302 files changed, 1922 insertions, 985 deletions
diff --git a/Documentation/devicetree/bindings/gpio/led.txt b/Documentation/devicetree/bindings/gpio/led.txt
index 141087cf3107..fd2bd56e7195 100644
--- a/Documentation/devicetree/bindings/gpio/led.txt
+++ b/Documentation/devicetree/bindings/gpio/led.txt
@@ -7,9 +7,9 @@ Each LED is represented as a sub-node of the gpio-leds device.  Each
 node's name represents the name of the corresponding LED.
 LED sub-node properties:
- gpios :  Should specify the LED's GPIO, see "Specifying GPIO information
+- gpios :  Should specify the LED's GPIO, see "gpios property" in
-  for devices" in Documentation/devicetree/booting-without-of.txt.  Active
+  Documentation/devicetree/gpio.txt.  Active low LEDs should be
-  low LEDs should be indicated using flags in the GPIO specifier.
+  indicated using flags in the GPIO specifier.
 - label :  (optional) The label for this LED.  If omitted, the label is
  taken from the node name (excluding the unit address).
 - linux,default-trigger :  (optional) This parameter, if present, is a
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index ecc6a6cd26c1..a20008ab319a 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -30,6 +30,7 @@ national	National Semiconductor
 nintendo        Nintendo
 nvidia  NVIDIA
 nxp     NXP Semiconductors
+picochip        Picochip Ltd
 powervr Imagination Technologies
 qcom    Qualcomm, Inc.
 ramtron Ramtron International
diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
index a22ecf48f255..52729a756c1b 100644
--- a/Documentation/hwmon/jc42
+++ b/Documentation/hwmon/jc42
@@ -7,21 +7,29 @@ Supported chips:
    Addresses scanned: I2C 0x18 - 0x1f
    Datasheets:
        http://www.analog.com/static/imported-files/data_sheets/ADT7408.pdf
-  * IDT TSE2002B3, TS3000B3
+  * Atmel AT30TS00
-    Prefix: 'tse2002b3', 'ts3000b3'
+    Prefix: 'at30ts00'
    Addresses scanned: I2C 0x18 - 0x1f
    Datasheets:
-        http://www.idt.com/products/getdoc.cfm?docid=18715691
+        http://www.atmel.com/Images/doc8585.pdf
-        http://www.idt.com/products/getdoc.cfm?docid=18715692
+  * IDT TSE2002B3, TSE2002GB2, TS3000B3, TS3000GB2
+    Prefix: 'tse2002', 'ts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002B3C_DST_20100512_120303152056.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002GB2A1_DST_20111107_120303145914.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000B3A_DST_20101129_120303152013.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000GB2A1_DST_20111104_120303151012.pdf
  * Maxim MAX6604
    Prefix: 'max6604'
    Addresses scanned: I2C 0x18 - 0x1f
    Datasheets:
        http://datasheets.maxim-ic.com/en/ds/MAX6604.pdf
-  * Microchip MCP9805, MCP98242, MCP98243, MCP9843
+  * Microchip MCP9804, MCP9805, MCP98242, MCP98243, MCP9843
-    Prefixes: 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
+    Prefixes: 'mcp9804', 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
    Addresses scanned: I2C 0x18 - 0x1f
    Datasheets:
+        http://ww1.microchip.com/downloads/en/DeviceDoc/22203C.pdf
        http://ww1.microchip.com/downloads/en/DeviceDoc/21977b.pdf
        http://ww1.microchip.com/downloads/en/DeviceDoc/21996a.pdf
        http://ww1.microchip.com/downloads/en/DeviceDoc/22153c.pdf
@@ -48,6 +56,12 @@ Supported chips:
    Datasheets:
        http://www.st.com/stonline/products/literature/ds/13447/stts424.pdf
        http://www.st.com/stonline/products/literature/ds/13448/stts424e02.pdf
+  * ST Microelectronics STTS2002, STTS3000
+    Prefix: 'stts2002', 'stts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00225278.pdf
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATA_BRIEF/CD00270920.pdf
  * JEDEC JC 42.4 compliant temperature sensor chips
    Prefix: 'jc42'
    Addresses scanned: I2C 0x18 - 0x1f
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index f274c28b5103..2f95308251d4 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -13,7 +13,8 @@ Detection
 All ALPS touchpads should respond to the "E6 report" command sequence:
 E8-E6-E6-E6-E9. An ALPS touchpad should respond with either 00-00-0A or
-00-00-64.
+00-00-64 if no buttons are pressed. The bits 0-2 of the first byte will be 1s
+if some buttons are pressed.
 If the E6 report is successful, the touchpad model is identified using the "E7
 report" sequence: E8-E7-E7-E7-E9. The response is the model signature and is
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 033d4e69b43b..d99fd9c0ec0e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2211,6 +2211,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        default: off.
+        printk.always_kmsg_dump=
+                        Trigger kmsg_dump for cases other than kernel oops or
+                        panics
+                        Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
+                        default: disabled
        printk.time=    Show timing data prefixed to each printk message line
                        Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
diff --git a/MAINTAINERS b/MAINTAINERS
index 0a96e80d4515..3321d75c6c7f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -962,7 +962,7 @@ F:	drivers/tty/serial/msm_serial.c
 F:      drivers/platform/msm/
 F:      drivers/*/pm8???-*
 F:      include/linux/mfd/pm8xxx/
-T:      git git://codeaurora.org/quic/kernel/davidb/linux-msm.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git
 S:      Maintained
 ARM/TOSA MACHINE SUPPORT
@@ -1310,7 +1310,7 @@ F:	drivers/atm/
 F:      include/linux/atm*
 ATMEL AT91 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.atmel.com/products/AT91/
 W:      http://www.at91.com/
@@ -1318,7 +1318,7 @@ S:	Maintained
 F:      drivers/mmc/host/at91_mci.c
 ATMEL AT91 / AT32 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 S:      Maintained
 F:      drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
@@ -7271,7 +7271,7 @@ WATCHDOG DEVICE DRIVERS
 M:      Wim Van Sebroeck <wim@iguana.be>
 L:      linux-watchdog@vger.kernel.org
 W:      http://www.linux-watchdog.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog.git
+T:      git git://www.linux-watchdog.org/linux-watchdog.git
 S:      Maintained
 F:      Documentation/watchdog/
 F:      drivers/watchdog/
diff --git a/Makefile b/Makefile
index b61a9638b6fc..56d481727c30 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc7
 NAME = Saber-toothed Squirrel
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/futex.h b/arch/alpha/include/asm/futex.h
index e8a761aee088..f939794363ac 100644
--- a/arch/alpha/include/asm/futex.h
+++ b/arch/alpha/include/asm/futex.h
@@ -108,7 +108,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
        "       lda     $31,3b-2b(%0)\n"
        "       .previous\n"
        :       "+r"(ret), "=&r"(prev), "=&r"(cmp)
-        :       "r"(uaddr), "r"((long)oldval), "r"(newval)
+        :       "r"(uaddr), "r"((long)(int)oldval), "r"(newval)
        :       "memory");
        *uval = prev;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index a48aecc17eac..dfb0312f4e73 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1280,7 +1280,7 @@ config ARM_ERRATA_743622
        depends on CPU_V7
        help
          This option enables the workaround for the 743622 Cortex-A9
-          (r2p0..r2p2) erratum. Under very rare conditions, a faulty
+          (r2p*) erratum. Under very rare conditions, a faulty
          optimisation in the Cortex-A9 Store Buffer may lead to data
          corruption. This workaround sets a specific bit in the diagnostic
          register of the Cortex-A9 which disables the Store Buffer
diff --git a/arch/arm/boot/.gitignore b/arch/arm/boot/.gitignore
index ce1c5ff746e7..3c79f85975aa 100644
--- a/arch/arm/boot/.gitignore
+++ b/arch/arm/boot/.gitignore
@@ -3,3 +3,4 @@ zImage
 xipImage
 bootpImage
 uImage
+*.dtb
diff --git a/arch/arm/include/asm/pmu.h b/arch/arm/include/asm/pmu.h
index b5a5be2536c1..90114faa9f3c 100644
--- a/arch/arm/include/asm/pmu.h
+++ b/arch/arm/include/asm/pmu.h
@@ -134,7 +134,7 @@ int __init armpmu_register(struct arm_pmu *armpmu, char *name, int type);
 u64 armpmu_event_update(struct perf_event *event,
                        struct hw_perf_event *hwc,
-                        int idx, int overflow);
+                        int idx);
 int armpmu_event_set_period(struct perf_event *event,
                            struct hw_perf_event *hwc,
diff --git a/arch/arm/kernel/ecard.c b/arch/arm/kernel/ecard.c
index 4dd0edab6a65..1651d4950744 100644
--- a/arch/arm/kernel/ecard.c
+++ b/arch/arm/kernel/ecard.c
@@ -242,6 +242,7 @@ static void ecard_init_pgtables(struct mm_struct *mm)
        memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
+        vma.vm_flags = VM_EXEC;
        vma.vm_mm = mm;
        flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 5bb91bf3d47f..b2abfa18f137 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -180,7 +180,7 @@ armpmu_event_set_period(struct perf_event *event,
 u64
 armpmu_event_update(struct perf_event *event,
                    struct hw_perf_event *hwc,
-                    int idx, int overflow)
+                    int idx)
 {
        struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
        u64 delta, prev_raw_count, new_raw_count;
@@ -193,13 +193,7 @@ again:
                             new_raw_count) != prev_raw_count)
                goto again;
-        new_raw_count &= armpmu->max_period;
+        delta = (new_raw_count - prev_raw_count) & armpmu->max_period;
-        prev_raw_count &= armpmu->max_period;
-        if (overflow)
-                delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
-        else
-                delta = new_raw_count - prev_raw_count;
        local64_add(delta, &event->count);
        local64_sub(delta, &hwc->period_left);
@@ -216,7 +210,7 @@ armpmu_read(struct perf_event *event)
        if (hwc->idx < 0)
                return;
-        armpmu_event_update(event, hwc, hwc->idx, 0);
+        armpmu_event_update(event, hwc, hwc->idx);
 }
 static void
@@ -232,7 +226,7 @@ armpmu_stop(struct perf_event *event, int flags)
        if (!(hwc->state & PERF_HES_STOPPED)) {
                armpmu->disable(hwc, hwc->idx);
                barrier(); /* why? */
-                armpmu_event_update(event, hwc, hwc->idx, 0);
+                armpmu_event_update(event, hwc, hwc->idx);
                hwc->state |= PERF_HES_STOPPED | PERF_HES_UPTODATE;
        }
 }
@@ -518,7 +512,13 @@ __hw_perf_event_init(struct perf_event *event)
        hwc->config_base            |= (unsigned long)mapping;
        if (!hwc->sample_period) {
-                hwc->sample_period  = armpmu->max_period;
+                /*
+                 * For non-sampling runs, limit the sample_period to half
+                 * of the counter width. That way, the new counter value
+                 * is far less likely to overtake the previous one unless
+                 * you have some serious IRQ latency issues.
+                 */
+                hwc->sample_period  = armpmu->max_period >> 1;
                hwc->last_period    = hwc->sample_period;
                local64_set(&hwc->period_left, hwc->sample_period);
        }
@@ -680,6 +680,28 @@ static void __init cpu_pmu_init(struct arm_pmu *armpmu)
 }
 /*
+ * PMU hardware loses all context when a CPU goes offline.
+ * When a CPU is hotplugged back in, since some hardware registers are
+ * UNKNOWN at reset, the PMU must be explicitly reset to avoid reading
+ * junk values out of them.
+ */
+static int __cpuinit pmu_cpu_notify(struct notifier_block *b,
+                                        unsigned long action, void *hcpu)
+{
+        if ((action & ~CPU_TASKS_FROZEN) != CPU_STARTING)
+                return NOTIFY_DONE;
+        if (cpu_pmu && cpu_pmu->reset)
+                cpu_pmu->reset(NULL);
+        return NOTIFY_OK;
+}
+static struct notifier_block __cpuinitdata pmu_cpu_notifier = {
+        .notifier_call = pmu_cpu_notify,
+};
+/*
 * CPU PMU identification and registration.
 */
 static int __init
@@ -730,6 +752,7 @@ init_hw_perf_events(void)
                pr_info("enabled with %s PMU driver, %d counters available\n",
                        cpu_pmu->name, cpu_pmu->num_events);
                cpu_pmu_init(cpu_pmu);
+                register_cpu_notifier(&pmu_cpu_notifier);
                armpmu_register(cpu_pmu, "cpu", PERF_TYPE_RAW);
        } else {
                pr_info("no hardware support available\n");
diff --git a/arch/arm/kernel/perf_event_v6.c b/arch/arm/kernel/perf_event_v6.c
index 533be9930ec2..b78af0cc6ef3 100644
--- a/arch/arm/kernel/perf_event_v6.c
+++ b/arch/arm/kernel/perf_event_v6.c
@@ -467,23 +467,6 @@ armv6pmu_enable_event(struct hw_perf_event *hwc,
        raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
-static int counter_is_active(unsigned long pmcr, int idx)
-{
-        unsigned long mask = 0;
-        if (idx == ARMV6_CYCLE_COUNTER)
-                mask = ARMV6_PMCR_CCOUNT_IEN;
-        else if (idx == ARMV6_COUNTER0)
-                mask = ARMV6_PMCR_COUNT0_IEN;
-        else if (idx == ARMV6_COUNTER1)
-                mask = ARMV6_PMCR_COUNT1_IEN;
-        if (mask)
-                return pmcr & mask;
-        WARN_ONCE(1, "invalid counter number (%d)\n", idx);
-        return 0;
-}
 static irqreturn_t
 armv6pmu_handle_irq(int irq_num,
                    void *dev)
@@ -513,7 +496,8 @@ armv6pmu_handle_irq(int irq_num,
                struct perf_event *event = cpuc->events[idx];
                struct hw_perf_event *hwc;
-                if (!counter_is_active(pmcr, idx))
+                /* Ignore if we don't have an event. */
+                if (!event)
                        continue;
                /*
@@ -524,7 +508,7 @@ armv6pmu_handle_irq(int irq_num,
                        continue;
                hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                data.period = event->hw.last_period;
                if (!armpmu_event_set_period(event, hwc, idx))
                        continue;
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 6933244c68f9..4d7095af2ab3 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -809,6 +809,11 @@ static inline int armv7_pmnc_disable_intens(int idx)
        counter = ARMV7_IDX_TO_COUNTER(idx);
        asm volatile("mcr p15, 0, %0, c9, c14, 2" : : "r" (BIT(counter)));
+        isb();
+        /* Clear the overflow flag in case an interrupt is pending. */
+        asm volatile("mcr p15, 0, %0, c9, c12, 3" : : "r" (BIT(counter)));
+        isb();
        return idx;
 }
@@ -955,6 +960,10 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                struct perf_event *event = cpuc->events[idx];
                struct hw_perf_event *hwc;
+                /* Ignore if we don't have an event. */
+                if (!event)
+                        continue;
                /*
                 * We have a single interrupt for all counters. Check that
                 * each counter has overflowed before we process it.
@@ -963,7 +972,7 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                        continue;
                hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                data.period = event->hw.last_period;
                if (!armpmu_event_set_period(event, hwc, idx))
                        continue;
diff --git a/arch/arm/kernel/perf_event_xscale.c b/arch/arm/kernel/perf_event_xscale.c
index 3b99d8269829..71a21e6712f5 100644
--- a/arch/arm/kernel/perf_event_xscale.c
+++ b/arch/arm/kernel/perf_event_xscale.c
@@ -255,11 +255,14 @@ xscale1pmu_handle_irq(int irq_num, void *dev)
                struct perf_event *event = cpuc->events[idx];
                struct hw_perf_event *hwc;
+                if (!event)
+                        continue;
                if (!xscale1_pmnc_counter_has_overflowed(pmnc, idx))
                        continue;
                hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                data.period = event->hw.last_period;
                if (!armpmu_event_set_period(event, hwc, idx))
                        continue;
@@ -592,11 +595,14 @@ xscale2pmu_handle_irq(int irq_num, void *dev)
                struct perf_event *event = cpuc->events[idx];
                struct hw_perf_event *hwc;
-                if (!xscale2_pmnc_counter_has_overflowed(pmnc, idx))
+                if (!event)
+                        continue;
+                if (!xscale2_pmnc_counter_has_overflowed(of_flags, idx))
                        continue;
                hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                data.period = event->hw.last_period;
                if (!armpmu_event_set_period(event, hwc, idx))
                        continue;
@@ -663,7 +669,7 @@ xscale2pmu_enable_event(struct hw_perf_event *hwc, int idx)
 static void
 xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
 {
-        unsigned long flags, ien, evtsel;
+        unsigned long flags, ien, evtsel, of_flags;
        struct pmu_hw_events *events = cpu_pmu->get_hw_events();
        ien = xscale2pmu_read_int_enable();
@@ -672,26 +678,31 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
        switch (idx) {
        case XSCALE_CYCLE_COUNTER:
                ien &= ~XSCALE2_CCOUNT_INT_EN;
+                of_flags = XSCALE2_CCOUNT_OVERFLOW;
                break;
        case XSCALE_COUNTER0:
                ien &= ~XSCALE2_COUNT0_INT_EN;
                evtsel &= ~XSCALE2_COUNT0_EVT_MASK;
                evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT0_EVT_SHFT;
+                of_flags = XSCALE2_COUNT0_OVERFLOW;
                break;
        case XSCALE_COUNTER1:
                ien &= ~XSCALE2_COUNT1_INT_EN;
                evtsel &= ~XSCALE2_COUNT1_EVT_MASK;
                evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT1_EVT_SHFT;
+                of_flags = XSCALE2_COUNT1_OVERFLOW;
                break;
        case XSCALE_COUNTER2:
                ien &= ~XSCALE2_COUNT2_INT_EN;
                evtsel &= ~XSCALE2_COUNT2_EVT_MASK;
                evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT2_EVT_SHFT;
+                of_flags = XSCALE2_COUNT2_OVERFLOW;
                break;
        case XSCALE_COUNTER3:
                ien &= ~XSCALE2_COUNT3_INT_EN;
                evtsel &= ~XSCALE2_COUNT3_EVT_MASK;
                evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT3_EVT_SHFT;
+                of_flags = XSCALE2_COUNT3_OVERFLOW;
                break;
        default:
                WARN_ONCE(1, "invalid counter number (%d)\n", idx);
@@ -701,6 +712,7 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
        raw_spin_lock_irqsave(&events->pmu_lock, flags);
        xscale2pmu_write_event_select(evtsel);
        xscale2pmu_write_int_enable(ien);
+        xscale2pmu_write_overflow_flags(of_flags);
        raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index b7582dd10dc3..96e2adcd5a84 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -38,10 +38,6 @@
 #if defined(CONFIG_AT_HDMAC) || defined(CONFIG_AT_HDMAC_MODULE)
 static u64 hdmac_dmamask = DMA_BIT_MASK(32);
-static struct at_dma_platform_data atdma_pdata = {
-        .nr_channels    = 8,
-};
 static struct resource hdmac_resources[] = {
        [0] = {
                .start  = AT91SAM9G45_BASE_DMA,
@@ -56,12 +52,11 @@ static struct resource hdmac_resources[] = {
 };
 static struct platform_device at_hdmac_device = {
-        .name           = "at_hdmac",
+        .name           = "at91sam9g45_dma",
        .id             = -1,
        .dev            = {
                                .dma_mask               = &hdmac_dmamask,
                                .coherent_dma_mask      = DMA_BIT_MASK(32),
-                                .platform_data          = &atdma_pdata,
        },
        .resource       = hdmac_resources,
        .num_resources  = ARRAY_SIZE(hdmac_resources),
@@ -69,9 +64,15 @@ static struct platform_device at_hdmac_device = {
 void __init at91_add_device_hdmac(void)
 {
-        dma_cap_set(DMA_MEMCPY, atdma_pdata.cap_mask);
+#if defined(CONFIG_OF)
-        dma_cap_set(DMA_SLAVE, atdma_pdata.cap_mask);
+        struct device_node *of_node =
-        platform_device_register(&at_hdmac_device);
+                of_find_node_by_name(NULL, "dma-controller");
+        if (of_node)
+                of_node_put(of_node);
+        else
+#endif
+                platform_device_register(&at_hdmac_device);
 }
 #else
 void __init at91_add_device_hdmac(void) {}
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index 61908dce9784..9be71c11d0f0 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -33,10 +33,6 @@
 #if defined(CONFIG_AT_HDMAC) || defined(CONFIG_AT_HDMAC_MODULE)
 static u64 hdmac_dmamask = DMA_BIT_MASK(32);
-static struct at_dma_platform_data atdma_pdata = {
-        .nr_channels    = 2,
-};
 static struct resource hdmac_resources[] = {
        [0] = {
                .start  = AT91SAM9RL_BASE_DMA,
@@ -51,12 +47,11 @@ static struct resource hdmac_resources[] = {
 };
 static struct platform_device at_hdmac_device = {
-        .name           = "at_hdmac",
+        .name           = "at91sam9rl_dma",
        .id             = -1,
        .dev            = {
                                .dma_mask               = &hdmac_dmamask,
                                .coherent_dma_mask      = DMA_BIT_MASK(32),
-                                .platform_data          = &atdma_pdata,
        },
        .resource       = hdmac_resources,
        .num_resources  = ARRAY_SIZE(hdmac_resources),
@@ -64,7 +59,6 @@ static struct platform_device at_hdmac_device = {
 void __init at91_add_device_hdmac(void)
 {
-        dma_cap_set(DMA_MEMCPY, atdma_pdata.cap_mask);
        platform_device_register(&at_hdmac_device);
 }
 #else
diff --git a/arch/arm/mach-ep93xx/vision_ep9307.c b/arch/arm/mach-ep93xx/vision_ep9307.c
index d5fb44f16d31..d67d0b4feb6f 100644
--- a/arch/arm/mach-ep93xx/vision_ep9307.c
+++ b/arch/arm/mach-ep93xx/vision_ep9307.c
@@ -34,6 +34,7 @@
 #include <mach/ep93xx_spi.h>
 #include <mach/gpio-ep93xx.h>
+#include <asm/hardware/vic.h>
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
 #include <asm/mach/arch.h>
@@ -361,6 +362,7 @@ MACHINE_START(VISION_EP9307, "Vision Engraving Systems EP9307")
        .atag_offset    = 0x100,
        .map_io         = vision_map_io,
        .init_irq       = ep93xx_init_irq,
+        .handle_irq     = vic_handle_irq,
        .timer          = &ep93xx_timer,
        .init_machine   = vision_init_machine,
        .restart        = ep93xx_restart,
diff --git a/arch/arm/mach-exynos/mach-universal_c210.c b/arch/arm/mach-exynos/mach-universal_c210.c
index 0fc65ffde8ff..38939956c34f 100644
--- a/arch/arm/mach-exynos/mach-universal_c210.c
+++ b/arch/arm/mach-exynos/mach-universal_c210.c
@@ -13,6 +13,7 @@
 #include <linux/i2c.h>
 #include <linux/gpio_keys.h>
 #include <linux/gpio.h>
+#include <linux/interrupt.h>
 #include <linux/fb.h>
 #include <linux/mfd/max8998.h>
 #include <linux/regulator/machine.h>
@@ -595,6 +596,7 @@ static struct mxt_platform_data qt602240_platform_data = {
        .threshold      = 0x28,
        .voltage        = 2800000,              /* 2.8V */
        .orient         = MXT_DIAGONAL,
+        .irqflags       = IRQF_TRIGGER_FALLING,
 };
 static struct i2c_board_info i2c3_devs[] __initdata = {
diff --git a/arch/arm/mach-lpc32xx/include/mach/irqs.h b/arch/arm/mach-lpc32xx/include/mach/irqs.h
index 2667f52e3b04..9e3b90df32e1 100644
--- a/arch/arm/mach-lpc32xx/include/mach/irqs.h
+++ b/arch/arm/mach-lpc32xx/include/mach/irqs.h
@@ -61,7 +61,7 @@
 */
 #define IRQ_LPC32XX_JTAG_COMM_TX        LPC32XX_SIC1_IRQ(1)
 #define IRQ_LPC32XX_JTAG_COMM_RX        LPC32XX_SIC1_IRQ(2)
-#define IRQ_LPC32XX_GPI_11              LPC32XX_SIC1_IRQ(4)
+#define IRQ_LPC32XX_GPI_28              LPC32XX_SIC1_IRQ(4)
 #define IRQ_LPC32XX_TS_P                LPC32XX_SIC1_IRQ(6)
 #define IRQ_LPC32XX_TS_IRQ              LPC32XX_SIC1_IRQ(7)
 #define IRQ_LPC32XX_TS_AUX              LPC32XX_SIC1_IRQ(8)
diff --git a/arch/arm/mach-lpc32xx/irq.c b/arch/arm/mach-lpc32xx/irq.c
index 4eae566dfdc7..c74de01ab5b6 100644
--- a/arch/arm/mach-lpc32xx/irq.c
+++ b/arch/arm/mach-lpc32xx/irq.c
@@ -118,6 +118,10 @@ static const struct lpc32xx_event_info lpc32xx_events[NR_IRQS] = {
                .event_group = &lpc32xx_event_pin_regs,
                .mask = LPC32XX_CLKPWR_EXTSRC_GPI_06_BIT,
        },
+        [IRQ_LPC32XX_GPI_28] = {
+                .event_group = &lpc32xx_event_pin_regs,
+                .mask = LPC32XX_CLKPWR_EXTSRC_GPI_28_BIT,
+        },
        [IRQ_LPC32XX_GPIO_00] = {
                .event_group = &lpc32xx_event_int_regs,
                .mask = LPC32XX_CLKPWR_INTSRC_GPIO_00_BIT,
@@ -305,9 +309,18 @@ static int lpc32xx_irq_wake(struct irq_data *d, unsigned int state)
                if (state)
                        eventreg |= lpc32xx_events[d->irq].mask;
-                else
+                else {
                        eventreg &= ~lpc32xx_events[d->irq].mask;
+                        /*
+                         * When disabling the wakeup, clear the latched
+                         * event
+                         */
+                        __raw_writel(lpc32xx_events[d->irq].mask,
+                                lpc32xx_events[d->irq].
+                                event_group->rawstat_reg);
+                }
                __raw_writel(eventreg,
                        lpc32xx_events[d->irq].event_group->enab_reg);
@@ -380,13 +393,15 @@ void __init lpc32xx_init_irq(void)
        /* Setup SIC1 */
        __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
        /* Setup SIC2 */
        __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
        /* Configure supported IRQ's */
        for (i = 0; i < NR_IRQS; i++) {
diff --git a/arch/arm/mach-lpc32xx/serial.c b/arch/arm/mach-lpc32xx/serial.c
index 429cfdbb2b3d..f2735281616a 100644
--- a/arch/arm/mach-lpc32xx/serial.c
+++ b/arch/arm/mach-lpc32xx/serial.c
@@ -88,6 +88,7 @@ struct uartinit {
        char *uart_ck_name;
        u32 ck_mode_mask;
        void __iomem *pdiv_clk_reg;
+        resource_size_t mapbase;
 };
 static struct uartinit uartinit_data[] __initdata = {
@@ -97,6 +98,7 @@ static struct uartinit uartinit_data[] __initdata = {
                .ck_mode_mask =
                        LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 5),
                .pdiv_clk_reg = LPC32XX_CLKPWR_UART5_CLK_CTRL,
+                .mapbase = LPC32XX_UART5_BASE,
        },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART3_SELECT
@@ -105,6 +107,7 @@ static struct uartinit uartinit_data[] __initdata = {
                .ck_mode_mask =
                        LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 3),
                .pdiv_clk_reg = LPC32XX_CLKPWR_UART3_CLK_CTRL,
+                .mapbase = LPC32XX_UART3_BASE,
        },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART4_SELECT
@@ -113,6 +116,7 @@ static struct uartinit uartinit_data[] __initdata = {
                .ck_mode_mask =
                        LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 4),
                .pdiv_clk_reg = LPC32XX_CLKPWR_UART4_CLK_CTRL,
+                .mapbase = LPC32XX_UART4_BASE,
        },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART6_SELECT
@@ -121,6 +125,7 @@ static struct uartinit uartinit_data[] __initdata = {
                .ck_mode_mask =
                        LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 6),
                .pdiv_clk_reg = LPC32XX_CLKPWR_UART6_CLK_CTRL,
+                .mapbase = LPC32XX_UART6_BASE,
        },
 #endif
 };
@@ -165,11 +170,24 @@ void __init lpc32xx_serial_init(void)
                /* pre-UART clock divider set to 1 */
                __raw_writel(0x0101, uartinit_data[i].pdiv_clk_reg);
+                /*
+                 * Force a flush of the RX FIFOs to work around a
+                 * HW bug
+                 */
+                puart = uartinit_data[i].mapbase;
+                __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
+                __raw_writel(0x00, LPC32XX_UART_DLL_FIFO(puart));
+                j = LPC32XX_SUART_FIFO_SIZE;
+                while (j--)
+                        tmp = __raw_readl(
+                                LPC32XX_UART_DLL_FIFO(puart));
+                __raw_writel(0, LPC32XX_UART_IIR_FCR(puart));
        }
        /* This needs to be done after all UART clocks are setup */
        __raw_writel(clkmodes, LPC32XX_UARTCTL_CLKMODE);
-        for (i = 0; i < ARRAY_SIZE(uartinit_data) - 1; i++) {
+        for (i = 0; i < ARRAY_SIZE(uartinit_data); i++) {
                /* Force a flush of the RX FIFOs to work around a HW bug */
                puart = serial_std_platform_data[i].mapbase;
                __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
diff --git a/arch/arm/mach-mmp/aspenite.c b/arch/arm/mach-mmp/aspenite.c
index 17cb76060125..3588a5584153 100644
--- a/arch/arm/mach-mmp/aspenite.c
+++ b/arch/arm/mach-mmp/aspenite.c
@@ -17,7 +17,6 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/nand.h>
 #include <linux/interrupt.h>
-#include <linux/gpio.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 7bc17eaa12eb..ada1213982b4 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -24,7 +24,6 @@
 #include <mach/dma.h>
 #include <mach/devices.h>
 #include <mach/mfp.h>
-#include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <mach/pxa168.h>
diff --git a/arch/arm/mach-mmp/tavorevb.c b/arch/arm/mach-mmp/tavorevb.c
index 8e3b5af04a57..bc97170125bf 100644
--- a/arch/arm/mach-mmp/tavorevb.c
+++ b/arch/arm/mach-mmp/tavorevb.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/smc91x.h>
-#include <linux/gpio.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index 309369ea6978..be2002f42dea 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -416,13 +416,13 @@ static void __init innovator_init(void)
 #ifdef CONFIG_ARCH_OMAP15XX
        if (cpu_is_omap1510()) {
                omap1_usb_init(&innovator1510_usb_config);
-                innovator_config[1].data = &innovator1510_lcd_config;
+                innovator_config[0].data = &innovator1510_lcd_config;
        }
 #endif
 #ifdef CONFIG_ARCH_OMAP16XX
        if (cpu_is_omap1610()) {
                omap1_usb_init(&h2_usb_config);
-                innovator_config[1].data = &innovator1610_lcd_config;
+                innovator_config[0].data = &innovator1610_lcd_config;
        }
 #endif
        omap_board_config = innovator_config;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index d965da45160e..e20c8ab80b0e 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -364,8 +364,8 @@ config OMAP3_SDRC_AC_TIMING
          going on could result in system crashes;
 config OMAP4_ERRATA_I688
-        bool "OMAP4 errata: Async Bridge Corruption (BROKEN)"
+        bool "OMAP4 errata: Async Bridge Corruption"
-        depends on ARCH_OMAP4 && BROKEN
+        depends on ARCH_OMAP4
        select ARCH_HAS_BARRIERS
        help
          If a data is stalled inside asynchronous bridge because of back
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index 42a4d11fad23..672262717601 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -371,7 +371,11 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
        else
                *openp = 0;
+#ifdef CONFIG_MMC_OMAP
        omap_mmc_notify_cover_event(mmc_device, index, *openp);
+#else
+        pr_warn("MMC: notify cover event not available\n");
+#endif
 }
 static int n8x0_mmc_late_init(struct device *dev)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index c775bead1497..c877236a8442 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -381,7 +381,7 @@ static int omap3evm_twl_gpio_setup(struct device *dev,
        gpio_request_one(gpio + 7, GPIOF_OUT_INIT_LOW, "EN_DVI");
        /* TWL4030_GPIO_MAX + 1 == ledB (out, active low LED) */
-        gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
+        gpio_leds[0].gpio = gpio + TWL4030_GPIO_MAX + 1;
        platform_device_register(&leds_gpio);
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index febffde2ff10..7e9338e8d684 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -132,6 +132,7 @@ void omap3_map_io(void);
 void am33xx_map_io(void);
 void omap4_map_io(void);
 void ti81xx_map_io(void);
+void omap_barriers_init(void);
 /**
 * omap_test_timeout - busy-loop, testing a condition
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index cfdbb86bc84e..72e018b9b260 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -65,7 +65,6 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
        struct timespec ts_preidle, ts_postidle, ts_idle;
        u32 cpu1_state;
        int idle_time;
-        int new_state_idx;
        int cpu_id = smp_processor_id();
        /* Used to keep track of the total time in idle */
@@ -84,8 +83,8 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
         */
        cpu1_state = pwrdm_read_pwrst(cpu1_pd);
        if (cpu1_state != PWRDM_POWER_OFF) {
-                new_state_idx = drv->safe_state_index;
+                index = drv->safe_state_index;
-                cx = cpuidle_get_statedata(&dev->states_usage[new_state_idx]);
+                cx = cpuidle_get_statedata(&dev->states_usage[index]);
        }
        if (index > 0)
diff --git a/arch/arm/mach-omap2/gpmc-smsc911x.c b/arch/arm/mach-omap2/gpmc-smsc911x.c
index 997033129d26..bbb870c04a5e 100644
--- a/arch/arm/mach-omap2/gpmc-smsc911x.c
+++ b/arch/arm/mach-omap2/gpmc-smsc911x.c
@@ -19,6 +19,8 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 #include <plat/board.h>
 #include <plat/gpmc.h>
@@ -42,6 +44,50 @@ static struct smsc911x_platform_config gpmc_smsc911x_config = {
        .flags          = SMSC911X_USE_16BIT,
 };
+static struct regulator_consumer_supply gpmc_smsc911x_supply[] = {
+        REGULATOR_SUPPLY("vddvario", "smsc911x.0"),
+        REGULATOR_SUPPLY("vdd33a", "smsc911x.0"),
+};
+/* Generic regulator definition to satisfy smsc911x */
+static struct regulator_init_data gpmc_smsc911x_reg_init_data = {
+        .constraints = {
+                .min_uV                 = 3300000,
+                .max_uV                 = 3300000,
+                .valid_modes_mask       = REGULATOR_MODE_NORMAL
+                                        | REGULATOR_MODE_STANDBY,
+                .valid_ops_mask         = REGULATOR_CHANGE_MODE
+                                        | REGULATOR_CHANGE_STATUS,
+        },
+        .num_consumer_supplies  = ARRAY_SIZE(gpmc_smsc911x_supply),
+        .consumer_supplies      = gpmc_smsc911x_supply,
+};
+static struct fixed_voltage_config gpmc_smsc911x_fixed_reg_data = {
+        .supply_name            = "gpmc_smsc911x",
+        .microvolts             = 3300000,
+        .gpio                   = -EINVAL,
+        .startup_delay          = 0,
+        .enable_high            = 0,
+        .enabled_at_boot        = 1,
+        .init_data              = &gpmc_smsc911x_reg_init_data,
+};
+/*
+ * Platform device id of 42 is a temporary fix to avoid conflicts
+ * with other reg-fixed-voltage devices. The real fix should
+ * involve the driver core providing a way of dynamically
+ * assigning a unique id on registration for platform devices
+ * in the same name space.
+ */
+static struct platform_device gpmc_smsc911x_regulator = {
+        .name           = "reg-fixed-voltage",
+        .id             = 42,
+        .dev = {
+                .platform_data  = &gpmc_smsc911x_fixed_reg_data,
+        },
+};
 /*
 * Initialize smsc911x device connected to the GPMC. Note that we
 * assume that pin multiplexing is done in the board-*.c file,
@@ -55,6 +101,12 @@ void __init gpmc_smsc911x_init(struct omap_smsc911x_platform_data *board_data)
        gpmc_cfg = board_data;
+        ret = platform_device_register(&gpmc_smsc911x_regulator);
+        if (ret < 0) {
+                pr_err("Unable to register smsc911x regulators: %d\n", ret);
+                return;
+        }
        if (gpmc_cs_request(gpmc_cfg->cs, SZ_16M, &cs_mem_base) < 0) {
                pr_err("Failed to request GPMC mem region\n");
                return;
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index b40c28895298..19dd1657245c 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -428,6 +428,7 @@ static int omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
        return 0;
 }
+static int omap_hsmmc_done;
 #define MAX_OMAP_MMC_HWMOD_NAME_LEN             16
 void omap_init_hsmmc(struct omap2_hsmmc_info *hsmmcinfo, int ctrl_nr)
@@ -491,6 +492,11 @@ void omap2_hsmmc_init(struct omap2_hsmmc_info *controllers)
 {
        u32 reg;
+        if (omap_hsmmc_done)
+                return;
+        omap_hsmmc_done = 1;
        if (!cpu_is_omap44xx()) {
                if (cpu_is_omap2430()) {
                        control_pbias_offset = OMAP243X_CONTROL_PBIAS_LITE;
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 6c5826605eae..719ee423abe2 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -343,6 +343,7 @@ static void __init omap3_check_revision(const char **cpu_rev)
        case 0xb944:
                omap_revision = AM335X_REV_ES1_0;
                *cpu_rev = "1.0";
+                break;
        case 0xb8f2:
                switch (rev) {
                case 0:
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index eb50c29fb644..fb11b44fbdec 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -307,6 +307,7 @@ void __init omapam33xx_map_common_io(void)
 void __init omap44xx_map_common_io(void)
 {
        iotable_init(omap44xx_io_desc, ARRAY_SIZE(omap44xx_io_desc));
+        omap_barriers_init();
 }
 #endif
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index a6db1e4f7b6e..415a6f1cf419 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -281,8 +281,16 @@ static struct omap_mbox mbox_iva_info = {
        .ops    = &omap2_mbox_ops,
        .priv   = &omap2_mbox_iva_priv,
 };
+#endif
-struct omap_mbox *omap2_mboxes[] = { &mbox_dsp_info, &mbox_iva_info, NULL };
+#ifdef CONFIG_ARCH_OMAP2
+struct omap_mbox *omap2_mboxes[] = {
+        &mbox_dsp_info,
+#ifdef CONFIG_SOC_OMAP2420
+        &mbox_iva_info,
+#endif
+        NULL
+};
 #endif
 #if defined(CONFIG_ARCH_OMAP4)
@@ -412,8 +420,7 @@ static void __exit omap2_mbox_exit(void)
        platform_driver_unregister(&omap2_mbox_driver);
 }
-/* must be ready before omap3isp is probed */
+module_init(omap2_mbox_init);
-subsys_initcall(omap2_mbox_init);
 module_exit(omap2_mbox_exit);
 MODULE_LICENSE("GPL v2");
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fb8bc9fa43b1..611a0e3d54ca 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -218,7 +218,7 @@ static int _omap_mux_get_by_name(struct omap_mux_partition *partition,
        return -ENODEV;
 }
-static int __init
+static int
 omap_mux_get_by_name(const char *muxname,
                        struct omap_mux_partition **found_partition,
                        struct omap_mux **found_mux)
diff --git a/arch/arm/mach-omap2/omap-iommu.c b/arch/arm/mach-omap2/omap-iommu.c
index b8822048e409..ac49384d0285 100644
--- a/arch/arm/mach-omap2/omap-iommu.c
+++ b/arch/arm/mach-omap2/omap-iommu.c
@@ -150,7 +150,8 @@ err_out:
                platform_device_put(omap_iommu_pdev[i]);
        return err;
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 static void __exit omap_iommu_exit(void)
 {
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 40a8fbc07e4b..70de277f5c15 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -24,12 +24,14 @@
 #include <plat/irqs.h>
 #include <plat/sram.h>
+#include <plat/omap-secure.h>
 #include <mach/hardware.h>
 #include <mach/omap-wakeupgen.h>
 #include "common.h"
 #include "omap4-sar-layout.h"
+#include <linux/export.h>
 #ifdef CONFIG_CACHE_L2X0
 static void __iomem *l2cache_base;
@@ -43,6 +45,9 @@ static void __iomem *sar_ram_base;
 void __iomem *dram_sync, *sram_sync;
+static phys_addr_t paddr;
+static u32 size;
 void omap_bus_sync(void)
 {
        if (dram_sync && sram_sync) {
@@ -51,19 +56,22 @@ void omap_bus_sync(void)
                isb();
        }
 }
+EXPORT_SYMBOL(omap_bus_sync);
-static int __init omap_barriers_init(void)
+/* Steal one page physical memory for barrier implementation */
+int __init omap_barrier_reserve_memblock(void)
 {
-        struct map_desc dram_io_desc[1];
-        phys_addr_t paddr;
-        u32 size;
-        if (!cpu_is_omap44xx())
-                return -ENODEV;
        size = ALIGN(PAGE_SIZE, SZ_1M);
        paddr = arm_memblock_steal(size, SZ_1M);
+        return 0;
+}
+void __init omap_barriers_init(void)
+{
+        struct map_desc dram_io_desc[1];
        dram_io_desc[0].virtual = OMAP4_DRAM_BARRIER_VA;
        dram_io_desc[0].pfn = __phys_to_pfn(paddr);
        dram_io_desc[0].length = size;
@@ -75,9 +83,10 @@ static int __init omap_barriers_init(void)
        pr_info("OMAP4: Map 0x%08llx to 0x%08lx for dram barrier\n",
                (long long) paddr, dram_io_desc[0].virtual);
-        return 0;
 }
-core_initcall(omap_barriers_init);
+#else
+void __init omap_barriers_init(void)
+{}
 #endif
 void __init gic_init_irq(void)
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 1881fe915149..5a65dd04aa38 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -174,14 +174,17 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
        freq = clk->rate;
        clk_put(clk);
+        rcu_read_lock();
        opp = opp_find_freq_ceil(dev, &freq);
        if (IS_ERR(opp)) {
+                rcu_read_unlock();
                pr_err("%s: unable to find boot up OPP for vdd_%s\n",
                        __func__, vdd_name);
                goto exit;
        }
        bootup_volt = opp_get_voltage(opp);
+        rcu_read_unlock();
        if (!bootup_volt) {
                pr_err("%s: unable to find voltage corresponding "
                        "to the bootup OPP for vdd_%s\n", __func__, vdd_name);
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 10b20c652e5d..4b57757bf9d1 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -270,7 +270,6 @@ static struct regulator_init_data omap4_vusb_idata = {
        .constraints = {
                .min_uV                 = 3300000,
                .max_uV                 = 3300000,
-                .apply_uV               = true,
                .valid_modes_mask       = REGULATOR_MODE_NORMAL
                                        | REGULATOR_MODE_STANDBY,
                .valid_ops_mask         = REGULATOR_CHANGE_MODE
diff --git a/arch/arm/mach-omap2/usb-host.c b/arch/arm/mach-omap2/usb-host.c
index 771dc781b746..f51348dafafd 100644
--- a/arch/arm/mach-omap2/usb-host.c
+++ b/arch/arm/mach-omap2/usb-host.c
@@ -486,7 +486,7 @@ static void setup_4430ohci_io_mux(const enum usbhs_omap_port_mode *port_mode)
 void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
 {
        struct omap_hwmod       *oh[2];
-        struct omap_device      *od;
+        struct platform_device  *pdev;
        int                     bus_id = -1;
        int                     i;
@@ -522,11 +522,11 @@ void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
                return;
        }
-        od = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
+        pdev = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
                                (void *)&usbhs_data, sizeof(usbhs_data),
                                omap_uhhtll_latency,
                                ARRAY_SIZE(omap_uhhtll_latency), false);
-        if (IS_ERR(od)) {
+        if (IS_ERR(pdev)) {
                pr_err("Could not build hwmod devices %s,%s\n",
                        USBHS_UHH_HWMODNAME, USBHS_TLL_HWMODNAME);
                return;
diff --git a/arch/arm/mach-pxa/generic.h b/arch/arm/mach-pxa/generic.h
index 0d729e6619df..42d5cca66257 100644
--- a/arch/arm/mach-pxa/generic.h
+++ b/arch/arm/mach-pxa/generic.h
@@ -49,7 +49,6 @@ extern unsigned pxa3xx_get_clk_frequency_khz(int);
 #endif
 extern struct syscore_ops pxa_irq_syscore_ops;
-extern struct syscore_ops pxa_gpio_syscore_ops;
 extern struct syscore_ops pxa2xx_mfp_syscore_ops;
 extern struct syscore_ops pxa3xx_mfp_syscore_ops;
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index fb9b62dcf4ca..208eef1c0485 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -45,6 +45,7 @@
 #include <mach/hx4700.h>
 #include <mach/irda.h>
+#include <sound/ak4641.h>
 #include <video/platform_lcd.h>
 #include <video/w100fb.h>
@@ -765,6 +766,28 @@ static struct i2c_board_info __initdata pi2c_board_info[] = {
 };
 /*
+ * Asahi Kasei AK4641 on I2C
+ */
+static struct ak4641_platform_data ak4641_info = {
+        .gpio_power = GPIO27_HX4700_CODEC_ON,
+        .gpio_npdn  = GPIO109_HX4700_CODEC_nPDN,
+};
+static struct i2c_board_info i2c_board_info[] __initdata = {
+        {
+                I2C_BOARD_INFO("ak4641", 0x12),
+                .platform_data = &ak4641_info,
+        },
+};
+static struct platform_device audio = {
+        .name   = "hx4700-audio",
+        .id     = -1,
+};
+/*
 * PCMCIA
 */
@@ -790,6 +813,7 @@ static struct platform_device *devices[] __initdata = {
        &gpio_vbus,
        &power_supply,
        &strataflash,
+        &audio,
        &pcmcia,
 };
@@ -827,6 +851,7 @@ static void __init hx4700_init(void)
        pxa_set_ficp_info(&ficp_info);
        pxa27x_set_i2c_power_info(NULL);
        pxa_set_i2c_info(NULL);
+        i2c_register_board_info(0, ARRAY_AND_SIZE(i2c_board_info));
        i2c_register_board_info(1, ARRAY_AND_SIZE(pi2c_board_info));
        pxa2xx_set_spi_info(2, &pxa_ssp2_master_info);
        spi_register_board_info(ARRAY_AND_SIZE(tsc2046_board_info));
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index f14775536b83..29b62afc6f7c 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -226,6 +226,12 @@ static void __init pxa25x_mfp_init(void)
 {
        int i;
+        /* running before pxa_gpio_probe() */
+#ifdef CONFIG_CPU_PXA26x
+        pxa_last_gpio = 89;
+#else
+        pxa_last_gpio = 84;
+#endif
        for (i = 0; i <= pxa_last_gpio; i++)
                gpio_desc[i].valid = 1;
@@ -295,6 +301,7 @@ static void __init pxa27x_mfp_init(void)
 {
        int i, gpio;
+        pxa_last_gpio = 120;    /* running before pxa_gpio_probe() */
        for (i = 0; i <= pxa_last_gpio; i++) {
                /* skip GPIO2, 5, 6, 7, 8, they are not
                 * valid pins allow configuration
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 91e4f6c03766..3352b37b60cf 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -25,7 +25,6 @@
 #include <linux/suspend.h>
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
-#include <linux/gpio.h>
 #include <asm/mach/map.h>
 #include <asm/suspend.h>
@@ -209,6 +208,7 @@ static struct clk_lookup pxa25x_clkregs[] = {
        INIT_CLKREG(&clk_pxa25x_gpio11, NULL, "GPIO11_CLK"),
        INIT_CLKREG(&clk_pxa25x_gpio12, NULL, "GPIO12_CLK"),
        INIT_CLKREG(&clk_pxa25x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 static struct clk_lookup pxa25x_hwuart_clkreg =
@@ -368,7 +368,6 @@ static int __init pxa25x_init(void)
                register_syscore_ops(&pxa_irq_syscore_ops);
                register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                register_syscore_ops(&pxa2xx_clock_syscore_ops);
                ret = platform_add_devices(pxa25x_devices,
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index aed6cbcf3866..6bce78edce7a 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/i2c/pxa-i2c.h>
-#include <linux/gpio.h>
 #include <asm/mach/map.h>
 #include <mach/hardware.h>
@@ -230,6 +229,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
        INIT_CLKREG(&clk_pxa27x_im, NULL, "IMCLK"),
        INIT_CLKREG(&clk_pxa27x_memc, NULL, "MEMCLK"),
        INIT_CLKREG(&clk_pxa27x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 #ifdef CONFIG_PM
@@ -456,7 +456,6 @@ static int __init pxa27x_init(void)
                register_syscore_ops(&pxa_irq_syscore_ops);
                register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                register_syscore_ops(&pxa2xx_clock_syscore_ops);
                ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c
index 4f402afa6609..3918a672238e 100644
--- a/arch/arm/mach-pxa/pxa3xx.c
+++ b/arch/arm/mach-pxa/pxa3xx.c
@@ -462,7 +462,6 @@ static int __init pxa3xx_init(void)
                register_syscore_ops(&pxa_irq_syscore_ops);
                register_syscore_ops(&pxa3xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                register_syscore_ops(&pxa3xx_clock_syscore_ops);
                ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa95x.c b/arch/arm/mach-pxa/pxa95x.c
index d082a583df78..5ce434b95e87 100644
--- a/arch/arm/mach-pxa/pxa95x.c
+++ b/arch/arm/mach-pxa/pxa95x.c
@@ -283,7 +283,6 @@ static int __init pxa95x_init(void)
                        return ret;
                register_syscore_ops(&pxa_irq_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                register_syscore_ops(&pxa3xx_clock_syscore_ops);
                ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/saarb.c b/arch/arm/mach-pxa/saarb.c
index febc809ed5a6..5aded5e6148f 100644
--- a/arch/arm/mach-pxa/saarb.c
+++ b/arch/arm/mach-pxa/saarb.c
@@ -15,7 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <linux/mfd/88pm860x.h>
-#include <linux/gpio.h>
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
index 8d5168d253a9..30989baf7f2a 100644
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -168,6 +168,7 @@ struct battery_thresh sharpsl_battery_levels_noac[] = {
 #define MAXCTRL_SEL_SH   4
 #define MAXCTRL_STR      (1u << 7)
+extern int max1111_read_channel(int);
 /*
 * Read MAX1111 ADC
 */
@@ -177,8 +178,6 @@ int sharpsl_pm_pxa_read_max1111(int channel)
        if (machine_is_tosa())
            return 0;
-        extern int max1111_read_channel(int);
        /* max1111 accepts channels from 0-3, however,
         * it is encoded from 0-7 here in the code.
         */
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 34cbdac51525..438f02fe122a 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -172,10 +172,9 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
 static unsigned long spitz_charger_wakeup(void)
 {
        unsigned long ret;
-        ret = (!gpio_get_value(SPITZ_GPIO_KEY_INT)
+        ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
                << GPIO_bit(SPITZ_GPIO_KEY_INT))
-                | (!gpio_get_value(SPITZ_GPIO_SYNC)
+                | gpio_get_value(SPITZ_GPIO_SYNC));
-                << GPIO_bit(SPITZ_GPIO_SYNC));
        return ret;
 }
diff --git a/arch/arm/mach-s3c2440/common.h b/arch/arm/mach-s3c2440/common.h
index db8a98ac68c5..0c1eb1dfc534 100644
--- a/arch/arm/mach-s3c2440/common.h
+++ b/arch/arm/mach-s3c2440/common.h
@@ -12,6 +12,6 @@
 #ifndef __ARCH_ARM_MACH_S3C2440_COMMON_H
 #define __ARCH_ARM_MACH_S3C2440_COMMON_H
-void s3c2440_restart(char mode, const char *cmd);
+void s3c244x_restart(char mode, const char *cmd);
 #endif /* __ARCH_ARM_MACH_S3C2440_COMMON_H */
diff --git a/arch/arm/mach-s3c2440/mach-anubis.c b/arch/arm/mach-s3c2440/mach-anubis.c
index 24569550de1a..19b577bc09b8 100644
--- a/arch/arm/mach-s3c2440/mach-anubis.c
+++ b/arch/arm/mach-s3c2440/mach-anubis.c
@@ -487,5 +487,5 @@ MACHINE_START(ANUBIS, "Simtec-Anubis")
        .init_machine   = anubis_init,
        .init_irq       = s3c24xx_init_irq,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-at2440evb.c b/arch/arm/mach-s3c2440/mach-at2440evb.c
index d6a9763110cd..d7ae49c90118 100644
--- a/arch/arm/mach-s3c2440/mach-at2440evb.c
+++ b/arch/arm/mach-s3c2440/mach-at2440evb.c
@@ -222,5 +222,5 @@ MACHINE_START(AT2440EVB, "AT2440EVB")
        .init_machine   = at2440evb_init,
        .init_irq       = s3c24xx_init_irq,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
index 5859e609d28c..9a4a5bc008e6 100644
--- a/arch/arm/mach-s3c2440/mach-gta02.c
+++ b/arch/arm/mach-s3c2440/mach-gta02.c
@@ -601,5 +601,5 @@ MACHINE_START(NEO1973_GTA02, "GTA02")
        .init_irq       = s3c24xx_init_irq,
        .init_machine   = gta02_machine_init,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-mini2440.c b/arch/arm/mach-s3c2440/mach-mini2440.c
index adbbb85bc4cd..5d66fb218a41 100644
--- a/arch/arm/mach-s3c2440/mach-mini2440.c
+++ b/arch/arm/mach-s3c2440/mach-mini2440.c
@@ -701,5 +701,5 @@ MACHINE_START(MINI2440, "MINI2440")
        .init_machine   = mini2440_init,
        .init_irq       = s3c24xx_init_irq,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-nexcoder.c b/arch/arm/mach-s3c2440/mach-nexcoder.c
index 40eaf844bc1f..5198e3e1c5be 100644
--- a/arch/arm/mach-s3c2440/mach-nexcoder.c
+++ b/arch/arm/mach-s3c2440/mach-nexcoder.c
@@ -158,5 +158,5 @@ MACHINE_START(NEXCODER_2440, "NexVision - Nexcoder 2440")
        .init_machine   = nexcoder_init,
        .init_irq       = s3c24xx_init_irq,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-osiris.c b/arch/arm/mach-s3c2440/mach-osiris.c
index 4c480ef734f6..c5daeb612a88 100644
--- a/arch/arm/mach-s3c2440/mach-osiris.c
+++ b/arch/arm/mach-s3c2440/mach-osiris.c
@@ -436,5 +436,5 @@ MACHINE_START(OSIRIS, "Simtec-OSIRIS")
        .init_irq       = s3c24xx_init_irq,
        .init_machine   = osiris_init,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx1950.c b/arch/arm/mach-s3c2440/mach-rx1950.c
index 80077f6472ee..6f68abf44fab 100644
--- a/arch/arm/mach-s3c2440/mach-rx1950.c
+++ b/arch/arm/mach-s3c2440/mach-rx1950.c
@@ -822,5 +822,5 @@ MACHINE_START(RX1950, "HP iPAQ RX1950")
        .init_irq = s3c24xx_init_irq,
        .init_machine = rx1950_init_machine,
        .timer = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx3715.c b/arch/arm/mach-s3c2440/mach-rx3715.c
index 20103bafbd4b..56af35447598 100644
--- a/arch/arm/mach-s3c2440/mach-rx3715.c
+++ b/arch/arm/mach-s3c2440/mach-rx3715.c
@@ -213,5 +213,5 @@ MACHINE_START(RX3715, "IPAQ-RX3715")
        .init_irq       = rx3715_init_irq,
        .init_machine   = rx3715_init_machine,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-smdk2440.c b/arch/arm/mach-s3c2440/mach-smdk2440.c
index 1deb60d12a60..83a1036d7dcb 100644
--- a/arch/arm/mach-s3c2440/mach-smdk2440.c
+++ b/arch/arm/mach-s3c2440/mach-smdk2440.c
@@ -183,5 +183,5 @@ MACHINE_START(S3C2440, "SMDK2440")
        .map_io         = smdk2440_map_io,
        .init_machine   = smdk2440_machine_init,
        .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/s3c2440.c b/arch/arm/mach-s3c2440/s3c2440.c
index 517623a09fc5..2b3dddb49af7 100644
--- a/arch/arm/mach-s3c2440/s3c2440.c
+++ b/arch/arm/mach-s3c2440/s3c2440.c
@@ -35,7 +35,6 @@
 #include <plat/cpu.h>
 #include <plat/s3c244x.h>
 #include <plat/pm.h>
-#include <plat/watchdog-reset.h>
 #include <plat/gpio-core.h>
 #include <plat/gpio-cfg.h>
@@ -74,15 +73,3 @@ void __init s3c2440_map_io(void)
        s3c24xx_gpiocfg_default.set_pull = s3c24xx_gpio_setpull_1up;
        s3c24xx_gpiocfg_default.get_pull = s3c24xx_gpio_getpull_1up;
 }
-void s3c2440_restart(char mode, const char *cmd)
-{
-        if (mode == 's') {
-                soft_restart(0);
-        }
-        arch_wdt_reset();
-        /* we'll take a jump through zero as a poor second */
-        soft_restart(0);
-}
diff --git a/arch/arm/mach-s3c2440/s3c244x.c b/arch/arm/mach-s3c2440/s3c244x.c
index 36bc60f61d0a..d15852f642b7 100644
--- a/arch/arm/mach-s3c2440/s3c244x.c
+++ b/arch/arm/mach-s3c2440/s3c244x.c
@@ -46,6 +46,7 @@
 #include <plat/pm.h>
 #include <plat/pll.h>
 #include <plat/nand-core.h>
+#include <plat/watchdog-reset.h>
 static struct map_desc s3c244x_iodesc[] __initdata = {
        IODESC_ENT(CLKPWR),
@@ -196,3 +197,14 @@ struct syscore_ops s3c244x_pm_syscore_ops = {
        .suspend        = s3c244x_suspend,
        .resume         = s3c244x_resume,
 };
+void s3c244x_restart(char mode, const char *cmd)
+{
+        if (mode == 's')
+                soft_restart(0);
+        arch_wdt_reset();
+        /* we'll take a jump through zero as a poor second */
+        soft_restart(0);
+}
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 52af00446a63..c59e8b892d6b 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -5,7 +5,7 @@ config UX500_SOC_COMMON
        default y
        select ARM_GIC
        select HAS_MTU
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
        select ARM_ERRATA_754322
        select ARM_ERRATA_764369
diff --git a/arch/arm/mach-vexpress/Kconfig b/arch/arm/mach-vexpress/Kconfig
index 9b3d0fbaee72..88c3ba151e87 100644
--- a/arch/arm/mach-vexpress/Kconfig
+++ b/arch/arm/mach-vexpress/Kconfig
@@ -7,7 +7,7 @@ config ARCH_VEXPRESS_CA9X4
        select ARM_GIC
        select ARM_ERRATA_720789
        select ARM_ERRATA_751472
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
        select HAVE_SMP
        select MIGHT_HAVE_CACHE_L2X0
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0404ccbb8aa3..f1c8486f7501 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -230,9 +230,7 @@ __v7_setup:
        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
 #endif
 #ifdef CONFIG_ARM_ERRATA_743622
-        teq     r6, #0x20                       @ present in r2p0
+        teq     r5, #0x00200000                 @ only present in r2p*
-        teqne   r6, #0x21                       @ present in r2p1
-        teqne   r6, #0x22                       @ present in r2p2
        mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
        orreq   r10, r10, #1 << 6               @ set bit #6
        mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index 06383b51e655..4de7d1e79e73 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -69,6 +69,7 @@ void __init omap_reserve(void)
        omap_vram_reserve_sdram_memblock();
        omap_dsp_reserve_sdram_memblock();
        omap_secure_ram_reserve_memblock();
+        omap_barrier_reserve_memblock();
 }
 void __init omap_init_consistent_dma_size(void)
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 2efd6454bce0..37bbbbb981b2 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -428,8 +428,16 @@
 #define OMAP_GPMC_NR_IRQS       8
 #define OMAP_GPMC_IRQ_END       (OMAP_GPMC_IRQ_BASE + OMAP_GPMC_NR_IRQS)
+/* PRCM IRQ handler */
+#ifdef CONFIG_ARCH_OMAP2PLUS
+#define OMAP_PRCM_IRQ_BASE      (OMAP_GPMC_IRQ_END)
+#define OMAP_PRCM_NR_IRQS       64
+#define OMAP_PRCM_IRQ_END       (OMAP_PRCM_IRQ_BASE + OMAP_PRCM_NR_IRQS)
+#else
+#define OMAP_PRCM_IRQ_END       OMAP_GPMC_IRQ_END
+#endif
-#define NR_IRQS                 OMAP_GPMC_IRQ_END
+#define NR_IRQS                 OMAP_PRCM_IRQ_END
 #define OMAP_IRQ_BIT(irq)       (1 << ((irq) % 32))
diff --git a/arch/arm/plat-omap/include/plat/omap-secure.h b/arch/arm/plat-omap/include/plat/omap-secure.h
index 3047ff923a63..8c7994ce9869 100644
--- a/arch/arm/plat-omap/include/plat/omap-secure.h
+++ b/arch/arm/plat-omap/include/plat/omap-secure.h
@@ -10,4 +10,10 @@ static inline void omap_secure_ram_reserve_memblock(void)
 { }
 #endif
+#ifdef CONFIG_OMAP4_ERRATA_I688
+extern int omap_barrier_reserve_memblock(void);
+#else
+static inline void omap_barrier_reserve_memblock(void)
+{ }
+#endif
 #endif /* __OMAP_SECURE_H__ */
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index 9fe35348e03b..2bab4c99a234 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -1249,7 +1249,7 @@ static void s3c2410_dma_resume(void)
        struct s3c2410_dma_chan *cp = s3c2410_chans + dma_channels - 1;
        int channel;
-        for (channel = dma_channels - 1; channel >= 0; cp++, channel--)
+        for (channel = dma_channels - 1; channel >= 0; cp--, channel--)
                s3c2410_dma_resume_chan(cp);
 }
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index f10768e988d4..d21d744e4d99 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -1409,7 +1409,7 @@ void __init s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd)
 #ifdef CONFIG_S3C_DEV_USB_HSOTG
 static struct resource s3c_usb_hsotg_resources[] = {
-        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_16K),
+        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_128K),
        [1] = DEFINE_RES_IRQ(IRQ_OTG),
 };
diff --git a/arch/arm/plat-spear/time.c b/arch/arm/plat-spear/time.c
index 0c77e4298675..abb5bdecd509 100644
--- a/arch/arm/plat-spear/time.c
+++ b/arch/arm/plat-spear/time.c
@@ -145,11 +145,13 @@ static void clockevent_set_mode(enum clock_event_mode mode,
 static int clockevent_next_event(unsigned long cycles,
                                 struct clock_event_device *clk_event_dev)
 {
-        u16 val;
+        u16 val = readw(gpt_base + CR(CLKEVT));
+        if (val & CTRL_ENABLE)
+                writew(val & ~CTRL_ENABLE, gpt_base + CR(CLKEVT));
        writew(cycles, gpt_base + LOAD(CLKEVT));
-        val = readw(gpt_base + CR(CLKEVT));
        val |= CTRL_ENABLE | CTRL_INT_ENABLE;
        writew(val, gpt_base + CR(CLKEVT));
diff --git a/arch/c6x/include/asm/processor.h b/arch/c6x/include/asm/processor.h
index 8154c4ee8c9c..77ecbded1f37 100644
--- a/arch/c6x/include/asm/processor.h
+++ b/arch/c6x/include/asm/processor.h
@@ -122,8 +122,8 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 extern unsigned long get_wchan(struct task_struct *p);
-#define KSTK_EIP(tsk)   (task_pt_regs(task)->pc)
+#define KSTK_EIP(task)  (task_pt_regs(task)->pc)
-#define KSTK_ESP(tsk)   (task_pt_regs(task)->sp)
+#define KSTK_ESP(task)  (task_pt_regs(task)->sp)
 #define cpu_relax()             do { } while (0)
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 7da4d0081487..a7193ae13a5d 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -146,7 +146,7 @@ static int __init alchemy_time_init(unsigned int m2int)
        cd->shift = 32;
        cd->mult = div_sc(32768, NSEC_PER_SEC, cd->shift);
        cd->max_delta_ns = clockevent_delta2ns(0xffffffff, cd);
-        cd->min_delta_ns = clockevent_delta2ns(8, cd);  /* ~0.25ms */
+        cd->min_delta_ns = clockevent_delta2ns(9, cd);  /* ~0.28ms */
        clockevents_register_device(cd);
        setup_irq(m2int, &au1x_rtcmatch2_irqaction);
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index 24f546985b69..e21507052066 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -96,7 +96,7 @@ void __init ath79_register_wmac(u8 *cal_data)
 {
        if (soc_is_ar913x())
                ar913x_wmac_setup();
-        if (soc_is_ar933x())
+        else if (soc_is_ar933x())
                ar933x_wmac_setup();
        else
                BUG();
diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
index 4479fd669ac1..28c6b276c216 100644
--- a/arch/mips/configs/nlm_xlp_defconfig
+++ b/arch/mips/configs/nlm_xlp_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_SECCOMP is not set
 CONFIG_USE_OF=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_CGROUPS=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlp"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_LZMA=y
diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
index 7c68666fdd64..d0b857d98c91 100644
--- a/arch/mips/configs/nlm_xlr_defconfig
+++ b/arch/mips/configs/nlm_xlr_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_KEXEC=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_NAMESPACES=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlr"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
diff --git a/arch/mips/configs/powertv_defconfig b/arch/mips/configs/powertv_defconfig
index 3b0b6e8c8533..7fda0ce5f692 100644
--- a/arch/mips/configs/powertv_defconfig
+++ b/arch/mips/configs/powertv_defconfig
@@ -6,7 +6,7 @@ CONFIG_HZ_1000=y
 CONFIG_PREEMPT=y
 # CONFIG_SECCOMP is not set
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
diff --git a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
index 556e1be20bf6..fb9975c74c57 100644
--- a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
+++ b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
@@ -11,6 +11,9 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
+struct gpio;
+struct gpio_chip;
 /* with the current GPIC design, up to 128 GPIOs are possible.
 * The only implementation so far is in the Au1300, which has 75 externally
 * available GPIOs.
@@ -203,7 +206,22 @@ static inline int gpio_request(unsigned int gpio, const char *label)
        return 0;
 }
-static inline void gpio_free(unsigned int gpio)
+static inline int gpio_request_one(unsigned gpio,
+                                        unsigned long flags, const char *label)
+{
+        return 0;
+}
+static inline int gpio_request_array(struct gpio *array, size_t num)
+{
+        return 0;
+}
+static inline void gpio_free(unsigned gpio)
+{
+}
+static inline void gpio_free_array(struct gpio *array, size_t num)
 {
 }
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index d41790928c64..da9bd7d270d1 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -39,9 +39,6 @@
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #else /* !CONFIG_HUGETLB_PAGE */
-# ifndef BUILD_BUG
-#  define BUILD_BUG() do { extern void __build_bug(void); __build_bug(); } while (0)
-# endif
 #define HPAGE_SHIFT     ({BUILD_BUG(); 0; })
 #define HPAGE_SIZE      ({BUILD_BUG(); 0; })
 #define HPAGE_MASK      ({BUILD_BUG(); 0; })
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 58fe71afd879..d5e950ab8527 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -8,7 +8,6 @@
 * SMP support for BMIPS
 */
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cc4a3f120f54..d79ae5437b58 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1135,7 +1135,7 @@ asmlinkage void do_mt(struct pt_regs *regs)
                printk(KERN_DEBUG "YIELD Scheduler Exception\n");
                break;
        case 5:
-                printk(KERN_DEBUG "Gating Storage Schedulier Exception\n");
+                printk(KERN_DEBUG "Gating Storage Scheduler Exception\n");
                break;
        default:
                printk(KERN_DEBUG "*** UNKNOWN THREAD EXCEPTION %d ***\n",
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index a81176f44c74..924da5eb7031 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -69,7 +69,6 @@ SECTIONS
        RODATA
        /* writeable */
-        _sdata = .;                             /* Start of data section */
        .data : {       /* Data */
                . = . + DATAOFFSET;             /* for CONFIG_MAPPED_KERNEL */
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 937cf3368164..69ebd586d7ff 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -42,6 +42,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
        const int field = sizeof(unsigned long) * 2;
        siginfo_t info;
        int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                                                 (write ? FAULT_FLAG_WRITE : 0);
 #if 0
        printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
@@ -91,6 +93,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
        if (in_atomic() || !mm)
                goto bad_area_nosemaphore;
+retry:
        down_read(&mm->mmap_sem);
        vma = find_vma(mm, address);
        if (!vma)
@@ -144,7 +147,11 @@ good_area:
         * make sure we exit gracefully rather than endlessly redo
         * the fault.
         */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
        if (unlikely(fault & VM_FAULT_ERROR)) {
                if (fault & VM_FAULT_OOM)
@@ -153,12 +160,27 @@ good_area:
                        goto do_sigbus;
                BUG();
        }
-        if (fault & VM_FAULT_MAJOR) {
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
+                if (fault & VM_FAULT_MAJOR) {
-                tsk->maj_flt++;
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
-        } else {
+                                                  regs, address);
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
+                        tsk->maj_flt++;
-                tsk->min_flt++;
+                } else {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                                  regs, address);
+                        tsk->min_flt++;
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+                        /*
+                         * No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+                        goto retry;
+                }
        }
        up_read(&mm->mmap_sem);
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index aec2b111d35b..15521505ebe8 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -279,7 +279,6 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
        /* Propagate hose info into the subordinate devices.  */
-        struct list_head *ln;
        struct pci_dev *dev = bus->self;
        if (pci_probe_only && dev &&
@@ -288,9 +287,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
                pcibios_fixup_device_resources(dev, bus);
        }
-        for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
+        list_for_each_entry(dev, &bus->devices, bus_list) {
-                dev = pci_dev_b(ln);
                if ((dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
                        pcibios_fixup_device_resources(dev, bus);
        }
diff --git a/arch/mips/pmc-sierra/yosemite/ht-irq.c b/arch/mips/pmc-sierra/yosemite/ht-irq.c
index 86b98e98fb4f..62ead6601c69 100644
--- a/arch/mips/pmc-sierra/yosemite/ht-irq.c
+++ b/arch/mips/pmc-sierra/yosemite/ht-irq.c
@@ -35,16 +35,6 @@
 */
 void __init titan_ht_pcibios_fixup_bus(struct pci_bus *bus)
 {
-        struct pci_bus *current_bus = bus;
-        struct pci_dev *devices;
-        struct list_head *devices_link;
-        list_for_each(devices_link, &(current_bus->devices)) {
-                devices = pci_dev_b(devices_link);
-                if (devices == NULL)
-                        continue;
-        }
        /*
         * PLX and SPKT related changes go here
         */
diff --git a/arch/mips/txx9/generic/7segled.c b/arch/mips/txx9/generic/7segled.c
index 8e93b2122524..4642f56e70e5 100644
--- a/arch/mips/txx9/generic/7segled.c
+++ b/arch/mips/txx9/generic/7segled.c
@@ -102,7 +102,7 @@ static int __init tx_7segled_init_sysfs(void)
                        break;
                }
                dev->id = i;
-                dev->dev = &tx_7segled_subsys;
+                dev->bus = &tx_7segled_subsys;
                error = device_register(dev);
                if (!error) {
                        device_create_file(dev, &dev_attr_ascii);
diff --git a/arch/openrisc/include/asm/ptrace.h b/arch/openrisc/include/asm/ptrace.h
index 054537c5f9c9..e612ce4512c7 100644
--- a/arch/openrisc/include/asm/ptrace.h
+++ b/arch/openrisc/include/asm/ptrace.h
@@ -77,7 +77,6 @@ struct pt_regs {
        long  syscallno;        /* Syscall number (used by strace) */
        long dummy;             /* Cheap alignment fix */
 };
-#endif /* __ASSEMBLY__ */
 /* TODO: Rename this to REDZONE because that's what it is */
 #define STACK_FRAME_OVERHEAD  128  /* size of minimum stack frame */
@@ -87,6 +86,13 @@ struct pt_regs {
 #define user_stack_pointer(regs)        ((unsigned long)(regs)->sp)
 #define profile_pc(regs)                instruction_pointer(regs)
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->gpr[11];
+}
+#endif /* __ASSEMBLY__ */
 /*
 * Offsets used by 'ptrace' system call interface.
 */
diff --git a/arch/openrisc/kernel/init_task.c b/arch/openrisc/kernel/init_task.c
index 45744a384927..ca534082d5f3 100644
--- a/arch/openrisc/kernel/init_task.c
+++ b/arch/openrisc/kernel/init_task.c
@@ -17,6 +17,7 @@
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/export.h>
 static struct signal_struct init_signals = INIT_SIGNALS(init_signals);
 static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
index 59b302338331..4bfead220956 100644
--- a/arch/openrisc/kernel/irq.c
+++ b/arch/openrisc/kernel/irq.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/kernel_stat.h>
+#include <linux/export.h>
 #include <linux/irqflags.h>
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 656b94beab89..7259047d5f9d 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -188,11 +188,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                 */
                ret = -1L;
-        /* Are these regs right??? */
+        audit_syscall_entry(audit_arch(), regs->syscallno,
-        if (unlikely(current->audit_context))
+                            regs->gpr[3], regs->gpr[4],
-                audit_syscall_entry(audit_arch(), regs->syscallno,
+                            regs->gpr[5], regs->gpr[6]);
-                                    regs->gpr[3], regs->gpr[4],
-                                    regs->gpr[5], regs->gpr[6]);
        return ret ? : regs->syscallno;
 }
@@ -201,9 +199,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
        int step;
-        if (unlikely(current->audit_context))
+        audit_syscall_exit(regs);
-                audit_syscall_exit(AUDITSC_RESULT(regs->gpr[11]),
-                                   regs->gpr[11]);
        step = test_thread_flag(TIF_SINGLESTEP);
        if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 55cca1dac431..19ab7b2ea1cd 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -31,7 +31,11 @@ ifdef CONFIG_64BIT
 UTS_MACHINE     := parisc64
 CHECKFLAGS      += -D__LP64__=1 -m64
 WIDTH           := 64
+# FIXME: if no default set, should really try to locate dynamically
+ifeq ($(CROSS_COMPILE),)
 CROSS_COMPILE   := hppa64-linux-gnu-
+endif
 else # 32-bit
 WIDTH           :=
 endif
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index d1727584230a..6d99a5fcc090 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -227,6 +227,9 @@ config COMPAT
 config SYSVIPC_COMPAT
        def_bool y if COMPAT && SYSVIPC
+config KEYS_COMPAT
+        def_bool y if COMPAT && KEYS
 config AUDIT_ARCH
        def_bool y
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 39f8fd4438fc..c383ce440d99 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
-#include <linux/crash_dump.h>
 #include <linux/bootmem.h>
 #include <linux/elf.h>
 #include <asm/ipl.h>
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 5d633019d8f3..50236610de83 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -223,16 +223,38 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 #ifdef CONFIG_MEMORY_HOTPLUG
 int arch_add_memory(int nid, u64 start, u64 size)
 {
-        struct pglist_data *pgdat;
+        unsigned long zone_start_pfn, zone_end_pfn, nr_pages;
+        unsigned long start_pfn = PFN_DOWN(start);
+        unsigned long size_pages = PFN_DOWN(size);
        struct zone *zone;
        int rc;
-        pgdat = NODE_DATA(nid);
-        zone = pgdat->node_zones + ZONE_MOVABLE;
        rc = vmem_add_mapping(start, size);
        if (rc)
                return rc;
-        rc = __add_pages(nid, zone, PFN_DOWN(start), PFN_DOWN(size));
+        for_each_zone(zone) {
+                if (zone_idx(zone) != ZONE_MOVABLE) {
+                        /* Add range within existing zone limits */
+                        zone_start_pfn = zone->zone_start_pfn;
+                        zone_end_pfn = zone->zone_start_pfn +
+                                       zone->spanned_pages;
+                } else {
+                        /* Add remaining range to ZONE_MOVABLE */
+                        zone_start_pfn = start_pfn;
+                        zone_end_pfn = start_pfn + size_pages;
+                }
+                if (start_pfn < zone_start_pfn || start_pfn >= zone_end_pfn)
+                        continue;
+                nr_pages = (start_pfn + size_pages > zone_end_pfn) ?
+                           zone_end_pfn - start_pfn : size_pages;
+                rc = __add_pages(nid, zone, start_pfn, nr_pages);
+                if (rc)
+                        break;
+                start_pfn += nr_pages;
+                size_pages -= nr_pages;
+                if (!size_pages)
+                        break;
+        }
        if (rc)
                vmem_remove_mapping(start, size);
        return rc;
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index fd843877e841..39e49091f648 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -315,6 +315,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
        current->mm->free_area_cache = TASK_UNMAPPED_BASE;
        current->mm->cached_hole_size = 0;
+        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
        install_exec_creds(bprm);
        current->flags &= ~PF_FORKNOEXEC;
@@ -410,13 +417,6 @@ beyond_if:
        set_brk(current->mm->start_brk, current->mm->brk);
-        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) {
-                /* Someone check-me: is this error path enough? */
-                send_sig(SIGKILL, current, 0);
-                return retval;
-        }
        current->mm->start_stack =
                (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
        /* start thread */
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 096c975e099f..461ce432b1c2 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -242,4 +242,12 @@ static inline void perf_get_x86_pmu_capability(struct x86_pmu_capability *cap)
 static inline void perf_events_lapic_init(void) { }
 #endif
+#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_AMD)
+ extern void amd_pmu_enable_virt(void);
+ extern void amd_pmu_disable_virt(void);
+#else
+ static inline void amd_pmu_enable_virt(void) { }
+ static inline void amd_pmu_disable_virt(void) { }
+#endif
 #endif /* _ASM_X86_PERF_EVENT_H */
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 8944062f46e2..c30c807ddc72 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -147,7 +147,9 @@ struct cpu_hw_events {
        /*
         * AMD specific bits
         */
-        struct amd_nb           *amd_nb;
+        struct amd_nb                   *amd_nb;
+        /* Inverted mask of bits to clear in the perf_ctr ctrl registers */
+        u64                             perf_ctr_virt_mask;
        void                            *kfree_on_online;
 };
@@ -417,9 +419,11 @@ void x86_pmu_disable_all(void);
 static inline void __x86_pmu_enable_event(struct hw_perf_event *hwc,
                                          u64 enable_mask)
 {
+        u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask);
        if (hwc->extra_reg.reg)
                wrmsrl(hwc->extra_reg.reg, hwc->extra_reg.config);
-        wrmsrl(hwc->config_base, hwc->config | enable_mask);
+        wrmsrl(hwc->config_base, (hwc->config | enable_mask) & ~disable_mask);
 }
 void x86_pmu_enable_all(int added);
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 0397b23be8e9..67250a52430b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -1,4 +1,5 @@
 #include <linux/perf_event.h>
+#include <linux/export.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -357,7 +358,9 @@ static void amd_pmu_cpu_starting(int cpu)
        struct amd_nb *nb;
        int i, nb_id;
-        if (boot_cpu_data.x86_max_cores < 2)
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+        if (boot_cpu_data.x86_max_cores < 2 || boot_cpu_data.x86 == 0x15)
                return;
        nb_id = amd_get_nb_id(cpu);
@@ -587,9 +590,9 @@ static __initconst const struct x86_pmu amd_pmu_f15h = {
        .put_event_constraints  = amd_put_event_constraints,
        .cpu_prepare            = amd_pmu_cpu_prepare,
-        .cpu_starting           = amd_pmu_cpu_starting,
        .cpu_dead               = amd_pmu_cpu_dead,
 #endif
+        .cpu_starting           = amd_pmu_cpu_starting,
 };
 __init int amd_pmu_init(void)
@@ -621,3 +624,33 @@ __init int amd_pmu_init(void)
        return 0;
 }
+void amd_pmu_enable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        cpuc->perf_ctr_virt_mask = 0;
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
+void amd_pmu_disable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+        /*
+         * We only mask out the Host-only bit so that host-only counting works
+         * when SVM is disabled. If someone sets up a guest-only counter when
+         * SVM is disabled the Guest-only bits still gets set and the counter
+         * will not count anything.
+         */
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 5fa553babe56..e385214711cb 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -29,6 +29,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
+#include <asm/perf_event.h>
 #include <asm/tlbflush.h>
 #include <asm/desc.h>
 #include <asm/kvm_para.h>
@@ -575,6 +576,8 @@ static void svm_hardware_disable(void *garbage)
                wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
        cpu_svm_disable();
+        amd_pmu_disable_virt();
 }
 static int svm_hardware_enable(void *garbage)
@@ -622,6 +625,8 @@ static int svm_hardware_enable(void *garbage)
        svm_init_erratum_383();
+        amd_pmu_enable_virt();
        return 0;
 }
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index fc45ba887d05..e395693abdb1 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
 }
 /* TSC based delay: */
-static void delay_tsc(unsigned long loops)
+static void delay_tsc(unsigned long __loops)
 {
-        unsigned long bclock, now;
+        u32 bclock, now, loops = __loops;
        int cpu;
        preempt_disable();
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index f581a18c0d4d..8ecbb4bba4b3 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -333,13 +333,15 @@ try_again:
                 * Lookup failure means no vma is above this address,
                 * i.e. return with success:
                 */
-                if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
+                vma = find_vma(mm, addr);
+                if (!vma)
                        return addr;
                /*
                 * new region fits between prev_vma->vm_end and
                 * vma->vm_start, use it:
                 */
+                prev_vma = vma->vm_prev;
                if (addr + len <= vma->vm_start &&
                            (!prev_vma || (addr >= prev_vma->vm_end))) {
                        /* remember the address as a hint for next time */
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index a312e76063a7..49a5cb55429b 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -60,6 +60,16 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                        DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
                },
        },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=42619 */
+        {
+                .callback = set_use_crs,
+                .ident = "MSI MS-7253",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-7253"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                },
+        },
        /* Now for the blacklist.. */
@@ -282,9 +292,6 @@ static void add_resources(struct pci_root_info *info)
        int i;
        struct resource *res, *root, *conflict;
-        if (!pci_use_crs)
-                return;
        coalesce_windows(info, IORESOURCE_MEM);
        coalesce_windows(info, IORESOURCE_IO);
@@ -336,8 +343,13 @@ get_current_resources(struct acpi_device *device, int busnum,
        acpi_walk_resources(device->handle, METHOD_NAME__CRS, setup_resource,
                                &info);
-        add_resources(&info);
+        if (pci_use_crs) {
-        return;
+                add_resources(&info);
+                return;
+        }
+        kfree(info.name);
 name_alloc_fail:
        kfree(info.res);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9baf11e86362..744f078f4dd8 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3832,7 +3832,7 @@ static int __floppy_read_block_0(struct block_device *bdev)
        bio.bi_size = size;
        bio.bi_bdev = bdev;
        bio.bi_sector = 0;
-        bio.bi_flags = BIO_QUIET;
+        bio.bi_flags = (1 << BIO_QUIET);
        init_completion(&complete);
        bio.bi_private = &complete;
        bio.bi_end_io = floppy_rb0_complete;
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 597235a2f8f9..0d40cf66b3cc 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -714,6 +714,7 @@ static int mv_hash_final(struct ahash_request *req)
 {
        struct mv_req_hash_ctx *ctx = ahash_request_ctx(req);
+        ahash_request_set_crypt(req, NULL, req->result, 0);
        mv_update_hash_req_ctx(ctx, 1, 0);
        return mv_handle_req(&req->base);
 }
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index d620b0784257..618bd4d87d28 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
+#include <drm/exynos_drm.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
@@ -44,8 +45,9 @@ struct exynos_drm_connector {
 /* convert exynos_video_timings to drm_display_mode */
 static inline void
 convert_to_display_mode(struct drm_display_mode *mode,
-                        struct fb_videomode *timing)
+                        struct exynos_drm_panel_info *panel)
 {
+        struct fb_videomode *timing = &panel->timing;
        DRM_DEBUG_KMS("%s\n", __FILE__);
        mode->clock = timing->pixclock / 1000;
@@ -60,6 +62,8 @@ convert_to_display_mode(struct drm_display_mode *mode,
        mode->vsync_start = mode->vdisplay + timing->upper_margin;
        mode->vsync_end = mode->vsync_start + timing->vsync_len;
        mode->vtotal = mode->vsync_end + timing->lower_margin;
+        mode->width_mm = panel->width_mm;
+        mode->height_mm = panel->height_mm;
        if (timing->vmode & FB_VMODE_INTERLACED)
                mode->flags |= DRM_MODE_FLAG_INTERLACE;
@@ -148,16 +152,18 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                connector->display_info.raw_edid = edid;
        } else {
                struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                struct fb_videomode *timing;
+                struct exynos_drm_panel_info *panel;
-                if (display_ops->get_timing)
+                if (display_ops->get_panel)
-                        timing = display_ops->get_timing(manager->dev);
+                        panel = display_ops->get_panel(manager->dev);
                else {
                        drm_mode_destroy(connector->dev, mode);
                        return 0;
                }
-                convert_to_display_mode(mode, timing);
+                convert_to_display_mode(mode, panel);
+                connector->display_info.width_mm = mode->width_mm;
+                connector->display_info.height_mm = mode->height_mm;
                mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
                drm_mode_set_name(mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index e685e1e33055..13540de90bfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -136,7 +136,7 @@ struct exynos_drm_overlay {
 * @type: one of EXYNOS_DISPLAY_TYPE_LCD and HDMI.
 * @is_connected: check for that display is connected or not.
 * @get_edid: get edid modes from display driver.
- * @get_timing: get timing object from display driver.
+ * @get_panel: get panel object from display driver.
 * @check_timing: check if timing is valid or not.
 * @power_on: display device on or off.
 */
@@ -145,7 +145,7 @@ struct exynos_drm_display_ops {
        bool (*is_connected)(struct device *dev);
        int (*get_edid)(struct device *dev, struct drm_connector *connector,
                                u8 *edid, int len);
-        void *(*get_timing)(struct device *dev);
+        void *(*get_panel)(struct device *dev);
        int (*check_timing)(struct device *dev, void *timing);
        int (*power_on)(struct device *dev, int mode);
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index 0dbb32bb18a3..360adf2bba04 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -89,7 +89,7 @@ struct fimd_context {
        bool                            suspended;
        struct mutex                    lock;
-        struct fb_videomode             *timing;
+        struct exynos_drm_panel_info *panel;
 };
 static bool fimd_display_is_connected(struct device *dev)
@@ -101,13 +101,13 @@ static bool fimd_display_is_connected(struct device *dev)
        return true;
 }
-static void *fimd_get_timing(struct device *dev)
+static void *fimd_get_panel(struct device *dev)
 {
        struct fimd_context *ctx = get_fimd_context(dev);
        DRM_DEBUG_KMS("%s\n", __FILE__);
-        return ctx->timing;
+        return ctx->panel;
 }
 static int fimd_check_timing(struct device *dev, void *timing)
@@ -131,7 +131,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
 static struct exynos_drm_display_ops fimd_display_ops = {
        .type = EXYNOS_DISPLAY_TYPE_LCD,
        .is_connected = fimd_display_is_connected,
-        .get_timing = fimd_get_timing,
+        .get_panel = fimd_get_panel,
        .check_timing = fimd_check_timing,
        .power_on = fimd_display_power_on,
 };
@@ -193,7 +193,8 @@ static void fimd_apply(struct device *subdrv_dev)
 static void fimd_commit(struct device *dev)
 {
        struct fimd_context *ctx = get_fimd_context(dev);
-        struct fb_videomode *timing = ctx->timing;
+        struct exynos_drm_panel_info *panel = ctx->panel;
+        struct fb_videomode *timing = &panel->timing;
        u32 val;
        if (ctx->suspended)
@@ -786,7 +787,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
        struct fimd_context *ctx;
        struct exynos_drm_subdrv *subdrv;
        struct exynos_drm_fimd_pdata *pdata;
-        struct fb_videomode *timing;
+        struct exynos_drm_panel_info *panel;
        struct resource *res;
        int win;
        int ret = -EINVAL;
@@ -799,9 +800,9 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                return -EINVAL;
        }
-        timing = &pdata->timing;
+        panel = &pdata->panel;
-        if (!timing) {
+        if (!panel) {
-                dev_err(dev, "timing is null.\n");
+                dev_err(dev, "panel is null.\n");
                return -EINVAL;
        }
@@ -863,16 +864,16 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                goto err_req_irq;
        }
-        ctx->clkdiv = fimd_calc_clkdiv(ctx, timing);
+        ctx->clkdiv = fimd_calc_clkdiv(ctx, &panel->timing);
        ctx->vidcon0 = pdata->vidcon0;
        ctx->vidcon1 = pdata->vidcon1;
        ctx->default_win = pdata->default_win;
-        ctx->timing = timing;
+        ctx->panel = panel;
-        timing->pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
+        panel->timing.pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
        DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
-                        timing->pixclock, ctx->clkdiv);
+                        panel->timing.pixclock, ctx->clkdiv);
        subdrv = &ctx->subdrv;
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 4a5b099c3bc5..53404af2e748 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,6 +321,8 @@ static int cdv_chip_setup(struct drm_device *dev)
        cdv_get_core_freq(dev);
        gma_intel_opregion_init(dev);
        psb_intel_init_bios(dev);
+        REG_WRITE(PORT_HOTPLUG_EN, 0);
+        REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
        return 0;
 }
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 830dfdd6bf15..be616735ec91 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,7 +247,6 @@ static struct fb_ops psbfb_roll_ops = {
        .fb_imageblit = cfb_imageblit,
        .fb_pan_display = psbfb_pan,
        .fb_mmap = psbfb_mmap,
-        .fb_sync = psbfb_sync,
        .fb_ioctl = psbfb_ioctl,
 };
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 5d5330f667f1..aff194fbe9f3 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -446,10 +446,9 @@ int psb_gtt_init(struct drm_device *dev, int resume)
        pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
        gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
                                                                >> PAGE_SHIFT;
-        /* Some CDV firmware doesn't report this currently. In which case the
+        /* CDV doesn't report this. In which case the system has 64 gtt pages */
-           system has 64 gtt pages */
        if (pg->gtt_start == 0 || gtt_pages == 0) {
-                dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
                gtt_pages = 64;
                pg->gtt_start = dev_priv->pge_ctl;
        }
@@ -461,10 +460,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
        if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
                static struct resource fudge;   /* Preferably peppermint */
-                /* This can occur on CDV SDV systems. Fudge it in this case.
+                /* This can occur on CDV systems. Fudge it in this case.
                   We really don't care what imaginary space is being allocated
                   at this point */
-                dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
                pg->gatt_start = 0x40000000;
                pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
                /* This is a little confusing but in fact the GTT is providing
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index f425b23e3803..f851db7be2cc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4680,8 +4680,17 @@ sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
        crtc = intel_get_crtc_for_plane(dev, plane);
        clock = crtc->mode.clock;
+        if (!clock) {
+                *sprite_wm = 0;
+                return false;
+        }
        line_time_us = (sprite_width * 1000) / clock;
+        if (!line_time_us) {
+                *sprite_wm = 0;
+                return false;
+        }
        line_count = (latency_ns / line_time_us + 1000) / 1000;
        line_size = sprite_width * pixel_size;
@@ -6175,7 +6184,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
        int i;
        /* The clocks have to be on to load the palette. */
-        if (!crtc->enabled)
+        if (!crtc->enabled || !intel_crtc->active)
                return;
        /* use legacy palette for Ironlake */
@@ -6561,7 +6570,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
        mode_cmd.height = mode->vdisplay;
        mode_cmd.pitches[0] = intel_framebuffer_pitch_for_width(mode_cmd.width,
                                                                bpp);
-        mode_cmd.pixel_format = 0;
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
        return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
@@ -8185,7 +8194,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
        if (intel_enable_rc6(dev_priv->dev))
                rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
-                        (IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0;
+                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
        I915_WRITE(GEN6_RC_CONTROL,
                   rc6_mask |
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 1ab842c6032e..536191540b03 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -301,7 +301,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
        I915_WRITE_CTL(ring,
                        ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
-                        | RING_REPORT_64K | RING_VALID);
+                        | RING_VALID);
        /* If the head is still not zero, the ring is dead */
        if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
@@ -1132,18 +1132,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
        struct drm_device *dev = ring->dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
        unsigned long end;
-        u32 head;
-        /* If the reported head position has wrapped or hasn't advanced,
-         * fallback to the slow and accurate path.
-         */
-        head = intel_read_status_page(ring, 4);
-        if (head > ring->head) {
-                ring->head = head;
-                ring->space = ring_space(ring);
-                if (ring->space >= n)
-                        return 0;
-        }
        trace_i915_ring_wait_begin(ring);
        if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index fbcd84803b60..17ca72ce3027 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2362,6 +2362,9 @@ void r600_semaphore_ring_emit(struct radeon_device *rdev,
        uint64_t addr = semaphore->gpu_addr;
        unsigned sel = emit_wait ? PACKET3_SEM_SEL_WAIT : PACKET3_SEM_SEL_SIGNAL;
+        if (rdev->family < CHIP_CAYMAN)
+                sel |= PACKET3_SEM_WAIT_ON_SIGNAL;
        radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
        radeon_ring_write(ring, addr & 0xffffffff);
        radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.c b/drivers/gpu/drm/radeon/r600_blit_shaders.c
index 2d1f6c5ee2a7..73e2c7c6edbc 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.c
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.c
@@ -314,6 +314,10 @@ const u32 r6xx_default_state[] =
        0x00000000, /* VGT_VTX_CNT_EN */
        0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+        0xc0016900,
        0x000002c8,
        0x00000000, /* VGT_STRMOUT_BUFFER_EN */
@@ -626,6 +630,10 @@ const u32 r7xx_default_state[] =
        0x00000000, /* VGT_VTX_CNT_EN */
        0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+        0xc0016900,
        0x000002c8,
        0x00000000, /* VGT_STRMOUT_BUFFER_EN */
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 38ce5d0427e3..387fcc9f03ef 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1304,6 +1304,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
        h0 = G_038004_TEX_HEIGHT(word1) + 1;
        d0 = G_038004_TEX_DEPTH(word1);
        nfaces = 1;
+        array = 0;
        switch (G_038000_DIM(word0)) {
        case V_038000_SQ_TEX_DIM_1D:
        case V_038000_SQ_TEX_DIM_2D:
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 3ee1fd7ef394..9b23670716f1 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -831,6 +831,7 @@
 #define PACKET3_STRMOUT_BUFFER_UPDATE                   0x34
 #define PACKET3_INDIRECT_BUFFER_MP                      0x38
 #define PACKET3_MEM_SEMAPHORE                           0x39
+#              define PACKET3_SEM_WAIT_ON_SIGNAL    (0x1 << 12)
 #              define PACKET3_SEM_SEL_SIGNAL        (0x6 << 29)
 #              define PACKET3_SEM_SEL_WAIT          (0x7 << 29)
 #define PACKET3_MPEG_INDEX                              0x3A
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e7cb3ab09243..8c9a8115b632 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1057,7 +1057,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
                    (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
                        return MODE_OK;
                else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
-                        if (ASIC_IS_DCE3(rdev)) {
+                        if (0) {
                                /* HDMI 1.3+ supports max clock of 340 Mhz */
                                if (mode->clock > 340000)
                                        return MODE_CLOCK_HIGH;
@@ -1117,13 +1117,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
            (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                struct drm_display_mode *mode;
-                if (!radeon_dig_connector->edp_on)
+                if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
-                        atombios_set_edp_panel_power(connector,
+                        if (!radeon_dig_connector->edp_on)
-                                                     ATOM_TRANSMITTER_ACTION_POWER_ON);
+                                atombios_set_edp_panel_power(connector,
-                ret = radeon_ddc_get_modes(radeon_connector);
+                                                             ATOM_TRANSMITTER_ACTION_POWER_ON);
-                if (!radeon_dig_connector->edp_on)
+                        ret = radeon_ddc_get_modes(radeon_connector);
-                        atombios_set_edp_panel_power(connector,
+                        if (!radeon_dig_connector->edp_on)
-                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                } else {
+                        /* need to setup ddc on the bridge */
+                        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
+                            ENCODER_OBJECT_ID_NONE) {
+                                if (encoder)
+                                        radeon_atom_ext_encoder_setup_ddc(encoder);
+                        }
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                }
                if (ret > 0) {
                        if (encoder) {
@@ -1134,7 +1144,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                        return ret;
                }
-                encoder = radeon_best_single_encoder(connector);
                if (!encoder)
                        return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8c49fef1ce78..3d314338d843 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1078,15 +1078,21 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
        .create_handle = radeon_user_framebuffer_create_handle,
 };
-void
+int
 radeon_framebuffer_init(struct drm_device *dev,
                        struct radeon_framebuffer *rfb,
                        struct drm_mode_fb_cmd2 *mode_cmd,
                        struct drm_gem_object *obj)
 {
+        int ret;
        rfb->obj = obj;
-        drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        ret = drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        if (ret) {
+                rfb->obj = NULL;
+                return ret;
+        }
        drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
+        return 0;
 }
 static struct drm_framebuffer *
@@ -1096,6 +1102,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
 {
        struct drm_gem_object *obj;
        struct radeon_framebuffer *radeon_fb;
+        int ret;
        obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
        if (obj ==  NULL) {
@@ -1108,7 +1115,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
        if (radeon_fb == NULL)
                return ERR_PTR(-ENOMEM);
-        radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        if (ret) {
+                kfree(radeon_fb);
+                drm_gem_object_unreference_unlocked(obj);
+                return NULL;
+        }
        return &radeon_fb->base;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9419c51bcf50..26e92708d114 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -307,8 +307,6 @@ void radeon_panel_mode_fixup(struct drm_encoder *encoder,
 bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                                    u32 pixel_clock)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
        struct drm_connector *connector;
        struct radeon_connector *radeon_connector;
        struct radeon_connector_atom_dig *dig_connector;
@@ -326,7 +324,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
        case DRM_MODE_CONNECTOR_HDMIB:
                if (radeon_connector->use_digital) {
                        /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                if (pixel_clock > 340000)
                                        return true;
                                else
@@ -348,7 +346,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                        return false;
                else {
                        /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                if (pixel_clock > 340000)
                                        return true;
                                else
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cf2bf35b56b8..195471cf65d3 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -209,6 +209,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
                                                          sizes->surface_depth);
        ret = radeonfb_create_pinned_object(rfbdev, &mode_cmd, &gobj);
+        if (ret) {
+                DRM_ERROR("failed to create fbcon object %d\n", ret);
+                return ret;
+        }
        rbo = gem_to_radeon_bo(gobj);
        /* okay we have an object now allocate the framebuffer */
@@ -220,7 +225,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
        info->par = rfbdev;
-        radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        if (ret) {
+                DRM_ERROR("failed to initalise framebuffer %d\n", ret);
+                goto out_unref;
+        }
        fb = &rfbdev->rfb.base;
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae..c58a036233fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
        if (bo_va == NULL)
                return 0;
-        list_del(&bo_va->bo_list);
        mutex_lock(&vm->mutex);
        radeon_mutex_lock(&rdev->cs_mutex);
        radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
        radeon_mutex_unlock(&rdev->cs_mutex);
        list_del(&bo_va->vm_list);
        mutex_unlock(&vm->mutex);
+        list_del(&bo_va->bo_list);
        kfree(bo_va);
        return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 4330e3253573..8a85598fb242 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -649,7 +649,7 @@ extern void radeon_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                     u16 blue, int regno);
 extern void radeon_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
                                     u16 *blue, int regno);
-void radeon_framebuffer_init(struct drm_device *dev,
+int radeon_framebuffer_init(struct drm_device *dev,
                             struct radeon_framebuffer *rfb,
                             struct drm_mode_fb_cmd2 *mode_cmd,
                             struct drm_gem_object *obj);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b8574cddd953..63552e30d0c3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -59,6 +59,9 @@
 #define USB_VENDOR_ID_AIRCABLE          0x16CA
 #define USB_DEVICE_ID_AIRCABLE1         0x1502
+#define USB_VENDOR_ID_AIREN             0x1a2c
+#define USB_DEVICE_ID_AIREN_SLIMPLUS    0x0002
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                return;
        }
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
+        /*
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                dbg_hid("Ignoring out-of-range value %x\n", value);
                return;
        }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index c831af937481..57d4e1e1df48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -54,6 +54,7 @@ static const struct hid_blacklist {
        { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
        { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
        { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 02260406b9e4..dad895fec62a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -497,8 +497,9 @@ config SENSORS_JC42
          If you say yes here, you get support for JEDEC JC42.4 compliant
          temperature sensors, which are used on many DDR3 memory modules for
          mobile devices and servers.  Support will include, but not be limited
-          to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
+          to, ADT7408, AT30TS00, CAT34TS02, CAT6095, MAX6604, MCP9804, MCP9805,
-          MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+          MCP98242, MCP98243, MCP9843, SE97, SE98, STTS424(E), STTS2002,
+          STTS3000, TSE2002B3, TSE2002GB2, TS3000B3, and TS3000GB2.
          This driver can also be built as a module.  If so, the module
          will be called jc42.
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index 6bab2001ef3b..6aa5a9fad879 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -178,6 +178,16 @@ static inline void f75375_write16(struct i2c_client *client, u8 reg,
        i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
 }
+static void f75375_write_pwm(struct i2c_client *client, int nr)
+{
+        struct f75375_data *data = i2c_get_clientdata(client);
+        if (data->kind == f75387)
+                f75375_write16(client, F75375_REG_FAN_EXP(nr), data->pwm[nr]);
+        else
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                              data->pwm[nr]);
+}
 static struct f75375_data *f75375_update_device(struct device *dev)
 {
        struct i2c_client *client = to_i2c_client(dev);
@@ -254,6 +264,36 @@ static inline u16 rpm_to_reg(int rpm)
        return 1500000 / rpm;
 }
+static bool duty_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        case 2: /* Auto, speed mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        default:
+                BUG();
+        }
+}
+static bool auto_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        case 2: /* Auto, speed mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        default:
+                BUG();
+        }
+}
 static ssize_t set_fan_min(struct device *dev, struct device_attribute *attr,
                const char *buf, size_t count)
 {
@@ -287,6 +327,11 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *attr,
        if (err < 0)
                return err;
+        if (auto_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+        if (data->kind == f75387 && duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
        mutex_lock(&data->update_lock);
        data->fan_target[nr] = rpm_to_reg(val);
        f75375_write16(client, F75375_REG_FAN_EXP(nr), data->fan_target[nr]);
@@ -307,9 +352,13 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
        if (err < 0)
                return err;
+        if (auto_mode_enabled(data->pwm_enable[nr]) ||
+            !duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
        mutex_lock(&data->update_lock);
        data->pwm[nr] = SENSORS_LIMIT(val, 0, 255);
-        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr), data->pwm[nr]);
+        f75375_write_pwm(client, nr);
        mutex_unlock(&data->update_lock);
        return count;
 }
@@ -327,11 +376,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
        struct f75375_data *data = i2c_get_clientdata(client);
        u8 fanmode;
-        if (val < 0 || val > 3)
+        if (val < 0 || val > 4)
                return -EINVAL;
        fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
        if (data->kind == f75387) {
+                /* For now, deny dangerous toggling of duty mode */
+                if (duty_mode_enabled(data->pwm_enable[nr]) !=
+                                duty_mode_enabled(val))
+                        return -EOPNOTSUPP;
                /* clear each fanX_mode bit before setting them properly */
                fanmode &= ~(1 << F75387_FAN_DUTY_MODE(nr));
                fanmode &= ~(1 << F75387_FAN_MANU_MODE(nr));
@@ -345,12 +398,14 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                        fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
                        fanmode  |= (1 << F75387_FAN_DUTY_MODE(nr));
                        break;
-                case 2: /* AUTOMATIC*/
+                case 2: /* Automatic, speed mode */
-                        fanmode  |=  (1 << F75387_FAN_DUTY_MODE(nr));
                        break;
                case 3: /* fan speed */
                        fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                        break;
+                case 4: /* Automatic, pwm */
+                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
+                        break;
                }
        } else {
                /* clear each fanX_mode bit before setting them properly */
@@ -368,14 +423,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                        break;
                case 3: /* fan speed */
                        break;
+                case 4: /* Automatic pwm */
+                        return -EINVAL;
                }
        }
        f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
        data->pwm_enable[nr] = val;
        if (val == 0)
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                f75375_write_pwm(client, nr);
-                                data->pwm[nr]);
        return 0;
 }
@@ -726,14 +782,17 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
                                manu = ((mode >> F75387_FAN_MANU_MODE(nr)) & 1);
                                duty = ((mode >> F75387_FAN_DUTY_MODE(nr)) & 1);
-                                if (manu && duty)
+                                if (!manu && duty)
-                                        /* speed */
+                                        /* auto, pwm */
+                                        data->pwm_enable[nr] = 4;
+                                else if (manu && !duty)
+                                        /* manual, speed */
                                        data->pwm_enable[nr] = 3;
-                                else if (!manu && duty)
+                                else if (!manu && !duty)
-                                        /* automatic */
+                                        /* automatic, speed */
                                        data->pwm_enable[nr] = 2;
                                else
-                                        /* manual */
+                                        /* manual, pwm */
                                        data->pwm_enable[nr] = 1;
                        } else {
                                if (!(conf & (1 << F75375_FAN_CTRL_LINEAR(nr))))
@@ -758,9 +817,11 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
        set_pwm_enable_direct(client, 0, f75375s_pdata->pwm_enable[0]);
        set_pwm_enable_direct(client, 1, f75375s_pdata->pwm_enable[1]);
        for (nr = 0; nr < 2; nr++) {
+                if (auto_mode_enabled(f75375s_pdata->pwm_enable[nr]) ||
+                    !duty_mode_enabled(f75375s_pdata->pwm_enable[nr]))
+                        continue;
                data->pwm[nr] = SENSORS_LIMIT(f75375s_pdata->pwm[nr], 0, 255);
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                f75375_write_pwm(client, nr);
-                        data->pwm[nr]);
        }
 }
@@ -787,7 +848,7 @@ static int f75375_probe(struct i2c_client *client,
        if (err)
                goto exit_free;
-        if (data->kind == f75375) {
+        if (data->kind != f75373) {
                err = sysfs_chmod_file(&client->dev.kobj,
                        &sensor_dev_attr_pwm1_mode.dev_attr.attr,
                        S_IRUGO | S_IWUSR);
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index 28c09eead36b..b927ee5ccdd7 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -64,6 +64,7 @@ static const unsigned short normal_i2c[] = {
 /* Manufacturer IDs */
 #define ADT_MANID               0x11d4  /* Analog Devices */
+#define ATMEL_MANID             0x001f  /* Atmel */
 #define MAX_MANID               0x004d  /* Maxim */
 #define IDT_MANID               0x00b3  /* IDT */
 #define MCP_MANID               0x0054  /* Microchip */
@@ -77,15 +78,25 @@ static const unsigned short normal_i2c[] = {
 #define ADT7408_DEVID           0x0801
 #define ADT7408_DEVID_MASK      0xffff
+/* Atmel */
+#define AT30TS00_DEVID          0x8201
+#define AT30TS00_DEVID_MASK     0xffff
 /* IDT */
 #define TS3000B3_DEVID          0x2903  /* Also matches TSE2002B3 */
 #define TS3000B3_DEVID_MASK     0xffff
+#define TS3000GB2_DEVID         0x2912  /* Also matches TSE2002GB2 */
+#define TS3000GB2_DEVID_MASK    0xffff
 /* Maxim */
 #define MAX6604_DEVID           0x3e00
 #define MAX6604_DEVID_MASK      0xffff
 /* Microchip */
+#define MCP9804_DEVID           0x0200
+#define MCP9804_DEVID_MASK      0xfffc
 #define MCP98242_DEVID          0x2000
 #define MCP98242_DEVID_MASK     0xfffc
@@ -113,6 +124,12 @@ static const unsigned short normal_i2c[] = {
 #define STTS424E_DEVID          0x0000
 #define STTS424E_DEVID_MASK     0xfffe
+#define STTS2002_DEVID          0x0300
+#define STTS2002_DEVID_MASK     0xffff
+#define STTS3000_DEVID          0x0200
+#define STTS3000_DEVID_MASK     0xffff
 static u16 jc42_hysteresis[] = { 0, 1500, 3000, 6000 };
 struct jc42_chips {
@@ -123,8 +140,11 @@ struct jc42_chips {
 static struct jc42_chips jc42_chips[] = {
        { ADT_MANID, ADT7408_DEVID, ADT7408_DEVID_MASK },
+        { ATMEL_MANID, AT30TS00_DEVID, AT30TS00_DEVID_MASK },
        { IDT_MANID, TS3000B3_DEVID, TS3000B3_DEVID_MASK },
+        { IDT_MANID, TS3000GB2_DEVID, TS3000GB2_DEVID_MASK },
        { MAX_MANID, MAX6604_DEVID, MAX6604_DEVID_MASK },
+        { MCP_MANID, MCP9804_DEVID, MCP9804_DEVID_MASK },
        { MCP_MANID, MCP98242_DEVID, MCP98242_DEVID_MASK },
        { MCP_MANID, MCP98243_DEVID, MCP98243_DEVID_MASK },
        { MCP_MANID, MCP9843_DEVID, MCP9843_DEVID_MASK },
@@ -133,6 +153,8 @@ static struct jc42_chips jc42_chips[] = {
        { NXP_MANID, SE98_DEVID, SE98_DEVID_MASK },
        { STM_MANID, STTS424_DEVID, STTS424_DEVID_MASK },
        { STM_MANID, STTS424E_DEVID, STTS424E_DEVID_MASK },
+        { STM_MANID, STTS2002_DEVID, STTS2002_DEVID_MASK },
+        { STM_MANID, STTS3000_DEVID, STTS3000_DEVID_MASK },
 };
 /* Each client has this additional data */
@@ -159,10 +181,12 @@ static struct jc42_data *jc42_update_device(struct device *dev);
 static const struct i2c_device_id jc42_id[] = {
        { "adt7408", 0 },
+        { "at30ts00", 0 },
        { "cat94ts02", 0 },
        { "cat6095", 0 },
        { "jc42", 0 },
        { "max6604", 0 },
+        { "mcp9804", 0 },
        { "mcp9805", 0 },
        { "mcp98242", 0 },
        { "mcp98243", 0 },
@@ -171,8 +195,10 @@ static const struct i2c_device_id jc42_id[] = {
        { "se97b", 0 },
        { "se98", 0 },
        { "stts424", 0 },
-        { "tse2002b3", 0 },
+        { "stts2002", 0 },
-        { "ts3000b3", 0 },
+        { "stts3000", 0 },
+        { "tse2002", 0 },
+        { "ts3000", 0 },
        { }
 };
 MODULE_DEVICE_TABLE(i2c, jc42_id);
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 00460d8d8423..d89b33967a85 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -54,7 +54,8 @@
                                                   lcrit_alarm, crit_alarm */
 #define PMBUS_IOUT_BOOLEANS_PER_PAGE    3       /* alarm, lcrit_alarm,
                                                   crit_alarm */
-#define PMBUS_POUT_BOOLEANS_PER_PAGE    2       /* alarm, crit_alarm */
+#define PMBUS_POUT_BOOLEANS_PER_PAGE    3       /* cap_alarm, alarm, crit_alarm
+                                                 */
 #define PMBUS_MAX_BOOLEANS_PER_FAN      2       /* alarm, fault */
 #define PMBUS_MAX_BOOLEANS_PER_TEMP     4       /* min_alarm, max_alarm,
                                                   lcrit_alarm, crit_alarm */
diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index 48c7b4a716ae..880b90cf4d32 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -33,6 +33,7 @@ enum chips { zl2004, zl2005, zl2006, zl2008, zl2105, zl2106, zl6100, zl6105 };
 struct zl6100_data {
        int id;
        ktime_t access;         /* chip access time */
+        int delay;              /* Delay between chip accesses in uS */
        struct pmbus_driver_info info;
 };
@@ -52,10 +53,10 @@ MODULE_PARM_DESC(delay, "Delay between chip accesses in uS");
 /* Some chips need a delay between accesses */
 static inline void zl6100_wait(const struct zl6100_data *data)
 {
-        if (delay) {
+        if (data->delay) {
                s64 delta = ktime_us_delta(ktime_get(), data->access);
-                if (delta < delay)
+                if (delta < data->delay)
-                        udelay(delay - delta);
+                        udelay(data->delay - delta);
        }
 }
@@ -207,8 +208,9 @@ static int zl6100_probe(struct i2c_client *client,
         * can be cleared later for additional chips if tests show that it
         * is not needed (in other words, better be safe than sorry).
         */
+        data->delay = delay;
        if (data->id == zl2004 || data->id == zl6105)
-                delay = 0;
+                data->delay = 0;
        /*
         * Since there was a direct I2C device access above, wait before
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 7e78f7c87857..3d471d56bf15 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -72,6 +72,7 @@
 #define MXS_I2C_QUEUESTAT       (0x70)
 #define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
+#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
 #define MXS_I2C_QUEUECMD        (0x80)
@@ -219,14 +220,14 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
        int ret;
        int flags;
-        init_completion(&i2c->cmd_complete);
        dev_dbg(i2c->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
                msg->addr, msg->len, msg->flags, stop);
        if (msg->len == 0)
                return -EINVAL;
+        init_completion(&i2c->cmd_complete);
        flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
        if (msg->flags & I2C_M_RD)
@@ -286,6 +287,7 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
        struct mxs_i2c_dev *i2c = dev_id;
        u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
+        bool is_last_cmd;
        if (!stat)
                return IRQ_NONE;
@@ -300,9 +302,14 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
        else
                i2c->cmd_err = 0;
-        complete(&i2c->cmd_complete);
+        is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
+                MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
+        if (is_last_cmd || i2c->cmd_err)
+                complete(&i2c->cmd_complete);
        writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
        return IRQ_HANDLED;
 }
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index afc166fcc3d9..7df5bfef2624 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -332,7 +332,7 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
        struct evdev_client *client = file->private_data;
        struct evdev *evdev = client->evdev;
        struct input_event event;
-        int retval;
+        int retval = 0;
        if (count < input_event_size())
                return -EINVAL;
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index 37651373a95b..f3bc4189a7ba 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -172,7 +172,7 @@ static void twl4030_vibra_close(struct input_dev *input)
 }
 /*** Module ***/
-#if CONFIG_PM
+#if CONFIG_PM_SLEEP
 static int twl4030_vibra_suspend(struct device *dev)
 {
        struct platform_device *pdev = to_platform_device(dev);
@@ -189,10 +189,10 @@ static int twl4030_vibra_resume(struct device *dev)
        vibra_disable_leds();
        return 0;
 }
+#endif
 static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
                         twl4030_vibra_suspend, twl4030_vibra_resume);
-#endif
 static int __devinit twl4030_vibra_probe(struct platform_device *pdev)
 {
@@ -273,9 +273,7 @@ static struct platform_driver twl4030_vibra_driver = {
        .driver         = {
                .name   = "twl4030-vibra",
                .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                .pm     = &twl4030_vibra_pm_ops,
-#endif
        },
 };
 module_platform_driver(twl4030_vibra_driver);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index bd87380bd879..4c6a72d3d48c 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -952,7 +952,9 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
        /*
         * First try "E6 report".
-         * ALPS should return 0,0,10 or 0,0,100
+         * ALPS should return 0,0,10 or 0,0,100 if no buttons are pressed.
+         * The bits 0-2 of the first byte will be 1s if some buttons are
+         * pressed.
         */
        param[0] = 0;
        if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES) ||
@@ -968,7 +970,8 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
        psmouse_dbg(psmouse, "E6 report: %2.2x %2.2x %2.2x",
                    param[0], param[1], param[2]);
-        if (param[0] != 0 || param[1] != 0 || (param[2] != 10 && param[2] != 100))
+        if ((param[0] & 0xf8) != 0 || param[1] != 0 ||
+            (param[2] != 10 && param[2] != 100))
                return NULL;
        /*
diff --git a/drivers/input/tablet/Kconfig b/drivers/input/tablet/Kconfig
index 58a87755b936..e53f4081a586 100644
--- a/drivers/input/tablet/Kconfig
+++ b/drivers/input/tablet/Kconfig
@@ -77,6 +77,8 @@ config TABLET_USB_WACOM
        tristate "Wacom Intuos/Graphire tablet support (USB)"
        depends on USB_ARCH_HAS_HCD
        select USB
+        select NEW_LEDS
+        select LEDS_CLASS
        help
          Say Y here if you want to use the USB version of the Wacom Intuos
          or Graphire tablet.  Make sure to say Y to "Mouse support"
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 88672ec296c1..cd3ed29e0801 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -926,7 +926,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
 {
        struct input_dev *input = wacom->input;
        unsigned char *data = wacom->data;
-        int count = data[1] & 0x03;
+        int count = data[1] & 0x07;
        int i;
        if (data[0] != 0x02)
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bdea288dc185..a35e98ad9725 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -275,7 +275,7 @@ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 }
 /* Programs the physical address of the device table into the IOMMU hardware */
-static void __init iommu_set_device_table(struct amd_iommu *iommu)
+static void iommu_set_device_table(struct amd_iommu *iommu)
 {
        u64 entry;
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 9fb18c147825..b280c433e4a0 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -323,7 +323,7 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio,
         * Corrupt successful READs while in down state.
         * If flags were specified, only corrupt those that match.
         */
-        if (!error && bio_submitted_while_down &&
+        if (fc->corrupt_bio_byte && !error && bio_submitted_while_down &&
            (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
            all_corrupt_bio_flags_match(bio, fc))
                corrupt_bio_data(bio, fc);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ad2eba40e319..ea5dd289fe2a 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -296,6 +296,8 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
        unsigned offset;
        unsigned num_bvecs;
        sector_t remaining = where->count;
+        struct request_queue *q = bdev_get_queue(where->bdev);
+        sector_t discard_sectors;
        /*
         * where->count may be zero if rw holds a flush and we need to
@@ -305,9 +307,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                /*
                 * Allocate a suitably sized-bio.
                 */
-                num_bvecs = dm_sector_div_up(remaining,
+                if (rw & REQ_DISCARD)
-                                             (PAGE_SIZE >> SECTOR_SHIFT));
+                        num_bvecs = 1;
-                num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
+                else
+                        num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev),
+                                          dm_sector_div_up(remaining, (PAGE_SIZE >> SECTOR_SHIFT)));
                bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                bio->bi_sector = where->sector + (where->count - remaining);
                bio->bi_bdev = where->bdev;
@@ -315,10 +320,14 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                bio->bi_destructor = dm_bio_destructor;
                store_io_and_region_in_bio(bio, io, region);
-                /*
+                if (rw & REQ_DISCARD) {
-                 * Try and add as many pages as possible.
+                        discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
-                 */
+                        bio->bi_size = discard_sectors << SECTOR_SHIFT;
-                while (remaining) {
+                        remaining -= discard_sectors;
+                } else while (remaining) {
+                        /*
+                         * Try and add as many pages as possible.
+                         */
                        dp->get_page(dp, &page, &len, &offset);
                        len = min(len, to_bytes(remaining));
                        if (!bio_add_page(bio, page, len, offset))
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 31c2dc25886d..1ce84ed0b765 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1437,7 +1437,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
        if (!argc) {
                DMWARN("Empty message received.");
-                goto out;
+                goto out_argv;
        }
        table = dm_get_live_table(md);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 86cb7e5d83d5..787022c18187 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -668,7 +668,14 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
                return ret;
        sb = page_address(rdev->sb_page);
-        if (sb->magic != cpu_to_le32(DM_RAID_MAGIC)) {
+        /*
+         * Two cases that we want to write new superblocks and rebuild:
+         * 1) New device (no matching magic number)
+         * 2) Device specified for rebuild (!In_sync w/ offset == 0)
+         */
+        if ((sb->magic != cpu_to_le32(DM_RAID_MAGIC)) ||
+            (!test_bit(In_sync, &rdev->flags) && !rdev->recovery_offset)) {
                super_sync(rdev->mddev, rdev);
                set_bit(FirstUse, &rdev->flags);
@@ -745,11 +752,8 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
         */
        rdev_for_each(r, t, mddev) {
                if (!test_bit(In_sync, &r->flags)) {
-                        if (!test_bit(FirstUse, &r->flags))
+                        DMINFO("Device %d specified for rebuild: "
-                                DMERR("Superblock area of "
+                               "Clearing superblock", r->raid_disk);
-                                      "rebuild device %d should have been "
-                                      "cleared.", r->raid_disk);
-                        set_bit(FirstUse, &r->flags);
                        rebuilds++;
                } else if (test_bit(FirstUse, &r->flags))
                        new_devs++;
@@ -971,6 +975,7 @@ static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
        INIT_WORK(&rs->md.event_work, do_table_event);
        ti->private = rs;
+        ti->num_flush_requests = 1;
        mutex_lock(&rs->md.reconfig_mutex);
        ret = md_run(&rs->md);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 59c4f0446ffa..237571af77fd 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -385,6 +385,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
                data_sm = dm_sm_disk_create(tm, nr_blocks);
                if (IS_ERR(data_sm)) {
                        DMERR("sm_disk_create failed");
+                        dm_tm_unlock(tm, sblock);
                        r = PTR_ERR(data_sm);
                        goto bad;
                }
@@ -789,6 +790,11 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
        return 0;
 }
+/*
+ * __open_device: Returns @td corresponding to device with id @dev,
+ * creating it if @create is set and incrementing @td->open_count.
+ * On failure, @td is undefined.
+ */
 static int __open_device(struct dm_pool_metadata *pmd,
                         dm_thin_id dev, int create,
                         struct dm_thin_device **td)
@@ -799,10 +805,16 @@ static int __open_device(struct dm_pool_metadata *pmd,
        struct disk_device_details details_le;
        /*
-         * Check the device isn't already open.
+         * If the device is already open, return it.
         */
        list_for_each_entry(td2, &pmd->thin_devices, list)
                if (td2->id == dev) {
+                        /*
+                         * May not create an already-open device.
+                         */
+                        if (create)
+                                return -EEXIST;
                        td2->open_count++;
                        *td = td2;
                        return 0;
@@ -817,6 +829,9 @@ static int __open_device(struct dm_pool_metadata *pmd,
                if (r != -ENODATA || !create)
                        return r;
+                /*
+                 * Create new device.
+                 */
                changed = 1;
                details_le.mapped_blocks = 0;
                details_le.transaction_id = cpu_to_le64(pmd->trans_id);
@@ -882,12 +897,10 @@ static int __create_thin(struct dm_pool_metadata *pmd,
        r = __open_device(pmd, dev, 1, &td);
        if (r) {
-                __close_device(td);
                dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
                dm_btree_del(&pmd->bl_info, dev_root);
                return r;
        }
-        td->changed = 1;
        __close_device(td);
        return r;
@@ -967,14 +980,14 @@ static int __create_snap(struct dm_pool_metadata *pmd,
                goto bad;
        r = __set_snapshot_details(pmd, td, origin, pmd->time);
+        __close_device(td);
        if (r)
                goto bad;
-        __close_device(td);
        return 0;
 bad:
-        __close_device(td);
        dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
        dm_btree_remove(&pmd->details_info, pmd->details_root,
                        &key, &pmd->details_root);
@@ -1211,6 +1224,8 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
        if (r)
                return r;
+        td->mapped_blocks--;
+        td->changed = 1;
        pmd->need_commit = 1;
        return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a368db2431a5..a0b225eb4ac4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -624,7 +624,7 @@ int md_raid1_congested(struct mddev *mddev, int bits)
                return 1;
        rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks * 2; i++) {
                struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
                if (rdev && !test_bit(Faulty, &rdev->flags)) {
                        struct request_queue *q = bdev_get_queue(rdev->bdev);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6e8aa213f0d5..58c44d6453a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -67,6 +67,7 @@ static int max_queued_requests = 1024;
 static void allow_barrier(struct r10conf *conf);
 static void lower_barrier(struct r10conf *conf);
+static int enough(struct r10conf *conf, int ignore);
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -347,6 +348,19 @@ static void raid10_end_read_request(struct bio *bio, int error)
                 * wait for the 'master' bio.
                 */
                set_bit(R10BIO_Uptodate, &r10_bio->state);
+        } else {
+                /* If all other devices that store this block have
+                 * failed, we want to return the error upwards rather
+                 * than fail the last device.  Here we redefine
+                 * "uptodate" to mean "Don't want to retry"
+                 */
+                unsigned long flags;
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (!enough(conf, rdev->raid_disk))
+                        uptodate = 1;
+                spin_unlock_irqrestore(&conf->device_lock, flags);
+        }
+        if (uptodate) {
                raid_end_bio_io(r10_bio);
                rdev_dec_pending(rdev, conf->mddev);
        } else {
@@ -2052,6 +2066,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                       "md/raid10:%s: %s: Failing raid device\n",
                       mdname(mddev), b);
                md_error(mddev, conf->mirrors[d].rdev);
+                r10_bio->devs[r10_bio->read_slot].bio = IO_BLOCKED;
                return;
        }
@@ -2105,8 +2120,11 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                                    rdev,
                                    r10_bio->devs[r10_bio->read_slot].addr
                                    + sect,
-                                    s, 0))
+                                    s, 0)) {
                                md_error(mddev, rdev);
+                                r10_bio->devs[r10_bio->read_slot].bio
+                                        = IO_BLOCKED;
+                        }
                        break;
                }
@@ -2299,17 +2317,20 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
         * This is all done synchronously while the array is
         * frozen.
         */
+        bio = r10_bio->devs[slot].bio;
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r10_bio->devs[slot].bio = NULL;
        if (mddev->ro == 0) {
                freeze_array(conf);
                fix_read_error(conf, mddev, r10_bio);
                unfreeze_array(conf);
-        }
+        } else
+                r10_bio->devs[slot].bio = IO_BLOCKED;
        rdev_dec_pending(rdev, mddev);
-        bio = r10_bio->devs[slot].bio;
-        bdevname(bio->bi_bdev, b);
-        r10_bio->devs[slot].bio =
-                mddev->ro ? IO_BLOCKED : NULL;
 read_more:
        rdev = read_balance(conf, r10_bio, &max_sectors);
        if (rdev == NULL) {
@@ -2318,13 +2339,10 @@ read_more:
                       mdname(mddev), b,
                       (unsigned long long)r10_bio->sector);
                raid_end_bio_io(r10_bio);
-                bio_put(bio);
                return;
        }
        do_sync = (r10_bio->master_bio->bi_rw & REQ_SYNC);
-        if (bio)
-                bio_put(bio);
        slot = r10_bio->read_slot;
        printk_ratelimited(
                KERN_ERR
@@ -2360,7 +2378,6 @@ read_more:
                        mbio->bi_phys_segments++;
                spin_unlock_irq(&conf->device_lock);
                generic_make_request(bio);
-                bio = NULL;
                r10_bio = mempool_alloc(conf->r10bio_pool,
                                        GFP_NOIO);
@@ -3243,7 +3260,6 @@ static int run(struct mddev *mddev)
                        disk->rdev = rdev;
                }
-                disk->rdev = rdev;
                disk_stack_limits(mddev->gendisk, rdev->bdev,
                                  rdev->data_offset << 9);
                /* as we don't honour merge_bvec_fn, we must never risk
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 53e2a80f42fa..d295941c9a3d 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -956,11 +956,12 @@ int __devinit ab8500_init(struct ab8500 *ab8500)
        return ret;
 out_freeirq:
-        if (ab8500->irq_base) {
+        if (ab8500->irq_base)
                free_irq(ab8500->irq, ab8500);
 out_removeirq:
+        if (ab8500->irq_base)
                ab8500_irq_remove(ab8500);
-        }
        return ret;
 }
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0f5922812bff..411f523d4878 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -123,7 +123,7 @@ static int mfd_add_device(struct device *parent, int id,
                }
                if (!cell->ignore_resource_conflicts) {
-                        ret = acpi_check_resource_conflict(res);
+                        ret = acpi_check_resource_conflict(&res[r]);
                        if (ret)
                                goto fail_res;
                }
diff --git a/drivers/mfd/s5m-core.c b/drivers/mfd/s5m-core.c
index e075c113eec6..caadabeed8e9 100644
--- a/drivers/mfd/s5m-core.c
+++ b/drivers/mfd/s5m-core.c
@@ -105,7 +105,7 @@ static int s5m87xx_i2c_probe(struct i2c_client *i2c,
        s5m87xx->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
        i2c_set_clientdata(s5m87xx->rtc, s5m87xx);
-        if (pdata->cfg_pmic_irq)
+        if (pdata && pdata->cfg_pmic_irq)
                pdata->cfg_pmic_irq();
        s5m_irq_init(s5m87xx);
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 01cf5012a08f..4392f6bca156 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -168,7 +168,7 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
                goto err;
        init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
        tps65910_gpio_init(tps65910, pmic_plat_data->gpio_base);
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 5fec23a9ac03..74fd8cb5f372 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -151,7 +151,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
                goto err;
        init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
        ret = tps65912_irq_init(tps65912, init_data->irq, init_data);
        if (ret < 0)
                goto err;
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
index 8a1fafd0bf7d..9fd01bf63c51 100644
--- a/drivers/mfd/wm8350-irq.c
+++ b/drivers/mfd/wm8350-irq.c
@@ -496,7 +496,6 @@ int wm8350_irq_init(struct wm8350 *wm8350, int irq,
        mutex_init(&wm8350->irq_lock);
        wm8350->chip_irq = irq;
-        wm8350->irq_base = pdata->irq_base;
        if (pdata && pdata->irq_base > 0)
                irq_base = pdata->irq_base;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index f117e7fb9321..a04b3c108c8c 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -256,6 +256,20 @@ static int wm8994_suspend(struct device *dev)
                break;
        }
+        switch (wm8994->type) {
+        case WM1811:
+                ret = wm8994_reg_read(wm8994, WM8994_ANTIPOP_2);
+                if (ret < 0) {
+                        dev_err(dev, "Failed to read jackdet: %d\n", ret);
+                } else if (ret & WM1811_JACKDET_MODE_MASK) {
+                        dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
        /* Disable LDO pulldowns while the device is suspended if we
         * don't know that something will be driving them. */
        if (!wm8994->ldo_ena_always_driven)
diff --git a/drivers/mfd/wm8994-regmap.c b/drivers/mfd/wm8994-regmap.c
index c598ae69b8ff..bc0c5096539a 100644
--- a/drivers/mfd/wm8994-regmap.c
+++ b/drivers/mfd/wm8994-regmap.c
@@ -806,6 +806,7 @@ static bool wm1811_readable_register(struct device *dev, unsigned int reg)
        case WM8994_DC_SERVO_2:
        case WM8994_DC_SERVO_READBACK:
        case WM8994_DC_SERVO_4:
+        case WM8994_DC_SERVO_4E:
        case WM8994_ANALOGUE_HP_1:
        case WM8958_MIC_DETECT_1:
        case WM8958_MIC_DETECT_2:
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 19fc7c1cb428..f428d86bfc10 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -984,9 +984,9 @@ static int __init c2port_init(void)
                " - (C) 2007 Rodolfo Giometti\n");
        c2port_class = class_create(THIS_MODULE, "c2port");
-        if (!c2port_class) {
+        if (IS_ERR(c2port_class)) {
                printk(KERN_ERR "c2port: failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(c2port_class);
        }
        c2port_class->dev_attrs = c2port_attrs;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 690255c7d4dc..132378b89d76 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2068,6 +2068,9 @@ static int mmc_rescan_try_freq(struct mmc_host *host, unsigned freq)
         */
        mmc_hw_reset_for_init(host);
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
        /*
         * sdio_reset sends CMD52 to reset card.  Since we do not know
         * if the card is being re-initialized, just send it.  CMD52
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 30055f2b0d44..c3704e293a7b 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -238,10 +238,10 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
        /* Hold MCI clock for 8 cycles by default */
        host->clk_delay = 8;
        /*
-         * Default clock gating delay is 200ms.
+         * Default clock gating delay is 0ms to avoid wasting power.
         * This value can be tuned by writing into sysfs entry.
         */
-        host->clkgate_delay = 200;
+        host->clkgate_delay = 0;
        host->clk_gated = false;
        INIT_DELAYED_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
        spin_lock_init(&host->clk_lock);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a48066344fa8..2b9ed1401dc4 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -816,6 +816,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
        if (!mmc_host_is_spi(host))
                mmc_set_bus_mode(host, MMC_BUSMODE_OPENDRAIN);
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
        /*
         * Since we're changing the OCR value, we seem to
         * need to tell some cards to go back to the idle
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 5017f9354ce2..c272c6868ecf 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -911,6 +911,9 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr,
        BUG_ON(!host);
        WARN_ON(!host->claimed);
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
        err = mmc_sd_get_cid(host, ocr, cid, &rocr);
        if (err)
                return err;
@@ -1156,11 +1159,6 @@ int mmc_attach_sd(struct mmc_host *host)
        BUG_ON(!host);
        WARN_ON(!host->claimed);
-        /* Make sure we are at 3.3V signalling voltage */
-        err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, false);
-        if (err)
-                return err;
        /* Disable preset value enable if already set since last time */
        if (host->ops->enable_preset_value) {
                mmc_host_clk_hold(host);
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 12cde6ee17f5..2c7c83f832d2 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -585,6 +585,9 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
         * Inform the card of the voltage
         */
        if (!powered_resume) {
+                /* The initialization should be done at 3.3 V I/O voltage. */
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
                err = mmc_send_io_op_cond(host, host->ocr, &ocr);
                if (err)
                        goto err;
@@ -996,6 +999,11 @@ static int mmc_sdio_power_restore(struct mmc_host *host)
         * With these steps taken, mmc_select_voltage() is also required to
         * restore the correct voltage setting of the card.
         */
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        if (!mmc_card_keep_power(host))
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
        sdio_reset(host);
        mmc_go_idle(host);
        mmc_send_if_cond(host, host->ocr_avail);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 6985cdb0bb26..e4449a54ae8f 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1948,12 +1948,12 @@ static bool atmci_filter(struct dma_chan *chan, void *slave)
        }
 }
-static void atmci_configure_dma(struct atmel_mci *host)
+static bool atmci_configure_dma(struct atmel_mci *host)
 {
        struct mci_platform_data        *pdata;
        if (host == NULL)
-                return;
+                return false;
        pdata = host->pdev->dev.platform_data;
@@ -1970,12 +1970,15 @@ static void atmci_configure_dma(struct atmel_mci *host)
                host->dma.chan =
                        dma_request_channel(mask, atmci_filter, pdata->dma_slave);
        }
-        if (!host->dma.chan)
+        if (!host->dma.chan) {
-                dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
+                dev_warn(&host->pdev->dev, "no DMA channel available\n");
-        else
+                return false;
+        } else {
                dev_info(&host->pdev->dev,
                                        "Using %s for DMA transfers\n",
                                        dma_chan_name(host->dma.chan));
+                return true;
+        }
 }
 static inline unsigned int atmci_get_version(struct atmel_mci *host)
@@ -2085,8 +2088,7 @@ static int __init atmci_probe(struct platform_device *pdev)
        /* Get MCI capabilities and set operations according to it */
        atmci_get_cap(host);
-        if (host->caps.has_dma) {
+        if (host->caps.has_dma && atmci_configure_dma(host)) {
-                dev_info(&pdev->dev, "using DMA\n");
                host->prepare_data = &atmci_prepare_data_dma;
                host->submit_data = &atmci_submit_data_dma;
                host->stop_transfer = &atmci_stop_transfer_dma;
@@ -2096,15 +2098,12 @@ static int __init atmci_probe(struct platform_device *pdev)
                host->submit_data = &atmci_submit_data_pdc;
                host->stop_transfer = &atmci_stop_transfer_pdc;
        } else {
-                dev_info(&pdev->dev, "no DMA, no PDC\n");
+                dev_info(&pdev->dev, "using PIO\n");
                host->prepare_data = &atmci_prepare_data;
                host->submit_data = &atmci_submit_data;
                host->stop_transfer = &atmci_stop_transfer;
        }
-        if (host->caps.has_dma)
-                atmci_configure_dma(host);
        platform_set_drvdata(pdev, host);
        /* We need at least one slot to succeed */
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 0d955ffaf44e..11e589cd8233 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1271,12 +1271,13 @@ static int __devinit mmci_probe(struct amba_device *dev,
        /*
         * Block size can be up to 2048 bytes, but must be a power of two.
         */
-        mmc->max_blk_size = 2048;
+        mmc->max_blk_size = 1 << 11;
        /*
-         * No limit on the number of blocks transferred.
+         * Limit the number of blocks transferred so that we don't overflow
+         * the maximum request size.
         */
-        mmc->max_blk_count = mmc->max_req_size;
+        mmc->max_blk_count = mmc->max_req_size >> 11;
        spin_lock_init(&host->lock);
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d601e41af282..0be4e2013632 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -269,8 +269,9 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
                imx_data->scratchpad = val;
                return;
        case SDHCI_COMMAND:
-                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION)
+                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION ||
-                        && (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
+                     host->cmd->opcode == MMC_SET_BLOCK_COUNT) &&
+                    (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
                        val |= SDHCI_CMD_ABORTCMD;
                if (is_imx6q_usdhc(imx_data)) {
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 0a4fc62a381d..c998e1afebc6 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -978,7 +978,7 @@ static void cfhsi_setup(struct net_device *dev)
        dev->netdev_ops = &cfhsi_ops;
        dev->type = ARPHRD_CAIF;
        dev->flags = IFF_POINTOPOINT | IFF_NOARP;
-        dev->mtu = CFHSI_MAX_PAYLOAD_SZ;
+        dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
        dev->tx_queue_len = 0;
        dev->destructor = free_netdev;
        skb_queue_head_init(&cfhsi->qhead);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 1ff3c6df35a2..47a9bb2c813c 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1710,7 +1710,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
                                        "atl1c hardware error (status = 0x%x)\n",
                                        status & ISR_ERROR);
                        /* reset MAC */
-                        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+                        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
                        schedule_work(&adapter->common_task);
                        return IRQ_HANDLED;
                }
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a1f2e0fed78b..35c2a202d67a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -5352,7 +5352,7 @@ static void tg3_tx(struct tg3_napi *tnapi)
                }
        }
-        netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
+        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
        tnapi->tx_cons = sw_idx;
@@ -6793,7 +6793,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        skb_tx_timestamp(skb);
-        netdev_sent_queue(tp->dev, skb->len);
+        netdev_tx_sent_queue(txq, skb->len);
        /* Packets are ready, update Tx producer idx local and on card. */
        tw32_tx_mbox(tnapi->prodmbox, entry);
@@ -7275,8 +7275,8 @@ static void tg3_free_rings(struct tg3 *tp)
                        dev_kfree_skb_any(skb);
                }
+                netdev_tx_reset_queue(netdev_get_tx_queue(tp->dev, j));
        }
-        netdev_reset_queue(tp->dev);
 }
 /* Initialize tx/rx rings for packet processing.
@@ -7886,10 +7886,8 @@ static int tg3_chip_reset(struct tg3 *tp)
        return 0;
 }
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
+static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
-                                                 struct rtnl_link_stats64 *);
+static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
-                                                struct tg3_ethtool_stats *);
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7910,7 +7908,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
        if (tp->hw_stats) {
                /* Save the stats across chip resets... */
-                tg3_get_stats64(tp->dev, &tp->net_stats_prev),
+                tg3_get_nstats(tp, &tp->net_stats_prev),
                tg3_get_estats(tp, &tp->estats_prev);
                /* And make sure the next sample is new data */
@@ -9847,7 +9845,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
       return ((u64)val->high << 32) | ((u64)val->low);
 }
-static u64 calc_crc_errors(struct tg3 *tp)
+static u64 tg3_calc_crc_errors(struct tg3 *tp)
 {
        struct tg3_hw_stats *hw_stats = tp->hw_stats;
@@ -9856,14 +9854,12 @@ static u64 calc_crc_errors(struct tg3 *tp)
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
                u32 val;
-                spin_lock_bh(&tp->lock);
                if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
                        tg3_writephy(tp, MII_TG3_TEST1,
                                     val | MII_TG3_TEST1_CRC_EN);
                        tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
                } else
                        val = 0;
-                spin_unlock_bh(&tp->lock);
                tp->phy_crc_errors += val;
@@ -9877,14 +9873,13 @@ static u64 calc_crc_errors(struct tg3 *tp)
        estats->member =        old_estats->member + \
                                get_stat64(&hw_stats->member)
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
+static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
-                                               struct tg3_ethtool_stats *estats)
 {
        struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
        struct tg3_hw_stats *hw_stats = tp->hw_stats;
        if (!hw_stats)
-                return old_estats;
+                return;
        ESTAT_ADD(rx_octets);
        ESTAT_ADD(rx_fragments);
@@ -9963,20 +9958,13 @@ static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
        ESTAT_ADD(nic_tx_threshold_hit);
        ESTAT_ADD(mbuf_lwm_thresh_hit);
-        return estats;
 }
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
-                                                 struct rtnl_link_stats64 *stats)
 {
-        struct tg3 *tp = netdev_priv(dev);
        struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
        struct tg3_hw_stats *hw_stats = tp->hw_stats;
-        if (!hw_stats)
-                return old_stats;
        stats->rx_packets = old_stats->rx_packets +
                get_stat64(&hw_stats->rx_ucast_packets) +
                get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10019,15 +10007,13 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
                get_stat64(&hw_stats->tx_carrier_sense_errors);
        stats->rx_crc_errors = old_stats->rx_crc_errors +
-                calc_crc_errors(tp);
+                tg3_calc_crc_errors(tp);
        stats->rx_missed_errors = old_stats->rx_missed_errors +
                get_stat64(&hw_stats->rx_discards);
        stats->rx_dropped = tp->rx_dropped;
        stats->tx_dropped = tp->tx_dropped;
-        return stats;
 }
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15409,6 +15395,21 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
        }
 }
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
+{
+        struct tg3 *tp = netdev_priv(dev);
+        if (!tp->hw_stats)
+                return &tp->net_stats_prev;
+        spin_lock_bh(&tp->lock);
+        tg3_get_nstats(tp, stats);
+        spin_unlock_bh(&tp->lock);
+        return stats;
+}
 static const struct net_device_ops tg3_netdev_ops = {
        .ndo_open               = tg3_open,
        .ndo_stop               = tg3_close,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e83d12c7bf20..9d76e59d9526 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -196,6 +196,8 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
        CH_DEVICE(0x4408, 4),
        CH_DEVICE(0x4409, 4),
        CH_DEVICE(0x440a, 4),
+        CH_DEVICE(0x440d, 4),
+        CH_DEVICE(0x440e, 4),
        { 0, }
 };
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index e53365a71484..d963c1d57f71 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2892,6 +2892,8 @@ static struct pci_device_id cxgb4vf_pci_tbl[] = {
        CH_DEVICE(0x4808, 0),   /* T420-cx */
        CH_DEVICE(0x4809, 0),   /* T420-bt */
        CH_DEVICE(0x480a, 0),   /* T404-bt */
+        CH_DEVICE(0x480d, 0),   /* T480-cr */
+        CH_DEVICE(0x480e, 0),   /* T440-lp-cr */
        { 0, }
 };
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index ee93a2087fe6..c52295cd05ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
        u32 rx_coalesce_usecs;
        u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-        u32 num_vfs;
+        u16 num_vfs;
 #endif
        struct enic_port_profile *pp;
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ab3f67f980d8..0e4edd3b6bee 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
        pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
        if (pos) {
                pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-                        (u16 *)&enic->num_vfs);
+                        &enic->num_vfs);
                if (enic->num_vfs) {
                        err = pci_enable_sriov(pdev, enic->num_vfs);
                        if (err) {
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 5d5fb2627184..e6893cdfd13b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -336,7 +336,9 @@ static struct rtnl_link_stats64 *ehea_get_stats64(struct net_device *dev,
        stats->tx_bytes = tx_bytes;
        stats->rx_packets = rx_packets;
-        return &port->stats;
+        stats->multicast = port->stats.multicast;
+        stats->rx_errors = port->stats.rx_errors;
+        return stats;
 }
 static void ehea_update_stats(struct work_struct *work)
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 738f950a1ce5..fb2b36759cbf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -151,11 +151,6 @@ static int __mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
                context->log_page_size   = mtt->page_shift - MLX4_ICM_PAGE_SHIFT;
        }
-        port = ((context->pri_path.sched_queue >> 6) & 1) + 1;
-        if (dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH)
-                context->pri_path.sched_queue = (context->pri_path.sched_queue &
-                                                0xc3);
        *(__be32 *) mailbox->buf = cpu_to_be32(optpar);
        memcpy(mailbox->buf + 8, context, sizeof *context);
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index bfdb7af19e49..8752e6e08169 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2255,8 +2255,7 @@ int mlx4_MODIFY_CQ_wrapper(struct mlx4_dev *dev, int slave,
        if (vhcr->op_modifier == 0) {
                err = handle_resize(dev, slave, vhcr, inbox, outbox, cmd, cq);
-                if (err)
+                goto ex_put;
-                        goto ex_put;
        }
        err = mlx4_DMA_wrapper(dev, slave, vhcr, inbox, outbox, cmd);
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 9cb5f912e489..29e23bec809c 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                        pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                        hw->phy.autoneg_advertised = opt.def;
                } else {
-                        hw->phy.autoneg_advertised = AutoNeg;
+                        int tmp = AutoNeg;
-                        pch_gbe_validate_option(
-                                (int *)(&hw->phy.autoneg_advertised),
+                        pch_gbe_validate_option(&tmp, &opt, adapter);
-                                &opt, adapter);
+                        hw->phy.autoneg_advertised = tmp;
                }
        }
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                        .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                         .p = fc_list } }
                };
-                hw->mac.fc = FlowControl;
+                int tmp = FlowControl;
-                pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                                &opt, adapter);
+                pch_gbe_validate_option(&tmp, &opt, adapter);
+                hw->mac.fc = tmp;
        }
        pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index b97132d9dff0..8f29feb35548 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 config NET_PACKET_ENGINE
        bool "Packet Engine devices"
+        default y
        depends on PCI
        ---help---
          If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 7931531c3a40..e61560e16385 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,7 +3017,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                (void __iomem *)port_regs;
        u32 delay = 10;
        int status = 0;
-        unsigned long hw_flags = 0;
        if (ql_mii_setup(qdev))
                return -1;
@@ -3228,9 +3227,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                if (value & PORT_STATUS_IC)
                        break;
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+                spin_unlock_irq(&qdev->hw_lock);
                msleep(500);
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+                spin_lock_irq(&qdev->hw_lock);
        } while (--delay);
        if (delay == 0) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a0c800b50ad..bbacb3741ec0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
        rtl_generic_op(tp, tp->jumbo_ops.enable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
        rtl_generic_op(tp, tp->jumbo_ops.disable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
@@ -6186,6 +6194,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
        struct rtl8169_private *tp = netdev_priv(dev);
+        struct device *d = &pdev->dev;
+        pm_runtime_get_sync(d);
        rtl8169_net_suspend(dev);
@@ -6207,6 +6218,8 @@ static void rtl_shutdown(struct pci_dev *pdev)
                pci_wake_from_d3(pdev, true);
                pci_set_power_state(pdev, PCI_D3hot);
        }
+        pm_runtime_put_noidle(d);
 }
 static struct pci_driver rtl8169_pci_driver = {
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 466c58a7353d..bf01841bda5b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -313,7 +313,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
 static void netvsc_get_drvinfo(struct net_device *net,
                               struct ethtool_drvinfo *info)
 {
-        strcpy(info->driver, "hv_netvsc");
+        strcpy(info->driver, KBUILD_MODNAME);
        strcpy(info->version, HV_DRV_VERSION);
        strcpy(info->fw_version, "N/A");
 }
@@ -485,7 +485,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 /* The one and only one */
 static struct  hv_driver netvsc_drv = {
-        .name = "netvsc",
+        .name = KBUILD_MODNAME,
        .id_table = id_table,
        .probe = netvsc_probe,
        .remove = netvsc_remove,
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fae0fbd8bc88..81b96e303757 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -589,6 +589,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                entry = (struct skb_data *) skb->cb;
                urb = entry->urb;
+                spin_unlock_irqrestore(&q->lock, flags);
                // during some PM-driven resume scenarios,
                // these (async) unlinks complete immediately
                retval = usb_unlink_urb (urb);
@@ -596,6 +597,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                        netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
                else
                        count++;
+                spin_lock_irqsave(&q->lock, flags);
        }
        spin_unlock_irqrestore (&q->lock, flags);
        return count;
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 3dcd3857a36c..756c0f5565a5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,13 +830,8 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                        ctx->l4_hdr_size = ((struct tcphdr *)
                                           skb_transport_header(skb))->doff * 4;
                                else if (iph->protocol == IPPROTO_UDP)
-                                        /*
-                                         * Use tcp header size so that bytes to
-                                         * be copied are more than required by
-                                         * the device.
-                                         */
                                        ctx->l4_hdr_size =
-                                                        sizeof(struct tcphdr);
+                                                        sizeof(struct udphdr);
                                else
                                        ctx->l4_hdr_size = 0;
                        } else {
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ed54797db191..fc46a81ad538 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
 * Version numbers
 */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 #if defined(CONFIG_PCI_MSI)
        /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index f901a17f76ba..86a891f93fc9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
        ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
        ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
        ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
        ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
        return 0;
@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
        ATH_FREE_BANK(ah->analogBank6Data);
        ATH_FREE_BANK(ah->analogBank6TPCData);
        ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
        ATH_FREE_BANK(ah->bank6Temp);
 #undef ATH_FREE_BANK
@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
        if (ah->eep_ops->set_addac)
                ah->eep_ops->set_addac(ah, chan);
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
+        REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
        REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
        ENABLE_REGWRITE_BUFFER(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 11f192a1ceb7..d190411ac8f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
                               ARRAY_SIZE(ar5416Addac), 2);
        }
+        /* iniAddac needs to be modified for these chips */
+        if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
+                struct ar5416IniArray *addac = &ah->iniAddac;
+                u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
+                u32 *data;
+                data = kmalloc(size, GFP_KERNEL);
+                if (!data)
+                        return;
+                memcpy(data, addac->ia_array, size);
+                addac->ia_array = data;
+                if (!AR_SREV_5416_22_OR_LATER(ah)) {
+                        /* override CLKDRV value */
+                        INI_RA(addac, 31,1) = 0;
+                }
+        }
 }
 /* Support for Japan ch.14 (2484) spread */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6a29004a71b0..c8261d4fc780 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,7 +940,6 @@ struct ath_hw {
        u32 *analogBank6Data;
        u32 *analogBank6TPCData;
        u32 *analogBank7Data;
-        u32 *addac5416_21;
        u32 *bank6Temp;
        u8 txpower_limit;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d19a9ee9d057..bbc813dee983 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1234,6 +1234,7 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
 {
        struct ieee80211_sta *sta;
        struct carl9170_sta_info *sta_info;
+        struct ieee80211_tx_info *tx_info;
        rcu_read_lock();
        sta = __carl9170_get_tx_sta(ar, skb);
@@ -1241,16 +1242,18 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
                goto out_rcu;
        sta_info = (void *) sta->drv_priv;
-        if (unlikely(sta_info->sleeping)) {
+        tx_info = IEEE80211_SKB_CB(skb);
-                struct ieee80211_tx_info *tx_info;
+        if (unlikely(sta_info->sleeping) &&
+            !(tx_info->flags & (IEEE80211_TX_CTL_POLL_RESPONSE |
+                                IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
                rcu_read_unlock();
-                tx_info = IEEE80211_SKB_CB(skb);
                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
                        atomic_dec(&ar->tx_ampdu_upload);
                tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                carl9170_release_dev_space(ar, skb);
                carl9170_tx_status(ar, skb, false);
                return true;
        }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 90911eec0cf5..30b58870b1b6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,17 +1051,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                }
                /* either retransmit or send bar if ack not recd */
                if (!ack_recd) {
-                        struct ieee80211_tx_rate *txrate =
+                        if (retry && (ini->txretry[index] < (int)retry_limit)) {
-                            tx_info->status.rates;
-                        if (retry && (txrate[0].count < (int)retry_limit)) {
                                ini->txretry[index]++;
                                ini->tx_in_transit--;
                                /*
                                 * Use high prededence for retransmit to
                                 * give some punch
                                 */
-                                /* brcms_c_txq_enq(wlc, scb, p,
-                                 * BRCMS_PRIO_TO_PREC(tid)); */
                                brcms_c_txq_enq(wlc, scb, p,
                                                BRCMS_PRIO_TO_HI_PREC(tid));
                        } else {
@@ -1074,9 +1070,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                    IEEE80211_TX_STAT_AMPDU_NO_BACK;
                                skb_pull(p, D11_PHY_HDR_LEN);
                                skb_pull(p, D11_TXH_LEN);
-                                wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
+                                BCMMSG(wiphy,
-                                        "transit %d\n", "AMPDU status", seq,
+                                       "BA Timeout, seq %d, in_transit %d\n",
-                                        ini->tx_in_transit);
+                                       seq, ini->tx_in_transit);
                                ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                            p);
                        }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 64cf439035c3..ca78e91de86c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1240,7 +1240,7 @@ int iwlagn_suspend(struct iwl_priv *priv,
                                .flags = CMD_SYNC,
                                .data[0] = key_data.rsc_tsc,
                                .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                                .len[0] = sizeof(key_data.rsc_tsc),
+                                .len[0] = sizeof(*key_data.rsc_tsc),
                        };
                        ret = iwl_trans_send_cmd(trans(priv), &rsc_tsc_cmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 7353826095f1..e483cfa8d14e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,6 +1187,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
        unsigned long flags;
        struct iwl_addsta_cmd sta_cmd;
        u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
+        __le16 key_flags;
        /* if station isn't there, neither is the key */
        if (sta_id == IWL_INVALID_STATION)
@@ -1212,7 +1213,14 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                IWL_ERR(priv, "offset %d not used in uCode key table.\n",
                        keyconf->hw_key_idx);
-        sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
+                     STA_KEY_FLG_INVALID;
+        if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                key_flags |= STA_KEY_MULTICAST_MSK;
+        sta_cmd.key.key_flags = key_flags;
        sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
        sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
        sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 5b2972b43b0e..2210a0f9af2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -846,6 +846,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
        priv->sec_info.wpa_enabled = false;
        priv->sec_info.wpa2_enabled = false;
        priv->wep_key_curr_index = 0;
+        priv->sec_info.encryption_mode = 0;
        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
        if (mode == NL80211_IFTYPE_ADHOC) {
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..d2a1ea98d0f2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1220,7 +1220,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                cancel_work_sync(&rt2x00dev->rxdone_work);
                cancel_work_sync(&rt2x00dev->txdone_work);
        }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
        /*
         * Free the tx status fifo.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index ea2bd1be2640..91a375fb6ae6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -23,7 +23,6 @@
 #include <asm/machdep.h>
 #endif /* CONFIG_PPC */
-#include <asm/setup.h>
 #include <asm/page.h>
 char *of_fdt_get_string(struct boot_param_header *blob, u32 offset)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 980c079e4443..483c0adcad87 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -182,7 +182,7 @@ struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
        if (!phy_id || sz < sizeof(*phy_id))
                return NULL;
-        sprintf(bus_id, PHY_ID_FMT, "0", be32_to_cpu(phy_id[0]));
+        sprintf(bus_id, PHY_ID_FMT, "fixed-0", be32_to_cpu(phy_id[0]));
        phy = phy_connect(dev, bus_id, hndlr, 0, iface);
        return IS_ERR(phy) ? NULL : phy;
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index a9c46cc2db37..8c33491b21fe 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -1,3 +1,5 @@
+#include <linux/prefetch.h>
 /**
 * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
 * @ioc: The I/O Controller.
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index a87e2728b2c3..64d433ec4fc6 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -328,21 +328,15 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                        goto err1;
        }
-        if (ret) {
+        pxa2xx_configure_sockets(&dev->dev);
-                while (--i >= 0)
+        dev_set_drvdata(&dev->dev, sinfo);
-                        soc_pcmcia_remove_one(&sinfo->skt[i]);
-                kfree(sinfo);
-                clk_put(clk);
-        } else {
-                pxa2xx_configure_sockets(&dev->dev);
-                dev_set_drvdata(&dev->dev, sinfo);
-        }
        return 0;
 err1:
        while (--i >= 0)
                soc_pcmcia_remove_one(&sinfo->skt[i]);
+        clk_put(clk);
        kfree(sinfo);
 err0:
        return ret;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2baadd21b7a6..98fbe62694d4 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -369,9 +369,9 @@ static int __init pps_init(void)
        int err;
        pps_class = class_create(THIS_MODULE, "pps");
-        if (!pps_class) {
+        if (IS_ERR(pps_class)) {
                pr_err("failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(pps_class);
        }
        pps_class->dev_attrs = pps_attrs;
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 691b1ab1a3d0..30d2072f480b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
         */
        mport = priv->mport;
-        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
-        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
        while (wr_ptr != rd_ptr) {
                idb_entry = (u64 *)(priv->idb_base +
                                        (TSI721_IDB_ENTRY_SIZE * rd_ptr));
                rd_ptr++;
+                rd_ptr %= IDB_QSIZE;
                idb.msg = *idb_entry;
                *idb_entry = 0;
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index df33530cec4a..28b81ae4cf7f 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -196,7 +196,7 @@ static const unsigned int LDO12_suspend_table[] = {
 };
 static const unsigned int LDO13_table[] = {
-        1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0, 0,
+        1200000, 1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0,
 };
 static const unsigned int LDO13_suspend_table[] = {
@@ -389,10 +389,10 @@ static struct pm8607_regulator_info pm8607_regulator_info[] = {
        PM8607_LDO( 7,         LDO7, 0, 3, SUPPLIES_EN12, 1),
        PM8607_LDO( 8,         LDO8, 0, 3, SUPPLIES_EN12, 2),
        PM8607_LDO( 9,         LDO9, 0, 3, SUPPLIES_EN12, 3),
-        PM8607_LDO(10,        LDO10, 0, 3, SUPPLIES_EN12, 4),
+        PM8607_LDO(10,        LDO10, 0, 4, SUPPLIES_EN12, 4),
        PM8607_LDO(12,        LDO12, 0, 4, SUPPLIES_EN12, 5),
        PM8607_LDO(13, VIBRATOR_SET, 1, 3,  VIBRATOR_SET, 0),
-        PM8607_LDO(14,        LDO14, 0, 4, SUPPLIES_EN12, 6),
+        PM8607_LDO(14,        LDO14, 0, 3, SUPPLIES_EN12, 6),
 };
 static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 3767364452fd..ea4d8f575ac6 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -260,8 +260,8 @@ static int da9052_set_ldo5_6_voltage(struct regulator_dev *rdev,
         * the LDO activate bit to implment the changes on the
         * LDO output.
        */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
-                                 info->activate_bit);
+                                 info->activate_bit, info->activate_bit);
 }
 static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
@@ -280,8 +280,8 @@ static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
         * the DCDC activate bit to implment the changes on the
         * DCDC output.
        */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
-                                 info->activate_bit);
+                                 info->activate_bit, info->activate_bit);
 }
 static int da9052_get_regulator_voltage_sel(struct regulator_dev *rdev)
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 5c15ba01e9c7..40ecf5165899 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -662,7 +662,7 @@ static int tps65910_set_voltage_dcdc(struct regulator_dev *dev,
                tps65910_reg_write(pmic, TPS65910_VDD2_OP, vsel);
                break;
        case TPS65911_REG_VDDCTRL:
-                vsel = selector;
+                vsel = selector + 3;
                tps65910_reg_write(pmic, TPS65911_VDDCTRL_OP, vsel);
        }
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 9beba49c3c5b..2853c2a6f10f 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -125,6 +125,13 @@ static int __devinit r9701_probe(struct spi_device *spi)
        unsigned char tmp;
        int res;
+        tmp = R100CNT;
+        res = read_regs(&spi->dev, &tmp, 1);
+        if (res || tmp != 0x20) {
+                dev_err(&spi->dev, "cannot read RTC register\n");
+                return -ENODEV;
+        }
        rtc = rtc_device_register("r9701",
                                &spi->dev, &r9701_rtc_ops, THIS_MODULE);
        if (IS_ERR(rtc))
@@ -132,13 +139,6 @@ static int __devinit r9701_probe(struct spi_device *spi)
        dev_set_drvdata(&spi->dev, rtc);
-        tmp = R100CNT;
-        res = read_regs(&spi->dev, &tmp, 1);
-        if (res || tmp != 0x20) {
-                rtc_device_unregister(rtc);
-                return res;
-        }
        return 0;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3ef8d071c64a..770a740a393c 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -167,7 +167,7 @@ again:
        DBF_ERROR("%4x EQBS ERROR", SCH_NO(q));
        DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
        q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
        return 0;
 }
@@ -215,7 +215,7 @@ again:
        DBF_ERROR("%4x SQBS ERROR", SCH_NO(q));
        DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
        q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
        return 0;
 }
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index b31a8e3841d7..d4ed9eb52657 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -69,10 +69,10 @@
 #ifndef SCSI_OSD_MAJOR
 #  define SCSI_OSD_MAJOR 260
 #endif
-#define SCSI_OSD_MAX_MINOR 64
+#define SCSI_OSD_MAX_MINOR MINORMASK
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.2.0";
+static const char *osd_version_string = "open-osd 0.2.1";
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 0cb39ff21171..f8fb2d691c0a 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -408,7 +408,7 @@ int sd_dif_prepare(struct request *rq, sector_t hw_sector, unsigned int sector_s
                        kunmap_atomic(sdt, KM_USER0);
                }
-                bio->bi_flags |= BIO_MAPPED_INTEGRITY;
+                bio->bi_flags |= (1 << BIO_MAPPED_INTEGRITY);
        }
        return 0;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 2f9cb43a2398..f37ad2271ad5 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1083,7 +1083,7 @@ err_alloc_rx_sg:
        return -ENOMEM;
 }
-static int __init pl022_dma_probe(struct pl022 *pl022)
+static int __devinit pl022_dma_probe(struct pl022 *pl022)
 {
        dma_cap_mask_t mask;
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b3d17416d86a..830cd62d8492 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -365,7 +365,7 @@ config PPC_EPAPR_HV_BYTECHAN
 config PPC_EARLY_DEBUG_EHV_BC
        bool "Early console (udbg) support for ePAPR hypervisors"
-        depends on PPC_EPAPR_HV_BYTECHAN
+        depends on PPC_EPAPR_HV_BYTECHAN=y
        help
          Select this option to enable early console (a.k.a. "udbg") support
          via an ePAPR byte channel.  You also need to choose the byte channel
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index c26a82e83f6e..b556a72264d1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -239,7 +239,7 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
        ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 }
-static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
+static void ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 {
        struct usb_hcd *hcd = ehci_to_hcd(ehci);
        struct fsl_usb2_platform_data *pdata;
@@ -299,19 +299,12 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 #endif
                out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
        }
-        if (!(in_be32(non_ehci + FSL_SOC_USB_CTRL) & CTRL_PHY_CLK_VALID)) {
-                printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_fsl_reinit(struct ehci_hcd *ehci)
 {
-        if (ehci_fsl_usb_setup(ehci))
+        ehci_fsl_usb_setup(ehci);
-                return -ENODEV;
        ehci_port_power(ehci, 0);
        return 0;
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index bdf43e2adc51..491806221165 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -45,6 +45,5 @@
 #define FSL_SOC_USB_PRICTRL     0x40c   /* NOTE: big-endian */
 #define FSL_SOC_USB_SICTRL      0x410   /* NOTE: big-endian */
 #define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
-#define CTRL_PHY_CLK_VALID      (1 << 17)
 #define SNOOP_SIZE_2GB          0x1e
 #endif                          /* _EHCI_FSL_H */
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
index 74d29b552901..408a9927be92 100644
--- a/drivers/video/omap2/displays/Kconfig
+++ b/drivers/video/omap2/displays/Kconfig
@@ -12,7 +12,7 @@ config PANEL_GENERIC_DPI
 config PANEL_DVI
        tristate "DVI output"
-        depends on OMAP2_DSS_DPI
+        depends on OMAP2_DSS_DPI && I2C
        help
          Driver for external monitors, connected via DVI. The driver uses i2c
          to read EDID information from the monitor.
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/omap2/dss/apply.c
index 052dc874cd3d..87b3e25294cf 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -1276,6 +1276,9 @@ int dss_ovl_enable(struct omap_overlay *ovl)
        spin_unlock_irqrestore(&data_lock, flags);
+        /* wait for overlay to be enabled */
+        wait_pending_extra_info_updates();
        mutex_unlock(&apply_lock);
        return 0;
@@ -1313,6 +1316,9 @@ int dss_ovl_disable(struct omap_overlay *ovl)
        spin_unlock_irqrestore(&data_lock, flags);
+        /* wait for the overlay to be disabled */
+        wait_pending_extra_info_updates();
        mutex_unlock(&apply_lock);
        return 0;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index d7aa3b056529..a36b934b2db4 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -165,9 +165,25 @@ static int hdmi_runtime_get(void)
        DSSDBG("hdmi_runtime_get\n");
+        /*
+         * HACK: Add dss_runtime_get() to ensure DSS clock domain is enabled.
+         * This should be removed later.
+         */
+        r = dss_runtime_get();
+        if (r < 0)
+                goto err_get_dss;
        r = pm_runtime_get_sync(&hdmi.pdev->dev);
        WARN_ON(r < 0);
-        return r < 0 ? r : 0;
+        if (r < 0)
+                goto err_get_hdmi;
+        return 0;
+err_get_hdmi:
+        dss_runtime_put();
+err_get_dss:
+        return r;
 }
 static void hdmi_runtime_put(void)
@@ -178,6 +194,12 @@ static void hdmi_runtime_put(void)
        r = pm_runtime_put_sync(&hdmi.pdev->dev);
        WARN_ON(r < 0);
+        /*
+         * HACK: This is added to complement the dss_runtime_get() call in
+         * hdmi_runtime_get(). This should be removed later.
+         */
+        dss_runtime_put();
 }
 int hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
index 2d72334ca3da..6847a478b459 100644
--- a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
+++ b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
@@ -479,14 +479,7 @@ int ti_hdmi_4xxx_read_edid(struct hdmi_ip_data *ip_data,
 bool ti_hdmi_4xxx_detect(struct hdmi_ip_data *ip_data)
 {
-        int r;
+        return gpio_get_value(ip_data->hpd_gpio);
-        void __iomem *base = hdmi_core_sys_base(ip_data);
-        /* HPD */
-        r = REG_GET(base, HDMI_CORE_SYS_SYS_STAT, 1, 1);
-        return r == 1;
 }
 static void hdmi_core_init(struct hdmi_core_video_config *video_cfg,
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index d5aaca9cfa7e..8497727d66de 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -1810,7 +1810,11 @@ static void hw_init(void)
                break;
        }
+        /* magic required on VX900 for correct modesetting on IGA1 */
+        via_write_reg_mask(VIACR, 0x45, 0x00, 0x01);
        /* probably this should go to the scaling code one day */
+        via_write_reg_mask(VIACR, 0xFD, 0, 0x80); /* VX900 hw scale on IGA2 */
        viafb_write_regx(scaling_parameters, ARRAY_SIZE(scaling_parameters));
        /* Fill VPIT Parameters */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 95aeedf198f8..958e5129c601 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -367,29 +367,45 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 #ifdef CONFIG_PM
 static int virtballoon_freeze(struct virtio_device *vdev)
 {
+        struct virtio_balloon *vb = vdev->priv;
        /*
         * The kthread is already frozen by the PM core before this
         * function is called.
         */
+        while (vb->num_pages)
+                leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
        /* Ensure we don't get any more requests from the host */
        vdev->config->reset(vdev);
        vdev->config->del_vqs(vdev);
        return 0;
 }
+static int restore_common(struct virtio_device *vdev)
+{
+        struct virtio_balloon *vb = vdev->priv;
+        int ret;
+        ret = init_vqs(vdev->priv);
+        if (ret)
+                return ret;
+        fill_balloon(vb, towards_target(vb));
+        update_balloon_size(vb);
+        return 0;
+}
 static int virtballoon_thaw(struct virtio_device *vdev)
 {
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 static int virtballoon_restore(struct virtio_device *vdev)
 {
        struct virtio_balloon *vb = vdev->priv;
-        struct page *page, *page2;
-        /* We're starting from a clean slate */
-        vb->num_pages = 0;
        /*
         * If a request wasn't complete at the time of freezing, this
@@ -397,12 +413,7 @@ static int virtballoon_restore(struct virtio_device *vdev)
         */
        vb->need_stats_update = 0;
-        /* We don't have these pages in the balloon anymore! */
+        return restore_common(vdev);
-        list_for_each_entry_safe(page, page2, &vb->pages, lru) {
-                list_del(&page->lru);
-                totalram_pages++;
-        }
-        return init_vqs(vdev->priv);
 }
 #endif
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 877b107f77a7..df9e8f0e327d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1098,7 +1098,7 @@ config BOOKE_WDT_DEFAULT_TIMEOUT
          For Freescale Book-E processors, this is a number between 0 and 63.
          For other Book-E processors, this is a number between 0 and 3.
-          The value can be overidden by the wdt_period command-line parameter.
+          The value can be overridden by the wdt_period command-line parameter.
 # PPC64 Architecture
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 337265b47305..7c0fdfca2646 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -198,9 +198,13 @@ static long booke_wdt_ioctl(struct file *file,
                booke_wdt_period = tmp;
 #endif
                booke_wdt_set();
-                return 0;
+                /* Fall */
        case WDIOC_GETTIMEOUT:
+#ifdef  CONFIG_FSL_BOOKE
+                return put_user(period_to_sec(booke_wdt_period), p);
+#else
                return put_user(booke_wdt_period, p);
+#endif
        default:
                return -ENOTTY;
        }
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8464ea1c36a1..3c166d3f4e55 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,7 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
        cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
-        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
+        set_memory_x((unsigned long)bios32_map, 2);
        asminline_call(&cmn_regs, bios32_entrypoint);
        if (cmn_regs.u1.ral != 0) {
@@ -250,7 +250,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                        cru_rom_addr =
                                ioremap(cru_physical_address, cru_length);
                        if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
+                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
+                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
                                retval = 0;
                        }
                }
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 8e210aafdfd0..dfae030a7ef2 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
        wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (wdt_mem == NULL) {
                printk(KERN_INFO MODULE_NAME
-                        "failed to get memory region resouce\n");
+                        "failed to get memory region resource\n");
                return -ENOENT;
        }
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 4bc3744e14e4..404172f02c9b 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -312,18 +312,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
        dev = &pdev->dev;
        wdt_dev = &pdev->dev;
-        /* get the memory region for the watchdog timer */
        wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (wdt_mem == NULL) {
                dev_err(dev, "no memory resource specified\n");
                return -ENOENT;
        }
+        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (wdt_irq == NULL) {
+                dev_err(dev, "no irq resource specified\n");
+                ret = -ENOENT;
+                goto err;
+        }
+        /* get the memory region for the watchdog timer */
        size = resource_size(wdt_mem);
        if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
                dev_err(dev, "failed to get memory region\n");
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
        }
        wdt_base = ioremap(wdt_mem->start, size);
@@ -335,29 +343,17 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
        DBG("probe: mapped wdt_base=%p\n", wdt_base);
-        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (wdt_irq == NULL) {
-                dev_err(dev, "no irq resource specified\n");
-                ret = -ENOENT;
-                goto err_map;
-        }
-        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
-        if (ret != 0) {
-                dev_err(dev, "failed to install irq (%d)\n", ret);
-                goto err_map;
-        }
        wdt_clock = clk_get(&pdev->dev, "watchdog");
        if (IS_ERR(wdt_clock)) {
                dev_err(dev, "failed to find watchdog clock source\n");
                ret = PTR_ERR(wdt_clock);
-                goto err_irq;
+                goto err_map;
        }
        clk_enable(wdt_clock);
-        if (s3c2410wdt_cpufreq_register() < 0) {
+        ret = s3c2410wdt_cpufreq_register();
+        if (ret < 0) {
                printk(KERN_ERR PFX "failed to register cpufreq\n");
                goto err_clk;
        }
@@ -378,12 +374,18 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
                                                        "cannot start\n");
        }
+        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
+        if (ret != 0) {
+                dev_err(dev, "failed to install irq (%d)\n", ret);
+                goto err_cpufreq;
+        }
        watchdog_set_nowayout(&s3c2410_wdd, nowayout);
        ret = watchdog_register_device(&s3c2410_wdd);
        if (ret) {
                dev_err(dev, "cannot register watchdog (%d)\n", ret);
-                goto err_cpufreq;
+                goto err_irq;
        }
        if (tmr_atboot && started == 0) {
@@ -408,23 +410,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
        return 0;
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
 err_cpufreq:
        s3c2410wdt_cpufreq_deregister();
 err_clk:
        clk_disable(wdt_clock);
        clk_put(wdt_clock);
+        wdt_clock = NULL;
- err_irq:
-        free_irq(wdt_irq->start, pdev);
 err_map:
        iounmap(wdt_base);
 err_req:
        release_mem_region(wdt_mem->start, size);
-        wdt_mem = NULL;
+ err:
+        wdt_irq = NULL;
+        wdt_mem = NULL;
        return ret;
 }
@@ -432,18 +437,18 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
        watchdog_unregister_device(&s3c2410_wdd);
+        free_irq(wdt_irq->start, dev);
        s3c2410wdt_cpufreq_deregister();
        clk_disable(wdt_clock);
        clk_put(wdt_clock);
        wdt_clock = NULL;
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
        iounmap(wdt_base);
        release_mem_region(wdt_mem->start, resource_size(wdt_mem));
+        wdt_irq = NULL;
        wdt_mem = NULL;
        return 0;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 969beb0e2231..b9d64d89a043 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
        call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-        BUG_ON(atomic_read(&kioctx->users) <= 0);
-        atomic_inc(&kioctx->users);
-}
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
        return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
        mm = ctx->mm = current->mm;
        atomic_inc(&mm->mm_count);
-        atomic_set(&ctx->users, 1);
+        atomic_set(&ctx->users, 2);
        spin_lock_init(&ctx->ctx_lock);
        spin_lock_init(&ctx->ring_info.ring_lock);
        init_waitqueue_head(&ctx->wait);
@@ -490,6 +484,8 @@ static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
                kmem_cache_free(kiocb_cachep, req);
                ctx->reqs_active--;
        }
+        if (unlikely(!ctx->reqs_active && ctx->dead))
+                wake_up_all(&ctx->wait);
        spin_unlock_irq(&ctx->ctx_lock);
 }
@@ -607,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
                        fput(req->ki_filp);
                /* Link the iocb into the context's free list */
+                rcu_read_lock();
                spin_lock_irq(&ctx->ctx_lock);
                really_put_req(ctx, req);
+                /*
+                 * at that point ctx might've been killed, but actual
+                 * freeing is RCU'd
+                 */
                spin_unlock_irq(&ctx->ctx_lock);
+                rcu_read_unlock();
-                put_ioctx(ctx);
                spin_lock_irq(&fput_lock);
        }
        spin_unlock_irq(&fput_lock);
@@ -642,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
         * this function will be executed w/out any aio kthread wakeup.
         */
        if (unlikely(!fput_atomic(req->ki_filp))) {
-                get_ioctx(ctx);
                spin_lock(&fput_lock);
                list_add(&req->ki_list, &fput_head);
                spin_unlock(&fput_lock);
@@ -1336,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
        ret = PTR_ERR(ioctx);
        if (!IS_ERR(ioctx)) {
                ret = put_user(ioctx->user_id, ctxp);
-                if (!ret)
+                if (!ret) {
+                        put_ioctx(ioctx);
                        return 0;
+                }
-                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
                io_destroy(ioctx);
        }
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index a6395bdb26ae..1ff94054d35a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -259,6 +259,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
        current->mm->free_area_cache = current->mm->mmap_base;
        current->mm->cached_hole_size = 0;
+        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
        install_exec_creds(bprm);
        current->flags &= ~PF_FORKNOEXEC;
@@ -352,13 +359,6 @@ beyond_if:
                return retval;
        }
-        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) { 
-                /* Someone check-me: is this error path enough? */ 
-                send_sig(SIGKILL, current, 0); 
-                return retval;
-        }
        current->mm->start_stack =
                (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bcb884e2d613..07d096c49920 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1421,7 +1421,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
        for (i = 1; i < view->n; ++i) {
                const struct user_regset *regset = &view->regsets[i];
                do_thread_regset_writeback(t->task, regset);
-                if (regset->core_note_type &&
+                if (regset->core_note_type && regset->get &&
                    (!regset->active || regset->active(t->task, regset))) {
                        int ret;
                        size_t size = regset->n * regset->size;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 98f6bf10bbd4..0436c12da8c2 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -583,7 +583,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
        struct btrfs_path *path;
        struct btrfs_key info_key = { 0 };
        struct btrfs_delayed_ref_root *delayed_refs = NULL;
-        struct btrfs_delayed_ref_head *head = NULL;
+        struct btrfs_delayed_ref_head *head;
        int info_level = 0;
        int ret;
        struct list_head prefs_delayed;
@@ -607,6 +607,8 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
         * at a specified point in time
         */
 again:
+        head = NULL;
        ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
        if (ret < 0)
                goto out;
@@ -635,8 +637,10 @@ again:
                        goto again;
                }
                ret = __add_delayed_refs(head, seq, &info_key, &prefs_delayed);
-                if (ret)
+                if (ret) {
+                        spin_unlock(&delayed_refs->lock);
                        goto out;
+                }
        }
        spin_unlock(&delayed_refs->lock);
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 2373b39a132b..22db04550f6a 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -305,7 +305,7 @@ again:
        spin_lock(&fs_info->reada_lock);
        ret = radix_tree_insert(&dev->reada_zones,
-                                (unsigned long)zone->end >> PAGE_CACHE_SHIFT,
+                                (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                zone);
        spin_unlock(&fs_info->reada_lock);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 63a196b97d50..bc7e24420ac0 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                         * If either that or op not supported returned, follow
                         * the normal lookup.
                         */
-                        if ((rc == 0) || (rc == -ENOENT))
+                        switch (rc) {
+                        case 0:
+                                /*
+                                 * The server may allow us to open things like
+                                 * FIFOs, but the client isn't set up to deal
+                                 * with that. If it's not a regular file, just
+                                 * close it and proceed as if it were a normal
+                                 * lookup.
+                                 */
+                                if (newInode && !S_ISREG(newInode->i_mode)) {
+                                        CIFSSMBClose(xid, pTcon, fileHandle);
+                                        break;
+                                }
+                        case -ENOENT:
                                posix_open = true;
-                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+                        case -EOPNOTSUPP:
+                                break;
+                        default:
                                pTcon->broken_posix_open = true;
+                        }
                }
                if (!posix_open)
                        rc = cifs_get_inode_info_unix(&newInode, full_path,
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a5f54b7d9822..745da3d0653e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -534,6 +534,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
        if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                fattr->cf_dtype = DT_DIR;
+                /*
+                 * Server can return wrong NumberOfLinks value for directories
+                 * when Unix extensions are disabled - fake it.
+                 */
+                fattr->cf_nlink = 2;
        } else {
                fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
                fattr->cf_dtype = DT_REG;
@@ -541,9 +546,9 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                /* clear write bits if ATTR_READONLY is set */
                if (fattr->cf_cifsattrs & ATTR_READONLY)
                        fattr->cf_mode &= ~(S_IWUGO);
-        }
-        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+        }
        fattr->cf_uid = cifs_sb->mnt_uid;
        fattr->cf_gid = cifs_sb->mnt_gid;
@@ -1322,7 +1327,6 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                        }
 /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
        to set uid/gid */
-                        inc_nlink(inode);
                        cifs_unix_basic_to_fattr(&fattr, pInfo, cifs_sb);
                        cifs_fill_uniqueid(inode->i_sb, &fattr);
@@ -1355,7 +1359,6 @@ mkdir_retry_old:
                d_drop(direntry);
        } else {
 mkdir_get_info:
-                inc_nlink(inode);
                if (pTcon->unix_ext)
                        rc = cifs_get_inode_info_unix(&newinode, full_path,
                                                      inode->i_sb, xid);
@@ -1436,6 +1439,11 @@ mkdir_get_info:
                }
        }
 mkdir_out:
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        CIFS_I(inode)->time = 0;
        kfree(full_path);
        FreeXid(xid);
        cifs_put_tlink(tlink);
@@ -1475,7 +1483,6 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        cifs_put_tlink(tlink);
        if (!rc) {
-                drop_nlink(inode);
                spin_lock(&direntry->d_inode->i_lock);
                i_size_write(direntry->d_inode, 0);
                clear_nlink(direntry->d_inode);
@@ -1483,12 +1490,15 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
        }
        cifsInode = CIFS_I(direntry->d_inode);
-        cifsInode->time = 0;    /* force revalidate to go get info when
+        /* force revalidate to go get info when needed */
-                                   needed */
+        cifsInode->time = 0;
        cifsInode = CIFS_I(inode);
-        cifsInode->time = 0;    /* force revalidate to get parent dir info
+        /*
-                                   since cached search results now invalid */
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        cifsInode->time = 0;
        direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                current_fs_time(inode->i_sb);
diff --git a/fs/dcache.c b/fs/dcache.c
index fe19ac13f75f..bcbdb33fcc20 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -104,7 +104,7 @@ static unsigned int d_hash_shift __read_mostly;
 static struct hlist_bl_head *dentry_hashtable __read_mostly;
-static inline struct hlist_bl_head *d_hash(struct dentry *parent,
+static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
                                        unsigned long hash)
 {
        hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
@@ -137,6 +137,26 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
 }
 #endif
+/*
+ * Compare 2 name strings, return 0 if they match, otherwise non-zero.
+ * The strings are both count bytes long, and count is non-zero.
+ */
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
+        if (scount != tcount)
+                return 1;
+        do {
+                if (*cs != *ct)
+                        return 1;
+                cs++;
+                ct++;
+                tcount--;
+        } while (tcount);
+        return 0;
+}
 static void __d_free(struct rcu_head *head)
 {
        struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
@@ -1717,8 +1737,9 @@ EXPORT_SYMBOL(d_add_ci);
 * child is looked up. Thus, an interlocking stepping of sequence lock checks
 * is formed, giving integrity down the path walk.
 */
-struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
+struct dentry *__d_lookup_rcu(const struct dentry *parent,
-                                unsigned *seq, struct inode **inode)
+                                const struct qstr *name,
+                                unsigned *seqp, struct inode **inode)
 {
        unsigned int len = name->len;
        unsigned int hash = name->hash;
@@ -1748,6 +1769,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
         * See Documentation/filesystems/path-lookup.txt for more details.
         */
        hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
+                unsigned seq;
                struct inode *i;
                const char *tname;
                int tlen;
@@ -1756,7 +1778,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
                        continue;
 seqretry:
-                *seq = read_seqcount_begin(&dentry->d_seq);
+                seq = read_seqcount_begin(&dentry->d_seq);
                if (dentry->d_parent != parent)
                        continue;
                if (d_unhashed(dentry))
@@ -1771,7 +1793,7 @@ seqretry:
                 * edge of memory when walking. If we could load this
                 * atomically some other way, we could drop this check.
                 */
-                if (read_seqcount_retry(&dentry->d_seq, *seq))
+                if (read_seqcount_retry(&dentry->d_seq, seq))
                        goto seqretry;
                if (unlikely(parent->d_flags & DCACHE_OP_COMPARE)) {
                        if (parent->d_op->d_compare(parent, *inode,
@@ -1788,6 +1810,7 @@ seqretry:
                 * order to do anything useful with the returned dentry
                 * anyway.
                 */
+                *seqp = seq;
                *inode = i;
                return dentry;
        }
diff --git a/fs/exec.c b/fs/exec.c
index 92ce83a11e90..153dee14fe55 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1915,7 +1915,6 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
 {
        struct task_struct *tsk = current;
        struct mm_struct *mm = tsk->mm;
-        struct completion *vfork_done;
        int core_waiters = -EBUSY;
        init_completion(&core_state->startup);
@@ -1927,22 +1926,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                core_waiters = zap_threads(tsk, mm, core_state, exit_code);
        up_write(&mm->mmap_sem);
-        if (unlikely(core_waiters < 0))
+        if (core_waiters > 0)
-                goto fail;
-        /*
-         * Make sure nobody is waiting for us to release the VM,
-         * otherwise we can deadlock when we wait on each other
-         */
-        vfork_done = tsk->vfork_done;
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
-        if (core_waiters)
                wait_for_completion(&core_state->startup);
-fail:
        return core_waiters;
 }
diff --git a/fs/namei.c b/fs/namei.c
index a780ea515c47..e2ba62820a0f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1374,6 +1374,34 @@ static inline int can_lookup(struct inode *inode)
        return 1;
 }
+unsigned int full_name_hash(const unsigned char *name, unsigned int len)
+{
+        unsigned long hash = init_name_hash();
+        while (len--)
+                hash = partial_name_hash(*name++, hash);
+        return end_name_hash(hash);
+}
+EXPORT_SYMBOL(full_name_hash);
+/*
+ * We know there's a real path component here of at least
+ * one character.
+ */
+static inline unsigned long hash_name(const char *name, unsigned int *hashp)
+{
+        unsigned long hash = init_name_hash();
+        unsigned long len = 0, c;
+        c = (unsigned char)*name;
+        do {
+                len++;
+                hash = partial_name_hash(c, hash);
+                c = (unsigned char)name[len];
+        } while (c && c != '/');
+        *hashp = end_name_hash(hash);
+        return len;
+}
 /*
 * Name resolution.
 * This is the basic name resolution function, turning a pathname into
@@ -1394,31 +1422,22 @@ static int link_path_walk(const char *name, struct nameidata *nd)
        /* At this point we know we have a real path component. */
        for(;;) {
-                unsigned long hash;
                struct qstr this;
-                unsigned int c;
+                long len;
                int type;
                err = may_lookup(nd);
                if (err)
                        break;
+                len = hash_name(name, &this.hash);
                this.name = name;
-                c = *(const unsigned char *)name;
+                this.len = len;
-                hash = init_name_hash();
-                do {
-                        name++;
-                        hash = partial_name_hash(c, hash);
-                        c = *(const unsigned char *)name;
-                } while (c && (c != '/'));
-                this.len = name - (const char *) this.name;
-                this.hash = end_name_hash(hash);
                type = LAST_NORM;
-                if (this.name[0] == '.') switch (this.len) {
+                if (name[0] == '.') switch (len) {
                        case 2:
-                                if (this.name[1] == '.') {
+                                if (name[1] == '.') {
                                        type = LAST_DOTDOT;
                                        nd->flags |= LOOKUP_JUMPED;
                                }
@@ -1437,12 +1456,18 @@ static int link_path_walk(const char *name, struct nameidata *nd)
                        }
                }
-                /* remove trailing slashes? */
+                if (!name[len])
-                if (!c)
                        goto last_component;
-                while (*++name == '/');
+                /*
-                if (!*name)
+                 * If it wasn't NUL, we know it was '/'. Skip that
+                 * slash, and continue until no more slashes.
+                 */
+                do {
+                        len++;
+                } while (unlikely(name[len] == '/'));
+                if (!name[len])
                        goto last_component;
+                name += len;
                err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
                if (err < 0)
@@ -1775,24 +1800,21 @@ static struct dentry *lookup_hash(struct nameidata *nd)
 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 {
        struct qstr this;
-        unsigned long hash;
        unsigned int c;
        WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
        this.name = name;
        this.len = len;
+        this.hash = full_name_hash(name, len);
        if (!len)
                return ERR_PTR(-EACCES);
-        hash = init_name_hash();
        while (len--) {
                c = *(const unsigned char *)name++;
                if (c == '/' || c == '\0')
                        return ERR_PTR(-EACCES);
-                hash = partial_name_hash(c, hash);
        }
-        this.hash = end_name_hash(hash);
        /*
         * See if the low-level filesystem might want
         * to use its own hash..
diff --git a/include/asm-generic/iomap.h b/include/asm-generic/iomap.h
index 8a3d4fde2604..6afd7d6a9899 100644
--- a/include/asm-generic/iomap.h
+++ b/include/asm-generic/iomap.h
@@ -70,7 +70,7 @@ extern void ioport_unmap(void __iomem *);
 /* Destroy a virtual mapping cookie for a PCI BAR (memory or IO) */
 struct pci_dev;
 extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
-#else
+#elif defined(CONFIG_GENERIC_IOMAP)
 struct pci_dev;
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 { }
diff --git a/include/asm-generic/pci_iomap.h b/include/asm-generic/pci_iomap.h
index e58fcf891370..ce37349860fe 100644
--- a/include/asm-generic/pci_iomap.h
+++ b/include/asm-generic/pci_iomap.h
@@ -25,7 +25,7 @@ extern void __iomem *__pci_ioport_map(struct pci_dev *dev, unsigned long port,
 #define __pci_ioport_map(dev, port, nr) ioport_map((port), (nr))
 #endif
-#else
+#elif defined(CONFIG_GENERIC_PCI_IOMAP)
 static inline void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
        return NULL;
diff --git a/include/drm/Kbuild b/include/drm/Kbuild
index a5c0e10fd47d..1e38a19d68f6 100644
--- a/include/drm/Kbuild
+++ b/include/drm/Kbuild
@@ -2,6 +2,7 @@ header-y += drm.h
 header-y += drm_fourcc.h
 header-y += drm_mode.h
 header-y += drm_sarea.h
+header-y += exynos_drm.h
 header-y += i810_drm.h
 header-y += i915_drm.h
 header-y += mga_drm.h
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 5e120f1c5cd9..1ed3aae893a5 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -97,15 +97,30 @@ struct drm_exynos_plane_set_zpos {
 #define DRM_IOCTL_EXYNOS_PLANE_SET_ZPOS DRM_IOWR(DRM_COMMAND_BASE + \
                DRM_EXYNOS_PLANE_SET_ZPOS, struct drm_exynos_plane_set_zpos)
+#ifdef __KERNEL__
 /**
- * Platform Specific Structure for DRM based FIMD.
+ * A structure for lcd panel information.
 *
 * @timing: default video mode for initializing
+ * @width_mm: physical size of lcd width.
+ * @height_mm: physical size of lcd height.
+ */
+struct exynos_drm_panel_info {
+        struct fb_videomode timing;
+        u32 width_mm;
+        u32 height_mm;
+};
+/**
+ * Platform Specific Structure for DRM based FIMD.
+ *
+ * @panel: default panel info for initializing
 * @default_win: default window layer number to be used for UI.
 * @bpp: default bit per pixel.
 */
 struct exynos_drm_fimd_pdata {
-        struct fb_videomode             timing;
+        struct exynos_drm_panel_info panel;
        u32                             vidcon0;
        u32                             vidcon1;
        unsigned int                    default_win;
@@ -139,4 +154,5 @@ struct exynos_drm_hdmi_pdata {
        unsigned int                    bpp;
 };
-#endif
+#endif  /* __KERNEL__ */
+#endif  /* _EXYNOS_DRM_H_ */
diff --git a/include/linux/amba/serial.h b/include/linux/amba/serial.h
index 514ed45c462e..d117b29d1062 100644
--- a/include/linux/amba/serial.h
+++ b/include/linux/amba/serial.h
@@ -23,6 +23,8 @@
 #ifndef ASM_ARM_HARDWARE_SERIAL_AMBA_H
 #define ASM_ARM_HARDWARE_SERIAL_AMBA_H
+#include <linux/types.h>
 /* -------------------------------------------------------------------------------
 *  From AMBA UART (PL010) Block Specification
 * -------------------------------------------------------------------------------
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d64a55b23afd..ff5f5256d175 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -47,27 +47,6 @@ struct dentry_stat_t {
 };
 extern struct dentry_stat_t dentry_stat;
-/*
- * Compare 2 name strings, return 0 if they match, otherwise non-zero.
- * The strings are both count bytes long, and count is non-zero.
- */
-static inline int dentry_cmp(const unsigned char *cs, size_t scount,
-                                const unsigned char *ct, size_t tcount)
-{
-        int ret;
-        if (scount != tcount)
-                return 1;
-        do {
-                ret = (*cs != *ct);
-                if (ret)
-                        break;
-                cs++;
-                ct++;
-                tcount--;
-        } while (tcount);
-        return ret;
-}
 /* Name hashing routines. Initial hash value */
 /* Hash courtesy of the R5 hash in reiserfs modulo sign bits */
 #define init_name_hash()                0
@@ -89,14 +68,7 @@ static inline unsigned long end_name_hash(unsigned long hash)
 }
 /* Compute the hash for a name string. */
-static inline unsigned int
+extern unsigned int full_name_hash(const unsigned char *, unsigned int);
-full_name_hash(const unsigned char *name, unsigned int len)
-{
-        unsigned long hash = init_name_hash();
-        while (len--)
-                hash = partial_name_hash(*name++, hash);
-        return end_name_hash(hash);
-}
 /*
 * Try to keep struct dentry aligned on 64 byte cachelines (this will
@@ -309,7 +281,8 @@ extern struct dentry *d_ancestor(struct dentry *, struct dentry *);
 extern struct dentry *d_lookup(struct dentry *, struct qstr *);
 extern struct dentry *d_hash_and_lookup(struct dentry *, struct qstr *);
 extern struct dentry *__d_lookup(struct dentry *, struct qstr *);
-extern struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
+extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
                                unsigned *seq, struct inode **inode);
 /**
diff --git a/include/linux/kmsg_dump.h b/include/linux/kmsg_dump.h
index fee66317e071..35f7237ec972 100644
--- a/include/linux/kmsg_dump.h
+++ b/include/linux/kmsg_dump.h
@@ -15,13 +15,18 @@
 #include <linux/errno.h>
 #include <linux/list.h>
+/*
+ * Keep this list arranged in rough order of priority. Anything listed after
+ * KMSG_DUMP_OOPS will not be logged by default unless printk.always_kmsg_dump
+ * is passed to the kernel.
+ */
 enum kmsg_dump_reason {
-        KMSG_DUMP_OOPS,
        KMSG_DUMP_PANIC,
+        KMSG_DUMP_OOPS,
+        KMSG_DUMP_EMERG,
        KMSG_DUMP_RESTART,
        KMSG_DUMP_HALT,
        KMSG_DUMP_POWEROFF,
-        KMSG_DUMP_EMERG,
 };
 /**
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 4d34356fe644..b80de520670b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -129,7 +129,6 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                        struct page *newpage);
-extern void mem_cgroup_reset_owner(struct page *page);
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern int do_swap_account;
 #endif
@@ -392,10 +391,6 @@ static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
                                struct page *newpage)
 {
 }
-static inline void mem_cgroup_reset_owner(struct page *page)
-{
-}
 #endif /* CONFIG_CGROUP_MEM_CONT */
 #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
diff --git a/include/linux/of.h b/include/linux/of.h
index a75a831e2057..92cf6ad35e0e 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -281,6 +281,14 @@ static inline struct property *of_find_property(const struct device_node *np,
        return NULL;
 }
+static inline struct device_node *of_find_compatible_node(
+                                                struct device_node *from,
+                                                const char *type,
+                                                const char *compat)
+{
+        return NULL;
+}
 static inline int of_property_read_u32_array(const struct device_node *np,
                                             const char *propname,
                                             u32 *out_values, size_t sz)
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 32cd1f67462e..21638ae14e07 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -348,9 +348,9 @@ do {									\
 #define _this_cpu_generic_to_op(pcp, val, op)                           \
 do {                                                                    \
        unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
        *__this_cpu_ptr(&(pcp)) op val;                                 \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
 } while (0)
 #ifndef this_cpu_write
@@ -449,10 +449,10 @@ do {									\
 ({                                                                      \
        typeof(pcp) ret__;                                              \
        unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
        __this_cpu_add(pcp, val);                                       \
        ret__ = __this_cpu_read(pcp);                                   \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
        ret__;                                                          \
 })
@@ -479,10 +479,10 @@ do {									\
 #define _this_cpu_generic_xchg(pcp, nval)                               \
 ({      typeof(pcp) ret__;                                              \
        unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
        ret__ = __this_cpu_read(pcp);                                   \
        __this_cpu_write(pcp, nval);                                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
        ret__;                                                          \
 })
@@ -507,11 +507,11 @@ do {									\
 ({                                                                      \
        typeof(pcp) ret__;                                              \
        unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
        ret__ = __this_cpu_read(pcp);                                   \
        if (ret__ == (oval))                                            \
                __this_cpu_write(pcp, nval);                            \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
        ret__;                                                          \
 })
@@ -544,10 +544,10 @@ do {									\
 ({                                                                      \
        int ret__;                                                      \
        unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
        ret__ = __this_cpu_generic_cmpxchg_double(pcp1, pcp2,           \
                        oval1, oval2, nval1, nval2);                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
        ret__;                                                          \
 })
@@ -718,12 +718,13 @@ do {									\
 # ifndef __this_cpu_add_return_8
 #  define __this_cpu_add_return_8(pcp, val)     __this_cpu_generic_add_return(pcp, val)
 # endif
-# define __this_cpu_add_return(pcp, val)        __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
+# define __this_cpu_add_return(pcp, val)        \
+        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
-#define __this_cpu_sub_return(pcp, val) this_cpu_add_return(pcp, -(val))
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
-#define __this_cpu_inc_return(pcp)      this_cpu_add_return(pcp, 1)
+#define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
-#define __this_cpu_dec_return(pcp)      this_cpu_add_return(pcp, -1)
+#define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
 #define __this_cpu_generic_xchg(pcp, nval)                              \
 ({      typeof(pcp) ret__;                                              \
diff --git a/include/linux/regset.h b/include/linux/regset.h
index 8abee6556223..686f37327a49 100644
--- a/include/linux/regset.h
+++ b/include/linux/regset.h
@@ -335,8 +335,11 @@ static inline int copy_regset_to_user(struct task_struct *target,
 {
        const struct user_regset *regset = &view->regsets[setno];
+        if (!regset->get)
+                return -EOPNOTSUPP;
        if (!access_ok(VERIFY_WRITE, data, size))
-                return -EIO;
+                return -EFAULT;
        return regset->get(target, regset, offset, size, NULL, data);
 }
@@ -358,8 +361,11 @@ static inline int copy_regset_from_user(struct task_struct *target,
 {
        const struct user_regset *regset = &view->regsets[setno];
+        if (!regset->set)
+                return -EOPNOTSUPP;
        if (!access_ok(VERIFY_READ, data, size))
-                return -EIO;
+                return -EFAULT;
        return regset->set(target, regset, offset, size, NULL, data);
 }
diff --git a/include/linux/sched.h b/include/linux/sched.h
index c298fb9cf5ad..0cd002cc9e6a 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1793,7 +1793,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 /*
 * Per process flags
 */
-#define PF_STARTING     0x00000002      /* being created */
 #define PF_EXITING      0x00000004      /* getting shut down */
 #define PF_EXITPIDONE   0x00000008      /* pi exit done on shut down */
 #define PF_VCPU         0x00000010      /* I'm a virtual CPU */
@@ -2395,7 +2394,7 @@ static inline int thread_group_empty(struct task_struct *p)
 * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring
 * subscriptions and synchronises with wait4().  Also used in procfs.  Also
 * pins the final release of task.io_context.  Also protects ->cpuset and
- * ->cgroup.subsys[].
+ * ->cgroup.subsys[]. And ->vfork_done.
 *
 * Nests both inside and outside of read_lock(&tasklist_lock).
 * It must not be nested with write_lock_irq(&tasklist_lock),
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 46a85c9e1f25..3c7ffdb40dc6 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -412,7 +412,8 @@ struct tcp_sock {
        struct tcp_sack_block recv_sack_cache[4];
-        struct sk_buff *highest_sack;   /* highest skb with SACK received
+        struct sk_buff *highest_sack;   /* skb just after the highest
+                                         * skb with SACKed bit set
                                         * (validity guaranteed only if
                                         * sacked_out > 0)
                                         */
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 06b795dd5906..b94765e38e80 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -35,12 +35,12 @@ struct inet_peer {
        u32                     metrics[RTAX_MAX];
        u32                     rate_tokens;    /* rate limiting for ICMP */
-        int                     redirect_genid;
        unsigned long           rate_last;
        unsigned long           pmtu_expires;
        u32                     pmtu_orig;
        u32                     pmtu_learned;
        struct inetpeer_addr_base redirect_learned;
+        struct list_head        gc_list;
        /*
         * Once inet_peer is queued for deletion (refcnt == -1), following fields
         * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
@@ -96,6 +96,8 @@ static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr,
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
+extern void inetpeer_invalidate_tree(int family);
 /*
 * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
 * tcp_ts_stamp if no refcount is taken on inet_peer
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 42c29bfbcee3..2d80c291fffb 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1364,8 +1364,9 @@ static inline void tcp_push_pending_frames(struct sock *sk)
        }
 }
-/* Start sequence of the highest skb with SACKed bit, valid only if
+/* Start sequence of the skb just after the highest skb with SACKed
- * sacked > 0 or when the caller has ensured validity by itself.
+ * bit, valid only if sacked_out > 0 or when the caller has ensured
+ * validity by itself.
 */
 static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
 {
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index b7971d6f38bf..ee706ce44aa0 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -651,10 +651,10 @@ int __init init_hw_breakpoint(void)
 err_alloc:
        for_each_possible_cpu(err_cpu) {
-                if (err_cpu == cpu)
-                        break;
                for (i = 0; i < TYPE_MAX; i++)
                        kfree(per_cpu(nr_task_bp_pinned[i], cpu));
+                if (err_cpu == cpu)
+                        break;
        }
        return -ENOMEM;
diff --git a/kernel/fork.c b/kernel/fork.c
index e2cd3e2a5ae8..26a7a6707fa7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -668,6 +668,38 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
        return mm;
 }
+static void complete_vfork_done(struct task_struct *tsk)
+{
+        struct completion *vfork;
+        task_lock(tsk);
+        vfork = tsk->vfork_done;
+        if (likely(vfork)) {
+                tsk->vfork_done = NULL;
+                complete(vfork);
+        }
+        task_unlock(tsk);
+}
+static int wait_for_vfork_done(struct task_struct *child,
+                                struct completion *vfork)
+{
+        int killed;
+        freezer_do_not_count();
+        killed = wait_for_completion_killable(vfork);
+        freezer_count();
+        if (killed) {
+                task_lock(child);
+                child->vfork_done = NULL;
+                task_unlock(child);
+        }
+        put_task_struct(child);
+        return killed;
+}
 /* Please note the differences between mmput and mm_release.
 * mmput is called whenever we stop holding onto a mm_struct,
 * error success whatever.
@@ -683,8 +715,6 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
 */
 void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
-        struct completion *vfork_done = tsk->vfork_done;
        /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
        if (unlikely(tsk->robust_list)) {
@@ -704,17 +734,15 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
        /* Get rid of any cached register state */
        deactivate_mm(tsk, mm);
-        /* notify parent sleeping on vfork() */
+        if (tsk->vfork_done)
-        if (vfork_done) {
+                complete_vfork_done(tsk);
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
        /*
         * If we're exiting normally, clear a user-space tid field if
         * requested.  We leave this alone when dying by signal, to leave
         * the value intact in a core dump, and to save the unnecessary
-         * trouble otherwise.  Userland only wants this done for a sys_exit.
+         * trouble, say, a killed vfork parent shouldn't touch this mm.
+         * Userland only wants this done for a sys_exit.
         */
        if (tsk->clear_child_tid) {
                if (!(tsk->flags & PF_SIGNALED) &&
@@ -1018,7 +1046,6 @@ static void copy_flags(unsigned long clone_flags, struct task_struct *p)
        new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
        new_flags |= PF_FORKNOEXEC;
-        new_flags |= PF_STARTING;
        p->flags = new_flags;
 }
@@ -1548,16 +1575,9 @@ long do_fork(unsigned long clone_flags,
                if (clone_flags & CLONE_VFORK) {
                        p->vfork_done = &vfork;
                        init_completion(&vfork);
+                        get_task_struct(p);
                }
-                /*
-                 * We set PF_STARTING at creation in case tracing wants to
-                 * use this to distinguish a fully live task from one that
-                 * hasn't finished SIGSTOP raising yet.  Now we clear it
-                 * and set the child going.
-                 */
-                p->flags &= ~PF_STARTING;
                wake_up_new_task(p);
                /* forking complete and child started to run, tell ptracer */
@@ -1565,10 +1585,8 @@ long do_fork(unsigned long clone_flags,
                        ptrace_event(trace, nr);
                if (clone_flags & CLONE_VFORK) {
-                        freezer_do_not_count();
+                        if (!wait_for_vfork_done(p, &vfork))
-                        wait_for_completion(&vfork);
+                                ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
-                        freezer_count();
-                        ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
                }
        } else {
                nr = PTR_ERR(p);
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 2e48ec0c2e91..c21449f85a2a 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -119,15 +119,20 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
 * For preemptible RCU it is sufficient to call rcu_read_unlock in order
 * to exit the grace period. For classic RCU, a reschedule is required.
 */
-static void rcu_lock_break(struct task_struct *g, struct task_struct *t)
+static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
 {
+        bool can_cont;
        get_task_struct(g);
        get_task_struct(t);
        rcu_read_unlock();
        cond_resched();
        rcu_read_lock();
+        can_cont = pid_alive(g) && pid_alive(t);
        put_task_struct(t);
        put_task_struct(g);
+        return can_cont;
 }
 /*
@@ -154,9 +159,7 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
                        goto unlock;
                if (!--batch_count) {
                        batch_count = HUNG_TASK_BATCHING;
-                        rcu_lock_break(g, t);
+                        if (!rcu_lock_break(g, t))
-                        /* Exit if t or g was unhashed during refresh. */
-                        if (t->state == TASK_DEAD || g->state == TASK_DEAD)
                                goto unlock;
                }
                /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 32313c084442..0f0d4704ddd8 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -985,6 +985,11 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                /* add new interrupt at end of irq queue */
                do {
+                        /*
+                         * Or all existing action->thread_mask bits,
+                         * so we can find the next zero bit for this
+                         * new action.
+                         */
                        thread_mask |= old->thread_mask;
                        old_ptr = &old->next;
                        old = *old_ptr;
@@ -993,14 +998,41 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
        }
        /*
-         * Setup the thread mask for this irqaction. Unlikely to have
+         * Setup the thread mask for this irqaction for ONESHOT. For
-         * 32 resp 64 irqs sharing one line, but who knows.
+         * !ONESHOT irqs the thread mask is 0 so we can avoid a
+         * conditional in irq_wake_thread().
         */
-        if (new->flags & IRQF_ONESHOT && thread_mask == ~0UL) {
+        if (new->flags & IRQF_ONESHOT) {
-                ret = -EBUSY;
+                /*
-                goto out_mask;
+                 * Unlikely to have 32 resp 64 irqs sharing one line,
+                 * but who knows.
+                 */
+                if (thread_mask == ~0UL) {
+                        ret = -EBUSY;
+                        goto out_mask;
+                }
+                /*
+                 * The thread_mask for the action is or'ed to
+                 * desc->thread_active to indicate that the
+                 * IRQF_ONESHOT thread handler has been woken, but not
+                 * yet finished. The bit is cleared when a thread
+                 * completes. When all threads of a shared interrupt
+                 * line have completed desc->threads_active becomes
+                 * zero and the interrupt line is unmasked. See
+                 * handle.c:irq_wake_thread() for further information.
+                 *
+                 * If no thread is woken by primary (hard irq context)
+                 * interrupt handlers, then desc->threads_active is
+                 * also checked for zero to unmask the irq line in the
+                 * affected hard irq flow handlers
+                 * (handle_[fasteoi|level]_irq).
+                 *
+                 * The new action gets the first zero bit of
+                 * thread_mask assigned. See the loop above which or's
+                 * all existing action->thread_mask bits.
+                 */
+                new->thread_mask = 1 << ffz(thread_mask);
        }
-        new->thread_mask = 1 << ffz(thread_mask);
        if (!shared) {
                init_waitqueue_head(&desc->wait_for_threads);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9788c0ec6f43..c62b8546cc90 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1334,8 +1334,10 @@ int __kprobes register_kprobe(struct kprobe *p)
        if (!kernel_text_address((unsigned long) p->addr) ||
            in_kprobes_functions((unsigned long) p->addr) ||
            ftrace_text_reserved(p->addr, p->addr) ||
-            jump_label_text_reserved(p->addr, p->addr))
+            jump_label_text_reserved(p->addr, p->addr)) {
-                goto fail_with_jump_label;
+                ret = -EINVAL;
+                goto cannot_probe;
+        }
        /* User can pass only KPROBE_FLAG_DISABLED to register_kprobe */
        p->flags &= KPROBE_FLAG_DISABLED;
@@ -1352,7 +1354,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                 * its code to prohibit unexpected unloading.
                 */
                if (unlikely(!try_module_get(probed_mod)))
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
                /*
                 * If the module freed .init.text, we couldn't insert
@@ -1361,7 +1363,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                if (within_module_init((unsigned long)p->addr, probed_mod) &&
                    probed_mod->state != MODULE_STATE_COMING) {
                        module_put(probed_mod);
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
                }
                /* ret will be updated by following code */
        }
@@ -1409,7 +1411,7 @@ out:
        return ret;
-fail_with_jump_label:
+cannot_probe:
        preempt_enable();
        jump_label_unlock();
        return ret;
diff --git a/kernel/printk.c b/kernel/printk.c
index 7ca7ba591e21..49a2ae4a8dc7 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -702,6 +702,9 @@ static bool printk_time = 0;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
+static bool always_kmsg_dump;
+module_param_named(always_kmsg_dump, always_kmsg_dump, bool, S_IRUGO | S_IWUSR);
 /* Check if we have any console registered that can be called early in boot. */
 static int have_callable_console(void)
 {
@@ -1766,6 +1769,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
        unsigned long l1, l2;
        unsigned long flags;
+        if ((reason > KMSG_DUMP_OOPS) && !always_kmsg_dump)
+                return;
        /* Theoretically, the log could move on after we do this, but
           there's not a lot we can do about that. The new messages
           will overwrite the start of what we dump. */
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 77cb245f8e7b..0ab9ae8057f0 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -818,17 +818,9 @@ static int __init fixup_activate(void *addr, enum debug_obj_state state)
                if (obj->static_init == 1) {
                        debug_object_init(obj, &descr_type_test);
                        debug_object_activate(obj, &descr_type_test);
-                        /*
+                        return 0;
-                         * Real code should return 0 here ! This is
-                         * not a fixup of some bad behaviour. We
-                         * merily call the debug_init function to keep
-                         * track of the object.
-                         */
-                        return 1;
-                } else {
-                        /* Real code needs to emit a warning here */
                }
-                return 0;
+                return 1;
        case ODEBUG_STATE_ACTIVE:
                debug_object_deactivate(obj, &descr_type_test);
@@ -967,7 +959,7 @@ static void __init debug_objects_selftest(void)
        obj.static_init = 1;
        debug_object_activate(&obj, &descr_type_test);
-        if (check_results(&obj, ODEBUG_STATE_ACTIVE, ++fixups, warnings))
+        if (check_results(&obj, ODEBUG_STATE_ACTIVE, fixups, warnings))
                goto out;
        debug_object_init(&obj, &descr_type_test);
        if (check_results(&obj, ODEBUG_STATE_INIT, ++fixups, ++warnings))
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 8e75003d62f6..38e612e66da5 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -891,9 +891,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
        case 'U':
                return uuid_string(buf, end, ptr, spec, fmt);
        case 'V':
-                return buf + vsnprintf(buf, end > buf ? end - buf : 0,
+                {
-                                       ((struct va_format *)ptr)->fmt,
+                        va_list va;
-                                       *(((struct va_format *)ptr)->va));
+                        va_copy(va, *((struct va_format *)ptr)->va);
+                        buf += vsnprintf(buf, end > buf ? end - buf : 0,
+                                         ((struct va_format *)ptr)->fmt, va);
+                        va_end(va);
+                        return buf;
+                }
        case 'K':
                /*
                 * %pK cannot be used in IRQ context because its test
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 91d3efb25d15..8f7fc394f636 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
                set_pmd_at(mm, haddr, pmd, entry);
                prepare_pmd_huge_pte(pgtable, mm);
                add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                mm->nr_ptes++;
                spin_unlock(&mm->page_table_lock);
        }
@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
        pmd = pmd_mkold(pmd_wrprotect(pmd));
        set_pmd_at(dst_mm, addr, dst_pmd, pmd);
        prepare_pmd_huge_pte(pgtable, dst_mm);
+        dst_mm->nr_ptes++;
        ret = 0;
 out_unlock:
@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
        }
        kfree(pages);
-        mm->nr_ptes++;
        smp_wmb(); /* make pte visible before pmd */
        pmd_populate(mm, pmd, pgtable);
        page_remove_rmap(page);
@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                        VM_BUG_ON(page_mapcount(page) < 0);
                        add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
                        VM_BUG_ON(!PageHead(page));
+                        tlb->mm->nr_ptes--;
                        spin_unlock(&tlb->mm->page_table_lock);
                        tlb_remove_page(tlb, page);
                        pte_free(tlb->mm, pgtable);
@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
                        pte_unmap(pte);
                }
-                mm->nr_ptes++;
                smp_wmb(); /* make pte visible before pmd */
                /*
                 * Up to this point the pmd is present and huge and
@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
        set_pmd_at(mm, address, pmd, _pmd);
        update_mmu_cache(vma, address, _pmd);
        prepare_pmd_huge_pte(pgtable, mm);
-        mm->nr_ptes--;
        spin_unlock(&mm->page_table_lock);
 #ifndef CONFIG_NUMA
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5f34bd8dda34..a876871f6be5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                        set_page_dirty(page);
                list_add(&page->lru, &page_list);
        }
-        spin_unlock(&mm->page_table_lock);
        flush_tlb_range(vma, start, end);
+        spin_unlock(&mm->page_table_lock);
        mmu_notifier_invalidate_range_end(mm, start, end);
        list_for_each_entry_safe(page, tmp, &page_list, lru) {
                page_remove_rmap(page);
diff --git a/mm/ksm.c b/mm/ksm.c
index 1925ffbfb27f..310544a379ae 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -28,7 +28,6 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/memcontrol.h>
 #include <linux/rbtree.h>
 #include <linux/memory.h>
 #include <linux/mmu_notifier.h>
@@ -1572,16 +1571,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
        new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
        if (new_page) {
-                /*
-                 * The memcg-specific accounting when moving
-                 * pages around the LRU lists relies on the
-                 * page's owner (memcg) to be valid.  Usually,
-                 * pages are assigned to a new owner before
-                 * being put on the LRU list, but since this
-                 * is not the case here, the stale owner from
-                 * a previous allocation cycle must be reset.
-                 */
-                mem_cgroup_reset_owner(new_page);
                copy_user_highpage(new_page, page, address, vma);
                SetPageDirty(new_page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 77b5f227e1d8..99f285599501 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -99,9 +99,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
        phys_addr_t this_start, this_end, cand;
        u64 i;
-        /* align @size to avoid excessive fragmentation on reserved array */
-        size = round_up(size, align);
        /* pump up @end */
        if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
                end = memblock.current_limit;
@@ -731,6 +728,9 @@ static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
 {
        phys_addr_t found;
+        /* align @size to avoid excessive fragmentation on reserved array */
+        size = round_up(size, align);
        found = memblock_find_in_range_node(0, max_addr, size, align, nid);
        if (found && !memblock_reserve(found, size))
                return found;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 228d6461c12a..d0e57a3cda18 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1042,6 +1042,19 @@ struct lruvec *mem_cgroup_lru_add_list(struct zone *zone, struct page *page,
        pc = lookup_page_cgroup(page);
        memcg = pc->mem_cgroup;
+        /*
+         * Surreptitiously switch any uncharged page to root:
+         * an uncharged page off lru does nothing to secure
+         * its former mem_cgroup from sudden removal.
+         *
+         * Our caller holds lru_lock, and PageCgroupUsed is updated
+         * under page_cgroup lock: between them, they make all uses
+         * of pc->mem_cgroup safe.
+         */
+        if (!PageCgroupUsed(pc) && memcg != root_mem_cgroup)
+                pc->mem_cgroup = memcg = root_mem_cgroup;
        mz = page_cgroup_zoneinfo(memcg, page);
        /* compound_order() is stabilized through lru_lock */
        MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
@@ -2408,8 +2421,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                       struct page *page,
                                       unsigned int nr_pages,
                                       struct page_cgroup *pc,
-                                       enum charge_type ctype)
+                                       enum charge_type ctype,
+                                       bool lrucare)
 {
+        struct zone *uninitialized_var(zone);
+        bool was_on_lru = false;
        lock_page_cgroup(pc);
        if (unlikely(PageCgroupUsed(pc))) {
                unlock_page_cgroup(pc);
@@ -2420,6 +2437,21 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
         * we don't need page_cgroup_lock about tail pages, becase they are not
         * accessed by any other context at this point.
         */
+        /*
+         * In some cases, SwapCache and FUSE(splice_buf->radixtree), the page
+         * may already be on some other mem_cgroup's LRU.  Take care of it.
+         */
+        if (lrucare) {
+                zone = page_zone(page);
+                spin_lock_irq(&zone->lru_lock);
+                if (PageLRU(page)) {
+                        ClearPageLRU(page);
+                        del_page_from_lru_list(zone, page, page_lru(page));
+                        was_on_lru = true;
+                }
+        }
        pc->mem_cgroup = memcg;
        /*
         * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2443,9 +2475,18 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                break;
        }
+        if (lrucare) {
+                if (was_on_lru) {
+                        VM_BUG_ON(PageLRU(page));
+                        SetPageLRU(page);
+                        add_page_to_lru_list(zone, page, page_lru(page));
+                }
+                spin_unlock_irq(&zone->lru_lock);
+        }
        mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), nr_pages);
        unlock_page_cgroup(pc);
-        WARN_ON_ONCE(PageLRU(page));
        /*
         * "charge_statistics" updated event counter. Then, check it.
         * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
@@ -2643,7 +2684,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
        ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
        if (ret == -ENOMEM)
                return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
        return 0;
 }
@@ -2663,35 +2704,6 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr,
                                        enum charge_type ctype);
-static void
-__mem_cgroup_commit_charge_lrucare(struct page *page, struct mem_cgroup *memcg,
-                                        enum charge_type ctype)
-{
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        struct zone *zone = page_zone(page);
-        unsigned long flags;
-        bool removed = false;
-        /*
-         * In some case, SwapCache, FUSE(splice_buf->radixtree), the page
-         * is already on LRU. It means the page may on some other page_cgroup's
-         * LRU. Take care of it.
-         */
-        spin_lock_irqsave(&zone->lru_lock, flags);
-        if (PageLRU(page)) {
-                del_page_from_lru_list(zone, page, page_lru(page));
-                ClearPageLRU(page);
-                removed = true;
-        }
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
-        if (removed) {
-                add_page_to_lru_list(zone, page, page_lru(page));
-                SetPageLRU(page);
-        }
-        spin_unlock_irqrestore(&zone->lru_lock, flags);
-        return;
-}
 int mem_cgroup_cache_charge(struct page *page, struct mm_struct *mm,
                                gfp_t gfp_mask)
 {
@@ -2769,13 +2781,16 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                        enum charge_type ctype)
 {
+        struct page_cgroup *pc;
        if (mem_cgroup_disabled())
                return;
        if (!memcg)
                return;
        cgroup_exclude_rmdir(&memcg->css);
-        __mem_cgroup_commit_charge_lrucare(page, memcg, ctype);
+        pc = lookup_page_cgroup(page);
+        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
        /*
         * Now swap is on-memory. This means this page may be
         * counted both as mem and swap....double count.
@@ -3027,23 +3042,6 @@ void mem_cgroup_uncharge_end(void)
        batch->memcg = NULL;
 }
-/*
- * A function for resetting pc->mem_cgroup for newly allocated pages.
- * This function should be called if the newpage will be added to LRU
- * before start accounting.
- */
-void mem_cgroup_reset_owner(struct page *newpage)
-{
-        struct page_cgroup *pc;
-        if (mem_cgroup_disabled())
-                return;
-        pc = lookup_page_cgroup(newpage);
-        VM_BUG_ON(PageCgroupUsed(pc));
-        pc->mem_cgroup = root_mem_cgroup;
-}
 #ifdef CONFIG_SWAP
 /*
 * called after __delete_from_swap_cache() and drop "page" account.
@@ -3248,7 +3246,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
        else
                ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
        return ret;
 }
@@ -3332,7 +3330,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
         * the newpage may be on LRU(or pagevec for LRU) already. We lock
         * LRU while we overwrite pc->mem_cgroup.
         */
-        __mem_cgroup_commit_charge_lrucare(newpage, memcg, type);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
 }
 #ifdef CONFIG_DEBUG_VM
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 06b145fb64ab..47296fee23db 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -640,10 +640,11 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        unsigned long vmstart;
        unsigned long vmend;
-        vma = find_vma_prev(mm, start, &prev);
+        vma = find_vma(mm, start);
        if (!vma || vma->vm_start > start)
                return -EFAULT;
+        prev = vma->vm_prev;
        if (start > vma->vm_start)
                prev = vma;
diff --git a/mm/migrate.c b/mm/migrate.c
index df141f60289e..1503b6b54ecb 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -839,8 +839,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
        if (!newpage)
                return -ENOMEM;
-        mem_cgroup_reset_owner(newpage);
        if (page_count(page) == 1) {
                /* page was freed from under us. So we are done. */
                goto out;
diff --git a/mm/mlock.c b/mm/mlock.c
index 4f4f53bdc65d..ef726e8aa8e9 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -385,10 +385,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
                return -EINVAL;
        if (end == start)
                return 0;
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
        if (!vma || vma->vm_start > start)
                return -ENOMEM;
+        prev = vma->vm_prev;
        if (start > vma->vm_start)
                prev = vma;
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f758c7f4c81..da15a79b1441 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1266,8 +1266,9 @@ munmap_back:
        vma->vm_pgoff = pgoff;
        INIT_LIST_HEAD(&vma->anon_vma_chain);
+        error = -EINVAL;        /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
        if (file) {
-                error = -EINVAL;
                if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
                        goto free_vma;
                if (vm_flags & VM_DENYWRITE) {
@@ -1293,6 +1294,8 @@ munmap_back:
                pgoff = vma->vm_pgoff;
                vm_flags = vma->vm_flags;
        } else if (vm_flags & VM_SHARED) {
+                if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
+                        goto free_vma;
                error = shmem_zero_setup(vma);
                if (error)
                        goto free_vma;
@@ -1605,7 +1608,6 @@ EXPORT_SYMBOL(find_vma);
 /*
 * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
- * Note: pprev is set to NULL when return value is NULL.
 */
 struct vm_area_struct *
 find_vma_prev(struct mm_struct *mm, unsigned long addr,
@@ -1614,7 +1616,16 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
        struct vm_area_struct *vma;
        vma = find_vma(mm, addr);
-        *pprev = vma ? vma->vm_prev : NULL;
+        if (vma) {
+                *pprev = vma->vm_prev;
+        } else {
+                struct rb_node *rb_node = mm->mm_rb.rb_node;
+                *pprev = NULL;
+                while (rb_node) {
+                        *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+                        rb_node = rb_node->rb_right;
+                }
+        }
        return vma;
 }
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 5a688a2756be..f437d054c3bf 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -262,10 +262,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
        down_write(&current->mm->mmap_sem);
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
        error = -ENOMEM;
        if (!vma)
                goto out;
+        prev = vma->vm_prev;
        if (unlikely(grows & PROT_GROWSDOWN)) {
                if (vma->vm_start >= end)
                        goto out;
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index de1616aa9b1e..1ccbd714059c 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_cgroup(swp_entry_t ent,
        pgoff_t offset = swp_offset(ent);
        struct swap_cgroup_ctrl *ctrl;
        struct page *mappage;
+        struct swap_cgroup *sc;
        ctrl = &swap_cgroup_ctrl[swp_type(ent)];
        if (ctrlp)
                *ctrlp = ctrl;
        mappage = ctrl->map[offset / SC_PER_PAGE];
-        return page_address(mappage) + offset % SC_PER_PAGE;
+        sc = page_address(mappage);
+        return sc + offset % SC_PER_PAGE;
 }
 /**
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 12a48a88c0d8..405d331804c3 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -184,8 +184,7 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
                                   page_end - page_start);
        }
-        for (i = page_start; i < page_end; i++)
+        bitmap_clear(populated, page_start, page_end - page_start);
-                __clear_bit(i, populated);
 }
 /**
diff --git a/mm/swap.c b/mm/swap.c
index fff1ff7fb9ad..14380e9fbe33 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -652,7 +652,7 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct zone* zone,
                       struct page *page, struct page *page_tail)
 {
-        int active;
+        int uninitialized_var(active);
        enum lru_list lru;
        const int file = 0;
@@ -672,7 +672,6 @@ void lru_add_page_tail(struct zone* zone,
                        active = 0;
                        lru = LRU_INACTIVE_ANON;
                }
-                update_page_reclaim_stat(zone, page_tail, file, active);
        } else {
                SetPageUnevictable(page_tail);
                lru = LRU_UNEVICTABLE;
@@ -693,6 +692,9 @@ void lru_add_page_tail(struct zone* zone,
                list_head = page_tail->lru.prev;
                list_move_tail(&page_tail->lru, list_head);
        }
+        if (!PageUnevictable(page))
+                update_page_reclaim_stat(zone, page_tail, file, active);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
@@ -710,8 +712,8 @@ static void __pagevec_lru_add_fn(struct page *page, void *arg)
        SetPageLRU(page);
        if (active)
                SetPageActive(page);
-        update_page_reclaim_stat(zone, page, file, active);
        add_page_to_lru_list(zone, page, lru);
+        update_page_reclaim_stat(zone, page, file, active);
 }
 /*
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 470038a91873..ea6b32d61873 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -300,16 +300,6 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                        new_page = alloc_page_vma(gfp_mask, vma, addr);
                        if (!new_page)
                                break;          /* Out of memory */
-                        /*
-                         * The memcg-specific accounting when moving
-                         * pages around the LRU lists relies on the
-                         * page's owner (memcg) to be valid.  Usually,
-                         * pages are assigned to a new owner before
-                         * being put on the LRU list, but since this
-                         * is not the case here, the stale owner from
-                         * a previous allocation cycle must be reset.
-                         */
-                        mem_cgroup_reset_owner(new_page);
                }
                /*
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 568d5bf17534..702a1ae9220b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
        ip6h->nexthdr = IPPROTO_HOPOPTS;
        ip6h->hop_limit = 1;
        ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+        if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                           &ip6h->saddr);
+                               &ip6h->saddr)) {
+                kfree_skb(skb);
+                return NULL;
+        }
        ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
        hopopt = (u8 *)(ip6h + 1);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 84122472656c..dec4f3817133 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -62,6 +62,15 @@ static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #define brnf_filter_pppoe_tagged 0
 #endif
+#define IS_IP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
+#define IS_IPV6(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
+#define IS_ARP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
 static inline __be16 vlan_proto(const struct sk_buff *skb)
 {
        if (vlan_tx_tag_present(skb))
@@ -639,8 +648,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                return NF_DROP;
        br = p->br;
-        if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+        if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
-            IS_PPPOE_IPV6(skb)) {
                if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
                        return NF_ACCEPT;
@@ -651,8 +659,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
        if (!brnf_call_iptables && !br->nf_call_iptables)
                return NF_ACCEPT;
-        if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb) &&
+        if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
-            !IS_PPPOE_IP(skb))
                return NF_ACCEPT;
        nf_bridge_pull_encap_header_rcsum(skb);
@@ -701,7 +708,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
        struct nf_bridge_info *nf_bridge = skb->nf_bridge;
        struct net_device *in;
-        if (skb->protocol != htons(ETH_P_ARP) && !IS_VLAN_ARP(skb)) {
+        if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
                in = nf_bridge->physindev;
                if (nf_bridge->mask & BRNF_PKT_TYPE) {
                        skb->pkt_type = PACKET_OTHERHOST;
@@ -718,6 +725,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
        return 0;
 }
 /* This is the 'purely bridged' case.  For IP, we pass the packet to
 * netfilter with indev and outdev set to the bridge device,
 * but we are still able to filter on the 'real' indev/outdev
@@ -744,11 +752,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
        if (!parent)
                return NF_DROP;
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
-            IS_PPPOE_IP(skb))
                pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
-                 IS_PPPOE_IPV6(skb))
                pf = PF_INET6;
        else
                return NF_ACCEPT;
@@ -795,7 +801,7 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
        if (!brnf_call_arptables && !br->nf_call_arptables)
                return NF_ACCEPT;
-        if (skb->protocol != htons(ETH_P_ARP)) {
+        if (!IS_ARP(skb)) {
                if (!IS_VLAN_ARP(skb))
                        return NF_ACCEPT;
                nf_bridge_pull_encap_header(skb);
@@ -853,11 +859,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
        if (!realoutdev)
                return NF_DROP;
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
-            IS_PPPOE_IP(skb))
                pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
-                 IS_PPPOE_IPV6(skb))
                pf = PF_INET6;
        else
                return NF_ACCEPT;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index dd147d78a588..8c836d96ba76 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -17,9 +17,9 @@
 #include "br_private_stp.h"
 /* since time values in bpdu are in jiffies and then scaled (1/256)
- * before sending, make sure that is at least one.
+ * before sending, make sure that is at least one STP tick.
 */
-#define MESSAGE_AGE_INCR        ((HZ < 256) ? 1 : (HZ/256))
+#define MESSAGE_AGE_INCR        ((HZ / 256) + 1)
 static const char *const br_port_state_names[] = {
        [BR_STATE_DISABLED] = "disabled",
@@ -31,7 +31,7 @@ static const char *const br_port_state_names[] = {
 void br_log_state(const struct net_bridge_port *p)
 {
-        br_info(p->br, "port %u(%s) entering %s state\n",
+        br_info(p->br, "port %u(%s) entered %s state\n",
                (unsigned) p->port_no, p->dev->name,
                br_port_state_names[p->state]);
 }
@@ -186,7 +186,7 @@ static void br_record_config_information(struct net_bridge_port *p,
        p->designated_cost = bpdu->root_path_cost;
        p->designated_bridge = bpdu->bridge_id;
        p->designated_port = bpdu->port_id;
-        p->designated_age = jiffies + bpdu->message_age;
+        p->designated_age = jiffies - bpdu->message_age;
        mod_timer(&p->message_age_timer, jiffies
                  + (p->br->max_age - bpdu->message_age));
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 19308e305d85..f494496373d6 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -98,14 +98,13 @@ void br_stp_disable_port(struct net_bridge_port *p)
        struct net_bridge *br = p->br;
        int wasroot;
-        br_log_state(p);
        wasroot = br_is_root_bridge(br);
        br_become_designated_port(p);
        p->state = BR_STATE_DISABLED;
        p->topology_change_ack = 0;
        p->config_pending = 0;
+        br_log_state(p);
        br_ifinfo_notify(RTM_NEWLINK, p);
        del_timer(&p->message_age_timer);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5864cc491369..5fe2ff3b01ef 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1335,7 +1335,12 @@ static inline int ebt_make_matchname(const struct ebt_entry_match *m,
    const char *base, char __user *ubase)
 {
        char __user *hlp = ubase + ((char *)m - base);
-        if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+        /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
+           long. Copy 29 bytes and fill remaining bytes with zeroes. */
+        strncpy(name, m->u.match->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                return -EFAULT;
        return 0;
 }
@@ -1344,7 +1349,10 @@ static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
    const char *base, char __user *ubase)
 {
        char __user *hlp = ubase + ((char *)w - base);
-        if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+        strncpy(name, w->u.watcher->name, sizeof(name));
+        if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
                return -EFAULT;
        return 0;
 }
@@ -1355,6 +1363,7 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
        int ret;
        char __user *hlp;
        const struct ebt_entry_target *t;
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
        if (e->bitmask == 0)
                return 0;
@@ -1368,7 +1377,8 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
        ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
        if (ret != 0)
                return ret;
-        if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
+        strncpy(name, t->u.target->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                return -EFAULT;
        return 0;
 }
@@ -1893,10 +1903,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
        switch (compat_mwt) {
        case EBT_COMPAT_MATCH:
-                match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
+                match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
-                                                name, 0), "ebt_%s", name);
-                if (match == NULL)
-                        return -ENOENT;
                if (IS_ERR(match))
                        return PTR_ERR(match);
@@ -1915,10 +1922,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
                break;
        case EBT_COMPAT_WATCHER: /* fallthrough */
        case EBT_COMPAT_TARGET:
-                wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
+                wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
-                                                name, 0), "ebt_%s", name);
-                if (wt == NULL)
-                        return -ENOENT;
                if (IS_ERR(wt))
                        return PTR_ERR(wt);
                off = xt_compat_target_offset(wt);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 606a6e8f3671..f965dce6f20f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1060,11 +1060,12 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
        rcu_read_lock();
        cb->seq = net->dev_base_seq;
-        nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
-                    ifla_policy);
+                        ifla_policy) >= 0) {
-        if (tb[IFLA_EXT_MASK])
+                if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                idx = 0;
@@ -1900,10 +1901,11 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
        u32 ext_filter_mask = 0;
        u16 min_ifinfo_dump_size = 0;
-        nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX, ifla_policy);
+        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
-        if (tb[IFLA_EXT_MASK])
+                if (tb[IFLA_EXT_MASK])
-                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
        if (!ext_filter_mask)
                return NLMSG_GOODSIZE;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index bf4a9c4808e1..d4d61b694fab 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/net.h>
+#include <linux/workqueue.h>
 #include <net/ip.h>
 #include <net/inetpeer.h>
 #include <net/secure_seq.h>
@@ -66,6 +67,11 @@
 static struct kmem_cache *peer_cachep __read_mostly;
+static LIST_HEAD(gc_list);
+static const int gc_delay = 60 * HZ;
+static struct delayed_work gc_work;
+static DEFINE_SPINLOCK(gc_lock);
 #define node_height(x) x->avl_height
 #define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
@@ -102,6 +108,50 @@ int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries m
 int inet_peer_minttl __read_mostly = 120 * HZ;  /* TTL under high load: 120 sec */
 int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;      /* usual time to live: 10 min */
+static void inetpeer_gc_worker(struct work_struct *work)
+{
+        struct inet_peer *p, *n;
+        LIST_HEAD(list);
+        spin_lock_bh(&gc_lock);
+        list_replace_init(&gc_list, &list);
+        spin_unlock_bh(&gc_lock);
+        if (list_empty(&list))
+                return;
+        list_for_each_entry_safe(p, n, &list, gc_list) {
+                if(need_resched())
+                        cond_resched();
+                if (p->avl_left != peer_avl_empty) {
+                        list_add_tail(&p->avl_left->gc_list, &list);
+                        p->avl_left = peer_avl_empty;
+                }
+                if (p->avl_right != peer_avl_empty) {
+                        list_add_tail(&p->avl_right->gc_list, &list);
+                        p->avl_right = peer_avl_empty;
+                }
+                n = list_entry(p->gc_list.next, struct inet_peer, gc_list);
+                if (!atomic_read(&p->refcnt)) {
+                        list_del(&p->gc_list);
+                        kmem_cache_free(peer_cachep, p);
+                }
+        }
+        if (list_empty(&list))
+                return;
+        spin_lock_bh(&gc_lock);
+        list_splice(&list, &gc_list);
+        spin_unlock_bh(&gc_lock);
+        schedule_delayed_work(&gc_work, gc_delay);
+}
 /* Called from ip_output.c:ip_init  */
 void __init inet_initpeers(void)
@@ -126,6 +176,7 @@ void __init inet_initpeers(void)
                        0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                        NULL);
+        INIT_DELAYED_WORK_DEFERRABLE(&gc_work, inetpeer_gc_worker);
 }
 static int addr_compare(const struct inetpeer_addr *a,
@@ -447,9 +498,8 @@ relookup:
                p->rate_last = 0;
                p->pmtu_expires = 0;
                p->pmtu_orig = 0;
-                p->redirect_genid = 0;
                memset(&p->redirect_learned, 0, sizeof(p->redirect_learned));
+                INIT_LIST_HEAD(&p->gc_list);
                /* Link the node. */
                link_to_pool(p, base);
@@ -509,3 +559,30 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
        return rc;
 }
 EXPORT_SYMBOL(inet_peer_xrlim_allow);
+void inetpeer_invalidate_tree(int family)
+{
+        struct inet_peer *old, *new, *prev;
+        struct inet_peer_base *base = family_to_base(family);
+        write_seqlock_bh(&base->lock);
+        old = base->root;
+        if (old == peer_avl_empty_rcu)
+                goto out;
+        new = peer_avl_empty_rcu;
+        prev = cmpxchg(&base->root, old, new);
+        if (prev == old) {
+                base->total = 0;
+                spin_lock(&gc_lock);
+                list_add_tail(&prev->gc_list, &gc_list);
+                spin_unlock(&gc_lock);
+                schedule_delayed_work(&gc_work, gc_delay);
+        }
+out:
+        write_sequnlock_bh(&base->lock);
+}
+EXPORT_SYMBOL(inetpeer_invalidate_tree);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bcacf54e5418..019774796174 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -132,7 +132,6 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int rt_chain_length_max __read_mostly    = 20;
-static int redirect_genid;
 static struct delayed_work expires_work;
 static unsigned long expires_ljiffies;
@@ -937,7 +936,7 @@ static void rt_cache_invalidate(struct net *net)
        get_random_bytes(&shuffle, sizeof(shuffle));
        atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-        redirect_genid++;
+        inetpeer_invalidate_tree(AF_INET);
 }
 /*
@@ -1485,10 +1484,8 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
                                peer = rt->peer;
                                if (peer) {
-                                        if (peer->redirect_learned.a4 != new_gw ||
+                                        if (peer->redirect_learned.a4 != new_gw) {
-                                            peer->redirect_genid != redirect_genid) {
                                                peer->redirect_learned.a4 = new_gw;
-                                                peer->redirect_genid = redirect_genid;
                                                atomic_inc(&__rt_peer_genid);
                                        }
                                        check_peer_redir(&rt->dst, peer);
@@ -1793,8 +1790,6 @@ static void ipv4_validate_peer(struct rtable *rt)
                if (peer) {
                        check_peer_pmtu(&rt->dst, peer);
-                        if (peer->redirect_genid != redirect_genid)
-                                peer->redirect_learned.a4 = 0;
                        if (peer->redirect_learned.a4 &&
                            peer->redirect_learned.a4 != rt->rt_gateway)
                                check_peer_redir(&rt->dst, peer);
@@ -1958,8 +1953,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                dst_init_metrics(&rt->dst, peer->metrics, false);
                check_peer_pmtu(&rt->dst, peer);
-                if (peer->redirect_genid != redirect_genid)
-                        peer->redirect_learned.a4 = 0;
                if (peer->redirect_learned.a4 &&
                    peer->redirect_learned.a4 != rt->rt_gateway) {
                        rt->rt_gateway = peer->redirect_learned.a4;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53c8ce4046b2..b5e315f13641 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1403,8 +1403,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
        BUG_ON(!pcount);
-        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
+        /* Adjust counters and hints for the newly sacked sequence
-        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
+         * range but discard the return value since prev is already
+         * marked. We must tag the range first because the seq
+         * advancement below implicitly advances
+         * tcp_highest_sack_seq() when skb is highest_sack.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
+        if (skb == tp->lost_skb_hint)
                tp->lost_cnt_hint += pcount;
        TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1430,12 +1438,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                skb_shinfo(skb)->gso_type = 0;
        }
-        /* Adjust counters and hints for the newly sacked sequence range but
-         * discard the return value since prev is already marked.
-         */
-        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                        start_seq, end_seq, dup_sack, pcount);
        /* Difference in this won't matter, both ACKed by the same cumul. ACK */
        TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
@@ -1583,6 +1585,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                }
        }
+        /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
+        if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+                goto fallback;
        if (!skb_shift(prev, skb, len))
                goto fallback;
        if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
@@ -2567,6 +2573,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                if (cnt > packets) {
                        if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                            (oldcnt >= packets))
                                break;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c02280a4d126..6b8ebc5da0e1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
        /* Join all-node multicast group */
        ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
+        /* Join all-router multicast group if forwarding is set */
+        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
        return ndev;
 }
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01a21c2f6ab3..8e2137bd87e2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1332,6 +1332,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                hw_roc = true;
        list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
                if (sdata->old_idle == sdata->vif.bss_conf.idle)
                        continue;
                if (!ieee80211_sdata_running(sdata))
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index ad64f4d5271a..f9b8e819ca63 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -344,7 +344,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
        for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                info->control.rates[i].idx = -1;
                info->control.rates[i].flags = 0;
-                info->control.rates[i].count = 1;
+                info->control.rates[i].count = 0;
        }
        if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ed86a3be678e..fa4b82c8ae80 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -635,8 +635,12 @@ static noinline int early_drop(struct net *net, unsigned int hash)
        if (del_timer(&ct->timeout)) {
                death_by_timeout((unsigned long)ct);
-                dropped = 1;
+                /* Check if we indeed killed this entry. Reliable event
-                NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                   delivery may have inserted it into the dying list. */
+                if (test_bit(IPS_DYING_BIT, &ct->status)) {
+                        dropped = 1;
+                        NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                }
        }
        nf_ct_put(ct);
        return dropped;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 30c9d4ca0218..10687692831e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1041,16 +1041,13 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
        if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                rcu_read_unlock();
-                spin_unlock_bh(&nf_conntrack_lock);
                nfnl_unlock();
                if (request_module("nf-nat-ipv4") < 0) {
                        nfnl_lock();
-                        spin_lock_bh(&nf_conntrack_lock);
                        rcu_read_lock();
                        return -EOPNOTSUPP;
                }
                nfnl_lock();
-                spin_lock_bh(&nf_conntrack_lock);
                rcu_read_lock();
                if (nfnetlink_parse_nat_setup_hook)
                        return -EAGAIN;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 2725d1bdf291..48badffaafc1 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira Networks.
+ * Copyright (c) 2007-2012 Nicira Networks.
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of version 2 of the GNU General Public
@@ -145,9 +145,16 @@ static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
                        inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
                                                 *addr, new_addr, 1);
        } else if (nh->protocol == IPPROTO_UDP) {
-                if (likely(transport_len >= sizeof(struct udphdr)))
+                if (likely(transport_len >= sizeof(struct udphdr))) {
-                        inet_proto_csum_replace4(&udp_hdr(skb)->check, skb,
+                        struct udphdr *uh = udp_hdr(skb);
-                                                 *addr, new_addr, 1);
+                        if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+                                inet_proto_csum_replace4(&uh->check, skb,
+                                                         *addr, new_addr, 1);
+                                if (!uh->check)
+                                        uh->check = CSUM_MANGLED_0;
+                        }
+                }
        }
        csum_replace4(&nh->check, *addr, new_addr);
@@ -197,8 +204,22 @@ static void set_tp_port(struct sk_buff *skb, __be16 *port,
        skb->rxhash = 0;
 }
-static int set_udp_port(struct sk_buff *skb,
+static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
-                        const struct ovs_key_udp *udp_port_key)
+{
+        struct udphdr *uh = udp_hdr(skb);
+        if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
+                set_tp_port(skb, port, new_port, &uh->check);
+                if (!uh->check)
+                        uh->check = CSUM_MANGLED_0;
+        } else {
+                *port = new_port;
+                skb->rxhash = 0;
+        }
+}
+static int set_udp(struct sk_buff *skb, const struct ovs_key_udp *udp_port_key)
 {
        struct udphdr *uh;
        int err;
@@ -210,16 +231,15 @@ static int set_udp_port(struct sk_buff *skb,
        uh = udp_hdr(skb);
        if (udp_port_key->udp_src != uh->source)
-                set_tp_port(skb, &uh->source, udp_port_key->udp_src, &uh->check);
+                set_udp_port(skb, &uh->source, udp_port_key->udp_src);
        if (udp_port_key->udp_dst != uh->dest)
-                set_tp_port(skb, &uh->dest, udp_port_key->udp_dst, &uh->check);
+                set_udp_port(skb, &uh->dest, udp_port_key->udp_dst);
        return 0;
 }
-static int set_tcp_port(struct sk_buff *skb,
+static int set_tcp(struct sk_buff *skb, const struct ovs_key_tcp *tcp_port_key)
-                        const struct ovs_key_tcp *tcp_port_key)
 {
        struct tcphdr *th;
        int err;
@@ -328,11 +348,11 @@ static int execute_set_action(struct sk_buff *skb,
                break;
        case OVS_KEY_ATTR_TCP:
-                err = set_tcp_port(skb, nla_data(nested_attr));
+                err = set_tcp(skb, nla_data(nested_attr));
                break;
        case OVS_KEY_ATTR_UDP:
-                err = set_udp_port(skb, nla_data(nested_attr));
+                err = set_udp(skb, nla_data(nested_attr));
                break;
        }
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ce64c18b8c79..2c030505b335 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1521,6 +1521,9 @@ static struct vport *lookup_vport(struct ovs_header *ovs_header,
                vport = ovs_vport_locate(nla_data(a[OVS_VPORT_ATTR_NAME]));
                if (!vport)
                        return ERR_PTR(-ENODEV);
+                if (ovs_header->dp_ifindex &&
+                    ovs_header->dp_ifindex != get_dpifindex(vport->dp))
+                        return ERR_PTR(-ENODEV);
                return vport;
        } else if (a[OVS_VPORT_ATTR_PORT_NO]) {
                u32 port_no = nla_get_u32(a[OVS_VPORT_ATTR_PORT_NO]);
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 95ffa6a9db6e..496f14c1a731 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2684,10 +2684,9 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
                err = snd_opl3_hwdep_new(opl3, 0, 1, NULL);
                if (err < 0)
                        goto out_err;
+                opl3->private_data = chip;
        }
-        opl3->private_data = chip;
        sprintf(card->longname, "%s at 0x%lx, irq %i",
                card->shortname, chip->ctrl_io, chip->irq);
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index c2c65f63bf06..684307372d73 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1759,7 +1759,11 @@ static void put_vol_mute(struct hda_codec *codec, struct hda_amp_info *info,
        parm = ch ? AC_AMP_SET_RIGHT : AC_AMP_SET_LEFT;
        parm |= direction == HDA_OUTPUT ? AC_AMP_SET_OUTPUT : AC_AMP_SET_INPUT;
        parm |= index << AC_AMP_SET_INDEX_SHIFT;
-        parm |= val;
+        if ((val & HDA_AMP_MUTE) && !(info->amp_caps & AC_AMPCAP_MUTE) &&
+            (info->amp_caps & AC_AMPCAP_MIN_MUTE))
+                ; /* set the zero value as a fake mute */
+        else
+                parm |= val;
        snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm);
        info->vol[ch] = val;
 }
@@ -2026,7 +2030,7 @@ int snd_hda_mixer_amp_tlv(struct snd_kcontrol *kcontrol, int op_flag,
        val1 = -((caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT);
        val1 += ofs;
        val1 = ((int)val1) * ((int)val2);
-        if (min_mute)
+        if (min_mute || (caps & AC_AMPCAP_MIN_MUTE))
                val2 |= TLV_DB_SCALE_MUTE;
        if (put_user(SNDRV_CTL_TLVT_DB_SCALE, _tlv))
                return -EFAULT;
@@ -5114,7 +5118,7 @@ static int fill_audio_out_name(struct hda_codec *codec, hda_nid_t nid,
        const char *pfx = "", *sfx = "";
        /* handle as a speaker if it's a fixed line-out */
-        if (!strcmp(name, "Line-Out") && attr == INPUT_PIN_ATTR_INT)
+        if (!strcmp(name, "Line Out") && attr == INPUT_PIN_ATTR_INT)
                name = "Speaker";
        /* check the location */
        switch (attr) {
@@ -5173,7 +5177,7 @@ int snd_hda_get_pin_label(struct hda_codec *codec, hda_nid_t nid,
        switch (get_defcfg_device(def_conf)) {
        case AC_JACK_LINE_OUT:
-                return fill_audio_out_name(codec, nid, cfg, "Line-Out",
+                return fill_audio_out_name(codec, nid, cfg, "Line Out",
                                           label, maxlen, indexp);
        case AC_JACK_SPEAKER:
                return fill_audio_out_name(codec, nid, cfg, "Speaker",
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index e9f71dc0d464..f0f1943a4b2c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -298,6 +298,9 @@ enum {
 #define AC_AMPCAP_MUTE                  (1<<31)    /* mute capable */
 #define AC_AMPCAP_MUTE_SHIFT            31
+/* driver-specific amp-caps: using bits 24-30 */
+#define AC_AMPCAP_MIN_MUTE              (1 << 30) /* min-volume = mute */
 /* Connection list */
 #define AC_CLIST_LENGTH                 (0x7f<<0)
 #define AC_CLIST_LONG                   (1<<7)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bc5a993d1146..c83ccdba1e5a 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -609,7 +609,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                "Front Speaker", "Surround Speaker", "Bass Speaker"
        };
        static const char * const line_outs[] = {
-                "Front Line-Out", "Surround Line-Out", "Bass Line-Out"
+                "Front Line Out", "Surround Line Out", "Bass Line Out"
        };
        fix_volume_caps(codec, dac);
@@ -635,7 +635,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                if (num_ctls > 1)
                        name = line_outs[idx];
                else
-                        name = "Line-Out";
+                        name = "Line Out";
                break;
        }
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a7a5733aa4d2..d29d6d377904 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3482,7 +3482,7 @@ static int cx_automute_mode_info(struct snd_kcontrol *kcontrol,
                "Disabled", "Enabled"
        };
        static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
        };
        const char * const *texts;
@@ -4079,7 +4079,8 @@ static int cx_auto_add_volume_idx(struct hda_codec *codec, const char *basename,
                err = snd_hda_ctl_add(codec, nid, kctl);
                if (err < 0)
                        return err;
-                if (!(query_amp_caps(codec, nid, hda_dir) & AC_AMPCAP_MUTE))
+                if (!(query_amp_caps(codec, nid, hda_dir) &
+                      (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)))
                        break;
        }
        return 0;
@@ -4379,6 +4380,22 @@ static const struct snd_pci_quirk cxt_fixups[] = {
        {}
 };
+/* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+ * can be created (bko#42825)
+ */
+static void add_cx5051_fake_mutes(struct hda_codec *codec)
+{
+        static hda_nid_t out_nids[] = {
+                0x10, 0x11, 0
+        };
+        hda_nid_t *p;
+        for (p = out_nids; *p; p++)
+                snd_hda_override_amp_caps(codec, *p, HDA_OUTPUT,
+                                          AC_AMPCAP_MIN_MUTE |
+                                          query_amp_caps(codec, *p, HDA_OUTPUT));
+}
 static int patch_conexant_auto(struct hda_codec *codec)
 {
        struct conexant_spec *spec;
@@ -4397,6 +4414,9 @@ static int patch_conexant_auto(struct hda_codec *codec)
        case 0x14f15045:
                spec->single_adc_amp = 1;
                break;
+        case 0x14f15051:
+                add_cx5051_fake_mutes(codec);
+                break;
        }
        apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 3647baa9bfed..22c73b78ac6f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -802,7 +802,7 @@ static int alc_automute_mode_info(struct snd_kcontrol *kcontrol,
                "Disabled", "Enabled"
        };
        static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
        };
        const char * const *texts;
@@ -1856,7 +1856,7 @@ static const char * const alc_slave_vols[] = {
        "Headphone Playback Volume",
        "Speaker Playback Volume",
        "Mono Playback Volume",
-        "Line-Out Playback Volume",
+        "Line Out Playback Volume",
        "CLFE Playback Volume",
        "Bass Speaker Playback Volume",
        "PCM Playback Volume",
@@ -1873,7 +1873,7 @@ static const char * const alc_slave_sws[] = {
        "Speaker Playback Switch",
        "Mono Playback Switch",
        "IEC958 Playback Switch",
-        "Line-Out Playback Switch",
+        "Line Out Playback Switch",
        "CLFE Playback Switch",
        "Bass Speaker Playback Switch",
        "PCM Playback Switch",
@@ -2068,12 +2068,16 @@ static int alc_build_controls(struct hda_codec *codec)
 */
 static void alc_init_special_input_src(struct hda_codec *codec);
+static int alc269_fill_coef(struct hda_codec *codec);
 static int alc_init(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
        unsigned int i;
+        if (codec->vendor_id == 0x10ec0269)
+                alc269_fill_coef(codec);
        alc_fix_pll(codec);
        alc_auto_init_amp(codec, spec->init_amp);
@@ -3797,7 +3801,7 @@ static void alc_auto_init_input_src(struct hda_codec *codec)
        else
                nums = spec->num_adc_nids;
        for (c = 0; c < nums; c++)
-                alc_mux_select(codec, 0, spec->cur_mux[c], true);
+                alc_mux_select(codec, c, spec->cur_mux[c], true);
 }
 /* add mic boosts if needed */
@@ -4367,6 +4371,7 @@ enum {
        ALC882_FIXUP_PB_M5210,
        ALC882_FIXUP_ACER_ASPIRE_7736,
        ALC882_FIXUP_ASUS_W90V,
+        ALC889_FIXUP_CD,
        ALC889_FIXUP_VAIO_TT,
        ALC888_FIXUP_EEE1601,
        ALC882_FIXUP_EAPD,
@@ -4494,6 +4499,13 @@ static const struct alc_fixup alc882_fixups[] = {
                        { }
                }
        },
+        [ALC889_FIXUP_CD] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x1c, 0x993301f0 }, /* CD */
+                        { }
+                }
+        },
        [ALC889_FIXUP_VAIO_TT] = {
                .type = ALC_FIXUP_PINS,
                .v.pins = (const struct alc_pincfg[]) {
@@ -4650,6 +4662,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
        SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
        SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3", ALC889_FIXUP_CD),
        SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
        SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
        SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -5467,8 +5480,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = {
 static int alc269_fill_coef(struct hda_codec *codec)
 {
+        struct alc_spec *spec = codec->spec;
        int val;
+        if (spec->codec_variant != ALC269_TYPE_ALC269VB)
+                return 0;
        if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
                alc_write_coef_idx(codec, 0xf, 0x960b);
                alc_write_coef_idx(codec, 0xe, 0x8817);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6345df131a00..9dbb5735d778 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4629,7 +4629,7 @@ static void stac92xx_hp_detect(struct hda_codec *codec)
                unsigned int val = AC_PINCTL_OUT_EN | AC_PINCTL_HP_EN;
                if (no_hp_sensing(spec, i))
                        continue;
-                if (presence)
+                if (1 /*presence*/)
                        stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
 #if 0 /* FIXME */
 /* Resetting the pinctl like below may lead to (a sort of) regressions
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index cc9f6c83d661..bc030a2088da 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -6333,6 +6333,7 @@ static int __devinit snd_hdspm_create_hwdep(struct snd_card *card,
        hw->ops.open = snd_hdspm_hwdep_dummy_op;
        hw->ops.ioctl = snd_hdspm_hwdep_ioctl;
+        hw->ops.ioctl_compat = snd_hdspm_hwdep_ioctl;
        hw->ops.release = snd_hdspm_hwdep_dummy_op;
        return 0;
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 01d1f749cf02..b6adbed6e506 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -112,7 +112,7 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
                break;
        case SND_SOC_DAIFMT_DSP_A:
                /* data on rising edge of bclk, frame high 1clk before data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TEFS;
+                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0 | SSI_STCR_TEFS;
                break;
        }
diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
index c6012ff5bd3e..d23b19a59d83 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -367,7 +367,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
        .platform_name = "samsung-audio",
        .cpu_dai_name = "s3c24xx-iis",
        .codec_dai_name = "wm8753-hifi",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
        .init = neo1973_wm8753_init,
        .ops = &neo1973_hifi_ops,
 },
@@ -376,7 +376,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
        .stream_name = "Voice",
        .cpu_dai_name = "dfbmcs320-pcm",
        .codec_dai_name = "wm8753-voice",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
        .ops = &neo1973_voice_ops,
 },
 };
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1f55ded4047f..1315663c1c09 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3068,9 +3068,13 @@ static void soc_dapm_shutdown_codec(struct snd_soc_dapm_context *dapm)
         * standby.
         */
        if (powerdown) {
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_PREPARE);
+                if (dapm->bias_level == SND_SOC_BIAS_ON)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_PREPARE);
                dapm_seq_run(dapm, &down_list, 0, false);
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_STANDBY);
+                if (dapm->bias_level == SND_SOC_BIAS_PREPARE)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_STANDBY);
        }
 }
@@ -3083,7 +3087,9 @@ void snd_soc_dapm_shutdown(struct snd_soc_card *card)
        list_for_each_entry(codec, &card->codec_dev_list, list) {
                soc_dapm_shutdown_codec(&codec->dapm);
-                snd_soc_dapm_set_bias_level(&codec->dapm, SND_SOC_BIAS_OFF);
+                if (codec->dapm.bias_level == SND_SOC_BIAS_STANDBY)
+                        snd_soc_dapm_set_bias_level(&codec->dapm,
+                                                    SND_SOC_BIAS_OFF);
        }
 }
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 0abfb18b911f..227b6ae99785 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -204,6 +204,9 @@ static void perf_record__open(struct perf_record *rec)
                if (opts->group && pos != first)
                        group_fd = first->fd;
+fallback_missing_features:
+                if (opts->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                attr->sample_id_all = opts->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -217,15 +220,23 @@ try_again:
                        } else if (err ==  ENODEV && opts->cpu_list) {
                                die("No such device - did you specify"
                                        " an out-of-range profile CPU?\n");
-                        } else if (err == EINVAL && opts->sample_id_all_avail) {
+                        } else if (err == EINVAL) {
-                                /*
+                                if (!opts->exclude_guest_missing &&
-                                 * Old kernel, no attr->sample_id_type_all field
+                                    (attr->exclude_guest || attr->exclude_host)) {
-                                 */
+                                        pr_debug("Old kernel, cannot exclude "
-                                opts->sample_id_all_avail = false;
+                                                 "guest or host samples.\n");
-                                if (!opts->sample_time && !opts->raw_samples && !time_needed)
+                                        opts->exclude_guest_missing = true;
-                                        attr->sample_type &= ~PERF_SAMPLE_TIME;
+                                        goto fallback_missing_features;
+                                } else if (opts->sample_id_all_avail) {
-                                goto retry_sample_id;
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        opts->sample_id_all_avail = false;
+                                        if (!opts->sample_time && !opts->raw_samples && !time_needed)
+                                                attr->sample_type &= ~PERF_SAMPLE_TIME;
+                                        goto retry_sample_id;
+                                }
                        }
                        /*
@@ -503,9 +514,9 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                        return err;
        }
-        if (!!rec->no_buildid
+        if (!rec->no_buildid
            && !perf_header__has_feat(&session->header, HEADER_BUILD_ID)) {
-                pr_err("Couldn't generating buildids. "
+                pr_err("Couldn't generate buildids. "
                       "Use --no-buildid to profile anyway.\n");
                return -1;
        }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index dd162aa24baa..ecff31257eb3 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -857,6 +857,9 @@ static void perf_top__start_counters(struct perf_top *top)
                attr->mmap = 1;
                attr->comm = 1;
                attr->inherit = top->inherit;
+fallback_missing_features:
+                if (top->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                attr->sample_id_all = top->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -868,12 +871,20 @@ try_again:
                        if (err == EPERM || err == EACCES) {
                                ui__error_paranoid();
                                goto out_err;
-                        } else if (err == EINVAL && top->sample_id_all_avail) {
+                        } else if (err == EINVAL) {
-                                /*
+                                if (!top->exclude_guest_missing &&
-                                 * Old kernel, no attr->sample_id_type_all field
+                                    (attr->exclude_guest || attr->exclude_host)) {
-                                 */
+                                        pr_debug("Old kernel, cannot exclude "
-                                top->sample_id_all_avail = false;
+                                                 "guest or host samples.\n");
-                                goto retry_sample_id;
+                                        top->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (top->sample_id_all_avail) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        top->sample_id_all_avail = false;
+                                        goto retry_sample_id;
+                                }
                        }
                        /*
                         * If it's cycles then fall back to hrtimer
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 64f8bee31ced..16e7d20eee83 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -199,6 +199,7 @@ struct perf_record_opts {
        bool         sample_address;
        bool         sample_time;
        bool         sample_id_all_avail;
+        bool         exclude_guest_missing;
        bool         system_wide;
        bool         period;
        unsigned int freq;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 2044324b755a..2a6f33cd888c 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -74,6 +74,7 @@ static pid_t perf_event__get_comm_tgid(pid_t pid, char *comm, size_t len)
                        if (size >= len)
                                size = len - 1;
                        memcpy(comm, name, size);
+                        comm[size] = '\0';
                } else if (memcmp(bf, "Tgid:", 5) == 0) {
                        char *tgids = bf + 5;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 3f16e08a5c8d..ea32a061f1c8 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -349,6 +349,10 @@ struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
        hlist_for_each_entry(sid, pos, head, node)
                if (sid->id == id)
                        return sid->evsel;
+        if (!perf_evlist__sample_id_all(evlist))
+                return list_entry(evlist->entries.next, struct perf_evsel, node);
        return NULL;
 }
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 29cb65459811..e33554a562b3 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -1867,6 +1867,12 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                           tev->point.symbol);
                ret = -ENOENT;
                goto error;
+        } else if (tev->point.offset > sym->end - sym->start) {
+                pr_warning("Offset specified is greater than size of %s\n",
+                           tev->point.symbol);
+                ret = -ENOENT;
+                goto error;
        }
        return 1;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 5d732621a462..74bd2e63c4b4 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -672,7 +672,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                  bool retprobe, struct probe_trace_point *tp)
 {
-        Dwarf_Addr eaddr;
+        Dwarf_Addr eaddr, highaddr;
        const char *name;
        /* Copy the name of probe point */
@@ -683,6 +683,16 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                   dwarf_diename(sp_die));
                        return -ENOENT;
                }
+                if (dwarf_highpc(sp_die, &highaddr) != 0) {
+                        pr_warning("Failed to get end address of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -ENOENT;
+                }
+                if (paddr > highaddr) {
+                        pr_warning("Offset specified is greater than size of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -EINVAL;
+                }
                tp->symbol = strdup(name);
                if (tp->symbol == NULL)
                        return -ENOMEM;
diff --git a/tools/perf/util/top.h b/tools/perf/util/top.h
index a248f3c2c60d..f2eab81435ae 100644
--- a/tools/perf/util/top.h
+++ b/tools/perf/util/top.h
@@ -34,6 +34,7 @@ struct perf_top {
        bool               inherit;
        bool               group;
        bool               sample_id_all_avail;
+        bool               exclude_guest_missing;
        bool               dump_symtab;
        const char         *cpu_list;
        struct hist_entry  *sym_filter_entry;
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 813141047fc2..fb25d1329218 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -6,7 +6,7 @@
 * XXX We need to find a better place for these things...
 */
 bool perf_host  = true;
-bool perf_guest = true;
+bool perf_guest = false;
 void event_attr_init(struct perf_event_attr *attr)
 {