161 files changed, 1372 insertions, 884 deletions
diff --git a/Documentation/Changes b/Documentation/Changes
index 5f4828a034e3..b17580885273 100644
--- a/Documentation/Changes
+++ b/Documentation/Changes
@@ -2,13 +2,7 @@ Intro
 =====
 This document is designed to provide a list of the minimum levels of
-software necessary to run the 2.6 kernels, as well as provide brief
+software necessary to run the 3.0 kernels.
-instructions regarding any other "Gotchas" users may encounter when
-trying life on the Bleeding Edge.  If upgrading from a pre-2.4.x
-kernel, please consult the Changes file included with 2.4.x kernels for
-additional information; most of that information will not be repeated
-here.  Basically, this document assumes that your system is already
-functional and running at least 2.4.x kernels.
 This document is originally based on my "Changes" file for 2.0.x kernels
 and therefore owes credit to the same people as that file (Jared Mauch,
@@ -22,11 +16,10 @@ Upgrade to at *least* these software revisions before thinking you've
 encountered a bug!  If you're unsure what version you're currently
 running, the suggested command should tell you.
-Again, keep in mind that this list assumes you are already
+Again, keep in mind that this list assumes you are already functionally
-functionally running a Linux 2.4 kernel.  Also, not all tools are
+running a Linux kernel.  Also, not all tools are necessary on all
-necessary on all systems; obviously, if you don't have any ISDN
+systems; obviously, if you don't have any ISDN hardware, for example,
-hardware, for example, you probably needn't concern yourself with
+you probably needn't concern yourself with isdn4k-utils.
-isdn4k-utils.
 o  Gnu C                  3.2                     # gcc --version
 o  Gnu make               3.80                    # make --version
@@ -114,12 +107,12 @@ Ksymoops
 If the unthinkable happens and your kernel oopses, you may need the
 ksymoops tool to decode it, but in most cases you don't.
-In the 2.6 kernel it is generally preferred to build the kernel with
+It is generally preferred to build the kernel with CONFIG_KALLSYMS so
-CONFIG_KALLSYMS so that it produces readable dumps that can be used as-is
+that it produces readable dumps that can be used as-is (this also
-(this also produces better output than ksymoops).
+produces better output than ksymoops).  If for some reason your kernel
-If for some reason your kernel is not build with CONFIG_KALLSYMS and
+is not build with CONFIG_KALLSYMS and you have no way to rebuild and
-you have no way to rebuild and reproduce the Oops with that option, then
+reproduce the Oops with that option, then you can still decode that Oops
-you can still decode that Oops with ksymoops.
+with ksymoops.
 Module-Init-Tools
 -----------------
@@ -261,8 +254,8 @@ needs to be recompiled or (preferably) upgraded.
 NFS-utils
 ---------
-In 2.4 and earlier kernels, the nfs server needed to know about any
+In ancient (2.4 and earlier) kernels, the nfs server needed to know
-client that expected to be able to access files via NFS.  This
+about any client that expected to be able to access files via NFS.  This
 information would be given to the kernel by "mountd" when the client
 mounted the filesystem, or by "exportfs" at system startup.  exportfs
 would take information about active clients from /var/lib/nfs/rmtab.
@@ -272,11 +265,11 @@ which is not always easy, particularly when trying to implement
 fail-over.  Even when the system is working well, rmtab suffers from
 getting lots of old entries that never get removed.
-With 2.6 we have the option of having the kernel tell mountd when it
+With modern kernels we have the option of having the kernel tell mountd
-gets a request from an unknown host, and mountd can give appropriate
+when it gets a request from an unknown host, and mountd can give
-export information to the kernel.  This removes the dependency on
+appropriate export information to the kernel.  This removes the
-rmtab and means that the kernel only needs to know about currently
+dependency on rmtab and means that the kernel only needs to know about
-active clients.
+currently active clients.
 To enable this new functionality, you need to:
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 72e238465b0b..b1c921c27519 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -583,3 +583,25 @@ Why:	Superseded by the UVCIOC_CTRL_QUERY ioctl.
 Who:    Laurent Pinchart <laurent.pinchart@ideasonboard.com>
 ----------------------------
+What:   For VIDIOC_S_FREQUENCY the type field must match the device node's type.
+        If not, return -EINVAL.
+When:   3.2
+Why:    It makes no sense to switch the tuner to radio mode by calling
+        VIDIOC_S_FREQUENCY on a video node, or to switch the tuner to tv mode by
+        calling VIDIOC_S_FREQUENCY on a radio node. This is the first step of a
+        move to more consistent handling of tv and radio tuners.
+Who:    Hans Verkuil <hans.verkuil@cisco.com>
+----------------------------
+What:   Opening a radio device node will no longer automatically switch the
+        tuner mode from tv to radio.
+When:   3.3
+Why:    Just opening a V4L device should not change the state of the hardware
+        like that. It's very unexpected and against the V4L spec. Instead, you
+        switch to radio mode by calling VIDIOC_S_FREQUENCY. This is the second
+        and last step of the move to consistent handling of tv and radio tuners.
+Who:    Hans Verkuil <hans.verkuil@cisco.com>
+----------------------------
diff --git a/Documentation/filesystems/nilfs2.txt b/Documentation/filesystems/nilfs2.txt
index d5c0cef38a71..873a2ab2e9f8 100644
--- a/Documentation/filesystems/nilfs2.txt
+++ b/Documentation/filesystems/nilfs2.txt
@@ -40,7 +40,6 @@ Features which NILFS2 does not support yet:
        - POSIX ACLs
        - quotas
        - fsck
-        - resize
        - defragmentation
 Mount options
diff --git a/Documentation/laptops/thinkpad-acpi.txt b/Documentation/laptops/thinkpad-acpi.txt
index 1565eefd6fd5..61815483efa3 100644
--- a/Documentation/laptops/thinkpad-acpi.txt
+++ b/Documentation/laptops/thinkpad-acpi.txt
@@ -534,6 +534,8 @@ Events that are never propagated by the driver:
 0x2404          System is waking up from hibernation to undock
 0x2405          System is waking up from hibernation to eject bay
 0x5010          Brightness level changed/control event
+0x6000          KEYBOARD: Numlock key pressed
+0x6005          KEYBOARD: Fn key pressed (TO BE VERIFIED)
 Events that are propagated by the driver to userspace:
@@ -545,6 +547,8 @@ Events that are propagated by the driver to userspace:
 0x3006          Bay hotplug request (hint to power up SATA link when
                the optical drive tray is ejected)
 0x4003          Undocked (see 0x2x04), can sleep again
+0x4010          Docked into hotplug port replicator (non-ACPI dock)
+0x4011          Undocked from hotplug port replicator (non-ACPI dock)
 0x500B          Tablet pen inserted into its storage bay
 0x500C          Tablet pen removed from its storage bay
 0x6011          ALARM: battery is too hot
@@ -552,6 +556,7 @@ Events that are propagated by the driver to userspace:
 0x6021          ALARM: a sensor is too hot
 0x6022          ALARM: a sensor is extremely hot
 0x6030          System thermal table changed
+0x6040          Nvidia Optimus/AC adapter related (TO BE VERIFIED)
 Battery nearly empty alarms are a last resort attempt to get the
 operating system to hibernate or shutdown cleanly (0x2313), or shutdown
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index d3d653a5f9b9..bfe924217f24 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -346,7 +346,7 @@ tcp_orphan_retries - INTEGER
        when RTO retransmissions remain unacknowledged.
        See tcp_retries2 for more details.
-        The default value is 7.
+        The default value is 8.
        If your machine is a loaded WEB server,
        you should think about lowering this value, such sockets
        may consume significant resources. Cf. tcp_max_orphans.
diff --git a/Documentation/spinlocks.txt b/Documentation/spinlocks.txt
index 2e3c64b1a6a5..9dbe885ecd8d 100644
--- a/Documentation/spinlocks.txt
+++ b/Documentation/spinlocks.txt
@@ -13,18 +13,8 @@ static DEFINE_SPINLOCK(xxx_lock);
 The above is always safe. It will disable interrupts _locally_, but the
 spinlock itself will guarantee the global lock, so it will guarantee that
 there is only one thread-of-control within the region(s) protected by that
-lock. This works well even under UP. The above sequence under UP
+lock. This works well even under UP also, so the code does _not_ need to
-essentially is just the same as doing
+worry about UP vs SMP issues: the spinlocks work correctly under both.
-        unsigned long flags;
-        save_flags(flags); cli();
-         ... critical section ...
-        restore_flags(flags);
-so the code does _not_ need to worry about UP vs SMP issues: the spinlocks
-work correctly under both (and spinlocks are actually more efficient on
-architectures that allow doing the "save_flags + cli" in one operation).
   NOTE! Implications of spin_locks for memory are further described in:
@@ -36,27 +26,7 @@ The above is usually pretty simple (you usually need and want only one
 spinlock for most things - using more than one spinlock can make things a
 lot more complex and even slower and is usually worth it only for
 sequences that you _know_ need to be split up: avoid it at all cost if you
-aren't sure). HOWEVER, it _does_ mean that if you have some code that does
+aren't sure).
-        cli();
-        .. critical section ..
-        sti();
-and another sequence that does
-        spin_lock_irqsave(flags);
-        .. critical section ..
-        spin_unlock_irqrestore(flags);
-then they are NOT mutually exclusive, and the critical regions can happen
-at the same time on two different CPU's. That's fine per se, but the
-critical regions had better be critical for different things (ie they
-can't stomp on each other).
-The above is a problem mainly if you end up mixing code - for example the
-routines in ll_rw_block() tend to use cli/sti to protect the atomicity of
-their actions, and if a driver uses spinlocks instead then you should
-think about issues like the above.
 This is really the only really hard part about spinlocks: once you start
 using spinlocks they tend to expand to areas you might not have noticed
@@ -120,11 +90,10 @@ Lesson 3: spinlocks revisited.
 The single spin-lock primitives above are by no means the only ones. They
 are the most safe ones, and the ones that work under all circumstances,
-but partly _because_ they are safe they are also fairly slow. They are
+but partly _because_ they are safe they are also fairly slow. They are slower
-much faster than a generic global cli/sti pair, but slower than they'd
+than they'd need to be, because they do have to disable interrupts
-need to be, because they do have to disable interrupts (which is just a
+(which is just a single instruction on a x86, but it's an expensive one -
-single instruction on a x86, but it's an expensive one - and on other
+and on other architectures it can be worse).
-architectures it can be worse).
 If you have a case where you have to protect a data structure across
 several CPU's and you want to use spinlocks you can potentially use
diff --git a/Makefile b/Makefile
index 86f47a0ddc79..60d91f76c2fd 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 0
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Sneaky Weasel
 # *DOCUMENTATION*
diff --git a/arch/arm/mach-davinci/board-dm365-evm.c b/arch/arm/mach-davinci/board-dm365-evm.c
index c67f684ee3e5..09a87e61ffcf 100644
--- a/arch/arm/mach-davinci/board-dm365-evm.c
+++ b/arch/arm/mach-davinci/board-dm365-evm.c
@@ -520,7 +520,7 @@ fail:
         */
        if (have_imager()) {
                label = "HD imager";
-                mux |= 1;
+                mux |= 2;
                /* externally mux MMC1/ENET/AIC33 to imager */
                mux |= BIT(6) | BIT(5) | BIT(3);
@@ -540,7 +540,7 @@ fail:
                resets &= ~BIT(1);
                if (have_tvp7002()) {
-                        mux |= 2;
+                        mux |= 1;
                        resets &= ~BIT(2);
                        label = "tvp7002 HD";
                } else {
diff --git a/arch/arm/mach-davinci/gpio.c b/arch/arm/mach-davinci/gpio.c
index e7221398e5af..cafbe13a82a5 100644
--- a/arch/arm/mach-davinci/gpio.c
+++ b/arch/arm/mach-davinci/gpio.c
@@ -254,8 +254,10 @@ gpio_irq_handler(unsigned irq, struct irq_desc *desc)
 {
        struct davinci_gpio_regs __iomem *g;
        u32 mask = 0xffff;
+        struct davinci_gpio_controller *d;
-        g = (__force struct davinci_gpio_regs __iomem *) irq_desc_get_handler_data(desc);
+        d = (struct davinci_gpio_controller *)irq_desc_get_handler_data(desc);
+        g = (struct davinci_gpio_regs __iomem *)d->regs;
        /* we only care about one bank */
        if (irq & 1)
@@ -274,11 +276,14 @@ gpio_irq_handler(unsigned irq, struct irq_desc *desc)
                if (!status)
                        break;
                __raw_writel(status, &g->intstat);
-                if (irq & 1)
-                        status >>= 16;
                /* now demux them to the right lowlevel handler */
-                n = (int)irq_get_handler_data(irq);
+                n = d->irq_base;
+                if (irq & 1) {
+                        n += 16;
+                        status >>= 16;
+                }
                while (status) {
                        res = ffs(status);
                        n += res;
@@ -424,7 +429,13 @@ static int __init davinci_gpio_irq_setup(void)
                /* set up all irqs in this bank */
                irq_set_chained_handler(bank_irq, gpio_irq_handler);
-                irq_set_handler_data(bank_irq, (__force void *)g);
+                /*
+                 * Each chip handles 32 gpios, and each irq bank consists of 16
+                 * gpio irqs. Pass the irq bank's corresponding controller to
+                 * the chained irq handler.
+                 */
+                irq_set_handler_data(bank_irq, &chips[gpio / 32]);
                for (i = 0; i < 16 && gpio < ngpio; i++, irq++, gpio++) {
                        irq_set_chip(irq, &gpio_irqchip);
diff --git a/arch/arm/mach-davinci/irq.c b/arch/arm/mach-davinci/irq.c
index bfe68ec4e1a6..952dc126c390 100644
--- a/arch/arm/mach-davinci/irq.c
+++ b/arch/arm/mach-davinci/irq.c
@@ -52,8 +52,14 @@ davinci_alloc_gc(void __iomem *base, unsigned int irq_start, unsigned int num)
        struct irq_chip_type *ct;
        gc = irq_alloc_generic_chip("AINTC", 1, irq_start, base, handle_edge_irq);
+        if (!gc) {
+                pr_err("%s: irq_alloc_generic_chip for IRQ %u failed\n",
+                       __func__, irq_start);
+                return;
+        }
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
diff --git a/arch/arm/mach-ixp4xx/common.c b/arch/arm/mach-ixp4xx/common.c
index 74ed81a3cb1a..07772575d7ab 100644
--- a/arch/arm/mach-ixp4xx/common.c
+++ b/arch/arm/mach-ixp4xx/common.c
@@ -419,14 +419,20 @@ static void notrace ixp4xx_update_sched_clock(void)
 /*
 * clocksource
 */
+static cycle_t ixp4xx_clocksource_read(struct clocksource *c)
+{
+        return *IXP4XX_OSTS;
+}
 unsigned long ixp4xx_timer_freq = IXP4XX_TIMER_FREQ;
 EXPORT_SYMBOL(ixp4xx_timer_freq);
 static void __init ixp4xx_clocksource_init(void)
 {
        init_sched_clock(&cd, ixp4xx_update_sched_clock, 32, ixp4xx_timer_freq);
-        clocksource_mmio_init(&IXP4XX_OSTS, "OSTS", ixp4xx_timer_freq, 200, 32,
+        clocksource_mmio_init(NULL, "OSTS", ixp4xx_timer_freq, 200, 32,
-                        clocksource_mmio_readl_up);
+                        ixp4xx_clocksource_read);
 }
 /*
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 72b4e7631583..ab9f999106c7 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -79,7 +79,7 @@ static APBC_CLK(ssp4, PXA168_SSP4, 4, 0);
 static APBC_CLK(ssp5, PXA168_SSP5, 4, 0);
 static APBC_CLK(keypad, PXA168_KPC, 0, 32000);
-static APMU_CLK(nand, NAND, 0x01db, 208000000);
+static APMU_CLK(nand, NAND, 0x19b, 156000000);
 static APMU_CLK(lcd, LCD, 0x7f, 312000000);
 /* device and clock bindings */
diff --git a/arch/arm/mach-mmp/pxa910.c b/arch/arm/mach-mmp/pxa910.c
index 8f92ccd26edf..1464607aa60d 100644
--- a/arch/arm/mach-mmp/pxa910.c
+++ b/arch/arm/mach-mmp/pxa910.c
@@ -110,7 +110,7 @@ static APBC_CLK(pwm2, PXA910_PWM2, 1, 13000000);
 static APBC_CLK(pwm3, PXA910_PWM3, 1, 13000000);
 static APBC_CLK(pwm4, PXA910_PWM4, 1, 13000000);
-static APMU_CLK(nand, NAND, 0x01db, 208000000);
+static APMU_CLK(nand, NAND, 0x19b, 156000000);
 static APMU_CLK(u2o, USB, 0x1b, 480000000);
 /* device and clock bindings */
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index 87ae3129f4f7..b27544bcafcb 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -347,9 +347,9 @@ static int pxa2xx_mfp_suspend(void)
                if ((gpio_desc[i].config & MFP_LPM_KEEP_OUTPUT) &&
                    (GPDR(i) & GPIO_bit(i))) {
                        if (GPLR(i) & GPIO_bit(i))
-                                PGSR(i) |= GPIO_bit(i);
+                                PGSR(gpio_to_bank(i)) |= GPIO_bit(i);
                        else
-                                PGSR(i) &= ~GPIO_bit(i);
+                                PGSR(gpio_to_bank(i)) &= ~GPIO_bit(i);
                }
        }
diff --git a/arch/arm/mach-pxa/raumfeld.c b/arch/arm/mach-pxa/raumfeld.c
index d130f77b6d11..2f37d43f51b6 100644
--- a/arch/arm/mach-pxa/raumfeld.c
+++ b/arch/arm/mach-pxa/raumfeld.c
@@ -573,10 +573,10 @@ static struct pxafb_mode_info sharp_lq043t3dx02_mode = {
        .xres           = 480,
        .yres           = 272,
        .bpp            = 16,
-        .hsync_len      = 4,
+        .hsync_len      = 41,
        .left_margin    = 2,
        .right_margin   = 1,
-        .vsync_len      = 1,
+        .vsync_len      = 10,
        .upper_margin   = 3,
        .lower_margin   = 1,
        .sync           = 0,
@@ -596,29 +596,31 @@ static void __init raumfeld_lcd_init(void)
 {
        int ret;
-        pxa_set_fb_info(NULL, &raumfeld_sharp_lcd_info);
-        /* Earlier devices had the backlight regulator controlled
-         * via PWM, later versions use another controller for that */
-        if ((system_rev & 0xff) < 2) {
-                mfp_cfg_t raumfeld_pwm_pin_config = GPIO17_PWM0_OUT;
-                pxa3xx_mfp_config(&raumfeld_pwm_pin_config, 1);
-                platform_device_register(&raumfeld_pwm_backlight_device);
-        } else
-                platform_device_register(&raumfeld_lt3593_device);
        ret = gpio_request(GPIO_TFT_VA_EN, "display VA enable");
        if (ret < 0)
                pr_warning("Unable to request GPIO_TFT_VA_EN\n");
        else
                gpio_direction_output(GPIO_TFT_VA_EN, 1);
+        msleep(100);
        ret = gpio_request(GPIO_DISPLAY_ENABLE, "display enable");
        if (ret < 0)
                pr_warning("Unable to request GPIO_DISPLAY_ENABLE\n");
        else
                gpio_direction_output(GPIO_DISPLAY_ENABLE, 1);
+        /* Hardware revision 2 has the backlight regulator controlled
+         * by an LT3593, earlier and later devices use PWM for that. */
+        if ((system_rev & 0xff) == 2) {
+                platform_device_register(&raumfeld_lt3593_device);
+        } else {
+                mfp_cfg_t raumfeld_pwm_pin_config = GPIO17_PWM0_OUT;
+                pxa3xx_mfp_config(&raumfeld_pwm_pin_config, 1);
+                platform_device_register(&raumfeld_pwm_backlight_device);
+        }
+        pxa_set_fb_info(NULL, &raumfeld_sharp_lcd_info);
        platform_device_register(&pxa3xx_device_gcu);
 }
@@ -657,10 +659,10 @@ static struct lis3lv02d_platform_data lis3_pdata = {
 #define SPI_AK4104      \
 {                       \
-        .modalias       = "ak4104",     \
+        .modalias       = "ak4104-codec",       \
-        .max_speed_hz   = 10000,        \
+        .max_speed_hz   = 10000,                \
-        .bus_num        = 0,            \
+        .bus_num        = 0,                    \
-        .chip_select    = 0,            \
+        .chip_select    = 0,                    \
        .controller_data = (void *) GPIO_SPDIF_CS,      \
 }
diff --git a/arch/arm/mach-s3c64xx/dma.c b/arch/arm/mach-s3c64xx/dma.c
index b197171e7d03..204bfafe4bfc 100644
--- a/arch/arm/mach-s3c64xx/dma.c
+++ b/arch/arm/mach-s3c64xx/dma.c
@@ -113,7 +113,7 @@ found:
        return chan;
 }
-int s3c2410_dma_config(unsigned int channel, int xferunit)
+int s3c2410_dma_config(enum dma_ch channel, int xferunit)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -297,7 +297,7 @@ static int s3c64xx_dma_flush(struct s3c2410_dma_chan *chan)
        return 0;
 }
-int s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op)
+int s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -331,7 +331,7 @@ EXPORT_SYMBOL(s3c2410_dma_ctrl);
 *
 */
-int s3c2410_dma_enqueue(unsigned int channel, void *id,
+int s3c2410_dma_enqueue(enum dma_ch channel, void *id,
                        dma_addr_t data, int size)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -415,7 +415,7 @@ err_buff:
 EXPORT_SYMBOL(s3c2410_dma_enqueue);
-int s3c2410_dma_devconfig(unsigned int channel,
+int s3c2410_dma_devconfig(enum dma_ch channel,
                          enum s3c2410_dmasrc source,
                          unsigned long devaddr)
 {
@@ -463,7 +463,7 @@ int s3c2410_dma_devconfig(unsigned int channel,
 EXPORT_SYMBOL(s3c2410_dma_devconfig);
-int s3c2410_dma_getposition(unsigned int channel,
+int s3c2410_dma_getposition(enum dma_ch channel,
                            dma_addr_t *src, dma_addr_t *dst)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -487,7 +487,7 @@ EXPORT_SYMBOL(s3c2410_dma_getposition);
 * get control of an dma channel
 */
-int s3c2410_dma_request(unsigned int channel,
+int s3c2410_dma_request(enum dma_ch channel,
                        struct s3c2410_dma_client *client,
                        void *dev)
 {
@@ -533,7 +533,7 @@ EXPORT_SYMBOL(s3c2410_dma_request);
 * allowed to go through.
 */
-int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *client)
+int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *client)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
        unsigned long flags;
diff --git a/arch/arm/plat-orion/gpio.c b/arch/arm/plat-orion/gpio.c
index 5b4fffab1eb4..41ab97ebe4cf 100644
--- a/arch/arm/plat-orion/gpio.c
+++ b/arch/arm/plat-orion/gpio.c
@@ -432,7 +432,7 @@ void __init orion_gpio_init(int gpio_base, int ngpio,
        ct->regs.mask = ochip->mask_offset + GPIO_EDGE_MASK_OFF;
        ct->regs.ack = GPIO_EDGE_CAUSE_OFF;
        ct->type = IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_clr_bit;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
        ct->chip.irq_set_type = gpio_irq_set_type;
diff --git a/arch/arm/plat-pxa/gpio.c b/arch/arm/plat-pxa/gpio.c
index 48ebb9479b61..a11dc3670505 100644
--- a/arch/arm/plat-pxa/gpio.c
+++ b/arch/arm/plat-pxa/gpio.c
@@ -50,7 +50,7 @@ static inline void __iomem *gpio_chip_base(struct gpio_chip *c)
        return container_of(c, struct pxa_gpio_chip, chip)->regbase;
 }
-static inline struct pxa_gpio_chip *gpio_to_chip(unsigned gpio)
+static inline struct pxa_gpio_chip *gpio_to_pxachip(unsigned gpio)
 {
        return &pxa_gpio_chips[gpio_to_bank(gpio)];
 }
@@ -161,7 +161,7 @@ static int pxa_gpio_irq_type(struct irq_data *d, unsigned int type)
        int gpio = irq_to_gpio(d->irq);
        unsigned long gpdr, mask = GPIO_bit(gpio);
-        c = gpio_to_chip(gpio);
+        c = gpio_to_pxachip(gpio);
        if (type == IRQ_TYPE_PROBE) {
                /* Don't mess with enabled GPIOs using preconfigured edges or
@@ -230,7 +230,7 @@ static void pxa_gpio_demux_handler(unsigned int irq, struct irq_desc *desc)
 static void pxa_ack_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        __raw_writel(GPIO_bit(gpio), c->regbase + GEDR_OFFSET);
 }
@@ -238,7 +238,7 @@ static void pxa_ack_muxed_gpio(struct irq_data *d)
 static void pxa_mask_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        uint32_t grer, gfer;
        c->irq_mask &= ~GPIO_bit(gpio);
@@ -252,7 +252,7 @@ static void pxa_mask_muxed_gpio(struct irq_data *d)
 static void pxa_unmask_muxed_gpio(struct irq_data *d)
 {
        int gpio = irq_to_gpio(d->irq);
-        struct pxa_gpio_chip *c = gpio_to_chip(gpio);
+        struct pxa_gpio_chip *c = gpio_to_pxachip(gpio);
        c->irq_mask |= GPIO_bit(gpio);
        update_edge_detect(c);
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index a79a8ccd25f6..539bd0e3defd 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -712,7 +712,7 @@ static struct s3c2410_dma_chan *s3c2410_dma_map_channel(int channel);
 * get control of an dma channel
 */
-int s3c2410_dma_request(unsigned int channel,
+int s3c2410_dma_request(enum dma_ch channel,
                        struct s3c2410_dma_client *client,
                        void *dev)
 {
@@ -783,7 +783,7 @@ EXPORT_SYMBOL(s3c2410_dma_request);
 * allowed to go through.
 */
-int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *client)
+int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *client)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
        unsigned long flags;
@@ -974,7 +974,7 @@ static int s3c2410_dma_started(struct s3c2410_dma_chan *chan)
 }
 int
-s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op)
+s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -1021,7 +1021,7 @@ EXPORT_SYMBOL(s3c2410_dma_ctrl);
 * xfersize:     size of unit in bytes (1,2,4)
 */
-int s3c2410_dma_config(unsigned int channel,
+int s3c2410_dma_config(enum dma_ch channel,
                       int xferunit)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -1100,7 +1100,7 @@ EXPORT_SYMBOL(s3c2410_dma_config);
 * devaddr:   physical address of the source
 */
-int s3c2410_dma_devconfig(unsigned int channel,
+int s3c2410_dma_devconfig(enum dma_ch channel,
                          enum s3c2410_dmasrc source,
                          unsigned long devaddr)
 {
@@ -1173,7 +1173,7 @@ EXPORT_SYMBOL(s3c2410_dma_devconfig);
 * returns the current transfer points for the dma source and destination
 */
-int s3c2410_dma_getposition(unsigned int channel, dma_addr_t *src, dma_addr_t *dst)
+int s3c2410_dma_getposition(enum dma_ch channel, dma_addr_t *src, dma_addr_t *dst)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index 135abda31c9a..327ab9f662e8 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -152,7 +152,7 @@ static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
        if (!gc)
                return -ENOMEM;
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
        ct->chip.irq_set_type = s5p_gpioint_set_type,
diff --git a/arch/arm/plat-samsung/dma.c b/arch/arm/plat-samsung/dma.c
index cb459dd95459..6143aa147688 100644
--- a/arch/arm/plat-samsung/dma.c
+++ b/arch/arm/plat-samsung/dma.c
@@ -41,7 +41,7 @@ struct s3c2410_dma_chan *s3c_dma_lookup_channel(unsigned int channel)
 * irq?
 */
-int s3c2410_dma_set_opfn(unsigned int channel, s3c2410_dma_opfn_t rtn)
+int s3c2410_dma_set_opfn(enum dma_ch channel, s3c2410_dma_opfn_t rtn)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -56,7 +56,7 @@ int s3c2410_dma_set_opfn(unsigned int channel, s3c2410_dma_opfn_t rtn)
 }
 EXPORT_SYMBOL(s3c2410_dma_set_opfn);
-int s3c2410_dma_set_buffdone_fn(unsigned int channel, s3c2410_dma_cbfn_t rtn)
+int s3c2410_dma_set_buffdone_fn(enum dma_ch channel, s3c2410_dma_cbfn_t rtn)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
@@ -71,7 +71,7 @@ int s3c2410_dma_set_buffdone_fn(unsigned int channel, s3c2410_dma_cbfn_t rtn)
 }
 EXPORT_SYMBOL(s3c2410_dma_set_buffdone_fn);
-int s3c2410_dma_setflags(unsigned int channel, unsigned int flags)
+int s3c2410_dma_setflags(enum dma_ch channel, unsigned int flags)
 {
        struct s3c2410_dma_chan *chan = s3c_dma_lookup_channel(channel);
diff --git a/arch/arm/plat-samsung/include/plat/dma.h b/arch/arm/plat-samsung/include/plat/dma.h
index 2e8f8c6560d7..8c273b7a6f56 100644
--- a/arch/arm/plat-samsung/include/plat/dma.h
+++ b/arch/arm/plat-samsung/include/plat/dma.h
@@ -42,6 +42,7 @@ struct s3c2410_dma_client {
 };
 struct s3c2410_dma_chan;
+enum dma_ch;
 /* s3c2410_dma_cbfn_t
 *
@@ -62,7 +63,7 @@ typedef int  (*s3c2410_dma_opfn_t)(struct s3c2410_dma_chan *,
 * request a dma channel exclusivley
 */
-extern int s3c2410_dma_request(unsigned int channel,
+extern int s3c2410_dma_request(enum dma_ch channel,
                               struct s3c2410_dma_client *, void *dev);
@@ -71,14 +72,14 @@ extern int s3c2410_dma_request(unsigned int channel,
 * change the state of the dma channel
 */
-extern int s3c2410_dma_ctrl(unsigned int channel, enum s3c2410_chan_op op);
+extern int s3c2410_dma_ctrl(enum dma_ch channel, enum s3c2410_chan_op op);
 /* s3c2410_dma_setflags
 *
 * set the channel's flags to a given state
 */
-extern int s3c2410_dma_setflags(unsigned int channel,
+extern int s3c2410_dma_setflags(enum dma_ch channel,
                                unsigned int flags);
 /* s3c2410_dma_free
@@ -86,7 +87,7 @@ extern int s3c2410_dma_setflags(unsigned int channel,
 * free the dma channel (will also abort any outstanding operations)
 */
-extern int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *);
+extern int s3c2410_dma_free(enum dma_ch channel, struct s3c2410_dma_client *);
 /* s3c2410_dma_enqueue
 *
@@ -95,7 +96,7 @@ extern int s3c2410_dma_free(unsigned int channel, struct s3c2410_dma_client *);
 * drained before the buffer is given to the DMA system.
 */
-extern int s3c2410_dma_enqueue(unsigned int channel, void *id,
+extern int s3c2410_dma_enqueue(enum dma_ch channel, void *id,
                               dma_addr_t data, int size);
 /* s3c2410_dma_config
@@ -103,14 +104,14 @@ extern int s3c2410_dma_enqueue(unsigned int channel, void *id,
 * configure the dma channel
 */
-extern int s3c2410_dma_config(unsigned int channel, int xferunit);
+extern int s3c2410_dma_config(enum dma_ch channel, int xferunit);
 /* s3c2410_dma_devconfig
 *
 * configure the device we're talking to
 */
-extern int s3c2410_dma_devconfig(unsigned int channel,
+extern int s3c2410_dma_devconfig(enum dma_ch channel,
                enum s3c2410_dmasrc source, unsigned long devaddr);
 /* s3c2410_dma_getposition
@@ -118,10 +119,10 @@ extern int s3c2410_dma_devconfig(unsigned int channel,
 * get the position that the dma transfer is currently at
 */
-extern int s3c2410_dma_getposition(unsigned int channel,
+extern int s3c2410_dma_getposition(enum dma_ch channel,
                                   dma_addr_t *src, dma_addr_t *dest);
-extern int s3c2410_dma_set_opfn(unsigned int, s3c2410_dma_opfn_t rtn);
+extern int s3c2410_dma_set_opfn(enum dma_ch, s3c2410_dma_opfn_t rtn);
-extern int s3c2410_dma_set_buffdone_fn(unsigned int, s3c2410_dma_cbfn_t rtn);
+extern int s3c2410_dma_set_buffdone_fn(enum dma_ch, s3c2410_dma_cbfn_t rtn);
diff --git a/arch/arm/plat-samsung/irq-uart.c b/arch/arm/plat-samsung/irq-uart.c
index 32582c0958e3..657405c481d0 100644
--- a/arch/arm/plat-samsung/irq-uart.c
+++ b/arch/arm/plat-samsung/irq-uart.c
@@ -54,8 +54,15 @@ static void __init s3c_init_uart_irq(struct s3c_uart_irq *uirq)
        gc = irq_alloc_generic_chip("s3c-uart", 1, uirq->base_irq, reg_base,
                                    handle_level_irq);
+        if (!gc) {
+                pr_err("%s: irq_alloc_generic_chip for IRQ %u failed\n",
+                       __func__, uirq->base_irq);
+                return;
+        }
        ct = gc->chip_types;
-        ct->chip.irq_ack = irq_gc_ack;
+        ct->chip.irq_ack = irq_gc_ack_set_bit;
        ct->chip.irq_mask = irq_gc_mask_set_bit;
        ct->chip.irq_unmask = irq_gc_mask_clr_bit;
        ct->regs.ack = S3C64XX_UINTP;
diff --git a/arch/arm/plat-samsung/irq-vic-timer.c b/arch/arm/plat-samsung/irq-vic-timer.c
index a607546ddbd0..f714d060370d 100644
--- a/arch/arm/plat-samsung/irq-vic-timer.c
+++ b/arch/arm/plat-samsung/irq-vic-timer.c
@@ -54,6 +54,13 @@ void __init s3c_init_vic_timer_irq(unsigned int num, unsigned int timer_irq)
        s3c_tgc = irq_alloc_generic_chip("s3c-timer", 1, timer_irq,
                                         S3C64XX_TINT_CSTAT, handle_level_irq);
+        if (!s3c_tgc) {
+                pr_err("%s: irq_alloc_generic_chip for IRQ %d failed\n",
+                       __func__, timer_irq);
+                return;
+        }
        ct = s3c_tgc->chip_types;
        ct->chip.irq_mask = irq_gc_mask_clr_bit;
        ct->chip.irq_unmask = irq_gc_mask_set_bit;
diff --git a/arch/mips/kernel/i8259.c b/arch/mips/kernel/i8259.c
index c018696765d4..5c74eb797f08 100644
--- a/arch/mips/kernel/i8259.c
+++ b/arch/mips/kernel/i8259.c
@@ -14,7 +14,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/spinlock.h>
-#include <linux/sysdev.h>
+#include <linux/syscore_ops.h>
 #include <linux/irq.h>
 #include <asm/i8259.h>
@@ -215,14 +215,13 @@ spurious_8259A_irq:
        }
 }
-static int i8259A_resume(struct sys_device *dev)
+static void i8259A_resume(void)
 {
        if (i8259A_auto_eoi >= 0)
                init_8259A(i8259A_auto_eoi);
-        return 0;
 }
-static int i8259A_shutdown(struct sys_device *dev)
+static void i8259A_shutdown(void)
 {
        /* Put the i8259A into a quiescent state that
         * the kernel initialization code can get it
@@ -232,26 +231,17 @@ static int i8259A_shutdown(struct sys_device *dev)
                outb(0xff, PIC_MASTER_IMR);     /* mask all of 8259A-1 */
                outb(0xff, PIC_SLAVE_IMR);      /* mask all of 8259A-1 */
        }
-        return 0;
 }
-static struct sysdev_class i8259_sysdev_class = {
+static struct syscore_ops i8259_syscore_ops = {
-        .name = "i8259",
        .resume = i8259A_resume,
        .shutdown = i8259A_shutdown,
 };
-static struct sys_device device_i8259A = {
-        .id     = 0,
-        .cls    = &i8259_sysdev_class,
-};
 static int __init i8259A_init_sysfs(void)
 {
-        int error = sysdev_class_register(&i8259_sysdev_class);
+        register_syscore_ops(&i8259_syscore_ops);
-        if (!error)
+        return 0;
-                error = sysdev_register(&device_i8259A);
-        return error;
 }
 device_initcall(i8259A_init_sysfs);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 33867ec4a234..9d6a8effeda2 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -12,6 +12,8 @@
 #include <linux/of.h>
 #include <linux/memblock.h>
 #include <linux/vmalloc.h>
+#include <linux/memory.h>
 #include <asm/firmware.h>
 #include <asm/machdep.h>
 #include <asm/pSeries_reconfig.h>
@@ -20,24 +22,25 @@
 static unsigned long get_memblock_size(void)
 {
        struct device_node *np;
-        unsigned int memblock_size = 0;
+        unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE;
+        struct resource r;
        np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
        if (np) {
-                const unsigned long *size;
+                const __be64 *size;
                size = of_get_property(np, "ibm,lmb-size", NULL);
-                memblock_size = size ? *size : 0;
+                if (size)
+                        memblock_size = be64_to_cpup(size);
                of_node_put(np);
-        } else {
+        } else  if (machine_is(pseries)) {
+                /* This fallback really only applies to pseries */
                unsigned int memzero_size = 0;
-                const unsigned int *regs;
                np = of_find_node_by_path("/memory@0");
                if (np) {
-                        regs = of_get_property(np, "reg", NULL);
+                        if (!of_address_to_resource(np, 0, &r))
-                        memzero_size = regs ? regs[3] : 0;
+                                memzero_size = resource_size(&r);
                        of_node_put(np);
                }
@@ -50,16 +53,21 @@ static unsigned long get_memblock_size(void)
                        sprintf(buf, "/memory@%x", memzero_size);
                        np = of_find_node_by_path(buf);
                        if (np) {
-                                regs = of_get_property(np, "reg", NULL);
+                                if (!of_address_to_resource(np, 0, &r))
-                                memblock_size = regs ? regs[3] : 0;
+                                        memblock_size = resource_size(&r);
                                of_node_put(np);
                        }
                }
        }
        return memblock_size;
 }
+/* WARNING: This is going to override the generic definition whenever
+ * pseries is built-in regardless of what platform is active at boot
+ * time. This is fine for now as this is the only "option" and it
+ * should work everywhere. If not, we'll have to turn this into a
+ * ppc_md. callback
+ */
 unsigned long memory_block_size_bytes(void)
 {
        return get_memblock_size();
diff --git a/arch/sparc/include/asm/irqflags_32.h b/arch/sparc/include/asm/irqflags_32.h
index d4d0711de0f9..14848909e0de 100644
--- a/arch/sparc/include/asm/irqflags_32.h
+++ b/arch/sparc/include/asm/irqflags_32.h
@@ -18,7 +18,7 @@ extern void arch_local_irq_restore(unsigned long);
 extern unsigned long arch_local_irq_save(void);
 extern void arch_local_irq_enable(void);
-static inline unsigned long arch_local_save_flags(void)
+static inline notrace unsigned long arch_local_save_flags(void)
 {
        unsigned long flags;
@@ -26,17 +26,17 @@ static inline unsigned long arch_local_save_flags(void)
        return flags;
 }
-static inline void arch_local_irq_disable(void)
+static inline notrace void arch_local_irq_disable(void)
 {
        arch_local_irq_save();
 }
-static inline bool arch_irqs_disabled_flags(unsigned long flags)
+static inline notrace bool arch_irqs_disabled_flags(unsigned long flags)
 {
        return (flags & PSR_PIL) != 0;
 }
-static inline bool arch_irqs_disabled(void)
+static inline notrace bool arch_irqs_disabled(void)
 {
        return arch_irqs_disabled_flags(arch_local_save_flags());
 }
diff --git a/arch/sparc/include/asm/irqflags_64.h b/arch/sparc/include/asm/irqflags_64.h
index aab969c82c2b..23cd27f6beb4 100644
--- a/arch/sparc/include/asm/irqflags_64.h
+++ b/arch/sparc/include/asm/irqflags_64.h
@@ -14,7 +14,7 @@
 #ifndef __ASSEMBLY__
-static inline unsigned long arch_local_save_flags(void)
+static inline notrace unsigned long arch_local_save_flags(void)
 {
        unsigned long flags;
@@ -26,7 +26,7 @@ static inline unsigned long arch_local_save_flags(void)
        return flags;
 }
-static inline void arch_local_irq_restore(unsigned long flags)
+static inline notrace void arch_local_irq_restore(unsigned long flags)
 {
        __asm__ __volatile__(
                "wrpr   %0, %%pil"
@@ -36,7 +36,7 @@ static inline void arch_local_irq_restore(unsigned long flags)
        );
 }
-static inline void arch_local_irq_disable(void)
+static inline notrace void arch_local_irq_disable(void)
 {
        __asm__ __volatile__(
                "wrpr   %0, %%pil"
@@ -46,7 +46,7 @@ static inline void arch_local_irq_disable(void)
        );
 }
-static inline void arch_local_irq_enable(void)
+static inline notrace void arch_local_irq_enable(void)
 {
        __asm__ __volatile__(
                "wrpr   0, %%pil"
@@ -56,17 +56,17 @@ static inline void arch_local_irq_enable(void)
        );
 }
-static inline int arch_irqs_disabled_flags(unsigned long flags)
+static inline notrace int arch_irqs_disabled_flags(unsigned long flags)
 {
        return (flags > 0);
 }
-static inline int arch_irqs_disabled(void)
+static inline notrace int arch_irqs_disabled(void)
 {
        return arch_irqs_disabled_flags(arch_local_save_flags());
 }
-static inline unsigned long arch_local_irq_save(void)
+static inline notrace unsigned long arch_local_irq_save(void)
 {
        unsigned long flags, tmp;
diff --git a/arch/sparc/kernel/entry.S b/arch/sparc/kernel/entry.S
index 9fe08a1ea6c6..f445e98463e6 100644
--- a/arch/sparc/kernel/entry.S
+++ b/arch/sparc/kernel/entry.S
@@ -293,7 +293,7 @@ maybe_smp4m_msg:
        WRITE_PAUSE
        wr      %l4, PSR_ET, %psr
        WRITE_PAUSE
-        sll     %o3, 28, %o2            ! shift for simpler checks below
+        srl     %o3, 28, %o2            ! shift for simpler checks below
 maybe_smp4m_msg_check_single:
        andcc   %o2, 0x1, %g0
        beq,a   maybe_smp4m_msg_check_mask
diff --git a/arch/sparc/mm/leon_mm.c b/arch/sparc/mm/leon_mm.c
index c0e01297e64e..e485a6804998 100644
--- a/arch/sparc/mm/leon_mm.c
+++ b/arch/sparc/mm/leon_mm.c
@@ -226,7 +226,7 @@ void leon3_getCacheRegs(struct leon3_cacheregs *regs)
 * Leon2 and Leon3 differ in their way of telling cache information
 *
 */
-int leon_flush_needed(void)
+int __init leon_flush_needed(void)
 {
        int flush_needed = -1;
        unsigned int ssize, sets;
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index d865c4aeec55..bbaaa005bf0e 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -28,6 +28,7 @@
 #include <linux/poison.h>
 #include <linux/dma-mapping.h>
 #include <linux/module.h>
+#include <linux/memory.h>
 #include <linux/memory_hotplug.h>
 #include <linux/nmi.h>
 #include <linux/gfp.h>
@@ -895,8 +896,6 @@ const char *arch_vma_name(struct vm_area_struct *vma)
 }
 #ifdef CONFIG_X86_UV
-#define MIN_MEMORY_BLOCK_SIZE   (1 << SECTION_SIZE_BITS)
 unsigned long memory_block_size_bytes(void)
 {
        if (is_uv_system()) {
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index abda3786a5d7..181bc2f7bb74 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -139,13 +139,23 @@ static int __init hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
        struct platform_device *ghes_dev;
        struct ghes_arr *ghes_arr = data;
-        int rc;
+        int rc, i;
        if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                return 0;
        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                return 0;
+        for (i = 0; i < ghes_arr->count; i++) {
+                struct acpi_hest_header *hdr;
+                ghes_dev = ghes_arr->ghes_devs[i];
+                hdr = *(struct acpi_hest_header **)ghes_dev->dev.platform_data;
+                if (hdr->source_id == hest_hdr->source_id) {
+                        pr_warning(FW_WARN HEST_PFX "Duplicated hardware error source ID: %d.\n",
+                                   hdr->source_id);
+                        return -EIO;
+                }
+        }
        ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
        if (!ghes_dev)
                return -ENOMEM;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 52ca9649d769..372f9b70f7f4 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -1333,23 +1333,6 @@ int acpi_resources_are_enforced(void)
 EXPORT_SYMBOL(acpi_resources_are_enforced);
 /*
- * Create and initialize a spinlock.
- */
-acpi_status
-acpi_os_create_lock(acpi_spinlock *out_handle)
-{
-        spinlock_t *lock;
-        lock = ACPI_ALLOCATE(sizeof(spinlock_t));
-        if (!lock)
-                return AE_NO_MEMORY;
-        spin_lock_init(lock);
-        *out_handle = lock;
-        return AE_OK;
-}
-/*
 * Deallocate the memory for a spinlock.
 */
 void acpi_os_delete_lock(acpi_spinlock handle)
diff --git a/drivers/base/memory.c b/drivers/base/memory.c
index 9f9b2359f718..45d7c8fc73bd 100644
--- a/drivers/base/memory.c
+++ b/drivers/base/memory.c
@@ -30,7 +30,6 @@
 static DEFINE_MUTEX(mem_sysfs_mutex);
 #define MEMORY_CLASS_NAME       "memory"
-#define MIN_MEMORY_BLOCK_SIZE   (1 << SECTION_SIZE_BITS)
 static int sections_per_block;
diff --git a/drivers/base/syscore.c b/drivers/base/syscore.c
index c126db3cb7d1..e8d11b6630ee 100644
--- a/drivers/base/syscore.c
+++ b/drivers/base/syscore.c
@@ -9,6 +9,7 @@
 #include <linux/syscore_ops.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
+#include <linux/interrupt.h>
 static LIST_HEAD(syscore_ops_list);
 static DEFINE_MUTEX(syscore_ops_lock);
@@ -48,6 +49,13 @@ int syscore_suspend(void)
        struct syscore_ops *ops;
        int ret = 0;
+        pr_debug("Checking wakeup interrupts\n");
+        /* Return error code if there are any wakeup interrupts pending. */
+        ret = check_wakeup_irqs();
+        if (ret)
+                return ret;
        WARN_ONCE(!irqs_disabled(),
                "Interrupts enabled before system core suspend.\n");
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index 999803ce10dc..5da67f165afa 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -90,9 +90,10 @@
 #define G4x_GMCH_SIZE_MASK      (0xf << 8)
 #define G4x_GMCH_SIZE_1M        (0x1 << 8)
 #define G4x_GMCH_SIZE_2M        (0x3 << 8)
-#define G4x_GMCH_SIZE_VT_1M     (0x9 << 8)
+#define G4x_GMCH_SIZE_VT_EN     (0x8 << 8)
-#define G4x_GMCH_SIZE_VT_1_5M   (0xa << 8)
+#define G4x_GMCH_SIZE_VT_1M     (G4x_GMCH_SIZE_1M | G4x_GMCH_SIZE_VT_EN)
-#define G4x_GMCH_SIZE_VT_2M     (0xc << 8)
+#define G4x_GMCH_SIZE_VT_1_5M   ((0x2 << 8) | G4x_GMCH_SIZE_VT_EN)
+#define G4x_GMCH_SIZE_VT_2M     (G4x_GMCH_SIZE_2M | G4x_GMCH_SIZE_VT_EN)
 #define GFX_FLSH_CNTL           0x2170 /* 915+ */
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 4e04e1274388..596d5dd32f41 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -759,7 +759,7 @@ static void __exit acpi_cpufreq_exit(void)
        cpufreq_unregister_driver(&acpi_cpufreq_driver);
-        free_percpu(acpi_perf_data);
+        free_acpi_perf_data();
 }
 module_param(acpi_pstate_strict, uint, 0644);
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 438e6c831170..ebb897329c1e 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -264,6 +264,7 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
 #define PCI_DEVICE_ID_AGERE_FW643       0x5901
 #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
 #define PCI_DEVICE_ID_TI_TSB12LV22      0x8009
+#define PCI_VENDOR_ID_PINNACLE_SYSTEMS  0x11bd
 #define QUIRK_CYCLE_TIMER               1
 #define QUIRK_RESET_PACKET              2
@@ -3190,6 +3191,11 @@ static int __devinit pci_probe(struct pci_dev *dev,
        int i, err;
        size_t size;
+        if (dev->vendor == PCI_VENDOR_ID_PINNACLE_SYSTEMS) {
+                dev_err(&dev->dev, "Pinnacle MovieBoard is not yet supported\n");
+                return -ENOSYS;
+        }
        ohci = kzalloc(sizeof(*ohci), GFP_KERNEL);
        if (ohci == NULL) {
                err = -ENOMEM;
diff --git a/drivers/gpio/wm831x-gpio.c b/drivers/gpio/wm831x-gpio.c
index 309644cf4d9b..2bcfb0be09ff 100644
--- a/drivers/gpio/wm831x-gpio.c
+++ b/drivers/gpio/wm831x-gpio.c
@@ -180,6 +180,7 @@ static void wm831x_gpio_dbg_show(struct seq_file *s, struct gpio_chip *chip)
                        break;
                case WM831X_GPIO_PULL_UP:
                        pull = "pullup";
+                        break;
                default:
                        pull = "INVALID PULL";
                        break;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index e1787022d6c8..296fbd66f0e1 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1943,7 +1943,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (!dev_priv->mm.gtt) {
                DRM_ERROR("Failed to initialize GTT\n");
                ret = -ENODEV;
-                goto out_iomapfree;
+                goto out_rmmap;
        }
        agp_size = dev_priv->mm.gtt->gtt_mappable_entries << PAGE_SHIFT;
@@ -1987,7 +1987,7 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (dev_priv->wq == NULL) {
                DRM_ERROR("Failed to create our workqueue.\n");
                ret = -ENOMEM;
-                goto out_iomapfree;
+                goto out_mtrrfree;
        }
        /* enable GEM by default */
@@ -2074,13 +2074,21 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        return 0;
 out_gem_unload:
+        if (dev_priv->mm.inactive_shrinker.shrink)
+                unregister_shrinker(&dev_priv->mm.inactive_shrinker);
        if (dev->pdev->msi_enabled)
                pci_disable_msi(dev->pdev);
        intel_teardown_gmbus(dev);
        intel_teardown_mchbar(dev);
        destroy_workqueue(dev_priv->wq);
-out_iomapfree:
+out_mtrrfree:
+        if (dev_priv->mm.gtt_mtrr >= 0) {
+                mtrr_del(dev_priv->mm.gtt_mtrr, dev->agp->base,
+                         dev->agp->agp_info.aper_size * 1024 * 1024);
+                dev_priv->mm.gtt_mtrr = -1;
+        }
        io_mapping_free(dev_priv->mm.gtt_mapping);
 out_rmmap:
        pci_iounmap(dev->pdev, dev_priv->regs);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 013d304455b9..eb91e2dd7914 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -52,7 +52,7 @@ module_param_named(powersave, i915_powersave, int, 0600);
 unsigned int i915_semaphores = 0;
 module_param_named(semaphores, i915_semaphores, int, 0600);
-unsigned int i915_enable_rc6 = 1;
+unsigned int i915_enable_rc6 = 0;
 module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 unsigned int i915_enable_fbc = 0;
@@ -577,6 +577,7 @@ int i915_reset(struct drm_device *dev, u8 flags)
        if (get_seconds() - dev_priv->last_gpu_reset < 5) {
                DRM_ERROR("GPU hanging too fast, declaring wedged!\n");
        } else switch (INTEL_INFO(dev)->gen) {
+        case 7:
        case 6:
                ret = gen6_do_reset(dev, flags);
                /* If reset with a user forcewake, try to restore */
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 391b55f1cc74..e2aced6eec4c 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -50,7 +50,6 @@ struct intel_dp {
        bool has_audio;
        int force_audio;
        uint32_t color_range;
-        int dpms_mode;
        uint8_t link_bw;
        uint8_t lane_count;
        uint8_t dpcd[4];
@@ -138,8 +137,8 @@ intel_dp_max_lane_count(struct intel_dp *intel_dp)
 {
        int max_lane_count = 4;
-        if (intel_dp->dpcd[0] >= 0x11) {
+        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11) {
-                max_lane_count = intel_dp->dpcd[2] & 0x1f;
+                max_lane_count = intel_dp->dpcd[DP_MAX_LANE_COUNT] & 0x1f;
                switch (max_lane_count) {
                case 1: case 2: case 4:
                        break;
@@ -153,7 +152,7 @@ intel_dp_max_lane_count(struct intel_dp *intel_dp)
 static int
 intel_dp_max_link_bw(struct intel_dp *intel_dp)
 {
-        int max_link_bw = intel_dp->dpcd[1];
+        int max_link_bw = intel_dp->dpcd[DP_MAX_LINK_RATE];
        switch (max_link_bw) {
        case DP_LINK_BW_1_62:
@@ -774,7 +773,8 @@ intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
        /*
         * Check for DPCD version > 1.1 and enhanced framing support
         */
-        if (intel_dp->dpcd[0] >= 0x11 && (intel_dp->dpcd[2] & DP_ENHANCED_FRAME_CAP)) {
+        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11 &&
+            (intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_ENHANCED_FRAME_CAP)) {
                intel_dp->link_configuration[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
                intel_dp->DP |= DP_ENHANCED_FRAMING;
        }
@@ -942,11 +942,44 @@ static void ironlake_edp_pll_off(struct drm_encoder *encoder)
        udelay(200);
 }
+/* If the sink supports it, try to set the power state appropriately */
+static void intel_dp_sink_dpms(struct intel_dp *intel_dp, int mode)
+{
+        int ret, i;
+        /* Should have a valid DPCD by this point */
+        if (intel_dp->dpcd[DP_DPCD_REV] < 0x11)
+                return;
+        if (mode != DRM_MODE_DPMS_ON) {
+                ret = intel_dp_aux_native_write_1(intel_dp, DP_SET_POWER,
+                                                  DP_SET_POWER_D3);
+                if (ret != 1)
+                        DRM_DEBUG_DRIVER("failed to write sink power state\n");
+        } else {
+                /*
+                 * When turning on, we need to retry for 1ms to give the sink
+                 * time to wake up.
+                 */
+                for (i = 0; i < 3; i++) {
+                        ret = intel_dp_aux_native_write_1(intel_dp,
+                                                          DP_SET_POWER,
+                                                          DP_SET_POWER_D0);
+                        if (ret == 1)
+                                break;
+                        msleep(1);
+                }
+        }
+}
 static void intel_dp_prepare(struct drm_encoder *encoder)
 {
        struct intel_dp *intel_dp = enc_to_intel_dp(encoder);
        struct drm_device *dev = encoder->dev;
+        /* Wake up the sink first */
+        intel_dp_sink_dpms(intel_dp, DRM_MODE_DPMS_ON);
        if (is_edp(intel_dp)) {
                ironlake_edp_backlight_off(dev);
                ironlake_edp_panel_off(dev);
@@ -990,6 +1023,7 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
        if (mode != DRM_MODE_DPMS_ON) {
                if (is_edp(intel_dp))
                        ironlake_edp_backlight_off(dev);
+                intel_dp_sink_dpms(intel_dp, mode);
                intel_dp_link_down(intel_dp);
                if (is_edp(intel_dp))
                        ironlake_edp_panel_off(dev);
@@ -998,6 +1032,7 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
        } else {
                if (is_edp(intel_dp))
                        ironlake_edp_panel_vdd_on(intel_dp);
+                intel_dp_sink_dpms(intel_dp, mode);
                if (!(dp_reg & DP_PORT_EN)) {
                        intel_dp_start_link_train(intel_dp);
                        if (is_edp(intel_dp)) {
@@ -1009,7 +1044,31 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
                if (is_edp(intel_dp))
                        ironlake_edp_backlight_on(dev);
        }
-        intel_dp->dpms_mode = mode;
+}
+/*
+ * Native read with retry for link status and receiver capability reads for
+ * cases where the sink may still be asleep.
+ */
+static bool
+intel_dp_aux_native_read_retry(struct intel_dp *intel_dp, uint16_t address,
+                               uint8_t *recv, int recv_bytes)
+{
+        int ret, i;
+        /*
+         * Sinks are *supposed* to come up within 1ms from an off state,
+         * but we're also supposed to retry 3 times per the spec.
+         */
+        for (i = 0; i < 3; i++) {
+                ret = intel_dp_aux_native_read(intel_dp, address, recv,
+                                               recv_bytes);
+                if (ret == recv_bytes)
+                        return true;
+                msleep(1);
+        }
+        return false;
 }
 /*
@@ -1019,14 +1078,10 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
 static bool
 intel_dp_get_link_status(struct intel_dp *intel_dp)
 {
-        int ret;
+        return intel_dp_aux_native_read_retry(intel_dp,
+                                              DP_LANE0_1_STATUS,
-        ret = intel_dp_aux_native_read(intel_dp,
+                                              intel_dp->link_status,
-                                       DP_LANE0_1_STATUS,
+                                              DP_LINK_STATUS_SIZE);
-                                       intel_dp->link_status, DP_LINK_STATUS_SIZE);
-        if (ret != DP_LINK_STATUS_SIZE)
-                return false;
-        return true;
 }
 static uint8_t
@@ -1515,6 +1570,8 @@ intel_dp_link_down(struct intel_dp *intel_dp)
 static void
 intel_dp_check_link_status(struct intel_dp *intel_dp)
 {
+        int ret;
        if (!intel_dp->base.base.crtc)
                return;
@@ -1523,6 +1580,15 @@ intel_dp_check_link_status(struct intel_dp *intel_dp)
                return;
        }
+        /* Try to read receiver status if the link appears to be up */
+        ret = intel_dp_aux_native_read(intel_dp,
+                                       0x000, intel_dp->dpcd,
+                                       sizeof (intel_dp->dpcd));
+        if (ret != sizeof(intel_dp->dpcd)) {
+                intel_dp_link_down(intel_dp);
+                return;
+        }
        if (!intel_channel_eq_ok(intel_dp)) {
                intel_dp_start_link_train(intel_dp);
                intel_dp_complete_link_train(intel_dp);
@@ -1533,6 +1599,7 @@ static enum drm_connector_status
 ironlake_dp_detect(struct intel_dp *intel_dp)
 {
        enum drm_connector_status status;
+        bool ret;
        /* Can't disconnect eDP, but you can close the lid... */
        if (is_edp(intel_dp)) {
@@ -1543,13 +1610,11 @@ ironlake_dp_detect(struct intel_dp *intel_dp)
        }
        status = connector_status_disconnected;
-        if (intel_dp_aux_native_read(intel_dp,
+        ret = intel_dp_aux_native_read_retry(intel_dp,
-                                     0x000, intel_dp->dpcd,
+                                             0x000, intel_dp->dpcd,
-                                     sizeof (intel_dp->dpcd))
+                                             sizeof (intel_dp->dpcd));
-            == sizeof(intel_dp->dpcd)) {
+        if (ret && intel_dp->dpcd[DP_DPCD_REV] != 0)
-                if (intel_dp->dpcd[0] != 0)
+                status = connector_status_connected;
-                        status = connector_status_connected;
-        }
        DRM_DEBUG_KMS("DPCD: %hx%hx%hx%hx\n", intel_dp->dpcd[0],
                      intel_dp->dpcd[1], intel_dp->dpcd[2], intel_dp->dpcd[3]);
        return status;
@@ -1586,7 +1651,7 @@ g4x_dp_detect(struct intel_dp *intel_dp)
        if (intel_dp_aux_native_read(intel_dp, 0x000, intel_dp->dpcd,
                                     sizeof (intel_dp->dpcd)) == sizeof (intel_dp->dpcd))
        {
-                if (intel_dp->dpcd[0] != 0)
+                if (intel_dp->dpcd[DP_DPCD_REV] != 0)
                        status = connector_status_connected;
        }
@@ -1790,8 +1855,7 @@ intel_dp_hot_plug(struct intel_encoder *intel_encoder)
 {
        struct intel_dp *intel_dp = container_of(intel_encoder, struct intel_dp, base);
-        if (intel_dp->dpms_mode == DRM_MODE_DPMS_ON)
+        intel_dp_check_link_status(intel_dp);
-                intel_dp_check_link_status(intel_dp);
 }
 /* Return which DP Port should be selected for Transcoder DP control */
@@ -1859,7 +1923,6 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                return;
        intel_dp->output_reg = output_reg;
-        intel_dp->dpms_mode = -1;
        intel_connector = kzalloc(sizeof(struct intel_connector), GFP_KERNEL);
        if (!intel_connector) {
@@ -1954,8 +2017,9 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                                               sizeof(intel_dp->dpcd));
                ironlake_edp_panel_vdd_off(intel_dp);
                if (ret == sizeof(intel_dp->dpcd)) {
-                        if (intel_dp->dpcd[0] >= 0x11)
+                        if (intel_dp->dpcd[DP_DPCD_REV] >= 0x11)
-                                dev_priv->no_aux_handshake = intel_dp->dpcd[3] &
+                                dev_priv->no_aux_handshake =
+                                        intel_dp->dpcd[DP_MAX_DOWNSPREAD] &
                                        DP_NO_AUX_HANDSHAKE_LINK_TRAINING;
                } else {
                        /* if this fails, presume the device is a ghost */
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index c0e0ee63fbf4..39ac2b634ae5 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -165,7 +165,7 @@ void intel_cleanup_ring_buffer(struct intel_ring_buffer *ring);
 int __must_check intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n);
 static inline int intel_wait_ring_idle(struct intel_ring_buffer *ring)
 {
-        return intel_wait_ring_buffer(ring, ring->space - 8);
+        return intel_wait_ring_buffer(ring, ring->size - 8);
 }
 int __must_check intel_ring_begin(struct intel_ring_buffer *ring, int n);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 660f96401a05..15bd0477a3e8 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2000,7 +2000,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                        gb_backend_map = 0x66442200;
                        break;
                case CHIP_JUNIPER:
-                        gb_backend_map = 0x00006420;
+                        gb_backend_map = 0x00002200;
                        break;
                default:
                        gb_backend_map =
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index 57f3bc17b87e..2eb251858e72 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -252,7 +252,7 @@ draw_auto(struct radeon_device *rdev)
 }
-/* emits 36 */
+/* emits 39 */
 static void
 set_default_state(struct radeon_device *rdev)
 {
@@ -531,6 +531,11 @@ set_default_state(struct radeon_device *rdev)
                radeon_ring_write(rdev, (SQ_DYN_GPR_CNTL_PS_FLUSH_REQ - PACKET3_SET_CONFIG_REG_START) >> 2);
                radeon_ring_write(rdev, 0);
+                /* setup LDS */
+                radeon_ring_write(rdev, PACKET3(PACKET3_SET_CONFIG_REG, 1));
+                radeon_ring_write(rdev, (SQ_LDS_RESOURCE_MGMT - PACKET3_SET_CONFIG_REG_START) >> 2);
+                radeon_ring_write(rdev, 0x10001000);
                /* SQ config */
                radeon_ring_write(rdev, PACKET3(PACKET3_SET_CONFIG_REG, 11));
                radeon_ring_write(rdev, (SQ_CONFIG - PACKET3_SET_CONFIG_REG_START) >> 2);
@@ -773,7 +778,7 @@ int evergreen_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
        /* calculate number of loops correctly */
        ring_size = num_loops * dwords_per_loop;
        /* set default  + shaders */
-        ring_size += 52; /* shaders + def state */
+        ring_size += 55; /* shaders + def state */
        ring_size += 10; /* fence emit for VB IB */
        ring_size += 5; /* done copy */
        ring_size += 10; /* fence emit for done copy */
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 3fc5fa1aefd0..229a20f10e2b 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -331,7 +331,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        seprom_cntl1 = RREG32(RADEON_SEPROM_CNTL1);
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        bus_cntl = RREG32(RV370_BUS_CNTL);
        d1vga_control = RREG32(AVIVO_D1VGA_CONTROL);
        d2vga_control = RREG32(AVIVO_D2VGA_CONTROL);
        vga_render_control = RREG32(AVIVO_VGA_RENDER_CONTROL);
@@ -350,7 +350,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        WREG32(RV370_BUS_CNTL, (bus_cntl & ~RV370_BUS_BIOS_DIS_ROM));
        /* Disable VGA mode */
        WREG32(AVIVO_D1VGA_CONTROL,
@@ -367,7 +367,7 @@ static bool avivo_read_disabled_bios(struct radeon_device *rdev)
        /* restore regs */
        WREG32(RADEON_SEPROM_CNTL1, seprom_cntl1);
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        WREG32(RV370_BUS_CNTL, bus_cntl);
        WREG32(AVIVO_D1VGA_CONTROL, d1vga_control);
        WREG32(AVIVO_D2VGA_CONTROL, d2vga_control);
        WREG32(AVIVO_VGA_RENDER_CONTROL, vga_render_control);
@@ -390,7 +390,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        seprom_cntl1 = RREG32(RADEON_SEPROM_CNTL1);
        viph_control = RREG32(RADEON_VIPH_CONTROL);
-        bus_cntl = RREG32(RADEON_BUS_CNTL);
+        if (rdev->flags & RADEON_IS_PCIE)
+                bus_cntl = RREG32(RV370_BUS_CNTL);
+        else
+                bus_cntl = RREG32(RADEON_BUS_CNTL);
        crtc_gen_cntl = RREG32(RADEON_CRTC_GEN_CNTL);
        crtc2_gen_cntl = 0;
        crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
@@ -412,7 +415,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        WREG32(RADEON_VIPH_CONTROL, (viph_control & ~RADEON_VIPH_EN));
        /* enable the rom */
-        WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
+        if (rdev->flags & RADEON_IS_PCIE)
+                WREG32(RV370_BUS_CNTL, (bus_cntl & ~RV370_BUS_BIOS_DIS_ROM));
+        else
+                WREG32(RADEON_BUS_CNTL, (bus_cntl & ~RADEON_BUS_BIOS_DIS_ROM));
        /* Turn off mem requests and CRTC for both controllers */
        WREG32(RADEON_CRTC_GEN_CNTL,
@@ -439,7 +445,10 @@ static bool legacy_read_disabled_bios(struct radeon_device *rdev)
        /* restore regs */
        WREG32(RADEON_SEPROM_CNTL1, seprom_cntl1);
        WREG32(RADEON_VIPH_CONTROL, viph_control);
-        WREG32(RADEON_BUS_CNTL, bus_cntl);
+        if (rdev->flags & RADEON_IS_PCIE)
+                WREG32(RV370_BUS_CNTL, bus_cntl);
+        else
+                WREG32(RADEON_BUS_CNTL, bus_cntl);
        WREG32(RADEON_CRTC_GEN_CNTL, crtc_gen_cntl);
        if (!(rdev->flags & RADEON_SINGLE_CRTC)) {
                WREG32(RADEON_CRTC2_GEN_CNTL, crtc2_gen_cntl);
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index cbfca3a24fdf..9792d4ffdc86 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -52,6 +52,12 @@ void radeon_connector_hotplug(struct drm_connector *connector)
        struct radeon_device *rdev = dev->dev_private;
        struct radeon_connector *radeon_connector = to_radeon_connector(connector);
+        /* bail if the connector does not have hpd pin, e.g.,
+         * VGA, TV, etc.
+         */
+        if (radeon_connector->hpd.hpd == RADEON_HPD_NONE)
+                return;
        radeon_hpd_set_polarity(rdev, radeon_connector->hpd.hpd);
        /* powering up/down the eDP panel generates hpd events which
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index ec93a75369e6..bc44a3d35ec6 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -300,6 +300,8 @@
 #       define RADEON_BUS_READ_BURST         (1 << 30)
 #define RADEON_BUS_CNTL1                    0x0034
 #       define RADEON_BUS_WAIT_ON_LOCK_EN    (1 << 4)
+#define RV370_BUS_CNTL                      0x004c
+#       define RV370_BUS_BIOS_DIS_ROM        (1 << 2)
 /* rv370/rv380, rv410, r423/r430/r480, r5xx */
 #define RADEON_MSI_REARM_EN                 0x0160
 #       define RV370_MSI_REARM_EN            (1 << 0)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 6e3b11e5abbe..1f5850e473cc 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -426,7 +426,7 @@ int rs600_gart_init(struct radeon_device *rdev)
        return radeon_gart_table_vram_alloc(rdev);
 }
-int rs600_gart_enable(struct radeon_device *rdev)
+static int rs600_gart_enable(struct radeon_device *rdev)
 {
        u32 tmp;
        int r, i;
@@ -440,8 +440,8 @@ int rs600_gart_enable(struct radeon_device *rdev)
                return r;
        radeon_gart_restore(rdev);
        /* Enable bus master */
-        tmp = RREG32(R_00004C_BUS_CNTL) & C_00004C_BUS_MASTER_DIS;
+        tmp = RREG32(RADEON_BUS_CNTL) & ~RS600_BUS_MASTER_DIS;
-        WREG32(R_00004C_BUS_CNTL, tmp);
+        WREG32(RADEON_BUS_CNTL, tmp);
        /* FIXME: setup default page */
        WREG32_MC(R_000100_MC_PT0_CNTL,
                  (S_000100_EFFECTIVE_L2_CACHE_SIZE(6) |
diff --git a/drivers/hwmon/adm1275.c b/drivers/hwmon/adm1275.c
index b9b7caf4a1d2..8bc1bd663721 100644
--- a/drivers/hwmon/adm1275.c
+++ b/drivers/hwmon/adm1275.c
@@ -53,23 +53,23 @@ static int adm1275_probe(struct i2c_client *client,
        info->direct[PSC_VOLTAGE_IN] = true;
        info->direct[PSC_VOLTAGE_OUT] = true;
        info->direct[PSC_CURRENT_OUT] = true;
-        info->m[PSC_CURRENT_OUT] = 800;
+        info->m[PSC_CURRENT_OUT] = 807;
        info->b[PSC_CURRENT_OUT] = 20475;
        info->R[PSC_CURRENT_OUT] = -1;
        info->func[0] = PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT;
        if (config & ADM1275_VRANGE) {
-                info->m[PSC_VOLTAGE_IN] = 19045;
+                info->m[PSC_VOLTAGE_IN] = 19199;
                info->b[PSC_VOLTAGE_IN] = 0;
                info->R[PSC_VOLTAGE_IN] = -2;
-                info->m[PSC_VOLTAGE_OUT] = 19045;
+                info->m[PSC_VOLTAGE_OUT] = 19199;
                info->b[PSC_VOLTAGE_OUT] = 0;
                info->R[PSC_VOLTAGE_OUT] = -2;
        } else {
-                info->m[PSC_VOLTAGE_IN] = 6666;
+                info->m[PSC_VOLTAGE_IN] = 6720;
                info->b[PSC_VOLTAGE_IN] = 0;
                info->R[PSC_VOLTAGE_IN] = -1;
-                info->m[PSC_VOLTAGE_OUT] = 6666;
+                info->m[PSC_VOLTAGE_OUT] = 6720;
                info->b[PSC_VOLTAGE_OUT] = 0;
                info->R[PSC_VOLTAGE_OUT] = -1;
        }
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index dcb78a7a8047..00e98517f94c 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -674,6 +674,7 @@ static int atk_debugfs_gitm_get(void *p, u64 *val)
        else
                err = -EIO;
+        ACPI_FREE(ret);
        return err;
 }
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index bb6405b92007..5f5247750430 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -1538,7 +1538,7 @@ static struct attribute *it87_attributes_label[] = {
 };
 static const struct attribute_group it87_group_label = {
-        .attrs = it87_attributes_vid,
+        .attrs = it87_attributes_label,
 };
 /* SuperIO detection - will change isa_address if a chip is found */
diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
index 12a54aa29776..14335bbc9bdc 100644
--- a/drivers/hwmon/max1111.c
+++ b/drivers/hwmon/max1111.c
@@ -40,6 +40,8 @@ struct max1111_data {
        struct spi_transfer     xfer[2];
        uint8_t *tx_buf;
        uint8_t *rx_buf;
+        struct mutex            drvdata_lock;
+        /* protect msg, xfer and buffers from multiple access */
 };
 static int max1111_read(struct device *dev, int channel)
@@ -48,6 +50,9 @@ static int max1111_read(struct device *dev, int channel)
        uint8_t v1, v2;
        int err;
+        /* writing to drvdata struct is not thread safe, wait on mutex */
+        mutex_lock(&data->drvdata_lock);
        data->tx_buf[0] = (channel << MAX1111_CTRL_SEL_SH) |
                MAX1111_CTRL_PD0 | MAX1111_CTRL_PD1 |
                MAX1111_CTRL_SGL | MAX1111_CTRL_UNI | MAX1111_CTRL_STR;
@@ -55,12 +60,15 @@ static int max1111_read(struct device *dev, int channel)
        err = spi_sync(data->spi, &data->msg);
        if (err < 0) {
                dev_err(dev, "spi_sync failed with %d\n", err);
+                mutex_unlock(&data->drvdata_lock);
                return err;
        }
        v1 = data->rx_buf[0];
        v2 = data->rx_buf[1];
+        mutex_unlock(&data->drvdata_lock);
        if ((v1 & 0xc0) || (v2 & 0x3f))
                return -EINVAL;
@@ -176,6 +184,8 @@ static int __devinit max1111_probe(struct spi_device *spi)
        if (err)
                goto err_free_data;
+        mutex_init(&data->drvdata_lock);
        data->spi = spi;
        spi_set_drvdata(spi, data);
@@ -213,6 +223,7 @@ static int __devexit max1111_remove(struct spi_device *spi)
        hwmon_device_unregister(data->hwmon_dev);
        sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
+        mutex_destroy(&data->drvdata_lock);
        kfree(data->rx_buf);
        kfree(data->tx_buf);
        kfree(data);
diff --git a/drivers/hwmon/pmbus_core.c b/drivers/hwmon/pmbus_core.c
index 744672c1f26d..8e31a8e2c746 100644
--- a/drivers/hwmon/pmbus_core.c
+++ b/drivers/hwmon/pmbus_core.c
@@ -362,8 +362,8 @@ static struct pmbus_data *pmbus_update_device(struct device *dev)
 * Convert linear sensor values to milli- or micro-units
 * depending on sensor type.
 */
-static int pmbus_reg2data_linear(struct pmbus_data *data,
+static long pmbus_reg2data_linear(struct pmbus_data *data,
-                                 struct pmbus_sensor *sensor)
+                                  struct pmbus_sensor *sensor)
 {
        s16 exponent;
        s32 mantissa;
@@ -397,15 +397,15 @@ static int pmbus_reg2data_linear(struct pmbus_data *data,
        else
                val >>= -exponent;
-        return (int)val;
+        return val;
 }
 /*
 * Convert direct sensor values to milli- or micro-units
 * depending on sensor type.
 */
-static int pmbus_reg2data_direct(struct pmbus_data *data,
+static long pmbus_reg2data_direct(struct pmbus_data *data,
-                                 struct pmbus_sensor *sensor)
+                                  struct pmbus_sensor *sensor)
 {
        long val = (s16) sensor->data;
        long m, b, R;
@@ -440,12 +440,12 @@ static int pmbus_reg2data_direct(struct pmbus_data *data,
                R++;
        }
-        return (int)((val - b) / m);
+        return (val - b) / m;
 }
-static int pmbus_reg2data(struct pmbus_data *data, struct pmbus_sensor *sensor)
+static long pmbus_reg2data(struct pmbus_data *data, struct pmbus_sensor *sensor)
 {
-        int val;
+        long val;
        if (data->info->direct[sensor->class])
                val = pmbus_reg2data_direct(data, sensor);
@@ -619,7 +619,7 @@ static int pmbus_get_boolean(struct pmbus_data *data, int index, int *val)
        if (!s1 && !s2)
                *val = !!regval;
        else {
-                int v1, v2;
+                long v1, v2;
                struct pmbus_sensor *sensor1, *sensor2;
                sensor1 = &data->sensors[s1];
@@ -661,7 +661,7 @@ static ssize_t pmbus_show_sensor(struct device *dev,
        if (sensor->data < 0)
                return sensor->data;
-        return snprintf(buf, PAGE_SIZE, "%d\n", pmbus_reg2data(data, sensor));
+        return snprintf(buf, PAGE_SIZE, "%ld\n", pmbus_reg2data(data, sensor));
 }
 static ssize_t pmbus_set_sensor(struct device *dev,
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 98278041d75f..5b6b451d4694 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -1988,6 +1988,14 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
        if (dvbdev->users == -1 && fe->ops.ts_bus_ctrl) {
                if ((ret = fe->ops.ts_bus_ctrl(fe, 1)) < 0)
                        goto err0;
+                /* If we took control of the bus, we need to force
+                   reinitialization.  This is because many ts_bus_ctrl()
+                   functions strobe the RESET pin on the demod, and if the
+                   frontend thread already exists then the dvb_init() routine
+                   won't get called (which is what usually does initial
+                   register configuration). */
+                fepriv->reinitialise = 1;
        }
        if ((ret = dvb_generic_open (inode, file)) < 0)
diff --git a/drivers/media/radio/Kconfig b/drivers/media/radio/Kconfig
index e4c97fd6f05a..52798a111e16 100644
--- a/drivers/media/radio/Kconfig
+++ b/drivers/media/radio/Kconfig
@@ -168,7 +168,7 @@ config RADIO_MAXIRADIO
 config RADIO_MIROPCM20
        tristate "miroSOUND PCM20 radio"
-        depends on ISA && VIDEO_V4L2 && SND
+        depends on ISA && ISA_DMA_API && VIDEO_V4L2 && SND
        select SND_ISA
        select SND_MIRO
        ---help---
@@ -201,7 +201,7 @@ config RADIO_SF16FMI
 config RADIO_SF16FMR2
        tristate "SF16FMR2 Radio"
-        depends on ISA && VIDEO_V4L2
+        depends on ISA && VIDEO_V4L2 && SND
        ---help---
          Choose Y here if you have one of these FM radio cards.
diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c
index deca2e06ff22..c9f4a8e65dc4 100644
--- a/drivers/media/radio/si4713-i2c.c
+++ b/drivers/media/radio/si4713-i2c.c
@@ -1033,7 +1033,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
                char ps_name[MAX_RDS_PS_NAME + 1];
                len = control->size - 1;
-                if (len > MAX_RDS_PS_NAME) {
+                if (len < 0 || len > MAX_RDS_PS_NAME) {
                        rval = -ERANGE;
                        goto exit;
                }
@@ -1057,7 +1057,7 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev,
                char radio_text[MAX_RDS_RADIO_TEXT + 1];
                len = control->size - 1;
-                if (len > MAX_RDS_RADIO_TEXT) {
+                if (len < 0 || len > MAX_RDS_RADIO_TEXT) {
                        rval = -ERANGE;
                        goto exit;
                }
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 06dfe0957b5e..ec972dc25790 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -558,9 +558,10 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, char *buf,
                                 inout, data1);
                        break;
                case MCE_CMD_S_TIMEOUT:
-                        /* value is in units of 50us, so x*50/100 or x/2 ms */
+                        /* value is in units of 50us, so x*50/1000 ms */
                        dev_info(dev, "%s receive timeout of %d ms\n",
-                                 inout, ((data1 << 8) | data2) / 2);
+                                 inout,
+                                 ((data1 << 8) | data2) * MCE_TIME_UNIT / 1000);
                        break;
                case MCE_CMD_G_TIMEOUT:
                        dev_info(dev, "Get receive timeout\n");
@@ -847,7 +848,7 @@ static void mceusb_handle_command(struct mceusb_dev *ir, int index)
        switch (ir->buf_in[index]) {
        /* 2-byte return value commands */
        case MCE_CMD_S_TIMEOUT:
-                ir->rc->timeout = US_TO_NS((hi << 8 | lo) / 2);
+                ir->rc->timeout = US_TO_NS((hi << 8 | lo) * MCE_TIME_UNIT);
                break;
        /* 1-byte return value commands */
@@ -1078,7 +1079,7 @@ static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir)
        rc->priv = ir;
        rc->driver_type = RC_DRIVER_IR_RAW;
        rc->allowed_protos = RC_TYPE_ALL;
-        rc->timeout = US_TO_NS(1000);
+        rc->timeout = MS_TO_NS(100);
        if (!ir->flags.no_tx) {
                rc->s_tx_mask = mceusb_set_tx_mask;
                rc->s_tx_carrier = mceusb_set_tx_carrier;
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 565f24c20d77..ce595f9ab4c7 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -1110,7 +1110,7 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
        rdev->dev.parent = &pdev->dev;
        rdev->driver_name = NVT_DRIVER_NAME;
        rdev->map_name = RC_MAP_RC6_MCE;
-        rdev->timeout = US_TO_NS(1000);
+        rdev->timeout = MS_TO_NS(100);
        /* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
        rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
 #if 0
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index a97cf2750bd9..834a48394bce 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -3474,7 +3474,7 @@ static int radio_s_tuner(struct file *file, void *priv,
        if (0 != t->index)
                return -EINVAL;
-        bttv_call_all(btv, tuner, g_tuner, t);
+        bttv_call_all(btv, tuner, s_tuner, t);
        return 0;
 }
diff --git a/drivers/media/video/cx18/cx18-ioctl.c b/drivers/media/video/cx18/cx18-ioctl.c
index 1933d4d11bf2..e80134f52ef5 100644
--- a/drivers/media/video/cx18/cx18-ioctl.c
+++ b/drivers/media/video/cx18/cx18-ioctl.c
@@ -695,14 +695,10 @@ static int cx18_g_tuner(struct file *file, void *fh, struct v4l2_tuner *vt)
        cx18_call_all(cx, tuner, g_tuner, vt);
-        if (test_bit(CX18_F_I_RADIO_USER, &cx->i_flags)) {
+        if (vt->type == V4L2_TUNER_RADIO)
                strlcpy(vt->name, "cx18 Radio Tuner", sizeof(vt->name));
-                vt->type = V4L2_TUNER_RADIO;
+        else
-        } else {
                strlcpy(vt->name, "cx18 TV Tuner", sizeof(vt->name));
-                vt->type = V4L2_TUNER_ANALOG_TV;
-        }
        return 0;
 }
diff --git a/drivers/media/video/cx23885/cx23885-core.c b/drivers/media/video/cx23885/cx23885-core.c
index 64d9b2136ff6..419777a832ee 100644
--- a/drivers/media/video/cx23885/cx23885-core.c
+++ b/drivers/media/video/cx23885/cx23885-core.c
@@ -2060,12 +2060,8 @@ static int __devinit cx23885_initdev(struct pci_dev *pci_dev,
                goto fail_irq;
        }
-        if (!pci_enable_msi(pci_dev))
+        err = request_irq(pci_dev->irq, cx23885_irq,
-                err = request_irq(pci_dev->irq, cx23885_irq,
+                          IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
-                                  IRQF_DISABLED, dev->name, dev);
-        else
-                err = request_irq(pci_dev->irq, cx23885_irq,
-                                  IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
        if (err < 0) {
                printk(KERN_ERR "%s: can't get IRQ %d\n",
                       dev->name, pci_dev->irq);
@@ -2114,7 +2110,6 @@ static void __devexit cx23885_finidev(struct pci_dev *pci_dev)
        /* unregister stuff */
        free_irq(pci_dev->irq, dev);
-        pci_disable_msi(pci_dev);
        cx23885_dev_unregister(dev);
        v4l2_device_unregister(v4l2_dev);
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index f9e347dae739..120c7d8e0895 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -1184,14 +1184,10 @@ static int ivtv_g_tuner(struct file *file, void *fh, struct v4l2_tuner *vt)
        ivtv_call_all(itv, tuner, g_tuner, vt);
-        if (test_bit(IVTV_F_I_RADIO_USER, &itv->i_flags)) {
+        if (vt->type == V4L2_TUNER_RADIO)
                strlcpy(vt->name, "ivtv Radio Tuner", sizeof(vt->name));
-                vt->type = V4L2_TUNER_RADIO;
+        else
-        } else {
                strlcpy(vt->name, "ivtv TV Tuner", sizeof(vt->name));
-                vt->type = V4L2_TUNER_ANALOG_TV;
-        }
        return 0;
 }
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index de5d481b0328..c43c81f5f978 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -480,12 +480,14 @@ static int msp_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
        struct msp_state *state = to_state(sd);
        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (state->radio)
+        if (vt->type != V4L2_TUNER_ANALOG_TV)
                return 0;
-        if (state->opmode == OPMODE_AUTOSELECT)
+        if (!state->radio) {
-                msp_detect_stereo(client);
+                if (state->opmode == OPMODE_AUTOSELECT)
-        vt->audmode    = state->audmode;
+                        msp_detect_stereo(client);
-        vt->rxsubchans = state->rxsubchans;
+                vt->rxsubchans = state->rxsubchans;
+        }
+        vt->audmode = state->audmode;
        vt->capability |= V4L2_TUNER_CAP_STEREO |
                V4L2_TUNER_CAP_LANG1 | V4L2_TUNER_CAP_LANG2;
        return 0;
diff --git a/drivers/media/video/pvrusb2/pvrusb2-hdw.c b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
index 9d0dd08f57f8..e98d38212791 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-hdw.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-hdw.c
@@ -3046,6 +3046,8 @@ static void pvr2_subdev_update(struct pvr2_hdw *hdw)
        if (hdw->input_dirty || hdw->audiomode_dirty || hdw->force_dirty) {
                struct v4l2_tuner vt;
                memset(&vt, 0, sizeof(vt));
+                vt.type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
+                        V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
                vt.audmode = hdw->audiomode_val;
                v4l2_device_call_all(&hdw->v4l2_dev, 0, tuner, s_tuner, &vt);
        }
@@ -5171,6 +5173,8 @@ void pvr2_hdw_status_poll(struct pvr2_hdw *hdw)
 {
        struct v4l2_tuner *vtp = &hdw->tuner_signal_info;
        memset(vtp, 0, sizeof(*vtp));
+        vtp->type = (hdw->input_val == PVR2_CVAL_INPUT_RADIO) ?
+                V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
        hdw->tuner_signal_stale = 0;
        /* Note: There apparently is no replacement for VIDIOC_CROPCAP
           using v4l2-subdev - therefore we can't support that AT ALL right
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index 9363ed91a4cb..a03945ab9f08 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -714,29 +714,34 @@ static int tuner_remove(struct i2c_client *client)
 * returns 0.
 * This function is needed for boards that have a separate tuner for
 * radio (like devices with tea5767).
+ * NOTE: mt20xx uses V4L2_TUNER_DIGITAL_TV and calls set_tv_freq to
+ *       select a TV frequency. So, t_mode = T_ANALOG_TV could actually
+ *       be used to represent a Digital TV too.
 */
 static inline int check_mode(struct tuner *t, enum v4l2_tuner_type mode)
 {
-        if ((1 << mode & t->mode_mask) == 0)
+        int t_mode;
+        if (mode == V4L2_TUNER_RADIO)
+                t_mode = T_RADIO;
+        else
+                t_mode = T_ANALOG_TV;
+        if ((t_mode & t->mode_mask) == 0)
                return -EINVAL;
        return 0;
 }
 /**
- * set_mode_freq - Switch tuner to other mode.
+ * set_mode - Switch tuner to other mode.
- * @client:     struct i2c_client pointer
 * @t:          a pointer to the module's internal struct_tuner
 * @mode:       enum v4l2_type (radio or TV)
- * @freq:       frequency to set (0 means to use the previous one)
 *
 * If tuner doesn't support the needed mode (radio or TV), prints a
 * debug message and returns -EINVAL, changing its state to standby.
- * Otherwise, changes the state and sets frequency to the last value, if
+ * Otherwise, changes the mode and returns 0.
- * the tuner can sleep or if it supports both Radio and TV.
 */
-static int set_mode_freq(struct i2c_client *client, struct tuner *t,
+static int set_mode(struct tuner *t, enum v4l2_tuner_type mode)
-                         enum v4l2_tuner_type mode, unsigned int freq)
 {
        struct analog_demod_ops *analog_ops = &t->fe.ops.analog_ops;
@@ -752,17 +757,27 @@ static int set_mode_freq(struct i2c_client *client, struct tuner *t,
                t->mode = mode;
                tuner_dbg("Changing to mode %d\n", mode);
        }
+        return 0;
+}
+/**
+ * set_freq - Set the tuner to the desired frequency.
+ * @t:          a pointer to the module's internal struct_tuner
+ * @freq:       frequency to set (0 means to use the current frequency)
+ */
+static void set_freq(struct tuner *t, unsigned int freq)
+{
+        struct i2c_client *client = v4l2_get_subdevdata(&t->sd);
        if (t->mode == V4L2_TUNER_RADIO) {
-                if (freq)
+                if (!freq)
-                        t->radio_freq = freq;
+                        freq = t->radio_freq;
-                set_radio_freq(client, t->radio_freq);
+                set_radio_freq(client, freq);
        } else {
-                if (freq)
+                if (!freq)
-                        t->tv_freq = freq;
+                        freq = t->tv_freq;
-                set_tv_freq(client, t->tv_freq);
+                set_tv_freq(client, freq);
        }
-        return 0;
 }
 /*
@@ -817,7 +832,8 @@ static void set_tv_freq(struct i2c_client *c, unsigned int freq)
 /**
 * tuner_fixup_std - force a given video standard variant
 *
- * @t:  tuner internal struct
+ * @t: tuner internal struct
+ * @std:        TV standard
 *
 * A few devices or drivers have problem to detect some standard variations.
 * On other operational systems, the drivers generally have a per-country
@@ -827,57 +843,39 @@ static void set_tv_freq(struct i2c_client *c, unsigned int freq)
 * to distinguish all video standard variations, a modprobe parameter can
 * be used to force a video standard match.
 */
-static int tuner_fixup_std(struct tuner *t)
+static v4l2_std_id tuner_fixup_std(struct tuner *t, v4l2_std_id std)
 {
-        if ((t->std & V4L2_STD_PAL) == V4L2_STD_PAL) {
+        if (pal[0] != '-' && (std & V4L2_STD_PAL) == V4L2_STD_PAL) {
                switch (pal[0]) {
                case '6':
-                        tuner_dbg("insmod fixup: PAL => PAL-60\n");
+                        return V4L2_STD_PAL_60;
-                        t->std = V4L2_STD_PAL_60;
-                        break;
                case 'b':
                case 'B':
                case 'g':
                case 'G':
-                        tuner_dbg("insmod fixup: PAL => PAL-BG\n");
+                        return V4L2_STD_PAL_BG;
-                        t->std = V4L2_STD_PAL_BG;
-                        break;
                case 'i':
                case 'I':
-                        tuner_dbg("insmod fixup: PAL => PAL-I\n");
+                        return V4L2_STD_PAL_I;
-                        t->std = V4L2_STD_PAL_I;
-                        break;
                case 'd':
                case 'D':
                case 'k':
                case 'K':
-                        tuner_dbg("insmod fixup: PAL => PAL-DK\n");
+                        return V4L2_STD_PAL_DK;
-                        t->std = V4L2_STD_PAL_DK;
-                        break;
                case 'M':
                case 'm':
-                        tuner_dbg("insmod fixup: PAL => PAL-M\n");
+                        return V4L2_STD_PAL_M;
-                        t->std = V4L2_STD_PAL_M;
-                        break;
                case 'N':
                case 'n':
-                        if (pal[1] == 'c' || pal[1] == 'C') {
+                        if (pal[1] == 'c' || pal[1] == 'C')
-                                tuner_dbg("insmod fixup: PAL => PAL-Nc\n");
+                                return V4L2_STD_PAL_Nc;
-                                t->std = V4L2_STD_PAL_Nc;
+                        return V4L2_STD_PAL_N;
-                        } else {
-                                tuner_dbg("insmod fixup: PAL => PAL-N\n");
-                                t->std = V4L2_STD_PAL_N;
-                        }
-                        break;
-                case '-':
-                        /* default parameter, do nothing */
-                        break;
                default:
                        tuner_warn("pal= argument not recognised\n");
                        break;
                }
        }
-        if ((t->std & V4L2_STD_SECAM) == V4L2_STD_SECAM) {
+        if (secam[0] != '-' && (std & V4L2_STD_SECAM) == V4L2_STD_SECAM) {
                switch (secam[0]) {
                case 'b':
                case 'B':
@@ -885,63 +883,42 @@ static int tuner_fixup_std(struct tuner *t)
                case 'G':
                case 'h':
                case 'H':
-                        tuner_dbg("insmod fixup: SECAM => SECAM-BGH\n");
+                        return V4L2_STD_SECAM_B |
-                        t->std = V4L2_STD_SECAM_B |
+                               V4L2_STD_SECAM_G |
-                                 V4L2_STD_SECAM_G |
+                               V4L2_STD_SECAM_H;
-                                 V4L2_STD_SECAM_H;
-                        break;
                case 'd':
                case 'D':
                case 'k':
                case 'K':
-                        tuner_dbg("insmod fixup: SECAM => SECAM-DK\n");
+                        return V4L2_STD_SECAM_DK;
-                        t->std = V4L2_STD_SECAM_DK;
-                        break;
                case 'l':
                case 'L':
-                        if ((secam[1] == 'C') || (secam[1] == 'c')) {
+                        if ((secam[1] == 'C') || (secam[1] == 'c'))
-                                tuner_dbg("insmod fixup: SECAM => SECAM-L'\n");
+                                return V4L2_STD_SECAM_LC;
-                                t->std = V4L2_STD_SECAM_LC;
+                        return V4L2_STD_SECAM_L;
-                        } else {
-                                tuner_dbg("insmod fixup: SECAM => SECAM-L\n");
-                                t->std = V4L2_STD_SECAM_L;
-                        }
-                        break;
-                case '-':
-                        /* default parameter, do nothing */
-                        break;
                default:
                        tuner_warn("secam= argument not recognised\n");
                        break;
                }
        }
-        if ((t->std & V4L2_STD_NTSC) == V4L2_STD_NTSC) {
+        if (ntsc[0] != '-' && (std & V4L2_STD_NTSC) == V4L2_STD_NTSC) {
                switch (ntsc[0]) {
                case 'm':
                case 'M':
-                        tuner_dbg("insmod fixup: NTSC => NTSC-M\n");
+                        return V4L2_STD_NTSC_M;
-                        t->std = V4L2_STD_NTSC_M;
-                        break;
                case 'j':
                case 'J':
-                        tuner_dbg("insmod fixup: NTSC => NTSC_M_JP\n");
+                        return V4L2_STD_NTSC_M_JP;
-                        t->std = V4L2_STD_NTSC_M_JP;
-                        break;
                case 'k':
                case 'K':
-                        tuner_dbg("insmod fixup: NTSC => NTSC_M_KR\n");
+                        return V4L2_STD_NTSC_M_KR;
-                        t->std = V4L2_STD_NTSC_M_KR;
-                        break;
-                case '-':
-                        /* default parameter, do nothing */
-                        break;
                default:
                        tuner_info("ntsc= argument not recognised\n");
                        break;
                }
        }
-        return 0;
+        return std;
 }
 /*
@@ -1016,7 +993,7 @@ static void tuner_status(struct dvb_frontend *fe)
        case V4L2_TUNER_RADIO:
                p = "radio";
                break;
-        case V4L2_TUNER_DIGITAL_TV:
+        case V4L2_TUNER_DIGITAL_TV: /* Used by mt20xx */
                p = "digital TV";
                break;
        case V4L2_TUNER_ANALOG_TV:
@@ -1058,10 +1035,9 @@ static void tuner_status(struct dvb_frontend *fe)
 static int tuner_s_radio(struct v4l2_subdev *sd)
 {
        struct tuner *t = to_tuner(sd);
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (set_mode_freq(client, t, V4L2_TUNER_RADIO, 0) == -EINVAL)
+        if (set_mode(t, V4L2_TUNER_RADIO) == 0)
-                return 0;
+                set_freq(t, 0);
        return 0;
 }
@@ -1072,16 +1048,20 @@ static int tuner_s_radio(struct v4l2_subdev *sd)
 /**
 * tuner_s_power - controls the power state of the tuner
 * @sd: pointer to struct v4l2_subdev
- * @on: a zero value puts the tuner to sleep
+ * @on: a zero value puts the tuner to sleep, non-zero wakes it up
 */
 static int tuner_s_power(struct v4l2_subdev *sd, int on)
 {
        struct tuner *t = to_tuner(sd);
        struct analog_demod_ops *analog_ops = &t->fe.ops.analog_ops;
-        /* FIXME: Why this function don't wake the tuner if on != 0 ? */
+        if (on) {
-        if (on)
+                if (t->standby && set_mode(t, t->mode) == 0) {
+                        tuner_dbg("Waking up tuner\n");
+                        set_freq(t, 0);
+                }
                return 0;
+        }
        tuner_dbg("Putting tuner to sleep\n");
        t->standby = true;
@@ -1093,28 +1073,36 @@ static int tuner_s_power(struct v4l2_subdev *sd, int on)
 static int tuner_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
 {
        struct tuner *t = to_tuner(sd);
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (set_mode_freq(client, t, V4L2_TUNER_ANALOG_TV, 0) == -EINVAL)
+        if (set_mode(t, V4L2_TUNER_ANALOG_TV))
                return 0;
-        t->std = std;
+        t->std = tuner_fixup_std(t, std);
-        tuner_fixup_std(t);
+        if (t->std != std)
+                tuner_dbg("Fixup standard %llx to %llx\n", std, t->std);
+        set_freq(t, 0);
        return 0;
 }
 static int tuner_s_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
 {
        struct tuner *t = to_tuner(sd);
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (set_mode_freq(client, t, f->type, f->frequency) == -EINVAL)
-                return 0;
+        if (set_mode(t, f->type) == 0)
+                set_freq(t, f->frequency);
        return 0;
 }
+/**
+ * tuner_g_frequency - Get the tuned frequency for the tuner
+ * @sd: pointer to struct v4l2_subdev
+ * @f: pointer to struct v4l2_frequency
+ *
+ * At return, the structure f will be filled with tuner frequency
+ * if the tuner matches the f->type.
+ * Note: f->type should be initialized before calling it.
+ * This is done by either video_ioctl2 or by the bridge driver.
+ */
 static int tuner_g_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
 {
        struct tuner *t = to_tuner(sd);
@@ -1122,8 +1110,7 @@ static int tuner_g_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
        if (check_mode(t, f->type) == -EINVAL)
                return 0;
-        f->type = t->mode;
+        if (f->type == t->mode && fe_tuner_ops->get_frequency && !t->standby) {
-        if (fe_tuner_ops->get_frequency && !t->standby) {
                u32 abs_freq;
                fe_tuner_ops->get_frequency(&t->fe, &abs_freq);
@@ -1131,12 +1118,22 @@ static int tuner_g_frequency(struct v4l2_subdev *sd, struct v4l2_frequency *f)
                        DIV_ROUND_CLOSEST(abs_freq * 2, 125) :
                        DIV_ROUND_CLOSEST(abs_freq, 62500);
        } else {
-                f->frequency = (V4L2_TUNER_RADIO == t->mode) ?
+                f->frequency = (V4L2_TUNER_RADIO == f->type) ?
                        t->radio_freq : t->tv_freq;
        }
        return 0;
 }
+/**
+ * tuner_g_tuner - Fill in tuner information
+ * @sd: pointer to struct v4l2_subdev
+ * @vt: pointer to struct v4l2_tuner
+ *
+ * At return, the structure vt will be filled with tuner information
+ * if the tuner matches vt->type.
+ * Note: vt->type should be initialized before calling it.
+ * This is done by either video_ioctl2 or by the bridge driver.
+ */
 static int tuner_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 {
        struct tuner *t = to_tuner(sd);
@@ -1145,48 +1142,57 @@ static int tuner_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
        if (check_mode(t, vt->type) == -EINVAL)
                return 0;
-        vt->type = t->mode;
+        if (vt->type == t->mode && analog_ops->get_afc)
-        if (analog_ops->get_afc)
                vt->afc = analog_ops->get_afc(&t->fe);
-        if (t->mode == V4L2_TUNER_ANALOG_TV)
-                vt->capability |= V4L2_TUNER_CAP_NORM;
        if (t->mode != V4L2_TUNER_RADIO) {
+                vt->capability |= V4L2_TUNER_CAP_NORM;
                vt->rangelow = tv_range[0] * 16;
                vt->rangehigh = tv_range[1] * 16;
                return 0;
        }
        /* radio mode */
-        vt->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
+        if (vt->type == t->mode) {
-        if (fe_tuner_ops->get_status) {
+                vt->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
-                u32 tuner_status;
+                if (fe_tuner_ops->get_status) {
+                        u32 tuner_status;
-                fe_tuner_ops->get_status(&t->fe, &tuner_status);
-                vt->rxsubchans =
+                        fe_tuner_ops->get_status(&t->fe, &tuner_status);
-                        (tuner_status & TUNER_STATUS_STEREO) ?
+                        vt->rxsubchans =
-                        V4L2_TUNER_SUB_STEREO :
+                                (tuner_status & TUNER_STATUS_STEREO) ?
-                        V4L2_TUNER_SUB_MONO;
+                                V4L2_TUNER_SUB_STEREO :
+                                V4L2_TUNER_SUB_MONO;
+                }
+                if (analog_ops->has_signal)
+                        vt->signal = analog_ops->has_signal(&t->fe);
+                vt->audmode = t->audmode;
        }
-        if (analog_ops->has_signal)
-                vt->signal = analog_ops->has_signal(&t->fe);
        vt->capability |= V4L2_TUNER_CAP_LOW | V4L2_TUNER_CAP_STEREO;
-        vt->audmode = t->audmode;
        vt->rangelow = radio_range[0] * 16000;
        vt->rangehigh = radio_range[1] * 16000;
        return 0;
 }
+/**
+ * tuner_s_tuner - Set the tuner's audio mode
+ * @sd: pointer to struct v4l2_subdev
+ * @vt: pointer to struct v4l2_tuner
+ *
+ * Sets the audio mode if the tuner matches vt->type.
+ * Note: vt->type should be initialized before calling it.
+ * This is done by either video_ioctl2 or by the bridge driver.
+ */
 static int tuner_s_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 {
        struct tuner *t = to_tuner(sd);
-        struct i2c_client *client = v4l2_get_subdevdata(sd);
-        if (set_mode_freq(client, t, vt->type, 0) == -EINVAL)
+        if (set_mode(t, vt->type))
                return 0;
        if (t->mode == V4L2_TUNER_RADIO)
                t->audmode = vt->audmode;
+        set_freq(t, 0);
        return 0;
 }
@@ -1221,7 +1227,8 @@ static int tuner_resume(struct i2c_client *c)
        tuner_dbg("resume\n");
        if (!t->standby)
-                set_mode_freq(c, t, t->type, 0);
+                if (set_mode(t, t->mode) == 0)
+                        set_freq(t, 0);
        return 0;
 }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 506edcc2ddeb..69e8c6ffcc49 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1822,6 +1822,8 @@ static long __video_do_ioctl(struct file *file,
                if (!ops->vidioc_g_tuner)
                        break;
+                p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+                        V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
                ret = ops->vidioc_g_tuner(file, fh, p);
                if (!ret)
                        dbgarg(cmd, "index=%d, name=%s, type=%d, "
@@ -1840,6 +1842,8 @@ static long __video_do_ioctl(struct file *file,
                if (!ops->vidioc_s_tuner)
                        break;
+                p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+                        V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
                dbgarg(cmd, "index=%d, name=%s, type=%d, "
                                "capability=0x%x, rangelow=%d, "
                                "rangehigh=%d, signal=%d, afc=%d, "
@@ -1858,6 +1862,8 @@ static long __video_do_ioctl(struct file *file,
                if (!ops->vidioc_g_frequency)
                        break;
+                p->type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+                        V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
                ret = ops->vidioc_g_frequency(file, fh, p);
                if (!ret)
                        dbgarg(cmd, "tuner=%d, type=%d, frequency=%d\n",
@@ -1940,13 +1946,19 @@ static long __video_do_ioctl(struct file *file,
        case VIDIOC_S_HW_FREQ_SEEK:
        {
                struct v4l2_hw_freq_seek *p = arg;
+                enum v4l2_tuner_type type;
                if (!ops->vidioc_s_hw_freq_seek)
                        break;
+                type = (vfd->vfl_type == VFL_TYPE_RADIO) ?
+                        V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
                dbgarg(cmd,
-                        "tuner=%d, type=%d, seek_upward=%d, wrap_around=%d\n",
+                        "tuner=%u, type=%u, seek_upward=%u, wrap_around=%u, spacing=%u\n",
-                        p->tuner, p->type, p->seek_upward, p->wrap_around);
+                        p->tuner, p->type, p->seek_upward, p->wrap_around, p->spacing);
-                ret = ops->vidioc_s_hw_freq_seek(file, fh, p);
+                if (p->type != type)
+                        ret = -EINVAL;
+                else
+                        ret = ops->vidioc_s_hw_freq_seek(file, fh, p);
                break;
        }
        case VIDIOC_ENUM_FRAMESIZES:
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 2a7e43bc796d..aa7d1d79b8c5 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -247,12 +247,12 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                return 0;
        /* Version is coded in the CSD_STRUCTURE byte in the EXT_CSD register */
+        card->ext_csd.raw_ext_csd_structure = ext_csd[EXT_CSD_STRUCTURE];
        if (card->csd.structure == 3) {
-                int ext_csd_struct = ext_csd[EXT_CSD_STRUCTURE];
+                if (card->ext_csd.raw_ext_csd_structure > 2) {
-                if (ext_csd_struct > 2) {
                        printk(KERN_ERR "%s: unrecognised EXT_CSD structure "
                                "version %d\n", mmc_hostname(card->host),
-                                        ext_csd_struct);
+                                        card->ext_csd.raw_ext_csd_structure);
                        err = -EINVAL;
                        goto out;
                }
@@ -266,6 +266,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                goto out;
        }
+        card->ext_csd.raw_sectors[0] = ext_csd[EXT_CSD_SEC_CNT + 0];
+        card->ext_csd.raw_sectors[1] = ext_csd[EXT_CSD_SEC_CNT + 1];
+        card->ext_csd.raw_sectors[2] = ext_csd[EXT_CSD_SEC_CNT + 2];
+        card->ext_csd.raw_sectors[3] = ext_csd[EXT_CSD_SEC_CNT + 3];
        if (card->ext_csd.rev >= 2) {
                card->ext_csd.sectors =
                        ext_csd[EXT_CSD_SEC_CNT + 0] << 0 |
@@ -277,7 +281,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                if (card->ext_csd.sectors > (2u * 1024 * 1024 * 1024) / 512)
                        mmc_card_set_blockaddr(card);
        }
+        card->ext_csd.raw_card_type = ext_csd[EXT_CSD_CARD_TYPE];
        switch (ext_csd[EXT_CSD_CARD_TYPE] & EXT_CSD_CARD_TYPE_MASK) {
        case EXT_CSD_CARD_TYPE_DDR_52 | EXT_CSD_CARD_TYPE_52 |
             EXT_CSD_CARD_TYPE_26:
@@ -307,6 +311,11 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                        mmc_hostname(card->host));
        }
+        card->ext_csd.raw_s_a_timeout = ext_csd[EXT_CSD_S_A_TIMEOUT];
+        card->ext_csd.raw_erase_timeout_mult =
+                ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT];
+        card->ext_csd.raw_hc_erase_grp_size =
+                ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE];
        if (card->ext_csd.rev >= 3) {
                u8 sa_shift = ext_csd[EXT_CSD_S_A_TIMEOUT];
                card->ext_csd.part_config = ext_csd[EXT_CSD_PART_CONFIG];
@@ -334,6 +343,16 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                card->ext_csd.boot_size = ext_csd[EXT_CSD_BOOT_MULT] << 17;
        }
+        card->ext_csd.raw_hc_erase_gap_size =
+                ext_csd[EXT_CSD_PARTITION_ATTRIBUTE];
+        card->ext_csd.raw_sec_trim_mult =
+                ext_csd[EXT_CSD_SEC_TRIM_MULT];
+        card->ext_csd.raw_sec_erase_mult =
+                ext_csd[EXT_CSD_SEC_ERASE_MULT];
+        card->ext_csd.raw_sec_feature_support =
+                ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT];
+        card->ext_csd.raw_trim_mult =
+                ext_csd[EXT_CSD_TRIM_MULT];
        if (card->ext_csd.rev >= 4) {
                /*
                 * Enhanced area feature support -- check whether the eMMC
@@ -341,7 +360,7 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
                 * area offset and size to user by adding sysfs interface.
                 */
                if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) &&
-                                (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
+                    (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
                        u8 hc_erase_grp_sz =
                                ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE];
                        u8 hc_wp_grp_sz =
@@ -401,17 +420,17 @@ static inline void mmc_free_ext_csd(u8 *ext_csd)
 }
-static int mmc_compare_ext_csds(struct mmc_card *card, u8 *ext_csd,
+static int mmc_compare_ext_csds(struct mmc_card *card, unsigned bus_width)
-                        unsigned bus_width)
 {
        u8 *bw_ext_csd;
        int err;
+        if (bus_width == MMC_BUS_WIDTH_1)
+                return 0;
        err = mmc_get_ext_csd(card, &bw_ext_csd);
-        if (err)
-                return err;
-        if ((ext_csd == NULL || bw_ext_csd == NULL)) {
+        if (err || bw_ext_csd == NULL) {
                if (bus_width != MMC_BUS_WIDTH_1)
                        err = -EINVAL;
                goto out;
@@ -421,35 +440,40 @@ static int mmc_compare_ext_csds(struct mmc_card *card, u8 *ext_csd,
                goto out;
        /* only compare read only fields */
-        err = (!(ext_csd[EXT_CSD_PARTITION_SUPPORT] ==
+        err = (!(card->ext_csd.raw_partition_support ==
                        bw_ext_csd[EXT_CSD_PARTITION_SUPPORT]) &&
-                (ext_csd[EXT_CSD_ERASED_MEM_CONT] ==
+                (card->ext_csd.raw_erased_mem_count ==
                        bw_ext_csd[EXT_CSD_ERASED_MEM_CONT]) &&
-                (ext_csd[EXT_CSD_REV] ==
+                (card->ext_csd.rev ==
                        bw_ext_csd[EXT_CSD_REV]) &&
-                (ext_csd[EXT_CSD_STRUCTURE] ==
+                (card->ext_csd.raw_ext_csd_structure ==
                        bw_ext_csd[EXT_CSD_STRUCTURE]) &&
-                (ext_csd[EXT_CSD_CARD_TYPE] ==
+                (card->ext_csd.raw_card_type ==
                        bw_ext_csd[EXT_CSD_CARD_TYPE]) &&
-                (ext_csd[EXT_CSD_S_A_TIMEOUT] ==
+                (card->ext_csd.raw_s_a_timeout ==
                        bw_ext_csd[EXT_CSD_S_A_TIMEOUT]) &&
-                (ext_csd[EXT_CSD_HC_WP_GRP_SIZE] ==
+                (card->ext_csd.raw_hc_erase_gap_size ==
                        bw_ext_csd[EXT_CSD_HC_WP_GRP_SIZE]) &&
-                (ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT] ==
+                (card->ext_csd.raw_erase_timeout_mult ==
                        bw_ext_csd[EXT_CSD_ERASE_TIMEOUT_MULT]) &&
-                (ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE] ==
+                (card->ext_csd.raw_hc_erase_grp_size ==
                        bw_ext_csd[EXT_CSD_HC_ERASE_GRP_SIZE]) &&
-                (ext_csd[EXT_CSD_SEC_TRIM_MULT] ==
+                (card->ext_csd.raw_sec_trim_mult ==
                        bw_ext_csd[EXT_CSD_SEC_TRIM_MULT]) &&
-                (ext_csd[EXT_CSD_SEC_ERASE_MULT] ==
+                (card->ext_csd.raw_sec_erase_mult ==
                        bw_ext_csd[EXT_CSD_SEC_ERASE_MULT]) &&
-                (ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT] ==
+                (card->ext_csd.raw_sec_feature_support ==
                        bw_ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT]) &&
-                (ext_csd[EXT_CSD_TRIM_MULT] ==
+                (card->ext_csd.raw_trim_mult ==
                        bw_ext_csd[EXT_CSD_TRIM_MULT]) &&
-                memcmp(&ext_csd[EXT_CSD_SEC_CNT],
+                (card->ext_csd.raw_sectors[0] ==
-                       &bw_ext_csd[EXT_CSD_SEC_CNT],
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 0]) &&
-                       4) != 0);
+                (card->ext_csd.raw_sectors[1] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 1]) &&
+                (card->ext_csd.raw_sectors[2] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 2]) &&
+                (card->ext_csd.raw_sectors[3] ==
+                        bw_ext_csd[EXT_CSD_SEC_CNT + 3]));
        if (err)
                err = -EINVAL;
@@ -770,7 +794,6 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
                                 */
                                if (!(host->caps & MMC_CAP_BUS_WIDTH_TEST))
                                        err = mmc_compare_ext_csds(card,
-                                                ext_csd,
                                                bus_width);
                                else
                                        err = mmc_bus_test(card, bus_width);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index eafe44a528ac..63c22b0bb5ad 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1428,9 +1428,9 @@ out:
        return features;
 }
-#define BOND_VLAN_FEATURES      (NETIF_F_ALL_TX_OFFLOADS | \
+#define BOND_VLAN_FEATURES      (NETIF_F_ALL_CSUM | NETIF_F_SG | \
-                                 NETIF_F_SOFT_FEATURES | \
+                                 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
-                                 NETIF_F_LRO)
+                                 NETIF_F_HIGHDMA | NETIF_F_LRO)
 static void bond_compute_features(struct bonding *bond)
 {
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 2dfcc8047847..dfa55f94ba7f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -2289,6 +2289,23 @@ static int gfar_set_mac_address(struct net_device *dev)
        return 0;
 }
+/* Check if rx parser should be activated */
+void gfar_check_rx_parser_mode(struct gfar_private *priv)
+{
+        struct gfar __iomem *regs;
+        u32 tempval;
+        regs = priv->gfargrp[0].regs;
+        tempval = gfar_read(&regs->rctrl);
+        /* If parse is no longer required, then disable parser */
+        if (tempval & RCTRL_REQ_PARSER)
+                tempval |= RCTRL_PRSDEP_INIT;
+        else
+                tempval &= ~RCTRL_PRSDEP_INIT;
+        gfar_write(&regs->rctrl, tempval);
+}
 /* Enables and disables VLAN insertion/extraction */
 static void gfar_vlan_rx_register(struct net_device *dev,
@@ -2325,12 +2342,9 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                /* Disable VLAN tag extraction */
                tempval = gfar_read(&regs->rctrl);
                tempval &= ~RCTRL_VLEX;
-                /* If parse is no longer required, then disable parser */
-                if (tempval & RCTRL_REQ_PARSER)
-                        tempval |= RCTRL_PRSDEP_INIT;
-                else
-                        tempval &= ~RCTRL_PRSDEP_INIT;
                gfar_write(&regs->rctrl, tempval);
+                gfar_check_rx_parser_mode(priv);
        }
        gfar_change_mtu(dev, dev->mtu);
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index ba36dc7a3435..440e69d8beff 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -274,7 +274,7 @@ extern const char gfar_driver_version[];
 #define RCTRL_PROM              0x00000008
 #define RCTRL_EMEN              0x00000002
 #define RCTRL_REQ_PARSER        (RCTRL_VLEX | RCTRL_IPCSEN | \
-                                 RCTRL_TUCSEN)
+                                 RCTRL_TUCSEN | RCTRL_FILREN)
 #define RCTRL_CHECKSUMMING      (RCTRL_IPCSEN | RCTRL_TUCSEN | \
                                RCTRL_PRSDEP_INIT)
 #define RCTRL_EXTHASH           (RCTRL_GHTX)
@@ -1156,6 +1156,7 @@ extern void gfar_configure_coalescing(struct gfar_private *priv,
                unsigned long tx_mask, unsigned long rx_mask);
 void gfar_init_sysfs(struct net_device *dev);
 int gfar_set_features(struct net_device *dev, u32 features);
+extern void gfar_check_rx_parser_mode(struct gfar_private *priv);
 extern const struct ethtool_ops gfar_ethtool_ops;
diff --git a/drivers/net/natsemi.c b/drivers/net/natsemi.c
index 8f8b65af9ed5..60f46bc2bf64 100644
--- a/drivers/net/natsemi.c
+++ b/drivers/net/natsemi.c
@@ -140,7 +140,7 @@ MODULE_LICENSE("GPL");
 module_param(mtu, int, 0);
 module_param(debug, int, 0);
 module_param(rx_copybreak, int, 0);
-module_param(dspcfg_workaround, int, 1);
+module_param(dspcfg_workaround, int, 0);
 module_param_array(options, int, NULL, 0);
 module_param_array(full_duplex, int, NULL, 0);
 MODULE_PARM_DESC(mtu, "DP8381x MTU (all boards)");
@@ -2028,8 +2028,8 @@ static void drain_rx(struct net_device *dev)
                np->rx_ring[i].cmd_status = 0;
                np->rx_ring[i].addr = cpu_to_le32(0xBADF00D0); /* An invalid address. */
                if (np->rx_skbuff[i]) {
-                        pci_unmap_single(np->pci_dev,
+                        pci_unmap_single(np->pci_dev, np->rx_dma[i],
-                                np->rx_dma[i], buflen,
+                                buflen + NATSEMI_PADDING,
                                PCI_DMA_FROMDEVICE);
                        dev_kfree_skb(np->rx_skbuff[i]);
                }
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index 718879b35b7d..bc9a4bb31980 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -348,8 +348,9 @@ static int pppoe_device_event(struct notifier_block *this,
        /* Only look at sockets that are using this specific device. */
        switch (event) {
+        case NETDEV_CHANGEADDR:
        case NETDEV_CHANGEMTU:
-                /* A change in mtu is a bad thing, requiring
+                /* A change in mtu or address is a bad thing, requiring
                 * LCP re-negotiation.
                 */
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 200a363c3bf5..0ffec4608441 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -677,9 +677,11 @@ static irqreturn_t r6040_interrupt(int irq, void *dev_id)
                if (status & RX_FIFO_FULL)
                        dev->stats.rx_fifo_errors++;
-                /* Mask off RX interrupt */
+                if (likely(napi_schedule_prep(&lp->napi))) {
-                misr &= ~RX_INTS;
+                        /* Mask off RX interrupt */
-                napi_schedule(&lp->napi);
+                        misr &= ~RX_INTS;
+                        __napi_schedule(&lp->napi);
+                }
        }
        /* TX interrupt request */
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 8ec1a9a0bb9a..2f110fb30daa 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -182,11 +182,11 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
 #ifdef SL_INCLUDE_CSLIP
        cbuff = xchg(&sl->cbuff, cbuff);
        slcomp = xchg(&sl->slcomp, slcomp);
+#endif
 #ifdef CONFIG_SLIP_MODE_SLIP6
        sl->xdata    = 0;
        sl->xbits    = 0;
 #endif
-#endif
        spin_unlock_bh(&sl->lock);
        err = 0;
diff --git a/drivers/net/tulip/dmfe.c b/drivers/net/tulip/dmfe.c
index 468512731966..9a21ca3873fc 100644
--- a/drivers/net/tulip/dmfe.c
+++ b/drivers/net/tulip/dmfe.c
@@ -879,7 +879,6 @@ static void dmfe_free_tx_pkt(struct DEVICE *dev, struct dmfe_board_info * db)
        txptr = db->tx_remove_ptr;
        while(db->tx_packet_cnt) {
                tdes0 = le32_to_cpu(txptr->tdes0);
-                pr_debug("tdes0=%x\n", tdes0);
                if (tdes0 & 0x80000000)
                        break;
@@ -889,7 +888,6 @@ static void dmfe_free_tx_pkt(struct DEVICE *dev, struct dmfe_board_info * db)
                /* Transmit statistic counter */
                if ( tdes0 != 0x7fffffff ) {
-                        pr_debug("tdes0=%x\n", tdes0);
                        dev->stats.collisions += (tdes0 >> 3) & 0xf;
                        dev->stats.tx_bytes += le32_to_cpu(txptr->tdes1) & 0x7ff;
                        if (tdes0 & TDES0_ERR_MASK) {
@@ -986,7 +984,6 @@ static void dmfe_rx_packet(struct DEVICE *dev, struct dmfe_board_info * db)
                        /* error summary bit check */
                        if (rdes0 & 0x8000) {
                                /* This is a error packet */
-                                pr_debug("rdes0: %x\n", rdes0);
                                dev->stats.rx_errors++;
                                if (rdes0 & 1)
                                        dev->stats.rx_fifo_errors++;
@@ -1638,7 +1635,6 @@ static u8 dmfe_sense_speed(struct dmfe_board_info * db)
                else                            /* DM9102/DM9102A */
                        phy_mode = phy_read(db->ioaddr,
                                    db->phy_addr, 17, db->chip_id) & 0xf000;
-                pr_debug("Phy_mode %x\n", phy_mode);
                switch (phy_mode) {
                case 0x1000: db->op_mode = DMFE_10MHF; break;
                case 0x2000: db->op_mode = DMFE_10MFD; break;
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 387ca43f26f4..304fe78ff60e 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2421,10 +2421,8 @@ static void hso_free_net_device(struct hso_device *hso_dev)
        remove_net_device(hso_net->parent);
-        if (hso_net->net) {
+        if (hso_net->net)
                unregister_netdev(hso_net->net);
-                free_netdev(hso_net->net);
-        }
        /* start freeing */
        for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
@@ -2436,6 +2434,9 @@ static void hso_free_net_device(struct hso_device *hso_dev)
        kfree(hso_net->mux_bulk_tx_buf);
        hso_net->mux_bulk_tx_buf = NULL;
+        if (hso_net->net)
+                free_netdev(hso_net->net);
        kfree(hso_dev);
 }
diff --git a/drivers/net/wireless/ath/ath5k/desc.c b/drivers/net/wireless/ath/ath5k/desc.c
index 62172d585723..f82383b3ed30 100644
--- a/drivers/net/wireless/ath/ath5k/desc.c
+++ b/drivers/net/wireless/ath/ath5k/desc.c
@@ -107,10 +107,13 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                case AR5K_PKT_TYPE_BEACON:
                case AR5K_PKT_TYPE_PROBE_RESP:
                        frame_type = AR5K_AR5210_TX_DESC_FRAME_TYPE_NO_DELAY;
+                        break;
                case AR5K_PKT_TYPE_PIFS:
                        frame_type = AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS;
+                        break;
                default:
                        frame_type = type;
+                        break;
                }
                tx_ctl->tx_control_0 |=
diff --git a/drivers/net/wireless/ath/ath5k/pci.c b/drivers/net/wireless/ath/ath5k/pci.c
index 296c316a8341..f2c0c236392f 100644
--- a/drivers/net/wireless/ath/ath5k/pci.c
+++ b/drivers/net/wireless/ath/ath5k/pci.c
@@ -297,7 +297,9 @@ ath5k_pci_remove(struct pci_dev *pdev)
 #ifdef CONFIG_PM_SLEEP
 static int ath5k_pci_suspend(struct device *dev)
 {
-        struct ath5k_softc *sc = pci_get_drvdata(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+        struct ath5k_softc *sc = hw->priv;
        ath5k_led_off(sc);
        return 0;
@@ -306,7 +308,8 @@ static int ath5k_pci_suspend(struct device *dev)
 static int ath5k_pci_resume(struct device *dev)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
-        struct ath5k_softc *sc = pci_get_drvdata(pdev);
+        struct ieee80211_hw *hw = pci_get_drvdata(pdev);
+        struct ath5k_softc *sc = hw->priv;
        /*
         * Suspend/Resume resets the PCI configuration space, so we have to
diff --git a/drivers/net/wireless/ath/ath5k/sysfs.c b/drivers/net/wireless/ath/ath5k/sysfs.c
index 929c68cdf8ab..a073cdce1f15 100644
--- a/drivers/net/wireless/ath/ath5k/sysfs.c
+++ b/drivers/net/wireless/ath/ath5k/sysfs.c
@@ -10,7 +10,8 @@ static ssize_t ath5k_attr_show_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        char *buf)                                      \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
 }                                                                       \
                                                                        \
@@ -18,7 +19,8 @@ static ssize_t ath5k_attr_store_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        const char *buf, size_t count)                  \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        int val;                                                        \
                                                                        \
        val = (int)simple_strtoul(buf, NULL, 10);                       \
@@ -33,7 +35,8 @@ static ssize_t ath5k_attr_show_##name(struct device *dev,		\
                        struct device_attribute *attr,                  \
                        char *buf)                                      \
 {                                                                       \
-        struct ath5k_softc *sc = dev_get_drvdata(dev);                  \
+        struct ieee80211_hw *hw = dev_get_drvdata(dev);                 \
+        struct ath5k_softc *sc = hw->priv;                              \
        return snprintf(buf, PAGE_SIZE, "%d\n", get);                   \
 }                                                                       \
 static DEVICE_ATTR(name, S_IRUGO, ath5k_attr_show_##name, NULL)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 3779b8977d47..33443bcaa8d9 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -671,7 +671,8 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         * TODO - this could be improved to be dependent on the rate.
         *      The hardware can keep up at lower rates, but not higher rates
         */
-        if (fi->keyix != ATH9K_TXKEYIX_INVALID)
+        if ((fi->keyix != ATH9K_TXKEYIX_INVALID) &&
+            !(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA))
                ndelim += ATH_AGGR_ENCRYPTDELIM;
        /*
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 2fb53d067512..333b69ef2ae2 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -112,6 +112,8 @@ static struct usb_device_id carl9170_usb_ids[] = {
        { USB_DEVICE(0x04bb, 0x093f) },
        /* NEC WL300NU-G */
        { USB_DEVICE(0x0409, 0x0249) },
+        /* NEC WL300NU-AG */
+        { USB_DEVICE(0x0409, 0x02b4) },
        /* AVM FRITZ!WLAN USB Stick N */
        { USB_DEVICE(0x057c, 0x8401) },
        /* AVM FRITZ!WLAN USB Stick N 2.4 */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 092e342c19df..942f7a3969a7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -298,6 +298,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
        {RTL_USB_DEVICE(0x06f8, 0xe033, rtl92cu_hal_cfg)}, /*Hercules - Edimax*/
        {RTL_USB_DEVICE(0x07b8, 0x8188, rtl92cu_hal_cfg)}, /*Abocom - Abocom*/
        {RTL_USB_DEVICE(0x07b8, 0x8189, rtl92cu_hal_cfg)}, /*Funai - Abocom*/
+        {RTL_USB_DEVICE(0x0846, 0x9041, rtl92cu_hal_cfg)}, /*NetGear WNA1000M*/
        {RTL_USB_DEVICE(0x0Df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
        {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
        /* HP - Lite-On ,8188CUS Slim Combo */
diff --git a/drivers/pcmcia/pxa2xx_vpac270.c b/drivers/pcmcia/pxa2xx_vpac270.c
index 712baab3c83d..e956f659089a 100644
--- a/drivers/pcmcia/pxa2xx_vpac270.c
+++ b/drivers/pcmcia/pxa2xx_vpac270.c
@@ -76,10 +76,10 @@ static int vpac270_pcmcia_hw_init(struct soc_pcmcia_socket *skt)
 static void vpac270_pcmcia_hw_shutdown(struct soc_pcmcia_socket *skt)
 {
        if (skt->nr == 0)
-                gpio_request_array(vpac270_pcmcia_gpios,
+                gpio_free_array(vpac270_pcmcia_gpios,
                                        ARRAY_SIZE(vpac270_pcmcia_gpios));
        else
-                gpio_request_array(vpac270_cf_gpios,
+                gpio_free_array(vpac270_cf_gpios,
                                        ARRAY_SIZE(vpac270_cf_gpios));
 }
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 005417bd429e..e1c4938b301b 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1156,9 +1156,9 @@ static acpi_status wmid3_set_device_status(u32 value, u16 device)
        struct wmid3_gds_input_param params = {
                .function_num = 0x1,
                .hotkey_number = 0x01,
-                .devices = ACER_WMID3_GDS_WIRELESS &
+                .devices = ACER_WMID3_GDS_WIRELESS |
-                                ACER_WMID3_GDS_THREEG &
+                                ACER_WMID3_GDS_THREEG |
-                                ACER_WMID3_GDS_WIMAX &
+                                ACER_WMID3_GDS_WIMAX |
                                ACER_WMID3_GDS_BLUETOOTH,
        };
        struct acpi_buffer input = {
@@ -1445,6 +1445,8 @@ static void acer_wmi_notify(u32 value, void *context)
        union acpi_object *obj;
        struct event_return_value return_value;
        acpi_status status;
+        u16 device_state;
+        const struct key_entry *key;
        status = wmi_get_event_data(value, &response);
        if (status != AE_OK) {
@@ -1472,23 +1474,32 @@ static void acer_wmi_notify(u32 value, void *context)
        switch (return_value.function) {
        case WMID_HOTKEY_EVENT:
-                if (return_value.device_state) {
+                device_state = return_value.device_state;
-                        u16 device_state = return_value.device_state;
+                pr_debug("device state: 0x%x\n", device_state);
-                        pr_debug("device state: 0x%x\n", device_state);
-                        if (has_cap(ACER_CAP_WIRELESS))
+                key = sparse_keymap_entry_from_scancode(acer_wmi_input_dev,
-                                rfkill_set_sw_state(wireless_rfkill,
+                                                        return_value.key_num);
-                                !(device_state & ACER_WMID3_GDS_WIRELESS));
+                if (!key) {
-                        if (has_cap(ACER_CAP_BLUETOOTH))
-                                rfkill_set_sw_state(bluetooth_rfkill,
-                                !(device_state & ACER_WMID3_GDS_BLUETOOTH));
-                        if (has_cap(ACER_CAP_THREEG))
-                                rfkill_set_sw_state(threeg_rfkill,
-                                !(device_state & ACER_WMID3_GDS_THREEG));
-                }
-                if (!sparse_keymap_report_event(acer_wmi_input_dev,
-                                return_value.key_num, 1, true))
                        pr_warn("Unknown key number - 0x%x\n",
                                return_value.key_num);
+                } else {
+                        switch (key->keycode) {
+                        case KEY_WLAN:
+                        case KEY_BLUETOOTH:
+                                if (has_cap(ACER_CAP_WIRELESS))
+                                        rfkill_set_sw_state(wireless_rfkill,
+                                                !(device_state & ACER_WMID3_GDS_WIRELESS));
+                                if (has_cap(ACER_CAP_THREEG))
+                                        rfkill_set_sw_state(threeg_rfkill,
+                                                !(device_state & ACER_WMID3_GDS_THREEG));
+                                if (has_cap(ACER_CAP_BLUETOOTH))
+                                        rfkill_set_sw_state(bluetooth_rfkill,
+                                                !(device_state & ACER_WMID3_GDS_BLUETOOTH));
+                                break;
+                        }
+                        sparse_keymap_report_entry(acer_wmi_input_dev, key,
+                                                   1, true);
+                }
                break;
        default:
                pr_warn("Unknown function number - %d - %d\n",
diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
index 00460cb9587b..3c7857c71a23 100644
--- a/drivers/platform/x86/asus-wmi.c
+++ b/drivers/platform/x86/asus-wmi.c
@@ -1025,6 +1025,7 @@ static int asus_wmi_backlight_init(struct asus_wmi *asus)
                return power;
        memset(&props, 0, sizeof(struct backlight_properties));
+        props.type = BACKLIGHT_PLATFORM;
        props.max_brightness = max;
        bd = backlight_device_register(asus->driver->name,
                                       &asus->platform_device->dev, asus,
diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
index 3f204fde1b02..8877b836d27c 100644
--- a/drivers/platform/x86/compal-laptop.c
+++ b/drivers/platform/x86/compal-laptop.c
@@ -1030,8 +1030,10 @@ static int __devinit compal_probe(struct platform_device *pdev)
        initialize_fan_control_data(data);
        err = sysfs_create_group(&pdev->dev.kobj, &compal_attribute_group);
-        if (err)
+        if (err) {
+                kfree(data);
                return err;
+        }
        data->hwmon_dev = hwmon_device_register(&pdev->dev);
        if (IS_ERR(data->hwmon_dev)) {
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index d3841de6a8cf..e39ab1d3ed87 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -292,12 +292,9 @@ static int dell_rfkill_set(void *data, bool blocked)
        dell_send_request(buffer, 17, 11);
        /* If the hardware switch controls this radio, and the hardware
-           switch is disabled, don't allow changing the software state.
+           switch is disabled, don't allow changing the software state */
-           If the hardware switch is reported as not supported, always
-           fire the SMI to toggle the killswitch. */
        if ((hwswitch_state & BIT(hwswitch_bit)) &&
-            !(buffer->output[1] & BIT(16)) &&
+            !(buffer->output[1] & BIT(16))) {
-            (buffer->output[1] & BIT(0))) {
                ret = -EINVAL;
                goto out;
        }
@@ -403,23 +400,6 @@ static const struct file_operations dell_debugfs_fops = {
 static void dell_update_rfkill(struct work_struct *ignored)
 {
-        int status;
-        get_buffer();
-        dell_send_request(buffer, 17, 11);
-        status = buffer->output[1];
-        release_buffer();
-        /* if hardware rfkill is not supported, set it explicitly */
-        if (!(status & BIT(0))) {
-                if (wifi_rfkill)
-                        dell_rfkill_set((void *)1, !((status & BIT(17)) >> 17));
-                if (bluetooth_rfkill)
-                        dell_rfkill_set((void *)2, !((status & BIT(18)) >> 18));
-                if (wwan_rfkill)
-                        dell_rfkill_set((void *)3, !((status & BIT(19)) >> 19));
-        }
        if (wifi_rfkill)
                dell_rfkill_query(wifi_rfkill, (void *)1);
        if (bluetooth_rfkill)
@@ -560,11 +540,11 @@ static int dell_get_intensity(struct backlight_device *bd)
        else
                dell_send_request(buffer, 0, 1);
+        ret = buffer->output[1];
 out:
        release_buffer();
-        if (ret)
+        return ret;
-                return ret;
-        return buffer->output[1];
 }
 static const struct backlight_ops dell_ops = {
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index f94017bcdd6e..e2faa3cbb792 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -207,6 +207,7 @@ static int hp_wmi_perform_query(int query, int write, void *buffer,
        };
        struct acpi_buffer input = { sizeof(struct bios_args), &args };
        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+        u32 rc;
        if (WARN_ON(insize > sizeof(args.data)))
                return -EINVAL;
@@ -224,13 +225,13 @@ static int hp_wmi_perform_query(int query, int write, void *buffer,
        }
        bios_return = (struct bios_return *)obj->buffer.pointer;
+        rc = bios_return->return_code;
-        if (bios_return->return_code) {
+        if (rc) {
-                if (bios_return->return_code != HPWMI_RET_UNKNOWN_CMDTYPE)
+                if (rc != HPWMI_RET_UNKNOWN_CMDTYPE)
-                        pr_warn("query 0x%x returned error 0x%x\n",
+                        pr_warn("query 0x%x returned error 0x%x\n", query, rc);
-                                query, bios_return->return_code);
                kfree(obj);
-                return bios_return->return_code;
+                return rc;
        }
        if (!outsize) {
diff --git a/drivers/platform/x86/intel_oaktrail.c b/drivers/platform/x86/intel_oaktrail.c
index e936364a609d..7f88c7923fc6 100644
--- a/drivers/platform/x86/intel_oaktrail.c
+++ b/drivers/platform/x86/intel_oaktrail.c
@@ -250,6 +250,7 @@ static int oaktrail_backlight_init(void)
        struct backlight_properties props;
        memset(&props, 0, sizeof(struct backlight_properties));
+        props.type = BACKLIGHT_PLATFORM;
        props.max_brightness = OT_EC_BL_BRIGHTNESS_MAX;
        bd = backlight_device_register(DRIVER_NAME,
                                       &oaktrail_device->dev, NULL,
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 77f6e707a2a9..26c5b117df22 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -184,6 +184,10 @@ enum tpacpi_hkey_event_t {
        /* Misc bay events */
        TP_HKEY_EV_OPTDRV_EJ            = 0x3006, /* opt. drive tray ejected */
+        TP_HKEY_EV_HOTPLUG_DOCK         = 0x4010, /* docked into hotplug dock
+                                                     or port replicator */
+        TP_HKEY_EV_HOTPLUG_UNDOCK       = 0x4011, /* undocked from hotplug
+                                                     dock or port replicator */
        /* User-interface events */
        TP_HKEY_EV_LID_CLOSE            = 0x5001, /* laptop lid closed */
@@ -194,6 +198,10 @@ enum tpacpi_hkey_event_t {
        TP_HKEY_EV_PEN_REMOVED          = 0x500c, /* tablet pen removed */
        TP_HKEY_EV_BRGHT_CHANGED        = 0x5010, /* backlight control event */
+        /* Key-related user-interface events */
+        TP_HKEY_EV_KEY_NUMLOCK          = 0x6000, /* NumLock key pressed */
+        TP_HKEY_EV_KEY_FN               = 0x6005, /* Fn key pressed? E420 */
        /* Thermal events */
        TP_HKEY_EV_ALARM_BAT_HOT        = 0x6011, /* battery too hot */
        TP_HKEY_EV_ALARM_BAT_XHOT       = 0x6012, /* battery critically hot */
@@ -201,6 +209,10 @@ enum tpacpi_hkey_event_t {
        TP_HKEY_EV_ALARM_SENSOR_XHOT    = 0x6022, /* sensor critically hot */
        TP_HKEY_EV_THM_TABLE_CHANGED    = 0x6030, /* thermal table changed */
+        TP_HKEY_EV_UNK_6040             = 0x6040, /* Related to AC change?
+                                                     some sort of APM hint,
+                                                     W520 */
        /* Misc */
        TP_HKEY_EV_RFKILL_CHANGED       = 0x7000, /* rfkill switch changed */
 };
@@ -3513,6 +3525,34 @@ static bool hotkey_notify_wakeup(const u32 hkey,
        return true;
 }
+static bool hotkey_notify_dockevent(const u32 hkey,
+                                 bool *send_acpi_ev,
+                                 bool *ignore_acpi_ev)
+{
+        /* 0x4000-0x4FFF: dock-related events */
+        *send_acpi_ev = true;
+        *ignore_acpi_ev = false;
+        switch (hkey) {
+        case TP_HKEY_EV_UNDOCK_ACK:
+                /* ACPI undock operation completed after wakeup */
+                hotkey_autosleep_ack = 1;
+                pr_info("undocked\n");
+                hotkey_wakeup_hotunplug_complete_notify_change();
+                return true;
+        case TP_HKEY_EV_HOTPLUG_DOCK: /* docked to port replicator */
+                pr_info("docked into hotplug port replicator\n");
+                return true;
+        case TP_HKEY_EV_HOTPLUG_UNDOCK: /* undocked from port replicator */
+                pr_info("undocked from hotplug port replicator\n");
+                return true;
+        default:
+                return false;
+        }
+}
 static bool hotkey_notify_usrevent(const u32 hkey,
                                 bool *send_acpi_ev,
                                 bool *ignore_acpi_ev)
@@ -3547,13 +3587,13 @@ static bool hotkey_notify_usrevent(const u32 hkey,
 static void thermal_dump_all_sensors(void);
-static bool hotkey_notify_thermal(const u32 hkey,
+static bool hotkey_notify_6xxx(const u32 hkey,
                                 bool *send_acpi_ev,
                                 bool *ignore_acpi_ev)
 {
        bool known = true;
-        /* 0x6000-0x6FFF: thermal alarms */
+        /* 0x6000-0x6FFF: thermal alarms/notices and keyboard events */
        *send_acpi_ev = true;
        *ignore_acpi_ev = false;
@@ -3582,8 +3622,17 @@ static bool hotkey_notify_thermal(const u32 hkey,
                         "a sensor reports something is extremely hot!\n");
                /* recommended action: immediate sleep/hibernate */
                break;
+        case TP_HKEY_EV_KEY_NUMLOCK:
+        case TP_HKEY_EV_KEY_FN:
+                /* key press events, we just ignore them as long as the EC
+                 * is still reporting them in the normal keyboard stream */
+                *send_acpi_ev = false;
+                *ignore_acpi_ev = true;
+                return true;
        default:
-                pr_alert("THERMAL ALERT: unknown thermal alarm received\n");
+                pr_warn("unknown possible thermal alarm or keyboard event received\n");
                known = false;
        }
@@ -3652,15 +3701,9 @@ static void hotkey_notify(struct ibm_struct *ibm, u32 event)
                        }
                        break;
                case 4:
-                        /* 0x4000-0x4FFF: dock-related wakeups */
+                        /* 0x4000-0x4FFF: dock-related events */
-                        if (hkey == TP_HKEY_EV_UNDOCK_ACK) {
+                        known_ev = hotkey_notify_dockevent(hkey, &send_acpi_ev,
-                                hotkey_autosleep_ack = 1;
+                                                &ignore_acpi_ev);
-                                pr_info("undocked\n");
-                                hotkey_wakeup_hotunplug_complete_notify_change();
-                                known_ev = true;
-                        } else {
-                                known_ev = false;
-                        }
                        break;
                case 5:
                        /* 0x5000-0x5FFF: human interface helpers */
@@ -3668,8 +3711,9 @@ static void hotkey_notify(struct ibm_struct *ibm, u32 event)
                                                 &ignore_acpi_ev);
                        break;
                case 6:
-                        /* 0x6000-0x6FFF: thermal alarms */
+                        /* 0x6000-0x6FFF: thermal alarms/notices and
-                        known_ev = hotkey_notify_thermal(hkey, &send_acpi_ev,
+                         *                keyboard events */
+                        known_ev = hotkey_notify_6xxx(hkey, &send_acpi_ev,
                                                 &ignore_acpi_ev);
                        break;
                case 7:
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 2a20dabec76d..d6620ad309ce 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -516,8 +516,17 @@ static void ssb_pcicore_pcie_setup_workarounds(struct ssb_pcicore *pc)
 static void ssb_pcicore_init_clientmode(struct ssb_pcicore *pc)
 {
+        ssb_pcicore_fix_sprom_core_index(pc);
        /* Disable PCI interrupts. */
        ssb_write32(pc->dev, SSB_INTVEC, 0);
+        /* Additional PCIe always once-executed workarounds */
+        if (pc->dev->id.coreid == SSB_DEV_PCIE) {
+                ssb_pcicore_serdes_workaround(pc);
+                /* TODO: ASPM */
+                /* TODO: Clock Request Update */
+        }
 }
 void ssb_pcicore_init(struct ssb_pcicore *pc)
@@ -529,8 +538,6 @@ void ssb_pcicore_init(struct ssb_pcicore *pc)
        if (!ssb_device_is_enabled(dev))
                ssb_device_enable(dev, 0);
-        ssb_pcicore_fix_sprom_core_index(pc);
 #ifdef CONFIG_SSB_PCICORE_HOSTMODE
        pc->hostmode = pcicore_is_in_hostmode(pc);
        if (pc->hostmode)
@@ -538,13 +545,6 @@ void ssb_pcicore_init(struct ssb_pcicore *pc)
 #endif /* CONFIG_SSB_PCICORE_HOSTMODE */
        if (!pc->hostmode)
                ssb_pcicore_init_clientmode(pc);
-        /* Additional PCIe always once-executed workarounds */
-        if (dev->id.coreid == SSB_DEV_PCIE) {
-                ssb_pcicore_serdes_workaround(pc);
-                /* TODO: ASPM */
-                /* TODO: Clock Request Update */
-        }
 }
 static u32 ssb_pcie_read(struct ssb_pcicore *pc, u32 address)
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 9536d386bb38..21d816e9dfa5 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -599,8 +599,7 @@ config IT87_WDT
 config HP_WATCHDOG
        tristate "HP ProLiant iLO2+ Hardware Watchdog Timer"
-        depends on X86
+        depends on X86 && PCI
-        default m
        help
          A software monitoring watchdog and NMI sourcing driver. This driver
          will detect lockups and provide a stack trace. This is a driver that
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 79743d146be6..0c1d91756528 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1438,12 +1438,15 @@ char *ceph_mdsc_build_path(struct dentry *dentry, int *plen, u64 *base,
        struct dentry *temp;
        char *path;
        int len, pos;
+        unsigned seq;
        if (dentry == NULL)
                return ERR_PTR(-EINVAL);
 retry:
        len = 0;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
        for (temp = dentry; !IS_ROOT(temp);) {
                struct inode *inode = temp->d_inode;
                if (inode && ceph_snap(inode) == CEPH_SNAPDIR)
@@ -1455,10 +1458,12 @@ retry:
                        len += 1 + temp->d_name.len;
                temp = temp->d_parent;
                if (temp == NULL) {
+                        rcu_read_unlock();
                        pr_err("build_path corrupt dentry %p\n", dentry);
                        return ERR_PTR(-EINVAL);
                }
        }
+        rcu_read_unlock();
        if (len)
                len--;  /* no leading '/' */
@@ -1467,9 +1472,12 @@ retry:
                return ERR_PTR(-ENOMEM);
        pos = len;
        path[pos] = 0;  /* trailing null */
+        rcu_read_lock();
        for (temp = dentry; !IS_ROOT(temp) && pos != 0; ) {
-                struct inode *inode = temp->d_inode;
+                struct inode *inode;
+                spin_lock(&temp->d_lock);
+                inode = temp->d_inode;
                if (inode && ceph_snap(inode) == CEPH_SNAPDIR) {
                        dout("build_path path+%d: %p SNAPDIR\n",
                             pos, temp);
@@ -1478,21 +1486,26 @@ retry:
                        break;
                } else {
                        pos -= temp->d_name.len;
-                        if (pos < 0)
+                        if (pos < 0) {
+                                spin_unlock(&temp->d_lock);
                                break;
+                        }
                        strncpy(path + pos, temp->d_name.name,
                                temp->d_name.len);
                }
+                spin_unlock(&temp->d_lock);
                if (pos)
                        path[--pos] = '/';
                temp = temp->d_parent;
                if (temp == NULL) {
+                        rcu_read_unlock();
                        pr_err("build_path corrupt dentry\n");
                        kfree(path);
                        return ERR_PTR(-EINVAL);
                }
        }
-        if (pos != 0) {
+        rcu_read_unlock();
+        if (pos != 0 || read_seqretry(&rename_lock, seq)) {
                pr_err("build_path did not end path lookup where "
                       "expected, namelen is %d, pos is %d\n", len, pos);
                /* presumably this is only possible if racing with a
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 35f9154615fa..bc4b12ca537b 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -35,6 +35,7 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/freezer.h>
+#include <linux/namei.h>
 #include <net/ipv6.h>
 #include "cifsfs.h"
 #include "cifspdu.h"
@@ -542,14 +543,12 @@ static const struct super_operations cifs_super_ops = {
 static struct dentry *
 cifs_get_root(struct smb_vol *vol, struct super_block *sb)
 {
-        int xid, rc;
+        struct dentry *dentry;
-        struct inode *inode;
-        struct qstr name;
-        struct dentry *dparent = NULL, *dchild = NULL, *alias;
        struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
-        unsigned int i, full_len, len;
+        char *full_path = NULL;
-        char *full_path = NULL, *pstart;
+        char *s, *p;
        char sep;
+        int xid;
        full_path = cifs_build_path_to_root(vol, cifs_sb,
                                            cifs_sb_master_tcon(cifs_sb));
@@ -560,73 +559,32 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
        xid = GetXid();
        sep = CIFS_DIR_SEP(cifs_sb);
-        dparent = dget(sb->s_root);
+        dentry = dget(sb->s_root);
-        full_len = strlen(full_path);
+        p = s = full_path;
-        full_path[full_len] = sep;
-        pstart = full_path + 1;
+        do {
+                struct inode *dir = dentry->d_inode;
-        for (i = 1, len = 0; i <= full_len; i++) {
+                struct dentry *child;
-                if (full_path[i] != sep || !len) {
-                        len++;
+                /* skip separators */
-                        continue;
+                while (*s == sep)
-                }
+                        s++;
+                if (!*s)
-                full_path[i] = 0;
+                        break;
-                cFYI(1, "get dentry for %s", pstart);
+                p = s++;
+                /* next separator */
-                name.name = pstart;
+                while (*s && *s != sep)
-                name.len = len;
+                        s++;
-                name.hash = full_name_hash(pstart, len);
-                dchild = d_lookup(dparent, &name);
+                mutex_lock(&dir->i_mutex);
-                if (dchild == NULL) {
+                child = lookup_one_len(p, dentry, s - p);
-                        cFYI(1, "not exists");
+                mutex_unlock(&dir->i_mutex);
-                        dchild = d_alloc(dparent, &name);
+                dput(dentry);
-                        if (dchild == NULL) {
+                dentry = child;
-                                dput(dparent);
+        } while (!IS_ERR(dentry));
-                                dparent = ERR_PTR(-ENOMEM);
-                                goto out;
-                        }
-                }
-                cFYI(1, "get inode");
-                if (dchild->d_inode == NULL) {
-                        cFYI(1, "not exists");
-                        inode = NULL;
-                        if (cifs_sb_master_tcon(CIFS_SB(sb))->unix_ext)
-                                rc = cifs_get_inode_info_unix(&inode, full_path,
-                                                              sb, xid);
-                        else
-                                rc = cifs_get_inode_info(&inode, full_path,
-                                                         NULL, sb, xid, NULL);
-                        if (rc) {
-                                dput(dchild);
-                                dput(dparent);
-                                dparent = ERR_PTR(rc);
-                                goto out;
-                        }
-                        alias = d_materialise_unique(dchild, inode);
-                        if (alias != NULL) {
-                                dput(dchild);
-                                if (IS_ERR(alias)) {
-                                        dput(dparent);
-                                        dparent = ERR_PTR(-EINVAL); /* XXX */
-                                        goto out;
-                                }
-                                dchild = alias;
-                        }
-                }
-                cFYI(1, "parent %p, child %p", dparent, dchild);
-                dput(dparent);
-                dparent = dchild;
-                len = 0;
-                pstart = full_path + i + 1;
-                full_path[i] = sep;
-        }
-out:
        _FreeXid(xid);
        kfree(full_path);
-        return dparent;
+        return dentry;
 }
 static int cifs_set_super(struct super_block *sb, void *data)
@@ -649,9 +607,9 @@ cifs_do_mount(struct file_system_type *fs_type,
        cFYI(1, "Devname: %s flags: %d ", dev_name, flags);
-        rc = cifs_setup_volume_info(&volume_info, (char *)data, dev_name);
+        volume_info = cifs_get_volume_info((char *)data, dev_name);
-        if (rc)
+        if (IS_ERR(volume_info))
-                return ERR_PTR(rc);
+                return ERR_CAST(volume_info);
        cifs_sb = kzalloc(sizeof(struct cifs_sb_info), GFP_KERNEL);
        if (cifs_sb == NULL) {
@@ -713,7 +671,7 @@ cifs_do_mount(struct file_system_type *fs_type,
 out_super:
        deactivate_locked_super(sb);
 out:
-        cifs_cleanup_volume_info(&volume_info);
+        cifs_cleanup_volume_info(volume_info);
        return root;
 out_mountdata:
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 0900e1658c96..036ca83e5f46 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -129,5 +129,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CIFS_NFSD_EXPORT */
-#define CIFS_VERSION   "1.73"
+#define CIFS_VERSION   "1.74"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 257f312ede42..8df28e925e5b 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -154,9 +154,9 @@ extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,
 extern void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
                               struct cifs_sb_info *cifs_sb);
 extern int cifs_match_super(struct super_block *, void *);
-extern void cifs_cleanup_volume_info(struct smb_vol **pvolume_info);
+extern void cifs_cleanup_volume_info(struct smb_vol *pvolume_info);
-extern int cifs_setup_volume_info(struct smb_vol **pvolume_info,
+extern struct smb_vol *cifs_get_volume_info(char *mount_data,
-                                  char *mount_data, const char *devname);
+                                            const char *devname);
 extern int cifs_mount(struct cifs_sb_info *, struct smb_vol *);
 extern void cifs_umount(struct cifs_sb_info *);
 extern void cifs_dfs_release_automount_timer(void);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index c8cb83ef6f6f..ccc1afa0bf3b 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -65,6 +65,8 @@ static int ip_connect(struct TCP_Server_Info *server);
 static int generic_ip_connect(struct TCP_Server_Info *server);
 static void tlink_rb_insert(struct rb_root *root, struct tcon_link *new_tlink);
 static void cifs_prune_tlinks(struct work_struct *work);
+static int cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                                        const char *devname);
 /*
 * cifs tcp session reconnection
@@ -2240,8 +2242,8 @@ cifs_match_super(struct super_block *sb, void *data)
        rc = compare_mount_options(sb, mnt_data);
 out:
-        cifs_put_tlink(tlink);
        spin_unlock(&cifs_tcp_ses_lock);
+        cifs_put_tlink(tlink);
        return rc;
 }
@@ -2830,15 +2832,9 @@ is_path_accessible(int xid, struct cifs_tcon *tcon,
        return rc;
 }
-void
+static void
-cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
+cleanup_volume_info_contents(struct smb_vol *volume_info)
 {
-        struct smb_vol *volume_info;
-        if (!pvolume_info || !*pvolume_info)
-                return;
-        volume_info = *pvolume_info;
        kfree(volume_info->username);
        kzfree(volume_info->password);
        kfree(volume_info->UNC);
@@ -2846,28 +2842,44 @@ cifs_cleanup_volume_info(struct smb_vol **pvolume_info)
        kfree(volume_info->domainname);
        kfree(volume_info->iocharset);
        kfree(volume_info->prepath);
+}
+void
+cifs_cleanup_volume_info(struct smb_vol *volume_info)
+{
+        if (!volume_info)
+                return;
+        cleanup_volume_info_contents(volume_info);
        kfree(volume_info);
-        *pvolume_info = NULL;
-        return;
 }
 #ifdef CONFIG_CIFS_DFS_UPCALL
 /* build_path_to_root returns full path to root when
 * we do not have an exiting connection (tcon) */
 static char *
-build_unc_path_to_root(const struct smb_vol *volume_info,
+build_unc_path_to_root(const struct smb_vol *vol,
                const struct cifs_sb_info *cifs_sb)
 {
-        char *full_path;
+        char *full_path, *pos;
+        unsigned int pplen = vol->prepath ? strlen(vol->prepath) : 0;
+        unsigned int unc_len = strnlen(vol->UNC, MAX_TREE_SIZE + 1);
-        int unc_len = strnlen(volume_info->UNC, MAX_TREE_SIZE + 1);
+        full_path = kmalloc(unc_len + pplen + 1, GFP_KERNEL);
-        full_path = kmalloc(unc_len + 1, GFP_KERNEL);
        if (full_path == NULL)
                return ERR_PTR(-ENOMEM);
-        strncpy(full_path, volume_info->UNC, unc_len);
+        strncpy(full_path, vol->UNC, unc_len);
-        full_path[unc_len] = 0; /* add trailing null */
+        pos = full_path + unc_len;
+        if (pplen) {
+                strncpy(pos, vol->prepath, pplen);
+                pos += pplen;
+        }
+        *pos = '\0'; /* add trailing null */
        convert_delimiter(full_path, CIFS_DIR_SEP(cifs_sb));
+        cFYI(1, "%s: full_path=%s", __func__, full_path);
        return full_path;
 }
@@ -2910,15 +2922,18 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
                                                   &fake_devname);
                free_dfs_info_array(referrals, num_referrals);
-                kfree(fake_devname);
-                if (cifs_sb->mountdata != NULL)
-                        kfree(cifs_sb->mountdata);
                if (IS_ERR(mdata)) {
                        rc = PTR_ERR(mdata);
                        mdata = NULL;
+                } else {
+                        cleanup_volume_info_contents(volume_info);
+                        memset(volume_info, '\0', sizeof(*volume_info));
+                        rc = cifs_setup_volume_info(volume_info, mdata,
+                                                        fake_devname);
                }
+                kfree(fake_devname);
+                kfree(cifs_sb->mountdata);
                cifs_sb->mountdata = mdata;
        }
        kfree(full_path);
@@ -2926,33 +2941,20 @@ expand_dfs_referral(int xid, struct cifs_ses *pSesInfo,
 }
 #endif
-int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
+static int
-                           const char *devname)
+cifs_setup_volume_info(struct smb_vol *volume_info, char *mount_data,
+                        const char *devname)
 {
-        struct smb_vol *volume_info;
        int rc = 0;
-        *pvolume_info = NULL;
+        if (cifs_parse_mount_options(mount_data, devname, volume_info))
+                return -EINVAL;
-        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
-        if (!volume_info) {
-                rc = -ENOMEM;
-                goto out;
-        }
-        if (cifs_parse_mount_options(mount_data, devname,
-                                     volume_info)) {
-                rc = -EINVAL;
-                goto out;
-        }
        if (volume_info->nullauth) {
                cFYI(1, "null user");
                volume_info->username = kzalloc(1, GFP_KERNEL);
-                if (volume_info->username == NULL) {
+                if (volume_info->username == NULL)
-                        rc = -ENOMEM;
+                        return -ENOMEM;
-                        goto out;
-                }
        } else if (volume_info->username) {
                /* BB fixme parse for domain name here */
                cFYI(1, "Username: %s", volume_info->username);
@@ -2960,8 +2962,7 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                cifserror("No username specified");
        /* In userspace mount helper we can get user name from alternate
           locations such as env variables and files on disk */
-                rc = -EINVAL;
+                return -EINVAL;
-                goto out;
        }
        /* this is needed for ASCII cp to Unicode converts */
@@ -2973,18 +2974,32 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
                if (volume_info->local_nls == NULL) {
                        cERROR(1, "CIFS mount error: iocharset %s not found",
                                 volume_info->iocharset);
-                        rc = -ELIBACC;
+                        return -ELIBACC;
-                        goto out;
                }
        }
-        *pvolume_info = volume_info;
-        return rc;
-out:
-        cifs_cleanup_volume_info(&volume_info);
        return rc;
 }
+struct smb_vol *
+cifs_get_volume_info(char *mount_data, const char *devname)
+{
+        int rc;
+        struct smb_vol *volume_info;
+        volume_info = kzalloc(sizeof(struct smb_vol), GFP_KERNEL);
+        if (!volume_info)
+                return ERR_PTR(-ENOMEM);
+        rc = cifs_setup_volume_info(volume_info, mount_data, devname);
+        if (rc) {
+                cifs_cleanup_volume_info(volume_info);
+                volume_info = ERR_PTR(rc);
+        }
+        return volume_info;
+}
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
@@ -2997,6 +3012,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
        struct tcon_link *tlink;
 #ifdef CONFIG_CIFS_DFS_UPCALL
        int referral_walks_count = 0;
+#endif
        rc = bdi_setup_and_register(&cifs_sb->bdi, "cifs", BDI_CAP_MAP_COPY);
        if (rc)
@@ -3004,6 +3020,7 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
        cifs_sb->bdi.ra_pages = default_backing_dev_info.ra_pages;
+#ifdef CONFIG_CIFS_DFS_UPCALL
 try_mount_again:
        /* cleanup activities if we're chasing a referral */
        if (referral_walks_count) {
@@ -3012,7 +3029,6 @@ try_mount_again:
                else if (pSesInfo)
                        cifs_put_smb_ses(pSesInfo);
-                cifs_cleanup_volume_info(&volume_info);
                FreeXid(xid);
        }
 #endif
@@ -3469,7 +3485,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
                goto out;
        }
-        snprintf(username, MAX_USERNAME_SIZE, "krb50x%x", fsuid);
+        snprintf(username, sizeof(username), "krb50x%x", fsuid);
        vol_info->username = username;
        vol_info->local_nls = cifs_sb->local_nls;
        vol_info->linux_uid = fsuid;
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 81914df47ef1..fa8c21d913bc 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -55,6 +55,7 @@ build_path_from_dentry(struct dentry *direntry)
        char dirsep;
        struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
        struct cifs_tcon *tcon = cifs_sb_master_tcon(cifs_sb);
+        unsigned seq;
        if (direntry == NULL)
                return NULL;  /* not much we can do if dentry is freed and
@@ -68,22 +69,29 @@ build_path_from_dentry(struct dentry *direntry)
                dfsplen = 0;
 cifs_bp_rename_retry:
        namelen = dfsplen;
+        seq = read_seqbegin(&rename_lock);
+        rcu_read_lock();
        for (temp = direntry; !IS_ROOT(temp);) {
                namelen += (1 + temp->d_name.len);
                temp = temp->d_parent;
                if (temp == NULL) {
                        cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                        return NULL;
                }
        }
+        rcu_read_unlock();
        full_path = kmalloc(namelen+1, GFP_KERNEL);
        if (full_path == NULL)
                return full_path;
        full_path[namelen] = 0; /* trailing null */
+        rcu_read_lock();
        for (temp = direntry; !IS_ROOT(temp);) {
+                spin_lock(&temp->d_lock);
                namelen -= 1 + temp->d_name.len;
                if (namelen < 0) {
+                        spin_unlock(&temp->d_lock);
                        break;
                } else {
                        full_path[namelen] = dirsep;
@@ -91,14 +99,17 @@ cifs_bp_rename_retry:
                                temp->d_name.len);
                        cFYI(0, "name: %s", full_path + namelen);
                }
+                spin_unlock(&temp->d_lock);
                temp = temp->d_parent;
                if (temp == NULL) {
                        cERROR(1, "corrupt dentry");
+                        rcu_read_unlock();
                        kfree(full_path);
                        return NULL;
                }
        }
-        if (namelen != dfsplen) {
+        rcu_read_unlock();
+        if (namelen != dfsplen || read_seqretry(&rename_lock, seq)) {
                cERROR(1, "did not end path lookup where expected namelen is %d",
                        namelen);
                /* presumably this is only possible if racing with a rename
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 3892ab817a36..d3e619692ee0 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -428,8 +428,7 @@ static void build_ntlmssp_negotiate_blob(unsigned char *pbuffer,
                        (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                flags |= NTLMSSP_NEGOTIATE_SIGN;
                if (!ses->server->session_estab)
-                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH |
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
-                                NTLMSSP_NEGOTIATE_EXTENDED_SEC;
        }
        sec_blob->NegotiateFlags = cpu_to_le32(flags);
@@ -465,10 +464,11 @@ static int build_ntlmssp_auth_blob(unsigned char *pbuffer,
                NTLMSSP_NEGOTIATE_128 | NTLMSSP_NEGOTIATE_UNICODE |
                NTLMSSP_NEGOTIATE_NTLM | NTLMSSP_NEGOTIATE_EXTENDED_SEC;
        if (ses->server->sec_mode &
-           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED))
+           (SECMODE_SIGN_REQUIRED | SECMODE_SIGN_ENABLED)) {
                flags |= NTLMSSP_NEGOTIATE_SIGN;
-        if (ses->server->sec_mode & SECMODE_SIGN_REQUIRED)
+                if (!ses->server->session_estab)
-                flags |= NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+                        flags |= NTLMSSP_NEGOTIATE_KEY_XCH;
+        }
        tmp = pbuffer + sizeof(AUTHENTICATE_MESSAGE);
        sec_blob->NegotiateFlags = cpu_to_le32(flags);
diff --git a/fs/cramfs/inode.c b/fs/cramfs/inode.c
index e141939080f0..739fb59bcdc2 100644
--- a/fs/cramfs/inode.c
+++ b/fs/cramfs/inode.c
@@ -37,7 +37,7 @@ static DEFINE_MUTEX(read_mutex);
 /* These macros may change in future, to provide better st_ino semantics. */
 #define OFFSET(x)       ((x)->i_ino)
-static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
+static unsigned long cramino(const struct cramfs_inode *cino, unsigned int offset)
 {
        if (!cino->offset)
                return offset + 1;
@@ -61,7 +61,7 @@ static unsigned long cramino(struct cramfs_inode *cino, unsigned int offset)
 }
 static struct inode *get_cramfs_inode(struct super_block *sb,
-        struct cramfs_inode *cramfs_inode, unsigned int offset)
+        const struct cramfs_inode *cramfs_inode, unsigned int offset)
 {
        struct inode *inode;
        static struct timespec zerotime;
@@ -317,7 +317,7 @@ static int cramfs_fill_super(struct super_block *sb, void *data, int silent)
        /* Set it all up.. */
        sb->s_op = &cramfs_ops;
        root = get_cramfs_inode(sb, &super.root, 0);
-        if (!root)
+        if (IS_ERR(root))
                goto out;
        sb->s_root = d_alloc_root(root);
        if (!sb->s_root) {
@@ -423,6 +423,7 @@ static int cramfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
 static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, struct nameidata *nd)
 {
        unsigned int offset = 0;
+        struct inode *inode = NULL;
        int sorted;
        mutex_lock(&read_mutex);
@@ -449,8 +450,8 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
                for (;;) {
                        if (!namelen) {
-                                mutex_unlock(&read_mutex);
+                                inode = ERR_PTR(-EIO);
-                                return ERR_PTR(-EIO);
+                                goto out;
                        }
                        if (name[namelen-1])
                                break;
@@ -462,17 +463,18 @@ static struct dentry * cramfs_lookup(struct inode *dir, struct dentry *dentry, s
                if (retval > 0)
                        continue;
                if (!retval) {
-                        struct cramfs_inode entry = *de;
+                        inode = get_cramfs_inode(dir->i_sb, de, dir_off);
-                        mutex_unlock(&read_mutex);
+                        break;
-                        d_add(dentry, get_cramfs_inode(dir->i_sb, &entry, dir_off));
-                        return NULL;
                }
                /* else (retval < 0) */
                if (sorted)
                        break;
        }
+out:
        mutex_unlock(&read_mutex);
-        d_add(dentry, NULL);
+        if (IS_ERR(inode))
+                return ERR_CAST(inode);
+        d_add(dentry, inode);
        return NULL;
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 37f72ee5bf7c..6e4ea6d87774 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2213,14 +2213,15 @@ static void dentry_unlock_parents_for_move(struct dentry *dentry,
 * The hash value has to match the hash queue that the dentry is on..
 */
 /*
- * d_move - move a dentry
+ * __d_move - move a dentry
 * @dentry: entry to move
 * @target: new dentry
 *
 * Update the dcache to reflect the move of a file name. Negative
- * dcache entries should not be moved in this way.
+ * dcache entries should not be moved in this way.  Caller hold
+ * rename_lock.
 */
-void d_move(struct dentry * dentry, struct dentry * target)
+static void __d_move(struct dentry * dentry, struct dentry * target)
 {
        if (!dentry->d_inode)
                printk(KERN_WARNING "VFS: moving negative dcache entry\n");
@@ -2228,8 +2229,6 @@ void d_move(struct dentry * dentry, struct dentry * target)
        BUG_ON(d_ancestor(dentry, target));
        BUG_ON(d_ancestor(target, dentry));
-        write_seqlock(&rename_lock);
        dentry_lock_for_move(dentry, target);
        write_seqcount_begin(&dentry->d_seq);
@@ -2275,6 +2274,20 @@ void d_move(struct dentry * dentry, struct dentry * target)
        spin_unlock(&target->d_lock);
        fsnotify_d_move(dentry);
        spin_unlock(&dentry->d_lock);
+}
+/*
+ * d_move - move a dentry
+ * @dentry: entry to move
+ * @target: new dentry
+ *
+ * Update the dcache to reflect the move of a file name. Negative
+ * dcache entries should not be moved in this way.
+ */
+void d_move(struct dentry *dentry, struct dentry *target)
+{
+        write_seqlock(&rename_lock);
+        __d_move(dentry, target);
        write_sequnlock(&rename_lock);
 }
 EXPORT_SYMBOL(d_move);
@@ -2302,7 +2315,7 @@ struct dentry *d_ancestor(struct dentry *p1, struct dentry *p2)
 * This helper attempts to cope with remotely renamed directories
 *
 * It assumes that the caller is already holding
- * dentry->d_parent->d_inode->i_mutex and the inode->i_lock
+ * dentry->d_parent->d_inode->i_mutex, inode->i_lock and rename_lock
 *
 * Note: If ever the locking in lock_rename() changes, then please
 * remember to update this too...
@@ -2317,11 +2330,6 @@ static struct dentry *__d_unalias(struct inode *inode,
        if (alias->d_parent == dentry->d_parent)
                goto out_unalias;
-        /* Check for loops */
-        ret = ERR_PTR(-ELOOP);
-        if (d_ancestor(alias, dentry))
-                goto out_err;
        /* See lock_rename() */
        ret = ERR_PTR(-EBUSY);
        if (!mutex_trylock(&dentry->d_sb->s_vfs_rename_mutex))
@@ -2331,7 +2339,7 @@ static struct dentry *__d_unalias(struct inode *inode,
                goto out_err;
        m2 = &alias->d_parent->d_inode->i_mutex;
 out_unalias:
-        d_move(alias, dentry);
+        __d_move(alias, dentry);
        ret = alias;
 out_err:
        spin_unlock(&inode->i_lock);
@@ -2416,15 +2424,24 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                alias = __d_find_alias(inode, 0);
                if (alias) {
                        actual = alias;
-                        /* Is this an anonymous mountpoint that we could splice
+                        write_seqlock(&rename_lock);
-                         * into our tree? */
-                        if (IS_ROOT(alias)) {
+                        if (d_ancestor(alias, dentry)) {
+                                /* Check for loops */
+                                actual = ERR_PTR(-ELOOP);
+                        } else if (IS_ROOT(alias)) {
+                                /* Is this an anonymous mountpoint that we
+                                 * could splice into our tree? */
                                __d_materialise_dentry(dentry, alias);
+                                write_sequnlock(&rename_lock);
                                __d_drop(alias);
                                goto found;
+                        } else {
+                                /* Nope, but we must(!) avoid directory
+                                 * aliasing */
+                                actual = __d_unalias(inode, dentry, alias);
                        }
-                        /* Nope, but we must(!) avoid directory aliasing */
+                        write_sequnlock(&rename_lock);
-                        actual = __d_unalias(inode, dentry, alias);
                        if (IS_ERR(actual))
                                dput(alias);
                        goto out_nolock;
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 06065bd37fc3..c57beddcc217 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -913,7 +913,7 @@ struct dentry *exofs_get_parent(struct dentry *child)
        unsigned long ino = exofs_parent_ino(child);
        if (!ino)
-                return NULL;
+                return ERR_PTR(-ESTALE);
        return d_obtain_alias(exofs_iget(child->d_inode->i_sb, ino));
 }
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index 802ac5eeba28..f9fbbe96c222 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -1069,6 +1069,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                return 0;
        gfs2_log_lock(sdp);
+        spin_lock(&sdp->sd_ail_lock);
        head = bh = page_buffers(page);
        do {
                if (atomic_read(&bh->b_count))
@@ -1080,6 +1081,7 @@ int gfs2_releasepage(struct page *page, gfp_t gfp_mask)
                        goto not_possible;
                bh = bh->b_this_page;
        } while(bh != head);
+        spin_unlock(&sdp->sd_ail_lock);
        gfs2_log_unlock(sdp);
        head = bh = page_buffers(page);
@@ -1112,6 +1114,7 @@ not_possible: /* Should never happen */
        WARN_ON(buffer_dirty(bh));
        WARN_ON(buffer_pinned(bh));
 cannot_release:
+        spin_unlock(&sdp->sd_ail_lock);
        gfs2_log_unlock(sdp);
        return 0;
 }
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index 8ef70f464731..2cca29316bd6 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -47,10 +47,10 @@ static void __gfs2_ail_flush(struct gfs2_glock *gl)
                                bd_ail_gl_list);
                bh = bd->bd_bh;
                gfs2_remove_from_ail(bd);
-                spin_unlock(&sdp->sd_ail_lock);
                bd->bd_bh = NULL;
                bh->b_private = NULL;
+                spin_unlock(&sdp->sd_ail_lock);
                bd->bd_blkno = bh->b_blocknr;
                gfs2_log_lock(sdp);
                gfs2_assert_withdraw(sdp, !buffer_busy(bh));
@@ -221,8 +221,10 @@ static void inode_go_inval(struct gfs2_glock *gl, int flags)
                }
        }
-        if (ip == GFS2_I(gl->gl_sbd->sd_rindex))
+        if (ip == GFS2_I(gl->gl_sbd->sd_rindex)) {
+                gfs2_log_flush(gl->gl_sbd, NULL);
                gl->gl_sbd->sd_rindex_uptodate = 0;
+        }
        if (ip && S_ISREG(ip->i_inode.i_mode))
                truncate_inode_pages(ip->i_inode.i_mapping, 0);
 }
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 0a064e91ac70..81206e70cbf6 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -17,6 +17,7 @@
 #include <linux/buffer_head.h>
 #include <linux/rcupdate.h>
 #include <linux/rculist_bl.h>
+#include <linux/completion.h>
 #define DIO_WAIT        0x00000010
 #define DIO_METADATA    0x00000020
@@ -546,6 +547,7 @@ struct gfs2_sbd {
        struct gfs2_glock *sd_trans_gl;
        wait_queue_head_t sd_glock_wait;
        atomic_t sd_glock_disposal;
+        struct completion sd_locking_init;
        /* Inode Stuff */
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 903115f2bb34..85c62923ee29 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -903,6 +903,7 @@ void gfs2_meta_syncfs(struct gfs2_sbd *sdp)
                if (gfs2_ail1_empty(sdp))
                        break;
        }
+        gfs2_log_flush(sdp, NULL);
 }
 static inline int gfs2_jrnl_flush_reqd(struct gfs2_sbd *sdp)
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 8ac9ae189b53..2a77071fb7b6 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -72,6 +72,7 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
        init_waitqueue_head(&sdp->sd_glock_wait);
        atomic_set(&sdp->sd_glock_disposal, 0);
+        init_completion(&sdp->sd_locking_init);
        spin_lock_init(&sdp->sd_statfs_spin);
        spin_lock_init(&sdp->sd_rindex_spin);
@@ -1017,11 +1018,13 @@ hostdata_error:
                fsname++;
        if (lm->lm_mount == NULL) {
                fs_info(sdp, "Now mounting FS...\n");
+                complete(&sdp->sd_locking_init);
                return 0;
        }
        ret = lm->lm_mount(sdp, fsname);
        if (ret == 0)
                fs_info(sdp, "Joined cluster. Now mounting FS...\n");
+        complete(&sdp->sd_locking_init);
        return ret;
 }
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index ed540e7018be..fb0edf735483 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -757,13 +757,17 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
        struct timespec atime;
        struct gfs2_dinode *di;
        int ret = -EAGAIN;
+        int unlock_required = 0;
        /* Skip timestamp update, if this is from a memalloc */
        if (current->flags & PF_MEMALLOC)
                goto do_flush;
-        ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
+        if (!gfs2_glock_is_locked_by_me(ip->i_gl)) {
-        if (ret)
+                ret = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
-                goto do_flush;
+                if (ret)
+                        goto do_flush;
+                unlock_required = 1;
+        }
        ret = gfs2_trans_begin(sdp, RES_DINODE, 0);
        if (ret)
                goto do_unlock;
@@ -780,7 +784,8 @@ static int gfs2_write_inode(struct inode *inode, struct writeback_control *wbc)
        }
        gfs2_trans_end(sdp);
 do_unlock:
-        gfs2_glock_dq_uninit(&gh);
+        if (unlock_required)
+                gfs2_glock_dq_uninit(&gh);
 do_flush:
        if (wbc->sync_mode == WB_SYNC_ALL)
                gfs2_log_flush(GFS2_SB(inode), ip->i_gl);
@@ -1427,7 +1432,20 @@ out:
        return error;
 }
-/*
+/**
+ * gfs2_evict_inode - Remove an inode from cache
+ * @inode: The inode to evict
+ *
+ * There are three cases to consider:
+ * 1. i_nlink == 0, we are final opener (and must deallocate)
+ * 2. i_nlink == 0, we are not the final opener (and cannot deallocate)
+ * 3. i_nlink > 0
+ *
+ * If the fs is read only, then we have to treat all cases as per #3
+ * since we are unable to do any deallocation. The inode will be
+ * deallocated by the next read/write node to attempt an allocation
+ * in the same resource group
+ *
 * We have to (at the moment) hold the inodes main lock to cover
 * the gap between unlocking the shared lock on the iopen lock and
 * taking the exclusive lock. I'd rather do a shared -> exclusive
@@ -1470,6 +1488,8 @@ static void gfs2_evict_inode(struct inode *inode)
        if (error)
                goto out_truncate;
+        /* Case 1 starts here */
        if (S_ISDIR(inode->i_mode) &&
            (ip->i_diskflags & GFS2_DIF_EXHASH)) {
                error = gfs2_dir_exhash_dealloc(ip);
@@ -1493,13 +1513,16 @@ static void gfs2_evict_inode(struct inode *inode)
        goto out_unlock;
 out_truncate:
+        /* Case 2 starts here */
        error = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
        if (error)
                goto out_unlock;
-        gfs2_final_release_pages(ip);
+        /* Needs to be done before glock release & also in a transaction */
+        truncate_inode_pages(&inode->i_data, 0);
        gfs2_trans_end(sdp);
 out_unlock:
+        /* Error path for case 1 */
        if (test_bit(HIF_HOLDER, &ip->i_iopen_gh.gh_iflags))
                gfs2_glock_dq(&ip->i_iopen_gh);
        gfs2_holder_uninit(&ip->i_iopen_gh);
@@ -1507,6 +1530,7 @@ out_unlock:
        if (error && error != GLR_TRYFAILED && error != -EROFS)
                fs_warn(sdp, "gfs2_evict_inode: %d\n", error);
 out:
+        /* Case 3 starts here */
        truncate_inode_pages(&inode->i_data, 0);
        end_writeback(inode);
diff --git a/fs/gfs2/sys.c b/fs/gfs2/sys.c
index e20eab37bc80..443cabcfcd23 100644
--- a/fs/gfs2/sys.c
+++ b/fs/gfs2/sys.c
@@ -338,6 +338,9 @@ static ssize_t lkfirst_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
        rv = sscanf(buf, "%u", &first);
        if (rv != 1 || first > 1)
                return -EINVAL;
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
        spin_lock(&sdp->sd_jindex_spin);
        rv = -EBUSY;
        if (test_bit(SDF_NOJOURNALID, &sdp->sd_flags) == 0)
@@ -414,7 +417,9 @@ static ssize_t jid_store(struct gfs2_sbd *sdp, const char *buf, size_t len)
        rv = sscanf(buf, "%d", &jid);
        if (rv != 1)
                return -EINVAL;
+        rv = wait_for_completion_killable(&sdp->sd_locking_init);
+        if (rv)
+                return rv;
        spin_lock(&sdp->sd_jindex_spin);
        rv = -EINVAL;
        if (sdp->sd_lockstruct.ls_ops->lm_mount == NULL)
diff --git a/fs/hppfs/hppfs.c b/fs/hppfs/hppfs.c
index 87ed48e0343d..85c098a499f3 100644
--- a/fs/hppfs/hppfs.c
+++ b/fs/hppfs/hppfs.c
@@ -139,7 +139,8 @@ static int file_removed(struct dentry *dentry, const char *file)
 static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
                                   struct nameidata *nd)
 {
-        struct dentry *proc_dentry, *new, *parent;
+        struct dentry *proc_dentry, *parent;
+        struct qstr *name = &dentry->d_name;
        struct inode *inode;
        int err, deleted;
@@ -149,23 +150,9 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
        else if (deleted)
                return ERR_PTR(-ENOENT);
-        err = -ENOMEM;
        parent = HPPFS_I(ino)->proc_dentry;
        mutex_lock(&parent->d_inode->i_mutex);
-        proc_dentry = d_lookup(parent, &dentry->d_name);
+        proc_dentry = lookup_one_len(name->name, parent, name->len);
-        if (proc_dentry == NULL) {
-                proc_dentry = d_alloc(parent, &dentry->d_name);
-                if (proc_dentry == NULL) {
-                        mutex_unlock(&parent->d_inode->i_mutex);
-                        goto out;
-                }
-                new = (*parent->d_inode->i_op->lookup)(parent->d_inode,
-                                                       proc_dentry, NULL);
-                if (new) {
-                        dput(proc_dentry);
-                        proc_dentry = new;
-                }
-        }
        mutex_unlock(&parent->d_inode->i_mutex);
        if (IS_ERR(proc_dentry))
@@ -174,13 +161,11 @@ static struct dentry *hppfs_lookup(struct inode *ino, struct dentry *dentry,
        err = -ENOMEM;
        inode = get_inode(ino->i_sb, proc_dentry);
        if (!inode)
-                goto out_dput;
+                goto out;
        d_add(dentry, inode);
        return NULL;
- out_dput:
-        dput(proc_dentry);
 out:
        return ERR_PTR(err);
 }
@@ -690,8 +675,10 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
        struct inode *proc_ino = dentry->d_inode;
        struct inode *inode = new_inode(sb);
-        if (!inode)
+        if (!inode) {
+                dput(dentry);
                return ERR_PTR(-ENOMEM);
+        }
        if (S_ISDIR(dentry->d_inode->i_mode)) {
                inode->i_op = &hppfs_dir_iops;
@@ -704,7 +691,7 @@ static struct inode *get_inode(struct super_block *sb, struct dentry *dentry)
                inode->i_fop = &hppfs_file_fops;
        }
-        HPPFS_I(inode)->proc_dentry = dget(dentry);
+        HPPFS_I(inode)->proc_dentry = dentry;
        inode->i_uid = proc_ino->i_uid;
        inode->i_gid = proc_ino->i_gid;
@@ -737,7 +724,7 @@ static int hppfs_fill_super(struct super_block *sb, void *d, int silent)
        sb->s_fs_info = proc_mnt;
        err = -ENOMEM;
-        root_inode = get_inode(sb, proc_mnt->mnt_sb->s_root);
+        root_inode = get_inode(sb, dget(proc_mnt->mnt_sb->s_root));
        if (!root_inode)
                goto out_mntput;
diff --git a/fs/libfs.c b/fs/libfs.c
index c88eab55aec9..275ca4749a2e 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -822,7 +822,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
                goto out;
        attr->set_buf[size] = '\0';
-        val = simple_strtol(attr->set_buf, NULL, 0);
+        val = simple_strtoll(attr->set_buf, NULL, 0);
        ret = attr->set(attr->data, val);
        if (ret == 0)
                ret = len; /* on success, claim we got the whole input */
diff --git a/fs/namei.c b/fs/namei.c
index 0223c41fb114..14ab8d3f2f0c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -433,6 +433,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                        goto err_parent;
                BUG_ON(nd->inode != parent->d_inode);
        } else {
+                if (dentry->d_parent != parent)
+                        goto err_parent;
                spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
                if (!__d_rcu_to_refcount(dentry, nd->seq))
                        goto err_child;
@@ -940,7 +942,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 * Don't forget we might have a non-mountpoint managed dentry
                 * that wants to block transit.
                 */
-                *inode = path->dentry->d_inode;
                if (unlikely(managed_dentry_might_block(path->dentry)))
                        return false;
@@ -953,6 +954,12 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                path->mnt = mounted;
                path->dentry = mounted->mnt_root;
                nd->seq = read_seqcount_begin(&path->dentry->d_seq);
+                /*
+                 * Update the inode too. We don't need to re-check the
+                 * dentry sequence number here after this d_inode read,
+                 * because a mount-point is always pinned.
+                 */
+                *inode = path->dentry->d_inode;
        }
        return true;
 }
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 0bafcc91c27f..f9d03abcd04c 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -398,7 +398,6 @@ filelayout_write_pagelist(struct nfs_write_data *data, int sync)
         * this offset and save the original offset.
         */
        data->args.offset = filelayout_get_dserver_offset(lseg, offset);
-        data->mds_offset = offset;
        /* Perform an asynchronous write */
        status = nfs_initiate_write(data, ds->ds_clp->cl_rpcclient,
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 6870bc61ceec..e6e8f3b9a1de 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -91,7 +91,7 @@ static int nfs4_stat_to_errno(int);
 #define encode_getfh_maxsz      (op_encode_hdr_maxsz)
 #define decode_getfh_maxsz      (op_decode_hdr_maxsz + 1 + \
                                ((3+NFS4_FHSIZE) >> 2))
-#define nfs4_fattr_bitmap_maxsz 3
+#define nfs4_fattr_bitmap_maxsz 4
 #define encode_getattr_maxsz    (op_encode_hdr_maxsz + nfs4_fattr_bitmap_maxsz)
 #define nfs4_name_maxsz         (1 + ((3 + NFS4_MAXNAMLEN) >> 2))
 #define nfs4_path_maxsz         (1 + ((3 + NFS4_MAXPATHLEN) >> 2))
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e268e3b23497..727168059684 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -864,6 +864,8 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
        data->args.fh     = NFS_FH(inode);
        data->args.offset = req_offset(req) + offset;
+        /* pnfs_set_layoutcommit needs this */
+        data->mds_offset = data->args.offset;
        data->args.pgbase = req->wb_pgbase + offset;
        data->args.pages  = data->pagevec;
        data->args.count  = count;
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 29309e25417f..b57aab9a1184 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -56,16 +56,12 @@ static struct dentry *ufs_lookup(struct inode * dir, struct dentry *dentry, stru
        lock_ufs(dir->i_sb);
        ino = ufs_inode_by_name(dir, &dentry->d_name);
-        if (ino) {
+        if (ino)
                inode = ufs_iget(dir->i_sb, ino);
-                if (IS_ERR(inode)) {
-                        unlock_ufs(dir->i_sb);
-                        return ERR_CAST(inode);
-                }
-        }
        unlock_ufs(dir->i_sb);
-        d_add(dentry, inode);
+        if (IS_ERR(inode))
-        return NULL;
+                return ERR_CAST(inode);
+        return d_splice_alias(inode, dentry);
 }
 /*
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index 3a10ef5914eb..6cd5b6403a7b 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -210,7 +210,7 @@ struct acpi_device_power_state {
 struct acpi_device_power {
        int state;              /* Current state */
        struct acpi_device_power_flags flags;
-        struct acpi_device_power_state states[4];       /* Power states (D0-D3) */
+        struct acpi_device_power_state states[ACPI_D_STATE_COUNT];      /* Power states (D0-D3Cold) */
 };
 /* Performance Management */
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index a756bc8d866d..4543b6f75867 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -98,8 +98,11 @@ acpi_os_table_override(struct acpi_table_header *existing_table,
 /*
 * Spinlock primitives
 */
+#ifndef acpi_os_create_lock
 acpi_status
 acpi_os_create_lock(acpi_spinlock *out_handle);
+#endif
 void acpi_os_delete_lock(acpi_spinlock handle);
diff --git a/include/acpi/platform/aclinux.h b/include/acpi/platform/aclinux.h
index 5d2a5e9544d9..2ce1be9f6291 100644
--- a/include/acpi/platform/aclinux.h
+++ b/include/acpi/platform/aclinux.h
@@ -159,6 +159,24 @@ static inline void *acpi_os_acquire_object(acpi_cache_t * cache)
        } while (0)
 #endif
+/*
+ * When lockdep is enabled, the spin_lock_init() macro stringifies it's
+ * argument and uses that as a name for the lock in debugging.
+ * By executing spin_lock_init() in a macro the key changes from "lock" for
+ * all locks to the name of the argument of acpi_os_create_lock(), which
+ * prevents lockdep from reporting false positives for ACPICA locks.
+ */
+#define acpi_os_create_lock(__handle)                           \
+({                                                              \
+        spinlock_t *lock = ACPI_ALLOCATE(sizeof(*lock));        \
+                                                                \
+        if (lock) {                                             \
+                *(__handle) = lock;                             \
+                spin_lock_init(*(__handle));                    \
+        }                                                       \
+        lock ? AE_OK : AE_NO_MEMORY;                            \
+})
 #endif /* __KERNEL__ */
 #endif /* __ACLINUX_H__ */
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index e08f344c6cff..3d53efd25ab9 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -182,6 +182,7 @@
        {0x1002, 0x6750, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6758, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6759, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x675F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6760, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6761, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6762, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
@@ -192,6 +193,7 @@
        {0x1002, 0x6767, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6768, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6880, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x6888, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 8b4538446636..baa397eb9c33 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -676,7 +676,8 @@ void irq_gc_mask_disable_reg(struct irq_data *d);
 void irq_gc_mask_set_bit(struct irq_data *d);
 void irq_gc_mask_clr_bit(struct irq_data *d);
 void irq_gc_unmask_enable_reg(struct irq_data *d);
-void irq_gc_ack(struct irq_data *d);
+void irq_gc_ack_set_bit(struct irq_data *d);
+void irq_gc_ack_clr_bit(struct irq_data *d);
 void irq_gc_mask_disable_reg_and_ack(struct irq_data *d);
 void irq_gc_eoi(struct irq_data *d);
 int irq_gc_set_wake(struct irq_data *d, unsigned int on);
diff --git a/include/linux/memory.h b/include/linux/memory.h
index e1e3b2b84f85..935699b30b7c 100644
--- a/include/linux/memory.h
+++ b/include/linux/memory.h
@@ -20,6 +20,8 @@
 #include <linux/compiler.h>
 #include <linux/mutex.h>
+#define MIN_MEMORY_BLOCK_SIZE     (1 << SECTION_SIZE_BITS)
 struct memory_block {
        unsigned long start_section_nr;
        unsigned long end_section_nr;
diff --git a/include/linux/mmc/card.h b/include/linux/mmc/card.h
index c6927a4d157f..6ad43554ac05 100644
--- a/include/linux/mmc/card.h
+++ b/include/linux/mmc/card.h
@@ -64,6 +64,19 @@ struct mmc_ext_csd {
        unsigned long long      enhanced_area_offset;   /* Units: Byte */
        unsigned int            enhanced_area_size;     /* Units: KB */
        unsigned int            boot_size;              /* in bytes */
+        u8                      raw_partition_support;  /* 160 */
+        u8                      raw_erased_mem_count;   /* 181 */
+        u8                      raw_ext_csd_structure;  /* 194 */
+        u8                      raw_card_type;          /* 196 */
+        u8                      raw_s_a_timeout;                /* 217 */
+        u8                      raw_hc_erase_gap_size;  /* 221 */
+        u8                      raw_erase_timeout_mult; /* 223 */
+        u8                      raw_hc_erase_grp_size;  /* 224 */
+        u8                      raw_sec_trim_mult;      /* 229 */
+        u8                      raw_sec_erase_mult;     /* 230 */
+        u8                      raw_sec_feature_support;/* 231 */
+        u8                      raw_trim_mult;          /* 232 */
+        u8                      raw_sectors[4];         /* 212 - 4 bytes */
 };
 struct sd_scr {
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 54b8b4d7b68f..9e19477991ad 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1097,12 +1097,6 @@ struct net_device {
 #define NETIF_F_ALL_FCOE        (NETIF_F_FCOE_CRC | NETIF_F_FCOE_MTU | \
                                 NETIF_F_FSO)
-#define NETIF_F_ALL_TX_OFFLOADS (NETIF_F_ALL_CSUM | NETIF_F_SG | \
-                                 NETIF_F_FRAGLIST | NETIF_F_ALL_TSO | \
-                                 NETIF_F_HIGHDMA | \
-                                 NETIF_F_SCTP_CSUM | \
-                                 NETIF_F_ALL_FCOE)
        /*
         * If one device supports one of these features, then enable them
         * for all in netdev_increment_features.
diff --git a/include/linux/sdla.h b/include/linux/sdla.h
index 564acd3a71c1..9995c7fc3f60 100644
--- a/include/linux/sdla.h
+++ b/include/linux/sdla.h
@@ -112,11 +112,7 @@ struct sdla_dlci_conf {
   short Tb_max;
 };
-#ifndef __KERNEL__
+#ifdef __KERNEL__
-void sdla(void *cfg_info, char *dev, struct frad_conf *conf, int quiet);
-#else
 /* important Z80 window addresses */
 #define SDLA_CONTROL_WND                0xE000
diff --git a/include/media/v4l2-subdev.h b/include/media/v4l2-subdev.h
index 1562c4ff3a65..2884e3e69cb1 100644
--- a/include/media/v4l2-subdev.h
+++ b/include/media/v4l2-subdev.h
@@ -173,16 +173,20 @@ struct v4l2_subdev_core_ops {
                                 struct v4l2_event_subscription *sub);
 };
-/* s_mode: switch the tuner to a specific tuner mode. Replacement of s_radio.
+/* s_radio: v4l device was opened in radio mode.
-   s_radio: v4l device was opened in Radio mode, to be replaced by s_mode.
+   g_frequency: freq->type must be filled in. Normally done by video_ioctl2
+        or the bridge driver.
+   g_tuner:
+   s_tuner: vt->type must be filled in. Normally done by video_ioctl2 or the
+        bridge driver.
   s_type_addr: sets tuner type and its I2C addr.
   s_config: sets tda9887 specific stuff, like port1, port2 and qss
 */
 struct v4l2_subdev_tuner_ops {
-        int (*s_mode)(struct v4l2_subdev *sd, enum v4l2_tuner_type);
        int (*s_radio)(struct v4l2_subdev *sd);
        int (*s_frequency)(struct v4l2_subdev *sd, struct v4l2_frequency *freq);
        int (*g_frequency)(struct v4l2_subdev *sd, struct v4l2_frequency *freq);
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index dd6847e5d6e4..6506458ccd33 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -63,6 +63,7 @@ typedef enum {
        SCTP_CMD_ECN_ECNE,      /* Do delayed ECNE processing. */
        SCTP_CMD_ECN_CWR,       /* Do delayed CWR processing.  */
        SCTP_CMD_TIMER_START,   /* Start a timer.  */
+        SCTP_CMD_TIMER_START_ONCE, /* Start a timer once */
        SCTP_CMD_TIMER_RESTART, /* Restart a timer. */
        SCTP_CMD_TIMER_STOP,    /* Stop a timer. */
        SCTP_CMD_INIT_CHOOSE_TRANSPORT, /* Choose transport for an INIT. */
diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h
index 99b027b2adce..ca4693b4e09e 100644
--- a/include/net/sctp/ulpevent.h
+++ b/include/net/sctp/ulpevent.h
@@ -80,7 +80,7 @@ static inline struct sctp_ulpevent *sctp_skb2event(struct sk_buff *skb)
 void sctp_ulpevent_free(struct sctp_ulpevent *);
 int sctp_ulpevent_is_notification(const struct sctp_ulpevent *);
-void sctp_queue_purge_ulpevents(struct sk_buff_head *list);
+unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list);
 struct sctp_ulpevent *sctp_ulpevent_make_assoc_change(
        const struct sctp_association *asoc,
diff --git a/kernel/irq/generic-chip.c b/kernel/irq/generic-chip.c
index 31a9db711906..3a2cab407b93 100644
--- a/kernel/irq/generic-chip.c
+++ b/kernel/irq/generic-chip.c
@@ -101,10 +101,10 @@ void irq_gc_unmask_enable_reg(struct irq_data *d)
 }
 /**
- * irq_gc_ack - Ack pending interrupt
+ * irq_gc_ack_set_bit - Ack pending interrupt via setting bit
 * @d: irq_data
 */
-void irq_gc_ack(struct irq_data *d)
+void irq_gc_ack_set_bit(struct irq_data *d)
 {
        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
        u32 mask = 1 << (d->irq - gc->irq_base);
@@ -115,6 +115,20 @@ void irq_gc_ack(struct irq_data *d)
 }
 /**
+ * irq_gc_ack_clr_bit - Ack pending interrupt via clearing bit
+ * @d: irq_data
+ */
+void irq_gc_ack_clr_bit(struct irq_data *d)
+{
+        struct irq_chip_generic *gc = irq_data_get_irq_chip_data(d);
+        u32 mask = ~(1 << (d->irq - gc->irq_base));
+        irq_gc_lock(gc);
+        irq_reg_writel(mask, gc->reg_base + cur_regs(d)->ack);
+        irq_gc_unlock(gc);
+}
+/**
 * irq_gc_mask_disable_reg_and_ack- Mask and ack pending interrupt
 * @d: irq_data
 */
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 7e59ffb3d0ba..ba06207b1dd3 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -84,9 +84,32 @@ DEFINE_PER_CPU(struct rcu_data, rcu_bh_data);
 static struct rcu_state *rcu_state;
+/*
+ * The rcu_scheduler_active variable transitions from zero to one just
+ * before the first task is spawned.  So when this variable is zero, RCU
+ * can assume that there is but one task, allowing RCU to (for example)
+ * optimized synchronize_sched() to a simple barrier().  When this variable
+ * is one, RCU must actually do all the hard work required to detect real
+ * grace periods.  This variable is also used to suppress boot-time false
+ * positives from lockdep-RCU error checking.
+ */
 int rcu_scheduler_active __read_mostly;
 EXPORT_SYMBOL_GPL(rcu_scheduler_active);
+/*
+ * The rcu_scheduler_fully_active variable transitions from zero to one
+ * during the early_initcall() processing, which is after the scheduler
+ * is capable of creating new tasks.  So RCU processing (for example,
+ * creating tasks for RCU priority boosting) must be delayed until after
+ * rcu_scheduler_fully_active transitions from zero to one.  We also
+ * currently delay invocation of any RCU callbacks until after this point.
+ *
+ * It might later prove better for people registering RCU callbacks during
+ * early boot to take responsibility for these callbacks, but one step at
+ * a time.
+ */
+static int rcu_scheduler_fully_active __read_mostly;
 #ifdef CONFIG_RCU_BOOST
 /*
@@ -98,7 +121,6 @@ DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_status);
 DEFINE_PER_CPU(int, rcu_cpu_kthread_cpu);
 DEFINE_PER_CPU(unsigned int, rcu_cpu_kthread_loops);
 DEFINE_PER_CPU(char, rcu_cpu_has_work);
-static char rcu_kthreads_spawnable;
 #endif /* #ifdef CONFIG_RCU_BOOST */
@@ -1467,6 +1489,8 @@ static void rcu_process_callbacks(struct softirq_action *unused)
 */
 static void invoke_rcu_callbacks(struct rcu_state *rsp, struct rcu_data *rdp)
 {
+        if (unlikely(!ACCESS_ONCE(rcu_scheduler_fully_active)))
+                return;
        if (likely(!rsp->boost)) {
                rcu_do_batch(rsp, rdp);
                return;
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 14dc7dd00902..75113cb7c4fb 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -1532,7 +1532,7 @@ static int __cpuinit rcu_spawn_one_cpu_kthread(int cpu)
        struct sched_param sp;
        struct task_struct *t;
-        if (!rcu_kthreads_spawnable ||
+        if (!rcu_scheduler_fully_active ||
            per_cpu(rcu_cpu_kthread_task, cpu) != NULL)
                return 0;
        t = kthread_create(rcu_cpu_kthread, (void *)(long)cpu, "rcuc%d", cpu);
@@ -1639,7 +1639,7 @@ static int __cpuinit rcu_spawn_one_node_kthread(struct rcu_state *rsp,
        struct sched_param sp;
        struct task_struct *t;
-        if (!rcu_kthreads_spawnable ||
+        if (!rcu_scheduler_fully_active ||
            rnp->qsmaskinit == 0)
                return 0;
        if (rnp->node_kthread_task == NULL) {
@@ -1665,7 +1665,7 @@ static int __init rcu_spawn_kthreads(void)
        int cpu;
        struct rcu_node *rnp;
-        rcu_kthreads_spawnable = 1;
+        rcu_scheduler_fully_active = 1;
        for_each_possible_cpu(cpu) {
                per_cpu(rcu_cpu_has_work, cpu) = 0;
                if (cpu_online(cpu))
@@ -1687,7 +1687,7 @@ static void __cpuinit rcu_prepare_kthreads(int cpu)
        struct rcu_node *rnp = rdp->mynode;
        /* Fire up the incoming CPU's kthread and leaf rcu_node kthread. */
-        if (rcu_kthreads_spawnable) {
+        if (rcu_scheduler_fully_active) {
                (void)rcu_spawn_one_cpu_kthread(cpu);
                if (rnp->node_kthread_task == NULL)
                        (void)rcu_spawn_one_node_kthread(rcu_state, rnp);
@@ -1726,6 +1726,13 @@ static void rcu_cpu_kthread_setrt(int cpu, int to_rt)
 {
 }
+static int __init rcu_scheduler_really_started(void)
+{
+        rcu_scheduler_fully_active = 1;
+        return 0;
+}
+early_initcall(rcu_scheduler_really_started);
 static void __cpuinit rcu_prepare_kthreads(int cpu)
 {
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index 9769c756ad66..3dc716f6d8ad 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -7757,6 +7757,9 @@ static void init_cfs_rq(struct cfs_rq *cfs_rq, struct rq *rq)
 #endif
 #endif
        cfs_rq->min_vruntime = (u64)(-(1LL << 20));
+#ifndef CONFIG_64BIT
+        cfs_rq->min_vruntime_copy = cfs_rq->min_vruntime;
+#endif
 }
 static void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 5ed24b94c5e6..d036e59d302b 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2310,7 +2310,8 @@ static bool pgdat_balanced(pg_data_t *pgdat, unsigned long balanced_pages,
        for (i = 0; i <= classzone_idx; i++)
                present_pages += pgdat->node_zones[i].present_pages;
-        return balanced_pages > (present_pages >> 2);
+        /* A special case here: if zone has no page, we think it's balanced */
+        return balanced_pages >= (present_pages >> 2);
 }
 /* is kswapd sleeping prematurely? */
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 86bff9b1ac47..6e82148edfc8 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -528,7 +528,11 @@ static int vlan_dev_init(struct net_device *dev)
                                          (1<<__LINK_STATE_DORMANT))) |
                      (1<<__LINK_STATE_PRESENT);
-        dev->hw_features = NETIF_F_ALL_TX_OFFLOADS;
+        dev->hw_features = NETIF_F_ALL_CSUM | NETIF_F_SG |
+                           NETIF_F_FRAGLIST | NETIF_F_ALL_TSO |
+                           NETIF_F_HIGHDMA | NETIF_F_SCTP_CSUM |
+                           NETIF_F_ALL_FCOE;
        dev->features |= real_dev->vlan_features | NETIF_F_LLTX;
        dev->gso_max_size = real_dev->gso_max_size;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d3a05b9ade7a..bcd158f40bb9 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -393,6 +393,9 @@ int hci_conn_del(struct hci_conn *conn)
        hci_dev_put(hdev);
+        if (conn->handle == 0)
+                kfree(conn);
        return 0;
 }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index c405a954a603..43b4c2deb7cc 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -464,7 +464,8 @@ static void hidp_idle_timeout(unsigned long arg)
 {
        struct hidp_session *session = (struct hidp_session *) arg;
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 }
 static void hidp_set_timer(struct hidp_session *session)
@@ -535,7 +536,8 @@ static void hidp_process_hid_control(struct hidp_session *session,
                skb_queue_purge(&session->ctrl_transmit);
                skb_queue_purge(&session->intr_transmit);
-                kthread_stop(session->task);
+                atomic_inc(&session->terminate);
+                wake_up_process(current);
        }
 }
@@ -706,9 +708,8 @@ static int hidp_session(void *arg)
        add_wait_queue(sk_sleep(intr_sk), &intr_wait);
        session->waiting_for_startup = 0;
        wake_up_interruptible(&session->startup_queue);
-        while (!kthread_should_stop()) {
+        set_current_state(TASK_INTERRUPTIBLE);
-                set_current_state(TASK_INTERRUPTIBLE);
+        while (!atomic_read(&session->terminate)) {
                if (ctrl_sk->sk_state != BT_CONNECTED ||
                                intr_sk->sk_state != BT_CONNECTED)
                        break;
@@ -726,6 +727,7 @@ static int hidp_session(void *arg)
                hidp_process_transmit(session);
                schedule();
+                set_current_state(TASK_INTERRUPTIBLE);
        }
        set_current_state(TASK_RUNNING);
        remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
@@ -1060,7 +1062,8 @@ int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock,
 err_add_device:
        hid_destroy_device(session->hid);
        session->hid = NULL;
-        kthread_stop(session->task);
+        atomic_inc(&session->terminate);
+        wake_up_process(session->task);
 unlink:
        hidp_del_timer(session);
@@ -1111,7 +1114,8 @@ int hidp_del_connection(struct hidp_conndel_req *req)
                        skb_queue_purge(&session->ctrl_transmit);
                        skb_queue_purge(&session->intr_transmit);
-                        kthread_stop(session->task);
+                        atomic_inc(&session->terminate);
+                        wake_up_process(session->task);
                }
        } else
                err = -ENOENT;
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index 19e95004b286..af1bcc823f26 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -142,6 +142,7 @@ struct hidp_session {
        uint ctrl_mtu;
        uint intr_mtu;
+        atomic_t terminate;
        struct task_struct *task;
        unsigned char keys[8];
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 56fdd9162da9..7705e26e699f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -620,7 +620,8 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
                                        struct sock *parent = bt_sk(sk)->parent;
                                        rsp.result = cpu_to_le16(L2CAP_CR_PEND);
                                        rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
-                                        parent->sk_data_ready(parent, 0);
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
                                } else {
                                        sk->sk_state = BT_CONFIG;
@@ -2323,7 +2324,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        sk = chan->sk;
-        if (sk->sk_state != BT_CONFIG) {
+        if (sk->sk_state != BT_CONFIG && sk->sk_state != BT_CONNECT2) {
                struct l2cap_cmd_rej rej;
                rej.reason = cpu_to_le16(0x0002);
@@ -2334,7 +2335,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        /* Reject if config buffer is too small. */
        len = cmd_len - sizeof(*req);
-        if (chan->conf_len + len > sizeof(chan->conf_req)) {
+        if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
                l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
                                l2cap_build_conf_rsp(chan, rsp,
                                        L2CAP_CONF_REJECT, flags), rsp);
@@ -4009,7 +4010,8 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                        struct sock *parent = bt_sk(sk)->parent;
                                        res = L2CAP_CR_PEND;
                                        stat = L2CAP_CS_AUTHOR_PEND;
-                                        parent->sk_data_ready(parent, 0);
+                                        if (parent)
+                                                parent->sk_data_ready(parent, 0);
                                } else {
                                        sk->sk_state = BT_CONFIG;
                                        res = L2CAP_CR_SUCCESS;
diff --git a/net/ceph/ceph_fs.c b/net/ceph/ceph_fs.c
index a3a3a31d3c37..41466ccb972a 100644
--- a/net/ceph/ceph_fs.c
+++ b/net/ceph/ceph_fs.c
@@ -36,16 +36,19 @@ int ceph_flags_to_mode(int flags)
        if ((flags & O_DIRECTORY) == O_DIRECTORY)
                return CEPH_FILE_MODE_PIN;
 #endif
-        if ((flags & O_APPEND) == O_APPEND)
-                flags |= O_WRONLY;
-        if ((flags & O_ACCMODE) == O_RDWR)
+        switch (flags & O_ACCMODE) {
-                mode = CEPH_FILE_MODE_RDWR;
+        case O_WRONLY:
-        else if ((flags & O_ACCMODE) == O_WRONLY)
                mode = CEPH_FILE_MODE_WR;
-        else
+                break;
+        case O_RDONLY:
                mode = CEPH_FILE_MODE_RD;
+                break;
+        case O_RDWR:
+        case O_ACCMODE: /* this is what the VFS does */
+                mode = CEPH_FILE_MODE_RDWR;
+                break;
+        }
 #ifdef O_LAZY
        if (flags & O_LAZY)
                mode |= CEPH_FILE_MODE_LAZY;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 58ffa7d069c7..669d2e32efb6 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                      IEEE80211_MAX_SSID_LEN +
-                                                      local->scan_ies_len,
+                                                      local->scan_ies_len +
+                                                      req->ie_len,
                                                      GFP_KERNEL);
                if (!local->sched_scan_ies.ie[i]) {
                        ret = -ENOMEM;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index d91c1a26630d..8f6a302d2ac3 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -86,6 +86,11 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int queue = rx->queue;
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
        /*
         * it makes no sense to check for MIC errors on anything other
@@ -148,8 +153,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
 update_iv:
        /* update IV in key information to be able to detect replays */
-        rx->key->u.tkip.rx[rx->queue].iv32 = rx->tkip_iv32;
+        rx->key->u.tkip.rx[queue].iv32 = rx->tkip_iv32;
-        rx->key->u.tkip.rx[rx->queue].iv16 = rx->tkip_iv16;
+        rx->key->u.tkip.rx[queue].iv16 = rx->tkip_iv16;
        return RX_CONTINUE;
@@ -241,6 +246,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
        struct ieee80211_key *key = rx->key;
        struct sk_buff *skb = rx->skb;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        int queue = rx->queue;
+        /* otherwise, TKIP is vulnerable to TID 0 vs. non-QoS replays */
+        if (rx->queue == NUM_RX_DATA_QUEUES - 1)
+                queue = 0;
        hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -261,7 +271,7 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
        res = ieee80211_tkip_decrypt_data(rx->local->wep_rx_tfm,
                                          key, skb->data + hdrlen,
                                          skb->len - hdrlen, rx->sta->sta.addr,
-                                          hdr->addr1, hwaccel, rx->queue,
+                                          hdr->addr1, hwaccel, queue,
                                          &rx->tkip_iv32,
                                          &rx->tkip_iv16);
        if (res != TKIP_DECRYPT_OK)
diff --git a/net/sctp/output.c b/net/sctp/output.c
index b4f3cf06d8da..08b3cead6503 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -500,23 +500,20 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         * Note: Adler-32 is no longer applicable, as has been replaced
         * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
         */
-        if (!sctp_checksum_disable &&
+        if (!sctp_checksum_disable) {
-            !(dst->dev->features & (NETIF_F_NO_CSUM | NETIF_F_SCTP_CSUM))) {
+                if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
-                __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
+                        __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
-                /* 3) Put the resultant value into the checksum field in the
+                        /* 3) Put the resultant value into the checksum field in the
-                 *    common header, and leave the rest of the bits unchanged.
+                         *    common header, and leave the rest of the bits unchanged.
-                 */
+                         */
-                sh->checksum = sctp_end_cksum(crc32);
+                        sh->checksum = sctp_end_cksum(crc32);
-        } else {
+                } else {
-                if (dst->dev->features & NETIF_F_SCTP_CSUM) {
                        /* no need to seed pseudo checksum for SCTP */
                        nskb->ip_summed = CHECKSUM_PARTIAL;
                        nskb->csum_start = (skb_transport_header(nskb) -
                                            nskb->head);
                        nskb->csum_offset = offsetof(struct sctphdr, checksum);
-                } else {
-                        nskb->ip_summed = CHECKSUM_UNNECESSARY;
                }
        }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 1c88c8911dc5..d03682109b7a 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -1582,6 +1582,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
 #endif /* SCTP_DEBUG */
        if (transport) {
                if (bytes_acked) {
+                        struct sctp_association *asoc = transport->asoc;
                        /* We may have counted DATA that was migrated
                         * to this transport due to DEL-IP operation.
                         * Subtract those bytes, since the were never
@@ -1600,6 +1602,17 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                        transport->error_count = 0;
                        transport->asoc->overall_error_count = 0;
+                        /*
+                         * While in SHUTDOWN PENDING, we may have started
+                         * the T5 shutdown guard timer after reaching the
+                         * retransmission limit. Stop that timer as soon
+                         * as the receiver acknowledged any data.
+                         */
+                        if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING &&
+                            del_timer(&asoc->timers
+                                [SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD]))
+                                        sctp_association_put(asoc);
                        /* Mark the destination transport address as
                         * active if it is not so marked.
                         */
@@ -1629,10 +1642,15 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                         * A sender is doing zero window probing when the
                         * receiver's advertised window is zero, and there is
                         * only one data chunk in flight to the receiver.
+                         *
+                         * Allow the association to timeout while in SHUTDOWN
+                         * PENDING or SHUTDOWN RECEIVED in case the receiver
+                         * stays in zero window mode forever.
                         */
                        if (!q->asoc->peer.rwnd &&
                            !list_empty(&tlist) &&
-                            (sack_ctsn+2 == q->asoc->next_tsn)) {
+                            (sack_ctsn+2 == q->asoc->next_tsn) &&
+                            q->asoc->state < SCTP_STATE_SHUTDOWN_PENDING) {
                                SCTP_DEBUG_PRINTK("%s: SACK received for zero "
                                                  "window probe: %u\n",
                                                  __func__, sack_ctsn);
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 534c2e5feb05..6e0f88295aaf 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -670,10 +670,19 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
        /* 8.3 Upon the receipt of the HEARTBEAT ACK, the sender of the
         * HEARTBEAT should clear the error counter of the destination
         * transport address to which the HEARTBEAT was sent.
-         * The association's overall error count is also cleared.
         */
        t->error_count = 0;
-        t->asoc->overall_error_count = 0;
+        /*
+         * Although RFC4960 specifies that the overall error count must
+         * be cleared when a HEARTBEAT ACK is received, we make an
+         * exception while in SHUTDOWN PENDING. If the peer keeps its
+         * window shut forever, we may never be able to transmit our
+         * outstanding data and rely on the retransmission limit be reached
+         * to shutdown the association.
+         */
+        if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
+                t->asoc->overall_error_count = 0;
        /* Clear the hb_sent flag to signal that we had a good
         * acknowledgement.
@@ -1437,6 +1446,13 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                        sctp_cmd_setup_t2(commands, asoc, cmd->obj.ptr);
                        break;
+                case SCTP_CMD_TIMER_START_ONCE:
+                        timer = &asoc->timers[cmd->obj.to];
+                        if (timer_pending(timer))
+                                break;
+                        /* fall through */
                case SCTP_CMD_TIMER_START:
                        timer = &asoc->timers[cmd->obj.to];
                        timeout = asoc->timeouts[cmd->obj.to];
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index a297283154d5..246117142b5c 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -5154,7 +5154,7 @@ sctp_disposition_t sctp_sf_do_9_2_start_shutdown(
         * The sender of the SHUTDOWN MAY also start an overall guard timer
         * 'T5-shutdown-guard' to bound the overall time for shutdown sequence.
         */
-        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START,
+        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_RESTART,
                        SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
        if (asoc->autoclose)
@@ -5299,14 +5299,28 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
        SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
        if (asoc->overall_error_count >= asoc->max_retrans) {
-                sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
-                                SCTP_ERROR(ETIMEDOUT));
+                        /*
-                /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
+                         * We are here likely because the receiver had its rwnd
-                sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                         * closed for a while and we have not been able to
-                                SCTP_PERR(SCTP_ERROR_NO_ERROR));
+                         * transmit the locally queued data within the maximum
-                SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                         * retransmission attempts limit.  Start the T5
-                SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                         * shutdown guard timer to give the receiver one last
-                return SCTP_DISPOSITION_DELETE_TCB;
+                         * chance and some additional time to recover before
+                         * aborting.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_START_ONCE,
+                                SCTP_TO(SCTP_EVENT_TIMEOUT_T5_SHUTDOWN_GUARD));
+                } else {
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SET_SK_ERR,
+                                        SCTP_ERROR(ETIMEDOUT));
+                        /* CMD_ASSOC_FAILED calls CMD_DELETE_TCB. */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_ASSOC_FAILED,
+                                        SCTP_PERR(SCTP_ERROR_NO_ERROR));
+                        SCTP_INC_STATS(SCTP_MIB_ABORTEDS);
+                        SCTP_DEC_STATS(SCTP_MIB_CURRESTAB);
+                        return SCTP_DISPOSITION_DELETE_TCB;
+                }
        }
        /* E1) For the destination address for which the timer
diff --git a/net/sctp/sm_statetable.c b/net/sctp/sm_statetable.c
index 0338dc6fdc9d..7c211a7f90f4 100644
--- a/net/sctp/sm_statetable.c
+++ b/net/sctp/sm_statetable.c
@@ -827,7 +827,7 @@ static const sctp_sm_table_entry_t other_event_table[SCTP_NUM_OTHER_TYPES][SCTP_
        /* SCTP_STATE_ESTABLISHED */ \
        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
        /* SCTP_STATE_SHUTDOWN_PENDING */ \
-        TYPE_SCTP_FUNC(sctp_sf_timer_ignore), \
+        TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
        /* SCTP_STATE_SHUTDOWN_SENT */ \
        TYPE_SCTP_FUNC(sctp_sf_t5_timer_expire), \
        /* SCTP_STATE_SHUTDOWN_RECEIVED */ \
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 08c6238802de..d3ccf7973c59 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1384,6 +1384,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
        struct sctp_endpoint *ep;
        struct sctp_association *asoc;
        struct list_head *pos, *temp;
+        unsigned int data_was_unread;
        SCTP_DEBUG_PRINTK("sctp_close(sk: 0x%p, timeout:%ld)\n", sk, timeout);
@@ -1393,6 +1394,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
        ep = sctp_sk(sk)->ep;
+        /* Clean up any skbs sitting on the receive queue.  */
+        data_was_unread = sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
+        data_was_unread += sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
        /* Walk all associations on an endpoint.  */
        list_for_each_safe(pos, temp, &ep->asocs) {
                asoc = list_entry(pos, struct sctp_association, asocs);
@@ -1410,7 +1415,9 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                        }
                }
-                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
+                if (data_was_unread || !skb_queue_empty(&asoc->ulpq.lobby) ||
+                    !skb_queue_empty(&asoc->ulpq.reasm) ||
+                    (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)) {
                        struct sctp_chunk *chunk;
                        chunk = sctp_make_abort_user(asoc, NULL, 0);
@@ -1420,10 +1427,6 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                        sctp_primitive_SHUTDOWN(asoc, NULL);
        }
-        /* Clean up any skbs sitting on the receive queue.  */
-        sctp_queue_purge_ulpevents(&sk->sk_receive_queue);
-        sctp_queue_purge_ulpevents(&sctp_sk(sk)->pd_lobby);
        /* On a TCP-style socket, block for at most linger_time if set. */
        if (sctp_style(sk, TCP) && timeout)
                sctp_wait_for_close(sk, timeout);
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index e70e5fc87890..8a84017834c2 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -1081,9 +1081,19 @@ void sctp_ulpevent_free(struct sctp_ulpevent *event)
 }
 /* Purge the skb lists holding ulpevents. */
-void sctp_queue_purge_ulpevents(struct sk_buff_head *list)
+unsigned int sctp_queue_purge_ulpevents(struct sk_buff_head *list)
 {
        struct sk_buff *skb;
-        while ((skb = skb_dequeue(list)) != NULL)
+        unsigned int data_unread = 0;
-                sctp_ulpevent_free(sctp_skb2event(skb));
+        while ((skb = skb_dequeue(list)) != NULL) {
+                struct sctp_ulpevent *event = sctp_skb2event(skb);
+                if (!sctp_ulpevent_is_notification(event))
+                        data_unread += skb->len;
+                sctp_ulpevent_free(event);
+        }
+        return data_unread;
 }
diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c
index 9a80a922c527..e45d2fbbe5a8 100644
--- a/net/sunrpc/rpcb_clnt.c
+++ b/net/sunrpc/rpcb_clnt.c
@@ -597,7 +597,7 @@ void rpcb_getport_async(struct rpc_task *task)
        u32 bind_version;
        struct rpc_xprt *xprt;
        struct rpc_clnt *rpcb_clnt;
-        static struct rpcbind_args *map;
+        struct rpcbind_args *map;
        struct rpc_task *child;
        struct sockaddr_storage addr;
        struct sockaddr *sap = (struct sockaddr *)&addr;
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index a27406b1654f..4814e246a874 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -616,30 +616,25 @@ static void __rpc_execute(struct rpc_task *task)
        BUG_ON(RPC_IS_QUEUED(task));
        for (;;) {
+                void (*do_action)(struct rpc_task *);
                /*
-                 * Execute any pending callback.
+                 * Execute any pending callback first.
                 */
-                if (task->tk_callback) {
+                do_action = task->tk_callback;
-                        void (*save_callback)(struct rpc_task *);
+                task->tk_callback = NULL;
+                if (do_action == NULL) {
-                        /*
-                         * We set tk_callback to NULL before calling it,
-                         * in case it sets the tk_callback field itself:
-                         */
-                        save_callback = task->tk_callback;
-                        task->tk_callback = NULL;
-                        save_callback(task);
-                } else {
                        /*
                         * Perform the next FSM step.
-                         * tk_action may be NULL when the task has been killed
+                         * tk_action may be NULL if the task has been killed.
-                         * by someone else.
+                         * In particular, note that rpc_killall_tasks may
+                         * do this at any time, so beware when dereferencing.
                         */
-                        if (task->tk_action == NULL)
+                        do_action = task->tk_action;
+                        if (do_action == NULL)
                                break;
-                        task->tk_action(task);
                }
+                do_action(task);
                /*
                 * Lockless check for whether task is sleeping or not.
diff --git a/net/wireless/core.c b/net/wireless/core.c
index c22ef3492ee6..880dbe2e6f94 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -366,6 +366,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
        mutex_init(&rdev->mtx);
        mutex_init(&rdev->devlist_mtx);
+        mutex_init(&rdev->sched_scan_mtx);
        INIT_LIST_HEAD(&rdev->netdev_list);
        spin_lock_init(&rdev->bss_lock);
        INIT_LIST_HEAD(&rdev->bss_list);
@@ -701,6 +702,7 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
        rfkill_destroy(rdev->rfkill);
        mutex_destroy(&rdev->mtx);
        mutex_destroy(&rdev->devlist_mtx);
+        mutex_destroy(&rdev->sched_scan_mtx);
        list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list)
                cfg80211_put_bss(&scan->pub);
        cfg80211_rdev_free_wowlan(rdev);
@@ -737,12 +739,16 @@ static void wdev_cleanup_work(struct work_struct *work)
                ___cfg80211_scan_done(rdev, true);
        }
+        cfg80211_unlock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        if (WARN_ON(rdev->sched_scan_req &&
                    rdev->sched_scan_req->dev == wdev->netdev)) {
                __cfg80211_stop_sched_scan(rdev, false);
        }
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
        mutex_lock(&rdev->devlist_mtx);
        rdev->opencount--;
@@ -830,9 +836,9 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                        break;
                case NL80211_IFTYPE_P2P_CLIENT:
                case NL80211_IFTYPE_STATION:
-                        cfg80211_lock_rdev(rdev);
+                        mutex_lock(&rdev->sched_scan_mtx);
                        __cfg80211_stop_sched_scan(rdev, false);
-                        cfg80211_unlock_rdev(rdev);
+                        mutex_unlock(&rdev->sched_scan_mtx);
                        wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3dce1f167eba..a570ff9214ec 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -65,6 +65,8 @@ struct cfg80211_registered_device {
        struct work_struct scan_done_wk;
        struct work_struct sched_scan_results_wk;
+        struct mutex sched_scan_mtx;
 #ifdef CONFIG_NL80211_TESTMODE
        struct genl_info *testmode_info;
 #endif
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f07602d7bf68..cea338150d05 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -3461,9 +3461,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                return -EINVAL;
-        if (rdev->sched_scan_req)
-                return -EINPROGRESS;
        if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
                return -EINVAL;
@@ -3502,12 +3499,21 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
        if (ie_len > wiphy->max_scan_ie_len)
                return -EINVAL;
+        mutex_lock(&rdev->sched_scan_mtx);
+        if (rdev->sched_scan_req) {
+                err = -EINPROGRESS;
+                goto out;
+        }
        request = kzalloc(sizeof(*request)
                        + sizeof(*request->ssids) * n_ssids
                        + sizeof(*request->channels) * n_channels
                        + ie_len, GFP_KERNEL);
-        if (!request)
+        if (!request) {
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto out;
+        }
        if (n_ssids)
                request->ssids = (void *)&request->channels[n_channels];
@@ -3605,6 +3611,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
        kfree(request);
 out:
+        mutex_unlock(&rdev->sched_scan_mtx);
        return err;
 }
@@ -3612,12 +3619,17 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                   struct genl_info *info)
 {
        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        int err;
        if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
            !rdev->ops->sched_scan_stop)
                return -EOPNOTSUPP;
-        return __cfg80211_stop_sched_scan(rdev, false);
+        mutex_lock(&rdev->sched_scan_mtx);
+        err = __cfg80211_stop_sched_scan(rdev, false);
+        mutex_unlock(&rdev->sched_scan_mtx);
+        return err;
 }
 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 7a6c67667d70..ae0c2256ba3b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -100,14 +100,14 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
        rdev = container_of(wk, struct cfg80211_registered_device,
                            sched_scan_results_wk);
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        /* we don't have sched_scan_req anymore if the scan is stopping */
        if (rdev->sched_scan_req)
                nl80211_send_sched_scan_results(rdev,
                                                rdev->sched_scan_req->dev);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 void cfg80211_sched_scan_results(struct wiphy *wiphy)
@@ -123,9 +123,9 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
 {
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        cfg80211_lock_rdev(rdev);
+        mutex_lock(&rdev->sched_scan_mtx);
        __cfg80211_stop_sched_scan(rdev, true);
-        cfg80211_unlock_rdev(rdev);
+        mutex_unlock(&rdev->sched_scan_mtx);
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
@@ -135,7 +135,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
        int err;
        struct net_device *dev;
-        ASSERT_RDEV_LOCK(rdev);
+        lockdep_assert_held(&rdev->sched_scan_mtx);
        if (!rdev->sched_scan_req)
                return 0;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index d70f85eb7864..9414b9c5b1e4 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1345,6 +1345,8 @@ out:
                        xfrm_state_check_expire(x1);
                err = 0;
+                x->km.state = XFRM_STATE_DEAD;
+                __xfrm_state_put(x);
        }
        spin_unlock_bh(&x1->lock);
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index 3b029cba2baf..a27235685949 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -21,13 +21,15 @@ fi
 # older versions of depmod require the version string to start with three
 # numbers, so we cheat with a symlink here
 depmod_hack_needed=true
-mkdir -p .tmp_depmod/lib/modules/$KERNELRELEASE
+tmp_dir=$(mktemp -d ${TMPDIR:-/tmp}/depmod.XXXXXX)
-if "$DEPMOD" -b .tmp_depmod $KERNELRELEASE 2>/dev/null; then
+mkdir -p "$tmp_dir/lib/modules/$KERNELRELEASE"
-        if test -e .tmp_depmod/lib/modules/$KERNELRELEASE/modules.dep -o \
+if "$DEPMOD" -b "$tmp_dir" $KERNELRELEASE 2>/dev/null; then
-                -e .tmp_depmod/lib/modules/$KERNELRELEASE/modules.dep.bin; then
+        if test -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep" -o \
+                -e "$tmp_dir/lib/modules/$KERNELRELEASE/modules.dep.bin"; then
                depmod_hack_needed=false
        fi
 fi
+rm -rf "$tmp_dir"
 if $depmod_hack_needed; then
        symlink="$INSTALL_MOD_PATH/lib/modules/99.98.$KERNELRELEASE"
        ln -s "$KERNELRELEASE" "$symlink"
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index c2fc0356c2a4..83014a7c2e14 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -1190,7 +1190,6 @@ SND_SOC_DAPM_INPUT("DMIC1DAT"),
 SND_SOC_DAPM_INPUT("DMIC2DAT"),
 SND_SOC_DAPM_INPUT("Clock"),
-SND_SOC_DAPM_MICBIAS("MICBIAS", WM8994_MICBIAS, 2, 0),
 SND_SOC_DAPM_SUPPLY_S("MICBIAS Supply", 1, SND_SOC_NOPM, 0, 0, micbias_ev,
                      SND_SOC_DAPM_PRE_PMU),
@@ -1509,8 +1508,10 @@ static const struct snd_soc_dapm_route wm8994_revd_intercon[] = {
        { "AIF2DACDAT", NULL, "AIF1DACDAT" },
        { "AIF1ADCDAT", NULL, "AIF2ADCDAT" },
        { "AIF2ADCDAT", NULL, "AIF1ADCDAT" },
-        { "MICBIAS", NULL, "CLK_SYS" },
+        { "MICBIAS1", NULL, "CLK_SYS" },
-        { "MICBIAS", NULL, "MICBIAS Supply" },
+        { "MICBIAS1", NULL, "MICBIAS Supply" },
+        { "MICBIAS2", NULL, "CLK_SYS" },
+        { "MICBIAS2", NULL, "MICBIAS Supply" },
 };
 static const struct snd_soc_dapm_route wm8994_intercon[] = {
@@ -2763,7 +2764,7 @@ static void wm8958_default_micdet(u16 status, void *data)
        report = SND_JACK_MICROPHONE;
        /* Everything else is buttons; just assign slots */
-        if (status & 0x1c0)
+        if (status & 0x1c)
                report |= SND_JACK_BTN_0;
 done:
diff --git a/sound/soc/sh/fsi-ak4642.c b/sound/soc/sh/fsi-ak4642.c
index d6f4703b3c07..770a71a15366 100644
--- a/sound/soc/sh/fsi-ak4642.c
+++ b/sound/soc/sh/fsi-ak4642.c
@@ -97,7 +97,7 @@ static int fsi_ak4642_remove(struct platform_device *pdev)
 static struct fsi_ak4642_data fsi_a_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSIA (AK4642)",
+        .card           = "FSIA-AK4642",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi.0",
@@ -106,7 +106,7 @@ static struct fsi_ak4642_data fsi_a_ak4642 = {
 static struct fsi_ak4642_data fsi_b_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSIB (AK4642)",
+        .card           = "FSIB-AK4642",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi.0",
@@ -115,7 +115,7 @@ static struct fsi_ak4642_data fsi_b_ak4642 = {
 static struct fsi_ak4642_data fsi_a_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSIA (AK4643)",
+        .card           = "FSIA-AK4643",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi.0",
@@ -124,7 +124,7 @@ static struct fsi_ak4642_data fsi_a_ak4643 = {
 static struct fsi_ak4642_data fsi_b_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSIB (AK4643)",
+        .card           = "FSIB-AK4643",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi.0",
@@ -133,7 +133,7 @@ static struct fsi_ak4642_data fsi_b_ak4643 = {
 static struct fsi_ak4642_data fsi2_a_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSI2A (AK4642)",
+        .card           = "FSI2A-AK4642",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi2",
@@ -142,7 +142,7 @@ static struct fsi_ak4642_data fsi2_a_ak4642 = {
 static struct fsi_ak4642_data fsi2_b_ak4642 = {
        .name           = "AK4642",
-        .card           = "FSI2B (AK4642)",
+        .card           = "FSI2B-AK4642",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0012",
        .platform       = "sh_fsi2",
@@ -151,7 +151,7 @@ static struct fsi_ak4642_data fsi2_b_ak4642 = {
 static struct fsi_ak4642_data fsi2_a_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSI2A (AK4643)",
+        .card           = "FSI2A-AK4643",
        .cpu_dai        = "fsia-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi2",
@@ -160,7 +160,7 @@ static struct fsi_ak4642_data fsi2_a_ak4643 = {
 static struct fsi_ak4642_data fsi2_b_ak4643 = {
        .name           = "AK4643",
-        .card           = "FSI2B (AK4643)",
+        .card           = "FSI2B-AK4643",
        .cpu_dai        = "fsib-dai",
        .codec          = "ak4642-codec.0-0013",
        .platform       = "sh_fsi2",
diff --git a/sound/soc/sh/fsi-da7210.c b/sound/soc/sh/fsi-da7210.c
index dbafd7ac5590..59553fd8c2fb 100644
--- a/sound/soc/sh/fsi-da7210.c
+++ b/sound/soc/sh/fsi-da7210.c
@@ -42,7 +42,7 @@ static struct snd_soc_dai_link fsi_da7210_dai = {
 };
 static struct snd_soc_card fsi_soc_card = {
-        .name           = "FSI (DA7210)",
+        .name           = "FSI-DA7210",
        .dai_link       = &fsi_da7210_dai,
        .num_links      = 1,
 };
diff --git a/sound/soc/sh/fsi-hdmi.c b/sound/soc/sh/fsi-hdmi.c
index 9719985eb82d..d3d9fd880680 100644
--- a/sound/soc/sh/fsi-hdmi.c
+++ b/sound/soc/sh/fsi-hdmi.c
@@ -83,13 +83,13 @@ static int fsi_hdmi_remove(struct platform_device *pdev)
 static struct fsi_hdmi_data fsi2_a_hdmi = {
        .cpu_dai        = "fsia-dai",
-        .card           = "FSI2A (SH MOBILE HDMI)",
+        .card           = "FSI2A-HDMI",
        .id             = FSI_PORT_A,
 };
 static struct fsi_hdmi_data fsi2_b_hdmi = {
        .cpu_dai        = "fsib-dai",
-        .card           = "FSI2B (SH MOBILE HDMI)",
+        .card           = "FSI2B-HDMI",
        .id             = FSI_PORT_B,
 };