268 files changed, 2155 insertions, 1287 deletions
diff --git a/Documentation/networking/e1000.txt b/Documentation/networking/e1000.txt
index 2df71861e578..d9271e74e488 100644
--- a/Documentation/networking/e1000.txt
+++ b/Documentation/networking/e1000.txt
@@ -1,82 +1,35 @@
 Linux* Base Driver for the Intel(R) PRO/1000 Family of Adapters
 ===============================================================
-September 26, 2006
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 Contents
 ========
- In This Release
 - Identifying Your Adapter
- Building and Installation
 - Command Line Parameters
 - Speed and Duplex Configuration
 - Additional Configurations
- Known Issues
 - Support
-In This Release
-===============
-This file describes the Linux* Base Driver for the Intel(R) PRO/1000 Family
-of Adapters.  This driver includes support for Itanium(R)2-based systems.
-For questions related to hardware requirements, refer to the documentation
-supplied with your Intel PRO/1000 adapter. All hardware requirements listed
-apply to use with Linux.
-The following features are now available in supported kernels:
- - Native VLANs
- - Channel Bonding (teaming)
- - SNMP
-Channel Bonding documentation can be found in the Linux kernel source:
-/Documentation/networking/bonding.txt
-The driver information previously displayed in the /proc filesystem is not
-supported in this release.  Alternatively, you can use ethtool (version 1.6
-or later), lspci, and ifconfig to obtain the same information.
-Instructions on updating ethtool can be found in the section "Additional
-Configurations" later in this document.
-NOTE: The Intel(R) 82562v 10/100 Network Connection only provides 10/100
-support.
 Identifying Your Adapter
 ========================
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
-    http://support.intel.com/support/network/adapter/pro100/21397.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 For the latest Intel network drivers for Linux, refer to the following
 website.  In the search field, enter your adapter name or type, or use the
 networking link on the left to search for your adapter:
-    http://downloadfinder.intel.com/scripts-df/support_intel.asp
+    http://support.intel.com/support/go/network/adapter/home.htm
 Command Line Parameters
 =======================
-If the driver is built as a module, the  following optional parameters
-are used by entering them on the command line with the modprobe command
-using this syntax:
-     modprobe e1000 [<option>=<VAL1>,<VAL2>,...]
-For example, with two PRO/1000 PCI adapters, entering:
-     modprobe e1000 TxDescriptors=80,128
-loads the e1000 driver with 80 TX descriptors for the first adapter and
-128 TX descriptors for the second adapter.
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
@@ -89,10 +42,6 @@ NOTES:  For more information about the AutoNeg, Duplex, and Speed
        parameters, see the application note at:
        http://www.intel.com/design/network/applnots/ap450.htm
-        A descriptor describes a data buffer and attributes related to
-        the data buffer.  This information is accessed by the hardware.
 AutoNeg
 -------
 (Supported only on adapters with copper connections)
@@ -106,7 +55,6 @@ Duplex parameters must not be specified.
 NOTE:  Refer to the Speed and Duplex section of this readme for more
       information on the AutoNeg parameter.
 Duplex
 ------
 (Supported only on adapters with copper connections)
@@ -119,7 +67,6 @@ set to auto-negotiate, the board auto-detects the correct duplex.  If the
 link partner is forced (either full or half), Duplex defaults to half-
 duplex.
 FlowControl
 -----------
 Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
@@ -128,16 +75,16 @@ Default Value: Reads flow control settings from the EEPROM
 This parameter controls the automatic generation(Tx) and response(Rx)
 to Ethernet PAUSE frames.
 InterruptThrottleRate
 ---------------------
 (not supported on Intel(R) 82542, 82543 or 82544-based adapters)
-Valid Range:   0,1,3,100-100000 (0=off, 1=dynamic, 3=dynamic conservative)
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
 Default Value: 3
 The driver can limit the amount of interrupts per second that the adapter
-will generate for incoming packets. It does this by writing a value to the 
+will generate for incoming packets. It does this by writing a value to the
-adapter that is based on the maximum amount of interrupts that the adapter 
+adapter that is based on the maximum amount of interrupts that the adapter
 will generate per second.
 Setting InterruptThrottleRate to a value greater or equal to 100
@@ -146,37 +93,43 @@ per second, even if more packets have come in. This reduces interrupt
 load on the system and can lower CPU utilization under heavy load,
 but will increase latency as packets are not processed as quickly.
-The default behaviour of the driver previously assumed a static 
+The default behaviour of the driver previously assumed a static
-InterruptThrottleRate value of 8000, providing a good fallback value for 
+InterruptThrottleRate value of 8000, providing a good fallback value for
-all traffic types,but lacking in small packet performance and latency. 
+all traffic types,but lacking in small packet performance and latency.
-The hardware can handle many more small packets per second however, and 
+The hardware can handle many more small packets per second however, and
 for this reason an adaptive interrupt moderation algorithm was implemented.
 Since 7.3.x, the driver has two adaptive modes (setting 1 or 3) in which
-it dynamically adjusts the InterruptThrottleRate value based on the traffic 
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
 that it receives. After determining the type of incoming traffic in the last
-timeframe, it will adjust the InterruptThrottleRate to an appropriate value 
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
 for that traffic.
 The algorithm classifies the incoming traffic every interval into
-classes.  Once the class is determined, the InterruptThrottleRate value is 
+classes.  Once the class is determined, the InterruptThrottleRate value is
-adjusted to suit that traffic type the best. There are three classes defined: 
+adjusted to suit that traffic type the best. There are three classes defined:
 "Bulk traffic", for large amounts of packets of normal size; "Low latency",
 for small amounts of traffic and/or a significant percentage of small
-packets; and "Lowest latency", for almost completely small packets or 
+packets; and "Lowest latency", for almost completely small packets or
 minimal traffic.
-In dynamic conservative mode, the InterruptThrottleRate value is set to 4000 
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
-for traffic that falls in class "Bulk traffic". If traffic falls in the "Low 
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
-latency" or "Lowest latency" class, the InterruptThrottleRate is increased 
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
 stepwise to 20000. This default mode is suitable for most applications.
 For situations where low latency is vital such as cluster or
 grid computing, the algorithm can reduce latency even more when
 InterruptThrottleRate is set to mode 1. In this mode, which operates
-the same as mode 3, the InterruptThrottleRate will be increased stepwise to 
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
 70000 for traffic in class "Lowest latency".
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal, the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
 Setting InterruptThrottleRate to 0 turns off any interrupt moderation
 and may improve small packet latency, but is generally not suitable
 for bulk throughput traffic.
@@ -212,8 +165,6 @@ NOTE:  When e1000 is loaded with default settings and multiple adapters
       be platform-specific.  If CPU utilization is not a concern, use
       RX_POLLING (NAPI) and default driver settings.
 RxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -225,15 +176,14 @@ by the driver.  Increasing this value allows the driver to buffer more
 incoming packets, at the expense of increased system memory utilization.
 Each descriptor is 16 bytes.  A receive buffer is also allocated for each
-descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending 
+descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending
 on the MTU setting. The maximum MTU size is 16110.
-NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo 
+NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo
-       Frames.  Depending on the available system resources, the request 
+       Frames.  Depending on the available system resources, the request
-       for a higher number of receive descriptors may be denied.  In this 
+       for a higher number of receive descriptors may be denied.  In this
       case, use a lower number.
 RxIntDelay
 ----------
 Valid Range:   0-65535 (0=off)
@@ -254,7 +204,6 @@ CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
          restoring the network connection.  To eliminate the potential
          for the hang ensure that RxIntDelay is set to 0.
 RxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -268,7 +217,6 @@ packet is received within the set amount of time.  Proper tuning,
 along with RxIntDelay, may improve traffic throughput in specific network
 conditions.
 Speed
 -----
 (This parameter is supported only on adapters with copper connections.)
@@ -280,7 +228,6 @@ Speed forces the line speed to the specified value in megabits per second
 partner is set to auto-negotiate, the board will auto-detect the correct
 speed.  Duplex should also be set when Speed is set to either 10 or 100.
 TxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -295,6 +242,36 @@ NOTE:  Depending on the available system resources, the request for a
       higher number of transmit descriptors may be denied.  In this case,
       use a lower number.
+TxDescriptorStep
+----------------
+Valid Range:    1 (use every Tx Descriptor)
+                4 (use every 4th Tx Descriptor)
+Default Value:  1 (use every Tx Descriptor)
+On certain non-Intel architectures, it has been observed that intense TX
+traffic bursts of short packets may result in an improper descriptor
+writeback. If this occurs, the driver will report a "TX Timeout" and reset
+the adapter, after which the transmit flow will restart, though data may
+have stalled for as much as 10 seconds before it resumes.
+The improper writeback does not occur on the first descriptor in a system
+memory cache-line, which is typically 32 bytes, or 4 descriptors long.
+Setting TxDescriptorStep to a value of 4 will ensure that all TX descriptors
+are aligned to the start of a system memory cache line, and so this problem
+will not occur.
+NOTES: Setting TxDescriptorStep to 4 effectively reduces the number of
+       TxDescriptors available for transmits to 1/4 of the normal allocation.
+       This has a possible negative performance impact, which may be
+       compensated for by allocating more descriptors using the TxDescriptors
+       module parameter.
+       There are other conditions which may result in "TX Timeout", which will
+       not be resolved by the use of the TxDescriptorStep parameter. As the
+       issue addressed by this parameter has never been observed on Intel
+       Architecture platforms, it should not be used on Intel platforms.
 TxIntDelay
 ----------
@@ -307,7 +284,6 @@ efficiency if properly tuned for specific network traffic.  If the
 system is reporting dropped transmits, this value may be set too high
 causing the driver to run out of available transmit descriptors.
 TxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -330,6 +306,35 @@ Default Value: 1
 A value of '1' indicates that the driver should enable IP checksum
 offload for received packets (both UDP and TCP) to the adapter hardware.
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+Usage: insmod e1000.ko copybreak=128
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000/parameters/copybreak
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+Allows PHY to turn off in lower power states. The user can turn off
+this parameter in supported chipsets.
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
 Speed and Duplex Configuration
 ==============================
@@ -385,40 +390,9 @@ If the link partner is forced to a specific speed and duplex, then this
 parameter should not be used.  Instead, use the Speed and Duplex parameters
 previously mentioned to force the adapter to the same speed and duplex.
 Additional Configurations
 =========================
-  Configuring the Driver on Different Distributions
-  -------------------------------------------------
-  Configuring a network driver to load properly when the system is started
-  is distribution dependent.  Typically, the configuration process involves
-  adding an alias line to /etc/modules.conf or /etc/modprobe.conf as well
-  as editing other system startup scripts and/or configuration files.  Many
-  popular Linux distributions ship with tools to make these changes for you.
-  To learn the proper way to configure a network device for your system,
-  refer to your distribution documentation.  If during this process you are
-  asked for the driver or module name, the name for the Linux Base Driver
-  for the Intel(R) PRO/1000 Family of Adapters is e1000.
-  As an example, if you install the e1000 driver for two PRO/1000 adapters
-  (eth0 and eth1) and set the speed and duplex to 10full and 100half, add
-  the following to modules.conf or or modprobe.conf:
-       alias eth0 e1000
-       alias eth1 e1000
-       options e1000 Speed=10,100 Duplex=2,1
-  Viewing Link Messages
-  ---------------------
-  Link messages will not be displayed to the console if the distribution is
-  restricting system messages.  In order to see network driver link messages
-  on your console, set dmesg to eight by entering the following:
-       dmesg -n 8
-  NOTE: This setting is not saved across reboots.
  Jumbo Frames
  ------------
  Jumbo Frames support is enabled by changing the MTU to a value larger than
@@ -437,9 +411,11 @@ Additional Configurations
   setting in a different location.
  Notes:
+  Degradation in throughput performance may be observed in some Jumbo frames
-  - To enable Jumbo Frames, increase the MTU size on the interface beyond
+  environments. If this is observed, increasing the application's socket buffer
-    1500.
+  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
+  See the specific application manual and /usr/src/linux*/Documentation/
+  networking/ip-sysctl.txt for more details.
  - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
    with the maximum Jumbo Frames size of 16128.
@@ -447,40 +423,11 @@ Additional Configurations
  - Using Jumbo Frames at 10 or 100 Mbps may result in poor performance or
    loss of link.
-  - Some Intel gigabit adapters that support Jumbo Frames have a frame size
-    limit of 9238 bytes, with a corresponding MTU size limit of 9216 bytes.
-    The adapters with this limitation are based on the Intel(R) 82571EB,
-    82572EI, 82573L and 80003ES2LAN controller.  These correspond to the
-    following product names:
-     Intel(R) PRO/1000 PT Server Adapter
-     Intel(R) PRO/1000 PT Desktop Adapter
-     Intel(R) PRO/1000 PT Network Connection
-     Intel(R) PRO/1000 PT Dual Port Server Adapter
-     Intel(R) PRO/1000 PT Dual Port Network Connection
-     Intel(R) PRO/1000 PF Server Adapter
-     Intel(R) PRO/1000 PF Network Connection
-     Intel(R) PRO/1000 PF Dual Port Server Adapter
-     Intel(R) PRO/1000 PB Server Connection
-     Intel(R) PRO/1000 PL Network Connection
-     Intel(R) PRO/1000 EB Network Connection with I/O Acceleration
-     Intel(R) PRO/1000 EB Backplane Connection with I/O Acceleration
-     Intel(R) PRO/1000 PT Quad Port Server Adapter
  - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
    support Jumbo Frames. These correspond to the following product names:
     Intel(R) PRO/1000 Gigabit Server Adapter
     Intel(R) PRO/1000 PM Network Connection
-  - The following adapters do not support Jumbo Frames:
-     Intel(R) 82562V 10/100 Network Connection
-     Intel(R) 82566DM Gigabit Network Connection
-     Intel(R) 82566DC Gigabit Network Connection
-     Intel(R) 82566MM Gigabit Network Connection
-     Intel(R) 82566MC Gigabit Network Connection
-     Intel(R) 82562GT 10/100 Network Connection
-     Intel(R) 82562G 10/100 Network Connection
  Ethtool
  -------
  The driver utilizes the ethtool interface for driver configuration and
@@ -490,142 +437,14 @@ Additional Configurations
  The latest release of ethtool can be found from
  http://sourceforge.net/projects/gkernel.
-  NOTE: Ethtool 1.6 only supports a limited set of ethtool options.  Support
-  for a more complete ethtool feature set can be enabled by upgrading
-  ethtool to ethtool-1.8.1.
  Enabling Wake on LAN* (WoL)
  ---------------------------
-  WoL is configured through the Ethtool* utility.  Ethtool is included with
+  WoL is configured through the Ethtool* utility.
-  all versions of Red Hat after Red Hat 7.2.  For other Linux distributions,
-  download and install Ethtool from the following website:
-  http://sourceforge.net/projects/gkernel.
-  For instructions on enabling WoL with Ethtool, refer to the website listed
-  above.
  WoL will be enabled on the system during the next shut down or reboot.
  For this driver version, in order to enable WoL, the e1000 driver must be
  loaded when shutting down or rebooting the system.
-  Wake On LAN is only supported on port A for the following devices:
-  Intel(R) PRO/1000 PT Dual Port Network Connection
-  Intel(R) PRO/1000 PT Dual Port Server Connection
-  Intel(R) PRO/1000 PT Dual Port Server Adapter
-  Intel(R) PRO/1000 PF Dual Port Server Adapter
-  Intel(R) PRO/1000 PT Quad Port Server Adapter
-  NAPI
-  ----
-  NAPI (Rx polling mode) is enabled in the e1000 driver.
-  See www.cyberus.ca/~hadi/usenix-paper.tgz for more information on NAPI.
-Known Issues
-============
-Dropped Receive Packets on Half-duplex 10/100 Networks
------------------------------------------------------
-If you have an Intel PCI Express adapter running at 10mbps or 100mbps, half-
-duplex, you may observe occasional dropped receive packets.  There are no
-workarounds for this problem in this network configuration.  The network must
-be updated to operate in full-duplex, and/or 1000mbps only.
-Jumbo Frames System Requirement
-------------------------------
-Memory allocation failures have been observed on Linux systems with 64 MB
-of RAM or less that are running Jumbo Frames.  If you are using Jumbo
-Frames, your system may require more than the advertised minimum
-requirement of 64 MB of system memory.
-Performance Degradation with Jumbo Frames
-----------------------------------------
-Degradation in throughput performance may be observed in some Jumbo frames
-environments.  If this is observed, increasing the application's socket
-buffer size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values
-may help.  See the specific application manual and
-/usr/src/linux*/Documentation/
-networking/ip-sysctl.txt for more details.
-Jumbo Frames on Foundry BigIron 8000 switch
-------------------------------------------
-There is a known issue using Jumbo frames when connected to a Foundry
-BigIron 8000 switch.  This is a 3rd party limitation.  If you experience
-loss of packets, lower the MTU size.
-Allocating Rx Buffers when Using Jumbo Frames 
---------------------------------------------
-Allocating Rx buffers when using Jumbo Frames on 2.6.x kernels may fail if 
-the available memory is heavily fragmented. This issue may be seen with PCI-X 
-adapters or with packet split disabled. This can be reduced or eliminated 
-by changing the amount of available memory for receive buffer allocation, by
-increasing /proc/sys/vm/min_free_kbytes. 
-Multiple Interfaces on Same Ethernet Broadcast Network
------------------------------------------------------
-Due to the default ARP behavior on Linux, it is not possible to have
-one system on two IP networks in the same Ethernet broadcast domain
-(non-partitioned switch) behave as expected.  All Ethernet interfaces
-will respond to IP traffic for any IP address assigned to the system.
-This results in unbalanced receive traffic.
-If you have multiple interfaces in a server, either turn on ARP
-filtering by entering:
-    echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
-(this only works if your kernel's version is higher than 2.4.5),
-NOTE: This setting is not saved across reboots.  The configuration
-change can be made permanent by adding the line:
-    net.ipv4.conf.all.arp_filter = 1
-to the file /etc/sysctl.conf
-      or,
-install the interfaces in separate broadcast domains (either in
-different switches or in a switch partitioned to VLANs).
-82541/82547 can't link or are slow to link with some link partners
-----------------------------------------------------------------
-There is a known compatibility issue with 82541/82547 and some
-low-end switches where the link will not be established, or will
-be slow to establish.  In particular, these switches are known to
-be incompatible with 82541/82547:
-    Planex FXG-08TE
-    I-O Data ETG-SH8
-To workaround this issue, the driver can be compiled with an override
-of the PHY's master/slave setting.  Forcing master or forcing slave
-mode will improve time-to-link.
-    # make CFLAGS_EXTRA=-DE1000_MASTER_SLAVE=<n>
-Where <n> is:
-    0 = Hardware default
-    1 = Master mode
-    2 = Slave mode
-    3 = Auto master/slave
-Disable rx flow control with ethtool
------------------------------------
-In order to disable receive flow control using ethtool, you must turn
-off auto-negotiation on the same command line.
-For example:
-   ethtool -A eth? autoneg off rx off
-Unplugging network cable while ethtool -p is running
----------------------------------------------------
-In kernel versions 2.5.50 and later (including 2.6 kernel), unplugging
-the network cable while ethtool -p is running will cause the system to
-become unresponsive to keyboard commands, except for control-alt-delete.
-Restarting the system appears to be the only remedy.
 Support
 =======
diff --git a/Documentation/networking/e1000e.txt b/Documentation/networking/e1000e.txt
new file mode 100644
index 000000000000..6aa048badf32
--- /dev/null
+++ b/Documentation/networking/e1000e.txt
@@ -0,0 +1,302 @@
+Linux* Driver for Intel(R) Network Connection
+===============================================================
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
+Contents
+========
+- Identifying Your Adapter
+- Command Line Parameters
+- Additional Configurations
+- Support
+Identifying Your Adapter
+========================
+The e1000e driver supports all PCI Express Intel(R) Gigabit Network
+Connections, except those that are 82575, 82576 and 82580-based*.
+* NOTE: The Intel(R) PRO/1000 P Dual Port Server Adapter is supported by
+  the e1000 driver, not the e1000e driver due to the 82546 part being used
+  behind a PCI Express bridge.
+For more information on how to identify your adapter, go to the Adapter &
+Driver ID Guide at:
+    http://support.intel.com/support/go/network/adapter/idguide.htm
+For the latest Intel network drivers for Linux, refer to the following
+website.  In the search field, enter your adapter name or type, or use the
+networking link on the left to search for your adapter:
+    http://support.intel.com/support/go/network/adapter/home.htm
+Command Line Parameters
+=======================
+The default value for each parameter is generally the recommended setting,
+unless otherwise noted.
+NOTES:  For more information about the InterruptThrottleRate,
+        RxIntDelay, TxIntDelay, RxAbsIntDelay, and TxAbsIntDelay
+        parameters, see the application note at:
+        http://www.intel.com/design/network/applnots/ap450.htm
+InterruptThrottleRate
+---------------------
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
+Default Value: 3
+The driver can limit the amount of interrupts per second that the adapter
+will generate for incoming packets. It does this by writing a value to the
+adapter that is based on the maximum amount of interrupts that the adapter
+will generate per second.
+Setting InterruptThrottleRate to a value greater or equal to 100
+will program the adapter to send out a maximum of that many interrupts
+per second, even if more packets have come in. This reduces interrupt
+load on the system and can lower CPU utilization under heavy load,
+but will increase latency as packets are not processed as quickly.
+The driver has two adaptive modes (setting 1 or 3) in which
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
+that it receives. After determining the type of incoming traffic in the last
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
+for that traffic.
+The algorithm classifies the incoming traffic every interval into
+classes.  Once the class is determined, the InterruptThrottleRate value is
+adjusted to suit that traffic type the best. There are three classes defined:
+"Bulk traffic", for large amounts of packets of normal size; "Low latency",
+for small amounts of traffic and/or a significant percentage of small
+packets; and "Lowest latency", for almost completely small packets or
+minimal traffic.
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
+stepwise to 20000. This default mode is suitable for most applications.
+For situations where low latency is vital such as cluster or
+grid computing, the algorithm can reduce latency even more when
+InterruptThrottleRate is set to mode 1. In this mode, which operates
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
+70000 for traffic in class "Lowest latency".
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
+Setting InterruptThrottleRate to 0 turns off any interrupt moderation
+and may improve small packet latency, but is generally not suitable
+for bulk throughput traffic.
+NOTE:  InterruptThrottleRate takes precedence over the TxAbsIntDelay and
+       RxAbsIntDelay parameters.  In other words, minimizing the receive
+       and/or transmit absolute delays does not force the controller to
+       generate more interrupts than what the Interrupt Throttle Rate
+       allows.
+NOTE:  When e1000e is loaded with default settings and multiple adapters
+       are in use simultaneously, the CPU utilization may increase non-
+       linearly.  In order to limit the CPU utilization without impacting
+       the overall throughput, we recommend that you load the driver as
+       follows:
+           modprobe e1000e InterruptThrottleRate=3000,3000,3000
+       This sets the InterruptThrottleRate to 3000 interrupts/sec for
+       the first, second, and third instances of the driver.  The range
+       of 2000 to 3000 interrupts per second works on a majority of
+       systems and is a good starting point, but the optimal value will
+       be platform-specific.  If CPU utilization is not a concern, use
+       RX_POLLING (NAPI) and default driver settings.
+RxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 0
+This value delays the generation of receive interrupts in units of 1.024
+microseconds.  Receive interrupt reduction can improve CPU efficiency if
+properly tuned for specific network traffic.  Increasing this value adds
+extra latency to frame reception and can end up decreasing the throughput
+of TCP traffic.  If the system is reporting dropped receives, this value
+may be set too high, causing the driver to run out of available receive
+descriptors.
+CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
+          hang (stop transmitting) under certain network conditions.  If
+          this occurs a NETDEV WATCHDOG message is logged in the system
+          event log.  In addition, the controller is automatically reset,
+          restoring the network connection.  To eliminate the potential
+          for the hang ensure that RxIntDelay is set to 0.
+RxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+This value, in units of 1.024 microseconds, limits the delay in which a
+receive interrupt is generated.  Useful only if RxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is received within the set amount of time.  Proper tuning,
+along with RxIntDelay, may improve traffic throughput in specific network
+conditions.
+TxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+This value delays the generation of transmit interrupts in units of
+1.024 microseconds.  Transmit interrupt reduction can improve CPU
+efficiency if properly tuned for specific network traffic.  If the
+system is reporting dropped transmits, this value may be set too high
+causing the driver to run out of available transmit descriptors.
+TxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 32
+This value, in units of 1.024 microseconds, limits the delay in which a
+transmit interrupt is generated.  Useful only if TxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is sent on the wire within the set amount of time.  Proper tuning,
+along with TxIntDelay, may improve traffic throughput in specific
+network conditions.
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000e/parameters/copybreak
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+Allows PHY to turn off in lower power states. The user can set this parameter
+in supported chipsets.
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
+IntMode
+-------
+Valid Range: 0-2 (0=legacy, 1=MSI, 2=MSI-X)
+Default Value: 2
+Allows changing the interrupt mode at module load time, without requiring a
+recompile. If the driver load fails to enable a specific interrupt mode, the
+driver will try other interrupt modes, from least to most compatible.  The
+interrupt order is MSI-X, MSI, Legacy.  If specifying MSI (IntMode=1)
+interrupts, only MSI and Legacy will be attempted.
+CrcStripping
+------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+Strip the CRC from received packets before sending up the network stack.  If
+you have a machine with a BMC enabled but cannot receive IPMI traffic after
+loading or enabling the driver, try disabling this feature.
+WriteProtectNVM
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+Set the hardware to ignore all write/erase cycles to the GbE region in the
+ICHx NVM (non-volatile memory).  This feature can be disabled by the
+WriteProtectNVM module parameter (enabled by default) only after a hardware
+reset, but the machine must be power cycled before trying to enable writes.
+Note: the kernel boot option iomem=relaxed may need to be set if the kernel
+config option CONFIG_STRICT_DEVMEM=y, if the root user wants to write the
+NVM from user space via ethtool.
+Additional Configurations
+=========================
+  Jumbo Frames
+  ------------
+  Jumbo Frames support is enabled by changing the MTU to a value larger than
+  the default of 1500.  Use the ifconfig command to increase the MTU size.
+  For example:
+       ifconfig eth<x> mtu 9000 up
+  This setting is not saved across reboots.
+  Notes:
+  - The maximum MTU setting for Jumbo Frames is 9216.  This value coincides
+    with the maximum Jumbo Frames size of 9234 bytes.
+  - Using Jumbo Frames at 10 or 100 Mbps is not supported and may result in
+    poor performance or loss of link.
+  - Some adapters limit Jumbo Frames sized packets to a maximum of
+    4096 bytes and some adapters do not support Jumbo Frames.
+  Ethtool
+  -------
+  The driver utilizes the ethtool interface for driver configuration and
+  diagnostics, as well as displaying statistical information.  We
+  strongly recommend downloading the latest version of Ethtool at:
+  http://sourceforge.net/projects/gkernel.
+  Speed and Duplex
+  ----------------
+  Speed and Duplex are configured through the Ethtool* utility. For
+  instructions,  refer to the Ethtool man page.
+  Enabling Wake on LAN* (WoL)
+  ---------------------------
+  WoL is configured through the Ethtool* utility. For instructions on
+  enabling WoL with Ethtool, refer to the Ethtool man page.
+  WoL will be enabled on the system during the next shut down or reboot.
+  For this driver version, in order to enable WoL, the e1000e driver must be
+  loaded when shutting down or rebooting the system.
+  In most cases Wake On LAN is only supported on port A for multiple port
+  adapters. To verify if a port supports Wake on LAN run ethtool eth<X>.
+Support
+=======
+For general information, go to the Intel support website at:
+    www.intel.com/support/
+or the Intel Wired Networking project hosted by Sourceforge at:
+    http://sourceforge.net/projects/e1000
+If an issue is identified with the released source code on the supported
+kernel with a supported adapter, email the specific information related
+to the issue to e1000-devel@lists.sf.net
diff --git a/Documentation/networking/ixgbevf.txt b/Documentation/networking/ixgbevf.txt
index 19015de6725f..21dd5d15b6b4 100755..100644
--- a/Documentation/networking/ixgbevf.txt
+++ b/Documentation/networking/ixgbevf.txt
@@ -1,19 +1,16 @@
 Linux* Base Driver for Intel(R) Network Connection
 ==================================================
-November 24, 2009
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 Contents
 ========
- In This Release
 - Identifying Your Adapter
 - Known Issues/Troubleshooting
 - Support
-In This Release
-===============
 This file describes the ixgbevf Linux* Base Driver for Intel Network
 Connection.
@@ -33,7 +30,7 @@ Identifying Your Adapter
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
-    http://support.intel.com/support/network/sb/CS-008441.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 Known Issues/Troubleshooting
 ============================
@@ -57,34 +54,3 @@ or the Intel Wired Networking project hosted by Sourceforge at:
 If an issue is identified with the released source code on the supported
 kernel with a supported adapter, email the specific information related
 to the issue to e1000-devel@lists.sf.net
-License
-=======
-Intel 10 Gigabit Linux driver.
-Copyright(c) 1999 - 2009 Intel Corporation.
-This program is free software; you can redistribute it and/or modify it
-under the terms and conditions of the GNU General Public License,
-version 2, as published by the Free Software Foundation.
-This program is distributed in the hope it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details.
-You should have received a copy of the GNU General Public License along with
-this program; if not, write to the Free Software Foundation, Inc.,
-51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-The full GNU General Public License is included in this distribution in
-the file called "COPYING".
-Trademarks
-==========
-Intel, Itanium, and Pentium are trademarks or registered trademarks of
-Intel Corporation or its subsidiaries in the United States and other
-countries.
-* Other names and brands may be claimed as the property of others.
diff --git a/Documentation/vm/page-types.c b/Documentation/vm/page-types.c
index ccd951fa94ee..cc96ee2666f2 100644
--- a/Documentation/vm/page-types.c
+++ b/Documentation/vm/page-types.c
@@ -478,7 +478,7 @@ static void prepare_hwpoison_fd(void)
        }
        if (opt_unpoison && !hwpoison_forget_fd) {
-                sprintf(buf, "%s/renew-pfn", hwpoison_debug_fs);
+                sprintf(buf, "%s/unpoison-pfn", hwpoison_debug_fs);
                hwpoison_forget_fd = checked_open(buf, O_WRONLY);
        }
 }
diff --git a/MAINTAINERS b/MAINTAINERS
index f46d8e66333f..7679bf32f7bb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -969,6 +969,16 @@ L:	linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-s5p*/
+ARM/SAMSUNG S5P SERIES FIMC SUPPORT
+M:      Kyungmin Park <kyungmin.park@samsung.com>
+M:      Sylwester Nawrocki <s.nawrocki@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org
+L:      linux-media@vger.kernel.org
+S:      Maintained
+F:      arch/arm/plat-s5p/dev-fimc*
+F:      arch/arm/plat-samsung/include/plat/*fimc*
+F:      drivers/media/video/s5p-fimc/
 ARM/SHMOBILE ARM ARCHITECTURE
 M:      Paul Mundt <lethal@linux-sh.org>
 M:      Magnus Damm <magnus.damm@gmail.com>
@@ -2535,7 +2545,7 @@ S:	Supported
 F:      drivers/scsi/gdt*
 GENERIC GPIO I2C DRIVER
-M:      Haavard Skinnemoen <hskinnemoen@atmel.com>
+M:      Haavard Skinnemoen <hskinnemoen@gmail.com>
 S:      Supported
 F:      drivers/i2c/busses/i2c-gpio.c
 F:      include/linux/i2c-gpio.h
@@ -3063,16 +3073,27 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ixp2000/
-INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe)
+INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe/ixgbevf)
 M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
 M:      Jesse Brandeburg <jesse.brandeburg@intel.com>
 M:      Bruce Allan <bruce.w.allan@intel.com>
-M:      Alex Duyck <alexander.h.duyck@intel.com>
+M:      Carolyn Wyborny <carolyn.wyborny@intel.com>
+M:      Don Skidmore <donald.c.skidmore@intel.com>
+M:      Greg Rose <gregory.v.rose@intel.com>
 M:      PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>
+M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://e1000.sourceforge.net/
 S:      Supported
+F:      Documentation/networking/e100.txt
+F:      Documentation/networking/e1000.txt
+F:      Documentation/networking/e1000e.txt
+F:      Documentation/networking/igb.txt
+F:      Documentation/networking/igbvf.txt
+F:      Documentation/networking/ixgb.txt
+F:      Documentation/networking/ixgbe.txt
+F:      Documentation/networking/ixgbevf.txt
 F:      drivers/net/e100.c
 F:      drivers/net/e1000/
 F:      drivers/net/e1000e/
@@ -3080,6 +3101,7 @@ F:	drivers/net/igb/
 F:      drivers/net/igbvf/
 F:      drivers/net/ixgb/
 F:      drivers/net/ixgbe/
+F:      drivers/net/ixgbevf/
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
 L:      linux-wireless@vger.kernel.org
@@ -5008,6 +5030,12 @@ F:	drivers/media/common/saa7146*
 F:      drivers/media/video/*7146*
 F:      include/media/*7146*
+SAMSUNG AUDIO (ASoC) DRIVERS
+M:      Jassi Brar <jassi.brar@samsung.com>
+L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
+S:      Supported
+F:      sound/soc/s3c24xx
 TLG2300 VIDEO4LINUX-2 DRIVER
 M:      Huang Shijie <shijie8@gmail.com>
 M:      Kang Yong <kangyong@telegent.com>
@@ -6450,8 +6478,10 @@ F:	include/linux/wm97xx.h
 WOLFSON MICROELECTRONICS DRIVERS
 M:      Mark Brown <broonie@opensource.wolfsonmicro.com>
 M:      Ian Lartey <ian@opensource.wolfsonmicro.com>
+M:      Dimitris Papastamos <dp@opensource.wolfsonmicro.com>
+T:      git git://opensource.wolfsonmicro.com/linux-2.6-asoc
 T:      git git://opensource.wolfsonmicro.com/linux-2.6-audioplus
-W:      http://opensource.wolfsonmicro.com/node/8
+W:      http://opensource.wolfsonmicro.com/content/linux-drivers-wolfson-devices
 S:      Supported
 F:      Documentation/hwmon/wm83??
 F:      drivers/leds/leds-wm83*.c
diff --git a/Makefile b/Makefile
index 471c49fd2f43..7583116e5d9a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 36
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
-NAME = Sheep on Meth
+NAME = Flesh-Eating Bats with Fangs
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 88c97bc7a6f5..9c26ba7244fb 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1101,6 +1101,20 @@ config ARM_ERRATA_720789
          invalidated are not, resulting in an incoherency in the system page
          tables. The workaround changes the TLB flushing routines to invalidate
          entries regardless of the ASID.
+config ARM_ERRATA_743622
+        bool "ARM errata: Faulty hazard checking in the Store Buffer may lead to data corruption"
+        depends on CPU_V7
+        help
+          This option enables the workaround for the 743622 Cortex-A9
+          (r2p0..r2p2) erratum. Under very rare conditions, a faulty
+          optimisation in the Cortex-A9 Store Buffer may lead to data
+          corruption. This workaround sets a specific bit in the diagnostic
+          register of the Cortex-A9 which disables the Store Buffer
+          optimisation, preventing the defect from occurring. This has no
+          visible impact on the overall performance or power consumption of the
+          processor.
 endmenu
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
index 8bccbfa693ff..2c1f0050c9c4 100644
--- a/arch/arm/kernel/kprobes-decode.c
+++ b/arch/arm/kernel/kprobes-decode.c
@@ -1162,11 +1162,12 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
 {
        /*
         * MSR   : cccc 0011 0x10 xxxx xxxx xxxx xxxx xxxx
-         * Undef : cccc 0011 0x00 xxxx xxxx xxxx xxxx xxxx
+         * Undef : cccc 0011 0100 xxxx xxxx xxxx xxxx xxxx
         * ALU op with S bit and Rd == 15 :
         *         cccc 001x xxx1 xxxx 1111 xxxx xxxx xxxx
         */
-        if ((insn & 0x0f900000) == 0x03200000 ||        /* MSR & Undef */
+        if ((insn & 0x0fb00000) == 0x03200000 ||        /* MSR */
+            (insn & 0x0ff00000) == 0x03400000 ||        /* Undef */
            (insn & 0x0e10f000) == 0x0210f000)          /* ALU s-bit, R15  */
                return INSN_REJECTED;
@@ -1177,7 +1178,7 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
         * *S (bit 20) updates condition codes
         * ADC/SBC/RSC reads the C flag
         */
-        insn &= 0xfff00fff;     /* Rn = r0, Rd = r0 */
+        insn &= 0xffff0fff;     /* Rd = r0 */
        asi->insn[0] = insn;
        asi->insn_handler = (insn & (1 << 20)) ?  /* S-bit */
                        emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
diff --git a/arch/arm/mach-at91/include/mach/system.h b/arch/arm/mach-at91/include/mach/system.h
index c80e090b3670..ee8db152592e 100644
--- a/arch/arm/mach-at91/include/mach/system.h
+++ b/arch/arm/mach-at91/include/mach/system.h
@@ -28,17 +28,16 @@
 static inline void arch_idle(void)
 {
-#ifndef CONFIG_DEBUG_KERNEL
        /*
         * Disable the processor clock.  The processor will be automatically
         * re-enabled by an interrupt or by a reset.
         */
        at91_sys_write(AT91_PMC_SCDR, AT91_PMC_PCK);
-#else
+#ifndef CONFIG_CPU_ARM920T
        /*
         * Set the processor (CP15) into 'Wait for Interrupt' mode.
-         * Unlike disabling the processor clock via the PMC (above)
+         * Post-RM9200 processors need this in conjunction with the above
-         *  this allows the processor to be woken via JTAG.
+         * to save power when idle.
         */
        cpu_do_idle();
 #endif
diff --git a/arch/arm/mach-ep93xx/dma-m2p.c b/arch/arm/mach-ep93xx/dma-m2p.c
index 8904ca4e2e24..a696d354b1f8 100644
--- a/arch/arm/mach-ep93xx/dma-m2p.c
+++ b/arch/arm/mach-ep93xx/dma-m2p.c
@@ -276,7 +276,7 @@ static void channel_disable(struct m2p_channel *ch)
        v &= ~(M2P_CONTROL_STALL_IRQ_EN | M2P_CONTROL_NFB_IRQ_EN);
        m2p_set_control(ch, v);
-        while (m2p_channel_state(ch) == STATE_ON)
+        while (m2p_channel_state(ch) >= STATE_ON)
                cpu_relax();
        m2p_set_control(ch, 0x0);
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index c5c0369bb481..2f7e2728970d 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -122,6 +122,7 @@ config MACH_CPUIMX27
        select IMX_HAVE_PLATFORM_IMX_I2C
        select IMX_HAVE_PLATFORM_IMX_UART
        select IMX_HAVE_PLATFORM_MXC_NAND
+        select MXC_ULPI if USB_ULPI
        help
          Include support for Eukrea CPUIMX27 platform. This includes
          specific configurations for the module and its peripherals.
diff --git a/arch/arm/mach-imx/mach-cpuimx27.c b/arch/arm/mach-imx/mach-cpuimx27.c
index 339150ab0ea5..6830afd1d2ba 100644
--- a/arch/arm/mach-imx/mach-cpuimx27.c
+++ b/arch/arm/mach-imx/mach-cpuimx27.c
@@ -259,7 +259,7 @@ static void __init eukrea_cpuimx27_init(void)
        i2c_register_board_info(0, eukrea_cpuimx27_i2c_devices,
                                ARRAY_SIZE(eukrea_cpuimx27_i2c_devices));
-        imx27_add_i2c_imx1(&cpuimx27_i2c1_data);
+        imx27_add_i2c_imx0(&cpuimx27_i2c1_data);
        platform_add_devices(platform_devices, ARRAY_SIZE(platform_devices));
diff --git a/arch/arm/mach-s5p6440/cpu.c b/arch/arm/mach-s5p6440/cpu.c
index 526f33adb31d..ec592e866054 100644
--- a/arch/arm/mach-s5p6440/cpu.c
+++ b/arch/arm/mach-s5p6440/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5p6442/cpu.c b/arch/arm/mach-s5p6442/cpu.c
index a48fb553fd01..70ac681af72b 100644
--- a/arch/arm/mach-s5p6442/cpu.c
+++ b/arch/arm/mach-s5p6442/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5pc100/cpu.c b/arch/arm/mach-s5pc100/cpu.c
index 251c92ac5b22..cd1afbce83e2 100644
--- a/arch/arm/mach-s5pc100/cpu.c
+++ b/arch/arm/mach-s5pc100/cpu.c
@@ -21,6 +21,7 @@
 #include <linux/sysdev.h>
 #include <linux/serial_core.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index cfecd70657cb..d562670e1b0b 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -173,11 +173,6 @@ static int s5pv210_clk_ip3_ctrl(struct clk *clk, int enable)
        return s5p_gatectrl(S5P_CLKGATE_IP3, clk, enable);
 }
-static int s5pv210_clk_ip4_ctrl(struct clk *clk, int enable)
-{
-        return s5p_gatectrl(S5P_CLKGATE_IP4, clk, enable);
-}
 static int s5pv210_clk_mask0_ctrl(struct clk *clk, int enable)
 {
        return s5p_gatectrl(S5P_CLK_SRC_MASK0, clk, enable);
diff --git a/arch/arm/mach-s5pv210/cpu.c b/arch/arm/mach-s5pv210/cpu.c
index 77f456c91ad3..245b82b53df4 100644
--- a/arch/arm/mach-s5pv210/cpu.c
+++ b/arch/arm/mach-s5pv210/cpu.c
@@ -19,6 +19,7 @@
 #include <linux/io.h>
 #include <linux/sysdev.h>
 #include <linux/platform_device.h>
+#include <linux/sched.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
diff --git a/arch/arm/mach-vexpress/ct-ca9x4.c b/arch/arm/mach-vexpress/ct-ca9x4.c
index efb127022d42..71fb17349520 100644
--- a/arch/arm/mach-vexpress/ct-ca9x4.c
+++ b/arch/arm/mach-vexpress/ct-ca9x4.c
@@ -68,7 +68,7 @@ static void __init ct_ca9x4_init_irq(void)
 }
 #if 0
-static void ct_ca9x4_timer_init(void)
+static void __init ct_ca9x4_timer_init(void)
 {
        writel(0, MMIO_P2V(CT_CA9X4_TIMER0) + TIMER_CTRL);
        writel(0, MMIO_P2V(CT_CA9X4_TIMER1) + TIMER_CTRL);
@@ -222,7 +222,7 @@ static struct platform_device pmu_device = {
        .resource       = pmu_resources,
 };
-static void ct_ca9x4_init(void)
+static void __init ct_ca9x4_init(void)
 {
        int i;
diff --git a/arch/arm/mach-vexpress/v2m.c b/arch/arm/mach-vexpress/v2m.c
index 817f0ad38a0b..7eaa232180a5 100644
--- a/arch/arm/mach-vexpress/v2m.c
+++ b/arch/arm/mach-vexpress/v2m.c
@@ -48,7 +48,7 @@ void __init v2m_map_io(struct map_desc *tile, size_t num)
 }
-static void v2m_timer_init(void)
+static void __init v2m_timer_init(void)
 {
        writel(0, MMIO_P2V(V2M_TIMER0) + TIMER_CTRL);
        writel(0, MMIO_P2V(V2M_TIMER1) + TIMER_CTRL);
diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c
index ab506272b2d3..17e7b0b57e49 100644
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -204,8 +204,12 @@ void __iomem * __arm_ioremap_pfn_caller(unsigned long pfn,
        /*
         * Don't allow RAM to be mapped - this causes problems with ARMv6+
         */
-        if (WARN_ON(pfn_valid(pfn)))
+        if (pfn_valid(pfn)) {
-                return NULL;
+                printk(KERN_WARNING "BUG: Your driver calls ioremap() on system memory.  This leads\n"
+                       KERN_WARNING "to architecturally unpredictable behaviour on ARMv6+, and ioremap()\n"
+                       KERN_WARNING "will fail in the next kernel release.  Please fix your driver.\n");
+                WARN_ON(1);
+        }
        type = get_mem_type(mtype);
        if (!type)
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 6a3a2d0cd6db..e8ed9dc461fe 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -248,7 +248,7 @@ static struct mem_type mem_types[] = {
        },
        [MT_MEMORY] = {
                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_USER | L_PTE_EXEC,
+                                L_PTE_WRITE | L_PTE_EXEC,
                .prot_l1   = PMD_TYPE_TABLE,
                .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                .domain    = DOMAIN_KERNEL,
@@ -259,7 +259,7 @@ static struct mem_type mem_types[] = {
        },
        [MT_MEMORY_NONCACHED] = {
                .prot_pte  = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY |
-                                L_PTE_USER | L_PTE_EXEC | L_PTE_MT_BUFFERABLE,
+                                L_PTE_WRITE | L_PTE_EXEC | L_PTE_MT_BUFFERABLE,
                .prot_l1   = PMD_TYPE_TABLE,
                .prot_sect = PMD_TYPE_SECT | PMD_SECT_AP_WRITE,
                .domain    = DOMAIN_KERNEL,
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 7563ff0141bd..197f21bed5e9 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -253,6 +253,14 @@ __v7_setup:
        orreq   r10, r10, #1 << 22              @ set bit #22
        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
 #endif
+#ifdef CONFIG_ARM_ERRATA_743622
+        teq     r6, #0x20                       @ present in r2p0
+        teqne   r6, #0x21                       @ present in r2p1
+        teqne   r6, #0x22                       @ present in r2p2
+        mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
+        orreq   r10, r10, #1 << 6               @ set bit #6
+        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
+#endif
 3:      mov     r10, #0
 #ifdef HARVARD_CACHE
@@ -365,7 +373,7 @@ __v7_ca9mp_proc_info:
        b       __v7_ca9mp_setup
        .long   cpu_arch_name
        .long   cpu_elf_name
-        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP
+        .long   HWCAP_SWP|HWCAP_HALF|HWCAP_THUMB|HWCAP_FAST_MULT|HWCAP_EDSP|HWCAP_TLS
        .long   cpu_v7_name
        .long   v7_processor_functions
        .long   v7wbi_tlb_fns
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 0691176899ff..72e09eb642dd 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -102,6 +102,7 @@ static int op_create_counter(int cpu, int event)
        if (IS_ERR(pevent)) {
                ret = PTR_ERR(pevent);
        } else if (pevent->state != PERF_EVENT_STATE_ACTIVE) {
+                perf_event_release_kernel(pevent);
                pr_warning("oprofile: failed to enable event %d "
                                "on CPU %d\n", event, cpu);
                ret = -EBUSY;
@@ -365,6 +366,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        ret = init_driverfs();
        if (ret) {
                kfree(counter_config);
+                counter_config = NULL;
                return ret;
        }
@@ -402,7 +404,6 @@ void oprofile_arch_exit(void)
        struct perf_event *event;
        if (*perf_events) {
-                exit_driverfs();
                for_each_possible_cpu(cpu) {
                        for (id = 0; id < perf_num_counters; ++id) {
                                event = perf_events[cpu][id];
@@ -413,8 +414,10 @@ void oprofile_arch_exit(void)
                }
        }
-        if (counter_config)
+        if (counter_config) {
                kfree(counter_config);
+                exit_driverfs();
+        }
 }
 #else
 int __init oprofile_arch_init(struct oprofile_operations *ops)
diff --git a/arch/arm/plat-omap/iommu.c b/arch/arm/plat-omap/iommu.c
index a202a2ce6e3d..6cd151b31bc5 100644
--- a/arch/arm/plat-omap/iommu.c
+++ b/arch/arm/plat-omap/iommu.c
@@ -320,6 +320,7 @@ void flush_iotlb_page(struct iommu *obj, u32 da)
                if ((start <= da) && (da < start + bytes)) {
                        dev_dbg(obj->dev, "%s: %08x<=%08x(%x)\n",
                                __func__, start, da, bytes);
+                        iotlb_load_cr(obj, &cr);
                        iommu_write_reg(obj, 1, MMU_FLUSH_ENTRY);
                }
        }
diff --git a/arch/arm/plat-samsung/adc.c b/arch/arm/plat-samsung/adc.c
index 04d9521ddc9f..e8f2be2d67f2 100644
--- a/arch/arm/plat-samsung/adc.c
+++ b/arch/arm/plat-samsung/adc.c
@@ -435,7 +435,6 @@ static int s3c_adc_suspend(struct platform_device *pdev, pm_message_t state)
 static int s3c_adc_resume(struct platform_device *pdev)
 {
        struct adc_device *adc = platform_get_drvdata(pdev);
-        unsigned long flags;
        clk_enable(adc->clk);
        enable_irq(adc->irq);
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 90a20512d68d..e8d20b0bc50e 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -48,6 +48,9 @@
 #include <plat/clock.h>
 #include <plat/cpu.h>
+#include <linux/serial_core.h>
+#include <plat/regs-serial.h> /* for s3c24xx_uart_devs */
 /* clock information */
 static LIST_HEAD(clocks);
@@ -65,6 +68,28 @@ static int clk_null_enable(struct clk *clk, int enable)
        return 0;
 }
+static int dev_is_s3c_uart(struct device *dev)
+{
+        struct platform_device **pdev = s3c24xx_uart_devs;
+        int i;
+        for (i = 0; i < ARRAY_SIZE(s3c24xx_uart_devs); i++, pdev++)
+                if (*pdev && dev == &(*pdev)->dev)
+                        return 1;
+        return 0;
+}
+/*
+ * Serial drivers call get_clock() very early, before platform bus
+ * has been set up, this requires a special check to let them get
+ * a proper clock
+ */
+static int dev_is_platform_device(struct device *dev)
+{
+        return dev->bus == &platform_bus_type ||
+               (dev->bus == NULL && dev_is_s3c_uart(dev));
+}
 /* Clock API calls */
 struct clk *clk_get(struct device *dev, const char *id)
@@ -73,7 +98,7 @@ struct clk *clk_get(struct device *dev, const char *id)
        struct clk *clk = ERR_PTR(-ENOENT);
        int idno;
-        if (dev == NULL || dev->bus != &platform_bus_type)
+        if (dev == NULL || !dev_is_platform_device(dev))
                idno = -1;
        else
                idno = to_platform_device(dev)->id;
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index 98f94d041d9c..a727f54d64d6 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -314,10 +314,9 @@ int module_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
        vfree(module->arch.syminfo);
        module->arch.syminfo = NULL;
-        return module_bug_finalize(hdr, sechdrs, module);
+        return 0;
 }
 void module_arch_cleanup(struct module *module)
 {
-        module_bug_cleanup(module);
 }
diff --git a/arch/h8300/kernel/module.c b/arch/h8300/kernel/module.c
index 0865e291c20d..db4953dc4e1b 100644
--- a/arch/h8300/kernel/module.c
+++ b/arch/h8300/kernel/module.c
@@ -112,10 +112,9 @@ int module_finalize(const Elf_Ehdr *hdr,
                    const Elf_Shdr *sechdrs,
                    struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/m32r/include/asm/elf.h b/arch/m32r/include/asm/elf.h
index 2f85412ef730..b8da7d0574d2 100644
--- a/arch/m32r/include/asm/elf.h
+++ b/arch/m32r/include/asm/elf.h
@@ -82,9 +82,9 @@ typedef elf_fpreg_t elf_fpregset_t;
 * These are used to set parameters in the core dumps.
 */
 #define ELF_CLASS       ELFCLASS32
-#if defined(__LITTLE_ENDIAN)
+#if defined(__LITTLE_ENDIAN__)
 #define ELF_DATA        ELFDATA2LSB
-#elif defined(__BIG_ENDIAN)
+#elif defined(__BIG_ENDIAN__)
 #define ELF_DATA        ELFDATA2MSB
 #else
 #error no endian defined
diff --git a/arch/m32r/kernel/.gitignore b/arch/m32r/kernel/.gitignore
new file mode 100644
index 000000000000..c5f676c3c224
--- /dev/null
+++ b/arch/m32r/kernel/.gitignore
@@ -0,0 +1 @@
+vmlinux.lds
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index 7bbe38645ed5..a08697f0886d 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -28,6 +28,8 @@
 #define DEBUG_SIG 0
+#define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 asmlinkage int
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                unsigned long r2, unsigned long r3, unsigned long r4,
@@ -254,7 +256,7 @@ give_sigsegv:
 static int prev_insn(struct pt_regs *regs)
 {
        u16 inst;
-        if (get_user(&inst, (u16 __user *)(regs->bpc - 2)))
+        if (get_user(inst, (u16 __user *)(regs->bpc - 2)))
                return -EFAULT;
        if ((inst & 0xfff0) == 0x10f0)  /* trap ? */
                regs->bpc -= 2;
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 2d3cf3890904..4c9f402295dd 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -13,6 +13,7 @@ config MIPS
        select HAVE_KPROBES
        select HAVE_KRETPROBES
        select RTC_LIB if !MACH_LOONGSON
+        select GENERIC_ATOMIC64 if !64BIT
 mainmenu "Linux/MIPS Kernel Configuration"
@@ -1650,8 +1651,16 @@ config MIPS_MT_SMP
        select SYS_SUPPORTS_SMP
        select SMP_UP
        help
-          This is a kernel model which is also known a VSMP or lately
+          This is a kernel model which is known a VSMP but lately has been
-          has been marketesed into SMVP.
+          marketesed into SMVP.
+          Virtual SMP uses the processor's VPEs  to implement virtual
+          processors. In currently available configuration of the 34K processor
+          this allows for a dual processor. Both processors will share the same
+          primary caches; each will obtain the half of the TLB for it's own
+          exclusive use. For a layman this model can be described as similar to
+          what Intel calls Hyperthreading.
+          For further information see http://www.linux-mips.org/wiki/34K#VSMP
 config MIPS_MT_SMTC
        bool "SMTC: Use all TCs on all VPEs for SMP"
@@ -1668,6 +1677,14 @@ config MIPS_MT_SMTC
        help
          This is a kernel model which is known a SMTC or lately has been
          marketesed into SMVP.
+          is presenting the available TC's of the core as processors to Linux.
+          On currently available 34K processors this means a Linux system will
+          see up to 5 processors. The implementation of the SMTC kernel differs
+          significantly from VSMP and cannot efficiently coexist in the same
+          kernel binary so the choice between VSMP and SMTC is a compile time
+          decision.
+          For further information see http://www.linux-mips.org/wiki/34K#SMTC
 endchoice
diff --git a/arch/mips/alchemy/common/prom.c b/arch/mips/alchemy/common/prom.c
index c29511b11d44..534021059629 100644
--- a/arch/mips/alchemy/common/prom.c
+++ b/arch/mips/alchemy/common/prom.c
@@ -43,7 +43,7 @@ int prom_argc;
 char **prom_argv;
 char **prom_envp;
-void prom_init_cmdline(void)
+void __init prom_init_cmdline(void)
 {
        int i;
@@ -104,7 +104,7 @@ static inline void str2eaddr(unsigned char *ea, unsigned char *str)
        }
 }
-int prom_get_ethernet_addr(char *ethernet_addr)
+int __init prom_get_ethernet_addr(char *ethernet_addr)
 {
        char *ethaddr_str;
@@ -123,7 +123,6 @@ int prom_get_ethernet_addr(char *ethernet_addr)
        return 0;
 }
-EXPORT_SYMBOL(prom_get_ethernet_addr);
 void __init prom_free_prom_memory(void)
 {
diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index 4df4c77d2722..5042d51b0512 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -59,7 +59,7 @@ $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
 hostprogs-y := calc_vmlinuz_load_addr
 VMLINUZ_LOAD_ADDRESS = $(shell $(obj)/calc_vmlinuz_load_addr \
-                $(objtree)/$(KBUILD_IMAGE) $(VMLINUX_LOAD_ADDRESS))
+                $(obj)/vmlinux.bin $(VMLINUX_LOAD_ADDRESS))
 vmlinuzobjs-y += $(obj)/piggy.o
diff --git a/arch/mips/cavium-octeon/Kconfig b/arch/mips/cavium-octeon/Kconfig
index 094c17e38e16..47323ca452dc 100644
--- a/arch/mips/cavium-octeon/Kconfig
+++ b/arch/mips/cavium-octeon/Kconfig
@@ -83,3 +83,7 @@ config ARCH_SPARSEMEM_ENABLE
        def_bool y
        select SPARSEMEM_STATIC
        depends on CPU_CAVIUM_OCTEON
+config CAVIUM_OCTEON_HELPER
+        def_bool y
+        depends on OCTEON_ETHERNET || PCI
diff --git a/arch/mips/cavium-octeon/cpu.c b/arch/mips/cavium-octeon/cpu.c
index c664c8cc2b42..a5b427909b5c 100644
--- a/arch/mips/cavium-octeon/cpu.c
+++ b/arch/mips/cavium-octeon/cpu.c
@@ -41,7 +41,7 @@ static int cnmips_cu2_call(struct notifier_block *nfb, unsigned long action,
        return NOTIFY_OK;               /* Let default notifier send signals */
 }
-static int cnmips_cu2_setup(void)
+static int __init cnmips_cu2_setup(void)
 {
        return cu2_notifier(cnmips_cu2_call, 0);
 }
diff --git a/arch/mips/cavium-octeon/executive/Makefile b/arch/mips/cavium-octeon/executive/Makefile
index 2fd66db6939e..7f41c5be2190 100644
--- a/arch/mips/cavium-octeon/executive/Makefile
+++ b/arch/mips/cavium-octeon/executive/Makefile
@@ -11,4 +11,4 @@
 obj-y += cvmx-bootmem.o cvmx-l2c.o cvmx-sysinfo.o octeon-model.o
-obj-$(CONFIG_PCI) += cvmx-helper-errata.o cvmx-helper-jtag.o
+obj-$(CONFIG_CAVIUM_OCTEON_HELPER) += cvmx-helper-errata.o cvmx-helper-jtag.o
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index c63c56bfd184..47d87da379f9 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -782,6 +782,10 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
 */
 #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
+#else /* !CONFIG_64BIT */
+#include <asm-generic/atomic64.h>
 #endif /* CONFIG_64BIT */
 /*
diff --git a/arch/mips/include/asm/cop2.h b/arch/mips/include/asm/cop2.h
index 2cb2f0c2c4f8..3532e2c5f098 100644
--- a/arch/mips/include/asm/cop2.h
+++ b/arch/mips/include/asm/cop2.h
@@ -24,7 +24,7 @@ extern int cu2_notifier_call_chain(unsigned long val, void *v);
 #define cu2_notifier(fn, pri)                                           \
 ({                                                                      \
-        static struct notifier_block fn##_nb __cpuinitdata = {          \
+        static struct notifier_block fn##_nb = {                        \
                .notifier_call = fn,                                    \
                .priority = pri                                         \
        };                                                              \
diff --git a/arch/mips/include/asm/gic.h b/arch/mips/include/asm/gic.h
index 9b9436a4d816..86548da650e7 100644
--- a/arch/mips/include/asm/gic.h
+++ b/arch/mips/include/asm/gic.h
@@ -321,6 +321,7 @@ struct gic_intrmask_regs {
 */
 struct gic_intr_map {
        unsigned int cpunum;    /* Directed to this CPU */
+#define GIC_UNUSED              0xdead                  /* Dummy data */
        unsigned int pin;       /* Directed to this Pin */
        unsigned int polarity;  /* Polarity : +/-       */
        unsigned int trigtype;  /* Trigger  : Edge/Levl */
diff --git a/arch/mips/include/asm/mach-tx49xx/kmalloc.h b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
index b74caf65482b..ff9a8b86cb93 100644
--- a/arch/mips/include/asm/mach-tx49xx/kmalloc.h
+++ b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
@@ -1,6 +1,6 @@
 #ifndef __ASM_MACH_TX49XX_KMALLOC_H
 #define __ASM_MACH_TX49XX_KMALLOC_H
-#define ARCH_KMALLOC_MINALIGN   L1_CACHE_BYTES
+#define ARCH_DMA_MINALIGN L1_CACHE_BYTES
 #endif /* __ASM_MACH_TX49XX_KMALLOC_H */
diff --git a/arch/mips/include/asm/mips-boards/maltaint.h b/arch/mips/include/asm/mips-boards/maltaint.h
index cea872fc6f5c..d11aa02a956a 100644
--- a/arch/mips/include/asm/mips-boards/maltaint.h
+++ b/arch/mips/include/asm/mips-boards/maltaint.h
@@ -88,9 +88,6 @@
 #define GIC_EXT_INTR(x)         x
-/* Dummy data */
-#define X                       0xdead
 /* External Interrupts used for IPI */
 #define GIC_IPI_EXT_INTR_RESCHED_VPE0   16
 #define GIC_IPI_EXT_INTR_CALLFNC_VPE0   17
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index a16beafcea91..e59cd1ac09c2 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -150,6 +150,20 @@ typedef struct { unsigned long pgprot; } pgprot_t;
    ((unsigned long)(x) - PAGE_OFFSET + PHYS_OFFSET)
 #endif
 #define __va(x)         ((void *)((unsigned long)(x) + PAGE_OFFSET - PHYS_OFFSET))
+/*
+ * RELOC_HIDE was originally added by 6007b903dfe5f1d13e0c711ac2894bdd4a61b1ad
+ * (lmo) rsp. 8431fd094d625b94d364fe393076ccef88e6ce18 (kernel.org).  The
+ * discussion can be found in lkml posting
+ * <a2ebde260608230500o3407b108hc03debb9da6e62c@mail.gmail.com> which is
+ * archived at http://lists.linuxcoding.com/kernel/2006-q3/msg17360.html
+ *
+ * It is unclear if the misscompilations mentioned in
+ * http://lkml.org/lkml/2010/8/8/138 also affect MIPS so we keep this one
+ * until GCC 3.x has been retired before we can apply
+ * https://patchwork.linux-mips.org/patch/1541/
+ */
 #define __pa_symbol(x)  __pa(RELOC_HIDE((unsigned long)(x), 0))
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
diff --git a/arch/mips/include/asm/siginfo.h b/arch/mips/include/asm/siginfo.h
index 96e28f18dad1..1ca64b4d33d9 100644
--- a/arch/mips/include/asm/siginfo.h
+++ b/arch/mips/include/asm/siginfo.h
@@ -88,6 +88,7 @@ typedef struct siginfo {
 #ifdef __ARCH_SI_TRAPNO
                        int _trapno;    /* TRAP # which caused the signal */
 #endif
+                        short _addr_lsb;
                } _sigfault;
                /* SIGPOLL, SIGXFSZ (To do ...)  */
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 2376f2e06e47..70df9c0d3c5b 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -146,7 +146,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_LOAD_WATCH         (1<<TIF_LOAD_WATCH)
 /* work to do on interrupt/exception return */
-#define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
+#define _TIF_WORK_MASK          (0x0000ffef &                           \
+                                        ~(_TIF_SECCOMP | _TIF_SYSCALL_AUDIT))
 /* work to do on any return to u-space */
 #define _TIF_ALLWORK_MASK       (0x8000ffff & ~_TIF_SECCOMP)
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index baa318a59c97..550725b881d5 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -356,16 +356,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 333)
 #define __NR_accept4                    (__NR_Linux + 334)
 #define __NR_recvmmsg                   (__NR_Linux + 335)
+#define __NR_fanotify_init              (__NR_Linux + 336)
+#define __NR_fanotify_mark              (__NR_Linux + 337)
+#define __NR_prlimit64                  (__NR_Linux + 338)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             335
+#define __NR_Linux_syscalls             338
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         335
+#define __NR_O32_Linux_syscalls         338
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -668,16 +671,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 292)
 #define __NR_accept4                    (__NR_Linux + 293)
 #define __NR_recvmmsg                   (__NR_Linux + 294)
+#define __NR_fanotify_init              (__NR_Linux + 295)
+#define __NR_fanotify_mark              (__NR_Linux + 296)
+#define __NR_prlimit64                  (__NR_Linux + 297)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             294
+#define __NR_Linux_syscalls             297
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          294
+#define __NR_64_Linux_syscalls          297
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -985,16 +991,19 @@
 #define __NR_accept4                    (__NR_Linux + 297)
 #define __NR_recvmmsg                   (__NR_Linux + 298)
 #define __NR_getdents64                 (__NR_Linux + 299)
+#define __NR_fanotify_init              (__NR_Linux + 300)
+#define __NR_fanotify_mark              (__NR_Linux + 301)
+#define __NR_prlimit64                  (__NR_Linux + 302)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             299
+#define __NR_Linux_syscalls             302
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         299
+#define __NR_N32_Linux_syscalls         302
 #ifdef __KERNEL__
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index b181f2f0ea8e..82ba9f62f49e 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -7,7 +7,6 @@
 #include <asm/io.h>
 #include <asm/gic.h>
 #include <asm/gcmpregs.h>
-#include <asm/mips-boards/maltaint.h>
 #include <asm/irq.h>
 #include <linux/hardirq.h>
 #include <asm-generic/bitops/find.h>
@@ -131,7 +130,7 @@ static int gic_set_affinity(unsigned int irq, const struct cpumask *cpumask)
        int             i;
        irq -= _irqbase;
-        pr_debug(KERN_DEBUG "%s(%d) called\n", __func__, irq);
+        pr_debug("%s(%d) called\n", __func__, irq);
        cpumask_and(&tmp, cpumask, cpu_online_mask);
        if (cpus_empty(tmp))
                return -1;
@@ -222,7 +221,7 @@ static void __init gic_basic_init(int numintrs, int numvpes,
        /* Setup specifics */
        for (i = 0; i < mapsize; i++) {
                cpu = intrmap[i].cpunum;
-                if (cpu == X)
+                if (cpu == GIC_UNUSED)
                        continue;
                if (cpu == 0 && i != 0 && intrmap[i].flags == 0)
                        continue;
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 1f4e2fa64140..f4546e97c60d 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -283,7 +283,7 @@ static int kgdb_mips_notify(struct notifier_block *self, unsigned long cmd,
        struct pt_regs *regs = args->regs;
        int trap = (regs->cp0_cause & 0x7c) >> 2;
-        /* Userpace events, ignore. */
+        /* Userspace events, ignore. */
        if (user_mode(regs))
                return NOTIFY_DONE;
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 80e2ba694bab..29811f043399 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -251,7 +251,7 @@ void sp_work_handle_request(void)
                memset(&tz, 0, sizeof(tz));
                if ((ret.retval = sp_syscall(__NR_gettimeofday, (int)&tv,
                                             (int)&tz, 0, 0)) == 0)
-                ret.retval = tv.tv_sec;
+                        ret.retval = tv.tv_sec;
                break;
        case MTSP_SYSCALL_EXIT:
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index c2dab140dc98..6343b4a5b835 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -341,3 +341,10 @@ asmlinkage long sys32_lookup_dcookie(u32 a0, u32 a1, char __user *buf,
 {
        return sys_lookup_dcookie(merge_64(a0, a1), buf, len);
 }
+SYSCALL_DEFINE6(32_fanotify_mark, int, fanotify_fd, unsigned int, flags,
+                u64, a3, u64, a4, int, dfd, const char  __user *, pathname)
+{
+        return sys_fanotify_mark(fanotify_fd, flags, merge_64(a3, a4),
+                                 dfd, pathname);
+}
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 84b41797fae1..fbaabad0e6e2 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -582,7 +582,10 @@ einval:	li	v0, -ENOSYS
        sys     sys_rt_tgsigqueueinfo   4
        sys     sys_perf_event_open     5
        sys     sys_accept4             4
-        sys     sys_recvmmsg            5
+        sys     sys_recvmmsg            5       /* 4335 */
+        sys     sys_fanotify_init       2
+        sys     sys_fanotify_mark       6
+        sys     sys_prlimit64           4
        .endm
        /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index eb0bb73172c3..3f4179283207 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -417,9 +417,12 @@ sys_call_table:
        PTR     sys_pipe2
        PTR     sys_inotify_init1
        PTR     sys_preadv
-        PTR     sys_pwritev                     /* 5390 */
+        PTR     sys_pwritev                     /* 5290 */
        PTR     sys_rt_tgsigqueueinfo
        PTR     sys_perf_event_open
        PTR     sys_accept4
-        PTR     sys_recvmmsg
+        PTR     sys_recvmmsg
+        PTR     sys_fanotify_init               /* 5295 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index 4da3fafaa313..38b226938db3 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -421,5 +421,8 @@ EXPORT(sysn32_call_table)
        PTR     sys_perf_event_open
        PTR     sys_accept4
        PTR     compat_sys_recvmmsg
-        PTR     sys_getdents
+        PTR     sys_getdents64
+        PTR     sys_fanotify_init               /* 6300 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index d2bc285413dc..42fe14b52a33 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -539,5 +539,8 @@ sys_call_table:
        PTR     compat_sys_rt_tgsigqueueinfo
        PTR     sys_perf_event_open
        PTR     sys_accept4
-        PTR     compat_sys_recvmmsg
+        PTR     compat_sys_recvmmsg             /* 4335 */
+        PTR     sys_fanotify_init
+        PTR     sys_32_fanotify_mark
+        PTR     sys_prlimit64
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 7ba890860d98..469d4019f795 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -44,27 +44,39 @@ static inline int cpu_is_noncoherent_r10000(struct device *dev)
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
 {
+        gfp_t dma_flag;
        /* ignore region specifiers */
        gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
-#ifdef CONFIG_ZONE_DMA
+#ifdef CONFIG_ISA
        if (dev == NULL)
-                gfp |= __GFP_DMA;
+                dma_flag = __GFP_DMA;
-        else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
-                gfp |= __GFP_DMA;
        else
 #endif
-#ifdef CONFIG_ZONE_DMA32
+#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
             if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-                gfp |= __GFP_DMA32;
+                        dma_flag = __GFP_DMA;
+        else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                        dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA;
        else
 #endif
-                ;
+                dma_flag = 0;
        /* Don't invoke OOM killer */
        gfp |= __GFP_NORETRY;
-        return gfp;
+        return gfp | dma_flag;
 }
 void *dma_alloc_noncoherent(struct device *dev, size_t size,
diff --git a/arch/mips/mm/sc-rm7k.c b/arch/mips/mm/sc-rm7k.c
index 1ef75cd80a0d..274af3be1442 100644
--- a/arch/mips/mm/sc-rm7k.c
+++ b/arch/mips/mm/sc-rm7k.c
@@ -30,7 +30,7 @@
 #define tc_lsize        32
 extern unsigned long icache_way_size, dcache_way_size;
-unsigned long tcache_size;
+static unsigned long tcache_size;
 #include <asm/r4kcache.h>
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 15949b0be811..b79b24afe3a2 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -385,6 +385,8 @@ static int __initdata msc_nr_eicirqs = ARRAY_SIZE(msc_eicirqmap);
 */
 #define GIC_CPU_NMI GIC_MAP_TO_NMI_MSK
+#define X GIC_UNUSED
 static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
        { X, X,            X,           X,              0 },
        { X, X,            X,           X,              0 },
@@ -404,6 +406,7 @@ static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
        { X, X,            X,           X,              0 },
        /* The remainder of this table is initialised by fill_ipi_map */
 };
+#undef X
 /*
 * GCMP needs to be detected before any SMP initialisation
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index 71f7d27b0d4c..f31218e17d3c 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -118,7 +118,7 @@ static int __init rc32434_pcibridge_init(void)
        if (!((pcicvalue == PCIM_H_EA) ||
              (pcicvalue == PCIM_H_IA_FIX) ||
              (pcicvalue == PCIM_H_IA_RR))) {
-                pr_err(KERN_ERR "PCI init error!!!\n");
+                pr_err("PCI init error!!!\n");
                /* Not in Host Mode, return ERROR */
                return -1;
        }
diff --git a/arch/mips/pnx8550/common/reset.c b/arch/mips/pnx8550/common/reset.c
index fadd8744a6bc..e7a12ff304b9 100644
--- a/arch/mips/pnx8550/common/reset.c
+++ b/arch/mips/pnx8550/common/reset.c
@@ -22,29 +22,19 @@
 */
 #include <linux/kernel.h>
+#include <asm/processor.h>
 #include <asm/reboot.h>
 #include <glb.h>
 void pnx8550_machine_restart(char *command)
 {
-        char head[] = "************* Machine restart *************";
-        char foot[] = "*******************************************";
-        printk("\n\n");
-        printk("%s\n", head);
-        if (command != NULL)
-                printk("* %s\n", command);
-        printk("%s\n", foot);
        PNX8550_RST_CTL = PNX8550_RST_DO_SW_RST;
 }
 void pnx8550_machine_halt(void)
 {
-        printk("*** Machine halt. (Not implemented) ***\n");
+        while (1) {
-}
+                if (cpu_wait)
+                        cpu_wait();
-void pnx8550_machine_power_off(void)
+        }
-{
-        printk("*** Machine power off.  (Not implemented) ***\n");
 }
diff --git a/arch/mips/pnx8550/common/setup.c b/arch/mips/pnx8550/common/setup.c
index 64246c9c875c..43cb3945fdbf 100644
--- a/arch/mips/pnx8550/common/setup.c
+++ b/arch/mips/pnx8550/common/setup.c
@@ -44,7 +44,6 @@
 extern void __init board_setup(void);
 extern void pnx8550_machine_restart(char *);
 extern void pnx8550_machine_halt(void);
-extern void pnx8550_machine_power_off(void);
 extern struct resource ioport_resource;
 extern struct resource iomem_resource;
 extern char *prom_getcmdline(void);
@@ -100,7 +99,7 @@ void __init plat_mem_setup(void)
        _machine_restart = pnx8550_machine_restart;
        _machine_halt = pnx8550_machine_halt;
-        pm_power_off = pnx8550_machine_power_off;
+        pm_power_off = pnx8550_machine_halt;
        /* Clear the Global 2 Register, PCI Inta Output Enable Registers
           Bit 1:Enable DAC Powerdown
diff --git a/arch/mn10300/kernel/module.c b/arch/mn10300/kernel/module.c
index 6aea7fd76993..196a111e2e29 100644
--- a/arch/mn10300/kernel/module.c
+++ b/arch/mn10300/kernel/module.c
@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                    const Elf_Shdr *sechdrs,
                    struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 /*
@@ -214,5 +214,4 @@ int module_finalize(const Elf_Ehdr *hdr,
 */
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 159a2b81e90c..6e81bb596e5b 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -941,11 +941,10 @@ int module_finalize(const Elf_Ehdr *hdr,
        nsyms = newptr - (Elf_Sym *)symhdr->sh_addr;
        DEBUGP("NEW num_symtab %lu\n", nsyms);
        symhdr->sh_size = nsyms * sizeof(Elf_Sym);
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
        deregister_unwind_table(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
index 477c663e0140..49cee9df225b 100644
--- a/arch/powerpc/kernel/module.c
+++ b/arch/powerpc/kernel/module.c
@@ -63,11 +63,6 @@ int module_finalize(const Elf_Ehdr *hdr,
                const Elf_Shdr *sechdrs, struct module *me)
 {
        const Elf_Shdr *sect;
-        int err;
-        err = module_bug_finalize(hdr, sechdrs, me);
-        if (err)
-                return err;
        /* Apply feature fixups */
        sect = find_section(hdr, sechdrs, "__ftr_fixup");
@@ -101,5 +96,4 @@ int module_finalize(const Elf_Ehdr *hdr,
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/platforms/512x/clock.c b/arch/powerpc/platforms/512x/clock.c
index 5b243bd3eb3b..3dc2a8d262b8 100644
--- a/arch/powerpc/platforms/512x/clock.c
+++ b/arch/powerpc/platforms/512x/clock.c
@@ -57,7 +57,7 @@ static struct clk *mpc5121_clk_get(struct device *dev, const char *id)
        int id_match = 0;
        if (dev == NULL || id == NULL)
-                return NULL;
+                return clk;
        mutex_lock(&clocks_mutex);
        list_for_each_entry(p, &clocks, node) {
diff --git a/arch/powerpc/platforms/52xx/efika.c b/arch/powerpc/platforms/52xx/efika.c
index 45c0cb9b67e6..18c104820198 100644
--- a/arch/powerpc/platforms/52xx/efika.c
+++ b/arch/powerpc/platforms/52xx/efika.c
@@ -99,7 +99,7 @@ static void __init efika_pcisetup(void)
        if (bus_range == NULL || len < 2 * sizeof(int)) {
                printk(KERN_WARNING EFIKA_PLATFORM_NAME
                       ": Can't get bus-range for %s\n", pcictrl->full_name);
-                return;
+                goto out_put;
        }
        if (bus_range[1] == bus_range[0])
@@ -111,12 +111,12 @@ static void __init efika_pcisetup(void)
        printk(" controlled by %s\n", pcictrl->full_name);
        printk("\n");
-        hose = pcibios_alloc_controller(of_node_get(pcictrl));
+        hose = pcibios_alloc_controller(pcictrl);
        if (!hose) {
                printk(KERN_WARNING EFIKA_PLATFORM_NAME
                       ": Can't allocate PCI controller structure for %s\n",
                       pcictrl->full_name);
-                return;
+                goto out_put;
        }
        hose->first_busno = bus_range[0];
@@ -124,6 +124,9 @@ static void __init efika_pcisetup(void)
        hose->ops = &rtas_pci_ops;
        pci_process_bridge_OF_ranges(hose, pcictrl, 0);
+        return;
+out_put:
+        of_node_put(pcictrl);
 }
 #else
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 6e905314ad5d..41f3a7eda1de 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -325,12 +325,16 @@ int mpc5200_psc_ac97_gpio_reset(int psc_number)
        clrbits32(&simple_gpio->simple_dvo, sync | out);
        clrbits8(&wkup_gpio->wkup_dvo, reset);
-        /* wait at lease 1 us */
+        /* wait for 1 us */
-        udelay(2);
+        udelay(1);
        /* Deassert reset */
        setbits8(&wkup_gpio->wkup_dvo, reset);
+        /* wait at least 200ns */
+        /* 7 ~= (200ns * timebase) / ns2sec */
+        __delay(7);
        /* Restore pin-muxing */
        out_be32(&simple_gpio->port_config, mux);
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 22cfd634c355..f7167ee4604c 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -407,10 +407,9 @@ int module_finalize(const Elf_Ehdr *hdr,
 {
        vfree(me->arch.syminfo);
        me->arch.syminfo = NULL;
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/sh/kernel/module.c b/arch/sh/kernel/module.c
index 43adddfe4c04..ae0be697a89e 100644
--- a/arch/sh/kernel/module.c
+++ b/arch/sh/kernel/module.c
@@ -149,13 +149,11 @@ int module_finalize(const Elf_Ehdr *hdr,
        int ret = 0;
        ret |= module_dwarf_finalize(hdr, sechdrs, me);
-        ret |= module_bug_finalize(hdr, sechdrs, me);
        return ret;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
        module_dwarf_cleanup(mod);
 }
diff --git a/arch/um/drivers/hostaudio_kern.c b/arch/um/drivers/hostaudio_kern.c
index 0c46e398cd8f..63c740a85b4c 100644
--- a/arch/um/drivers/hostaudio_kern.c
+++ b/arch/um/drivers/hostaudio_kern.c
@@ -40,6 +40,11 @@ static char *mixer = HOSTAUDIO_DEV_MIXER;
 "    This is used to specify the host mixer device to the hostaudio driver.\n"\
 "    The default is \"" HOSTAUDIO_DEV_MIXER "\".\n\n"
+module_param(dsp, charp, 0644);
+MODULE_PARM_DESC(dsp, DSP_HELP);
+module_param(mixer, charp, 0644);
+MODULE_PARM_DESC(mixer, MIXER_HELP);
 #ifndef MODULE
 static int set_dsp(char *name, int *add)
 {
@@ -56,15 +61,6 @@ static int set_mixer(char *name, int *add)
 }
 __uml_setup("mixer=", set_mixer, "mixer=<mixer device>\n" MIXER_HELP);
-#else /*MODULE*/
-module_param(dsp, charp, 0644);
-MODULE_PARM_DESC(dsp, DSP_HELP);
-module_param(mixer, charp, 0644);
-MODULE_PARM_DESC(mixer, MIXER_HELP);
 #endif
 /* /dev/dsp file operations */
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 2ab233ba32c1..47d0c37897d5 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -255,18 +255,6 @@ static void uml_net_tx_timeout(struct net_device *dev)
        netif_wake_queue(dev);
 }
-static int uml_net_set_mac(struct net_device *dev, void *addr)
-{
-        struct uml_net_private *lp = netdev_priv(dev);
-        struct sockaddr *hwaddr = addr;
-        spin_lock_irq(&lp->lock);
-        eth_mac_addr(dev, hwaddr->sa_data);
-        spin_unlock_irq(&lp->lock);
-        return 0;
-}
 static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
 {
        dev->mtu = new_mtu;
@@ -373,7 +361,7 @@ static const struct net_device_ops uml_netdev_ops = {
        .ndo_start_xmit         = uml_net_start_xmit,
        .ndo_set_multicast_list = uml_net_set_multicast_list,
        .ndo_tx_timeout         = uml_net_tx_timeout,
-        .ndo_set_mac_address    = uml_net_set_mac,
+        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = uml_net_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
 };
@@ -472,7 +460,8 @@ static void eth_configure(int n, void *init, char *mac,
            ((*transport->user->init)(&lp->user, dev) != 0))
                goto out_unregister;
-        eth_mac_addr(dev, device->mac);
+        /* don't use eth_mac_addr, it will not work here */
+        memcpy(dev->dev_addr, device->mac, ETH_ALEN);
        dev->mtu = transport->user->mtu;
        dev->netdev_ops = &uml_netdev_ops;
        dev->ethtool_ops = &uml_net_ethtool_ops;
diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index 1bcd208c459f..9734994cba1e 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c
@@ -163,6 +163,7 @@ struct ubd {
        struct scatterlist sg[MAX_SG];
        struct request *request;
        int start_sg, end_sg;
+        sector_t rq_pos;
 };
 #define DEFAULT_COW { \
@@ -187,6 +188,7 @@ struct ubd {
        .request =              NULL, \
        .start_sg =             0, \
        .end_sg =               0, \
+        .rq_pos =               0, \
 }
 /* Protected by ubd_lock */
@@ -1228,7 +1230,6 @@ static void do_ubd_request(struct request_queue *q)
 {
        struct io_thread_req *io_req;
        struct request *req;
-        sector_t sector;
        int n;
        while(1){
@@ -1239,12 +1240,12 @@ static void do_ubd_request(struct request_queue *q)
                                return;
                        dev->request = req;
+                        dev->rq_pos = blk_rq_pos(req);
                        dev->start_sg = 0;
                        dev->end_sg = blk_rq_map_sg(q, req, dev->sg);
                }
                req = dev->request;
-                sector = blk_rq_pos(req);
                while(dev->start_sg < dev->end_sg){
                        struct scatterlist *sg = &dev->sg[dev->start_sg];
@@ -1256,10 +1257,9 @@ static void do_ubd_request(struct request_queue *q)
                                return;
                        }
                        prepare_request(req, io_req,
-                                        (unsigned long long)sector << 9,
+                                        (unsigned long long)dev->rq_pos << 9,
                                        sg->offset, sg->length, sg_page(sg));
-                        sector += sg->length >> 9;
                        n = os_write_file(thread_fd, &io_req,
                                          sizeof(struct io_thread_req *));
                        if(n != sizeof(struct io_thread_req *)){
@@ -1272,6 +1272,7 @@ static void do_ubd_request(struct request_queue *q)
                                return;
                        }
+                        dev->rq_pos += sg->length >> 9;
                        dev->start_sg++;
                }
                dev->end_sg = 0;
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index 0350311906ae..2d93bdbc9ac0 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -34,7 +34,7 @@
 #include <asm/ia32.h>
 #undef WARN_OLD
-#undef CORE_DUMP /* probably broken */
+#undef CORE_DUMP /* definitely broken */
 static int load_aout_binary(struct linux_binprm *, struct pt_regs *regs);
 static int load_aout_library(struct file *);
@@ -131,21 +131,15 @@ static void set_brk(unsigned long start, unsigned long end)
 * macros to write out all the necessary info.
 */
-static int dump_write(struct file *file, const void *addr, int nr)
+#include <linux/coredump.h>
-{
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
 #define DUMP_WRITE(addr, nr)                         \
        if (!dump_write(file, (void *)(addr), (nr))) \
                goto end_coredump;
-#define DUMP_SEEK(offset)                                               \
+#define DUMP_SEEK(offset)               \
-        if (file->f_op->llseek) {                                       \
+        if (!dump_seek(file, offset))   \
-                if (file->f_op->llseek(file, (offset), 0) != (offset))  \
+                goto end_coredump;
-                        goto end_coredump;                              \
-        } else                                                          \
-                file->f_pos = (offset)
 #define START_DATA()    (u.u_tsize << PAGE_SHIFT)
 #define START_STACK(u)  (u.start_stack)
@@ -217,12 +211,6 @@ static int aout_core_dump(long signr, struct pt_regs *regs, struct file *file,
                dump_size = dump.u_ssize << PAGE_SHIFT;
                DUMP_WRITE(dump_start, dump_size);
        }
-        /*
-         * Finally dump the task struct.  Not be used by gdb, but
-         * could be useful
-         */
-        set_fs(KERNEL_DS);
-        DUMP_WRITE(current, sizeof(*current));
 end_coredump:
        set_fs(fs);
        return has_dumped;
diff --git a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
index 994230d4dc4e..4f6f679f2799 100644
--- a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
@@ -368,16 +368,22 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
                return -ENODEV;
        out_obj = output.pointer;
-        if (out_obj->type != ACPI_TYPE_BUFFER)
+        if (out_obj->type != ACPI_TYPE_BUFFER) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
        errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
-        if (errors)
+        if (errors) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
        supported = *((u32 *)(out_obj->buffer.pointer + 4));
-        if (!(supported & 0x1))
+        if (!(supported & 0x1)) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
 out_free:
        kfree(output.pointer);
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 5e975298fa81..39aaee5c1ab2 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -141,6 +141,7 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
                                address = (low & MASK_BLKPTR_LO) >> 21;
                                if (!address)
                                        break;
                                address += MCG_XBLK_ADDR;
                        } else
                                ++address;
@@ -148,12 +149,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
                        if (rdmsr_safe(address, &low, &high))
                                break;
-                        if (!(high & MASK_VALID_HI)) {
+                        if (!(high & MASK_VALID_HI))
-                                if (block)
+                                continue;
-                                        continue;
-                                else
-                                        break;
-                        }
                        if (!(high & MASK_CNTP_HI)  ||
                             (high & MASK_LOCKED_HI))
diff --git a/arch/x86/kernel/cpu/mcheck/therm_throt.c b/arch/x86/kernel/cpu/mcheck/therm_throt.c
index d9368eeda309..169d8804a9f8 100644
--- a/arch/x86/kernel/cpu/mcheck/therm_throt.c
+++ b/arch/x86/kernel/cpu/mcheck/therm_throt.c
@@ -216,7 +216,7 @@ static __cpuinit int thermal_throttle_add_dev(struct sys_device *sys_dev,
                err = sysfs_add_file_to_group(&sys_dev->kobj,
                                              &attr_core_power_limit_count.attr,
                                              thermal_attr_group.name);
-        if (cpu_has(c, X86_FEATURE_PTS))
+        if (cpu_has(c, X86_FEATURE_PTS)) {
                err = sysfs_add_file_to_group(&sys_dev->kobj,
                                              &attr_package_throttle_count.attr,
                                              thermal_attr_group.name);
@@ -224,6 +224,7 @@ static __cpuinit int thermal_throttle_add_dev(struct sys_device *sys_dev,
                        err = sysfs_add_file_to_group(&sys_dev->kobj,
                                        &attr_package_power_limit_count.attr,
                                        thermal_attr_group.name);
+        }
        return err;
 }
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index b560db3305be..249015173992 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -660,8 +660,12 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
        for (idx = 0; idx < x86_pmu.num_counters; idx++) {
                int overflow;
-                if (!test_bit(idx, cpuc->active_mask))
+                if (!test_bit(idx, cpuc->active_mask)) {
+                        /* catch in-flight IRQs */
+                        if (__test_and_clear_bit(idx, cpuc->running))
+                                handled++;
                        continue;
+                }
                event = cpuc->events[idx];
                hwc = &event->hw;
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index e0bc186d7501..1c355c550960 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -239,11 +239,10 @@ int module_finalize(const Elf_Ehdr *hdr,
                apply_paravirt(pseg, pseg + para->sh_size);
        }
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
        alternatives_smp_module_del(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index bc5b9b8d4a33..81ed28cb36e6 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -766,7 +766,6 @@ static void init_vmcb(struct vcpu_svm *svm)
        control->iopm_base_pa = iopm_base;
        control->msrpm_base_pa = __pa(svm->msrpm);
-        control->tsc_offset = 0;
        control->int_ctl = V_INTR_MASKING_MASK;
        init_seg(&save->es);
@@ -902,6 +901,7 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
        svm->vmcb_pa = page_to_pfn(page) << PAGE_SHIFT;
        svm->asid_generation = 0;
        init_vmcb(svm);
+        svm->vmcb->control.tsc_offset = 0-native_read_tsc();
        err = fx_init(&svm->vcpu);
        if (err)
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index f9897f7a9ef1..9c0d0d399c30 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -420,9 +420,11 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
                return -1;
        }
-        for_each_node_mask(i, nodes_parsed)
+        for (i = 0; i < num_node_memblks; i++)
-                e820_register_active_regions(i, nodes[i].start >> PAGE_SHIFT,
+                e820_register_active_regions(memblk_nodeid[i],
-                                                nodes[i].end >> PAGE_SHIFT);
+                                node_memblk_range[i].start >> PAGE_SHIFT,
+                                node_memblk_range[i].end >> PAGE_SHIFT);
        /* for out of order entries in SRAT */
        sort_node_map();
        if (!nodes_cover_memory(nodes)) {
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 009b819f48d0..f1575c9a2572 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -674,6 +674,7 @@ static int __init ppro_init(char **cpu_type)
        case 0x0f:
        case 0x16:
        case 0x17:
+        case 0x1d:
                *cpu_type = "i386/core_2";
                break;
        case 0x1a:
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 1a5353a753fc..b2bb5aa3b054 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -489,8 +489,9 @@ static void xen_hvm_setup_cpu_clockevents(void)
 __init void xen_hvm_init_time_ops(void)
 {
        /* vector callback is needed otherwise we cannot receive interrupts
-         * on cpu > 0 */
+         * on cpu > 0 and at this point we don't know how many cpus are
-        if (!xen_have_vector_callback && num_present_cpus() > 1)
+         * available */
+        if (!xen_have_vector_callback)
                return;
        if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
                printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
diff --git a/block/elevator.c b/block/elevator.c
index 205b09a5bd9e..4e11559aa2b0 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -938,6 +938,7 @@ int elv_register_queue(struct request_queue *q)
                        }
                }
                kobject_uevent(&e->kobj, KOBJ_ADD);
+                e->registered = 1;
        }
        return error;
 }
@@ -947,6 +948,7 @@ static void __elv_unregister_queue(struct elevator_queue *e)
 {
        kobject_uevent(&e->kobj, KOBJ_REMOVE);
        kobject_del(&e->kobj);
+        e->registered = 0;
 }
 void elv_unregister_queue(struct request_queue *q)
@@ -1042,11 +1044,13 @@ static int elevator_switch(struct request_queue *q, struct elevator_type *new_e)
        spin_unlock_irq(q->queue_lock);
-        __elv_unregister_queue(old_elevator);
+        if (old_elevator->registered) {
+                __elv_unregister_queue(old_elevator);
-        err = elv_register_queue(q);
+                err = elv_register_queue(q);
-        if (err)
+                if (err)
-                goto fail_register;
+                        goto fail_register;
+        }
        /*
         * finally exit old elevator and turn off BYPASS.
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index f7619600270a..af308d03f492 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -204,6 +204,23 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                },
        },
        {
+        /*
+         * There have a NVIF method in MSI GX723 DSDT need call by Nvidia
+         * driver (e.g. nouveau) when user press brightness hotkey.
+         * Currently, nouveau driver didn't do the job and it causes there
+         * have a infinite while loop in DSDT when user press hotkey.
+         * We add MSI GX723's dmi information to this table for workaround
+         * this issue.
+         * Will remove MSI GX723 from the table after nouveau grows support.
+         */
+        .callback = dmi_disable_osi_vista,
+        .ident = "MSI GX723",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "GX723"),
+                },
+        },
+        {
        .callback = dmi_disable_osi_vista,
        .ident = "Sony VGN-NS10J_S",
        .matches = {
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index b618f888d66b..bec561c14beb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -346,4 +346,5 @@ void __init acpi_early_processor_set_pdc(void)
        acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                            ACPI_UINT32_MAX,
                            early_init_pdc, NULL, NULL, NULL);
+        acpi_get_devices("ACPI0007", early_init_pdc, NULL, NULL);
 }
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ee9ddeb53417..8cb0347dec28 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3156,7 +3156,6 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
 {  
        struct atm_dev *dev;  
        IADEV *iadev;  
-        unsigned long flags;
        int ret;
        iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
@@ -3188,19 +3187,14 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
        ia_dev[iadev_count] = iadev;
        _ia_dev[iadev_count] = dev;
        iadev_count++;
-        spin_lock_init(&iadev->misc_lock);
-        /* First fixes first. I don't want to think about this now. */
-        spin_lock_irqsave(&iadev->misc_lock, flags); 
        if (ia_init(dev) || ia_start(dev)) {  
                IF_INIT(printk("IA register failed!\n");)
                iadev_count--;
                ia_dev[iadev_count] = NULL;
                _ia_dev[iadev_count] = NULL;
-                spin_unlock_irqrestore(&iadev->misc_lock, flags); 
                ret = -EINVAL;
                goto err_out_deregister_dev;
        }
-        spin_unlock_irqrestore(&iadev->misc_lock, flags); 
        IF_EVENT(printk("iadev_count = %d\n", iadev_count);)
        iadev->next_board = ia_boards;  
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index b2cd20f549cb..077735e0e04b 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -1022,7 +1022,7 @@ typedef struct iadev_t {
        struct dle_q rx_dle_q;  
        struct free_desc_q *rx_free_desc_qhead;  
        struct sk_buff_head rx_dma_q;  
-        spinlock_t rx_lock, misc_lock;
+        spinlock_t rx_lock;
        struct atm_vcc **rx_open;       /* list of all open VCs */  
        u16 num_rx_desc, rx_buf_sz, rxing;
        u32 rx_pkt_ram, rx_tmp_cnt;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index f916ddf63938..f46138ab38b6 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
        struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
        struct solos_card *card = atmdev->dev_data;
        struct sk_buff *skb;
+        unsigned int len;
        spin_lock(&card->cli_queue_lock);
        skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
        if(skb == NULL)
                return sprintf(buf, "No data.\n");
-        memcpy(buf, skb->data, skb->len);
+        len = skb->len;
-        dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+        memcpy(buf, skb->data, len);
+        dev_dbg(&card->dev->dev, "len: %d\n", len);
        kfree_skb(skb);
-        return skb->len;
+        return len;
 }
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
index e9da874d0419..03688c2da319 100644
--- a/drivers/block/ps3disk.c
+++ b/drivers/block/ps3disk.c
@@ -113,7 +113,7 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,
                        memcpy(buf, dev->bounce_buf+offset, size);
                offset += size;
                flush_kernel_dcache_page(bvec->bv_page);
-                bvec_kunmap_irq(bvec, &flags);
+                bvec_kunmap_irq(buf, &flags);
                i++;
        }
 }
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2aafafca2b13..1101e251a629 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -202,6 +202,7 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
        struct virtio_blk *vblk = disk->private_data;
        struct request *req;
        struct bio *bio;
+        int err;
        bio = bio_map_kern(vblk->disk->queue, id_str, VIRTIO_BLK_ID_BYTES,
                           GFP_KERNEL);
@@ -215,7 +216,10 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
        }
        req->cmd_type = REQ_TYPE_SPECIAL;
-        return blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        err = blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        blk_put_request(req);
+        return err;
 }
 static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 216f9d383b5b..effd140fc042 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -879,7 +879,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
        dma->device_issue_pending = ioat2_issue_pending;
        dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
        dma->device_free_chan_resources = ioat2_free_chan_resources;
-        dma->device_tx_status = ioat_tx_status;
+        dma->device_tx_status = ioat_dma_tx_status;
        err = ioat_probe(device);
        if (err)
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 1b05896648bc..9dcb17d51aee 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2840,7 +2840,7 @@ static int __devinit pci_probe(struct pci_dev *dev,
                               const struct pci_device_id *ent)
 {
        struct fw_ohci *ohci;
-        u32 bus_options, max_receive, link_speed, version, link_enh;
+        u32 bus_options, max_receive, link_speed, version;
        u64 guid;
        int i, err, n_ir, n_it;
        size_t size;
@@ -2894,23 +2894,6 @@ static int __devinit pci_probe(struct pci_dev *dev,
        if (param_quirks)
                ohci->quirks = param_quirks;
-        /* TI OHCI-Lynx and compatible: set recommended configuration bits. */
-        if (dev->vendor == PCI_VENDOR_ID_TI) {
-                pci_read_config_dword(dev, PCI_CFG_TI_LinkEnh, &link_enh);
-                /* adjust latency of ATx FIFO: use 1.7 KB threshold */
-                link_enh &= ~TI_LinkEnh_atx_thresh_mask;
-                link_enh |= TI_LinkEnh_atx_thresh_1_7K;
-                /* use priority arbitration for asynchronous responses */
-                link_enh |= TI_LinkEnh_enab_unfair;
-                /* required for aPhyEnhanceEnable to work */
-                link_enh |= TI_LinkEnh_enab_accel;
-                pci_write_config_dword(dev, PCI_CFG_TI_LinkEnh, link_enh);
-        }
        ar_context_init(&ohci->ar_request_ctx, ohci,
                        OHCI1394_AsReqRcvContextControlSet);
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 0e6c5a466908..ef5e7336da68 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -155,12 +155,4 @@
 #define OHCI1394_phy_tcode              0xe
-/* TI extensions */
-#define PCI_CFG_TI_LinkEnh              0xf4
-#define  TI_LinkEnh_enab_accel          0x00000002
-#define  TI_LinkEnh_enab_unfair         0x00000080
-#define  TI_LinkEnh_atx_thresh_mask     0x00003000
-#define  TI_LinkEnh_atx_thresh_1_7K     0x00001000
 #endif /* _FIREWIRE_OHCI_H */
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9d67b4853030..2dd2c93ebfa3 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
                }
        }
-        div_u64(diff, diff1);
+        diff = div_u64(diff, diff1);
        ret = ((m * diff) + c);
-        div_u64(ret, 10);
+        ret = div_u64(ret, 10);
        dev_priv->last_count1 = total_count;
        dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
        /* More magic constants... */
        diff = diff * 1181;
-        div_u64(diff, diffms * 10);
+        diff = div_u64(diff, diffms * 10);
        dev_priv->gfx_power = diff;
 }
@@ -2231,6 +2231,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        dev_priv->mchdev_lock = &mchdev_lock;
        spin_unlock(&mchdev_lock);
+        /* XXX Prevent module unload due to memory corruption bugs. */
+        __module_get(THIS_MODULE);
        return 0;
 out_workqueue_free:
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 2a0025f3e98e..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -469,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check source.
+        /* Bounds check source.  */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_WRITE,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -488,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                        file_priv);
        }
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -578,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
        mutex_lock(&dev->struct_mutex);
@@ -932,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check destination.
+        /* Bounds check destination. */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_READ,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -973,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                DRM_INFO("pwrite failed %d\n", ret);
 #endif
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -3256,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                  (int) reloc->offset,
                                  reloc->read_domains,
                                  reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                        return -EINVAL;
                }
                if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index e85246ef691c..5c428fa3e0b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -93,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
+        struct drm_i915_gem_object *obj_priv;
        struct list_head *render_iter, *bsd_iter;
        int ret = 0;
@@ -175,39 +175,34 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
        return -ENOSPC;
 found:
+        /* drm_mm doesn't allow any other other operations while
+         * scanning, therefore store to be evicted objects on a
+         * temporary list. */
        INIT_LIST_HEAD(&eviction_list);
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&unwind_list)) {
-                                 &unwind_list, evict_list) {
+                obj_priv = list_first_entry(&unwind_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
                if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
-                        /* drm_mm doesn't allow any other other operations while
-                         * scanning, therefore store to be evicted objects on a
-                         * temporary list. */
                        list_move(&obj_priv->evict_list, &eviction_list);
-                } else
+                        continue;
-                        drm_gem_object_unreference(&obj_priv->base);
+                }
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
        }
        /* Unbinding will emit any required flushes */
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&eviction_list)) {
-                                 &eviction_list, evict_list) {
+                obj_priv = list_first_entry(&eviction_list,
-#if WATCH_LRU
+                                            struct drm_i915_gem_object,
-                DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
+                                            evict_list);
-#endif
+                if (ret == 0)
-                ret = i915_gem_object_unbind(&obj_priv->base);
+                        ret = i915_gem_object_unbind(&obj_priv->base);
-                if (ret)
+                list_del(&obj_priv->evict_list);
-                        return ret;
                drm_gem_object_unreference(&obj_priv->base);
        }
-        /* The just created free hole should be on the top of the free stack
+        return ret;
-         * maintained by drm_mm, so this BUG_ON actually executes in O(1).
-         * Furthermore all accessed data has just recently been used, so it
-         * should be really fast, too. */
-        BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
-                                   alignment, 0));
-        return 0;
 }
 int
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index b5bf51a4502d..979228594599 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
                DRM_DEBUG_KMS("vblank wait timed out\n");
 }
-/**
+/*
- * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
+ * intel_wait_for_pipe_off - wait for pipe to turn off
 * @dev: drm device
 * @pipe: pipe to wait for
 *
@@ -1022,25 +1022,39 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
 * spinning on the vblank interrupt status bit, since we won't actually
 * see an interrupt when the pipe is disabled.
 *
- * So this function waits for the display line value to settle (it
+ * On Gen4 and above:
- * usually ends up stopping at the start of the next frame).
+ *   wait for the pipe register state bit to turn off
+ *
+ * Otherwise:
+ *   wait for the display line value to settle (it usually
+ *   ends up stopping at the start of the next frame).
+ *  
 */
-void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
+static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        unsigned long timeout = jiffies + msecs_to_jiffies(100);
+        if (INTEL_INFO(dev)->gen >= 4) {
-        u32 last_line;
+                int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
-        /* Wait for the display line to settle */
+                /* Wait for the Pipe State to go off */
-        do {
+                if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
-                last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                             100, 0))
-                mdelay(5);
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
-        } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+        } else {
-                 time_after(timeout, jiffies));
+                u32 last_line;
+                int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        if (time_after(jiffies, timeout))
+                unsigned long timeout = jiffies + msecs_to_jiffies(100);
-                DRM_DEBUG_KMS("vblank wait timed out\n");
+                /* Wait for the display line to settle */
+                do {
+                        last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                        mdelay(5);
+                } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+                         time_after(timeout, jiffies));
+                if (time_after(jiffies, timeout))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        }
 }
 /* Parameters have changed, update FBC info */
@@ -2328,13 +2342,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(dspbase_reg);
                }
-                /* Wait for vblank for the disable to take effect */
-                intel_wait_for_vblank_off(dev, pipe);
                /* Don't disable pipe A or pipe A PLLs if needed */
                if (pipeconf_reg == PIPEACONF &&
-                    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
+                        /* Wait for vblank for the disable to take effect */
+                        intel_wait_for_vblank(dev, pipe);
                        goto skip_pipe_off;
+                }
                /* Next, disable display pipes */
                temp = I915_READ(pipeconf_reg);
@@ -2343,8 +2357,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(pipeconf_reg);
                }
-                /* Wait for vblank for the disable to take effect. */
+                /* Wait for the pipe to turn off */
-                intel_wait_for_vblank_off(dev, pipe);
+                intel_wait_for_pipe_off(dev, pipe);
                temp = I915_READ(dpll_reg);
                if ((temp & DPLL_VCO_ENABLE) != 0) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1a51ee07de3e..9ab8708ac6ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,18 +1138,14 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                        uint32_t dp_reg_value,
                        uint8_t dp_train_pat,
-                        uint8_t train_set[4],
+                        uint8_t train_set[4])
-                        bool first)
 {
        struct drm_device *dev = intel_dp->base.enc.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
        int ret;
        I915_WRITE(intel_dp->output_reg, dp_reg_value);
        POSTING_READ(intel_dp->output_reg);
-        if (first)
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
        intel_dp_aux_native_write_1(intel_dp,
                                    DP_TRAINING_PATTERN_SET,
@@ -1174,10 +1170,15 @@ intel_dp_link_train(struct intel_dp *intel_dp)
        uint8_t voltage;
        bool clock_recovery = false;
        bool channel_eq = false;
-        bool first = true;
        int tries;
        u32 reg;
        uint32_t DP = intel_dp->DP;
+        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
+        /* Enable output, wait for it to become active */
+        I915_WRITE(intel_dp->output_reg, intel_dp->DP);
+        POSTING_READ(intel_dp->output_reg);
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
        /* Write the link configuration data */
        intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1210,9 +1211,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                        reg = DP | DP_LINK_TRAIN_PAT_1;
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_1, train_set, first))
+                                             DP_TRAINING_PATTERN_1, train_set))
                        break;
-                first = false;
                /* Set training pattern 1 */
                udelay(100);
@@ -1266,8 +1266,7 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                /* channel eq pattern */
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_2, train_set,
+                                             DP_TRAINING_PATTERN_2, train_set))
-                                             false))
                        break;
                udelay(400);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ad312ca6b3e5..8828b3ac6414 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -229,7 +229,6 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                    struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
-extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 56ad9df2ccb5..b61966c126d3 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -238,8 +238,8 @@ int intel_fbdev_destroy(struct drm_device *dev,
        drm_framebuffer_cleanup(&ifb->base);
        if (ifb->obj) {
-                drm_gem_object_handle_unreference(ifb->obj);
                drm_gem_object_unreference(ifb->obj);
+                ifb->obj = NULL;
        }
        return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index d2047713dc59..dbd30b2e43fd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,7 +352,6 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
        if (nouveau_fb->nvbo) {
                nouveau_bo_unmap(nouveau_fb->nvbo);
-                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                nouveau_fb->nvbo = NULL;
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3c9964a8fbad..3ec181ff50ce 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,7 +79,6 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
        mutex_lock(&dev->struct_mutex);
        nouveau_bo_unpin(chan->notifier_bo);
        mutex_unlock(&dev->struct_mutex);
-        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
        drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
        drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 79082d4398ae..2f93d46ae69a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1137,7 +1137,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                WREG32(RCU_IND_INDEX, 0x203);
                efuse_straps_3 = RREG32(RCU_IND_DATA);
-                efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
+                efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
                switch(efuse_box_bit_127_124) {
                case 0x0:
@@ -1407,6 +1407,7 @@ int evergreen_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
@@ -1520,7 +1521,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
 {
        u32 tmp;
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
        WREG32(GRBM_INT_CNTL, 0);
        WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
        WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e151f16a8f86..e59422320bb6 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1030,6 +1030,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                return r;
        }
        rdev->cp.ready = true;
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
        return 0;
 }
@@ -1047,6 +1048,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
        /* Disable ring */
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        rdev->cp.ready = false;
        WREG32(RADEON_CP_CSQ_MODE, 0);
        WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2295,6 +2297,7 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
        /* FIXME we don't use the second aperture yet when we could use it */
        if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
        if (rdev->flags & RADEON_IS_IGP) {
                uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7a04959ba0ee..7b65e4efe8af 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1248,6 +1248,7 @@ int r600_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        if (rdev->flags & RADEON_IS_IGP) {
@@ -1917,6 +1918,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 */
 void r600_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
 }
@@ -2910,7 +2912,7 @@ static void r600_disable_interrupt_state(struct radeon_device *rdev)
 {
        u32 tmp;
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
        WREG32(GRBM_INT_CNTL, 0);
        WREG32(DxMODE_INT_MASK, 0);
        if (ASIC_IS_DCE3(rdev)) {
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 9ceb2a1ce799..3473c00781ff 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -532,6 +532,7 @@ int r600_blit_init(struct radeon_device *rdev)
        memcpy(ptr + rdev->r600_blit.ps_offset, r6xx_ps, r6xx_ps_size * 4);
        radeon_bo_kunmap(rdev->r600_blit.shader_obj);
        radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
        return 0;
 }
@@ -539,6 +540,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
        int r;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        if (rdev->r600_blit.shader_obj == NULL)
                return;
        /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a168d644bf9e..9ff38c99a6ea 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -344,6 +344,7 @@ struct radeon_mc {
         * about vram size near mc fb location */
        u64                     mc_vram_size;
        u64                     visible_vram_size;
+        u64                     active_vram_size;
        u64                     gtt_size;
        u64                     gtt_start;
        u64                     gtt_end;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 68932ba7b8a4..8e43ddae70cc 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1558,39 +1558,39 @@ radeon_atombios_get_tv_info(struct radeon_device *rdev)
                switch (tv_info->ucTV_BootUpDefaultStandard) {
                case ATOM_TV_NTSC:
                        tv_std = TV_STD_NTSC;
-                        DRM_INFO("Default TV standard: NTSC\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                        break;
                case ATOM_TV_NTSCJ:
                        tv_std = TV_STD_NTSC_J;
-                        DRM_INFO("Default TV standard: NTSC-J\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                        break;
                case ATOM_TV_PAL:
                        tv_std = TV_STD_PAL;
-                        DRM_INFO("Default TV standard: PAL\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL\n");
                        break;
                case ATOM_TV_PALM:
                        tv_std = TV_STD_PAL_M;
-                        DRM_INFO("Default TV standard: PAL-M\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                        break;
                case ATOM_TV_PALN:
                        tv_std = TV_STD_PAL_N;
-                        DRM_INFO("Default TV standard: PAL-N\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-N\n");
                        break;
                case ATOM_TV_PALCN:
                        tv_std = TV_STD_PAL_CN;
-                        DRM_INFO("Default TV standard: PAL-CN\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-CN\n");
                        break;
                case ATOM_TV_PAL60:
                        tv_std = TV_STD_PAL_60;
-                        DRM_INFO("Default TV standard: PAL-60\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                        break;
                case ATOM_TV_SECAM:
                        tv_std = TV_STD_SECAM;
-                        DRM_INFO("Default TV standard: SECAM\n");
+                        DRM_DEBUG_KMS("Default TV standard: SECAM\n");
                        break;
                default:
                        tv_std = TV_STD_NTSC;
-                        DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+                        DRM_DEBUG_KMS("Unknown TV standard; defaulting to NTSC\n");
                        break;
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index a04b7a6ad95f..7b7ea269549c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -913,47 +913,47 @@ radeon_combios_get_tv_info(struct radeon_device *rdev)
                        switch (RBIOS8(tv_info + 7) & 0xf) {
                        case 1:
                                tv_std = TV_STD_NTSC;
-                                DRM_INFO("Default TV standard: NTSC\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                                break;
                        case 2:
                                tv_std = TV_STD_PAL;
-                                DRM_INFO("Default TV standard: PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL\n");
                                break;
                        case 3:
                                tv_std = TV_STD_PAL_M;
-                                DRM_INFO("Default TV standard: PAL-M\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                                break;
                        case 4:
                                tv_std = TV_STD_PAL_60;
-                                DRM_INFO("Default TV standard: PAL-60\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                                break;
                        case 5:
                                tv_std = TV_STD_NTSC_J;
-                                DRM_INFO("Default TV standard: NTSC-J\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                                break;
                        case 6:
                                tv_std = TV_STD_SCART_PAL;
-                                DRM_INFO("Default TV standard: SCART-PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: SCART-PAL\n");
                                break;
                        default:
                                tv_std = TV_STD_NTSC;
-                                DRM_INFO
+                                DRM_DEBUG_KMS
                                    ("Unknown TV standard; defaulting to NTSC\n");
                                break;
                        }
                        switch ((RBIOS8(tv_info + 9) >> 2) & 0x3) {
                        case 0:
-                                DRM_INFO("29.498928713 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("29.498928713 MHz TV ref clk\n");
                                break;
                        case 1:
-                                DRM_INFO("28.636360000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("28.636360000 MHz TV ref clk\n");
                                break;
                        case 2:
-                                DRM_INFO("14.318180000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("14.318180000 MHz TV ref clk\n");
                                break;
                        case 3:
-                                DRM_INFO("27.000000000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("27.000000000 MHz TV ref clk\n");
                                break;
                        default:
                                break;
@@ -1324,7 +1324,7 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
        if (tmds_info) {
                ver = RBIOS8(tmds_info);
-                DRM_INFO("DFP table revision: %d\n", ver);
+                DRM_DEBUG_KMS("DFP table revision: %d\n", ver);
                if (ver == 3) {
                        n = RBIOS8(tmds_info + 5) + 1;
                        if (n > 4)
@@ -1408,7 +1408,7 @@ bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder
                offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
                if (offset) {
                        ver = RBIOS8(offset);
-                        DRM_INFO("External TMDS Table revision: %d\n", ver);
+                        DRM_DEBUG_KMS("External TMDS Table revision: %d\n", ver);
                        tmds->slave_addr = RBIOS8(offset + 4 + 2);
                        tmds->slave_addr >>= 1; /* 7 bit addressing */
                        gpio = RBIOS8(offset + 4 + 3);
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 9cdf6a35bc2c..40b0c087b592 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -97,7 +97,6 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
                radeon_bo_unpin(rbo);
                radeon_bo_unreserve(rbo);
        }
-        drm_gem_object_handle_unreference(gobj);
        drm_gem_object_unreference_unlocked(gobj);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 0afd1e62347d..b3b5306bb578 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -69,7 +69,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
        u32 c = 0;
        rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = 0;
+        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
        rbo->placement.placement = rbo->placements;
        rbo->placement.busy_placement = rbo->placements;
        if (domain & RADEON_GEM_DOMAIN_VRAM)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 353998dc2c03..3481bc7f6f58 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -124,11 +124,8 @@ static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
        int r;
        r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
-        if (unlikely(r != 0)) {
+        if (unlikely(r != 0))
-                if (r != -ERESTARTSYS)
-                        dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
                return r;
-        }
        spin_lock(&bo->tbo.lock);
        if (mem_type)
                *mem_type = bo->tbo.mem.mem_type;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index cc05b230d7ef..51d5f7b5ab21 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -693,6 +693,7 @@ void rs600_mc_init(struct radeon_device *rdev)
        rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
        base = RREG32_MC(R_000004_MC_FB_LOCATION);
        base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3e3f75718be3..4dc2a87ea680 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,6 +157,7 @@ void rs690_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
        base = G_000100_MC_FB_START(base) << 16;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index bfa59db374d2..9490da700749 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -267,6 +267,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
 */
 void r700_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
 }
@@ -992,6 +993,7 @@ int rv770_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index cb4cf7ef4d1e..db809e034cc4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -442,6 +442,43 @@ out_err:
 }
 /**
+ * Call bo::reserved and with the lru lock held.
+ * Will release GPU memory type usage on destruction.
+ * This is the place to put in driver specific hooks.
+ * Will release the bo::reserved lock and the
+ * lru lock on exit.
+ */
+static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
+{
+        struct ttm_bo_global *glob = bo->glob;
+        if (bo->ttm) {
+                /**
+                 * Release the lru_lock, since we don't want to have
+                 * an atomic requirement on ttm_tt[unbind|destroy].
+                 */
+                spin_unlock(&glob->lru_lock);
+                ttm_tt_unbind(bo->ttm);
+                ttm_tt_destroy(bo->ttm);
+                bo->ttm = NULL;
+                spin_lock(&glob->lru_lock);
+        }
+        if (bo->mem.mm_node) {
+                drm_mm_put_block(bo->mem.mm_node);
+                bo->mem.mm_node = NULL;
+        }
+        atomic_set(&bo->reserved, 0);
+        wake_up_all(&bo->event_queue);
+        spin_unlock(&glob->lru_lock);
+}
+/**
 * If bo idle, remove from delayed- and lru lists, and unref.
 * If not idle, and already on delayed list, do nothing.
 * If not idle, and not on delayed list, put on delayed list,
@@ -456,6 +493,7 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
        int ret;
        spin_lock(&bo->lock);
+retry:
        (void) ttm_bo_wait(bo, false, false, !remove_all);
        if (!bo->sync_obj) {
@@ -464,31 +502,52 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                spin_unlock(&bo->lock);
                spin_lock(&glob->lru_lock);
-                put_count = ttm_bo_del_from_lru(bo);
+                ret = ttm_bo_reserve_locked(bo, false, !remove_all, false, 0);
+                /**
+                 * Someone else has the object reserved. Bail and retry.
+                 */
-                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
+                if (unlikely(ret == -EBUSY)) {
-                BUG_ON(ret);
+                        spin_unlock(&glob->lru_lock);
-                if (bo->ttm)
+                        spin_lock(&bo->lock);
-                        ttm_tt_unbind(bo->ttm);
+                        goto requeue;
+                }
+                /**
+                 * We can re-check for sync object without taking
+                 * the bo::lock since setting the sync object requires
+                 * also bo::reserved. A busy object at this point may
+                 * be caused by another thread starting an accelerated
+                 * eviction.
+                 */
+                if (unlikely(bo->sync_obj)) {
+                        atomic_set(&bo->reserved, 0);
+                        wake_up_all(&bo->event_queue);
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        if (remove_all)
+                                goto retry;
+                        else
+                                goto requeue;
+                }
+                put_count = ttm_bo_del_from_lru(bo);
                if (!list_empty(&bo->ddestroy)) {
                        list_del_init(&bo->ddestroy);
                        ++put_count;
                }
-                if (bo->mem.mm_node) {
-                        drm_mm_put_block(bo->mem.mm_node);
-                        bo->mem.mm_node = NULL;
-                }
-                spin_unlock(&glob->lru_lock);
-                atomic_set(&bo->reserved, 0);
+                ttm_bo_cleanup_memtype_use(bo);
                while (put_count--)
                        kref_put(&bo->list_kref, ttm_bo_ref_bug);
                return 0;
        }
+requeue:
        spin_lock(&glob->lru_lock);
        if (list_empty(&bo->ddestroy)) {
                void *sync_obj = bo->sync_obj;
diff --git a/drivers/hid/hid-cando.c b/drivers/hid/hid-cando.c
index 4267a6fdc277..5925bdcd417d 100644
--- a/drivers/hid/hid-cando.c
+++ b/drivers/hid/hid-cando.c
@@ -237,6 +237,8 @@ static const struct hid_device_id cando_devices[] = {
                        USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
                        USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+                USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
        { }
 };
 MODULE_DEVICE_TABLE(hid, cando_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3f7292486024..a0dea3d1296e 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1292,6 +1292,7 @@ static const struct hid_device_id hid_blacklist[] = {
        { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
        { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 765a4f53eb5c..c5ae5f1545bd 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -134,6 +134,7 @@
 #define USB_VENDOR_ID_CANDO             0x2087
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
 #define USB_VENDOR_ID_CH                0x068e
 #define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
@@ -503,6 +504,7 @@
 #define USB_VENDOR_ID_TURBOX            0x062a
 #define USB_DEVICE_ID_TURBOX_KEYBOARD   0x0201
+#define USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART 0x7100
 #define USB_VENDOR_ID_TWINHAN           0x6253
 #define USB_DEVICE_ID_TWINHAN_IR_REMOTE 0x0100
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 47d70c523d93..a3866b5c0c43 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -109,6 +109,12 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t
        int ret = 0;
        mutex_lock(&minors_lock);
+        if (!hidraw_table[minor]) {
+                ret = -ENODEV;
+                goto out;
+        }
        dev = hidraw_table[minor]->hid;
        if (!dev->hid_output_raw_report) {
@@ -244,6 +250,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
        mutex_lock(&minors_lock);
        dev = hidraw_table[minor];
+        if (!dev) {
+                ret = -ENODEV;
+                goto out;
+        }
        switch (cmd) {
                case HIDIOCGRDESCSIZE:
@@ -317,6 +327,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
                ret = -ENOTTY;
        }
+out:
        mutex_unlock(&minors_lock);
        return ret;
 }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 70da3181c8a0..f0260c699adb 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -36,6 +36,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
        { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..75afb3b0e076 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline void superio_enter(int base);
+static inline int superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
@@ -861,11 +861,20 @@ static int superio_inw(int base, int reg)
        return val;
 }
-static inline void superio_enter(int base)
+static inline int superio_enter(int base)
 {
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                base);
+                return -EBUSY;
+        }
        /* according to the datasheet the key must be send twice! */
        outb(SIO_UNLOCK_KEY, base);
        outb(SIO_UNLOCK_KEY, base);
+        return 0;
 }
 static inline void superio_select(int base, int ld)
@@ -877,6 +886,7 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
        outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
 }
 static inline int fan_from_reg(u16 reg)
@@ -2175,21 +2185,15 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
        struct f71882fg_sio_data *sio_data)
 {
-        int err = -ENODEV;
        u16 devid;
+        int err = superio_enter(sioaddr);
-        /* Don't step on other drivers' I/O space by accident */
+        if (err)
-        if (!request_region(sioaddr, 2, DRVNAME)) {
+                return err;
-                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-                                (int)sioaddr);
-                return -EBUSY;
-        }
-        superio_enter(sioaddr);
        devid = superio_inw(sioaddr, SIO_REG_MANID);
        if (devid != SIO_FINTEK_ID) {
                pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
                goto exit;
        }
@@ -2213,6 +2217,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        default:
                printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
                       (unsigned int)devid);
+                err = -ENODEV;
                goto exit;
        }
@@ -2223,12 +2228,14 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
                printk(KERN_WARNING DRVNAME ": Device not activated\n");
+                err = -ENODEV;
                goto exit;
        }
        *address = superio_inw(sioaddr, SIO_REG_ADDR);
        if (*address == 0) {
                printk(KERN_WARNING DRVNAME ": Base address not set\n");
+                err = -ENODEV;
                goto exit;
        }
        *address &= ~(REGION_LENGTH - 1);       /* Ignore 3 LSB */
@@ -2239,7 +2246,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
                (int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
        superio_exit(sioaddr);
-        release_region(sioaddr, 2);
        return err;
 }
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f7bd2613cecc..f2de3be35df3 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -677,6 +677,11 @@ static int __devinit cpm_i2c_probe(struct platform_device *ofdev,
        dev_dbg(&ofdev->dev, "hw routines for %s registered.\n",
                cpm->adap.name);
+        /*
+         * register OF I2C devices
+         */
+        of_i2c_register_devices(&cpm->adap);
        return 0;
 out_shut:
        cpm_i2c_shutdown(cpm);
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index b8feac5f2ef4..5795c8398c7c 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -331,21 +331,16 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
        INIT_COMPLETION(dev->cmd_complete);
        dev->cmd_err = 0;
-        /* Take I2C out of reset, configure it as master and set the
+        /* Take I2C out of reset and configure it as master */
-         * start bit */
+        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST;
-        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST | DAVINCI_I2C_MDR_STT;
        /* if the slave address is ten bit address, enable XA bit */
        if (msg->flags & I2C_M_TEN)
                flag |= DAVINCI_I2C_MDR_XA;
        if (!(msg->flags & I2C_M_RD))
                flag |= DAVINCI_I2C_MDR_TRX;
-        if (stop)
+        if (msg->len == 0)
-                flag |= DAVINCI_I2C_MDR_STP;
-        if (msg->len == 0) {
                flag |= DAVINCI_I2C_MDR_RM;
-                flag &= ~DAVINCI_I2C_MDR_STP;
-        }
        /* Enable receive or transmit interrupts */
        w = davinci_i2c_read_reg(dev, DAVINCI_I2C_IMR_REG);
@@ -358,17 +353,28 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
        dev->terminate = 0;
        /*
+         * Write mode register first as needed for correct behaviour
+         * on OMAP-L138, but don't set STT yet to avoid a race with XRDY
+         * occuring before we have loaded DXR
+         */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
+        /*
         * First byte should be set here, not after interrupt,
         * because transmit-data-ready interrupt can come before
         * NACK-interrupt during sending of previous message and
         * ICDXR may have wrong data
+         * It also saves us one interrupt, slightly faster
         */
        if ((!(msg->flags & I2C_M_RD)) && dev->buf_len) {
                davinci_i2c_write_reg(dev, DAVINCI_I2C_DXR_REG, *dev->buf++);
                dev->buf_len--;
        }
-        /* write the data into mode register; start transmitting */
+        /* Set STT to begin transmit now DXR is loaded */
+        flag |= DAVINCI_I2C_MDR_STT;
+        if (stop && msg->len != 0)
+                flag |= DAVINCI_I2C_MDR_STP;
        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
        r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 43ca32fddde2..89eedf45d30e 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -761,6 +761,9 @@ static int __devinit iic_probe(struct platform_device *ofdev,
        dev_info(&ofdev->dev, "using %s mode\n",
                 dev->fast_mode ? "fast (400 kHz)" : "standard (100 kHz)");
+        /* Now register all the child nodes */
+        of_i2c_register_devices(adap);
        return 0;
 error_cleanup:
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index d1ff9408dc1f..4c2a62b75b5c 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -159,15 +159,9 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
 {
-        int result;
+        wait_event_timeout(i2c_imx->queue, i2c_imx->i2csr & I2SR_IIF, HZ / 10);
-        result = wait_event_interruptible_timeout(i2c_imx->queue,
-                i2c_imx->i2csr & I2SR_IIF, HZ / 10);
-        if (unlikely(result < 0)) {
+        if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
-                dev_dbg(&i2c_imx->adapter.dev, "<%s> result < 0\n", __func__);
-                return result;
-        } else if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
                dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
                return -ETIMEDOUT;
        }
@@ -295,7 +289,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
                i2c_imx->i2csr = temp;
                temp &= ~I2SR_IIF;
                writeb(temp, i2c_imx->base + IMX_I2C_I2SR);
-                wake_up_interruptible(&i2c_imx->queue);
+                wake_up(&i2c_imx->queue);
                return IRQ_HANDLED;
        }
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a1c419a716af..b74e6dc6886c 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -632,6 +632,7 @@ static int __devinit fsl_i2c_probe(struct platform_device *op,
                dev_err(i2c->dev, "failed to add adapter\n");
                goto fail_add;
        }
+        of_i2c_register_devices(&i2c->adap);
        return result;
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index bbd77603a417..29933f87d8fa 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -71,8 +71,8 @@ static int pca_isa_readbyte(void *pd, int reg)
 static int pca_isa_waitforcompletion(void *pd)
 {
-        long ret = ~0;
        unsigned long timeout;
+        long ret;
        if (irq > -1) {
                ret = wait_event_timeout(pca_wait,
@@ -81,11 +81,15 @@ static int pca_isa_waitforcompletion(void *pd)
        } else {
                /* Do polling */
                timeout = jiffies + pca_isa_ops.timeout;
-                while (((pca_isa_readbyte(pd, I2C_PCA_CON)
+                do {
-                                & I2C_PCA_CON_SI) == 0)
+                        ret = time_before(jiffies, timeout);
-                                && (ret = time_before(jiffies, timeout)))
+                        if (pca_isa_readbyte(pd, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                        udelay(100);
+                } while (ret);
        }
        return ret > 0;
 }
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index ef5c78487eb7..5f6d7f89e225 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -80,8 +80,8 @@ static void i2c_pca_pf_writebyte32(void *pd, int reg, int val)
 static int i2c_pca_pf_waitforcompletion(void *pd)
 {
        struct i2c_pca_pf_data *i2c = pd;
-        long ret = ~0;
        unsigned long timeout;
+        long ret;
        if (i2c->irq) {
                ret = wait_event_timeout(i2c->wait,
@@ -90,10 +90,13 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
        } else {
                /* Do polling */
                timeout = jiffies + i2c->adap.timeout;
-                while (((i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                do {
-                                & I2C_PCA_CON_SI) == 0)
+                        ret = time_before(jiffies, timeout);
-                                && (ret = time_before(jiffies, timeout)))
+                        if (i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                        udelay(100);
+                } while (ret);
        }
        return ret > 0;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 6649176de940..bea4c5021d26 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
-#include <linux/of_i2c.h>
 #include <linux/of_device.h>
 #include <linux/completion.h>
 #include <linux/hardirq.h>
@@ -197,11 +196,12 @@ static int i2c_device_pm_suspend(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->suspend ? pm->suspend(dev) : 0;
+                        return pm->suspend ? pm->suspend(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
@@ -216,12 +216,6 @@ static int i2c_device_pm_resume(struct device *dev)
        else
                ret = i2c_legacy_resume(dev);
-        if (!ret) {
-                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
-                pm_runtime_enable(dev);
-        }
        return ret;
 }
@@ -229,11 +223,12 @@ static int i2c_device_pm_freeze(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->freeze ? pm->freeze(dev) : 0;
+                        return pm->freeze ? pm->freeze(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
@@ -242,11 +237,12 @@ static int i2c_device_pm_thaw(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->thaw ? pm->thaw(dev) : 0;
+                        return pm->thaw ? pm->thaw(dev) : 0;
+        }
        return i2c_legacy_resume(dev);
 }
@@ -255,11 +251,12 @@ static int i2c_device_pm_poweroff(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->poweroff ? pm->poweroff(dev) : 0;
+                        return pm->poweroff ? pm->poweroff(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
@@ -876,9 +873,6 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
        if (adap->nr < __i2c_first_dynamic_bus_num)
                i2c_scan_static_board_info(adap);
-        /* Register devices from the device tree */
-        of_i2c_register_devices(adap);
        /* Notify drivers */
        mutex_lock(&core_lock);
        bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 0906fc5b69b9..c37ef64d1465 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -157,13 +157,13 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
        { /* MWAIT C5 */ },
        { /* MWAIT C6 */
                .name = "ATM-C6",
-                .desc = "MWAIT 0x40",
+                .desc = "MWAIT 0x52",
-                .driver_data = (void *) 0x40,
+                .driver_data = (void *) 0x52,
                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
-                .exit_latency = 200,
+                .exit_latency = 140,
                .power_usage = 150,
-                .target_residency = 800,
+                .target_residency = 560,
-                .enter = NULL },        /* disabled */
+                .enter = &intel_idle },
 };
 /**
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c908c5f83645..9ddafc30f432 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -669,6 +669,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
+                        if (!dev->absinfo)
+                                return -EINVAL;
                        t = _IOC_NR(cmd) & ABS_MAX;
                        abs = dev->absinfo[t];
@@ -680,10 +683,13 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                }
        }
-        if (_IOC_DIR(cmd) == _IOC_READ) {
+        if (_IOC_DIR(cmd) == _IOC_WRITE) {
                if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
+                        if (!dev->absinfo)
+                                return -EINVAL;
                        t = _IOC_NR(cmd) & ABS_MAX;
                        if (copy_from_user(&abs, p, min_t(size_t,
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index d85bd8a7967d..22239e988498 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -483,6 +483,9 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
        memcpy(joydev->abspam, abspam, len);
+        for (i = 0; i < joydev->nabs; i++)
+                joydev->absmap[joydev->abspam[i]] = i;
 out:
        kfree(abspam);
        return retval;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 0d4266a533a5..360698553eb5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -404,6 +404,13 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                retval = uinput_validate_absbits(dev);
                if (retval < 0)
                        goto exit;
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        input_mt_create_slots(dev, nslot);
+                        input_set_events_per_packet(dev, 6 * nslot);
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
        }
        udev->state = UIST_SETUP_COMPLETE;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 42ba3691d908..b35876ee6908 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -103,27 +103,26 @@ static void wacom_sys_irq(struct urb *urb)
 static int wacom_open(struct input_dev *dev)
 {
        struct wacom *wacom = input_get_drvdata(dev);
+        int retval = 0;
-        mutex_lock(&wacom->lock);
+        if (usb_autopm_get_interface(wacom->intf) < 0)
-        wacom->irq->dev = wacom->usbdev;
-        if (usb_autopm_get_interface(wacom->intf) < 0) {
-                mutex_unlock(&wacom->lock);
                return -EIO;
-        }
+        mutex_lock(&wacom->lock);
        if (usb_submit_urb(wacom->irq, GFP_KERNEL)) {
-                usb_autopm_put_interface(wacom->intf);
+                retval = -EIO;
-                mutex_unlock(&wacom->lock);
+                goto out;
-                return -EIO;
        }
        wacom->open = true;
        wacom->intf->needs_remote_wakeup = 1;
+out:
        mutex_unlock(&wacom->lock);
-        return 0;
+        if (retval)
+                usb_autopm_put_interface(wacom->intf);
+        return retval;
 }
 static void wacom_close(struct input_dev *dev)
@@ -135,6 +134,8 @@ static void wacom_close(struct input_dev *dev)
        wacom->open = false;
        wacom->intf->needs_remote_wakeup = 0;
        mutex_unlock(&wacom->lock);
+        usb_autopm_put_interface(wacom->intf);
 }
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 6e29badb969e..47fd7a041c52 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -442,8 +442,10 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
        /* general pen packet */
        if ((data[1] & 0xb8) == 0xa0) {
                t = (data[6] << 2) | ((data[7] >> 6) & 3);
-                if (features->type >= INTUOS4S && features->type <= INTUOS4L)
+                if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
+                    features->type == WACOM_21UX2) {
                        t = (t << 1) | (data[1] & 1);
+                }
                input_report_abs(input, ABS_PRESSURE, t);
                input_report_abs(input, ABS_TILT_X,
                                ((data[7] << 1) & 0x7e) | (data[8] >> 7));
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                        }
                        else if(callid>=0x0000 && callid<=0x7FFF)
                        {
+                                int len;
                                pr_debug("%s: Got Incoming Call\n",
                                                sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
-                                strcpy(setup.eazmsn,
+                                                sizeof(setup.phone));
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                setup.si1 = 7;
                                setup.si2 = 0;
                                setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                 * Handle a GetMyNumber Rsp
                 */
                if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                        continue;
                }
                        
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed4900ade93a..e4fb58db5454 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1000,10 +1000,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                page = bitmap->sb_page;
                                offset = sizeof(bitmap_super_t);
                                if (!file)
-                                        read_sb_page(bitmap->mddev,
+                                        page = read_sb_page(
-                                                     bitmap->mddev->bitmap_info.offset,
+                                                bitmap->mddev,
-                                                     page,
+                                                bitmap->mddev->bitmap_info.offset,
-                                                     index, count);
+                                                page,
+                                                index, count);
                        } else if (file) {
                                page = read_page(file, index, bitmap, count);
                                offset = 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ad83a4dcadc3..0b830bbe1d8b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1839,7 +1839,9 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                /* take from bio_init */
                bio->bi_next = NULL;
+                bio->bi_flags &= ~(BIO_POOL_MASK-1);
                bio->bi_flags |= 1 << BIO_UPTODATE;
+                bio->bi_comp_cpu = -1;
                bio->bi_rw = READ;
                bio->bi_vcnt = 0;
                bio->bi_idx = 0;
@@ -1912,7 +1914,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                break;
                        BUG_ON(sync_blocks < (PAGE_SIZE>>9));
-                        if (len > (sync_blocks<<9))
+                        if ((len >> 9) > sync_blocks)
                                len = sync_blocks<<9;
                }
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index 7e82a9df726b..7961d59f5cac 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -319,7 +319,7 @@ static void ir_timer_keyup(unsigned long cookie)
         * a keyup event might follow immediately after the keydown.
         */
        spin_lock_irqsave(&ir->keylock, flags);
-        if (time_is_after_eq_jiffies(ir->keyup_jiffies))
+        if (time_is_before_eq_jiffies(ir->keyup_jiffies))
                ir_keyup(ir);
        spin_unlock_irqrestore(&ir->keylock, flags);
 }
@@ -510,6 +510,13 @@ int __ir_input_register(struct input_dev *input_dev,
                   (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_IR_RAW) ?
                        " in raw mode" : "");
+        /*
+         * Default delay of 250ms is too short for some protocols, expecially
+         * since the timeout is currently set to 250ms. Increase it to 500ms,
+         * to avoid wrong repetition of the keycodes.
+         */
+        input_dev->rep[REP_DELAY] = 500;
        return 0;
 out_event:
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c
index 77b5946413c0..e63f757d5d72 100644
--- a/drivers/media/IR/ir-lirc-codec.c
+++ b/drivers/media/IR/ir-lirc-codec.c
@@ -267,7 +267,7 @@ static int ir_lirc_register(struct input_dev *input_dev)
                        features |= LIRC_CAN_SET_SEND_CARRIER;
                if (ir_dev->props->s_tx_duty_cycle)
-                        features |= LIRC_CAN_SET_REC_DUTY_CYCLE;
+                        features |= LIRC_CAN_SET_SEND_DUTY_CYCLE;
        }
        if (ir_dev->props->s_rx_carrier_range)
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccfa..8e0e1b1f8c87 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
                        "rc%u",  (unsigned int)ir->devno);
        if (IS_ERR(ir->raw->thread)) {
+                int ret = PTR_ERR(ir->raw->thread);
                kfree(ir->raw);
                ir->raw = NULL;
-                return PTR_ERR(ir->raw->thread);
+                return ret;
        }
        mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index 96dafc425c8e..46d42467f9b4 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d,
        char *tmp = buf;
        int i;
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                enabled = ir_dev->rc_tab.ir_type;
                allowed = ir_dev->props->allowed_protos;
-        } else {
+        } else if (ir_dev->raw) {
                enabled = ir_dev->raw->enabled_protocols;
                allowed = ir_raw_get_allowed_protocols();
-        }
+        } else
+                return sprintf(tmp, "[builtin]\n");
        IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                   (long long)allowed,
@@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d,
        int rc, i, count = 0;
        unsigned long flags;
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                type = ir_dev->rc_tab.ir_type;
-        else
+        else if (ir_dev->raw)
                type = ir_dev->raw->enabled_protocols;
+        else {
+                IR_dprintk(1, "Protocol switching not supported\n");
+                return -EINVAL;
+        }
        while ((tmp = strsep((char **) &data, " \n")) != NULL) {
                if (!*tmp)
@@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d,
                }
        }
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                spin_lock_irqsave(&ir_dev->rc_tab.lock, flags);
                ir_dev->rc_tab.ir_type = type;
                spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);
diff --git a/drivers/media/IR/keymaps/rc-rc6-mce.c b/drivers/media/IR/keymaps/rc-rc6-mce.c
index 64264f7f838f..39557ad401b6 100644
--- a/drivers/media/IR/keymaps/rc-rc6-mce.c
+++ b/drivers/media/IR/keymaps/rc-rc6-mce.c
@@ -19,6 +19,7 @@ static struct ir_scancode rc6_mce[] = {
        { 0x800f0416, KEY_PLAY },
        { 0x800f0418, KEY_PAUSE },
+        { 0x800f046e, KEY_PLAYPAUSE },
        { 0x800f0419, KEY_STOP },
        { 0x800f0417, KEY_RECORD },
@@ -37,6 +38,8 @@ static struct ir_scancode rc6_mce[] = {
        { 0x800f0411, KEY_VOLUMEDOWN },
        { 0x800f0412, KEY_CHANNELUP },
        { 0x800f0413, KEY_CHANNELDOWN },
+        { 0x800f043a, KEY_BRIGHTNESSUP },
+        { 0x800f0480, KEY_BRIGHTNESSDOWN },
        { 0x800f0401, KEY_NUMERIC_1 },
        { 0x800f0402, KEY_NUMERIC_2 },
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
index ac6bb2c01a48..bc620e10ef77 100644
--- a/drivers/media/IR/mceusb.c
+++ b/drivers/media/IR/mceusb.c
@@ -120,6 +120,10 @@ static struct usb_device_id mceusb_dev_table[] = {
        { USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
        /* Philips eHome Infrared Transceiver */
        { USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
        /* Realtek MCE IR Receiver */
        { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
        /* SMK/Toshiba G83C0004D410 */
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index fe818348b8a3..48397f103d32 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -673,9 +673,6 @@ static int dib0700_probe(struct usb_interface *intf,
                        else
                                dev->props.rc.core.bulk_mode = false;
-                        /* Need a higher delay, to avoid wrong repeat */
-                        dev->rc_input_dev->rep[REP_DELAY] = 500;
                        dib0700_rc_setup(dev);
                        return 0;
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index f634d2e784b2..e06acd1fecb6 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -940,6 +940,58 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
        return adap->fe == NULL ? -ENODEV : 0;
 }
+/* STK7770P */
+static struct dib7000p_config dib7770p_dib7000p_config = {
+        .output_mpeg2_in_188_bytes = 1,
+        .agc_config_count = 1,
+        .agc = &dib7070_agc_config,
+        .bw  = &dib7070_bw_config_12_mhz,
+        .tuner_is_baseband = 1,
+        .spur_protect = 1,
+        .gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
+        .gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
+        .gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
+        .hostbus_diversity = 1,
+        .enable_current_mirror = 1,
+        .disable_sample_and_hold = 0,
+};
+static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+{
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+        else
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+        dib0700_ctrl_clock(adap->dev, 72, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+        if (dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
+                                     &dib7770p_dib7000p_config) != 0) {
+                err("%s: dib7000p_i2c_enumeration failed.  Cannot continue\n",
+                    __func__);
+                return -ENODEV;
+        }
+        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
+                &dib7770p_dib7000p_config);
+        return adap->fe == NULL ? -ENODEV : 0;
+}
 /* DIB807x generic */
 static struct dibx000_agc_config dib807x_agc_config[2] = {
        {
@@ -1781,7 +1833,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_XXS_2) },
        { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
        { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
-        { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x000, 0x3f00) },
        { USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
 /* 65 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV73ESE) },
        { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV282E) },
@@ -2406,7 +2458,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                                .pid_filter_count = 32,
                                .pid_filter       = stk70x0p_pid_filter,
                                .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
-                                .frontend_attach  = stk7070p_frontend_attach,
+                                .frontend_attach  = stk7770p_frontend_attach,
                                .tuner_attach     = dib7770p_tuner_attach,
                                DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c
index 6b22ec64ab0c..f896337b4535 100644
--- a/drivers/media/dvb/dvb-usb/opera1.c
+++ b/drivers/media/dvb/dvb-usb/opera1.c
@@ -483,9 +483,7 @@ static int opera1_xilinx_load_firmware(struct usb_device *dev,
                }
        }
        kfree(p);
-        if (fw) {
+        release_firmware(fw);
-                release_firmware(fw);
-        }
        return ret;
 }
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 2e28b973dfd3..3aed0d433921 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -260,6 +260,9 @@ static void dib7000p_set_adc_state(struct dib7000p_state *state, enum dibx000_ad
 //      dprintk( "908: %x, 909: %x\n", reg_908, reg_909);
+        reg_909 |= (state->cfg.disable_sample_and_hold & 1) << 4;
+        reg_908 |= (state->cfg.enable_current_mirror & 1) << 7;
        dib7000p_write_word(state, 908, reg_908);
        dib7000p_write_word(state, 909, reg_909);
 }
@@ -778,7 +781,10 @@ static void dib7000p_set_channel(struct dib7000p_state *state, struct dvb_fronte
                default:
                case GUARD_INTERVAL_1_32: value *= 1; break;
        }
-        state->div_sync_wait = (value * 3) / 2 + 32; // add 50% SFN margin + compensate for one DVSY-fifo TODO
+        if (state->cfg.diversity_delay == 0)
+                state->div_sync_wait = (value * 3) / 2 + 48; // add 50% SFN margin + compensate for one DVSY-fifo
+        else
+                state->div_sync_wait = (value * 3) / 2 + state->cfg.diversity_delay; // add 50% SFN margin + compensate for one DVSY-fifo
        /* deactive the possibility of diversity reception if extended interleaver */
        state->div_force_off = !1 && ch->u.ofdm.transmission_mode != TRANSMISSION_MODE_8K;
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 805dd13a97ee..da17345bf5bd 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -33,6 +33,11 @@ struct dib7000p_config {
        int (*agc_control) (struct dvb_frontend *, u8 before);
        u8 output_mode;
+        u8 disable_sample_and_hold : 1;
+        u8 enable_current_mirror : 1;
+        u8 diversity_delay;
 };
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index d93468cd3a85..ff3b0fa901b3 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1098,33 +1098,26 @@ EXPORT_SYMBOL_GPL(smscore_onresponse);
 *
 * @return pointer to descriptor on success, NULL on error.
 */
-struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
 {
        struct smscore_buffer_t *cb = NULL;
        unsigned long flags;
-        DEFINE_WAIT(wait);
        spin_lock_irqsave(&coredev->bufferslock, flags);
+        if (!list_empty(&coredev->buffers)) {
-        /* This function must return a valid buffer, since the buffer list is
+                cb = (struct smscore_buffer_t *) coredev->buffers.next;
-         * finite, we check that there is an available buffer, if not, we wait
+                list_del(&cb->entry);
-         * until such buffer become available.
-         */
-        prepare_to_wait(&coredev->buffer_mng_waitq, &wait, TASK_INTERRUPTIBLE);
-        if (list_empty(&coredev->buffers)) {
-                spin_unlock_irqrestore(&coredev->bufferslock, flags);
-                schedule();
-                spin_lock_irqsave(&coredev->bufferslock, flags);
        }
+        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        return cb;
+}
-        finish_wait(&coredev->buffer_mng_waitq, &wait);
+struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+{
-        cb = (struct smscore_buffer_t *) coredev->buffers.next;
+        struct smscore_buffer_t *cb = NULL;
-        list_del(&cb->entry);
-        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        wait_event(coredev->buffer_mng_waitq, (cb = get_entry(coredev)));
        return cb;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 67a4ec8768a6..4ce541a5eb47 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -395,7 +395,7 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
        radio->registers[POWERCFG] = POWERCFG_ENABLE;
        if (si470x_set_register(radio, POWERCFG) < 0) {
                retval = -EIO;
-                goto err_all;
+                goto err_video;
        }
        msleep(110);
diff --git a/drivers/media/video/cx231xx/Makefile b/drivers/media/video/cx231xx/Makefile
index 755dd0ce65ff..6f2b57384488 100644
--- a/drivers/media/video/cx231xx/Makefile
+++ b/drivers/media/video/cx231xx/Makefile
@@ -11,4 +11,5 @@ EXTRA_CFLAGS += -Idrivers/media/video
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-usb
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 6bdc0ef18119..f2a4900014bc 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/cx25840.h>
+#include "dvb-usb-ids.h"
 #include "xc5000.h"
 #include "cx231xx.h"
@@ -175,6 +176,8 @@ struct usb_device_id cx231xx_id_table[] = {
         .driver_info = CX231XX_BOARD_CNXT_RDE_250},
        {USB_DEVICE(0x0572, 0x58A1),
         .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+        {USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x4000,0x4fff),
+         .driver_info = CX231XX_BOARD_UNKNOWN},
        {},
 };
@@ -226,14 +229,16 @@ void cx231xx_pre_card_setup(struct cx231xx *dev)
                     dev->board.name, dev->model);
        /* set the direction for GPIO pins */
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
+        if (dev->board.tuner_gpio) {
-        cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
+                cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
-        /* request some modules if any required */
+                /* request some modules if any required */
-        /* reset the Tuner */
+                /* reset the Tuner */
-        cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+                cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+        }
        /* set the mode to Analog mode initially */
        cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 86ca8c2359dd..f5a3e74c3c7c 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1996,7 +1996,7 @@ static int cx25840_probe(struct i2c_client *client,
                state->volume = v4l2_ctrl_new_std(&state->hdl,
                        &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_VOLUME,
-                        0, 65335, 65535 / 100, default_volume);
+                        0, 65535, 65535 / 100, default_volume);
                state->mute = v4l2_ctrl_new_std(&state->hdl,
                        &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_MUTE,
                        0, 1, 1, 0);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 99dbae117591..0fa85cbefbb1 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -17,7 +17,7 @@ config VIDEO_CX88
 config VIDEO_CX88_ALSA
        tristate "Conexant 2388x DMA audio support"
-        depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        depends on VIDEO_CX88 && SND
        select SND_PCM
        ---help---
          This is a video4linux driver for direct (DMA) audio on
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index b9846106913e..78abc1c1f9d5 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                usb_rcvintpipe(dev, ep->bEndpointAddress),
                buffer, buffer_len,
                int_irq, (void *)gspca_dev, interval);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
        gspca_dev->int_urb = urb;
        ret = usb_submit_urb(urb, GFP_KERNEL);
        if (ret < 0) {
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 83a718f0f3f9..9052d5702556 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2357,8 +2357,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                            (data[33] << 10);
                avg_lum >>= 9;
                atomic_set(&sd->avg_lum, avg_lum);
-                gspca_frame_add(gspca_dev, LAST_PACKET,
+                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
-                                data, len);
                return;
        }
        if (gspca_dev->last_packet_type == LAST_PACKET) {
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index be03a712731c..f0316d02f09f 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -466,6 +466,8 @@ static int ivtvfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long ar
                        struct fb_vblank vblank;
                        u32 trace;
+                        memset(&vblank, 0, sizeof(struct fb_vblank));
                        vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT |
                                        FB_VBLANK_HAVE_VSYNC;
                        trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16;
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 4525335f9bd4..a7210d981388 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -239,7 +239,7 @@ static int device_process(struct m2mtest_ctx *ctx,
                return -EFAULT;
        }
-        if (in_buf->vb.size < out_buf->vb.size) {
+        if (in_buf->vb.size > out_buf->vb.size) {
                v4l2_err(&dev->v4l2_dev, "Output buffer is too small\n");
                return -EINVAL;
        }
@@ -1014,6 +1014,7 @@ static int m2mtest_remove(struct platform_device *pdev)
        v4l2_m2m_release(dev->m2m_dev);
        del_timer_sync(&dev->timer);
        video_unregister_device(dev->vfd);
+        video_device_release(dev->vfd);
        v4l2_device_unregister(&dev->v4l2_dev);
        kfree(dev);
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 758a4db27d65..c71af4e0e517 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -447,6 +447,9 @@ static int mt9m111_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
        dev_dbg(&client->dev, "%s left=%d, top=%d, width=%d, height=%d\n",
                __func__, rect.left, rect.top, rect.width, rect.height);
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
        ret = mt9m111_make_rect(client, &rect);
        if (!ret)
                mt9m111->rect = rect;
@@ -466,12 +469,14 @@ static int mt9m111_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 {
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
        a->bounds.left                  = MT9M111_MIN_DARK_COLS;
        a->bounds.top                   = MT9M111_MIN_DARK_ROWS;
        a->bounds.width                 = MT9M111_MAX_WIDTH;
        a->bounds.height                = MT9M111_MAX_HEIGHT;
        a->defrect                      = a->bounds;
-        a->type                         = V4L2_BUF_TYPE_VIDEO_CAPTURE;
        a->pixelaspect.numerator        = 1;
        a->pixelaspect.denominator      = 1;
@@ -487,6 +492,7 @@ static int mt9m111_g_fmt(struct v4l2_subdev *sd,
        mf->width       = mt9m111->rect.width;
        mf->height      = mt9m111->rect.height;
        mf->code        = mt9m111->fmt->code;
+        mf->colorspace  = mt9m111->fmt->colorspace;
        mf->field       = V4L2_FIELD_NONE;
        return 0;
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index e7cd23cd6394..b48473c7896b 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -402,9 +402,6 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd,
                if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
                        return -EINVAL;
                break;
-        case 0:
-                /* No format change, only geometry */
-                break;
        default:
                return -EINVAL;
        }
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 66ff174151b5..b6ea67221d1d 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -378,6 +378,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
        spin_lock_irqsave(&pcdev->lock, flags);
+        if (*fb_active == NULL)
+                goto out;
        vb = &(*fb_active)->vb;
        dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                vb, vb->baddr, vb->bsize);
@@ -402,6 +405,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
        *fb_active = buf;
+out:
        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
index 1b992b847198..55ea914c7fcd 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
@@ -513,7 +513,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        if (ret >= 0) {
                                ret = pvr2_ctrl_range_check(cptr,*valptr);
                        }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                } else if (cptr->info->type == pvr2_ctl_bool) {
                        ret = parse_token(ptr,len,valptr,boolNames,
                                          ARRAY_SIZE(boolNames));
@@ -522,7 +522,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        } else if (ret == 0) {
                                *valptr = (*valptr & 1) ? !0 : 0;
                        }
-                        if (maskptr) *maskptr = 1;
+                        *maskptr = 1;
                } else if (cptr->info->type == pvr2_ctl_enum) {
                        ret = parse_token(
                                ptr,len,valptr,
@@ -531,7 +531,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        if (ret >= 0) {
                                ret = pvr2_ctrl_range_check(cptr,*valptr);
                        }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                } else if (cptr->info->type == pvr2_ctl_bitmask) {
                        ret = parse_tlist(
                                ptr,len,maskptr,valptr,
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index b151c7be8a50..6961c55baf9b 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -393,6 +393,37 @@ static void fimc_set_yuv_order(struct fimc_ctx *ctx)
        dbg("ctx->out_order_1p= %d", ctx->out_order_1p);
 }
+static void fimc_prepare_dma_offset(struct fimc_ctx *ctx, struct fimc_frame *f)
+{
+        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
+        f->dma_offset.y_h = f->offs_h;
+        if (!variant->pix_hoff)
+                f->dma_offset.y_h *= (f->fmt->depth >> 3);
+        f->dma_offset.y_v = f->offs_v;
+        f->dma_offset.cb_h = f->offs_h;
+        f->dma_offset.cb_v = f->offs_v;
+        f->dma_offset.cr_h = f->offs_h;
+        f->dma_offset.cr_v = f->offs_v;
+        if (!variant->pix_hoff) {
+                if (f->fmt->planes_cnt == 3) {
+                        f->dma_offset.cb_h >>= 1;
+                        f->dma_offset.cr_h >>= 1;
+                }
+                if (f->fmt->color == S5P_FIMC_YCBCR420) {
+                        f->dma_offset.cb_v >>= 1;
+                        f->dma_offset.cr_v >>= 1;
+                }
+        }
+        dbg("in_offset: color= %d, y_h= %d, y_v= %d",
+            f->fmt->color, f->dma_offset.y_h, f->dma_offset.y_v);
+}
 /**
 * fimc_prepare_config - check dimensions, operation and color mode
 *                       and pre-calculate offset and the scaling coefficients.
@@ -406,7 +437,6 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
 {
        struct fimc_frame *s_frame, *d_frame;
        struct fimc_vid_buffer *buf = NULL;
-        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
        int ret = 0;
        s_frame = &ctx->s_frame;
@@ -419,61 +449,16 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
                        swap(d_frame->width, d_frame->height);
                }
-                /* Prepare the output offset ratios for scaler. */
+                /* Prepare the DMA offset ratios for scaler. */
-                d_frame->dma_offset.y_h = d_frame->offs_h;
+                fimc_prepare_dma_offset(ctx, &ctx->s_frame);
-                if (!variant->pix_hoff)
+                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
-                        d_frame->dma_offset.y_h *= (d_frame->fmt->depth >> 3);
-                d_frame->dma_offset.y_v = d_frame->offs_v;
-                d_frame->dma_offset.cb_h = d_frame->offs_h;
-                d_frame->dma_offset.cb_v = d_frame->offs_v;
-                d_frame->dma_offset.cr_h = d_frame->offs_h;
-                d_frame->dma_offset.cr_v = d_frame->offs_v;
-                if (!variant->pix_hoff && d_frame->fmt->planes_cnt == 3) {
-                        d_frame->dma_offset.cb_h >>= 1;
-                        d_frame->dma_offset.cb_v >>= 1;
-                        d_frame->dma_offset.cr_h >>= 1;
-                        d_frame->dma_offset.cr_v >>= 1;
-                }
-                dbg("out offset: color= %d, y_h= %d, y_v= %d",
-                        d_frame->fmt->color,
-                        d_frame->dma_offset.y_h, d_frame->dma_offset.y_v);
-                /* Prepare the input offset ratios for scaler. */
-                s_frame->dma_offset.y_h = s_frame->offs_h;
-                if (!variant->pix_hoff)
-                        s_frame->dma_offset.y_h *= (s_frame->fmt->depth >> 3);
-                s_frame->dma_offset.y_v = s_frame->offs_v;
-                s_frame->dma_offset.cb_h = s_frame->offs_h;
-                s_frame->dma_offset.cb_v = s_frame->offs_v;
-                s_frame->dma_offset.cr_h = s_frame->offs_h;
-                s_frame->dma_offset.cr_v = s_frame->offs_v;
-                if (!variant->pix_hoff && s_frame->fmt->planes_cnt == 3) {
-                        s_frame->dma_offset.cb_h >>= 1;
-                        s_frame->dma_offset.cb_v >>= 1;
-                        s_frame->dma_offset.cr_h >>= 1;
-                        s_frame->dma_offset.cr_v >>= 1;
-                }
-                dbg("in offset: color= %d, y_h= %d, y_v= %d",
-                        s_frame->fmt->color, s_frame->dma_offset.y_h,
-                        s_frame->dma_offset.y_v);
-                fimc_set_yuv_order(ctx);
-                /* Check against the scaler ratio. */
                if (s_frame->height > (SCALER_MAX_VRATIO * d_frame->height) ||
                    s_frame->width > (SCALER_MAX_HRATIO * d_frame->width)) {
                        err("out of scaler range");
                        return -EINVAL;
                }
+                fimc_set_yuv_order(ctx);
        }
        /* Input DMA mode is not allowed when the scaler is disabled. */
@@ -822,7 +807,8 @@ static int fimc_m2m_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
        } else {
                v4l2_err(&ctx->fimc_dev->m2m.v4l2_dev,
                         "Wrong buffer/video queue type (%d)\n", f->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto s_fmt_out;
        }
        pix = &f->fmt.pix;
@@ -1414,8 +1400,10 @@ static int fimc_probe(struct platform_device *pdev)
        }
        fimc->work_queue = create_workqueue(dev_name(&fimc->pdev->dev));
-        if (!fimc->work_queue)
+        if (!fimc->work_queue) {
+                ret = -ENOMEM;
                goto err_irq;
+        }
        ret = fimc_register_m2m_device(fimc);
        if (ret)
@@ -1492,6 +1480,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
 };
 static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
+        .pix_hoff       = 1,
        .has_inp_rot    = 1,
        .has_out_rot    = 1,
        .min_inp_pixsize = 16,
@@ -1506,6 +1495,7 @@ static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
 };
 static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
+        .pix_hoff        = 1,
        .min_inp_pixsize = 16,
        .min_out_pixsize = 32,
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index ec697fcd406e..bb8d83d8ddaf 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4323,13 +4323,13 @@ struct saa7134_board saa7134_boards[] = {
        },
        [SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM] = {
                /*       Beholder Intl. Ltd. 2008      */
-                /*Dmitry Belimov <d.belimov@gmail.com> */
+                /* Dmitry Belimov <d.belimov@gmail.com> */
-                .name           = "Beholder BeholdTV Columbus TVFM",
+                .name           = "Beholder BeholdTV Columbus TV/FM",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_ALPS_TSBE5_PAL,
-                .radio_type     = UNSET,
+                .radio_type     = TUNER_TEA5767,
-                .tuner_addr     = ADDR_UNSET,
+                .tuner_addr     = 0xc2 >> 1,
-                .radio_addr     = ADDR_UNSET,
+                .radio_addr     = 0xc0 >> 1,
                .tda9887_conf   = TDA9887_PRESENT,
                .gpiomask       = 0x000A8004,
                .inputs         = {{
diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c
index 5713f3a4b76c..ddd25d32723d 100644
--- a/drivers/media/video/saa7164/saa7164-buffer.c
+++ b/drivers/media/video/saa7164/saa7164-buffer.c
@@ -136,10 +136,11 @@ ret:
 int saa7164_buffer_dealloc(struct saa7164_tsport *port,
        struct saa7164_buffer *buf)
 {
-        struct saa7164_dev *dev = port->dev;
+        struct saa7164_dev *dev;
-        if ((buf == 0) || (port == 0))
+        if (!buf || !port)
                return SAA_ERR_BAD_PARAMETER;
+        dev = port->dev;
        dprintk(DBGLVL_BUF, "%s() deallocating buffer @ 0x%p\n", __func__, buf);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8bdd940f32e6..2ac85d8984f0 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -486,6 +486,12 @@ static int uvc_parse_format(struct uvc_device *dev,
                            max(frame->dwFrameInterval[0],
                                frame->dwDefaultFrameInterval));
+                if (dev->quirks & UVC_QUIRK_RESTRICT_FRAME_RATE) {
+                        frame->bFrameIntervalType = 1;
+                        frame->dwFrameInterval[0] =
+                                frame->dwDefaultFrameInterval;
+                }
                uvc_trace(UVC_TRACE_DESCR, "- %ux%u (%u.%u fps)\n",
                        frame->wWidth, frame->wHeight,
                        10000000/frame->dwDefaultFrameInterval,
@@ -2026,6 +2032,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceClass      = USB_CLASS_VENDOR_SPEC,
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0 },
+        /* Chicony CNF7129 (Asus EEE 100HE) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x04f2,
+          .idProduct            = 0xb071,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_RESTRICT_FRAME_RATE },
        /* Alcor Micro AU3820 (Future Boy PC USB Webcam) */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2091,6 +2106,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                | UVC_QUIRK_PROBE_DEF },
+        /* IMC Networks (Medion Akoya) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x13d3,
+          .idProduct            = 0x5103,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
        /* Syntek (HP Spartan) */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bdacf3beabf5..892e0e51916c 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -182,6 +182,7 @@ struct uvc_xu_control {
 #define UVC_QUIRK_IGNORE_SELECTOR_UNIT  0x00000020
 #define UVC_QUIRK_FIX_BANDWIDTH         0x00000080
 #define UVC_QUIRK_PROBE_DEF             0x00000100
+#define UVC_QUIRK_RESTRICT_FRAME_RATE   0x00000200
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED         0x00000001
diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 073f01390cdd..86294ed35c9b 100644
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -193,17 +193,24 @@ static int put_video_window32(struct video_window *kp, struct video_window32 __u
 struct video_code32 {
        char            loadwhat[16];   /* name or tag of file being passed */
        compat_int_t    datasize;
-        unsigned char   *data;
+        compat_uptr_t   data;
 };
-static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
+static struct video_code __user *get_microcode32(struct video_code32 *kp)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
+        struct video_code __user *up;
-                copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
-                get_user(kp->datasize, &up->datasize) ||
+        up = compat_alloc_user_space(sizeof(*up));
-                copy_from_user(kp->data, up->data, up->datasize))
-                        return -EFAULT;
+        /*
-        return 0;
+         * NOTE! We don't actually care if these fail. If the
+         * user address is invalid, the native ioctl will do
+         * the error handling for us
+         */
+        (void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
+        (void) put_user(kp->datasize, &up->datasize);
+        (void) put_user(compat_ptr(kp->data), &up->data);
+        return up;
 }
 #define VIDIOCGTUNER32          _IOWR('v', 4, struct video_tuner32)
@@ -739,7 +746,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                struct video_tuner vt;
                struct video_buffer vb;
                struct video_window vw;
-                struct video_code vc;
+                struct video_code32 vc;
                struct video_audio va;
 #endif
                struct v4l2_format v2f;
@@ -818,8 +825,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                break;
        case VIDIOCSMICROCODE:
-                err = get_microcode32(&karg.vc, up);
+                /* Copy the 32-bit "video_code32" to kernel space */
-                compatible_arg = 0;
+                if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
+                        return -EFAULT;
+                /* Convert the 32-bit version to a 64-bit version in user space */
+                up = get_microcode32(&karg.vc);
                break;
        case VIDIOCSFREQ:
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 372b87efcd05..6ff9e4bac3ea 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -393,8 +393,10 @@ void videobuf_dma_contig_free(struct videobuf_queue *q,
        }
        /* read() method */
-        dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+        if (mem->vaddr) {
-        mem->vaddr = NULL;
+                dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+                mem->vaddr = NULL;
+        }
 }
 EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 06f9a9c2a39a..2ad0bc252b0e 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -94,7 +94,7 @@ err:
 * must free the memory.
 */
 static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
-                                                int nr_pages, int offset)
+                                        int nr_pages, int offset, size_t size)
 {
        struct scatterlist *sglist;
        int i;
@@ -110,12 +110,14 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
                /* DMA to highmem pages might not work */
                goto highmem;
        sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
+        size -= PAGE_SIZE - offset;
        for (i = 1; i < nr_pages; i++) {
                if (NULL == pages[i])
                        goto nopage;
                if (PageHighMem(pages[i]))
                        goto highmem;
-                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
+                sg_set_page(&sglist[i], pages[i], min(PAGE_SIZE, size), 0);
+                size -= min(PAGE_SIZE, size);
        }
        return sglist;
@@ -170,7 +172,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
        first = (data          & PAGE_MASK) >> PAGE_SHIFT;
        last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
-        dma->offset   = data & ~PAGE_MASK;
+        dma->offset = data & ~PAGE_MASK;
+        dma->size = size;
        dma->nr_pages = last-first+1;
        dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
        if (NULL == dma->pages)
@@ -252,7 +255,7 @@ int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
        if (dma->pages) {
                dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
-                                                   dma->offset);
+                                                   dma->offset, dma->size);
        }
        if (dma->vaddr) {
                dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 714c6b487313..d5f3a3fd2319 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -190,7 +190,6 @@ static int __devexit bh1780_remove(struct i2c_client *client)
        ddata = i2c_get_clientdata(client);
        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        i2c_set_clientdata(client, NULL);
        kfree(ddata);
        return 0;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 5db49b124ffa..09eee6df0653 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1631,6 +1631,19 @@ int mmc_suspend_host(struct mmc_host *host)
        if (host->bus_ops && !host->bus_dead) {
                if (host->bus_ops->suspend)
                        err = host->bus_ops->suspend(host);
+                if (err == -ENOSYS || !host->bus_ops->resume) {
+                        /*
+                         * We simply "remove" the card in this case.
+                         * It will be redetected on resume.
+                         */
+                        if (host->bus_ops->remove)
+                                host->bus_ops->remove(host);
+                        mmc_claim_host(host);
+                        mmc_detach_bus(host);
+                        mmc_release_host(host);
+                        host->pm_flags = 0;
+                        err = 0;
+                }
        }
        mmc_bus_put(host);
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index b2828e84d243..214b03afdd48 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -30,6 +30,8 @@
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/completion.h>
 #include <asm/mach/flash.h>
 #include <mach/mxc_nand.h>
@@ -151,7 +153,7 @@ struct mxc_nand_host {
        int                     irq;
        int                     eccsize;
-        wait_queue_head_t       irq_waitq;
+        struct completion       op_completion;
        uint8_t                 *data_buf;
        unsigned int            buf_start;
@@ -164,6 +166,7 @@ struct mxc_nand_host {
        void                    (*send_read_id)(struct mxc_nand_host *);
        uint16_t                (*get_dev_status)(struct mxc_nand_host *);
        int                     (*check_int)(struct mxc_nand_host *);
+        void                    (*irq_control)(struct mxc_nand_host *, int);
 };
 /* OOB placement block for use with hardware ecc generation */
@@ -216,9 +219,12 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
 {
        struct mxc_nand_host *host = dev_id;
-        disable_irq_nosync(irq);
+        if (!host->check_int(host))
+                return IRQ_NONE;
-        wake_up(&host->irq_waitq);
+        host->irq_control(host, 0);
+        complete(&host->op_completion);
        return IRQ_HANDLED;
 }
@@ -245,11 +251,54 @@ static int check_int_v1_v2(struct mxc_nand_host *host)
        if (!(tmp & NFC_V1_V2_CONFIG2_INT))
                return 0;
-        writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
+        if (!cpu_is_mx21())
+                writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
        return 1;
 }
+/*
+ * It has been observed that the i.MX21 cannot read the CONFIG2:INT bit
+ * if interrupts are masked (CONFIG1:INT_MSK is set). To handle this, the
+ * driver can enable/disable the irq line rather than simply masking the
+ * interrupts.
+ */
+static void irq_control_mx21(struct mxc_nand_host *host, int activate)
+{
+        if (activate)
+                enable_irq(host->irq);
+        else
+                disable_irq_nosync(host->irq);
+}
+static void irq_control_v1_v2(struct mxc_nand_host *host, int activate)
+{
+        uint16_t tmp;
+        tmp = readw(NFC_V1_V2_CONFIG1);
+        if (activate)
+                tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
+        else
+                tmp |= NFC_V1_V2_CONFIG1_INT_MSK;
+        writew(tmp, NFC_V1_V2_CONFIG1);
+}
+static void irq_control_v3(struct mxc_nand_host *host, int activate)
+{
+        uint32_t tmp;
+        tmp = readl(NFC_V3_CONFIG2);
+        if (activate)
+                tmp &= ~NFC_V3_CONFIG2_INT_MSK;
+        else
+                tmp |= NFC_V3_CONFIG2_INT_MSK;
+        writel(tmp, NFC_V3_CONFIG2);
+}
 /* This function polls the NANDFC to wait for the basic operation to
 * complete by checking the INT bit of config2 register.
 */
@@ -259,10 +308,9 @@ static void wait_op_done(struct mxc_nand_host *host, int useirq)
        if (useirq) {
                if (!host->check_int(host)) {
+                        INIT_COMPLETION(host->op_completion);
-                        enable_irq(host->irq);
+                        host->irq_control(host, 1);
+                        wait_for_completion(&host->op_completion);
-                        wait_event(host->irq_waitq, host->check_int(host));
                }
        } else {
                while (max_retries-- > 0) {
@@ -799,6 +847,7 @@ static void preset_v3(struct mtd_info *mtd)
                NFC_V3_CONFIG2_2CMD_PHASES |
                NFC_V3_CONFIG2_SPAS(mtd->oobsize >> 1) |
                NFC_V3_CONFIG2_ST_CMD(0x70) |
+                NFC_V3_CONFIG2_INT_MSK |
                NFC_V3_CONFIG2_NUM_ADDR_PHASE0;
        if (chip->ecc.mode == NAND_ECC_HW)
@@ -1024,6 +1073,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                host->send_read_id = send_read_id_v1_v2;
                host->get_dev_status = get_dev_status_v1_v2;
                host->check_int = check_int_v1_v2;
+                if (cpu_is_mx21())
+                        host->irq_control = irq_control_mx21;
+                else
+                        host->irq_control = irq_control_v1_v2;
        }
        if (nfc_is_v21()) {
@@ -1062,6 +1115,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                host->send_read_id = send_read_id_v3;
                host->check_int = check_int_v3;
                host->get_dev_status = get_dev_status_v3;
+                host->irq_control = irq_control_v3;
                oob_smallpage = &nandv2_hw_eccoob_smallpage;
                oob_largepage = &nandv2_hw_eccoob_largepage;
        } else
@@ -1093,14 +1147,34 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                this->options |= NAND_USE_FLASH_BBT;
        }
-        init_waitqueue_head(&host->irq_waitq);
+        init_completion(&host->op_completion);
        host->irq = platform_get_irq(pdev, 0);
+        /*
+         * mask the interrupt. For i.MX21 explicitely call
+         * irq_control_v1_v2 to use the mask bit. We can't call
+         * disable_irq_nosync() for an interrupt we do not own yet.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 0);
+        else
+                host->irq_control(host, 0);
        err = request_irq(host->irq, mxc_nfc_irq, IRQF_DISABLED, DRIVER_NAME, host);
        if (err)
                goto eirq;
+        host->irq_control(host, 0);
+        /*
+         * Now that the interrupt is disabled make sure the interrupt
+         * mask bit is cleared on i.MX21. Otherwise we can't read
+         * the interrupt status bit on this machine.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 1);
        /* first scan to find the device and get the page size */
        if (nand_scan_ident(mtd, 1, NULL)) {
                err = -ENXIO;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..5db667c0b371 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 config MV643XX_ETH
        tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
        select INET_LRO
        select PHYLIB
        help
@@ -2803,7 +2803,7 @@ config NIU
 config PASEMI_MAC
        tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
        select PHYLIB
        select INET_LRO
        help
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1e620e287ae0..efeffdf9e5fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2170,8 +2170,6 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
        dev->irq = sdev->irq;
        SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
-        netif_carrier_off(dev);
        err = ssb_bus_powerup(sdev->bus, 0);
        if (err) {
                dev_err(sdev->dev,
@@ -2213,6 +2211,8 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
                goto err_out_powerdown;
        }
+        netif_carrier_off(dev);
        ssb_set_drvdata(sdev, dev);
        /* Chip reset provides power to the b44 MAC & PCI cores, which
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                res = dev_alloc_name(bond_dev, "bond%d");
                if (res < 0)
                        goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
        }
        res = register_netdevice(bond_dev);
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a333b42111b8..6372610ed240 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -533,8 +533,15 @@ static inline void ehea_fill_skb(struct net_device *dev,
        int length = cqe->num_bytes_transfered - 4;     /*remove CRC */
        skb_put(skb, length);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
        skb->protocol = eth_type_trans(skb, dev);
+        /* The packet was not an IPV4 packet so a complemented checksum was
+           calculated. The value is found in the Internet Checksum field. */
+        if (cqe->status & EHEA_CQE_BLIND_CKSUM) {
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum = csum_unfold(~cqe->inet_checksum_value);
+        } else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
index f608a6c54af5..38104734a3be 100644
--- a/drivers/net/ehea/ehea_qmr.h
+++ b/drivers/net/ehea/ehea_qmr.h
@@ -150,6 +150,7 @@ struct ehea_rwqe {
 #define EHEA_CQE_TYPE_RQ           0x60
 #define EHEA_CQE_STAT_ERR_MASK     0x700F
 #define EHEA_CQE_STAT_FAT_ERR_MASK 0xF
+#define EHEA_CQE_BLIND_CKSUM       0x8000
 #define EHEA_CQE_STAT_ERR_TCP      0x4000
 #define EHEA_CQE_STAT_ERR_IP       0x2000
 #define EHEA_CQE_STAT_ERR_CRC      0x1000
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 768b840aeb6b..cce32d43175f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -678,24 +678,37 @@ static int fec_enet_mii_probe(struct net_device *dev)
 {
        struct fec_enet_private *fep = netdev_priv(dev);
        struct phy_device *phy_dev = NULL;
-        int ret;
+        char mdio_bus_id[MII_BUS_ID_SIZE];
+        char phy_name[MII_BUS_ID_SIZE + 3];
+        int phy_id;
        fep->phy_dev = NULL;
-        /* find the first phy */
+        /* check for attached phy */
-        phy_dev = phy_find_first(fep->mii_bus);
+        for (phy_id = 0; (phy_id < PHY_MAX_ADDR); phy_id++) {
-        if (!phy_dev) {
+                if ((fep->mii_bus->phy_mask & (1 << phy_id)))
-                printk(KERN_ERR "%s: no PHY found\n", dev->name);
+                        continue;
-                return -ENODEV;
+                if (fep->mii_bus->phy_map[phy_id] == NULL)
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id]->phy_id == 0)
+                        continue;
+                strncpy(mdio_bus_id, fep->mii_bus->id, MII_BUS_ID_SIZE);
+                break;
        }
-        /* attach the mac to the phy */
+        if (phy_id >= PHY_MAX_ADDR) {
-        ret = phy_connect_direct(dev, phy_dev,
+                printk(KERN_INFO "%s: no PHY, assuming direct connection "
-                             &fec_enet_adjust_link, 0,
+                        "to switch\n", dev->name);
-                             PHY_INTERFACE_MODE_MII);
+                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE);
-        if (ret) {
+                phy_id = 0;
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
+        }
-                return ret;
+        snprintf(phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        phy_dev = phy_connect(dev, phy_name, &fec_enet_adjust_link, 0,
+                PHY_INTERFACE_MODE_MII);
+        if (IS_ERR(phy_dev)) {
+                printk(KERN_ERR "%s: could not attach to PHY\n", dev->name);
+                return PTR_ERR(phy_dev);
        }
        /* mask with MAC supported features */
@@ -738,7 +751,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
        fep->mii_bus->read = fec_enet_mdio_read;
        fep->mii_bus->write = fec_enet_mdio_write;
        fep->mii_bus->reset = fec_enet_mdio_reset;
-        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id);
+        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id + 1);
        fep->mii_bus->priv = fep;
        fep->mii_bus->parent = &pdev->dev;
@@ -1311,6 +1324,9 @@ fec_probe(struct platform_device *pdev)
        if (ret)
                goto failed_mii_init;
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(ndev);
        ret = register_netdev(ndev);
        if (ret)
                goto failed_register;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index a0da4a17b025..992db2fa136e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1212,7 +1212,8 @@ static void rtl8169_update_counters(struct net_device *dev)
        if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
                return;
-        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
+        counters = dma_alloc_coherent(&tp->pci_dev->dev, sizeof(*counters),
+                                      &paddr, GFP_KERNEL);
        if (!counters)
                return;
@@ -1233,7 +1234,8 @@ static void rtl8169_update_counters(struct net_device *dev)
        RTL_W32(CounterAddrLow, 0);
        RTL_W32(CounterAddrHigh, 0);
-        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
+        dma_free_coherent(&tp->pci_dev->dev, sizeof(*counters), counters,
+                          paddr);
 }
 static void rtl8169_get_ethtool_stats(struct net_device *dev,
@@ -3292,15 +3294,15 @@ static int rtl8169_open(struct net_device *dev)
        /*
         * Rx and Tx desscriptors needs 256 bytes alignment.
-         * pci_alloc_consistent provides more.
+         * dma_alloc_coherent provides more.
         */
-        tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
+        tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES,
-                                               &tp->TxPhyAddr);
+                                             &tp->TxPhyAddr, GFP_KERNEL);
        if (!tp->TxDescArray)
                goto err_pm_runtime_put;
-        tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
+        tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES,
-                                               &tp->RxPhyAddr);
+                                             &tp->RxPhyAddr, GFP_KERNEL);
        if (!tp->RxDescArray)
                goto err_free_tx_0;
@@ -3334,12 +3336,12 @@ out:
 err_release_ring_2:
        rtl8169_rx_clear(tp);
 err_free_rx_1:
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+                          tp->RxPhyAddr);
        tp->RxDescArray = NULL;
 err_free_tx_0:
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+                          tp->TxPhyAddr);
        tp->TxDescArray = NULL;
 err_pm_runtime_put:
        pm_runtime_put_noidle(&pdev->dev);
@@ -3975,7 +3977,7 @@ static void rtl8169_free_rx_skb(struct rtl8169_private *tp,
 {
        struct pci_dev *pdev = tp->pci_dev;
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
                         PCI_DMA_FROMDEVICE);
        dev_kfree_skb(*sk_buff);
        *sk_buff = NULL;
@@ -4000,7 +4002,7 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
 static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
                                            struct net_device *dev,
                                            struct RxDesc *desc, int rx_buf_sz,
-                                            unsigned int align)
+                                            unsigned int align, gfp_t gfp)
 {
        struct sk_buff *skb;
        dma_addr_t mapping;
@@ -4008,13 +4010,13 @@ static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
        pad = align ? align : NET_IP_ALIGN;
-        skb = netdev_alloc_skb(dev, rx_buf_sz + pad);
+        skb = __netdev_alloc_skb(dev, rx_buf_sz + pad, gfp);
        if (!skb)
                goto err_out;
        skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad);
-        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
+        mapping = dma_map_single(&pdev->dev, skb->data, rx_buf_sz,
                                 PCI_DMA_FROMDEVICE);
        rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
@@ -4039,7 +4041,7 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp)
 }
 static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
-                           u32 start, u32 end)
+                           u32 start, u32 end, gfp_t gfp)
 {
        u32 cur;
@@ -4054,7 +4056,7 @@ static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
                skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev,
                                           tp->RxDescArray + i,
-                                           tp->rx_buf_sz, tp->align);
+                                           tp->rx_buf_sz, tp->align, gfp);
                if (!skb)
                        break;
@@ -4082,7 +4084,7 @@ static int rtl8169_init_ring(struct net_device *dev)
        memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info));
        memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
-        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
+        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC, GFP_KERNEL) != NUM_RX_DESC)
                goto err_out;
        rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
@@ -4099,7 +4101,8 @@ static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb,
 {
        unsigned int len = tx_skb->len;
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), len,
+                         PCI_DMA_TODEVICE);
        desc->opts1 = 0x00;
        desc->opts2 = 0x00;
        desc->addr = 0x00;
@@ -4243,7 +4246,8 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
                txd = tp->TxDescArray + entry;
                len = frag->size;
                addr = ((void *) page_address(frag->page)) + frag->page_offset;
-                mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE);
+                mapping = dma_map_single(&tp->pci_dev->dev, addr, len,
+                                         PCI_DMA_TODEVICE);
                /* anti gcc 2.95.3 bugware (sic) */
                status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC));
@@ -4313,7 +4317,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
                tp->tx_skb[entry].skb = skb;
        }
-        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
+        mapping = dma_map_single(&tp->pci_dev->dev, skb->data, len,
+                                 PCI_DMA_TODEVICE);
        tp->tx_skb[entry].len = len;
        txd->addr = cpu_to_le64(mapping);
@@ -4477,8 +4482,8 @@ static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
        if (!skb)
                goto out;
-        pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size,
+        dma_sync_single_for_cpu(&tp->pci_dev->dev, addr, pkt_size,
-                                    PCI_DMA_FROMDEVICE);
+                                PCI_DMA_FROMDEVICE);
        skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size);
        *sk_buff = skb;
        done = true;
@@ -4549,11 +4554,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                        rtl8169_rx_csum(skb, desc);
                        if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
-                                pci_dma_sync_single_for_device(pdev, addr,
+                                dma_sync_single_for_device(&pdev->dev, addr,
                                        pkt_size, PCI_DMA_FROMDEVICE);
                                rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
                        } else {
-                                pci_unmap_single(pdev, addr, tp->rx_buf_sz,
+                                dma_unmap_single(&pdev->dev, addr, tp->rx_buf_sz,
                                                 PCI_DMA_FROMDEVICE);
                                tp->Rx_skbuff[entry] = NULL;
                        }
@@ -4583,7 +4588,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
        count = cur_rx - tp->cur_rx;
        tp->cur_rx = cur_rx;
-        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
+        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx, GFP_ATOMIC);
        if (!delta && count)
                netif_info(tp, intr, dev, "no Rx buffer allocated\n");
        tp->dirty_rx += delta;
@@ -4769,10 +4774,10 @@ static int rtl8169_close(struct net_device *dev)
        free_irq(dev->irq, dev);
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+                          tp->RxPhyAddr);
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+                          tp->TxPhyAddr);
        tp->TxDescArray = NULL;
        tp->RxDescArray = NULL;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
        netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
+static int only_32bit_dma;
 static int __devinit skge_probe(struct pci_dev *pdev,
                                const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
        pci_set_master(pdev);
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                using_dac = 1;
                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
        } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
        .shutdown =     skge_shutdown,
 };
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
        skge_debug_init();
        return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc3af78a869f..1ec4b9e0239a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4666,7 +4666,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                                       desc_idx, *post_ptr);
                drop_it_no_recycle:
                        /* Other statistics kept track of by card. */
-                        tp->net_stats.rx_dropped++;
+                        tp->rx_dropped++;
                        goto next_pkt;
                }
@@ -4726,7 +4726,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                if (len > (tp->dev->mtu + ETH_HLEN) &&
                    skb->protocol != htons(ETH_P_8021Q)) {
                        dev_kfree_skb(skb);
-                        goto next_pkt;
+                        goto drop_it_no_recycle;
                }
                if (desc->type_flags & RXD_FLAG_VLAN &&
@@ -9240,6 +9240,8 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
        stats->rx_missed_errors = old_stats->rx_missed_errors +
                get_stat64(&hw_stats->rx_discards);
+        stats->rx_dropped = tp->rx_dropped;
        return stats;
 }
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..be7ff138a7f9 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2759,7 +2759,7 @@ struct tg3 {
        /* begin "everything else" cacheline(s) section */
-        struct rtnl_link_stats64        net_stats;
+        unsigned long                   rx_dropped;
        struct rtnl_link_stats64        net_stats_prev;
        struct tg3_ethtool_stats        estats;
        struct tg3_ethtool_stats        estats_prev;
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 8cc9e319f435..1737d1488b35 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
        int i, result;
        struct device *dev = i2400m_dev(i2400m);
        const struct i2400m_msg_hdr *msg_hdr;
-        size_t pl_itr, pl_size, skb_len;
+        size_t pl_itr, pl_size;
        unsigned long flags;
-        unsigned num_pls, single_last;
+        unsigned num_pls, single_last, skb_len;
        skb_len = skb->len;
-        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
                  i2400m, skb, skb_len);
        result = -EIO;
        msg_hdr = (void *) skb->data;
-        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
        if (result < 0)
                goto error_msg_hdr_check;
        result = -EIO;
@@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
        pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
                num_pls * sizeof(msg_hdr->pld[0]);
        pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
-        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+        if (pl_itr > skb_len) { /* got all the payload descriptors? */
                dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
                        "%u payload descriptors (%zu each, total %zu)\n",
-                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                        skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
                goto error_pl_descr_short;
        }
        /* Walk each payload payload--check we really got it */
@@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
                /* work around old gcc warnings */
                pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
                result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
-                                                  pl_itr, skb->len);
+                                                  pl_itr, skb_len);
                if (result < 0)
                        goto error_pl_descr_check;
                single_last = num_pls == 1 || i == num_pls - 1;
@@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
        if (i < i2400m->rx_pl_min)
                i2400m->rx_pl_min = i;
        i2400m->rx_num++;
-        i2400m->rx_size_acc += skb->len;
+        i2400m->rx_size_acc += skb_len;
-        if (skb->len < i2400m->rx_size_min)
+        if (skb_len < i2400m->rx_size_min)
-                i2400m->rx_size_min = skb->len;
+                i2400m->rx_size_min = skb_len;
-        if (skb->len > i2400m->rx_size_max)
+        if (skb_len > i2400m->rx_size_max)
-                i2400m->rx_size_max = skb->len;
+                i2400m->rx_size_max = skb_len;
        spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 error_pl_descr_check:
 error_pl_descr_short:
 error_msg_hdr_check:
-        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+        d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
                i2400m, skb, skb_len, result);
        return result;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..a3d95cca8f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -543,7 +543,7 @@ static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
        if (conf_is_ht40(conf))
                return clockrate * 2;
-        return clockrate * 2;
+        return clockrate;
 }
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 9dd9e64c2b0b..8fd00a6e5120 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCAN_HW, &priv->status);
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 59a308b02f95..d31661c1ce77 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 static void iwl3945_bg_restart(struct work_struct *data)
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 9024480a8228..c44a5e8b8b82 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -51,7 +51,6 @@
 * TODO:
 *   - handle CPU hotplug
 *   - provide turbo enable/disable api
- *   - make sure we can write turbo enable/disable reg based on MISC_EN
 *
 * Related documents:
 *   - CDI 403777, 403778 - Auburndale EDS vol 1 & 2
@@ -230,7 +229,7 @@
 #define THM_TC2         0xac
 #define THM_DTV         0xb0
 #define THM_ITV         0xd8
-#define   ITV_ME_SEQNO_MASK 0x000f0000 /* ME should update every ~200ms */
+#define   ITV_ME_SEQNO_MASK 0x00ff0000 /* ME should update every ~200ms */
 #define   ITV_ME_SEQNO_SHIFT (16)
 #define   ITV_MCH_TEMP_MASK 0x0000ff00
 #define   ITV_MCH_TEMP_SHIFT (8)
@@ -325,6 +324,7 @@ struct ips_driver {
        bool gpu_preferred;
        bool poll_turbo_status;
        bool second_cpu;
+        bool turbo_toggle_allowed;
        struct ips_mcp_limits *limits;
        /* Optional MCH interfaces for if i915 is in use */
@@ -415,7 +415,7 @@ static void ips_cpu_lower(struct ips_driver *ips)
        new_limit = cur_limit - 8; /* 1W decrease */
        /* Clamp to SKU TDP limit */
-        if (((new_limit * 10) / 8) < (ips->orig_turbo_limit & TURBO_TDP_MASK))
+        if (new_limit  < (ips->orig_turbo_limit & TURBO_TDP_MASK))
                new_limit = ips->orig_turbo_limit & TURBO_TDP_MASK;
        thm_writew(THM_MPCPC, (new_limit * 10) / 8);
@@ -461,7 +461,8 @@ static void ips_enable_cpu_turbo(struct ips_driver *ips)
        if (ips->__cpu_turbo_on)
                return;
-        on_each_cpu(do_enable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_enable_cpu_turbo, ips, 1);
        ips->__cpu_turbo_on = true;
 }
@@ -498,7 +499,8 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
        if (!ips->__cpu_turbo_on)
                return;
-        on_each_cpu(do_disable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_disable_cpu_turbo, ips, 1);
        ips->__cpu_turbo_on = false;
 }
@@ -598,17 +600,29 @@ static bool mcp_exceeded(struct ips_driver *ips)
 {
        unsigned long flags;
        bool ret = false;
+        u32 temp_limit;
+        u32 avg_power;
+        const char *msg = "MCP limit exceeded: ";
        spin_lock_irqsave(&ips->turbo_status_lock, flags);
-        if (ips->mcp_avg_temp > (ips->mcp_temp_limit * 100))
-                ret = true;
+        temp_limit = ips->mcp_temp_limit * 100;
-        if (ips->cpu_avg_power + ips->mch_avg_power > ips->mcp_power_limit)
+        if (ips->mcp_avg_temp > temp_limit) {
+                dev_info(&ips->dev->dev,
+                        "%sAvg temp %u, limit %u\n", msg, ips->mcp_avg_temp,
+                        temp_limit);
                ret = true;
-        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
+        }
-        if (ret)
+        avg_power = ips->cpu_avg_power + ips->mch_avg_power;
+        if (avg_power > ips->mcp_power_limit) {
                dev_info(&ips->dev->dev,
-                         "MCP power or thermal limit exceeded\n");
+                        "%sAvg power %u, limit %u\n", msg, avg_power,
+                        ips->mcp_power_limit);
+                ret = true;
+        }
+        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
        return ret;
 }
@@ -663,6 +677,27 @@ static bool mch_exceeded(struct ips_driver *ips)
 }
 /**
+ * verify_limits - verify BIOS provided limits
+ * @ips: IPS structure
+ *
+ * BIOS can optionally provide non-default limits for power and temp.  Check
+ * them here and use the defaults if the BIOS values are not provided or
+ * are otherwise unusable.
+ */
+static void verify_limits(struct ips_driver *ips)
+{
+        if (ips->mcp_power_limit < ips->limits->mcp_power_limit ||
+            ips->mcp_power_limit > 35000)
+                ips->mcp_power_limit = ips->limits->mcp_power_limit;
+        if (ips->mcp_temp_limit < ips->limits->core_temp_limit ||
+            ips->mcp_temp_limit < ips->limits->mch_temp_limit ||
+            ips->mcp_temp_limit > 150)
+                ips->mcp_temp_limit = min(ips->limits->core_temp_limit,
+                                          ips->limits->mch_temp_limit);
+}
+/**
 * update_turbo_limits - get various limits & settings from regs
 * @ips: IPS driver struct
 *
@@ -680,12 +715,21 @@ static void update_turbo_limits(struct ips_driver *ips)
        u32 hts = thm_readl(THM_HTS);
        ips->cpu_turbo_enabled = !(hts & HTS_PCTD_DIS);
-        ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+        /* 
+         * Disable turbo for now, until we can figure out why the power figures
+         * are wrong
+         */
+        ips->cpu_turbo_enabled = false;
+        if (ips->gpu_busy)
+                ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
        ips->core_power_limit = thm_readw(THM_MPCPC);
        ips->mch_power_limit = thm_readw(THM_MMGPC);
        ips->mcp_temp_limit = thm_readw(THM_PTL);
        ips->mcp_power_limit = thm_readw(THM_MPPC);
+        verify_limits(ips);
        /* Ignore BIOS CPU vs GPU pref */
 }
@@ -858,7 +902,7 @@ static u32 get_cpu_power(struct ips_driver *ips, u32 *last, int period)
        ret = (ret * 1000) / 65535;
        *last = val;
-        return ret;
+        return 0;
 }
 static const u16 temp_decay_factor = 2;
@@ -940,7 +984,6 @@ static int ips_monitor(void *data)
                kfree(mch_samples);
                kfree(cpu_samples);
                kfree(mchp_samples);
-                kthread_stop(ips->adjust);
                return -ENOMEM;
        }
@@ -948,7 +991,7 @@ static int ips_monitor(void *data)
                ITV_ME_SEQNO_SHIFT;
        seqno_timestamp = get_jiffies_64();
-        old_cpu_power = thm_readl(THM_CEC) / 65535;
+        old_cpu_power = thm_readl(THM_CEC);
        schedule_timeout_interruptible(msecs_to_jiffies(IPS_SAMPLE_PERIOD));
        /* Collect an initial average */
@@ -1150,11 +1193,18 @@ static irqreturn_t ips_irq_handler(int irq, void *arg)
                                STS_GPL_SHIFT;
                        /* ignore EC CPU vs GPU pref */
                        ips->cpu_turbo_enabled = !(sts & STS_PCTD_DIS);
-                        ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
+                        /* 
+                         * Disable turbo for now, until we can figure
+                         * out why the power figures are wrong
+                         */
+                        ips->cpu_turbo_enabled = false;
+                        if (ips->gpu_busy)
+                                ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
                        ips->mcp_temp_limit = (sts & STS_PTL_MASK) >>
                                STS_PTL_SHIFT;
                        ips->mcp_power_limit = (tc1 & STS_PPL_MASK) >>
                                STS_PPL_SHIFT;
+                        verify_limits(ips);
                        spin_unlock(&ips->turbo_status_lock);
                        thm_writeb(THM_SEC, SEC_ACK);
@@ -1333,8 +1383,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
         * turbo manually or we'll get an illegal MSR access, even though
         * turbo will still be available.
         */
-        if (!(misc_en & IA32_MISC_TURBO_EN))
+        if (misc_en & IA32_MISC_TURBO_EN)
-                ; /* add turbo MSR write allowed flag if necessary */
+                ips->turbo_toggle_allowed = true;
+        else
+                ips->turbo_toggle_allowed = false;
        if (strstr(boot_cpu_data.x86_model_id, "CPU       M"))
                limits = &ips_sv_limits;
@@ -1351,9 +1403,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
        tdp = turbo_power & TURBO_TDP_MASK;
        /* Sanity check TDP against CPU */
-        if (limits->mcp_power_limit != (tdp / 8) * 1000) {
+        if (limits->core_power_limit != (tdp / 8) * 1000) {
-                dev_warn(&ips->dev->dev, "Warning: CPU TDP doesn't match expected value (found %d, expected %d)\n",
+                dev_info(&ips->dev->dev, "CPU TDP doesn't match expected value (found %d, expected %d)\n",
-                         tdp / 8, limits->mcp_power_limit / 1000);
+                         tdp / 8, limits->core_power_limit / 1000);
+                limits->core_power_limit = (tdp / 8) * 1000;
        }
 out:
@@ -1390,7 +1443,7 @@ static bool ips_get_i915_syms(struct ips_driver *ips)
        return true;
 out_put_busy:
-        symbol_put(i915_gpu_turbo_disable);
+        symbol_put(i915_gpu_busy);
 out_put_lower:
        symbol_put(i915_gpu_lower);
 out_put_raise:
@@ -1532,22 +1585,27 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        /* Save turbo limits & ratios */
        rdmsrl(TURBO_POWER_CURRENT_LIMIT, ips->orig_turbo_limit);
-        ips_enable_cpu_turbo(ips);
+        ips_disable_cpu_turbo(ips);
-        ips->cpu_turbo_enabled = true;
+        ips->cpu_turbo_enabled = false;
-        /* Set up the work queue and monitor/adjust threads */
+        /* Create thermal adjust thread */
-        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
-        if (IS_ERR(ips->monitor)) {
+        if (IS_ERR(ips->adjust)) {
                dev_err(&dev->dev,
-                        "failed to create thermal monitor thread, aborting\n");
+                        "failed to create thermal adjust thread, aborting\n");
                ret = -ENOMEM;
                goto error_free_irq;
        }
-        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
+        /*
-        if (IS_ERR(ips->adjust)) {
+         * Set up the work queue and monitor thread. The monitor thread
+         * will wake up ips_adjust thread.
+         */
+        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        if (IS_ERR(ips->monitor)) {
                dev_err(&dev->dev,
-                        "failed to create thermal adjust thread, aborting\n");
+                        "failed to create thermal monitor thread, aborting\n");
                ret = -ENOMEM;
                goto error_thread_cleanup;
        }
@@ -1566,7 +1624,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        return ret;
 error_thread_cleanup:
-        kthread_stop(ips->monitor);
+        kthread_stop(ips->adjust);
 error_free_irq:
        free_irq(ips->dev->irq, ips);
 error_unmap:
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index df1fb53c09d2..a4be41614eeb 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -256,7 +256,6 @@ static int __devexit ad5398_remove(struct i2c_client *client)
        regulator_unregister(chip->rdev);
        kfree(chip);
-        i2c_set_clientdata(client, NULL);
        return 0;
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 422a709d271d..cc8b337b9119 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
            constraints->min_uA != constraints->max_uA) {
                ret = _regulator_get_current_limit(rdev);
                if (ret > 0)
-                        count += sprintf(buf + count, "at %d uA ", ret / 1000);
+                        count += sprintf(buf + count, "at %d mA ", ret / 1000);
        }
        if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,8 +2302,10 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
        dev_set_name(&rdev->dev, "regulator.%d",
                     atomic_inc_return(&regulator_no) - 1);
        ret = device_register(&rdev->dev);
-        if (ret != 0)
+        if (ret != 0) {
+                put_device(&rdev->dev);
                goto clean;
+        }
        dev_set_drvdata(&rdev->dev, rdev);
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index d61ecb885a8c..b8cc6389a541 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -191,8 +191,6 @@ static int __devexit isl6271a_remove(struct i2c_client *i2c)
        struct isl_pmic *pmic = i2c_get_clientdata(i2c);
        int i;
-        i2c_set_clientdata(i2c, NULL);
        for (i = 0; i < 3; i++)
                regulator_unregister(pmic->rdev[i]);
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 4520ace3f7e7..6b60a9c0366b 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
                /* set external clock frequency */
                info->extclk_freq = pdata->extclk_freq;
                max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-                                 info->extclk_freq);
+                                 info->extclk_freq << 6);
        }
        if (pdata->ramp_timing) {
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 9daed8db83d3..9de8516e3531 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -268,7 +268,6 @@ out_irq:
                free_irq(client->irq, client);
 out_free:
-        i2c_set_clientdata(client, NULL);
        kfree(ds3232);
        return ret;
 }
@@ -287,7 +286,6 @@ static int __devexit ds3232_remove(struct i2c_client *client)
        }
        rtc_device_unregister(ds3232->rtc);
-        i2c_set_clientdata(client, NULL);
        kfree(ds3232);
        return 0;
 }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 0bcf4c1601a2..b5a78a1f4421 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -86,6 +87,10 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
        const struct spi_device *spi = to_spi_device(dev);
        const struct spi_driver *sdrv = to_spi_driver(drv);
+        /* Attempt an OF style match */
+        if (of_driver_match_device(dev, drv))
+                return 1;
        if (sdrv->id_table)
                return !!spi_match_id(sdrv->id_table, spi);
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index e24a63498acb..63e51b011d50 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
        spi_gpio->bitbang.master = spi_master_get(master);
        spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
-        if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
+        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
                spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
                spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
                spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index d31b57f7baaf..1dd86b835cd8 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
        xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
-        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        if (mspi->rx_dma == mspi->dma_dummy_rx)
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
+        else
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
        out_be16(&rx_bd->cbd_datlen, 0);
        out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
-        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        if (mspi->tx_dma == mspi->dma_dummy_tx)
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
+        else
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
        out_be16(&tx_bd->cbd_datlen, xfer_len);
        out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
                                 BD_SC_LAST);
diff --git a/drivers/staging/tm6000/Kconfig b/drivers/staging/tm6000/Kconfig
index c725356cc346..de7ebb99d8f6 100644
--- a/drivers/staging/tm6000/Kconfig
+++ b/drivers/staging/tm6000/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_TM6000
        tristate "TV Master TM5600/6000/6010 driver"
-        depends on VIDEO_DEV && I2C && INPUT && USB && EXPERIMENTAL
+        depends on VIDEO_DEV && I2C && INPUT && IR_CORE && USB && EXPERIMENTAL
        select VIDEO_TUNER
        select MEDIA_TUNER_XC2028
        select MEDIA_TUNER_XC5000
diff --git a/drivers/staging/tm6000/tm6000-input.c b/drivers/staging/tm6000/tm6000-input.c
index 32f7a0af6938..54f7667cc706 100644
--- a/drivers/staging/tm6000/tm6000-input.c
+++ b/drivers/staging/tm6000/tm6000-input.c
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(enable_ir, "enable ir (default is enable");
        }
 struct tm6000_ir_poll_result {
-        u8 rc_data[4];
+        u16 rc_data;
 };
 struct tm6000_IR {
@@ -60,9 +60,9 @@ struct tm6000_IR {
        int                     polling;
        struct delayed_work     work;
        u8                      wait:1;
+        u8                      key:1;
        struct urb              *int_urb;
        u8                      *urb_data;
-        u8                      key:1;
        int (*get_key) (struct tm6000_IR *, struct tm6000_ir_poll_result *);
@@ -122,13 +122,14 @@ static void tm6000_ir_urb_received(struct urb *urb)
        if (urb->status != 0)
                printk(KERN_INFO "not ready\n");
-        else if (urb->actual_length > 0)
+        else if (urb->actual_length > 0) {
                memcpy(ir->urb_data, urb->transfer_buffer, urb->actual_length);
-        dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
+                dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
-        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
+                        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
-        ir->key = 1;
+                ir->key = 1;
+        }
        rc = usb_submit_urb(urb, GFP_ATOMIC);
 }
@@ -140,30 +141,47 @@ static int default_polling_getkey(struct tm6000_IR *ir,
        int rc;
        u8 buf[2];
-        if (ir->wait && !&dev->int_in) {
+        if (ir->wait && !&dev->int_in)
-                poll_result->rc_data[0] = 0xff;
                return 0;
-        }
        if (&dev->int_in) {
-                poll_result->rc_data[0] = ir->urb_data[0];
+                if (ir->ir.ir_type == IR_TYPE_RC5)
-                poll_result->rc_data[1] = ir->urb_data[1];
+                        poll_result->rc_data = ir->urb_data[0];
+                else
+                        poll_result->rc_data = ir->urb_data[0] | ir->urb_data[1] << 8;
        } else {
                tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 0);
                msleep(10);
                tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 1);
                msleep(10);
-                rc = tm6000_read_write_usb(dev, USB_DIR_IN | USB_TYPE_VENDOR |
+                if (ir->ir.ir_type == IR_TYPE_RC5) {
-                 USB_RECIP_DEVICE, REQ_02_GET_IR_CODE, 0, 0, buf, 1);
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 1);
-                msleep(10);
+                        msleep(10);
-                dprintk("read data=%02x\n", buf[0]);
+                        dprintk("read data=%02x\n", buf[0]);
-                if (rc < 0)
+                        if (rc < 0)
-                        return rc;
+                                return rc;
-                poll_result->rc_data[0] = buf[0];
+                        poll_result->rc_data = buf[0];
+                } else {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 2);
+                        msleep(10);
+                        dprintk("read data=%04x\n", buf[0] | buf[1] << 8);
+                        if (rc < 0)
+                                return rc;
+                        poll_result->rc_data = buf[0] | buf[1] << 8;
+                }
+                if ((poll_result->rc_data & 0x00ff) != 0xff)
+                        ir->key = 1;
        }
        return 0;
 }
@@ -180,12 +198,11 @@ static void tm6000_ir_handle_key(struct tm6000_IR *ir)
                return;
        }
-        dprintk("ir->get_key result data=%02x %02x\n",
+        dprintk("ir->get_key result data=%04x\n", poll_result.rc_data);
-                poll_result.rc_data[0], poll_result.rc_data[1]);
-        if (poll_result.rc_data[0] != 0xff && ir->key == 1) {
+        if (ir->key) {
                ir_input_keydown(ir->input->input_dev, &ir->ir,
-                        poll_result.rc_data[0] | poll_result.rc_data[1] << 8);
+                                (u32)poll_result.rc_data);
                ir_input_nokey(ir->input->input_dev, &ir->ir);
                ir->key = 0;
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 29bac5118877..d409495876f1 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -755,7 +755,10 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
        int ret = 0;
-        blocking_notifier_chain_register(&xenstore_chain, nb);
+        if (xenstored_ready > 0)
+                ret = nb->notifier_call(nb, 0, NULL);
+        else
+                blocking_notifier_chain_register(&xenstore_chain, nb);
        return ret;
 }
@@ -769,7 +772,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 void xenbus_probe(struct work_struct *unused)
 {
-        BUG_ON((xenstored_ready <= 0));
+        xenstored_ready = 1;
        /* Enumerate devices in xenstore and watch for changes. */
        xenbus_probe_devices(&xenbus_frontend);
@@ -835,8 +838,8 @@ static int __init xenbus_init(void)
                        xen_store_evtchn = xen_start_info->store_evtchn;
                        xen_store_mfn = xen_start_info->store_mfn;
                        xen_store_interface = mfn_to_virt(xen_store_mfn);
+                        xenstored_ready = 1;
                }
-                xenstored_ready = 1;
        }
        /* Initialize the interface to xenstore. */
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index f96eff04e11a..a6395bdb26ae 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -134,10 +134,6 @@ static int aout_core_dump(struct coredump_params *cprm)
                if (!dump_write(file, dump_start, dump_size))
                        goto end_coredump;
        }
-/* Finally dump the task struct.  Not be used by gdb, but could be useful */
-        set_fs(KERNEL_DS);
-        if (!dump_write(file, current, sizeof(*current)))
-                goto end_coredump;
 end_coredump:
        set_fs(fs);
        return has_dumped;
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 73c153092f72..5e9da996a151 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2283,7 +2283,8 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
 {
        struct ceph_inode_info *ci = ceph_inode(inode);
        int mds = session->s_mds;
-        int seq = le32_to_cpu(grant->seq);
+        unsigned seq = le32_to_cpu(grant->seq);
+        unsigned issue_seq = le32_to_cpu(grant->issue_seq);
        int newcaps = le32_to_cpu(grant->caps);
        int issued, implemented, used, wanted, dirty;
        u64 size = le64_to_cpu(grant->size);
@@ -2295,8 +2296,8 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
        int revoked_rdcache = 0;
        int queue_invalidate = 0;
-        dout("handle_cap_grant inode %p cap %p mds%d seq %d %s\n",
+        dout("handle_cap_grant inode %p cap %p mds%d seq %u/%u %s\n",
-             inode, cap, mds, seq, ceph_cap_string(newcaps));
+             inode, cap, mds, seq, issue_seq, ceph_cap_string(newcaps));
        dout(" size %llu max_size %llu, i_size %llu\n", size, max_size,
                inode->i_size);
@@ -2392,6 +2393,7 @@ static void handle_cap_grant(struct inode *inode, struct ceph_mds_caps *grant,
        }
        cap->seq = seq;
+        cap->issue_seq = issue_seq;
        /* file layout may have changed */
        ci->i_layout = grant->layout;
@@ -2774,15 +2776,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                if (op == CEPH_CAP_OP_IMPORT)
                        __queue_cap_release(session, vino.ino, cap_id,
                                            mseq, seq);
+                goto flush_cap_releases;
-                /*
-                 * send any full release message to try to move things
-                 * along for the mds (who clearly thinks we still have this
-                 * cap).
-                 */
-                ceph_add_cap_releases(mdsc, session);
-                ceph_send_cap_releases(mdsc, session);
-                goto done;
        }
        /* these will work even if we don't have a cap yet */
@@ -2810,7 +2804,7 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                dout(" no cap on %p ino %llx.%llx from mds%d\n",
                     inode, ceph_ino(inode), ceph_snap(inode), mds);
                spin_unlock(&inode->i_lock);
-                goto done;
+                goto flush_cap_releases;
        }
        /* note that each of these drops i_lock for us */
@@ -2834,6 +2828,17 @@ void ceph_handle_caps(struct ceph_mds_session *session,
                       ceph_cap_op_name(op));
        }
+        goto done;
+flush_cap_releases:
+        /*
+         * send any full release message to try to move things
+         * along for the mds (who clearly thinks we still have this
+         * cap).
+         */
+        ceph_add_cap_releases(mdsc, session);
+        ceph_send_cap_releases(mdsc, session);
 done:
        mutex_unlock(&session->s_mutex);
 done_unlocked:
diff --git a/fs/ceph/export.c b/fs/ceph/export.c
index 4480cb1c63e7..e38423e82f2e 100644
--- a/fs/ceph/export.c
+++ b/fs/ceph/export.c
@@ -42,32 +42,37 @@ struct ceph_nfs_confh {
 static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len,
                          int connectable)
 {
+        int type;
        struct ceph_nfs_fh *fh = (void *)rawfh;
        struct ceph_nfs_confh *cfh = (void *)rawfh;
        struct dentry *parent = dentry->d_parent;
        struct inode *inode = dentry->d_inode;
-        int type;
+        int connected_handle_length = sizeof(*cfh)/4;
+        int handle_length = sizeof(*fh)/4;
        /* don't re-export snaps */
        if (ceph_snap(inode) != CEPH_NOSNAP)
                return -EINVAL;
-        if (*max_len >= sizeof(*cfh)) {
+        if (*max_len >= connected_handle_length) {
                dout("encode_fh %p connectable\n", dentry);
                cfh->ino = ceph_ino(dentry->d_inode);
                cfh->parent_ino = ceph_ino(parent->d_inode);
                cfh->parent_name_hash = parent->d_name.hash;
-                *max_len = sizeof(*cfh);
+                *max_len = connected_handle_length;
                type = 2;
-        } else if (*max_len > sizeof(*fh)) {
+        } else if (*max_len >= handle_length) {
-                if (connectable)
+                if (connectable) {
-                        return -ENOSPC;
+                        *max_len = connected_handle_length;
+                        return 255;
+                }
                dout("encode_fh %p\n", dentry);
                fh->ino = ceph_ino(dentry->d_inode);
-                *max_len = sizeof(*fh);
+                *max_len = handle_length;
                type = 1;
        } else {
-                return -ENOSPC;
+                *max_len = handle_length;
+                return 255;
        }
        return type;
 }
diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 8c044a4f0457..66e4da6dba22 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -697,7 +697,7 @@ more:
                         * start_request so that a tid has been assigned.
                         */
                        spin_lock(&ci->i_unsafe_lock);
-                        list_add(&ci->i_unsafe_writes, &req->r_unsafe_item);
+                        list_add(&req->r_unsafe_item, &ci->i_unsafe_writes);
                        spin_unlock(&ci->i_unsafe_lock);
                        ceph_get_cap_refs(ci, CEPH_CAP_FILE_WR);
                }
diff --git a/fs/ceph/osd_client.c b/fs/ceph/osd_client.c
index dfced1dacbcd..3b5571b8ce22 100644
--- a/fs/ceph/osd_client.c
+++ b/fs/ceph/osd_client.c
@@ -549,7 +549,7 @@ static void __unregister_request(struct ceph_osd_client *osdc,
 */
 static void __cancel_request(struct ceph_osd_request *req)
 {
-        if (req->r_sent) {
+        if (req->r_sent && req->r_osd) {
                ceph_con_revoke(&req->r_osd->o_con, req->r_request);
                req->r_sent = 0;
        }
diff --git a/fs/exec.c b/fs/exec.c
index 828dd2461d6b..6d2b6f936858 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -2014,3 +2014,43 @@ fail_creds:
 fail:
        return;
 }
+/*
+ * Core dumping helper functions.  These are the only things you should
+ * do on a core-file: use only these functions to write out all the
+ * necessary info.
+ */
+int dump_write(struct file *file, const void *addr, int nr)
+{
+        return access_ok(VERIFY_READ, addr, nr) && file->f_op->write(file, addr, nr, &file->f_pos) == nr;
+}
+EXPORT_SYMBOL(dump_write);
+int dump_seek(struct file *file, loff_t off)
+{
+        int ret = 1;
+        if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
+                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
+                        return 0;
+        } else {
+                char *buf = (char *)get_zeroed_page(GFP_KERNEL);
+                if (!buf)
+                        return 0;
+                while (off > 0) {
+                        unsigned long n = off;
+                        if (n > PAGE_SIZE)
+                                n = PAGE_SIZE;
+                        if (!dump_write(file, buf, n)) {
+                                ret = 0;
+                                break;
+                        }
+                        off -= n;
+                }
+                free_page((unsigned long)buf);
+        }
+        return ret;
+}
+EXPORT_SYMBOL(dump_seek);
diff --git a/fs/exofs/inode.c b/fs/exofs/inode.c
index eb7368ebd8cd..3eadd97324b1 100644
--- a/fs/exofs/inode.c
+++ b/fs/exofs/inode.c
@@ -54,6 +54,9 @@ struct page_collect {
        unsigned nr_pages;
        unsigned long length;
        loff_t pg_first; /* keep 64bit also in 32-arches */
+        bool read_4_write; /* This means two things: that the read is sync
+                            * And the pages should not be unlocked.
+                            */
 };
 static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
@@ -71,6 +74,7 @@ static void _pcol_init(struct page_collect *pcol, unsigned expected_pages,
        pcol->nr_pages = 0;
        pcol->length = 0;
        pcol->pg_first = -1;
+        pcol->read_4_write = false;
 }
 static void _pcol_reset(struct page_collect *pcol)
@@ -347,7 +351,8 @@ static int readpage_strip(void *data, struct page *page)
                if (PageError(page))
                        ClearPageError(page);
-                unlock_page(page);
+                if (!pcol->read_4_write)
+                        unlock_page(page);
                EXOFS_DBGMSG("readpage_strip(0x%lx, 0x%lx) empty page,"
                             " splitting\n", inode->i_ino, page->index);
@@ -428,6 +433,7 @@ static int _readpage(struct page *page, bool is_sync)
        /* readpage_strip might call read_exec(,is_sync==false) at several
         * places but not if we have a single page.
         */
+        pcol.read_4_write = is_sync;
        ret = readpage_strip(&pcol, page);
        if (ret) {
                EXOFS_ERR("_readpage => %d\n", ret);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 5581122bd2c0..ab38fef1c9a1 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -72,22 +72,11 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 static inline struct backing_dev_info *inode_to_bdi(struct inode *inode)
 {
        struct super_block *sb = inode->i_sb;
-        struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
-        /*
+        if (strcmp(sb->s_type->name, "bdev") == 0)
-         * For inodes on standard filesystems, we use superblock's bdi. For
+                return inode->i_mapping->backing_dev_info;
-         * inodes on virtual filesystems, we want to use inode mapping's bdi
-         * because they can possibly point to something useful (think about
+        return sb->s_bdi;
-         * block_dev filesystem).
-         */
-        if (sb->s_bdi && sb->s_bdi != &noop_backing_dev_info) {
-                /* Some device inodes could play dirty tricks. Catch them... */
-                WARN(bdi != sb->s_bdi && bdi_cap_writeback_dirty(bdi),
-                        "Dirtiable inode bdi %s != sb bdi %s\n",
-                        bdi->name, sb->s_bdi->name);
-                return sb->s_bdi;
-        }
-        return bdi;
 }
 static void bdi_queue_work(struct backing_dev_info *bdi,
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index d367af1514ef..cde755cca564 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1354,7 +1354,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
        loff_t file_size;
        unsigned int num;
        unsigned int offset;
-        size_t total_len;
+        size_t total_len = 0;
        req = fuse_get_req(fc);
        if (IS_ERR(req))
diff --git a/fs/nfsd/nfsfh.h b/fs/nfsd/nfsfh.h
index cdfb8c6a4206..c16f8d8331b5 100644
--- a/fs/nfsd/nfsfh.h
+++ b/fs/nfsd/nfsfh.h
@@ -196,8 +196,6 @@ fh_lock(struct svc_fh *fhp)
 static inline void
 fh_unlock(struct svc_fh *fhp)
 {
-        BUG_ON(!fhp->fh_dentry);
        if (fhp->fh_locked) {
                fill_post_wcc(fhp);
                mutex_unlock(&fhp->fh_dentry->d_inode->i_mutex);
diff --git a/fs/notify/Kconfig b/fs/notify/Kconfig
index 22c629eedd82..b388443c3a09 100644
--- a/fs/notify/Kconfig
+++ b/fs/notify/Kconfig
@@ -3,4 +3,4 @@ config FSNOTIFY
 source "fs/notify/dnotify/Kconfig"
 source "fs/notify/inotify/Kconfig"
-source "fs/notify/fanotify/Kconfig"
+#source "fs/notify/fanotify/Kconfig"
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index d59c4a65d492..81976ffed7d6 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -668,14 +668,11 @@ xfs_inode_set_reclaim_tag(
        xfs_perag_put(pag);
 }
-void
+STATIC void
-__xfs_inode_clear_reclaim_tag(
+__xfs_inode_clear_reclaim(
-        xfs_mount_t     *mp,
        xfs_perag_t     *pag,
        xfs_inode_t     *ip)
 {
-        radix_tree_tag_clear(&pag->pag_ici_root,
-                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
        pag->pag_ici_reclaimable--;
        if (!pag->pag_ici_reclaimable) {
                /* clear the reclaim tag from the perag radix tree */
@@ -689,6 +686,17 @@ __xfs_inode_clear_reclaim_tag(
        }
 }
+void
+__xfs_inode_clear_reclaim_tag(
+        xfs_mount_t     *mp,
+        xfs_perag_t     *pag,
+        xfs_inode_t     *ip)
+{
+        radix_tree_tag_clear(&pag->pag_ici_root,
+                        XFS_INO_TO_AGINO(mp, ip->i_ino), XFS_ICI_RECLAIM_TAG);
+        __xfs_inode_clear_reclaim(pag, ip);
+}
 /*
 * Inodes in different states need to be treated differently, and the return
 * value of xfs_iflush is not sufficient to get this right. The following table
@@ -838,6 +846,7 @@ reclaim:
        if (!radix_tree_delete(&pag->pag_ici_root,
                                XFS_INO_TO_AGINO(ip->i_mount, ip->i_ino)))
                ASSERT(0);
+        __xfs_inode_clear_reclaim(pag, ip);
        write_unlock(&pag->pag_ici_lock);
        /*
diff --git a/include/drm/ttm/ttm_bo_api.h b/include/drm/ttm/ttm_bo_api.h
index 267a86c74e2e..2040e6c4f172 100644
--- a/include/drm/ttm/ttm_bo_api.h
+++ b/include/drm/ttm/ttm_bo_api.h
@@ -246,9 +246,11 @@ struct ttm_buffer_object {
        atomic_t reserved;
        /**
         * Members protected by the bo::lock
+         * In addition, setting sync_obj to anything else
+         * than NULL requires bo::reserved to be held. This allows for
+         * checking NULL while reserved but not holding bo::lock.
         */
        void *sync_obj_arg;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 626b629429ff..4e8ea8c8ec1e 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -118,7 +118,6 @@ header-y += eventpoll.h
 header-y += ext2_fs.h
 header-y += fadvise.h
 header-y += falloc.h
-header-y += fanotify.h
 header-y += fb.h
 header-y += fcntl.h
 header-y += fd.h
diff --git a/include/linux/coredump.h b/include/linux/coredump.h
index 8ba66a9d9022..ba4b85a6d9b8 100644
--- a/include/linux/coredump.h
+++ b/include/linux/coredump.h
@@ -9,37 +9,7 @@
 * These are the only things you should do on a core-file: use only these
 * functions to write out all the necessary info.
 */
-static inline int dump_write(struct file *file, const void *addr, int nr)
+extern int dump_write(struct file *file, const void *addr, int nr);
-{
+extern int dump_seek(struct file *file, loff_t off);
-        return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
-}
-static inline int dump_seek(struct file *file, loff_t off)
-{
-        int ret = 1;
-        if (file->f_op->llseek && file->f_op->llseek != no_llseek) {
-                if (file->f_op->llseek(file, off, SEEK_CUR) < 0)
-                        return 0;
-        } else {
-                char *buf = (char *)get_zeroed_page(GFP_KERNEL);
-                if (!buf)
-                        return 0;
-                while (off > 0) {
-                        unsigned long n = off;
-                        if (n > PAGE_SIZE)
-                                n = PAGE_SIZE;
-                        if (!dump_write(file, buf, n)) {
-                                ret = 0;
-                                break;
-                        }
-                        off -= n;
-                }
-                free_page((unsigned long)buf);
-        }
-        return ret;
-}
 #endif /* _LINUX_COREDUMP_H */
diff --git a/include/linux/elevator.h b/include/linux/elevator.h
index 926b50322a46..4fd978e7eb83 100644
--- a/include/linux/elevator.h
+++ b/include/linux/elevator.h
@@ -93,6 +93,7 @@ struct elevator_queue
        struct elevator_type *elevator_type;
        struct mutex sysfs_lock;
        struct hlist_head *hash;
+        unsigned int registered:1;
 };
 /*
diff --git a/include/linux/module.h b/include/linux/module.h
index 8a6b9fdc7ffa..aace066bad8f 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -686,17 +686,16 @@ extern int module_sysfs_initialized;
 #ifdef CONFIG_GENERIC_BUG
-int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
                         struct module *);
 void module_bug_cleanup(struct module *);
 #else   /* !CONFIG_GENERIC_BUG */
-static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
+static inline void module_bug_finalize(const Elf_Ehdr *hdr,
                                        const Elf_Shdr *sechdrs,
                                        struct module *mod)
 {
-        return 0;
 }
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif  /* CONFIG_GENERIC_BUG */
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 9fbc54a2585d..83af1f8d8b74 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -454,7 +454,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 * Makes rcu_dereference_check() do the dirty work.
 */
 #define rcu_dereference_bh(p) \
-                rcu_dereference_check(p, rcu_read_lock_bh_held())
+                rcu_dereference_check(p, rcu_read_lock_bh_held() || irqs_disabled())
 /**
 * rcu_dereference_sched - fetch RCU-protected pointer, checking for RCU-sched
diff --git a/include/linux/types.h b/include/linux/types.h
index 01a082f56ef4..357dbc19606f 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -121,7 +121,15 @@ typedef		__u64		u_int64_t;
 typedef         __s64           int64_t;
 #endif
-/* this is a special 64bit data type that is 8-byte aligned */
+/*
+ * aligned_u64 should be used in defining kernel<->userspace ABIs to avoid
+ * common 32/64-bit compat problems.
+ * 64-bit values align to 4-byte boundaries on x86_32 (and possibly other
+ * architectures) and to 8-byte boundaries on 64-bit architetures.  The new
+ * aligned_64 type enforces 8-byte alignment so that structs containing
+ * aligned_64 values have the same alignment on 32-bit and 64-bit architectures.
+ * No conversions are necessary between 32-bit user-space and a 64-bit kernel.
+ */
 #define aligned_u64 __u64 __attribute__((aligned(8)))
 #define aligned_be64 __be64 __attribute__((aligned(8)))
 #define aligned_le64 __le64 __attribute__((aligned(8)))
@@ -178,6 +186,11 @@ typedef __u64 __bitwise __be64;
 typedef __u16 __bitwise __sum16;
 typedef __u32 __bitwise __wsum;
+/* this is a special 64bit data type that is 8-byte aligned */
+#define __aligned_u64 __u64 __attribute__((aligned(8)))
+#define __aligned_be64 __be64 __attribute__((aligned(8)))
+#define __aligned_le64 __le64 __attribute__((aligned(8)))
 #ifdef __KERNEL__
 typedef unsigned __bitwise__ gfp_t;
 typedef unsigned __bitwise__ fmode_t;
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 0836ccc57121..3efc9f3f43a0 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -614,6 +614,7 @@ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
                (wait)->private = current;                              \
                (wait)->func = autoremove_wake_function;                \
                INIT_LIST_HEAD(&(wait)->task_list);                     \
+                (wait)->flags = 0;                                      \
        } while (0)
 /**
diff --git a/include/media/videobuf-dma-sg.h b/include/media/videobuf-dma-sg.h
index 97e07f46a0fa..aa4ebb42a565 100644
--- a/include/media/videobuf-dma-sg.h
+++ b/include/media/videobuf-dma-sg.h
@@ -48,6 +48,7 @@ struct videobuf_dmabuf {
        /* for userland buffer */
        int                 offset;
+        size_t              size;
        struct page         **pages;
        /* for kernel buffers */
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index 27a902d9b3a9..30fce0128dd7 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -161,12 +161,30 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk, unsigned long l
 {
        struct sk_buff *skb;
+        release_sock(sk);
        if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
                skb_reserve(skb, BT_SKB_RESERVE);
                bt_cb(skb)->incoming  = 0;
        }
+        lock_sock(sk);
+        if (!skb && *err)
+                return NULL;
+        *err = sock_error(sk);
+        if (*err)
+                goto out;
+        if (sk->sk_shutdown) {
+                *err = -ECONNRESET;
+                goto out;
+        }
        return skb;
+out:
+        kfree_skb(skb);
+        return NULL;
 }
 int bt_err(__u16 code);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 1decafbb6b1a..72206cf5c6cf 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -931,6 +931,7 @@ static inline int
 remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
 {
        if (hrtimer_is_queued(timer)) {
+                unsigned long state;
                int reprogram;
                /*
@@ -944,8 +945,13 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base)
                debug_deactivate(timer);
                timer_stats_hrtimer_clear_start_info(timer);
                reprogram = base->cpu_base == &__get_cpu_var(hrtimer_bases);
-                __remove_hrtimer(timer, base, HRTIMER_STATE_INACTIVE,
+                /*
-                                 reprogram);
+                 * We must preserve the CALLBACK state flag here,
+                 * otherwise we could move the timer base in
+                 * switch_hrtimer_base.
+                 */
+                state = timer->state & HRTIMER_STATE_CALLBACK;
+                __remove_hrtimer(timer, base, state, reprogram);
                return 1;
        }
        return 0;
@@ -1231,6 +1237,9 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now)
                BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
                enqueue_hrtimer(timer, base);
        }
+        WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));
        timer->state &= ~HRTIMER_STATE_CALLBACK;
 }
diff --git a/kernel/module.c b/kernel/module.c
index d0b5f8db11b4..ccd641991842 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1537,6 +1537,7 @@ static int __unlink_module(void *_mod)
 {
        struct module *mod = _mod;
        list_del(&mod->list);
+        module_bug_cleanup(mod);
        return 0;
 }
@@ -2625,6 +2626,7 @@ static struct module *load_module(void __user *umod,
        if (err < 0)
                goto ddebug;
+        module_bug_finalize(info.hdr, info.sechdrs, mod);
        list_add_rcu(&mod->list, &modules);
        mutex_unlock(&module_mutex);
@@ -2650,6 +2652,8 @@ static struct module *load_module(void __user *umod,
        mutex_lock(&module_mutex);
        /* Unlink carefully: kallsyms could be walking list. */
        list_del_rcu(&mod->list);
+        module_bug_cleanup(mod);
 ddebug:
        if (!mod->taints)
                dynamic_debug_remove(info.debug);
diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index db5b56064687..b98bed3d8182 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -2202,15 +2202,13 @@ static void perf_event_for_each(struct perf_event *event,
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
 {
        struct perf_event_context *ctx = event->ctx;
-        unsigned long size;
        int ret = 0;
        u64 value;
        if (!event->attr.sample_period)
                return -EINVAL;
-        size = copy_from_user(&value, arg, sizeof(value));
+        if (copy_from_user(&value, arg, sizeof(value)))
-        if (size != sizeof(value))
                return -EFAULT;
        if (!value)
diff --git a/kernel/signal.c b/kernel/signal.c
index bded65187780..919562c3d6b7 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2215,6 +2215,14 @@ int copy_siginfo_to_user(siginfo_t __user *to, siginfo_t *from)
 #ifdef __ARCH_SI_TRAPNO
                err |= __put_user(from->si_trapno, &to->si_trapno);
 #endif
+#ifdef BUS_MCEERR_AO
+                /* 
+                 * Other callers might not initialize the si_lsb field,
+                 * so check explicitely for the right codes here.
+                 */
+                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
+                        err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+#endif
                break;
        case __SI_CHLD:
                err |= __put_user(from->si_pid, &to->si_pid);
diff --git a/kernel/smp.c b/kernel/smp.c
index 75c970c715d3..ed6aacfcb7ef 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -365,9 +365,10 @@ call:
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 /**
- * __smp_call_function_single(): Run a function on another CPU
+ * __smp_call_function_single(): Run a function on a specific CPU
 * @cpu: The CPU to run on.
 * @data: Pre-allocated and setup data structure
+ * @wait: If true, wait until function has completed on specified CPU.
 *
 * Like smp_call_function_single(), but allow caller to pass in a
 * pre-allocated data structure. Useful for embedding @data inside
@@ -376,8 +377,10 @@ EXPORT_SYMBOL_GPL(smp_call_function_any);
 void __smp_call_function_single(int cpu, struct call_single_data *data,
                                int wait)
 {
-        csd_lock(data);
+        unsigned int this_cpu;
+        unsigned long flags;
+        this_cpu = get_cpu();
        /*
         * Can deadlock when called with interrupts disabled.
         * We allow cpu's that are not yet online though, as no one else can
@@ -387,7 +390,15 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
        WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
                     && !oops_in_progress);
-        generic_exec_single(cpu, data, wait);
+        if (cpu == this_cpu) {
+                local_irq_save(flags);
+                data->func(data->info);
+                local_irq_restore(flags);
+        } else {
+                csd_lock(data);
+                generic_exec_single(cpu, data, wait);
+        }
+        put_cpu();
 }
 /**
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index f88552c6d227..3a45c224770f 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2485,7 +2485,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
                kbuf[left] = 0;
        }
-        for (; left && vleft--; i++, min++, max++, first=0) {
+        for (; left && vleft--; i++, first = 0) {
                unsigned long val;
                if (write) {
diff --git a/kernel/sysctl_check.c b/kernel/sysctl_check.c
index 04cdcf72c827..10b90d8a03c4 100644
--- a/kernel/sysctl_check.c
+++ b/kernel/sysctl_check.c
@@ -143,15 +143,6 @@ int sysctl_check_table(struct nsproxy *namespaces, struct ctl_table *table)
                                if (!table->maxlen)
                                        set_fail(&fail, table, "No maxlen");
                        }
-                        if ((table->proc_handler == proc_doulongvec_minmax) ||
-                            (table->proc_handler == proc_doulongvec_ms_jiffies_minmax)) {
-                                if (table->maxlen > sizeof (unsigned long)) {
-                                        if (!table->extra1)
-                                                set_fail(&fail, table, "No min");
-                                        if (!table->extra2)
-                                                set_fail(&fail, table, "No max");
-                                }
-                        }
 #ifdef CONFIG_PROC_SYSCTL
                        if (table->procname && !table->proc_handler)
                                set_fail(&fail, table, "No proc_handler");
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 492197e2f86c..bca96377fd4e 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -405,7 +405,7 @@ static inline int test_time_stamp(u64 delta)
 #define BUF_MAX_DATA_SIZE (BUF_PAGE_SIZE - (sizeof(u32) * 2))
 /* Max number of timestamps that can fit on a page */
-#define RB_TIMESTAMPS_PER_PAGE  (BUF_PAGE_SIZE / RB_LEN_TIME_STAMP)
+#define RB_TIMESTAMPS_PER_PAGE  (BUF_PAGE_SIZE / RB_LEN_TIME_EXTEND)
 int ring_buffer_print_page_header(struct trace_seq *s)
 {
diff --git a/lib/bug.c b/lib/bug.c
index 7cdfad88128f..19552096d16b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -72,8 +72,8 @@ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
        return NULL;
 }
-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-                        struct module *mod)
+                         struct module *mod)
 {
        char *secstrings;
        unsigned int i;
@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
         * could potentially lead to deadlock and thus be counter-productive.
         */
        list_add(&mod->bug_list, &module_bug_list);
-        return 0;
 }
 void module_bug_cleanup(struct module *mod)
diff --git a/mm/ksm.c b/mm/ksm.c
index b1873cf03ed9..65ab5c7067d9 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -712,7 +712,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
        if (!ptep)
                goto out;
-        if (pte_write(*ptep)) {
+        if (pte_write(*ptep) || pte_dirty(*ptep)) {
                pte_t entry;
                swapped = PageSwapCache(page);
@@ -735,7 +735,9 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                        set_pte_at(mm, addr, ptep, entry);
                        goto out_unlock;
                }
-                entry = pte_wrprotect(entry);
+                if (pte_dirty(entry))
+                        set_page_dirty(page);
+                entry = pte_mkclean(pte_wrprotect(entry));
                set_pte_at_notify(mm, addr, ptep, entry);
        }
        *orig_pte = *ptep;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 3eed583895a6..9be3cf8a5da4 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3587,9 +3587,13 @@ unlock:
 static void mem_cgroup_threshold(struct mem_cgroup *memcg)
 {
-        __mem_cgroup_threshold(memcg, false);
+        while (memcg) {
-        if (do_swap_account)
+                __mem_cgroup_threshold(memcg, false);
-                __mem_cgroup_threshold(memcg, true);
+                if (do_swap_account)
+                        __mem_cgroup_threshold(memcg, true);
+                memcg = parent_mem_cgroup(memcg);
+        }
 }
 static int compare_thresholds(const void *a, const void *b)
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index 9c26eeca1342..757f6b0accfe 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -183,7 +183,7 @@ EXPORT_SYMBOL_GPL(hwpoison_filter);
 * signal.
 */
 static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
-                        unsigned long pfn)
+                        unsigned long pfn, struct page *page)
 {
        struct siginfo si;
        int ret;
@@ -198,7 +198,7 @@ static int kill_proc_ao(struct task_struct *t, unsigned long addr, int trapno,
 #ifdef __ARCH_SI_TRAPNO
        si.si_trapno = trapno;
 #endif
-        si.si_addr_lsb = PAGE_SHIFT;
+        si.si_addr_lsb = compound_order(compound_head(page)) + PAGE_SHIFT;
        /*
         * Don't use force here, it's convenient if the signal
         * can be temporarily blocked.
@@ -235,7 +235,7 @@ void shake_page(struct page *p, int access)
                int nr;
                do {
                        nr = shrink_slab(1000, GFP_KERNEL, 1000);
-                        if (page_count(p) == 0)
+                        if (page_count(p) == 1)
                                break;
                } while (nr > 10);
        }
@@ -327,7 +327,7 @@ static void add_to_kill(struct task_struct *tsk, struct page *p,
 * wrong earlier.
 */
 static void kill_procs_ao(struct list_head *to_kill, int doit, int trapno,
-                          int fail, unsigned long pfn)
+                          int fail, struct page *page, unsigned long pfn)
 {
        struct to_kill *tk, *next;
@@ -352,7 +352,7 @@ static void kill_procs_ao(struct list_head *to_kill, int doit, int trapno,
                         * process anyways.
                         */
                        else if (kill_proc_ao(tk->tsk, tk->addr, trapno,
-                                              pfn) < 0)
+                                              pfn, page) < 0)
                                printk(KERN_ERR
                "MCE %#lx: Cannot send advisory machine check signal to %s:%d\n",
                                        pfn, tk->tsk->comm, tk->tsk->pid);
@@ -928,7 +928,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
         * any accesses to the poisoned memory.
         */
        kill_procs_ao(&tokill, !!PageDirty(hpage), trapno,
-                      ret != SWAP_SUCCESS, pfn);
+                      ret != SWAP_SUCCESS, p, pfn);
        return ret;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a8cfa9cc6e86..f12ad1836abe 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5182,9 +5182,9 @@ void *__init alloc_large_system_hash(const char *tablename,
        if (!table)
                panic("Failed to allocate %s hash table\n", tablename);
-        printk(KERN_INFO "%s hash table entries: %d (order: %d, %lu bytes)\n",
+        printk(KERN_INFO "%s hash table entries: %ld (order: %d, %lu bytes)\n",
               tablename,
-               (1U << log2qty),
+               (1UL << log2qty),
               ilog2(size) - PAGE_SHIFT,
               size);
diff --git a/mm/rmap.c b/mm/rmap.c
index 9d2ba01bd4f9..92e6757f196e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -381,7 +381,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
        if (PageAnon(page)) {
-                if (vma->anon_vma->root != page_anon_vma(page)->root)
+                struct anon_vma *page__anon_vma = page_anon_vma(page);
+                /*
+                 * Note: swapoff's unuse_vma() is more efficient with this
+                 * check, and needs it to match anon_vma when KSM is active.
+                 */
+                if (!vma->anon_vma || !page__anon_vma ||
+                    vma->anon_vma->root != page__anon_vma->root)
                        return -EFAULT;
        } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                if (!vma->vm_file ||
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 01ddb0472f86..0eb96f7e44be 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
        if (vlan_dev)
                skb->dev = vlan_dev;
-        else if (vlan_id)
+        else if (vlan_id) {
-                goto drop;
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
        return (polling ? netif_receive_skb(skb) : netif_rx(skb));
@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
        if (vlan_dev)
                skb->dev = vlan_dev;
-        else if (vlan_id)
+        else if (vlan_id) {
-                goto drop;
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
        for (p = napi->gro_list; p; p = p->next) {
                NAPI_GRO_CB(p)->same_flow =
diff --git a/net/atm/mpc.c b/net/atm/mpc.c
index 622b471e14e0..74bcc662c3dd 100644
--- a/net/atm/mpc.c
+++ b/net/atm/mpc.c
@@ -778,7 +778,7 @@ static void mpc_push(struct atm_vcc *vcc, struct sk_buff *skb)
        eg->packets_rcvd++;
        mpc->eg_ops->put(eg);
-        memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
+        memset(ATM_SKB(new_skb), 0, sizeof(struct atm_skb_data));
        netif_rx(new_skb);
 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index fadf26b4ed7c..0b54b7dd8401 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1441,33 +1441,23 @@ static inline void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
 static void l2cap_streaming_send(struct sock *sk)
 {
-        struct sk_buff *skb, *tx_skb;
+        struct sk_buff *skb;
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        u16 control, fcs;
-        while ((skb = sk->sk_send_head)) {
+        while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
+                control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
-                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
                control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
-                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
+                put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
                if (pi->fcs == L2CAP_FCS_CRC16) {
-                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
+                        fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
-                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
+                        put_unaligned_le16(fcs, skb->data + skb->len - 2);
                }
-                l2cap_do_send(sk, tx_skb);
+                l2cap_do_send(sk, skb);
                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
-                if (skb_queue_is_last(TX_QUEUE(sk), skb))
-                        sk->sk_send_head = NULL;
-                else
-                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
-                skb = skb_dequeue(TX_QUEUE(sk));
-                kfree_skb(skb);
        }
 }
@@ -1960,6 +1950,11 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
        switch (optname) {
        case L2CAP_OPTIONS:
+                if (sk->sk_state == BT_CONNECTED) {
+                        err = -EINVAL;
+                        break;
+                }
                opts.imtu     = l2cap_pi(sk)->imtu;
                opts.omtu     = l2cap_pi(sk)->omtu;
                opts.flush_to = l2cap_pi(sk)->flush_to;
@@ -2771,10 +2766,10 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                case L2CAP_CONF_MTU:
                        if (val < L2CAP_DEFAULT_MIN_MTU) {
                                *result = L2CAP_CONF_UNACCEPT;
-                                pi->omtu = L2CAP_DEFAULT_MIN_MTU;
+                                pi->imtu = L2CAP_DEFAULT_MIN_MTU;
                        } else
-                                pi->omtu = val;
+                                pi->imtu = val;
-                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
                        break;
                case L2CAP_CONF_FLUSH_TO:
@@ -3071,6 +3066,17 @@ static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hd
        return 0;
 }
+static inline void set_default_fcs(struct l2cap_pinfo *pi)
+{
+        /* FCS is enabled only in ERTM or streaming mode, if one or both
+         * sides request it.
+         */
+        if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
+                pi->fcs = L2CAP_FCS_NONE;
+        else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
+                pi->fcs = L2CAP_FCS_CRC16;
+}
 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
 {
        struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
@@ -3088,14 +3094,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        if (!sk)
                return -ENOENT;
-        if (sk->sk_state != BT_CONFIG) {
+        if (sk->sk_state == BT_DISCONN)
-                struct l2cap_cmd_rej rej;
-                rej.reason = cpu_to_le16(0x0002);
-                l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
-                                sizeof(rej), &rej);
                goto unlock;
-        }
        /* Reject if config buffer is too small. */
        len = cmd_len - sizeof(*req);
@@ -3135,9 +3135,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                goto unlock;
        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                set_default_fcs(l2cap_pi(sk));
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
                sk->sk_state = BT_CONNECTED;
@@ -3225,9 +3223,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-                if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                set_default_fcs(l2cap_pi(sk));
-                    l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
-                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
                sk->sk_state = BT_CONNECTED;
                l2cap_pi(sk)->next_tx_seq = 0;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 44a623275951..194b3a04cfd3 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -82,11 +82,14 @@ static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 {
        struct sock *sk = d->owner, *parent;
+        unsigned long flags;
        if (!sk)
                return;
        BT_DBG("dlc %p state %ld err %d", d, d->state, err);
+        local_irq_save(flags);
        bh_lock_sock(sk);
        if (err)
@@ -108,6 +111,7 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
        }
        bh_unlock_sock(sk);
+        local_irq_restore(flags);
        if (parent && sock_flag(sk, SOCK_ZAPPED)) {
                /* We have to drop DLC lock here, otherwise
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 8ce904786116..4bf28f25f368 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -827,6 +827,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
        long timeo;
        int err;
        int ifindex, headroom, tailroom;
+        unsigned int mtu;
        struct net_device *dev;
        lock_sock(sk);
@@ -896,15 +897,23 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
                cf_sk->sk.sk_state = CAIF_DISCONNECTED;
                goto out;
        }
-        dev = dev_get_by_index(sock_net(sk), ifindex);
+        err = -ENODEV;
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                goto out;
+        }
        cf_sk->headroom = LL_RESERVED_SPACE_EXTRA(dev, headroom);
+        mtu = dev->mtu;
+        rcu_read_unlock();
        cf_sk->tailroom = tailroom;
-        cf_sk->maxframe = dev->mtu - (headroom + tailroom);
+        cf_sk->maxframe = mtu - (headroom + tailroom);
-        dev_put(dev);
        if (cf_sk->maxframe < 1) {
-                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%d)\n",
+                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%u)\n",
-                        __func__, dev->mtu);
+                           __func__, mtu);
-                err = -ENODEV;
                goto out;
        }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 7a85367b3c2f..8451ab481095 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -348,7 +348,7 @@ static noinline_for_stack int ethtool_get_rxnfc(struct net_device *dev,
        if (info.cmd == ETHTOOL_GRXCLSRLALL) {
                if (info.rule_cnt > 0) {
                        if (info.rule_cnt <= KMALLOC_MAX_SIZE / sizeof(u32))
-                                rule_buf = kmalloc(info.rule_cnt * sizeof(u32),
+                                rule_buf = kzalloc(info.rule_cnt * sizeof(u32),
                                                   GFP_USER);
                        if (!rule_buf)
                                return -ENOMEM;
@@ -397,7 +397,7 @@ static noinline_for_stack int ethtool_get_rxfh_indir(struct net_device *dev,
            (KMALLOC_MAX_SIZE - sizeof(*indir)) / sizeof(*indir->ring_index))
                return -ENOMEM;
        full_size = sizeof(*indir) + sizeof(*indir->ring_index) * table_size;
-        indir = kmalloc(full_size, GFP_USER);
+        indir = kzalloc(full_size, GFP_USER);
        if (!indir)
                return -ENOMEM;
@@ -538,7 +538,7 @@ static int ethtool_get_rx_ntuple(struct net_device *dev, void __user *useraddr)
        gstrings.len = ret;
-        data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+        data = kzalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
        if (!data)
                return -ENOMEM;
@@ -775,7 +775,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
        if (regs.len > reglen)
                regs.len = reglen;
-        regbuf = kmalloc(reglen, GFP_USER);
+        regbuf = kzalloc(reglen, GFP_USER);
        if (!regbuf)
                return -ENOMEM;
diff --git a/net/core/stream.c b/net/core/stream.c
index d959e0f41528..f5df85dcd20b 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -141,10 +141,10 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                sk->sk_write_pending++;
-                sk_wait_event(sk, &current_timeo, !sk->sk_err &&
+                sk_wait_event(sk, &current_timeo, sk->sk_err ||
-                                                  !(sk->sk_shutdown & SEND_SHUTDOWN) &&
+                                                  (sk->sk_shutdown & SEND_SHUTDOWN) ||
-                                                  sk_stream_memory_free(sk) &&
+                                                  (sk_stream_memory_free(sk) &&
-                                                  vm_wait);
+                                                  !vm_wait));
                sk->sk_write_pending--;
                if (vm_wait) {
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 571f8950ed06..7cd7760144f7 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -217,6 +217,7 @@ config NET_IPIP
 config NET_IPGRE
        tristate "IP: GRE tunnels over IP"
+        depends on IPV6 || IPV6=n
        help
          Tunneling means encapsulating data of one protocol type within
          another protocol and sending it over a channel that understands the
@@ -412,7 +413,7 @@ config INET_XFRM_MODE_BEET
          If unsure, say Y.
 config INET_LRO
-        bool "Large Receive Offload (ipv4/tcp)"
+        tristate "Large Receive Offload (ipv4/tcp)"
        default y
        ---help---
          Support for Large Receive Offload (ipv4/tcp).
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fdcacd36ce7..2a4bb76f2132 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -834,7 +834,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
        int                     mark = 0;
-        if (len == 8 || IGMP_V2_SEEN(in_dev)) {
+        if (len == 8) {
                if (ih->code == 0) {
                        /* Alas, old v1 router presents here. */
@@ -856,6 +856,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                igmpv3_clear_delrec(in_dev);
        } else if (len < 12) {
                return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
        } else { /* v3 */
                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                        return;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c35b469e851c..74c54b30600f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 /* This function calculates a "timeout" which is equivalent to the timeout of a
 * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN.
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
 */
 static bool retransmits_timed_out(struct sock *sk,
-                                  unsigned int boundary)
+                                  unsigned int boundary,
+                                  bool syn_set)
 {
        unsigned int timeout, linear_backoff_thresh;
        unsigned int start_ts;
+        unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
        if (!inet_csk(sk)->icsk_retransmits)
                return false;
@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk,
        else
                start_ts = tcp_sk(sk)->retrans_stamp;
-        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
        if (boundary <= linear_backoff_thresh)
-                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+                timeout = ((2 << boundary) - 1) * rto_base;
        else
-                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
        return (tcp_time_stamp - start_ts) >= timeout;
@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        int retry_until;
-        bool do_reset;
+        bool do_reset, syn_set = 0;
        if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                if (icsk->icsk_retransmits)
                        dst_negative_advice(sk);
                retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+                syn_set = 1;
        } else {
-                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
                        /* Black hole detection */
                        tcp_mtu_probing(icsk, sk);
@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk)
                        retry_until = tcp_orphan_retries(sk, alive);
                        do_reset = alive ||
-                                   !retransmits_timed_out(sk, retry_until);
+                                   !retransmits_timed_out(sk, retry_until, 0);
                        if (tcp_out_of_resources(sk, do_reset))
                                return 1;
                }
        }
-        if (retransmits_timed_out(sk, retry_until)) {
+        if (retransmits_timed_out(sk, retry_until, syn_set)) {
                /* Has it gone just too far? */
                tcp_write_err(sk);
                return 1;
@@ -436,7 +440,7 @@ out_reset_timer:
                icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
        }
        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
                __sk_dst_reset(sk);
 out:;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8323136bdc54..a275c6e1e25c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1556,14 +1556,13 @@ out:
 *      i.e. Path MTU discovery
 */
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
-                        struct net_device *dev, u32 pmtu)
+                             struct net *net, u32 pmtu, int ifindex)
 {
        struct rt6_info *rt, *nrt;
-        struct net *net = dev_net(dev);
        int allfrag = 0;
-        rt = rt6_lookup(net, daddr, saddr, dev->ifindex, 0);
+        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
        if (rt == NULL)
                return;
@@ -1631,6 +1630,27 @@ out:
        dst_release(&rt->dst);
 }
+void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+                        struct net_device *dev, u32 pmtu)
+{
+        struct net *net = dev_net(dev);
+        /*
+         * RFC 1981 states that a node "MUST reduce the size of the packets it
+         * is sending along the path" that caused the Packet Too Big message.
+         * Since it's not possible in the general case to determine which
+         * interface was used to send the original packet, we update the MTU
+         * on the interface that will be used to send future packets. We also
+         * update the MTU on the interface that received the Packet Too Big in
+         * case the original packet was forced out that interface with
+         * SO_BINDTODEVICE or similar. This is the next best thing to the
+         * correct behaviour, which would be to update the MTU on all
+         * interfaces.
+         */
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, 0);
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, dev->ifindex);
+}
 /*
 *      Misc support functions
 */
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index c893f236acea..8f23401832b7 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -175,6 +175,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid,
        set_bit(HT_AGG_STATE_STOPPING, &tid_tx->state);
+        del_timer_sync(&tid_tx->addba_resp_timer);
        /*
         * After this packets are no longer handed right through
         * to the driver but are put onto tid_tx->pending instead,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa0f37e4afe4..28624282c5f3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        struct net_device *prev_dev = NULL;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
        if (skb_headroom(skb) < sizeof(*rthdr) &&
            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                goto out_free_skb;
@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        } else
                goto out_free_skb;
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
        return;
 out_free_skb:
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 10caec5ea8fa..34da67995d94 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -377,7 +377,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                                skb2 = skb_clone(skb, GFP_ATOMIC);
                                if (skb2) {
                                        skb2->dev = prev_dev;
-                                        netif_receive_skb(skb2);
+                                        netif_rx(skb2);
                                }
                        }
@@ -386,7 +386,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
        }
        if (prev_dev) {
                skb->dev = prev_dev;
-                netif_receive_skb(skb);
+                netif_rx(skb);
                skb = NULL;
        }
        rcu_read_unlock();
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b2a3ae6cad78..15003021f4f0 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk)
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
        struct pep_sock *pn = pep_sk(sk);
-        struct pnpipehdr *hdr = pnp_hdr(skb);
+        struct pnpipehdr *hdr;
        int wake = 0;
        if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
                return -EINVAL;
+        hdr = pnp_hdr(skb);
        if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
                LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
                                (unsigned)hdr->data[0]);
diff --git a/net/rds/page.c b/net/rds/page.c
index 595a952d4b17..1dfbfea12e9b 100644
--- a/net/rds/page.c
+++ b/net/rds/page.c
@@ -57,30 +57,17 @@ int rds_page_copy_user(struct page *page, unsigned long offset,
        unsigned long ret;
        void *addr;
-        if (to_user)
+        addr = kmap(page);
+        if (to_user) {
                rds_stats_add(s_copy_to_user, bytes);
-        else
+                ret = copy_to_user(ptr, addr + offset, bytes);
+        } else {
                rds_stats_add(s_copy_from_user, bytes);
+                ret = copy_from_user(addr + offset, ptr, bytes);
-        addr = kmap_atomic(page, KM_USER0);
-        if (to_user)
-                ret = __copy_to_user_inatomic(ptr, addr + offset, bytes);
-        else
-                ret = __copy_from_user_inatomic(addr + offset, ptr, bytes);
-        kunmap_atomic(addr, KM_USER0);
-        if (ret) {
-                addr = kmap(page);
-                if (to_user)
-                        ret = copy_to_user(ptr, addr + offset, bytes);
-                else
-                        ret = copy_from_user(addr + offset, ptr, bytes);
-                kunmap(page);
-                if (ret)
-                        return -EFAULT;
        }
+        kunmap(page);
-        return 0;
+        return ret ? -EFAULT : 0;
 }
 EXPORT_SYMBOL_GPL(rds_page_copy_user);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 7416a5c73b2a..b0c2a82178af 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -137,7 +137,7 @@ next_knode:
                        int toff = off + key->off + (off2 & key->offmask);
                        __be32 *data, _data;
-                        if (skb_headroom(skb) + toff < 0)
+                        if (skb_headroom(skb) + toff > INT_MAX)
                                goto out;
                        data = skb_header_pointer(skb, toff, 4, &_data);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 86366390038a..ddbbf7c81fa1 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -543,16 +543,20 @@ struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
                id = ntohs(hmacs->hmac_ids[i]);
                /* Check the id is in the supported range */
-                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                if (id > SCTP_AUTH_HMAC_ID_MAX) {
+                        id = 0;
                        continue;
+                }
                /* See is we support the id.  Supported IDs have name and
                 * length fields set, so that we can allocated and use
                 * them.  We can safely just check for name, for without the
                 * name, we can't allocate the TFM.
                 */
-                if (!sctp_hmac_list[id].hmac_name)
+                if (!sctp_hmac_list[id].hmac_name) {
+                        id = 0;
                        continue;
+                }
                break;
        }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ca44917872d2..fbb70770ad05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
        /* Walk through the addrs buffer and count the number of addresses. */
        addr_buf = kaddrs;
        while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        kfree(kaddrs);
+                        return -EINVAL;
+                }
                sa_addr = (struct sockaddr *)addr_buf;
                af = sctp_get_af_specific(sa_addr->sa_family);
@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
        /* Walk through the addrs buffer and count the number of addresses. */
        addr_buf = kaddrs;
        while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
                sa_addr = (union sctp_addr *)addr_buf;
                af = sctp_get_af_specific(sa_addr->sa.sa_family);
-                port = ntohs(sa_addr->v4.sin_port);
                /* If the address family is not supported or if this address
                 * causes the address buffer to overflow return EINVAL.
@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
                        goto out_free;
                }
+                port = ntohs(sa_addr->v4.sin_port);
                /* Save current address so we can work with it */
                memcpy(&to, sa_addr, af->sockaddr_len);
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 5b7c86ea43a1..7ef429cd5cb3 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -427,7 +427,7 @@ static void check_conf(struct menu *menu)
                                if (sym->name && !sym_is_choice_value(sym)) {
                                        printf("CONFIG_%s\n", sym->name);
                                }
-                        } else {
+                        } else if (input_mode != oldnoconfig) {
                                if (!conf_cnt++)
                                        printf(_("*\n* Restart config...\n*\n"));
                                rootEntry = menu_get_parent_menu(menu);
diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h
index 6ee2e4fb1481..170459c224a1 100644
--- a/scripts/kconfig/expr.h
+++ b/scripts/kconfig/expr.h
@@ -165,7 +165,6 @@ struct menu {
        struct symbol *sym;
        struct property *prompt;
        struct expr *dep;
-        struct expr *dir_dep;
        unsigned int flags;
        char *help;
        struct file *file;
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 4fb590247f33..edda8b49619d 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -107,7 +107,6 @@ static struct expr *menu_check_dep(struct expr *e)
 void menu_add_dep(struct expr *dep)
 {
        current_entry->dep = expr_alloc_and(current_entry->dep, menu_check_dep(dep));
-        current_entry->dir_dep = current_entry->dep;
 }
 void menu_set_type(int type)
@@ -291,10 +290,6 @@ void menu_finalize(struct menu *parent)
                for (menu = parent->list; menu; menu = menu->next)
                        menu_finalize(menu);
        } else if (sym) {
-                /* ignore inherited dependencies for dir_dep */
-                sym->dir_dep.expr = expr_transform(expr_copy(parent->dir_dep));
-                sym->dir_dep.expr = expr_eliminate_dups(sym->dir_dep.expr);
                basedep = parent->prompt ? parent->prompt->visible.expr : NULL;
                basedep = expr_trans_compare(basedep, E_UNEQUAL, &symbol_no);
                basedep = expr_eliminate_dups(expr_transform(basedep));
@@ -325,6 +320,8 @@ void menu_finalize(struct menu *parent)
                        parent->next = last_menu->next;
                        last_menu->next = NULL;
                }
+                sym->dir_dep.expr = parent->dep;
        }
        for (menu = parent->list; menu; menu = menu->next) {
                if (sym && sym_is_choice(sym) &&
diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 943712ca6c0a..1f8b305449db 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c
@@ -350,6 +350,7 @@ void sym_calc_value(struct symbol *sym)
                                }
                        }
                calc_newval:
+#if 0
                        if (sym->dir_dep.tri == no && sym->rev_dep.tri != no) {
                                fprintf(stderr, "warning: (");
                                expr_fprint(sym->rev_dep.expr, stderr);
@@ -358,6 +359,7 @@ void sym_calc_value(struct symbol *sym)
                                expr_fprint(sym->dir_dep.expr, stderr);
                                fprintf(stderr, ")\n");
                        }
+#endif
                        newval.tri = EXPR_OR(newval.tri, sym->rev_dep.tri);
                }
                if (newval.tri == mod && sym_get_type(sym) == S_BOOLEAN)
diff --git a/sound/core/control.c b/sound/core/control.c
index 070aab490191..45a818002d99 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -31,6 +31,7 @@
 /* max number of user-defined controls */
 #define MAX_USER_CONTROLS       32
+#define MAX_CONTROL_COUNT       1028
 struct snd_kctl_ioctl {
        struct list_head list;          /* list of all ioctls */
@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
        
        if (snd_BUG_ON(!control || !control->count))
                return NULL;
+        if (control->count > MAX_CONTROL_COUNT)
+                return NULL;
        kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
        if (kctl == NULL) {
                snd_printk(KERN_ERR "Cannot allocate control instance\n");
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index a7868ad4d530..cbbed0db9e56 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -535,13 +535,15 @@ static int snd_rawmidi_release(struct inode *inode, struct file *file)
 {
        struct snd_rawmidi_file *rfile;
        struct snd_rawmidi *rmidi;
+        struct module *module;
        rfile = file->private_data;
        rmidi = rfile->rmidi;
        rawmidi_release_priv(rfile);
        kfree(rfile);
+        module = rmidi->card->module;
        snd_card_file_remove(rmidi->card, file);
-        module_put(rmidi->card->module);
+        module_put(module);
        return 0;
 }
diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
index 1adb8a3c2b62..42d7844ecd0b 100644
--- a/sound/i2c/other/ak4xxx-adda.c
+++ b/sound/i2c/other/ak4xxx-adda.c
@@ -900,7 +900,7 @@ static int proc_init(struct snd_akm4xxx *ak)
        return 0;
 }
 #else /* !CONFIG_PROC_FS */
-static int proc_init(struct snd_akm4xxx *ak) {}
+static int proc_init(struct snd_akm4xxx *ak) { return 0; }
 #endif
 int snd_akm4xxx_build_controls(struct snd_akm4xxx *ak)
diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
index 92aa762ffb7e..07f803e6d203 100644
--- a/sound/oss/soundcard.c
+++ b/sound/oss/soundcard.c
@@ -391,11 +391,11 @@ static long sound_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case SND_DEV_DSP:
        case SND_DEV_DSP16:
        case SND_DEV_AUDIO:
-                return audio_ioctl(dev, file, cmd, p);
+                ret = audio_ioctl(dev, file, cmd, p);
                break;
        case SND_DEV_MIDIN:
-                return MIDIbuf_ioctl(dev, file, cmd, p);
+                ret = MIDIbuf_ioctl(dev, file, cmd, p);
                break;
        }
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 95148e58026c..c16c5ba0fda0 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1747,6 +1747,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                      "HP dv6", STAC_HP_DV5),
        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3061,
                      "HP dv6", STAC_HP_DV5), /* HP dv6-1110ax */
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x363e,
+                      "HP DV6", STAC_HP_DV5),
        SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_HP, 0xfff0, 0x7010,
                      "HP", STAC_HP_DV5),
        SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0233,
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 4f1fa77c1feb..1950e19af1cf 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -1017,7 +1017,7 @@ builtin-revert.o wt-status.o: wt-status.h
 # we compile into subdirectories. if the target directory is not the source directory, they might not exists. So
 # we depend the various files onto their directories.
 DIRECTORY_DEPS = $(LIB_OBJS) $(BUILTIN_OBJS) $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)common-cmds.h
-$(DIRECTORY_DEPS): $(sort $(dir $(DIRECTORY_DEPS)))
+$(DIRECTORY_DEPS): | $(sort $(dir $(DIRECTORY_DEPS)))
 # In the second step, we make a rule to actually create these directories
 $(sort $(dir $(DIRECTORY_DEPS))):
        $(QUIET_MKDIR)$(MKDIR) -p $@ 2>/dev/null
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index ef7aa0a0c526..95aaf565c704 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -73,6 +73,18 @@ void get_term_dimensions(struct winsize *ws);
 #define cpu_relax()     asm volatile("":::"memory")
 #endif
+#ifdef __mips__
+#include "../../arch/mips/include/asm/unistd.h"
+#define rmb()           asm volatile(                                   \
+                                ".set   mips2\n\t"                      \
+                                "sync\n\t"                              \
+                                ".set   mips0"                          \
+                                : /* no output */                       \
+                                : /* no input */                        \
+                                : "memory")
+#define cpu_relax()     asm volatile("" ::: "memory")
+#endif
 #include <time.h>
 #include <unistd.h>
 #include <sys/types.h>
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index 7ea983acfaea..f7af2fca965d 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -97,7 +97,7 @@ void setup_python_scripting(void)
        register_python_scripting(&python_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops python_scripting_ops;
+extern struct scripting_ops python_scripting_ops;
 void setup_python_scripting(void)
 {
@@ -158,7 +158,7 @@ void setup_perl_scripting(void)
        register_perl_scripting(&perl_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops perl_scripting_ops;
+extern struct scripting_ops perl_scripting_ops;
 void setup_perl_scripting(void)
 {
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index dafdf6775d77..6866aa4c41e0 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -773,7 +773,7 @@ int hists__browse(struct hists *self, const char *helpline, const char *ev_name)
                        switch (key) {
                        case 'a':
-                                if (browser->selection->map == NULL &&
+                                if (browser->selection->map == NULL ||
                                    browser->selection->map->dso->annotate_warned)
                                        continue;
                                goto do_annotate;