags))
                set_disk_ro(gdp, 1);
-        gdp->private_data = block;
+        dasd_add_link_to_gendisk(gdp, base);
        gdp->queue = block->request_queue;
        block->gdp = gdp;
        set_capacity(block->gdp, 0);
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index df9f6999411d..d1e4f2c1264c 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -686,6 +686,9 @@ struct dasd_device *dasd_device_from_cdev(struct ccw_device *);
 struct dasd_device *dasd_device_from_cdev_locked(struct ccw_device *);
 struct dasd_device *dasd_device_from_devindex(int);
+void dasd_add_link_to_gendisk(struct gendisk *, struct dasd_device *);
+struct dasd_device *dasd_device_from_gendisk(struct gendisk *);
 int dasd_parse(void);
 int dasd_busid_known(const char *);
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index 26075e95b1ba..72261e4c516d 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -42,16 +42,22 @@ dasd_ioctl_api_version(void __user *argp)
 static int
 dasd_ioctl_enable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
-        dasd_enable_device(block->base);
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        dasd_enable_device(base);
        /* Formatting the dasd device can change the capacity. */
        mutex_lock(&bdev->bd_mutex);
-        i_size_write(bdev->bd_inode, (loff_t)get_capacity(block->gdp) << 9);
+        i_size_write(bdev->bd_inode,
+                     (loff_t)get_capacity(base->block->gdp) << 9);
        mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
        return 0;
 }
@@ -62,11 +68,14 @@ dasd_ioctl_enable(struct block_device *bdev)
 static int
 dasd_ioctl_disable(struct block_device *bdev)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
        /*
         * Man this is sick. We don't do a real disable but only downgrade
         * the device to DASD_STATE_BASIC. The reason is that dasdfmt uses
@@ -75,7 +84,7 @@ dasd_ioctl_disable(struct block_device *bdev)
         * using the BIODASDFMT ioctl. Therefore the correct state for the
         * device is DASD_STATE_BASIC that allows to do basic i/o.
         */
-        dasd_set_target_state(block->base, DASD_STATE_BASIC);
+        dasd_set_target_state(base, DASD_STATE_BASIC);
        /*
         * Set i_size to zero, since read, write, etc. check against this
         * value.
@@ -83,6 +92,7 @@ dasd_ioctl_disable(struct block_device *bdev)
        mutex_lock(&bdev->bd_mutex);
        i_size_write(bdev->bd_inode, 0);
        mutex_unlock(&bdev->bd_mutex);
+        dasd_put_device(base);
        return 0;
 }
@@ -191,26 +201,36 @@ static int dasd_format(struct dasd_block *block, struct format_data_t *fdata)
 static int
 dasd_ioctl_format(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_device *base;
        struct format_data_t fdata;
+        int rc;
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
        if (!argp)
                return -EINVAL;
+        base = dasd_device_from_gendisk(bdev->bd_disk);
-        if (block->base->features & DASD_FEATURE_READONLY ||
+        if (!base)
-            test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+                return -ENODEV;
+        if (base->features & DASD_FEATURE_READONLY ||
+            test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                return -EROFS;
-        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t)))
+        }
+        if (copy_from_user(&fdata, argp, sizeof(struct format_data_t))) {
+                dasd_put_device(base);
                return -EFAULT;
+        }
        if (bdev != bdev->bd_contains) {
                pr_warning("%s: The specified DASD is a partition and cannot "
                           "be formatted\n",
-                           dev_name(&block->base->cdev->dev));
+                           dev_name(&base->cdev->dev));
+                dasd_put_device(base);
                return -EINVAL;
        }
-        return dasd_format(block, &fdata);
+        rc = dasd_format(base->block, &fdata);
+        dasd_put_device(base);
+        return rc;
 }
 #ifdef CONFIG_DASD_PROFILE
@@ -340,8 +360,8 @@ static int dasd_ioctl_information(struct dasd_block *block,
 static int
 dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
 {
-        struct dasd_block *block =  bdev->bd_disk->private_data;
+        struct dasd_device *base;
-        int intval;
+        int intval, rc;
        if (!capable(CAP_SYS_ADMIN))
                return -EACCES;
@@ -350,10 +370,17 @@ dasd_ioctl_set_ro(struct block_device *bdev, void __user *argp)
                return -EINVAL;
        if (get_user(intval, (int __user *)argp))
                return -EFAULT;
-        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &block->base->flags))
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        if (!intval && test_bit(DASD_FLAG_DEVICE_RO, &base->flags)) {
+                dasd_put_device(base);
                return -EROFS;
+        }
        set_disk_ro(bdev->bd_disk, intval);
-        return dasd_set_feature(block->base->cdev, DASD_FEATURE_READONLY, intval);
+        rc = dasd_set_feature(base->cdev, DASD_FEATURE_READONLY, intval);
+        dasd_put_device(base);
+        return rc;
 }
 static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
@@ -372,59 +399,78 @@ static int dasd_ioctl_readall_cmb(struct dasd_block *block, unsigned int cmd,
 int dasd_ioctl(struct block_device *bdev, fmode_t mode,
               unsigned int cmd, unsigned long arg)
 {
-        struct dasd_block *block = bdev->bd_disk->private_data;
+        struct dasd_block *block;
+        struct dasd_device *base;
        void __user *argp;
+        int rc;
        if (is_compat_task())
                argp = compat_ptr(arg);
        else
                argp = (void __user *)arg;
-        if (!block)
-                return -ENODEV;
        if ((_IOC_DIR(cmd) != _IOC_NONE) && !arg) {
                PRINT_DEBUG("empty data ptr");
                return -EINVAL;
        }
+        base = dasd_device_from_gendisk(bdev->bd_disk);
+        if (!base)
+                return -ENODEV;
+        block = base->block;
+        rc = 0;
        switch (cmd) {
        case BIODASDDISABLE:
-                return dasd_ioctl_disable(bdev);
+                rc = dasd_ioctl_disable(bdev);
+                break;
        case BIODASDENABLE:
-                return dasd_ioctl_enable(bdev);
+                rc = dasd_ioctl_enable(bdev);
+                break;
        case BIODASDQUIESCE:
-                return dasd_ioctl_quiesce(block);
+                rc = dasd_ioctl_quiesce(block);
+                break;
        case BIODASDRESUME:
-                return dasd_ioctl_resume(block);
+                rc = dasd_ioctl_resume(block);
+                break;
        case BIODASDFMT:
-                return dasd_ioctl_format(bdev, argp);
+                rc = dasd_ioctl_format(bdev, argp);
+                break;
        case BIODASDINFO:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
        case BIODASDINFO2:
-                return dasd_ioctl_information(block, cmd, argp);
+                rc = dasd_ioctl_information(block, cmd, argp);
+                break;
        case BIODASDPRRD:
-                return dasd_ioctl_read_profile(block, argp);
+                rc = dasd_ioctl_read_profile(block, argp);
+                break;
        case BIODASDPRRST:
-                return dasd_ioctl_reset_profile(block);
+                rc = dasd_ioctl_reset_profile(block);
+                break;
        case BLKROSET:
-                return dasd_ioctl_set_ro(bdev, argp);
+                rc = dasd_ioctl_set_ro(bdev, argp);
+                break;
        case DASDAPIVER:
-                return dasd_ioctl_api_version(argp);
+                rc = dasd_ioctl_api_version(argp);
+                break;
        case BIODASDCMFENABLE:
-                return enable_cmf(block->base->cdev);
+                rc = enable_cmf(base->cdev);
+                break;
        case BIODASDCMFDISABLE:
-                return disable_cmf(block->base->cdev);
+                rc = disable_cmf(base->cdev);
+                break;
        case BIODASDREADALLCMB:
-                return dasd_ioctl_readall_cmb(block, cmd, argp);
+                rc = dasd_ioctl_readall_cmb(block, cmd, argp);
+                break;
        default:
                /* if the discipline has an ioctl method try it. */
-                if (block->base->discipline->ioctl) {
+                if (base->discipline->ioctl) {
-                        int rval = block->base->discipline->ioctl(block, cmd, argp);
+                        rc = base->discipline->ioctl(block, cmd, argp);
-                        if (rval != -ENOIOCTLCMD)
+                        if (rc == -ENOIOCTLCMD)
-                                return rval;
+                                rc = -EINVAL;
-                }
+                } else
+                        rc = -EINVAL;
-                return -EINVAL;
        }
+        dasd_put_device(base);
+        return rc;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index c532ba929ccd..e8f267eb8887 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -407,8 +407,11 @@ static inline void account_sbals(struct qdio_q *q, int count)
        q->q_stats.nr_sbals[pos]++;
 }
-static void announce_buffer_error(struct qdio_q *q, int count)
+static void process_buffer_error(struct qdio_q *q, int count)
 {
+        unsigned char state = (q->is_input_q) ? SLSB_P_INPUT_NOT_INIT :
+                                        SLSB_P_OUTPUT_NOT_INIT;
        q->qdio_error |= QDIO_ERROR_SLSB_STATE;
        /* special handling for no target buffer empty */
@@ -426,6 +429,12 @@ static void announce_buffer_error(struct qdio_q *q, int count)
        DBF_ERROR("F14:%2x F15:%2x",
                  q->sbal[q->first_to_check]->element[14].flags & 0xff,
                  q->sbal[q->first_to_check]->element[15].flags & 0xff);
+        /*
+         * Interrupts may be avoided as long as the error is present
+         * so change the buffer state immediately to avoid starvation.
+         */
+        set_buf_states(q, q->first_to_check, state, count);
 }
 static inline void inbound_primed(struct qdio_q *q, int count)
@@ -506,8 +515,7 @@ static int get_inbound_buffer_frontier(struct qdio_q *q)
                        account_sbals(q, count);
                break;
        case SLSB_P_INPUT_ERROR:
-                announce_buffer_error(q, count);
+                process_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
                q->first_to_check = add_buf(q->first_to_check, count);
                atomic_sub(count, &q->nr_buf_used);
                if (q->irq_ptr->perf_stat_enabled)
@@ -677,8 +685,7 @@ static int get_outbound_buffer_frontier(struct qdio_q *q)
                        account_sbals(q, count);
                break;
        case SLSB_P_OUTPUT_ERROR:
-                announce_buffer_error(q, count);
+                process_buffer_error(q, count);
-                /* process the buffer, the upper layer will take care of it */
                q->first_to_check = add_buf(q->first_to_check, count);
                atomic_sub(count, &q->nr_buf_used);
                if (q->irq_ptr->perf_stat_enabled)
diff --git a/drivers/staging/rt2860/common/cmm_data_pci.c b/drivers/staging/rt2860/common/cmm_data_pci.c
index bef0bbd8cef7..f01a51c381f1 100644
--- a/drivers/staging/rt2860/common/cmm_data_pci.c
+++ b/drivers/staging/rt2860/common/cmm_data_pci.c
@@ -444,7 +444,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                        return (NDIS_STATUS_FAILURE);
                }
        }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
        /* I am kind of doubting the U2M bit operation */
        /* if (pRxD->U2M == 0) */
        /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/rt2860/common/cmm_data_usb.c b/drivers/staging/rt2860/common/cmm_data_usb.c
index 5637857ae9eb..83a62faa7e57 100644
--- a/drivers/staging/rt2860/common/cmm_data_usb.c
+++ b/drivers/staging/rt2860/common/cmm_data_usb.c
@@ -860,7 +860,7 @@ int RTMPCheckRxError(struct rt_rtmp_adapter *pAd,
                DBGPRINT_RAW(RT_DEBUG_ERROR, ("received packet too long\n"));
                return NDIS_STATUS_FAILURE;
        }
-        /* Drop not U2M frames, can't's drop here because we will drop beacon in this case */
+        /* Drop not U2M frames, can't drop here because we will drop beacon in this case */
        /* I am kind of doubting the U2M bit operation */
        /* if (pRxD->U2M == 0) */
        /*      return(NDIS_STATUS_FAILURE); */
diff --git a/drivers/staging/spectra/ffsport.c b/drivers/staging/spectra/ffsport.c
index 20dae73d3b78..506547b603e1 100644
--- a/drivers/staging/spectra/ffsport.c
+++ b/drivers/staging/spectra/ffsport.c
@@ -653,7 +653,7 @@ static int SBD_setup_device(struct spectra_nand_dev *dev, int which)
        }
        dev->queue->queuedata = dev;
-        /* As Linux block layer does't support >4KB hardware sector,  */
+        /* As Linux block layer doesn't support >4KB hardware sector,  */
        /* Here we force report 512 byte hardware sector size to Kernel */
        blk_queue_logical_block_size(dev->queue, 512);
diff --git a/drivers/staging/tidspbridge/dynload/cload.c b/drivers/staging/tidspbridge/dynload/cload.c
index 5cecd237e3f6..fe1ef0addb09 100644
--- a/drivers/staging/tidspbridge/dynload/cload.c
+++ b/drivers/staging/tidspbridge/dynload/cload.c
@@ -718,7 +718,7 @@ static void dload_symbols(struct dload_state *dlthis)
         * as a temporary for .dllview record construction.
         * Allocate storage for the whole table.  Add 1 to the section count
         * in case a trampoline section is auto-generated as well as the
-         * size of the trampoline section name so DLLView does't get lost.
+         * size of the trampoline section name so DLLView doesn't get lost.
         */
        siz = sym_count * sizeof(struct local_symbol);
diff --git a/drivers/staging/tty/specialix.c b/drivers/staging/tty/specialix.c
index cb24c6d999db..5c3598ec7456 100644
--- a/drivers/staging/tty/specialix.c
+++ b/drivers/staging/tty/specialix.c
@@ -978,7 +978,7 @@ static void sx_change_speed(struct specialix_board *bp,
        spin_lock_irqsave(&bp->lock, flags);
        sx_out(bp, CD186x_CAR, port_No(port));
-        /* The Specialix board does't implement the RTS lines.
+        /* The Specialix board doesn't implement the RTS lines.
           They are used to set the IRQ level. Don't touch them. */
        if (sx_crtscts(tty))
                port->MSVR = MSVR_DTR | (sx_in(bp, CD186x_MSVR) & MSVR_RTS);
diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c
index 35a0d12dad73..5fd020da7c55 100644
--- a/drivers/watchdog/iTCO_wdt.c
+++ b/drivers/watchdog/iTCO_wdt.c
@@ -35,6 +35,7 @@
 *      document number 324645-001, 324646-001: Cougar Point (CPT)
 *      document number TBD                   : Patsburg (PBG)
 *      document number TBD                   : DH89xxCC
+ *      document number TBD                   : Panther Point
 */
 /*
@@ -153,6 +154,38 @@ enum iTCO_chipsets {
        TCO_PBG1,       /* Patsburg */
        TCO_PBG2,       /* Patsburg */
        TCO_DH89XXCC,   /* DH89xxCC */
+        TCO_PPT0,       /* Panther Point */
+        TCO_PPT1,       /* Panther Point */
+        TCO_PPT2,       /* Panther Point */
+        TCO_PPT3,       /* Panther Point */
+        TCO_PPT4,       /* Panther Point */
+        TCO_PPT5,       /* Panther Point */
+        TCO_PPT6,       /* Panther Point */
+        TCO_PPT7,       /* Panther Point */
+        TCO_PPT8,       /* Panther Point */
+        TCO_PPT9,       /* Panther Point */
+        TCO_PPT10,      /* Panther Point */
+        TCO_PPT11,      /* Panther Point */
+        TCO_PPT12,      /* Panther Point */
+        TCO_PPT13,      /* Panther Point */
+        TCO_PPT14,      /* Panther Point */
+        TCO_PPT15,      /* Panther Point */
+        TCO_PPT16,      /* Panther Point */
+        TCO_PPT17,      /* Panther Point */
+        TCO_PPT18,      /* Panther Point */
+        TCO_PPT19,      /* Panther Point */
+        TCO_PPT20,      /* Panther Point */
+        TCO_PPT21,      /* Panther Point */
+        TCO_PPT22,      /* Panther Point */
+        TCO_PPT23,      /* Panther Point */
+        TCO_PPT24,      /* Panther Point */
+        TCO_PPT25,      /* Panther Point */
+        TCO_PPT26,      /* Panther Point */
+        TCO_PPT27,      /* Panther Point */
+        TCO_PPT28,      /* Panther Point */
+        TCO_PPT29,      /* Panther Point */
+        TCO_PPT30,      /* Panther Point */
+        TCO_PPT31,      /* Panther Point */
 };
 static struct {
@@ -244,6 +277,38 @@ static struct {
        {"Patsburg", 2},
        {"Patsburg", 2},
        {"DH89xxCC", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
+        {"Panther Point", 2},
        {NULL, 0}
 };
@@ -363,6 +428,38 @@ static DEFINE_PCI_DEVICE_TABLE(iTCO_wdt_pci_tbl) = {
        { ITCO_PCI_DEVICE(0x1d40,                               TCO_PBG1)},
        { ITCO_PCI_DEVICE(0x1d41,                               TCO_PBG2)},
        { ITCO_PCI_DEVICE(0x2310,                               TCO_DH89XXCC)},
+        { ITCO_PCI_DEVICE(0x1e40,                               TCO_PPT0)},
+        { ITCO_PCI_DEVICE(0x1e41,                               TCO_PPT1)},
+        { ITCO_PCI_DEVICE(0x1e42,                               TCO_PPT2)},
+        { ITCO_PCI_DEVICE(0x1e43,                               TCO_PPT3)},
+        { ITCO_PCI_DEVICE(0x1e44,                               TCO_PPT4)},
+        { ITCO_PCI_DEVICE(0x1e45,                               TCO_PPT5)},
+        { ITCO_PCI_DEVICE(0x1e46,                               TCO_PPT6)},
+        { ITCO_PCI_DEVICE(0x1e47,                               TCO_PPT7)},
+        { ITCO_PCI_DEVICE(0x1e48,                               TCO_PPT8)},
+        { ITCO_PCI_DEVICE(0x1e49,                               TCO_PPT9)},
+        { ITCO_PCI_DEVICE(0x1e4a,                               TCO_PPT10)},
+        { ITCO_PCI_DEVICE(0x1e4b,                               TCO_PPT11)},
+        { ITCO_PCI_DEVICE(0x1e4c,                               TCO_PPT12)},
+        { ITCO_PCI_DEVICE(0x1e4d,                               TCO_PPT13)},
+        { ITCO_PCI_DEVICE(0x1e4e,                               TCO_PPT14)},
+        { ITCO_PCI_DEVICE(0x1e4f,                               TCO_PPT15)},
+        { ITCO_PCI_DEVICE(0x1e50,                               TCO_PPT16)},
+        { ITCO_PCI_DEVICE(0x1e51,                               TCO_PPT17)},
+        { ITCO_PCI_DEVICE(0x1e52,                               TCO_PPT18)},
+        { ITCO_PCI_DEVICE(0x1e53,                               TCO_PPT19)},
+        { ITCO_PCI_DEVICE(0x1e54,                               TCO_PPT20)},
+        { ITCO_PCI_DEVICE(0x1e55,                               TCO_PPT21)},
+        { ITCO_PCI_DEVICE(0x1e56,                               TCO_PPT22)},
+        { ITCO_PCI_DEVICE(0x1e57,                               TCO_PPT23)},
+        { ITCO_PCI_DEVICE(0x1e58,                               TCO_PPT24)},
+        { ITCO_PCI_DEVICE(0x1e59,                               TCO_PPT25)},
+        { ITCO_PCI_DEVICE(0x1e5a,                               TCO_PPT26)},
+        { ITCO_PCI_DEVICE(0x1e5b,                               TCO_PPT27)},
+        { ITCO_PCI_DEVICE(0x1e5c,                               TCO_PPT28)},
+        { ITCO_PCI_DEVICE(0x1e5d,                               TCO_PPT29)},
+        { ITCO_PCI_DEVICE(0x1e5e,                               TCO_PPT30)},
+        { ITCO_PCI_DEVICE(0x1e5f,                               TCO_PPT31)},
        { 0, },                 /* End of list */
 };
 MODULE_DEVICE_TABLE(pci, iTCO_wdt_pci_tbl);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 2e61fe1b6b8c..8f4b81de3ae2 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -718,7 +718,7 @@ struct btrfs_space_info {
        u64 total_bytes;        /* total bytes in the space,
                                   this doesn't take mirrors into account */
        u64 bytes_used;         /* total bytes used,
-                                   this does't take mirrors into account */
+                                   this doesn't take mirrors into account */
        u64 bytes_pinned;       /* total bytes pinned, will be freed when the
                                   transaction finishes */
        u64 bytes_reserved;     /* total bytes the allocator has reserved for
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 68c84c8c24bd..228cf36ece83 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2824,6 +2824,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
        spin_lock(&delayed_refs->lock);
        if (delayed_refs->num_entries == 0) {
+                spin_unlock(&delayed_refs->lock);
                printk(KERN_INFO "delayed_refs has NO entry\n");
                return ret;
        }
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 31f33ba56fe8..cd52f7f556ef 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -8059,6 +8059,10 @@ static noinline int relocate_one_extent(struct btrfs_root *extent_root,
                                u64 group_start = group->key.objectid;
                                new_extents = kmalloc(sizeof(*new_extents),
                                                      GFP_NOFS);
+                                if (!new_extents) {
+                                        ret = -ENOMEM;
+                                        goto out;
+                                }
                                nr_extents = 1;
                                ret = get_new_locations(reloc_inode,
                                                        extent_key,
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 315138605088..ba41da59e31b 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2681,7 +2681,7 @@ int extent_readpages(struct extent_io_tree *tree,
                prefetchw(&page->flags);
                list_del(&page->lru);
                if (!add_to_page_cache_lru(page, mapping,
-                                        page->index, GFP_KERNEL)) {
+                                        page->index, GFP_NOFS)) {
                        __extent_read_full_page(tree, page, get_extent,
                                                &bio, 0, &bio_flags);
                }
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index 11d2e9cea09e..63731a1fb0a1 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -1768,10 +1768,13 @@ void btrfs_remove_free_space_cache(struct btrfs_block_group_cache *block_group)
        while ((node = rb_last(&block_group->free_space_offset)) != NULL) {
                info = rb_entry(node, struct btrfs_free_space, offset_index);
-                unlink_free_space(block_group, info);
+                if (!info->bitmap) {
-                if (info->bitmap)
+                        unlink_free_space(block_group, info);
-                        kfree(info->bitmap);
+                        kmem_cache_free(btrfs_free_space_cachep, info);
-                kmem_cache_free(btrfs_free_space_cachep, info);
+                } else {
+                        free_bitmap(block_group, info);
+                }
                if (need_resched()) {
                        spin_unlock(&block_group->tree_lock);
                        cond_resched();
@@ -2301,7 +2304,7 @@ int btrfs_trim_block_group(struct btrfs_block_group_cache *block_group,
                        start = entry->offset;
                        bytes = min(entry->bytes, end - start);
                        unlink_free_space(block_group, entry);
-                        kfree(entry);
+                        kmem_cache_free(btrfs_free_space_cachep, entry);
                }
                spin_unlock(&block_group->tree_lock);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index fcd66b6a8086..7cd8ab0ef04d 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -954,6 +954,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
                         1, 0, NULL, GFP_NOFS);
        while (start < end) {
                async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
+                BUG_ON(!async_cow);
                async_cow->inode = inode;
                async_cow->root = root;
                async_cow->locked_page = locked_page;
@@ -4731,9 +4732,10 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                dentry->d_name.len, dir->i_ino, objectid,
                                BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
+        if (IS_ERR(inode)) {
-        if (IS_ERR(inode))
+                err = PTR_ERR(inode);
                goto out_unlock;
+        }
        err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
        if (err) {
@@ -4792,9 +4794,10 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
        inode = btrfs_new_inode(trans, root, dir, dentry->d_name.name,
                                dentry->d_name.len, dir->i_ino, objectid,
                                BTRFS_I(dir)->block_group, mode, &index);
-        err = PTR_ERR(inode);
+        if (IS_ERR(inode)) {
-        if (IS_ERR(inode))
+                err = PTR_ERR(inode);
                goto out_unlock;
+        }
        err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
        if (err) {
@@ -4999,6 +5002,8 @@ static noinline int uncompress_inline(struct btrfs_path *path,
        inline_size = btrfs_file_extent_inline_item_len(leaf,
                                        btrfs_item_nr(leaf, path->slots[0]));
        tmp = kmalloc(inline_size, GFP_NOFS);
+        if (!tmp)
+                return -ENOMEM;
        ptr = btrfs_file_extent_inline_start(item);
        read_extent_buffer(leaf, tmp, ptr, inline_size);
@@ -6036,7 +6041,7 @@ static int btrfs_submit_direct_hook(int rw, struct btrfs_dio_private *dip,
        ret = btrfs_map_block(map_tree, READ, start_sector << 9,
                              &map_length, NULL, 0);
        if (ret) {
-                bio_put(bio);
+                bio_put(orig_bio);
                return -EIO;
        }
@@ -7273,9 +7278,10 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
                                dentry->d_name.len, dir->i_ino, objectid,
                                BTRFS_I(dir)->block_group, S_IFLNK|S_IRWXUGO,
                                &index);
-        err = PTR_ERR(inode);
+        if (IS_ERR(inode)) {
-        if (IS_ERR(inode))
+                err = PTR_ERR(inode);
                goto out_unlock;
+        }
        err = btrfs_init_inode_security(trans, inode, dir, &dentry->d_name);
        if (err) {
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index c50271ad3157..f997ec0c1ba4 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -2209,8 +2209,10 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
        log = root->log_root;
        path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out_unlock;
+        }
        di = btrfs_lookup_dir_item(trans, log, path, dir->i_ino,
                                   name, name_len, -1);
@@ -2271,6 +2273,7 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
        }
 fail:
        btrfs_free_path(path);
+out_unlock:
        mutex_unlock(&BTRFS_I(dir)->log_mutex);
        if (ret == -ENOSPC) {
                root->fs_info->last_trans_log_full_commit = trans->transid;
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 309a57b9fc85..c7367ae5a3e6 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -155,6 +155,15 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
        unsigned long limit;
        unsigned long last_waited = 0;
        int force_reg = 0;
+        struct blk_plug plug;
+        /*
+         * this function runs all the bios we've collected for
+         * a particular device.  We don't want to wander off to
+         * another device without first sending all of these down.
+         * So, setup a plug here and finish it off before we return
+         */
+        blk_start_plug(&plug);
        bdi = blk_get_backing_dev_info(device->bdev);
        fs_info = device->dev_root->fs_info;
@@ -294,6 +303,7 @@ loop_lock:
        spin_unlock(&device->io_lock);
 done:
+        blk_finish_plug(&plug);
        return 0;
 }
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index db9d55b507d0..4bc862a80efa 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -807,8 +807,7 @@ static int
 cifs_parse_mount_options(char *options, const char *devname,
                         struct smb_vol *vol)
 {
-        char *value;
+        char *value, *data, *end;
-        char *data;
        unsigned int  temp_len, i, j;
        char separator[2];
        short int override_uid = -1;
@@ -851,6 +850,7 @@ cifs_parse_mount_options(char *options, const char *devname,
        if (!options)
                return 1;
+        end = options + strlen(options);
        if (strncmp(options, "sep=", 4) == 0) {
                if (options[4] != 0) {
                        separator[0] = options[4];
@@ -916,6 +916,7 @@ cifs_parse_mount_options(char *options, const char *devname,
                        the only illegal character in a password is null */
                        if ((value[temp_len] == 0) &&
+                            (value + temp_len < end) &&
                            (value[temp_len+1] == separator[0])) {
                                /* reinsert comma */
                                value[temp_len] = separator[0];
diff --git a/fs/dcache.c b/fs/dcache.c
index d600a0af3b2e..22a0ef41bad1 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -109,16 +109,6 @@ static inline struct hlist_bl_head *d_hash(struct dentry *parent,
        return dentry_hashtable + (hash & D_HASHMASK);
 }
-static inline void spin_lock_bucket(struct hlist_bl_head *b)
-{
-        bit_spin_lock(0, (unsigned long *)&b->first);
-}
-static inline void spin_unlock_bucket(struct hlist_bl_head *b)
-{
-        __bit_spin_unlock(0, (unsigned long *)&b->first);
-}
 /* Statistics gathering. */
 struct dentry_stat_t dentry_stat = {
        .age_limit = 45,
@@ -334,10 +324,10 @@ void __d_drop(struct dentry *dentry)
                else
                        b = d_hash(dentry->d_parent, dentry->d_name.hash);
-                spin_lock_bucket(b);
+                hlist_bl_lock(b);
                __hlist_bl_del(&dentry->d_hash);
                dentry->d_hash.pprev = NULL;
-                spin_unlock_bucket(b);
+                hlist_bl_unlock(b);
                dentry_rcuwalk_barrier(dentry);
        }
@@ -1594,9 +1584,9 @@ struct dentry *d_obtain_alias(struct inode *inode)
        tmp->d_inode = inode;
        tmp->d_flags |= DCACHE_DISCONNECTED;
        list_add(&tmp->d_alias, &inode->i_dentry);
-        spin_lock_bucket(&tmp->d_sb->s_anon);
+        hlist_bl_lock(&tmp->d_sb->s_anon);
        hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
-        spin_unlock_bucket(&tmp->d_sb->s_anon);
+        hlist_bl_unlock(&tmp->d_sb->s_anon);
        spin_unlock(&tmp->d_lock);
        spin_unlock(&inode->i_lock);
        security_d_instantiate(tmp, inode);
@@ -2076,10 +2066,10 @@ EXPORT_SYMBOL(d_delete);
 static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
 {
        BUG_ON(!d_unhashed(entry));
-        spin_lock_bucket(b);
+        hlist_bl_lock(b);
        entry->d_flags |= DCACHE_RCUACCESS;
        hlist_bl_add_head_rcu(&entry->d_hash, b);
-        spin_unlock_bucket(b);
+        hlist_bl_unlock(b);
 }
 static void _d_rehash(struct dentry * entry)
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index d2a70a4561f9..b8d5c8091024 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1452,6 +1452,25 @@ static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
        crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
 }
+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode)
+{
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        struct ecryptfs_crypt_stat *crypt_stat;
+        u64 file_size;
+        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
+        mount_crypt_stat =
+                &ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
+        if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
+                file_size = i_size_read(ecryptfs_inode_to_lower(inode));
+                if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
+                        file_size += crypt_stat->metadata_size;
+        } else
+                file_size = get_unaligned_be64(page_virt);
+        i_size_write(inode, (loff_t)file_size);
+        crypt_stat->flags |= ECRYPTFS_I_SIZE_INITIALIZED;
+}
 /**
 * ecryptfs_read_headers_virt
 * @page_virt: The virtual address into which to read the headers
@@ -1482,6 +1501,8 @@ static int ecryptfs_read_headers_virt(char *page_virt,
                rc = -EINVAL;
                goto out;
        }
+        if (!(crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED))
+                ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
        offset += MAGIC_ECRYPTFS_MARKER_SIZE_BYTES;
        rc = ecryptfs_process_flags(crypt_stat, (page_virt + offset),
                                    &bytes_read);
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index bd3cafd0949d..e70282775e2c 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -269,6 +269,7 @@ struct ecryptfs_crypt_stat {
 #define ECRYPTFS_ENCFN_USE_MOUNT_FNEK 0x00000800
 #define ECRYPTFS_ENCFN_USE_FEK        0x00001000
 #define ECRYPTFS_UNLINK_SIGS          0x00002000
+#define ECRYPTFS_I_SIZE_INITIALIZED   0x00004000
        u32 flags;
        unsigned int file_version;
        size_t iv_bytes;
@@ -295,6 +296,8 @@ struct ecryptfs_crypt_stat {
 struct ecryptfs_inode_info {
        struct inode vfs_inode;
        struct inode *wii_inode;
+        struct mutex lower_file_mutex;
+        atomic_t lower_file_count;
        struct file *lower_file;
        struct ecryptfs_crypt_stat crypt_stat;
 };
@@ -626,6 +629,7 @@ struct ecryptfs_open_req {
 int ecryptfs_interpose(struct dentry *hidden_dentry,
                       struct dentry *this_dentry, struct super_block *sb,
                       u32 flags);
+void ecryptfs_i_size_init(const char *page_virt, struct inode *inode);
 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                                        struct dentry *lower_dentry,
                                        struct inode *ecryptfs_dir_inode);
@@ -757,7 +761,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
                             struct dentry *lower_dentry,
                             struct vfsmount *lower_mnt,
                             const struct cred *cred);
-int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry);
+int ecryptfs_get_lower_file(struct dentry *ecryptfs_dentry);
+void ecryptfs_put_lower_file(struct inode *inode);
 int
 ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes,
                             size_t *packet_size,
diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
index cedc913d11ba..566e5472f78c 100644
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -191,10 +191,10 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                      | ECRYPTFS_ENCRYPTED);
        }
        mutex_unlock(&crypt_stat->cs_mutex);
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
        if (rc) {
                printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                        "[%s]; rc = [%d]\n", __func__,
                        ecryptfs_dentry->d_name.name, rc);
                goto out_free;
@@ -202,9 +202,9 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
        if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
            == O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
                rc = -EPERM;
-                printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
+                printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
                       "file must hence be opened RO\n", __func__);
-                goto out_free;
+                goto out_put;
        }
        ecryptfs_set_file_lower(
                file, ecryptfs_inode_to_private(inode)->lower_file);
@@ -232,10 +232,11 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                                       "Plaintext passthrough mode is not "
                                       "enabled; returning -EIO\n");
                                mutex_unlock(&crypt_stat->cs_mutex);
-                                goto out_free;
+                                goto out_put;
                        }
                        rc = 0;
-                        crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
+                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
+                                               | ECRYPTFS_ENCRYPTED);
                        mutex_unlock(&crypt_stat->cs_mutex);
                        goto out;
                }
@@ -245,6 +246,8 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
                        "[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
                        (unsigned long long)i_size_read(inode));
        goto out;
+out_put:
+        ecryptfs_put_lower_file(inode);
 out_free:
        kmem_cache_free(ecryptfs_file_info_cache,
                        ecryptfs_file_to_private(file));
@@ -254,17 +257,13 @@ out:
 static int ecryptfs_flush(struct file *file, fl_owner_t td)
 {
-        int rc = 0;
+        return file->f_mode & FMODE_WRITE
-        struct file *lower_file = NULL;
+               ? filemap_write_and_wait(file->f_mapping) : 0;
-        lower_file = ecryptfs_file_to_lower(file);
-        if (lower_file->f_op && lower_file->f_op->flush)
-                rc = lower_file->f_op->flush(lower_file, td);
-        return rc;
 }
 static int ecryptfs_release(struct inode *inode, struct file *file)
 {
+        ecryptfs_put_lower_file(inode);
        kmem_cache_free(ecryptfs_file_info_cache,
                        ecryptfs_file_to_private(file));
        return 0;
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index f99051b7adab..4d4cc6a90cd5 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -168,19 +168,18 @@ static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
                                "context; rc = [%d]\n", rc);
                goto out;
        }
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
        if (rc) {
                printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                        "[%s]; rc = [%d]\n", __func__,
                        ecryptfs_dentry->d_name.name, rc);
                goto out;
        }
        rc = ecryptfs_write_metadata(ecryptfs_dentry);
-        if (rc) {
+        if (rc)
                printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
-                goto out;
+        ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
-        }
 out:
        return rc;
 }
@@ -226,11 +225,9 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
        struct dentry *lower_dir_dentry;
        struct vfsmount *lower_mnt;
        struct inode *lower_inode;
-        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
        struct ecryptfs_crypt_stat *crypt_stat;
        char *page_virt = NULL;
-        u64 file_size;
+        int put_lower = 0, rc = 0;
-        int rc = 0;
        lower_dir_dentry = lower_dentry->d_parent;
        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
@@ -277,14 +274,15 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                rc = -ENOMEM;
                goto out;
        }
-        rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
+        rc = ecryptfs_get_lower_file(ecryptfs_dentry);
        if (rc) {
                printk(KERN_ERR "%s: Error attempting to initialize "
-                        "the persistent file for the dentry with name "
+                        "the lower file for the dentry with name "
                        "[%s]; rc = [%d]\n", __func__,
                        ecryptfs_dentry->d_name.name, rc);
                goto out_free_kmem;
        }
+        put_lower = 1;
        crypt_stat = &ecryptfs_inode_to_private(
                                        ecryptfs_dentry->d_inode)->crypt_stat;
        /* TODO: lock for crypt_stat comparison */
@@ -302,18 +300,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                }
                crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
        }
-        mount_crypt_stat = &ecryptfs_superblock_to_private(
+        ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
-                ecryptfs_dentry->d_sb)->mount_crypt_stat;
-        if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
-                if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                        file_size = (crypt_stat->metadata_size
-                                     + i_size_read(lower_dentry->d_inode));
-                else
-                        file_size = i_size_read(lower_dentry->d_inode);
-        } else {
-                file_size = get_unaligned_be64(page_virt);
-        }
-        i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
 out_free_kmem:
        kmem_cache_free(ecryptfs_header_cache_2, page_virt);
        goto out;
@@ -322,6 +309,8 @@ out_put:
        mntput(lower_mnt);
        d_drop(ecryptfs_dentry);
 out:
+        if (put_lower)
+                ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
        return rc;
 }
@@ -538,8 +527,6 @@ static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
        dget(lower_dentry);
        rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
        dput(lower_dentry);
-        if (!rc)
-                d_delete(lower_dentry);
        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
        dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
        unlock_dir(lower_dir_dentry);
@@ -610,8 +597,8 @@ ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 out_lock:
        unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
-        dput(lower_new_dentry->d_parent);
+        dput(lower_new_dir_dentry);
-        dput(lower_old_dentry->d_parent);
+        dput(lower_old_dir_dentry);
        dput(lower_new_dentry);
        dput(lower_old_dentry);
        return rc;
@@ -759,8 +746,11 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
        if (unlikely((ia->ia_size == i_size))) {
                lower_ia->ia_valid &= ~ATTR_SIZE;
-                goto out;
+                return 0;
        }
+        rc = ecryptfs_get_lower_file(dentry);
+        if (rc)
+                return rc;
        crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
        /* Switch on growing or shrinking file */
        if (ia->ia_size > i_size) {
@@ -838,6 +828,7 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
                        lower_ia->ia_valid &= ~ATTR_SIZE;
        }
 out:
+        ecryptfs_put_lower_file(inode);
        return rc;
 }
@@ -913,7 +904,13 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                mount_crypt_stat = &ecryptfs_superblock_to_private(
                        dentry->d_sb)->mount_crypt_stat;
+                rc = ecryptfs_get_lower_file(dentry);
+                if (rc) {
+                        mutex_unlock(&crypt_stat->cs_mutex);
+                        goto out;
+                }
                rc = ecryptfs_read_metadata(dentry);
+                ecryptfs_put_lower_file(inode);
                if (rc) {
                        if (!(mount_crypt_stat->flags
                              & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
@@ -927,10 +924,17 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
                                goto out;
                        }
                        rc = 0;
-                        crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
+                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
+                                               | ECRYPTFS_ENCRYPTED);
                }
        }
        mutex_unlock(&crypt_stat->cs_mutex);
+        if (S_ISREG(inode->i_mode)) {
+                rc = filemap_write_and_wait(inode->i_mapping);
+                if (rc)
+                        goto out;
+                fsstack_copy_attr_all(inode, lower_inode);
+        }
        memcpy(&lower_ia, ia, sizeof(lower_ia));
        if (ia->ia_valid & ATTR_FILE)
                lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
diff --git a/fs/ecryptfs/kthread.c b/fs/ecryptfs/kthread.c
index 0851ab6980f5..69f994a7d524 100644
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -44,7 +44,7 @@ static struct task_struct *ecryptfs_kthread;
 * @ignored: ignored
 *
 * The eCryptfs kernel thread that has the responsibility of getting
- * the lower persistent file with RW permissions.
+ * the lower file with RW permissions.
 *
 * Returns zero on success; non-zero otherwise
 */
@@ -141,8 +141,8 @@ int ecryptfs_privileged_open(struct file **lower_file,
        int rc = 0;
        /* Corresponding dput() and mntput() are done when the
-         * persistent file is fput() when the eCryptfs inode is
+         * lower file is fput() when all eCryptfs files for the inode are
-         * destroyed. */
+         * released. */
        dget(lower_dentry);
        mntget(lower_mnt);
        flags |= IS_RDONLY(lower_dentry->d_inode) ? O_RDONLY : O_RDWR;
diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
index fdb2eb0ad09e..89b93389af8e 100644
--- a/fs/ecryptfs/main.c
+++ b/fs/ecryptfs/main.c
@@ -96,7 +96,7 @@ void __ecryptfs_printk(const char *fmt, ...)
 }
 /**
- * ecryptfs_init_persistent_file
+ * ecryptfs_init_lower_file
 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
 *                   the lower dentry and the lower mount set
 *
@@ -104,42 +104,70 @@ void __ecryptfs_printk(const char *fmt, ...)
 * inode. All I/O operations to the lower inode occur through that
 * file. When the first eCryptfs dentry that interposes with the first
 * lower dentry for that inode is created, this function creates the
- * persistent file struct and associates it with the eCryptfs
+ * lower file struct and associates it with the eCryptfs
- * inode. When the eCryptfs inode is destroyed, the file is closed.
+ * inode. When all eCryptfs files associated with the inode are released, the
+ * file is closed.
 *
- * The persistent file will be opened with read/write permissions, if
+ * The lower file will be opened with read/write permissions, if
 * possible. Otherwise, it is opened read-only.
 *
- * This function does nothing if a lower persistent file is already
+ * This function does nothing if a lower file is already
 * associated with the eCryptfs inode.
 *
 * Returns zero on success; non-zero otherwise
 */
-int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry)
+static int ecryptfs_init_lower_file(struct dentry *dentry,
+                                    struct file **lower_file)
 {
        const struct cred *cred = current_cred();
-        struct ecryptfs_inode_info *inode_info =
+        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-                ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
+        struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
-        int rc = 0;
+        int rc;
-        if (!inode_info->lower_file) {
+        rc = ecryptfs_privileged_open(lower_file, lower_dentry, lower_mnt,
-                struct dentry *lower_dentry;
+                                      cred);
-                struct vfsmount *lower_mnt =
+        if (rc) {
-                        ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
+                printk(KERN_ERR "Error opening lower file "
+                       "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
+                       "rc = [%d]\n", lower_dentry, lower_mnt, rc);
+                (*lower_file) = NULL;
+        }
+        return rc;
+}
-                lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
+int ecryptfs_get_lower_file(struct dentry *dentry)
-                rc = ecryptfs_privileged_open(&inode_info->lower_file,
+{
-                                              lower_dentry, lower_mnt, cred);
+        struct ecryptfs_inode_info *inode_info =
-                if (rc) {
+                ecryptfs_inode_to_private(dentry->d_inode);
-                        printk(KERN_ERR "Error opening lower persistent file "
+        int count, rc = 0;
-                               "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
-                               "rc = [%d]\n", lower_dentry, lower_mnt, rc);
+        mutex_lock(&inode_info->lower_file_mutex);
-                        inode_info->lower_file = NULL;
+        count = atomic_inc_return(&inode_info->lower_file_count);
-                }
+        if (WARN_ON_ONCE(count < 1))
+                rc = -EINVAL;
+        else if (count == 1) {
+                rc = ecryptfs_init_lower_file(dentry,
+                                              &inode_info->lower_file);
+                if (rc)
+                        atomic_set(&inode_info->lower_file_count, 0);
        }
+        mutex_unlock(&inode_info->lower_file_mutex);
        return rc;
 }
+void ecryptfs_put_lower_file(struct inode *inode)
+{
+        struct ecryptfs_inode_info *inode_info;
+        inode_info = ecryptfs_inode_to_private(inode);
+        if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
+                                      &inode_info->lower_file_mutex)) {
+                fput(inode_info->lower_file);
+                inode_info->lower_file = NULL;
+                mutex_unlock(&inode_info->lower_file_mutex);
+        }
+}
 static struct inode *ecryptfs_get_inode(struct inode *lower_inode,
                       struct super_block *sb)
 {
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index bacc882e1ae4..245b517bf1b6 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -55,6 +55,8 @@ static struct inode *ecryptfs_alloc_inode(struct super_block *sb)
        if (unlikely(!inode_info))
                goto out;
        ecryptfs_init_crypt_stat(&inode_info->crypt_stat);
+        mutex_init(&inode_info->lower_file_mutex);
+        atomic_set(&inode_info->lower_file_count, 0);
        inode_info->lower_file = NULL;
        inode = &inode_info->vfs_inode;
 out:
@@ -77,8 +79,7 @@ static void ecryptfs_i_callback(struct rcu_head *head)
 *
 * This is used during the final destruction of the inode.  All
 * allocation of memory related to the inode, including allocated
- * memory in the crypt_stat struct, will be released here. This
+ * memory in the crypt_stat struct, will be released here.
- * function also fput()'s the persistent file for the lower inode.
 * There should be no chance that this deallocation will be missed.
 */
 static void ecryptfs_destroy_inode(struct inode *inode)
@@ -86,16 +87,7 @@ static void ecryptfs_destroy_inode(struct inode *inode)
        struct ecryptfs_inode_info *inode_info;
        inode_info = ecryptfs_inode_to_private(inode);
-        if (inode_info->lower_file) {
+        BUG_ON(inode_info->lower_file);
-                struct dentry *lower_dentry =
-                        inode_info->lower_file->f_dentry;
-                BUG_ON(!lower_dentry);
-                if (lower_dentry->d_inode) {
-                        fput(inode_info->lower_file);
-                        inode_info->lower_file = NULL;
-                }
-        }
        ecryptfs_destroy_crypt_stat(&inode_info->crypt_stat);
        call_rcu(&inode->i_rcu, ecryptfs_i_callback);
 }
diff --git a/fs/file.c b/fs/file.c
index 0be344755c02..4c6992d8f3ba 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
+#include <linux/mmzone.h>
 #include <linux/time.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
@@ -39,14 +40,17 @@ int sysctl_nr_open_max = 1024 * 1024; /* raised later */
 */
 static DEFINE_PER_CPU(struct fdtable_defer, fdtable_defer_list);
-static inline void *alloc_fdmem(unsigned int size)
+static void *alloc_fdmem(unsigned int size)
 {
-        void *data;
+        /*
+         * Very large allocations can stress page reclaim, so fall back to
-        data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+         * vmalloc() if the allocation size will be considered "large" by the VM.
-        if (data != NULL)
+         */
-                return data;
+        if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
+                void *data = kmalloc(size, GFP_KERNEL|__GFP_NOWARN);
+                if (data != NULL)
+                        return data;
+        }
        return vmalloc(size);
 }
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index f07643e21bfa..7a4fb630a320 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -93,14 +93,12 @@ static unsigned int gl_hash(const struct gfs2_sbd *sdp,
 static inline void spin_lock_bucket(unsigned int hash)
 {
-        struct hlist_bl_head *bl = &gl_hash_table[hash];
+        hlist_bl_lock(&gl_hash_table[hash]);
-        bit_spin_lock(0, (unsigned long *)bl);
 }
 static inline void spin_unlock_bucket(unsigned int hash)
 {
-        struct hlist_bl_head *bl = &gl_hash_table[hash];
+        hlist_bl_unlock(&gl_hash_table[hash]);
-        __bit_spin_unlock(0, (unsigned long *)bl);
 }
 static void gfs2_glock_dealloc(struct rcu_head *rcu)
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 89fc160fd5b0..1f063bacd285 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -119,7 +119,7 @@ Elong:
 }
 #ifdef CONFIG_NFS_V4
-static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors, struct inode *inode)
+static rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
 {
        struct gss_api_mech *mech;
        struct xdr_netobj oid;
@@ -166,7 +166,7 @@ static int nfs_negotiate_security(const struct dentry *parent,
                }
                flavors = page_address(page);
                ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                *flavor = nfs_find_best_sec(flavors, dentry->d_inode);
+                *flavor = nfs_find_best_sec(flavors);
                put_page(page);
        }
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index e1c261ddd65d..c4a69833dd0d 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -47,6 +47,7 @@ enum nfs4_client_state {
        NFS4CLNT_LAYOUTRECALL,
        NFS4CLNT_SESSION_RESET,
        NFS4CLNT_RECALL_SLOT,
+        NFS4CLNT_LEASE_CONFIRM,
 };
 enum nfs4_session_state {
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 9bf41eab3e46..69c0f3c5ee7a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -46,6 +46,7 @@
 #include <linux/nfs4.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfs_page.h>
+#include <linux/nfs_mount.h>
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/module.h>
@@ -443,8 +444,8 @@ static int nfs41_sequence_done(struct rpc_task *task, struct nfs4_sequence_res *
        if (res->sr_status == 1)
                res->sr_status = NFS_OK;
-        /* -ERESTARTSYS can result in skipping nfs41_sequence_setup */
+        /* don't increment the sequence number if the task wasn't sent */
-        if (!res->sr_slot)
+        if (!RPC_WAS_SENT(task))
                goto out;
        /* Check the SEQUENCE operation status */
@@ -2185,9 +2186,14 @@ static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
        struct nfs4_exception exception = { };
        int err;
        do {
-                err = nfs4_handle_exception(server,
+                err = _nfs4_lookup_root(server, fhandle, info);
-                                _nfs4_lookup_root(server, fhandle, info),
+                switch (err) {
-                                &exception);
+                case 0:
+                case -NFS4ERR_WRONGSEC:
+                        break;
+                default:
+                        err = nfs4_handle_exception(server, err, &exception);
+                }
        } while (exception.retry);
        return err;
 }
@@ -2208,25 +2214,47 @@ out:
        return ret;
 }
-/*
+static int nfs4_find_root_sec(struct nfs_server *server, struct nfs_fh *fhandle,
- * get the file handle for the "/" directory on the server
- */
-static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
                              struct nfs_fsinfo *info)
 {
        int i, len, status = 0;
-        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS + 2];
+        rpc_authflavor_t flav_array[NFS_MAX_SECFLAVORS];
-        flav_array[0] = RPC_AUTH_UNIX;
+        len = gss_mech_list_pseudoflavors(&flav_array[0]);
-        len = gss_mech_list_pseudoflavors(&flav_array[1]);
+        flav_array[len] = RPC_AUTH_NULL;
-        flav_array[1+len] = RPC_AUTH_NULL;
+        len += 1;
-        len += 2;
        for (i = 0; i < len; i++) {
                status = nfs4_lookup_root_sec(server, fhandle, info, flav_array[i]);
-                if (status != -EPERM)
+                if (status == -NFS4ERR_WRONGSEC || status == -EACCES)
-                        break;
+                        continue;
+                break;
        }
+        /*
+         * -EACCESS could mean that the user doesn't have correct permissions
+         * to access the mount.  It could also mean that we tried to mount
+         * with a gss auth flavor, but rpc.gssd isn't running.  Either way,
+         * existing mount programs don't handle -EACCES very well so it should
+         * be mapped to -EPERM instead.
+         */
+        if (status == -EACCES)
+                status = -EPERM;
+        return status;
+}
+/*
+ * get the file handle for the "/" directory on the server
+ */
+static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
+                              struct nfs_fsinfo *info)
+{
+        int status = nfs4_lookup_root(server, fhandle, info);
+        if ((status == -NFS4ERR_WRONGSEC) && !(server->flags & NFS_MOUNT_SECFLAVOUR))
+                /*
+                 * A status of -NFS4ERR_WRONGSEC will be mapped to -EPERM
+                 * by nfs4_map_errors() as this function exits.
+                 */
+                status = nfs4_find_root_sec(server, fhandle, info);
        if (status == 0)
                status = nfs4_server_capabilities(server, fhandle);
        if (status == 0)
@@ -3723,21 +3751,20 @@ int nfs4_proc_setclientid(struct nfs_client *clp, u32 program,
                                sizeof(setclientid.sc_uaddr), "%s.%u.%u",
                                clp->cl_ipaddr, port >> 8, port & 255);
-                status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+                status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
                if (status != -NFS4ERR_CLID_INUSE)
                        break;
-                if (signalled())
+                if (loop != 0) {
+                        ++clp->cl_id_uniquifier;
                        break;
-                if (loop++ & 1)
+                }
-                        ssleep(clp->cl_lease_time / HZ + 1);
+                ++loop;
-                else
+                ssleep(clp->cl_lease_time / HZ + 1);
-                        if (++clp->cl_id_uniquifier == 0)
-                                break;
        }
        return status;
 }
-static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
+int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
                struct nfs4_setclientid_res *arg,
                struct rpc_cred *cred)
 {
@@ -3752,7 +3779,7 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
        int status;
        now = jiffies;
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
        if (status == 0) {
                spin_lock(&clp->cl_lock);
                clp->cl_lease_time = fsinfo.lease_time * HZ;
@@ -3762,26 +3789,6 @@ static int _nfs4_proc_setclientid_confirm(struct nfs_client *clp,
        return status;
 }
-int nfs4_proc_setclientid_confirm(struct nfs_client *clp,
-                struct nfs4_setclientid_res *arg,
-                struct rpc_cred *cred)
-{
-        long timeout = 0;
-        int err;
-        do {
-                err = _nfs4_proc_setclientid_confirm(clp, arg, cred);
-                switch (err) {
-                        case 0:
-                                return err;
-                        case -NFS4ERR_RESOURCE:
-                                /* The IBM lawyers misread another document! */
-                        case -NFS4ERR_DELAY:
-                                err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                }
-        } while (err == 0);
-        return err;
-}
 struct nfs4_delegreturndata {
        struct nfs4_delegreturnargs args;
        struct nfs4_delegreturnres res;
@@ -4786,7 +4793,7 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                init_utsname()->domainname,
                                clp->cl_rpcclient->cl_auth->au_flavor);
-        status = rpc_call_sync(clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
        if (!status)
                status = nfs4_check_cl_exchange_flags(clp->cl_exchange_flags);
        dprintk("<-- %s status= %d\n", __func__, status);
@@ -4869,7 +4876,8 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
                .rpc_client = clp->cl_rpcclient,
                .rpc_message = &msg,
                .callback_ops = &nfs4_get_lease_time_ops,
-                .callback_data = &data
+                .callback_data = &data,
+                .flags = RPC_TASK_TIMEOUT,
        };
        int status;
@@ -5171,7 +5179,7 @@ static int _nfs4_proc_create_session(struct nfs_client *clp)
        nfs4_init_channel_attrs(&args);
        args.flags = (SESSION4_PERSIST | SESSION4_BACK_CHAN);
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
        if (!status)
                /* Verify the session's negotiated channel_attrs values */
@@ -5194,20 +5202,10 @@ int nfs4_proc_create_session(struct nfs_client *clp)
        int status;
        unsigned *ptr;
        struct nfs4_session *session = clp->cl_session;
-        long timeout = 0;
-        int err;
        dprintk("--> %s clp=%p session=%p\n", __func__, clp, session);
-        do {
+        status = _nfs4_proc_create_session(clp);
-                status = _nfs4_proc_create_session(clp);
-                if (status == -NFS4ERR_DELAY) {
-                        err = nfs4_delay(clp->cl_rpcclient, &timeout);
-                        if (err)
-                                status = err;
-                }
-        } while (status == -NFS4ERR_DELAY);
        if (status)
                goto out;
@@ -5248,7 +5246,7 @@ int nfs4_proc_destroy_session(struct nfs4_session *session)
        msg.rpc_argp = session;
        msg.rpc_resp = NULL;
        msg.rpc_cred = NULL;
-        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, 0);
+        status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
        if (status)
                printk(KERN_WARNING
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a6804f704d9d..036f5adc9e1f 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -64,10 +64,15 @@ static LIST_HEAD(nfs4_clientid_list);
 int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
-        struct nfs4_setclientid_res clid;
+        struct nfs4_setclientid_res clid = {
+                .clientid = clp->cl_clientid,
+                .confirm = clp->cl_confirm,
+        };
        unsigned short port;
        int status;
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
        port = nfs_callback_tcpport;
        if (clp->cl_addr.ss_family == AF_INET6)
                port = nfs_callback_tcpport6;
@@ -75,10 +80,14 @@ int nfs4_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
        status = nfs4_proc_setclientid(clp, NFS4_CALLBACK, port, cred, &clid);
        if (status != 0)
                goto out;
+        clp->cl_clientid = clid.clientid;
+        clp->cl_confirm = clid.confirm;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
        status = nfs4_proc_setclientid_confirm(clp, &clid, cred);
        if (status != 0)
                goto out;
-        clp->cl_clientid = clid.clientid;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
        nfs4_schedule_state_renewal(clp);
 out:
        return status;
@@ -230,13 +239,18 @@ int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
        int status;
+        if (test_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state))
+                goto do_confirm;
        nfs4_begin_drain_session(clp);
        status = nfs4_proc_exchange_id(clp, cred);
        if (status != 0)
                goto out;
+        set_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+do_confirm:
        status = nfs4_proc_create_session(clp);
        if (status != 0)
                goto out;
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
        nfs41_setup_state_renewal(clp);
        nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
@@ -1584,20 +1598,23 @@ static int nfs4_recall_slot(struct nfs_client *clp) { return 0; }
 */
 static void nfs4_set_lease_expired(struct nfs_client *clp, int status)
 {
-        if (nfs4_has_session(clp)) {
+        switch (status) {
-                switch (status) {
+        case -NFS4ERR_CLID_INUSE:
-                case -NFS4ERR_DELAY:
+        case -NFS4ERR_STALE_CLIENTID:
-                case -NFS4ERR_CLID_INUSE:
+                clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
-                case -EAGAIN:
+                break;
-                        break;
+        case -NFS4ERR_DELAY:
+        case -ETIMEDOUT:
+        case -EAGAIN:
+                ssleep(1);
+                break;
-                case -EKEYEXPIRED:
+        case -EKEYEXPIRED:
-                        nfs4_warn_keyexpired(clp->cl_hostname);
+                nfs4_warn_keyexpired(clp->cl_hostname);
-                case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
+        case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
-                                         * in nfs4_exchange_id */
+                                 * in nfs4_exchange_id */
-                default:
+        default:
-                        return;
+                return;
-                }
        }
        set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state);
 }
@@ -1607,7 +1624,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
        int status = 0;
        /* Ensure exclusive access to NFSv4 state */
-        for(;;) {
+        do {
                if (test_and_clear_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state)) {
                        /* We're going to have to re-establish a clientid */
                        status = nfs4_reclaim_lease(clp);
@@ -1691,7 +1708,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
                        break;
                if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0)
                        break;
-        }
+        } while (atomic_read(&clp->cl_count) > 1);
        return;
 out_error:
        printk(KERN_WARNING "Error: state manager failed on NFSv4 server %s"
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index dddfb5795d7b..c3ccd2c46834 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1452,26 +1452,25 @@ static void encode_read(struct xdr_stream *xdr, const struct nfs_readargs *args,
 static void encode_readdir(struct xdr_stream *xdr, const struct nfs4_readdir_arg *readdir, struct rpc_rqst *req, struct compound_hdr *hdr)
 {
-        uint32_t attrs[2] = {0, 0};
+        uint32_t attrs[2] = {
+                FATTR4_WORD0_RDATTR_ERROR,
+                FATTR4_WORD1_MOUNTED_ON_FILEID,
+        };
        uint32_t dircount = readdir->count >> 1;
        __be32 *p;
        if (readdir->plus) {
                attrs[0] |= FATTR4_WORD0_TYPE|FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE|
-                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE;
+                        FATTR4_WORD0_FSID|FATTR4_WORD0_FILEHANDLE|FATTR4_WORD0_FILEID;
                attrs[1] |= FATTR4_WORD1_MODE|FATTR4_WORD1_NUMLINKS|FATTR4_WORD1_OWNER|
                        FATTR4_WORD1_OWNER_GROUP|FATTR4_WORD1_RAWDEV|
                        FATTR4_WORD1_SPACE_USED|FATTR4_WORD1_TIME_ACCESS|
                        FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY;
                dircount >>= 1;
        }
-        attrs[0] |= FATTR4_WORD0_RDATTR_ERROR|FATTR4_WORD0_FILEID;
+        /* Use mounted_on_fileid only if the server supports it */
-        attrs[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID;
+        if (!(readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID))
-        /* Switch to mounted_on_fileid if the server supports it */
+                attrs[0] |= FATTR4_WORD0_FILEID;
-        if (readdir->bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID)
-                attrs[0] &= ~FATTR4_WORD0_FILEID;
-        else
-                attrs[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
        p = reserve_space(xdr, 12+NFS4_VERIFIER_SIZE+20);
        *p++ = cpu_to_be32(OP_READDIR);
@@ -3140,7 +3139,7 @@ static int decode_attr_mounted_on_fileid(struct xdr_stream *xdr, uint32_t *bitma
                        goto out_overflow;
                xdr_decode_hyper(p, fileid);
                bitmap[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID;
-                ret = NFS_ATTR_FATTR_FILEID;
+                ret = NFS_ATTR_FATTR_MOUNTED_ON_FILEID;
        }
        dprintk("%s: fileid=%Lu\n", __func__, (unsigned long long)*fileid);
        return ret;
@@ -4002,7 +4001,6 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
 {
        int status;
        umode_t fmode = 0;
-        uint64_t fileid;
        uint32_t type;
        status = decode_attr_type(xdr, bitmap, &type);
@@ -4101,13 +4099,10 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
                goto xdr_error;
        fattr->valid |= status;
-        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fileid);
+        status = decode_attr_mounted_on_fileid(xdr, bitmap, &fattr->mounted_on_fileid);
        if (status < 0)
                goto xdr_error;
-        if (status != 0 && !(fattr->valid & status)) {
+        fattr->valid |= status;
-                fattr->fileid = fileid;
-                fattr->valid |= status;
-        }
 xdr_error:
        dprintk("%s: xdr returned %d\n", __func__, -status);
@@ -4838,17 +4833,21 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
        struct nfs4_secinfo_flavor *sec_flavor;
        int status;
        __be32 *p;
-        int i;
+        int i, num_flavors;
        status = decode_op_hdr(xdr, OP_SECINFO);
+        if (status)
+                goto out;
        p = xdr_inline_decode(xdr, 4);
        if (unlikely(!p))
                goto out_overflow;
-        res->flavors->num_flavors = be32_to_cpup(p);
-        for (i = 0; i < res->flavors->num_flavors; i++) {
+        res->flavors->num_flavors = 0;
+        num_flavors = be32_to_cpup(p);
+        for (i = 0; i < num_flavors; i++) {
                sec_flavor = &res->flavors->flavors[i];
-                if ((char *)&sec_flavor[1] - (char *)res > PAGE_SIZE)
+                if ((char *)&sec_flavor[1] - (char *)res->flavors > PAGE_SIZE)
                        break;
                p = xdr_inline_decode(xdr, 4);
@@ -4857,13 +4856,15 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
                sec_flavor->flavor = be32_to_cpup(p);
                if (sec_flavor->flavor == RPC_AUTH_GSS) {
-                        if (decode_secinfo_gss(xdr, sec_flavor))
+                        status = decode_secinfo_gss(xdr, sec_flavor);
-                                break;
+                        if (status)
+                                goto out;
                }
+                res->flavors->num_flavors++;
        }
-        return 0;
+out:
+        return status;
 out_overflow:
        print_overflow_msg(__func__, xdr);
        return -EIO;
@@ -6408,7 +6409,9 @@ int nfs4_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
        if (decode_getfattr_attrs(xdr, bitmap, entry->fattr, entry->fh,
                                        entry->server, 1) < 0)
                goto out_overflow;
-        if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
+        if (entry->fattr->valid & NFS_ATTR_FATTR_MOUNTED_ON_FILEID)
+                entry->ino = entry->fattr->mounted_on_fileid;
+        else if (entry->fattr->valid & NFS_ATTR_FATTR_FILEID)
                entry->ino = entry->fattr->fileid;
        entry->d_type = DT_UNKNOWN;
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index d9ab97269ce6..ff681ab65d31 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1004,6 +1004,7 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
 {
        struct nfs_inode *nfsi = NFS_I(wdata->inode);
        loff_t end_pos = wdata->args.offset + wdata->res.count;
+        bool mark_as_dirty = false;
        spin_lock(&nfsi->vfs_inode.i_lock);
        if (!test_and_set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags)) {
@@ -1011,13 +1012,18 @@ pnfs_set_layoutcommit(struct nfs_write_data *wdata)
                get_lseg(wdata->lseg);
                wdata->lseg->pls_lc_cred =
                        get_rpccred(wdata->args.context->state->owner->so_cred);
-                mark_inode_dirty_sync(wdata->inode);
+                mark_as_dirty = true;
                dprintk("%s: Set layoutcommit for inode %lu ",
                        __func__, wdata->inode->i_ino);
        }
        if (end_pos > wdata->lseg->pls_end_pos)
                wdata->lseg->pls_end_pos = end_pos;
        spin_unlock(&nfsi->vfs_inode.i_lock);
+        /* if pnfs_layoutcommit_inode() runs between inode locks, the next one
+         * will be a noop because NFS_INO_LAYOUTCOMMIT will not be set */
+        if (mark_as_dirty)
+                mark_inode_dirty_sync(wdata->inode);
 }
 EXPORT_SYMBOL_GPL(pnfs_set_layoutcommit);
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 2b8e9a5e366a..e288f06d3fa7 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1004,6 +1004,7 @@ static int nfs_parse_security_flavors(char *value,
                return 0;
        }
+        mnt->flags |= NFS_MOUNT_SECFLAVOUR;
        mnt->auth_flavor_len = 1;
        return 1;
 }
@@ -1976,6 +1977,15 @@ nfs_remount(struct super_block *sb, int *flags, char *raw_data)
        if (error < 0)
                goto out;
+        /*
+         * noac is a special case. It implies -o sync, but that's not
+         * necessarily reflected in the mtab options. do_remount_sb
+         * will clear MS_SYNCHRONOUS if -o sync wasn't specified in the
+         * remount options, so we have to explicitly reset it.
+         */
+        if (data->flags & NFS_MOUNT_NOAC)
+                *flags |= MS_SYNCHRONOUS;
        /* compare new mount options with old ones */
        error = nfs_compare_remount_data(nfss, data);
 out:
@@ -2235,8 +2245,7 @@ static struct dentry *nfs_fs_mount(struct file_system_type *fs_type,
        if (!s->s_root) {
                /* initial superblock/root creation */
                nfs_fill_super(s, data);
-                nfs_fscache_get_super_cookie(
+                nfs_fscache_get_super_cookie(s, data->fscache_uniq, NULL);
-                        s, data ? data->fscache_uniq : NULL, NULL);
        }
        mntroot = nfs_get_root(s, mntfh, dev_name);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e4cbc11a74ab..3bd5d7e80f6c 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -680,7 +680,6 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
        req = nfs_setup_write_request(ctx, page, offset, count);
        if (IS_ERR(req))
                return PTR_ERR(req);
-        nfs_mark_request_dirty(req);
        /* Update file length */
        nfs_grow_file(page, offset, count);
        nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
@@ -1418,8 +1417,7 @@ static void nfs_commit_done(struct rpc_task *task, void *calldata)
                                task->tk_pid, task->tk_status);
        /* Call the NFS version-specific code */
-        if (NFS_PROTO(data->inode)->commit_done(task, data) != 0)
+        NFS_PROTO(data->inode)->commit_done(task, data);
-                return;
 }
 void nfs_commit_release_pages(struct nfs_write_data *data)
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index b68f87a83924..938387a10d5d 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1019,7 +1019,7 @@ struct ocfs2_xattr_entry {
        __le16  xe_name_offset;  /* byte offset from the 1st entry in the
                                    local xattr storage(inode, xattr block or
                                    xattr bucket). */
-        __u8    xe_name_len;     /* xattr name len, does't include prefix. */
+        __u8    xe_name_len;     /* xattr name len, doesn't include prefix. */
        __u8    xe_type;         /* the low 7 bits indicate the name prefix
                                  * type and the highest bit indicates whether
                                  * the EA is stored in the local storage. */
diff --git a/include/drm/drm_fb_helper.h b/include/drm/drm_fb_helper.h
index f22e7fe4b6db..ade09d7b4271 100644
--- a/include/drm/drm_fb_helper.h
+++ b/include/drm/drm_fb_helper.h
@@ -118,6 +118,7 @@ int drm_fb_helper_setcolreg(unsigned regno,
                            unsigned transp,
                            struct fb_info *info);
+bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper);
 void drm_fb_helper_restore(void);
 void drm_fb_helper_fill_var(struct fb_info *info, struct drm_fb_helper *fb_helper,
                            uint32_t fb_width, uint32_t fb_height);
diff --git a/include/drm/radeon_drm.h b/include/drm/radeon_drm.h
index 3bce1a4fc305..7aa5dddb2098 100644
--- a/include/drm/radeon_drm.h
+++ b/include/drm/radeon_drm.h
@@ -909,6 +909,7 @@ struct drm_radeon_cs {
 #define RADEON_INFO_WANT_CMASK          0x08 /* get access to CMASK on r300 */
 #define RADEON_INFO_CLOCK_CRYSTAL_FREQ  0x09 /* clock crystal frequency */
 #define RADEON_INFO_NUM_BACKENDS        0x0a /* DB/backends for r600+ - need for OQ */
+#define RADEON_INFO_NUM_TILE_PIPES      0x0b /* tile pipes for r600+ */
 struct drm_radeon_info {
        uint32_t                request;
diff --git a/include/linux/bit_spinlock.h b/include/linux/bit_spinlock.h
index e612575a2596..b4326bfa684f 100644
--- a/include/linux/bit_spinlock.h
+++ b/include/linux/bit_spinlock.h
@@ -23,11 +23,11 @@ static inline void bit_spin_lock(int bitnum, unsigned long *addr)
        preempt_disable();
 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
        while (unlikely(test_and_set_bit_lock(bitnum, addr))) {
-                while (test_bit(bitnum, addr)) {
+                preempt_enable();
-                        preempt_enable();
+                do {
                        cpu_relax();
-                        preempt_disable();
+                } while (test_bit(bitnum, addr));
-                }
+                preempt_disable();
        }
 #endif
        __acquire(bitlock);
diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index df29c8fde36b..8847c8c29791 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -117,7 +117,7 @@ static inline void vma_adjust_trans_huge(struct vm_area_struct *vma,
                                         unsigned long end,
                                         long adjust_next)
 {
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
+        if (!vma->anon_vma || vma->vm_ops)
                return;
        __vma_adjust_trans_huge(vma, start, end, adjust_next);
 }
diff --git a/include/linux/list_bl.h b/include/linux/list_bl.h
index 5bad17d1acde..31f9d75adc5b 100644
--- a/include/linux/list_bl.h
+++ b/include/linux/list_bl.h
@@ -2,6 +2,7 @@
 #define _LINUX_LIST_BL_H
 #include <linux/list.h>
+#include <linux/bit_spinlock.h>
 /*
 * Special version of lists, where head of the list has a lock in the lowest
@@ -114,6 +115,16 @@ static inline void hlist_bl_del_init(struct hlist_bl_node *n)
        }
 }
+static inline void hlist_bl_lock(struct hlist_bl_head *b)
+{
+        bit_spin_lock(0, (unsigned long *)b);
+}
+static inline void hlist_bl_unlock(struct hlist_bl_head *b)
+{
+        __bit_spin_unlock(0, (unsigned long *)b);
+}
 /**
 * hlist_bl_for_each_entry      - iterate over list of given type
 * @tpos:       the type * to use as a loop cursor.
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 692dbae6ffa7..2348db26bc3d 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -137,7 +137,8 @@ extern unsigned int kobjsize(const void *objp);
 #define VM_RandomReadHint(v)            ((v)->vm_flags & VM_RAND_READ)
 /*
- * special vmas that are non-mergable, non-mlock()able
+ * Special vmas that are non-mergable, non-mlock()able.
+ * Note: mm/huge_memory.c VM_NO_THP depends on this definition.
 */
 #define VM_SPECIAL (VM_IO | VM_DONTEXPAND | VM_RESERVED | VM_PFNMAP)
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 216cea5db0aa..87694ca86914 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -47,6 +47,7 @@ struct nfs_client {
 #ifdef CONFIG_NFS_V4
        u64                     cl_clientid;    /* constant */
+        nfs4_verifier           cl_confirm;     /* Clientid verifier */
        unsigned long           cl_state;
        spinlock_t              cl_lock;
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index 78b101e487ea..890dce242639 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -50,6 +50,7 @@ struct nfs_fattr {
        } du;
        struct nfs_fsid         fsid;
        __u64                   fileid;
+        __u64                   mounted_on_fileid;
        struct timespec         atime;
        struct timespec         mtime;
        struct timespec         ctime;
@@ -83,6 +84,7 @@ struct nfs_fattr {
 #define NFS_ATTR_FATTR_PRECHANGE        (1U << 18)
 #define NFS_ATTR_FATTR_V4_REFERRAL      (1U << 19)      /* NFSv4 referral */
 #define NFS_ATTR_FATTR_MOUNTPOINT       (1U << 20)      /* Treat as mountpoint */
+#define NFS_ATTR_FATTR_MOUNTED_ON_FILEID                (1U << 21)
 #define NFS_ATTR_FATTR (NFS_ATTR_FATTR_TYPE \
                | NFS_ATTR_FATTR_MODE \
diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h
index d81db8012c63..f73c482ec9c6 100644
--- a/include/linux/sunrpc/sched.h
+++ b/include/linux/sunrpc/sched.h
@@ -127,13 +127,16 @@ struct rpc_task_setup {
 #define RPC_TASK_KILLED         0x0100          /* task was killed */
 #define RPC_TASK_SOFT           0x0200          /* Use soft timeouts */
 #define RPC_TASK_SOFTCONN       0x0400          /* Fail if can't connect */
+#define RPC_TASK_SENT           0x0800          /* message was sent */
+#define RPC_TASK_TIMEOUT        0x1000          /* fail with ETIMEDOUT on timeout */
 #define RPC_IS_ASYNC(t)         ((t)->tk_flags & RPC_TASK_ASYNC)
 #define RPC_IS_SWAPPER(t)       ((t)->tk_flags & RPC_TASK_SWAPPER)
 #define RPC_DO_ROOTOVERRIDE(t)  ((t)->tk_flags & RPC_TASK_ROOTCREDS)
 #define RPC_ASSASSINATED(t)     ((t)->tk_flags & RPC_TASK_KILLED)
-#define RPC_IS_SOFT(t)          ((t)->tk_flags & RPC_TASK_SOFT)
+#define RPC_IS_SOFT(t)          ((t)->tk_flags & (RPC_TASK_SOFT|RPC_TASK_TIMEOUT))
 #define RPC_IS_SOFTCONN(t)      ((t)->tk_flags & RPC_TASK_SOFTCONN)
+#define RPC_WAS_SENT(t)         ((t)->tk_flags & RPC_TASK_SENT)
 #define RPC_TASK_RUNNING        0
 #define RPC_TASK_QUEUED         1
diff --git a/include/linux/v4l2-mediabus.h b/include/linux/v4l2-mediabus.h
index 7054a7a8065e..de5c15921025 100644
--- a/include/linux/v4l2-mediabus.h
+++ b/include/linux/v4l2-mediabus.h
@@ -47,7 +47,7 @@ enum v4l2_mbus_pixelcode {
        V4L2_MBUS_FMT_RGB565_2X8_BE = 0x1007,
        V4L2_MBUS_FMT_RGB565_2X8_LE = 0x1008,
-        /* YUV (including grey) - next is 0x2013 */
+        /* YUV (including grey) - next is 0x2014 */
        V4L2_MBUS_FMT_Y8_1X8 = 0x2001,
        V4L2_MBUS_FMT_UYVY8_1_5X8 = 0x2002,
        V4L2_MBUS_FMT_VYUY8_1_5X8 = 0x2003,
@@ -60,6 +60,7 @@ enum v4l2_mbus_pixelcode {
        V4L2_MBUS_FMT_Y10_1X10 = 0x200a,
        V4L2_MBUS_FMT_YUYV10_2X10 = 0x200b,
        V4L2_MBUS_FMT_YVYU10_2X10 = 0x200c,
+        V4L2_MBUS_FMT_Y12_1X12 = 0x2013,
        V4L2_MBUS_FMT_UYVY8_1X16 = 0x200f,
        V4L2_MBUS_FMT_VYUY8_1X16 = 0x2010,
        V4L2_MBUS_FMT_YUYV8_1X16 = 0x2011,
@@ -67,9 +68,11 @@ enum v4l2_mbus_pixelcode {
        V4L2_MBUS_FMT_YUYV10_1X20 = 0x200d,
        V4L2_MBUS_FMT_YVYU10_1X20 = 0x200e,
-        /* Bayer - next is 0x3013 */
+        /* Bayer - next is 0x3015 */
        V4L2_MBUS_FMT_SBGGR8_1X8 = 0x3001,
+        V4L2_MBUS_FMT_SGBRG8_1X8 = 0x3013,
        V4L2_MBUS_FMT_SGRBG8_1X8 = 0x3002,
+        V4L2_MBUS_FMT_SRGGB8_1X8 = 0x3014,
        V4L2_MBUS_FMT_SBGGR10_DPCM8_1X8 = 0x300b,
        V4L2_MBUS_FMT_SGBRG10_DPCM8_1X8 = 0x300c,
        V4L2_MBUS_FMT_SGRBG10_DPCM8_1X8 = 0x3009,
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index aa6c393b7ae9..be82c8ead1af 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -308,6 +308,7 @@ struct v4l2_pix_format {
 #define V4L2_PIX_FMT_Y4      v4l2_fourcc('Y', '0', '4', ' ') /*  4  Greyscale     */
 #define V4L2_PIX_FMT_Y6      v4l2_fourcc('Y', '0', '6', ' ') /*  6  Greyscale     */
 #define V4L2_PIX_FMT_Y10     v4l2_fourcc('Y', '1', '0', ' ') /* 10  Greyscale     */
+#define V4L2_PIX_FMT_Y12     v4l2_fourcc('Y', '1', '2', ' ') /* 12  Greyscale     */
 #define V4L2_PIX_FMT_Y16     v4l2_fourcc('Y', '1', '6', ' ') /* 16  Greyscale     */
 /* Palette formats */
diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
index bd102cf509ac..d61febfb1668 100644
--- a/include/media/v4l2-device.h
+++ b/include/media/v4l2-device.h
@@ -163,7 +163,7 @@ v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev);
 ({                                                                      \
        struct v4l2_subdev *__sd;                                       \
        __v4l2_device_call_subdevs_until_err_p(v4l2_dev, __sd, cond, o, \
-                                                f, args...);            \
+                                                f , ##args);            \
 })
 /* Call the specified callback for all subdevs matching grp_id (if 0, then
diff --git a/init/Kconfig b/init/Kconfig
index 56240e724d9a..d886b1e9278e 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -924,14 +924,6 @@ menuconfig EXPERT
          environments which can tolerate a "non-standard" kernel.
          Only use this if you really know what you are doing.
-config EMBEDDED
-        bool "Embedded system"
-        select EXPERT
-        help
-          This option should be enabled if compiling the kernel for
-          an embedded system so certain expert options are available
-          for configuration.
 config UID16
        bool "Enable 16-bit UID system calls" if EXPERT
        depends on ARM || BLACKFIN || CRIS || FRV || H8300 || X86_32 || M68K || (S390 && !64BIT) || SUPERH || SPARC32 || (SPARC64 && COMPAT) || UML || (X86_64 && IA32_EMULATION)
@@ -1104,6 +1096,14 @@ config AIO
          by some high performance threaded applications. Disabling
          this option saves about 7k.
+config EMBEDDED
+        bool "Embedded system"
+        select EXPERT
+        help
+          This option should be enabled if compiling the kernel for
+          an embedded system so certain expert options are available
+          for configuration.
 config HAVE_PERF_EVENTS
        bool
        help
@@ -1226,6 +1226,7 @@ config SLAB
          per cpu and per node queues.
 config SLUB
+        depends on BROKEN || NUMA || !DISCONTIGMEM
        bool "SLUB (Unqueued Allocator)"
        help
           SLUB is a slab allocator that minimizes cache line usage
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index 140dce750450..14733d4d156b 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -430,9 +430,12 @@ static int watchdog_enable(int cpu)
                p = kthread_create(watchdog, (void *)(unsigned long)cpu, "watchdog/%d", cpu);
                if (IS_ERR(p)) {
                        printk(KERN_ERR "softlockup watchdog for %i failed\n", cpu);
-                        if (!err)
+                        if (!err) {
                                /* if hardlockup hasn't already set this */
                                err = PTR_ERR(p);
+                                /* and disable the perf event */
+                                watchdog_nmi_disable(cpu);
+                        }
                        goto out;
                }
                kthread_bind(p, cpu);
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 470dcda10add..83326ad66d9b 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1408,6 +1408,9 @@ out:
        return ret;
 }
+#define VM_NO_THP (VM_SPECIAL|VM_INSERTPAGE|VM_MIXEDMAP|VM_SAO| \
+                   VM_HUGETLB|VM_SHARED|VM_MAYSHARE)
 int hugepage_madvise(struct vm_area_struct *vma,
                     unsigned long *vm_flags, int advice)
 {
@@ -1416,11 +1419,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                /*
                 * Be somewhat over-protective like KSM for now!
                 */
-                if (*vm_flags & (VM_HUGEPAGE |
+                if (*vm_flags & (VM_HUGEPAGE | VM_NO_THP))
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
                        return -EINVAL;
                *vm_flags &= ~VM_NOHUGEPAGE;
                *vm_flags |= VM_HUGEPAGE;
@@ -1436,11 +1435,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
                /*
                 * Be somewhat over-protective like KSM for now!
                 */
-                if (*vm_flags & (VM_NOHUGEPAGE |
+                if (*vm_flags & (VM_NOHUGEPAGE | VM_NO_THP))
-                                 VM_SHARED   | VM_MAYSHARE   |
-                                 VM_PFNMAP   | VM_IO      | VM_DONTEXPAND |
-                                 VM_RESERVED | VM_HUGETLB | VM_INSERTPAGE |
-                                 VM_MIXEDMAP | VM_SAO))
                        return -EINVAL;
                *vm_flags &= ~VM_HUGEPAGE;
                *vm_flags |= VM_NOHUGEPAGE;
@@ -1574,10 +1569,14 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
                 * page fault if needed.
                 */
                return 0;
-        if (vma->vm_file || vma->vm_ops)
+        if (vma->vm_ops)
                /* khugepaged not yet working on file or special mappings */
                return 0;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
        hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
        hend = vma->vm_end & HPAGE_PMD_MASK;
        if (hstart < hend)
@@ -1828,12 +1827,15 @@ static void collapse_huge_page(struct mm_struct *mm,
            (vma->vm_flags & VM_NOHUGEPAGE))
                goto out;
-        /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+        if (!vma->anon_vma || vma->vm_ops)
-        if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
                goto out;
        if (is_vma_temporary_stack(vma))
                goto out;
-        VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+        /*
+         * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+         * true too, verify it here.
+         */
+        VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
        pgd = pgd_offset(mm, address);
        if (!pgd_present(*pgd))
@@ -2066,13 +2068,16 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages,
                        progress++;
                        continue;
                }
-                /* VM_PFNMAP vmas may have vm_ops null but vm_file set */
+                if (!vma->anon_vma || vma->vm_ops)
-                if (!vma->anon_vma || vma->vm_ops || vma->vm_file)
                        goto skip;
                if (is_vma_temporary_stack(vma))
                        goto skip;
+                /*
-                VM_BUG_ON(is_linear_pfn_mapping(vma) || is_pfn_mapping(vma));
+                 * If is_pfn_mapping() is true is_learn_pfn_mapping()
+                 * must be true too, verify it here.
+                 */
+                VM_BUG_ON(is_linear_pfn_mapping(vma) ||
+                          vma->vm_flags & VM_NO_THP);
                hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
                hend = vma->vm_end & HPAGE_PMD_MASK;
diff --git a/mm/memory.c b/mm/memory.c
index ce22a250926f..607098d47e74 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3396,7 +3396,7 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
         * run pte_offset_map on the pmd, if an huge pmd could
         * materialize from under us from a different thread.
         */
-        if (unlikely(__pte_alloc(mm, vma, pmd, address)))
+        if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
                return VM_FAULT_OOM;
        /* if an huge pmd materialized from under us just retry later */
        if (unlikely(pmd_trans_huge(*pmd)))
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index 83fb72c108b7..f52e85c80e8d 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -172,10 +172,13 @@ unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *mem,
        /*
         * The baseline for the badness score is the proportion of RAM that each
-         * task's rss and swap space use.
+         * task's rss, pagetable and swap space use.
         */
-        points = (get_mm_rss(p->mm) + get_mm_counter(p->mm, MM_SWAPENTS)) * 1000 /
+        points = get_mm_rss(p->mm) + p->mm->nr_ptes;
-                        totalpages;
+        points += get_mm_counter(p->mm, MM_SWAPENTS);
+        points *= 1000;
+        points /= totalpages;
        task_unlock(p);
        /*
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index fce9bd3bd3fe..5c04f3e42704 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -667,7 +667,7 @@ MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
 MODULE_DESCRIPTION("L2TP over IP");
 MODULE_VERSION("1.0");
-/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
+/* Use the value of SOCK_DGRAM (2) directory, because __stringify doesn't like
 * enums
 */
 MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index dff27d5e22fd..61b1f5ada96a 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -554,7 +554,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_send_failed(
        memcpy(&ssf->ssf_info, &chunk->sinfo, sizeof(struct sctp_sndrcvinfo));
        /* Per TSVWG discussion with Randy. Allow the application to
-         * resemble a fragmented message.
+         * reassemble a fragmented message.
         */
        ssf->ssf_info.sinfo_flags = chunk->chunk_hdr->flags;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index 8873fd8ddacd..b2198e65d8bb 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -18,14 +18,13 @@ config SUNRPC_XPRT_RDMA
          If unsure, say N.
 config RPCSEC_GSS_KRB5
-        tristate
+        tristate "Secure RPC: Kerberos V mechanism"
        depends on SUNRPC && CRYPTO
-        prompt "Secure RPC: Kerberos V mechanism" if !(NFS_V4 || NFSD_V4)
+        depends on CRYPTO_MD5 && CRYPTO_DES && CRYPTO_CBC && CRYPTO_CTS
+        depends on CRYPTO_ECB && CRYPTO_HMAC && CRYPTO_SHA1 && CRYPTO_AES
+        depends on CRYPTO_ARC4
        default y
        select SUNRPC_GSS
-        select CRYPTO_MD5
-        select CRYPTO_DES
-        select CRYPTO_CBC
        help
          Choose Y here to enable Secure RPC using the Kerberos version 5
          GSS-API mechanism (RFC 1964).
diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index f3914d0c5079..339ba64cce1e 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -520,7 +520,7 @@ gss_refresh_upcall(struct rpc_task *task)
                warn_gssd();
                task->tk_timeout = 15*HZ;
                rpc_sleep_on(&pipe_version_rpc_waitqueue, task, NULL);
-                return 0;
+                return -EAGAIN;
        }
        if (IS_ERR(gss_msg)) {
                err = PTR_ERR(gss_msg);
@@ -563,10 +563,12 @@ retry:
        if (PTR_ERR(gss_msg) == -EAGAIN) {
                err = wait_event_interruptible_timeout(pipe_version_waitqueue,
                                pipe_version >= 0, 15*HZ);
+                if (pipe_version < 0) {
+                        warn_gssd();
+                        err = -EACCES;
+                }
                if (err)
                        goto out;
-                if (pipe_version < 0)
-                        warn_gssd();
                goto retry;
        }
        if (IS_ERR(gss_msg)) {
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index e7a96e478f63..8d83f9d48713 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1508,7 +1508,10 @@ call_timeout(struct rpc_task *task)
                if (clnt->cl_chatty)
                        printk(KERN_NOTICE "%s: server %s not responding, timed out\n",
                                clnt->cl_protname, clnt->cl_server);
-                rpc_exit(task, -EIO);
+                if (task->tk_flags & RPC_TASK_TIMEOUT)
+                        rpc_exit(task, -ETIMEDOUT);
+                else
+                        rpc_exit(task, -EIO);
                return;
        }
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 9494c3767356..ce5eb68a9664 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -906,6 +906,7 @@ void xprt_transmit(struct rpc_task *task)
        }
        dprintk("RPC: %5u xmit complete\n", task->tk_pid);
+        task->tk_flags |= RPC_TASK_SENT;
        spin_lock_bh(&xprt->transport_lock);
        xprt->ops->set_retrans_timeout(task);
diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index 9da6420e2056..1d027e29ce8d 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -471,6 +471,7 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
 * @avd: access vector decisions
 * @result: result from avc_has_perm_noaudit
 * @a:  auxiliary audit data
+ * @flags: VFS walk flags
 *
 * Audit the granting or denial of permissions in accordance
 * with the policy.  This function is typically called by
@@ -481,9 +482,10 @@ static void avc_audit_post_callback(struct audit_buffer *ab, void *a)
 * be performed under a lock, to allow the lock to be released
 * before calling the auditing code.
 */
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
               u16 tclass, u32 requested,
-               struct av_decision *avd, int result, struct common_audit_data *a)
+               struct av_decision *avd, int result, struct common_audit_data *a,
+               unsigned flags)
 {
        struct common_audit_data stack_data;
        u32 denied, audited;
@@ -515,11 +517,24 @@ void avc_audit(u32 ssid, u32 tsid,
        else
                audited = requested & avd->auditallow;
        if (!audited)
-                return;
+                return 0;
        if (!a) {
                a = &stack_data;
                COMMON_AUDIT_DATA_INIT(a, NONE);
        }
+        /*
+         * When in a RCU walk do the audit on the RCU retry.  This is because
+         * the collection of the dname in an inode audit message is not RCU
+         * safe.  Note this may drop some audits when the situation changes
+         * during retry. However this is logically just as if the operation
+         * happened a little later.
+         */
+        if ((a->type == LSM_AUDIT_DATA_FS) &&
+            (flags & IPERM_FLAG_RCU))
+                return -ECHILD;
        a->selinux_audit_data.tclass = tclass;
        a->selinux_audit_data.requested = requested;
        a->selinux_audit_data.ssid = ssid;
@@ -529,6 +544,7 @@ void avc_audit(u32 ssid, u32 tsid,
        a->lsm_pre_audit = avc_audit_pre_callback;
        a->lsm_post_audit = avc_audit_post_callback;
        common_lsm_audit(a);
+        return 0;
 }
 /**
@@ -793,6 +809,7 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
 * @tclass: target security class
 * @requested: requested permissions, interpreted based on @tclass
 * @auditdata: auxiliary audit data
+ * @flags: VFS walk flags
 *
 * Check the AVC to determine whether the @requested permissions are granted
 * for the SID pair (@ssid, @tsid), interpreting the permissions
@@ -802,14 +819,19 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
 * permissions are granted, -%EACCES if any permissions are denied, or
 * another -errno upon other errors.
 */
-int avc_has_perm(u32 ssid, u32 tsid, u16 tclass,
+int avc_has_perm_flags(u32 ssid, u32 tsid, u16 tclass,
-                 u32 requested, struct common_audit_data *auditdata)
+                       u32 requested, struct common_audit_data *auditdata,
+                       unsigned flags)
 {
        struct av_decision avd;
-        int rc;
+        int rc, rc2;
        rc = avc_has_perm_noaudit(ssid, tsid, tclass, requested, 0, &avd);
-        avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata);
+        rc2 = avc_audit(ssid, tsid, tclass, requested, &avd, rc, auditdata,
+                        flags);
+        if (rc2)
+                return rc2;
        return rc;
 }
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a73f4e463774..f7cf0ea6faea 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1446,8 +1446,11 @@ static int task_has_capability(struct task_struct *tsk,
        }
        rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
-        if (audit == SECURITY_CAP_AUDIT)
+        if (audit == SECURITY_CAP_AUDIT) {
-                avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
+                int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
+                if (rc2)
+                        return rc2;
+        }
        return rc;
 }
@@ -1467,7 +1470,8 @@ static int task_has_system(struct task_struct *tsk,
 static int inode_has_perm(const struct cred *cred,
                          struct inode *inode,
                          u32 perms,
-                          struct common_audit_data *adp)
+                          struct common_audit_data *adp,
+                          unsigned flags)
 {
        struct inode_security_struct *isec;
        struct common_audit_data ad;
@@ -1487,7 +1491,7 @@ static int inode_has_perm(const struct cred *cred,
                ad.u.fs.inode = inode;
        }
-        return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
+        return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
 }
 /* Same as inode_has_perm, but pass explicit audit data containing
@@ -1504,7 +1508,7 @@ static inline int dentry_has_perm(const struct cred *cred,
        COMMON_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.path.mnt = mnt;
        ad.u.fs.path.dentry = dentry;
-        return inode_has_perm(cred, inode, av, &ad);
+        return inode_has_perm(cred, inode, av, &ad, 0);
 }
 /* Check whether a task can use an open file descriptor to
@@ -1540,7 +1544,7 @@ static int file_has_perm(const struct cred *cred,
        /* av is zero if only checking access to the descriptor. */
        rc = 0;
        if (av)
-                rc = inode_has_perm(cred, inode, av, &ad);
+                rc = inode_has_perm(cred, inode, av, &ad, 0);
 out:
        return rc;
@@ -2103,7 +2107,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                        file = file_priv->file;
                        inode = file->f_path.dentry->d_inode;
                        if (inode_has_perm(cred, inode,
-                                           FILE__READ | FILE__WRITE, NULL)) {
+                                           FILE__READ | FILE__WRITE, NULL, 0)) {
                                drop_tty = 1;
                        }
                }
@@ -2649,10 +2653,6 @@ static int selinux_inode_permission(struct inode *inode, int mask, unsigned flag
        if (!mask)
                return 0;
-        /* May be droppable after audit */
-        if (flags & IPERM_FLAG_RCU)
-                return -ECHILD;
        COMMON_AUDIT_DATA_INIT(&ad, FS);
        ad.u.fs.inode = inode;
@@ -2661,7 +2661,7 @@ static int selinux_inode_permission(struct inode *inode, int mask, unsigned flag
        perms = file_mask_to_av(inode->i_mode, mask);
-        return inode_has_perm(cred, inode, perms, &ad);
+        return inode_has_perm(cred, inode, perms, &ad, flags);
 }
 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
@@ -3209,7 +3209,7 @@ static int selinux_dentry_open(struct file *file, const struct cred *cred)
         * new inode label or new policy.
         * This check is not redundant - do not remove.
         */
-        return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
+        return inode_has_perm(cred, inode, open_file_to_av(file), NULL, 0);
 }
 /* task security operations */
diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
index 5615081b73ec..e77b2ac2908b 100644
--- a/security/selinux/include/avc.h
+++ b/security/selinux/include/avc.h
@@ -54,11 +54,11 @@ struct avc_cache_stats {
 void __init avc_init(void);
-void avc_audit(u32 ssid, u32 tsid,
+int avc_audit(u32 ssid, u32 tsid,
               u16 tclass, u32 requested,
               struct av_decision *avd,
               int result,
-               struct common_audit_data *a);
+              struct common_audit_data *a, unsigned flags);
 #define AVC_STRICT 1 /* Ignore permissive mode. */
 int avc_has_perm_noaudit(u32 ssid, u32 tsid,
@@ -66,9 +66,17 @@ int avc_has_perm_noaudit(u32 ssid, u32 tsid,
                         unsigned flags,
                         struct av_decision *avd);
-int avc_has_perm(u32 ssid, u32 tsid,
+int avc_has_perm_flags(u32 ssid, u32 tsid,
-                 u16 tclass, u32 requested,
+                       u16 tclass, u32 requested,
-                 struct common_audit_data *auditdata);
+                       struct common_audit_data *auditdata,
+                       unsigned);
+static inline int avc_has_perm(u32 ssid, u32 tsid,
+                               u16 tclass, u32 requested,
+                               struct common_audit_data *auditdata)
+{
+        return avc_has_perm_flags(ssid, tsid, tclass, requested, auditdata, 0);
+}
 u32 avc_policy_seqno(void);
diff --git a/sound/aoa/codecs/tas.c b/sound/aoa/codecs/tas.c
index 58804c7acfcf..fd2188c3df2b 100644
--- a/sound/aoa/codecs/tas.c
+++ b/sound/aoa/codecs/tas.c
@@ -170,7 +170,7 @@ static void tas_set_volume(struct tas *tas)
        /* analysing the volume and mixer tables shows
         * that they are similar enough when we shift
         * the mixer table down by 4 bits. The error
-         * is minuscule, in just one item the error
+         * is miniscule, in just one item the error
         * is 1, at a value of 0x07f17b (mixer table
         * value is 0x07f17a) */
        tmp = tas_gaintable[left];