43 files changed, 392 insertions, 319 deletions

diff --git a/Documentation/fault-injection/fault-injection.txt b/Documentation/fault-injection/fault-injection.txt
index 079305640790..7be15e44d481 100644
--- a/Documentation/fault-injection/fault-injection.txt
+++ b/Documentation/fault-injection/fault-injection.txt
@@ -143,8 +143,8 @@ o provide a way to configure fault attributes
   failslab, fail_page_alloc, and fail_make_request use this way.
   Helper functions:
 
-        init_fault_attr_entries(entries, attr, name);
-        void cleanup_fault_attr_entries(entries);
+        init_fault_attr_dentries(entries, attr, name);
+        void cleanup_fault_attr_dentries(entries);
 
 - module parameters
 
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index 5198b9bb34ef..69ddfbd91135 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -49,6 +49,7 @@
 #include <asm/numa.h>
 #include <asm/cacheflush.h>
 #include <asm/init.h>
+#include <linux/bootmem.h>
 
 static unsigned long dma_reserve __initdata;
 
@@ -616,6 +617,21 @@ void __init paging_init(void)
  */
 #ifdef CONFIG_MEMORY_HOTPLUG
 /*
+ * After memory hotplug the variables max_pfn, max_low_pfn and high_memory need
+ * updating.
+ */
+static void  update_end_of_memory_vars(u64 start, u64 size)
+{
+        unsigned long end_pfn = PFN_UP(start + size);
+
+        if (end_pfn > max_pfn) {
+                max_pfn = end_pfn;
+                max_low_pfn = end_pfn;
+                high_memory = (void *)__va(max_pfn * PAGE_SIZE - 1) + 1;
+        }
+}
+
+/*
  * Memory is added always to NORMAL zone. This means you will never get
  * additional DMA/DMA32 memory.
  */
@@ -634,6 +650,9 @@ int arch_add_memory(int nid, u64 start, u64 size)
         ret = __add_pages(nid, zone, start_pfn, nr_pages);
         WARN_ON_ONCE(ret);
 
+        /* update max_pfn, max_low_pfn and high_memory */
+        update_end_of_memory_vars(start, size);
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(arch_add_memory);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 2ddf03ae034e..68b5957f107c 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -322,7 +322,7 @@ static void pkt_sysfs_dev_remove(struct pktcdvd_device *pd)
         pkt_kobj_remove(pd->kobj_stat);
         pkt_kobj_remove(pd->kobj_wqueue);
         if (class_pktcdvd)
-                device_destroy(class_pktcdvd, pd->pkt_dev);
+                device_unregister(pd->dev);
 }
 
 
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 652367aa6546..058fbccf2f52 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -195,5 +195,16 @@ config BT_MRVL_SDIO
           Say Y here to compile support for Marvell BT-over-SDIO driver
           into the kernel or say M to compile it as module.
 
-endmenu
+config BT_ATH3K
+        tristate "Atheros firmware download driver"
+        depends on BT_HCIBTUSB
+        select FW_LOADER
+        help
+          Bluetooth firmware download driver.
+          This driver loads the firmware into the Atheros Bluetooth
+          chipset.
 
+          Say Y here to compile support for "Atheros firmware download driver"
+          into the kernel or say M to compile it as module (ath3k).
+
+endmenu
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index b3f57d2d4eb0..7e5aed598121 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_BT_HCIBTUART)	+= btuart_cs.o
 obj-$(CONFIG_BT_HCIBTUSB)       += btusb.o
 obj-$(CONFIG_BT_HCIBTSDIO)      += btsdio.o
 
+obj-$(CONFIG_BT_ATH3K)          += ath3k.o
 obj-$(CONFIG_BT_MRVL)           += btmrvl.o
 obj-$(CONFIG_BT_MRVL_SDIO)      += btmrvl_sdio.o
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
new file mode 100644
index 000000000000..add9485ca5b6
--- /dev/null
+++ b/drivers/bluetooth/ath3k.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/usb.h>
+#include <net/bluetooth/bluetooth.h>
+
+#define VERSION "1.0"
+
+
+static struct usb_device_id ath3k_table[] = {
+        /* Atheros AR3011 */
+        { USB_DEVICE(0x0CF3, 0x3000) },
+        { }     /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, ath3k_table);
+
+#define USB_REQ_DFU_DNLOAD      1
+#define BULK_SIZE               4096
+
+struct ath3k_data {
+        struct usb_device *udev;
+        u8 *fw_data;
+        u32 fw_size;
+        u32 fw_sent;
+};
+
+static int ath3k_load_firmware(struct ath3k_data *data,
+                                unsigned char *firmware,
+                                int count)
+{
+        u8 *send_buf;
+        int err, pipe, len, size, sent = 0;
+
+        BT_DBG("ath3k %p udev %p", data, data->udev);
+
+        pipe = usb_sndctrlpipe(data->udev, 0);
+
+        if ((usb_control_msg(data->udev, pipe,
+                                USB_REQ_DFU_DNLOAD,
+                                USB_TYPE_VENDOR, 0, 0,
+                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                BT_ERR("Can't change to loading configuration err");
+                return -EBUSY;
+        }
+        sent += 20;
+        count -= 20;
+
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
+        while (count) {
+                size = min_t(uint, count, BULK_SIZE);
+                pipe = usb_sndbulkpipe(data->udev, 0x02);
+                memcpy(send_buf, firmware + sent, size);
+
+                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                                        &len, 3000);
+
+                if (err || (len != size)) {
+                        BT_ERR("Error in firmware loading err = %d,"
+                                "len = %d, size = %d", err, len, size);
+                        goto error;
+                }
+
+                sent  += size;
+                count -= size;
+        }
+
+        kfree(send_buf);
+        return 0;
+
+error:
+        kfree(send_buf);
+        return err;
+}
+
+static int ath3k_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        const struct firmware *firmware;
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct ath3k_data *data;
+        int size;
+
+        BT_DBG("intf %p id %p", intf, id);
+
+        if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+                return -ENODEV;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        data->udev = udev;
+
+        if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
+                kfree(data);
+                return -EIO;
+        }
+
+        size = max_t(uint, firmware->size, 4096);
+        data->fw_data = kmalloc(size, GFP_KERNEL);
+        if (!data->fw_data) {
+                release_firmware(firmware);
+                kfree(data);
+                return -ENOMEM;
+        }
+
+        memcpy(data->fw_data, firmware->data, firmware->size);
+        data->fw_size = firmware->size;
+        data->fw_sent = 0;
+        release_firmware(firmware);
+
+        usb_set_intfdata(intf, data);
+        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
+                usb_set_intfdata(intf, NULL);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static void ath3k_disconnect(struct usb_interface *intf)
+{
+        struct ath3k_data *data = usb_get_intfdata(intf);
+
+        BT_DBG("ath3k_disconnect intf %p", intf);
+
+        kfree(data->fw_data);
+        kfree(data);
+}
+
+static struct usb_driver ath3k_driver = {
+        .name           = "ath3k",
+        .probe          = ath3k_probe,
+        .disconnect     = ath3k_disconnect,
+        .id_table       = ath3k_table,
+};
+
+static int __init ath3k_init(void)
+{
+        BT_INFO("Atheros AR30xx firmware driver ver %s", VERSION);
+        return usb_register(&ath3k_driver);
+}
+
+static void __exit ath3k_exit(void)
+{
+        usb_deregister(&ath3k_driver);
+}
+
+module_init(ath3k_init);
+module_exit(ath3k_exit);
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Atheros AR30xx firmware driver");
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("ath3k-1.fw");
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 2acdc605cb4b..c2cf81144715 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -503,7 +503,9 @@ static irqreturn_t bluecard_interrupt(int irq, void *dev_inst)
         unsigned int iobase;
         unsigned char reg;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         if (!test_bit(CARD_READY, &(info->hw_state)))
                 return IRQ_HANDLED;
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index d814a2755ccb..9f5926aaf57f 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -345,7 +345,9 @@ static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
         int iir;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index d339464dc15e..91c523099804 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -295,7 +295,9 @@ static irqreturn_t btuart_interrupt(int irq, void *dev_inst)
         int iir, lsr;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 4f02a6f3c980..697591941e17 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -299,7 +299,9 @@ static irqreturn_t dtl1_interrupt(int irq, void *dev_inst)
         int iir, lsr;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index be832b6f8279..48788db4e280 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -395,6 +395,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
         unsigned long p = *ppos;
         ssize_t low_count, read, sz;
         char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
+        int err = 0;
 
         read = 0;
         if (p < (unsigned long) high_memory) {
@@ -441,12 +442,16 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                         return -ENOMEM;
                 while (count > 0) {
                         sz = size_inside_page(p, count);
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         sz = vread(kbuf, (char *)p, sz);
                         if (!sz)
                                 break;
                         if (copy_to_user(buf, kbuf, sz)) {
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
                         count -= sz;
                         buf += sz;
@@ -455,8 +460,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                 }
                 free_page((unsigned long)kbuf);
         }
-        *ppos = p;
-        return read;
+        *ppos = p;
+        return read ? read : err;
 }
 
 
@@ -520,6 +525,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
         ssize_t wrote = 0;
         ssize_t virtr = 0;
         char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+        int err = 0;
 
         if (p < (unsigned long) high_memory) {
                 unsigned long to_write = min_t(unsigned long, count,
@@ -540,14 +546,16 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                         unsigned long sz = size_inside_page(p, count);
                         unsigned long n;
 
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         n = copy_from_user(kbuf, buf, sz);
                         if (n) {
-                                if (wrote + virtr)
-                                        break;
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
-                        sz = vwrite(kbuf, (char *)p, sz);
+                        vwrite(kbuf, (char *)p, sz);
                         count -= sz;
                         buf += sz;
                         virtr += sz;
@@ -556,8 +564,8 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                 free_page((unsigned long)kbuf);
         }
 
-        *ppos = p;
-        return virtr + wrote;
+        *ppos = p;
+        return virtr + wrote ? : err;
 }
 #endif
 
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index f06024668f99..537c29ac4487 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -36,17 +36,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
-static u32 cn_idx = CN_IDX_CONNECTOR;
-static u32 cn_val = CN_VAL_CONNECTOR;
-
-module_param(cn_idx, uint, 0);
-module_param(cn_val, uint, 0);
-MODULE_PARM_DESC(cn_idx, "Connector's main device idx.");
-MODULE_PARM_DESC(cn_val, "Connector's main device val.");
-
-static DEFINE_MUTEX(notify_lock);
-static LIST_HEAD(notify_list);
-
 static struct cn_dev cdev;
 
 static int cn_already_initialized;
@@ -210,54 +199,6 @@ static void cn_rx_skb(struct sk_buff *__skb)
 }
 
 /*
- * Notification routing.
- *
- * Gets id and checks if there are notification request for it's idx
- * and val.  If there are such requests notify the listeners with the
- * given notify event.
- *
- */
-static void cn_notify(struct cb_id *id, u32 notify_event)
-{
-        struct cn_ctl_entry *ent;
-
-        mutex_lock(&notify_lock);
-        list_for_each_entry(ent, &notify_list, notify_entry) {
-                int i;
-                struct cn_notify_req *req;
-                struct cn_ctl_msg *ctl = ent->msg;
-                int idx_found, val_found;
-
-                idx_found = val_found = 0;
-
-                req = (struct cn_notify_req *)ctl->data;
-                for (i = 0; i < ctl->idx_notify_num; ++i, ++req) {
-                        if (id->idx >= req->first &&
-                                        id->idx < req->first + req->range) {
-                                idx_found = 1;
-                                break;
-                        }
-                }
-
-                for (i = 0; i < ctl->val_notify_num; ++i, ++req) {
-                        if (id->val >= req->first &&
-                                        id->val < req->first + req->range) {
-                                val_found = 1;
-                                break;
-                        }
-                }
-
-                if (idx_found && val_found) {
-                        struct cn_msg m = { .ack = notify_event, };
-
-                        memcpy(&m.id, id, sizeof(m.id));
-                        cn_netlink_send(&m, ctl->group, GFP_KERNEL);
-                }
-        }
-        mutex_unlock(&notify_lock);
-}
-
-/*
  * Callback add routing - adds callback with given ID and name.
  * If there is registered callback with the same ID it will not be added.
  *
@@ -276,8 +217,6 @@ int cn_add_callback(struct cb_id *id, char *name,
         if (err)
                 return err;
 
-        cn_notify(id, 0);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(cn_add_callback);
@@ -295,111 +234,9 @@ void cn_del_callback(struct cb_id *id)
         struct cn_dev *dev = &cdev;
 
         cn_queue_del_callback(dev->cbdev, id);
-        cn_notify(id, 1);
 }
 EXPORT_SYMBOL_GPL(cn_del_callback);
 
-/*
- * Checks two connector's control messages to be the same.
- * Returns 1 if they are the same or if the first one is corrupted.
- */
-static int cn_ctl_msg_equals(struct cn_ctl_msg *m1, struct cn_ctl_msg *m2)
-{
-        int i;
-        struct cn_notify_req *req1, *req2;
-
-        if (m1->idx_notify_num != m2->idx_notify_num)
-                return 0;
-
-        if (m1->val_notify_num != m2->val_notify_num)
-                return 0;
-
-        if (m1->len != m2->len)
-                return 0;
-
-        if ((m1->idx_notify_num + m1->val_notify_num) * sizeof(*req1) !=
-            m1->len)
-                return 1;
-
-        req1 = (struct cn_notify_req *)m1->data;
-        req2 = (struct cn_notify_req *)m2->data;
-
-        for (i = 0; i < m1->idx_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-
-        for (i = 0; i < m1->val_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-
-        return 1;
-}
-
-/*
- * Main connector device's callback.
- *
- * Used for notification of a request's processing.
- */
-static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
-{
-        struct cn_ctl_msg *ctl;
-        struct cn_ctl_entry *ent;
-        u32 size;
-
-        if (msg->len < sizeof(*ctl))
-                return;
-
-        ctl = (struct cn_ctl_msg *)msg->data;
-
-        size = (sizeof(*ctl) + ((ctl->idx_notify_num +
-                                 ctl->val_notify_num) *
-                                sizeof(struct cn_notify_req)));
-
-        if (msg->len != size)
-                return;
-
-        if (ctl->len + sizeof(*ctl) != msg->len)
-                return;
-
-        /*
-         * Remove notification.
-         */
-        if (ctl->group == 0) {
-                struct cn_ctl_entry *n;
-
-                mutex_lock(&notify_lock);
-                list_for_each_entry_safe(ent, n, &notify_list, notify_entry) {
-                        if (cn_ctl_msg_equals(ent->msg, ctl)) {
-                                list_del(&ent->notify_entry);
-                                kfree(ent);
-                        }
-                }
-                mutex_unlock(&notify_lock);
-
-                return;
-        }
-
-        size += sizeof(*ent);
-
-        ent = kzalloc(size, GFP_KERNEL);
-        if (!ent)
-                return;
-
-        ent->msg = (struct cn_ctl_msg *)(ent + 1);
-
-        memcpy(ent->msg, ctl, size - sizeof(*ent));
-
-        mutex_lock(&notify_lock);
-        list_add(&ent->notify_entry, &notify_list);
-        mutex_unlock(&notify_lock);
-}
-
 static int cn_proc_show(struct seq_file *m, void *v)
 {
         struct cn_queue_dev *dev = cdev.cbdev;
@@ -437,11 +274,8 @@ static const struct file_operations cn_file_ops = {
 static int __devinit cn_init(void)
 {
         struct cn_dev *dev = &cdev;
-        int err;
 
         dev->input = cn_rx_skb;
-        dev->id.idx = cn_idx;
-        dev->id.val = cn_val;
 
         dev->nls = netlink_kernel_create(&init_net, NETLINK_CONNECTOR,
                                          CN_NETLINK_USERS + 0xf,
@@ -457,14 +291,6 @@ static int __devinit cn_init(void)
 
         cn_already_initialized = 1;
 
-        err = cn_add_callback(&dev->id, "connector", &cn_callback);
-        if (err) {
-                cn_already_initialized = 0;
-                cn_queue_free_dev(dev->cbdev);
-                netlink_kernel_release(dev->nls);
-                return -EINVAL;
-        }
-
         proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
 
         return 0;
@@ -478,7 +304,6 @@ static void __devexit cn_fini(void)
 
         proc_net_remove(&init_net, "connector");
 
-        cn_del_callback(&dev->id);
         cn_queue_free_dev(dev->cbdev);
         netlink_kernel_release(dev->nls);
 }
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 9fd8e5ecd5d7..5bc74590c73e 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -276,8 +276,13 @@ struct be_adapter {
         int link_speed;
         u8 port_type;
         u8 transceiver;
+        u8 generation;          /* BladeEngine ASIC generation */
 };
 
+/* BladeEngine Generation numbers */
+#define BE_GEN2 2
+#define BE_GEN3 3
+
 extern const struct ethtool_ops be_ethtool_ops;
 
 #define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index c002b8391b4d..13b33c841083 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -164,7 +164,8 @@ struct be_cmd_req_hdr {
         u8 domain;              /* dword 0 */
         u32 timeout;            /* dword 1 */
         u32 request_length;     /* dword 2 */
-        u32 rsvd;               /* dword 3 */
+        u8 version;             /* dword 3 */
+        u8 rsvd[3];             /* dword 3 */
 };
 
 #define RESP_HDR_INFO_OPCODE_SHIFT      0       /* bits 0 - 7 */
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 33ab8c7f14fe..626b76c0ebc7 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1350,7 +1350,7 @@ static irqreturn_t be_intx(int irq, void *dev)
         int isr;
 
         isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-                        be_pci_func(adapter) * CEV_ISR_SIZE);
+                (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
         if (!isr)
                 return IRQ_NONE;
 
@@ -2051,6 +2051,7 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
         u8 __iomem *addr;
+        int pcicfg_reg;
 
         addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
                         pci_resource_len(adapter->pdev, 2));
@@ -2064,8 +2065,13 @@ static int be_map_pci_bars(struct be_adapter *adapter)
                 goto pci_map_err;
         adapter->db = addr;
 
-        addr = ioremap_nocache(pci_resource_start(adapter->pdev, 1),
-                        pci_resource_len(adapter->pdev, 1));
+        if (adapter->generation == BE_GEN2)
+                pcicfg_reg = 1;
+        else
+                pcicfg_reg = 0;
+
+        addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+                        pci_resource_len(adapter->pdev, pcicfg_reg));
         if (addr == NULL)
                 goto pci_map_err;
         adapter->pcicfg = addr;
@@ -2162,6 +2168,7 @@ static int be_stats_init(struct be_adapter *adapter)
         cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
         if (cmd->va == NULL)
                 return -1;
+        memset(cmd->va, 0, cmd->size);
         return 0;
 }
 
@@ -2240,6 +2247,20 @@ static int __devinit be_probe(struct pci_dev *pdev,
                 goto rel_reg;
         }
         adapter = netdev_priv(netdev);
+
+        switch (pdev->device) {
+        case BE_DEVICE_ID1:
+        case OC_DEVICE_ID1:
+                adapter->generation = BE_GEN2;
+                break;
+        case BE_DEVICE_ID2:
+        case OC_DEVICE_ID2:
+                adapter->generation = BE_GEN3;
+                break;
+        default:
+                adapter->generation = 0;
+        }
+
         adapter->pdev = pdev;
         pci_set_drvdata(pdev, adapter);
         adapter->netdev = netdev;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3f0071cfe56b..efa0e41bf3ec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3639,7 +3639,7 @@ static int bond_open(struct net_device *bond_dev)
                  */
                 if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
                         /* something went wrong - fail the open operation */
-                        return -1;
+                        return -ENOMEM;
                 }
 
                 INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 297a5ddd77f0..2aa71a766c35 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -2117,6 +2117,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
         /* set time_stamp *before* dma to help avoid a possible race */
         buffer_info->time_stamp = jiffies;
         buffer_info->next_to_watch = i;
+        buffer_info->mapped_as_page = false;
         buffer_info->dma = pci_map_single(pdev, skb->data, len,
                                           PCI_DMA_TODEVICE);
         if (pci_dma_mapping_error(pdev, buffer_info->dma))
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 56f37f66b696..dd4883f642be 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -223,7 +223,7 @@ static void ixgbe_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id,
 
         if (adapter->temp_dcb_cfg.bw_percentage[0][bwg_id] !=
             adapter->dcb_cfg.bw_percentage[0][bwg_id]) {
-                adapter->dcb_set_bitmap |= BIT_PG_RX;
+                adapter->dcb_set_bitmap |= BIT_PG_TX;
                 adapter->dcb_set_bitmap |= BIT_RESETLINK;
         }
 }
@@ -341,6 +341,12 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
         if (!adapter->dcb_set_bitmap)
                 return DCB_NO_HW_CHG;
 
+        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
+                                 adapter->ring_feature[RING_F_DCB].indices);
+
+        if (ret)
+                return DCB_NO_HW_CHG;
+
         /*
          * Only take down the adapter if the configuration change
          * requires a reset.
@@ -359,14 +365,6 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
                 }
         }
 
-        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
-                                 adapter->ring_feature[RING_F_DCB].indices);
-        if (ret) {
-                if (adapter->dcb_set_bitmap & BIT_RESETLINK)
-                        clear_bit(__IXGBE_RESETTING, &adapter->state);
-                return DCB_NO_HW_CHG;
-        }
-
         if (adapter->dcb_cfg.pfc_mode_enable) {
                 if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
                         (adapter->hw.fc.current_mode != ixgbe_fc_pfc))
diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
index c146304d8d6c..c0ceebccaa49 100644
--- a/drivers/net/ks8851_mll.c
+++ b/drivers/net/ks8851_mll.c
@@ -854,8 +854,8 @@ static void ks_update_link_status(struct net_device *netdev, struct ks_net *ks)
 
 static irqreturn_t ks_irq(int irq, void *pw)
 {
-        struct ks_net *ks = pw;
-        struct net_device *netdev = ks->netdev;
+        struct net_device *netdev = pw;
+        struct ks_net *ks = netdev_priv(netdev);
         u16 status;
 
         /*this should be the first in IRQ handler */
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 95db60adde41..f9521136a869 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device *dev)
         if (retval) {
                 printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
                        FIRMWARE_RX);
-                return retval;
+                goto out_init;
         }
         if (fw_rx->size % 4) {
                 printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
@@ -1108,6 +1108,9 @@ out_tx:
         release_firmware(fw_tx);
 out_rx:
         release_firmware(fw_rx);
+out_init:
+        if (retval)
+                netdev_close(dev);
         return retval;
 }
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 21e183a83b99..4f27f022fbf7 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -419,7 +419,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER | FLAG_LINK_INTR,
+        .flags =        FLAG_ETHER,
         // .check_connect = cdc_check_connect,
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2ec61f08cfdb..ae371448b5a0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -855,12 +855,11 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
+static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
 {
         u32 i, j;
 
-        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
-            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
+        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
 
                 /* EEPROM Fixup */
                 for (i = 0; i < ah->iniModes.ia_rows; i++) {
@@ -980,7 +979,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         if (r)
                 return r;
 
-        ath9k_hw_init_11a_eeprom_fix(ah);
+        ath9k_hw_init_eeprom_fix(ah);
 
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 996eb90263cc..643bea35686f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2655,10 +2655,10 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-                ath_beacon_return(sc, avp);
                 ath9k_ps_restore(sc);
         }
 
+        ath_beacon_return(sc, avp);
         sc->sc_flags &= ~SC_OP_BEACONS;
 
         for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index cde09a890b73..90fbdb25399e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -297,7 +297,7 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
 }
 EXPORT_SYMBOL(iwl_add_station);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
 {
         unsigned long flags;
         u8 sta_id = iwl_find_station(priv, addr);
@@ -324,7 +324,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 {
         struct iwl_rem_sta_cmd *rm_sta =
                         (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const char *addr = rm_sta->addr;
+        const u8 *addr = rm_sta->addr;
 
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
index 3a7be11cc6b9..812c66755083 100644
--- a/drivers/rtc/rtc-fm3130.c
+++ b/drivers/rtc/rtc-fm3130.c
@@ -376,20 +376,22 @@ static int __devinit fm3130_probe(struct i2c_client *client,
         }
 
         /* Disabling calibration mode */
-        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL)
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL) {
                 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                         fm3130->regs[FM3130_RTC_CONTROL] &
                                 ~(FM3130_RTC_CONTROL_BIT_CAL));
                 dev_warn(&client->dev, "Disabling calibration mode!\n");
+        }
 
         /* Disabling read and write modes */
         if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_WRITE ||
-            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ)
+            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ) {
                 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                         fm3130->regs[FM3130_RTC_CONTROL] &
                                 ~(FM3130_RTC_CONTROL_BIT_READ |
                                         FM3130_RTC_CONTROL_BIT_WRITE));
                 dev_warn(&client->dev, "Disabling READ or WRITE mode!\n");
+        }
 
         /* oscillator off?  turn it on, so clock can tick. */
         if (fm3130->regs[FM3130_CAL_CONTROL] & FM3130_CAL_CONTROL_BIT_nOSCEN)
diff --git a/drivers/serial/uartlite.c b/drivers/serial/uartlite.c
index 377f2712289e..ab2ab3c81834 100644
--- a/drivers/serial/uartlite.c
+++ b/drivers/serial/uartlite.c
@@ -394,7 +394,7 @@ static void ulite_console_write(struct console *co, const char *s,
                 spin_unlock_irqrestore(&port->lock, flags);
 }
 
-static int __init ulite_console_setup(struct console *co, char *options)
+static int __devinit ulite_console_setup(struct console *co, char *options)
 {
         struct uart_port *port;
         int baud = 9600;
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index 66358fa825f3..b4b6deceed15 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -593,7 +593,8 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
  */
 static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
 
         pr_debug("%s\n", __func__);
 
@@ -603,7 +604,8 @@ static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 
 static int imxfb_resume(struct platform_device *dev)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
 
         pr_debug("%s\n", __func__);
 
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 054ef29be479..772ba3f45e6f 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -324,8 +324,11 @@ static void sdc_enable_channel(struct mx3fb_info *mx3_fbi)
         unsigned long flags;
         dma_cookie_t cookie;
 
-        dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
-                to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+        if (mx3_fbi->txd)
+                dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+                        to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+        else
+                dev_dbg(mx3fb->dev, "mx3fbi %p, txd = NULL\n", mx3_fbi);
 
         /* This enables the channel */
         if (mx3_fbi->cookie < 0) {
@@ -646,6 +649,7 @@ static int sdc_set_global_alpha(struct mx3fb_data *mx3fb, bool enable, uint8_t a
 
 static void sdc_set_brightness(struct mx3fb_data *mx3fb, uint8_t value)
 {
+        dev_dbg(mx3fb->dev, "%s: value = %d\n", __func__, value);
         /* This might be board-specific */
         mx3fb_write_reg(mx3fb, 0x03000000UL | value << 16, SDC_PWM_CTRL);
         return;
@@ -1486,12 +1490,12 @@ static int mx3fb_probe(struct platform_device *pdev)
                 goto ersdc0;
         }
 
+        mx3fb->backlight_level = 255;
+
         ret = init_fb_chan(mx3fb, to_idmac_chan(chan));
         if (ret < 0)
                 goto eisdc0;
 
-        mx3fb->backlight_level = 255;
-
         return 0;
 
 eisdc0:
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index c18913a777ae..a9f5e137f1d3 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -828,6 +828,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
                 if (!page)
                         break;
 
+                if (mapping_writably_mapped(mapping))
+                        flush_dcache_page(page);
+
                 pagefault_disable();
                 tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
                 pagefault_enable();
diff --git a/include/linux/connector.h b/include/linux/connector.h
index 72ba63eb83c5..3a779ffba60b 100644
--- a/include/linux/connector.h
+++ b/include/linux/connector.h
@@ -24,9 +24,6 @@
 
 #include <linux/types.h>
 
-#define CN_IDX_CONNECTOR                0xffffffff
-#define CN_VAL_CONNECTOR                0xffffffff
-
 /*
  * Process Events connector unique ids -- used for message routing
  */
@@ -75,30 +72,6 @@ struct cn_msg {
         __u8 data[0];
 };
 
-/*
- * Notify structure - requests notification about
- * registering/unregistering idx/val in range [first, first+range].
- */
-struct cn_notify_req {
-        __u32 first;
-        __u32 range;
-};
-
-/*
- * Main notification control message
- * *_notify_num         - number of appropriate cn_notify_req structures after 
- *                              this struct.
- * group                - notification receiver's idx.
- * len                  - total length of the attached data.
- */
-struct cn_ctl_msg {
-        __u32 idx_notify_num;
-        __u32 val_notify_num;
-        __u32 group;
-        __u32 len;
-        __u8 data[0];
-};
-
 #ifdef __KERNEL__
 
 #include <asm/atomic.h>
@@ -151,11 +124,6 @@ struct cn_callback_entry {
         u32 seq, group;
 };
 
-struct cn_ctl_entry {
-        struct list_head notify_entry;
-        struct cn_ctl_msg *msg;
-};
-
 struct cn_dev {
         struct cb_id id;
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 1fbcc748044a..aa3bee566446 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2936,14 +2936,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
 
         for_each_subsys(root, ss) {
                 struct cgroup_subsys_state *css = ss->create(ss, cgrp);
+
                 if (IS_ERR(css)) {
                         err = PTR_ERR(css);
                         goto err_destroy;
                 }
                 init_cgroup_css(css, ss, cgrp);
-                if (ss->use_id)
-                        if (alloc_css_id(ss, parent, cgrp))
+                if (ss->use_id) {
+                        err = alloc_css_id(ss, parent, cgrp);
+                        if (err)
                                 goto err_destroy;
+                }
                 /* At error, ->destroy() callback has to free assigned ID. */
         }
 
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 32c5c15d750d..498cabba225e 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -349,6 +349,7 @@ EXPORT_SYMBOL(__kfifo_from_user_n);
  * @fifo: the fifo to be used.
  * @from: pointer to the data to be added.
  * @len: the length of the data to be added.
+ * @total: the actual returned data length.
  *
  * This function copies at most @len bytes from the @from into the
  * FIFO depending and returns -EFAULT/0.
@@ -399,7 +400,7 @@ EXPORT_SYMBOL(__kfifo_to_user_n);
  * @fifo: the fifo to be used.
  * @to: where the data must be copied.
  * @len: the size of the destination buffer.
- @ @lenout: pointer to output variable with copied data
+ * @lenout: pointer to output variable with copied data
  *
  * This function copies at most @len bytes from the FIFO into the
  * @to buffer and 0 or -EFAULT.
diff --git a/lib/idr.c b/lib/idr.c
index 1cac726c44bc..ba7d37cf7847 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -140,8 +140,7 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
         id = *starting_id;
  restart:
         p = idp->top;
-        l = idp->layers;
-        pa[l--] = NULL;
+        l = p->layer;
         while (1) {
                 /*
                  * We run around this while until we reach the leaf node...
@@ -155,8 +154,8 @@ static int sub_alloc(struct idr *idp, int *starting_id, struct idr_layer **pa)
                         oid = id;
                         id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
-                        /* if already at the top layer, we need to grow */
-                        if (!(p = pa[l])) {
+                        /* did id go over the limit? */
+                        if (id >= (1 << (idp->layers * IDR_BITS))) {
                                 *starting_id = id;
                                 return IDR_NEED_TO_GROW;
                         }
diff --git a/mm/filemap.c b/mm/filemap.c
index e3736923220e..698ea80f2102 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2232,6 +2232,9 @@ again:
                 if (unlikely(status))
                         break;
 
+                if (mapping_writably_mapped(mapping))
+                        flush_dcache_page(page);
+
                 pagefault_disable();
                 copied = iov_iter_copy_from_user_atomic(page, i, offset, bytes);
                 pagefault_enable();
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index e91b81b63670..2d16fa6b8c2d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1515,10 +1515,9 @@ static struct attribute_group hstate_attr_group = {
         .attrs = hstate_attrs,
 };
 
-static int __init hugetlb_sysfs_add_hstate(struct hstate *h,
-                                struct kobject *parent,
-                                struct kobject **hstate_kobjs,
-                                struct attribute_group *hstate_attr_group)
+static int hugetlb_sysfs_add_hstate(struct hstate *h, struct kobject *parent,
+                                    struct kobject **hstate_kobjs,
+                                    struct attribute_group *hstate_attr_group)
 {
         int retval;
         int hi = h - hstates;
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 18e7f5a43dc4..6cf526d06e21 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -243,6 +243,39 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
         input_sync(dev);
 }
 
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p data %p size %d", session, data, size);
+
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+
+        skb_queue_tail(&session->ctrl_transmit, skb);
+
+        return 0;
+}
+
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+
+        hidp_schedule(session);
+
+        return err;
+}
+
 static int hidp_queue_report(struct hidp_session *session,
                                 unsigned char *data, int size)
 {
@@ -282,7 +315,9 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
 
 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count)
 {
-        if (hidp_queue_report(hid->driver_data, data, count))
+        if (hidp_send_ctrl_message(hid->driver_data,
+                        HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE,
+                        data, count))
                 return -ENOMEM;
         return count;
 }
@@ -307,39 +342,6 @@ static inline void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
-static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        struct sk_buff *skb;
-
-        BT_DBG("session %p data %p size %d", session, data, size);
-
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
-                BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
-        }
-
-        *skb_put(skb, 1) = hdr;
-        if (data && size > 0)
-                memcpy(skb_put(skb, size), data, size);
-
-        skb_queue_tail(&session->ctrl_transmit, skb);
-
-        return 0;
-}
-
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        int err;
-
-        err = __hidp_send_ctrl_message(session, hdr, data, size);
-
-        hidp_schedule(session);
-
-        return err;
-}
-
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf14a548..400efa26ddba 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1368,7 +1368,6 @@ static int l2cap_ertm_send(struct sock *sk)
 
         while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
                !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
 
                 if (pi->remote_max_tx &&
                                 bt_cb(skb)->retries == pi->remote_max_tx) {
@@ -1376,6 +1375,8 @@ static int l2cap_ertm_send(struct sock *sk)
                         break;
                 }
 
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
                 bt_cb(skb)->retries++;
 
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
@@ -3518,7 +3519,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
         struct l2cap_pinfo *pi;
         u16 control, len;
         u8 tx_seq;
-        int err;
 
         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
         if (!sk) {
@@ -3570,13 +3570,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                         goto drop;
 
                 if (__is_iframe(control))
-                        err = l2cap_data_channel_iframe(sk, control, skb);
+                        l2cap_data_channel_iframe(sk, control, skb);
                 else
-                        err = l2cap_data_channel_sframe(sk, control, skb);
+                        l2cap_data_channel_sframe(sk, control, skb);
 
-                if (!err)
-                        goto done;
-                break;
+                goto done;
 
         case L2CAP_MODE_STREAMING:
                 control = get_unaligned_le16(skb->data);
@@ -3602,7 +3600,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 else
                         pi->expected_tx_seq = tx_seq + 1;
 
-                err = l2cap_sar_reassembly_sdu(sk, skb, control);
+                l2cap_sar_reassembly_sdu(sk, skb, control);
 
                 goto done;
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 312c20adc83f..624a54832a7c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -63,6 +63,7 @@ struct nf_ct_frag6_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index ee94ea0c67e9..da8497ef7063 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -680,7 +680,7 @@ TRACE_EVENT(drv_ampdu_action,
                 __entry->ret = ret;
                 __entry->action = action;
                 __entry->tid = tid;
-                __entry->ssn = *ssn;
+                __entry->ssn = ssn ? *ssn : 0;
         ),
 
         TP_printk(
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 59d8064eb522..42f21c01a93e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1437,8 +1437,9 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
         struct nlattr *nest_parms;
 
         memset(&m, 0xFF, sizeof(m));
-        m.src.u.all = mask->src.u.all;
         memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+        m.src.u.all = mask->src.u.all;
+        m.dst.protonum = tuple->dst.protonum;
 
         nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
         if (!nest_parms)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4b572163784b..023966b569bf 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -376,7 +376,7 @@ int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
                         dptr += hdr->len;
                 else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
                          strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
-                         !isalpha(*(dptr + hdr->clen + 1)))
+                         !isalpha(*(dptr + hdr->clen)))
                         dptr += hdr->clen;
                 else
                         continue;
diff --git a/scripts/get_maintainer.pl b/scripts/get_maintainer.pl
index 090f24839700..2f3230db7ffb 100755
--- a/scripts/get_maintainer.pl
+++ b/scripts/get_maintainer.pl
@@ -74,8 +74,8 @@ my %VCS_cmds;
 my %VCS_cmds_git = (
     "execute_cmd" => \&git_execute_cmd,
     "available" => '(which("git") ne "") && (-d ".git")',
-    "find_signers_cmd" => "git log --since=\$email_git_since -- \$file",
-    "find_commit_signers_cmd" => "git log -1 \$commit",
+    "find_signers_cmd" => "git log --no-color --since=\$email_git_since -- \$file",
+    "find_commit_signers_cmd" => "git log --no-color -1 \$commit",
     "blame_range_cmd" => "git blame -l -L \$diff_start,+\$diff_length \$file",
     "blame_file_cmd" => "git blame -l \$file",
     "commit_pattern" => "^commit [0-9a-f]{40,40}",
diff --git a/scripts/markup_oops.pl b/scripts/markup_oops.pl
index ce3e40b01e48..e950f9cde019 100644
--- a/scripts/markup_oops.pl
+++ b/scripts/markup_oops.pl
@@ -158,7 +158,7 @@ while (<STDIN>) {
                 $function = $1;
                 $func_offset = $2;
         }
-        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+(0x[0-9a-f]+)\/0x[a-f0-9]/) {
+        if ($line =~ /RIP: 0010:\[\<[0-9a-f]+\>\]  \[\<[0-9a-f]+\>\] ([a-zA-Z0-9\_]+)\+0x([0-9a-f]+)\/0x[a-f0-9]/) {
                 $function = $1;
                 $func_offset = $2;
         }