260 files changed, 2361 insertions, 1329 deletions
diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
index 6434f0df012e..6cd6daefaaed 100644
--- a/Documentation/ABI/testing/ima_policy
+++ b/Documentation/ABI/testing/ima_policy
@@ -20,7 +20,7 @@ Description:
                        lsm:    [[subj_user=] [subj_role=] [subj_type=]
                                 [obj_user=] [obj_role=] [obj_type=]]
-                base:   func:= [BPRM_CHECK][FILE_MMAP][INODE_PERMISSION]
+                base:   func:= [BPRM_CHECK][FILE_MMAP][FILE_CHECK]
                        mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
                        fsmagic:= hex value
                        uid:= decimal value
@@ -40,11 +40,11 @@ Description:
                        measure func=BPRM_CHECK
                        measure func=FILE_MMAP mask=MAY_EXEC
-                        measure func=INODE_PERM mask=MAY_READ uid=0
+                        measure func=FILE_CHECK mask=MAY_READ uid=0
                The default policy measures all executables in bprm_check,
                all files mmapped executable in file_mmap, and all files
-                open for read by root in inode_permission.
+                open for read by root in do_filp_open.
                Examples of LSM specific definitions:
@@ -54,8 +54,8 @@ Description:
                        dont_measure obj_type=var_log_t
                        dont_measure obj_type=auditd_log_t
-                        measure subj_user=system_u func=INODE_PERM mask=MAY_READ
+                        measure subj_user=system_u func=FILE_CHECK mask=MAY_READ
-                        measure subj_role=system_r func=INODE_PERM mask=MAY_READ
+                        measure subj_role=system_r func=FILE_CHECK mask=MAY_READ
                Smack:
-                        measure subj_user=_ func=INODE_PERM mask=MAY_READ
+                        measure subj_user=_ func=FILE_CHECK mask=MAY_READ
diff --git a/Documentation/cpu-freq/governors.txt b/Documentation/cpu-freq/governors.txt
index aed082f49d09..737988fca64d 100644
--- a/Documentation/cpu-freq/governors.txt
+++ b/Documentation/cpu-freq/governors.txt
@@ -145,8 +145,8 @@ show_sampling_rate_max: THIS INTERFACE IS DEPRECATED, DON'T USE IT.
 up_threshold: defines what the average CPU usage between the samplings
 of 'sampling_rate' needs to be for the kernel to make a decision on
 whether it should increase the frequency.  For example when it is set
-to its default value of '80' it means that between the checking
+to its default value of '95' it means that between the checking
-intervals the CPU needs to be on average more than 80% in use to then
+intervals the CPU needs to be on average more than 95% in use to then
 decide that the CPU frequency needs to be increased.  
 ignore_nice_load: this parameter takes a value of '0' or '1'. When
diff --git a/Documentation/fault-injection/fault-injection.txt b/Documentation/fault-injection/fault-injection.txt
index 079305640790..7be15e44d481 100644
--- a/Documentation/fault-injection/fault-injection.txt
+++ b/Documentation/fault-injection/fault-injection.txt
@@ -143,8 +143,8 @@ o provide a way to configure fault attributes
  failslab, fail_page_alloc, and fail_make_request use this way.
  Helper functions:
-        init_fault_attr_entries(entries, attr, name);
+        init_fault_attr_dentries(entries, attr, name);
-        void cleanup_fault_attr_entries(entries);
+        void cleanup_fault_attr_dentries(entries);
 - module parameters
diff --git a/MAINTAINERS b/MAINTAINERS
index 03f38c18f323..412eff60c33d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3411,8 +3411,10 @@ S:	Maintained
 F:      drivers/scsi/sym53c8xx_2/
 LTP (Linux Test Project)
-M:      Subrata Modak <subrata@linux.vnet.ibm.com>
+M:      Rishikesh K Rajak <risrajak@linux.vnet.ibm.com>
-M:      Mike Frysinger <vapier@gentoo.org>
+M:      Garrett Cooper <yanegomi@gmail.com>
+M:     Mike Frysinger <vapier@gentoo.org>
+M:     Subrata Modak <subrata@linux.vnet.ibm.com>
 L:      ltp-list@lists.sourceforge.net (subscribers-only)
 W:      http://ltp.sourceforge.net/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/galak/ltp.git
@@ -3836,6 +3838,7 @@ NETWORKING DRIVERS
 L:      netdev@vger.kernel.org
 W:      http://www.linuxfoundation.org/en/Net
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6.git
 S:      Odd Fixes
 F:      drivers/net/
 F:      include/linux/if_*
diff --git a/Makefile b/Makefile
index 394aec712c7d..f8e02e9491d0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 33
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Man-Eating Seals of Antiquity
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 4c33ca82f9b1..184a6bd54825 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -702,6 +702,7 @@ config ARCH_OMAP
        select ARCH_HAS_CPUFREQ
        select GENERIC_TIME
        select GENERIC_CLOCKEVENTS
+        select ARCH_HAS_HOLES_MEMORYMODEL
        help
          Support for TI's OMAP platform (OMAP1 and OMAP2).
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 9e7582572741..356d702c0808 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -94,7 +94,7 @@ CFLAGS_ABI	+=-funwind-tables
 endif
 ifeq ($(CONFIG_THUMB2_KERNEL),y)
-AFLAGS_AUTOIT   :=$(call as-option,-Wa$(comma)-mimplicit-it=thumb,-Wa$(comma)-mauto-it)
+AFLAGS_AUTOIT   :=$(call as-option,-Wa$(comma)-mimplicit-it=always,-Wa$(comma)-mauto-it)
 AFLAGS_NOWARN   :=$(call as-option,-Wa$(comma)-mno-warn-deprecated,-Wa$(comma)-W)
 CFLAGS_THUMB2   :=-mthumb $(AFLAGS_AUTOIT) $(AFLAGS_NOWARN)
 AFLAGS_THUMB2   :=$(CFLAGS_THUMB2) -Wa$(comma)-mthumb
diff --git a/arch/arm/mach-mx25/clock.c b/arch/arm/mach-mx25/clock.c
index 6e838b857712..6acc88bcdc40 100644
--- a/arch/arm/mach-mx25/clock.c
+++ b/arch/arm/mach-mx25/clock.c
@@ -119,6 +119,11 @@ static unsigned long get_rate_nfc(struct clk *clk)
        return get_rate_per(8);
 }
+static unsigned long get_rate_gpt(struct clk *clk)
+{
+        return get_rate_per(5);
+}
 static unsigned long get_rate_otg(struct clk *clk)
 {
        return 48000000; /* FIXME */
@@ -144,7 +149,7 @@ static void clk_cgcr_disable(struct clk *clk)
        __raw_writel(reg, clk->enable_reg);
 }
-#define DEFINE_CLOCK(name, i, er, es, gr, sr)           \
+#define DEFINE_CLOCK(name, i, er, es, gr, sr, s)        \
        static struct clk name = {                      \
                .id             = i,                    \
                .enable_reg     = CRM_BASE + er,        \
@@ -153,27 +158,30 @@ static void clk_cgcr_disable(struct clk *clk)
                .set_rate       = sr,                   \
                .enable         = clk_cgcr_enable,      \
                .disable        = clk_cgcr_disable,     \
+                .secondary      = s,                    \
        }
-DEFINE_CLOCK(gpt_clk,    0, CCM_CGCR0,  5, get_rate_ipg, NULL);
+DEFINE_CLOCK(gpt_clk,    0, CCM_CGCR0,  5, get_rate_gpt, NULL, NULL);
-DEFINE_CLOCK(cspi1_clk,  0, CCM_CGCR1,  5, get_rate_ipg, NULL);
+DEFINE_CLOCK(uart_per_clk, 0, CCM_CGCR0, 15, get_rate_uart, NULL, NULL);
-DEFINE_CLOCK(cspi2_clk,  0, CCM_CGCR1,  6, get_rate_ipg, NULL);
+DEFINE_CLOCK(cspi1_clk,  0, CCM_CGCR1,  5, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(cspi3_clk,  0, CCM_CGCR1,  7, get_rate_ipg, NULL);
+DEFINE_CLOCK(cspi2_clk,  0, CCM_CGCR1,  6, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(uart1_clk,  0, CCM_CGCR2, 14, get_rate_uart, NULL);
+DEFINE_CLOCK(cspi3_clk,  0, CCM_CGCR1,  7, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(uart2_clk,  0, CCM_CGCR2, 15, get_rate_uart, NULL);
+DEFINE_CLOCK(fec_ahb_clk, 0, CCM_CGCR0, 23, NULL,        NULL, NULL);
-DEFINE_CLOCK(uart3_clk,  0, CCM_CGCR2, 16, get_rate_uart, NULL);
+DEFINE_CLOCK(uart1_clk,  0, CCM_CGCR2, 14, get_rate_uart, NULL, &uart_per_clk);
-DEFINE_CLOCK(uart4_clk,  0, CCM_CGCR2, 17, get_rate_uart, NULL);
+DEFINE_CLOCK(uart2_clk,  0, CCM_CGCR2, 15, get_rate_uart, NULL, &uart_per_clk);
-DEFINE_CLOCK(uart5_clk,  0, CCM_CGCR2, 18, get_rate_uart, NULL);
+DEFINE_CLOCK(uart3_clk,  0, CCM_CGCR2, 16, get_rate_uart, NULL, &uart_per_clk);
-DEFINE_CLOCK(nfc_clk,    0, CCM_CGCR0,  8, get_rate_nfc, NULL);
+DEFINE_CLOCK(uart4_clk,  0, CCM_CGCR2, 17, get_rate_uart, NULL, &uart_per_clk);
-DEFINE_CLOCK(usbotg_clk, 0, CCM_CGCR0, 28, get_rate_otg, NULL);
+DEFINE_CLOCK(uart5_clk,  0, CCM_CGCR2, 18, get_rate_uart, NULL, &uart_per_clk);
-DEFINE_CLOCK(pwm1_clk,   0, CCM_CGCR1, 31, get_rate_ipg, NULL);
+DEFINE_CLOCK(nfc_clk,    0, CCM_CGCR0,  8, get_rate_nfc, NULL, NULL);
-DEFINE_CLOCK(pwm2_clk,   0, CCM_CGCR2,  0, get_rate_ipg, NULL);
+DEFINE_CLOCK(usbotg_clk, 0, CCM_CGCR0, 28, get_rate_otg, NULL, NULL);
-DEFINE_CLOCK(pwm3_clk,   0, CCM_CGCR2,  1, get_rate_ipg, NULL);
+DEFINE_CLOCK(pwm1_clk,   0, CCM_CGCR1, 31, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(pwm4_clk,   0, CCM_CGCR2,  2, get_rate_ipg, NULL);
+DEFINE_CLOCK(pwm2_clk,   0, CCM_CGCR2,  0, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(kpp_clk,    0, CCM_CGCR1, 28, get_rate_ipg, NULL);
+DEFINE_CLOCK(pwm3_clk,   0, CCM_CGCR2,  1, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(tsc_clk,    0, CCM_CGCR2, 13, get_rate_ipg, NULL);
+DEFINE_CLOCK(pwm4_clk,   0, CCM_CGCR2,  2, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(i2c_clk,    0, CCM_CGCR0,  6, get_rate_i2c, NULL);
+DEFINE_CLOCK(kpp_clk,    0, CCM_CGCR1, 28, get_rate_ipg, NULL, NULL);
-DEFINE_CLOCK(fec_clk,    0, CCM_CGCR0, 23, get_rate_ipg, NULL);
+DEFINE_CLOCK(tsc_clk,    0, CCM_CGCR2, 13, get_rate_ipg, NULL, NULL);
+DEFINE_CLOCK(i2c_clk,    0, CCM_CGCR0,  6, get_rate_i2c, NULL, NULL);
+DEFINE_CLOCK(fec_clk,    0, CCM_CGCR1, 15, get_rate_ipg, NULL, &fec_ahb_clk);
 #define _REGISTER_CLOCK(d, n, c)        \
        {                               \
@@ -208,13 +216,21 @@ static struct clk_lookup lookups[] = {
        _REGISTER_CLOCK("fec.0", NULL, fec_clk)
 };
-int __init mx25_clocks_init(unsigned long fref)
+int __init mx25_clocks_init(void)
 {
        int i;
        for (i = 0; i < ARRAY_SIZE(lookups); i++)
                clkdev_add(&lookups[i]);
+        /* Turn off all clocks except the ones we need to survive, namely:
+         * EMI, GPIO1-3 (CCM_CGCR1[18:16]), GPT1, IOMUXC (CCM_CGCR1[27]), IIM,
+         * SCC
+         */
+        __raw_writel((1 << 19), CRM_BASE + CCM_CGCR0);
+        __raw_writel((0xf << 16) | (3 << 26), CRM_BASE + CCM_CGCR1);
+        __raw_writel((1 << 5), CRM_BASE + CCM_CGCR2);
        mxc_timer_init(&gpt_clk, MX25_IO_ADDRESS(MX25_GPT1_BASE_ADDR), 54);
        return 0;
diff --git a/arch/arm/mach-mx25/mx25pdk.c b/arch/arm/mach-mx25/mx25pdk.c
index 921bc99ea231..6f06089246eb 100644
--- a/arch/arm/mach-mx25/mx25pdk.c
+++ b/arch/arm/mach-mx25/mx25pdk.c
@@ -91,7 +91,7 @@ static void __init mx25pdk_init(void)
 static void __init mx25pdk_timer_init(void)
 {
-        mx25_clocks_init(26000000);
+        mx25_clocks_init();
 }
 static struct sys_timer mx25pdk_timer = {
diff --git a/arch/arm/mach-mx3/mx31ads.c b/arch/arm/mach-mx3/mx31ads.c
index 3e7bafa2ddbb..938c549767dc 100644
--- a/arch/arm/mach-mx3/mx31ads.c
+++ b/arch/arm/mach-mx3/mx31ads.c
@@ -173,6 +173,7 @@ static void expio_unmask_irq(u32 irq)
 }
 static struct irq_chip expio_irq_chip = {
+        .name = "EXPIO(CPLD)",
        .ack = expio_ack_irq,
        .mask = expio_mask_irq,
        .unmask = expio_unmask_irq,
@@ -302,6 +303,7 @@ static struct regulator_init_data ldo1_data = {
                .min_uV = 2800000,
                .max_uV = 2800000,
                .valid_modes_mask = REGULATOR_MODE_NORMAL,
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
                .apply_uV = 1,
        },
 };
@@ -322,6 +324,7 @@ static struct regulator_init_data ldo2_data = {
                .min_uV = 3300000,
                .max_uV = 3300000,
                .valid_modes_mask = REGULATOR_MODE_NORMAL,
+                .valid_ops_mask = REGULATOR_CHANGE_STATUS,
                .apply_uV = 1,
        },
        .num_consumer_supplies = ARRAY_SIZE(ldo2_consumers),
@@ -459,6 +462,7 @@ static int mx31_wm8350_init(struct wm8350 *wm8350)
 static struct wm8350_platform_data __initdata mx31_wm8350_pdata = {
        .init = mx31_wm8350_init,
+        .irq_base = MXC_BOARD_IRQ_START + MXC_MAX_EXP_IO_LINES,
 };
 #endif
diff --git a/arch/arm/mach-omap2/gpmc.c b/arch/arm/mach-omap2/gpmc.c
index 3f1334f62e7a..7027cdc1ba49 100644
--- a/arch/arm/mach-omap2/gpmc.c
+++ b/arch/arm/mach-omap2/gpmc.c
@@ -505,7 +505,7 @@ static void __init gpmc_mem_init(void)
 void __init gpmc_init(void)
 {
        u32 l;
-        char *ck;
+        char *ck = NULL;
        if (cpu_is_omap24xx()) {
                ck = "core_l3_ck";
@@ -521,6 +521,9 @@ void __init gpmc_init(void)
                l = OMAP44XX_GPMC_BASE;
        }
+        if (WARN_ON(!ck))
+                return;
        gpmc_l3_clk = clk_get(NULL, ck);
        if (IS_ERR(gpmc_l3_clk)) {
                printk(KERN_ERR "Could not get GPMC clock %s\n", ck);
diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
index 27054025da2b..26aeef560aa3 100644
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -194,7 +194,7 @@ void __init omap_init_irq(void)
        int i;
        for (i = 0; i < ARRAY_SIZE(irq_banks); i++) {
-                unsigned long base;
+                unsigned long base = 0;
                struct omap_irq_bank *bank = irq_banks + i;
                if (cpu_is_omap24xx())
@@ -202,6 +202,8 @@ void __init omap_init_irq(void)
                else if (cpu_is_omap34xx())
                        base = OMAP34XX_IC_BASE;
+                BUG_ON(!base);
                /* Static mapping, never released */
                bank->base_reg = ioremap(base, SZ_4K);
                if (!bank->base_reg) {
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index 3f59bd12cbbf..5fedc50c58e4 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -486,7 +486,7 @@ int __init omap_mux_init_signal(char *muxname, int val)
 static inline void omap_mux_decode(struct seq_file *s, u16 val)
 {
        char *flags[OMAP_MUX_MAX_NR_FLAGS];
-        char mode[14];
+        char mode[sizeof("OMAP_MUX_MODE") + 1];
        int i = -1;
        sprintf(mode, "OMAP_MUX_MODE%d", val & 0x7);
@@ -553,6 +553,7 @@ static int omap_mux_dbg_board_show(struct seq_file *s, void *unused)
                if (!m0_name)
                        continue;
+                /* REVISIT: Needs to be updated if mode0 names get longer */
                for (i = 0; i < OMAP_MUX_DEFNAME_LEN; i++) {
                        if (m0_name[i] == '\0') {
                                m0_def[i] = m0_name[i];
@@ -968,6 +969,13 @@ static void __init omap_mux_init_list(struct omap_mux *superset)
                }
 #endif
+#if defined(CONFIG_OMAP_MUX) && defined(CONFIG_DEBUG_FS)
+                if (!superset->muxnames || !superset->muxnames[0]) {
+                        superset++;
+                        continue;
+                }
+#endif
                entry = omap_mux_list_add(superset);
                if (!entry) {
                        printk(KERN_ERR "mux: Could not add entry\n");
diff --git a/arch/arm/mach-omap2/mux34xx.c b/arch/arm/mach-omap2/mux34xx.c
index 68e0a595f9a1..07aa7b3c95f7 100644
--- a/arch/arm/mach-omap2/mux34xx.c
+++ b/arch/arm/mach-omap2/mux34xx.c
@@ -649,6 +649,53 @@ static struct omap_mux __initdata omap3_muxmodes[] = {
        _OMAP3_MUXENTRY(UART3_TX_IRTX, 166,
                "uart3_tx_irtx", NULL, NULL, NULL,
                "gpio_166", NULL, NULL, "safe_mode"),
+        /* Only on 3630, see omap36xx_cbp_subset for the signals */
+        _OMAP3_MUXENTRY(GPMC_A11, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MBUSFLAG, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MREAD, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MWRITE, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_SBUSFLAG, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_SREAD, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_SWRITE, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(GPMC_A11, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD28, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD29, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD32, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD33, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD34, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD35, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
+        _OMAP3_MUXENTRY(SAD2D_MCAD36, 0,
+                NULL, NULL, NULL, NULL,
+                NULL, NULL, NULL, NULL),
        { .reg_offset = OMAP_MUX_TERMINATOR },
 };
diff --git a/arch/arm/mach-omap2/serial.c b/arch/arm/mach-omap2/serial.c
index 8c964bec8159..e10a02df6e1d 100644
--- a/arch/arm/mach-omap2/serial.c
+++ b/arch/arm/mach-omap2/serial.c
@@ -36,7 +36,13 @@
 #define UART_OMAP_NO_EMPTY_FIFO_READ_IP_REV     0x52
 #define UART_OMAP_WER           0x17    /* Wake-up enable register */
-#define DEFAULT_TIMEOUT (5 * HZ)
+/*
+ * NOTE: By default the serial timeout is disabled as it causes lost characters
+ * over the serial ports. This means that the UART clocks will stay on until
+ * disabled via sysfs. This also causes that any deeper omap sleep states are
+ * blocked. 
+ */
+#define DEFAULT_TIMEOUT 0
 struct omap_uart_state {
        int num;
@@ -422,7 +428,8 @@ static void omap_uart_idle_init(struct omap_uart_state *uart)
        uart->timeout = DEFAULT_TIMEOUT;
        setup_timer(&uart->timer, omap_uart_idle_timer,
                    (unsigned long) uart);
-        mod_timer(&uart->timer, jiffies + uart->timeout);
+        if (uart->timeout)
+                mod_timer(&uart->timer, jiffies + uart->timeout);
        omap_uart_smart_idle_enable(uart, 0);
        if (cpu_is_omap34xx()) {
diff --git a/arch/arm/mach-realview/realview_pbx.c b/arch/arm/mach-realview/realview_pbx.c
index a21a4b395f73..d94857eb0690 100644
--- a/arch/arm/mach-realview/realview_pbx.c
+++ b/arch/arm/mach-realview/realview_pbx.c
@@ -334,8 +334,8 @@ static void realview_pbx_reset(char mode)
         * in the system FPGA
         */
        __raw_writel(REALVIEW_SYS_LOCK_VAL, lock_ctrl);
-        __raw_writel(0x0000, reset_ctrl);
+        __raw_writel(0x00F0, reset_ctrl);
-        __raw_writel(0x0004, reset_ctrl);
+        __raw_writel(0x00F4, reset_ctrl);
 }
 static void __init realview_pbx_init(void)
diff --git a/arch/arm/mm/proc-arm6_7.S b/arch/arm/mm/proc-arm6_7.S
index 3f9cd3d8f6d5..795dc615f43b 100644
--- a/arch/arm/mm/proc-arm6_7.S
+++ b/arch/arm/mm/proc-arm6_7.S
@@ -41,7 +41,7 @@ ENTRY(cpu_arm7_dcache_clean_area)
 ENTRY(cpu_arm7_data_abort)
        mrc     p15, 0, r1, c5, c0, 0           @ get FSR
        mrc     p15, 0, r0, c6, c0, 0           @ get FAR
-        ldr     r8, [r0]                        @ read arm instruction
+        ldr     r8, [r2]                        @ read arm instruction
        tst     r8, #1 << 20                    @ L = 0 -> write?
        orreq   r1, r1, #1 << 11                @ yes.
        and     r7, r8, #15 << 24
diff --git a/arch/arm/plat-mxc/audmux-v2.c b/arch/arm/plat-mxc/audmux-v2.c
index 6f21096086fd..b06954a84436 100644
--- a/arch/arm/plat-mxc/audmux-v2.c
+++ b/arch/arm/plat-mxc/audmux-v2.c
@@ -23,6 +23,7 @@
 #include <linux/err.h>
 #include <linux/io.h>
 #include <linux/clk.h>
+#include <linux/debugfs.h>
 #include <mach/audmux.h>
 #include <mach/hardware.h>
@@ -32,6 +33,140 @@ static void __iomem *audmux_base;
 #define MXC_AUDMUX_V2_PTCR(x)           ((x) * 8)
 #define MXC_AUDMUX_V2_PDCR(x)           ((x) * 8 + 4)
+#ifdef CONFIG_DEBUG_FS
+static struct dentry *audmux_debugfs_root;
+static int audmux_open_file(struct inode *inode, struct file *file)
+{
+        file->private_data = inode->i_private;
+        return 0;
+}
+/* There is an annoying discontinuity in the SSI numbering with regard
+ * to the Linux number of the devices */
+static const char *audmux_port_string(int port)
+{
+        switch (port) {
+        case MX31_AUDMUX_PORT1_SSI0:
+                return "imx-ssi.0";
+        case MX31_AUDMUX_PORT2_SSI1:
+                return "imx-ssi.1";
+        case MX31_AUDMUX_PORT3_SSI_PINS_3:
+                return "SSI3";
+        case MX31_AUDMUX_PORT4_SSI_PINS_4:
+                return "SSI4";
+        case MX31_AUDMUX_PORT5_SSI_PINS_5:
+                return "SSI5";
+        case MX31_AUDMUX_PORT6_SSI_PINS_6:
+                return "SSI6";
+        default:
+                return "UNKNOWN";
+        }
+}
+static ssize_t audmux_read_file(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        ssize_t ret;
+        char *buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+        int port = (int)file->private_data;
+        u32 pdcr, ptcr;
+        if (!buf)
+                return -ENOMEM;
+        if (audmux_clk)
+                clk_enable(audmux_clk);
+        ptcr = readl(audmux_base + MXC_AUDMUX_V2_PTCR(port));
+        pdcr = readl(audmux_base + MXC_AUDMUX_V2_PDCR(port));
+        if (audmux_clk)
+                clk_disable(audmux_clk);
+        ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n",
+                       pdcr, ptcr);
+        if (ptcr & MXC_AUDMUX_V2_PTCR_TFSDIR)
+                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                "TxFS output from %s, ",
+                                audmux_port_string((ptcr >> 27) & 0x7));
+        else
+                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                "TxFS input, ");
+        if (ptcr & MXC_AUDMUX_V2_PTCR_TCLKDIR)
+                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                "TxClk output from %s",
+                                audmux_port_string((ptcr >> 22) & 0x7));
+        else
+                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                "TxClk input");
+        ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n");
+        if (ptcr & MXC_AUDMUX_V2_PTCR_SYN) {
+                ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                "Port is symmetric");
+        } else {
+                if (ptcr & MXC_AUDMUX_V2_PTCR_RFSDIR)
+                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                        "RxFS output from %s, ",
+                                        audmux_port_string((ptcr >> 17) & 0x7));
+                else
+                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                        "RxFS input, ");
+                if (ptcr & MXC_AUDMUX_V2_PTCR_RCLKDIR)
+                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                        "RxClk output from %s",
+                                        audmux_port_string((ptcr >> 12) & 0x7));
+                else
+                        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                                        "RxClk input");
+        }
+        ret += snprintf(buf + ret, PAGE_SIZE - ret,
+                        "\nData received from %s\n",
+                        audmux_port_string((pdcr >> 13) & 0x7));
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
+        kfree(buf);
+        return ret;
+}
+static const struct file_operations audmux_debugfs_fops = {
+        .open = audmux_open_file,
+        .read = audmux_read_file,
+};
+static void audmux_debugfs_init(void)
+{
+        int i;
+        char buf[20];
+        audmux_debugfs_root = debugfs_create_dir("audmux", NULL);
+        if (!audmux_debugfs_root) {
+                pr_warning("Failed to create AUDMUX debugfs root\n");
+                return;
+        }
+        for (i = 1; i < 8; i++) {
+                snprintf(buf, sizeof(buf), "ssi%d", i);
+                if (!debugfs_create_file(buf, 0444, audmux_debugfs_root,
+                                         (void *)i, &audmux_debugfs_fops))
+                        pr_warning("Failed to create AUDMUX port %d debugfs file\n",
+                                   i);
+        }
+}
+#else
+static inline void audmux_debugfs_init(void)
+{
+}
+#endif
 int mxc_audmux_v2_configure_port(unsigned int port, unsigned int ptcr,
                unsigned int pdcr)
 {
@@ -68,6 +203,8 @@ static int mxc_audmux_v2_init(void)
        if (cpu_is_mx31() || cpu_is_mx35())
                audmux_base = IO_ADDRESS(AUDMUX_BASE_ADDR);
+        audmux_debugfs_init();
        return 0;
 }
diff --git a/arch/arm/plat-mxc/include/mach/board-mx31lite.h b/arch/arm/plat-mxc/include/mach/board-mx31lite.h
index 0184b638c268..2b2da0367578 100644
--- a/arch/arm/plat-mxc/include/mach/board-mx31lite.h
+++ b/arch/arm/plat-mxc/include/mach/board-mx31lite.h
@@ -25,7 +25,7 @@
 #ifndef __ASSEMBLY__
-enum mx31lilly_boards {
+enum mx31lite_boards {
        MX31LITE_NOBOARD        = 0,
        MX31LITE_DB             = 1,
 };
diff --git a/arch/arm/plat-mxc/include/mach/common.h b/arch/arm/plat-mxc/include/mach/common.h
index 286cb9b0a25b..4bf1068ffad9 100644
--- a/arch/arm/plat-mxc/include/mach/common.h
+++ b/arch/arm/plat-mxc/include/mach/common.h
@@ -32,7 +32,7 @@ extern void mxc91231_init_irq(void);
 extern void mxc_timer_init(struct clk *timer_clk, void __iomem *, int);
 extern int mx1_clocks_init(unsigned long fref);
 extern int mx21_clocks_init(unsigned long lref, unsigned long fref);
-extern int mx25_clocks_init(unsigned long fref);
+extern int mx25_clocks_init(void);
 extern int mx27_clocks_init(unsigned long fref);
 extern int mx31_clocks_init(unsigned long fref);
 extern int mx35_clocks_init(void);
diff --git a/arch/arm/plat-mxc/include/mach/iomux-mx35.h b/arch/arm/plat-mxc/include/mach/iomux-mx35.h
index 00b0ac1db225..c88d40795f7a 100644
--- a/arch/arm/plat-mxc/include/mach/iomux-mx35.h
+++ b/arch/arm/plat-mxc/include/mach/iomux-mx35.h
@@ -671,7 +671,7 @@
 #define MX35_PAD_LD8__SDMA_SDMA_DEBUG_PC_8                      IOMUX_PAD(0x634, 0x1d0, 6, 0x0,   0, NO_PAD_CTRL)
 #define MX35_PAD_LD9__IPU_DISPB_DAT_9                           IOMUX_PAD(0x638, 0x1d4, 0, 0x0,   0, NO_PAD_CTRL)
-#define MX35_PAD_LD9__GPIO2_9                                   IOMUX_PAD(0x638, 0x1d4, 5, 0x8e4  0, NO_PAD_CTRL)
+#define MX35_PAD_LD9__GPIO2_9                                   IOMUX_PAD(0x638, 0x1d4, 5, 0x8e4, 0, NO_PAD_CTRL)
 #define MX35_PAD_LD9__SDMA_SDMA_DEBUG_PC_9                      IOMUX_PAD(0x638, 0x1d4, 6, 0x0,   0, NO_PAD_CTRL)
 #define MX35_PAD_LD10__IPU_DISPB_DAT_10                         IOMUX_PAD(0x63c, 0x1d8, 0, 0x0,   0, NO_PAD_CTRL)
diff --git a/arch/arm/plat-mxc/include/mach/irqs.h b/arch/arm/plat-mxc/include/mach/irqs.h
index ead9d592168d..0cb347645db4 100644
--- a/arch/arm/plat-mxc/include/mach/irqs.h
+++ b/arch/arm/plat-mxc/include/mach/irqs.h
@@ -37,7 +37,12 @@
 * within sensible limits.
 */
 #define MXC_BOARD_IRQ_START     (MXC_INTERNAL_IRQS + MXC_GPIO_IRQS)
+#ifdef CONFIG_MACH_MX31ADS_WM1133_EV1
+#define MXC_BOARD_IRQS  80
+#else
 #define MXC_BOARD_IRQS  16
+#endif
 #define MXC_IPU_IRQ_START       (MXC_BOARD_IRQ_START + MXC_BOARD_IRQS)
diff --git a/arch/arm/plat-omap/clock.c b/arch/arm/plat-omap/clock.c
index d9f8c844c385..4becbdd1935c 100644
--- a/arch/arm/plat-omap/clock.c
+++ b/arch/arm/plat-omap/clock.c
@@ -391,7 +391,7 @@ static struct dentry *clk_debugfs_root;
 static int clk_debugfs_register_one(struct clk *c)
 {
        int err;
-        struct dentry *d, *child;
+        struct dentry *d, *child, *child_tmp;
        struct clk *pa = c->parent;
        char s[255];
        char *p = s;
@@ -423,7 +423,7 @@ static int clk_debugfs_register_one(struct clk *c)
 err_out:
        d = c->dent;
-        list_for_each_entry(child, &d->d_subdirs, d_u.d_child)
+        list_for_each_entry_safe(child, child_tmp, &d->d_subdirs, d_u.d_child)
                debugfs_remove(child);
        debugfs_remove(c->dent);
        return err;
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index d17620c50c28..d2422c766cca 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -750,6 +750,7 @@ static inline void set_24xx_gpio_triggering(struct gpio_bank *bank, int gpio,
 }
 #endif
+#ifdef CONFIG_ARCH_OMAP1
 /*
 * This only applies to chips that can't do both rising and falling edge
 * detection at once.  For all other chips, this function is a noop.
@@ -760,11 +761,9 @@ static void _toggle_gpio_edge_triggering(struct gpio_bank *bank, int gpio)
        u32 l = 0;
        switch (bank->method) {
-#ifdef CONFIG_ARCH_OMAP1
        case METHOD_MPUIO:
                reg += OMAP_MPUIO_GPIO_INT_EDGE;
                break;
-#endif
 #ifdef CONFIG_ARCH_OMAP15XX
        case METHOD_GPIO_1510:
                reg += OMAP1510_GPIO_INT_CONTROL;
@@ -787,6 +786,7 @@ static void _toggle_gpio_edge_triggering(struct gpio_bank *bank, int gpio)
        __raw_writel(l, reg);
 }
+#endif
 static int _set_gpio_triggering(struct gpio_bank *bank, int gpio, int trigger)
 {
diff --git a/arch/arm/plat-omap/omap_device.c b/arch/arm/plat-omap/omap_device.c
index 1e5648d3e3d8..2ed72013c2e2 100644
--- a/arch/arm/plat-omap/omap_device.c
+++ b/arch/arm/plat-omap/omap_device.c
@@ -89,16 +89,6 @@
 #define USE_WAKEUP_LAT                  0
 #define IGNORE_WAKEUP_LAT               1
-/* XXX this should be moved into a separate file */
-#if defined(CONFIG_ARCH_OMAP2420)
-# define OMAP_32KSYNCT_BASE             0x48004000
-#elif defined(CONFIG_ARCH_OMAP2430)
-# define OMAP_32KSYNCT_BASE             0x49020000
-#elif defined(CONFIG_ARCH_OMAP3430)
-# define OMAP_32KSYNCT_BASE             0x48320000
-#else
-# error Unknown OMAP device
-#endif
 /* Private functions */
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index f60a5400a25b..a63c4be99b36 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -197,10 +197,13 @@ static void vfp_raise_exceptions(u32 exceptions, u32 inst, u32 fpscr, struct pt_
        }
        /*
-         * Update the FPSCR with the additional exception flags.
+         * If any of the status flags are set, update the FPSCR.
         * Comparison instructions always return at least one of
         * these flags set.
         */
+        if (exceptions & (FPSCR_N|FPSCR_Z|FPSCR_C|FPSCR_V))
+                fpscr &= ~(FPSCR_N|FPSCR_Z|FPSCR_C|FPSCR_V);
        fpscr |= exceptions;
        fmxr(FPSCR, fpscr);
diff --git a/arch/avr32/mach-at32ap/at32ap700x.c b/arch/avr32/mach-at32ap/at32ap700x.c
index 1aa1ea5e9212..b13d1879e51b 100644
--- a/arch/avr32/mach-at32ap/at32ap700x.c
+++ b/arch/avr32/mach-at32ap/at32ap700x.c
@@ -1325,7 +1325,7 @@ struct platform_device *__init
 at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
 {
        struct platform_device          *pdev;
-        struct mci_dma_slave            *slave;
+        struct mci_dma_data             *slave;
        u32                             pioa_mask;
        u32                             piob_mask;
@@ -1344,7 +1344,9 @@ at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
                                ARRAY_SIZE(atmel_mci0_resource)))
                goto fail;
-        slave = kzalloc(sizeof(struct mci_dma_slave), GFP_KERNEL);
+        slave = kzalloc(sizeof(struct mci_dma_data), GFP_KERNEL);
+        if (!slave)
+                goto fail;
        slave->sdata.dma_dev = &dw_dmac0_device.dev;
        slave->sdata.reg_width = DW_DMA_SLAVE_WIDTH_32BIT;
@@ -1357,7 +1359,7 @@ at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
        if (platform_device_add_data(pdev, data,
                                sizeof(struct mci_platform_data)))
-                goto fail;
+                goto fail_free;
        /* CLK line is common to both slots */
        pioa_mask = 1 << 10;
@@ -1381,7 +1383,7 @@ at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
                /* Slot is unused */
                break;
        default:
-                goto fail;
+                goto fail_free;
        }
        select_peripheral(PIOA, pioa_mask, PERIPH_A, 0);
@@ -1408,7 +1410,7 @@ at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
                break;
        default:
                if (!data->slot[0].bus_width)
-                        goto fail;
+                        goto fail_free;
                data->slot[1].bus_width = 0;
                break;
@@ -1419,9 +1421,10 @@ at32_add_device_mci(unsigned int id, struct mci_platform_data *data)
        platform_device_add(pdev);
        return pdev;
+fail_free:
+        kfree(slave);
 fail:
        data->dma_slave = NULL;
-        kfree(slave);
        platform_device_put(pdev);
        return NULL;
 }
diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
index bb7c374713ad..6fced1fe3bf0 100644
--- a/arch/microblaze/configs/mmu_defconfig
+++ b/arch/microblaze/configs/mmu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.31
+# Linux kernel version: 2.6.33-rc6
-# Thu Sep 24 10:28:50 2009
+# Wed Feb  3 10:02:59 2010
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -19,8 +19,12 @@ CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_CSUM=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
 # CONFIG_PCI is not set
 CONFIG_NO_DMA=y
+CONFIG_DTC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_CONSTRUCTORS=y
@@ -44,6 +48,7 @@ CONFIG_SYSVIPC_SYSCTL=y
 #
 CONFIG_TREE_RCU=y
 # CONFIG_TREE_PREEMPT_RCU is not set
+# CONFIG_TINY_RCU is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_RCU_FANOUT=32
 # CONFIG_RCU_FANOUT_EXACT is not set
@@ -64,10 +69,12 @@ CONFIG_INITRAMFS_ROOT_GID=0
 CONFIG_RD_GZIP=y
 # CONFIG_RD_BZIP2 is not set
 # CONFIG_RD_LZMA is not set
+# CONFIG_RD_LZO is not set
 # CONFIG_INITRAMFS_COMPRESSION_NONE is not set
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
 # CONFIG_INITRAMFS_COMPRESSION_BZIP2 is not set
 # CONFIG_INITRAMFS_COMPRESSION_LZMA is not set
+# CONFIG_INITRAMFS_COMPRESSION_LZO is not set
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SYSCTL=y
 CONFIG_ANON_INODES=y
@@ -90,21 +97,20 @@ CONFIG_EVENTFD=y
 CONFIG_AIO=y
 #
-# Performance Counters
+# Kernel Performance Events And Counters
 #
 CONFIG_VM_EVENT_COUNTERS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
+CONFIG_HAVE_OPROFILE=y
 #
 # GCOV-based kernel profiling
 #
-# CONFIG_SLOW_WORK is not set
+CONFIG_SLOW_WORK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_BASE_SMALL=1
@@ -123,14 +129,41 @@ CONFIG_LBDAF=y
 # IO Schedulers
 #
 CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
-# CONFIG_DEFAULT_AS is not set
 # CONFIG_DEFAULT_DEADLINE is not set
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+# CONFIG_INLINE_SPIN_UNLOCK is not set
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+# CONFIG_INLINE_SPIN_UNLOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+# CONFIG_INLINE_READ_UNLOCK is not set
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+# CONFIG_INLINE_READ_UNLOCK_IRQ is not set
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+# CONFIG_INLINE_WRITE_UNLOCK is not set
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+# CONFIG_INLINE_WRITE_UNLOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
 # CONFIG_FREEZER is not set
 #
@@ -139,11 +172,6 @@ CONFIG_DEFAULT_IOSCHED="cfq"
 CONFIG_PLATFORM_GENERIC=y
 CONFIG_OPT_LIB_FUNCTION=y
 CONFIG_OPT_LIB_ASM=y
-CONFIG_ALLOW_EDIT_AUTO=y
-#
-# Automatic platform settings from Kconfig.auto
-#
 #
 # Definitions for MICROBLAZE0
@@ -203,12 +231,11 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
-CONFIG_SPLIT_PTLOCK_CPUS=4
+CONFIG_SPLIT_PTLOCK_CPUS=999999
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_HAVE_MLOCK=y
+# CONFIG_KSM is not set
-CONFIG_HAVE_MLOCKED_PAGE_BIT=y
 CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 #
@@ -289,7 +316,13 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
-# CONFIG_WIRELESS is not set
+CONFIG_WIRELESS=y
+# CONFIG_CFG80211 is not set
+# CONFIG_LIB80211 is not set
+#
+# CFG80211 needs to be enabled for MAC80211
+#
 # CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
@@ -313,6 +346,10 @@ CONFIG_OF_DEVICE=y
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
 # CONFIG_BLK_DEV_LOOP is not set
+#
+# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
+#
 # CONFIG_BLK_DEV_NBD is not set
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
@@ -349,7 +386,6 @@ CONFIG_NETDEVICES=y
 # CONFIG_PHYLIB is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
-# CONFIG_ETHOC is not set
 # CONFIG_DNET is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
@@ -359,12 +395,12 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_KS8842 is not set
+# CONFIG_KS8851_MLL is not set
 CONFIG_XILINX_EMACLITE=y
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 CONFIG_WLAN=y
-# CONFIG_WLAN_PRE80211 is not set
+# CONFIG_HOSTAP is not set
-# CONFIG_WLAN_80211 is not set
 #
 # Enable WiMAX (Networking options) to see the WiMAX drivers
@@ -408,6 +444,7 @@ CONFIG_SERIAL_UARTLITE=y
 CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
@@ -433,7 +470,6 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
-# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -526,8 +562,6 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_SYSCTL=y
 CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
-CONFIG_TMPFS=y
-# CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
 CONFIG_MISC_FILESYSTEMS=y
@@ -638,11 +672,13 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 #
 # Kernel hacking
 #
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=1024
 # CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_HEADERS_CHECK is not set
@@ -662,6 +698,9 @@ CONFIG_DEBUG_SLAB=y
 # CONFIG_DEBUG_SLAB_LEAK is not set
 CONFIG_DEBUG_SPINLOCK=y
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
@@ -680,10 +719,29 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 # CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
 # CONFIG_SYSCTL_SYSCALL_CHECK is not set
 # CONFIG_PAGE_POISONING is not set
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+# CONFIG_BOOT_TRACER is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_KMEMTRACE is not set
+# CONFIG_WORKQUEUE_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_SAMPLES is not set
-# CONFIG_KMEMCHECK is not set
 CONFIG_EARLY_PRINTK=y
 # CONFIG_HEART_BEAT is not set
 CONFIG_DEBUG_BOOTMEM=y
@@ -694,7 +752,11 @@ CONFIG_DEBUG_BOOTMEM=y
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
-# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
 CONFIG_CRYPTO=y
 #
diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
index adb839bab704..ce2da535246a 100644
--- a/arch/microblaze/configs/nommu_defconfig
+++ b/arch/microblaze/configs/nommu_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.31
+# Linux kernel version: 2.6.33-rc6
-# Thu Sep 24 10:29:43 2009
+# Wed Feb  3 10:03:21 2010
 #
 CONFIG_MICROBLAZE=y
 # CONFIG_SWAP is not set
@@ -19,8 +19,12 @@ CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_GENERIC_GPIO=y
 CONFIG_GENERIC_CSUM=y
+CONFIG_STACKTRACE_SUPPORT=y
+CONFIG_LOCKDEP_SUPPORT=y
+CONFIG_HAVE_LATENCYTOP_SUPPORT=y
 # CONFIG_PCI is not set
 CONFIG_NO_DMA=y
+CONFIG_DTC=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_CONSTRUCTORS=y
@@ -46,6 +50,7 @@ CONFIG_BSD_PROCESS_ACCT_V3=y
 #
 CONFIG_TREE_RCU=y
 # CONFIG_TREE_PREEMPT_RCU is not set
+# CONFIG_TINY_RCU is not set
 # CONFIG_RCU_TRACE is not set
 CONFIG_RCU_FANOUT=32
 # CONFIG_RCU_FANOUT_EXACT is not set
@@ -81,16 +86,16 @@ CONFIG_EVENTFD=y
 CONFIG_AIO=y
 #
-# Performance Counters
+# Kernel Performance Events And Counters
 #
 CONFIG_VM_EVENT_COUNTERS=y
-# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
+# CONFIG_MMAP_ALLOW_UNINITIALIZED is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
+CONFIG_HAVE_OPROFILE=y
 #
 # GCOV-based kernel profiling
@@ -116,14 +121,41 @@ CONFIG_LBDAF=y
 # IO Schedulers
 #
 CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
-# CONFIG_DEFAULT_AS is not set
 # CONFIG_DEFAULT_DEADLINE is not set
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+CONFIG_INLINE_SPIN_UNLOCK=y
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+# CONFIG_MUTEX_SPIN_ON_OWNER is not set
 # CONFIG_FREEZER is not set
 #
@@ -132,7 +164,10 @@ CONFIG_DEFAULT_IOSCHED="cfq"
 CONFIG_PLATFORM_GENERIC=y
 # CONFIG_SELFMOD is not set
 # CONFIG_OPT_LIB_FUNCTION is not set
-# CONFIG_ALLOW_EDIT_AUTO is not set
+#
+# Definitions for MICROBLAZE0
+#
 CONFIG_KERNEL_BASE_ADDR=0x90000000
 CONFIG_XILINX_MICROBLAZE0_FAMILY="virtex5"
 CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
@@ -190,7 +225,6 @@ CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
-CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_NOMMU_INITIAL_TRIM_EXCESS=1
 #
@@ -274,9 +308,6 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 CONFIG_WIRELESS=y
 # CONFIG_CFG80211 is not set
-CONFIG_CFG80211_DEFAULT_PS_VALUE=0
-CONFIG_WIRELESS_OLD_REGULATORY=y
-# CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
 #
@@ -301,9 +332,9 @@ CONFIG_STANDALONE=y
 # CONFIG_CONNECTOR is not set
 CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
+# CONFIG_MTD_TESTS is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
-# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_OF_PARTS is not set
@@ -387,6 +418,10 @@ CONFIG_OF_DEVICE=y
 CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
 # CONFIG_BLK_DEV_LOOP is not set
+#
+# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
+#
 CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
@@ -423,7 +458,6 @@ CONFIG_NETDEVICES=y
 # CONFIG_PHYLIB is not set
 CONFIG_NET_ETHERNET=y
 # CONFIG_MII is not set
-# CONFIG_ETHOC is not set
 # CONFIG_DNET is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
@@ -433,12 +467,12 @@ CONFIG_NET_ETHERNET=y
 # CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
 # CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_KS8842 is not set
+# CONFIG_KS8851_MLL is not set
 # CONFIG_XILINX_EMACLITE is not set
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 CONFIG_WLAN=y
-# CONFIG_WLAN_PRE80211 is not set
+# CONFIG_HOSTAP is not set
-# CONFIG_WLAN_80211 is not set
 #
 # Enable WiMAX (Networking options) to see the WiMAX drivers
@@ -482,6 +516,7 @@ CONFIG_SERIAL_UARTLITE=y
 CONFIG_SERIAL_UARTLITE_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
+# CONFIG_SERIAL_GRLIB_GAISLER_APBUART is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
@@ -508,7 +543,6 @@ CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
-# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
 #
@@ -616,7 +650,6 @@ CONFIG_INOTIFY_USER=y
 CONFIG_PROC_FS=y
 CONFIG_PROC_SYSCTL=y
 CONFIG_SYSFS=y
-# CONFIG_TMPFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
 CONFIG_MISC_FILESYSTEMS=y
@@ -672,11 +705,13 @@ CONFIG_MSDOS_PARTITION=y
 #
 # Kernel hacking
 #
+CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=1024
 # CONFIG_MAGIC_SYSRQ is not set
+# CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_UNUSED_SYMBOLS=y
 CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
@@ -695,12 +730,16 @@ CONFIG_DEBUG_OBJECTS=y
 CONFIG_DEBUG_OBJECTS_SELFTEST=y
 CONFIG_DEBUG_OBJECTS_FREE=y
 CONFIG_DEBUG_OBJECTS_TIMERS=y
+# CONFIG_DEBUG_OBJECTS_WORK is not set
 CONFIG_DEBUG_OBJECTS_ENABLE_DEFAULT=1
 # CONFIG_DEBUG_SLAB is not set
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
 # CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_LOCK_ALLOC is not set
+# CONFIG_PROVE_LOCKING is not set
+# CONFIG_LOCK_STAT is not set
 # CONFIG_DEBUG_SPINLOCK_SLEEP is not set
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
@@ -720,8 +759,28 @@ CONFIG_DEBUG_SG=y
 # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 # CONFIG_FAULT_INJECTION is not set
+# CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
 # CONFIG_PAGE_POISONING is not set
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+# CONFIG_BOOT_TRACER is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_KMEMTRACE is not set
+# CONFIG_WORKQUEUE_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_DYNAMIC_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_EARLY_PRINTK=y
@@ -734,7 +793,11 @@ CONFIG_EARLY_PRINTK=y
 # CONFIG_KEYS is not set
 # CONFIG_SECURITY is not set
 # CONFIG_SECURITYFS is not set
-# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
 CONFIG_CRYPTO=y
 #
diff --git a/arch/microblaze/kernel/entry-nommu.S b/arch/microblaze/kernel/entry-nommu.S
index 95b0855802df..391d6197fc3b 100644
--- a/arch/microblaze/kernel/entry-nommu.S
+++ b/arch/microblaze/kernel/entry-nommu.S
@@ -122,7 +122,7 @@ ENTRY(_interrupt)
 ret_from_intr:
        lwi     r11, r1, PT_MODE
-        bneid   r11, 3f
+        bneid   r11, no_intr_resched
        lwi     r6, r31, TS_THREAD_INFO /* get thread info */
        lwi     r19, r6, TI_FLAGS       /* get flags in thread info */
@@ -133,16 +133,18 @@ ret_from_intr:
        bralid  r15, schedule
        nop
 1:      andi    r11, r19, _TIF_SIGPENDING
-        beqid   r11, no_intr_reshed
+        beqid   r11, no_intr_resched
        addk    r5, r1, r0
        addk    r7, r0, r0
        bralid  r15, do_signal
        addk    r6, r0, r0
-no_intr_reshed:
+no_intr_resched:
+        /* Disable interrupts, we are now committed to the state restore */
+        disable_irq
        /* save mode indicator */
        lwi     r11, r1, PT_MODE
-3:
        swi     r11, r0, PER_CPU(KM)
        /* save r31 */
diff --git a/arch/microblaze/kernel/setup.c b/arch/microblaze/kernel/setup.c
index 5372b24ad049..bb8c4b9ccb80 100644
--- a/arch/microblaze/kernel/setup.c
+++ b/arch/microblaze/kernel/setup.c
@@ -54,6 +54,7 @@ void __init setup_arch(char **cmdline_p)
        microblaze_cache_init();
+        invalidate_dcache();
        enable_dcache();
        invalidate_icache();
diff --git a/arch/powerpc/mm/tlb_hash64.c b/arch/powerpc/mm/tlb_hash64.c
index 282d9306361f..1ec06576f619 100644
--- a/arch/powerpc/mm/tlb_hash64.c
+++ b/arch/powerpc/mm/tlb_hash64.c
@@ -63,15 +63,21 @@ void hpte_need_flush(struct mm_struct *mm, unsigned long addr,
        if (huge) {
 #ifdef CONFIG_HUGETLB_PAGE
                psize = get_slice_psize(mm, addr);
+                /* Mask the address for the correct page size */
+                addr &= ~((1UL << mmu_psize_defs[psize].shift) - 1);
 #else
                BUG();
                psize = pte_pagesize_index(mm, addr, pte); /* shutup gcc */
 #endif
-        } else
+        } else {
                psize = pte_pagesize_index(mm, addr, pte);
+                /* Mask the address for the standard page size.  If we
+                 * have a 64k page kernel, but the hardware does not
+                 * support 64k pages, this might be different from the
+                 * hardware page size encoded in the slice table. */
+                addr &= PAGE_MASK;
+        }
-        /* Mask the address for the correct page size */
-        addr &= ~((1UL << mmu_psize_defs[psize].shift) - 1);
        /* Build full vaddr */
        if (!is_kernel_addr(addr)) {
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 1ee66db003be..f5f79196721c 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -784,9 +784,13 @@ static void xics_set_cpu_priority(unsigned char cppr)
 {
        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
-        BUG_ON(os_cppr->index != 0);
+        /*
+         * we only really want to set the priority when there's
+         * just one cppr value on the stack
+         */
+        WARN_ON(os_cppr->index != 0);
-        os_cppr->stack[os_cppr->index] = cppr;
+        os_cppr->stack[0] = cppr;
        if (firmware_has_feature(FW_FEATURE_LPAR))
                lpar_cppr_info(cppr);
@@ -821,8 +825,14 @@ void xics_setup_cpu(void)
 void xics_teardown_cpu(void)
 {
+        struct xics_cppr *os_cppr = &__get_cpu_var(xics_cppr);
        int cpu = smp_processor_id();
+        /*
+         * we have to reset the cppr index to 0 because we're
+         * not going to return from the IPI
+         */
+        os_cppr->index = 0;
        xics_set_cpu_priority(0);
        /* Clear any pending IPI request */
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index f2ef4b619ce1..c25dfac7dd76 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -293,12 +293,12 @@ struct _lowcore
        __u64   clock_comparator;               /* 0x02d0 */
        __u32   machine_flags;                  /* 0x02d8 */
        __u32   ftrace_func;                    /* 0x02dc */
-        __u8    pad_0x02f0[0x0300-0x02f0];      /* 0x02f0 */
+        __u8    pad_0x02e0[0x0300-0x02e0];      /* 0x02e0 */
        /* Interrupt response block */
        __u8    irb[64];                        /* 0x0300 */
-        __u8    pad_0x0400[0x0e00-0x0400];      /* 0x0400 */
+        __u8    pad_0x0340[0x0e00-0x0340];      /* 0x0340 */
        /*
         * 0xe00 contains the address of the IPL Parameter Information
diff --git a/arch/sh/kernel/cpu/sh3/entry.S b/arch/sh/kernel/cpu/sh3/entry.S
index 3f7e2a22c7c2..f6a389c996cb 100644
--- a/arch/sh/kernel/cpu/sh3/entry.S
+++ b/arch/sh/kernel/cpu/sh3/entry.S
@@ -132,7 +132,6 @@ ENTRY(tlb_protection_violation_store)
         mov    #1, r5
 call_handle_tlbmiss:
-        setup_frame_reg
        mov.l   1f, r0
        mov     r5, r8
        mov.l   @r0, r6
@@ -365,6 +364,8 @@ handle_exception:
         mov.l  @k2, k2         ! read out vector and keep in k2
 handle_exception_special:
+        setup_frame_reg
        ! Setup return address and jump to exception handler
        mov.l   7f, r9          ! fetch return address
        stc     r2_bank, r0     ! k2 (vector)
diff --git a/arch/sh/kernel/dwarf.c b/arch/sh/kernel/dwarf.c
index 88d28ec3780a..e51168064e56 100644
--- a/arch/sh/kernel/dwarf.c
+++ b/arch/sh/kernel/dwarf.c
@@ -540,6 +540,8 @@ void dwarf_free_frame(struct dwarf_frame *frame)
        mempool_free(frame, dwarf_frame_pool);
 }
+extern void ret_from_irq(void);
 /**
 *      dwarf_unwind_stack - unwind the stack
 *
@@ -678,6 +680,24 @@ struct dwarf_frame * dwarf_unwind_stack(unsigned long pc,
        addr = frame->cfa + reg->addr;
        frame->return_addr = __raw_readl(addr);
+        /*
+         * Ah, the joys of unwinding through interrupts.
+         *
+         * Interrupts are tricky - the DWARF info needs to be _really_
+         * accurate and unfortunately I'm seeing a lot of bogus DWARF
+         * info. For example, I've seen interrupts occur in epilogues
+         * just after the frame pointer (r14) had been restored. The
+         * problem was that the DWARF info claimed that the CFA could be
+         * reached by using the value of the frame pointer before it was
+         * restored.
+         *
+         * So until the compiler can be trusted to produce reliable
+         * DWARF info when it really matters, let's stop unwinding once
+         * we've calculated the function that was interrupted.
+         */
+        if (prev && prev->pc == (unsigned long)ret_from_irq)
+                frame->return_addr = 0;
        return frame;
 bail:
diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S
index f0abd58c3a69..2b15ae60c3a0 100644
--- a/arch/sh/kernel/entry-common.S
+++ b/arch/sh/kernel/entry-common.S
@@ -70,8 +70,14 @@ ret_from_exception:
        CFI_STARTPROC simple
        CFI_DEF_CFA r14, 0
        CFI_REL_OFFSET 17, 64
-        CFI_REL_OFFSET 15, 0
+        CFI_REL_OFFSET 15, 60
        CFI_REL_OFFSET 14, 56
+        CFI_REL_OFFSET 13, 52
+        CFI_REL_OFFSET 12, 48
+        CFI_REL_OFFSET 11, 44
+        CFI_REL_OFFSET 10, 40
+        CFI_REL_OFFSET 9, 36
+        CFI_REL_OFFSET 8, 32
        preempt_stop()
 ENTRY(ret_from_irq)
        !
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index 2830b415e214..c49865b30719 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -526,7 +526,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
                         * Set some valid stack frames to give to the child.
                         */
                        childstack = (struct sparc_stackf __user *)
-                                (sp & ~0x7UL);
+                                (sp & ~0xfUL);
                        parentstack = (struct sparc_stackf __user *)
                                regs->u_regs[UREG_FP];
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index c3f1cce0e95e..cb70476bd8f5 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -398,11 +398,11 @@ static unsigned long clone_stackframe(unsigned long csp, unsigned long psp)
        } else
                __get_user(fp, &(((struct reg_window32 __user *)psp)->ins[6]));
-        /* Now 8-byte align the stack as this is mandatory in the
+        /* Now align the stack as this is mandatory in the Sparc ABI
-         * Sparc ABI due to how register windows work.  This hides
+         * due to how register windows work.  This hides the
-         * the restriction from thread libraries etc.  -DaveM
+         * restriction from thread libraries etc.
         */
-        csp &= ~7UL;
+        csp &= ~15UL;
        distance = fp - psp;
        rval = (csp - distance);
diff --git a/arch/sparc/kernel/signal32.c b/arch/sparc/kernel/signal32.c
index ba5b09ad6666..ea22cd373c64 100644
--- a/arch/sparc/kernel/signal32.c
+++ b/arch/sparc/kernel/signal32.c
@@ -120,8 +120,8 @@ struct rt_signal_frame32 {
 };
 /* Align macros */
-#define SF_ALIGNEDSZ  (((sizeof(struct signal_frame32) + 7) & (~7)))
+#define SF_ALIGNEDSZ  (((sizeof(struct signal_frame32) + 15) & (~15)))
-#define RT_ALIGNEDSZ  (((sizeof(struct rt_signal_frame32) + 7) & (~7)))
+#define RT_ALIGNEDSZ  (((sizeof(struct rt_signal_frame32) + 15) & (~15)))
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
@@ -420,15 +420,17 @@ static void __user *get_sigframe(struct sigaction *sa, struct pt_regs *regs, uns
                        sp = current->sas_ss_sp + current->sas_ss_size;
        }
+        sp -= framesize;
        /* Always align the stack frame.  This handles two cases.  First,
         * sigaltstack need not be mindful of platform specific stack
         * alignment.  Second, if we took this signal because the stack
         * is not aligned properly, we'd like to take the signal cleanly
         * and report that.
         */
-        sp &= ~7UL;
+        sp &= ~15UL;
-        return (void __user *)(sp - framesize);
+        return (void __user *) sp;
 }
 static int save_fpu_state32(struct pt_regs *regs, __siginfo_fpu_t __user *fpu)
diff --git a/arch/sparc/kernel/signal_32.c b/arch/sparc/kernel/signal_32.c
index 7ce1a1005b1d..9882df92ba0a 100644
--- a/arch/sparc/kernel/signal_32.c
+++ b/arch/sparc/kernel/signal_32.c
@@ -267,15 +267,17 @@ static inline void __user *get_sigframe(struct sigaction *sa, struct pt_regs *re
                        sp = current->sas_ss_sp + current->sas_ss_size;
        }
+        sp -= framesize;
        /* Always align the stack frame.  This handles two cases.  First,
         * sigaltstack need not be mindful of platform specific stack
         * alignment.  Second, if we took this signal because the stack
         * is not aligned properly, we'd like to take the signal cleanly
         * and report that.
         */
-        sp &= ~7UL;
+        sp &= ~15UL;
-        return (void __user *)(sp - framesize);
+        return (void __user *) sp;
 }
 static inline int
diff --git a/arch/sparc/kernel/signal_64.c b/arch/sparc/kernel/signal_64.c
index 647afbda7ae1..9fa48c30037e 100644
--- a/arch/sparc/kernel/signal_64.c
+++ b/arch/sparc/kernel/signal_64.c
@@ -353,7 +353,7 @@ segv:
 /* Checks if the fp is valid */
 static int invalid_frame_pointer(void __user *fp, int fplen)
 {
-        if (((unsigned long) fp) & 7)
+        if (((unsigned long) fp) & 15)
                return 1;
        return 0;
 }
@@ -396,15 +396,17 @@ static inline void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *
                        sp = current->sas_ss_sp + current->sas_ss_size;
        }
+        sp -= framesize;
        /* Always align the stack frame.  This handles two cases.  First,
         * sigaltstack need not be mindful of platform specific stack
         * alignment.  Second, if we took this signal because the stack
         * is not aligned properly, we'd like to take the signal cleanly
         * and report that.
         */
-        sp &= ~7UL;
+        sp &= ~15UL;
-        return (void __user *)(sp - framesize);
+        return (void __user *) sp;
 }
 static inline void
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index f125e5c551c0..6e44519960c8 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -1356,6 +1356,7 @@ static int __devexit powernowk8_cpu_exit(struct cpufreq_policy *pol)
        kfree(data->powernow_table);
        kfree(data);
+        per_cpu(powernow_data, pol->cpu) = NULL;
        return 0;
 }
@@ -1375,7 +1376,7 @@ static unsigned int powernowk8_get(unsigned int cpu)
        int err;
        if (!data)
-                return -EINVAL;
+                return 0;
        smp_call_function_single(cpu, query_values_on_cpu, &err, true);
        if (err)
diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
index 296aba49472a..15578f180e59 100644
--- a/arch/x86/kvm/i8254.c
+++ b/arch/x86/kvm/i8254.c
@@ -467,6 +467,9 @@ static int pit_ioport_read(struct kvm_io_device *this,
                return -EOPNOTSUPP;
        addr &= KVM_PIT_CHANNEL_MASK;
+        if (addr == 3)
+                return 0;
        s = &pit_state->channels[addr];
        mutex_lock(&pit_state->lock);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 1ddcad452add..a1e1bc9d412d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -670,7 +670,7 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
 {
        static int version;
        struct pvclock_wall_clock wc;
-        struct timespec now, sys, boot;
+        struct timespec boot;
        if (!wall_clock)
                return;
@@ -685,9 +685,7 @@ static void kvm_write_wall_clock(struct kvm *kvm, gpa_t wall_clock)
         * wall clock specified here.  guest system time equals host
         * system time for us, thus we must fill in host boot time here.
         */
-        now = current_kernel_time();
+        getboottime(&boot);
-        ktime_get_ts(&sys);
-        boot = ns_to_timespec(timespec_to_ns(&now) - timespec_to_ns(&sys));
        wc.sec = boot.tv_sec;
        wc.nsec = boot.tv_nsec;
@@ -762,6 +760,7 @@ static void kvm_write_guest_time(struct kvm_vcpu *v)
        local_irq_save(flags);
        kvm_get_msr(v, MSR_IA32_TSC, &vcpu->hv_clock.tsc_timestamp);
        ktime_get_ts(&ts);
+        monotonic_to_bootbased(&ts);
        local_irq_restore(flags);
        /* With all the info we got, fill in the values */
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 5198b9bb34ef..69ddfbd91135 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -49,6 +49,7 @@
 #include <asm/numa.h>
 #include <asm/cacheflush.h>
 #include <asm/init.h>
+#include <linux/bootmem.h>
 static unsigned long dma_reserve __initdata;
@@ -616,6 +617,21 @@ void __init paging_init(void)
 */
 #ifdef CONFIG_MEMORY_HOTPLUG
 /*
+ * After memory hotplug the variables max_pfn, max_low_pfn and high_memory need
+ * updating.
+ */
+static void  update_end_of_memory_vars(u64 start, u64 size)
+{
+        unsigned long end_pfn = PFN_UP(start + size);
+        if (end_pfn > max_pfn) {
+                max_pfn = end_pfn;
+                max_low_pfn = end_pfn;
+                high_memory = (void *)__va(max_pfn * PAGE_SIZE - 1) + 1;
+        }
+}
+/*
 * Memory is added always to NORMAL zone. This means you will never get
 * additional DMA/DMA32 memory.
 */
@@ -634,6 +650,9 @@ int arch_add_memory(int nid, u64 start, u64 size)
        ret = __add_pages(nid, zone, start_pfn, nr_pages);
        WARN_ON_ONCE(ret);
+        /* update max_pfn, max_low_pfn and high_memory */
+        update_end_of_memory_vars(start, size);
        return ret;
 }
 EXPORT_SYMBOL_GPL(arch_add_memory);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index b8bea100a160..b34390347c16 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -2868,6 +2868,21 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
                        },
                        .driver_data = "F.23",  /* cutoff BIOS version */
                },
+                /*
+                 * Acer eMachines G725 has the same problem.  BIOS
+                 * V1.03 is known to be broken.  V3.04 is known to
+                 * work.  Inbetween, there are V1.06, V2.06 and V3.03
+                 * that we don't have much idea about.  For now,
+                 * blacklist anything older than V3.04.
+                 */
+                {
+                        .ident = "G725",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
+                        },
+                        .driver_data = "V3.04", /* cutoff BIOS version */
+                },
                { }     /* terminate list */
        };
        const struct dmi_system_id *dmi = dmi_first_match(sysids);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index f4ea5a8c325b..d096fbcbc771 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2875,7 +2875,7 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
         * write indication (used for PIO/DMA setup), result TF is
         * copied back and we don't whine too much about its failure.
         */
-        tf->flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+        tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
        if (scmd->sc_data_direction == DMA_TO_DEVICE)
                tf->flags |= ATA_TFLAG_WRITE;
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 741065c9da67..730ef3c384ca 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -893,6 +893,9 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
                                       do_write);
        }
+        if (!do_write)
+                flush_dcache_page(page);
        qc->curbytes += qc->sect_size;
        qc->cursg_ofs += qc->sect_size;
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 2ddf03ae034e..68b5957f107c 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -322,7 +322,7 @@ static void pkt_sysfs_dev_remove(struct pktcdvd_device *pd)
        pkt_kobj_remove(pd->kobj_stat);
        pkt_kobj_remove(pd->kobj_wqueue);
        if (class_pktcdvd)
-                device_destroy(class_pktcdvd, pd->pkt_dev);
+                device_unregister(pd->dev);
 }
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 652367aa6546..058fbccf2f52 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -195,5 +195,16 @@ config BT_MRVL_SDIO
          Say Y here to compile support for Marvell BT-over-SDIO driver
          into the kernel or say M to compile it as module.
-endmenu
+config BT_ATH3K
+        tristate "Atheros firmware download driver"
+        depends on BT_HCIBTUSB
+        select FW_LOADER
+        help
+          Bluetooth firmware download driver.
+          This driver loads the firmware into the Atheros Bluetooth
+          chipset.
+          Say Y here to compile support for "Atheros firmware download driver"
+          into the kernel or say M to compile it as module (ath3k).
+endmenu
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index b3f57d2d4eb0..7e5aed598121 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_BT_HCIBTUART)	+= btuart_cs.o
 obj-$(CONFIG_BT_HCIBTUSB)       += btusb.o
 obj-$(CONFIG_BT_HCIBTSDIO)      += btsdio.o
+obj-$(CONFIG_BT_ATH3K)          += ath3k.o
 obj-$(CONFIG_BT_MRVL)           += btmrvl.o
 obj-$(CONFIG_BT_MRVL_SDIO)      += btmrvl_sdio.o
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
new file mode 100644
index 000000000000..add9485ca5b6
--- /dev/null
+++ b/drivers/bluetooth/ath3k.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/usb.h>
+#include <net/bluetooth/bluetooth.h>
+#define VERSION "1.0"
+static struct usb_device_id ath3k_table[] = {
+        /* Atheros AR3011 */
+        { USB_DEVICE(0x0CF3, 0x3000) },
+        { }     /* Terminating entry */
+};
+MODULE_DEVICE_TABLE(usb, ath3k_table);
+#define USB_REQ_DFU_DNLOAD      1
+#define BULK_SIZE               4096
+struct ath3k_data {
+        struct usb_device *udev;
+        u8 *fw_data;
+        u32 fw_size;
+        u32 fw_sent;
+};
+static int ath3k_load_firmware(struct ath3k_data *data,
+                                unsigned char *firmware,
+                                int count)
+{
+        u8 *send_buf;
+        int err, pipe, len, size, sent = 0;
+        BT_DBG("ath3k %p udev %p", data, data->udev);
+        pipe = usb_sndctrlpipe(data->udev, 0);
+        if ((usb_control_msg(data->udev, pipe,
+                                USB_REQ_DFU_DNLOAD,
+                                USB_TYPE_VENDOR, 0, 0,
+                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                BT_ERR("Can't change to loading configuration err");
+                return -EBUSY;
+        }
+        sent += 20;
+        count -= 20;
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+        while (count) {
+                size = min_t(uint, count, BULK_SIZE);
+                pipe = usb_sndbulkpipe(data->udev, 0x02);
+                memcpy(send_buf, firmware + sent, size);
+                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                                        &len, 3000);
+                if (err || (len != size)) {
+                        BT_ERR("Error in firmware loading err = %d,"
+                                "len = %d, size = %d", err, len, size);
+                        goto error;
+                }
+                sent  += size;
+                count -= size;
+        }
+        kfree(send_buf);
+        return 0;
+error:
+        kfree(send_buf);
+        return err;
+}
+static int ath3k_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        const struct firmware *firmware;
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct ath3k_data *data;
+        int size;
+        BT_DBG("intf %p id %p", intf, id);
+        if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+                return -ENODEV;
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        data->udev = udev;
+        if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
+                kfree(data);
+                return -EIO;
+        }
+        size = max_t(uint, firmware->size, 4096);
+        data->fw_data = kmalloc(size, GFP_KERNEL);
+        if (!data->fw_data) {
+                release_firmware(firmware);
+                kfree(data);
+                return -ENOMEM;
+        }
+        memcpy(data->fw_data, firmware->data, firmware->size);
+        data->fw_size = firmware->size;
+        data->fw_sent = 0;
+        release_firmware(firmware);
+        usb_set_intfdata(intf, data);
+        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
+                usb_set_intfdata(intf, NULL);
+                return -EIO;
+        }
+        return 0;
+}
+static void ath3k_disconnect(struct usb_interface *intf)
+{
+        struct ath3k_data *data = usb_get_intfdata(intf);
+        BT_DBG("ath3k_disconnect intf %p", intf);
+        kfree(data->fw_data);
+        kfree(data);
+}
+static struct usb_driver ath3k_driver = {
+        .name           = "ath3k",
+        .probe          = ath3k_probe,
+        .disconnect     = ath3k_disconnect,
+        .id_table       = ath3k_table,
+};
+static int __init ath3k_init(void)
+{
+        BT_INFO("Atheros AR30xx firmware driver ver %s", VERSION);
+        return usb_register(&ath3k_driver);
+}
+static void __exit ath3k_exit(void)
+{
+        usb_deregister(&ath3k_driver);
+}
+module_init(ath3k_init);
+module_exit(ath3k_exit);
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Atheros AR30xx firmware driver");
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("ath3k-1.fw");
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 2acdc605cb4b..c2cf81144715 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -503,7 +503,9 @@ static irqreturn_t bluecard_interrupt(int irq, void *dev_inst)
        unsigned int iobase;
        unsigned char reg;
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
        if (!test_bit(CARD_READY, &(info->hw_state)))
                return IRQ_HANDLED;
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index d814a2755ccb..9f5926aaf57f 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -345,7 +345,9 @@ static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
        int iir;
        irqreturn_t r = IRQ_NONE;
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
        iobase = info->p_dev->io.BasePort1;
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index f36defa37764..57d965b7f521 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -808,6 +808,7 @@ static int btmrvl_sdio_host_to_card(struct btmrvl_private *priv,
 exit:
        sdio_release_host(card->func);
+        kfree(tmpbuf);
        return ret;
 }
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index d339464dc15e..91c523099804 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -295,7 +295,9 @@ static irqreturn_t btuart_interrupt(int irq, void *dev_inst)
        int iir, lsr;
        irqreturn_t r = IRQ_NONE;
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
        iobase = info->p_dev->io.BasePort1;
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 4f02a6f3c980..697591941e17 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -299,7 +299,9 @@ static irqreturn_t dtl1_interrupt(int irq, void *dev_inst)
        int iir, lsr;
        irqreturn_t r = IRQ_NONE;
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
        iobase = info->p_dev->io.BasePort1;
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index be832b6f8279..48788db4e280 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -395,6 +395,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
        unsigned long p = *ppos;
        ssize_t low_count, read, sz;
        char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
+        int err = 0;
        read = 0;
        if (p < (unsigned long) high_memory) {
@@ -441,12 +442,16 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                        return -ENOMEM;
                while (count > 0) {
                        sz = size_inside_page(p, count);
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                        sz = vread(kbuf, (char *)p, sz);
                        if (!sz)
                                break;
                        if (copy_to_user(buf, kbuf, sz)) {
-                                free_page((unsigned long)kbuf);
+                                err = -EFAULT;
-                                return -EFAULT;
+                                break;
                        }
                        count -= sz;
                        buf += sz;
@@ -455,8 +460,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                }
                free_page((unsigned long)kbuf);
        }
-        *ppos = p;
+        *ppos = p;
-        return read;
+        return read ? read : err;
 }
@@ -520,6 +525,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
        ssize_t wrote = 0;
        ssize_t virtr = 0;
        char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+        int err = 0;
        if (p < (unsigned long) high_memory) {
                unsigned long to_write = min_t(unsigned long, count,
@@ -540,14 +546,16 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                        unsigned long sz = size_inside_page(p, count);
                        unsigned long n;
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                        n = copy_from_user(kbuf, buf, sz);
                        if (n) {
-                                if (wrote + virtr)
+                                err = -EFAULT;
-                                        break;
+                                break;
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
                        }
-                        sz = vwrite(kbuf, (char *)p, sz);
+                        vwrite(kbuf, (char *)p, sz);
                        count -= sz;
                        buf += sz;
                        virtr += sz;
@@ -556,8 +564,8 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                free_page((unsigned long)kbuf);
        }
-        *ppos = p;
+        *ppos = p;
-        return virtr + wrote;
+        return virtr + wrote ? : err;
 }
 #endif
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ecba4942fc8e..f58440791e65 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -39,12 +39,12 @@
 struct tpm_inf_dev {
        int iotype;
-        void __iomem *mem_base;         /* MMIO ioremap'd addr */
+        void __iomem *mem_base; /* MMIO ioremap'd addr */
-        unsigned long map_base;         /* phys MMIO base */
+        unsigned long map_base; /* phys MMIO base */
-        unsigned long map_size;         /* MMIO region size */
+        unsigned long map_size; /* MMIO region size */
-        unsigned int index_off;         /* index register offset */
+        unsigned int index_off; /* index register offset */
-        unsigned int data_regs;         /* Data registers */
+        unsigned int data_regs; /* Data registers */
        unsigned int data_size;
        unsigned int config_port;       /* IO Port config index reg */
@@ -406,14 +406,14 @@ static const struct tpm_vendor_specific tpm_inf = {
        .miscdev = {.fops = &inf_ops,},
 };
-static const struct pnp_device_id tpm_pnp_tbl[] = {
+static const struct pnp_device_id tpm_inf_pnp_tbl[] = {
        /* Infineon TPMs */
        {"IFX0101", 0},
        {"IFX0102", 0},
        {"", 0}
 };
-MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
+MODULE_DEVICE_TABLE(pnp, tpm_inf_pnp_tbl);
 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                                       const struct pnp_device_id *dev_id)
@@ -430,7 +430,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
        if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
            !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
-                tpm_dev.iotype = TPM_INF_IO_PORT;
+                tpm_dev.iotype = TPM_INF_IO_PORT;
                tpm_dev.config_port = pnp_port_start(dev, 0);
                tpm_dev.config_size = pnp_port_len(dev, 0);
@@ -459,9 +459,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                        goto err_last;
                }
        } else if (pnp_mem_valid(dev, 0) &&
-                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
+                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
-                tpm_dev.iotype = TPM_INF_IO_MEM;
+                tpm_dev.iotype = TPM_INF_IO_MEM;
                tpm_dev.map_base = pnp_mem_start(dev, 0);
                tpm_dev.map_size = pnp_mem_len(dev, 0);
@@ -563,11 +563,11 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         "product id 0x%02x%02x"
                         "%s\n",
                         tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.config_port :
+                         tpm_dev.config_port :
-                                tpm_dev.map_base + tpm_dev.index_off,
+                         tpm_dev.map_base + tpm_dev.index_off,
                         tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.data_regs :
+                         tpm_dev.data_regs :
-                                tpm_dev.map_base + tpm_dev.data_regs,
+                         tpm_dev.map_base + tpm_dev.data_regs,
                         version[0], version[1],
                         vendorid[0], vendorid[1],
                         productid[0], productid[1], chipname);
@@ -607,20 +607,55 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
                        iounmap(tpm_dev.mem_base);
                        release_mem_region(tpm_dev.map_base, tpm_dev.map_size);
                }
+                tpm_dev_vendor_release(chip);
                tpm_remove_hardware(chip->dev);
        }
 }
+static int tpm_inf_pnp_suspend(struct pnp_dev *dev, pm_message_t pm_state)
+{
+        struct tpm_chip *chip = pnp_get_drvdata(dev);
+        int rc;
+        if (chip) {
+                u8 savestate[] = {
+                        0, 193, /* TPM_TAG_RQU_COMMAND */
+                        0, 0, 0, 10,    /* blob length (in bytes) */
+                        0, 0, 0, 152    /* TPM_ORD_SaveState */
+                };
+                dev_info(&dev->dev, "saving TPM state\n");
+                rc = tpm_inf_send(chip, savestate, sizeof(savestate));
+                if (rc < 0) {
+                        dev_err(&dev->dev, "error while saving TPM state\n");
+                        return rc;
+                }
+        }
+        return 0;
+}
+static int tpm_inf_pnp_resume(struct pnp_dev *dev)
+{
+        /* Re-configure TPM after suspending */
+        tpm_config_out(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        tpm_config_out(IOLIMH, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs >> 8) & 0xff, TPM_INF_DATA);
+        tpm_config_out(IOLIML, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs & 0xff), TPM_INF_DATA);
+        /* activate register */
+        tpm_config_out(TPM_DAR, TPM_INF_ADDR);
+        tpm_config_out(0x01, TPM_INF_DATA);
+        tpm_config_out(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        /* disable RESET, LP and IRQC */
+        tpm_data_out(RESET_LP_IRQC_DISABLE, CMD);
+        return tpm_pm_resume(&dev->dev);
+}
 static struct pnp_driver tpm_inf_pnp_driver = {
        .name = "tpm_inf_pnp",
-        .driver = {
+        .id_table = tpm_inf_pnp_tbl,
-                .owner = THIS_MODULE,
-                .suspend = tpm_pm_suspend,
-                .resume = tpm_pm_resume,
-        },
-        .id_table = tpm_pnp_tbl,
        .probe = tpm_inf_pnp_probe,
-        .remove = __devexit_p(tpm_inf_pnp_remove),
+        .suspend = tpm_inf_pnp_suspend,
+        .resume = tpm_inf_pnp_resume,
+        .remove = __devexit_p(tpm_inf_pnp_remove)
 };
 static int __init init_inf(void)
@@ -638,5 +673,5 @@ module_exit(cleanup_inf);
 MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.9");
+MODULE_VERSION("1.9.2");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index c6f3b48be9dd..dcb9083ecde0 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
                        pid = task_pid(current);
                        type = PIDTYPE_PID;
                }
-                retval = __f_setown(filp, pid, type, 0);
+                get_pid(pid);
                spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+                retval = __f_setown(filp, pid, type, 0);
+                put_pid(pid);
                if (retval)
                        goto out;
        } else {
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index f06024668f99..537c29ac4487 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -36,17 +36,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
-static u32 cn_idx = CN_IDX_CONNECTOR;
-static u32 cn_val = CN_VAL_CONNECTOR;
-module_param(cn_idx, uint, 0);
-module_param(cn_val, uint, 0);
-MODULE_PARM_DESC(cn_idx, "Connector's main device idx.");
-MODULE_PARM_DESC(cn_val, "Connector's main device val.");
-static DEFINE_MUTEX(notify_lock);
-static LIST_HEAD(notify_list);
 static struct cn_dev cdev;
 static int cn_already_initialized;
@@ -210,54 +199,6 @@ static void cn_rx_skb(struct sk_buff *__skb)
 }
 /*
- * Notification routing.
- *
- * Gets id and checks if there are notification request for it's idx
- * and val.  If there are such requests notify the listeners with the
- * given notify event.
- *
- */
-static void cn_notify(struct cb_id *id, u32 notify_event)
-{
-        struct cn_ctl_entry *ent;
-        mutex_lock(&notify_lock);
-        list_for_each_entry(ent, &notify_list, notify_entry) {
-                int i;
-                struct cn_notify_req *req;
-                struct cn_ctl_msg *ctl = ent->msg;
-                int idx_found, val_found;
-                idx_found = val_found = 0;
-                req = (struct cn_notify_req *)ctl->data;
-                for (i = 0; i < ctl->idx_notify_num; ++i, ++req) {
-                        if (id->idx >= req->first &&
-                                        id->idx < req->first + req->range) {
-                                idx_found = 1;
-                                break;
-                        }
-                }
-                for (i = 0; i < ctl->val_notify_num; ++i, ++req) {
-                        if (id->val >= req->first &&
-                                        id->val < req->first + req->range) {
-                                val_found = 1;
-                                break;
-                        }
-                }
-                if (idx_found && val_found) {
-                        struct cn_msg m = { .ack = notify_event, };
-                        memcpy(&m.id, id, sizeof(m.id));
-                        cn_netlink_send(&m, ctl->group, GFP_KERNEL);
-                }
-        }
-        mutex_unlock(&notify_lock);
-}
-/*
 * Callback add routing - adds callback with given ID and name.
 * If there is registered callback with the same ID it will not be added.
 *
@@ -276,8 +217,6 @@ int cn_add_callback(struct cb_id *id, char *name,
        if (err)
                return err;
-        cn_notify(id, 0);
        return 0;
 }
 EXPORT_SYMBOL_GPL(cn_add_callback);
@@ -295,111 +234,9 @@ void cn_del_callback(struct cb_id *id)
        struct cn_dev *dev = &cdev;
        cn_queue_del_callback(dev->cbdev, id);
-        cn_notify(id, 1);
 }
 EXPORT_SYMBOL_GPL(cn_del_callback);
-/*
- * Checks two connector's control messages to be the same.
- * Returns 1 if they are the same or if the first one is corrupted.
- */
-static int cn_ctl_msg_equals(struct cn_ctl_msg *m1, struct cn_ctl_msg *m2)
-{
-        int i;
-        struct cn_notify_req *req1, *req2;
-        if (m1->idx_notify_num != m2->idx_notify_num)
-                return 0;
-        if (m1->val_notify_num != m2->val_notify_num)
-                return 0;
-        if (m1->len != m2->len)
-                return 0;
-        if ((m1->idx_notify_num + m1->val_notify_num) * sizeof(*req1) !=
-            m1->len)
-                return 1;
-        req1 = (struct cn_notify_req *)m1->data;
-        req2 = (struct cn_notify_req *)m2->data;
-        for (i = 0; i < m1->idx_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-        for (i = 0; i < m1->val_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-        return 1;
-}
-/*
- * Main connector device's callback.
- *
- * Used for notification of a request's processing.
- */
-static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
-{
-        struct cn_ctl_msg *ctl;
-        struct cn_ctl_entry *ent;
-        u32 size;
-        if (msg->len < sizeof(*ctl))
-                return;
-        ctl = (struct cn_ctl_msg *)msg->data;
-        size = (sizeof(*ctl) + ((ctl->idx_notify_num +
-                                 ctl->val_notify_num) *
-                                sizeof(struct cn_notify_req)));
-        if (msg->len != size)
-                return;
-        if (ctl->len + sizeof(*ctl) != msg->len)
-                return;
-        /*
-         * Remove notification.
-         */
-        if (ctl->group == 0) {
-                struct cn_ctl_entry *n;
-                mutex_lock(&notify_lock);
-                list_for_each_entry_safe(ent, n, &notify_list, notify_entry) {
-                        if (cn_ctl_msg_equals(ent->msg, ctl)) {
-                                list_del(&ent->notify_entry);
-                                kfree(ent);
-                        }
-                }
-                mutex_unlock(&notify_lock);
-                return;
-        }
-        size += sizeof(*ent);
-        ent = kzalloc(size, GFP_KERNEL);
-        if (!ent)
-                return;
-        ent->msg = (struct cn_ctl_msg *)(ent + 1);
-        memcpy(ent->msg, ctl, size - sizeof(*ent));
-        mutex_lock(&notify_lock);
-        list_add(&ent->notify_entry, &notify_list);
-        mutex_unlock(&notify_lock);
-}
 static int cn_proc_show(struct seq_file *m, void *v)
 {
        struct cn_queue_dev *dev = cdev.cbdev;
@@ -437,11 +274,8 @@ static const struct file_operations cn_file_ops = {
 static int __devinit cn_init(void)
 {
        struct cn_dev *dev = &cdev;
-        int err;
        dev->input = cn_rx_skb;
-        dev->id.idx = cn_idx;
-        dev->id.val = cn_val;
        dev->nls = netlink_kernel_create(&init_net, NETLINK_CONNECTOR,
                                         CN_NETLINK_USERS + 0xf,
@@ -457,14 +291,6 @@ static int __devinit cn_init(void)
        cn_already_initialized = 1;
-        err = cn_add_callback(&dev->id, "connector", &cn_callback);
-        if (err) {
-                cn_already_initialized = 0;
-                cn_queue_free_dev(dev->cbdev);
-                netlink_kernel_release(dev->nls);
-                return -EINVAL;
-        }
        proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
        return 0;
@@ -478,7 +304,6 @@ static void __devexit cn_fini(void)
        proc_net_remove(&init_net, "connector");
-        cn_del_callback(&dev->id);
        cn_queue_free_dev(dev->cbdev);
        netlink_kernel_release(dev->nls);
 }
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 4b34ade2332b..bd444dc93cf2 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -554,6 +554,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                (dbs_tuners_ins.up_threshold -
                                 dbs_tuners_ins.down_differential);
+                if (freq_next < policy->min)
+                        freq_next = policy->min;
                if (!dbs_tuners_ins.powersave_bias) {
                        __cpufreq_driver_target(policy, freq_next,
                                        CPUFREQ_RELATION_L);
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index cf27402af97b..ecd5928d7110 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -804,8 +804,8 @@ static void __devinit mpc85xx_init_csrows(struct mem_ctl_info *mci)
                end   <<= (24 - PAGE_SHIFT);
                end    |= (1 << (24 - PAGE_SHIFT)) - 1;
-                csrow->first_page = start >> PAGE_SHIFT;
+                csrow->first_page = start;
-                csrow->last_page = end >> PAGE_SHIFT;
+                csrow->last_page = end;
                csrow->nr_pages = end + 1 - start;
                csrow->grain = 8;
                csrow->mtype = mtype;
@@ -892,10 +892,6 @@ static int __devinit mpc85xx_mc_err_probe(struct of_device *op,
        mpc85xx_init_csrows(mci);
-#ifdef CONFIG_EDAC_DEBUG
-        edac_mc_register_mcidev_debug((struct attribute **)debug_attr);
-#endif
        /* store the original error disable bits */
        orig_ddr_err_disable =
            in_be32(pdata->mc_vbase + MPC85XX_MC_ERR_DISABLE);
diff --git a/drivers/gpu/drm/ati_pcigart.c b/drivers/gpu/drm/ati_pcigart.c
index a1fce68e3bbe..17be051b7aa3 100644
--- a/drivers/gpu/drm/ati_pcigart.c
+++ b/drivers/gpu/drm/ati_pcigart.c
@@ -113,7 +113,7 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
                if (pci_set_dma_mask(dev->pdev, gart_info->table_mask)) {
                        DRM_ERROR("fail to set dma mask to 0x%Lx\n",
-                                  gart_info->table_mask);
+                                  (unsigned long long)gart_info->table_mask);
                        ret = 1;
                        goto done;
                }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 46d88965852a..ecac882e1d54 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -120,7 +120,7 @@ const static struct intel_device_info intel_gm45_info = {
 const static struct intel_device_info intel_pineview_info = {
        .is_g33 = 1, .is_pineview = 1, .is_mobile = 1, .is_i9xx = 1,
-        .has_pipe_cxsr = 1,
+        .need_gfx_hws = 1,
        .has_hotplug = 1,
 };
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index dda787aafcc6..b4c8c0230689 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3564,6 +3564,9 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object2 *exec_list,
        uint32_t reloc_count = 0, i;
        int ret = 0;
+        if (relocs == NULL)
+            return 0;
        for (i = 0; i < buffer_count; i++) {
                struct drm_i915_gem_relocation_entry __user *user_relocs;
                int unwritten;
@@ -3653,7 +3656,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
        struct drm_gem_object *batch_obj;
        struct drm_i915_gem_object *obj_priv;
        struct drm_clip_rect *cliprects = NULL;
-        struct drm_i915_gem_relocation_entry *relocs;
+        struct drm_i915_gem_relocation_entry *relocs = NULL;
        int ret = 0, ret2, i, pinned = 0;
        uint64_t exec_offset;
        uint32_t seqno, flush_domains, reloc_index;
@@ -3722,6 +3725,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                if (object_list[i] == NULL) {
                        DRM_ERROR("Invalid object handle %d at index %d\n",
                                   exec_list[i].handle, i);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                        ret = -EBADF;
                        goto err;
                }
@@ -3730,6 +3735,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                if (obj_priv->in_execbuffer) {
                        DRM_ERROR("Object %p appears more than once in object list\n",
                                   object_list[i]);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                        ret = -EBADF;
                        goto err;
                }
@@ -3926,6 +3933,7 @@ err:
        mutex_unlock(&dev->struct_mutex);
+pre_mutex_err:
        /* Copy the updated relocations out regardless of current error
         * state.  Failure to update the relocs would mean that the next
         * time userland calls execbuf, it would do so with presumed offset
@@ -3940,7 +3948,6 @@ err:
                        ret = ret2;
        }
-pre_mutex_err:
        drm_free_large(object_list);
        kfree(cliprects);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 89a071a3e6fb..50ddf4a95c5e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -309,6 +309,22 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
        if (de_iir & DE_GSE)
                ironlake_opregion_gse_intr(dev);
+        if (de_iir & DE_PLANEA_FLIP_DONE)
+                intel_prepare_page_flip(dev, 0);
+        if (de_iir & DE_PLANEB_FLIP_DONE)
+                intel_prepare_page_flip(dev, 1);
+        if (de_iir & DE_PIPEA_VBLANK) {
+                drm_handle_vblank(dev, 0);
+                intel_finish_page_flip(dev, 0);
+        }
+        if (de_iir & DE_PIPEB_VBLANK) {
+                drm_handle_vblank(dev, 1);
+                intel_finish_page_flip(dev, 1);
+        }
        /* check event from PCH */
        if ((de_iir & DE_PCH_EVENT) &&
            (pch_iir & SDE_HOTPLUG_MASK)) {
@@ -844,11 +860,11 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
        if (!(pipeconf & PIPEACONF_ENABLE))
                return -EINVAL;
-        if (IS_IRONLAKE(dev))
-                return 0;
        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        if (IS_I965G(dev))
+        if (IS_IRONLAKE(dev))
+                ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
+                                            DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else if (IS_I965G(dev))
                i915_enable_pipestat(dev_priv, pipe,
                                     PIPE_START_VBLANK_INTERRUPT_ENABLE);
        else
@@ -866,13 +882,14 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        unsigned long irqflags;
-        if (IS_IRONLAKE(dev))
-                return;
        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        i915_disable_pipestat(dev_priv, pipe,
+        if (IS_IRONLAKE(dev))
-                              PIPE_VBLANK_INTERRUPT_ENABLE |
+                ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
-                              PIPE_START_VBLANK_INTERRUPT_ENABLE);
+                                             DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else
+                i915_disable_pipestat(dev_priv, pipe,
+                                      PIPE_VBLANK_INTERRUPT_ENABLE |
+                                      PIPE_START_VBLANK_INTERRUPT_ENABLE);
        spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
 }
@@ -1015,13 +1032,14 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
        /* enable kind of interrupts always enabled */
-        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT;
+        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+                           DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
        u32 render_mask = GT_USER_INTERRUPT;
        u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                           SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
        dev_priv->irq_mask_reg = ~display_mask;
-        dev_priv->de_irq_enable_reg = display_mask;
+        dev_priv->de_irq_enable_reg = display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK;
        /* should always can generate irq */
        I915_WRITE(DEIIR, I915_READ(DEIIR));
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index ddefc871edfe..79dd4026586f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -157,6 +157,9 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
        adpa = I915_READ(PCH_ADPA);
        adpa &= ~ADPA_CRT_HOTPLUG_MASK;
+        /* disable HPD first */
+        I915_WRITE(PCH_ADPA, adpa);
+        (void)I915_READ(PCH_ADPA);
        adpa |= (ADPA_CRT_HOTPLUG_PERIOD_128 |
                        ADPA_CRT_HOTPLUG_WARMUP_10MS |
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 45da78ef4a92..12775df1bbfd 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1638,6 +1638,7 @@ static void ironlake_crtc_dpms(struct drm_crtc *crtc, int mode)
        case DRM_MODE_DPMS_OFF:
                DRM_DEBUG_KMS("crtc %d dpms off\n", pipe);
+                drm_vblank_off(dev, pipe);
                /* Disable display plane */
                temp = I915_READ(dspcntr_reg);
                if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
@@ -2519,6 +2520,10 @@ static void g4x_update_wm(struct drm_device *dev,  int planea_clock,
                sr_entries = roundup(sr_entries / cacheline_size, 1);
                DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, SR %d\n",
@@ -2562,6 +2567,10 @@ static void i965_update_wm(struct drm_device *dev, int planea_clock,
                        srwm = 1;
                srwm &= 0x3f;
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
@@ -2630,6 +2639,10 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
                if (srwm < 0)
                        srwm = 1;
                I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
        }
        DRM_DEBUG_KMS("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
@@ -3984,6 +3997,12 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
        spin_lock_irqsave(&dev->event_lock, flags);
        work = intel_crtc->unpin_work;
        if (work == NULL || !work->pending) {
+                if (work && !work->pending) {
+                        obj_priv = work->obj->driver_private;
+                        DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n",
+                                         obj_priv,
+                                         atomic_read(&obj_priv->pending_flip));
+                }
                spin_unlock_irqrestore(&dev->event_lock, flags);
                return;
        }
@@ -4005,7 +4024,10 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
        spin_unlock_irqrestore(&dev->event_lock, flags);
        obj_priv = work->obj->driver_private;
-        if (atomic_dec_and_test(&obj_priv->pending_flip))
+        /* Initial scanout buffer will have a 0 pending flip count */
+        if ((atomic_read(&obj_priv->pending_flip) == 0) ||
+            atomic_dec_and_test(&obj_priv->pending_flip))
                DRM_WAKEUP(&dev_priv->pending_flip_queue);
        schedule_work(&work->work);
 }
@@ -4018,8 +4040,11 @@ void intel_prepare_page_flip(struct drm_device *dev, int plane)
        unsigned long flags;
        spin_lock_irqsave(&dev->event_lock, flags);
-        if (intel_crtc->unpin_work)
+        if (intel_crtc->unpin_work) {
                intel_crtc->unpin_work->pending = 1;
+        } else {
+                DRM_DEBUG_DRIVER("preparing flip with no unpin work?\n");
+        }
        spin_unlock_irqrestore(&dev->event_lock, flags);
 }
@@ -4053,6 +4078,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        /* We borrow the event spin lock for protecting unpin_work */
        spin_lock_irqsave(&dev->event_lock, flags);
        if (intel_crtc->unpin_work) {
+                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
                spin_unlock_irqrestore(&dev->event_lock, flags);
                kfree(work);
                mutex_unlock(&dev->struct_mutex);
@@ -4066,7 +4092,10 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
        ret = intel_pin_and_fence_fb_obj(dev, obj);
        if (ret != 0) {
+                DRM_DEBUG_DRIVER("flip queue: %p pin & fence failed\n",
+                          obj->driver_private);
                kfree(work);
+                intel_crtc->unpin_work = NULL;
                mutex_unlock(&dev->struct_mutex);
                return ret;
        }
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index aa74e59bec61..b1d0acbae4e4 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -611,7 +611,7 @@ static const struct dmi_system_id bad_lid_status[] = {
        {
                .ident = "Samsung SX20S",
                .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Phoenix Technologies LTD"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
                        DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
                },
        },
@@ -623,6 +623,13 @@ static const struct dmi_system_id bad_lid_status[] = {
                },
        },
        {
+                .ident = "Aspire 1810T",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1810T"),
+                },
+        },
+        {
                .ident = "PC-81005",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
@@ -643,7 +650,7 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
 {
        enum drm_connector_status status = connector_status_connected;
-        if (!acpi_lid_open() && !dmi_check_system(bad_lid_status))
+        if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
                status = connector_status_disconnected;
        return status;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index eaacfd0920df..82678d30ab06 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2345,6 +2345,14 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                        (1 << INTEL_ANALOG_CLONE_BIT);
+        } else if (flags & SDVO_OUTPUT_CVBS0) {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_CVBS0;
+                encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
        } else if (flags & SDVO_OUTPUT_LVDS0) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 11c9a3fe6810..c0d4650cdb79 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -354,11 +354,17 @@ u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
                return RREG32(RADEON_CRTC2_CRNT_FRAME);
 }
+/* Who ever call radeon_fence_emit should call ring_lock and ask
+ * for enough space (today caller are ib schedule and buffer move) */
 void r100_fence_ring_emit(struct radeon_device *rdev,
                          struct radeon_fence *fence)
 {
-        /* Who ever call radeon_fence_emit should call ring_lock and ask
+        /* We have to make sure that caches are flushed before
-         * for enough space (today caller are ib schedule and buffer move) */
+         * CPU might read something from VRAM. */
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_DSTCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_DC_FLUSH_ALL);
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_ZCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_ZC_FLUSH_ALL);
        /* Wait until IDLE & CLEAN */
        radeon_ring_write(rdev, PACKET0(0x1720, 0));
        radeon_ring_write(rdev, (1 << 16) | (1 << 17));
@@ -3369,7 +3375,6 @@ int r100_suspend(struct radeon_device *rdev)
 void r100_fini(struct radeon_device *rdev)
 {
-        r100_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -3481,13 +3486,12 @@ int r100_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r100_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 0051d11b907c..43b55a030b4d 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -506,11 +506,14 @@ void r300_vram_info(struct radeon_device *rdev)
        /* DDR for all card after R300 & IGP */
        rdev->mc.vram_is_ddr = true;
        tmp = RREG32(RADEON_MEM_CNTL);
-        if (tmp & R300_MEM_NUM_CHANNELS_MASK) {
+        tmp &= R300_MEM_NUM_CHANNELS_MASK;
-                rdev->mc.vram_width = 128;
+        switch (tmp) {
-        } else {
+        case 0: rdev->mc.vram_width = 64; break;
-                rdev->mc.vram_width = 64;
+        case 1: rdev->mc.vram_width = 128; break;
+        case 2: rdev->mc.vram_width = 256; break;
+        default:  rdev->mc.vram_width = 128; break;
        }
        r100_vram_init_sizes(rdev);
@@ -1327,7 +1330,6 @@ int r300_suspend(struct radeon_device *rdev)
 void r300_fini(struct radeon_device *rdev)
 {
-        r300_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -1418,15 +1420,15 @@ int r300_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r300_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCIE)
                        rv370_pcie_gart_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
+                radeon_agp_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4526faaacca8..d9373246c97f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -389,16 +389,15 @@ int r420_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r420_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                if (rdev->flags & RADEON_IS_PCIE)
                        rv370_pcie_gart_fini(rdev);
                if (rdev->flags & RADEON_IS_PCI)
                        r100_pci_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 9a189072f2b9..ddf5731eba0d 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -294,13 +294,12 @@ int r520_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv370_pcie_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 1b6d0001b20e..a1198d99cdf9 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1654,6 +1654,12 @@ void r600_ring_init(struct radeon_device *rdev, unsigned ring_size)
        rdev->cp.align_mask = 16 - 1;
 }
+void r600_cp_fini(struct radeon_device *rdev)
+{
+        r600_cp_stop(rdev);
+        radeon_ring_fini(rdev);
+}
 /*
 * GPU scratch registers helpers function.
@@ -1861,6 +1867,12 @@ int r600_startup(struct radeon_device *rdev)
                        return r;
        }
        r600_gpu_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
        /* pin copy shader into vram */
        if (rdev->r600_blit.shader_obj) {
                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
@@ -2045,19 +2057,15 @@ int r600_init(struct radeon_device *rdev)
        r = r600_pcie_gart_init(rdev);
        if (r)
                return r;
-        r = r600_blit_init(rdev);
-        if (r) {
-                r600_blit_fini(rdev);
-                rdev->asic->copy = NULL;
-                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
-        }
        rdev->accel_working = true;
        r = r600_startup(rdev);
        if (r) {
-                r600_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                r600_pcie_gart_fini(rdev);
                rdev->accel_working = false;
        }
@@ -2083,20 +2091,17 @@ int r600_init(struct radeon_device *rdev)
 void r600_fini(struct radeon_device *rdev)
 {
-        /* Suspend operations */
-        r600_suspend(rdev);
        r600_audio_fini(rdev);
        r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
        r600_irq_fini(rdev);
        radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
        r600_pcie_gart_fini(rdev);
+        radeon_agp_fini(rdev);
        radeon_gem_fini(rdev);
        radeon_fence_driver_fini(rdev);
        radeon_clocks_fini(rdev);
-        radeon_agp_fini(rdev);
        radeon_bo_fini(rdev);
        radeon_atombios_fini(rdev);
        kfree(rdev->bios);
@@ -2900,3 +2905,18 @@ int r600_debugfs_mc_info_init(struct radeon_device *rdev)
        return 0;
 #endif
 }
+/**
+ * r600_ioctl_wait_idle - flush host path cache on wait idle ioctl
+ * rdev: radeon device structure
+ * bo: buffer object struct which userspace is waiting for idle
+ *
+ * Some R6XX/R7XX doesn't seems to take into account HDP flush performed
+ * through ring buffer, this leads to corruption in rendering, see
+ * http://bugzilla.kernel.org/show_bug.cgi?id=15186 to avoid this we
+ * directly perform HDP flush by writing register through MMIO.
+ */
+void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
+{
+        WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
+}
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 99e2c3891a7d..b1c1d3433454 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -35,7 +35,7 @@
 */
 static int r600_audio_chipset_supported(struct radeon_device *rdev)
 {
-        return rdev->family >= CHIP_R600
+        return (rdev->family >= CHIP_R600 && rdev->family < CHIP_RV710)
                || rdev->family == CHIP_RS600
                || rdev->family == CHIP_RS690
                || rdev->family == CHIP_RS740;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 2d5f2bfa7201..f57480ba1355 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -661,6 +661,13 @@ struct radeon_asic {
        void (*hpd_fini)(struct radeon_device *rdev);
        bool (*hpd_sense)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
        void (*hpd_set_polarity)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+        /* ioctl hw specific callback. Some hw might want to perform special
+         * operation on specific ioctl. For instance on wait idle some hw
+         * might want to perform and HDP flush through MMIO as it seems that
+         * some R6XX/R7XX hw doesn't take HDP flush into account if programmed
+         * through ring.
+         */
+        void (*ioctl_wait_idle)(struct radeon_device *rdev, struct radeon_bo *bo);
 };
 /*
@@ -1143,6 +1150,7 @@ extern bool r600_card_posted(struct radeon_device *rdev);
 extern void r600_cp_stop(struct radeon_device *rdev);
 extern void r600_ring_init(struct radeon_device *rdev, unsigned ring_size);
 extern int r600_cp_resume(struct radeon_device *rdev);
+extern void r600_cp_fini(struct radeon_device *rdev);
 extern int r600_count_pipe_bits(uint32_t val);
 extern int r600_gart_clear_page(struct radeon_device *rdev, int i);
 extern int r600_mc_wait_for_idle(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index f2fbd2e4e9df..05ee1aeac3fd 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -117,6 +117,7 @@ static struct radeon_asic r100_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -176,6 +177,7 @@ static struct radeon_asic r300_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 /*
@@ -219,6 +221,7 @@ static struct radeon_asic r420_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -267,6 +270,7 @@ static struct radeon_asic rs400_asic = {
        .hpd_fini = &r100_hpd_fini,
        .hpd_sense = &r100_hpd_sense,
        .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -323,6 +327,7 @@ static struct radeon_asic rs600_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -370,6 +375,7 @@ static struct radeon_asic rs690_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -421,6 +427,7 @@ static struct radeon_asic rv515_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
@@ -463,6 +470,7 @@ static struct radeon_asic r520_asic = {
        .hpd_fini = &rs600_hpd_fini,
        .hpd_sense = &rs600_hpd_sense,
        .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 /*
@@ -504,6 +512,7 @@ void r600_hpd_fini(struct radeon_device *rdev);
 bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
 void r600_hpd_set_polarity(struct radeon_device *rdev,
                           enum radeon_hpd_id hpd);
+extern void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo);
 static struct radeon_asic r600_asic = {
        .init = &r600_init,
@@ -538,6 +547,7 @@ static struct radeon_asic r600_asic = {
        .hpd_fini = &r600_hpd_fini,
        .hpd_sense = &r600_hpd_sense,
        .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 /*
@@ -582,6 +592,7 @@ static struct radeon_asic rv770_asic = {
        .hpd_fini = &r600_hpd_fini,
        .hpd_sense = &r600_hpd_sense,
        .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 579c8920e081..e7b19440102e 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -971,8 +971,7 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
                         lvds->native_mode.vdisplay);
                lvds->panel_vcc_delay = RBIOS16(lcd_info + 0x2c);
-                if (lvds->panel_vcc_delay > 2000 || lvds->panel_vcc_delay < 0)
+                lvds->panel_vcc_delay = min_t(u16, lvds->panel_vcc_delay, 2000);
-                        lvds->panel_vcc_delay = 2000;
                lvds->panel_pwr_delay = RBIOS8(lcd_info + 0x24);
                lvds->panel_digon_delay = RBIOS16(lcd_info + 0x38) & 0xf;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 55266416fa47..2d8e5a70f284 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1343,7 +1343,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                radeon_connector->dac_load_detect = false;
                        drm_connector_attach_property(&radeon_connector->base,
                                                      rdev->mode_info.load_detect_property,
-                                                      1);
+                                                      radeon_connector->dac_load_detect);
                        drm_connector_attach_property(&radeon_connector->base,
                                                      rdev->mode_info.tv_std_property,
                                                      radeon_combios_get_tv_info(rdev));
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 0e1325e18534..db8e9a355a01 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -308,6 +308,9 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
        }
        robj = gobj->driver_private;
        r = radeon_bo_wait(robj, NULL, false);
+        /* callback hw specific functions if any */
+        if (robj->rdev->asic->ioctl_wait_idle)
+                robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
        mutex_lock(&dev->struct_mutex);
        drm_gem_object_unreference(gobj);
        mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 9f5418983e2a..287fcebfb4e6 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -223,15 +223,31 @@ int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
        return 0;
 }
+int rs400_mc_wait_for_idle(struct radeon_device *rdev)
+{
+        unsigned i;
+        uint32_t tmp;
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                /* read MC_STATUS */
+                tmp = RREG32(0x0150);
+                if (tmp & (1 << 2)) {
+                        return 0;
+                }
+                DRM_UDELAY(1);
+        }
+        return -1;
+}
 void rs400_gpu_init(struct radeon_device *rdev)
 {
        /* FIXME: HDP same place on rs400 ? */
        r100_hdp_reset(rdev);
        /* FIXME: is this correct ? */
        r420_pipes_init(rdev);
-        if (r300_mc_wait_for_idle(rdev)) {
+        if (rs400_mc_wait_for_idle(rdev)) {
-                printk(KERN_WARNING "Failed to wait MC idle while "
+                printk(KERN_WARNING "rs400: Failed to wait MC idle while "
-                       "programming pipes. Bad things might happen.\n");
+                       "programming pipes. Bad things might happen. %08x\n", RREG32(0x150));
        }
 }
@@ -370,8 +386,8 @@ void rs400_mc_program(struct radeon_device *rdev)
        r100_mc_stop(rdev, &save);
        /* Wait for mc idle */
-        if (r300_mc_wait_for_idle(rdev))
+        if (rs400_mc_wait_for_idle(rdev))
-                dev_warn(rdev->dev, "Wait MC idle timeout before updating MC.\n");
+                dev_warn(rdev->dev, "rs400: Wait MC idle timeout before updating MC.\n");
        WREG32(R_000148_MC_FB_LOCATION,
                S_000148_MC_FB_START(rdev->mc.vram_start >> 16) |
                S_000148_MC_FB_TOP(rdev->mc.vram_end >> 16));
@@ -448,7 +464,6 @@ int rs400_suspend(struct radeon_device *rdev)
 void rs400_fini(struct radeon_device *rdev)
 {
-        rs400_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -527,7 +542,6 @@ int rs400_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs400_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index d5255751e7b3..c3818562a13e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -610,7 +610,6 @@ int rs600_suspend(struct radeon_device *rdev)
 void rs600_fini(struct radeon_device *rdev)
 {
-        rs600_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -689,7 +688,6 @@ int rs600_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs600_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index cd31da913771..06e2771aee5a 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -676,7 +676,6 @@ int rs690_suspend(struct radeon_device *rdev)
 void rs690_fini(struct radeon_device *rdev)
 {
-        rs690_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -756,7 +755,6 @@ int rs690_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs690_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 62756717b044..0e1e6b8632b8 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -537,7 +537,6 @@ void rv515_set_safe_registers(struct radeon_device *rdev)
 void rv515_fini(struct radeon_device *rdev)
 {
-        rv515_suspend(rdev);
        r100_cp_fini(rdev);
        r100_wb_fini(rdev);
        r100_ib_fini(rdev);
@@ -615,13 +614,12 @@ int rv515_init(struct radeon_device *rdev)
        if (r) {
                /* Somethings want wront with the accel init stop accel */
                dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                r100_cp_fini(rdev);
                r100_wb_fini(rdev);
                r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv370_pcie_gart_fini(rdev);
                radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                rdev->accel_working = false;
        }
        return 0;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index afd9e8213c29..5943d561fd1e 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -887,6 +887,12 @@ static int rv770_startup(struct radeon_device *rdev)
                        return r;
        }
        rv770_gpu_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
        /* pin copy shader into vram */
        if (rdev->r600_blit.shader_obj) {
                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
@@ -1055,19 +1061,15 @@ int rv770_init(struct radeon_device *rdev)
        r = r600_pcie_gart_init(rdev);
        if (r)
                return r;
-        r = r600_blit_init(rdev);
-        if (r) {
-                r600_blit_fini(rdev);
-                rdev->asic->copy = NULL;
-                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
-        }
        rdev->accel_working = true;
        r = rv770_startup(rdev);
        if (r) {
-                rv770_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                rv770_pcie_gart_fini(rdev);
                rdev->accel_working = false;
        }
@@ -1089,13 +1091,11 @@ int rv770_init(struct radeon_device *rdev)
 void rv770_fini(struct radeon_device *rdev)
 {
-        rv770_suspend(rdev);
        r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
        r600_irq_fini(rdev);
        radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
        rv770_pcie_gart_fini(rdev);
        radeon_gem_fini(rdev);
        radeon_fence_driver_fini(rdev);
diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
index a31e77c776ae..b8156b4893bb 100644
--- a/drivers/hwmon/adt7462.c
+++ b/drivers/hwmon/adt7462.c
@@ -179,7 +179,7 @@ static const unsigned short normal_i2c[] = { 0x58, 0x5C, I2C_CLIENT_END };
 *
 * Some, but not all, of these voltages have low/high limits.
 */
-#define ADT7462_VOLT_COUNT      12
+#define ADT7462_VOLT_COUNT      13
 #define ADT7462_VENDOR          0x41
 #define ADT7462_DEVICE          0x62
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index cadcbd90ff3b..72ff2c4e757d 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -851,17 +851,16 @@ static struct lm78_data *lm78_update_device(struct device *dev)
 static int __init lm78_isa_found(unsigned short address)
 {
        int val, save, found = 0;
+        int port;
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
-        if (!request_region(address, 4, "lm78")) {
+         * to base+7 and some base+5 to base+6. So we better request each port
-                pr_debug("lm78: Failed to request low part of region\n");
+         * individually for the probing phase. */
-                return 0;
+        for (port = address; port < address + LM78_EXTENT; port++) {
-        }
+                if (!request_region(port, 1, "lm78")) {
-        if (!request_region(address + 4, 4, "lm78")) {
+                        pr_debug("lm78: Failed to request port 0x%x\n", port);
-                pr_debug("lm78: Failed to request high part of region\n");
+                        goto release;
-                release_region(address, 4);
+                }
-                return 0;
        }
 #define REALLY_SLOW_IO
@@ -925,8 +924,8 @@ static int __init lm78_isa_found(unsigned short address)
                        val & 0x80 ? "LM79" : "LM78", (int)address);
 release:
-        release_region(address + 4, 4);
+        for (port--; port >= address; port--)
-        release_region(address, 4);
+                release_region(port, 1);
        return found;
 }
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index 05f9225b6f94..32d4adee73db 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1793,17 +1793,17 @@ static int __init
 w83781d_isa_found(unsigned short address)
 {
        int val, save, found = 0;
+        int port;
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
-        if (!request_region(address, 4, "w83781d")) {
+         * to base+7 and some base+5 to base+6. So we better request each port
-                pr_debug("w83781d: Failed to request low part of region\n");
+         * individually for the probing phase. */
-                return 0;
+        for (port = address; port < address + W83781D_EXTENT; port++) {
-        }
+                if (!request_region(port, 1, "w83781d")) {
-        if (!request_region(address + 4, 4, "w83781d")) {
+                        pr_debug("w83781d: Failed to request port 0x%x\n",
-                pr_debug("w83781d: Failed to request high part of region\n");
+                                 port);
-                release_region(address, 4);
+                        goto release;
-                return 0;
+                }
        }
 #define REALLY_SLOW_IO
@@ -1877,8 +1877,8 @@ w83781d_isa_found(unsigned short address)
                        val == 0x30 ? "W83782D" : "W83781D", (int)address);
 release:
-        release_region(address + 4, 4);
+        for (port--; port >= address; port--)
-        release_region(address, 4);
+                release_region(port, 1);
        return found;
 }
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index b1c050ff311d..e29b6d5ba8ef 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/module.h>
+#include <linux/types.h>
 /* include interfaces to usb layer */
 #include <linux/usb.h>
@@ -31,8 +32,8 @@
 #define CMD_I2C_IO_END          (1<<1)
 /* i2c bit delay, default is 10us -> 100kHz */
-static int delay = 10;
+static unsigned short delay = 10;
-module_param(delay, int, 0);
+module_param(delay, ushort, 0);
 MODULE_PARM_DESC(delay, "bit delay in microseconds, "
                 "e.g. 10 for 100kHz (default is 100kHz)");
@@ -109,7 +110,7 @@ static int usb_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, int num)
 static u32 usb_func(struct i2c_adapter *adapter)
 {
-        u32 func;
+        __le32 func;
        /* get functionality from adapter */
        if (usb_read(adapter, CMD_GET_FUNC, 0, 0, &func, sizeof(func)) !=
@@ -118,7 +119,7 @@ static u32 usb_func(struct i2c_adapter *adapter)
                return 0;
        }
-        return func;
+        return le32_to_cpu(func);
 }
 /* This is the actual algorithm we define */
@@ -216,8 +217,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,
                 "i2c-tiny-usb at bus %03d device %03d",
                 dev->usb_dev->bus->busnum, dev->usb_dev->devnum);
-        if (usb_write(&dev->adapter, CMD_SET_DELAY,
+        if (usb_write(&dev->adapter, CMD_SET_DELAY, delay, 0, NULL, 0) != 0) {
-                      cpu_to_le16(delay), 0, NULL, 0) != 0) {
                dev_err(&dev->adapter.dev,
                        "failure setting delay to %dus\n", delay);
                retval = -EIO;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dd3dfe42d5a9..a20a71e5efd3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4075,8 +4075,10 @@ static void mddev_delayed_delete(struct work_struct *ws)
 {
        mddev_t *mddev = container_of(ws, mddev_t, del_work);
-        if (mddev->private == &md_redundancy_group) {
+        if (mddev->private) {
                sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->private != (void*)1)
+                        sysfs_remove_group(&mddev->kobj, mddev->private);
                if (mddev->sysfs_action)
                        sysfs_put(mddev->sysfs_action);
                mddev->sysfs_action = NULL;
@@ -4287,10 +4289,7 @@ static int do_md_run(mddev_t * mddev)
                sysfs_notify_dirent(rdev->sysfs_state);
        }
-        md_probe(mddev->unit, NULL, NULL);
        disk = mddev->gendisk;
-        if (!disk)
-                return -ENOMEM;
        spin_lock(&pers_lock);
        pers = find_pers(mddev->level, mddev->clevel);
@@ -4530,8 +4529,8 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                        mddev->queue->unplug_fn = NULL;
                        mddev->queue->backing_dev_info.congested_fn = NULL;
                        module_put(mddev->pers->owner);
-                        if (mddev->pers->sync_request)
+                        if (mddev->pers->sync_request && mddev->private == NULL)
-                                mddev->private = &md_redundancy_group;
+                                mddev->private = (void*)1;
                        mddev->pers = NULL;
                        /* tell userspace to handle 'inactive' */
                        sysfs_notify_dirent(mddev->sysfs_state);
@@ -4578,9 +4577,6 @@ out:
                }
                mddev->bitmap_info.offset = 0;
-                /* make sure all md_delayed_delete calls have finished */
-                flush_scheduled_work();
                export_array(mddev);
                mddev->array_sectors = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e84204eb12df..ceb24afdc147 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5136,9 +5136,8 @@ static int stop(mddev_t *mddev)
        mddev->thread = NULL;
        mddev->queue->backing_dev_info.congested_fn = NULL;
        blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
-        sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
        free_conf(conf);
-        mddev->private = NULL;
+        mddev->private = &raid5_attrs_group;
        return 0;
 }
@@ -5464,11 +5463,11 @@ static int raid5_start_reshape(mddev_t *mddev)
                    !test_bit(Faulty, &rdev->flags)) {
                        if (raid5_add_disk(mddev, rdev) == 0) {
                                char nm[20];
-                                if (rdev->raid_disk >= conf->previous_raid_disks)
+                                if (rdev->raid_disk >= conf->previous_raid_disks) {
                                        set_bit(In_sync, &rdev->flags);
-                                else
+                                        added_devices++;
+                                } else
                                        rdev->recovery_offset = 0;
-                                added_devices++;
                                sprintf(nm, "rd%d", rdev->raid_disk);
                                if (sysfs_create_link(&mddev->kobj,
                                                      &rdev->kobj, nm))
@@ -5480,9 +5479,12 @@ static int raid5_start_reshape(mddev_t *mddev)
                                break;
                }
+        /* When a reshape changes the number of devices, ->degraded
+         * is measured against the large of the pre and post number of
+         * devices.*/
        if (mddev->delta_disks > 0) {
                spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = (conf->raid_disks - conf->previous_raid_disks)
+                mddev->degraded += (conf->raid_disks - conf->previous_raid_disks)
                        - added_devices;
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index becbaadb3b77..5ed75263340a 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -1333,9 +1333,9 @@ static void buffer_release(struct videobuf_queue *q, struct videobuf_buffer *vb)
        DEB_CAP(("vbuf:%p\n",vb));
-        release_all_pagetables(dev, buf);
        saa7146_dma_free(dev,q,buf);
+        release_all_pagetables(dev, buf);
 }
 static struct videobuf_queue_ops video_qops = {
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index c37790ad92d0..9ddc57909d49 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
        dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192);
        dmxdevfilter->type = DMXDEV_TYPE_NONE;
        dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED);
-        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
        init_timer(&dmxdevfilter->timer);
        dvbdev->users++;
@@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(struct dmxdev *dmxdev,
        dmxdevfilter->type = DMXDEV_TYPE_PES;
        memcpy(&dmxdevfilter->params, params,
               sizeof(struct dmx_pes_filter_params));
+        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
        dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET);
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index b78cfb7d1897..67f189b7aa1f 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -426,16 +426,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                };
        };
-        if (dvb_demux_tscheck) {
+        if (demux->cnt_storage) {
-                if (!demux->cnt_storage)
-                        demux->cnt_storage = vmalloc(MAX_PID + 1);
-                if (!demux->cnt_storage) {
-                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
-                        dvb_demux_tscheck = 0;
-                        goto no_dvb_demux_tscheck;
-                }
                /* check pkt counter */
                if (pid < MAX_PID) {
                        if (buf[1] & 0x80)
@@ -454,7 +445,6 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                };
                /* end check */
        };
-no_dvb_demux_tscheck:
        list_for_each_entry(feed, &demux->feed_list, list_head) {
                if ((feed->pid != pid) && (feed->pid != 0x2000))
@@ -1246,6 +1236,7 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
        dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
        if (!dvbdemux->feed) {
                vfree(dvbdemux->filter);
+                dvbdemux->filter = NULL;
                return -ENOMEM;
        }
        for (i = 0; i < dvbdemux->filternum; i++) {
@@ -1257,6 +1248,13 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
                dvbdemux->feed[i].index = i;
        }
+        if (dvb_demux_tscheck) {
+                dvbdemux->cnt_storage = vmalloc(MAX_PID + 1);
+                if (!dvbdemux->cnt_storage)
+                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
+        }
        INIT_LIST_HEAD(&dvbdemux->frontend_list);
        for (i = 0; i < DMX_TS_PES_OTHER; i++) {
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 7dfecfc6017c..ee5bff02a92c 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -93,9 +93,9 @@ static int ts_open(struct file *file)
        dprintk("open dev=%s\n", video_device_node_name(vdev));
        err = -EBUSY;
        if (!mutex_trylock(&dev->empress_tsq.vb_lock))
-                goto done;
+                return err;
        if (atomic_read(&dev->empress_users))
-                goto done_up;
+                goto done;
        /* Unmute audio */
        saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
@@ -105,10 +105,8 @@ static int ts_open(struct file *file)
        file->private_data = dev;
        err = 0;
-done_up:
-        mutex_unlock(&dev->empress_tsq.vb_lock);
 done:
-        unlock_kernel();
+        mutex_unlock(&dev->empress_tsq.vb_lock);
        return err;
 }
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index b9f1e84897cc..e7f8027165e6 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -74,6 +74,9 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
        }
        mrq->cmd->arg = dev_addr;
+        if (!mmc_card_blockaddr(test->card))
+                mrq->cmd->arg <<= 9;
        mrq->cmd->flags = MMC_RSP_R1 | MMC_CMD_ADTC;
        if (blocks == 1)
@@ -190,7 +193,7 @@ static int __mmc_test_prepare(struct mmc_test_card *test, int write)
        }
        for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                if (ret)
                        return ret;
        }
@@ -219,7 +222,7 @@ static int mmc_test_cleanup(struct mmc_test_card *test)
        memset(test->buffer, 0, 512);
        for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                if (ret)
                        return ret;
        }
@@ -426,7 +429,7 @@ static int mmc_test_transfer(struct mmc_test_card *test,
                for (i = 0;i < sectors;i++) {
                        ret = mmc_test_buffer_transfer(test,
                                test->buffer + i * 512,
-                                dev_addr + i * 512, 512, 0);
+                                dev_addr + i, 512, 0);
                        if (ret)
                                return ret;
                }
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 62d9c9cc5671..1dd4403247ca 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -921,7 +921,7 @@ static int ax_probe(struct platform_device *pdev)
                size = (res->end - res->start) + 1;
                ax->mem2 = request_mem_region(res->start, size, pdev->name);
-                if (ax->mem == NULL) {
+                if (ax->mem2 == NULL) {
                        dev_err(&pdev->dev, "cannot reserve registers\n");
                        ret = -ENXIO;
                        goto exit_mem1;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 9fd8e5ecd5d7..5bc74590c73e 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -276,8 +276,13 @@ struct be_adapter {
        int link_speed;
        u8 port_type;
        u8 transceiver;
+        u8 generation;          /* BladeEngine ASIC generation */
 };
+/* BladeEngine Generation numbers */
+#define BE_GEN2 2
+#define BE_GEN3 3
 extern const struct ethtool_ops be_ethtool_ops;
 #define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index c002b8391b4d..13b33c841083 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -164,7 +164,8 @@ struct be_cmd_req_hdr {
        u8 domain;              /* dword 0 */
        u32 timeout;            /* dword 1 */
        u32 request_length;     /* dword 2 */
-        u32 rsvd;               /* dword 3 */
+        u8 version;             /* dword 3 */
+        u8 rsvd[3];             /* dword 3 */
 };
 #define RESP_HDR_INFO_OPCODE_SHIFT      0       /* bits 0 - 7 */
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 33ab8c7f14fe..626b76c0ebc7 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1350,7 +1350,7 @@ static irqreturn_t be_intx(int irq, void *dev)
        int isr;
        isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-                        be_pci_func(adapter) * CEV_ISR_SIZE);
+                (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
        if (!isr)
                return IRQ_NONE;
@@ -2051,6 +2051,7 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
        u8 __iomem *addr;
+        int pcicfg_reg;
        addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
                        pci_resource_len(adapter->pdev, 2));
@@ -2064,8 +2065,13 @@ static int be_map_pci_bars(struct be_adapter *adapter)
                goto pci_map_err;
        adapter->db = addr;
-        addr = ioremap_nocache(pci_resource_start(adapter->pdev, 1),
+        if (adapter->generation == BE_GEN2)
-                        pci_resource_len(adapter->pdev, 1));
+                pcicfg_reg = 1;
+        else
+                pcicfg_reg = 0;
+        addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+                        pci_resource_len(adapter->pdev, pcicfg_reg));
        if (addr == NULL)
                goto pci_map_err;
        adapter->pcicfg = addr;
@@ -2162,6 +2168,7 @@ static int be_stats_init(struct be_adapter *adapter)
        cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
        if (cmd->va == NULL)
                return -1;
+        memset(cmd->va, 0, cmd->size);
        return 0;
 }
@@ -2240,6 +2247,20 @@ static int __devinit be_probe(struct pci_dev *pdev,
                goto rel_reg;
        }
        adapter = netdev_priv(netdev);
+        switch (pdev->device) {
+        case BE_DEVICE_ID1:
+        case OC_DEVICE_ID1:
+                adapter->generation = BE_GEN2;
+                break;
+        case BE_DEVICE_ID2:
+        case OC_DEVICE_ID2:
+                adapter->generation = BE_GEN3;
+                break;
+        default:
+                adapter->generation = 0;
+        }
        adapter->pdev = pdev;
        pci_set_drvdata(pdev, adapter);
        adapter->netdev = netdev;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3f0071cfe56b..efa0e41bf3ec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3639,7 +3639,7 @@ static int bond_open(struct net_device *bond_dev)
                 */
                if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
                        /* something went wrong - fail the open operation */
-                        return -1;
+                        return -ENOMEM;
                }
                INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index bdbd14727e4b..318a018ca7c5 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2079,6 +2079,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                         struct sge_fl *fl, int len, int complete)
 {
        struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
+        struct port_info *pi = netdev_priv(qs->netdev);
        struct sk_buff *skb = NULL;
        struct cpl_rx_pkt *cpl;
        struct skb_frag_struct *rx_frag;
@@ -2116,11 +2117,18 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
        if (!nr_frags) {
                offset = 2 + sizeof(struct cpl_rx_pkt);
-                qs->lro_va = sd->pg_chunk.va + 2;
+                cpl = qs->lro_va = sd->pg_chunk.va + 2;
-        }
-        len -= offset;
-        prefetch(qs->lro_va);
+                if ((pi->rx_offload & T3_RX_CSUM) &&
+                     cpl->csum_valid && cpl->csum == htons(0xffff)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
+                } else
+                        skb->ip_summed = CHECKSUM_NONE;
+        } else
+                cpl = qs->lro_va;
+        len -= offset;
        rx_frag += nr_frags;
        rx_frag->page = sd->pg_chunk.page;
@@ -2136,12 +2144,8 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                return;
        skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        cpl = qs->lro_va;
        if (unlikely(cpl->vlan_valid)) {
-                struct net_device *dev = qs->netdev;
-                struct port_info *pi = netdev_priv(dev);
                struct vlan_group *grp = pi->vlan_grp;
                if (likely(grp != NULL)) {
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 997124d2992a..c881347cb26d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
                        msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
                if (tx_queue > IGB_N0_QUEUE)
                        msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+                if (!adapter->msix_entries && msix_vector == 0)
+                        msixbm |= E1000_EIMS_OTHER;
                array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
                q_vector->eims_value = msixbm;
                break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
 {
        struct net_device *netdev = adapter->netdev;
        struct pci_dev *pdev = adapter->pdev;
-        struct e1000_hw *hw = &adapter->hw;
        int err = 0;
        if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
                igb_setup_all_tx_resources(adapter);
                igb_setup_all_rx_resources(adapter);
        } else {
-                switch (hw->mac.type) {
+                igb_assign_vector(adapter->q_vector[0], 0);
-                case e1000_82575:
-                        wr32(E1000_MSIXBM(0),
-                             (E1000_EICR_RX_QUEUE0 |
-                              E1000_EICR_TX_QUEUE0 |
-                              E1000_EIMS_OTHER));
-                        break;
-                case e1000_82580:
-                case e1000_82576:
-                        wr32(E1000_IVAR0, E1000_IVAR_VALID);
-                        break;
-                default:
-                        break;
-                }
        }
        if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
        }
        if (adapter->msix_entries)
                igb_configure_msix(adapter);
+        else
+                igb_assign_vector(adapter->q_vector[0], 0);
        /* Clear any pending interrupts. */
        rd32(E1000_ICR);
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 297a5ddd77f0..2aa71a766c35 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -2117,6 +2117,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
        /* set time_stamp *before* dma to help avoid a possible race */
        buffer_info->time_stamp = jiffies;
        buffer_info->next_to_watch = i;
+        buffer_info->mapped_as_page = false;
        buffer_info->dma = pci_map_single(pdev, skb->data, len,
                                          PCI_DMA_TODEVICE);
        if (pci_dma_mapping_error(pdev, buffer_info->dma))
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 56f37f66b696..dd4883f642be 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -223,7 +223,7 @@ static void ixgbe_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id,
        if (adapter->temp_dcb_cfg.bw_percentage[0][bwg_id] !=
            adapter->dcb_cfg.bw_percentage[0][bwg_id]) {
-                adapter->dcb_set_bitmap |= BIT_PG_RX;
+                adapter->dcb_set_bitmap |= BIT_PG_TX;
                adapter->dcb_set_bitmap |= BIT_RESETLINK;
        }
 }
@@ -341,6 +341,12 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
        if (!adapter->dcb_set_bitmap)
                return DCB_NO_HW_CHG;
+        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
+                                 adapter->ring_feature[RING_F_DCB].indices);
+        if (ret)
+                return DCB_NO_HW_CHG;
        /*
         * Only take down the adapter if the configuration change
         * requires a reset.
@@ -359,14 +365,6 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
                }
        }
-        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
-                                 adapter->ring_feature[RING_F_DCB].indices);
-        if (ret) {
-                if (adapter->dcb_set_bitmap & BIT_RESETLINK)
-                        clear_bit(__IXGBE_RESETTING, &adapter->state);
-                return DCB_NO_HW_CHG;
-        }
        if (adapter->dcb_cfg.pfc_mode_enable) {
                if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
                        (adapter->hw.fc.current_mode != ixgbe_fc_pfc))
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b5f64ad67975..7b7c8486c0bf 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5179,7 +5179,7 @@ dma_error:
                ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
        }
-        return count;
+        return 0;
 }
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
@@ -5329,8 +5329,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
        struct ixgbe_adapter *adapter = netdev_priv(dev);
        int txq = smp_processor_id();
-        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE)
+        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
+                while (unlikely(txq >= dev->real_num_tx_queues))
+                        txq -= dev->real_num_tx_queues;
                return txq;
+        }
 #ifdef IXGBE_FCOE
        if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
index c146304d8d6c..c0ceebccaa49 100644
--- a/drivers/net/ks8851_mll.c
+++ b/drivers/net/ks8851_mll.c
@@ -854,8 +854,8 @@ static void ks_update_link_status(struct net_device *netdev, struct ks_net *ks)
 static irqreturn_t ks_irq(int irq, void *pw)
 {
-        struct ks_net *ks = pw;
+        struct net_device *netdev = pw;
-        struct net_device *netdev = ks->netdev;
+        struct ks_net *ks = netdev_priv(netdev);
        u16 status;
        /*this should be the first in IRQ handler */
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f9d6081959b..24279e6e55f5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1941,7 +1941,7 @@ static void netxen_tx_timeout_task(struct work_struct *work)
                netif_wake_queue(adapter->netdev);
                clear_bit(__NX_RESETTING, &adapter->state);
+                return;
        } else {
                clear_bit(__NX_RESETTING, &adapter->state);
                if (!netxen_nic_reset_context(adapter)) {
@@ -2240,7 +2240,9 @@ netxen_detach_work(struct work_struct *work)
        netxen_nic_down(adapter, netdev);
+        rtnl_lock();
        netxen_nic_detach(adapter);
+        rtnl_unlock();
        status = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d760650c5c04..67249c3c9f50 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1025,11 +1025,8 @@ static void sky2_prefetch_init(struct sky2_hw *hw, u32 qaddr,
 static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
 {
        struct sky2_tx_le *le = sky2->tx_le + *slot;
-        struct tx_ring_info *re = sky2->tx_ring + *slot;
        *slot = RING_NEXT(*slot, sky2->tx_ring_size);
-        re->flags = 0;
-        re->skb = NULL;
        le->ctrl = 0;
        return le;
 }
@@ -1622,8 +1619,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
        return count;
 }
-static void sky2_tx_unmap(struct pci_dev *pdev,
+static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
-                          const struct tx_ring_info *re)
 {
        if (re->flags & TX_MAP_SINGLE)
                pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
@@ -1633,6 +1629,7 @@ static void sky2_tx_unmap(struct pci_dev *pdev,
                pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
                               pci_unmap_len(re, maplen),
                               PCI_DMA_TODEVICE);
+        re->flags = 0;
 }
 /*
@@ -1839,6 +1836,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
                        dev->stats.tx_packets++;
                        dev->stats.tx_bytes += skb->len;
+                        re->skb = NULL;
                        dev_kfree_skb_any(skb);
                        sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 95db60adde41..f9521136a869 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device *dev)
        if (retval) {
                printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
                       FIRMWARE_RX);
-                return retval;
+                goto out_init;
        }
        if (fw_rx->size % 4) {
                printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
@@ -1108,6 +1108,9 @@ out_tx:
        release_firmware(fw_tx);
 out_rx:
        release_firmware(fw_rx);
+out_init:
+        if (retval)
+                netdev_close(dev);
        return retval;
 }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 21e183a83b99..4f27f022fbf7 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -419,7 +419,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 static const struct driver_info cdc_info = {
        .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER | FLAG_LINK_INTR,
+        .flags =        FLAG_ETHER,
        // .check_connect = cdc_check_connect,
        .bind =         cdc_bind,
        .unbind =       usbnet_cdc_unbind,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2ec61f08cfdb..ae371448b5a0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -855,12 +855,11 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
        }
 }
-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
+static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
 {
        u32 i, j;
-        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
+        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
-            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
                /* EEPROM Fixup */
                for (i = 0; i < ah->iniModes.ia_rows; i++) {
@@ -980,7 +979,7 @@ int ath9k_hw_init(struct ath_hw *ah)
        if (r)
                return r;
-        ath9k_hw_init_11a_eeprom_fix(ah);
+        ath9k_hw_init_eeprom_fix(ah);
        r = ath9k_hw_init_macaddr(ah);
        if (r) {
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 996eb90263cc..643bea35686f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2655,10 +2655,10 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
            (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
                ath9k_ps_wakeup(sc);
                ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-                ath_beacon_return(sc, avp);
                ath9k_ps_restore(sc);
        }
+        ath_beacon_return(sc, avp);
        sc->sc_flags &= ~SC_OP_BEACONS;
        for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index cde09a890b73..90fbdb25399e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -297,7 +297,7 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
 }
 EXPORT_SYMBOL(iwl_add_station);
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
 {
        unsigned long flags;
        u8 sta_id = iwl_find_station(priv, addr);
@@ -324,7 +324,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 {
        struct iwl_rem_sta_cmd *rm_sta =
                        (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const char *addr = rm_sta->addr;
+        const u8 *addr = rm_sta->addr;
        if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c74694345b6e..d58b94030ef3 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -338,6 +338,23 @@ static void __devinit quirk_s3_64M(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_868,           quirk_s3_64M);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_968,           quirk_s3_64M);
+/*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33  20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
+ */
+static void __devinit quirk_cs5536_vsa(struct pci_dev *dev)
+{
+        if (pci_resource_len(dev, 0) != 8) {
+                struct resource *res = &dev->resource[0];
+                res->end = res->start + 8 - 1;
+                dev_info(&dev->dev, "CS5536 ISA bridge bug detected "
+                                "(incorrect header); workaround applied.\n");
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
 static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
        unsigned size, int nr, const char *name)
 {
diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
index 3a7be11cc6b9..812c66755083 100644
--- a/drivers/rtc/rtc-fm3130.c
+++ b/drivers/rtc/rtc-fm3130.c
@@ -376,20 +376,22 @@ static int __devinit fm3130_probe(struct i2c_client *client,
        }
        /* Disabling calibration mode */
-        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL)
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL) {
                i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                        fm3130->regs[FM3130_RTC_CONTROL] &
                                ~(FM3130_RTC_CONTROL_BIT_CAL));
                dev_warn(&client->dev, "Disabling calibration mode!\n");
+        }
        /* Disabling read and write modes */
        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_WRITE ||
-            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ)
+            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ) {
                i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                        fm3130->regs[FM3130_RTC_CONTROL] &
                                ~(FM3130_RTC_CONTROL_BIT_READ |
                                        FM3130_RTC_CONTROL_BIT_WRITE));
                dev_warn(&client->dev, "Disabling READ or WRITE mode!\n");
+        }
        /* oscillator off?  turn it on, so clock can tick. */
        if (fm3130->regs[FM3130_CAL_CONTROL] & FM3130_CAL_CONTROL_BIT_nOSCEN)
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 999fe80c4051..62b654af9237 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -531,7 +531,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
        qdio_siga_sync_q(q);
        get_buf_state(q, q->first_to_check, &state, 0);
-        if (state == SLSB_P_INPUT_PRIMED)
+        if (state == SLSB_P_INPUT_PRIMED || state == SLSB_P_INPUT_ERROR)
                /* more work coming */
                return 0;
@@ -960,6 +960,8 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                        qdio_handle_activate_check(cdev, intparm, cstat,
                                                   dstat);
                break;
+        case QDIO_IRQ_STATE_STOPPED:
+                break;
        default:
                WARN_ON(1);
        }
diff --git a/drivers/serial/uartlite.c b/drivers/serial/uartlite.c
index 377f2712289e..ab2ab3c81834 100644
--- a/drivers/serial/uartlite.c
+++ b/drivers/serial/uartlite.c
@@ -394,7 +394,7 @@ static void ulite_console_write(struct console *co, const char *s,
                spin_unlock_irqrestore(&port->lock, flags);
 }
-static int __init ulite_console_setup(struct console *co, char *options)
+static int __devinit ulite_console_setup(struct console *co, char *options)
 {
        struct uart_port *port;
        int baud = 9600;
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index 0ceec123ddfd..bee558aed427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -35,7 +35,9 @@
 #include <linux/usb.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/mm.h>
 #include <linux/irq.h>
+#include <asm/cacheflush.h>
 #include "../core/hcd.h"
 #include "r8a66597.h"
@@ -820,6 +822,26 @@ static void enable_r8a66597_pipe(struct r8a66597 *r8a66597, struct urb *urb,
        enable_r8a66597_pipe_dma(r8a66597, dev, pipe, urb);
 }
+static void r8a66597_urb_done(struct r8a66597 *r8a66597, struct urb *urb,
+                              int status)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) {
+                void *ptr;
+                for (ptr = urb->transfer_buffer;
+                     ptr < urb->transfer_buffer + urb->transfer_buffer_length;
+                     ptr += PAGE_SIZE)
+                        flush_dcache_page(virt_to_page(ptr));
+        }
+        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
+        spin_unlock(&r8a66597->lock);
+        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb, status);
+        spin_lock(&r8a66597->lock);
+}
 /* this function must be called with interrupt disabled */
 static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
 {
@@ -838,15 +860,9 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
                list_del(&td->queue);
                kfree(td);
-                if (urb) {
+                if (urb)
-                        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
+                        r8a66597_urb_done(r8a66597, urb, -ENODEV);
-                                        urb);
-                        spin_unlock(&r8a66597->lock);
-                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb,
-                                        -ENODEV);
-                        spin_lock(&r8a66597->lock);
-                }
                break;
        }
 }
@@ -1006,6 +1022,8 @@ static void start_root_hub_sampling(struct r8a66597 *r8a66597, int port,
 /* this function must be called with interrupt disabled */
 static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                                        u16 syssts)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
 {
        if (syssts == SE0) {
                r8a66597_write(r8a66597, ~ATTCH, get_intsts_reg(port));
@@ -1023,7 +1041,9 @@ static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                        usb_hcd_resume_root_hub(r8a66597_to_hcd(r8a66597));
        }
+        spin_unlock(&r8a66597->lock);
        usb_hcd_poll_rh_status(r8a66597_to_hcd(r8a66597));
+        spin_lock(&r8a66597->lock);
 }
 /* this function must be called with interrupt disabled */
@@ -1283,10 +1303,7 @@ __releases(r8a66597->lock) __acquires(r8a66597->lock)
                if (usb_pipeisoc(urb->pipe))
                        urb->start_frame = r8a66597_get_frame(hcd);
-                usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
+                r8a66597_urb_done(r8a66597, urb, status);
-                spin_unlock(&r8a66597->lock);
-                usb_hcd_giveback_urb(hcd, urb, status);
-                spin_lock(&r8a66597->lock);
        }
        if (restart) {
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index 66358fa825f3..b4b6deceed15 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -593,7 +593,8 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
 */
 static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
        pr_debug("%s\n", __func__);
@@ -603,7 +604,8 @@ static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 static int imxfb_resume(struct platform_device *dev)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
        pr_debug("%s\n", __func__);
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 054ef29be479..772ba3f45e6f 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -324,8 +324,11 @@ static void sdc_enable_channel(struct mx3fb_info *mx3_fbi)
        unsigned long flags;
        dma_cookie_t cookie;
-        dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+        if (mx3_fbi->txd)
-                to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+                dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+                        to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+        else
+                dev_dbg(mx3fb->dev, "mx3fbi %p, txd = NULL\n", mx3_fbi);
        /* This enables the channel */
        if (mx3_fbi->cookie < 0) {
@@ -646,6 +649,7 @@ static int sdc_set_global_alpha(struct mx3fb_data *mx3fb, bool enable, uint8_t a
 static void sdc_set_brightness(struct mx3fb_data *mx3fb, uint8_t value)
 {
+        dev_dbg(mx3fb->dev, "%s: value = %d\n", __func__, value);
        /* This might be board-specific */
        mx3fb_write_reg(mx3fb, 0x03000000UL | value << 16, SDC_PWM_CTRL);
        return;
@@ -1486,12 +1490,12 @@ static int mx3fb_probe(struct platform_device *pdev)
                goto ersdc0;
        }
+        mx3fb->backlight_level = 255;
        ret = init_fb_chan(mx3fb, to_idmac_chan(chan));
        if (ret < 0)
                goto eisdc0;
-        mx3fb->backlight_level = 255;
        return 0;
 eisdc0:
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index cf62b05e296a..7d6c2139891d 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -84,7 +84,7 @@ static const match_table_t tokens = {
 static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
 {
-        char *options;
+        char *options, *tmp_options;
        substring_t args[MAX_OPT_ARGS];
        char *p;
        int option = 0;
@@ -102,9 +102,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
        if (!opts)
                return 0;
-        options = kstrdup(opts, GFP_KERNEL);
+        tmp_options = kstrdup(opts, GFP_KERNEL);
-        if (!options)
+        if (!tmp_options) {
+                ret = -ENOMEM;
                goto fail_option_alloc;
+        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -159,8 +162,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                        break;
                case Opt_cache:
                        s = match_strdup(&args[0]);
-                        if (!s)
+                        if (!s) {
-                                goto fail_option_alloc;
+                                ret = -ENOMEM;
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                  "problem allocating copy of cache arg\n");
+                                goto free_and_return;
+                        }
                        if (strcmp(s, "loose") == 0)
                                v9ses->cache = CACHE_LOOSE;
@@ -173,8 +180,12 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                case Opt_access:
                        s = match_strdup(&args[0]);
-                        if (!s)
+                        if (!s) {
-                                goto fail_option_alloc;
+                                ret = -ENOMEM;
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                  "problem allocating copy of access arg\n");
+                                goto free_and_return;
+                        }
                        v9ses->flags &= ~V9FS_ACCESS_MASK;
                        if (strcmp(s, "user") == 0)
@@ -194,13 +205,11 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts)
                        continue;
                }
        }
-        kfree(options);
-        return ret;
+free_and_return:
+        kfree(tmp_options);
 fail_option_alloc:
-        P9_DPRINTK(P9_DEBUG_ERROR,
+        return ret;
-                   "failed to allocate copy of option argument\n");
-        return -ENOMEM;
 }
 /**
diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
index 3a7560e35865..ed835836e0dc 100644
--- a/fs/9p/v9fs_vfs.h
+++ b/fs/9p/v9fs_vfs.h
@@ -60,3 +60,4 @@ void v9fs_dentry_release(struct dentry *);
 int v9fs_uflags2omode(int uflags, int extended);
 ssize_t v9fs_file_readn(struct file *, char *, char __user *, u32, u64);
+void v9fs_blank_wstat(struct p9_wstat *wstat);
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 3902bf43a088..74a0461a9ac0 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -257,6 +257,23 @@ v9fs_file_write(struct file *filp, const char __user * data,
        return total;
 }
+static int v9fs_file_fsync(struct file *filp, struct dentry *dentry,
+                                        int datasync)
+{
+        struct p9_fid *fid;
+        struct p9_wstat wstat;
+        int retval;
+        P9_DPRINTK(P9_DEBUG_VFS, "filp %p dentry %p datasync %x\n", filp,
+                                                dentry, datasync);
+        fid = filp->private_data;
+        v9fs_blank_wstat(&wstat);
+        retval = p9_client_wstat(fid, &wstat);
+        return retval;
+}
 static const struct file_operations v9fs_cached_file_operations = {
        .llseek = generic_file_llseek,
        .read = do_sync_read,
@@ -266,6 +283,7 @@ static const struct file_operations v9fs_cached_file_operations = {
        .release = v9fs_dir_release,
        .lock = v9fs_file_lock,
        .mmap = generic_file_readonly_mmap,
+        .fsync = v9fs_file_fsync,
 };
 const struct file_operations v9fs_file_operations = {
@@ -276,4 +294,5 @@ const struct file_operations v9fs_file_operations = {
        .release = v9fs_dir_release,
        .lock = v9fs_file_lock,
        .mmap = generic_file_readonly_mmap,
+        .fsync = v9fs_file_fsync,
 };
diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 9d03d1ebca6f..a407fa3388c0 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -176,7 +176,7 @@ int v9fs_uflags2omode(int uflags, int extended)
 *
 */
-static void
+void
 v9fs_blank_wstat(struct p9_wstat *wstat)
 {
        wstat->type = ~0;
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 33baf27fac78..34ddda888e63 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -873,6 +873,7 @@ befs_fill_super(struct super_block *sb, void *data, int silent)
        brelse(bh);
      unacquire_priv_sbp:
+        kfree(befs_sb->mount_opts.iocharset);
        kfree(sb->s_fs_info);
      unacquire_none:
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 73d6a735b8f3..d11d0289f3d2 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -246,7 +246,8 @@ struct super_block *freeze_bdev(struct block_device *bdev)
        if (!sb)
                goto out;
        if (sb->s_flags & MS_RDONLY) {
-                deactivate_locked_super(sb);
+                sb->s_frozen = SB_FREEZE_TRANS;
+                up_write(&sb->s_umount);
                mutex_unlock(&bdev->bd_fsfreeze_mutex);
                return sb;
        }
@@ -307,7 +308,7 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
        BUG_ON(sb->s_bdev != bdev);
        down_write(&sb->s_umount);
        if (sb->s_flags & MS_RDONLY)
-                goto out_deactivate;
+                goto out_unfrozen;
        if (sb->s_op->unfreeze_fs) {
                error = sb->s_op->unfreeze_fs(sb);
@@ -321,11 +322,11 @@ int thaw_bdev(struct block_device *bdev, struct super_block *sb)
                }
        }
+out_unfrozen:
        sb->s_frozen = SB_UNFROZEN;
        smp_wmb();
        wake_up(&sb->s_wait_unfrozen);
-out_deactivate:
        if (sb)
                deactivate_locked_super(sb);
 out_unlock:
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 87b25543d7d1..2b59201b955c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1982,7 +1982,12 @@ struct btrfs_root *open_ctree(struct super_block *sb,
        if (!(sb->s_flags & MS_RDONLY)) {
                ret = btrfs_recover_relocation(tree_root);
-                BUG_ON(ret);
+                if (ret < 0) {
+                        printk(KERN_WARNING
+                               "btrfs: failed to recover relocation\n");
+                        err = -EINVAL;
+                        goto fail_trans_kthread;
+                }
        }
        location.objectid = BTRFS_FS_TREE_OBJECTID;
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 432a2da4641e..559f72489b3b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5402,10 +5402,6 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
        int ret;
        while (level >= 0) {
-                if (path->slots[level] >=
-                    btrfs_header_nritems(path->nodes[level]))
-                        break;
                ret = walk_down_proc(trans, root, path, wc, lookup_info);
                if (ret > 0)
                        break;
@@ -5413,6 +5409,10 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                if (level == 0)
                        break;
+                if (path->slots[level] >=
+                    btrfs_header_nritems(path->nodes[level]))
+                        break;
                ret = do_walk_down(trans, root, path, wc, &lookup_info);
                if (ret > 0) {
                        path->slots[level]++;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 96577e8bf9fd..b177ed319612 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3165,10 +3165,9 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                spin_unlock(&tree->buffer_lock);
                goto free_eb;
        }
-        spin_unlock(&tree->buffer_lock);
        /* add one reference for the tree */
        atomic_inc(&eb->refs);
+        spin_unlock(&tree->buffer_lock);
        return eb;
 free_eb:
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index c02033596f02..9d0809629967 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1133,7 +1133,7 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
        }
        mutex_lock(&dentry->d_inode->i_mutex);
 out:
-        return ret > 0 ? EIO : ret;
+        return ret > 0 ? -EIO : ret;
 }
 static const struct vm_operations_struct btrfs_file_vm_ops = {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8cd109972fa6..4deb280f8969 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1681,24 +1681,6 @@ static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
 * before we start the transaction.  It limits the amount of btree
 * reads required while inside the transaction.
 */
-static noinline void reada_csum(struct btrfs_root *root,
-                                struct btrfs_path *path,
-                                struct btrfs_ordered_extent *ordered_extent)
-{
-        struct btrfs_ordered_sum *sum;
-        u64 bytenr;
-        sum = list_entry(ordered_extent->list.next, struct btrfs_ordered_sum,
-                         list);
-        bytenr = sum->sums[0].bytenr;
-        /*
-         * we don't care about the results, the point of this search is
-         * just to get the btree leaves into ram
-         */
-        btrfs_lookup_csum(NULL, root->fs_info->csum_root, path, bytenr, 0);
-}
 /* as ordered data IO finishes, this gets called so we can finish
 * an ordered extent if the range of bytes in the file it covers are
 * fully written.
@@ -1709,7 +1691,6 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
        struct btrfs_trans_handle *trans;
        struct btrfs_ordered_extent *ordered_extent = NULL;
        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
-        struct btrfs_path *path;
        int compressed = 0;
        int ret;
@@ -1717,32 +1698,9 @@ static int btrfs_finish_ordered_io(struct inode *inode, u64 start, u64 end)
        if (!ret)
                return 0;
-        /*
+        ordered_extent = btrfs_lookup_ordered_extent(inode, start);
-         * before we join the transaction, try to do some of our IO.
-         * This will limit the amount of IO that we have to do with
-         * the transaction running.  We're unlikely to need to do any
-         * IO if the file extents are new, the disk_i_size checks
-         * covers the most common case.
-         */
-        if (start < BTRFS_I(inode)->disk_i_size) {
-                path = btrfs_alloc_path();
-                if (path) {
-                        ret = btrfs_lookup_file_extent(NULL, root, path,
-                                                       inode->i_ino,
-                                                       start, 0);
-                        ordered_extent = btrfs_lookup_ordered_extent(inode,
-                                                                     start);
-                        if (!list_empty(&ordered_extent->list)) {
-                                btrfs_release_path(root, path);
-                                reada_csum(root, path, ordered_extent);
-                        }
-                        btrfs_free_path(path);
-                }
-        }
-        if (!ordered_extent)
-                ordered_extent = btrfs_lookup_ordered_extent(inode, start);
        BUG_ON(!ordered_extent);
        if (test_bit(BTRFS_ORDERED_NOCOW, &ordered_extent->flags)) {
                BUG_ON(!list_empty(&ordered_extent->list));
                ret = btrfs_ordered_update_i_size(inode, 0, ordered_extent);
@@ -5841,7 +5799,9 @@ static int prealloc_file_range(struct inode *inode, u64 start, u64 end,
                inode->i_ctime = CURRENT_TIME;
                BTRFS_I(inode)->flags |= BTRFS_INODE_PREALLOC;
                if (!(mode & FALLOC_FL_KEEP_SIZE) &&
-                    cur_offset > inode->i_size) {
+                        (actual_len > inode->i_size) &&
+                        (cur_offset > inode->i_size)) {
                        if (cur_offset > actual_len)
                                i_size  = actual_len;
                        else
diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index ed3e4a2ec2c8..ab7ab5318745 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -3764,7 +3764,8 @@ out:
                                       BTRFS_DATA_RELOC_TREE_OBJECTID);
                if (IS_ERR(fs_root))
                        err = PTR_ERR(fs_root);
-                btrfs_orphan_cleanup(fs_root);
+                else
+                        btrfs_orphan_cleanup(fs_root);
        }
        return err;
 }
diff --git a/fs/cifs/CHANGES b/fs/cifs/CHANGES
index 7b2600b380d7..49503d2edc7e 100644
--- a/fs/cifs/CHANGES
+++ b/fs/cifs/CHANGES
@@ -1,3 +1,7 @@
+Version 1.62
+------------
+Add sockopt=TCP_NODELAY mount option.
 Version 1.61
 ------------
 Fix append problem to Samba servers (files opened with O_APPEND could
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index ac2b24c192f8..78c1b86d55f6 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -113,5 +113,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* EXPERIMENTAL */
-#define CIFS_VERSION   "1.61"
+#define CIFS_VERSION   "1.62"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index 4b35f7ec0583..ed751bb657db 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -149,6 +149,7 @@ struct TCP_Server_Info {
        bool svlocal:1;                 /* local server or remote */
        bool noblocksnd;                /* use blocking sendmsg */
        bool noautotune;                /* do not autotune send buf sizes */
+        bool tcp_nodelay;
        atomic_t inFlight;  /* number of requests on the wire to server */
 #ifdef CONFIG_CIFS_STATS2
        atomic_t inSend; /* requests trying to send */
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 3bbcaa716b3c..2e9e09ca0e30 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -98,7 +98,7 @@ struct smb_vol {
        bool nostrictsync:1; /* do not force expensive SMBflush on every sync */
        unsigned int rsize;
        unsigned int wsize;
-        unsigned int sockopt;
+        bool sockopt_tcp_nodelay:1;
        unsigned short int port;
        char *prepath;
 };
@@ -1142,9 +1142,11 @@ cifs_parse_mount_options(char *options, const char *devname,
                                        simple_strtoul(value, &value, 0);
                        }
                } else if (strnicmp(data, "sockopt", 5) == 0) {
-                        if (value && *value) {
+                        if (!value || !*value) {
-                                vol->sockopt =
+                                cERROR(1, ("no socket option specified"));
-                                        simple_strtoul(value, &value, 0);
+                                continue;
+                        } else if (strnicmp(value, "TCP_NODELAY", 11) == 0) {
+                                vol->sockopt_tcp_nodelay = 1;
                        }
                } else if (strnicmp(data, "netbiosname", 4) == 0) {
                        if (!value || !*value || (*value == ' ')) {
@@ -1514,6 +1516,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
        tcp_ses->noblocksnd = volume_info->noblocksnd;
        tcp_ses->noautotune = volume_info->noautotune;
+        tcp_ses->tcp_nodelay = volume_info->sockopt_tcp_nodelay;
        atomic_set(&tcp_ses->inFlight, 0);
        init_waitqueue_head(&tcp_ses->response_q);
        init_waitqueue_head(&tcp_ses->request_q);
@@ -1764,6 +1767,7 @@ static int
 ipv4_connect(struct TCP_Server_Info *server)
 {
        int rc = 0;
+        int val;
        bool connected = false;
        __be16 orig_port = 0;
        struct socket *socket = server->ssocket;
@@ -1845,6 +1849,14 @@ ipv4_connect(struct TCP_Server_Info *server)
                        socket->sk->sk_rcvbuf = 140 * 1024;
        }
+        if (server->tcp_nodelay) {
+                val = 1;
+                rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
+                                (char *)&val, sizeof(val));
+                if (rc)
+                        cFYI(1, ("set TCP_NODELAY socket option error %d", rc));
+        }
         cFYI(1, ("sndbuf %d rcvbuf %d rcvtimeo 0x%lx",
                 socket->sk->sk_sndbuf,
                 socket->sk->sk_rcvbuf, socket->sk->sk_rcvtimeo));
@@ -1916,6 +1928,7 @@ static int
 ipv6_connect(struct TCP_Server_Info *server)
 {
        int rc = 0;
+        int val;
        bool connected = false;
        __be16 orig_port = 0;
        struct socket *socket = server->ssocket;
@@ -1987,6 +2000,15 @@ ipv6_connect(struct TCP_Server_Info *server)
         */
        socket->sk->sk_rcvtimeo = 7 * HZ;
        socket->sk->sk_sndtimeo = 5 * HZ;
+        if (server->tcp_nodelay) {
+                val = 1;
+                rc = kernel_setsockopt(socket, SOL_TCP, TCP_NODELAY,
+                                (char *)&val, sizeof(val));
+                if (rc)
+                        cFYI(1, ("set TCP_NODELAY socket option error %d", rc));
+        }
        server->ssocket = socket;
        return rc;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index cf18ee765590..e3fda978f481 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1762,8 +1762,18 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs)
                                        CIFS_MOUNT_MAP_SPECIAL_CHR);
        }
-        if (!rc)
+        if (!rc) {
                rc = inode_setattr(inode, attrs);
+                /* force revalidate when any of these times are set since some
+                   of the fs types (eg ext3, fat) do not have fine enough
+                   time granularity to match protocol, and we do not have a
+                   a way (yet) to query the server fs's time granularity (and
+                   whether it rounds times down).
+                */
+                if (!rc && (attrs->ia_valid & (ATTR_MTIME | ATTR_CTIME)))
+                        cifsInode->time = 0;
+        }
 out:
        kfree(args);
        kfree(full_path);
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index f84062f9a985..c343b14ba2d3 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -77,6 +77,11 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
        cFYI(1, ("For %s", name->name));
+        if (parent->d_op && parent->d_op->d_hash)
+                parent->d_op->d_hash(parent, name);
+        else
+                name->hash = full_name_hash(name->name, name->len);
        dentry = d_lookup(parent, name);
        if (dentry) {
                /* FIXME: check for inode number changes? */
@@ -666,12 +671,11 @@ static int cifs_get_name_from_search_buf(struct qstr *pqst,
                                           min(len, max_len), nlt,
                                           cifs_sb->mnt_cifs_flags &
                                                CIFS_MOUNT_MAP_SPECIAL_CHR);
+                pqst->len -= nls_nullsize(nlt);
        } else {
                pqst->name = filename;
                pqst->len = len;
        }
-        pqst->hash = full_name_hash(pqst->name, pqst->len);
-/*      cFYI(1, ("filldir on %s",pqst->name));  */
        return rc;
 }
diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
index 7085a6275c4c..aaa9c1c5a5bd 100644
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -223,9 +223,9 @@ static void unicode_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
                /* null user mount */
                *bcc_ptr = 0;
                *(bcc_ptr+1) = 0;
-        } else { /* 300 should be long enough for any conceivable user name */
+        } else {
                bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->userName,
-                                          300, nls_cp);
+                                          MAX_USERNAME_SIZE, nls_cp);
        }
        bcc_ptr += 2 * bytes_ret;
        bcc_ptr += 2; /* account for null termination */
@@ -246,11 +246,10 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifsSesInfo *ses,
        /* copy user */
        if (ses->userName == NULL) {
                /* BB what about null user mounts - check that we do this BB */
-        } else { /* 300 should be long enough for any conceivable user name */
+        } else {
-                strncpy(bcc_ptr, ses->userName, 300);
+                strncpy(bcc_ptr, ses->userName, MAX_USERNAME_SIZE);
        }
-        /* BB improve check for overflow */
+        bcc_ptr += strnlen(ses->userName, MAX_USERNAME_SIZE);
-        bcc_ptr += strnlen(ses->userName, 300);
        *bcc_ptr = 0;
        bcc_ptr++; /* account for null termination */
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index c5c45de1a2ee..30698a13fb22 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -936,6 +936,7 @@ COMPATIBLE_IOCTL(TCSETSF)
 COMPATIBLE_IOCTL(TIOCLINUX)
 COMPATIBLE_IOCTL(TIOCSBRK)
 COMPATIBLE_IOCTL(TIOCCBRK)
+COMPATIBLE_IOCTL(TIOCGSID)
 COMPATIBLE_IOCTL(TIOCGICOUNT)
 /* Little t */
 COMPATIBLE_IOCTL(TIOCGETD)
@@ -1038,6 +1039,8 @@ COMPATIBLE_IOCTL(FIOQSIZE)
 #ifdef CONFIG_BLOCK
 /* loop */
 IGNORE_IOCTL(LOOP_CLR_FD)
+/* md calls this on random blockdevs */
+IGNORE_IOCTL(RAID_VERSION)
 /* SG stuff */
 COMPATIBLE_IOCTL(SG_SET_TIMEOUT)
 COMPATIBLE_IOCTL(SG_GET_TIMEOUT)
diff --git a/fs/exec.c b/fs/exec.c
index 0790a107ff7e..e95c692ef0e4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -571,6 +571,9 @@ int setup_arg_pages(struct linux_binprm *bprm,
        struct vm_area_struct *prev = NULL;
        unsigned long vm_flags;
        unsigned long stack_base;
+        unsigned long stack_size;
+        unsigned long stack_expand;
+        unsigned long rlim_stack;
 #ifdef CONFIG_STACK_GROWSUP
        /* Limit stack size to 1GB */
@@ -627,10 +630,24 @@ int setup_arg_pages(struct linux_binprm *bprm,
                        goto out_unlock;
        }
+        stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+        stack_size = vma->vm_end - vma->vm_start;
+        /*
+         * Align this down to a page boundary as expand_stack
+         * will align it up.
+         */
+        rlim_stack = rlimit(RLIMIT_STACK) & PAGE_MASK;
+        rlim_stack = min(rlim_stack, stack_size);
 #ifdef CONFIG_STACK_GROWSUP
-        stack_base = vma->vm_end + EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+        if (stack_size + stack_expand > rlim_stack)
+                stack_base = vma->vm_start + rlim_stack;
+        else
+                stack_base = vma->vm_end + stack_expand;
 #else
-        stack_base = vma->vm_start - EXTRA_STACK_VM_PAGES * PAGE_SIZE;
+        if (stack_size + stack_expand > rlim_stack)
+                stack_base = vma->vm_end - rlim_stack;
+        else
+                stack_base = vma->vm_start - stack_expand;
 #endif
        ret = expand_stack(vma, stack_base);
        if (ret)
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 5ef953e6f908..97e01dc0d95f 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -199,9 +199,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
                     int force)
 {
-        unsigned long flags;
+        write_lock_irq(&filp->f_owner.lock);
-        write_lock_irqsave(&filp->f_owner.lock, flags);
        if (force || !filp->f_owner.pid) {
                put_pid(filp->f_owner.pid);
                filp->f_owner.pid = get_pid(pid);
@@ -213,7 +211,7 @@ static void f_modown(struct file *filp, struct pid *pid, enum pid_type type,
                        filp->f_owner.euid = cred->euid;
                }
        }
-        write_unlock_irqrestore(&filp->f_owner.lock, flags);
+        write_unlock_irq(&filp->f_owner.lock);
 }
 int __f_setown(struct file *filp, struct pid *pid, enum pid_type type,
diff --git a/fs/file_table.c b/fs/file_table.c
index 69652c5bd5f0..b98404b54383 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -253,6 +253,7 @@ void __fput(struct file *file)
        if (file->f_op && file->f_op->release)
                file->f_op->release(inode, file);
        security_file_free(file);
+        ima_file_free(file);
        if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
                cdev_put(inode->i_cdev);
        fops_put(file->f_op);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c18913a777ae..a9f5e137f1d3 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -828,6 +828,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                if (!page)
                        break;
+                if (mapping_writably_mapped(mapping))
+                        flush_dcache_page(page);
                pagefault_disable();
                tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
                pagefault_enable();
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index f455a03a09e2..f42663325931 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -769,6 +769,7 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
        if (!gl)
                return -ENOMEM;
+        atomic_inc(&sdp->sd_glock_disposal);
        gl->gl_flags = 0;
        gl->gl_name = name;
        atomic_set(&gl->gl_ref, 1);
@@ -1538,6 +1539,9 @@ void gfs2_gl_hash_clear(struct gfs2_sbd *sdp)
                up_write(&gfs2_umount_flush_sem);
                msleep(10);
        }
+        flush_workqueue(glock_workqueue);
+        wait_event(sdp->sd_glock_wait, atomic_read(&sdp->sd_glock_disposal) == 0);
+        gfs2_dump_lockstate(sdp);
 }
 void gfs2_glock_finish_truncate(struct gfs2_inode *ip)
diff --git a/fs/gfs2/glock.h b/fs/gfs2/glock.h
index 13f0bd228132..c0262faf4725 100644
--- a/fs/gfs2/glock.h
+++ b/fs/gfs2/glock.h
@@ -123,7 +123,7 @@ struct lm_lockops {
        int (*lm_mount) (struct gfs2_sbd *sdp, const char *fsname);
        void (*lm_unmount) (struct gfs2_sbd *sdp);
        void (*lm_withdraw) (struct gfs2_sbd *sdp);
-        void (*lm_put_lock) (struct kmem_cache *cachep, void *gl);
+        void (*lm_put_lock) (struct kmem_cache *cachep, struct gfs2_glock *gl);
        unsigned int (*lm_lock) (struct gfs2_glock *gl,
                                 unsigned int req_state, unsigned int flags);
        void (*lm_cancel) (struct gfs2_glock *gl);
diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
index 4792200978c8..bc0ad158e6b4 100644
--- a/fs/gfs2/incore.h
+++ b/fs/gfs2/incore.h
@@ -544,6 +544,8 @@ struct gfs2_sbd {
        struct gfs2_holder sd_live_gh;
        struct gfs2_glock *sd_rename_gl;
        struct gfs2_glock *sd_trans_gl;
+        wait_queue_head_t sd_glock_wait;
+        atomic_t sd_glock_disposal;
        /* Inode Stuff */
diff --git a/fs/gfs2/lock_dlm.c b/fs/gfs2/lock_dlm.c
index 46df988323bc..0e5e0e7022e5 100644
--- a/fs/gfs2/lock_dlm.c
+++ b/fs/gfs2/lock_dlm.c
@@ -21,6 +21,7 @@ static void gdlm_ast(void *arg)
 {
        struct gfs2_glock *gl = arg;
        unsigned ret = gl->gl_state;
+        struct gfs2_sbd *sdp = gl->gl_sbd;
        BUG_ON(gl->gl_lksb.sb_flags & DLM_SBF_DEMOTED);
@@ -30,6 +31,8 @@ static void gdlm_ast(void *arg)
        switch (gl->gl_lksb.sb_status) {
        case -DLM_EUNLOCK: /* Unlocked, so glock can be freed */
                kmem_cache_free(gfs2_glock_cachep, gl);
+                if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                        wake_up(&sdp->sd_glock_wait);
                return;
        case -DLM_ECANCEL: /* Cancel while getting lock */
                ret |= LM_OUT_CANCELED;
@@ -164,14 +167,16 @@ static unsigned int gdlm_lock(struct gfs2_glock *gl,
        return LM_OUT_ASYNC;
 }
-static void gdlm_put_lock(struct kmem_cache *cachep, void *ptr)
+static void gdlm_put_lock(struct kmem_cache *cachep, struct gfs2_glock *gl)
 {
-        struct gfs2_glock *gl = ptr;
+        struct gfs2_sbd *sdp = gl->gl_sbd;
-        struct lm_lockstruct *ls = &gl->gl_sbd->sd_lockstruct;
+        struct lm_lockstruct *ls = &sdp->sd_lockstruct;
        int error;
        if (gl->gl_lksb.sb_lkid == 0) {
                kmem_cache_free(cachep, gl);
+                if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                        wake_up(&sdp->sd_glock_wait);
                return;
        }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index edfee24f3636..8a102f731003 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -82,6 +82,8 @@ static struct gfs2_sbd *init_sbd(struct super_block *sb)
        gfs2_tune_init(&sdp->sd_tune);
+        init_waitqueue_head(&sdp->sd_glock_wait);
+        atomic_set(&sdp->sd_glock_disposal, 0);
        spin_lock_init(&sdp->sd_statfs_spin);
        spin_lock_init(&sdp->sd_rindex_spin);
@@ -983,9 +985,17 @@ static const match_table_t nolock_tokens = {
        { Opt_err, NULL },
 };
+static void nolock_put_lock(struct kmem_cache *cachep, struct gfs2_glock *gl)
+{
+        struct gfs2_sbd *sdp = gl->gl_sbd;
+        kmem_cache_free(cachep, gl);
+        if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+                wake_up(&sdp->sd_glock_wait);
+}
 static const struct lm_lockops nolock_ops = {
        .lm_proto_name = "lock_nolock",
-        .lm_put_lock = kmem_cache_free,
+        .lm_put_lock = nolock_put_lock,
        .lm_tokens = &nolock_tokens,
 };
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index c282ad41f3d1..b9dd3da22c0a 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -21,6 +21,7 @@
 #include <linux/gfs2_ondisk.h>
 #include <linux/crc32.h>
 #include <linux/time.h>
+#include <linux/wait.h>
 #include "gfs2.h"
 #include "incore.h"
diff --git a/fs/namei.c b/fs/namei.c
index 94a5e60779f9..d62fdc875f22 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1736,8 +1736,7 @@ do_last:
                if (nd.root.mnt)
                        path_put(&nd.root);
                if (!IS_ERR(filp)) {
-                        error = ima_path_check(&filp->f_path, filp->f_mode &
+                        error = ima_file_check(filp, acc_mode);
-                                       (MAY_READ | MAY_WRITE | MAY_EXEC));
                        if (error) {
                                fput(filp);
                                filp = ERR_PTR(error);
@@ -1797,8 +1796,7 @@ ok:
        }
        filp = nameidata_to_filp(&nd);
        if (!IS_ERR(filp)) {
-                error = ima_path_check(&filp->f_path, filp->f_mode &
+                error = ima_file_check(filp, acc_mode);
-                               (MAY_READ | MAY_WRITE | MAY_EXEC));
                if (error) {
                        fput(filp);
                        filp = ERR_PTR(error);
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index 6b891328f332..63f2071d6445 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -486,6 +486,8 @@ static int nfs_release_page(struct page *page, gfp_t gfp)
 {
        dfprintk(PAGECACHE, "NFS: release_page(%p)\n", page);
+        if (gfp & __GFP_WAIT)
+                nfs_wb_page(page->mapping->host, page);
        /* If PagePrivate() is set, then the page is not freeable */
        if (PagePrivate(page))
                return 0;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index faa091865ad0..f141bde7756a 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1261,8 +1261,10 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
        if (fattr->valid & NFS_ATTR_FATTR_MODE) {
                if ((inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO)) {
+                        umode_t newmode = inode->i_mode & S_IFMT;
+                        newmode |= fattr->mode & S_IALLUGO;
+                        inode->i_mode = newmode;
                        invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-                        inode->i_mode = fattr->mode;
                }
        } else if (server->caps & NFS_CAP_MODE)
                invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index 865265bdca03..0c6fda33d66e 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -146,6 +146,7 @@ enum {
        NFS_O_RDWR_STATE,               /* OPEN stateid has read/write state */
        NFS_STATE_RECLAIM_REBOOT,       /* OPEN stateid server rebooted */
        NFS_STATE_RECLAIM_NOGRACE,      /* OPEN stateid needs to recover state */
+        NFS_STATE_POSIX_LOCKS,          /* Posix locks are supported */
 };
 struct nfs4_state {
@@ -277,6 +278,7 @@ extern void nfs4_state_set_mode_locked(struct nfs4_state *, fmode_t);
 extern void nfs4_schedule_state_recovery(struct nfs_client *);
 extern void nfs4_schedule_state_manager(struct nfs_client *);
 extern int nfs4_state_mark_reclaim_nograce(struct nfs_client *clp, struct nfs4_state *state);
+extern int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state);
 extern void nfs41_handle_sequence_flag_errors(struct nfs_client *clp, u32 flags);
 extern void nfs4_put_lock_state(struct nfs4_lock_state *lsp);
 extern int nfs4_set_lock_state(struct nfs4_state *state, struct file_lock *fl);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 198d51d17c13..375f0fae2c6a 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -249,19 +249,15 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                        if (state == NULL)
                                break;
                        nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                case -NFS4ERR_STALE_STATEID:
-                case -NFS4ERR_EXPIRED:
+                        if (state == NULL)
-                        nfs4_schedule_state_recovery(clp);
-                        ret = nfs4_wait_clnt_recover(clp);
-                        if (ret == 0)
-                                exception->retry = 1;
-#if !defined(CONFIG_NFS_V4_1)
-                        break;
-#else /* !defined(CONFIG_NFS_V4_1) */
-                        if (!nfs4_has_session(server->nfs_client))
                                break;
-                        /* FALLTHROUGH */
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
+                case -NFS4ERR_EXPIRED:
+                        goto do_state_recovery;
+#if defined(CONFIG_NFS_V4_1)
                case -NFS4ERR_BADSESSION:
                case -NFS4ERR_BADSLOT:
                case -NFS4ERR_BAD_HIGH_SLOT:
@@ -274,7 +270,7 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
                        nfs4_schedule_state_recovery(clp);
                        exception->retry = 1;
                        break;
-#endif /* !defined(CONFIG_NFS_V4_1) */
+#endif /* defined(CONFIG_NFS_V4_1) */
                case -NFS4ERR_FILE_OPEN:
                        if (exception->timeout > HZ) {
                                /* We have retried a decent amount, time to
@@ -293,6 +289,12 @@ static int nfs4_handle_exception(const struct nfs_server *server, int errorcode,
        }
        /* We failed to handle the error */
        return nfs4_map_errors(ret);
+do_state_recovery:
+        nfs4_schedule_state_recovery(clp);
+        ret = nfs4_wait_clnt_recover(clp);
+        if (ret == 0)
+                exception->retry = 1;
+        return ret;
 }
@@ -1658,6 +1660,8 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
        status = PTR_ERR(state);
        if (IS_ERR(state))
                goto err_opendata_put;
+        if ((opendata->o_res.rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) != 0)
+                set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
        nfs4_opendata_put(opendata);
        nfs4_put_state_owner(sp);
        *res = state;
@@ -3422,15 +3426,14 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                        if (state == NULL)
                                break;
                        nfs4_state_mark_reclaim_nograce(clp, state);
-                case -NFS4ERR_STALE_CLIENTID:
+                        goto do_state_recovery;
                case -NFS4ERR_STALE_STATEID:
+                        if (state == NULL)
+                                break;
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                case -NFS4ERR_STALE_CLIENTID:
                case -NFS4ERR_EXPIRED:
-                        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+                        goto do_state_recovery;
-                        nfs4_schedule_state_recovery(clp);
-                        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
-                                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
-                        task->tk_status = 0;
-                        return -EAGAIN;
 #if defined(CONFIG_NFS_V4_1)
                case -NFS4ERR_BADSESSION:
                case -NFS4ERR_BADSLOT:
@@ -3458,6 +3461,13 @@ _nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
        }
        task->tk_status = nfs4_map_errors(task->tk_status);
        return 0;
+do_state_recovery:
+        rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL);
+        nfs4_schedule_state_recovery(clp);
+        if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0)
+                rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task);
+        task->tk_status = 0;
+        return -EAGAIN;
 }
 static int
@@ -4088,6 +4098,28 @@ static const struct rpc_call_ops nfs4_recover_lock_ops = {
        .rpc_release = nfs4_lock_release,
 };
+static void nfs4_handle_setlk_error(struct nfs_server *server, struct nfs4_lock_state *lsp, int new_lock_owner, int error)
+{
+        struct nfs_client *clp = server->nfs_client;
+        struct nfs4_state *state = lsp->ls_state;
+        switch (error) {
+        case -NFS4ERR_ADMIN_REVOKED:
+        case -NFS4ERR_BAD_STATEID:
+        case -NFS4ERR_EXPIRED:
+                if (new_lock_owner != 0 ||
+                   (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_nograce(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+                break;
+        case -NFS4ERR_STALE_STATEID:
+                if (new_lock_owner != 0 ||
+                    (lsp->ls_flags & NFS_LOCK_INITIALIZED) != 0)
+                        nfs4_state_mark_reclaim_reboot(clp, state);
+                lsp->ls_seqid.flags &= ~NFS_SEQID_CONFIRMED;
+        };
+}
 static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *fl, int recovery_type)
 {
        struct nfs4_lockdata *data;
@@ -4126,6 +4158,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
        ret = nfs4_wait_for_completion_rpc_task(task);
        if (ret == 0) {
                ret = data->rpc_status;
+                if (ret)
+                        nfs4_handle_setlk_error(data->server, data->lsp,
+                                        data->arg.new_lock_owner, ret);
        } else
                data->cancelled = 1;
        rpc_put_task(task);
@@ -4181,8 +4216,11 @@ static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock
 {
        struct nfs_inode *nfsi = NFS_I(state->inode);
        unsigned char fl_flags = request->fl_flags;
-        int status;
+        int status = -ENOLCK;
+        if ((fl_flags & FL_POSIX) &&
+                        !test_bit(NFS_STATE_POSIX_LOCKS, &state->flags))
+                goto out;
        /* Is this a delegated open? */
        status = nfs4_set_lock_state(state, request);
        if (status != 0)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 6d263ed79e92..c1e2733f4fa4 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -901,7 +901,7 @@ void nfs4_schedule_state_recovery(struct nfs_client *clp)
        nfs4_schedule_state_manager(clp);
 }
-static int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
+int nfs4_state_mark_reclaim_reboot(struct nfs_client *clp, struct nfs4_state *state)
 {
        set_bit(NFS_STATE_RECLAIM_REBOOT, &state->flags);
diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
index e2975939126a..a12c45b65dd4 100644
--- a/fs/nfs/pagelist.c
+++ b/fs/nfs/pagelist.c
@@ -176,6 +176,12 @@ void nfs_release_request(struct nfs_page *req)
        kref_put(&req->wb_kref, nfs_free_request);
 }
+static int nfs_wait_bit_uninterruptible(void *word)
+{
+        io_schedule();
+        return 0;
+}
 /**
 * nfs_wait_on_request - Wait for a request to complete.
 * @req: request to wait upon.
@@ -186,14 +192,9 @@ void nfs_release_request(struct nfs_page *req)
 int
 nfs_wait_on_request(struct nfs_page *req)
 {
-        int ret = 0;
+        return wait_on_bit(&req->wb_flags, PG_BUSY,
+                        nfs_wait_bit_uninterruptible,
-        if (!test_bit(PG_BUSY, &req->wb_flags))
+                        TASK_UNINTERRUPTIBLE);
-                goto out;
-        ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
-                        nfs_wait_bit_killable, TASK_KILLABLE);
-out:
-        return ret;
 }
 /**
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ce907efc5508..f1afee4eea77 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -243,6 +243,7 @@ static int  nfs_show_stats(struct seq_file *, struct vfsmount *);
 static int nfs_get_sb(struct file_system_type *, int, const char *, void *, struct vfsmount *);
 static int nfs_xdev_get_sb(struct file_system_type *fs_type,
                int flags, const char *dev_name, void *raw_data, struct vfsmount *mnt);
+static void nfs_put_super(struct super_block *);
 static void nfs_kill_super(struct super_block *);
 static int nfs_remount(struct super_block *sb, int *flags, char *raw_data);
@@ -266,6 +267,7 @@ static const struct super_operations nfs_sops = {
        .alloc_inode    = nfs_alloc_inode,
        .destroy_inode  = nfs_destroy_inode,
        .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
        .statfs         = nfs_statfs,
        .clear_inode    = nfs_clear_inode,
        .umount_begin   = nfs_umount_begin,
@@ -335,6 +337,7 @@ static const struct super_operations nfs4_sops = {
        .alloc_inode    = nfs_alloc_inode,
        .destroy_inode  = nfs_destroy_inode,
        .write_inode    = nfs_write_inode,
+        .put_super      = nfs_put_super,
        .statfs         = nfs_statfs,
        .clear_inode    = nfs4_clear_inode,
        .umount_begin   = nfs_umount_begin,
@@ -2258,6 +2261,17 @@ error_splat_super:
 }
 /*
+ * Ensure that we unregister the bdi before kill_anon_super
+ * releases the device name
+ */
+static void nfs_put_super(struct super_block *s)
+{
+        struct nfs_server *server = NFS_SB(s);
+        bdi_unregister(&server->backing_dev_info);
+}
+/*
 * Destroy an NFS2/3 superblock
 */
 static void nfs_kill_super(struct super_block *s)
@@ -2265,7 +2279,6 @@ static void nfs_kill_super(struct super_block *s)
        struct nfs_server *server = NFS_SB(s);
        kill_anon_super(s);
-        bdi_unregister(&server->backing_dev_info);
        nfs_fscache_release_super_cookie(s);
        nfs_free_server(server);
 }
diff --git a/fs/nfs/sysctl.c b/fs/nfs/sysctl.c
index 70e1fbbaaeab..ad4d2e787b20 100644
--- a/fs/nfs/sysctl.c
+++ b/fs/nfs/sysctl.c
@@ -15,8 +15,10 @@
 #include "callback.h"
+#ifdef CONFIG_NFS_V4
 static const int nfs_set_port_min = 0;
 static const int nfs_set_port_max = 65535;
+#endif
 static struct ctl_table_header *nfs_callback_sysctl_table;
 static ctl_table nfs_cb_sysctls[] = {
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index d171696017f4..7b54b8bb101f 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -1233,7 +1233,7 @@ int nfs_writeback_done(struct rpc_task *task, struct nfs_write_data *data)
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
-void nfs_commitdata_release(void *data)
+static void nfs_commitdata_release(void *data)
 {
        struct nfs_write_data *wdata = data;
@@ -1541,6 +1541,7 @@ int nfs_wb_page_cancel(struct inode *inode, struct page *page)
                        break;
                }
                ret = nfs_wait_on_request(req);
+                nfs_release_request(req);
                if (ret < 0)
                        goto out;
        }
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index c487810a2366..a0c4016413f1 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -1316,19 +1316,11 @@ rqst_exp_parent(struct svc_rqst *rqstp, struct path *path)
 static struct svc_export *find_fsidzero_export(struct svc_rqst *rqstp)
 {
-        struct svc_export *exp;
        u32 fsidv[2];
        mk_fsid(FSID_NUM, fsidv, 0, 0, 0, NULL);
-        exp = rqst_exp_find(rqstp, FSID_NUM, fsidv);
+        return rqst_exp_find(rqstp, FSID_NUM, fsidv);
-        /*
-         * We shouldn't have accepting an nfsv4 request at all if we
-         * don't have a pseudoexport!:
-         */
-        if (IS_ERR(exp) && PTR_ERR(exp) == -ENOENT)
-                exp = ERR_PTR(-ESERVERFAULT);
-        return exp;
 }
 /*
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index c194793b642b..97d79eff6b7f 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -752,6 +752,7 @@ nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
                            flags, current_cred());
        if (IS_ERR(*filp))
                host_err = PTR_ERR(*filp);
+        host_err = ima_file_check(*filp, access);
 out_nfserr:
        err = nfserrno(host_err);
 out:
@@ -2127,7 +2128,6 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp,
         */
        path.mnt = exp->ex_path.mnt;
        path.dentry = dentry;
-        err = ima_path_check(&path, acc & (MAY_READ | MAY_WRITE | MAY_EXEC));
 nfsd_out:
        return err? nfserrno(err) : 0;
 }
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 17584c524486..105b508b47a8 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2829,7 +2829,7 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
                || sci->sc_seq_request != sci->sc_seq_done);
        spin_unlock(&sci->sc_state_lock);
-        if (flag || nilfs_segctor_confirm(sci))
+        if (flag || !nilfs_segctor_confirm(sci))
                nilfs_segctor_write_out(sci);
        WARN_ON(!list_empty(&sci->sc_copied_buffers));
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 3dae4a13f6e4..7e9df11260f4 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -599,7 +599,7 @@ bail:
        return ret;
 }
-/* 
+/*
 * ocfs2_dio_end_io is called by the dio core when a dio is finished.  We're
 * particularly interested in the aio/dio case.  Like the core uses
 * i_alloc_sem, we use the rw_lock DLM lock to protect io on one node from
@@ -670,7 +670,7 @@ static ssize_t ocfs2_direct_IO(int rw,
        ret = blockdev_direct_IO_no_locking(rw, iocb, inode,
                                            inode->i_sb->s_bdev, iov, offset,
-                                            nr_segs, 
+                                            nr_segs,
                                            ocfs2_direct_IO_get_blocks,
                                            ocfs2_dio_end_io);
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index d43d34a1dd31..21c808f752d8 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -368,7 +368,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
        }
        ocfs2_metadata_cache_io_unlock(ci);
-        mlog(ML_BH_IO, "block=(%llu), nr=(%d), cached=%s, flags=0x%x\n", 
+        mlog(ML_BH_IO, "block=(%llu), nr=(%d), cached=%s, flags=0x%x\n",
             (unsigned long long)block, nr,
             ((flags & OCFS2_BH_IGNORE_CACHE) || ignore_cache) ? "no" : "yes",
             flags);
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index eda5b8bcddd5..5c9890006708 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -78,7 +78,7 @@ static struct o2hb_callback *hbcall_from_type(enum o2hb_callback_type type);
 unsigned int o2hb_dead_threshold = O2HB_DEFAULT_DEAD_THRESHOLD;
-/* Only sets a new threshold if there are no active regions. 
+/* Only sets a new threshold if there are no active regions.
 *
 * No locking or otherwise interesting code is required for reading
 * o2hb_dead_threshold as it can't change once regions are active and
@@ -170,7 +170,7 @@ static void o2hb_write_timeout(struct work_struct *work)
        mlog(ML_ERROR, "Heartbeat write timeout to device %s after %u "
             "milliseconds\n", reg->hr_dev_name,
-             jiffies_to_msecs(jiffies - reg->hr_last_timeout_start)); 
+             jiffies_to_msecs(jiffies - reg->hr_last_timeout_start));
        o2quo_disk_timeout();
 }
@@ -624,7 +624,7 @@ static int o2hb_check_slot(struct o2hb_region *reg,
             "seq %llu last %llu changed %u equal %u\n",
             slot->ds_node_num, (long long)slot->ds_last_generation,
             le32_to_cpu(hb_block->hb_cksum),
-             (unsigned long long)le64_to_cpu(hb_block->hb_seq), 
+             (unsigned long long)le64_to_cpu(hb_block->hb_seq),
             (unsigned long long)slot->ds_last_time, slot->ds_changed_samples,
             slot->ds_equal_samples);
diff --git a/fs/ocfs2/cluster/tcp.c b/fs/ocfs2/cluster/tcp.c
index 334f231a422c..d8d0c65ac03c 100644
--- a/fs/ocfs2/cluster/tcp.c
+++ b/fs/ocfs2/cluster/tcp.c
@@ -485,7 +485,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
        }
        if (was_valid && !valid) {
-                printk(KERN_INFO "o2net: no longer connected to "
+                printk(KERN_NOTICE "o2net: no longer connected to "
                       SC_NODEF_FMT "\n", SC_NODEF_ARGS(old_sc));
                o2net_complete_nodes_nsw(nn);
        }
@@ -493,7 +493,7 @@ static void o2net_set_nn_state(struct o2net_node *nn,
        if (!was_valid && valid) {
                o2quo_conn_up(o2net_num_from_nn(nn));
                cancel_delayed_work(&nn->nn_connect_expired);
-                printk(KERN_INFO "o2net: %s " SC_NODEF_FMT "\n",
+                printk(KERN_NOTICE "o2net: %s " SC_NODEF_FMT "\n",
                       o2nm_this_node() > sc->sc_node->nd_num ?
                                "connected to" : "accepted connection from",
                       SC_NODEF_ARGS(sc));
@@ -930,7 +930,7 @@ static void o2net_sendpage(struct o2net_sock_container *sc,
                        cond_resched();
                        continue;
                }
-                mlog(ML_ERROR, "sendpage of size %zu to " SC_NODEF_FMT 
+                mlog(ML_ERROR, "sendpage of size %zu to " SC_NODEF_FMT
                     " failed with %zd\n", size, SC_NODEF_ARGS(sc), ret);
                o2net_ensure_shutdown(nn, sc, 0);
                break;
@@ -1476,14 +1476,14 @@ static void o2net_idle_timer(unsigned long data)
        do_gettimeofday(&now);
-        printk(KERN_INFO "o2net: connection to " SC_NODEF_FMT " has been idle for %u.%u "
+        printk(KERN_NOTICE "o2net: connection to " SC_NODEF_FMT " has been idle for %u.%u "
             "seconds, shutting it down.\n", SC_NODEF_ARGS(sc),
                     o2net_idle_timeout() / 1000,
                     o2net_idle_timeout() % 1000);
        mlog(ML_NOTICE, "here are some times that might help debug the "
             "situation: (tmr %ld.%ld now %ld.%ld dr %ld.%ld adv "
             "%ld.%ld:%ld.%ld func (%08x:%u) %ld.%ld:%ld.%ld)\n",
-             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec, 
+             sc->sc_tv_timer.tv_sec, (long) sc->sc_tv_timer.tv_usec,
             now.tv_sec, (long) now.tv_usec,
             sc->sc_tv_data_ready.tv_sec, (long) sc->sc_tv_data_ready.tv_usec,
             sc->sc_tv_advance_start.tv_sec,
diff --git a/fs/ocfs2/cluster/tcp_internal.h b/fs/ocfs2/cluster/tcp_internal.h
index 8d58cfe410b1..96fa7ebc530c 100644
--- a/fs/ocfs2/cluster/tcp_internal.h
+++ b/fs/ocfs2/cluster/tcp_internal.h
@@ -32,10 +32,10 @@
 * on their number */
 #define O2NET_QUORUM_DELAY_MS   ((o2hb_dead_threshold + 2) * O2HB_REGION_TIMEOUT_MS)
-/* 
+/*
 * This version number represents quite a lot, unfortunately.  It not
 * only represents the raw network message protocol on the wire but also
- * locking semantics of the file system using the protocol.  It should 
+ * locking semantics of the file system using the protocol.  It should
 * be somewhere else, I'm sure, but right now it isn't.
 *
 * With version 11, we separate out the filesystem locking portion.  The
diff --git a/fs/ocfs2/dlm/dlmapi.h b/fs/ocfs2/dlm/dlmapi.h
index b5786a787fab..3cfa114aa391 100644
--- a/fs/ocfs2/dlm/dlmapi.h
+++ b/fs/ocfs2/dlm/dlmapi.h
@@ -95,7 +95,7 @@ const char *dlm_errname(enum dlm_status err);
                mlog(ML_ERROR, "dlm status = %s\n", dlm_errname((st))); \
 } while (0)
-#define DLM_LKSB_UNUSED1           0x01  
+#define DLM_LKSB_UNUSED1           0x01
 #define DLM_LKSB_PUT_LVB           0x02
 #define DLM_LKSB_GET_LVB           0x04
 #define DLM_LKSB_UNUSED2           0x08
diff --git a/fs/ocfs2/dlm/dlmast.c b/fs/ocfs2/dlm/dlmast.c
index 01cf8cc3d286..dccc439fa087 100644
--- a/fs/ocfs2/dlm/dlmast.c
+++ b/fs/ocfs2/dlm/dlmast.c
@@ -123,7 +123,7 @@ static void __dlm_queue_ast(struct dlm_ctxt *dlm, struct dlm_lock *lock)
                dlm_lock_put(lock);
                /* free up the reserved bast that we are cancelling.
                 * guaranteed that this will not be the last reserved
-                 * ast because *both* an ast and a bast were reserved 
+                 * ast because *both* an ast and a bast were reserved
                 * to get to this point.  the res->spinlock will not be
                 * taken here */
                dlm_lockres_release_ast(dlm, res);
diff --git a/fs/ocfs2/dlm/dlmconvert.c b/fs/ocfs2/dlm/dlmconvert.c
index ca96bce50e18..f283bce776b4 100644
--- a/fs/ocfs2/dlm/dlmconvert.c
+++ b/fs/ocfs2/dlm/dlmconvert.c
@@ -396,7 +396,7 @@ static enum dlm_status dlm_send_remote_convert_request(struct dlm_ctxt *dlm,
                        /* instead of logging the same network error over
                         * and over, sleep here and wait for the heartbeat
                         * to notice the node is dead.  times out after 5s. */
-                        dlm_wait_for_node_death(dlm, res->owner, 
+                        dlm_wait_for_node_death(dlm, res->owner,
                                                DLM_NODE_DEATH_WAIT_MAX);
                        ret = DLM_RECOVERING;
                        mlog(0, "node %u died so returning DLM_RECOVERING "
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 42b0bad7a612..0cd24cf54396 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -102,7 +102,7 @@ void __dlm_print_one_lock_resource(struct dlm_lock_resource *res)
        assert_spin_locked(&res->spinlock);
        stringify_lockname(res->lockname.name, res->lockname.len,
-                           buf, sizeof(buf) - 1);
+                           buf, sizeof(buf));
        printk("lockres: %s, owner=%u, state=%u\n",
               buf, res->owner, res->state);
        printk("  last used: %lu, refcnt: %u, on purge list: %s\n",
diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c
index 0334000676d3..988c9055fd4e 100644
--- a/fs/ocfs2/dlm/dlmdomain.c
+++ b/fs/ocfs2/dlm/dlmdomain.c
@@ -816,7 +816,7 @@ static int dlm_query_join_handler(struct o2net_msg *msg, u32 len, void *data,
        }
        /* Once the dlm ctxt is marked as leaving then we don't want
-         * to be put in someone's domain map. 
+         * to be put in someone's domain map.
         * Also, explicitly disallow joining at certain troublesome
         * times (ie. during recovery). */
        if (dlm && dlm->dlm_state != DLM_CTXT_LEAVING) {
diff --git a/fs/ocfs2/dlm/dlmlock.c b/fs/ocfs2/dlm/dlmlock.c
index 437698e9465f..733337772671 100644
--- a/fs/ocfs2/dlm/dlmlock.c
+++ b/fs/ocfs2/dlm/dlmlock.c
@@ -269,7 +269,7 @@ static enum dlm_status dlmlock_remote(struct dlm_ctxt *dlm,
                }
                dlm_revert_pending_lock(res, lock);
                dlm_lock_put(lock);
-        } else if (dlm_is_recovery_lock(res->lockname.name, 
+        } else if (dlm_is_recovery_lock(res->lockname.name,
                                        res->lockname.len)) {
                /* special case for the $RECOVERY lock.
                 * there will never be an AST delivered to put
diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
index 03ccf9a7b1f4..a659606dcb95 100644
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -366,7 +366,7 @@ void dlm_hb_event_notify_attached(struct dlm_ctxt *dlm, int idx, int node_up)
        struct dlm_master_list_entry *mle;
        assert_spin_locked(&dlm->spinlock);
-        
        list_for_each_entry(mle, &dlm->mle_hb_events, hb_events) {
                if (node_up)
                        dlm_mle_node_up(dlm, mle, NULL, idx);
@@ -833,7 +833,7 @@ lookup:
                __dlm_insert_mle(dlm, mle);
                /* still holding the dlm spinlock, check the recovery map
-                 * to see if there are any nodes that still need to be 
+                 * to see if there are any nodes that still need to be
                 * considered.  these will not appear in the mle nodemap
                 * but they might own this lockres.  wait on them. */
                bit = find_next_bit(dlm->recovery_map, O2NM_MAX_NODES, 0);
@@ -883,7 +883,7 @@ redo_request:
                                msleep(500);
                        }
                        continue;
-                } 
+                }
                dlm_kick_recovery_thread(dlm);
                msleep(1000);
@@ -939,8 +939,8 @@ wait:
                     res->lockname.name, blocked);
                if (++tries > 20) {
                        mlog(ML_ERROR, "%s:%.*s: spinning on "
-                             "dlm_wait_for_lock_mastery, blocked=%d\n", 
+                             "dlm_wait_for_lock_mastery, blocked=%d\n",
-                             dlm->name, res->lockname.len, 
+                             dlm->name, res->lockname.len,
                             res->lockname.name, blocked);
                        dlm_print_one_lock_resource(res);
                        dlm_print_one_mle(mle);
@@ -1029,7 +1029,7 @@ recheck:
                ret = dlm_restart_lock_mastery(dlm, res, mle, *blocked);
                b = (mle->type == DLM_MLE_BLOCK);
                if ((*blocked && !b) || (!*blocked && b)) {
-                        mlog(0, "%s:%.*s: status change: old=%d new=%d\n", 
+                        mlog(0, "%s:%.*s: status change: old=%d new=%d\n",
                             dlm->name, res->lockname.len, res->lockname.name,
                             *blocked, b);
                        *blocked = b;
@@ -1602,7 +1602,7 @@ send_response:
                }
                mlog(0, "%u is the owner of %.*s, cleaning everyone else\n",
                             dlm->node_num, res->lockname.len, res->lockname.name);
-                ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx, 
+                ret = dlm_dispatch_assert_master(dlm, res, 0, request->node_idx,
                                                 DLM_ASSERT_MASTER_MLE_CLEANUP);
                if (ret < 0) {
                        mlog(ML_ERROR, "failed to dispatch assert master work\n");
@@ -1701,7 +1701,7 @@ again:
                if (r & DLM_ASSERT_RESPONSE_REASSERT) {
                        mlog(0, "%.*s: node %u create mles on other "
-                             "nodes and requests a re-assert\n", 
+                             "nodes and requests a re-assert\n",
                             namelen, lockname, to);
                        reassert = 1;
                }
@@ -1812,7 +1812,7 @@ int dlm_assert_master_handler(struct o2net_msg *msg, u32 len, void *data,
                                spin_unlock(&dlm->master_lock);
                                spin_unlock(&dlm->spinlock);
                                goto done;
-                        }       
+                        }
                }
        }
        spin_unlock(&dlm->master_lock);
@@ -1883,7 +1883,7 @@ ok:
                int extra_ref = 0;
                int nn = -1;
                int rr, err = 0;
-                
                spin_lock(&mle->spinlock);
                if (mle->type == DLM_MLE_BLOCK || mle->type == DLM_MLE_MIGRATION)
                        extra_ref = 1;
@@ -1891,7 +1891,7 @@ ok:
                        /* MASTER mle: if any bits set in the response map
                         * then the calling node needs to re-assert to clear
                         * up nodes that this node contacted */
-                        while ((nn = find_next_bit (mle->response_map, O2NM_MAX_NODES, 
+                        while ((nn = find_next_bit (mle->response_map, O2NM_MAX_NODES,
                                                    nn+1)) < O2NM_MAX_NODES) {
                                if (nn != dlm->node_num && nn != assert->node_idx)
                                        master_request = 1;
@@ -2002,7 +2002,7 @@ kill:
        __dlm_print_one_lock_resource(res);
        spin_unlock(&res->spinlock);
        spin_unlock(&dlm->spinlock);
-        *ret_data = (void *)res; 
+        *ret_data = (void *)res;
        dlm_put(dlm);
        return -EINVAL;
 }
@@ -2040,10 +2040,10 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
        item->u.am.request_from = request_from;
        item->u.am.flags = flags;
-        if (ignore_higher) 
+        if (ignore_higher)
-                mlog(0, "IGNORE HIGHER: %.*s\n", res->lockname.len, 
+                mlog(0, "IGNORE HIGHER: %.*s\n", res->lockname.len,
                     res->lockname.name);
-                
        spin_lock(&dlm->work_lock);
        list_add_tail(&item->list, &dlm->work_list);
        spin_unlock(&dlm->work_lock);
@@ -2133,7 +2133,7 @@ put:
 * think that $RECOVERY is currently mastered by a dead node.  If so,
 * we wait a short time to allow that node to get notified by its own
 * heartbeat stack, then check again.  All $RECOVERY lock resources
- * mastered by dead nodes are purged when the hearbeat callback is 
+ * mastered by dead nodes are purged when the hearbeat callback is
 * fired, so we can know for sure that it is safe to continue once
 * the node returns a live node or no node.  */
 static int dlm_pre_master_reco_lockres(struct dlm_ctxt *dlm,
@@ -2174,7 +2174,7 @@ static int dlm_pre_master_reco_lockres(struct dlm_ctxt *dlm,
                                ret = -EAGAIN;
                        }
                        spin_unlock(&dlm->spinlock);
-                        mlog(0, "%s: reco lock master is %u\n", dlm->name, 
+                        mlog(0, "%s: reco lock master is %u\n", dlm->name,
                             master);
                        break;
                }
@@ -2602,7 +2602,7 @@ fail:
                        mlog(0, "%s:%.*s: timed out during migration\n",
                             dlm->name, res->lockname.len, res->lockname.name);
-                        /* avoid hang during shutdown when migrating lockres 
+                        /* avoid hang during shutdown when migrating lockres
                         * to a node which also goes down */
                        if (dlm_is_node_dead(dlm, target)) {
                                mlog(0, "%s:%.*s: expected migration "
@@ -2738,7 +2738,7 @@ static int dlm_migration_can_proceed(struct dlm_ctxt *dlm,
        can_proceed = !!(res->state & DLM_LOCK_RES_MIGRATING);
        spin_unlock(&res->spinlock);
-        /* target has died, so make the caller break out of the 
+        /* target has died, so make the caller break out of the
         * wait_event, but caller must recheck the domain_map */
        spin_lock(&dlm->spinlock);
        if (!test_bit(mig_target, dlm->domain_map))
diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
index 2f9e4e19a4f2..344bcf90cbf4 100644
--- a/fs/ocfs2/dlm/dlmrecovery.c
+++ b/fs/ocfs2/dlm/dlmrecovery.c
@@ -1050,7 +1050,7 @@ static void dlm_move_reco_locks_to_list(struct dlm_ctxt *dlm,
                                if (lock->ml.node == dead_node) {
                                        mlog(0, "AHA! there was "
                                             "a $RECOVERY lock for dead "
-                                             "node %u (%s)!\n", 
+                                             "node %u (%s)!\n",
                                             dead_node, dlm->name);
                                        list_del_init(&lock->list);
                                        dlm_lock_put(lock);
@@ -1164,6 +1164,39 @@ static void dlm_init_migratable_lockres(struct dlm_migratable_lockres *mres,
        mres->master = master;
 }
+static void dlm_prepare_lvb_for_migration(struct dlm_lock *lock,
+                                          struct dlm_migratable_lockres *mres,
+                                          int queue)
+{
+        if (!lock->lksb)
+               return;
+        /* Ignore lvb in all locks in the blocked list */
+        if (queue == DLM_BLOCKED_LIST)
+                return;
+        /* Only consider lvbs in locks with granted EX or PR lock levels */
+        if (lock->ml.type != LKM_EXMODE && lock->ml.type != LKM_PRMODE)
+                return;
+        if (dlm_lvb_is_empty(mres->lvb)) {
+                memcpy(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN);
+                return;
+        }
+        /* Ensure the lvb copied for migration matches in other valid locks */
+        if (!memcmp(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN))
+                return;
+        mlog(ML_ERROR, "Mismatched lvb in lock cookie=%u:%llu, name=%.*s, "
+             "node=%u\n",
+             dlm_get_lock_cookie_node(be64_to_cpu(lock->ml.cookie)),
+             dlm_get_lock_cookie_seq(be64_to_cpu(lock->ml.cookie)),
+             lock->lockres->lockname.len, lock->lockres->lockname.name,
+             lock->ml.node);
+        dlm_print_one_lock_resource(lock->lockres);
+        BUG();
+}
 /* returns 1 if this lock fills the network structure,
 * 0 otherwise */
@@ -1181,20 +1214,7 @@ static int dlm_add_lock_to_array(struct dlm_lock *lock,
        ml->list = queue;
        if (lock->lksb) {
                ml->flags = lock->lksb->flags;
-                /* send our current lvb */
+                dlm_prepare_lvb_for_migration(lock, mres, queue);
-                if (ml->type == LKM_EXMODE ||
-                    ml->type == LKM_PRMODE) {
-                        /* if it is already set, this had better be a PR
-                         * and it has to match */
-                        if (!dlm_lvb_is_empty(mres->lvb) &&
-                            (ml->type == LKM_EXMODE ||
-                             memcmp(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN))) {
-                                mlog(ML_ERROR, "mismatched lvbs!\n");
-                                dlm_print_one_lock_resource(lock->lockres);
-                                BUG();
-                        }
-                        memcpy(mres->lvb, lock->lksb->lvb, DLM_LVB_LEN);
-                }
        }
        ml->node = lock->ml.node;
        mres->num_locks++;
@@ -1730,6 +1750,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
        struct dlm_lock *lock = NULL;
        u8 from = O2NM_MAX_NODES;
        unsigned int added = 0;
+        __be64 c;
        mlog(0, "running %d locks for this lockres\n", mres->num_locks);
        for (i=0; i<mres->num_locks; i++) {
@@ -1777,19 +1798,48 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                        /* lock is always created locally first, and
                         * destroyed locally last.  it must be on the list */
                        if (!lock) {
-                                __be64 c = ml->cookie;
+                                c = ml->cookie;
-                                mlog(ML_ERROR, "could not find local lock "
+                                mlog(ML_ERROR, "Could not find local lock "
-                                               "with cookie %u:%llu!\n",
+                                               "with cookie %u:%llu, node %u, "
+                                               "list %u, flags 0x%x, type %d, "
+                                               "conv %d, highest blocked %d\n",
                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
-                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)));
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     ml->node, ml->list, ml->flags, ml->type,
+                                     ml->convert_type, ml->highest_blocked);
+                                __dlm_print_one_lock_resource(res);
+                                BUG();
+                        }
+                        if (lock->ml.node != ml->node) {
+                                c = lock->ml.cookie;
+                                mlog(ML_ERROR, "Mismatched node# in lock "
+                                     "cookie %u:%llu, name %.*s, node %u\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     res->lockname.len, res->lockname.name,
+                                     lock->ml.node);
+                                c = ml->cookie;
+                                mlog(ML_ERROR, "Migrate lock cookie %u:%llu, "
+                                     "node %u, list %u, flags 0x%x, type %d, "
+                                     "conv %d, highest blocked %d\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     ml->node, ml->list, ml->flags, ml->type,
+                                     ml->convert_type, ml->highest_blocked);
                                __dlm_print_one_lock_resource(res);
                                BUG();
                        }
-                        BUG_ON(lock->ml.node != ml->node);
                        if (tmpq != queue) {
-                                mlog(0, "lock was on %u instead of %u for %.*s\n",
+                                c = ml->cookie;
-                                     j, ml->list, res->lockname.len, res->lockname.name);
+                                mlog(0, "Lock cookie %u:%llu was on list %u "
+                                     "instead of list %u for %.*s\n",
+                                     dlm_get_lock_cookie_node(be64_to_cpu(c)),
+                                     dlm_get_lock_cookie_seq(be64_to_cpu(c)),
+                                     j, ml->list, res->lockname.len,
+                                     res->lockname.name);
+                                __dlm_print_one_lock_resource(res);
                                spin_unlock(&res->spinlock);
                                continue;
                        }
@@ -1839,7 +1889,7 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm,
                                 * the lvb. */
                                memcpy(res->lvb, mres->lvb, DLM_LVB_LEN);
                        } else {
-                                /* otherwise, the node is sending its 
+                                /* otherwise, the node is sending its
                                 * most recent valid lvb info */
                                BUG_ON(ml->type != LKM_EXMODE &&
                                       ml->type != LKM_PRMODE);
@@ -1886,7 +1936,7 @@ skip_lvb:
                spin_lock(&res->spinlock);
                list_for_each_entry(lock, queue, list) {
                        if (lock->ml.cookie == ml->cookie) {
-                                __be64 c = lock->ml.cookie;
+                                c = lock->ml.cookie;
                                mlog(ML_ERROR, "%s:%.*s: %u:%llu: lock already "
                                     "exists on this lockres!\n", dlm->name,
                                     res->lockname.len, res->lockname.name,
@@ -2114,7 +2164,7 @@ static void dlm_revalidate_lvb(struct dlm_ctxt *dlm,
        assert_spin_locked(&res->spinlock);
        if (res->owner == dlm->node_num)
-                /* if this node owned the lockres, and if the dead node 
+                /* if this node owned the lockres, and if the dead node
                 * had an EX when he died, blank out the lvb */
                search_node = dead_node;
        else {
@@ -2152,7 +2202,7 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
        /* this node is the lockres master:
         * 1) remove any stale locks for the dead node
-         * 2) if the dead node had an EX when he died, blank out the lvb 
+         * 2) if the dead node had an EX when he died, blank out the lvb
         */
        assert_spin_locked(&dlm->spinlock);
        assert_spin_locked(&res->spinlock);
@@ -2193,7 +2243,12 @@ static void dlm_free_dead_locks(struct dlm_ctxt *dlm,
                mlog(0, "%s:%.*s: freed %u locks for dead node %u, "
                     "dropping ref from lockres\n", dlm->name,
                     res->lockname.len, res->lockname.name, freed, dead_node);
-                BUG_ON(!test_bit(dead_node, res->refmap));
+                if(!test_bit(dead_node, res->refmap)) {
+                        mlog(ML_ERROR, "%s:%.*s: freed %u locks for dead node %u, "
+                             "but ref was not set\n", dlm->name,
+                             res->lockname.len, res->lockname.name, freed, dead_node);
+                        __dlm_print_one_lock_resource(res);
+                }
                dlm_lockres_clear_refmap_bit(dead_node, res);
        } else if (test_bit(dead_node, res->refmap)) {
                mlog(0, "%s:%.*s: dead node %u had a ref, but had "
@@ -2260,7 +2315,7 @@ static void dlm_do_local_recovery_cleanup(struct dlm_ctxt *dlm, u8 dead_node)
                                }
                                spin_unlock(&res->spinlock);
                                continue;
-                        }                       
+                        }
                        spin_lock(&res->spinlock);
                        /* zero the lvb if necessary */
                        dlm_revalidate_lvb(dlm, res, dead_node);
@@ -2411,7 +2466,7 @@ static void dlm_reco_unlock_ast(void *astdata, enum dlm_status st)
 * this function on each node racing to become the recovery
 * master will not stop attempting this until either:
 * a) this node gets the EX (and becomes the recovery master),
- * or b) dlm->reco.new_master gets set to some nodenum 
+ * or b) dlm->reco.new_master gets set to some nodenum
 * != O2NM_INVALID_NODE_NUM (another node will do the reco).
 * so each time a recovery master is needed, the entire cluster
 * will sync at this point.  if the new master dies, that will
@@ -2424,7 +2479,7 @@ static int dlm_pick_recovery_master(struct dlm_ctxt *dlm)
        mlog(0, "starting recovery of %s at %lu, dead=%u, this=%u\n",
             dlm->name, jiffies, dlm->reco.dead_node, dlm->node_num);
-again:  
+again:
        memset(&lksb, 0, sizeof(lksb));
        ret = dlmlock(dlm, LKM_EXMODE, &lksb, LKM_NOQUEUE|LKM_RECOVERY,
@@ -2437,8 +2492,8 @@ again:
        if (ret == DLM_NORMAL) {
                mlog(0, "dlm=%s dlmlock says I got it (this=%u)\n",
                     dlm->name, dlm->node_num);
-                
-                /* got the EX lock.  check to see if another node 
+                /* got the EX lock.  check to see if another node
                 * just became the reco master */
                if (dlm_reco_master_ready(dlm)) {
                        mlog(0, "%s: got reco EX lock, but %u will "
@@ -2451,12 +2506,12 @@ again:
                        /* see if recovery was already finished elsewhere */
                        spin_lock(&dlm->spinlock);
                        if (dlm->reco.dead_node == O2NM_INVALID_NODE_NUM) {
-                                status = -EINVAL;       
+                                status = -EINVAL;
                                mlog(0, "%s: got reco EX lock, but "
                                     "node got recovered already\n", dlm->name);
                                if (dlm->reco.new_master != O2NM_INVALID_NODE_NUM) {
                                        mlog(ML_ERROR, "%s: new master is %u "
-                                             "but no dead node!\n", 
+                                             "but no dead node!\n",
                                             dlm->name, dlm->reco.new_master);
                                        BUG();
                                }
@@ -2468,7 +2523,7 @@ again:
                 * set the master and send the messages to begin recovery */
                if (!status) {
                        mlog(0, "%s: dead=%u, this=%u, sending "
-                             "begin_reco now\n", dlm->name, 
+                             "begin_reco now\n", dlm->name,
                             dlm->reco.dead_node, dlm->node_num);
                        status = dlm_send_begin_reco_message(dlm,
                                      dlm->reco.dead_node);
@@ -2501,7 +2556,7 @@ again:
                mlog(0, "dlm=%s dlmlock says another node got it (this=%u)\n",
                     dlm->name, dlm->node_num);
                /* another node is master. wait on
-                 * reco.new_master != O2NM_INVALID_NODE_NUM 
+                 * reco.new_master != O2NM_INVALID_NODE_NUM
                 * for at most one second */
                wait_event_timeout(dlm->dlm_reco_thread_wq,
                                         dlm_reco_master_ready(dlm),
@@ -2589,7 +2644,13 @@ retry:
                             "begin reco msg (%d)\n", dlm->name, nodenum, ret);
                        ret = 0;
                }
-                if (ret == -EAGAIN) {
+                /*
+                 * Prior to commit aad1b15310b9bcd59fa81ab8f2b1513b59553ea8,
+                 * dlm_begin_reco_handler() returned EAGAIN and not -EAGAIN.
+                 * We are handling both for compatibility reasons.
+                 */
+                if (ret == -EAGAIN || ret == EAGAIN) {
                        mlog(0, "%s: trying to start recovery of node "
                             "%u, but node %u is waiting for last recovery "
                             "to complete, backoff for a bit\n", dlm->name,
@@ -2599,7 +2660,7 @@ retry:
                }
                if (ret < 0) {
                        struct dlm_lock_resource *res;
-                        /* this is now a serious problem, possibly ENOMEM 
+                        /* this is now a serious problem, possibly ENOMEM
                         * in the network stack.  must retry */
                        mlog_errno(ret);
                        mlog(ML_ERROR, "begin reco of dlm %s to node %u "
@@ -2612,7 +2673,7 @@ retry:
                        } else {
                                mlog(ML_ERROR, "recovery lock not found\n");
                        }
-                        /* sleep for a bit in hopes that we can avoid 
+                        /* sleep for a bit in hopes that we can avoid
                         * another ENOMEM */
                        msleep(100);
                        goto retry;
@@ -2664,7 +2725,7 @@ int dlm_begin_reco_handler(struct o2net_msg *msg, u32 len, void *data,
        }
        if (dlm->reco.dead_node != O2NM_INVALID_NODE_NUM) {
                mlog(ML_NOTICE, "%s: dead_node previously set to %u, "
-                     "node %u changing it to %u\n", dlm->name, 
+                     "node %u changing it to %u\n", dlm->name,
                     dlm->reco.dead_node, br->node_idx, br->dead_node);
        }
        dlm_set_reco_master(dlm, br->node_idx);
@@ -2730,8 +2791,8 @@ stage2:
                if (ret < 0) {
                        mlog_errno(ret);
                        if (dlm_is_host_down(ret)) {
-                                /* this has no effect on this recovery 
+                                /* this has no effect on this recovery
-                                 * session, so set the status to zero to 
+                                 * session, so set the status to zero to
                                 * finish out the last recovery */
                                mlog(ML_ERROR, "node %u went down after this "
                                     "node finished recovery.\n", nodenum);
@@ -2768,7 +2829,7 @@ int dlm_finalize_reco_handler(struct o2net_msg *msg, u32 len, void *data,
        mlog(0, "%s: node %u finalizing recovery stage%d of "
             "node %u (%u:%u)\n", dlm->name, fr->node_idx, stage,
             fr->dead_node, dlm->reco.dead_node, dlm->reco.new_master);
- 
        spin_lock(&dlm->spinlock);
        if (dlm->reco.new_master != fr->node_idx) {
diff --git a/fs/ocfs2/dlm/dlmunlock.c b/fs/ocfs2/dlm/dlmunlock.c
index 00f53b2aea76..49e29ecd0201 100644
--- a/fs/ocfs2/dlm/dlmunlock.c
+++ b/fs/ocfs2/dlm/dlmunlock.c
@@ -190,8 +190,8 @@ static enum dlm_status dlmunlock_common(struct dlm_ctxt *dlm,
                        actions &= ~(DLM_UNLOCK_REMOVE_LOCK|
                                     DLM_UNLOCK_REGRANT_LOCK|
                                     DLM_UNLOCK_CLEAR_CONVERT_TYPE);
-                } else if (status == DLM_RECOVERING || 
+                } else if (status == DLM_RECOVERING ||
-                           status == DLM_MIGRATING || 
+                           status == DLM_MIGRATING ||
                           status == DLM_FORWARD) {
                        /* must clear the actions because this unlock
                         * is about to be retried.  cannot free or do
@@ -661,14 +661,14 @@ retry:
        if (call_ast) {
                mlog(0, "calling unlockast(%p, %d)\n", data, status);
                if (is_master) {
-                        /* it is possible that there is one last bast 
+                        /* it is possible that there is one last bast
                         * pending.  make sure it is flushed, then
                         * call the unlockast.
                         * not an issue if this is a mastered remotely,
                         * since this lock has been removed from the
                         * lockres queues and cannot be found. */
                        dlm_kick_thread(dlm, NULL);
-                        wait_event(dlm->ast_wq, 
+                        wait_event(dlm->ast_wq,
                                   dlm_lock_basts_flushed(dlm, lock));
                }
                (*unlockast)(data, status);
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index c5e4a49e3a12..e044019cb3b1 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -875,6 +875,14 @@ static inline void ocfs2_generic_handle_convert_action(struct ocfs2_lock_res *lo
                lockres_or_flags(lockres, OCFS2_LOCK_NEEDS_REFRESH);
        lockres->l_level = lockres->l_requested;
+        /*
+         * We set the OCFS2_LOCK_UPCONVERT_FINISHING flag before clearing
+         * the OCFS2_LOCK_BUSY flag to prevent the dc thread from
+         * downconverting the lock before the upconvert has fully completed.
+         */
+        lockres_or_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
        mlog_exit_void();
@@ -907,8 +915,6 @@ static int ocfs2_generic_handle_bast(struct ocfs2_lock_res *lockres,
        assert_spin_locked(&lockres->l_lock);
-        lockres_or_flags(lockres, OCFS2_LOCK_BLOCKED);
        if (level > lockres->l_blocking) {
                /* only schedule a downconvert if we haven't already scheduled
                 * one that goes low enough to satisfy the level we're
@@ -921,6 +927,9 @@ static int ocfs2_generic_handle_bast(struct ocfs2_lock_res *lockres,
                lockres->l_blocking = level;
        }
+        if (needs_downconvert)
+                lockres_or_flags(lockres, OCFS2_LOCK_BLOCKED);
        mlog_exit(needs_downconvert);
        return needs_downconvert;
 }
@@ -1133,6 +1142,7 @@ static inline void ocfs2_recover_from_dlm_error(struct ocfs2_lock_res *lockres,
        mlog_entry_void();
        spin_lock_irqsave(&lockres->l_lock, flags);
        lockres_clear_flags(lockres, OCFS2_LOCK_BUSY);
+        lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
        if (convert)
                lockres->l_action = OCFS2_AST_INVALID;
        else
@@ -1323,13 +1333,13 @@ static int __ocfs2_cluster_lock(struct ocfs2_super *osb,
 again:
        wait = 0;
+        spin_lock_irqsave(&lockres->l_lock, flags);
        if (catch_signals && signal_pending(current)) {
                ret = -ERESTARTSYS;
-                goto out;
+                goto unlock;
        }
-        spin_lock_irqsave(&lockres->l_lock, flags);
        mlog_bug_on_msg(lockres->l_flags & OCFS2_LOCK_FREEING,
                        "Cluster lock called on freeing lockres %s! flags "
                        "0x%lx\n", lockres->l_name, lockres->l_flags);
@@ -1346,6 +1356,25 @@ again:
                goto unlock;
        }
+        if (lockres->l_flags & OCFS2_LOCK_UPCONVERT_FINISHING) {
+                /*
+                 * We've upconverted. If the lock now has a level we can
+                 * work with, we take it. If, however, the lock is not at the
+                 * required level, we go thru the full cycle. One way this could
+                 * happen is if a process requesting an upconvert to PR is
+                 * closely followed by another requesting upconvert to an EX.
+                 * If the process requesting EX lands here, we want it to
+                 * continue attempting to upconvert and let the process
+                 * requesting PR take the lock.
+                 * If multiple processes request upconvert to PR, the first one
+                 * here will take the lock. The others will have to go thru the
+                 * OCFS2_LOCK_BLOCKED check to ensure that there is no pending
+                 * downconvert request.
+                 */
+                if (level <= lockres->l_level)
+                        goto update_holders;
+        }
        if (lockres->l_flags & OCFS2_LOCK_BLOCKED &&
            !ocfs2_may_continue_on_blocked_lock(lockres, level)) {
                /* is the lock is currently blocked on behalf of
@@ -1416,11 +1445,14 @@ again:
                goto again;
        }
+update_holders:
        /* Ok, if we get here then we're good to go. */
        ocfs2_inc_holders(lockres, level);
        ret = 0;
 unlock:
+        lockres_clear_flags(lockres, OCFS2_LOCK_UPCONVERT_FINISHING);
        spin_unlock_irqrestore(&lockres->l_lock, flags);
 out:
        /*
@@ -3155,7 +3187,7 @@ out:
 /* Mark the lockres as being dropped. It will no longer be
 * queued if blocking, but we still may have to wait on it
 * being dequeued from the downconvert thread before we can consider
- * it safe to drop. 
+ * it safe to drop.
 *
 * You can *not* attempt to call cluster_lock on this lockres anymore. */
 void ocfs2_mark_lockres_freeing(struct ocfs2_lock_res *lockres)
@@ -3352,6 +3384,7 @@ static int ocfs2_unblock_lock(struct ocfs2_super *osb,
        unsigned long flags;
        int blocking;
        int new_level;
+        int level;
        int ret = 0;
        int set_lvb = 0;
        unsigned int gen;
@@ -3360,9 +3393,17 @@ static int ocfs2_unblock_lock(struct ocfs2_super *osb,
        spin_lock_irqsave(&lockres->l_lock, flags);
-        BUG_ON(!(lockres->l_flags & OCFS2_LOCK_BLOCKED));
 recheck:
+        /*
+         * Is it still blocking? If not, we have no more work to do.
+         */
+        if (!(lockres->l_flags & OCFS2_LOCK_BLOCKED)) {
+                BUG_ON(lockres->l_blocking != DLM_LOCK_NL);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                ret = 0;
+                goto leave;
+        }
        if (lockres->l_flags & OCFS2_LOCK_BUSY) {
                /* XXX
                 * This is a *big* race.  The OCFS2_LOCK_PENDING flag
@@ -3401,6 +3442,31 @@ recheck:
                goto leave;
        }
+        /*
+         * This prevents livelocks. OCFS2_LOCK_UPCONVERT_FINISHING flag is
+         * set when the ast is received for an upconvert just before the
+         * OCFS2_LOCK_BUSY flag is cleared. Now if the fs received a bast
+         * on the heels of the ast, we want to delay the downconvert just
+         * enough to allow the up requestor to do its task. Because this
+         * lock is in the blocked queue, the lock will be downconverted
+         * as soon as the requestor is done with the lock.
+         */
+        if (lockres->l_flags & OCFS2_LOCK_UPCONVERT_FINISHING)
+                goto leave_requeue;
+        /*
+         * How can we block and yet be at NL?  We were trying to upconvert
+         * from NL and got canceled.  The code comes back here, and now
+         * we notice and clear BLOCKING.
+         */
+        if (lockres->l_level == DLM_LOCK_NL) {
+                BUG_ON(lockres->l_ex_holders || lockres->l_ro_holders);
+                lockres->l_blocking = DLM_LOCK_NL;
+                lockres_clear_flags(lockres, OCFS2_LOCK_BLOCKED);
+                spin_unlock_irqrestore(&lockres->l_lock, flags);
+                goto leave;
+        }
        /* if we're blocking an exclusive and we have *any* holders,
         * then requeue. */
        if ((lockres->l_blocking == DLM_LOCK_EX)
@@ -3438,6 +3504,7 @@ recheck:
         * may sleep, so we save off a copy of what we're blocking as
         * it may change while we're not holding the spin lock. */
        blocking = lockres->l_blocking;
+        level = lockres->l_level;
        spin_unlock_irqrestore(&lockres->l_lock, flags);
        ctl->unblock_action = lockres->l_ops->downconvert_worker(lockres, blocking);
@@ -3446,7 +3513,7 @@ recheck:
                goto leave;
        spin_lock_irqsave(&lockres->l_lock, flags);
-        if (blocking != lockres->l_blocking) {
+        if ((blocking != lockres->l_blocking) || (level != lockres->l_level)) {
                /* If this changed underneath us, then we can't drop
                 * it just yet. */
                goto recheck;
diff --git a/fs/ocfs2/export.c b/fs/ocfs2/export.c
index 15713cbb865c..19ad145d2af3 100644
--- a/fs/ocfs2/export.c
+++ b/fs/ocfs2/export.c
@@ -239,7 +239,7 @@ static int ocfs2_encode_fh(struct dentry *dentry, u32 *fh_in, int *max_len,
                mlog(0, "Encoding parent: blkno: %llu, generation: %u\n",
                     (unsigned long long)blkno, generation);
        }
-        
        *max_len = len;
 bail:
diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
index d35a27f4523e..5328529e7fd2 100644
--- a/fs/ocfs2/extent_map.c
+++ b/fs/ocfs2/extent_map.c
@@ -192,7 +192,7 @@ static int ocfs2_try_to_merge_extent_map(struct ocfs2_extent_map_item *emi,
                emi->ei_clusters += ins->ei_clusters;
                return 1;
        } else if ((ins->ei_phys + ins->ei_clusters) == emi->ei_phys &&
-                   (ins->ei_cpos + ins->ei_clusters) == emi->ei_phys &&
+                   (ins->ei_cpos + ins->ei_clusters) == emi->ei_cpos &&
                   ins->ei_flags == emi->ei_flags) {
                emi->ei_phys = ins->ei_phys;
                emi->ei_cpos = ins->ei_cpos;
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 06ccf6a86d35..558ce0312421 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -749,7 +749,7 @@ static int ocfs2_write_zero_page(struct inode *inode,
        int ret;
        offset = (size & (PAGE_CACHE_SIZE-1)); /* Within page */
-        /* ugh.  in prepare/commit_write, if from==to==start of block, we 
+        /* ugh.  in prepare/commit_write, if from==to==start of block, we
        ** skip the prepare.  make sure we never send an offset for the start
        ** of a block
        */
@@ -1779,7 +1779,7 @@ static int ocfs2_prepare_inode_for_write(struct dentry *dentry,
        struct inode *inode = dentry->d_inode;
        loff_t saved_pos, end;
-        /* 
+        /*
         * We start with a read level meta lock and only jump to an ex
         * if we need to make modifications here.
         */
@@ -2013,8 +2013,8 @@ out_dio:
        /* buffered aio wouldn't have proper lock coverage today */
        BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
-        if ((file->f_flags & O_DSYNC && !direct_io) || IS_SYNC(inode) ||
+        if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
-            (file->f_flags & O_DIRECT && has_refcount)) {
+            ((file->f_flags & O_DIRECT) && has_refcount)) {
                ret = filemap_fdatawrite_range(file->f_mapping, pos,
                                               pos + count - 1);
                if (ret < 0)
@@ -2033,7 +2033,7 @@ out_dio:
                                                      pos + count - 1);
        }
-        /* 
+        /*
         * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
         * function pointer which is called when o_direct io completes so that
         * it can unlock our rw lock.  (it's the clustered equivalent of
@@ -2198,7 +2198,7 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
                goto bail;
        }
-        /* 
+        /*
         * buffered reads protect themselves in ->readpage().  O_DIRECT reads
         * need locks to protect pending reads from racing with truncate.
         */
@@ -2220,10 +2220,10 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
         * We're fine letting folks race truncates and extending
         * writes with read across the cluster, just like they can
         * locally. Hence no rw_lock during read.
-         * 
+         *
         * Take and drop the meta data lock to update inode fields
         * like i_size. This allows the checks down below
-         * generic_file_aio_read() a chance of actually working. 
+         * generic_file_aio_read() a chance of actually working.
         */
        ret = ocfs2_inode_lock_atime(inode, filp->f_vfsmnt, &lock_level);
        if (ret < 0) {
@@ -2248,7 +2248,7 @@ static ssize_t ocfs2_file_aio_read(struct kiocb *iocb,
 bail:
        if (have_alloc_sem)
                up_read(&inode->i_alloc_sem);
-        if (rw_level != -1) 
+        if (rw_level != -1)
                ocfs2_rw_unlock(inode, rw_level);
        mlog_exit(ret);
diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c
index 0297fb8982b8..88459bdd1ff3 100644
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -475,7 +475,7 @@ static int ocfs2_read_locked_inode(struct inode *inode,
        if (args->fi_flags & OCFS2_FI_FLAG_ORPHAN_RECOVERY) {
                status = ocfs2_try_open_lock(inode, 0);
                if (status) {
-                        make_bad_inode(inode);  
+                        make_bad_inode(inode);
                        return status;
                }
        }
@@ -684,7 +684,7 @@ bail:
        return status;
 }
-/* 
+/*
 * Serialize with orphan dir recovery. If the process doing
 * recovery on this orphan dir does an iget() with the dir
 * i_mutex held, we'll deadlock here. Instead we detect this
diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c
index 31fbb0619510..7d9d9c132cef 100644
--- a/fs/ocfs2/ioctl.c
+++ b/fs/ocfs2/ioctl.c
@@ -7,6 +7,7 @@
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/compat.h>
 #define MLOG_MASK_PREFIX ML_INODE
 #include <cluster/masklog.h>
@@ -181,6 +182,10 @@ long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 #ifdef CONFIG_COMPAT
 long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
 {
+        bool preserve;
+        struct reflink_arguments args;
+        struct inode *inode = file->f_path.dentry->d_inode;
        switch (cmd) {
        case OCFS2_IOC32_GETFLAGS:
                cmd = OCFS2_IOC_GETFLAGS;
@@ -195,8 +200,15 @@ long ocfs2_compat_ioctl(struct file *file, unsigned cmd, unsigned long arg)
        case OCFS2_IOC_GROUP_EXTEND:
        case OCFS2_IOC_GROUP_ADD:
        case OCFS2_IOC_GROUP_ADD64:
-        case OCFS2_IOC_REFLINK:
                break;
+        case OCFS2_IOC_REFLINK:
+                if (copy_from_user(&args, (struct reflink_arguments *)arg,
+                                   sizeof(args)))
+                        return -EFAULT;
+                preserve = (args.preserve != 0);
+                return ocfs2_reflink_ioctl(inode, compat_ptr(args.old_path),
+                                           compat_ptr(args.new_path), preserve);
        default:
                return -ENOIOCTLCMD;
        }
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index bf34c491ae96..9336c60e3a36 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -2034,7 +2034,7 @@ static int ocfs2_queue_orphans(struct ocfs2_super *osb,
                status = -ENOENT;
                mlog_errno(status);
                return status;
-        }       
+        }
        mutex_lock(&orphan_dir_inode->i_mutex);
        status = ocfs2_inode_lock(orphan_dir_inode, NULL, 0);
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 9362eea7424b..740f448041e2 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -136,6 +136,10 @@ enum ocfs2_unlock_action {
 #define OCFS2_LOCK_PENDING       (0x00000400) /* This lockres is pending a
                                                 call to dlm_lock.  Only
                                                 exists with BUSY set. */
+#define OCFS2_LOCK_UPCONVERT_FINISHING (0x00000800) /* blocks the dc thread
+                                                     * from downconverting
+                                                     * before the upconvert
+                                                     * has completed */
 struct ocfs2_lock_res_ops;
diff --git a/fs/ocfs2/ocfs2_fs.h b/fs/ocfs2/ocfs2_fs.h
index 1a1a679e51b5..7638a38c32bc 100644
--- a/fs/ocfs2/ocfs2_fs.h
+++ b/fs/ocfs2/ocfs2_fs.h
@@ -1417,9 +1417,16 @@ static inline int ocfs2_fast_symlink_chars(int blocksize)
        return blocksize - offsetof(struct ocfs2_dinode, id2.i_symlink);
 }
-static inline int ocfs2_max_inline_data(int blocksize)
+static inline int ocfs2_max_inline_data_with_xattr(int blocksize,
+                                                   struct ocfs2_dinode *di)
 {
-        return blocksize - offsetof(struct ocfs2_dinode, id2.i_data.id_data);
+        if (di && (di->i_dyn_features & OCFS2_INLINE_XATTR_FL))
+                return blocksize -
+                        offsetof(struct ocfs2_dinode, id2.i_data.id_data) -
+                        di->i_xattr_inline_size;
+        else
+                return blocksize -
+                        offsetof(struct ocfs2_dinode, id2.i_data.id_data);
 }
 static inline int ocfs2_extent_recs_per_inode(int blocksize)
diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
index 74db2be75dd6..8ae65c9c020c 100644
--- a/fs/ocfs2/refcounttree.c
+++ b/fs/ocfs2/refcounttree.c
@@ -2945,7 +2945,7 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,
        while (offset < end) {
                page_index = offset >> PAGE_CACHE_SHIFT;
-                map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
+                map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
                if (map_end > end)
                        map_end = end;
@@ -2957,8 +2957,12 @@ static int ocfs2_duplicate_clusters_by_page(handle_t *handle,
                page = grab_cache_page(mapping, page_index);
-                /* This page can't be dirtied before we CoW it out. */
+                /*
-                BUG_ON(PageDirty(page));
+                 * In case PAGE_CACHE_SIZE <= CLUSTER_SIZE, This page
+                 * can't be dirtied before we CoW it out.
+                 */
+                if (PAGE_CACHE_SIZE <= OCFS2_SB(sb)->s_clustersize)
+                        BUG_ON(PageDirty(page));
                if (!PageUptodate(page)) {
                        ret = block_read_full_page(page, ocfs2_get_block);
@@ -3170,7 +3174,7 @@ static int ocfs2_cow_sync_writeback(struct super_block *sb,
        while (offset < end) {
                page_index = offset >> PAGE_CACHE_SHIFT;
-                map_end = (page_index + 1) << PAGE_CACHE_SHIFT;
+                map_end = ((loff_t)page_index + 1) << PAGE_CACHE_SHIFT;
                if (map_end > end)
                        map_end = end;
diff --git a/fs/ocfs2/stack_o2cb.c b/fs/ocfs2/stack_o2cb.c
index e49c41050264..3038c92af493 100644
--- a/fs/ocfs2/stack_o2cb.c
+++ b/fs/ocfs2/stack_o2cb.c
@@ -277,7 +277,7 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
        u32 dlm_key;
        struct dlm_ctxt *dlm;
        struct o2dlm_private *priv;
-        struct dlm_protocol_version dlm_version;
+        struct dlm_protocol_version fs_version;
        BUG_ON(conn == NULL);
        BUG_ON(o2cb_stack.sp_proto == NULL);
@@ -304,18 +304,18 @@ static int o2cb_cluster_connect(struct ocfs2_cluster_connection *conn)
        /* used by the dlm code to make message headers unique, each
         * node in this domain must agree on this. */
        dlm_key = crc32_le(0, conn->cc_name, conn->cc_namelen);
-        dlm_version.pv_major = conn->cc_version.pv_major;
+        fs_version.pv_major = conn->cc_version.pv_major;
-        dlm_version.pv_minor = conn->cc_version.pv_minor;
+        fs_version.pv_minor = conn->cc_version.pv_minor;
-        dlm = dlm_register_domain(conn->cc_name, dlm_key, &dlm_version);
+        dlm = dlm_register_domain(conn->cc_name, dlm_key, &fs_version);
        if (IS_ERR(dlm)) {
                rc = PTR_ERR(dlm);
                mlog_errno(rc);
                goto out_free;
        }
-        conn->cc_version.pv_major = dlm_version.pv_major;
+        conn->cc_version.pv_major = fs_version.pv_major;
-        conn->cc_version.pv_minor = dlm_version.pv_minor;
+        conn->cc_version.pv_minor = fs_version.pv_minor;
        conn->cc_lockspace = dlm;
        dlm_register_eviction_cb(dlm, &priv->op_eviction_cb);
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 26069917a9f5..755cd49a5ef3 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1062,7 +1062,7 @@ static int ocfs2_fill_super(struct super_block *sb, void *data, int silent)
                                     "file system, but write access is "
                                     "unavailable.\n");
                        else
-                                mlog_errno(status);                     
+                                mlog_errno(status);
                        goto read_super_error;
                }
diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
index 49b133ccbf11..32499d213fc4 100644
--- a/fs/ocfs2/symlink.c
+++ b/fs/ocfs2/symlink.c
@@ -137,20 +137,20 @@ static void *ocfs2_fast_follow_link(struct dentry *dentry,
        }
        memcpy(link, target, len);
-        nd_set_link(nd, link);
 bail:
+        nd_set_link(nd, status ? ERR_PTR(status) : link);
        brelse(bh);
        mlog_exit(status);
-        return status ? ERR_PTR(status) : link;
+        return NULL;
 }
 static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-        char *link = cookie;
+        char *link = nd_get_link(nd);
+        if (!IS_ERR(link))
-        kfree(link);
+                kfree(link);
 }
 const struct inode_operations ocfs2_symlink_inode_operations = {
diff --git a/fs/ocfs2/uptodate.c b/fs/ocfs2/uptodate.c
index c61369342a27..a0a120e82b97 100644
--- a/fs/ocfs2/uptodate.c
+++ b/fs/ocfs2/uptodate.c
@@ -267,8 +267,8 @@ static int ocfs2_buffer_cached(struct ocfs2_caching_info *ci,
 }
 /* Warning: even if it returns true, this does *not* guarantee that
- * the block is stored in our inode metadata cache. 
+ * the block is stored in our inode metadata cache.
- * 
+ *
 * This can be called under lock_buffer()
 */
 int ocfs2_buffer_uptodate(struct ocfs2_caching_info *ci,
diff --git a/include/linux/ata.h b/include/linux/ata.h
index 38a6948ce0c2..20f31567ccee 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -647,9 +647,9 @@ static inline int ata_id_has_large_logical_sectors(const u16 *id)
        return id[ATA_ID_SECTOR_SIZE] & (1 << 13);
 }
-static inline u8 ata_id_logical_per_physical_sectors(const u16 *id)
+static inline u16 ata_id_logical_per_physical_sectors(const u16 *id)
 {
-        return id[ATA_ID_SECTOR_SIZE] & 0xf;
+        return 1 << (id[ATA_ID_SECTOR_SIZE] & 0xf);
 }
 static inline int ata_id_has_lba48(const u16 *id)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 5be3dab4a695..188fcae10a99 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -15,6 +15,7 @@
 # define __acquire(x)   __context__(x,1)
 # define __release(x)   __context__(x,-1)
 # define __cond_lock(x,c)       ((c) ? ({ __acquire(x); 1; }) : 0)
+# define __percpu       __attribute__((noderef, address_space(3)))
 extern void __chk_user_ptr(const volatile void __user *);
 extern void __chk_io_ptr(const volatile void __iomem *);
 #else
@@ -32,6 +33,7 @@ extern void __chk_io_ptr(const volatile void __iomem *);
 # define __acquire(x) (void)0
 # define __release(x) (void)0
 # define __cond_lock(x,c) (c)
+# define __percpu
 #endif
 #ifdef __KERNEL__
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 72ba63eb83c5..3a779ffba60b 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -24,9 +24,6 @@
 #include <linux/types.h>
-#define CN_IDX_CONNECTOR                0xffffffff
-#define CN_VAL_CONNECTOR                0xffffffff
 /*
 * Process Events connector unique ids -- used for message routing
 */
@@ -75,30 +72,6 @@ struct cn_msg {
        __u8 data[0];
 };
-/*
- * Notify structure - requests notification about
- * registering/unregistering idx/val in range [first, first+range].
- */
-struct cn_notify_req {
-        __u32 first;
-        __u32 range;
-};
-/*
- * Main notification control message
- * *_notify_num         - number of appropriate cn_notify_req structures after 
- *                              this struct.
- * group                - notification receiver's idx.
- * len                  - total length of the attached data.
- */
-struct cn_ctl_msg {
-        __u32 idx_notify_num;
-        __u32 val_notify_num;
-        __u32 group;
-        __u32 len;
-        __u8 data[0];
-};
 #ifdef __KERNEL__
 #include <asm/atomic.h>
@@ -151,11 +124,6 @@ struct cn_callback_entry {
        u32 seq, group;
 };
-struct cn_ctl_entry {
-        struct list_head notify_entry;
-        struct cn_ctl_msg *msg;
-};
 struct cn_dev {
        struct cb_id id;
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 99dc6d5cf7e5..975837e7d6c0 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -17,7 +17,7 @@ struct linux_binprm;
 extern int ima_bprm_check(struct linux_binprm *bprm);
 extern int ima_inode_alloc(struct inode *inode);
 extern void ima_inode_free(struct inode *inode);
-extern int ima_path_check(struct path *path, int mask);
+extern int ima_file_check(struct file *file, int mask);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
 extern void ima_counts_get(struct file *file);
@@ -38,7 +38,7 @@ static inline void ima_inode_free(struct inode *inode)
        return;
 }
-static inline int ima_path_check(struct path *path, int mask)
+static inline int ima_file_check(struct file *file, int mask)
 {
        return 0;
 }
diff --git a/include/linux/sched.h b/include/linux/sched.h
index abdfacc58653..78efe7c485ac 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -310,6 +310,7 @@ extern void sched_show_task(struct task_struct *p);
 #ifdef CONFIG_DETECT_SOFTLOCKUP
 extern void softlockup_tick(void);
 extern void touch_softlockup_watchdog(void);
+extern void touch_softlockup_watchdog_sync(void);
 extern void touch_all_softlockup_watchdogs(void);
 extern int proc_dosoftlockup_thresh(struct ctl_table *table, int write,
                                    void __user *buffer,
@@ -323,6 +324,9 @@ static inline void softlockup_tick(void)
 static inline void touch_softlockup_watchdog(void)
 {
 }
+static inline void touch_softlockup_watchdog_sync(void)
+{
+}
 static inline void touch_all_softlockup_watchdogs(void)
 {
 }
diff --git a/include/net/netns/conntrack.h b/include/net/netns/conntrack.h
index ba1ba0c5efd1..63d449807d9b 100644
--- a/include/net/netns/conntrack.h
+++ b/include/net/netns/conntrack.h
@@ -11,6 +11,8 @@ struct nf_conntrack_ecache;
 struct netns_ct {
        atomic_t                count;
        unsigned int            expect_count;
+        unsigned int            htable_size;
+        struct kmem_cache       *nf_conntrack_cachep;
        struct hlist_nulls_head *hash;
        struct hlist_head       *expect_hash;
        struct hlist_nulls_head unconfirmed;
@@ -28,5 +30,6 @@ struct netns_ct {
 #endif
        int                     hash_vmalloc;
        int                     expect_vmalloc;
+        char                    *slabname;
 };
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 2eb3814d6258..9a4b8b714079 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -40,6 +40,7 @@ struct netns_ipv4 {
        struct xt_table         *iptable_security;
        struct xt_table         *nat_table;
        struct hlist_head       *nat_bysource;
+        unsigned int            nat_htable_size;
        int                     nat_vmalloced;
 #endif
diff --git a/init/main.c b/init/main.c
index dac44a9356a5..4cb47a159f02 100644
--- a/init/main.c
+++ b/init/main.c
@@ -657,9 +657,9 @@ asmlinkage void __init start_kernel(void)
        proc_caches_init();
        buffer_init();
        key_init();
+        radix_tree_init();
        security_init();
        vfs_caches_init(totalram_pages);
-        radix_tree_init();
        signals_init();
        /* rootfs populating might need page-writeback */
        page_writeback_init();
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 1fbcc748044a..aa3bee566446 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2936,14 +2936,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
        for_each_subsys(root, ss) {
                struct cgroup_subsys_state *css = ss->create(ss, cgrp);
                if (IS_ERR(css)) {
                        err = PTR_ERR(css);
                        goto err_destroy;
                }
                init_cgroup_css(css, ss, cgrp);
-                if (ss->use_id)
+                if (ss->use_id) {
-                        if (alloc_css_id(ss, parent, cgrp))
+                        err = alloc_css_id(ss, parent, cgrp);
+                        if (err)
                                goto err_destroy;
+                }
                /* At error, ->destroy() callback has to free assigned ID. */
        }
diff --git a/kernel/cred.c b/kernel/cred.c
index dd76cfe5f5b0..1ed8ca18790c 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -224,7 +224,7 @@ struct cred *cred_alloc_blank(void)
 #ifdef CONFIG_KEYS
        new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL);
        if (!new->tgcred) {
-                kfree(new);
+                kmem_cache_free(cred_jar, new);
                return NULL;
        }
        atomic_set(&new->tgcred->usage, 1);
diff --git a/kernel/futex.c b/kernel/futex.c
index d9b3a2228f9d..e7a35f1039e7 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -530,8 +530,25 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
                                return -EINVAL;
                        WARN_ON(!atomic_read(&pi_state->refcount));
-                        WARN_ON(pid && pi_state->owner &&
-                                pi_state->owner->pid != pid);
+                        /*
+                         * When pi_state->owner is NULL then the owner died
+                         * and another waiter is on the fly. pi_state->owner
+                         * is fixed up by the task which acquires
+                         * pi_state->rt_mutex.
+                         *
+                         * We do not check for pid == 0 which can happen when
+                         * the owner died and robust_list_exit() cleared the
+                         * TID.
+                         */
+                        if (pid && pi_state->owner) {
+                                /*
+                                 * Bail out if user space manipulated the
+                                 * futex value.
+                                 */
+                                if (pid != task_pid_vnr(pi_state->owner))
+                                        return -EINVAL;
+                        }
                        atomic_inc(&pi_state->refcount);
                        *ps = pi_state;
@@ -758,6 +775,13 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
        if (!pi_state)
                return -EINVAL;
+        /*
+         * If current does not own the pi_state then the futex is
+         * inconsistent and user space fiddled with the futex value.
+         */
+        if (pi_state->owner != current)
+                return -EINVAL;
        raw_spin_lock(&pi_state->pi_mutex.wait_lock);
        new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
@@ -1971,7 +1995,7 @@ retry_private:
        /* Unqueue and drop the lock */
        unqueue_me_pi(&q);
-        goto out;
+        goto out_put_key;
 out_unlock_put_key:
        queue_unlock(&q, hb);
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 32c5c15d750d..498cabba225e 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -349,6 +349,7 @@ EXPORT_SYMBOL(__kfifo_from_user_n);
 * @fifo: the fifo to be used.
 * @from: pointer to the data to be added.
 * @len: the length of the data to be added.
+ * @total: the actual returned data length.
 *
 * This function copies at most @len bytes from the @from into the
 * FIFO depending and returns -EFAULT/0.
@@ -399,7 +400,7 @@ EXPORT_SYMBOL(__kfifo_to_user_n);
 * @fifo: the fifo to be used.
 * @to: where the data must be copied.
 * @len: the size of the destination buffer.
- @ @lenout: pointer to output variable with copied data
+ * @lenout: pointer to output variable with copied data
 *
 * This function copies at most @len bytes from the FIFO into the
 * @to buffer and 0 or -EFAULT.
diff --git a/kernel/kgdb.c b/kernel/kgdb.c
index c7ade62e4ef0..761fdd2b3034 100644
--- a/kernel/kgdb.c
+++ b/kernel/kgdb.c
@@ -599,7 +599,7 @@ static void kgdb_wait(struct pt_regs *regs)
        /* Signal the primary CPU that we are done: */
        atomic_set(&cpu_in_kgdb[cpu], 0);
-        touch_softlockup_watchdog();
+        touch_softlockup_watchdog_sync();
        clocksource_touch_watchdog();
        local_irq_restore(flags);
 }
@@ -1453,7 +1453,7 @@ acquirelock:
            (kgdb_info[cpu].task &&
             kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
                atomic_set(&kgdb_active, -1);
-                touch_softlockup_watchdog();
+                touch_softlockup_watchdog_sync();
                clocksource_touch_watchdog();
                local_irq_restore(flags);
@@ -1553,7 +1553,7 @@ kgdb_restore:
        }
        /* Free kgdb_active */
        atomic_set(&kgdb_active, -1);
-        touch_softlockup_watchdog();
+        touch_softlockup_watchdog_sync();
        clocksource_touch_watchdog();
        local_irq_restore(flags);
diff --git a/kernel/softlockup.c b/kernel/softlockup.c
index d22579087e27..0d4c7898ab80 100644
--- a/kernel/softlockup.c
+++ b/kernel/softlockup.c
@@ -25,6 +25,7 @@ static DEFINE_SPINLOCK(print_lock);
 static DEFINE_PER_CPU(unsigned long, softlockup_touch_ts); /* touch timestamp */
 static DEFINE_PER_CPU(unsigned long, softlockup_print_ts); /* print timestamp */
 static DEFINE_PER_CPU(struct task_struct *, softlockup_watchdog);
+static DEFINE_PER_CPU(bool, softlock_touch_sync);
 static int __read_mostly did_panic;
 int __read_mostly softlockup_thresh = 60;
@@ -79,6 +80,12 @@ void touch_softlockup_watchdog(void)
 }
 EXPORT_SYMBOL(touch_softlockup_watchdog);
+void touch_softlockup_watchdog_sync(void)
+{
+        __raw_get_cpu_var(softlock_touch_sync) = true;
+        __raw_get_cpu_var(softlockup_touch_ts) = 0;
+}
 void touch_all_softlockup_watchdogs(void)
 {
        int cpu;
@@ -118,6 +125,14 @@ void softlockup_tick(void)
        }
        if (touch_ts == 0) {
+                if (unlikely(per_cpu(softlock_touch_sync, this_cpu))) {
+                        /*
+                         * If the time stamp was touched atomically
+                         * make sure the scheduler tick is up to date.
+                         */
+                        per_cpu(softlock_touch_sync, this_cpu) = false;
+                        sched_clock_tick();
+                }
                __touch_softlockup_watchdog();
                return;
        }
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 7faaa32fbf4f..e2ab064c6d41 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -880,6 +880,7 @@ void getboottime(struct timespec *ts)
        set_normalized_timespec(ts, -boottime.tv_sec, -boottime.tv_nsec);
 }
+EXPORT_SYMBOL_GPL(getboottime);
 /**
 * monotonic_to_bootbased - Convert the monotonic time to boot based.
@@ -889,6 +890,7 @@ void monotonic_to_bootbased(struct timespec *ts)
 {
        *ts = timespec_add_safe(*ts, total_sleep_time);
 }
+EXPORT_SYMBOL_GPL(monotonic_to_bootbased);
 unsigned long get_seconds(void)
 {
diff --git a/mm/filemap.c b/mm/filemap.c
index e3736923220e..698ea80f2102 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2232,6 +2232,9 @@ again:
                if (unlikely(status))
                        break;
+                if (mapping_writably_mapped(mapping))
+                        flush_dcache_page(page);
                pagefault_disable();
                copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
                pagefault_enable();
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e91b81b63670..2d16fa6b8c2d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1515,10 +1515,9 @@ static struct attribute_group hstate_attr_group = {
        .attrs = hstate_attrs,
 };
-static int __init hugetlb_sysfs_add_hstate(struct hstate *h,
+static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
-                                struct kobject *parent,
+                                    struct kobject **hstate_kobjs,
-                                struct kobject **hstate_kobjs,
+                                    struct attribute_group *hstate_attr_group)
-                                struct attribute_group *hstate_attr_group)
 {
        int retval;
        int hi = h - hstates;
diff --git a/mm/migrate.c b/mm/migrate.c
index efddbf0926b2..9a0db5bbabe4 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -912,6 +912,9 @@ static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
                                goto out_pm;
                        err = -ENODEV;
+                        if (node < 0 || node >= MAX_NUMNODES)
+                                goto out_pm;
                        if (!node_state(node, N_HIGH_MEMORY))
                                goto out_pm;
diff --git a/net/9p/client.c b/net/9p/client.c
index 8af95b2dddd6..09d4f1e2e4a8 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -69,7 +69,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 static int parse_opts(char *opts, struct p9_client *clnt)
 {
-        char *options;
+        char *options, *tmp_options;
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
@@ -81,12 +81,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
        if (!opts)
                return 0;
-        options = kstrdup(opts, GFP_KERNEL);
+        tmp_options = kstrdup(opts, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -108,6 +109,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                        break;
                case Opt_trans:
                        clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
+                        if(clnt->trans_mod == NULL) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                   "Could not find request transport: %s\n",
+                                   (char *) &args[0]);
+                                ret = -EINVAL;
+                                goto free_and_return;
+                        }
                        break;
                case Opt_legacy:
                        clnt->dotu = 0;
@@ -117,7 +125,8 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                }
        }
-        kfree(options);
+free_and_return:
+        kfree(tmp_options);
        return ret;
 }
@@ -667,18 +676,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        clnt->trans = NULL;
        spin_lock_init(&clnt->lock);
        INIT_LIST_HEAD(&clnt->fidlist);
-        clnt->fidpool = p9_idpool_create();
-        if (IS_ERR(clnt->fidpool)) {
-                err = PTR_ERR(clnt->fidpool);
-                clnt->fidpool = NULL;
-                goto error;
-        }
        p9_tag_init(clnt);
        err = parse_opts(options, clnt);
        if (err < 0)
-                goto error;
+                goto free_client;
        if (!clnt->trans_mod)
                clnt->trans_mod = v9fs_get_default_trans();
@@ -687,7 +690,14 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                err = -EPROTONOSUPPORT;
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "No transport defined or default transport\n");
-                goto error;
+                goto free_client;
+        }
+        clnt->fidpool = p9_idpool_create();
+        if (IS_ERR(clnt->fidpool)) {
+                err = PTR_ERR(clnt->fidpool);
+                clnt->fidpool = NULL;
+                goto put_trans;
        }
        P9_DPRINTK(P9_DEBUG_MUX, "clnt %p trans %p msize %d dotu %d\n",
@@ -695,19 +705,25 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
        err = clnt->trans_mod->create(clnt, dev_name, options);
        if (err)
-                goto error;
+                goto destroy_fidpool;
        if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
                clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
        err = p9_client_version(clnt);
        if (err)
-                goto error;
+                goto close_trans;
        return clnt;
-error:
+close_trans:
-        p9_client_destroy(clnt);
+        clnt->trans_mod->close(clnt);
+destroy_fidpool:
+        p9_idpool_destroy(clnt->fidpool);
+put_trans:
+        v9fs_put_trans(clnt->trans_mod);
+free_client:
+        kfree(clnt);
        return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_create);
@@ -1214,10 +1230,11 @@ static int p9_client_statsize(struct p9_wstat *wst, int optional)
 {
        int ret;
+        /* NOTE: size shouldn't include its own length */
        /* size[2] type[2] dev[4] qid[13] */
        /* mode[4] atime[4] mtime[4] length[8]*/
        /* name[s] uid[s] gid[s] muid[s] */
-        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+        ret = 2+4+13+4+4+4+8+2+2+2+2;
        if (wst->name)
                ret += strlen(wst->name);
@@ -1258,7 +1275,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                wst->n_uid, wst->n_gid, wst->n_muid);
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
        if (IS_ERR(req)) {
                err = PTR_ERR(req);
                goto error;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index be1cb909d8c0..31d0b05582a9 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -714,7 +714,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
-        char *options;
+        char *options, *tmp_options;
        int ret;
        opts->port = P9_PORT;
@@ -724,12 +724,13 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
        if (!params)
                return 0;
-        options = kstrdup(params, GFP_KERNEL);
+        tmp_options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                                "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -760,7 +761,8 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                        continue;
                }
        }
-        kfree(options);
+        kfree(tmp_options);
        return 0;
 }
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 65cb29db03f8..2c95a89c0f46 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -166,7 +166,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        char *p;
        substring_t args[MAX_OPT_ARGS];
        int option;
-        char *options;
+        char *options, *tmp_options;
        int ret;
        opts->port = P9_PORT;
@@ -177,12 +177,13 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        if (!params)
                return 0;
-        options = kstrdup(params, GFP_KERNEL);
+        tmp_options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        if (!tmp_options) {
                P9_DPRINTK(P9_DEBUG_ERROR,
                           "failed to allocate copy of option string\n");
                return -ENOMEM;
        }
+        options = tmp_options;
        while ((p = strsep(&options, ",")) != NULL) {
                int token;
@@ -216,7 +217,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
        }
        /* RQ must be at least as large as the SQ */
        opts->rq_depth = max(opts->rq_depth, opts->sq_depth);
-        kfree(options);
+        kfree(tmp_options);
        return 0;
 }
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index ea1e3daabefe..cb50f4ae5eef 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -102,7 +102,8 @@ static void p9_virtio_close(struct p9_client *client)
        struct virtio_chan *chan = client->trans;
        mutex_lock(&virtio_9p_lock);
-        chan->inuse = false;
+        if (chan)
+                chan->inuse = false;
        mutex_unlock(&virtio_9p_lock);
 }
@@ -311,6 +312,7 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
        }
        client->trans = (void *)chan;
+        client->status = Connected;
        chan->client = client;
        return 0;
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b7c4224f4e7d..b10e3cdb08f8 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -377,6 +377,9 @@ struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst, __u8
        if (acl->state == BT_CONNECTED &&
                        (sco->state == BT_OPEN || sco->state == BT_CLOSED)) {
+                acl->power_save = 1;
+                hci_conn_enter_active_mode(acl);
                if (lmp_esco_capable(hdev))
                        hci_setup_sync(sco, acl->handle);
                else
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 28517bad796c..592da5c909c1 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1699,6 +1699,7 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                break;
        case 0x1c:      /* SCO interval rejected */
+        case 0x1a:      /* Unsupported Remote Feature */
        case 0x1f:      /* Unspecified error */
                if (conn->out && conn->attempt < 2) {
                        conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 18e7f5a43dc4..fc6ec1e72652 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -243,6 +243,39 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
        input_sync(dev);
 }
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+        BT_DBG("session %p data %p size %d", session, data, size);
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+        skb_queue_tail(&session->ctrl_transmit, skb);
+        return 0;
+}
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+        hidp_schedule(session);
+        return err;
+}
 static int hidp_queue_report(struct hidp_session *session,
                                unsigned char *data, int size)
 {
@@ -282,7 +315,9 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count)
 {
-        if (hidp_queue_report(hid->driver_data, data, count))
+        if (hidp_send_ctrl_message(hid->driver_data,
+                        HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE,
+                        data, count))
                return -ENOMEM;
        return count;
 }
@@ -307,39 +342,6 @@ static inline void hidp_del_timer(struct hidp_session *session)
                del_timer(&session->timer);
 }
-static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        struct sk_buff *skb;
-        BT_DBG("session %p data %p size %d", session, data, size);
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
-                BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
-        }
-        *skb_put(skb, 1) = hdr;
-        if (data && size > 0)
-                memcpy(skb_put(skb, size), data, size);
-        skb_queue_tail(&session->ctrl_transmit, skb);
-        return 0;
-}
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        int err;
-        err = __hidp_send_ctrl_message(session, hdr, data, size);
-        hidp_schedule(session);
-        return err;
-}
 static void hidp_process_handshake(struct hidp_session *session,
                                        unsigned char param)
 {
@@ -701,29 +703,9 @@ static void hidp_close(struct hid_device *hid)
 static int hidp_parse(struct hid_device *hid)
 {
        struct hidp_session *session = hid->driver_data;
-        struct hidp_connadd_req *req = session->req;
-        unsigned char *buf;
-        int ret;
-        buf = kmalloc(req->rd_size, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-        if (copy_from_user(buf, req->rd_data, req->rd_size)) {
-                kfree(buf);
-                return -EFAULT;
-        }
-        ret = hid_parse_report(session->hid, buf, req->rd_size);
-        kfree(buf);
-        if (ret)
-                return ret;
-        session->req = NULL;
+        return hid_parse_report(session->hid, session->rd_data,
+                        session->rd_size);
-        return 0;
 }
 static int hidp_start(struct hid_device *hid)
@@ -768,12 +750,24 @@ static int hidp_setup_hid(struct hidp_session *session,
        bdaddr_t src, dst;
        int err;
+        session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
+        if (!session->rd_data)
+                return -ENOMEM;
+        if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
+                err = -EFAULT;
+                goto fault;
+        }
+        session->rd_size = req->rd_size;
        hid = hid_allocate_device();
-        if (IS_ERR(hid))
+        if (IS_ERR(hid)) {
-                return PTR_ERR(hid);
+                err = PTR_ERR(hid);
+                goto fault;
+        }
        session->hid = hid;
-        session->req = req;
        hid->driver_data = session;
        baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
@@ -804,6 +798,10 @@ failed:
        hid_destroy_device(hid);
        session->hid = NULL;
+fault:
+        kfree(session->rd_data);
+        session->rd_data = NULL;
        return err;
 }
@@ -898,6 +896,9 @@ unlink:
                session->hid = NULL;
        }
+        kfree(session->rd_data);
+        session->rd_data = NULL;
 purge:
        skb_queue_purge(&session->ctrl_transmit);
        skb_queue_purge(&session->intr_transmit);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index faf3d74c3586..a4e215d50c10 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -154,7 +154,9 @@ struct hidp_session {
        struct sk_buff_head ctrl_transmit;
        struct sk_buff_head intr_transmit;
-        struct hidp_connadd_req *req;
+        /* Report descriptor */
+        __u8 *rd_data;
+        uint rd_size;
 };
 static inline void hidp_schedule(struct hidp_session *session)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf14a548..400efa26ddba 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1368,7 +1368,6 @@ static int l2cap_ertm_send(struct sock *sk)
        while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
               !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
                if (pi->remote_max_tx &&
                                bt_cb(skb)->retries == pi->remote_max_tx) {
@@ -1376,6 +1375,8 @@ static int l2cap_ertm_send(struct sock *sk)
                        break;
                }
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
                bt_cb(skb)->retries++;
                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
@@ -3518,7 +3519,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
        struct l2cap_pinfo *pi;
        u16 control, len;
        u8 tx_seq;
-        int err;
        sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
        if (!sk) {
@@ -3570,13 +3570,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                        goto drop;
                if (__is_iframe(control))
-                        err = l2cap_data_channel_iframe(sk, control, skb);
+                        l2cap_data_channel_iframe(sk, control, skb);
                else
-                        err = l2cap_data_channel_sframe(sk, control, skb);
+                        l2cap_data_channel_sframe(sk, control, skb);
-                if (!err)
+                goto done;
-                        goto done;
-                break;
        case L2CAP_MODE_STREAMING:
                control = get_unaligned_le16(skb->data);
@@ -3602,7 +3600,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                else
                        pi->expected_tx_seq = tx_seq + 1;
-                err = l2cap_sar_reassembly_sdu(sk, skb, control);
+                l2cap_sar_reassembly_sdu(sk, skb, control);
                goto done;
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index fc5ee3296e22..89f4a59eb82b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -252,7 +252,6 @@ static void rfcomm_session_timeout(unsigned long arg)
        BT_DBG("session %p state %ld", s, s->state);
        set_bit(RFCOMM_TIMED_OUT, &s->flags);
-        rfcomm_session_put(s);
        rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 }
@@ -1151,7 +1150,11 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                        break;
                case BT_DISCONN:
-                        rfcomm_session_put(s);
+                        /* When socket is closed and we are not RFCOMM
+                         * initiator rfcomm_process_rx already calls
+                         * rfcomm_session_put() */
+                        if (s->sock->sk->sk_state != BT_CLOSED)
+                                rfcomm_session_put(s);
                        break;
                }
        }
@@ -1920,6 +1923,7 @@ static inline void rfcomm_process_sessions(void)
                if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
                        s->state = BT_DISCONN;
                        rfcomm_send_disc(s, 0);
+                        rfcomm_session_put(s);
                        continue;
                }
diff --git a/net/core/dst.c b/net/core/dst.c
index 57bc4d5b8d08..cb1b3488b739 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/types.h>
 #include <net/net_namespace.h>
+#include <linux/sched.h>
 #include <net/dst.h>
@@ -79,6 +80,7 @@ loop:
        while ((dst = next) != NULL) {
                next = dst->next;
                prefetch(&next->next);
+                cond_resched();
                if (likely(atomic_read(&dst->__refcnt))) {
                        last->next = dst;
                        last = dst;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index de0c2c726420..2e692afdc55d 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3524,6 +3524,7 @@ static int pktgen_thread_worker(void *arg)
                        wait_event_interruptible_timeout(t->queue,
                                                         t->control != 0,
                                                         HZ/10);
+                        try_to_freeze();
                        continue;
                }
diff --git a/net/dccp/ccid.c b/net/dccp/ccid.c
index 57dfb9c8c4f2..ff16e9df1969 100644
--- a/net/dccp/ccid.c
+++ b/net/dccp/ccid.c
@@ -83,7 +83,7 @@ static struct kmem_cache *ccid_kmem_cache_create(int obj_size, char *slab_name_f
        va_list args;
        va_start(args, fmt);
-        vsnprintf(slab_name_fmt, sizeof(slab_name_fmt), fmt, args);
+        vsnprintf(slab_name_fmt, CCID_SLAB_NAME_LENGTH, fmt, args);
        va_end(args);
        slab = kmem_cache_create(slab_name_fmt, sizeof(struct ccid) + obj_size, 0,
diff --git a/net/dccp/ccid.h b/net/dccp/ccid.h
index 269958bf7fe9..6df6f8ac9636 100644
--- a/net/dccp/ccid.h
+++ b/net/dccp/ccid.h
@@ -19,7 +19,9 @@
 #include <linux/list.h>
 #include <linux/module.h>
-#define CCID_MAX 255
+/* maximum value for a CCID (RFC 4340, 19.5) */
+#define CCID_MAX                255
+#define CCID_SLAB_NAME_LENGTH   32
 struct tcp_info;
@@ -49,8 +51,8 @@ struct ccid_operations {
        const char              *ccid_name;
        struct kmem_cache       *ccid_hc_rx_slab,
                                *ccid_hc_tx_slab;
-        char                    ccid_hc_rx_slab_name[32];
+        char                    ccid_hc_rx_slab_name[CCID_SLAB_NAME_LENGTH];
-        char                    ccid_hc_tx_slab_name[32];
+        char                    ccid_hc_tx_slab_name[CCID_SLAB_NAME_LENGTH];
        __u32                   ccid_hc_rx_obj_size,
                                ccid_hc_tx_obj_size;
        /* Interface Routines */
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index bace1d8cbcfd..f5b3464f1242 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -161,8 +161,8 @@ static __init int dccpprobe_init(void)
        if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
                goto err0;
-        ret = try_then_request_module((register_jprobe(&dccp_send_probe) == 0),
+        try_then_request_module((ret = register_jprobe(&dccp_send_probe)) == 0,
-                                        "dccp");
+                                "dccp");
        if (ret)
                goto err1;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 06632762ba5f..90203e1b9187 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -925,10 +925,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct arpt_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(NFPROTO_ARP);
                        private = &tmp;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 572330a552ef..3ce53cf13d5a 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1132,10 +1132,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ipt_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET);
                        private = &tmp;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index d171b123a656..d1ea38a7c490 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -210,7 +210,7 @@ static ctl_table ip_ct_sysctl_table[] = {
        },
        {
                .procname       = "ip_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0444,
                .proc_handler   = proc_dointvec,
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
index 8668a3defda6..2fb7b76da94f 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4_compat.c
@@ -32,7 +32,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
        struct hlist_nulls_node *n;
        for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
             st->bucket++) {
                n = rcu_dereference(net->ct.hash[st->bucket].first);
                if (!is_a_nulls(n))
@@ -50,7 +50,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
        head = rcu_dereference(head->next);
        while (is_a_nulls(head)) {
                if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                return NULL;
                }
                head = rcu_dereference(net->ct.hash[st->bucket].first);
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index fe1a64479dd0..26066a2327ad 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -35,9 +35,6 @@ static DEFINE_SPINLOCK(nf_nat_lock);
 static struct nf_conntrack_l3proto *l3proto __read_mostly;
-/* Calculated at init based on memory size */
-static unsigned int nf_nat_htable_size __read_mostly;
 #define MAX_IP_NAT_PROTO 256
 static const struct nf_nat_protocol *nf_nat_protos[MAX_IP_NAT_PROTO]
                                                __read_mostly;
@@ -72,7 +69,7 @@ EXPORT_SYMBOL_GPL(nf_nat_proto_put);
 /* We keep an extra hash for each conntrack, for fast searching. */
 static inline unsigned int
-hash_by_src(const struct nf_conntrack_tuple *tuple)
+hash_by_src(const struct net *net, const struct nf_conntrack_tuple *tuple)
 {
        unsigned int hash;
@@ -80,7 +77,7 @@ hash_by_src(const struct nf_conntrack_tuple *tuple)
        hash = jhash_3words((__force u32)tuple->src.u3.ip,
                            (__force u32)tuple->src.u.all,
                            tuple->dst.protonum, 0);
-        return ((u64)hash * nf_nat_htable_size) >> 32;
+        return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 /* Is this tuple already taken? (not by us) */
@@ -147,7 +144,7 @@ find_appropriate_src(struct net *net,
                     struct nf_conntrack_tuple *result,
                     const struct nf_nat_range *range)
 {
-        unsigned int h = hash_by_src(tuple);
+        unsigned int h = hash_by_src(net, tuple);
        const struct nf_conn_nat *nat;
        const struct nf_conn *ct;
        const struct hlist_node *n;
@@ -330,7 +327,7 @@ nf_nat_setup_info(struct nf_conn *ct,
        if (have_to_hash) {
                unsigned int srchash;
-                srchash = hash_by_src(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+                srchash = hash_by_src(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
                spin_lock_bh(&nf_nat_lock);
                /* nf_conntrack_alter_reply might re-allocate exntension aera */
                nat = nfct_nat(ct);
@@ -679,8 +676,10 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 static int __net_init nf_nat_net_init(struct net *net)
 {
-        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&nf_nat_htable_size,
+        /* Leave them the same for the moment. */
-                                                      &net->ipv4.nat_vmalloced, 0);
+        net->ipv4.nat_htable_size = net->ct.htable_size;
+        net->ipv4.nat_bysource = nf_ct_alloc_hashtable(&net->ipv4.nat_htable_size,
+                                                       &net->ipv4.nat_vmalloced, 0);
        if (!net->ipv4.nat_bysource)
                return -ENOMEM;
        return 0;
@@ -703,7 +702,7 @@ static void __net_exit nf_nat_net_exit(struct net *net)
        nf_ct_iterate_cleanup(net, &clean_nat, NULL);
        synchronize_rcu();
        nf_ct_free_hashtable(net->ipv4.nat_bysource, net->ipv4.nat_vmalloced,
-                             nf_nat_htable_size);
+                             net->ipv4.nat_htable_size);
 }
 static struct pernet_operations nf_nat_net_ops = {
@@ -724,9 +723,6 @@ static int __init nf_nat_init(void)
                return ret;
        }
-        /* Leave them the same for the moment. */
-        nf_nat_htable_size = nf_conntrack_htable_size;
        ret = register_pernet_subsys(&nf_nat_net_ops);
        if (ret < 0)
                goto cleanup_extend;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 480d7f8c9802..8a7e0f52e177 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1164,10 +1164,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ip6t_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET6);
                        private = &tmp;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 312c20adc83f..624a54832a7c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -63,6 +63,7 @@ struct nf_ct_frag6_queue
        struct inet_frag_queue  q;
        __be32                  id;             /* fragment id          */
+        u32                     user;
        struct in6_addr         saddr;
        struct in6_addr         daddr;
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 156020d138b5..6b3602de359a 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -698,15 +698,18 @@ dev_irnet_ioctl(
      /* Query PPP channel and unit number */
    case PPPIOCGCHAN:
+      lock_kernel();
      if(ap->ppp_open && !put_user(ppp_channel_index(&ap->chan),
                                                (int __user *)argp))
        err = 0;
+      unlock_kernel();
      break;
    case PPPIOCGUNIT:
      lock_kernel();
      if(ap->ppp_open && !put_user(ppp_unit_number(&ap->chan),
                                                (int __user *)argp))
-      err = 0;
+        err = 0;
+      unlock_kernel();
      break;
      /* All these ioctls can be passed both directly and from ppp_generic,
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 76fa6fef6473..539f43bc97db 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3794,9 +3794,9 @@ static struct pernet_operations pfkey_net_ops = {
 static void __exit ipsec_pfkey_exit(void)
 {
-        unregister_pernet_subsys(&pfkey_net_ops);
        xfrm_unregister_km(&pfkeyv2_mgr);
        sock_unregister(PF_KEY);
+        unregister_pernet_subsys(&pfkey_net_ops);
        proto_unregister(&key_proto);
 }
@@ -3807,21 +3807,22 @@ static int __init ipsec_pfkey_init(void)
        if (err != 0)
                goto out;
-        err = sock_register(&pfkey_family_ops);
+        err = register_pernet_subsys(&pfkey_net_ops);
        if (err != 0)
                goto out_unregister_key_proto;
+        err = sock_register(&pfkey_family_ops);
+        if (err != 0)
+                goto out_unregister_pernet;
        err = xfrm_register_km(&pfkeyv2_mgr);
        if (err != 0)
                goto out_sock_unregister;
-        err = register_pernet_subsys(&pfkey_net_ops);
-        if (err != 0)
-                goto out_xfrm_unregister_km;
 out:
        return err;
-out_xfrm_unregister_km:
-        xfrm_unregister_km(&pfkeyv2_mgr);
 out_sock_unregister:
        sock_unregister(PF_KEY);
+out_unregister_pernet:
+        unregister_pernet_subsys(&pfkey_net_ops);
 out_unregister_key_proto:
        proto_unregister(&key_proto);
        goto out;
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index ee94ea0c67e9..da8497ef7063 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -680,7 +680,7 @@ TRACE_EVENT(drv_ampdu_action,
                __entry->ret = ret;
                __entry->action = action;
                __entry->tid = tid;
-                __entry->ssn = *ssn;
+                __entry->ssn = ssn ? *ssn : 0;
        ),
        TP_printk(
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 0e98c3282d42..4d79e3c1616c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -30,6 +30,7 @@
 #include <linux/netdevice.h>
 #include <linux/socket.h>
 #include <linux/mm.h>
+#include <linux/nsproxy.h>
 #include <linux/rculist_nulls.h>
 #include <net/netfilter/nf_conntrack.h>
@@ -63,8 +64,6 @@ EXPORT_SYMBOL_GPL(nf_conntrack_max);
 struct nf_conn nf_conntrack_untracked __read_mostly;
 EXPORT_SYMBOL_GPL(nf_conntrack_untracked);
-static struct kmem_cache *nf_conntrack_cachep __read_mostly;
 static int nf_conntrack_hash_rnd_initted;
 static unsigned int nf_conntrack_hash_rnd;
@@ -86,9 +85,10 @@ static u_int32_t __hash_conntrack(const struct nf_conntrack_tuple *tuple,
        return ((u64)h * size) >> 32;
 }
-static inline u_int32_t hash_conntrack(const struct nf_conntrack_tuple *tuple)
+static inline u_int32_t hash_conntrack(const struct net *net,
+                                       const struct nf_conntrack_tuple *tuple)
 {
-        return __hash_conntrack(tuple, nf_conntrack_htable_size,
+        return __hash_conntrack(tuple, net->ct.htable_size,
                                nf_conntrack_hash_rnd);
 }
@@ -296,7 +296,7 @@ __nf_conntrack_find(struct net *net, const struct nf_conntrack_tuple *tuple)
 {
        struct nf_conntrack_tuple_hash *h;
        struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        unsigned int hash = hash_conntrack(net, tuple);
        /* Disable BHs the entire time since we normally need to disable them
         * at least once for the stats anyway.
@@ -366,10 +366,11 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
 void nf_conntrack_hash_insert(struct nf_conn *ct)
 {
+        struct net *net = nf_ct_net(ct);
        unsigned int hash, repl_hash;
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
        __nf_conntrack_hash_insert(ct, hash, repl_hash);
 }
@@ -397,8 +398,8 @@ __nf_conntrack_confirm(struct sk_buff *skb)
        if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
                return NF_ACCEPT;
-        hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        repl_hash = hash_conntrack(net, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
        /* We're not in hash table, and we refuse to set up related
           connections for unconfirmed conns.  But packet copies and
@@ -468,7 +469,7 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple,
        struct net *net = nf_ct_net(ignored_conntrack);
        struct nf_conntrack_tuple_hash *h;
        struct hlist_nulls_node *n;
-        unsigned int hash = hash_conntrack(tuple);
+        unsigned int hash = hash_conntrack(net, tuple);
        /* Disable BHs the entire time since we need to disable them at
         * least once for the stats anyway.
@@ -503,7 +504,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
        int dropped = 0;
        rcu_read_lock();
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash],
                                         hnnode) {
                        tmp = nf_ct_tuplehash_to_ctrack(h);
@@ -523,7 +524,7 @@ static noinline int early_drop(struct net *net, unsigned int hash)
                if (cnt >= NF_CT_EVICTION_RANGE)
                        break;
-                hash = (hash + 1) % nf_conntrack_htable_size;
+                hash = (hash + 1) % net->ct.htable_size;
        }
        rcu_read_unlock();
@@ -557,7 +558,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
        if (nf_conntrack_max &&
            unlikely(atomic_read(&net->ct.count) > nf_conntrack_max)) {
-                unsigned int hash = hash_conntrack(orig);
+                unsigned int hash = hash_conntrack(net, orig);
                if (!early_drop(net, hash)) {
                        atomic_dec(&net->ct.count);
                        if (net_ratelimit())
@@ -572,7 +573,7 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
         * Do not use kmem_cache_zalloc(), as this cache uses
         * SLAB_DESTROY_BY_RCU.
         */
-        ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
+        ct = kmem_cache_alloc(net->ct.nf_conntrack_cachep, gfp);
        if (ct == NULL) {
                pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
                atomic_dec(&net->ct.count);
@@ -611,7 +612,7 @@ void nf_conntrack_free(struct nf_conn *ct)
        nf_ct_ext_destroy(ct);
        atomic_dec(&net->ct.count);
        nf_ct_ext_free(ct);
-        kmem_cache_free(nf_conntrack_cachep, ct);
+        kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_free);
@@ -1014,7 +1015,7 @@ get_next_corpse(struct net *net, int (*iter)(struct nf_conn *i, void *data),
        struct hlist_nulls_node *n;
        spin_lock_bh(&nf_conntrack_lock);
-        for (; *bucket < nf_conntrack_htable_size; (*bucket)++) {
+        for (; *bucket < net->ct.htable_size; (*bucket)++) {
                hlist_nulls_for_each_entry(h, n, &net->ct.hash[*bucket], hnnode) {
                        ct = nf_ct_tuplehash_to_ctrack(h);
                        if (iter(ct, data))
@@ -1113,9 +1114,12 @@ static void nf_ct_release_dying_list(struct net *net)
 static void nf_conntrack_cleanup_init_net(void)
 {
+        /* wait until all references to nf_conntrack_untracked are dropped */
+        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
+                schedule();
        nf_conntrack_helper_fini();
        nf_conntrack_proto_fini();
-        kmem_cache_destroy(nf_conntrack_cachep);
 }
 static void nf_conntrack_cleanup_net(struct net *net)
@@ -1127,15 +1131,14 @@ static void nf_conntrack_cleanup_net(struct net *net)
                schedule();
                goto i_see_dead_people;
        }
-        /* wait until all references to nf_conntrack_untracked are dropped */
-        while (atomic_read(&nf_conntrack_untracked.ct_general.use) > 1)
-                schedule();
        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
        nf_conntrack_ecache_fini(net);
        nf_conntrack_acct_fini(net);
        nf_conntrack_expect_fini(net);
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+        kfree(net->ct.slabname);
        free_percpu(net->ct.stat);
 }
@@ -1190,10 +1193,12 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
 {
        int i, bucket, vmalloced, old_vmalloced;
        unsigned int hashsize, old_size;
-        int rnd;
        struct hlist_nulls_head *hash, *old_hash;
        struct nf_conntrack_tuple_hash *h;
+        if (current->nsproxy->net_ns != &init_net)
+                return -EOPNOTSUPP;
        /* On boot, we can set this without any fancy locking. */
        if (!nf_conntrack_htable_size)
                return param_set_uint(val, kp);
@@ -1206,33 +1211,29 @@ int nf_conntrack_set_hashsize(const char *val, struct kernel_param *kp)
        if (!hash)
                return -ENOMEM;
-        /* We have to rehahs for the new table anyway, so we also can
-         * use a newrandom seed */
-        get_random_bytes(&rnd, sizeof(rnd));
        /* Lookups in the old hash might happen in parallel, which means we
         * might get false negatives during connection lookup. New connections
         * created because of a false negative won't make it into the hash
         * though since that required taking the lock.
         */
        spin_lock_bh(&nf_conntrack_lock);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < init_net.ct.htable_size; i++) {
                while (!hlist_nulls_empty(&init_net.ct.hash[i])) {
                        h = hlist_nulls_entry(init_net.ct.hash[i].first,
                                        struct nf_conntrack_tuple_hash, hnnode);
                        hlist_nulls_del_rcu(&h->hnnode);
-                        bucket = __hash_conntrack(&h->tuple, hashsize, rnd);
+                        bucket = __hash_conntrack(&h->tuple, hashsize,
+                                                  nf_conntrack_hash_rnd);
                        hlist_nulls_add_head_rcu(&h->hnnode, &hash[bucket]);
                }
        }
-        old_size = nf_conntrack_htable_size;
+        old_size = init_net.ct.htable_size;
        old_vmalloced = init_net.ct.hash_vmalloc;
        old_hash = init_net.ct.hash;
-        nf_conntrack_htable_size = hashsize;
+        init_net.ct.htable_size = nf_conntrack_htable_size = hashsize;
        init_net.ct.hash_vmalloc = vmalloced;
        init_net.ct.hash = hash;
-        nf_conntrack_hash_rnd = rnd;
        spin_unlock_bh(&nf_conntrack_lock);
        nf_ct_free_hashtable(old_hash, old_vmalloced, old_size);
@@ -1271,15 +1272,6 @@ static int nf_conntrack_init_init_net(void)
               NF_CONNTRACK_VERSION, nf_conntrack_htable_size,
               nf_conntrack_max);
-        nf_conntrack_cachep = kmem_cache_create("nf_conntrack",
-                                                sizeof(struct nf_conn),
-                                                0, SLAB_DESTROY_BY_RCU, NULL);
-        if (!nf_conntrack_cachep) {
-                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
-                ret = -ENOMEM;
-                goto err_cache;
-        }
        ret = nf_conntrack_proto_init();
        if (ret < 0)
                goto err_proto;
@@ -1288,13 +1280,19 @@ static int nf_conntrack_init_init_net(void)
        if (ret < 0)
                goto err_helper;
+        /* Set up fake conntrack: to never be deleted, not in any hashes */
+#ifdef CONFIG_NET_NS
+        nf_conntrack_untracked.ct_net = &init_net;
+#endif
+        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
+        /*  - and look it like as a confirmed connection */
+        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
        return 0;
 err_helper:
        nf_conntrack_proto_fini();
 err_proto:
-        kmem_cache_destroy(nf_conntrack_cachep);
-err_cache:
        return ret;
 }
@@ -1316,7 +1314,24 @@ static int nf_conntrack_init_net(struct net *net)
                ret = -ENOMEM;
                goto err_stat;
        }
-        net->ct.hash = nf_ct_alloc_hashtable(&nf_conntrack_htable_size,
+        net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net);
+        if (!net->ct.slabname) {
+                ret = -ENOMEM;
+                goto err_slabname;
+        }
+        net->ct.nf_conntrack_cachep = kmem_cache_create(net->ct.slabname,
+                                                        sizeof(struct nf_conn), 0,
+                                                        SLAB_DESTROY_BY_RCU, NULL);
+        if (!net->ct.nf_conntrack_cachep) {
+                printk(KERN_ERR "Unable to create nf_conn slab cache\n");
+                ret = -ENOMEM;
+                goto err_cache;
+        }
+        net->ct.htable_size = nf_conntrack_htable_size;
+        net->ct.hash = nf_ct_alloc_hashtable(&net->ct.htable_size,
                                             &net->ct.hash_vmalloc, 1);
        if (!net->ct.hash) {
                ret = -ENOMEM;
@@ -1333,15 +1348,6 @@ static int nf_conntrack_init_net(struct net *net)
        if (ret < 0)
                goto err_ecache;
-        /* Set up fake conntrack:
-            - to never be deleted, not in any hashes */
-#ifdef CONFIG_NET_NS
-        nf_conntrack_untracked.ct_net = &init_net;
-#endif
-        atomic_set(&nf_conntrack_untracked.ct_general.use, 1);
-        /*  - and look it like as a confirmed connection */
-        set_bit(IPS_CONFIRMED_BIT, &nf_conntrack_untracked.status);
        return 0;
 err_ecache:
@@ -1350,8 +1356,12 @@ err_acct:
        nf_conntrack_expect_fini(net);
 err_expect:
        nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc,
-                             nf_conntrack_htable_size);
+                             net->ct.htable_size);
 err_hash:
+        kmem_cache_destroy(net->ct.nf_conntrack_cachep);
+err_cache:
+        kfree(net->ct.slabname);
+err_slabname:
        free_percpu(net->ct.stat);
 err_stat:
        return ret;
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index fdf5d2a1d9b4..2f25ff610982 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -569,7 +569,7 @@ static void exp_proc_remove(struct net *net)
 #endif /* CONFIG_PROC_FS */
 }
-module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0600);
+module_param_named(expect_hashsize, nf_ct_expect_hsize, uint, 0400);
 int nf_conntrack_expect_init(struct net *net)
 {
@@ -577,7 +577,7 @@ int nf_conntrack_expect_init(struct net *net)
        if (net_eq(net, &init_net)) {
                if (!nf_ct_expect_hsize) {
-                        nf_ct_expect_hsize = nf_conntrack_htable_size / 256;
+                        nf_ct_expect_hsize = net->ct.htable_size / 256;
                        if (!nf_ct_expect_hsize)
                                nf_ct_expect_hsize = 1;
                }
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 65c2a7bc3afc..4b1a56bd074c 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -192,7 +192,7 @@ static void __nf_conntrack_helper_unregister(struct nf_conntrack_helper *me,
        /* Get rid of expecteds, set helpers to NULL. */
        hlist_nulls_for_each_entry(h, nn, &net->ct.unconfirmed, hnnode)
                unhelp(h, me);
-        for (i = 0; i < nf_conntrack_htable_size; i++) {
+        for (i = 0; i < net->ct.htable_size; i++) {
                hlist_nulls_for_each_entry(h, nn, &net->ct.hash[i], hnnode)
                        unhelp(h, me);
        }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 59d8064eb522..0ffe689dfe97 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -594,7 +594,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        last = (struct nf_conn *)cb->args[1];
-        for (; cb->args[0] < nf_conntrack_htable_size; cb->args[0]++) {
+        for (; cb->args[0] < init_net.ct.htable_size; cb->args[0]++) {
 restart:
                hlist_nulls_for_each_entry_rcu(h, n, &init_net.ct.hash[cb->args[0]],
                                         hnnode) {
@@ -1437,8 +1437,9 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
        struct nlattr *nest_parms;
        memset(&m, 0xFF, sizeof(m));
-        m.src.u.all = mask->src.u.all;
        memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+        m.src.u.all = mask->src.u.all;
+        m.dst.protonum = tuple->dst.protonum;
        nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
        if (!nest_parms)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4b572163784b..023966b569bf 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -376,7 +376,7 @@ int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
                        dptr += hdr->len;
                else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
                         strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
-                         !isalpha(*(dptr + hdr->clen + 1)))
+                         !isalpha(*(dptr + hdr->clen)))
                        dptr += hdr->clen;
                else
                        continue;
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 028aba667ef7..e310f1561bb2 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -51,7 +51,7 @@ static struct hlist_nulls_node *ct_get_first(struct seq_file *seq)
        struct hlist_nulls_node *n;
        for (st->bucket = 0;
-             st->bucket < nf_conntrack_htable_size;
+             st->bucket < net->ct.htable_size;
             st->bucket++) {
                n = rcu_dereference(net->ct.hash[st->bucket].first);
                if (!is_a_nulls(n))
@@ -69,7 +69,7 @@ static struct hlist_nulls_node *ct_get_next(struct seq_file *seq,
        head = rcu_dereference(head->next);
        while (is_a_nulls(head)) {
                if (likely(get_nulls_value(head) == st->bucket)) {
-                        if (++st->bucket >= nf_conntrack_htable_size)
+                        if (++st->bucket >= net->ct.htable_size)
                                return NULL;
                }
                head = rcu_dereference(net->ct.hash[st->bucket].first);
@@ -355,7 +355,7 @@ static ctl_table nf_ct_sysctl_table[] = {
        },
        {
                .procname       = "nf_conntrack_buckets",
-                .data           = &nf_conntrack_htable_size,
+                .data           = &init_net.ct.htable_size,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0444,
                .proc_handler   = proc_dointvec,
@@ -421,6 +421,7 @@ static int nf_conntrack_standalone_init_sysctl(struct net *net)
                goto out_kmemdup;
        table[1].data = &net->ct.count;
+        table[2].data = &net->ct.htable_size;
        table[3].data = &net->ct.sysctl_checksum;
        table[4].data = &net->ct.sysctl_log_invalid;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index a4957bf2ca60..4c5972ba8c78 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -455,9 +455,14 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
        if (nl_table[protocol].registered &&
            try_module_get(nl_table[protocol].module))
                module = nl_table[protocol].module;
+        else
+                err = -EPROTONOSUPPORT;
        cb_mutex = nl_table[protocol].cb_mutex;
        netlink_unlock_table();
+        if (err < 0)
+                goto out;
        err = __netlink_create(net, sock, cb_mutex, protocol);
        if (err < 0)
                goto out_module;
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 929218a47620..21f9c7678aa3 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -433,7 +433,7 @@ config NET_ACT_POLICE
          module.
          To compile this code as a module, choose M here: the
-          module will be called police.
+          module will be called act_police.
 config NET_ACT_GACT
        tristate "Generic actions"
@@ -443,7 +443,7 @@ config NET_ACT_GACT
          accepting packets.
          To compile this code as a module, choose M here: the
-          module will be called gact.
+          module will be called act_gact.
 config GACT_PROB
        bool "Probability support"
@@ -459,7 +459,7 @@ config NET_ACT_MIRRED
          other devices.
          To compile this code as a module, choose M here: the
-          module will be called mirred.
+          module will be called act_mirred.
 config NET_ACT_IPT
        tristate "IPtables targets"
@@ -469,7 +469,7 @@ config NET_ACT_IPT
          classification.
          To compile this code as a module, choose M here: the
-          module will be called ipt.
+          module will be called act_ipt.
 config NET_ACT_NAT
        tristate "Stateless NAT"
@@ -479,7 +479,7 @@ config NET_ACT_NAT
          netfilter for NAT unless you know what you are doing.
          To compile this code as a module, choose M here: the
-          module will be called nat.
+          module will be called act_nat.
 config NET_ACT_PEDIT
        tristate "Packet Editing"
@@ -488,7 +488,7 @@ config NET_ACT_PEDIT
          Say Y here if you want to mangle the content of packets.
          To compile this code as a module, choose M here: the
-          module will be called pedit.
+          module will be called act_pedit.
 config NET_ACT_SIMP
        tristate "Simple Example (Debug)"
@@ -502,7 +502,7 @@ config NET_ACT_SIMP
          If unsure, say N.
          To compile this code as a module, choose M here: the
-          module will be called simple.
+          module will be called act_simple.
 config NET_ACT_SKBEDIT
        tristate "SKB Editing"
@@ -513,7 +513,7 @@ config NET_ACT_SKBEDIT
          If unsure, say N.
          To compile this code as a module, choose M here: the
-          module will be called skbedit.
+          module will be called act_skbedit.
 config NET_CLS_IND
        bool "Incoming device classification"
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 090f24839700..2f3230db7ffb 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -74,8 +74,8 @@ my %VCS_cmds;
 my %VCS_cmds_git = (
    "execute_cmd" => \&git_execute_cmd,
    "available" => '(which("git") ne "") && (-d ".git")',
-    "find_signers_cmd" => "git log --since=\$email_git_since -- \$file",
+    "find_signers_cmd" => "git log --no-color --since=\$email_git_since -- \$file",
-    "find_commit_signers_cmd" => "git log -1 \$commit",
+    "find_commit_signers_cmd" => "git log --no-color -1 \$commit",
    "blame_range_cmd" => "git blame -l -L \$diff_start,+\$diff_length \$file",
    "blame_file_cmd" => "git blame -l \$file",
    "commit_pattern" => "^commit [0-9a-f]{40,40}",
diff --git a/scripts/markup_oops.pl b/scripts/markup_oops.pl
index ce3e40b01e48..e950f9cde019 100644
--- a/scripts/markup_oops.pl
+++ b/scripts/markup_oops.pl
@@ -158,7 +158,7 @@ while (<STDIN>) {
                $function = $1;
                $func_offset = $2;
        }
-        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]/) {
+        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+0x([0-9a-f]+)\/0x[a-f0-9]/) {
                $function = $1;
                $func_offset = $2;
        }
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index c41afe6639a0..47fb65d1fcbd 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -65,7 +65,6 @@ void integrity_audit_msg(int audit_msgno, struct inode *inode,
                         const char *cause, int result, int info);
 /* Internal IMA function definitions */
-void ima_iintcache_init(void);
 int ima_init(void);
 void ima_cleanup(void);
 int ima_fs_init(void);
@@ -131,7 +130,7 @@ void iint_free(struct kref *kref);
 void iint_rcu_free(struct rcu_head *rcu);
 /* IMA policy related functions */
-enum ima_hooks { PATH_CHECK = 1, FILE_MMAP, BPRM_CHECK };
+enum ima_hooks { FILE_CHECK = 1, FILE_MMAP, BPRM_CHECK };
 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask);
 void ima_init_policy(void);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 3cd58b60afd2..2a5e0bcf3887 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -95,12 +95,12 @@ err_out:
 * ima_must_measure - measure decision based on policy.
 * @inode: pointer to inode to measure
 * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXECUTE)
- * @function: calling function (PATH_CHECK, BPRM_CHECK, FILE_MMAP)
+ * @function: calling function (FILE_CHECK, BPRM_CHECK, FILE_MMAP)
 *
 * The policy is defined in terms of keypairs:
 *              subj=, obj=, type=, func=, mask=, fsmagic=
 *      subj,obj, and type: are LSM specific.
- *      func: PATH_CHECK | BPRM_CHECK | FILE_MMAP
+ *      func: FILE_CHECK | BPRM_CHECK | FILE_MMAP
 *      mask: contains the permission mask
 *      fsmagic: hex value
 *
diff --git a/security/integrity/ima/ima_iint.c b/security/integrity/ima/ima_iint.c
index fa592ff1ac1c..0d83edcfc402 100644
--- a/security/integrity/ima/ima_iint.c
+++ b/security/integrity/ima/ima_iint.c
@@ -52,9 +52,6 @@ int ima_inode_alloc(struct inode *inode)
        struct ima_iint_cache *iint = NULL;
        int rc = 0;
-        if (!ima_initialized)
-                return 0;
        iint = kmem_cache_alloc(iint_cache, GFP_NOFS);
        if (!iint)
                return -ENOMEM;
@@ -118,8 +115,6 @@ void ima_inode_free(struct inode *inode)
 {
        struct ima_iint_cache *iint;
-        if (!ima_initialized)
-                return;
        spin_lock(&ima_iint_lock);
        iint = radix_tree_delete(&ima_iint_store, (unsigned long)inode);
        spin_unlock(&ima_iint_lock);
@@ -141,9 +136,11 @@ static void init_once(void *foo)
        kref_set(&iint->refcount, 1);
 }
-void __init ima_iintcache_init(void)
+static int __init ima_iintcache_init(void)
 {
        iint_cache =
            kmem_cache_create("iint_cache", sizeof(struct ima_iint_cache), 0,
                              SLAB_PANIC, init_once);
+        return 0;
 }
+security_initcall(ima_iintcache_init);
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index a89f44d5e030..294b005d6520 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -14,7 +14,7 @@
 *
 * File: ima_main.c
 *      implements the IMA hooks: ima_bprm_check, ima_file_mmap,
- *      and ima_path_check.
+ *      and ima_file_check.
 */
 #include <linux/module.h>
 #include <linux/file.h>
@@ -84,6 +84,36 @@ out:
        return found;
 }
+/* ima_read_write_check - reflect possible reading/writing errors in the PCR.
+ *
+ * When opening a file for read, if the file is already open for write,
+ * the file could change, resulting in a file measurement error.
+ *
+ * Opening a file for write, if the file is already open for read, results
+ * in a time of measure, time of use (ToMToU) error.
+ *
+ * In either case invalidate the PCR.
+ */
+enum iint_pcr_error { TOMTOU, OPEN_WRITERS };
+static void ima_read_write_check(enum iint_pcr_error error,
+                                 struct ima_iint_cache *iint,
+                                 struct inode *inode,
+                                 const unsigned char *filename)
+{
+        switch (error) {
+        case TOMTOU:
+                if (iint->readcount > 0)
+                        ima_add_violation(inode, filename, "invalid_pcr",
+                                          "ToMToU");
+                break;
+        case OPEN_WRITERS:
+                if (iint->writecount > 0)
+                        ima_add_violation(inode, filename, "invalid_pcr",
+                                          "open_writers");
+                break;
+        }
+}
 /*
 * Update the counts given an fmode_t
 */
@@ -99,6 +129,47 @@ static void ima_inc_counts(struct ima_iint_cache *iint, fmode_t mode)
 }
 /*
+ * ima_counts_get - increment file counts
+ *
+ * Maintain read/write counters for all files, but only
+ * invalidate the PCR for measured files:
+ *      - Opening a file for write when already open for read,
+ *        results in a time of measure, time of use (ToMToU) error.
+ *      - Opening a file for read when already open for write,
+ *        could result in a file measurement error.
+ *
+ */
+void ima_counts_get(struct file *file)
+{
+        struct dentry *dentry = file->f_path.dentry;
+        struct inode *inode = dentry->d_inode;
+        fmode_t mode = file->f_mode;
+        struct ima_iint_cache *iint;
+        int rc;
+        if (!ima_initialized || !S_ISREG(inode->i_mode))
+                return;
+        iint = ima_iint_find_get(inode);
+        if (!iint)
+                return;
+        mutex_lock(&iint->mutex);
+        rc = ima_must_measure(iint, inode, MAY_READ, FILE_CHECK);
+        if (rc < 0)
+                goto out;
+        if (mode & FMODE_WRITE) {
+                ima_read_write_check(TOMTOU, iint, inode, dentry->d_name.name);
+                goto out;
+        }
+        ima_read_write_check(OPEN_WRITERS, iint, inode, dentry->d_name.name);
+out:
+        ima_inc_counts(iint, file->f_mode);
+        mutex_unlock(&iint->mutex);
+        kref_put(&iint->refcount, iint_free);
+}
+/*
 * Decrement ima counts
 */
 static void ima_dec_counts(struct ima_iint_cache *iint, struct inode *inode,
@@ -153,123 +224,6 @@ void ima_file_free(struct file *file)
        kref_put(&iint->refcount, iint_free);
 }
-/* ima_read_write_check - reflect possible reading/writing errors in the PCR.
- *
- * When opening a file for read, if the file is already open for write,
- * the file could change, resulting in a file measurement error.
- *
- * Opening a file for write, if the file is already open for read, results
- * in a time of measure, time of use (ToMToU) error.
- *
- * In either case invalidate the PCR.
- */
-enum iint_pcr_error { TOMTOU, OPEN_WRITERS };
-static void ima_read_write_check(enum iint_pcr_error error,
-                                 struct ima_iint_cache *iint,
-                                 struct inode *inode,
-                                 const unsigned char *filename)
-{
-        switch (error) {
-        case TOMTOU:
-                if (iint->readcount > 0)
-                        ima_add_violation(inode, filename, "invalid_pcr",
-                                          "ToMToU");
-                break;
-        case OPEN_WRITERS:
-                if (iint->writecount > 0)
-                        ima_add_violation(inode, filename, "invalid_pcr",
-                                          "open_writers");
-                break;
-        }
-}
-static int get_path_measurement(struct ima_iint_cache *iint, struct file *file,
-                                const unsigned char *filename)
-{
-        int rc = 0;
-        ima_inc_counts(iint, file->f_mode);
-        rc = ima_collect_measurement(iint, file);
-        if (!rc)
-                ima_store_measurement(iint, file, filename);
-        return rc;
-}
-/**
- * ima_path_check - based on policy, collect/store measurement.
- * @path: contains a pointer to the path to be measured
- * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
- *
- * Measure the file being open for readonly, based on the
- * ima_must_measure() policy decision.
- *
- * Keep read/write counters for all files, but only
- * invalidate the PCR for measured files:
- *      - Opening a file for write when already open for read,
- *        results in a time of measure, time of use (ToMToU) error.
- *      - Opening a file for read when already open for write,
- *        could result in a file measurement error.
- *
- * Always return 0 and audit dentry_open failures.
- * (Return code will be based upon measurement appraisal.)
- */
-int ima_path_check(struct path *path, int mask)
-{
-        struct inode *inode = path->dentry->d_inode;
-        struct ima_iint_cache *iint;
-        struct file *file = NULL;
-        int rc;
-        if (!ima_initialized || !S_ISREG(inode->i_mode))
-                return 0;
-        iint = ima_iint_find_get(inode);
-        if (!iint)
-                return 0;
-        mutex_lock(&iint->mutex);
-        rc = ima_must_measure(iint, inode, MAY_READ, PATH_CHECK);
-        if (rc < 0)
-                goto out;
-        if ((mask & MAY_WRITE) || (mask == 0))
-                ima_read_write_check(TOMTOU, iint, inode,
-                                     path->dentry->d_name.name);
-        if ((mask & (MAY_WRITE | MAY_READ | MAY_EXEC)) != MAY_READ)
-                goto out;
-        ima_read_write_check(OPEN_WRITERS, iint, inode,
-                             path->dentry->d_name.name);
-        if (!(iint->flags & IMA_MEASURED)) {
-                struct dentry *dentry = dget(path->dentry);
-                struct vfsmount *mnt = mntget(path->mnt);
-                file = dentry_open(dentry, mnt, O_RDONLY | O_LARGEFILE,
-                                   current_cred());
-                if (IS_ERR(file)) {
-                        int audit_info = 0;
-                        integrity_audit_msg(AUDIT_INTEGRITY_PCR, inode,
-                                            dentry->d_name.name,
-                                            "add_measurement",
-                                            "dentry_open failed",
-                                            1, audit_info);
-                        file = NULL;
-                        goto out;
-                }
-                rc = get_path_measurement(iint, file, dentry->d_name.name);
-        }
-out:
-        mutex_unlock(&iint->mutex);
-        if (file)
-                fput(file);
-        kref_put(&iint->refcount, iint_free);
-        return 0;
-}
-EXPORT_SYMBOL_GPL(ima_path_check);
 static int process_measurement(struct file *file, const unsigned char *filename,
                               int mask, int function)
 {
@@ -297,33 +251,6 @@ out:
        return rc;
 }
-/*
- * ima_counts_get - increment file counts
- *
- * - for IPC shm and shmat file.
- * - for nfsd exported files.
- *
- * Increment the counts for these files to prevent unnecessary
- * imbalance messages.
- */
-void ima_counts_get(struct file *file)
-{
-        struct inode *inode = file->f_dentry->d_inode;
-        struct ima_iint_cache *iint;
-        if (!ima_initialized || !S_ISREG(inode->i_mode))
-                return;
-        iint = ima_iint_find_get(inode);
-        if (!iint)
-                return;
-        mutex_lock(&iint->mutex);
-        ima_inc_counts(iint, file->f_mode);
-        mutex_unlock(&iint->mutex);
-        kref_put(&iint->refcount, iint_free);
-}
-EXPORT_SYMBOL_GPL(ima_counts_get);
 /**
 * ima_file_mmap - based on policy, collect/store measurement.
 * @file: pointer to the file to be measured (May be NULL)
@@ -369,11 +296,31 @@ int ima_bprm_check(struct linux_binprm *bprm)
        return 0;
 }
+/**
+ * ima_path_check - based on policy, collect/store measurement.
+ * @file: pointer to the file to be measured
+ * @mask: contains MAY_READ, MAY_WRITE or MAY_EXECUTE
+ *
+ * Measure files based on the ima_must_measure() policy decision.
+ *
+ * Always return 0 and audit dentry_open failures.
+ * (Return code will be based upon measurement appraisal.)
+ */
+int ima_file_check(struct file *file, int mask)
+{
+        int rc;
+        rc = process_measurement(file, file->f_dentry->d_name.name,
+                                 mask & (MAY_READ | MAY_WRITE | MAY_EXEC),
+                                 FILE_CHECK);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(ima_file_check);
 static int __init init_ima(void)
 {
        int error;
-        ima_iintcache_init();
        error = ima_init();
        ima_initialized = 1;
        return error;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index e1278399b345..4759d0f99335 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -67,7 +67,7 @@ static struct ima_measure_rule_entry default_rules[] = {
         .flags = IMA_FUNC | IMA_MASK},
        {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
         .flags = IMA_FUNC | IMA_MASK},
-        {.action = MEASURE,.func = PATH_CHECK,.mask = MAY_READ,.uid = 0,
+        {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0,
         .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 };
@@ -282,8 +282,11 @@ static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
                        break;
                case Opt_func:
                        audit_log_format(ab, "func=%s ", args[0].from);
-                        if (strcmp(args[0].from, "PATH_CHECK") == 0)
+                        if (strcmp(args[0].from, "FILE_CHECK") == 0)
-                                entry->func = PATH_CHECK;
+                                entry->func = FILE_CHECK;
+                        /* PATH_CHECK is for backwards compat */
+                        else if (strcmp(args[0].from, "PATH_CHECK") == 0)
+                                entry->func = FILE_CHECK;
                        else if (strcmp(args[0].from, "FILE_MMAP") == 0)
                                entry->func = FILE_MMAP;
                        else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
diff --git a/security/security.c b/security/security.c
index 24e060be9fa5..122b748d0f4c 100644
--- a/security/security.c
+++ b/security/security.c
@@ -666,8 +666,6 @@ int security_file_alloc(struct file *file)
 void security_file_free(struct file *file)
 {
        security_ops->file_free_security(file);
-        if (file->f_dentry)
-                ima_file_free(file);
 }
 int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
diff --git a/sound/pci/ctxfi/ctatc.c b/sound/pci/ctxfi/ctatc.c
index cb65bd0dd35b..459c1f62783b 100644
--- a/sound/pci/ctxfi/ctatc.c
+++ b/sound/pci/ctxfi/ctatc.c
@@ -166,18 +166,7 @@ static void ct_unmap_audio_buffer(struct ct_atc *atc, struct ct_atc_pcm *apcm)
 static unsigned long atc_get_ptp_phys(struct ct_atc *atc, int index)
 {
-        struct ct_vm *vm;
+        return atc->vm->get_ptp_phys(atc->vm, index);
-        void *kvirt_addr;
-        unsigned long phys_addr;
-        vm = atc->vm;
-        kvirt_addr = vm->get_ptp_virt(vm, index);
-        if (kvirt_addr == NULL)
-                phys_addr = (~0UL);
-        else
-                phys_addr = virt_to_phys(kvirt_addr);
-        return phys_addr;
 }
 static unsigned int convert_format(snd_pcm_format_t snd_format)
@@ -1669,7 +1658,7 @@ int __devinit ct_atc_create(struct snd_card *card, struct pci_dev *pci,
        }
        /* Set up device virtual memory management object */
-        err = ct_vm_create(&atc->vm);
+        err = ct_vm_create(&atc->vm, pci);
        if (err < 0)
                goto error1;
diff --git a/sound/pci/ctxfi/ctvmem.c b/sound/pci/ctxfi/ctvmem.c
index 6b78752e9503..65da6e466f80 100644
--- a/sound/pci/ctxfi/ctvmem.c
+++ b/sound/pci/ctxfi/ctvmem.c
@@ -138,7 +138,7 @@ ct_vm_map(struct ct_vm *vm, struct snd_pcm_substream *substream, int size)
                return NULL;
        }
-        ptp = vm->ptp[0];
+        ptp = (unsigned long *)vm->ptp[0].area;
        pte_start = (block->addr >> CT_PAGE_SHIFT);
        pages = block->size >> CT_PAGE_SHIFT;
        for (i = 0; i < pages; i++) {
@@ -158,25 +158,25 @@ static void ct_vm_unmap(struct ct_vm *vm, struct ct_vm_block *block)
 }
 /* *
- * return the host (kmalloced) addr of the @index-th device
+ * return the host physical addr of the @index-th device
- * page talbe page on success, or NULL on failure.
+ * page table page on success, or ~0UL on failure.
- * The first returned NULL indicates the termination.
+ * The first returned ~0UL indicates the termination.
 * */
-static void *
+static dma_addr_t
-ct_get_ptp_virt(struct ct_vm *vm, int index)
+ct_get_ptp_phys(struct ct_vm *vm, int index)
 {
-        void *addr;
+        dma_addr_t addr;
-        addr = (index >= CT_PTP_NUM) ? NULL : vm->ptp[index];
+        addr = (index >= CT_PTP_NUM) ? ~0UL : vm->ptp[index].addr;
        return addr;
 }
-int ct_vm_create(struct ct_vm **rvm)
+int ct_vm_create(struct ct_vm **rvm, struct pci_dev *pci)
 {
        struct ct_vm *vm;
        struct ct_vm_block *block;
-        int i;
+        int i, err = 0;
        *rvm = NULL;
@@ -188,23 +188,21 @@ int ct_vm_create(struct ct_vm **rvm)
        /* Allocate page table pages */
        for (i = 0; i < CT_PTP_NUM; i++) {
-                vm->ptp[i] = kmalloc(PAGE_SIZE, GFP_KERNEL);
+                err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
-                if (!vm->ptp[i])
+                                          snd_dma_pci_data(pci),
+                                          PAGE_SIZE, &vm->ptp[i]);
+                if (err < 0)
                        break;
        }
-        if (!i) {
+        if (err < 0) {
                /* no page table pages are allocated */
-                kfree(vm);
+                ct_vm_destroy(vm);
                return -ENOMEM;
        }
        vm->size = CT_ADDRS_PER_PAGE * i;
-        /* Initialise remaining ptps */
-        for (; i < CT_PTP_NUM; i++)
-                vm->ptp[i] = NULL;
        vm->map = ct_vm_map;
        vm->unmap = ct_vm_unmap;
-        vm->get_ptp_virt = ct_get_ptp_virt;
+        vm->get_ptp_phys = ct_get_ptp_phys;
        INIT_LIST_HEAD(&vm->unused);
        INIT_LIST_HEAD(&vm->used);
        block = kzalloc(sizeof(*block), GFP_KERNEL);
@@ -242,7 +240,7 @@ void ct_vm_destroy(struct ct_vm *vm)
        /* free allocated page table pages */
        for (i = 0; i < CT_PTP_NUM; i++)
-                kfree(vm->ptp[i]);
+                snd_dma_free_pages(&vm->ptp[i]);
        vm->size = 0;
diff --git a/sound/pci/ctxfi/ctvmem.h b/sound/pci/ctxfi/ctvmem.h
index 01e4fd0386a3..b23adfca4de6 100644
--- a/sound/pci/ctxfi/ctvmem.h
+++ b/sound/pci/ctxfi/ctvmem.h
@@ -22,6 +22,8 @@
 #include <linux/mutex.h>
 #include <linux/list.h>
+#include <linux/pci.h>
+#include <sound/memalloc.h>
 /* The chip can handle the page table of 4k pages
 * (emu20k1 can handle even 8k pages, but we don't use it right now)
@@ -41,7 +43,7 @@ struct snd_pcm_substream;
 /* Virtual memory management object for card device */
 struct ct_vm {
-        void *ptp[CT_PTP_NUM];          /* Device page table pages */
+        struct snd_dma_buffer ptp[CT_PTP_NUM];  /* Device page table pages */
        unsigned int size;              /* Available addr space in bytes */
        struct list_head unused;        /* List of unused blocks */
        struct list_head used;          /* List of used blocks */
@@ -52,10 +54,10 @@ struct ct_vm {
                                   int size);
        /* Unmap device logical addr area. */
        void (*unmap)(struct ct_vm *, struct ct_vm_block *block);
-        void *(*get_ptp_virt)(struct ct_vm *vm, int index);
+        dma_addr_t (*get_ptp_phys)(struct ct_vm *vm, int index);
 };
-int ct_vm_create(struct ct_vm **rvm);
+int ct_vm_create(struct ct_vm **rvm, struct pci_dev *pci);
 void ct_vm_destroy(struct ct_vm *vm);
 #endif /* CTVMEM_H */
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 565de38a3fc7..b8faa6dc5abe 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -426,6 +426,7 @@ struct azx {
        /* flags */
        int position_fix;
+        int poll_count;
        unsigned int running :1;
        unsigned int initialized :1;
        unsigned int single_cmd :1;
@@ -506,7 +507,7 @@ static char *driver_short_names[] __devinitdata = {
 #define get_azx_dev(substream) (substream->runtime->private_data)
 static int azx_acquire_irq(struct azx *chip, int do_disconnect);
+static int azx_send_cmd(struct hda_bus *bus, unsigned int val);
 /*
 * Interface for HD codec
 */
@@ -664,11 +665,12 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
 {
        struct azx *chip = bus->private_data;
        unsigned long timeout;
+        int do_poll = 0;
 again:
        timeout = jiffies + msecs_to_jiffies(1000);
        for (;;) {
-                if (chip->polling_mode) {
+                if (chip->polling_mode || do_poll) {
                        spin_lock_irq(&chip->reg_lock);
                        azx_update_rirb(chip);
                        spin_unlock_irq(&chip->reg_lock);
@@ -676,6 +678,9 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
                if (!chip->rirb.cmds[addr]) {
                        smp_rmb();
                        bus->rirb_error = 0;
+                        if (!do_poll)
+                                chip->poll_count = 0;
                        return chip->rirb.res[addr]; /* the last value */
                }
                if (time_after(jiffies, timeout))
@@ -688,6 +693,16 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
                }
        }
+        if (!chip->polling_mode && chip->poll_count < 2) {
+                snd_printdd(SFX "azx_get_response timeout, "
+                           "polling the codec once: last cmd=0x%08x\n",
+                           chip->last_cmd[addr]);
+                do_poll = 1;
+                chip->poll_count++;
+                goto again;
+        }
        if (!chip->polling_mode) {
                snd_printk(KERN_WARNING SFX "azx_get_response timeout, "
                           "switching to polling mode: last cmd=0x%08x\n",
@@ -2043,7 +2058,7 @@ static int azx_acquire_irq(struct azx *chip, int do_disconnect)
 {
        if (request_irq(chip->pci->irq, azx_interrupt,
                        chip->msi ? 0 : IRQF_SHARED,
-                        "HDA Intel", chip)) {
+                        "hda_intel", chip)) {
                printk(KERN_ERR "hda-intel: unable to grab IRQ %d, "
                       "disabling device\n", chip->pci->irq);
                if (do_disconnect)
diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c
index 765d7bd4c3d4..9e66f6d306f8 100644
--- a/sound/pci/ice1712/aureon.c
+++ b/sound/pci/ice1712/aureon.c
@@ -703,11 +703,13 @@ static void wm_set_vol(struct snd_ice1712 *ice, unsigned int index, unsigned sho
 {
        unsigned char nvol;
-        if ((master & WM_VOL_MUTE) || (vol & WM_VOL_MUTE))
+        if ((master & WM_VOL_MUTE) || (vol & WM_VOL_MUTE)) {
                nvol = 0;
-        else
+        } else {
                nvol = ((vol % WM_VOL_CNT) * (master % WM_VOL_CNT)) /
                                                                WM_VOL_MAX;
+                nvol += 0x1b;
+        }
        wm_put(ice, index, nvol);
        wm_put_nocache(ice, index, 0x180 | nvol);
@@ -778,7 +780,7 @@ static int wm_master_vol_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
        for (ch = 0; ch < 2; ch++) {
                unsigned int vol = ucontrol->value.integer.value[ch];
                if (vol > WM_VOL_MAX)
-                        continue;
+                        vol = WM_VOL_MAX;
                vol |= spec->master[ch] & WM_VOL_MUTE;
                if (vol != spec->master[ch]) {
                        int dac;
@@ -834,8 +836,8 @@ static int wm_vol_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *
        for (i = 0; i < voices; i++) {
                unsigned int vol = ucontrol->value.integer.value[i];
                if (vol > WM_VOL_MAX)
-                        continue;
+                        vol = WM_VOL_MAX;
-                vol |= spec->vol[ofs+i];
+                vol |= spec->vol[ofs+i] & WM_VOL_MUTE;
                if (vol != spec->vol[ofs+i]) {
                        spec->vol[ofs+i] = vol;
                        idx  = WM_DAC_ATTEN + ofs + i;
diff --git a/sound/soc/omap/omap3pandora.c b/sound/soc/omap/omap3pandora.c
index 71b2c161158d..68980c19a3bc 100644
--- a/sound/soc/omap/omap3pandora.c
+++ b/sound/soc/omap/omap3pandora.c
@@ -145,6 +145,7 @@ static const struct snd_soc_dapm_widget omap3pandora_in_dapm_widgets[] = {
 };
 static const struct snd_soc_dapm_route omap3pandora_out_map[] = {
+        {"PCM DAC", NULL, "APLL Enable"},
        {"Headphone Amplifier", NULL, "PCM DAC"},
        {"Line Out", NULL, "PCM DAC"},
        {"Headphone Jack", NULL, "Headphone Amplifier"},