275 files changed, 2621 insertions, 1545 deletions

diff --git a/Documentation/devicetree/bindings/ata/calxeda-sata.txt b/Documentation/devicetree/bindings/ata/ahci-platform.txt
index 79caa5651f53..8bb8a76d42e8 100644
--- a/Documentation/devicetree/bindings/ata/calxeda-sata.txt
+++ b/Documentation/devicetree/bindings/ata/ahci-platform.txt
@@ -1,10 +1,10 @@
-* Calxeda SATA Controller
+* AHCI SATA Controller
 
 SATA nodes are defined to describe on-chip Serial ATA controllers.
 Each SATA controller should have its own node.
 
 Required properties:
-- compatible        : compatible list, contains "calxeda,hb-ahci"
+- compatible        : compatible list, contains "calxeda,hb-ahci" or "snps,spear-ahci"
 - interrupts        : <interrupt mapping for SATA IRQ>
 - reg               : <registers mapping>
 
@@ -14,4 +14,3 @@ Example:
                 reg = <0xffe08000 0x1000>;
                 interrupts = <115>;
         };
-
diff --git a/Documentation/devicetree/bindings/sound/sgtl5000.txt b/Documentation/devicetree/bindings/sound/sgtl5000.txt
index 2c3cd413f042..9cc44449508d 100644
--- a/Documentation/devicetree/bindings/sound/sgtl5000.txt
+++ b/Documentation/devicetree/bindings/sound/sgtl5000.txt
@@ -3,6 +3,8 @@
 Required properties:
 - compatible : "fsl,sgtl5000".
 
+- reg : the I2C address of the device
+
 Example:
 
 codec: sgtl5000@0a {
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index bd80ba5847d2..1619a8c80873 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -147,7 +147,7 @@ tcp_adv_win_scale - INTEGER
         (if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
         if it is <= 0.
         Possible values are [-31, 31], inclusive.
-        Default: 2
+        Default: 1
 
 tcp_allowed_congestion_control - STRING
         Show/set the congestion control choices available to non-privileged
@@ -410,7 +410,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
         net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
         automatic tuning of that socket's receive buffer size, in which
         case this value is ignored.
-        Default: between 87380B and 4MB, depending on RAM size.
+        Default: between 87380B and 6MB, depending on RAM size.
 
 tcp_sack - BOOLEAN
         Enable select acknowledgments (SACKS).
diff --git a/MAINTAINERS b/MAINTAINERS
index bb76fc42fc42..de4e2806030f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1968,10 +1968,7 @@ S:	Maintained
 F:      drivers/net/ethernet/ti/cpmac.c
 
 CPU FREQUENCY DRIVERS
-M:      Dave Jones <davej@redhat.com>
 L:      cpufreq@vger.kernel.org
-W:      http://www.codemonkey.org.uk/projects/cpufreq/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq.git
 S:      Maintained
 F:      drivers/cpufreq/
 F:      include/linux/cpufreq.h
@@ -4037,6 +4034,7 @@ F:	Documentation/scsi/53c700.txt
 F:      drivers/scsi/53c700*
 
 LED SUBSYSTEM
+M:      Bryan Wu <bryan.wu@canonical.com>
 M:      Richard Purdie <rpurdie@rpsys.net>
 S:      Maintained
 F:      drivers/leds/
@@ -5892,11 +5890,11 @@ F:	Documentation/scsi/st.txt
 F:      drivers/scsi/st*
 
 SCTP PROTOCOL
-M:      Vlad Yasevich <vladislav.yasevich@hp.com>
+M:      Vlad Yasevich <vyasevich@gmail.com>
 M:      Sridhar Samudrala <sri@us.ibm.com>
 L:      linux-sctp@vger.kernel.org
 W:      http://lksctp.sourceforge.net
-S:      Supported
+S:      Maintained
 F:      Documentation/networking/sctp.txt
 F:      include/linux/sctp.h
 F:      include/net/sctp/
diff --git a/Makefile b/Makefile
index a06ee9fa8022..9e384ae6c403 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 4
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 56a4df952fb0..22e58a99f38b 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -477,7 +477,7 @@ config ALPHA_BROKEN_IRQ_MASK
 
 config VGA_HOSE
         bool
-        depends on ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL || ALPHA_TSUNAMI
+        depends on VGA_CONSOLE && (ALPHA_GENERIC || ALPHA_TITAN || ALPHA_MARVEL || ALPHA_TSUNAMI)
         default y
         help
           Support VGA on an arbitrary hose; needed for several platforms
diff --git a/arch/alpha/include/asm/rtc.h b/arch/alpha/include/asm/rtc.h
index 1f7fba671ae6..d70408d36677 100644
--- a/arch/alpha/include/asm/rtc.h
+++ b/arch/alpha/include/asm/rtc.h
@@ -1,14 +1,10 @@
 #ifndef _ALPHA_RTC_H
 #define _ALPHA_RTC_H
 
-#if defined(CONFIG_ALPHA_GENERIC)
+#if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP) \
+ || defined(CONFIG_ALPHA_GENERIC)
 # define get_rtc_time           alpha_mv.rtc_get_time
 # define set_rtc_time           alpha_mv.rtc_set_time
-#else
-# if defined(CONFIG_ALPHA_MARVEL) && defined(CONFIG_SMP)
-#  define get_rtc_time          marvel_get_rtc_time
-#  define set_rtc_time          marvel_set_rtc_time
-# endif
 #endif
 
 #include <asm-generic/rtc.h>
diff --git a/arch/alpha/kernel/core_tsunami.c b/arch/alpha/kernel/core_tsunami.c
index 5e7c28f92f19..61893d7bdda5 100644
--- a/arch/alpha/kernel/core_tsunami.c
+++ b/arch/alpha/kernel/core_tsunami.c
@@ -11,6 +11,7 @@
 #include <asm/core_tsunami.h>
 #undef __EXTERN_INLINE
 
+#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/pci.h>
 #include <linux/sched.h>
diff --git a/arch/alpha/kernel/sys_marvel.c b/arch/alpha/kernel/sys_marvel.c
index 14a4b6a7cf59..407accc80877 100644
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -317,7 +317,7 @@ marvel_init_irq(void)
 }
 
 static int 
-marvel_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+marvel_map_irq(struct pci_dev *dev, u8 slot, u8 pin)
 {
         struct pci_controller *hose = dev->sysdata;
         struct io7_port *io7_port = hose->sysdata;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index cf006d40342c..36586dba6fa6 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1186,6 +1186,15 @@ if !MMU
 source "arch/arm/Kconfig-nommu"
 endif
 
+config ARM_ERRATA_326103
+        bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory"
+        depends on CPU_V6
+        help
+          Executing a SWP instruction to read-only memory does not set bit 11
+          of the FSR on the ARM 1136 prior to r1p0. This causes the kernel to
+          treat the access as a read, preventing a COW from occurring and
+          causing the faulting task to livelock.
+
 config ARM_ERRATA_411920
         bool "ARM errata: Invalidation of the Instruction Cache operation can fail"
         depends on CPU_V6 || CPU_V6K
diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
index 0b32925f2147..e2fe3195c0d1 100644
--- a/arch/arm/boot/dts/versatile-ab.dts
+++ b/arch/arm/boot/dts/versatile-ab.dts
@@ -173,7 +173,7 @@
                         mmc@5000 {
                                 compatible = "arm,primecell";
                                 reg = < 0x5000 0x1000>;
-                                interrupts = <22>;
+                                interrupts = <22 34>;
                         };
                         kmi@6000 {
                                 compatible = "arm,pl050", "arm,primecell";
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index 166461073b78..7e8175269064 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -41,7 +41,7 @@
                         mmc@b000 {
                                 compatible = "arm,primecell";
                                 reg = <0xb000 0x1000>;
-                                interrupts = <23>;
+                                interrupts = <23 34>;
                         };
                 };
         };
diff --git a/arch/arm/include/asm/thread_info.h b/arch/arm/include/asm/thread_info.h
index d4c24d412a8d..0f04d84582e1 100644
--- a/arch/arm/include/asm/thread_info.h
+++ b/arch/arm/include/asm/thread_info.h
@@ -118,6 +118,13 @@ extern void iwmmxt_task_switch(struct thread_info *);
 extern void vfp_sync_hwstate(struct thread_info *);
 extern void vfp_flush_hwstate(struct thread_info *);
 
+struct user_vfp;
+struct user_vfp_exc;
+
+extern int vfp_preserve_user_clear_hwstate(struct user_vfp __user *,
+                                           struct user_vfp_exc __user *);
+extern int vfp_restore_user_hwstate(struct user_vfp __user *,
+                                    struct user_vfp_exc __user *);
 #endif
 
 /*
diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
index 60843eb0f61c..73409e6c0251 100644
--- a/arch/arm/include/asm/tls.h
+++ b/arch/arm/include/asm/tls.h
@@ -7,6 +7,8 @@
 
         .macro set_tls_v6k, tp, tmp1, tmp2
         mcr     p15, 0, \tp, c13, c0, 3         @ set TLS register
+        mov     \tmp1, #0
+        mcr     p15, 0, \tmp1, c13, c0, 2       @ clear user r/w TLS register
         .endm
 
         .macro set_tls_v6, tp, tmp1, tmp2
@@ -15,6 +17,8 @@
         mov     \tmp2, #0xffff0fff
         tst     \tmp1, #HWCAP_TLS               @ hardware TLS available?
         mcrne   p15, 0, \tp, c13, c0, 3         @ yes, set TLS register
+        movne   \tmp1, #0
+        mcrne   p15, 0, \tmp1, c13, c0, 2       @ clear user r/w TLS register
         streq   \tp, [\tmp2, #-15]              @ set TLS value at 0xffff0ff0
         .endm
 
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 71ccdbfed662..8349d4e97e2b 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -155,10 +155,10 @@ static bool migrate_one_irq(struct irq_desc *desc)
         }
 
         c = irq_data_get_irq_chip(d);
-        if (c->irq_set_affinity)
-                c->irq_set_affinity(d, affinity, true);
-        else
+        if (!c->irq_set_affinity)
                 pr_debug("IRQ%u: unable to set affinity\n", d->irq);
+        else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
+                cpumask_copy(d->affinity, affinity);
 
         return ret;
 }
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index 80abafb9bf33..9650c143afc1 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -906,27 +906,14 @@ long arch_ptrace(struct task_struct *child, long request,
         return ret;
 }
 
-#ifdef __ARMEB__
-#define AUDIT_ARCH_NR AUDIT_ARCH_ARMEB
-#else
-#define AUDIT_ARCH_NR AUDIT_ARCH_ARM
-#endif
-
 asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
 {
         unsigned long ip;
 
-        /*
-         * Save IP.  IP is used to denote syscall entry/exit:
-         *  IP = 0 -> entry, = 1 -> exit
-         */
-        ip = regs->ARM_ip;
-        regs->ARM_ip = why;
-
-        if (!ip)
+        if (why)
                 audit_syscall_exit(regs);
         else
-                audit_syscall_entry(AUDIT_ARCH_NR, scno, regs->ARM_r0,
+                audit_syscall_entry(AUDIT_ARCH_ARM, scno, regs->ARM_r0,
                                     regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
 
         if (!test_thread_flag(TIF_SYSCALL_TRACE))
@@ -936,6 +923,13 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
 
         current_thread_info()->syscall = scno;
 
+        /*
+         * IP is used to denote syscall entry/exit:
+         * IP = 0 -> entry, =1 -> exit
+         */
+        ip = regs->ARM_ip;
+        regs->ARM_ip = why;
+
         /* the 0x80 provides a way for the tracing parent to distinguish
            between a syscall stop and SIGTRAP delivery */
         ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index 7cb532fc8aa4..d68d1b694680 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -180,44 +180,23 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)
 
 static int preserve_vfp_context(struct vfp_sigframe __user *frame)
 {
-        struct thread_info *thread = current_thread_info();
-        struct vfp_hard_struct *h = &thread->vfpstate.hard;
         const unsigned long magic = VFP_MAGIC;
         const unsigned long size = VFP_STORAGE_SIZE;
         int err = 0;
 
-        vfp_sync_hwstate(thread);
         __put_user_error(magic, &frame->magic, err);
         __put_user_error(size, &frame->size, err);
 
-        /*
-         * Copy the floating point registers. There can be unused
-         * registers see asm/hwcap.h for details.
-         */
-        err |= __copy_to_user(&frame->ufp.fpregs, &h->fpregs,
-                              sizeof(h->fpregs));
-        /*
-         * Copy the status and control register.
-         */
-        __put_user_error(h->fpscr, &frame->ufp.fpscr, err);
-
-        /*
-         * Copy the exception registers.
-         */
-        __put_user_error(h->fpexc, &frame->ufp_exc.fpexc, err);
-        __put_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
-        __put_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+        if (err)
+                return -EFAULT;
 
-        return err ? -EFAULT : 0;
+        return vfp_preserve_user_clear_hwstate(&frame->ufp, &frame->ufp_exc);
 }
 
 static int restore_vfp_context(struct vfp_sigframe __user *frame)
 {
-        struct thread_info *thread = current_thread_info();
-        struct vfp_hard_struct *h = &thread->vfpstate.hard;
         unsigned long magic;
         unsigned long size;
-        unsigned long fpexc;
         int err = 0;
 
         __get_user_error(magic, &frame->magic, err);
@@ -228,33 +207,7 @@ static int restore_vfp_context(struct vfp_sigframe __user *frame)
         if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
                 return -EINVAL;
 
-        vfp_flush_hwstate(thread);
-
-        /*
-         * Copy the floating point registers. There can be unused
-         * registers see asm/hwcap.h for details.
-         */
-        err |= __copy_from_user(&h->fpregs, &frame->ufp.fpregs,
-                                sizeof(h->fpregs));
-        /*
-         * Copy the status and control register.
-         */
-        __get_user_error(h->fpscr, &frame->ufp.fpscr, err);
-
-        /*
-         * Sanitise and restore the exception registers.
-         */
-        __get_user_error(fpexc, &frame->ufp_exc.fpexc, err);
-        /* Ensure the VFP is enabled. */
-        fpexc |= FPEXC_EN;
-        /* Ensure FPINST2 is invalid and the exception flag is cleared. */
-        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
-        h->fpexc = fpexc;
-
-        __get_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
-        __get_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
-
-        return err ? -EFAULT : 0;
+        return vfp_restore_user_hwstate(&frame->ufp, &frame->ufp_exc);
 }
 
 #endif
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index addbbe8028c2..8f4644659777 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -251,8 +251,6 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         struct mm_struct *mm = &init_mm;
         unsigned int cpu = smp_processor_id();
 
-        printk("CPU%u: Booted secondary processor\n", cpu);
-
         /*
          * All kernel threads share the same mm context; grab a
          * reference and switch to it.
@@ -264,6 +262,8 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
         enter_lazy_tlb(mm, current);
         local_flush_tlb_all();
 
+        printk("CPU%u: Booted secondary processor\n", cpu);
+
         cpu_init();
         preempt_disable();
         trace_hardirqs_off();
@@ -510,10 +510,6 @@ static void ipi_cpu_stop(unsigned int cpu)
         local_fiq_disable();
         local_irq_disable();
 
-#ifdef CONFIG_HOTPLUG_CPU
-        platform_cpu_kill(cpu);
-#endif
-
         while (1)
                 cpu_relax();
 }
@@ -576,17 +572,25 @@ void smp_send_reschedule(int cpu)
         smp_cross_call(cpumask_of(cpu), IPI_RESCHEDULE);
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
+static void smp_kill_cpus(cpumask_t *mask)
+{
+        unsigned int cpu;
+        for_each_cpu(cpu, mask)
+                platform_cpu_kill(cpu);
+}
+#else
+static void smp_kill_cpus(cpumask_t *mask) { }
+#endif
+
 void smp_send_stop(void)
 {
         unsigned long timeout;
+        struct cpumask mask;
 
-        if (num_online_cpus() > 1) {
-                struct cpumask mask;
-                cpumask_copy(&mask, cpu_online_mask);
-                cpumask_clear_cpu(smp_processor_id(), &mask);
-
-                smp_cross_call(&mask, IPI_CPU_STOP);
-        }
+        cpumask_copy(&mask, cpu_online_mask);
+        cpumask_clear_cpu(smp_processor_id(), &mask);
+        smp_cross_call(&mask, IPI_CPU_STOP);
 
         /* Wait up to one second for other CPUs to stop */
         timeout = USEC_PER_SEC;
@@ -595,6 +599,8 @@ void smp_send_stop(void)
 
         if (num_online_cpus() > 1)
                 pr_warning("SMP: failed to stop secondary CPUs\n");
+
+        smp_kill_cpus(&mask);
 }
 
 /*
diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
index d2b177905cdb..76cbb055dd05 100644
--- a/arch/arm/kernel/sys_arm.c
+++ b/arch/arm/kernel/sys_arm.c
@@ -115,7 +115,7 @@ int kernel_execve(const char *filename,
                   "Ir" (THREAD_START_SP - sizeof(regs)),
                   "r" (&regs),
                   "Ir" (sizeof(regs))
-                : "r0", "r1", "r2", "r3", "ip", "lr", "memory");
+                : "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
 
  out:
         return ret;
diff --git a/arch/arm/mach-kirkwood/board-dt.c b/arch/arm/mach-kirkwood/board-dt.c
index 1c672d9e6656..f7fe1b9f3170 100644
--- a/arch/arm/mach-kirkwood/board-dt.c
+++ b/arch/arm/mach-kirkwood/board-dt.c
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/kexec.h>
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 #include <mach/bridge-regs.h>
diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c
index fcce7ff37630..cfd98b186fcc 100644
--- a/arch/arm/mach-omap1/ams-delta-fiq.c
+++ b/arch/arm/mach-omap1/ams-delta-fiq.c
@@ -48,7 +48,7 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id)
         struct irq_chip *irq_chip = NULL;
         int gpio, irq_num, fiq_count;
 
-        irq_desc = irq_to_desc(IH_GPIO_BASE);
+        irq_desc = irq_to_desc(gpio_to_irq(AMS_DELTA_GPIO_PIN_KEYBRD_CLK));
         if (irq_desc)
                 irq_chip = irq_desc->irq_data.chip;
 
diff --git a/arch/arm/mach-omap2/board-igep0020.c b/arch/arm/mach-omap2/board-igep0020.c
index 930c0d380435..740cee9369ba 100644
--- a/arch/arm/mach-omap2/board-igep0020.c
+++ b/arch/arm/mach-omap2/board-igep0020.c
@@ -641,7 +641,7 @@ static struct regulator_consumer_supply dummy_supplies[] = {
 
 static void __init igep_init(void)
 {
-        regulator_register_fixed(0, dummy_supplies, ARRAY_SIZE(dummy_supplies));
+        regulator_register_fixed(1, dummy_supplies, ARRAY_SIZE(dummy_supplies));
         omap3_mux_init(board_mux, OMAP_PACKAGE_CBB);
 
         /* Get IGEP2 hardware revision */
diff --git a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
index 1e2d3322f33e..c88420de1151 100644
--- a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
+++ b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
@@ -941,10 +941,10 @@
 #define OMAP4_DSI2_LANEENABLE_MASK                              (0x7 << 29)
 #define OMAP4_DSI1_LANEENABLE_SHIFT                             24
 #define OMAP4_DSI1_LANEENABLE_MASK                              (0x1f << 24)
-#define OMAP4_DSI2_PIPD_SHIFT                                   19
-#define OMAP4_DSI2_PIPD_MASK                                    (0x1f << 19)
-#define OMAP4_DSI1_PIPD_SHIFT                                   14
-#define OMAP4_DSI1_PIPD_MASK                                    (0x1f << 14)
+#define OMAP4_DSI1_PIPD_SHIFT                                   19
+#define OMAP4_DSI1_PIPD_MASK                                    (0x1f << 19)
+#define OMAP4_DSI2_PIPD_SHIFT                                   14
+#define OMAP4_DSI2_PIPD_MASK                                    (0x1f << 14)
 
 /* CONTROL_MCBSPLP */
 #define OMAP4_ALBCTRLRX_FSX_SHIFT                               31
diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h
index eac68978a2c2..db70e79a1198 100644
--- a/arch/arm/mach-orion5x/mpp.h
+++ b/arch/arm/mach-orion5x/mpp.h
@@ -65,8 +65,8 @@
 #define MPP8_GIGE               MPP(8,  0x1, 0, 0, 1,   1,   1)
 
 #define MPP9_UNUSED             MPP(9,  0x0, 0, 0, 1,   1,   1)
-#define MPP9_GPIO               MPP(9,  0x0, 0, 0, 1,   1,   1)
-#define MPP9_GIGE               MPP(9,  0x1, 1, 1, 1,   1,   1)
+#define MPP9_GPIO               MPP(9,  0x0, 1, 1, 1,   1,   1)
+#define MPP9_GIGE               MPP(9,  0x1, 0, 0, 1,   1,   1)
 
 #define MPP10_UNUSED            MPP(10, 0x0, 0, 0, 1,   1,   1)
 #define MPP10_GPIO              MPP(10, 0x0, 1, 1, 1,   1,   1)
diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
index ff1f7cc11f87..80741992a9fc 100644
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -26,18 +26,23 @@ ENTRY(v6_early_abort)
         mrc     p15, 0, r1, c5, c0, 0           @ get FSR
         mrc     p15, 0, r0, c6, c0, 0           @ get FAR
 /*
- * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR (erratum 326103).
- * The test below covers all the write situations, including Java bytecodes
+ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR.
  */
-        bic     r1, r1, #1 << 11                @ clear bit 11 of FSR
+#ifdef CONFIG_ARM_ERRATA_326103
+        ldr     ip, =0x4107b36
+        mrc     p15, 0, r3, c0, c0, 0           @ get processor id
+        teq     ip, r3, lsr #4                  @ r0 ARM1136?
+        bne     do_DataAbort
         tst     r5, #PSR_J_BIT                  @ Java?
+        tsteq   r5, #PSR_T_BIT                  @ Thumb?
         bne     do_DataAbort
-        do_thumb_abort fsr=r1, pc=r4, psr=r5, tmp=r3
-        ldreq   r3, [r4]                        @ read aborted ARM instruction
+        bic     r1, r1, #1 << 11                @ clear bit 11 of FSR
+        ldr     r3, [r4]                        @ read aborted ARM instruction
 #ifdef CONFIG_CPU_ENDIAN_BE8
-        reveq   r3, r3
+        rev     r3, r3
 #endif
         do_ldrd_abort tmp=ip, insn=r3
         tst     r3, #1 << 20                    @ L = 0 -> write
         orreq   r1, r1, #1 << 11                @ yes.
+#endif
         b       do_DataAbort
diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
index a53fd2aaa2f4..2a8e380501e8 100644
--- a/arch/arm/mm/cache-l2x0.c
+++ b/arch/arm/mm/cache-l2x0.c
@@ -32,6 +32,7 @@ static void __iomem *l2x0_base;
 static DEFINE_RAW_SPINLOCK(l2x0_lock);
 static u32 l2x0_way_mask;       /* Bitmask of active ways */
 static u32 l2x0_size;
+static unsigned long sync_reg_offset = L2X0_CACHE_SYNC;
 
 struct l2x0_regs l2x0_saved_regs;
 
@@ -61,12 +62,7 @@ static inline void cache_sync(void)
 {
         void __iomem *base = l2x0_base;
 
-#ifdef CONFIG_PL310_ERRATA_753970
-        /* write to an unmmapped register */
-        writel_relaxed(0, base + L2X0_DUMMY_REG);
-#else
-        writel_relaxed(0, base + L2X0_CACHE_SYNC);
-#endif
+        writel_relaxed(0, base + sync_reg_offset);
         cache_wait(base + L2X0_CACHE_SYNC, 1);
 }
 
@@ -85,10 +81,13 @@ static inline void l2x0_inv_line(unsigned long addr)
 }
 
 #if defined(CONFIG_PL310_ERRATA_588369) || defined(CONFIG_PL310_ERRATA_727915)
+static inline void debug_writel(unsigned long val)
+{
+        if (outer_cache.set_debug)
+                outer_cache.set_debug(val);
+}
 
-#define debug_writel(val)       outer_cache.set_debug(val)
-
-static void l2x0_set_debug(unsigned long val)
+static void pl310_set_debug(unsigned long val)
 {
         writel_relaxed(val, l2x0_base + L2X0_DEBUG_CTRL);
 }
@@ -98,7 +97,7 @@ static inline void debug_writel(unsigned long val)
 {
 }
 
-#define l2x0_set_debug  NULL
+#define pl310_set_debug NULL
 #endif
 
 #ifdef CONFIG_PL310_ERRATA_588369
@@ -331,6 +330,11 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
                 else
                         ways = 8;
                 type = "L310";
+#ifdef CONFIG_PL310_ERRATA_753970
+                /* Unmapped register. */
+                sync_reg_offset = L2X0_DUMMY_REG;
+#endif
+                outer_cache.set_debug = pl310_set_debug;
                 break;
         case L2X0_CACHE_ID_PART_L210:
                 ways = (aux >> 13) & 0xf;
@@ -379,7 +383,6 @@ void __init l2x0_init(void __iomem *base, u32 aux_val, u32 aux_mask)
         outer_cache.flush_all = l2x0_flush_all;
         outer_cache.inv_all = l2x0_inv_all;
         outer_cache.disable = l2x0_disable;
-        outer_cache.set_debug = l2x0_set_debug;
 
         printk(KERN_INFO "%s cache controller enabled\n", type);
         printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n",
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 595079fa9d1d..8f5813bbffb5 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -293,11 +293,11 @@ EXPORT_SYMBOL(pfn_valid);
 #endif
 
 #ifndef CONFIG_SPARSEMEM
-static void arm_memory_present(void)
+static void __init arm_memory_present(void)
 {
 }
 #else
-static void arm_memory_present(void)
+static void __init arm_memory_present(void)
 {
         struct memblock_region *reg;
 
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index b86f8933ff91..2c7cf2f9c837 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -618,8 +618,8 @@ static void __init alloc_init_section(pud_t *pud, unsigned long addr,
         }
 }
 
-static void alloc_init_pud(pgd_t *pgd, unsigned long addr, unsigned long end,
-        unsigned long phys, const struct mem_type *type)
+static void __init alloc_init_pud(pgd_t *pgd, unsigned long addr,
+        unsigned long end, unsigned long phys, const struct mem_type *type)
 {
         pud_t *pud = pud_offset(pgd, addr);
         unsigned long next;
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index ecdb3da0dea9..c58d896cd5c3 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -916,6 +916,13 @@ void omap_start_dma(int lch)
                         l |= OMAP_DMA_CCR_BUFFERING_DISABLE;
         l |= OMAP_DMA_CCR_EN;
 
+        /*
+         * As dma_write() uses IO accessors which are weakly ordered, there
+         * is no guarantee that data in coherent DMA memory will be visible
+         * to the DMA device.  Add a memory barrier here to ensure that any
+         * such data is visible prior to enabling DMA.
+         */
+        mb();
         p->dma_write(l, CCR, lch);
 
         dma_chan[lch].flags |= OMAP_DMA_ACTIVE;
@@ -965,6 +972,13 @@ void omap_stop_dma(int lch)
                 p->dma_write(l, CCR, lch);
         }
 
+        /*
+         * Ensure that data transferred by DMA is visible to any access
+         * after DMA has been disabled.  This is important for coherent
+         * DMA regions.
+         */
+        mb();
+
         if (!omap_dma_in_1510_mode() && dma_chan[lch].next_lch != -1) {
                 int next_lch, cur_lch = lch;
                 char dma_chan_link_map[dma_lch_count];
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index 858748eaa144..bc683b8219b5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -17,6 +17,8 @@
 #include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/uaccess.h>
+#include <linux/user.h>
 
 #include <asm/cp15.h>
 #include <asm/cputype.h>
@@ -529,6 +531,103 @@ void vfp_flush_hwstate(struct thread_info *thread)
 }
 
 /*
+ * Save the current VFP state into the provided structures and prepare
+ * for entry into a new function (signal handler).
+ */
+int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,
+                                    struct user_vfp_exc __user *ufp_exc)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+        int err = 0;
+
+        /* Ensure that the saved hwstate is up-to-date. */
+        vfp_sync_hwstate(thread);
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_to_user(&ufp->fpregs, &hwstate->fpregs,
+                              sizeof(hwstate->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __put_user_error(hwstate->fpscr, &ufp->fpscr, err);
+
+        /*
+         * Copy the exception registers.
+         */
+        __put_user_error(hwstate->fpexc, &ufp_exc->fpexc, err);
+        __put_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+        __put_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+
+        if (err)
+                return -EFAULT;
+
+        /* Ensure that VFP is disabled. */
+        vfp_flush_hwstate(thread);
+
+        /*
+         * As per the PCS, clear the length and stride bits for function
+         * entry.
+         */
+        hwstate->fpscr &= ~(FPSCR_LENGTH_MASK | FPSCR_STRIDE_MASK);
+
+        /*
+         * Disable VFP in the hwstate so that we can detect if it gets
+         * used.
+         */
+        hwstate->fpexc &= ~FPEXC_EN;
+        return 0;
+}
+
+/* Sanitise and restore the current VFP state from the provided structures. */
+int vfp_restore_user_hwstate(struct user_vfp __user *ufp,
+                             struct user_vfp_exc __user *ufp_exc)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *hwstate = &thread->vfpstate.hard;
+        unsigned long fpexc;
+        int err = 0;
+
+        /*
+         * If VFP has been used, then disable it to avoid corrupting
+         * the new thread state.
+         */
+        if (hwstate->fpexc & FPEXC_EN)
+                vfp_flush_hwstate(thread);
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_from_user(&hwstate->fpregs, &ufp->fpregs,
+                                sizeof(hwstate->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __get_user_error(hwstate->fpscr, &ufp->fpscr, err);
+
+        /*
+         * Sanitise and restore the exception registers.
+         */
+        __get_user_error(fpexc, &ufp_exc->fpexc, err);
+
+        /* Ensure the VFP is enabled. */
+        fpexc |= FPEXC_EN;
+
+        /* Ensure FPINST2 is invalid and the exception flag is cleared. */
+        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+        hwstate->fpexc = fpexc;
+
+        __get_user_error(hwstate->fpinst, &ufp_exc->fpinst, err);
+        __get_user_error(hwstate->fpinst2, &ufp_exc->fpinst2, err);
+
+        return err ? -EFAULT : 0;
+}
+
+/*
  * VFP hardware can lose all context when a CPU goes offline.
  * As we will be running in SMP mode with CPU hotplug, we will save the
  * hardware state at every thread switch.  We clear our held state when
diff --git a/arch/ia64/kvm/kvm-ia64.c b/arch/ia64/kvm/kvm-ia64.c
index f5104b7c52cd..463fb3bbe11e 100644
--- a/arch/ia64/kvm/kvm-ia64.c
+++ b/arch/ia64/kvm/kvm-ia64.c
@@ -1174,7 +1174,7 @@ out:
 
 bool kvm_vcpu_compatible(struct kvm_vcpu *vcpu)
 {
-        return irqchip_in_kernel(vcpu->kcm) == (vcpu->arch.apic != NULL);
+        return irqchip_in_kernel(vcpu->kvm) == (vcpu->arch.apic != NULL);
 }
 
 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
diff --git a/arch/m68k/platform/520x/config.c b/arch/m68k/platform/520x/config.c
index 235947844f27..09df4b89e8be 100644
--- a/arch/m68k/platform/520x/config.c
+++ b/arch/m68k/platform/520x/config.c
@@ -22,7 +22,7 @@
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m520x_qspi_init(void)
 {
@@ -35,7 +35,7 @@ static void __init m520x_qspi_init(void)
         writew(par, MCF_GPIO_PAR_UART);
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -79,7 +79,7 @@ void __init config_BSP(char *commandp, int size)
         mach_sched_init = hw_timer_init;
         m520x_uarts_init();
         m520x_fec_init();
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m520x_qspi_init();
 #endif
 }
diff --git a/arch/m68k/platform/523x/config.c b/arch/m68k/platform/523x/config.c
index c8b405d5a961..d47dfd8f50a2 100644
--- a/arch/m68k/platform/523x/config.c
+++ b/arch/m68k/platform/523x/config.c
@@ -22,7 +22,7 @@
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m523x_qspi_init(void)
 {
@@ -36,7 +36,7 @@ static void __init m523x_qspi_init(void)
         writew(par, MCFGPIO_PAR_TIMER);
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -58,7 +58,7 @@ void __init config_BSP(char *commandp, int size)
 {
         mach_sched_init = hw_timer_init;
         m523x_fec_init();
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m523x_qspi_init();
 #endif
 }
diff --git a/arch/m68k/platform/5249/config.c b/arch/m68k/platform/5249/config.c
index bbf05135bb98..300e729a58d0 100644
--- a/arch/m68k/platform/5249/config.c
+++ b/arch/m68k/platform/5249/config.c
@@ -51,7 +51,7 @@ static struct platform_device *m5249_devices[] __initdata = {
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m5249_qspi_init(void)
 {
@@ -61,7 +61,7 @@ static void __init m5249_qspi_init(void)
         mcf_mapirq2imr(MCF_IRQ_QSPI, MCFINTC_QSPI);
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -90,7 +90,7 @@ void __init config_BSP(char *commandp, int size)
 #ifdef CONFIG_M5249C3
         m5249_smc91x_init();
 #endif
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m5249_qspi_init();
 #endif
 }
diff --git a/arch/m68k/platform/527x/config.c b/arch/m68k/platform/527x/config.c
index f91a53294c35..b3cb378c5e94 100644
--- a/arch/m68k/platform/527x/config.c
+++ b/arch/m68k/platform/527x/config.c
@@ -23,7 +23,7 @@
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m527x_qspi_init(void)
 {
@@ -42,7 +42,7 @@ static void __init m527x_qspi_init(void)
 #endif
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -90,7 +90,7 @@ void __init config_BSP(char *commandp, int size)
         mach_sched_init = hw_timer_init;
         m527x_uarts_init();
         m527x_fec_init();
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m527x_qspi_init();
 #endif
 }
diff --git a/arch/m68k/platform/528x/config.c b/arch/m68k/platform/528x/config.c
index d4492926614c..c5f11ba49be5 100644
--- a/arch/m68k/platform/528x/config.c
+++ b/arch/m68k/platform/528x/config.c
@@ -24,7 +24,7 @@
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m528x_qspi_init(void)
 {
@@ -32,7 +32,7 @@ static void __init m528x_qspi_init(void)
         __raw_writeb(0x07, MCFGPIO_PQSPAR);
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -98,7 +98,7 @@ void __init config_BSP(char *commandp, int size)
         mach_sched_init = hw_timer_init;
         m528x_uarts_init();
         m528x_fec_init();
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m528x_qspi_init();
 #endif
 }
diff --git a/arch/m68k/platform/532x/config.c b/arch/m68k/platform/532x/config.c
index 2bec3477b739..37082d02f2bd 100644
--- a/arch/m68k/platform/532x/config.c
+++ b/arch/m68k/platform/532x/config.c
@@ -30,7 +30,7 @@
 
 /***************************************************************************/
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 
 static void __init m532x_qspi_init(void)
 {
@@ -38,7 +38,7 @@ static void __init m532x_qspi_init(void)
         writew(0x01f0, MCF_GPIO_PAR_QSPI);
 }
 
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 /***************************************************************************/
 
@@ -77,7 +77,7 @@ void __init config_BSP(char *commandp, int size)
         mach_sched_init = hw_timer_init;
         m532x_uarts_init();
         m532x_fec_init();
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         m532x_qspi_init();
 #endif
 
diff --git a/arch/m68k/platform/coldfire/device.c b/arch/m68k/platform/coldfire/device.c
index 7af97362b95c..3aa77ddea89d 100644
--- a/arch/m68k/platform/coldfire/device.c
+++ b/arch/m68k/platform/coldfire/device.c
@@ -121,7 +121,7 @@ static struct platform_device mcf_fec1 = {
 #endif /* MCFFEC_BASE1 */
 #endif /* CONFIG_FEC */
 
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
 /*
  *      The ColdFire QSPI module is an SPI protocol hardware block used
  *      on a number of different ColdFire CPUs.
@@ -274,7 +274,7 @@ static struct platform_device mcf_qspi = {
         .resource               = mcf_qspi_resources,
         .dev.platform_data      = &mcf_qspi_data,
 };
-#endif /* CONFIG_SPI_COLDFIRE_QSPI */
+#endif /* IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI) */
 
 static struct platform_device *mcf_devices[] __initdata = {
         &mcf_uart,
@@ -284,7 +284,7 @@ static struct platform_device *mcf_devices[] __initdata = {
         &mcf_fec1,
 #endif
 #endif
-#ifdef CONFIG_SPI_COLDFIRE_QSPI
+#if IS_ENABLED(CONFIG_SPI_COLDFIRE_QSPI)
         &mcf_qspi,
 #endif
 };
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index e21507052066..9c717bf98ffe 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -58,8 +58,8 @@ static void __init ar913x_wmac_setup(void)
 
 static int ar933x_wmac_reset(void)
 {
-        ath79_device_reset_clear(AR933X_RESET_WMAC);
         ath79_device_reset_set(AR933X_RESET_WMAC);
+        ath79_device_reset_clear(AR933X_RESET_WMAC);
 
         return 0;
 }
diff --git a/arch/mips/include/asm/mach-jz4740/irq.h b/arch/mips/include/asm/mach-jz4740/irq.h
index a865c983c70a..5ad1a9c113c6 100644
--- a/arch/mips/include/asm/mach-jz4740/irq.h
+++ b/arch/mips/include/asm/mach-jz4740/irq.h
@@ -45,7 +45,7 @@
 #define JZ4740_IRQ_LCD          JZ4740_IRQ(30)
 
 /* 2nd-level interrupts */
-#define JZ4740_IRQ_DMA(x)       (JZ4740_IRQ(32) + (X))
+#define JZ4740_IRQ_DMA(x)       (JZ4740_IRQ(32) + (x))
 
 #define JZ4740_IRQ_INTC_GPIO(x) (JZ4740_IRQ_GPIO0 - (x))
 #define JZ4740_IRQ_GPIO(x)      (JZ4740_IRQ(48) + (x))
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 73c0d45798de..9b02cfba7449 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -37,12 +37,6 @@ extern void tlbmiss_handler_setup_pgd(unsigned long pgd);
                 write_c0_xcontext((unsigned long) smp_processor_id() << 51); \
         } while (0)
 
-
-static inline unsigned long get_current_pgd(void)
-{
-        return PHYS_TO_XKSEG_CACHED((read_c0_context() >> 11) & ~0xfffUL);
-}
-
 #else /* CONFIG_MIPS_PGD_C0_CONTEXT: using  pgd_current*/
 
 /*
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index 185ca00c4c84..d5a338a1739c 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -257,11 +257,8 @@ asmlinkage int sys_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -286,11 +283,8 @@ asmlinkage int sys_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -362,10 +356,7 @@ asmlinkage void sys_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&blocked, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = blocked;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&blocked);
 
         sig = restore_sigcontext(&regs, &frame->sf_sc);
         if (sig < 0)
@@ -401,10 +392,7 @@ asmlinkage void sys_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
@@ -580,12 +568,7 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         if (ret)
                 return ret;
 
-        spin_lock_irq(&current->sighand->siglock);
-        sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
-        if (!(ka->sa.sa_flags & SA_NODEFER))
-                sigaddset(&current->blocked, sig);
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        block_sigmask(ka, sig);
 
         return ret;
 }
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 06b5da392e24..ac3b8d89aae5 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -290,11 +290,8 @@ asmlinkage int sys32_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -318,11 +315,8 @@ asmlinkage int sys32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
                 return -EFAULT;
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -488,10 +482,7 @@ asmlinkage void sys32_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&blocked, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = blocked;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&blocked);
 
         sig = restore_sigcontext32(&regs, &frame->sf_sc);
         if (sig < 0)
@@ -529,10 +520,7 @@ asmlinkage void sys32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext32(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index ae29e894ab8d..86eb4b04631c 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -93,11 +93,8 @@ asmlinkage int sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
         sigset_from_compat(&newset, &uset);
         sigdelsetmask(&newset, ~_BLOCKABLE);
 
-        spin_lock_irq(&current->sighand->siglock);
         current->saved_sigmask = current->blocked;
-        current->blocked = newset;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&newset);
 
         current->state = TASK_INTERRUPTIBLE;
         schedule();
@@ -121,10 +118,7 @@ asmlinkage void sysn32_rt_sigreturn(nabi_no_regargs struct pt_regs regs)
                 goto badframe;
 
         sigdelsetmask(&set, ~_BLOCKABLE);
-        spin_lock_irq(&current->sighand->siglock);
-        current->blocked = set;
-        recalc_sigpending();
-        spin_unlock_irq(&current->sighand->siglock);
+        set_current_blocked(&set);
 
         sig = restore_sigcontext(&regs, &frame->rs_uc.uc_mcontext);
         if (sig < 0)
diff --git a/arch/parisc/include/asm/hardware.h b/arch/parisc/include/asm/hardware.h
index 4e9626836bab..d1d864b81bae 100644
--- a/arch/parisc/include/asm/hardware.h
+++ b/arch/parisc/include/asm/hardware.h
@@ -2,7 +2,6 @@
 #define _PARISC_HARDWARE_H
 
 #include <linux/mod_devicetable.h>
-#include <asm/pdc.h>
 
 #define HWTYPE_ANY_ID           PA_HWTYPE_ANY_ID
 #define HVERSION_ANY_ID         PA_HVERSION_ANY_ID
@@ -95,12 +94,14 @@ struct bc_module {
 #define HPHW_MC        15
 #define HPHW_FAULTY    31
 
+struct parisc_device_id;
 
 /* hardware.c: */
 extern const char *parisc_hardware_description(struct parisc_device_id *id);
 extern enum cpu_type parisc_get_cpu_type(unsigned long hversion);
 
 struct pci_dev;
+struct hardware_path;
 
 /* drivers.c: */
 extern struct parisc_device *alloc_pa_dev(unsigned long hpa,
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index a84cc1f925f6..4e0e7dbf0f3f 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -160,5 +160,11 @@ extern int npmem_ranges;
 
 #include <asm-generic/memory_model.h>
 #include <asm-generic/getorder.h>
+#include <asm/pdc.h>
+
+#define PAGE0   ((struct zeropage *)__PAGE_OFFSET)
+
+/* DEFINITION OF THE ZERO-PAGE (PAG0) */
+/* based on work by Jason Eckhardt (jason@equator.com) */
 
 #endif /* _PARISC_PAGE_H */
diff --git a/arch/parisc/include/asm/pdc.h b/arch/parisc/include/asm/pdc.h
index 4ca510b3c6f8..7f0f2d23059d 100644
--- a/arch/parisc/include/asm/pdc.h
+++ b/arch/parisc/include/asm/pdc.h
@@ -343,8 +343,6 @@
 
 #ifdef __KERNEL__
 
-#include <asm/page.h> /* for __PAGE_OFFSET */
-
 extern int pdc_type;
 
 /* Values for pdc_type */
@@ -677,11 +675,6 @@ static inline char * os_id_to_string(u16 os_id) {
 
 #endif /* __KERNEL__ */
 
-#define PAGE0   ((struct zeropage *)__PAGE_OFFSET)
-
-/* DEFINITION OF THE ZERO-PAGE (PAG0) */
-/* based on work by Jason Eckhardt (jason@equator.com) */
-
 /* flags of the device_path */
 #define PF_AUTOBOOT     0x80
 #define PF_AUTOSEARCH   0x40
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
index 22dadeb58695..ee99f2339356 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
@@ -44,6 +44,8 @@ struct vm_area_struct;
 
 #endif /* !__ASSEMBLY__ */
 
+#include <asm/page.h>
+
 #define pte_ERROR(e) \
         printk("%s:%d: bad pte %08lx.\n", __FILE__, __LINE__, pte_val(e))
 #define pmd_ERROR(e) \
diff --git a/arch/parisc/include/asm/spinlock.h b/arch/parisc/include/asm/spinlock.h
index 804aa28ab1d6..3516e0b27044 100644
--- a/arch/parisc/include/asm/spinlock.h
+++ b/arch/parisc/include/asm/spinlock.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_SPINLOCK_H
 #define __ASM_SPINLOCK_H
 
+#include <asm/barrier.h>
+#include <asm/ldcw.h>
 #include <asm/processor.h>
 #include <asm/spinlock_types.h>
 
diff --git a/arch/parisc/kernel/pdc_cons.c b/arch/parisc/kernel/pdc_cons.c
index 4f004596a6e7..47341aa208f2 100644
--- a/arch/parisc/kernel/pdc_cons.c
+++ b/arch/parisc/kernel/pdc_cons.c
@@ -50,6 +50,7 @@
 #include <linux/init.h>
 #include <linux/major.h>
 #include <linux/tty.h>
+#include <asm/page.h>           /* for PAGE0 */
 #include <asm/pdc.h>            /* for iodc_call() proto and friends */
 
 static DEFINE_SPINLOCK(pdc_console_lock);
@@ -104,7 +105,7 @@ static int pdc_console_tty_open(struct tty_struct *tty, struct file *filp)
 
 static void pdc_console_tty_close(struct tty_struct *tty, struct file *filp)
 {
-        if (!tty->count) {
+        if (tty->count == 1) {
                 del_timer_sync(&pdc_console_timer);
                 tty_port_tty_set(&tty_port, NULL);
         }
diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c
index 7c0774397b89..70e105d62423 100644
--- a/arch/parisc/kernel/time.c
+++ b/arch/parisc/kernel/time.c
@@ -29,6 +29,7 @@
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/irq.h>
+#include <asm/page.h>
 #include <asm/param.h>
 #include <asm/pdc.h>
 #include <asm/led.h>
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index 29f13570214d..ed1718feb9d9 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -584,23 +584,19 @@ _GLOBAL(ret_from_except_lite)
 fast_exc_return_irq:
 restore:
         /*
-         * This is the main kernel exit path, we first check if we
-         * have to change our interrupt state.
+         * This is the main kernel exit path. First we check if we
+         * are about to re-enable interrupts
          */
         ld      r5,SOFTE(r1)
         lbz     r6,PACASOFTIRQEN(r13)
-        cmpwi   cr1,r5,0
-        cmpw    cr0,r5,r6
-        beq     cr0,4f
+        cmpwi   cr0,r5,0
+        beq     restore_irq_off
 
-        /* We do, handle disable first, which is easy */
-        bne     cr1,3f;
-        li      r0,0
-        stb     r0,PACASOFTIRQEN(r13);
-        TRACE_DISABLE_INTS
-        b       4f
+        /* We are enabling, were we already enabled ? Yes, just return */
+        cmpwi   cr0,r6,1
+        beq     cr0,do_restore
 
-3:      /*
+        /*
          * We are about to soft-enable interrupts (we are hard disabled
          * at this point). We check if there's anything that needs to
          * be replayed first.
@@ -622,7 +618,7 @@ restore_no_replay:
         /*
          * Final return path. BookE is handled in a different file
          */
-4:
+do_restore:
 #ifdef CONFIG_PPC_BOOK3E
         b       .exception_return_book3e
 #else
@@ -696,6 +692,25 @@ fast_exception_return:
 #endif /* CONFIG_PPC_BOOK3E */
 
         /*
+         * We are returning to a context with interrupts soft disabled.
+         *
+         * However, we may also about to hard enable, so we need to
+         * make sure that in this case, we also clear PACA_IRQ_HARD_DIS
+         * or that bit can get out of sync and bad things will happen
+         */
+restore_irq_off:
+        ld      r3,_MSR(r1)
+        lbz     r7,PACAIRQHAPPENED(r13)
+        andi.   r0,r3,MSR_EE
+        beq     1f
+        rlwinm  r7,r7,0,~PACA_IRQ_HARD_DIS
+        stb     r7,PACAIRQHAPPENED(r13)
+1:      li      r0,0
+        stb     r0,PACASOFTIRQEN(r13);
+        TRACE_DISABLE_INTS
+        b       do_restore
+
+        /*
          * Something did happen, check if a re-emit is needed
          * (this also clears paca->irq_happened)
          */
@@ -744,6 +759,9 @@ restore_check_irq_replay:
 #endif /* CONFIG_PPC_BOOK3E */
 1:      b       .ret_from_except /* What else to do here ? */
  
+
+
+3:
 do_work:
 #ifdef CONFIG_PREEMPT
         andi.   r0,r3,MSR_PR    /* Returning to user mode? */
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index c6c6f3b7f8cd..641da9e868ce 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -229,6 +229,19 @@ notrace void arch_local_irq_restore(unsigned long en)
          */
         if (unlikely(irq_happened != PACA_IRQ_HARD_DIS))
                 __hard_irq_disable();
+#ifdef CONFIG_TRACE_IRQFLAG
+        else {
+                /*
+                 * We should already be hard disabled here. We had bugs
+                 * where that wasn't the case so let's dbl check it and
+                 * warn if we are wrong. Only do that when IRQ tracing
+                 * is enabled as mfmsr() can be costly.
+                 */
+                if (WARN_ON(mfmsr() & MSR_EE))
+                        __hard_irq_disable();
+        }
+#endif /* CONFIG_TRACE_IRQFLAG */
+
         set_soft_enabled(0);
 
         /*
diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c
index ddc485a529f2..c3beaeef3f60 100644
--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -258,6 +258,8 @@ static long kvmppc_get_guest_page(struct kvm *kvm, unsigned long gfn,
                             !(memslot->userspace_addr & (s - 1))) {
                                 start &= ~(s - 1);
                                 pgsize = s;
+                                get_page(hpage);
+                                put_page(page);
                                 page = hpage;
                         }
                 }
@@ -281,11 +283,8 @@ static long kvmppc_get_guest_page(struct kvm *kvm, unsigned long gfn,
         err = 0;
 
  out:
-        if (got) {
-                if (PageHuge(page))
-                        page = compound_head(page);
+        if (got)
                 put_page(page);
-        }
         return err;
 
  up_err:
@@ -678,8 +677,15 @@ int kvmppc_book3s_hv_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu,
                 SetPageDirty(page);
 
  out_put:
-        if (page)
-                put_page(page);
+        if (page) {
+                /*
+                 * We drop pages[0] here, not page because page might
+                 * have been set to the head page of a compound, but
+                 * we have to drop the reference on the correct tail
+                 * page to match the get inside gup()
+                 */
+                put_page(pages[0]);
+        }
         return ret;
 
  out_unlock:
@@ -979,6 +985,7 @@ void *kvmppc_pin_guest_page(struct kvm *kvm, unsigned long gpa,
                         pa = *physp;
                 }
                 page = pfn_to_page(pa >> PAGE_SHIFT);
+                get_page(page);
         } else {
                 hva = gfn_to_hva_memslot(memslot, gfn);
                 npages = get_user_pages_fast(hva, 1, 1, pages);
@@ -991,8 +998,6 @@ void *kvmppc_pin_guest_page(struct kvm *kvm, unsigned long gpa,
                 page = compound_head(page);
                 psize <<= compound_order(page);
         }
-        if (!kvm->arch.using_mmu_notifiers)
-                get_page(page);
         offset = gpa & (psize - 1);
         if (nb_ret)
                 *nb_ret = psize - offset;
@@ -1003,7 +1008,6 @@ void kvmppc_unpin_guest_page(struct kvm *kvm, void *va)
 {
         struct page *page = virt_to_page(va);
 
-        page = compound_head(page);
         put_page(page);
 }
 
diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c
index 01294a5099dd..108d1f580177 100644
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1192,8 +1192,6 @@ static void unpin_slot(struct kvm *kvm, int slot_id)
                                 continue;
                         pfn = physp[j] >> PAGE_SHIFT;
                         page = pfn_to_page(pfn);
-                        if (PageHuge(page))
-                                page = compound_head(page);
                         SetPageDirty(page);
                         put_page(page);
                 }
diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
index af1ab5e9a691..5c3cf2d04e41 100644
--- a/arch/powerpc/net/bpf_jit.h
+++ b/arch/powerpc/net/bpf_jit.h
@@ -48,7 +48,13 @@
 /*
  * Assembly helpers from arch/powerpc/net/bpf_jit.S:
  */
-extern u8 sk_load_word[], sk_load_half[], sk_load_byte[], sk_load_byte_msh[];
+#define DECLARE_LOAD_FUNC(func) \
+        extern u8 func[], func##_negative_offset[], func##_positive_offset[]
+
+DECLARE_LOAD_FUNC(sk_load_word);
+DECLARE_LOAD_FUNC(sk_load_half);
+DECLARE_LOAD_FUNC(sk_load_byte);
+DECLARE_LOAD_FUNC(sk_load_byte_msh);
 
 #define FUNCTION_DESCR_SIZE     24
 
diff --git a/arch/powerpc/net/bpf_jit_64.S b/arch/powerpc/net/bpf_jit_64.S
index ff4506e85cce..55ba3855a97f 100644
--- a/arch/powerpc/net/bpf_jit_64.S
+++ b/arch/powerpc/net/bpf_jit_64.S
@@ -31,14 +31,13 @@
  * then branch directly to slow_path_XXX if required.  (In fact, could
  * load a spare GPR with the address of slow_path_generic and pass size
  * as an argument, making the call site a mtlr, li and bllr.)
- *
- * Technically, the "is addr < 0" check is unnecessary & slowing down
- * the ABS path, as it's statically checked on generation.
  */
         .globl  sk_load_word
 sk_load_word:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_word_neg
+        .globl  sk_load_word_positive_offset
+sk_load_word_positive_offset:
         /* Are we accessing past headlen? */
         subi    r_scratch1, r_HL, 4
         cmpd    r_scratch1, r_addr
@@ -51,7 +50,9 @@ sk_load_word:
         .globl  sk_load_half
 sk_load_half:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_half_neg
+        .globl  sk_load_half_positive_offset
+sk_load_half_positive_offset:
         subi    r_scratch1, r_HL, 2
         cmpd    r_scratch1, r_addr
         blt     bpf_slow_path_half
@@ -61,7 +62,9 @@ sk_load_half:
         .globl  sk_load_byte
 sk_load_byte:
         cmpdi   r_addr, 0
-        blt     bpf_error
+        blt     bpf_slow_path_byte_neg
+        .globl  sk_load_byte_positive_offset
+sk_load_byte_positive_offset:
         cmpd    r_HL, r_addr
         ble     bpf_slow_path_byte
         lbzx    r_A, r_D, r_addr
@@ -69,22 +72,20 @@ sk_load_byte:
 
 /*
  * BPF_S_LDX_B_MSH: ldxb  4*([offset]&0xf)
- * r_addr is the offset value, already known positive
+ * r_addr is the offset value
  */
         .globl sk_load_byte_msh
 sk_load_byte_msh:
+        cmpdi   r_addr, 0
+        blt     bpf_slow_path_byte_msh_neg
+        .globl sk_load_byte_msh_positive_offset
+sk_load_byte_msh_positive_offset:
         cmpd    r_HL, r_addr
         ble     bpf_slow_path_byte_msh
         lbzx    r_X, r_D, r_addr
         rlwinm  r_X, r_X, 2, 32-4-2, 31-2
         blr
 
-bpf_error:
-        /* Entered with cr0 = lt */
-        li      r3, 0
-        /* Generated code will 'blt epilogue', returning 0. */
-        blr
-
 /* Call out to skb_copy_bits:
  * We'll need to back up our volatile regs first; we have
  * local variable space at r1+(BPF_PPC_STACK_BASIC).
@@ -136,3 +137,84 @@ bpf_slow_path_byte_msh:
         lbz     r_X, BPF_PPC_STACK_BASIC+(2*8)(r1)
         rlwinm  r_X, r_X, 2, 32-4-2, 31-2
         blr
+
+/* Call out to bpf_internal_load_pointer_neg_helper:
+ * We'll need to back up our volatile regs first; we have
+ * local variable space at r1+(BPF_PPC_STACK_BASIC).
+ * Allocate a new stack frame here to remain ABI-compliant in
+ * stashing LR.
+ */
+#define sk_negative_common(SIZE)                                \
+        mflr    r0;                                             \
+        std     r0, 16(r1);                                     \
+        /* R3 goes in parameter space of caller's frame */      \
+        std     r_skb, (BPF_PPC_STACKFRAME+48)(r1);             \
+        std     r_A, (BPF_PPC_STACK_BASIC+(0*8))(r1);           \
+        std     r_X, (BPF_PPC_STACK_BASIC+(1*8))(r1);           \
+        stdu    r1, -BPF_PPC_SLOWPATH_FRAME(r1);                \
+        /* R3 = r_skb, as passed */                             \
+        mr      r4, r_addr;                                     \
+        li      r5, SIZE;                                       \
+        bl      bpf_internal_load_pointer_neg_helper;           \
+        /* R3 != 0 on success */                                \
+        addi    r1, r1, BPF_PPC_SLOWPATH_FRAME;                 \
+        ld      r0, 16(r1);                                     \
+        ld      r_A, (BPF_PPC_STACK_BASIC+(0*8))(r1);           \
+        ld      r_X, (BPF_PPC_STACK_BASIC+(1*8))(r1);           \
+        mtlr    r0;                                             \
+        cmpldi  r3, 0;                                          \
+        beq     bpf_error_slow; /* cr0 = EQ */                  \
+        mr      r_addr, r3;                                     \
+        ld      r_skb, (BPF_PPC_STACKFRAME+48)(r1);             \
+        /* Great success! */
+
+bpf_slow_path_word_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_word_negative_offset
+sk_load_word_negative_offset:
+        sk_negative_common(4)
+        lwz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_half_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_half_negative_offset
+sk_load_half_negative_offset:
+        sk_negative_common(2)
+        lhz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_byte_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_byte_negative_offset
+sk_load_byte_negative_offset:
+        sk_negative_common(1)
+        lbz     r_A, 0(r_addr)
+        blr
+
+bpf_slow_path_byte_msh_neg:
+        lis     r_scratch1,-32  /* SKF_LL_OFF */
+        cmpd    r_addr, r_scratch1      /* addr < SKF_* */
+        blt     bpf_error       /* cr0 = LT */
+        .globl  sk_load_byte_msh_negative_offset
+sk_load_byte_msh_negative_offset:
+        sk_negative_common(1)
+        lbz     r_X, 0(r_addr)
+        rlwinm  r_X, r_X, 2, 32-4-2, 31-2
+        blr
+
+bpf_error_slow:
+        /* fabricate a cr0 = lt */
+        li      r_scratch1, -1
+        cmpdi   r_scratch1, 0
+bpf_error:
+        /* Entered with cr0 = lt */
+        li      r3, 0
+        /* Generated code will 'blt epilogue', returning 0. */
+        blr
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index 73619d3aeb6c..2dc8b1484845 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -127,6 +127,9 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx)
         PPC_BLR();
 }
 
+#define CHOOSE_LOAD_FUNC(K, func) \
+        ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative_offset : func) : func##_positive_offset)
+
 /* Assemble the body code between the prologue & epilogue. */
 static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                               struct codegen_context *ctx,
@@ -391,21 +394,16 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
 
                         /*** Absolute loads from packet header/data ***/
                 case BPF_S_LD_W_ABS:
-                        func = sk_load_word;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_word);
                         goto common_load;
                 case BPF_S_LD_H_ABS:
-                        func = sk_load_half;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_half);
                         goto common_load;
                 case BPF_S_LD_B_ABS:
-                        func = sk_load_byte;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_byte);
                 common_load:
-                        /*
-                         * Load from [K].  Reference with the (negative)
-                         * SKF_NET_OFF/SKF_LL_OFF offsets is unsupported.
-                         */
+                        /* Load from [K]. */
                         ctx->seen |= SEEN_DATAREF;
-                        if ((int)K < 0)
-                                return -ENOTSUPP;
                         PPC_LI64(r_scratch1, func);
                         PPC_MTLR(r_scratch1);
                         PPC_LI32(r_addr, K);
@@ -429,7 +427,7 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                 common_load_ind:
                         /*
                          * Load from [X + K].  Negative offsets are tested for
-                         * in the helper functions, and result in a 'ret 0'.
+                         * in the helper functions.
                          */
                         ctx->seen |= SEEN_DATAREF | SEEN_XREG;
                         PPC_LI64(r_scratch1, func);
@@ -443,13 +441,7 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                         break;
 
                 case BPF_S_LDX_B_MSH:
-                        /*
-                         * x86 version drops packet (RET 0) when K<0, whereas
-                         * interpreter does allow K<0 (__load_pointer, special
-                         * ancillary data).  common_load returns ENOTSUPP if K<0,
-                         * so we fall back to interpreter & filter works.
-                         */
-                        func = sk_load_byte_msh;
+                        func = CHOOSE_LOAD_FUNC(K, sk_load_byte_msh);
                         goto common_load;
                         break;
 
diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c
index 38d48a59879c..9708851a8b9f 100644
--- a/arch/sparc/kernel/central.c
+++ b/arch/sparc/kernel/central.c
@@ -269,4 +269,4 @@ static int __init sunfire_init(void)
         return 0;
 }
 
-subsys_initcall(sunfire_init);
+fs_initcall(sunfire_init);
diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
index b57a5942ba64..874162a11ceb 100644
--- a/arch/sparc/mm/ultra.S
+++ b/arch/sparc/mm/ultra.S
@@ -495,11 +495,11 @@ xcall_fetch_glob_regs:
         stx             %o7, [%g1 + GR_SNAP_O7]
         stx             %i7, [%g1 + GR_SNAP_I7]
         /* Don't try this at home kids... */
-        rdpr            %cwp, %g2
-        sub             %g2, 1, %g7
+        rdpr            %cwp, %g3
+        sub             %g3, 1, %g7
         wrpr            %g7, %cwp
         mov             %i7, %g7
-        wrpr            %g2, %cwp
+        wrpr            %g3, %cwp
         stx             %g7, [%g1 + GR_SNAP_RPC]
         sethi           %hi(trap_block), %g7
         or              %g7, %lo(trap_block), %g7
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 1d14cc6b79ad..c9866b0b77d8 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -81,7 +81,7 @@ config X86
         select CLKEVT_I8253
         select ARCH_HAVE_NMI_SAFE_CMPXCHG
         select GENERIC_IOMAP
-        select DCACHE_WORD_ACCESS if !DEBUG_PAGEALLOC
+        select DCACHE_WORD_ACCESS
 
 config INSTRUCTION_DECODER
         def_bool (KPROBES || PERF_EVENTS)
diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
index d3c0b0277666..fb7117a4ade1 100644
--- a/arch/x86/boot/compressed/relocs.c
+++ b/arch/x86/boot/compressed/relocs.c
@@ -403,13 +403,11 @@ static void print_absolute_symbols(void)
         for (i = 0; i < ehdr.e_shnum; i++) {
                 struct section *sec = &secs[i];
                 char *sym_strtab;
-                Elf32_Sym *sh_symtab;
                 int j;
 
                 if (sec->shdr.sh_type != SHT_SYMTAB) {
                         continue;
                 }
-                sh_symtab = sec->symtab;
                 sym_strtab = sec->link->strtab;
                 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
                         Elf32_Sym *sym;
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index 4824fb45560f..07b3a68d2d29 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -294,8 +294,7 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
 
         /* OK, This is the point of no return */
         set_personality(PER_LINUX);
-        set_thread_flag(TIF_IA32);
-        current->mm->context.ia32_compat = 1;
+        set_personality_ia32(false);
 
         setup_new_exec(bprm);
 
diff --git a/arch/x86/include/asm/word-at-a-time.h b/arch/x86/include/asm/word-at-a-time.h
index 6fe6767b7124..e58f03b206c3 100644
--- a/arch/x86/include/asm/word-at-a-time.h
+++ b/arch/x86/include/asm/word-at-a-time.h
@@ -43,4 +43,37 @@ static inline unsigned long has_zero(unsigned long a)
         return ((a - REPEAT_BYTE(0x01)) & ~a) & REPEAT_BYTE(0x80);
 }
 
+/*
+ * Load an unaligned word from kernel space.
+ *
+ * In the (very unlikely) case of the word being a page-crosser
+ * and the next page not being mapped, take the exception and
+ * return zeroes in the non-existing part.
+ */
+static inline unsigned long load_unaligned_zeropad(const void *addr)
+{
+        unsigned long ret, dummy;
+
+        asm(
+                "1:\tmov %2,%0\n"
+                "2:\n"
+                ".section .fixup,\"ax\"\n"
+                "3:\t"
+                "lea %2,%1\n\t"
+                "and %3,%1\n\t"
+                "mov (%1),%0\n\t"
+                "leal %2,%%ecx\n\t"
+                "andl %4,%%ecx\n\t"
+                "shll $3,%%ecx\n\t"
+                "shr %%cl,%0\n\t"
+                "jmp 2b\n"
+                ".previous\n"
+                _ASM_EXTABLE(1b, 3b)
+                :"=&r" (ret),"=&c" (dummy)
+                :"m" (*(unsigned long *)addr),
+                 "i" (-sizeof(unsigned long)),
+                 "i" (sizeof(unsigned long)-1));
+        return ret;
+}
+
 #endif /* _ASM_WORD_AT_A_TIME_H */
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 1c67ca100e4c..146bb6218eec 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -580,6 +580,24 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                 }
         }
 
+        /* re-enable TopologyExtensions if switched off by BIOS */
+        if ((c->x86 == 0x15) &&
+            (c->x86_model >= 0x10) && (c->x86_model <= 0x1f) &&
+            !cpu_has(c, X86_FEATURE_TOPOEXT)) {
+                u64 val;
+
+                if (!rdmsrl_amd_safe(0xc0011005, &val)) {
+                        val |= 1ULL << 54;
+                        wrmsrl_amd_safe(0xc0011005, val);
+                        rdmsrl(0xc0011005, val);
+                        if (val & (1ULL << 54)) {
+                                set_cpu_cap(c, X86_FEATURE_TOPOEXT);
+                                printk(KERN_INFO FW_INFO "CPU: Re-enabling "
+                                  "disabled Topology Extensions Support\n");
+                        }
+                }
+        }
+
         cpu_detect_cache_sizes(c);
 
         /* Multi core CPU? */
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index b8ba6e4a27e4..e554e5ad2fe8 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -79,7 +79,6 @@ struct kvm_task_sleep_node {
         u32 token;
         int cpu;
         bool halted;
-        struct mm_struct *mm;
 };
 
 static struct kvm_task_sleep_head {
@@ -126,9 +125,7 @@ void kvm_async_pf_task_wait(u32 token)
 
         n.token = token;
         n.cpu = smp_processor_id();
-        n.mm = current->active_mm;
         n.halted = idle || preempt_count() > 1;
-        atomic_inc(&n.mm->mm_count);
         init_waitqueue_head(&n.wq);
         hlist_add_head(&n.link, &b->list);
         spin_unlock(&b->lock);
@@ -161,9 +158,6 @@ EXPORT_SYMBOL_GPL(kvm_async_pf_task_wait);
 static void apf_task_wake_one(struct kvm_task_sleep_node *n)
 {
         hlist_del_init(&n->link);
-        if (!n->mm)
-                return;
-        mmdrop(n->mm);
         if (n->halted)
                 smp_send_reschedule(n->cpu);
         else if (waitqueue_active(&n->wq))
@@ -207,7 +201,7 @@ again:
                  * async PF was not yet handled.
                  * Add dummy entry for the token.
                  */
-                n = kmalloc(sizeof(*n), GFP_ATOMIC);
+                n = kzalloc(sizeof(*n), GFP_ATOMIC);
                 if (!n) {
                         /*
                          * Allocation failed! Busy wait while other cpu
@@ -219,7 +213,6 @@ again:
                 }
                 n->token = token;
                 n->cpu = smp_processor_id();
-                n->mm = NULL;
                 init_waitqueue_head(&n->wq);
                 hlist_add_head(&n->link, &b->list);
         } else
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 733ca39f367e..43d8b48b23e6 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -423,6 +423,7 @@ void set_personality_ia32(bool x32)
                 current_thread_info()->status |= TS_COMPAT;
         }
 }
+EXPORT_SYMBOL_GPL(set_personality_ia32);
 
 unsigned long get_wchan(struct task_struct *p)
 {
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 71f4727da373..5a98aa272184 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -185,10 +185,22 @@ void __init setup_per_cpu_areas(void)
 #endif
         rc = -EINVAL;
         if (pcpu_chosen_fc != PCPU_FC_PAGE) {
-                const size_t atom_size = cpu_has_pse ? PMD_SIZE : PAGE_SIZE;
                 const size_t dyn_size = PERCPU_MODULE_RESERVE +
                         PERCPU_DYNAMIC_RESERVE - PERCPU_FIRST_CHUNK_RESERVE;
+                size_t atom_size;
 
+                /*
+                 * On 64bit, use PMD_SIZE for atom_size so that embedded
+                 * percpu areas are aligned to PMD.  This, in the future,
+                 * can also allow using PMD mappings in vmalloc area.  Use
+                 * PAGE_SIZE on 32bit as vmalloc space is highly contended
+                 * and large vmalloc area allocs can easily fail.
+                 */
+#ifdef CONFIG_X86_64
+                atom_size = PMD_SIZE;
+#else
+                atom_size = PAGE_SIZE;
+#endif
                 rc = pcpu_embed_first_chunk(PERCPU_FIRST_CHUNK_RESERVE,
                                             dyn_size, atom_size,
                                             pcpu_cpu_distance,
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 91a5e989abcf..185a2b823a2d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6581,6 +6581,7 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu,
                 kvm_inject_page_fault(vcpu, &fault);
         }
         vcpu->arch.apf.halted = false;
+        vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE;
 }
 
 bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu)
diff --git a/arch/x86/platform/geode/net5501.c b/arch/x86/platform/geode/net5501.c
index 66d377e334f7..646e3b5b4bb6 100644
--- a/arch/x86/platform/geode/net5501.c
+++ b/arch/x86/platform/geode/net5501.c
@@ -63,7 +63,7 @@ static struct gpio_led net5501_leds[] = {
                 .name = "net5501:1",
                 .gpio = 6,
                 .default_trigger = "default-on",
-                .active_low = 1,
+                .active_low = 0,
         },
 };
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index a8f8844b8d32..95dccce8e979 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -63,6 +63,7 @@
 #include <asm/stackprotector.h>
 #include <asm/hypervisor.h>
 #include <asm/mwait.h>
+#include <asm/pci_x86.h>
 
 #ifdef CONFIG_ACPI
 #include <linux/acpi.h>
@@ -809,9 +810,40 @@ static void xen_io_delay(void)
 }
 
 #ifdef CONFIG_X86_LOCAL_APIC
+static unsigned long xen_set_apic_id(unsigned int x)
+{
+        WARN_ON(1);
+        return x;
+}
+static unsigned int xen_get_apic_id(unsigned long x)
+{
+        return ((x)>>24) & 0xFFu;
+}
 static u32 xen_apic_read(u32 reg)
 {
-        return 0;
+        struct xen_platform_op op = {
+                .cmd = XENPF_get_cpuinfo,
+                .interface_version = XENPF_INTERFACE_VERSION,
+                .u.pcpu_info.xen_cpuid = 0,
+        };
+        int ret = 0;
+
+        /* Shouldn't need this as APIC is turned off for PV, and we only
+         * get called on the bootup processor. But just in case. */
+        if (!xen_initial_domain() || smp_processor_id())
+                return 0;
+
+        if (reg == APIC_LVR)
+                return 0x10;
+
+        if (reg != APIC_ID)
+                return 0;
+
+        ret = HYPERVISOR_dom0_op(&op);
+        if (ret)
+                return 0;
+
+        return op.u.pcpu_info.apic_id << 24;
 }
 
 static void xen_apic_write(u32 reg, u32 val)
@@ -849,6 +881,8 @@ static void set_xen_basic_apic_ops(void)
         apic->icr_write = xen_apic_icr_write;
         apic->wait_icr_idle = xen_apic_wait_icr_idle;
         apic->safe_wait_icr_idle = xen_safe_apic_wait_icr_idle;
+        apic->set_apic_id = xen_set_apic_id;
+        apic->get_apic_id = xen_get_apic_id;
 }
 
 #endif
@@ -1365,8 +1399,10 @@ asmlinkage void __init xen_start_kernel(void)
                 /* Make sure ACS will be enabled */
                 pci_request_acs();
         }
-                
-
+#ifdef CONFIG_PCI
+        /* PCI BIOS service won't work from a PV guest. */
+        pci_probe &= ~PCI_PROBE_BIOS;
+#endif
         xen_raw_console_write("about to get started...\n");
 
         xen_setup_runstate_info(0);
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index b8e279479a6b..69f5857660ac 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -353,8 +353,13 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
 {
         if (val & _PAGE_PRESENT) {
                 unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
+                unsigned long pfn = mfn_to_pfn(mfn);
+
                 pteval_t flags = val & PTE_FLAGS_MASK;
-                val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
+                if (unlikely(pfn == ~0))
+                        val = flags & ~_PAGE_PRESENT;
+                else
+                        val = ((pteval_t)pfn << PAGE_SHIFT) | flags;
         }
 
         return val;
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 7049a7d27c4f..330bb4d75852 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -631,7 +631,7 @@ int acpi_power_get_inferred_state(struct acpi_device *device, int *state)
          * We know a device's inferred power state when all the resources
          * required for a given D-state are 'on'.
          */
-        for (i = ACPI_STATE_D0; i < ACPI_STATE_D3; i++) {
+        for (i = ACPI_STATE_D0; i < ACPI_STATE_D3_HOT; i++) {
                 list = &device->power.states[i].resources;
                 if (list->count < 1)
                         continue;
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index 767e2dcb9616..7417267e88fa 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -869,7 +869,7 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
         /*
          * Enumerate supported power management states
          */
-        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3; i++) {
+        for (i = ACPI_STATE_D0; i <= ACPI_STATE_D3_HOT; i++) {
                 struct acpi_device_power_state *ps = &device->power.states[i];
                 char object_name[5] = { '_', 'P', 'R', '0' + i, '\0' };
 
@@ -884,21 +884,18 @@ static int acpi_bus_get_power_flags(struct acpi_device *device)
                                 acpi_bus_add_power_resource(ps->resources.handles[j]);
                 }
 
-                /* The exist of _PR3 indicates D3Cold support */
-                if (i == ACPI_STATE_D3) {
-                        status = acpi_get_handle(device->handle, object_name, &handle);
-                        if (ACPI_SUCCESS(status))
-                                device->power.states[ACPI_STATE_D3_COLD].flags.valid = 1;
-                }
-
                 /* Evaluate "_PSx" to see if we can do explicit sets */
                 object_name[2] = 'S';
                 status = acpi_get_handle(device->handle, object_name, &handle);
                 if (ACPI_SUCCESS(status))
                         ps->flags.explicit_set = 1;
 
-                /* State is valid if we have some power control */
-                if (ps->resources.count || ps->flags.explicit_set)
+                /*
+                 * State is valid if there are means to put the device into it.
+                 * D3hot is only valid if _PR3 present.
+                 */
+                if (ps->resources.count ||
+                    (ps->flags.explicit_set && i < ACPI_STATE_D3_HOT))
                         ps->flags.valid = 1;
 
                 ps->power = -1; /* Unknown - driver assigned */
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 79a1e9dd56d9..ebaf67e4b2bc 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -394,6 +394,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
           .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
         { PCI_DEVICE(0x1b4b, 0x9125),
           .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
+        { PCI_DEVICE(0x1b4b, 0x917a),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
         { PCI_DEVICE(0x1b4b, 0x91a3),
           .driver_data = board_ahci_yes_fbs },
 
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 0c86c77764bc..9e419e1c2006 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -280,6 +280,7 @@ static struct dev_pm_ops ahci_pm_ops = {
 
 static const struct of_device_id ahci_of_match[] = {
         { .compatible = "calxeda,hb-ahci", },
+        { .compatible = "snps,spear-ahci", },
         {},
 };
 MODULE_DEVICE_TABLE(of, ahci_of_match);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 28db50b57b91..23763a1ec570 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -95,7 +95,7 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev);
 static void ata_dev_xfermask(struct ata_device *dev);
 static unsigned long ata_dev_blacklisted(const struct ata_device *dev);
 
-atomic_t ata_print_id = ATOMIC_INIT(1);
+atomic_t ata_print_id = ATOMIC_INIT(0);
 
 struct ata_force_param {
         const char      *name;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index c61316e9d2f7..d1fbd59ead16 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -3501,7 +3501,8 @@ static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg
         u64 now = get_jiffies_64();
         int *trials = void_arg;
 
-        if (ent->timestamp < now - min(now, interval))
+        if ((ent->eflags & ATA_EFLAG_OLD_ER) ||
+            (ent->timestamp < now - min(now, interval)))
                 return -1;
 
         (*trials)++;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 93dabdcd2cbe..22226350cd0c 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3399,7 +3399,8 @@ int ata_scsi_add_hosts(struct ata_host *host, struct scsi_host_template *sht)
                  */
                 shost->max_host_blocked = 1;
 
-                rc = scsi_add_host(ap->scsi_host, &ap->tdev);
+                rc = scsi_add_host_with_dma(ap->scsi_host,
+                                                &ap->tdev, ap->host->dev);
                 if (rc)
                         goto err_add;
         }
@@ -3838,18 +3839,25 @@ void ata_sas_port_stop(struct ata_port *ap)
 }
 EXPORT_SYMBOL_GPL(ata_sas_port_stop);
 
-int ata_sas_async_port_init(struct ata_port *ap)
+/**
+ * ata_sas_async_probe - simply schedule probing and return
+ * @ap: Port to probe
+ *
+ * For batch scheduling of probe for sas attached ata devices, assumes
+ * the port has already been through ata_sas_port_init()
+ */
+void ata_sas_async_probe(struct ata_port *ap)
 {
-        int rc = ap->ops->port_start(ap);
-
-        if (!rc) {
-                ap->print_id = atomic_inc_return(&ata_print_id);
-                __ata_port_probe(ap);
-        }
+        __ata_port_probe(ap);
+}
+EXPORT_SYMBOL_GPL(ata_sas_async_probe);
 
-        return rc;
+int ata_sas_sync_probe(struct ata_port *ap)
+{
+        return ata_port_probe(ap);
 }
-EXPORT_SYMBOL_GPL(ata_sas_async_port_init);
+EXPORT_SYMBOL_GPL(ata_sas_sync_probe);
+
 
 /**
  *      ata_sas_port_init - Initialize a SATA device
@@ -3866,12 +3874,10 @@ int ata_sas_port_init(struct ata_port *ap)
 {
         int rc = ap->ops->port_start(ap);
 
-        if (!rc) {
-                ap->print_id = atomic_inc_return(&ata_print_id);
-                rc = ata_port_probe(ap);
-        }
-
-        return rc;
+        if (rc)
+                return rc;
+        ap->print_id = atomic_inc_return(&ata_print_id);
+        return 0;
 }
 EXPORT_SYMBOL_GPL(ata_sas_port_init);
 
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index fc2db2a89a6b..3239517f4d90 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -943,9 +943,9 @@ static int arasan_cf_resume(struct device *dev)
 
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(arasan_cf_pm_ops, arasan_cf_suspend, arasan_cf_resume);
-#endif
 
 static struct platform_driver arasan_cf_driver = {
         .probe          = arasan_cf_probe,
@@ -953,9 +953,7 @@ static struct platform_driver arasan_cf_driver = {
         .driver         = {
                 .name   = DRIVER_NAME,
                 .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm     = &arasan_cf_pm_ops,
-#endif
         },
 };
 
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 7a3f535e481c..bb80853ff27a 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -775,9 +775,11 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
                         map->format.parse_val(val + i);
         } else {
                 for (i = 0; i < val_count; i++) {
-                        ret = regmap_read(map, reg + i, val + (i * val_bytes));
+                        unsigned int ival;
+                        ret = regmap_read(map, reg + i, &ival);
                         if (ret != 0)
                                 return ret;
+                        memcpy(val + (i * val_bytes), &ival, val_bytes);
                 }
         }
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index ae9edca7b56d..57fd867553d7 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -75,6 +75,8 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
         { USB_DEVICE(0x04CA, 0x3005) },
+        { USB_DEVICE(0x13d3, 0x3362) },
+        { USB_DEVICE(0x0CF3, 0xE004) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -94,6 +96,8 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 
         { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3311b812a0c6..9217121362e1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -101,12 +101,16 @@ static struct usb_device_id btusb_table[] = {
         { USB_DEVICE(0x0c10, 0x0000) },
 
         /* Broadcom BCM20702A0 */
+        { USB_DEVICE(0x0489, 0xe042) },
         { USB_DEVICE(0x0a5c, 0x21e3) },
         { USB_DEVICE(0x0a5c, 0x21e6) },
         { USB_DEVICE(0x0a5c, 0x21e8) },
         { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
+        /* Foxconn - Hon Hai */
+        { USB_DEVICE(0x0489, 0xe033) },
+
         { }     /* Terminating entry */
 };
 
@@ -133,6 +137,8 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index d25599f2a3f8..47408e802ab6 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -191,6 +191,190 @@ utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len)
         }
 }
 
+static bool
+validate_device_path(struct efi_variable *var, int match, u8 *buffer,
+                     unsigned long len)
+{
+        struct efi_generic_dev_path *node;
+        int offset = 0;
+
+        node = (struct efi_generic_dev_path *)buffer;
+
+        if (len < sizeof(*node))
+                return false;
+
+        while (offset <= len - sizeof(*node) &&
+               node->length >= sizeof(*node) &&
+                node->length <= len - offset) {
+                offset += node->length;
+
+                if ((node->type == EFI_DEV_END_PATH ||
+                     node->type == EFI_DEV_END_PATH2) &&
+                    node->sub_type == EFI_DEV_END_ENTIRE)
+                        return true;
+
+                node = (struct efi_generic_dev_path *)(buffer + offset);
+        }
+
+        /*
+         * If we're here then either node->length pointed past the end
+         * of the buffer or we reached the end of the buffer without
+         * finding a device path end node.
+         */
+        return false;
+}
+
+static bool
+validate_boot_order(struct efi_variable *var, int match, u8 *buffer,
+                    unsigned long len)
+{
+        /* An array of 16-bit integers */
+        if ((len % 2) != 0)
+                return false;
+
+        return true;
+}
+
+static bool
+validate_load_option(struct efi_variable *var, int match, u8 *buffer,
+                     unsigned long len)
+{
+        u16 filepathlength;
+        int i, desclength = 0, namelen;
+
+        namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName));
+
+        /* Either "Boot" or "Driver" followed by four digits of hex */
+        for (i = match; i < match+4; i++) {
+                if (var->VariableName[i] > 127 ||
+                    hex_to_bin(var->VariableName[i] & 0xff) < 0)
+                        return true;
+        }
+
+        /* Reject it if there's 4 digits of hex and then further content */
+        if (namelen > match + 4)
+                return false;
+
+        /* A valid entry must be at least 8 bytes */
+        if (len < 8)
+                return false;
+
+        filepathlength = buffer[4] | buffer[5] << 8;
+
+        /*
+         * There's no stored length for the description, so it has to be
+         * found by hand
+         */
+        desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
+
+        /* Each boot entry must have a descriptor */
+        if (!desclength)
+                return false;
+
+        /*
+         * If the sum of the length of the description, the claimed filepath
+         * length and the original header are greater than the length of the
+         * variable, it's malformed
+         */
+        if ((desclength + filepathlength + 6) > len)
+                return false;
+
+        /*
+         * And, finally, check the filepath
+         */
+        return validate_device_path(var, match, buffer + desclength + 6,
+                                    filepathlength);
+}
+
+static bool
+validate_uint16(struct efi_variable *var, int match, u8 *buffer,
+                unsigned long len)
+{
+        /* A single 16-bit integer */
+        if (len != 2)
+                return false;
+
+        return true;
+}
+
+static bool
+validate_ascii_string(struct efi_variable *var, int match, u8 *buffer,
+                      unsigned long len)
+{
+        int i;
+
+        for (i = 0; i < len; i++) {
+                if (buffer[i] > 127)
+                        return false;
+
+                if (buffer[i] == 0)
+                        return true;
+        }
+
+        return false;
+}
+
+struct variable_validate {
+        char *name;
+        bool (*validate)(struct efi_variable *var, int match, u8 *data,
+                         unsigned long len);
+};
+
+static const struct variable_validate variable_validate[] = {
+        { "BootNext", validate_uint16 },
+        { "BootOrder", validate_boot_order },
+        { "DriverOrder", validate_boot_order },
+        { "Boot*", validate_load_option },
+        { "Driver*", validate_load_option },
+        { "ConIn", validate_device_path },
+        { "ConInDev", validate_device_path },
+        { "ConOut", validate_device_path },
+        { "ConOutDev", validate_device_path },
+        { "ErrOut", validate_device_path },
+        { "ErrOutDev", validate_device_path },
+        { "Timeout", validate_uint16 },
+        { "Lang", validate_ascii_string },
+        { "PlatformLang", validate_ascii_string },
+        { "", NULL },
+};
+
+static bool
+validate_var(struct efi_variable *var, u8 *data, unsigned long len)
+{
+        int i;
+        u16 *unicode_name = var->VariableName;
+
+        for (i = 0; variable_validate[i].validate != NULL; i++) {
+                const char *name = variable_validate[i].name;
+                int match;
+
+                for (match = 0; ; match++) {
+                        char c = name[match];
+                        u16 u = unicode_name[match];
+
+                        /* All special variables are plain ascii */
+                        if (u > 127)
+                                return true;
+
+                        /* Wildcard in the matching name means we've matched */
+                        if (c == '*')
+                                return variable_validate[i].validate(var,
+                                                             match, data, len);
+
+                        /* Case sensitive match */
+                        if (c != u)
+                                break;
+
+                        /* Reached the end of the string while matching */
+                        if (!c)
+                                return variable_validate[i].validate(var,
+                                                             match, data, len);
+                }
+        }
+
+        return true;
+}
+
 static efi_status_t
 get_var_data_locked(struct efivars *efivars, struct efi_variable *var)
 {
@@ -324,6 +508,12 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
                 return -EINVAL;
         }
 
+        if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
+            validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
+                printk(KERN_ERR "efivars: Malformed variable content\n");
+                return -EINVAL;
+        }
+
         spin_lock(&efivars->lock);
         status = efivars->ops->set_variable(new_var->VariableName,
                                             &new_var->VendorGuid,
@@ -626,6 +816,12 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
         if (!capable(CAP_SYS_ADMIN))
                 return -EACCES;
 
+        if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
+            validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
+                printk(KERN_ERR "efivars: Malformed variable content\n");
+                return -EINVAL;
+        }
+
         spin_lock(&efivars->lock);
 
         /*
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index b505b70dba05..e6162a1681f0 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1224,6 +1224,9 @@ static int i915_emon_status(struct seq_file *m, void *unused)
         unsigned long temp, chipset, gfx;
         int ret;
 
+        if (!IS_GEN5(dev))
+                return -ENODEV;
+
         ret = mutex_lock_interruptible(&dev->struct_mutex);
         if (ret)
                 return ret;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 785f67f963ef..ba60f3c8f911 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1701,6 +1701,9 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
         unsigned long diffms;
         u32 count;
 
+        if (dev_priv->info->gen != 5)
+                return;
+
         getrawmonotonic(&now);
         diff1 = timespec_sub(now, dev_priv->last_time2);
 
@@ -2121,12 +2124,14 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         setup_timer(&dev_priv->hangcheck_timer, i915_hangcheck_elapsed,
                     (unsigned long) dev);
 
-        spin_lock(&mchdev_lock);
-        i915_mch_dev = dev_priv;
-        dev_priv->mchdev_lock = &mchdev_lock;
-        spin_unlock(&mchdev_lock);
+        if (IS_GEN5(dev)) {
+                spin_lock(&mchdev_lock);
+                i915_mch_dev = dev_priv;
+                dev_priv->mchdev_lock = &mchdev_lock;
+                spin_unlock(&mchdev_lock);
 
-        ips_ping_for_i915_load();
+                ips_ping_for_i915_load();
+        }
 
         return 0;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 5908cd563400..1b1cf3b3ff51 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -7072,9 +7072,6 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
         struct drm_device *dev = crtc->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        int pipe = intel_crtc->pipe;
-        int dpll_reg = DPLL(pipe);
-        int dpll = I915_READ(dpll_reg);
 
         if (HAS_PCH_SPLIT(dev))
                 return;
@@ -7087,10 +7084,15 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
          * the manual case.
          */
         if (!HAS_PIPE_CXSR(dev) && intel_crtc->lowfreq_avail) {
+                int pipe = intel_crtc->pipe;
+                int dpll_reg = DPLL(pipe);
+                u32 dpll;
+
                 DRM_DEBUG_DRIVER("downclocking LVDS\n");
 
                 assert_panel_unlocked(dev_priv, pipe);
 
+                dpll = I915_READ(dpll_reg);
                 dpll |= DISPLAY_RATE_SELECT_FPA1;
                 I915_WRITE(dpll_reg, dpll);
                 intel_wait_for_vblank(dev, pipe);
@@ -7098,7 +7100,6 @@ static void intel_decrease_pllclock(struct drm_crtc *crtc)
                 if (!(dpll & DISPLAY_RATE_SELECT_FPA1))
                         DRM_DEBUG_DRIVER("failed to downclock LVDS!\n");
         }
-
 }
 
 /**
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index cae3e5f17a49..2d7f47b56b6a 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -136,7 +136,7 @@ static void i9xx_write_infoframe(struct drm_encoder *encoder,
 
         val &= ~VIDEO_DIP_SELECT_MASK;
 
-        I915_WRITE(VIDEO_DIP_CTL, val | port | flags);
+        I915_WRITE(VIDEO_DIP_CTL, VIDEO_DIP_ENABLE | val | port | flags);
 
         for (i = 0; i < len; i += 4) {
                 I915_WRITE(VIDEO_DIP_DATA, *data);
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 30e2c82101de..9c71183629c2 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -750,7 +750,7 @@ static const struct dmi_system_id intel_no_lvds[] = {
                 .ident = "Hewlett-Packard t5745",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_BOARD_NAME, "hp t5745"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "hp t5745"),
                 },
         },
         {
@@ -758,7 +758,7 @@ static const struct dmi_system_id intel_no_lvds[] = {
                 .ident = "Hewlett-Packard st5747",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
-                        DMI_MATCH(DMI_BOARD_NAME, "hp st5747"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "hp st5747"),
                 },
         },
         {
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 80fce51e2f43..62892a826ede 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -398,10 +398,8 @@ static int init_render_ring(struct intel_ring_buffer *ring)
                         return ret;
         }
 
-        if (INTEL_INFO(dev)->gen >= 6) {
-                I915_WRITE(INSTPM,
-                           INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING);
 
+        if (IS_GEN6(dev)) {
                 /* From the Sandybridge PRM, volume 1 part 3, page 24:
                  * "If this bit is set, STCunit will have LRA as replacement
                  *  policy. [...] This bit must be reset.  LRA replacement
@@ -411,6 +409,11 @@ static int init_render_ring(struct intel_ring_buffer *ring)
                            CM0_STC_EVICT_DISABLE_LRA_SNB << CM0_MASK_SHIFT);
         }
 
+        if (INTEL_INFO(dev)->gen >= 6) {
+                I915_WRITE(INSTPM,
+                           INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING);
+        }
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 232d77d07d8b..ae5e748f39bb 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1220,8 +1220,14 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
 
 static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
 {
+        struct drm_device *dev = intel_sdvo->base.base.dev;
         u8 response[2];
 
+        /* HW Erratum: SDVO Hotplug is broken on all i945G chips, there's noise
+         * on the line. */
+        if (IS_I945G(dev) || IS_I945GM(dev))
+                return false;
+
         return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
                                     &response, 2) && response[0];
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 7814a760c164..284bd25d5d21 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -270,7 +270,7 @@ static bool nouveau_dsm_detect(void)
         struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name};
         struct pci_dev *pdev = NULL;
         int has_dsm = 0;
-        int has_optimus;
+        int has_optimus = 0;
         int vga_count = 0;
         bool guid_valid;
         int retval;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 80963d05b54a..0be4a815e706 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -6156,10 +6156,14 @@ dcb_fake_connectors(struct nvbios *bios)
 
         /* heuristic: if we ever get a non-zero connector field, assume
          * that all the indices are valid and we don't need fake them.
+         *
+         * and, as usual, a blacklist of boards with bad bios data..
          */
-        for (i = 0; i < dcbt->entries; i++) {
-                if (dcbt->entry[i].connector)
-                        return;
+        if (!nv_match_device(bios->dev, 0x0392, 0x107d, 0x20a2)) {
+                for (i = 0; i < dcbt->entries; i++) {
+                        if (dcbt->entry[i].connector)
+                                return;
+                }
         }
 
         /* no useful connector info available, we need to make it up
diff --git a/drivers/gpu/drm/nouveau/nouveau_hdmi.c b/drivers/gpu/drm/nouveau/nouveau_hdmi.c
index 59ea1c14eca0..c3de36384522 100644
--- a/drivers/gpu/drm/nouveau/nouveau_hdmi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_hdmi.c
@@ -32,7 +32,9 @@ static bool
 hdmi_sor(struct drm_encoder *encoder)
 {
         struct drm_nouveau_private *dev_priv = encoder->dev->dev_private;
-        if (dev_priv->chipset < 0xa3)
+        if (dev_priv->chipset <  0xa3 ||
+            dev_priv->chipset == 0xaa ||
+            dev_priv->chipset == 0xac)
                 return false;
         return true;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_i2c.c b/drivers/gpu/drm/nouveau/nouveau_i2c.c
index e2be95af2e52..77e564667b5c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_i2c.c
+++ b/drivers/gpu/drm/nouveau/nouveau_i2c.c
@@ -29,10 +29,6 @@
 #include "nouveau_i2c.h"
 #include "nouveau_hw.h"
 
-#define T_TIMEOUT  2200000
-#define T_RISEFALL 1000
-#define T_HOLD     5000
-
 static void
 i2c_drive_scl(void *data, int state)
 {
@@ -113,175 +109,6 @@ i2c_sense_sda(void *data)
         return 0;
 }
 
-static void
-i2c_delay(struct nouveau_i2c_chan *port, u32 nsec)
-{
-        udelay((nsec + 500) / 1000);
-}
-
-static bool
-i2c_raise_scl(struct nouveau_i2c_chan *port)
-{
-        u32 timeout = T_TIMEOUT / T_RISEFALL;
-
-        i2c_drive_scl(port, 1);
-        do {
-                i2c_delay(port, T_RISEFALL);
-        } while (!i2c_sense_scl(port) && --timeout);
-
-        return timeout != 0;
-}
-
-static int
-i2c_start(struct nouveau_i2c_chan *port)
-{
-        int ret = 0;
-
-        port->state  = i2c_sense_scl(port);
-        port->state |= i2c_sense_sda(port) << 1;
-        if (port->state != 3) {
-                i2c_drive_scl(port, 0);
-                i2c_drive_sda(port, 1);
-                if (!i2c_raise_scl(port))
-                        ret = -EBUSY;
-        }
-
-        i2c_drive_sda(port, 0);
-        i2c_delay(port, T_HOLD);
-        i2c_drive_scl(port, 0);
-        i2c_delay(port, T_HOLD);
-        return ret;
-}
-
-static void
-i2c_stop(struct nouveau_i2c_chan *port)
-{
-        i2c_drive_scl(port, 0);
-        i2c_drive_sda(port, 0);
-        i2c_delay(port, T_RISEFALL);
-
-        i2c_drive_scl(port, 1);
-        i2c_delay(port, T_HOLD);
-        i2c_drive_sda(port, 1);
-        i2c_delay(port, T_HOLD);
-}
-
-static int
-i2c_bitw(struct nouveau_i2c_chan *port, int sda)
-{
-        i2c_drive_sda(port, sda);
-        i2c_delay(port, T_RISEFALL);
-
-        if (!i2c_raise_scl(port))
-                return -ETIMEDOUT;
-        i2c_delay(port, T_HOLD);
-
-        i2c_drive_scl(port, 0);
-        i2c_delay(port, T_HOLD);
-        return 0;
-}
-
-static int
-i2c_bitr(struct nouveau_i2c_chan *port)
-{
-        int sda;
-
-        i2c_drive_sda(port, 1);
-        i2c_delay(port, T_RISEFALL);
-
-        if (!i2c_raise_scl(port))
-                return -ETIMEDOUT;
-        i2c_delay(port, T_HOLD);
-
-        sda = i2c_sense_sda(port);
-
-        i2c_drive_scl(port, 0);
-        i2c_delay(port, T_HOLD);
-        return sda;
-}
-
-static int
-i2c_get_byte(struct nouveau_i2c_chan *port, u8 *byte, bool last)
-{
-        int i, bit;
-
-        *byte = 0;
-        for (i = 7; i >= 0; i--) {
-                bit = i2c_bitr(port);
-                if (bit < 0)
-                        return bit;
-                *byte |= bit << i;
-        }
-
-        return i2c_bitw(port, last ? 1 : 0);
-}
-
-static int
-i2c_put_byte(struct nouveau_i2c_chan *port, u8 byte)
-{
-        int i, ret;
-        for (i = 7; i >= 0; i--) {
-                ret = i2c_bitw(port, !!(byte & (1 << i)));
-                if (ret < 0)
-                        return ret;
-        }
-
-        ret = i2c_bitr(port);
-        if (ret == 1) /* nack */
-                ret = -EIO;
-        return ret;
-}
-
-static int
-i2c_addr(struct nouveau_i2c_chan *port, struct i2c_msg *msg)
-{
-        u32 addr = msg->addr << 1;
-        if (msg->flags & I2C_M_RD)
-                addr |= 1;
-        return i2c_put_byte(port, addr);
-}
-
-static int
-i2c_bit_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
-{
-        struct nouveau_i2c_chan *port = (struct nouveau_i2c_chan *)adap;
-        struct i2c_msg *msg = msgs;
-        int ret = 0, mcnt = num;
-
-        while (!ret && mcnt--) {
-                u8 remaining = msg->len;
-                u8 *ptr = msg->buf;
-
-                ret = i2c_start(port);
-                if (ret == 0)
-                        ret = i2c_addr(port, msg);
-
-                if (msg->flags & I2C_M_RD) {
-                        while (!ret && remaining--)
-                                ret = i2c_get_byte(port, ptr++, !remaining);
-                } else {
-                        while (!ret && remaining--)
-                                ret = i2c_put_byte(port, *ptr++);
-                }
-
-                msg++;
-        }
-
-        i2c_stop(port);
-        return (ret < 0) ? ret : num;
-}
-
-static u32
-i2c_bit_func(struct i2c_adapter *adap)
-{
-        return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL;
-}
-
-const struct i2c_algorithm nouveau_i2c_bit_algo = {
-        .master_xfer = i2c_bit_xfer,
-        .functionality = i2c_bit_func
-};
-
 static const uint32_t nv50_i2c_port[] = {
         0x00e138, 0x00e150, 0x00e168, 0x00e180,
         0x00e254, 0x00e274, 0x00e764, 0x00e780,
@@ -384,12 +211,10 @@ nouveau_i2c_init(struct drm_device *dev)
                 case 0: /* NV04:NV50 */
                         port->drive = entry[0];
                         port->sense = entry[1];
-                        port->adapter.algo = &nouveau_i2c_bit_algo;
                         break;
                 case 4: /* NV4E */
                         port->drive = 0x600800 + entry[1];
                         port->sense = port->drive;
-                        port->adapter.algo = &nouveau_i2c_bit_algo;
                         break;
                 case 5: /* NV50- */
                         port->drive = entry[0] & 0x0f;
@@ -402,7 +227,6 @@ nouveau_i2c_init(struct drm_device *dev)
                                 port->drive = 0x00d014 + (port->drive * 0x20);
                                 port->sense = port->drive;
                         }
-                        port->adapter.algo = &nouveau_i2c_bit_algo;
                         break;
                 case 6: /* NV50- DP AUX */
                         port->drive = entry[0];
@@ -413,7 +237,7 @@ nouveau_i2c_init(struct drm_device *dev)
                         break;
                 }
 
-                if (!port->adapter.algo) {
+                if (!port->adapter.algo && !port->drive) {
                         NV_ERROR(dev, "I2C%d: type %d index %x/%x unknown\n",
                                  i, port->type, port->drive, port->sense);
                         kfree(port);
@@ -429,7 +253,26 @@ nouveau_i2c_init(struct drm_device *dev)
                 port->dcb = ROM32(entry[0]);
                 i2c_set_adapdata(&port->adapter, i2c);
 
-                ret = i2c_add_adapter(&port->adapter);
+                if (port->adapter.algo != &nouveau_dp_i2c_algo) {
+                        port->adapter.algo_data = &port->bit;
+                        port->bit.udelay = 10;
+                        port->bit.timeout = usecs_to_jiffies(2200);
+                        port->bit.data = port;
+                        port->bit.setsda = i2c_drive_sda;
+                        port->bit.setscl = i2c_drive_scl;
+                        port->bit.getsda = i2c_sense_sda;
+                        port->bit.getscl = i2c_sense_scl;
+
+                        i2c_drive_scl(port, 0);
+                        i2c_drive_sda(port, 1);
+                        i2c_drive_scl(port, 1);
+
+                        ret = i2c_bit_add_bus(&port->adapter);
+                } else {
+                        port->adapter.algo = &nouveau_dp_i2c_algo;
+                        ret = i2c_add_adapter(&port->adapter);
+                }
+
                 if (ret) {
                         NV_ERROR(dev, "I2C%d: failed register: %d\n", i, ret);
                         kfree(port);
diff --git a/drivers/gpu/drm/nouveau/nouveau_i2c.h b/drivers/gpu/drm/nouveau/nouveau_i2c.h
index 4d2e4e9031be..1d083893a4d7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_i2c.h
+++ b/drivers/gpu/drm/nouveau/nouveau_i2c.h
@@ -34,6 +34,7 @@
 struct nouveau_i2c_chan {
         struct i2c_adapter adapter;
         struct drm_device *dev;
+        struct i2c_algo_bit_data bit;
         struct list_head head;
         u8  index;
         u8  type;
diff --git a/drivers/gpu/drm/nouveau/nv10_gpio.c b/drivers/gpu/drm/nouveau/nv10_gpio.c
index 550ad3fcf0af..9d79180069df 100644
--- a/drivers/gpu/drm/nouveau/nv10_gpio.c
+++ b/drivers/gpu/drm/nouveau/nv10_gpio.c
@@ -65,7 +65,7 @@ nv10_gpio_drive(struct drm_device *dev, int line, int dir, int out)
         if (line < 10) {
                 line = (line - 2) * 4;
                 reg  = NV_PCRTC_GPIO_EXT;
-                mask = 0x00000003 << ((line - 2) * 4);
+                mask = 0x00000003;
                 data = (dir << 1) | out;
         } else
         if (line < 14) {
diff --git a/drivers/gpu/drm/nouveau/nvc0_fb.c b/drivers/gpu/drm/nouveau/nvc0_fb.c
index 5bf55038fd92..f704e942372e 100644
--- a/drivers/gpu/drm/nouveau/nvc0_fb.c
+++ b/drivers/gpu/drm/nouveau/nvc0_fb.c
@@ -54,6 +54,11 @@ nvc0_mfb_isr(struct drm_device *dev)
                         nvc0_mfb_subp_isr(dev, unit, subp);
                 units &= ~(1 << unit);
         }
+
+        /* we do something horribly wrong and upset PMFB a lot, so mask off
+         * interrupts from it after the first one until it's fixed
+         */
+        nv_mask(dev, 0x000640, 0x02000000, 0x00000000);
 }
 
 static void
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index ea7df16e2f84..5992502a3448 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -241,8 +241,8 @@ int radeon_wb_init(struct radeon_device *rdev)
                                 rdev->wb.use_event = true;
                 }
         }
-        /* always use writeback/events on NI */
-        if (ASIC_IS_DCE5(rdev)) {
+        /* always use writeback/events on NI, APUs */
+        if (rdev->family >= CHIP_PALM) {
                 rdev->wb.enabled = true;
                 rdev->wb.use_event = true;
         }
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 0d3141fbbc20..b9d512331ed4 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -52,7 +52,7 @@ module_param_named(tjmax, force_tjmax, int, 0444);
 MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
-#define NUM_REAL_CORES          16      /* Number of Real cores per cpu */
+#define NUM_REAL_CORES          32      /* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
 #define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
@@ -709,6 +709,10 @@ static void __cpuinit put_core_offline(unsigned int cpu)
 
         indx = TO_ATTR_NO(cpu);
 
+        /* The core id is too big, just return */
+        if (indx > MAX_CORE_DATA - 1)
+                return;
+
         if (pdata->core_data[indx] && pdata->core_data[indx]->cpu == cpu)
                 coretemp_remove_core(pdata, &pdev->dev, indx);
 
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index f086131cb1c7..c811289b61e2 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -324,7 +324,7 @@ static s32 pch_i2c_wait_for_xfer_complete(struct i2c_algo_pch_data *adap)
 {
         long ret;
         ret = wait_event_timeout(pch_event,
-                        (adap->pch_event_flag != 0), msecs_to_jiffies(50));
+                        (adap->pch_event_flag != 0), msecs_to_jiffies(1000));
 
         if (ret == 0) {
                 pch_err(adap, "timeout: %x\n", adap->pch_event_flag);
@@ -1063,6 +1063,6 @@ module_exit(pch_pci_exit);
 
 MODULE_DESCRIPTION("Intel EG20T PCH/LAPIS Semico ML7213/ML7223/ML7831 IOH I2C");
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Tomoya MORINAGA. <tomoya-linux@dsn.lapis-semi.com>");
+MODULE_AUTHOR("Tomoya MORINAGA. <tomoya.rohm@gmail.com>");
 module_param(pch_i2c_speed, int, (S_IRUSR | S_IWUSR));
 module_param(pch_clk, int, (S_IRUSR | S_IWUSR));
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 3d471d56bf15..76b8af44f634 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -227,6 +227,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
                 return -EINVAL;
 
         init_completion(&i2c->cmd_complete);
+        i2c->cmd_err = 0;
 
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
@@ -252,6 +253,9 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
 
         if (i2c->cmd_err == -ENXIO)
                 mxs_i2c_reset(i2c);
+        else
+                writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
+                                i2c->regs + MXS_I2C_QUEUECTRL_CLR);
 
         dev_dbg(i2c->dev, "Done with err=%d\n", i2c->cmd_err);
 
@@ -299,8 +303,6 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
                     MXS_I2C_CTRL1_SLAVE_STOP_IRQ | MXS_I2C_CTRL1_SLAVE_IRQ))
                 /* MXS_I2C_CTRL1_OVERSIZE_XFER_TERM_IRQ is only for slaves */
                 i2c->cmd_err = -EIO;
-        else
-                i2c->cmd_err = 0;
 
         is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
                 MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
@@ -384,8 +386,6 @@ static int __devexit mxs_i2c_remove(struct platform_device *pdev)
         if (ret)
                 return -EBUSY;
 
-        writel(MXS_I2C_QUEUECTRL_QUEUE_RUN,
-                        i2c->regs + MXS_I2C_QUEUECTRL_CLR);
         writel(MXS_I2C_CTRL0_SFTRST, i2c->regs + MXS_I2C_CTRL0_SET);
 
         platform_set_drvdata(pdev, NULL);
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 04be9f82e14b..eb8ad538c79f 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -546,8 +546,7 @@ static int i2c_pnx_controller_suspend(struct platform_device *pdev,
 {
         struct i2c_pnx_algo_data *alg_data = platform_get_drvdata(pdev);
 
-        /* FIXME: shouldn't this be clk_disable? */
-        clk_enable(alg_data->clk);
+        clk_disable(alg_data->clk);
 
         return 0;
 }
diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
index e978635e60f0..55e5ea62ccee 100644
--- a/drivers/i2c/busses/i2c-tegra.c
+++ b/drivers/i2c/busses/i2c-tegra.c
@@ -516,6 +516,14 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev,
         if (likely(i2c_dev->msg_err == I2C_ERR_NONE))
                 return 0;
 
+        /*
+         * NACK interrupt is generated before the I2C controller generates the
+         * STOP condition on the bus. So wait for 2 clock periods before resetting
+         * the controller so that STOP condition has been delivered properly.
+         */
+        if (i2c_dev->msg_err == I2C_ERR_NO_ACK)
+                udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate));
+
         tegra_i2c_init(i2c_dev);
         if (i2c_dev->msg_err == I2C_ERR_NO_ACK) {
                 if (msg->flags & I2C_M_IGNORE_NAK)
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 8081a0a5d602..a4b14a41cbf4 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -274,7 +274,8 @@ static int synaptics_set_advanced_gesture_mode(struct psmouse *psmouse)
         static unsigned char param = 0xc8;
         struct synaptics_data *priv = psmouse->private;
 
-        if (!SYN_CAP_ADV_GESTURE(priv->ext_cap_0c))
+        if (!(SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+              SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)))
                 return 0;
 
         if (psmouse_sliced_command(psmouse, SYN_QUE_MODEL))
diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c
index d8433f2d53bc..73973fdbd8be 100644
--- a/drivers/leds/leds-netxbig.c
+++ b/drivers/leds/leds-netxbig.c
@@ -112,7 +112,7 @@ err_free_addr:
         return err;
 }
 
-static void __devexit gpio_ext_free(struct netxbig_gpio_ext *gpio_ext)
+static void gpio_ext_free(struct netxbig_gpio_ext *gpio_ext)
 {
         int i;
 
@@ -294,7 +294,7 @@ static ssize_t netxbig_led_sata_show(struct device *dev,
 
 static DEVICE_ATTR(sata, 0644, netxbig_led_sata_show, netxbig_led_sata_store);
 
-static void __devexit delete_netxbig_led(struct netxbig_led_data *led_dat)
+static void delete_netxbig_led(struct netxbig_led_data *led_dat)
 {
         if (led_dat->mode_val[NETXBIG_LED_SATA] != NETXBIG_LED_INVALID_MODE)
                 device_remove_file(led_dat->cdev.dev, &dev_attr_sata);
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index 2f0a14421a73..01cf89ec6944 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -255,7 +255,7 @@ err_free_cmd:
         return ret;
 }
 
-static void __devexit delete_ns2_led(struct ns2_led_data *led_dat)
+static void delete_ns2_led(struct ns2_led_data *led_dat)
 {
         device_remove_file(led_dat->cdev.dev, &dev_attr_sata);
         led_classdev_unregister(&led_dat->cdev);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 97e73e555d11..17e2b472e16d 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1727,8 +1727,7 @@ int bitmap_create(struct mddev *mddev)
         bitmap->chunkshift = (ffz(~mddev->bitmap_info.chunksize)
                               - BITMAP_BLOCK_SHIFT);
 
-        /* now that chunksize and chunkshift are set, we can use these macros */
-        chunks = (blocks + bitmap->chunkshift - 1) >>
+        chunks = (blocks + (1 << bitmap->chunkshift) - 1) >>
                         bitmap->chunkshift;
         pages = (chunks + PAGE_COUNTER_RATIO - 1) / PAGE_COUNTER_RATIO;
 
diff --git a/drivers/md/bitmap.h b/drivers/md/bitmap.h
index 55ca5aec84e4..b44b0aba2d47 100644
--- a/drivers/md/bitmap.h
+++ b/drivers/md/bitmap.h
@@ -101,9 +101,6 @@ typedef __u16 bitmap_counter_t;
 
 #define BITMAP_BLOCK_SHIFT 9
 
-/* how many blocks per chunk? (this is variable) */
-#define CHUNK_BLOCK_RATIO(bitmap) ((bitmap)->mddev->bitmap_info.chunksize >> BITMAP_BLOCK_SHIFT)
-
 #endif
 
 /*
diff --git a/drivers/mfd/omap-usb-host.c b/drivers/mfd/omap-usb-host.c
index c8aae6640e64..7e96bb229724 100644
--- a/drivers/mfd/omap-usb-host.c
+++ b/drivers/mfd/omap-usb-host.c
@@ -25,6 +25,7 @@
 #include <linux/clk.h>
 #include <linux/dma-mapping.h>
 #include <linux/spinlock.h>
+#include <plat/cpu.h>
 #include <plat/usb.h>
 #include <linux/pm_runtime.h>
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 062ac333fde6..ceeab8e852ef 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi)
                 if (sblk->status & SD_STATUS_LINK_CHG)
                         work_exists = 1;
         }
-        /* check for RX/TX work to do */
-        if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
+
+        /* check for TX work to do */
+        if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
+                work_exists = 1;
+
+        /* check for RX work to do */
+        if (tnapi->rx_rcb_prod_idx &&
             *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
                 work_exists = 1;
 
@@ -6124,6 +6129,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
                         return work_done;
         }
 
+        if (!tnapi->rx_rcb_prod_idx)
+                return work_done;
+
         /* run RX thread, within the bounds set by NAPI.
          * All RX "locking" is done by ensuring outside
          * code synchronizes with tg3->napi.poll()
@@ -7567,6 +7575,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
                  */
                 switch (i) {
                 default:
+                        if (tg3_flag(tp, ENABLE_RSS)) {
+                                tnapi->rx_rcb_prod_idx = NULL;
+                                break;
+                        }
+                        /* Fall through */
+                case 1:
                         tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
                         break;
                 case 2:
diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
index 63bfdd10bd6d..abb6ce7c1b7e 100644
--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c
@@ -1150,6 +1150,48 @@ release_tpsram:
 }
 
 /**
+ * t3_synchronize_rx - wait for current Rx processing on a port to complete
+ * @adap: the adapter
+ * @p: the port
+ *
+ * Ensures that current Rx processing on any of the queues associated with
+ * the given port completes before returning.  We do this by acquiring and
+ * releasing the locks of the response queues associated with the port.
+ */
+static void t3_synchronize_rx(struct adapter *adap, const struct port_info *p)
+{
+        int i;
+
+        for (i = p->first_qset; i < p->first_qset + p->nqsets; i++) {
+                struct sge_rspq *q = &adap->sge.qs[i].rspq;
+
+                spin_lock_irq(&q->lock);
+                spin_unlock_irq(&q->lock);
+        }
+}
+
+static void cxgb_vlan_mode(struct net_device *dev, netdev_features_t features)
+{
+        struct port_info *pi = netdev_priv(dev);
+        struct adapter *adapter = pi->adapter;
+
+        if (adapter->params.rev > 0) {
+                t3_set_vlan_accel(adapter, 1 << pi->port_id,
+                                  features & NETIF_F_HW_VLAN_RX);
+        } else {
+                /* single control for all ports */
+                unsigned int i, have_vlans = features & NETIF_F_HW_VLAN_RX;
+
+                for_each_port(adapter, i)
+                        have_vlans |=
+                                adapter->port[i]->features & NETIF_F_HW_VLAN_RX;
+
+                t3_set_vlan_accel(adapter, 1, have_vlans);
+        }
+        t3_synchronize_rx(adapter, pi);
+}
+
+/**
  *      cxgb_up - enable the adapter
  *      @adapter: adapter being enabled
  *
@@ -1161,7 +1203,7 @@ release_tpsram:
  */
 static int cxgb_up(struct adapter *adap)
 {
-        int err;
+        int i, err;
 
         if (!(adap->flags & FULL_INIT_DONE)) {
                 err = t3_check_fw_version(adap);
@@ -1198,6 +1240,9 @@ static int cxgb_up(struct adapter *adap)
                 if (err)
                         goto out;
 
+                for_each_port(adap, i)
+                        cxgb_vlan_mode(adap->port[i], adap->port[i]->features);
+
                 setup_rss(adap);
                 if (!(adap->flags & NAPI_INIT))
                         init_napi(adap);
@@ -2508,48 +2553,6 @@ static int cxgb_set_mac_addr(struct net_device *dev, void *p)
         return 0;
 }
 
-/**
- * t3_synchronize_rx - wait for current Rx processing on a port to complete
- * @adap: the adapter
- * @p: the port
- *
- * Ensures that current Rx processing on any of the queues associated with
- * the given port completes before returning.  We do this by acquiring and
- * releasing the locks of the response queues associated with the port.
- */
-static void t3_synchronize_rx(struct adapter *adap, const struct port_info *p)
-{
-        int i;
-
-        for (i = p->first_qset; i < p->first_qset + p->nqsets; i++) {
-                struct sge_rspq *q = &adap->sge.qs[i].rspq;
-
-                spin_lock_irq(&q->lock);
-                spin_unlock_irq(&q->lock);
-        }
-}
-
-static void cxgb_vlan_mode(struct net_device *dev, netdev_features_t features)
-{
-        struct port_info *pi = netdev_priv(dev);
-        struct adapter *adapter = pi->adapter;
-
-        if (adapter->params.rev > 0) {
-                t3_set_vlan_accel(adapter, 1 << pi->port_id,
-                                  features & NETIF_F_HW_VLAN_RX);
-        } else {
-                /* single control for all ports */
-                unsigned int i, have_vlans = features & NETIF_F_HW_VLAN_RX;
-
-                for_each_port(adapter, i)
-                        have_vlans |=
-                                adapter->port[i]->features & NETIF_F_HW_VLAN_RX;
-
-                t3_set_vlan_accel(adapter, 1, have_vlans);
-        }
-        t3_synchronize_rx(adapter, pi);
-}
-
 static netdev_features_t cxgb_fix_features(struct net_device *dev,
         netdev_features_t features)
 {
@@ -3353,9 +3356,6 @@ static int __devinit init_one(struct pci_dev *pdev,
         err = sysfs_create_group(&adapter->port[0]->dev.kobj,
                                  &cxgb3_attr_group);
 
-        for_each_port(adapter, i)
-                cxgb_vlan_mode(adapter->port[i], adapter->port[i]->features);
-
         print_port_info(adapter, ai);
         return 0;
 
diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
index b2dc2c81a147..2e09edb9cdf8 100644
--- a/drivers/net/ethernet/dlink/dl2k.c
+++ b/drivers/net/ethernet/dlink/dl2k.c
@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
 {
         int phy_addr;
         struct netdev_private *np = netdev_priv(dev);
-        struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
-
-        struct netdev_desc *desc;
-        int i;
+        struct mii_ioctl_data *miidata = if_mii(rq);
 
         phy_addr = np->phy_addr;
         switch (cmd) {
-        case SIOCDEVPRIVATE:
-                break;
-
-        case SIOCDEVPRIVATE + 1:
-                miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
+        case SIOCGMIIPHY:
+                miidata->phy_id = phy_addr;
                 break;
-        case SIOCDEVPRIVATE + 2:
-                mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
+        case SIOCGMIIREG:
+                miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
                 break;
-        case SIOCDEVPRIVATE + 3:
-                break;
-        case SIOCDEVPRIVATE + 4:
-                break;
-        case SIOCDEVPRIVATE + 5:
-                netif_stop_queue (dev);
+        case SIOCSMIIREG:
+                if (!capable(CAP_NET_ADMIN))
+                        return -EPERM;
+                mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
                 break;
-        case SIOCDEVPRIVATE + 6:
-                netif_wake_queue (dev);
-                break;
-        case SIOCDEVPRIVATE + 7:
-                printk
-                    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
-                     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
-                     np->old_rx);
-                break;
-        case SIOCDEVPRIVATE + 8:
-                printk("TX ring:\n");
-                for (i = 0; i < TX_RING_SIZE; i++) {
-                        desc = &np->tx_ring[i];
-                        printk
-                            ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
-                             i,
-                             (u32) (np->tx_ring_dma + i * sizeof (*desc)),
-                             (u32)le64_to_cpu(desc->next_desc),
-                             (u32)le64_to_cpu(desc->status),
-                             (u32)(le64_to_cpu(desc->fraginfo) >> 32),
-                             (u32)le64_to_cpu(desc->fraginfo));
-                        printk ("\n");
-                }
-                printk ("\n");
-                break;
-
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
index ba0adcafa55a..30c2da3de548 100644
--- a/drivers/net/ethernet/dlink/dl2k.h
+++ b/drivers/net/ethernet/dlink/dl2k.h
@@ -365,13 +365,6 @@ struct ioctl_data {
         char *data;
 };
 
-struct mii_data {
-        __u16 reserved;
-        __u16 reg_num;
-        __u16 in_value;
-        __u16 out_value;
-};
-
 /* The Rx and Tx buffer descriptors. */
 struct netdev_desc {
         __le64 next_desc;
diff --git a/drivers/net/ethernet/freescale/ucc_geth.c b/drivers/net/ethernet/freescale/ucc_geth.c
index 17a46e76123f..9ac14f804851 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.c
+++ b/drivers/net/ethernet/freescale/ucc_geth.c
@@ -116,10 +116,10 @@ static struct ucc_geth_info ugeth_primary_info = {
         .maxGroupAddrInHash = 4,
         .maxIndAddrInHash = 4,
         .prel = 7,
-        .maxFrameLength = 1518,
+        .maxFrameLength = 1518+16, /* Add extra bytes for VLANs etc. */
         .minFrameLength = 64,
-        .maxD1Length = 1520,
-        .maxD2Length = 1520,
+        .maxD1Length = 1520+16, /* Add extra bytes for VLANs etc. */
+        .maxD2Length = 1520+16, /* Add extra bytes for VLANs etc. */
         .vlantype = 0x8100,
         .ecamptr = ((uint32_t) NULL),
         .eventRegMask = UCCE_OTHER,
diff --git a/drivers/net/ethernet/freescale/ucc_geth.h b/drivers/net/ethernet/freescale/ucc_geth.h
index 2e395a2566b8..f71b3e7b12de 100644
--- a/drivers/net/ethernet/freescale/ucc_geth.h
+++ b/drivers/net/ethernet/freescale/ucc_geth.h
@@ -877,7 +877,7 @@ struct ucc_geth_hardware_statistics {
 
 /* Driver definitions */
 #define TX_BD_RING_LEN                          0x10
-#define RX_BD_RING_LEN                          0x10
+#define RX_BD_RING_LEN                          0x20
 
 #define TX_RING_MOD_MASK(size)                  (size-1)
 #define RX_RING_MOD_MASK(size)                  (size-1)
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 3516e17a399d..c9069a28832b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -290,16 +290,18 @@ static void ehea_update_bcmc_registrations(void)
 
                                 arr[i].adh = adapter->handle;
                                 arr[i].port_id = port->logical_port_id;
-                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
-                                                  EHEA_BCMC_MULTICAST |
+                                arr[i].reg_type = EHEA_BCMC_MULTICAST |
                                                   EHEA_BCMC_UNTAGGED;
+                                if (mc_entry->macaddr == 0)
+                                        arr[i].reg_type |= EHEA_BCMC_SCOPE_ALL;
                                 arr[i++].macaddr = mc_entry->macaddr;
 
                                 arr[i].adh = adapter->handle;
                                 arr[i].port_id = port->logical_port_id;
-                                arr[i].reg_type = EHEA_BCMC_SCOPE_ALL |
-                                                  EHEA_BCMC_MULTICAST |
+                                arr[i].reg_type = EHEA_BCMC_MULTICAST |
                                                   EHEA_BCMC_VLANID_ALL;
+                                if (mc_entry->macaddr == 0)
+                                        arr[i].reg_type |= EHEA_BCMC_SCOPE_ALL;
                                 arr[i++].macaddr = mc_entry->macaddr;
                                 num_registrations -= 2;
                         }
@@ -1838,8 +1840,9 @@ static u64 ehea_multicast_reg_helper(struct ehea_port *port, u64 mc_mac_addr,
         u64 hret;
         u8 reg_type;
 
-        reg_type = EHEA_BCMC_SCOPE_ALL | EHEA_BCMC_MULTICAST
-                 | EHEA_BCMC_UNTAGGED;
+        reg_type = EHEA_BCMC_MULTICAST | EHEA_BCMC_UNTAGGED;
+        if (mc_mac_addr == 0)
+                reg_type |= EHEA_BCMC_SCOPE_ALL;
 
         hret = ehea_h_reg_dereg_bcmc(port->adapter->handle,
                                      port->logical_port_id,
@@ -1847,8 +1850,9 @@ static u64 ehea_multicast_reg_helper(struct ehea_port *port, u64 mc_mac_addr,
         if (hret)
                 goto out;
 
-        reg_type = EHEA_BCMC_SCOPE_ALL | EHEA_BCMC_MULTICAST
-                 | EHEA_BCMC_VLANID_ALL;
+        reg_type = EHEA_BCMC_MULTICAST | EHEA_BCMC_VLANID_ALL;
+        if (mc_mac_addr == 0)
+                reg_type |= EHEA_BCMC_SCOPE_ALL;
 
         hret = ehea_h_reg_dereg_bcmc(port->adapter->handle,
                                      port->logical_port_id,
@@ -1898,7 +1902,7 @@ static void ehea_allmulti(struct net_device *dev, int enable)
                                 netdev_err(dev,
                                            "failed enabling IFF_ALLMULTI\n");
                 }
-        } else
+        } else {
                 if (!enable) {
                         /* Disable ALLMULTI */
                         hret = ehea_multicast_reg_helper(port, 0, H_DEREG_BCMC);
@@ -1908,6 +1912,7 @@ static void ehea_allmulti(struct net_device *dev, int enable)
                                 netdev_err(dev,
                                            "failed disabling IFF_ALLMULTI\n");
                 }
+        }
 }
 
 static void ehea_add_multicast_entry(struct ehea_port *port, u8 *mc_mac_addr)
@@ -1941,11 +1946,7 @@ static void ehea_set_multicast_list(struct net_device *dev)
         struct netdev_hw_addr *ha;
         int ret;
 
-        if (port->promisc) {
-                ehea_promiscuous(dev, 1);
-                return;
-        }
-        ehea_promiscuous(dev, 0);
+        ehea_promiscuous(dev, !!(dev->flags & IFF_PROMISC));
 
         if (dev->flags & IFF_ALLMULTI) {
                 ehea_allmulti(dev, 1);
@@ -2463,6 +2464,7 @@ static int ehea_down(struct net_device *dev)
                 return 0;
 
         ehea_drop_multicast_list(dev);
+        ehea_allmulti(dev, 0);
         ehea_broadcast_reg_helper(port, H_DEREG_BCMC);
 
         ehea_free_interrupts(dev);
@@ -3261,6 +3263,7 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
         struct ehea_adapter *adapter;
         const u64 *adapter_handle;
         int ret;
+        int i;
 
         if (!dev || !dev->dev.of_node) {
                 pr_err("Invalid ibmebus device probed\n");
@@ -3314,17 +3317,9 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
         tasklet_init(&adapter->neq_tasklet, ehea_neq_tasklet,
                      (unsigned long)adapter);
 
-        ret = ibmebus_request_irq(adapter->neq->attr.ist1,
-                                  ehea_interrupt_neq, IRQF_DISABLED,
-                                  "ehea_neq", adapter);
-        if (ret) {
-                dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
-                goto out_kill_eq;
-        }
-
         ret = ehea_create_device_sysfs(dev);
         if (ret)
-                goto out_free_irq;
+                goto out_kill_eq;
 
         ret = ehea_setup_ports(adapter);
         if (ret) {
@@ -3332,15 +3327,28 @@ static int __devinit ehea_probe_adapter(struct platform_device *dev,
                 goto out_rem_dev_sysfs;
         }
 
+        ret = ibmebus_request_irq(adapter->neq->attr.ist1,
+                                  ehea_interrupt_neq, IRQF_DISABLED,
+                                  "ehea_neq", adapter);
+        if (ret) {
+                dev_err(&dev->dev, "requesting NEQ IRQ failed\n");
+                goto out_shutdown_ports;
+        }
+
+
         ret = 0;
         goto out;
 
+out_shutdown_ports:
+        for (i = 0; i < EHEA_MAX_PORTS; i++)
+                if (adapter->port[i]) {
+                        ehea_shutdown_single_port(adapter->port[i]);
+                        adapter->port[i] = NULL;
+                }
+
 out_rem_dev_sysfs:
         ehea_remove_device_sysfs(dev);
 
-out_free_irq:
-        ibmebus_free_irq(adapter->neq->attr.ist1, adapter);
-
 out_kill_eq:
         ehea_destroy_eq(adapter->neq);
 
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_phyp.h b/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
index 52c456ec4d6c..8364815c32ff 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
+++ b/drivers/net/ethernet/ibm/ehea/ehea_phyp.h
@@ -450,7 +450,7 @@ u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
                             void *cb_addr);
 
 #define H_REGBCMC_PN            EHEA_BMASK_IBM(48, 63)
-#define H_REGBCMC_REGTYPE       EHEA_BMASK_IBM(61, 63)
+#define H_REGBCMC_REGTYPE       EHEA_BMASK_IBM(60, 63)
 #define H_REGBCMC_MACADDR       EHEA_BMASK_IBM(16, 63)
 #define H_REGBCMC_VLANID        EHEA_BMASK_IBM(52, 63)
 
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 19ab2154802c..9520a6ac1f30 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -3799,7 +3799,7 @@ static int e1000_test_msi_interrupt(struct e1000_adapter *adapter)
         /* fire an unusual interrupt on the test handler */
         ew32(ICS, E1000_ICS_RXSEQ);
         e1e_flush();
-        msleep(50);
+        msleep(100);
 
         e1000_irq_disable(adapter);
 
diff --git a/drivers/net/ethernet/intel/e1000e/param.c b/drivers/net/ethernet/intel/e1000e/param.c
index ff796e42c3eb..16adeb9418a8 100644
--- a/drivers/net/ethernet/intel/e1000e/param.c
+++ b/drivers/net/ethernet/intel/e1000e/param.c
@@ -106,7 +106,7 @@ E1000_PARAM(RxAbsIntDelay, "Receive Absolute Interrupt Delay");
 /*
  * Interrupt Throttle Rate (interrupts/sec)
  *
- * Valid Range: 100-100000 (0=off, 1=dynamic, 3=dynamic conservative)
+ * Valid Range: 100-100000 or one of: 0=off, 1=dynamic, 3=dynamic conservative
  */
 E1000_PARAM(InterruptThrottleRate, "Interrupt Throttling Rate");
 #define DEFAULT_ITR 3
@@ -344,53 +344,60 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
 
                 if (num_InterruptThrottleRate > bd) {
                         adapter->itr = InterruptThrottleRate[bd];
-                        switch (adapter->itr) {
-                        case 0:
-                                e_info("%s turned off\n", opt.name);
-                                break;
-                        case 1:
-                                e_info("%s set to dynamic mode\n", opt.name);
-                                adapter->itr_setting = adapter->itr;
-                                adapter->itr = 20000;
-                                break;
-                        case 3:
-                                e_info("%s set to dynamic conservative mode\n",
-                                        opt.name);
-                                adapter->itr_setting = adapter->itr;
-                                adapter->itr = 20000;
-                                break;
-                        case 4:
-                                e_info("%s set to simplified (2000-8000 ints) "
-                                       "mode\n", opt.name);
-                                adapter->itr_setting = 4;
-                                break;
-                        default:
-                                /*
-                                 * Save the setting, because the dynamic bits
-                                 * change itr.
-                                 */
-                                if (e1000_validate_option(&adapter->itr, &opt,
-                                                          adapter) &&
-                                    (adapter->itr == 3)) {
-                                        /*
-                                         * In case of invalid user value,
-                                         * default to conservative mode.
-                                         */
-                                        adapter->itr_setting = adapter->itr;
-                                        adapter->itr = 20000;
-                                } else {
-                                        /*
-                                         * Clear the lower two bits because
-                                         * they are used as control.
-                                         */
-                                        adapter->itr_setting =
-                                                adapter->itr & ~3;
-                                }
-                                break;
-                        }
+
+                        /*
+                         * Make sure a message is printed for non-special
+                         * values.  And in case of an invalid option, display
+                         * warning, use default and got through itr/itr_setting
+                         * adjustment logic below
+                         */
+                        if ((adapter->itr > 4) &&
+                            e1000_validate_option(&adapter->itr, &opt, adapter))
+                                adapter->itr = opt.def;
                 } else {
-                        adapter->itr_setting = opt.def;
+                        /*
+                         * If no option specified, use default value and go
+                         * through the logic below to adjust itr/itr_setting
+                         */
+                        adapter->itr = opt.def;
+
+                        /*
+                         * Make sure a message is printed for non-special
+                         * default values
+                         */
+                        if (adapter->itr > 40)
+                                e_info("%s set to default %d\n", opt.name,
+                                       adapter->itr);
+                }
+
+                adapter->itr_setting = adapter->itr;
+                switch (adapter->itr) {
+                case 0:
+                        e_info("%s turned off\n", opt.name);
+                        break;
+                case 1:
+                        e_info("%s set to dynamic mode\n", opt.name);
+                        adapter->itr = 20000;
+                        break;
+                case 3:
+                        e_info("%s set to dynamic conservative mode\n",
+                               opt.name);
                         adapter->itr = 20000;
+                        break;
+                case 4:
+                        e_info("%s set to simplified (2000-8000 ints) mode\n",
+                               opt.name);
+                        break;
+                default:
+                        /*
+                         * Save the setting, because the dynamic bits
+                         * change itr.
+                         *
+                         * Clear the lower two bits because
+                         * they are used as control.
+                         */
+                        adapter->itr_setting &= ~3;
+                        break;
                 }
         }
         { /* Interrupt Mode */
diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index d61ca2a732f0..8ec74b07f940 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -2731,14 +2731,14 @@ static int __devinit igbvf_probe(struct pci_dev *pdev,
                         netdev->addr_len);
         }
 
-        if (!is_valid_ether_addr(netdev->perm_addr)) {
+        if (!is_valid_ether_addr(netdev->dev_addr)) {
                 dev_err(&pdev->dev, "Invalid MAC Address: %pM\n",
                         netdev->dev_addr);
                 err = -EIO;
                 goto err_hw_init;
         }
 
-        memcpy(netdev->perm_addr, adapter->hw.mac.addr, netdev->addr_len);
+        memcpy(netdev->perm_addr, netdev->dev_addr, netdev->addr_len);
 
         setup_timer(&adapter->watchdog_timer, &igbvf_watchdog,
                     (unsigned long) adapter);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
index 77ea4b716535..bc07933d67da 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c
@@ -437,6 +437,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
          */
         if ((fh->fh_r_ctl == FC_RCTL_DD_SOL_DATA) &&
             (fctl & FC_FC_END_SEQ)) {
+                skb_linearize(skb);
                 crc = (struct fcoe_crc_eof *)skb_put(skb, sizeof(*crc));
                 crc->fcoe_eof = FC_EOF_T;
         }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index a7f3cd872caf..88f6b2e9b72d 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4873,10 +4873,6 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake)
         }
 
         ixgbe_clear_interrupt_scheme(adapter);
-#ifdef CONFIG_DCB
-        kfree(adapter->ixgbe_ieee_pfc);
-        kfree(adapter->ixgbe_ieee_ets);
-#endif
 
 #ifdef CONFIG_PM
         retval = pci_save_state(pdev);
@@ -7224,6 +7220,11 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
 
         ixgbe_release_hw_control(adapter);
 
+#ifdef CONFIG_DCB
+        kfree(adapter->ixgbe_ieee_pfc);
+        kfree(adapter->ixgbe_ieee_ets);
+
+#endif
         iounmap(adapter->hw.hw_addr);
         pci_release_selected_regions(pdev, pci_select_bars(pdev,
                                      IORESOURCE_MEM));
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index c9b504e2dfc3..487a6c8bd4ec 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -2494,8 +2494,13 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
                 skb_copy_from_linear_data(re->skb, skb->data, length);
                 skb->ip_summed = re->skb->ip_summed;
                 skb->csum = re->skb->csum;
+                skb->rxhash = re->skb->rxhash;
+                skb->vlan_tci = re->skb->vlan_tci;
+
                 pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
                                                length, PCI_DMA_FROMDEVICE);
+                re->skb->vlan_tci = 0;
+                re->skb->rxhash = 0;
                 re->skb->ip_summed = CHECKSUM_NONE;
                 skb_put(skb, length);
         }
@@ -2580,9 +2585,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
         struct sk_buff *skb = NULL;
         u16 count = (status & GMR_FS_LEN) >> 16;
 
-        if (status & GMR_FS_VLAN)
-                count -= VLAN_HLEN;     /* Account for vlan tag */
-
         netif_printk(sky2, rx_status, KERN_DEBUG, dev,
                      "rx slot %u status 0x%x len %d\n",
                      sky2->rx_next, status, length);
@@ -2590,6 +2592,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
         sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
         prefetch(sky2->rx_ring + sky2->rx_next);
 
+        if (vlan_tx_tag_present(re->skb))
+                count -= VLAN_HLEN;     /* Account for vlan tag */
+
         /* This chip has hardware problems that generates bogus status.
          * So do only marginal checking and expect higher level protocols
          * to handle crap frames.
@@ -2647,11 +2652,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 }
 
 static inline void sky2_skb_rx(const struct sky2_port *sky2,
-                               u32 status, struct sk_buff *skb)
+                               struct sk_buff *skb)
 {
-        if (status & GMR_FS_VLAN)
-                __vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
-
         if (skb->ip_summed == CHECKSUM_NONE)
                 netif_receive_skb(skb);
         else
@@ -2705,6 +2707,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
         }
 }
 
+static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
+{
+        struct sk_buff *skb;
+
+        skb = sky2->rx_ring[sky2->rx_next].skb;
+        __vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
+}
+
 static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
 {
         struct sk_buff *skb;
@@ -2763,8 +2773,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                         }
 
                         skb->protocol = eth_type_trans(skb, dev);
-
-                        sky2_skb_rx(sky2, status, skb);
+                        sky2_skb_rx(sky2, skb);
 
                         /* Stop after net poll weight */
                         if (++work_done >= to_do)
@@ -2772,11 +2781,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                         break;
 
                 case OP_RXVLAN:
-                        sky2->rx_tag = length;
+                        sky2_rx_tag(sky2, length);
                         break;
 
                 case OP_RXCHKSVLAN:
-                        sky2->rx_tag = length;
+                        sky2_rx_tag(sky2, length);
                         /* fall through */
                 case OP_RXCHKS:
                         if (likely(dev->features & NETIF_F_RXCSUM))
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index ff6f58bf822a..3c896ce80b71 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2241,7 +2241,6 @@ struct sky2_port {
         u16                  rx_pending;
         u16                  rx_data_size;
         u16                  rx_nfrags;
-        u16                  rx_tag;
 
         struct {
                 unsigned long last;
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index 558409ff4058..4ba969096717 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2339,7 +2339,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
         netif_device_detach(dev);
 
         /* Switch off chip, remember WOL setting */
-        gp->asleep_wol = gp->wake_on_lan;
+        gp->asleep_wol = !!gp->wake_on_lan;
         gem_do_stop(dev, gp->asleep_wol);
 
         /* Unlock the network stack */
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 174a3348f676..08aff1a2087c 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1511,7 +1511,7 @@ static int emac_devioctl(struct net_device *ndev, struct ifreq *ifrq, int cmd)
 
 static int match_first_device(struct device *dev, void *data)
 {
-        return 1;
+        return !strncmp(dev_name(dev), "davinci_mdio", 12);
 }
 
 /**
diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c
index 817ad3bc4957..efd36691ce54 100644
--- a/drivers/net/ethernet/ti/tlan.c
+++ b/drivers/net/ethernet/ti/tlan.c
@@ -228,7 +228,7 @@ tlan_get_skb(const struct tlan_list *tag)
         unsigned long addr;
 
         addr = tag->buffer[9].address;
-        addr |= (tag->buffer[8].address << 16) << 16;
+        addr |= ((unsigned long) tag->buffer[8].address << 16) << 16;
         return (struct sk_buff *) addr;
 }
 
diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
index 5ee032cafade..42b5151aa78a 100644
--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -355,7 +355,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         u32 packet_len;
         u32 padbytes = 0xffff0000;
 
-        padlen = ((skb->len + 4) % 512) ? 0 : 4;
+        padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
 
         if ((!skb_cloned(skb)) &&
             ((headroom + tailroom) >= (4 + padlen))) {
@@ -377,7 +377,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         cpu_to_le32s(&packet_len);
         skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
 
-        if ((skb->len % 512) == 0) {
+        if (padlen) {
                 cpu_to_le32s(&padbytes);
                 memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
                 skb_put(skb, sizeof(padbytes));
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index a2349483cd2a..00103a8c5e04 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -98,7 +98,7 @@ static int __must_check smsc75xx_read_reg(struct usbnet *dev, u32 index,
 
         if (unlikely(ret < 0))
                 netdev_warn(dev->net,
-                        "Failed to read register index 0x%08x", index);
+                        "Failed to read reg index 0x%08x: %d", index, ret);
 
         le32_to_cpus(buf);
         *data = *buf;
@@ -128,7 +128,7 @@ static int __must_check smsc75xx_write_reg(struct usbnet *dev, u32 index,
 
         if (unlikely(ret < 0))
                 netdev_warn(dev->net,
-                        "Failed to write register index 0x%08x", index);
+                        "Failed to write reg index 0x%08x: %d", index, ret);
 
         kfree(buf);
 
@@ -171,7 +171,7 @@ static int smsc75xx_mdio_read(struct net_device *netdev, int phy_id, int idx)
         idx &= dev->mii.reg_num_mask;
         addr = ((phy_id << MII_ACCESS_PHY_ADDR_SHIFT) & MII_ACCESS_PHY_ADDR)
                 | ((idx << MII_ACCESS_REG_ADDR_SHIFT) & MII_ACCESS_REG_ADDR)
-                | MII_ACCESS_READ;
+                | MII_ACCESS_READ | MII_ACCESS_BUSY;
         ret = smsc75xx_write_reg(dev, MII_ACCESS, addr);
         check_warn_goto_done(ret, "Error writing MII_ACCESS");
 
@@ -210,7 +210,7 @@ static void smsc75xx_mdio_write(struct net_device *netdev, int phy_id, int idx,
         idx &= dev->mii.reg_num_mask;
         addr = ((phy_id << MII_ACCESS_PHY_ADDR_SHIFT) & MII_ACCESS_PHY_ADDR)
                 | ((idx << MII_ACCESS_REG_ADDR_SHIFT) & MII_ACCESS_REG_ADDR)
-                | MII_ACCESS_WRITE;
+                | MII_ACCESS_WRITE | MII_ACCESS_BUSY;
         ret = smsc75xx_write_reg(dev, MII_ACCESS, addr);
         check_warn_goto_done(ret, "Error writing MII_ACCESS");
 
@@ -508,9 +508,10 @@ static int smsc75xx_link_reset(struct usbnet *dev)
         u16 lcladv, rmtadv;
         int ret;
 
-        /* clear interrupt status */
+        /* read and write to clear phy interrupt status */
         ret = smsc75xx_mdio_read(dev->net, mii->phy_id, PHY_INT_SRC);
         check_warn_return(ret, "Error reading PHY_INT_SRC");
+        smsc75xx_mdio_write(dev->net, mii->phy_id, PHY_INT_SRC, 0xffff);
 
         ret = smsc75xx_write_reg(dev, INT_STS, INT_STS_CLEAR_ALL);
         check_warn_return(ret, "Error writing INT_STS");
@@ -643,7 +644,7 @@ static int smsc75xx_set_mac_address(struct usbnet *dev)
 
 static int smsc75xx_phy_initialize(struct usbnet *dev)
 {
-        int bmcr, timeout = 0;
+        int bmcr, ret, timeout = 0;
 
         /* Initialize MII structure */
         dev->mii.dev = dev->net;
@@ -651,6 +652,7 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
         dev->mii.mdio_write = smsc75xx_mdio_write;
         dev->mii.phy_id_mask = 0x1f;
         dev->mii.reg_num_mask = 0x1f;
+        dev->mii.supports_gmii = 1;
         dev->mii.phy_id = SMSC75XX_INTERNAL_PHY_ID;
 
         /* reset phy and wait for reset to complete */
@@ -661,7 +663,7 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
                 bmcr = smsc75xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR);
                 check_warn_return(bmcr, "Error reading MII_BMCR");
                 timeout++;
-        } while ((bmcr & MII_BMCR) && (timeout < 100));
+        } while ((bmcr & BMCR_RESET) && (timeout < 100));
 
         if (timeout >= 100) {
                 netdev_warn(dev->net, "timeout on PHY Reset");
@@ -671,10 +673,13 @@ static int smsc75xx_phy_initialize(struct usbnet *dev)
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
                 ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
                 ADVERTISE_PAUSE_ASYM);
+        smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_CTRL1000,
+                ADVERTISE_1000FULL);
 
-        /* read to clear */
-        smsc75xx_mdio_read(dev->net, dev->mii.phy_id, PHY_INT_SRC);
-        check_warn_return(bmcr, "Error reading PHY_INT_SRC");
+        /* read and write to clear phy interrupt status */
+        ret = smsc75xx_mdio_read(dev->net, dev->mii.phy_id, PHY_INT_SRC);
+        check_warn_return(ret, "Error reading PHY_INT_SRC");
+        smsc75xx_mdio_write(dev->net, dev->mii.phy_id, PHY_INT_SRC, 0xffff);
 
         smsc75xx_mdio_write(dev->net, dev->mii.phy_id, PHY_INT_MASK,
                 PHY_INT_MASK_DEFAULT);
@@ -946,6 +951,14 @@ static int smsc75xx_reset(struct usbnet *dev)
         ret = smsc75xx_write_reg(dev, INT_EP_CTL, buf);
         check_warn_return(ret, "Failed to write INT_EP_CTL: %d", ret);
 
+        /* allow mac to detect speed and duplex from phy */
+        ret = smsc75xx_read_reg(dev, MAC_CR, &buf);
+        check_warn_return(ret, "Failed to read MAC_CR: %d", ret);
+
+        buf |= (MAC_CR_ADD | MAC_CR_ASD);
+        ret = smsc75xx_write_reg(dev, MAC_CR, buf);
+        check_warn_return(ret, "Failed to write MAC_CR: %d", ret);
+
         ret = smsc75xx_read_reg(dev, MAC_TX, &buf);
         check_warn_return(ret, "Failed to read MAC_TX: %d", ret);
 
@@ -1212,7 +1225,7 @@ static const struct driver_info smsc75xx_info = {
         .rx_fixup       = smsc75xx_rx_fixup,
         .tx_fixup       = smsc75xx_tx_fixup,
         .status         = smsc75xx_status,
-        .flags          = FLAG_ETHER | FLAG_SEND_ZLP,
+        .flags          = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
 };
 
 static const struct usb_device_id products[] = {
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 5f19f84d3494..94ae66999f59 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1017,6 +1017,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
         dev->net->ethtool_ops = &smsc95xx_ethtool_ops;
         dev->net->flags |= IFF_MULTICAST;
         dev->net->hard_header_len += SMSC95XX_TX_OVERHEAD_CSUM;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
         return 0;
 }
 
@@ -1191,7 +1192,7 @@ static const struct driver_info smsc95xx_info = {
         .rx_fixup       = smsc95xx_rx_fixup,
         .tx_fixup       = smsc95xx_tx_fixup,
         .status         = smsc95xx_status,
-        .flags          = FLAG_ETHER | FLAG_SEND_ZLP,
+        .flags          = FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
 };
 
 static const struct usb_device_id products[] = {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index b7b3f5b0d406..2d927fb4adf4 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -210,6 +210,7 @@ static int init_status (struct usbnet *dev, struct usb_interface *intf)
                 } else {
                         usb_fill_int_urb(dev->interrupt, dev->udev, pipe,
                                 buf, maxp, intr_complete, dev, period);
+                        dev->interrupt->transfer_flags |= URB_FREE_BUFFER;
                         dev_dbg(&intf->dev,
                                 "status ep%din, %d bytes period %d\n",
                                 usb_pipeendpoint(pipe), maxp, period);
@@ -1443,7 +1444,7 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 
         status = register_netdev (net);
         if (status)
-                goto out3;
+                goto out4;
         netif_info(dev, probe, dev->net,
                    "register '%s' at usb-%s-%s, %s, %pM\n",
                    udev->dev.driver->name,
@@ -1461,6 +1462,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 
         return 0;
 
+out4:
+        usb_free_urb(dev->interrupt);
 out3:
         if (info->unbind)
                 info->unbind (dev, udev);
diff --git a/drivers/net/wireless/ath/ath5k/ahb.c b/drivers/net/wireless/ath/ath5k/ahb.c
index 8c50d9d19d78..aec33cc207fd 100644
--- a/drivers/net/wireless/ath/ath5k/ahb.c
+++ b/drivers/net/wireless/ath/ath5k/ahb.c
@@ -220,6 +220,7 @@ static int ath_ahb_remove(struct platform_device *pdev)
         }
 
         ath5k_deinit_ah(ah);
+        iounmap(ah->iobase);
         platform_set_drvdata(pdev, NULL);
         ieee80211_free_hw(hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index d7d8e9199140..aba088005b22 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -869,7 +869,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         ar5008_hw_set_channel_regs(ah, chan);
         ar5008_hw_init_chain_masks(ah);
         ath9k_olc_init(ah);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
 
         /* Write analog registers */
         if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 59647a3ceb7f..3d400e8d6535 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -54,7 +54,7 @@ void ar9003_paprd_enable(struct ath_hw *ah, bool val)
 
         if (val) {
                 ah->paprd_table_write_done = true;
-                ath9k_hw_apply_txpower(ah, chan);
+                ath9k_hw_apply_txpower(ah, chan, false);
         }
 
         REG_RMW_FIELD(ah, AR_PHY_PAPRD_CTRL0_B0,
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index bc992b237ae5..deb6cfb2959a 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -694,7 +694,7 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         ar9003_hw_override_ini(ah);
         ar9003_hw_set_channel_regs(ah, chan);
         ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
 
         if (AR_SREV_9462(ah)) {
                 if (REG_READ_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_0,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index f272236d8053..b34e8b2990b1 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -824,6 +824,8 @@ static void ath9k_hw_ar9287_set_txpower(struct ath_hw *ah,
                         regulatory->max_power_level = ratesArray[i];
         }
 
+        ath9k_hw_update_regulatory_maxpower(ah);
+
         if (test)
                 return;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 6c69e4e8b1cb..fa84e37bf091 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1454,7 +1454,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                 return false;
         }
         ath9k_hw_set_clockrate(ah);
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, false);
         ath9k_hw_rfbus_done(ah);
 
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
@@ -2652,7 +2652,8 @@ static int get_antenna_gain(struct ath_hw *ah, struct ath9k_channel *chan)
         return ah->eep_ops->get_eeprom(ah, gain_param);
 }
 
-void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan)
+void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan,
+                            bool test)
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
         struct ieee80211_channel *channel;
@@ -2673,7 +2674,7 @@ void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan)
 
         ah->eep_ops->set_txpower(ah, chan,
                                  ath9k_regd_get_ctl(reg, chan),
-                                 ant_reduction, new_pwr, false);
+                                 ant_reduction, new_pwr, test);
 }
 
 void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
@@ -2686,7 +2687,7 @@ void ath9k_hw_set_txpowerlimit(struct ath_hw *ah, u32 limit, bool test)
         if (test)
                 channel->max_power = MAX_RATE_POWER / 2;
 
-        ath9k_hw_apply_txpower(ah, chan);
+        ath9k_hw_apply_txpower(ah, chan, test);
 
         if (test)
                 channel->max_power = DIV_ROUND_UP(reg->max_power_level, 2);
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index aa1680a0c7fd..e88f182ff45c 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -985,7 +985,8 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
 /* PHY */
 void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
                                    u32 *coef_mantissa, u32 *coef_exponent);
-void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan);
+void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan,
+                            bool test);
 
 /*
  * Code Specific to AR5008, AR9001 or AR9002,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index c79e6638c88d..e4d6dc2e37d1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4827,8 +4827,14 @@ static int b43_op_start(struct ieee80211_hw *hw)
  out_mutex_unlock:
         mutex_unlock(&wl->mutex);
 
-        /* reload configuration */
-        b43_op_config(hw, ~0);
+        /*
+         * Configuration may have been overwritten during initialization.
+         * Reload the configuration, but only if initialization was
+         * successful. Reloading the configuration after a failed init
+         * may hang the system.
+         */
+        if (!err)
+                b43_op_config(hw, ~0);
 
         return err;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 4688904908ec..758c115b556e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -108,9 +108,15 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                         sdio_release_host(sdfunc);
                 }
         } else if (regaddr == SDIO_CCCR_ABORT) {
+                sdfunc = kmemdup(sdiodev->func[0], sizeof(struct sdio_func),
+                                 GFP_KERNEL);
+                if (!sdfunc)
+                        return -ENOMEM;
+                sdfunc->num = 0;
                 sdio_claim_host(sdfunc);
                 sdio_writeb(sdfunc, *byte, regaddr, &err_ret);
                 sdio_release_host(sdfunc);
+                kfree(sdfunc);
         } else if (regaddr < 0xF0) {
                 brcmf_dbg(ERROR, "F0 Wr:0x%02x: write disallowed\n", regaddr);
                 err_ret = -EPERM;
@@ -486,7 +492,7 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
                         kfree(bus_if);
                         return -ENOMEM;
                 }
-                sdiodev->func[0] = func->card->sdio_func[0];
+                sdiodev->func[0] = func;
                 sdiodev->func[1] = func;
                 sdiodev->bus_if = bus_if;
                 bus_if->bus_priv.sdio = sdiodev;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 2bf5dda29291..eb3829b03cd3 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -574,6 +574,8 @@ struct brcmf_sdio {
 
         struct task_struct *dpc_tsk;
         struct completion dpc_wait;
+        struct list_head dpc_tsklst;
+        spinlock_t dpc_tl_lock;
 
         struct semaphore sdsem;
 
@@ -2594,29 +2596,58 @@ clkwait:
         return resched;
 }
 
+static inline void brcmf_sdbrcm_adddpctsk(struct brcmf_sdio *bus)
+{
+        struct list_head *new_hd;
+        unsigned long flags;
+
+        if (in_interrupt())
+                new_hd = kzalloc(sizeof(struct list_head), GFP_ATOMIC);
+        else
+                new_hd = kzalloc(sizeof(struct list_head), GFP_KERNEL);
+        if (new_hd == NULL)
+                return;
+
+        spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+        list_add_tail(new_hd, &bus->dpc_tsklst);
+        spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
+}
+
 static int brcmf_sdbrcm_dpc_thread(void *data)
 {
         struct brcmf_sdio *bus = (struct brcmf_sdio *) data;
+        struct list_head *cur_hd, *tmp_hd;
+        unsigned long flags;
 
         allow_signal(SIGTERM);
         /* Run until signal received */
         while (1) {
                 if (kthread_should_stop())
                         break;
-                if (!wait_for_completion_interruptible(&bus->dpc_wait)) {
-                        /* Call bus dpc unless it indicated down
-                        (then clean stop) */
-                        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN) {
-                                if (brcmf_sdbrcm_dpc(bus))
-                                        complete(&bus->dpc_wait);
-                        } else {
+
+                if (list_empty(&bus->dpc_tsklst))
+                        if (wait_for_completion_interruptible(&bus->dpc_wait))
+                                break;
+
+                spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+                list_for_each_safe(cur_hd, tmp_hd, &bus->dpc_tsklst) {
+                        spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
+
+                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
                                 /* after stopping the bus, exit thread */
                                 brcmf_sdbrcm_bus_stop(bus->sdiodev->dev);
                                 bus->dpc_tsk = NULL;
                                 break;
                         }
-                } else
-                        break;
+
+                        if (brcmf_sdbrcm_dpc(bus))
+                                brcmf_sdbrcm_adddpctsk(bus);
+
+                        spin_lock_irqsave(&bus->dpc_tl_lock, flags);
+                        list_del(cur_hd);
+                        kfree(cur_hd);
+                }
+                spin_unlock_irqrestore(&bus->dpc_tl_lock, flags);
         }
         return 0;
 }
@@ -2669,8 +2700,10 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         /* Schedule DPC if needed to send queued packet(s) */
         if (!bus->dpc_sched) {
                 bus->dpc_sched = true;
-                if (bus->dpc_tsk)
+                if (bus->dpc_tsk) {
+                        brcmf_sdbrcm_adddpctsk(bus);
                         complete(&bus->dpc_wait);
+                }
         }
 
         return ret;
@@ -3514,8 +3547,10 @@ void brcmf_sdbrcm_isr(void *arg)
                 brcmf_dbg(ERROR, "isr w/o interrupt configured!\n");
 
         bus->dpc_sched = true;
-        if (bus->dpc_tsk)
+        if (bus->dpc_tsk) {
+                brcmf_sdbrcm_adddpctsk(bus);
                 complete(&bus->dpc_wait);
+        }
 }
 
 static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
@@ -3559,8 +3594,10 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                                 bus->ipend = true;
 
                                 bus->dpc_sched = true;
-                                if (bus->dpc_tsk)
+                                if (bus->dpc_tsk) {
+                                        brcmf_sdbrcm_adddpctsk(bus);
                                         complete(&bus->dpc_wait);
+                                }
                         }
                 }
 
@@ -3897,6 +3934,8 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         }
         /* Initialize DPC thread */
         init_completion(&bus->dpc_wait);
+        INIT_LIST_HEAD(&bus->dpc_tsklst);
+        spin_lock_init(&bus->dpc_tl_lock);
         bus->dpc_tsk = kthread_run(brcmf_sdbrcm_dpc_thread,
                                    bus, "brcmf_dpc");
         if (IS_ERR(bus->dpc_tsk)) {
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 7083db75b00c..b4d92792c502 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -847,8 +847,7 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
          */
         if (!(txs->status & TX_STATUS_AMPDU)
             && (txs->status & TX_STATUS_INTERMEDIATE)) {
-                wiphy_err(wlc->wiphy, "%s: INTERMEDIATE but not AMPDU\n",
-                          __func__);
+                BCMMSG(wlc->wiphy, "INTERMEDIATE but not AMPDU\n");
                 return false;
         }
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 2b022571a859..1779db3aa2b0 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2191,6 +2191,7 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
 {
         int rc = 0;
         unsigned long flags;
+        unsigned long now, end;
 
         spin_lock_irqsave(&priv->lock, flags);
         if (priv->status & STATUS_HCMD_ACTIVE) {
@@ -2232,10 +2233,20 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
+        now = jiffies;
+        end = now + HOST_COMPLETE_TIMEOUT;
+again:
         rc = wait_event_interruptible_timeout(priv->wait_command_queue,
                                               !(priv->
                                                 status & STATUS_HCMD_ACTIVE),
-                                              HOST_COMPLETE_TIMEOUT);
+                                              end - now);
+        if (rc < 0) {
+                now = jiffies;
+                if (time_before(now, end))
+                        goto again;
+                rc = 0;
+        }
+
         if (rc == 0) {
                 spin_lock_irqsave(&priv->lock, flags);
                 if (priv->status & STATUS_HCMD_ACTIVE) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 5b0d888f746b..8d80e233bc7a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -46,8 +46,8 @@
 #include "iwl-prph.h"
 
 /* Highest firmware API version supported */
-#define IWL1000_UCODE_API_MAX 6
-#define IWL100_UCODE_API_MAX 6
+#define IWL1000_UCODE_API_MAX 5
+#define IWL100_UCODE_API_MAX 5
 
 /* Oldest version we won't warn about */
 #define IWL1000_UCODE_API_OK 5
@@ -226,5 +226,5 @@ const struct iwl_cfg iwl100_bg_cfg = {
         IWL_DEVICE_100,
 };
 
-MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index 5635b9e2c69e..ea108622e0bd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -51,10 +51,10 @@
 #define IWL135_UCODE_API_MAX 6
 
 /* Oldest version we won't warn about */
-#define IWL2030_UCODE_API_OK 5
-#define IWL2000_UCODE_API_OK 5
-#define IWL105_UCODE_API_OK 5
-#define IWL135_UCODE_API_OK 5
+#define IWL2030_UCODE_API_OK 6
+#define IWL2000_UCODE_API_OK 6
+#define IWL105_UCODE_API_OK 6
+#define IWL135_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL2030_UCODE_API_MIN 5
@@ -328,7 +328,7 @@ const struct iwl_cfg iwl135_bgn_cfg = {
         .ht_params = &iwl2000_ht_params,
 };
 
-MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_OK));
+MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_OK));
+MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index a805e97b89af..de0920c74cdd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -51,6 +51,10 @@
 #define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 
+/* Oldest version we won't warn about */
+#define IWL5000_UCODE_API_OK 5
+#define IWL5150_UCODE_API_OK 2
+
 /* Lowest firmware API version supported */
 #define IWL5000_UCODE_API_MIN 1
 #define IWL5150_UCODE_API_MIN 1
@@ -326,6 +330,7 @@ static const struct iwl_ht_params iwl5000_ht_params = {
 #define IWL_DEVICE_5000                                         \
         .fw_name_pre = IWL5000_FW_PRE,                          \
         .ucode_api_max = IWL5000_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL5000_UCODE_API_OK,                   \
         .ucode_api_min = IWL5000_UCODE_API_MIN,                 \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
@@ -371,6 +376,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
         .fw_name_pre = IWL5000_FW_PRE,
         .ucode_api_max = IWL5000_UCODE_API_MAX,
+        .ucode_api_ok = IWL5000_UCODE_API_OK,
         .ucode_api_min = IWL5000_UCODE_API_MIN,
         .max_inst_size = IWLAGN_RTC_INST_SIZE,
         .max_data_size = IWLAGN_RTC_DATA_SIZE,
@@ -386,6 +392,7 @@ const struct iwl_cfg iwl5350_agn_cfg = {
 #define IWL_DEVICE_5150                                         \
         .fw_name_pre = IWL5150_FW_PRE,                          \
         .ucode_api_max = IWL5150_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL5150_UCODE_API_OK,                   \
         .ucode_api_min = IWL5150_UCODE_API_MIN,                 \
         .max_inst_size = IWLAGN_RTC_INST_SIZE,                  \
         .max_data_size = IWLAGN_RTC_DATA_SIZE,                  \
@@ -409,5 +416,5 @@ const struct iwl_cfg iwl5150_abg_cfg = {
         IWL_DEVICE_5150,
 };
 
-MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_OK));
+MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 64060cd738b5..f0c91505a7f7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -53,6 +53,8 @@
 /* Oldest version we won't warn about */
 #define IWL6000_UCODE_API_OK 4
 #define IWL6000G2_UCODE_API_OK 5
+#define IWL6050_UCODE_API_OK 5
+#define IWL6000G2B_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
@@ -388,7 +390,7 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
 #define IWL_DEVICE_6030                                         \
         .fw_name_pre = IWL6030_FW_PRE,                          \
         .ucode_api_max = IWL6000G2_UCODE_API_MAX,               \
-        .ucode_api_ok = IWL6000G2_UCODE_API_OK,                 \
+        .ucode_api_ok = IWL6000G2B_UCODE_API_OK,                \
         .ucode_api_min = IWL6000G2_UCODE_API_MIN,               \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
@@ -557,6 +559,6 @@ const struct iwl_cfg iwl6000_3agn_cfg = {
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_OK));
-MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
-MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_OK));
+MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_OK));
+MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2B_UCODE_API_OK));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index f1226dbf789d..2a9a16f901c3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -863,7 +863,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
 
 void iwlagn_prepare_restart(struct iwl_priv *priv)
 {
-        struct iwl_rxon_context *ctx;
         bool bt_full_concurrent;
         u8 bt_ci_compliance;
         u8 bt_load;
@@ -872,8 +871,6 @@ void iwlagn_prepare_restart(struct iwl_priv *priv)
 
         lockdep_assert_held(&priv->mutex);
 
-        for_each_context(priv, ctx)
-                ctx->vif = NULL;
         priv->is_open = 0;
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 90208094b8eb..74bce97a8600 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -104,15 +104,29 @@
  * (see struct iwl_tfd_frame).  These 16 pointer registers are offset by 0x04
  * bytes from one another.  Each TFD circular buffer in DRAM must be 256-byte
  * aligned (address bits 0-7 must be 0).
+ * Later devices have 20 (5000 series) or 30 (higher) queues, but the registers
+ * for them are in different places.
  *
  * Bit fields in each pointer register:
  *  27-0: TFD CB physical base address [35:8], must be 256-byte aligned
  */
-#define FH_MEM_CBBC_LOWER_BOUND          (FH_MEM_LOWER_BOUND + 0x9D0)
-#define FH_MEM_CBBC_UPPER_BOUND          (FH_MEM_LOWER_BOUND + 0xA10)
-
-/* Find TFD CB base pointer for given queue (range 0-15). */
-#define FH_MEM_CBBC_QUEUE(x)  (FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4)
+#define FH_MEM_CBBC_0_15_LOWER_BOUND            (FH_MEM_LOWER_BOUND + 0x9D0)
+#define FH_MEM_CBBC_0_15_UPPER_BOUND            (FH_MEM_LOWER_BOUND + 0xA10)
+#define FH_MEM_CBBC_16_19_LOWER_BOUND           (FH_MEM_LOWER_BOUND + 0xBF0)
+#define FH_MEM_CBBC_16_19_UPPER_BOUND           (FH_MEM_LOWER_BOUND + 0xC00)
+#define FH_MEM_CBBC_20_31_LOWER_BOUND           (FH_MEM_LOWER_BOUND + 0xB20)
+#define FH_MEM_CBBC_20_31_UPPER_BOUND           (FH_MEM_LOWER_BOUND + 0xB80)
+
+/* Find TFD CB base pointer for given queue */
+static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
+{
+        if (chnl < 16)
+                return FH_MEM_CBBC_0_15_LOWER_BOUND + 4 * chnl;
+        if (chnl < 20)
+                return FH_MEM_CBBC_16_19_LOWER_BOUND + 4 * (chnl - 16);
+        WARN_ON_ONCE(chnl >= 32);
+        return FH_MEM_CBBC_20_31_LOWER_BOUND + 4 * (chnl - 20);
+}
 
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index b6805f8e9a01..c24a7134a6f9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -1244,6 +1244,7 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         struct iwl_rxon_context *tmp, *ctx = NULL;
         int err;
         enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif);
+        bool reset = false;
 
         IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
                            viftype, vif->addr);
@@ -1265,6 +1266,13 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
                         tmp->interface_modes | tmp->exclusive_interface_modes;
 
                 if (tmp->vif) {
+                        /* On reset we need to add the same interface again */
+                        if (tmp->vif == vif) {
+                                reset = true;
+                                ctx = tmp;
+                                break;
+                        }
+
                         /* check if this busy context is exclusive */
                         if (tmp->exclusive_interface_modes &
                                                 BIT(tmp->vif->type)) {
@@ -1291,7 +1299,7 @@ static int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
         ctx->vif = vif;
 
         err = iwl_setup_interface(priv, ctx);
-        if (!err)
+        if (!err || reset)
                 goto out;
 
         ctx->vif = NULL;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 75dc20bd965b..3b1069290fa9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -223,12 +223,33 @@
 #define SCD_AIT                 (SCD_BASE + 0x0c)
 #define SCD_TXFACT              (SCD_BASE + 0x10)
 #define SCD_ACTIVE              (SCD_BASE + 0x14)
-#define SCD_QUEUE_WRPTR(x)      (SCD_BASE + 0x18 + (x) * 4)
-#define SCD_QUEUE_RDPTR(x)      (SCD_BASE + 0x68 + (x) * 4)
 #define SCD_QUEUECHAIN_SEL      (SCD_BASE + 0xe8)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
-#define SCD_QUEUE_STATUS_BITS(x)        (SCD_BASE + 0x10c + (x) * 4)
+
+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x18 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x284 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x68 + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
+}
+
+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
+{
+        if (chnl < 20)
+                return SCD_BASE + 0x10c + chnl * 4;
+        WARN_ON_ONCE(chnl >= 32);
+        return SCD_BASE + 0x384 + (chnl - 20) * 4;
+}
 
 /*********************** END TX SCHEDULER *************************************/
 
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 288b035a3579..cc15fdb36060 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -1941,6 +1941,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
                 rtl_deinit_deferred_work(hw);
                 rtlpriv->intf_ops->adapter_stop(hw);
         }
+        rtlpriv->cfg->ops->disable_interrupt(hw);
 
         /*deinit rfkill */
         rtl_deinit_rfkill(hw);
diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
index 41302c7b1ad0..d1afb8e3b2ef 100644
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         cancel_work_sync(&wl->irq_work);
         cancel_work_sync(&wl->tx_work);
         cancel_work_sync(&wl->filter_work);
+        cancel_delayed_work_sync(&wl->elp_work);
 
         mutex_lock(&wl->mutex);
 
diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
index f78694295c39..1b851f650e07 100644
--- a/drivers/net/wireless/wl1251/sdio.c
+++ b/drivers/net/wireless/wl1251/sdio.c
@@ -315,8 +315,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
 
         if (wl->irq)
                 free_irq(wl->irq, wl);
-        kfree(wl_sdio);
         wl1251_free_hw(wl);
+        kfree(wl_sdio);
 
         sdio_claim_host(func);
         sdio_release_irq(func);
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 8644d5372e7f..42cfcd9eb9aa 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -44,6 +44,7 @@
 #include <asm/ropes.h>
 #include <asm/mckinley.h>       /* for proc_mckinley_root */
 #include <asm/runway.h>         /* for proc_runway_root */
+#include <asm/page.h>           /* for PAGE0 */
 #include <asm/pdc.h>            /* for PDC_MODEL_* */
 #include <asm/pdcpat.h>         /* for is_pdc_pat() */
 #include <asm/parisc-device.h>
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 0f150f271c2a..1929c0c63b75 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -200,7 +200,7 @@ static pci_power_t acpi_pci_choose_state(struct pci_dev *pdev)
                 return PCI_D1;
         case ACPI_STATE_D2:
                 return PCI_D2;
-        case ACPI_STATE_D3:
+        case ACPI_STATE_D3_HOT:
                 return PCI_D3hot;
         case ACPI_STATE_D3_COLD:
                 return PCI_D3cold;
@@ -223,7 +223,7 @@ static int acpi_pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                 [PCI_D0] = ACPI_STATE_D0,
                 [PCI_D1] = ACPI_STATE_D1,
                 [PCI_D2] = ACPI_STATE_D2,
-                [PCI_D3hot] = ACPI_STATE_D3,
+                [PCI_D3hot] = ACPI_STATE_D3_HOT,
                 [PCI_D3cold] = ACPI_STATE_D3
         };
         int error = -EINVAL;
diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c
index 0a3594c7e912..bcbad8452a6f 100644
--- a/drivers/platform/x86/intel_mid_powerbtn.c
+++ b/drivers/platform/x86/intel_mid_powerbtn.c
@@ -78,7 +78,7 @@ static int __devinit mfld_pb_probe(struct platform_device *pdev)
 
         input_set_capability(input, EV_KEY, KEY_POWER);
 
-        error = request_threaded_irq(irq, NULL, mfld_pb_isr, 0,
+        error = request_threaded_irq(irq, NULL, mfld_pb_isr, IRQF_NO_SUSPEND,
                         DRIVER_NAME, input);
         if (error) {
                 dev_err(&pdev->dev, "Unable to request irq %d for mfld power"
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e70dd382a009..046fb1bd8619 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1431,7 +1431,10 @@ void devm_regulator_put(struct regulator *regulator)
 
         rc = devres_destroy(regulator->dev, devm_regulator_release,
                             devm_regulator_match, regulator);
-        WARN_ON(rc);
+        if (rc == 0)
+                regulator_put(regulator);
+        else
+                WARN_ON(rc);
 }
 EXPORT_SYMBOL_GPL(devm_regulator_put);
 
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index 96579296f04d..17a58c56eebf 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -684,7 +684,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
                 }
 
                 new_val++;
-        } while (desc->min + desc->step + new_val <= desc->max);
+        } while (desc->min + desc->step * new_val <= desc->max);
 
         new_idx = tmp_idx;
         new_val = tmp_val;
diff --git a/drivers/rtc/rtc-mpc5121.c b/drivers/rtc/rtc-mpc5121.c
index 42f5f829b3ee..029e421baaed 100644
--- a/drivers/rtc/rtc-mpc5121.c
+++ b/drivers/rtc/rtc-mpc5121.c
@@ -360,12 +360,11 @@ static int __devinit mpc5121_rtc_probe(struct platform_device *op)
                                                 &mpc5200_rtc_ops, THIS_MODULE);
         }
 
-        rtc->rtc->uie_unsupported = 1;
-
         if (IS_ERR(rtc->rtc)) {
                 err = PTR_ERR(rtc->rtc);
                 goto out_free_irq;
         }
+        rtc->rtc->uie_unsupported = 1;
 
         return 0;
 
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 120955c66410..8334dadc681d 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -1672,7 +1672,8 @@ static void qeth_configure_blkt_default(struct qeth_card *card, char *prcd)
 {
         QETH_DBF_TEXT(SETUP, 2, "cfgblkt");
 
-        if (prcd[74] == 0xF0 && prcd[75] == 0xF0 && prcd[76] == 0xF5) {
+        if (prcd[74] == 0xF0 && prcd[75] == 0xF0 &&
+            (prcd[76] == 0xF5 || prcd[76] == 0xF6)) {
                 card->info.blkt.time_total = 250;
                 card->info.blkt.inter_packet = 5;
                 card->info.blkt.inter_packet_jumbo = 15;
@@ -4540,7 +4541,8 @@ static void qeth_determine_capabilities(struct qeth_card *card)
                 goto out_offline;
         }
         qeth_configure_unitaddr(card, prcd);
-        qeth_configure_blkt_default(card, prcd);
+        if (ddev_offline)
+                qeth_configure_blkt_default(card, prcd);
         kfree(prcd);
 
         rc = qdio_get_ssqd_desc(ddev, &card->ssqd);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index e002cd466e9a..467dc38246f9 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4549,8 +4549,12 @@ static int ipr_ata_slave_alloc(struct scsi_device *sdev)
         ENTER;
         if (sdev->sdev_target)
                 sata_port = sdev->sdev_target->hostdata;
-        if (sata_port)
+        if (sata_port) {
                 rc = ata_sas_port_init(sata_port->ap);
+                if (rc == 0)
+                        rc = ata_sas_sync_probe(sata_port->ap);
+        }
+
         if (rc)
                 ipr_slave_destroy(sdev);
 
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index ef9560dff295..cc83b66d45b7 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1742,17 +1742,19 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
         mfs = ntohs(flp->fl_csp.sp_bb_data) &
                 FC_SP_BB_DATA_MASK;
-        if (mfs >= FC_SP_MIN_MAX_PAYLOAD &&
-            mfs <= lport->mfs) {
-                lport->mfs = mfs;
-                fc_host_maxframe_size(lport->host) = mfs;
-        } else {
+
+        if (mfs < FC_SP_MIN_MAX_PAYLOAD || mfs > FC_SP_MAX_MAX_PAYLOAD) {
                 FC_LPORT_DBG(lport, "FLOGI bad mfs:%hu response, "
                              "lport->mfs:%hu\n", mfs, lport->mfs);
                 fc_lport_error(lport, fp);
                 goto err;
         }
 
+        if (mfs <= lport->mfs) {
+                lport->mfs = mfs;
+                fc_host_maxframe_size(lport->host) = mfs;
+        }
+
         csp_flags = ntohs(flp->fl_csp.sp_features);
         r_a_tov = ntohl(flp->fl_csp.sp_r_a_tov);
         e_d_tov = ntohl(flp->fl_csp.sp_e_d_tov);
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index bc0cecc6ad62..441d88ad99a7 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -546,11 +546,12 @@ static struct ata_port_info sata_port_info = {
         .port_ops = &sas_sata_ops
 };
 
-int sas_ata_init_host_and_port(struct domain_device *found_dev)
+int sas_ata_init(struct domain_device *found_dev)
 {
         struct sas_ha_struct *ha = found_dev->port->ha;
         struct Scsi_Host *shost = ha->core.shost;
         struct ata_port *ap;
+        int rc;
 
         ata_host_init(&found_dev->sata_dev.ata_host,
                       ha->dev,
@@ -567,8 +568,11 @@ int sas_ata_init_host_and_port(struct domain_device *found_dev)
         ap->private_data = found_dev;
         ap->cbl = ATA_CBL_SATA;
         ap->scsi_host = shost;
-        /* publish initialized ata port */
-        smp_wmb();
+        rc = ata_sas_port_init(ap);
+        if (rc) {
+                ata_sas_port_destroy(ap);
+                return rc;
+        }
         found_dev->sata_dev.ap = ap;
 
         return 0;
@@ -648,18 +652,13 @@ static void sas_get_ata_command_set(struct domain_device *dev)
 void sas_probe_sata(struct asd_sas_port *port)
 {
         struct domain_device *dev, *n;
-        int err;
 
         mutex_lock(&port->ha->disco_mutex);
-        list_for_each_entry_safe(dev, n, &port->disco_list, disco_list_node) {
+        list_for_each_entry(dev, &port->disco_list, disco_list_node) {
                 if (!dev_is_sata(dev))
                         continue;
 
-                err = sas_ata_init_host_and_port(dev);
-                if (err)
-                        sas_fail_probe(dev, __func__, err);
-                else
-                        ata_sas_async_port_init(dev->sata_dev.ap);
+                ata_sas_async_probe(dev->sata_dev.ap);
         }
         mutex_unlock(&port->ha->disco_mutex);
 
@@ -718,18 +717,6 @@ static void async_sas_ata_eh(void *data, async_cookie_t cookie)
         sas_put_device(dev);
 }
 
-static bool sas_ata_dev_eh_valid(struct domain_device *dev)
-{
-        struct ata_port *ap;
-
-        if (!dev_is_sata(dev))
-                return false;
-        ap = dev->sata_dev.ap;
-        /* consume fully initialized ata ports */
-        smp_rmb();
-        return !!ap;
-}
-
 void sas_ata_strategy_handler(struct Scsi_Host *shost)
 {
         struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(shost);
@@ -753,7 +740,7 @@ void sas_ata_strategy_handler(struct Scsi_Host *shost)
 
                 spin_lock(&port->dev_list_lock);
                 list_for_each_entry(dev, &port->dev_list, dev_list_node) {
-                        if (!sas_ata_dev_eh_valid(dev))
+                        if (!dev_is_sata(dev))
                                 continue;
                         async_schedule_domain(async_sas_ata_eh, dev, &async);
                 }
diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
index 364679675602..629a0865b130 100644
--- a/drivers/scsi/libsas/sas_discover.c
+++ b/drivers/scsi/libsas/sas_discover.c
@@ -72,6 +72,7 @@ static int sas_get_port_device(struct asd_sas_port *port)
         struct asd_sas_phy *phy;
         struct sas_rphy *rphy;
         struct domain_device *dev;
+        int rc = -ENODEV;
 
         dev = sas_alloc_device();
         if (!dev)
@@ -110,9 +111,16 @@ static int sas_get_port_device(struct asd_sas_port *port)
 
         sas_init_dev(dev);
 
+        dev->port = port;
         switch (dev->dev_type) {
-        case SAS_END_DEV:
         case SATA_DEV:
+                rc = sas_ata_init(dev);
+                if (rc) {
+                        rphy = NULL;
+                        break;
+                }
+                /* fall through */
+        case SAS_END_DEV:
                 rphy = sas_end_device_alloc(port->port);
                 break;
         case EDGE_DEV:
@@ -131,19 +139,14 @@ static int sas_get_port_device(struct asd_sas_port *port)
 
         if (!rphy) {
                 sas_put_device(dev);
-                return -ENODEV;
+                return rc;
         }
 
-        spin_lock_irq(&port->phy_list_lock);
-        list_for_each_entry(phy, &port->phy_list, port_phy_el)
-                sas_phy_set_target(phy, dev);
-        spin_unlock_irq(&port->phy_list_lock);
         rphy->identify.phy_identifier = phy->phy->identify.phy_identifier;
         memcpy(dev->sas_addr, port->attached_sas_addr, SAS_ADDR_SIZE);
         sas_fill_in_rphy(dev, rphy);
         sas_hash_addr(dev->hashed_sas_addr, dev->sas_addr);
         port->port_dev = dev;
-        dev->port = port;
         dev->linkrate = port->linkrate;
         dev->min_linkrate = port->linkrate;
         dev->max_linkrate = port->linkrate;
@@ -155,6 +158,7 @@ static int sas_get_port_device(struct asd_sas_port *port)
         sas_device_set_phy(dev, port->port);
 
         dev->rphy = rphy;
+        get_device(&dev->rphy->dev);
 
         if (dev_is_sata(dev) || dev->dev_type == SAS_END_DEV)
                 list_add_tail(&dev->disco_list_node, &port->disco_list);
@@ -164,6 +168,11 @@ static int sas_get_port_device(struct asd_sas_port *port)
                 spin_unlock_irq(&port->dev_list_lock);
         }
 
+        spin_lock_irq(&port->phy_list_lock);
+        list_for_each_entry(phy, &port->phy_list, port_phy_el)
+                sas_phy_set_target(phy, dev);
+        spin_unlock_irq(&port->phy_list_lock);
+
         return 0;
 }
 
@@ -205,8 +214,7 @@ void sas_notify_lldd_dev_gone(struct domain_device *dev)
 static void sas_probe_devices(struct work_struct *work)
 {
         struct domain_device *dev, *n;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_PROBE, &port->disc.pending);
@@ -255,6 +263,9 @@ void sas_free_device(struct kref *kref)
 {
         struct domain_device *dev = container_of(kref, typeof(*dev), kref);
 
+        put_device(&dev->rphy->dev);
+        dev->rphy = NULL;
+
         if (dev->parent)
                 sas_put_device(dev->parent);
 
@@ -291,8 +302,7 @@ static void sas_unregister_common_dev(struct asd_sas_port *port, struct domain_d
 static void sas_destruct_devices(struct work_struct *work)
 {
         struct domain_device *dev, *n;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_DESTRUCT, &port->disc.pending);
@@ -302,7 +312,6 @@ static void sas_destruct_devices(struct work_struct *work)
 
                 sas_remove_children(&dev->rphy->dev);
                 sas_rphy_delete(dev->rphy);
-                dev->rphy = NULL;
                 sas_unregister_common_dev(port, dev);
         }
 }
@@ -314,11 +323,11 @@ void sas_unregister_dev(struct asd_sas_port *port, struct domain_device *dev)
                 /* this rphy never saw sas_rphy_add */
                 list_del_init(&dev->disco_list_node);
                 sas_rphy_free(dev->rphy);
-                dev->rphy = NULL;
                 sas_unregister_common_dev(port, dev);
+                return;
         }
 
-        if (dev->rphy && !test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) {
+        if (!test_and_set_bit(SAS_DEV_DESTROY, &dev->state)) {
                 sas_rphy_unlink(dev->rphy);
                 list_move_tail(&dev->disco_list_node, &port->destroy_list);
                 sas_discover_event(dev->port, DISCE_DESTRUCT);
@@ -377,8 +386,7 @@ static void sas_discover_domain(struct work_struct *work)
 {
         struct domain_device *dev;
         int error = 0;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
 
         clear_bit(DISCE_DISCOVER_DOMAIN, &port->disc.pending);
@@ -419,8 +427,6 @@ static void sas_discover_domain(struct work_struct *work)
 
         if (error) {
                 sas_rphy_free(dev->rphy);
-                dev->rphy = NULL;
-
                 list_del_init(&dev->disco_list_node);
                 spin_lock_irq(&port->dev_list_lock);
                 list_del_init(&dev->dev_list_node);
@@ -437,8 +443,7 @@ static void sas_discover_domain(struct work_struct *work)
 static void sas_revalidate_domain(struct work_struct *work)
 {
         int res = 0;
-        struct sas_discovery_event *ev =
-                container_of(work, struct sas_discovery_event, work);
+        struct sas_discovery_event *ev = to_sas_discovery_event(work);
         struct asd_sas_port *port = ev->port;
         struct sas_ha_struct *ha = port->ha;
 
@@ -466,21 +471,25 @@ static void sas_revalidate_domain(struct work_struct *work)
 
 /* ---------- Events ---------- */
 
-static void sas_chain_work(struct sas_ha_struct *ha, struct work_struct *work)
+static void sas_chain_work(struct sas_ha_struct *ha, struct sas_work *sw)
 {
-        /* chained work is not subject to SA_HA_DRAINING or SAS_HA_REGISTERED */
-        scsi_queue_work(ha->core.shost, work);
+        /* chained work is not subject to SA_HA_DRAINING or
+         * SAS_HA_REGISTERED, because it is either submitted in the
+         * workqueue, or known to be submitted from a context that is
+         * not racing against draining
+         */
+        scsi_queue_work(ha->core.shost, &sw->work);
 }
 
 static void sas_chain_event(int event, unsigned long *pending,
-                            struct work_struct *work,
+                            struct sas_work *sw,
                             struct sas_ha_struct *ha)
 {
         if (!test_and_set_bit(event, pending)) {
                 unsigned long flags;
 
                 spin_lock_irqsave(&ha->state_lock, flags);
-                sas_chain_work(ha, work);
+                sas_chain_work(ha, sw);
                 spin_unlock_irqrestore(&ha->state_lock, flags);
         }
 }
@@ -519,7 +528,7 @@ void sas_init_disc(struct sas_discovery *disc, struct asd_sas_port *port)
 
         disc->pending = 0;
         for (i = 0; i < DISC_NUM_EVENTS; i++) {
-                INIT_WORK(&disc->disc_work[i].work, sas_event_fns[i]);
+                INIT_SAS_WORK(&disc->disc_work[i].work, sas_event_fns[i]);
                 disc->disc_work[i].port = port;
         }
 }
diff --git a/drivers/scsi/libsas/sas_event.c b/drivers/scsi/libsas/sas_event.c
index 16639bbae629..4e4292d210c1 100644
--- a/drivers/scsi/libsas/sas_event.c
+++ b/drivers/scsi/libsas/sas_event.c
@@ -27,19 +27,21 @@
 #include "sas_internal.h"
 #include "sas_dump.h"
 
-void sas_queue_work(struct sas_ha_struct *ha, struct work_struct *work)
+void sas_queue_work(struct sas_ha_struct *ha, struct sas_work *sw)
 {
         if (!test_bit(SAS_HA_REGISTERED, &ha->state))
                 return;
 
-        if (test_bit(SAS_HA_DRAINING, &ha->state))
-                list_add(&work->entry, &ha->defer_q);
-        else
-                scsi_queue_work(ha->core.shost, work);
+        if (test_bit(SAS_HA_DRAINING, &ha->state)) {
+                /* add it to the defer list, if not already pending */
+                if (list_empty(&sw->drain_node))
+                        list_add(&sw->drain_node, &ha->defer_q);
+        } else
+                scsi_queue_work(ha->core.shost, &sw->work);
 }
 
 static void sas_queue_event(int event, unsigned long *pending,
-                            struct work_struct *work,
+                            struct sas_work *work,
                             struct sas_ha_struct *ha)
 {
         if (!test_and_set_bit(event, pending)) {
@@ -55,7 +57,7 @@ static void sas_queue_event(int event, unsigned long *pending,
 void __sas_drain_work(struct sas_ha_struct *ha)
 {
         struct workqueue_struct *wq = ha->core.shost->work_q;
-        struct work_struct *w, *_w;
+        struct sas_work *sw, *_sw;
 
         set_bit(SAS_HA_DRAINING, &ha->state);
         /* flush submitters */
@@ -66,9 +68,9 @@ void __sas_drain_work(struct sas_ha_struct *ha)
 
         spin_lock_irq(&ha->state_lock);
         clear_bit(SAS_HA_DRAINING, &ha->state);
-        list_for_each_entry_safe(w, _w, &ha->defer_q, entry) {
-                list_del_init(&w->entry);
-                sas_queue_work(ha, w);
+        list_for_each_entry_safe(sw, _sw, &ha->defer_q, drain_node) {
+                list_del_init(&sw->drain_node);
+                sas_queue_work(ha, sw);
         }
         spin_unlock_irq(&ha->state_lock);
 }
@@ -151,7 +153,7 @@ int sas_init_events(struct sas_ha_struct *sas_ha)
         int i;
 
         for (i = 0; i < HA_NUM_EVENTS; i++) {
-                INIT_WORK(&sas_ha->ha_events[i].work, sas_ha_event_fns[i]);
+                INIT_SAS_WORK(&sas_ha->ha_events[i].work, sas_ha_event_fns[i]);
                 sas_ha->ha_events[i].ha = sas_ha;
         }
 
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 05acd9e35fc4..caa0525d2523 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -202,6 +202,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         u8 sas_addr[SAS_ADDR_SIZE];
         struct smp_resp *resp = rsp;
         struct discover_resp *dr = &resp->disc;
+        struct sas_ha_struct *ha = dev->port->ha;
         struct expander_device *ex = &dev->ex_dev;
         struct ex_phy *phy = &ex->ex_phy[phy_id];
         struct sas_rphy *rphy = dev->rphy;
@@ -209,6 +210,8 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         char *type;
 
         if (new_phy) {
+                if (WARN_ON_ONCE(test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)))
+                        return;
                 phy->phy = sas_phy_alloc(&rphy->dev, phy_id);
 
                 /* FIXME: error_handling */
@@ -233,6 +236,8 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
 
         phy->attached_dev_type = to_dev_type(dr);
+        if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
+                goto out;
         phy->phy_id = phy_id;
         phy->linkrate = dr->linkrate;
         phy->attached_sata_host = dr->attached_sata_host;
@@ -240,7 +245,14 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         phy->attached_sata_ps   = dr->attached_sata_ps;
         phy->attached_iproto = dr->iproto << 1;
         phy->attached_tproto = dr->tproto << 1;
-        memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
+        /* help some expanders that fail to zero sas_address in the 'no
+         * device' case
+         */
+        if (phy->attached_dev_type == NO_DEVICE ||
+            phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
+                memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
+        else
+                memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
         phy->attached_phy_id = dr->attached_phy_id;
         phy->phy_change_count = dr->change_count;
         phy->routing_attr = dr->routing_attr;
@@ -266,6 +278,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
                         return;
                 }
 
+ out:
         switch (phy->attached_dev_type) {
         case SATA_PENDING:
                 type = "stp pending";
@@ -304,7 +317,15 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
         else
                 return;
 
-        SAS_DPRINTK("ex %016llx phy%02d:%c:%X attached: %016llx (%s)\n",
+        /* if the attached device type changed and ata_eh is active,
+         * make sure we run revalidation when eh completes (see:
+         * sas_enable_revalidation)
+         */
+        if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
+                set_bit(DISCE_REVALIDATE_DOMAIN, &dev->port->disc.pending);
+
+        SAS_DPRINTK("%sex %016llx phy%02d:%c:%X attached: %016llx (%s)\n",
+                    test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state) ? "ata: " : "",
                     SAS_ADDR(dev->sas_addr), phy->phy_id,
                     sas_route_char(dev, phy), phy->linkrate,
                     SAS_ADDR(phy->attached_sas_addr), type);
@@ -776,13 +797,16 @@ static struct domain_device *sas_ex_discover_end_dev(
                 if (res)
                         goto out_free;
 
+                sas_init_dev(child);
+                res = sas_ata_init(child);
+                if (res)
+                        goto out_free;
                 rphy = sas_end_device_alloc(phy->port);
-                if (unlikely(!rphy))
+                if (!rphy)
                         goto out_free;
 
-                sas_init_dev(child);
-
                 child->rphy = rphy;
+                get_device(&rphy->dev);
 
                 list_add_tail(&child->disco_list_node, &parent->port->disco_list);
 
@@ -806,6 +830,7 @@ static struct domain_device *sas_ex_discover_end_dev(
                 sas_init_dev(child);
 
                 child->rphy = rphy;
+                get_device(&rphy->dev);
                 sas_fill_in_rphy(child, rphy);
 
                 list_add_tail(&child->disco_list_node, &parent->port->disco_list);
@@ -830,8 +855,6 @@ static struct domain_device *sas_ex_discover_end_dev(
 
  out_list_del:
         sas_rphy_free(child->rphy);
-        child->rphy = NULL;
-
         list_del(&child->disco_list_node);
         spin_lock_irq(&parent->port->dev_list_lock);
         list_del(&child->dev_list_node);
@@ -911,6 +934,7 @@ static struct domain_device *sas_ex_discover_expander(
         }
         port = parent->port;
         child->rphy = rphy;
+        get_device(&rphy->dev);
         edev = rphy_to_expander_device(rphy);
         child->dev_type = phy->attached_dev_type;
         kref_get(&parent->kref);
@@ -934,6 +958,7 @@ static struct domain_device *sas_ex_discover_expander(
 
         res = sas_discover_expander(child);
         if (res) {
+                sas_rphy_delete(rphy);
                 spin_lock_irq(&parent->port->dev_list_lock);
                 list_del(&child->dev_list_node);
                 spin_unlock_irq(&parent->port->dev_list_lock);
@@ -1718,9 +1743,17 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                 int phy_change_count = 0;
 
                 res = sas_get_phy_change_count(dev, i, &phy_change_count);
-                if (res)
-                        goto out;
-                else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
+                switch (res) {
+                case SMP_RESP_PHY_VACANT:
+                case SMP_RESP_NO_PHY:
+                        continue;
+                case SMP_RESP_FUNC_ACC:
+                        break;
+                default:
+                        return res;
+                }
+
+                if (phy_change_count != ex->ex_phy[i].phy_change_count) {
                         if (update)
                                 ex->ex_phy[i].phy_change_count =
                                         phy_change_count;
@@ -1728,8 +1761,7 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
                         return 0;
                 }
         }
-out:
-        return res;
+        return 0;
 }
 
 static int sas_get_ex_change_count(struct domain_device *dev, int *ecc)
diff --git a/drivers/scsi/libsas/sas_init.c b/drivers/scsi/libsas/sas_init.c
index 120bff64be30..10cb5ae30977 100644
--- a/drivers/scsi/libsas/sas_init.c
+++ b/drivers/scsi/libsas/sas_init.c
@@ -94,8 +94,7 @@ void sas_hash_addr(u8 *hashed, const u8 *sas_addr)
 
 void sas_hae_reset(struct work_struct *work)
 {
-        struct sas_ha_event *ev =
-                container_of(work, struct sas_ha_event, work);
+        struct sas_ha_event *ev = to_sas_ha_event(work);
         struct sas_ha_struct *ha = ev->ha;
 
         clear_bit(HAE_RESET, &ha->pending);
@@ -369,14 +368,14 @@ static void sas_phy_release(struct sas_phy *phy)
 
 static void phy_reset_work(struct work_struct *work)
 {
-        struct sas_phy_data *d = container_of(work, typeof(*d), reset_work);
+        struct sas_phy_data *d = container_of(work, typeof(*d), reset_work.work);
 
         d->reset_result = transport_sas_phy_reset(d->phy, d->hard_reset);
 }
 
 static void phy_enable_work(struct work_struct *work)
 {
-        struct sas_phy_data *d = container_of(work, typeof(*d), enable_work);
+        struct sas_phy_data *d = container_of(work, typeof(*d), enable_work.work);
 
         d->enable_result = sas_phy_enable(d->phy, d->enable);
 }
@@ -389,8 +388,8 @@ static int sas_phy_setup(struct sas_phy *phy)
                 return -ENOMEM;
 
         mutex_init(&d->event_lock);
-        INIT_WORK(&d->reset_work, phy_reset_work);
-        INIT_WORK(&d->enable_work, phy_enable_work);
+        INIT_SAS_WORK(&d->reset_work, phy_reset_work);
+        INIT_SAS_WORK(&d->enable_work, phy_enable_work);
         d->phy = phy;
         phy->hostdata = d;
 
diff --git a/drivers/scsi/libsas/sas_internal.h b/drivers/scsi/libsas/sas_internal.h
index f05c63879949..507e4cf12e56 100644
--- a/drivers/scsi/libsas/sas_internal.h
+++ b/drivers/scsi/libsas/sas_internal.h
@@ -45,10 +45,10 @@ struct sas_phy_data {
         struct mutex event_lock;
         int hard_reset;
         int reset_result;
-        struct work_struct reset_work;
+        struct sas_work reset_work;
         int enable;
         int enable_result;
-        struct work_struct enable_work;
+        struct sas_work enable_work;
 };
 
 void sas_scsi_recover_host(struct Scsi_Host *shost);
@@ -80,7 +80,7 @@ void sas_porte_broadcast_rcvd(struct work_struct *work);
 void sas_porte_link_reset_err(struct work_struct *work);
 void sas_porte_timer_event(struct work_struct *work);
 void sas_porte_hard_reset(struct work_struct *work);
-void sas_queue_work(struct sas_ha_struct *ha, struct work_struct *work);
+void sas_queue_work(struct sas_ha_struct *ha, struct sas_work *sw);
 
 int sas_notify_lldd_dev_found(struct domain_device *);
 void sas_notify_lldd_dev_gone(struct domain_device *);
diff --git a/drivers/scsi/libsas/sas_phy.c b/drivers/scsi/libsas/sas_phy.c
index dcfd4a9105c5..521422e857ab 100644
--- a/drivers/scsi/libsas/sas_phy.c
+++ b/drivers/scsi/libsas/sas_phy.c
@@ -32,8 +32,7 @@
 
 static void sas_phye_loss_of_signal(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PHYE_LOSS_OF_SIGNAL, &phy->phy_events_pending);
@@ -43,8 +42,7 @@ static void sas_phye_loss_of_signal(struct work_struct *work)
 
 static void sas_phye_oob_done(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PHYE_OOB_DONE, &phy->phy_events_pending);
@@ -53,8 +51,7 @@ static void sas_phye_oob_done(struct work_struct *work)
 
 static void sas_phye_oob_error(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         struct sas_ha_struct *sas_ha = phy->ha;
         struct asd_sas_port *port = phy->port;
@@ -85,8 +82,7 @@ static void sas_phye_oob_error(struct work_struct *work)
 
 static void sas_phye_spinup_hold(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         struct sas_ha_struct *sas_ha = phy->ha;
         struct sas_internal *i =
@@ -127,14 +123,12 @@ int sas_register_phys(struct sas_ha_struct *sas_ha)
                 phy->error = 0;
                 INIT_LIST_HEAD(&phy->port_phy_el);
                 for (k = 0; k < PORT_NUM_EVENTS; k++) {
-                        INIT_WORK(&phy->port_events[k].work,
-                                  sas_port_event_fns[k]);
+                        INIT_SAS_WORK(&phy->port_events[k].work, sas_port_event_fns[k]);
                         phy->port_events[k].phy = phy;
                 }
 
                 for (k = 0; k < PHY_NUM_EVENTS; k++) {
-                        INIT_WORK(&phy->phy_events[k].work,
-                                  sas_phy_event_fns[k]);
+                        INIT_SAS_WORK(&phy->phy_events[k].work, sas_phy_event_fns[k]);
                         phy->phy_events[k].phy = phy;
                 }
 
@@ -144,8 +138,7 @@ int sas_register_phys(struct sas_ha_struct *sas_ha)
                 spin_lock_init(&phy->sas_prim_lock);
                 phy->frame_rcvd_size = 0;
 
-                phy->phy = sas_phy_alloc(&sas_ha->core.shost->shost_gendev,
-                                         i);
+                phy->phy = sas_phy_alloc(&sas_ha->core.shost->shost_gendev, i);
                 if (!phy->phy)
                         return -ENOMEM;
 
diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
index eb19c016d500..e884a8c58a0c 100644
--- a/drivers/scsi/libsas/sas_port.c
+++ b/drivers/scsi/libsas/sas_port.c
@@ -123,7 +123,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
         spin_unlock_irqrestore(&sas_ha->phy_port_lock, flags);
 
         if (!port->port) {
-                port->port = sas_port_alloc(phy->phy->dev.parent, phy->id);
+                port->port = sas_port_alloc(phy->phy->dev.parent, port->id);
                 BUG_ON(!port->port);
                 sas_port_add(port->port);
         }
@@ -208,8 +208,7 @@ void sas_deform_port(struct asd_sas_phy *phy, int gone)
 
 void sas_porte_bytes_dmaed(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_BYTES_DMAED, &phy->port_events_pending);
@@ -219,8 +218,7 @@ void sas_porte_bytes_dmaed(struct work_struct *work)
 
 void sas_porte_broadcast_rcvd(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
         unsigned long flags;
         u32 prim;
@@ -237,8 +235,7 @@ void sas_porte_broadcast_rcvd(struct work_struct *work)
 
 void sas_porte_link_reset_err(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_LINK_RESET_ERR, &phy->port_events_pending);
@@ -248,8 +245,7 @@ void sas_porte_link_reset_err(struct work_struct *work)
 
 void sas_porte_timer_event(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_TIMER_EVENT, &phy->port_events_pending);
@@ -259,8 +255,7 @@ void sas_porte_timer_event(struct work_struct *work)
 
 void sas_porte_hard_reset(struct work_struct *work)
 {
-        struct asd_sas_event *ev =
-                container_of(work, struct asd_sas_event, work);
+        struct asd_sas_event *ev = to_asd_sas_event(work);
         struct asd_sas_phy *phy = ev->phy;
 
         clear_bit(PORTE_HARD_RESET, &phy->port_events_pending);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index ead6405f3e51..5dfd7495d1a1 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1638,7 +1638,7 @@ struct request_queue *__scsi_alloc_queue(struct Scsi_Host *shost,
                                          request_fn_proc *request_fn)
 {
         struct request_queue *q;
-        struct device *dev = shost->shost_gendev.parent;
+        struct device *dev = shost->dma_dev;
 
         q = blk_init_queue(request_fn, NULL);
         if (!q)
diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
index 86dd1e302bb3..29ca20dbd335 100644
--- a/drivers/tty/vt/keyboard.c
+++ b/drivers/tty/vt/keyboard.c
@@ -1085,15 +1085,21 @@ void vt_set_led_state(int console, int leds)
  *
  *      Handle console start. This is a wrapper for the VT layer
  *      so that we can keep kbd knowledge internal
+ *
+ *      FIXME: We eventually need to hold the kbd lock here to protect
+ *      the LED updating. We can't do it yet because fn_hold calls stop_tty
+ *      and start_tty under the kbd_event_lock, while normal tty paths
+ *      don't hold the lock. We probably need to split out an LED lock
+ *      but not during an -rc release!
  */
 void vt_kbd_con_start(int console)
 {
         struct kbd_struct * kbd = kbd_table + console;
-        unsigned long flags;
-        spin_lock_irqsave(&kbd_event_lock, flags);
+/*      unsigned long flags; */
+/*      spin_lock_irqsave(&kbd_event_lock, flags); */
         clr_vc_kbd_led(kbd, VC_SCROLLOCK);
         set_leds();
-        spin_unlock_irqrestore(&kbd_event_lock, flags);
+/*      spin_unlock_irqrestore(&kbd_event_lock, flags); */
 }
 
 /**
@@ -1102,22 +1108,28 @@ void vt_kbd_con_start(int console)
  *
  *      Handle console stop. This is a wrapper for the VT layer
  *      so that we can keep kbd knowledge internal
+ *
+ *      FIXME: We eventually need to hold the kbd lock here to protect
+ *      the LED updating. We can't do it yet because fn_hold calls stop_tty
+ *      and start_tty under the kbd_event_lock, while normal tty paths
+ *      don't hold the lock. We probably need to split out an LED lock
+ *      but not during an -rc release!
  */
 void vt_kbd_con_stop(int console)
 {
         struct kbd_struct * kbd = kbd_table + console;
-        unsigned long flags;
-        spin_lock_irqsave(&kbd_event_lock, flags);
+/*      unsigned long flags; */
+/*      spin_lock_irqsave(&kbd_event_lock, flags); */
         set_vc_kbd_led(kbd, VC_SCROLLOCK);
         set_leds();
-        spin_unlock_irqrestore(&kbd_event_lock, flags);
+/*      spin_unlock_irqrestore(&kbd_event_lock, flags); */
 }
 
 /*
  * This is the tasklet that updates LED state on all keyboards
  * attached to the box. The reason we use tasklet is that we
  * need to handle the scenario when keyboard handler is not
- * registered yet but we already getting updates form VT to
+ * registered yet but we already getting updates from the VT to
  * update led state.
  */
 static void kbd_bh(unsigned long dummy)
diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
index 86183366647f..f214a80cdee2 100644
--- a/drivers/usb/host/ehci-tegra.c
+++ b/drivers/usb/host/ehci-tegra.c
@@ -24,6 +24,7 @@
 #include <linux/gpio.h>
 #include <linux/of.h>
 #include <linux/of_gpio.h>
+#include <linux/pm_runtime.h>
 
 #include <mach/usb_phy.h>
 #include <mach/iomap.h>
@@ -37,9 +38,7 @@ struct tegra_ehci_hcd {
         struct clk *emc_clk;
         struct usb_phy *transceiver;
         int host_resumed;
-        int bus_suspended;
         int port_resuming;
-        int power_down_on_bus_suspend;
         enum tegra_usb_phy_port_speed port_speed;
 };
 
@@ -273,120 +272,6 @@ static void tegra_ehci_restart(struct usb_hcd *hcd)
         up_write(&ehci_cf_port_reset_rwsem);
 }
 
-static int tegra_usb_suspend(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        struct ehci_regs __iomem *hw = tegra->ehci->regs;
-        unsigned long flags;
-
-        spin_lock_irqsave(&tegra->ehci->lock, flags);
-
-        tegra->port_speed = (readl(&hw->port_status[0]) >> 26) & 0x3;
-        ehci_halt(tegra->ehci);
-        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-
-        spin_unlock_irqrestore(&tegra->ehci->lock, flags);
-
-        tegra_ehci_power_down(hcd);
-        return 0;
-}
-
-static int tegra_usb_resume(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
-        struct ehci_regs __iomem *hw = ehci->regs;
-        unsigned long val;
-
-        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
-        tegra_ehci_power_up(hcd);
-
-        if (tegra->port_speed > TEGRA_USB_PHY_PORT_SPEED_HIGH) {
-                /* Wait for the phy to detect new devices
-                 * before we restart the controller */
-                msleep(10);
-                goto restart;
-        }
-
-        /* Force the phy to keep data lines in suspend state */
-        tegra_ehci_phy_restore_start(tegra->phy, tegra->port_speed);
-
-        /* Enable host mode */
-        tdi_reset(ehci);
-
-        /* Enable Port Power */
-        val = readl(&hw->port_status[0]);
-        val |= PORT_POWER;
-        writel(val, &hw->port_status[0]);
-        udelay(10);
-
-        /* Check if the phy resume from LP0. When the phy resume from LP0
-         * USB register will be reset. */
-        if (!readl(&hw->async_next)) {
-                /* Program the field PTC based on the saved speed mode */
-                val = readl(&hw->port_status[0]);
-                val &= ~PORT_TEST(~0);
-                if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_HIGH)
-                        val |= PORT_TEST_FORCE;
-                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_FULL)
-                        val |= PORT_TEST(6);
-                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_LOW)
-                        val |= PORT_TEST(7);
-                writel(val, &hw->port_status[0]);
-                udelay(10);
-
-                /* Disable test mode by setting PTC field to NORMAL_OP */
-                val = readl(&hw->port_status[0]);
-                val &= ~PORT_TEST(~0);
-                writel(val, &hw->port_status[0]);
-                udelay(10);
-        }
-
-        /* Poll until CCS is enabled */
-        if (handshake(ehci, &hw->port_status[0], PORT_CONNECT,
-                                                 PORT_CONNECT, 2000)) {
-                pr_err("%s: timeout waiting for PORT_CONNECT\n", __func__);
-                goto restart;
-        }
-
-        /* Poll until PE is enabled */
-        if (handshake(ehci, &hw->port_status[0], PORT_PE,
-                                                 PORT_PE, 2000)) {
-                pr_err("%s: timeout waiting for USB_PORTSC1_PE\n", __func__);
-                goto restart;
-        }
-
-        /* Clear the PCI status, to avoid an interrupt taken upon resume */
-        val = readl(&hw->status);
-        val |= STS_PCD;
-        writel(val, &hw->status);
-
-        /* Put controller in suspend mode by writing 1 to SUSP bit of PORTSC */
-        val = readl(&hw->port_status[0]);
-        if ((val & PORT_POWER) && (val & PORT_PE)) {
-                val |= PORT_SUSPEND;
-                writel(val, &hw->port_status[0]);
-
-                /* Wait until port suspend completes */
-                if (handshake(ehci, &hw->port_status[0], PORT_SUSPEND,
-                                                         PORT_SUSPEND, 1000)) {
-                        pr_err("%s: timeout waiting for PORT_SUSPEND\n",
-                                                                __func__);
-                        goto restart;
-                }
-        }
-
-        tegra_ehci_phy_restore_end(tegra->phy);
-        return 0;
-
-restart:
-        if (tegra->port_speed <= TEGRA_USB_PHY_PORT_SPEED_HIGH)
-                tegra_ehci_phy_restore_end(tegra->phy);
-
-        tegra_ehci_restart(hcd);
-        return 0;
-}
-
 static void tegra_ehci_shutdown(struct usb_hcd *hcd)
 {
         struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
@@ -434,36 +319,6 @@ static int tegra_ehci_setup(struct usb_hcd *hcd)
         return retval;
 }
 
-#ifdef CONFIG_PM
-static int tegra_ehci_bus_suspend(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-        int error_status = 0;
-
-        error_status = ehci_bus_suspend(hcd);
-        if (!error_status && tegra->power_down_on_bus_suspend) {
-                tegra_usb_suspend(hcd);
-                tegra->bus_suspended = 1;
-        }
-
-        return error_status;
-}
-
-static int tegra_ehci_bus_resume(struct usb_hcd *hcd)
-{
-        struct tegra_ehci_hcd *tegra = dev_get_drvdata(hcd->self.controller);
-
-        if (tegra->bus_suspended && tegra->power_down_on_bus_suspend) {
-                tegra_usb_resume(hcd);
-                tegra->bus_suspended = 0;
-        }
-
-        tegra_usb_phy_preresume(tegra->phy);
-        tegra->port_resuming = 1;
-        return ehci_bus_resume(hcd);
-}
-#endif
-
 struct temp_buffer {
         void *kmalloc_ptr;
         void *old_xfer_buffer;
@@ -574,8 +429,8 @@ static const struct hc_driver tegra_ehci_hc_driver = {
         .hub_control            = tegra_ehci_hub_control,
         .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
 #ifdef CONFIG_PM
-        .bus_suspend            = tegra_ehci_bus_suspend,
-        .bus_resume             = tegra_ehci_bus_resume,
+        .bus_suspend            = ehci_bus_suspend,
+        .bus_resume             = ehci_bus_resume,
 #endif
         .relinquish_port        = ehci_relinquish_port,
         .port_handed_over       = ehci_port_handed_over,
@@ -603,11 +458,187 @@ static int setup_vbus_gpio(struct platform_device *pdev)
                 dev_err(&pdev->dev, "can't enable vbus\n");
                 return err;
         }
-        gpio_set_value(gpio, 1);
 
         return err;
 }
 
+#ifdef CONFIG_PM
+
+static int controller_suspend(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct ehci_hcd *ehci = tegra->ehci;
+        struct usb_hcd *hcd = ehci_to_hcd(ehci);
+        struct ehci_regs __iomem *hw = ehci->regs;
+        unsigned long flags;
+
+        if (time_before(jiffies, ehci->next_statechange))
+                msleep(10);
+
+        spin_lock_irqsave(&ehci->lock, flags);
+
+        tegra->port_speed = (readl(&hw->port_status[0]) >> 26) & 0x3;
+        ehci_halt(ehci);
+        clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+
+        spin_unlock_irqrestore(&ehci->lock, flags);
+
+        tegra_ehci_power_down(hcd);
+        return 0;
+}
+
+static int controller_resume(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct ehci_hcd *ehci = tegra->ehci;
+        struct usb_hcd *hcd = ehci_to_hcd(ehci);
+        struct ehci_regs __iomem *hw = ehci->regs;
+        unsigned long val;
+
+        set_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
+        tegra_ehci_power_up(hcd);
+
+        if (tegra->port_speed > TEGRA_USB_PHY_PORT_SPEED_HIGH) {
+                /* Wait for the phy to detect new devices
+                 * before we restart the controller */
+                msleep(10);
+                goto restart;
+        }
+
+        /* Force the phy to keep data lines in suspend state */
+        tegra_ehci_phy_restore_start(tegra->phy, tegra->port_speed);
+
+        /* Enable host mode */
+        tdi_reset(ehci);
+
+        /* Enable Port Power */
+        val = readl(&hw->port_status[0]);
+        val |= PORT_POWER;
+        writel(val, &hw->port_status[0]);
+        udelay(10);
+
+        /* Check if the phy resume from LP0. When the phy resume from LP0
+         * USB register will be reset. */
+        if (!readl(&hw->async_next)) {
+                /* Program the field PTC based on the saved speed mode */
+                val = readl(&hw->port_status[0]);
+                val &= ~PORT_TEST(~0);
+                if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_HIGH)
+                        val |= PORT_TEST_FORCE;
+                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_FULL)
+                        val |= PORT_TEST(6);
+                else if (tegra->port_speed == TEGRA_USB_PHY_PORT_SPEED_LOW)
+                        val |= PORT_TEST(7);
+                writel(val, &hw->port_status[0]);
+                udelay(10);
+
+                /* Disable test mode by setting PTC field to NORMAL_OP */
+                val = readl(&hw->port_status[0]);
+                val &= ~PORT_TEST(~0);
+                writel(val, &hw->port_status[0]);
+                udelay(10);
+        }
+
+        /* Poll until CCS is enabled */
+        if (handshake(ehci, &hw->port_status[0], PORT_CONNECT,
+                                                 PORT_CONNECT, 2000)) {
+                pr_err("%s: timeout waiting for PORT_CONNECT\n", __func__);
+                goto restart;
+        }
+
+        /* Poll until PE is enabled */
+        if (handshake(ehci, &hw->port_status[0], PORT_PE,
+                                                 PORT_PE, 2000)) {
+                pr_err("%s: timeout waiting for USB_PORTSC1_PE\n", __func__);
+                goto restart;
+        }
+
+        /* Clear the PCI status, to avoid an interrupt taken upon resume */
+        val = readl(&hw->status);
+        val |= STS_PCD;
+        writel(val, &hw->status);
+
+        /* Put controller in suspend mode by writing 1 to SUSP bit of PORTSC */
+        val = readl(&hw->port_status[0]);
+        if ((val & PORT_POWER) && (val & PORT_PE)) {
+                val |= PORT_SUSPEND;
+                writel(val, &hw->port_status[0]);
+
+                /* Wait until port suspend completes */
+                if (handshake(ehci, &hw->port_status[0], PORT_SUSPEND,
+                                                         PORT_SUSPEND, 1000)) {
+                        pr_err("%s: timeout waiting for PORT_SUSPEND\n",
+                                                                __func__);
+                        goto restart;
+                }
+        }
+
+        tegra_ehci_phy_restore_end(tegra->phy);
+        goto done;
+
+ restart:
+        if (tegra->port_speed <= TEGRA_USB_PHY_PORT_SPEED_HIGH)
+                tegra_ehci_phy_restore_end(tegra->phy);
+
+        tegra_ehci_restart(hcd);
+
+ done:
+        tegra_usb_phy_preresume(tegra->phy);
+        tegra->port_resuming = 1;
+        return 0;
+}
+
+static int tegra_ehci_suspend(struct device *dev)
+{
+        struct tegra_ehci_hcd *tegra =
+                        platform_get_drvdata(to_platform_device(dev));
+        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
+        int rc = 0;
+
+        /*
+         * When system sleep is supported and USB controller wakeup is
+         * implemented: If the controller is runtime-suspended and the
+         * wakeup setting needs to be changed, call pm_runtime_resume().
+         */
+        if (HCD_HW_ACCESSIBLE(hcd))
+                rc = controller_suspend(dev);
+        return rc;
+}
+
+static int tegra_ehci_resume(struct device *dev)
+{
+        int rc;
+
+        rc = controller_resume(dev);
+        if (rc == 0) {
+                pm_runtime_disable(dev);
+                pm_runtime_set_active(dev);
+                pm_runtime_enable(dev);
+        }
+        return rc;
+}
+
+static int tegra_ehci_runtime_suspend(struct device *dev)
+{
+        return controller_suspend(dev);
+}
+
+static int tegra_ehci_runtime_resume(struct device *dev)
+{
+        return controller_resume(dev);
+}
+
+static const struct dev_pm_ops tegra_ehci_pm_ops = {
+        .suspend        = tegra_ehci_suspend,
+        .resume         = tegra_ehci_resume,
+        .runtime_suspend = tegra_ehci_runtime_suspend,
+        .runtime_resume = tegra_ehci_runtime_resume,
+};
+
+#endif
+
 static u64 tegra_ehci_dma_mask = DMA_BIT_MASK(32);
 
 static int tegra_ehci_probe(struct platform_device *pdev)
@@ -722,7 +753,6 @@ static int tegra_ehci_probe(struct platform_device *pdev)
         }
 
         tegra->host_resumed = 1;
-        tegra->power_down_on_bus_suspend = pdata->power_down_on_bus_suspend;
         tegra->ehci = hcd_to_ehci(hcd);
 
         irq = platform_get_irq(pdev, 0);
@@ -746,6 +776,14 @@ static int tegra_ehci_probe(struct platform_device *pdev)
                 goto fail;
         }
 
+        pm_runtime_set_active(&pdev->dev);
+        pm_runtime_get_noresume(&pdev->dev);
+
+        /* Don't skip the pm_runtime_forbid call if wakeup isn't working */
+        /* if (!pdata->power_down_on_bus_suspend) */
+                pm_runtime_forbid(&pdev->dev);
+        pm_runtime_enable(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
         return err;
 
 fail:
@@ -772,33 +810,6 @@ fail_hcd:
         return err;
 }
 
-#ifdef CONFIG_PM
-static int tegra_ehci_resume(struct platform_device *pdev)
-{
-        struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
-
-        if (tegra->bus_suspended)
-                return 0;
-
-        return tegra_usb_resume(hcd);
-}
-
-static int tegra_ehci_suspend(struct platform_device *pdev, pm_message_t state)
-{
-        struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = ehci_to_hcd(tegra->ehci);
-
-        if (tegra->bus_suspended)
-                return 0;
-
-        if (time_before(jiffies, tegra->ehci->next_statechange))
-                msleep(10);
-
-        return tegra_usb_suspend(hcd);
-}
-#endif
-
 static int tegra_ehci_remove(struct platform_device *pdev)
 {
         struct tegra_ehci_hcd *tegra = platform_get_drvdata(pdev);
@@ -807,6 +818,10 @@ static int tegra_ehci_remove(struct platform_device *pdev)
         if (tegra == NULL || hcd == NULL)
                 return -EINVAL;
 
+        pm_runtime_get_sync(&pdev->dev);
+        pm_runtime_disable(&pdev->dev);
+        pm_runtime_put_noidle(&pdev->dev);
+
 #ifdef CONFIG_USB_OTG_UTILS
         if (tegra->transceiver) {
                 otg_set_host(tegra->transceiver->otg, NULL);
@@ -847,13 +862,12 @@ static struct of_device_id tegra_ehci_of_match[] __devinitdata = {
 static struct platform_driver tegra_ehci_driver = {
         .probe          = tegra_ehci_probe,
         .remove         = tegra_ehci_remove,
-#ifdef CONFIG_PM
-        .suspend        = tegra_ehci_suspend,
-        .resume         = tegra_ehci_resume,
-#endif
         .shutdown       = tegra_ehci_hcd_shutdown,
         .driver         = {
                 .name   = "tegra-ehci",
                 .of_match_table = tegra_ehci_of_match,
+#ifdef CONFIG_PM
+                .pm     = &tegra_ehci_pm_ops,
+#endif
         }
 };
diff --git a/drivers/video/console/sticore.c b/drivers/video/console/sticore.c
index 6468a297e341..39571f9e0162 100644
--- a/drivers/video/console/sticore.c
+++ b/drivers/video/console/sticore.c
@@ -22,7 +22,9 @@
 #include <linux/font.h>
 
 #include <asm/hardware.h>
+#include <asm/page.h>
 #include <asm/parisc-device.h>
+#include <asm/pdc.h>
 #include <asm/cacheflush.h>
 #include <asm/grfioctl.h>
 
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index cb4529c40d74..b7f5173ff9e9 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -365,7 +365,7 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
         struct fb_info *fb_info;
         int fb_size;
         int val;
-        int ret;
+        int ret = 0;
 
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (info == NULL) {
@@ -458,26 +458,31 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
         xenfb_init_shared_page(info, fb_info);
 
         ret = xenfb_connect_backend(dev, info);
-        if (ret < 0)
-                goto error;
+        if (ret < 0) {
+                xenbus_dev_fatal(dev, ret, "xenfb_connect_backend");
+                goto error_fb;
+        }
 
         ret = register_framebuffer(fb_info);
         if (ret) {
-                fb_deferred_io_cleanup(fb_info);
-                fb_dealloc_cmap(&fb_info->cmap);
-                framebuffer_release(fb_info);
                 xenbus_dev_fatal(dev, ret, "register_framebuffer");
-                goto error;
+                goto error_fb;
         }
         info->fb_info = fb_info;
 
         xenfb_make_preferred_console();
         return 0;
 
- error_nomem:
-        ret = -ENOMEM;
-        xenbus_dev_fatal(dev, ret, "allocating device memory");
- error:
+error_fb:
+        fb_deferred_io_cleanup(fb_info);
+        fb_dealloc_cmap(&fb_info->cmap);
+        framebuffer_release(fb_info);
+error_nomem:
+        if (!ret) {
+                ret = -ENOMEM;
+                xenbus_dev_fatal(dev, ret, "allocating device memory");
+        }
+error:
         xenfb_remove(dev);
         return ret;
 }
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
index 94243136f6bf..ea20c51d24c7 100644
--- a/drivers/xen/Kconfig
+++ b/drivers/xen/Kconfig
@@ -183,15 +183,17 @@ config XEN_ACPI_PROCESSOR
         depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
         default m
         help
-          This ACPI processor uploads Power Management information to the Xen hypervisor.
-
-          To do that the driver parses the Power Management data and uploads said
-          information to the Xen hypervisor. Then the Xen hypervisor can select the
-          proper Cx and Pxx states. It also registers itslef as the SMM so that
-          other drivers (such as ACPI cpufreq scaling driver) will not load.
-
-          To compile this driver as a module, choose M here: the
-          module will be called xen_acpi_processor  If you do not know what to choose,
-          select M here. If the CPUFREQ drivers are built in, select Y here.
+          This ACPI processor uploads Power Management information to the Xen
+          hypervisor.
+
+          To do that the driver parses the Power Management data and uploads
+          said information to the Xen hypervisor. Then the Xen hypervisor can
+          select the proper Cx and Pxx states. It also registers itslef as the
+          SMM so that other drivers (such as ACPI cpufreq scaling driver) will
+          not load.
+
+          To compile this driver as a module, choose M here: the module will be
+          called xen_acpi_processor  If you do not know what to choose, select
+          M here. If the CPUFREQ drivers are built in, select Y here.
 
 endmenu
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index e801f226d7e0..4106264fbc65 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -220,10 +220,12 @@ struct extent_buffer *btrfs_read_lock_root_node(struct btrfs_root *root)
  */
 static void add_root_to_dirty_list(struct btrfs_root *root)
 {
+        spin_lock(&root->fs_info->trans_lock);
         if (root->track_dirty && list_empty(&root->dirty_list)) {
                 list_add(&root->dirty_list,
                          &root->fs_info->dirty_cowonly_roots);
         }
+        spin_unlock(&root->fs_info->trans_lock);
 }
 
 /*
@@ -723,7 +725,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
 
                 cur = btrfs_find_tree_block(root, blocknr, blocksize);
                 if (cur)
-                        uptodate = btrfs_buffer_uptodate(cur, gen);
+                        uptodate = btrfs_buffer_uptodate(cur, gen, 0);
                 else
                         uptodate = 0;
                 if (!cur || !uptodate) {
@@ -1358,7 +1360,12 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                 block1 = btrfs_node_blockptr(parent, slot - 1);
                 gen = btrfs_node_ptr_generation(parent, slot - 1);
                 eb = btrfs_find_tree_block(root, block1, blocksize);
-                if (eb && btrfs_buffer_uptodate(eb, gen))
+                /*
+                 * if we get -eagain from btrfs_buffer_uptodate, we
+                 * don't want to return eagain here.  That will loop
+                 * forever
+                 */
+                if (eb && btrfs_buffer_uptodate(eb, gen, 1) != 0)
                         block1 = 0;
                 free_extent_buffer(eb);
         }
@@ -1366,7 +1373,7 @@ static noinline int reada_for_balance(struct btrfs_root *root,
                 block2 = btrfs_node_blockptr(parent, slot + 1);
                 gen = btrfs_node_ptr_generation(parent, slot + 1);
                 eb = btrfs_find_tree_block(root, block2, blocksize);
-                if (eb && btrfs_buffer_uptodate(eb, gen))
+                if (eb && btrfs_buffer_uptodate(eb, gen, 1) != 0)
                         block2 = 0;
                 free_extent_buffer(eb);
         }
@@ -1504,8 +1511,9 @@ read_block_for_search(struct btrfs_trans_handle *trans,
 
         tmp = btrfs_find_tree_block(root, blocknr, blocksize);
         if (tmp) {
-                if (btrfs_buffer_uptodate(tmp, 0)) {
-                        if (btrfs_buffer_uptodate(tmp, gen)) {
+                /* first we do an atomic uptodate check */
+                if (btrfs_buffer_uptodate(tmp, 0, 1) > 0) {
+                        if (btrfs_buffer_uptodate(tmp, gen, 1) > 0) {
                                 /*
                                  * we found an up to date block without
                                  * sleeping, return
@@ -1523,8 +1531,9 @@ read_block_for_search(struct btrfs_trans_handle *trans,
                         free_extent_buffer(tmp);
                         btrfs_set_path_blocking(p);
 
+                        /* now we're allowed to do a blocking uptodate check */
                         tmp = read_tree_block(root, blocknr, blocksize, gen);
-                        if (tmp && btrfs_buffer_uptodate(tmp, gen)) {
+                        if (tmp && btrfs_buffer_uptodate(tmp, gen, 0) > 0) {
                                 *eb_ret = tmp;
                                 return 0;
                         }
@@ -1559,7 +1568,7 @@ read_block_for_search(struct btrfs_trans_handle *trans,
                  * and give up so that our caller doesn't loop forever
                  * on our EAGAINs.
                  */
-                if (!btrfs_buffer_uptodate(tmp, 0))
+                if (!btrfs_buffer_uptodate(tmp, 0, 0))
                         ret = -EIO;
                 free_extent_buffer(tmp);
         }
@@ -4043,7 +4052,7 @@ again:
                         tmp = btrfs_find_tree_block(root, blockptr,
                                             btrfs_level_size(root, level - 1));
 
-                        if (tmp && btrfs_buffer_uptodate(tmp, gen)) {
+                        if (tmp && btrfs_buffer_uptodate(tmp, gen, 1) > 0) {
                                 free_extent_buffer(tmp);
                                 break;
                         }
@@ -4166,7 +4175,8 @@ next:
                                 struct extent_buffer *cur;
                                 cur = btrfs_find_tree_block(root, blockptr,
                                             btrfs_level_size(root, level - 1));
-                                if (!cur || !btrfs_buffer_uptodate(cur, gen)) {
+                                if (!cur ||
+                                    btrfs_buffer_uptodate(cur, gen, 1) <= 0) {
                                         slot++;
                                         if (cur)
                                                 free_extent_buffer(cur);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index d0c969beaad4..a7ffc88a7dbe 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -323,7 +323,8 @@ static int csum_tree_block(struct btrfs_root *root, struct extent_buffer *buf,
  * in the wrong place.
  */
 static int verify_parent_transid(struct extent_io_tree *io_tree,
-                                 struct extent_buffer *eb, u64 parent_transid)
+                                 struct extent_buffer *eb, u64 parent_transid,
+                                 int atomic)
 {
         struct extent_state *cached_state = NULL;
         int ret;
@@ -331,6 +332,9 @@ static int verify_parent_transid(struct extent_io_tree *io_tree,
         if (!parent_transid || btrfs_header_generation(eb) == parent_transid)
                 return 0;
 
+        if (atomic)
+                return -EAGAIN;
+
         lock_extent_bits(io_tree, eb->start, eb->start + eb->len - 1,
                          0, &cached_state);
         if (extent_buffer_uptodate(eb) &&
@@ -372,7 +376,8 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
                 ret = read_extent_buffer_pages(io_tree, eb, start,
                                                WAIT_COMPLETE,
                                                btree_get_extent, mirror_num);
-                if (!ret && !verify_parent_transid(io_tree, eb, parent_transid))
+                if (!ret && !verify_parent_transid(io_tree, eb,
+                                                   parent_transid, 0))
                         break;
 
                 /*
@@ -1202,7 +1207,7 @@ static int __must_check find_and_setup_root(struct btrfs_root *tree_root,
         root->commit_root = NULL;
         root->node = read_tree_block(root, btrfs_root_bytenr(&root->root_item),
                                      blocksize, generation);
-        if (!root->node || !btrfs_buffer_uptodate(root->node, generation)) {
+        if (!root->node || !btrfs_buffer_uptodate(root->node, generation, 0)) {
                 free_extent_buffer(root->node);
                 root->node = NULL;
                 return -EIO;
@@ -3143,7 +3148,8 @@ int close_ctree(struct btrfs_root *root)
         return 0;
 }
 
-int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid)
+int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid,
+                          int atomic)
 {
         int ret;
         struct inode *btree_inode = buf->pages[0]->mapping->host;
@@ -3153,7 +3159,9 @@ int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid)
                 return ret;
 
         ret = verify_parent_transid(&BTRFS_I(btree_inode)->io_tree, buf,
-                                    parent_transid);
+                                    parent_transid, atomic);
+        if (ret == -EAGAIN)
+                return ret;
         return !ret;
 }
 
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index a7ace1a2dd12..ab1830aaf0ed 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -66,7 +66,8 @@ void btrfs_btree_balance_dirty(struct btrfs_root *root, unsigned long nr);
 void __btrfs_btree_balance_dirty(struct btrfs_root *root, unsigned long nr);
 void btrfs_free_fs_root(struct btrfs_fs_info *fs_info, struct btrfs_root *root);
 void btrfs_mark_buffer_dirty(struct extent_buffer *buf);
-int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid);
+int btrfs_buffer_uptodate(struct extent_buffer *buf, u64 parent_transid,
+                          int atomic);
 int btrfs_set_buffer_uptodate(struct extent_buffer *buf);
 int btrfs_read_buffer(struct extent_buffer *buf, u64 parent_transid);
 u32 btrfs_csum_data(struct btrfs_root *root, char *data, u32 seed, size_t len);
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 6fc2e6f5aab8..49fd7b66d57b 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -6568,7 +6568,7 @@ static noinline int do_walk_down(struct btrfs_trans_handle *trans,
                         goto skip;
         }
 
-        if (!btrfs_buffer_uptodate(next, generation)) {
+        if (!btrfs_buffer_uptodate(next, generation, 0)) {
                 btrfs_tree_unlock(next);
                 free_extent_buffer(next);
                 next = NULL;
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 198c2ba2fa40..c9018a05036e 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4120,6 +4120,7 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                         if (atomic_inc_not_zero(&exists->refs)) {
                                 spin_unlock(&mapping->private_lock);
                                 unlock_page(p);
+                                page_cache_release(p);
                                 mark_extent_buffer_accessed(exists);
                                 goto free_eb;
                         }
@@ -4199,8 +4200,7 @@ free_eb:
                         unlock_page(eb->pages[i]);
         }
 
-        if (!atomic_dec_and_test(&eb->refs))
-                return exists;
+        WARN_ON(!atomic_dec_and_test(&eb->refs));
         btrfs_release_extent_buffer(eb);
         return exists;
 }
diff --git a/fs/btrfs/ioctl.h b/fs/btrfs/ioctl.h
index 4f69028a68c4..086e6bdae1c4 100644
--- a/fs/btrfs/ioctl.h
+++ b/fs/btrfs/ioctl.h
@@ -252,7 +252,7 @@ struct btrfs_data_container {
 
 struct btrfs_ioctl_ino_path_args {
         __u64                           inum;           /* in */
-        __u32                           size;           /* in */
+        __u64                           size;           /* in */
         __u64                           reserved[4];
         /* struct btrfs_data_container  *fspath;           out */
         __u64                           fspath;         /* out */
@@ -260,7 +260,7 @@ struct btrfs_ioctl_ino_path_args {
 
 struct btrfs_ioctl_logical_ino_args {
         __u64                           logical;        /* in */
-        __u32                           size;           /* in */
+        __u64                           size;           /* in */
         __u64                           reserved[4];
         /* struct btrfs_data_container  *inodes;        out   */
         __u64                           inodes;
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 4f76fc3f8e89..2f3d6f917fb3 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -998,6 +998,7 @@ static int scrub_setup_recheck_block(struct scrub_dev *sdev,
                         page = sblock->pagev + page_index;
                         page->logical = logical;
                         page->physical = bbio->stripes[mirror_index].physical;
+                        /* for missing devices, bdev is NULL */
                         page->bdev = bbio->stripes[mirror_index].dev->bdev;
                         page->mirror_num = mirror_index + 1;
                         page->page = alloc_page(GFP_NOFS);
@@ -1042,6 +1043,12 @@ static int scrub_recheck_block(struct btrfs_fs_info *fs_info,
                 struct scrub_page *page = sblock->pagev + page_num;
                 DECLARE_COMPLETION_ONSTACK(complete);
 
+                if (page->bdev == NULL) {
+                        page->io_error = 1;
+                        sblock->no_io_error_seen = 0;
+                        continue;
+                }
+
                 BUG_ON(!page->page);
                 bio = bio_alloc(GFP_NOFS, 1);
                 if (!bio)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index d017283ae6f5..eb1ae908582c 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -279,7 +279,7 @@ static int process_one_buffer(struct btrfs_root *log,
                                                 log->fs_info->extent_root,
                                                 eb->start, eb->len);
 
-        if (btrfs_buffer_uptodate(eb, gen)) {
+        if (btrfs_buffer_uptodate(eb, gen, 0)) {
                 if (wc->write)
                         btrfs_write_tree_block(eb);
                 if (wc->wait)
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 811245b1ff2e..541ef81f6ae8 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -442,7 +442,7 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
         seq_printf(s, ",rsize=%u", cifs_sb->rsize);
         seq_printf(s, ",wsize=%u", cifs_sb->wsize);
         /* convert actimeo and display it in seconds */
-                seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
+        seq_printf(s, ",actimeo=%lu", cifs_sb->actimeo / HZ);
 
         return 0;
 }
@@ -699,7 +699,7 @@ static loff_t cifs_llseek(struct file *file, loff_t offset, int origin)
          * origin == SEEK_END || SEEK_DATA || SEEK_HOLE => we must revalidate
          * the cached file length
          */
-        if (origin != SEEK_SET || origin != SEEK_CUR) {
+        if (origin != SEEK_SET && origin != SEEK_CUR) {
                 int rc;
                 struct inode *inode = file->f_path.dentry->d_inode;
 
diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index d1389bb33ceb..65365358c976 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -125,5 +125,5 @@ extern long cifs_ioctl(struct file *filep, unsigned int cmd, unsigned long arg);
 extern const struct export_operations cifs_export_ops;
 #endif /* CONFIG_CIFS_NFSD_EXPORT */
 
-#define CIFS_VERSION   "1.77"
+#define CIFS_VERSION   "1.78"
 #endif                          /* _CIFSFS_H */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index f52c5ab78f9d..da2f5446fa7a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4844,8 +4844,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
                 max_len = data_end - temp;
                 node->node_name = cifs_strndup_from_utf16(temp, max_len,
                                                 is_unicode, nls_codepage);
-                if (!node->node_name)
+                if (!node->node_name) {
                         rc = -ENOMEM;
+                        goto parse_DFS_referrals_exit;
+                }
+
+                ref++;
         }
 
 parse_DFS_referrals_exit:
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index f4d381e331ce..5dcc55197fb3 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -215,6 +215,8 @@ static const match_table_t cifs_mount_option_tokens = {
 
         { Opt_ignore, "cred" },
         { Opt_ignore, "credentials" },
+        { Opt_ignore, "cred=%s" },
+        { Opt_ignore, "credentials=%s" },
         { Opt_ignore, "guest" },
         { Opt_ignore, "rw" },
         { Opt_ignore, "ro" },
@@ -2183,6 +2185,7 @@ cifs_get_tcp_session(struct smb_vol *volume_info)
         tcp_ses->session_estab = false;
         tcp_ses->sequence_number = 0;
         tcp_ses->lstrp = jiffies;
+        spin_lock_init(&tcp_ses->req_lock);
         INIT_LIST_HEAD(&tcp_ses->tcp_ses_list);
         INIT_LIST_HEAD(&tcp_ses->smb_ses_list);
         INIT_DELAYED_WORK(&tcp_ses->echo, cifs_echo_request);
@@ -3614,22 +3617,6 @@ cifs_get_volume_info(char *mount_data, const char *devname)
         return volume_info;
 }
 
-/* make sure ra_pages is a multiple of rsize */
-static inline unsigned int
-cifs_ra_pages(struct cifs_sb_info *cifs_sb)
-{
-        unsigned int reads;
-        unsigned int rsize_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
-
-        if (rsize_pages >= default_backing_dev_info.ra_pages)
-                return default_backing_dev_info.ra_pages;
-        else if (rsize_pages == 0)
-                return rsize_pages;
-
-        reads = default_backing_dev_info.ra_pages / rsize_pages;
-        return reads * rsize_pages;
-}
-
 int
 cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info)
 {
@@ -3717,7 +3704,7 @@ try_mount_again:
         cifs_sb->rsize = cifs_negotiate_rsize(tcon, volume_info);
 
         /* tune readahead according to rsize */
-        cifs_sb->bdi.ra_pages = cifs_ra_pages(cifs_sb);
+        cifs_sb->bdi.ra_pages = cifs_sb->rsize / PAGE_CACHE_SIZE;
 
 remote_path_check:
 #ifdef CONFIG_CIFS_DFS_UPCALL
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index d172c8ed9017..ec4e9a2a12f8 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -668,12 +668,19 @@ cifs_d_revalidate(struct dentry *direntry, struct nameidata *nd)
                         return 0;
                 else {
                         /*
-                         * Forcibly invalidate automounting directory inodes
-                         * (remote DFS directories) so to have them
-                         * instantiated again for automount
+                         * If the inode wasn't known to be a dfs entry when
+                         * the dentry was instantiated, such as when created
+                         * via ->readdir(), it needs to be set now since the
+                         * attributes will have been updated by
+                         * cifs_revalidate_dentry().
                          */
-                        if (IS_AUTOMOUNT(direntry->d_inode))
-                                return 0;
+                        if (IS_AUTOMOUNT(direntry->d_inode) &&
+                           !(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) {
+                                spin_lock(&direntry->d_lock);
+                                direntry->d_flags |= DCACHE_NEED_AUTOMOUNT;
+                                spin_unlock(&direntry->d_lock);
+                        }
+
                         return 1;
                 }
         }
diff --git a/fs/dcache.c b/fs/dcache.c
index b60ddc41d783..b80531c91779 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -141,18 +141,29 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
  * Compare 2 name strings, return 0 if they match, otherwise non-zero.
  * The strings are both count bytes long, and count is non-zero.
  */
+#ifdef CONFIG_DCACHE_WORD_ACCESS
+
+#include <asm/word-at-a-time.h>
+/*
+ * NOTE! 'cs' and 'scount' come from a dentry, so it has a
+ * aligned allocation for this particular component. We don't
+ * strictly need the load_unaligned_zeropad() safety, but it
+ * doesn't hurt either.
+ *
+ * In contrast, 'ct' and 'tcount' can be from a pathname, and do
+ * need the careful unaligned handling.
+ */
 static inline int dentry_cmp(const unsigned char *cs, size_t scount,
                                 const unsigned char *ct, size_t tcount)
 {
-#ifdef CONFIG_DCACHE_WORD_ACCESS
         unsigned long a,b,mask;
 
         if (unlikely(scount != tcount))
                 return 1;
 
         for (;;) {
-                a = *(unsigned long *)cs;
-                b = *(unsigned long *)ct;
+                a = load_unaligned_zeropad(cs);
+                b = load_unaligned_zeropad(ct);
                 if (tcount < sizeof(unsigned long))
                         break;
                 if (unlikely(a != b))
@@ -165,7 +176,13 @@ static inline int dentry_cmp(const unsigned char *cs, size_t scount,
         }
         mask = ~(~0ul << tcount*8);
         return unlikely(!!((a ^ b) & mask));
+}
+
 #else
+
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
         if (scount != tcount)
                 return 1;
 
@@ -177,9 +194,10 @@ static inline int dentry_cmp(const unsigned char *cs, size_t scount,
                 tcount--;
         } while (tcount);
         return 0;
-#endif
 }
 
+#endif
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
index 4dfbfec357e8..ec2a9c23f0c9 100644
--- a/fs/hfsplus/catalog.c
+++ b/fs/hfsplus/catalog.c
@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid,
         err = hfs_brec_find(&src_fd);
         if (err)
                 goto out;
+        if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
+                err = -EIO;
+                goto out;
+        }
 
         hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
                                 src_fd.entrylength);
diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
index 88e155f895c6..26b53fb09f68 100644
--- a/fs/hfsplus/dir.c
+++ b/fs/hfsplus/dir.c
@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                 filp->f_pos++;
                 /* fall through */
         case 1:
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
                         err = -EIO;
                         goto out;
                 }
+
+                if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
+                        err = -EIO;
+                        goto out;
+                }
+
                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
                         fd.entrylength);
                 type = be16_to_cpu(entry.type);
diff --git a/fs/namei.c b/fs/namei.c
index 0062dd17eb55..c42791914f82 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1429,7 +1429,7 @@ unsigned int full_name_hash(const unsigned char *name, unsigned int len)
         unsigned long hash = 0;
 
         for (;;) {
-                a = *(unsigned long *)name;
+                a = load_unaligned_zeropad(name);
                 if (len < sizeof(unsigned long))
                         break;
                 hash += a;
@@ -1459,7 +1459,7 @@ static inline unsigned long hash_name(const char *name, unsigned int *hashp)
         do {
                 hash = (hash + a) * 9;
                 len += sizeof(unsigned long);
-                a = *(unsigned long *)(name+len);
+                a = load_unaligned_zeropad(name+len);
                 /* Do we have any NUL or '/' bytes in this word? */
                 mask = has_zero(a) | has_zero(a ^ REPEAT_BYTE('/'));
         } while (!mask);
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index 9c94297bb70e..7f6a23f0244e 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -38,6 +38,8 @@
 #include <linux/buffer_head.h>  /* various write calls */
 #include <linux/prefetch.h>
 
+#include "../pnfs.h"
+#include "../internal.h"
 #include "blocklayout.h"
 
 #define NFSDBG_FACILITY NFSDBG_PNFS_LD
@@ -868,7 +870,7 @@ nfs4_blk_get_deviceinfo(struct nfs_server *server, const struct nfs_fh *fh,
          * GETDEVICEINFO's maxcount
          */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
         dprintk("%s max_resp_sz %u max_pages %d\n",
                 __func__, max_resp_sz, max_pages);
 
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index da7b5e4ff9ec..60f7e4ec842c 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1729,7 +1729,8 @@ error:
  */
 struct nfs_server *nfs_clone_server(struct nfs_server *source,
                                     struct nfs_fh *fh,
-                                    struct nfs_fattr *fattr)
+                                    struct nfs_fattr *fattr,
+                                    rpc_authflavor_t flavor)
 {
         struct nfs_server *server;
         struct nfs_fattr *fattr_fsinfo;
@@ -1758,7 +1759,7 @@ struct nfs_server *nfs_clone_server(struct nfs_server *source,
 
         error = nfs_init_server_rpcclient(server,
                         source->client->cl_timeout,
-                        source->client->cl_auth->au_flavor);
+                        flavor);
         if (error < 0)
                 goto out_free_server;
         if (!IS_ERR(source->client_acl))
diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
index b7f348bb618b..ba3019f5934c 100644
--- a/fs/nfs/idmap.c
+++ b/fs/nfs/idmap.c
@@ -554,12 +554,16 @@ static int rpc_pipefs_event(struct notifier_block *nb, unsigned long event,
         struct nfs_client *clp;
         int error = 0;
 
+        if (!try_module_get(THIS_MODULE))
+                return 0;
+
         while ((clp = nfs_get_client_for_event(sb->s_fs_info, event))) {
                 error = __rpc_pipefs_event(clp, event, sb);
                 nfs_put_client(clp);
                 if (error)
                         break;
         }
+        module_put(THIS_MODULE);
         return error;
 }
 
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 2476dc69365f..b777bdaba4c5 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -165,7 +165,8 @@ extern struct nfs_server *nfs4_create_referral_server(struct nfs_clone_mount *,
 extern void nfs_free_server(struct nfs_server *server);
 extern struct nfs_server *nfs_clone_server(struct nfs_server *,
                                            struct nfs_fh *,
-                                           struct nfs_fattr *);
+                                           struct nfs_fattr *,
+                                           rpc_authflavor_t);
 extern void nfs_mark_client_ready(struct nfs_client *clp, int state);
 extern int nfs4_check_client_ready(struct nfs_client *clp);
 extern struct nfs_client *nfs4_set_ds_client(struct nfs_client* mds_clp,
@@ -186,10 +187,10 @@ static inline void nfs_fs_proc_exit(void)
 
 /* nfs4namespace.c */
 #ifdef CONFIG_NFS_V4
-extern struct vfsmount *nfs_do_refmount(struct dentry *dentry);
+extern struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry);
 #else
 static inline
-struct vfsmount *nfs_do_refmount(struct dentry *dentry)
+struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry)
 {
         return ERR_PTR(-ENOENT);
 }
@@ -234,7 +235,6 @@ extern const u32 nfs41_maxwrite_overhead;
 /* nfs4proc.c */
 #ifdef CONFIG_NFS_V4
 extern struct rpc_procinfo nfs4_procedures[];
-void nfs_fixup_secinfo_attributes(struct nfs_fattr *, struct nfs_fh *);
 #endif
 
 extern int nfs4_init_ds_session(struct nfs_client *clp);
diff --git a/fs/nfs/namespace.c b/fs/nfs/namespace.c
index 1807866bb3ab..d51868e5683c 100644
--- a/fs/nfs/namespace.c
+++ b/fs/nfs/namespace.c
@@ -148,66 +148,31 @@ rpc_authflavor_t nfs_find_best_sec(struct nfs4_secinfo_flavors *flavors)
         return pseudoflavor;
 }
 
-static int nfs_negotiate_security(const struct dentry *parent,
-                                  const struct dentry *dentry,
-                                  rpc_authflavor_t *flavor)
+static struct rpc_clnt *nfs_lookup_mountpoint(struct inode *dir,
+                                              struct qstr *name,
+                                              struct nfs_fh *fh,
+                                              struct nfs_fattr *fattr)
 {
-        struct page *page;
-        struct nfs4_secinfo_flavors *flavors;
-        int (*secinfo)(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
-        int ret = -EPERM;
-
-        secinfo = NFS_PROTO(parent->d_inode)->secinfo;
-        if (secinfo != NULL) {
-                page = alloc_page(GFP_KERNEL);
-                if (!page) {
-                        ret = -ENOMEM;
-                        goto out;
-                }
-                flavors = page_address(page);
-                ret = secinfo(parent->d_inode, &dentry->d_name, flavors);
-                *flavor = nfs_find_best_sec(flavors);
-                put_page(page);
-        }
-
-out:
-        return ret;
-}
-
-static int nfs_lookup_with_sec(struct nfs_server *server, struct dentry *parent,
-                               struct dentry *dentry, struct path *path,
-                               struct nfs_fh *fh, struct nfs_fattr *fattr,
-                               rpc_authflavor_t *flavor)
-{
-        struct rpc_clnt *clone;
-        struct rpc_auth *auth;
         int err;
 
-        err = nfs_negotiate_security(parent, path->dentry, flavor);
-        if (err < 0)
-                goto out;
-        clone  = rpc_clone_client(server->client);
-        auth   = rpcauth_create(*flavor, clone);
-        if (!auth) {
-                err = -EIO;
-                goto out_shutdown;
-        }
-        err = server->nfs_client->rpc_ops->lookup(clone, parent->d_inode,
-                                                  &path->dentry->d_name,
-                                                  fh, fattr);
-out_shutdown:
-        rpc_shutdown_client(clone);
-out:
-        return err;
+        if (NFS_PROTO(dir)->version == 4)
+                return nfs4_proc_lookup_mountpoint(dir, name, fh, fattr);
+
+        err = NFS_PROTO(dir)->lookup(NFS_SERVER(dir)->client, dir, name, fh, fattr);
+        if (err)
+                return ERR_PTR(err);
+        return rpc_clone_client(NFS_SERVER(dir)->client);
 }
 #else /* CONFIG_NFS_V4 */
-static inline int nfs_lookup_with_sec(struct nfs_server *server,
-                                      struct dentry *parent, struct dentry *dentry,
-                                      struct path *path, struct nfs_fh *fh,
-                                      struct nfs_fattr *fattr,
-                                      rpc_authflavor_t *flavor)
+static inline struct rpc_clnt *nfs_lookup_mountpoint(struct inode *dir,
+                                                     struct qstr *name,
+                                                     struct nfs_fh *fh,
+                                                     struct nfs_fattr *fattr)
 {
-        return -EPERM;
+        int err = NFS_PROTO(dir)->lookup(NFS_SERVER(dir)->client, dir, name, fh, fattr);
+        if (err)
+                return ERR_PTR(err);
+        return rpc_clone_client(NFS_SERVER(dir)->client);
 }
 #endif /* CONFIG_NFS_V4 */
 
@@ -226,12 +191,10 @@ static inline int nfs_lookup_with_sec(struct nfs_server *server,
 struct vfsmount *nfs_d_automount(struct path *path)
 {
         struct vfsmount *mnt;
-        struct nfs_server *server = NFS_SERVER(path->dentry->d_inode);
         struct dentry *parent;
         struct nfs_fh *fh = NULL;
         struct nfs_fattr *fattr = NULL;
-        int err;
-        rpc_authflavor_t flavor = RPC_AUTH_UNIX;
+        struct rpc_clnt *client;
 
         dprintk("--> nfs_d_automount()\n");
 
@@ -249,21 +212,19 @@ struct vfsmount *nfs_d_automount(struct path *path)
 
         /* Look it up again to get its attributes */
         parent = dget_parent(path->dentry);
-        err = server->nfs_client->rpc_ops->lookup(server->client, parent->d_inode,
-                                                  &path->dentry->d_name,
-                                                  fh, fattr);
-        if (err == -EPERM && NFS_PROTO(parent->d_inode)->secinfo != NULL)
-                err = nfs_lookup_with_sec(server, parent, path->dentry, path, fh, fattr, &flavor);
+        client = nfs_lookup_mountpoint(parent->d_inode, &path->dentry->d_name, fh, fattr);
         dput(parent);
-        if (err != 0) {
-                mnt = ERR_PTR(err);
+        if (IS_ERR(client)) {
+                mnt = ERR_CAST(client);
                 goto out;
         }
 
         if (fattr->valid & NFS_ATTR_FATTR_V4_REFERRAL)
-                mnt = nfs_do_refmount(path->dentry);
+                mnt = nfs_do_refmount(client, path->dentry);
         else
-                mnt = nfs_do_submount(path->dentry, fh, fattr, flavor);
+                mnt = nfs_do_submount(path->dentry, fh, fattr, client->cl_auth->au_flavor);
+        rpc_shutdown_client(client);
+
         if (IS_ERR(mnt))
                 goto out;
 
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index b6db9e33fb7b..8d75021020b3 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -205,6 +205,9 @@ struct nfs4_state_maintenance_ops {
 extern const struct dentry_operations nfs4_dentry_operations;
 extern const struct inode_operations nfs4_dir_inode_operations;
 
+/* nfs4namespace.c */
+struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *, struct inode *, struct qstr *);
+
 /* nfs4proc.c */
 extern int nfs4_proc_setclientid(struct nfs_client *, u32, unsigned short, struct rpc_cred *, struct nfs4_setclientid_res *);
 extern int nfs4_proc_setclientid_confirm(struct nfs_client *, struct nfs4_setclientid_res *arg, struct rpc_cred *);
@@ -213,8 +216,11 @@ extern int nfs4_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs41_init_clientid(struct nfs_client *, struct rpc_cred *);
 extern int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait, bool roc);
 extern int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle);
-extern int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
-                struct nfs4_fs_locations *fs_locations, struct page *page);
+extern int nfs4_proc_fs_locations(struct rpc_clnt *, struct inode *, const struct qstr *,
+                                  struct nfs4_fs_locations *, struct page *);
+extern struct rpc_clnt *nfs4_proc_lookup_mountpoint(struct inode *, struct qstr *,
+                            struct nfs_fh *, struct nfs_fattr *);
+extern int nfs4_proc_secinfo(struct inode *, const struct qstr *, struct nfs4_secinfo_flavors *);
 extern int nfs4_release_lockowner(struct nfs4_lock_state *);
 extern const struct xattr_handler *nfs4_xattr_handlers[];
 
diff --git a/fs/nfs/nfs4filelayoutdev.c b/fs/nfs/nfs4filelayoutdev.c
index a866bbd2890a..c9cff9adb2d3 100644
--- a/fs/nfs/nfs4filelayoutdev.c
+++ b/fs/nfs/nfs4filelayoutdev.c
@@ -699,7 +699,7 @@ get_device_info(struct inode *inode, struct nfs4_deviceid *dev_id, gfp_t gfp_fla
          * GETDEVICEINFO's maxcount
          */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
         dprintk("%s inode %p max_resp_sz %u max_pages %d\n",
                 __func__, inode, max_resp_sz, max_pages);
 
diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c
index 9c8eca315f43..a7f3dedc4ec7 100644
--- a/fs/nfs/nfs4namespace.c
+++ b/fs/nfs/nfs4namespace.c
@@ -52,6 +52,30 @@ Elong:
 }
 
 /*
+ * return the path component of "<server>:<path>"
+ *  nfspath - the "<server>:<path>" string
+ *  end - one past the last char that could contain "<server>:"
+ * returns NULL on failure
+ */
+static char *nfs_path_component(const char *nfspath, const char *end)
+{
+        char *p;
+
+        if (*nfspath == '[') {
+                /* parse [] escaped IPv6 addrs */
+                p = strchr(nfspath, ']');
+                if (p != NULL && ++p < end && *p == ':')
+                        return p + 1;
+        } else {
+                /* otherwise split on first colon */
+                p = strchr(nfspath, ':');
+                if (p != NULL && p < end)
+                        return p + 1;
+        }
+        return NULL;
+}
+
+/*
  * Determine the mount path as a string
  */
 static char *nfs4_path(struct dentry *dentry, char *buffer, ssize_t buflen)
@@ -59,9 +83,9 @@ static char *nfs4_path(struct dentry *dentry, char *buffer, ssize_t buflen)
         char *limit;
         char *path = nfs_path(&limit, dentry, buffer, buflen);
         if (!IS_ERR(path)) {
-                char *colon = strchr(path, ':');
-                if (colon && colon < limit)
-                        path = colon + 1;
+                char *path_component = nfs_path_component(path, limit);
+                if (path_component)
+                        return path_component;
         }
         return path;
 }
@@ -108,6 +132,58 @@ static size_t nfs_parse_server_name(char *string, size_t len,
         return ret;
 }
 
+static rpc_authflavor_t nfs4_negotiate_security(struct inode *inode, struct qstr *name)
+{
+        struct page *page;
+        struct nfs4_secinfo_flavors *flavors;
+        rpc_authflavor_t flavor;
+        int err;
+
+        page = alloc_page(GFP_KERNEL);
+        if (!page)
+                return -ENOMEM;
+        flavors = page_address(page);
+
+        err = nfs4_proc_secinfo(inode, name, flavors);
+        if (err < 0) {
+                flavor = err;
+                goto out;
+        }
+
+        flavor = nfs_find_best_sec(flavors);
+
+out:
+        put_page(page);
+        return flavor;
+}
+
+/*
+ * Please call rpc_shutdown_client() when you are done with this client.
+ */
+struct rpc_clnt *nfs4_create_sec_client(struct rpc_clnt *clnt, struct inode *inode,
+                                        struct qstr *name)
+{
+        struct rpc_clnt *clone;
+        struct rpc_auth *auth;
+        rpc_authflavor_t flavor;
+
+        flavor = nfs4_negotiate_security(inode, name);
+        if (flavor < 0)
+                return ERR_PTR(flavor);
+
+        clone = rpc_clone_client(clnt);
+        if (IS_ERR(clone))
+                return clone;
+
+        auth = rpcauth_create(flavor, clone);
+        if (!auth) {
+                rpc_shutdown_client(clone);
+                clone = ERR_PTR(-EIO);
+        }
+
+        return clone;
+}
+
 static struct vfsmount *try_location(struct nfs_clone_mount *mountdata,
                                      char *page, char *page2,
                                      const struct nfs4_fs_location *location)
@@ -224,7 +300,7 @@ out:
  * @dentry - dentry of referral
  *
  */
-struct vfsmount *nfs_do_refmount(struct dentry *dentry)
+struct vfsmount *nfs_do_refmount(struct rpc_clnt *client, struct dentry *dentry)
 {
         struct vfsmount *mnt = ERR_PTR(-ENOMEM);
         struct dentry *parent;
@@ -250,7 +326,7 @@ struct vfsmount *nfs_do_refmount(struct dentry *dentry)
         dprintk("%s: getting locations for %s/%s\n",
                 __func__, parent->d_name.name, dentry->d_name.name);
 
-        err = nfs4_proc_fs_locations(parent->d_inode, &dentry->d_name, fs_locations, page);
+        err = nfs4_proc_fs_locations(client, parent->d_inode, &dentry->d_name, fs_locations, page);
         dput(parent);
         if (err != 0 ||
             fs_locations->nlocations <= 0 ||
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 60d5f4c26dda..99650aaf8937 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2377,8 +2377,9 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *fhandle,
  * Note that we'll actually follow the referral later when
  * we detect fsid mismatch in inode revalidation
  */
-static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
-                             struct nfs_fattr *fattr, struct nfs_fh *fhandle)
+static int nfs4_get_referral(struct rpc_clnt *client, struct inode *dir,
+                             const struct qstr *name, struct nfs_fattr *fattr,
+                             struct nfs_fh *fhandle)
 {
         int status = -ENOMEM;
         struct page *page = NULL;
@@ -2391,7 +2392,7 @@ static int nfs4_get_referral(struct inode *dir, const struct qstr *name,
         if (locations == NULL)
                 goto out;
 
-        status = nfs4_proc_fs_locations(dir, name, locations, page);
+        status = nfs4_proc_fs_locations(client, dir, name, locations, page);
         if (status != 0)
                 goto out;
         /* Make sure server returned a different fsid for the referral */
@@ -2528,39 +2529,84 @@ static int _nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir,
         return status;
 }
 
-void nfs_fixup_secinfo_attributes(struct nfs_fattr *fattr, struct nfs_fh *fh)
+static void nfs_fixup_secinfo_attributes(struct nfs_fattr *fattr)
 {
-        memset(fh, 0, sizeof(struct nfs_fh));
-        fattr->fsid.major = 1;
         fattr->valid |= NFS_ATTR_FATTR_TYPE | NFS_ATTR_FATTR_MODE |
-                NFS_ATTR_FATTR_NLINK | NFS_ATTR_FATTR_FSID | NFS_ATTR_FATTR_MOUNTPOINT;
+                NFS_ATTR_FATTR_NLINK | NFS_ATTR_FATTR_MOUNTPOINT;
         fattr->mode = S_IFDIR | S_IRUGO | S_IXUGO;
         fattr->nlink = 2;
 }
 
-static int nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir, struct qstr *name,
-                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+static int nfs4_proc_lookup_common(struct rpc_clnt **clnt, struct inode *dir,
+                                   struct qstr *name, struct nfs_fh *fhandle,
+                                   struct nfs_fattr *fattr)
 {
         struct nfs4_exception exception = { };
+        struct rpc_clnt *client = *clnt;
         int err;
         do {
-                int status;
-
-                status = _nfs4_proc_lookup(clnt, dir, name, fhandle, fattr);
-                switch (status) {
+                err = _nfs4_proc_lookup(client, dir, name, fhandle, fattr);
+                switch (err) {
                 case -NFS4ERR_BADNAME:
-                        return -ENOENT;
+                        err = -ENOENT;
+                        goto out;
                 case -NFS4ERR_MOVED:
-                        return nfs4_get_referral(dir, name, fattr, fhandle);
+                        err = nfs4_get_referral(client, dir, name, fattr, fhandle);
+                        goto out;
                 case -NFS4ERR_WRONGSEC:
-                        nfs_fixup_secinfo_attributes(fattr, fhandle);
+                        err = -EPERM;
+                        if (client != *clnt)
+                                goto out;
+
+                        client = nfs4_create_sec_client(client, dir, name);
+                        if (IS_ERR(client))
+                                return PTR_ERR(client);
+
+                        exception.retry = 1;
+                        break;
+                default:
+                        err = nfs4_handle_exception(NFS_SERVER(dir), err, &exception);
                 }
-                err = nfs4_handle_exception(NFS_SERVER(dir),
-                                status, &exception);
         } while (exception.retry);
+
+out:
+        if (err == 0)
+                *clnt = client;
+        else if (client != *clnt)
+                rpc_shutdown_client(client);
+
         return err;
 }
 
+static int nfs4_proc_lookup(struct rpc_clnt *clnt, struct inode *dir, struct qstr *name,
+                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+{
+        int status;
+        struct rpc_clnt *client = NFS_CLIENT(dir);
+
+        status = nfs4_proc_lookup_common(&client, dir, name, fhandle, fattr);
+        if (client != NFS_CLIENT(dir)) {
+                rpc_shutdown_client(client);
+                nfs_fixup_secinfo_attributes(fattr);
+        }
+        return status;
+}
+
+struct rpc_clnt *
+nfs4_proc_lookup_mountpoint(struct inode *dir, struct qstr *name,
+                            struct nfs_fh *fhandle, struct nfs_fattr *fattr)
+{
+        int status;
+        struct rpc_clnt *client = rpc_clone_client(NFS_CLIENT(dir));
+
+        status = nfs4_proc_lookup_common(&client, dir, name, fhandle, fattr);
+        if (status < 0) {
+                rpc_shutdown_client(client);
+                return ERR_PTR(status);
+        }
+        return client;
+}
+
 static int _nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
 {
         struct nfs_server *server = NFS_SERVER(inode);
@@ -3628,16 +3674,16 @@ out:
         return ret;
 }
 
-static void nfs4_write_cached_acl(struct inode *inode, const char *buf, size_t acl_len)
+static void nfs4_write_cached_acl(struct inode *inode, struct page **pages, size_t pgbase, size_t acl_len)
 {
         struct nfs4_cached_acl *acl;
 
-        if (buf && acl_len <= PAGE_SIZE) {
+        if (pages && acl_len <= PAGE_SIZE) {
                 acl = kmalloc(sizeof(*acl) + acl_len, GFP_KERNEL);
                 if (acl == NULL)
                         goto out;
                 acl->cached = 1;
-                memcpy(acl->data, buf, acl_len);
+                _copy_from_pages(acl->data, pages, pgbase, acl_len);
         } else {
                 acl = kmalloc(sizeof(*acl), GFP_KERNEL);
                 if (acl == NULL)
@@ -3670,7 +3716,6 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         struct nfs_getaclres res = {
                 .acl_len = buflen,
         };
-        void *resp_buf;
         struct rpc_message msg = {
                 .rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_GETACL],
                 .rpc_argp = &args,
@@ -3684,24 +3729,27 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         if (npages == 0)
                 npages = 1;
 
+        /* Add an extra page to handle the bitmap returned */
+        npages++;
+
         for (i = 0; i < npages; i++) {
                 pages[i] = alloc_page(GFP_KERNEL);
                 if (!pages[i])
                         goto out_free;
         }
-        if (npages > 1) {
-                /* for decoding across pages */
-                res.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!res.acl_scratch)
-                        goto out_free;
-        }
+
+        /* for decoding across pages */
+        res.acl_scratch = alloc_page(GFP_KERNEL);
+        if (!res.acl_scratch)
+                goto out_free;
+
         args.acl_len = npages * PAGE_SIZE;
         args.acl_pgbase = 0;
+
         /* Let decode_getfacl know not to fail if the ACL data is larger than
          * the page we send as a guess */
         if (buf == NULL)
                 res.acl_flags |= NFS4_ACL_LEN_REQUEST;
-        resp_buf = page_address(pages[0]);
 
         dprintk("%s  buf %p buflen %zu npages %d args.acl_len %zu\n",
                 __func__, buf, buflen, npages, args.acl_len);
@@ -3712,9 +3760,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
 
         acl_len = res.acl_len - res.acl_data_offset;
         if (acl_len > args.acl_len)
-                nfs4_write_cached_acl(inode, NULL, acl_len);
+                nfs4_write_cached_acl(inode, NULL, 0, acl_len);
         else
-                nfs4_write_cached_acl(inode, resp_buf + res.acl_data_offset,
+                nfs4_write_cached_acl(inode, pages, res.acl_data_offset,
                                       acl_len);
         if (buf) {
                 ret = -ERANGE;
@@ -4919,8 +4967,10 @@ static void nfs_fixup_referral_attributes(struct nfs_fattr *fattr)
         fattr->nlink = 2;
 }
 
-int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
-                struct nfs4_fs_locations *fs_locations, struct page *page)
+static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+                                   const struct qstr *name,
+                                   struct nfs4_fs_locations *fs_locations,
+                                   struct page *page)
 {
         struct nfs_server *server = NFS_SERVER(dir);
         u32 bitmask[2] = {
@@ -4954,11 +5004,26 @@ int nfs4_proc_fs_locations(struct inode *dir, const struct qstr *name,
         nfs_fattr_init(&fs_locations->fattr);
         fs_locations->server = server;
         fs_locations->nlocations = 0;
-        status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, &res.seq_res, 0);
+        status = nfs4_call_sync(client, server, &msg, &args.seq_args, &res.seq_res, 0);
         dprintk("%s: returned status = %d\n", __func__, status);
         return status;
 }
 
+int nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir,
+                           const struct qstr *name,
+                           struct nfs4_fs_locations *fs_locations,
+                           struct page *page)
+{
+        struct nfs4_exception exception = { };
+        int err;
+        do {
+                err = nfs4_handle_exception(NFS_SERVER(dir),
+                                _nfs4_proc_fs_locations(client, dir, name, fs_locations, page),
+                                &exception);
+        } while (exception.retry);
+        return err;
+}
+
 static int _nfs4_proc_secinfo(struct inode *dir, const struct qstr *name, struct nfs4_secinfo_flavors *flavors)
 {
         int status;
@@ -4981,8 +5046,8 @@ static int _nfs4_proc_secinfo(struct inode *dir, const struct qstr *name, struct
         return status;
 }
 
-static int nfs4_proc_secinfo(struct inode *dir, const struct qstr *name,
-                struct nfs4_secinfo_flavors *flavors)
+int nfs4_proc_secinfo(struct inode *dir, const struct qstr *name,
+                      struct nfs4_secinfo_flavors *flavors)
 {
         struct nfs4_exception exception = { };
         int err;
@@ -5057,10 +5122,9 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
         nfs4_construct_boot_verifier(clp, &verifier);
 
         args.id_len = scnprintf(args.id, sizeof(args.id),
-                                "%s/%s.%s/%u",
+                                "%s/%s/%u",
                                 clp->cl_ipaddr,
-                                init_utsname()->nodename,
-                                init_utsname()->domainname,
+                                clp->cl_rpcclient->cl_nodename,
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
         res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 77fc5f959c4e..c54aae364bee 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4258,8 +4258,6 @@ static int decode_getfattr_attrs(struct xdr_stream *xdr, uint32_t *bitmap,
         status = decode_attr_error(xdr, bitmap, &err);
         if (status < 0)
                 goto xdr_error;
-        if (err == -NFS4ERR_WRONGSEC)
-                nfs_fixup_secinfo_attributes(fattr, fh);
 
         status = decode_attr_filehandle(xdr, bitmap, fh);
         if (status < 0)
@@ -4902,11 +4900,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                  bitmap[3] = {0};
         struct kvec *iov = req->rq_rcv_buf.head;
         int status;
+        size_t page_len = xdr->buf->page_len;
 
         res->acl_len = 0;
         if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
                 goto out;
+
         bm_p = xdr->p;
+        res->acl_data_offset = be32_to_cpup(bm_p) + 2;
+        res->acl_data_offset <<= 2;
+        /* Check if the acl data starts beyond the allocated buffer */
+        if (res->acl_data_offset > page_len)
+                return -ERANGE;
+
         if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
                 goto out;
         if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
@@ -4916,28 +4922,24 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
                 return -EIO;
         if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
                 size_t hdrlen;
-                u32 recvd;
 
                 /* The bitmap (xdr len + bitmaps) and the attr xdr len words
                  * are stored with the acl data to handle the problem of
                  * variable length bitmaps.*/
                 xdr->p = bm_p;
-                res->acl_data_offset = be32_to_cpup(bm_p) + 2;
-                res->acl_data_offset <<= 2;
 
                 /* We ignore &savep and don't do consistency checks on
                  * the attr length.  Let userspace figure it out.... */
                 hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
                 attrlen += res->acl_data_offset;
-                recvd = req->rq_rcv_buf.len - hdrlen;
-                if (attrlen > recvd) {
+                if (attrlen > page_len) {
                         if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
                                 /* getxattr interface called with a NULL buf */
                                 res->acl_len = attrlen;
                                 goto out;
                         }
-                        dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
-                                        attrlen, recvd);
+                        dprintk("NFS: acl reply: attrlen %u > page_len %zu\n",
+                                        attrlen, page_len);
                         return -EINVAL;
                 }
                 xdr_read_pages(xdr, attrlen);
@@ -5090,16 +5092,13 @@ out_err:
         return -EINVAL;
 }
 
-static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+static int decode_secinfo_common(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
 {
         struct nfs4_secinfo_flavor *sec_flavor;
         int status;
         __be32 *p;
         int i, num_flavors;
 
-        status = decode_op_hdr(xdr, OP_SECINFO);
-        if (status)
-                goto out;
         p = xdr_inline_decode(xdr, 4);
         if (unlikely(!p))
                 goto out_overflow;
@@ -5125,6 +5124,7 @@ static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
                 res->flavors->num_flavors++;
         }
 
+        status = 0;
 out:
         return status;
 out_overflow:
@@ -5132,7 +5132,23 @@ out_overflow:
         return -EIO;
 }
 
+static int decode_secinfo(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+{
+        int status = decode_op_hdr(xdr, OP_SECINFO);
+        if (status)
+                return status;
+        return decode_secinfo_common(xdr, res);
+}
+
 #if defined(CONFIG_NFS_V4_1)
+static int decode_secinfo_no_name(struct xdr_stream *xdr, struct nfs4_secinfo_res *res)
+{
+        int status = decode_op_hdr(xdr, OP_SECINFO_NO_NAME);
+        if (status)
+                return status;
+        return decode_secinfo_common(xdr, res);
+}
+
 static int decode_exchange_id(struct xdr_stream *xdr,
                               struct nfs41_exchange_id_res *res)
 {
@@ -6817,7 +6833,7 @@ static int nfs4_xdr_dec_secinfo_no_name(struct rpc_rqst *rqstp,
         status = decode_putrootfh(xdr);
         if (status)
                 goto out;
-        status = decode_secinfo(xdr, res);
+        status = decode_secinfo_no_name(xdr, res);
 out:
         return status;
 }
diff --git a/fs/nfs/objlayout/objlayout.c b/fs/nfs/objlayout/objlayout.c
index 8d45f1c318ce..595c5fc21a19 100644
--- a/fs/nfs/objlayout/objlayout.c
+++ b/fs/nfs/objlayout/objlayout.c
@@ -604,7 +604,6 @@ int objlayout_get_deviceinfo(struct pnfs_layout_hdr *pnfslay,
 {
         struct objlayout_deviceinfo *odi;
         struct pnfs_device pd;
-        struct super_block *sb;
         struct page *page, **pages;
         u32 *p;
         int err;
@@ -623,7 +622,6 @@ int objlayout_get_deviceinfo(struct pnfs_layout_hdr *pnfslay,
         pd.pglen = PAGE_SIZE;
         pd.mincount = 0;
 
-        sb = pnfslay->plh_inode->i_sb;
         err = nfs4_proc_getdeviceinfo(NFS_SERVER(pnfslay->plh_inode), &pd);
         dprintk("%s nfs_getdeviceinfo returned %d\n", __func__, err);
         if (err)
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index b5d451586943..38512bcd2e98 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -587,7 +587,7 @@ send_layoutget(struct pnfs_layout_hdr *lo,
 
         /* allocate pages for xdr post processing */
         max_resp_sz = server->nfs_client->cl_session->fc_attrs.max_resp_sz;
-        max_pages = max_resp_sz >> PAGE_SHIFT;
+        max_pages = nfs_page_array_len(0, max_resp_sz);
 
         pages = kcalloc(max_pages, sizeof(struct page *), gfp_flags);
         if (!pages)
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 1e6715f0616c..4ac7fca7e4bf 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2428,7 +2428,7 @@ nfs_xdev_mount(struct file_system_type *fs_type, int flags,
         dprintk("--> nfs_xdev_mount()\n");
 
         /* create a new volume representation */
-        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr);
+        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out_err_noserver;
@@ -2955,7 +2955,7 @@ nfs4_xdev_mount(struct file_system_type *fs_type, int flags,
         dprintk("--> nfs4_xdev_mount()\n");
 
         /* create a new volume representation */
-        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr);
+        server = nfs_clone_server(NFS_SB(data->sb), data->fh, data->fattr, data->authflavor);
         if (IS_ERR(server)) {
                 error = PTR_ERR(server);
                 goto out_err_noserver;
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 4767429264a2..ed3f9206a0ee 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -577,7 +577,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
         struct cld_net *cn = nn->cld_net;
 
         if (mlen != sizeof(*cmsg)) {
-                dprintk("%s: got %lu bytes, expected %lu\n", __func__, mlen,
+                dprintk("%s: got %zu bytes, expected %zu\n", __func__, mlen,
                         sizeof(*cmsg));
                 return -EINVAL;
         }
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 2d60492d6df8..1030a716d155 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -747,6 +747,8 @@ static void pte_to_pagemap_entry(pagemap_entry_t *pme, pte_t pte)
         else if (pte_present(pte))
                 *pme = make_pme(PM_PFRAME(pte_pfn(pte))
                                 | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT);
+        else
+                *pme = make_pme(PM_NOT_PRESENT);
 }
 
 #ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -761,6 +763,8 @@ static void thp_pmd_to_pagemap_entry(pagemap_entry_t *pme,
         if (pmd_present(pmd))
                 *pme = make_pme(PM_PFRAME(pmd_pfn(pmd) + offset)
                                 | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT);
+        else
+                *pme = make_pme(PM_NOT_PRESENT);
 }
 #else
 static inline void thp_pmd_to_pagemap_entry(pagemap_entry_t *pme,
@@ -801,8 +805,10 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 
                 /* check to see if we've left 'vma' behind
                  * and need a new, higher one */
-                if (vma && (addr >= vma->vm_end))
+                if (vma && (addr >= vma->vm_end)) {
                         vma = find_vma(walk->mm, addr);
+                        pme = make_pme(PM_NOT_PRESENT);
+                }
 
                 /* check that 'vma' actually covers this address,
                  * and that it isn't a huge page vma */
@@ -830,6 +836,8 @@ static void huge_pte_to_pagemap_entry(pagemap_entry_t *pme,
         if (pte_present(pte))
                 *pme = make_pme(PM_PFRAME(pte_pfn(pte) + offset)
                                 | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT);
+        else
+                *pme = make_pme(PM_NOT_PRESENT);
 }
 
 /* This function walks within one hugetlb entry in the single call */
@@ -839,7 +847,7 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
 {
         struct pagemapread *pm = walk->private;
         int err = 0;
-        pagemap_entry_t pme = make_pme(PM_NOT_PRESENT);
+        pagemap_entry_t pme;
 
         for (; addr != end; addr += PAGE_SIZE) {
                 int offset = (addr & ~hmask) >> PAGE_SHIFT;
diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
index eba66043cf1b..e8bcc4742e0e 100644
--- a/include/acpi/actypes.h
+++ b/include/acpi/actypes.h
@@ -499,9 +499,10 @@ typedef u64 acpi_integer;
 #define ACPI_STATE_D0                   (u8) 0
 #define ACPI_STATE_D1                   (u8) 1
 #define ACPI_STATE_D2                   (u8) 2
-#define ACPI_STATE_D3                   (u8) 3
-#define ACPI_STATE_D3_COLD              (u8) 4
-#define ACPI_D_STATES_MAX               ACPI_STATE_D3_COLD
+#define ACPI_STATE_D3_HOT               (u8) 3
+#define ACPI_STATE_D3                   (u8) 4
+#define ACPI_STATE_D3_COLD              ACPI_STATE_D3
+#define ACPI_D_STATES_MAX               ACPI_STATE_D3
 #define ACPI_D_STATE_COUNT              5
 
 #define ACPI_STATE_C0                   (u8) 0
diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
index 0fd28e028de1..c749af9c0983 100644
--- a/include/asm-generic/statfs.h
+++ b/include/asm-generic/statfs.h
@@ -15,7 +15,7 @@ typedef __kernel_fsid_t	fsid_t;
  * with a 10' pole.
  */
 #ifndef __statfs_word
-#if BITS_PER_LONG == 64
+#if __BITS_PER_LONG == 64
 #define __statfs_word long
 #else
 #define __statfs_word __u32
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 88ec80670d5f..ec45ccd8708a 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -554,7 +554,18 @@ extern int __init efi_setup_pcdp_console(char *);
 #define EFI_VARIABLE_NON_VOLATILE       0x0000000000000001
 #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002
 #define EFI_VARIABLE_RUNTIME_ACCESS     0x0000000000000004
-
+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x0000000000000008
+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x0000000000000010
+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x0000000000000020
+#define EFI_VARIABLE_APPEND_WRITE       0x0000000000000040
+
+#define EFI_VARIABLE_MASK       (EFI_VARIABLE_NON_VOLATILE | \
+                                EFI_VARIABLE_BOOTSERVICE_ACCESS | \
+                                EFI_VARIABLE_RUNTIME_ACCESS | \
+                                EFI_VARIABLE_HARDWARE_ERROR_RECORD | \
+                                EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
+                                EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
+                                EFI_VARIABLE_APPEND_WRITE)
 /*
  * The type of search to perform when calling boottime->locate_handle
  */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 42378d637ffb..e926df7b54c9 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -996,7 +996,8 @@ extern int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *dev,
 extern void ata_sas_port_destroy(struct ata_port *);
 extern struct ata_port *ata_sas_port_alloc(struct ata_host *,
                                            struct ata_port_info *, struct Scsi_Host *);
-extern int ata_sas_async_port_init(struct ata_port *);
+extern void ata_sas_async_probe(struct ata_port *ap);
+extern int ata_sas_sync_probe(struct ata_port *ap);
 extern int ata_sas_port_init(struct ata_port *);
 extern int ata_sas_port_start(struct ata_port *ap);
 extern void ata_sas_port_stop(struct ata_port *ap);
diff --git a/include/linux/netfilter_bridge.h b/include/linux/netfilter_bridge.h
index 0ddd161f3b06..31d2844e6572 100644
--- a/include/linux/netfilter_bridge.h
+++ b/include/linux/netfilter_bridge.h
@@ -104,9 +104,18 @@ struct bridge_skb_cb {
         } daddr;
 };
 
+static inline void br_drop_fake_rtable(struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+
+        if (dst && (dst->flags & DST_FAKE_RTABLE))
+                skb_dst_drop(skb);
+}
+
 #else
 #define nf_bridge_maybe_copy_header(skb)        (0)
 #define nf_bridge_pad(skb)                      (0)
+#define br_drop_fake_rtable(skb)                do { } while (0)
 #endif /* CONFIG_BRIDGE_NETFILTER */
 
 #endif /* __KERNEL__ */
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index c6db9fb33c44..600060e25ec6 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const seqcount_t *s)
         unsigned ret;
 
 repeat:
-        ret = s->sequence;
+        ret = ACCESS_ONCE(s->sequence);
         if (unlikely(ret & 1)) {
                 cpu_relax();
                 goto repeat;
@@ -166,6 +166,27 @@ static inline unsigned read_seqcount_begin(const seqcount_t *s)
 }
 
 /**
+ * raw_seqcount_begin - begin a seq-read critical section
+ * @s: pointer to seqcount_t
+ * Returns: count to be passed to read_seqcount_retry
+ *
+ * raw_seqcount_begin opens a read critical section of the given seqcount.
+ * Validity of the critical section is tested by checking read_seqcount_retry
+ * function.
+ *
+ * Unlike read_seqcount_begin(), this function will not wait for the count
+ * to stabilize. If a writer is active when we begin, we will fail the
+ * read_seqcount_retry() instead of stabilizing at the beginning of the
+ * critical section.
+ */
+static inline unsigned raw_seqcount_begin(const seqcount_t *s)
+{
+        unsigned ret = ACCESS_ONCE(s->sequence);
+        smp_rmb();
+        return ret & ~1;
+}
+
+/**
  * __read_seqcount_retry - end a seq-read critical section (without barrier)
  * @s: pointer to seqcount_t
  * @start: count, from read_seqcount_begin
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 775292a66fa4..111f26b6e28b 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1020,7 +1020,7 @@ static inline void skb_queue_splice(const struct sk_buff_head *list,
 }
 
 /**
- *      skb_queue_splice - join two skb lists and reinitialise the emptied list
+ *      skb_queue_splice_init - join two skb lists and reinitialise the emptied list
  *      @list: the new list to add
  *      @head: the place to add it in the first list
  *
@@ -1051,7 +1051,7 @@ static inline void skb_queue_splice_tail(const struct sk_buff_head *list,
 }
 
 /**
- *      skb_queue_splice_tail - join two skb lists and reinitialise the emptied list
+ *      skb_queue_splice_tail_init - join two skb lists and reinitialise the emptied list
  *      @list: the new list to add
  *      @head: the place to add it in the first list
  *
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 6822d2595aff..db1c5df45224 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -314,6 +314,7 @@ struct hci_conn {
 
         __u8            remote_cap;
         __u8            remote_auth;
+        bool            flush_key;
 
         unsigned int    sent;
 
@@ -980,7 +981,7 @@ int mgmt_discoverable(struct hci_dev *hdev, u8 discoverable);
 int mgmt_connectable(struct hci_dev *hdev, u8 connectable);
 int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status);
 int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key,
-                      u8 persistent);
+                      bool persistent);
 int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                           u8 addr_type, u32 flags, u8 *name, u8 name_len,
                           u8 *dev_class);
diff --git a/include/net/dst.h b/include/net/dst.h
index ff4da42fcfc6..bed833d9796a 100644
--- a/include/net/dst.h
+++ b/include/net/dst.h
@@ -59,6 +59,7 @@ struct dst_entry {
 #define DST_NOCACHE             0x0010
 #define DST_NOCOUNT             0x0020
 #define DST_NOPEER              0x0040
+#define DST_FAKE_RTABLE         0x0080
 
         short                   error;
         short                   obsolete;
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 2bdee51ba30d..72522f087375 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -393,7 +393,7 @@ struct ip_vs_protocol {
 
         void (*exit)(struct ip_vs_protocol *pp);
 
-        void (*init_netns)(struct net *net, struct ip_vs_proto_data *pd);
+        int (*init_netns)(struct net *net, struct ip_vs_proto_data *pd);
 
         void (*exit_netns)(struct net *net, struct ip_vs_proto_data *pd);
 
@@ -1203,6 +1203,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
 
 extern int ip_vs_use_count_inc(void);
 extern void ip_vs_use_count_dec(void);
+extern int ip_vs_register_nl_ioctl(void);
+extern void ip_vs_unregister_nl_ioctl(void);
 extern int ip_vs_control_init(void);
 extern void ip_vs_control_cleanup(void);
 extern struct ip_vs_dest *
diff --git a/include/net/sock.h b/include/net/sock.h
index 188532ee88b6..5a0a58ac4126 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1129,9 +1129,9 @@ sk_sockets_allocated_read_positive(struct sock *sk)
         struct proto *prot = sk->sk_prot;
 
         if (mem_cgroup_sockets_enabled && sk->sk_cgrp)
-                return percpu_counter_sum_positive(sk->sk_cgrp->sockets_allocated);
+                return percpu_counter_read_positive(sk->sk_cgrp->sockets_allocated);
 
-        return percpu_counter_sum_positive(prot->sockets_allocated);
+        return percpu_counter_read_positive(prot->sockets_allocated);
 }
 
 static inline int
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index 5f5ed1b8b41b..f4f1c96dca72 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -217,11 +217,29 @@ struct domain_device {
         struct kref kref;
 };
 
-struct sas_discovery_event {
+struct sas_work {
+        struct list_head drain_node;
         struct work_struct work;
+};
+
+static inline void INIT_SAS_WORK(struct sas_work *sw, void (*fn)(struct work_struct *))
+{
+        INIT_WORK(&sw->work, fn);
+        INIT_LIST_HEAD(&sw->drain_node);
+}
+
+struct sas_discovery_event {
+        struct sas_work work;
         struct asd_sas_port *port;
 };
 
+static inline struct sas_discovery_event *to_sas_discovery_event(struct work_struct *work)
+{
+        struct sas_discovery_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 struct sas_discovery {
         struct sas_discovery_event disc_work[DISC_NUM_EVENTS];
         unsigned long    pending;
@@ -244,7 +262,7 @@ struct asd_sas_port {
         struct list_head destroy_list;
         enum   sas_linkrate linkrate;
 
-        struct work_struct work;
+        struct sas_work work;
 
 /* public: */
         int id;
@@ -270,10 +288,17 @@ struct asd_sas_port {
 };
 
 struct asd_sas_event {
-        struct work_struct work;
+        struct sas_work work;
         struct asd_sas_phy *phy;
 };
 
+static inline struct asd_sas_event *to_asd_sas_event(struct work_struct *work)
+{
+        struct asd_sas_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 /* The phy pretty much is controlled by the LLDD.
  * The class only reads those fields.
  */
@@ -333,10 +358,17 @@ struct scsi_core {
 };
 
 struct sas_ha_event {
-        struct work_struct work;
+        struct sas_work work;
         struct sas_ha_struct *ha;
 };
 
+static inline struct sas_ha_event *to_sas_ha_event(struct work_struct *work)
+{
+        struct sas_ha_event *ev = container_of(work, typeof(*ev), work.work);
+
+        return ev;
+}
+
 enum sas_ha_state {
         SAS_HA_REGISTERED,
         SAS_HA_DRAINING,
diff --git a/include/scsi/sas_ata.h b/include/scsi/sas_ata.h
index cdccd2eb7b6c..77670e823ed8 100644
--- a/include/scsi/sas_ata.h
+++ b/include/scsi/sas_ata.h
@@ -37,7 +37,7 @@ static inline int dev_is_sata(struct domain_device *dev)
 }
 
 int sas_get_ata_info(struct domain_device *dev, struct ex_phy *phy);
-int sas_ata_init_host_and_port(struct domain_device *found_dev);
+int sas_ata_init(struct domain_device *dev);
 void sas_ata_task_abort(struct sas_task *task);
 void sas_ata_strategy_handler(struct Scsi_Host *shost);
 void sas_ata_eh(struct Scsi_Host *shost, struct list_head *work_q,
@@ -52,7 +52,7 @@ static inline int dev_is_sata(struct domain_device *dev)
 {
         return 0;
 }
-static inline int sas_ata_init_host_and_port(struct domain_device *found_dev)
+static inline int sas_ata_init(struct domain_device *dev)
 {
         return 0;
 }
diff --git a/init/do_mounts.c b/init/do_mounts.c
index 0e93f92a0345..42b0707c3481 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -472,7 +472,7 @@ void __init change_floppy(char *fmt, ...)
 void __init mount_root(void)
 {
 #ifdef CONFIG_ROOT_NFS
-        if (MAJOR(ROOT_DEV) == UNNAMED_MAJOR) {
+        if (ROOT_DEV == Root_NFS) {
                 if (mount_nfs_root())
                         return;
 
diff --git a/kernel/compat.c b/kernel/compat.c
index 74ff8498809a..d2c67aa49ae6 100644
--- a/kernel/compat.c
+++ b/kernel/compat.c
@@ -372,25 +372,54 @@ asmlinkage long compat_sys_sigpending(compat_old_sigset_t __user *set)
 
 #ifdef __ARCH_WANT_SYS_SIGPROCMASK
 
-asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
-                compat_old_sigset_t __user *oset)
+/*
+ * sys_sigprocmask SIG_SETMASK sets the first (compat) word of the
+ * blocked set of signals to the supplied signal set
+ */
+static inline void compat_sig_setmask(sigset_t *blocked, compat_sigset_word set)
 {
-        old_sigset_t s;
-        long ret;
-        mm_segment_t old_fs;
+        memcpy(blocked->sig, &set, sizeof(set));
+}
 
-        if (set && get_user(s, set))
-                return -EFAULT;
-        old_fs = get_fs();
-        set_fs(KERNEL_DS);
-        ret = sys_sigprocmask(how,
-                              set ? (old_sigset_t __user *) &s : NULL,
-                              oset ? (old_sigset_t __user *) &s : NULL);
-        set_fs(old_fs);
-        if (ret == 0)
-                if (oset)
-                        ret = put_user(s, oset);
-        return ret;
+asmlinkage long compat_sys_sigprocmask(int how,
+                                       compat_old_sigset_t __user *nset,
+                                       compat_old_sigset_t __user *oset)
+{
+        old_sigset_t old_set, new_set;
+        sigset_t new_blocked;
+
+        old_set = current->blocked.sig[0];
+
+        if (nset) {
+                if (get_user(new_set, nset))
+                        return -EFAULT;
+                new_set &= ~(sigmask(SIGKILL) | sigmask(SIGSTOP));
+
+                new_blocked = current->blocked;
+
+                switch (how) {
+                case SIG_BLOCK:
+                        sigaddsetmask(&new_blocked, new_set);
+                        break;
+                case SIG_UNBLOCK:
+                        sigdelsetmask(&new_blocked, new_set);
+                        break;
+                case SIG_SETMASK:
+                        compat_sig_setmask(&new_blocked, new_set);
+                        break;
+                default:
+                        return -EINVAL;
+                }
+
+                set_current_blocked(&new_blocked);
+        }
+
+        if (oset) {
+                if (put_user(old_set, oset))
+                        return -EFAULT;
+        }
+
+        return 0;
 }
 
 #endif
diff --git a/kernel/fork.c b/kernel/fork.c
index b9372a0bff18..687a15d56243 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -47,6 +47,7 @@
 #include <linux/audit.h>
 #include <linux/memcontrol.h>
 #include <linux/ftrace.h>
+#include <linux/proc_fs.h>
 #include <linux/profile.h>
 #include <linux/rmap.h>
 #include <linux/ksm.h>
@@ -1464,6 +1465,8 @@ bad_fork_cleanup_io:
         if (p->io_context)
                 exit_io_context(p);
 bad_fork_cleanup_namespaces:
+        if (unlikely(clone_flags & CLONE_NEWPID))
+                pid_ns_release_proc(p->nsproxy->pid_ns);
         exit_task_namespaces(p);
 bad_fork_cleanup_mm:
         if (p->mm)
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5a16423a512c..ae8f708e3d75 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2498,7 +2498,6 @@ retry_avoidcopy:
                 if (outside_reserve) {
                         BUG_ON(huge_pte_none(pte));
                         if (unmap_ref_private(mm, vma, old_page, address)) {
-                                BUG_ON(page_count(old_page) != 1);
                                 BUG_ON(huge_pte_none(pte));
                                 spin_lock(&mm->page_table_lock);
                                 ptep = huge_pte_offset(mm, address & huge_page_mask(h));
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 31ab9c3f0178..b659260c56ad 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4507,6 +4507,12 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
 swap_buffers:
         /* Swap primary and spare array */
         thresholds->spare = thresholds->primary;
+        /* If all events are unregistered, free the spare array */
+        if (!new) {
+                kfree(thresholds->spare);
+                thresholds->spare = NULL;
+        }
+
         rcu_assign_pointer(thresholds->primary, new);
 
         /* To be sure that nobody uses thresholds */
diff --git a/mm/nobootmem.c b/mm/nobootmem.c
index e53bb8a256b1..1983fb1c7026 100644
--- a/mm/nobootmem.c
+++ b/mm/nobootmem.c
@@ -82,8 +82,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size)
 
 static void __init __free_pages_memory(unsigned long start, unsigned long end)
 {
-        int i;
-        unsigned long start_aligned, end_aligned;
+        unsigned long i, start_aligned, end_aligned;
         int order = ilog2(BITS_PER_LONG);
 
         start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index a712fb9e04ce..918330f71dba 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5203,7 +5203,7 @@ int percpu_pagelist_fraction_sysctl_handler(ctl_table *table, int write,
         int ret;
 
         ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
-        if (!write || (ret == -EINVAL))
+        if (!write || (ret < 0))
                 return ret;
         for_each_populated_zone(zone) {
                 for_each_possible_cpu(cpu) {
diff --git a/mm/percpu.c b/mm/percpu.c
index f47af9123af7..bb4be7435ce3 100644
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1132,20 +1132,20 @@ static void pcpu_dump_alloc_info(const char *lvl,
                 for (alloc_end += gi->nr_units / upa;
                      alloc < alloc_end; alloc++) {
                         if (!(alloc % apl)) {
-                                printk("\n");
+                                printk(KERN_CONT "\n");
                                 printk("%spcpu-alloc: ", lvl);
                         }
-                        printk("[%0*d] ", group_width, group);
+                        printk(KERN_CONT "[%0*d] ", group_width, group);
 
                         for (unit_end += upa; unit < unit_end; unit++)
                                 if (gi->cpu_map[unit] != NR_CPUS)
-                                        printk("%0*d ", cpu_width,
+                                        printk(KERN_CONT "%0*d ", cpu_width,
                                                gi->cpu_map[unit]);
                                 else
-                                        printk("%s ", empty_str);
+                                        printk(KERN_CONT "%s ", empty_str);
                 }
         }
-        printk("\n");
+        printk(KERN_CONT "\n");
 }
 
 /**
@@ -1650,6 +1650,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
                 areas[group] = ptr;
 
                 base = min(ptr, base);
+        }
+
+        /*
+         * Copy data and free unused parts.  This should happen after all
+         * allocations are complete; otherwise, we may end up with
+         * overlapping groups.
+         */
+        for (group = 0; group < ai->nr_groups; group++) {
+                struct pcpu_group_info *gi = &ai->groups[group];
+                void *ptr = areas[group];
 
                 for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
                         if (gi->cpu_map[i] == NR_CPUS) {
@@ -1885,6 +1895,8 @@ void __init setup_per_cpu_areas(void)
         fc = __alloc_bootmem(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
         if (!ai || !fc)
                 panic("Failed to allocate memory for percpu areas.");
+        /* kmemleak tracks the percpu allocations separately */
+        kmemleak_free(fc);
 
         ai->dyn_size = unit_size;
         ai->unit_size = unit_size;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 92a857e3786d..edfd61addcec 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1215,40 +1215,40 @@ struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
         return NULL;
 }
 
-static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
+static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
                                                 u8 key_type, u8 old_key_type)
 {
         /* Legacy key */
         if (key_type < 0x03)
-                return 1;
+                return true;
 
         /* Debug keys are insecure so don't store them persistently */
         if (key_type == HCI_LK_DEBUG_COMBINATION)
-                return 0;
+                return false;
 
         /* Changed combination key and there's no previous one */
         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
-                return 0;
+                return false;
 
         /* Security mode 3 case */
         if (!conn)
-                return 1;
+                return true;
 
         /* Neither local nor remote side had no-bonding as requirement */
         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
-                return 1;
+                return true;
 
         /* Local side had dedicated bonding as requirement */
         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
-                return 1;
+                return true;
 
         /* Remote side had dedicated bonding as requirement */
         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
-                return 1;
+                return true;
 
         /* If none of the above criteria match, then don't store the key
          * persistently */
-        return 0;
+        return false;
 }
 
 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
@@ -1285,7 +1285,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 {
         struct link_key *key, *old_key;
-        u8 old_key_type, persistent;
+        u8 old_key_type;
+        bool persistent;
 
         old_key = hci_find_link_key(hdev, bdaddr);
         if (old_key) {
@@ -1328,10 +1329,8 @@ int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
 
         mgmt_new_link_key(hdev, key, persistent);
 
-        if (!persistent) {
-                list_del(&key->list);
-                kfree(key);
-        }
+        if (conn)
+                conn->flush_key = !persistent;
 
         return 0;
 }
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b37531094c49..6c065254afc0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1901,6 +1901,8 @@ static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff
         }
 
         if (ev->status == 0) {
+                if (conn->type == ACL_LINK && conn->flush_key)
+                        hci_remove_link_key(hdev, &conn->dst);
                 hci_proto_disconn_cfm(conn, ev->reason);
                 hci_conn_del(conn);
         }
@@ -2311,6 +2313,7 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
 
         case HCI_OP_USER_PASSKEY_NEG_REPLY:
                 hci_cc_user_passkey_neg_reply(hdev, skb);
+                break;
 
         case HCI_OP_LE_SET_SCAN_PARAM:
                 hci_cc_le_set_scan_param(hdev, skb);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 4ef275c69675..4bb03b111122 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2884,7 +2884,7 @@ int mgmt_write_scan_failed(struct hci_dev *hdev, u8 scan, u8 status)
         return 0;
 }
 
-int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, u8 persistent)
+int mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, bool persistent)
 {
         struct mgmt_ev_new_link_key ev;
 
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 61f65344e711..a2098e3de500 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -47,6 +47,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                 kfree_skb(skb);
         } else {
                 skb_push(skb, ETH_HLEN);
+                br_drop_fake_rtable(skb);
                 dev_queue_xmit(skb);
         }
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index dec4f3817133..d7f49b63ab0f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -156,7 +156,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->dst.dev = br->dev;
         rt->dst.path = &rt->dst;
         dst_init_metrics(&rt->dst, br_dst_default_metrics, true);
-        rt->dst.flags   = DST_NOXFRM | DST_NOPEER;
+        rt->dst.flags   = DST_NOXFRM | DST_NOPEER | DST_FAKE_RTABLE;
         rt->dst.ops = &fake_dst_ops;
 }
 
@@ -694,11 +694,7 @@ static unsigned int br_nf_local_in(unsigned int hook, struct sk_buff *skb,
                                    const struct net_device *out,
                                    int (*okfn)(struct sk_buff *))
 {
-        struct rtable *rt = skb_rtable(skb);
-
-        if (rt && rt == bridge_parent_rtable(in))
-                skb_dst_drop(skb);
-
+        br_drop_fake_rtable(skb);
         return NF_ACCEPT;
 }
 
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index 5c3c81a609e5..a7cad741df01 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -42,13 +42,14 @@ static void send_dm_alert(struct work_struct *unused);
  * netlink alerts
  */
 static int trace_state = TRACE_OFF;
-static DEFINE_SPINLOCK(trace_state_lock);
+static DEFINE_MUTEX(trace_state_mutex);
 
 struct per_cpu_dm_data {
         struct work_struct dm_alert_work;
-        struct sk_buff *skb;
+        struct sk_buff __rcu *skb;
         atomic_t dm_hit_count;
         struct timer_list send_timer;
+        int cpu;
 };
 
 struct dm_hw_stat_delta {
@@ -79,29 +80,53 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
         size_t al;
         struct net_dm_alert_msg *msg;
         struct nlattr *nla;
+        struct sk_buff *skb;
+        struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
         al += sizeof(struct nlattr);
 
-        data->skb = genlmsg_new(al, GFP_KERNEL);
-        genlmsg_put(data->skb, 0, 0, &net_drop_monitor_family,
-                        0, NET_DM_CMD_ALERT);
-        nla = nla_reserve(data->skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
-        msg = nla_data(nla);
-        memset(msg, 0, al);
-        atomic_set(&data->dm_hit_count, dm_hit_limit);
+        skb = genlmsg_new(al, GFP_KERNEL);
+
+        if (skb) {
+                genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
+                                0, NET_DM_CMD_ALERT);
+                nla = nla_reserve(skb, NLA_UNSPEC,
+                                  sizeof(struct net_dm_alert_msg));
+                msg = nla_data(nla);
+                memset(msg, 0, al);
+        } else
+                schedule_work_on(data->cpu, &data->dm_alert_work);
+
+        /*
+         * Don't need to lock this, since we are guaranteed to only
+         * run this on a single cpu at a time.
+         * Note also that we only update data->skb if the old and new skb
+         * pointers don't match.  This ensures that we don't continually call
+         * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
+         */
+        if (skb != oskb) {
+                rcu_assign_pointer(data->skb, skb);
+
+                synchronize_rcu();
+
+                atomic_set(&data->dm_hit_count, dm_hit_limit);
+        }
+
 }
 
 static void send_dm_alert(struct work_struct *unused)
 {
         struct sk_buff *skb;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+
+        WARN_ON_ONCE(data->cpu != smp_processor_id());
 
         /*
          * Grab the skb we're about to send
          */
-        skb = data->skb;
+        skb = rcu_dereference_protected(data->skb, 1);
 
         /*
          * Replace it with a new one
@@ -111,8 +136,10 @@ static void send_dm_alert(struct work_struct *unused)
         /*
          * Ship it!
          */
-        genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
+        if (skb)
+                genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
 
+        put_cpu_var(dm_cpu_data);
 }
 
 /*
@@ -123,9 +150,11 @@ static void send_dm_alert(struct work_struct *unused)
  */
 static void sched_send_work(unsigned long unused)
 {
-        struct per_cpu_dm_data *data =  &__get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data =  &get_cpu_var(dm_cpu_data);
+
+        schedule_work_on(smp_processor_id(), &data->dm_alert_work);
 
-        schedule_work(&data->dm_alert_work);
+        put_cpu_var(dm_cpu_data);
 }
 
 static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -134,8 +163,15 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         struct nlmsghdr *nlh;
         struct nlattr *nla;
         int i;
-        struct per_cpu_dm_data *data = &__get_cpu_var(dm_cpu_data);
+        struct sk_buff *dskb;
+        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+
+
+        rcu_read_lock();
+        dskb = rcu_dereference(data->skb);
 
+        if (!dskb)
+                goto out;
 
         if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
                 /*
@@ -144,7 +180,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
                 goto out;
         }
 
-        nlh = (struct nlmsghdr *)data->skb->data;
+        nlh = (struct nlmsghdr *)dskb->data;
         nla = genlmsg_data(nlmsg_data(nlh));
         msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
@@ -158,7 +194,7 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         /*
          * We need to create a new entry
          */
-        __nla_reserve_nohdr(data->skb, sizeof(struct net_dm_drop_point));
+        __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point));
         nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point));
         memcpy(msg->points[msg->entries].pc, &location, sizeof(void *));
         msg->points[msg->entries].count = 1;
@@ -170,6 +206,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         }
 
 out:
+        rcu_read_unlock();
+        put_cpu_var(dm_cpu_data);
         return;
 }
 
@@ -214,7 +252,7 @@ static int set_all_monitor_traces(int state)
         struct dm_hw_stat_delta *new_stat = NULL;
         struct dm_hw_stat_delta *temp;
 
-        spin_lock(&trace_state_lock);
+        mutex_lock(&trace_state_mutex);
 
         if (state == trace_state) {
                 rc = -EAGAIN;
@@ -253,7 +291,7 @@ static int set_all_monitor_traces(int state)
                 rc = -EINPROGRESS;
 
 out_unlock:
-        spin_unlock(&trace_state_lock);
+        mutex_unlock(&trace_state_mutex);
 
         return rc;
 }
@@ -296,12 +334,12 @@ static int dropmon_net_event(struct notifier_block *ev_block,
 
                 new_stat->dev = dev;
                 new_stat->last_rx = jiffies;
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_add_rcu(&new_stat->list, &hw_stats_list);
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         case NETDEV_UNREGISTER:
-                spin_lock(&trace_state_lock);
+                mutex_lock(&trace_state_mutex);
                 list_for_each_entry_safe(new_stat, tmp, &hw_stats_list, list) {
                         if (new_stat->dev == dev) {
                                 new_stat->dev = NULL;
@@ -312,7 +350,7 @@ static int dropmon_net_event(struct notifier_block *ev_block,
                                 }
                         }
                 }
-                spin_unlock(&trace_state_lock);
+                mutex_unlock(&trace_state_mutex);
                 break;
         }
 out:
@@ -368,13 +406,15 @@ static int __init init_net_drop_monitor(void)
 
         for_each_present_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
-                reset_per_cpu_data(data);
+                data->cpu = cpu;
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
                 init_timer(&data->send_timer);
                 data->send_timer.data = cpu;
                 data->send_timer.function = sched_send_work;
+                reset_per_cpu_data(data);
         }
 
+
         goto out;
 
 out_unreg:
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 368515885368..840821b90bcd 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -1044,6 +1044,24 @@ static void lowpan_dev_free(struct net_device *dev)
         free_netdev(dev);
 }
 
+static struct wpan_phy *lowpan_get_phy(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_phy(real_dev);
+}
+
+static u16 lowpan_get_pan_id(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_pan_id(real_dev);
+}
+
+static u16 lowpan_get_short_addr(const struct net_device *dev)
+{
+        struct net_device *real_dev = lowpan_dev_info(dev)->real_dev;
+        return ieee802154_mlme_ops(real_dev)->get_short_addr(real_dev);
+}
+
 static struct header_ops lowpan_header_ops = {
         .create = lowpan_header_create,
 };
@@ -1053,6 +1071,12 @@ static const struct net_device_ops lowpan_netdev_ops = {
         .ndo_set_mac_address    = eth_mac_addr,
 };
 
+static struct ieee802154_mlme_ops lowpan_mlme = {
+        .get_pan_id = lowpan_get_pan_id,
+        .get_phy = lowpan_get_phy,
+        .get_short_addr = lowpan_get_short_addr,
+};
+
 static void lowpan_setup(struct net_device *dev)
 {
         pr_debug("(%s)\n", __func__);
@@ -1070,6 +1094,7 @@ static void lowpan_setup(struct net_device *dev)
 
         dev->netdev_ops         = &lowpan_netdev_ops;
         dev->header_ops         = &lowpan_header_ops;
+        dev->ml_priv            = &lowpan_mlme;
         dev->destructor         = lowpan_dev_free;
 }
 
@@ -1143,6 +1168,8 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev,
         list_add_tail(&entry->list, &lowpan_devices);
         mutex_unlock(&lowpan_dev_info(dev)->dev_list_mtx);
 
+        spin_lock_init(&flist_lock);
+
         register_netdevice(dev);
 
         return 0;
@@ -1152,11 +1179,20 @@ static void lowpan_dellink(struct net_device *dev, struct list_head *head)
 {
         struct lowpan_dev_info *lowpan_dev = lowpan_dev_info(dev);
         struct net_device *real_dev = lowpan_dev->real_dev;
-        struct lowpan_dev_record *entry;
-        struct lowpan_dev_record *tmp;
+        struct lowpan_dev_record *entry, *tmp;
+        struct lowpan_fragment *frame, *tframe;
 
         ASSERT_RTNL();
 
+        spin_lock(&flist_lock);
+        list_for_each_entry_safe(frame, tframe, &lowpan_fragments, list) {
+                del_timer(&frame->timer);
+                list_del(&frame->list);
+                dev_kfree_skb(frame->skb);
+                kfree(frame);
+        }
+        spin_unlock(&flist_lock);
+
         mutex_lock(&lowpan_dev_info(dev)->dev_list_mtx);
         list_for_each_entry_safe(entry, tmp, &lowpan_devices, list) {
                 if (entry->ldev == dev) {
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8d25a1c557eb..8f8db724bfaf 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -141,7 +141,7 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
                         goto rtattr_failure;
 
         if (icsk == NULL) {
-                r->idiag_rqueue = r->idiag_wqueue = 0;
+                handler->idiag_get_info(sk, r, NULL);
                 goto out;
         }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8bb6adeb62c0..1272a88c2a63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3243,7 +3243,7 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int max_share, cnt;
+        int max_rshare, max_wshare, cnt;
         unsigned int i;
         unsigned long jiffy = jiffies;
 
@@ -3303,15 +3303,16 @@ void __init tcp_init(void)
         tcp_init_mem(&init_net);
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
         limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
-        max_share = min(4UL*1024*1024, limit);
+        max_wshare = min(4UL*1024*1024, limit);
+        max_rshare = min(6UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_wmem[1] = 16*1024;
-        sysctl_tcp_wmem[2] = max(64*1024, max_share);
+        sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
 
         sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
         sysctl_tcp_rmem[1] = 87380;
-        sysctl_tcp_rmem[2] = max(87380, max_share);
+        sysctl_tcp_rmem[2] = max(87380, max_rshare);
 
         pr_info("Hash tables configured (established %u bind %u)\n",
                 tcp_hashinfo.ehash_mask + 1, tcp_hashinfo.bhash_size);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3ff364065376..257b61789eeb 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -85,7 +85,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
 EXPORT_SYMBOL(sysctl_tcp_ecn);
 int sysctl_tcp_dsack __read_mostly = 1;
 int sysctl_tcp_app_win __read_mostly = 31;
-int sysctl_tcp_adv_win_scale __read_mostly = 2;
+int sysctl_tcp_adv_win_scale __read_mostly = 1;
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 int sysctl_tcp_stdurg __read_mostly;
@@ -495,7 +495,7 @@ static inline void tcp_rcv_rtt_measure(struct tcp_sock *tp)
                 goto new_measure;
         if (before(tp->rcv_nxt, tp->rcv_rtt_est.seq))
                 return;
-        tcp_rcv_rtt_update(tp, jiffies - tp->rcv_rtt_est.time, 1);
+        tcp_rcv_rtt_update(tp, tcp_time_stamp - tp->rcv_rtt_est.time, 1);
 
 new_measure:
         tp->rcv_rtt_est.seq = tp->rcv_nxt + tp->rcv_wnd;
@@ -2868,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
 
         /* Do not moderate cwnd if it's already undone in cwr or recovery. */
         if (tp->undo_marker) {
-                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
+                if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
                         tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
-                else /* PRR */
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                } else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
+                        /* PRR algorithm. */
                         tp->snd_cwnd = tp->snd_ssthresh;
-                tp->snd_cwnd_stamp = tcp_time_stamp;
+                        tp->snd_cwnd_stamp = tcp_time_stamp;
+                }
         }
         tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
 }
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 8a949f19deb6..a7f86a3cd502 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -146,9 +146,17 @@ static int udp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh,
         return udp_dump_one(&udp_table, in_skb, nlh, req);
 }
 
+static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
+                void *info)
+{
+        r->idiag_rqueue = sk_rmem_alloc_get(sk);
+        r->idiag_wqueue = sk_wmem_alloc_get(sk);
+}
+
 static const struct inet_diag_handler udp_diag_handler = {
         .dump            = udp_diag_dump,
         .dump_one        = udp_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDP,
 };
 
@@ -167,6 +175,7 @@ static int udplite_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *
 static const struct inet_diag_handler udplite_diag_handler = {
         .dump            = udplite_diag_dump,
         .dump_one        = udplite_diag_dump_one,
+        .idiag_get_info  = udp_diag_get_info,
         .idiag_type      = IPPROTO_UDPLITE,
 };
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 585d93ecee2d..6274f0be82b0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -442,8 +442,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
 
                 daddr = lip->l2tp_addr.s_addr;
         } else {
+                rc = -EDESTADDRREQ;
                 if (sk->sk_state != TCP_ESTABLISHED)
-                        return -EDESTADDRREQ;
+                        goto out;
 
                 daddr = inet->inet_daddr;
                 connected = 1;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index d9798a307f20..db8fae51714c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1210,7 +1210,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_reset_conn_monitor(struct ieee80211_sub_if_data *sdata);
-void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata);
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata);
 
 /* IBSS code */
 void ieee80211_ibss_notify_scan_completed(struct ieee80211_local *local);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 401c01f0731e..c20051b7ffcd 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -486,6 +486,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 /* free all potentially still buffered bcast frames */
                 local->total_ps_buffered -= skb_queue_len(&sdata->u.ap.ps_bc_buf);
                 skb_queue_purge(&sdata->u.ap.ps_bc_buf);
+        } else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
+                ieee80211_mgd_stop(sdata);
         }
 
         if (going_down)
@@ -644,8 +646,6 @@ static void ieee80211_teardown_sdata(struct net_device *dev)
 
         if (ieee80211_vif_is_mesh(&sdata->vif))
                 mesh_rmc_free(sdata);
-        else if (sdata->vif.type == NL80211_IFTYPE_STATION)
-                ieee80211_mgd_teardown(sdata);
 
         flushed = sta_info_flush(local, sdata);
         WARN_ON(flushed);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index f76da5b3f5c5..20c680bfc3ae 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3497,7 +3497,7 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         return 0;
 }
 
-void ieee80211_mgd_teardown(struct ieee80211_sub_if_data *sdata)
+void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 782a60198df4..e76facc69e95 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1158,7 +1158,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
                 tx->sta = rcu_dereference(sdata->u.vlan.sta);
                 if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
                         return TX_DROP;
-        } else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
+        } else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
+                   tx->sdata->control_port_protocol == tx->skb->protocol) {
                 tx->sta = sta_info_get_bss(sdata, hdr->addr1);
         }
         if (!tx->sta)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 2555816e7788..00bdb1d9d690 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1924,6 +1924,7 @@ protocol_fail:
 control_fail:
         ip_vs_estimator_net_cleanup(net);
 estimator_fail:
+        net->ipvs = NULL;
         return -ENOMEM;
 }
 
@@ -1936,6 +1937,7 @@ static void __net_exit __ip_vs_cleanup(struct net *net)
         ip_vs_control_net_cleanup(net);
         ip_vs_estimator_net_cleanup(net);
         IP_VS_DBG(2, "ipvs netns %d released\n", net_ipvs(net)->gen);
+        net->ipvs = NULL;
 }
 
 static void __net_exit __ip_vs_dev_cleanup(struct net *net)
@@ -1993,10 +1995,18 @@ static int __init ip_vs_init(void)
                 goto cleanup_dev;
         }
 
+        ret = ip_vs_register_nl_ioctl();
+        if (ret < 0) {
+                pr_err("can't register netlink/ioctl.\n");
+                goto cleanup_hooks;
+        }
+
         pr_info("ipvs loaded.\n");
 
         return ret;
 
+cleanup_hooks:
+        nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
 cleanup_dev:
         unregister_pernet_device(&ipvs_core_dev_ops);
 cleanup_sub:
@@ -2012,6 +2022,7 @@ exit:
 
 static void __exit ip_vs_cleanup(void)
 {
+        ip_vs_unregister_nl_ioctl();
         nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
         unregister_pernet_device(&ipvs_core_dev_ops);
         unregister_pernet_subsys(&ipvs_core_ops);       /* free ip_vs struct */
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index b3afe189af61..f5589987fc80 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3680,7 +3680,7 @@ int __net_init ip_vs_control_net_init_sysctl(struct net *net)
         return 0;
 }
 
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -3692,7 +3692,7 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
 #else
 
 int __net_init ip_vs_control_net_init_sysctl(struct net *net) { return 0; }
-void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net) { }
+void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net) { }
 
 #endif
 
@@ -3750,21 +3750,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
         free_percpu(ipvs->tot_stats.cpustats);
 }
 
-int __init ip_vs_control_init(void)
+int __init ip_vs_register_nl_ioctl(void)
 {
-        int idx;
         int ret;
 
-        EnterFunction(2);
-
-        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
-        for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
-                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
-                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
-        }
-
-        smp_wmb();      /* Do we really need it now ? */
-
         ret = nf_register_sockopt(&ip_vs_sockopts);
         if (ret) {
                 pr_err("cannot register sockopt.\n");
@@ -3776,28 +3765,47 @@ int __init ip_vs_control_init(void)
                 pr_err("cannot register Generic Netlink interface.\n");
                 goto err_genl;
         }
-
-        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
-        if (ret < 0)
-                goto err_notf;
-
-        LeaveFunction(2);
         return 0;
 
-err_notf:
-        ip_vs_genl_unregister();
 err_genl:
         nf_unregister_sockopt(&ip_vs_sockopts);
 err_sock:
         return ret;
 }
 
+void ip_vs_unregister_nl_ioctl(void)
+{
+        ip_vs_genl_unregister();
+        nf_unregister_sockopt(&ip_vs_sockopts);
+}
+
+int __init ip_vs_control_init(void)
+{
+        int idx;
+        int ret;
+
+        EnterFunction(2);
+
+        /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+        for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
+                INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+                INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+        }
+
+        smp_wmb();      /* Do we really need it now ? */
+
+        ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+        if (ret < 0)
+                return ret;
+
+        LeaveFunction(2);
+        return 0;
+}
+
 
 void ip_vs_control_cleanup(void)
 {
         EnterFunction(2);
         unregister_netdevice_notifier(&ip_vs_dst_notifier);
-        ip_vs_genl_unregister();
-        nf_unregister_sockopt(&ip_vs_sockopts);
         LeaveFunction(2);
 }
diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
index 538d74ee4f68..e39f693dd3e4 100644
--- a/net/netfilter/ipvs/ip_vs_ftp.c
+++ b/net/netfilter/ipvs/ip_vs_ftp.c
@@ -439,6 +439,8 @@ static int __net_init __ip_vs_ftp_init(struct net *net)
         struct ip_vs_app *app;
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
         app = kmemdup(&ip_vs_ftp, sizeof(struct ip_vs_app), GFP_KERNEL);
         if (!app)
                 return -ENOMEM;
diff --git a/net/netfilter/ipvs/ip_vs_lblc.c b/net/netfilter/ipvs/ip_vs_lblc.c
index 0f16283fd058..caa43704e55e 100644
--- a/net/netfilter/ipvs/ip_vs_lblc.c
+++ b/net/netfilter/ipvs/ip_vs_lblc.c
@@ -551,6 +551,9 @@ static int __net_init __ip_vs_lblc_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblc_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
diff --git a/net/netfilter/ipvs/ip_vs_lblcr.c b/net/netfilter/ipvs/ip_vs_lblcr.c
index eec797f8cce7..548bf37aa29e 100644
--- a/net/netfilter/ipvs/ip_vs_lblcr.c
+++ b/net/netfilter/ipvs/ip_vs_lblcr.c
@@ -745,6 +745,9 @@ static int __net_init __ip_vs_lblcr_init(struct net *net)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
+        if (!ipvs)
+                return -ENOENT;
+
         if (!net_eq(net, &init_net)) {
                 ipvs->lblcr_ctl_table = kmemdup(vs_vars_table,
                                                 sizeof(vs_vars_table),
diff --git a/net/netfilter/ipvs/ip_vs_proto.c b/net/netfilter/ipvs/ip_vs_proto.c
index f843a8833250..ed835e67a07e 100644
--- a/net/netfilter/ipvs/ip_vs_proto.c
+++ b/net/netfilter/ipvs/ip_vs_proto.c
@@ -59,9 +59,6 @@ static int __used __init register_ip_vs_protocol(struct ip_vs_protocol *pp)
         return 0;
 }
 
-#if defined(CONFIG_IP_VS_PROTO_TCP) || defined(CONFIG_IP_VS_PROTO_UDP) || \
-    defined(CONFIG_IP_VS_PROTO_SCTP) || defined(CONFIG_IP_VS_PROTO_AH) || \
-    defined(CONFIG_IP_VS_PROTO_ESP)
 /*
  *      register an ipvs protocols netns related data
  */
@@ -81,12 +78,18 @@ register_ip_vs_proto_netns(struct net *net, struct ip_vs_protocol *pp)
         ipvs->proto_data_table[hash] = pd;
         atomic_set(&pd->appcnt, 0);     /* Init app counter */
 
-        if (pp->init_netns != NULL)
-                pp->init_netns(net, pd);
+        if (pp->init_netns != NULL) {
+                int ret = pp->init_netns(net, pd);
+                if (ret) {
+                        /* unlink an free proto data */
+                        ipvs->proto_data_table[hash] = pd->next;
+                        kfree(pd);
+                        return ret;
+                }
+        }
 
         return 0;
 }
-#endif
 
 /*
  *      unregister an ipvs protocol
@@ -316,22 +319,35 @@ ip_vs_tcpudp_debug_packet(int af, struct ip_vs_protocol *pp,
  */
 int __net_init ip_vs_protocol_net_init(struct net *net)
 {
+        int i, ret;
+        static struct ip_vs_protocol *protos[] = {
 #ifdef CONFIG_IP_VS_PROTO_TCP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_tcp);
+        &ip_vs_protocol_tcp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_UDP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_udp);
+        &ip_vs_protocol_udp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_SCTP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_sctp);
+        &ip_vs_protocol_sctp,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_AH
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_ah);
+        &ip_vs_protocol_ah,
 #endif
 #ifdef CONFIG_IP_VS_PROTO_ESP
-        register_ip_vs_proto_netns(net, &ip_vs_protocol_esp);
+        &ip_vs_protocol_esp,
 #endif
+        };
+
+        for (i = 0; i < ARRAY_SIZE(protos); i++) {
+                ret = register_ip_vs_proto_netns(net, protos[i]);
+                if (ret < 0)
+                        goto cleanup;
+        }
         return 0;
+
+cleanup:
+        ip_vs_protocol_net_cleanup(net);
+        return ret;
 }
 
 void __net_exit ip_vs_protocol_net_cleanup(struct net *net)
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 1fbf7a2816f5..9f3fb751c491 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -1090,7 +1090,7 @@ out:
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -1098,6 +1098,9 @@ static void __ip_vs_sctp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->sctp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)sctp_timeouts,
                                                         sizeof(sctp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __ip_vs_sctp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index ef8641f7af83..cd609cc62721 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -677,7 +677,7 @@ void ip_vs_tcp_conn_listen(struct net *net, struct ip_vs_conn *cp)
  *   timeouts is netns related now.
  * ---------------------------------------------
  */
-static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -685,7 +685,10 @@ static void __ip_vs_tcp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->tcp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)tcp_timeouts,
                                                         sizeof(tcp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
         pd->tcp_state_table =  tcp_states;
+        return 0;
 }
 
 static void __ip_vs_tcp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index f4b7262896bb..2fedb2dcb3d1 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -467,7 +467,7 @@ udp_state_transition(struct ip_vs_conn *cp, int direction,
         cp->timeout = pd->timeout_table[IP_VS_UDP_S_NORMAL];
 }
 
-static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
+static int __udp_init(struct net *net, struct ip_vs_proto_data *pd)
 {
         struct netns_ipvs *ipvs = net_ipvs(net);
 
@@ -475,6 +475,9 @@ static void __udp_init(struct net *net, struct ip_vs_proto_data *pd)
         spin_lock_init(&ipvs->udp_app_lock);
         pd->timeout_table = ip_vs_create_timeout_table((int *)udp_timeouts,
                                                         sizeof(udp_timeouts));
+        if (!pd->timeout_table)
+                return -ENOMEM;
+        return 0;
 }
 
 static void __udp_exit(struct net *net, struct ip_vs_proto_data *pd)
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 59530e93fa58..3746d8b9a478 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -227,7 +227,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
         }
 
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
-        if (info->timeout) {
+        if (info->timeout[0]) {
                 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
                 struct nf_conn_timeout *timeout_ext;
 
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 5da548fa7ae9..ebd22966f748 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -408,10 +408,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
                 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
                     (skb->ip_summed == CHECKSUM_PARTIAL &&
-                     skb_checksum_help(skb))) {
-                        sch->qstats.drops++;
-                        return NET_XMIT_DROP;
-                }
+                     skb_checksum_help(skb)))
+                        return qdisc_drop(skb, sch);
 
                 skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
         }
diff --git a/net/sunrpc/auth_gss/gss_mech_switch.c b/net/sunrpc/auth_gss/gss_mech_switch.c
index ca8cad8251c7..782bfe1b6465 100644
--- a/net/sunrpc/auth_gss/gss_mech_switch.c
+++ b/net/sunrpc/auth_gss/gss_mech_switch.c
@@ -242,12 +242,13 @@ EXPORT_SYMBOL_GPL(gss_mech_get_by_pseudoflavor);
 int gss_mech_list_pseudoflavors(rpc_authflavor_t *array_ptr)
 {
         struct gss_api_mech *pos = NULL;
-        int i = 0;
+        int j, i = 0;
 
         spin_lock(&registered_mechs_lock);
         list_for_each_entry(pos, &registered_mechs, gm_list) {
-                array_ptr[i] = pos->gm_pfs->pseudoflavor;
-                i++;
+                for (j=0; j < pos->gm_pf_num; j++) {
+                        array_ptr[i++] = pos->gm_pfs[j].pseudoflavor;
+                }
         }
         spin_unlock(&registered_mechs_lock);
         return i;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 67972462a543..adf2990acebf 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -176,16 +176,22 @@ rpc_setup_pipedir(struct rpc_clnt *clnt, const char *dir_name)
         return 0;
 }
 
-static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
-                                struct super_block *sb)
+static inline int rpc_clnt_skip_event(struct rpc_clnt *clnt, unsigned long event)
+{
+        if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
+            ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                return 1;
+        return 0;
+}
+
+static int __rpc_clnt_handle_event(struct rpc_clnt *clnt, unsigned long event,
+                                   struct super_block *sb)
 {
         struct dentry *dentry;
         int err = 0;
 
         switch (event) {
         case RPC_PIPEFS_MOUNT:
-                if (clnt->cl_program->pipe_dir_name == NULL)
-                        break;
                 dentry = rpc_setup_pipedir_sb(sb, clnt,
                                               clnt->cl_program->pipe_dir_name);
                 BUG_ON(dentry == NULL);
@@ -208,6 +214,20 @@ static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
         return err;
 }
 
+static int __rpc_pipefs_event(struct rpc_clnt *clnt, unsigned long event,
+                                struct super_block *sb)
+{
+        int error = 0;
+
+        for (;; clnt = clnt->cl_parent) {
+                if (!rpc_clnt_skip_event(clnt, event))
+                        error = __rpc_clnt_handle_event(clnt, event, sb);
+                if (error || clnt == clnt->cl_parent)
+                        break;
+        }
+        return error;
+}
+
 static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 {
         struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
@@ -215,10 +235,12 @@ static struct rpc_clnt *rpc_get_client_for_event(struct net *net, int event)
 
         spin_lock(&sn->rpc_client_lock);
         list_for_each_entry(clnt, &sn->all_clients, cl_clients) {
-                if (((event == RPC_PIPEFS_MOUNT) && clnt->cl_dentry) ||
-                    ((event == RPC_PIPEFS_UMOUNT) && !clnt->cl_dentry))
+                if (clnt->cl_program->pipe_dir_name == NULL)
+                        break;
+                if (rpc_clnt_skip_event(clnt, event))
+                        continue;
+                if (atomic_inc_not_zero(&clnt->cl_count) == 0)
                         continue;
-                atomic_inc(&clnt->cl_count);
                 spin_unlock(&sn->rpc_client_lock);
                 return clnt;
         }
@@ -257,6 +279,14 @@ void rpc_clients_notifier_unregister(void)
         return rpc_pipefs_notifier_unregister(&rpc_clients_block);
 }
 
+static void rpc_clnt_set_nodename(struct rpc_clnt *clnt, const char *nodename)
+{
+        clnt->cl_nodelen = strlen(nodename);
+        if (clnt->cl_nodelen > UNX_MAXNODENAME)
+                clnt->cl_nodelen = UNX_MAXNODENAME;
+        memcpy(clnt->cl_nodename, nodename, clnt->cl_nodelen);
+}
+
 static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, struct rpc_xprt *xprt)
 {
         const struct rpc_program *program = args->program;
@@ -337,10 +367,7 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
         }
 
         /* save the nodename */
-        clnt->cl_nodelen = strlen(init_utsname()->nodename);
-        if (clnt->cl_nodelen > UNX_MAXNODENAME)
-                clnt->cl_nodelen = UNX_MAXNODENAME;
-        memcpy(clnt->cl_nodename, init_utsname()->nodename, clnt->cl_nodelen);
+        rpc_clnt_set_nodename(clnt, utsname()->nodename);
         rpc_register_client(clnt);
         return clnt;
 
@@ -499,6 +526,7 @@ rpc_clone_client(struct rpc_clnt *clnt)
         err = rpc_setup_pipedir(new, clnt->cl_program->pipe_dir_name);
         if (err != 0)
                 goto out_no_path;
+        rpc_clnt_set_nodename(new, utsname()->nodename);
         if (new->cl_auth)
                 atomic_inc(&new->cl_auth->au_count);
         atomic_inc(&clnt->cl_count);
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 0af37fc46818..3b62cf288031 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -1126,19 +1126,20 @@ rpc_fill_super(struct super_block *sb, void *data, int silent)
                 return -ENOMEM;
         dprintk("RPC:   sending pipefs MOUNT notification for net %p%s\n", net,
                                                                 NET_NAME(net));
+        sn->pipefs_sb = sb;
         err = blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_MOUNT,
                                            sb);
         if (err)
                 goto err_depopulate;
         sb->s_fs_info = get_net(net);
-        sn->pipefs_sb = sb;
         return 0;
 
 err_depopulate:
         blocking_notifier_call_chain(&rpc_pipefs_notifier_list,
                                            RPC_PIPEFS_UMOUNT,
                                            sb);
+        sn->pipefs_sb = NULL;
         __rpc_depopulate(root, files, RPCAUTH_lockd, RPCAUTH_RootEOF);
         return err;
 }
diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
index 64417a733220..d8c670c9d62c 100644
--- a/sound/pci/echoaudio/echoaudio_dsp.c
+++ b/sound/pci/echoaudio/echoaudio_dsp.c
@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip)
         const struct firmware *fw;
         int box_type, err;
 
-        if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
+        if (snd_BUG_ON(!chip->comm_page))
                 return -EPERM;
 
         /* See if the ASIC is present and working - only if the DSP is already loaded */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 7a8fcc4c15f8..841475cc13b6 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -5444,10 +5444,6 @@ int snd_hda_suspend(struct hda_bus *bus)
         list_for_each_entry(codec, &bus->codec_list, list) {
                 if (hda_codec_is_power_on(codec))
                         hda_call_codec_suspend(codec);
-                else /* forcibly change the power to D3 even if not used */
-                        hda_set_power_state(codec,
-                                            codec->afg ? codec->afg : codec->mfg,
-                                            AC_PWRST_D3);
                 if (codec->patch_ops.post_suspend)
                         codec->patch_ops.post_suspend(codec);
         }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index c19e71a94e1b..1f350522bed4 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -783,11 +783,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
 {
         struct azx *chip = bus->private_data;
         unsigned long timeout;
+        unsigned long loopcounter;
         int do_poll = 0;
 
  again:
         timeout = jiffies + msecs_to_jiffies(1000);
-        for (;;) {
+
+        for (loopcounter = 0;; loopcounter++) {
                 if (chip->polling_mode || do_poll) {
                         spin_lock_irq(&chip->reg_lock);
                         azx_update_rirb(chip);
@@ -803,7 +805,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
                 }
                 if (time_after(jiffies, timeout))
                         break;
-                if (bus->needs_damn_long_delay)
+                if (bus->needs_damn_long_delay || loopcounter > 3000)
                         msleep(2); /* temporary workaround */
                 else {
                         udelay(10);
@@ -2351,6 +2353,17 @@ static void azx_power_notify(struct hda_bus *bus)
  * power management
  */
 
+static int snd_hda_codecs_inuse(struct hda_bus *bus)
+{
+        struct hda_codec *codec;
+
+        list_for_each_entry(codec, &bus->codec_list, list) {
+                if (snd_hda_codec_needs_resume(codec))
+                        return 1;
+        }
+        return 0;
+}
+
 static int azx_suspend(struct pci_dev *pci, pm_message_t state)
 {
         struct snd_card *card = pci_get_drvdata(pci);
@@ -2397,7 +2410,8 @@ static int azx_resume(struct pci_dev *pci)
                 return -EIO;
         azx_init_pci(chip);
 
-        azx_init_chip(chip, 1);
+        if (snd_hda_codecs_inuse(chip->bus))
+                azx_init_chip(chip, 1);
 
         snd_hda_resume(chip->bus);
         snd_power_change_state(card, SNDRV_CTL_POWER_D0);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 818f90bc7d57..7810913d07a0 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5405,6 +5405,8 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1025, 0x0142, "Acer Aspire 7730G",
                       ALC882_FIXUP_ACER_ASPIRE_4930G),
         SND_PCI_QUIRK(0x1025, 0x0155, "Packard-Bell M5120", ALC882_FIXUP_PB_M5210),
+        SND_PCI_QUIRK(0x1025, 0x021e, "Acer Aspire 5739G",
+                      ALC882_FIXUP_ACER_ASPIRE_4930G),
         SND_PCI_QUIRK(0x1025, 0x0259, "Acer Aspire 5935", ALC889_FIXUP_DAC_ROUTE),
         SND_PCI_QUIRK(0x1025, 0x026b, "Acer Aspire 8940G", ALC882_FIXUP_ACER_ASPIRE_8930G),
         SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", ALC882_FIXUP_ACER_ASPIRE_7736),
@@ -5438,6 +5440,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
         SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
 
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+        SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
         SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3", ALC889_FIXUP_CD),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
@@ -5638,13 +5641,13 @@ static int patch_alc262(struct hda_codec *codec)
         snd_hda_codec_write(codec, 0x1a, 0, AC_VERB_SET_PROC_COEF, tmp | 0x80);
         }
 #endif
-        alc_auto_parse_customize_define(codec);
-
         alc_fix_pll_init(codec, 0x20, 0x0a, 10);
 
         alc_pick_fixup(codec, NULL, alc262_fixup_tbl, alc262_fixups);
         alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
 
+        alc_auto_parse_customize_define(codec);
+
         /* automatic parse from the BIOS config */
         err = alc262_parse_auto_config(codec);
         if (err < 0)
@@ -6249,8 +6252,6 @@ static int patch_alc269(struct hda_codec *codec)
 
         spec->mixer_nid = 0x0b;
 
-        alc_auto_parse_customize_define(codec);
-
         err = alc_codec_rename_from_preset(codec);
         if (err < 0)
                 goto error;
@@ -6283,6 +6284,8 @@ static int patch_alc269(struct hda_codec *codec)
                        alc269_fixup_tbl, alc269_fixups);
         alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
 
+        alc_auto_parse_customize_define(codec);
+
         /* automatic parse from the BIOS config */
         err = alc269_parse_auto_config(codec);
         if (err < 0)
@@ -6859,8 +6862,6 @@ static int patch_alc662(struct hda_codec *codec)
         /* handle multiple HPs as is */
         spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
 
-        alc_auto_parse_customize_define(codec);
-
         alc_fix_pll_init(codec, 0x20, 0x04, 15);
 
         err = alc_codec_rename_from_preset(codec);
@@ -6877,6 +6878,9 @@ static int patch_alc662(struct hda_codec *codec)
         alc_pick_fixup(codec, alc662_fixup_models,
                        alc662_fixup_tbl, alc662_fixups);
         alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE);
+
+        alc_auto_parse_customize_define(codec);
+
         /* automatic parse from the BIOS config */
         err = alc662_parse_auto_config(codec);
         if (err < 0)
diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
index b68cdec03b9e..0b2aea2ce172 100644
--- a/sound/pci/rme9652/hdsp.c
+++ b/sound/pci/rme9652/hdsp.c
@@ -5170,6 +5170,7 @@ static int snd_hdsp_create_hwdep(struct snd_card *card, struct hdsp *hdsp)
         strcpy(hw->name, "HDSP hwdep interface");
 
         hw->ops.ioctl = snd_hdsp_hwdep_ioctl;
+        hw->ops.ioctl_compat = snd_hdsp_hwdep_ioctl;
 
         return 0;
 }
diff --git a/sound/soc/blackfin/bf5xx-ssm2602.c b/sound/soc/blackfin/bf5xx-ssm2602.c
index df3ac73f8778..b39ad356b92b 100644
--- a/sound/soc/blackfin/bf5xx-ssm2602.c
+++ b/sound/soc/blackfin/bf5xx-ssm2602.c
@@ -99,6 +99,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai[] = {
                 .platform_name = "bfin-i2s-pcm-audio",
                 .codec_name = "ssm2602.0-001b",
                 .ops = &bf5xx_ssm2602_ops,
+                .dai_fmt = BF5XX_SSM2602_DAIFMT,
         },
         {
                 .name = "ssm2602",
@@ -108,6 +109,7 @@ static struct snd_soc_dai_link bf5xx_ssm2602_dai[] = {
                 .platform_name = "bfin-i2s-pcm-audio",
                 .codec_name = "ssm2602.0-001b",
                 .ops = &bf5xx_ssm2602_ops,
+                .dai_fmt = BF5XX_SSM2602_DAIFMT,
         },
 };
 
diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
index 16d55f91a653..df1e07ffac32 100644
--- a/sound/soc/codecs/tlv320aic23.c
+++ b/sound/soc/codecs/tlv320aic23.c
@@ -472,7 +472,7 @@ static int tlv320aic23_set_dai_sysclk(struct snd_soc_dai *codec_dai,
 static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
                                       enum snd_soc_bias_level level)
 {
-        u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0xff7f;
+        u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0x17f;
 
         switch (level) {
         case SND_SOC_BIAS_ON:
@@ -491,7 +491,7 @@ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
         case SND_SOC_BIAS_OFF:
                 /* everything off, dac mute, inactive */
                 snd_soc_write(codec, TLV320AIC23_ACTIVE, 0x0);
-                snd_soc_write(codec, TLV320AIC23_PWR, 0xffff);
+                snd_soc_write(codec, TLV320AIC23_PWR, 0x1ff);
                 break;
         }
         codec->dapm.bias_level = level;
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index 8c4c9591ec05..aa12c6b6beeb 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -60,7 +60,7 @@ struct wm8350_jack_data {
 };
 
 struct wm8350_data {
-        struct snd_soc_codec codec;
+        struct wm8350 *wm8350;
         struct wm8350_output out1;
         struct wm8350_output out2;
         struct wm8350_jack_data hpl;
@@ -1309,7 +1309,7 @@ static void wm8350_hp_work(struct wm8350_data *priv,
                            struct wm8350_jack_data *jack,
                            u16 mask)
 {
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         u16 reg;
         int report;
 
@@ -1342,7 +1342,7 @@ static void wm8350_hpr_work(struct work_struct *work)
 static irqreturn_t wm8350_hp_jack_handler(int irq, void *data)
 {
         struct wm8350_data *priv = data;
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         struct wm8350_jack_data *jack = NULL;
 
         switch (irq - wm8350->irq_base) {
@@ -1427,7 +1427,7 @@ EXPORT_SYMBOL_GPL(wm8350_hp_jack_detect);
 static irqreturn_t wm8350_mic_handler(int irq, void *data)
 {
         struct wm8350_data *priv = data;
-        struct wm8350 *wm8350 = priv->codec.control_data;
+        struct wm8350 *wm8350 = priv->wm8350;
         u16 reg;
         int report = 0;
 
@@ -1536,6 +1536,8 @@ static  int wm8350_codec_probe(struct snd_soc_codec *codec)
                 return -ENOMEM;
         snd_soc_codec_set_drvdata(codec, priv);
 
+        priv->wm8350 = wm8350;
+
         for (i = 0; i < ARRAY_SIZE(supply_names); i++)
                 priv->supplies[i].supply = supply_names[i];
 
@@ -1544,7 +1546,6 @@ static  int wm8350_codec_probe(struct snd_soc_codec *codec)
         if (ret != 0)
                 return ret;
 
-        wm8350->codec.codec = codec;
         codec->control_data = wm8350;
 
         /* Put the codec into reset if it wasn't already */
diff --git a/sound/soc/codecs/wm_hubs.c b/sound/soc/codecs/wm_hubs.c
index f13f2886339c..6c028c470601 100644
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -1035,7 +1035,7 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
                             enum snd_soc_bias_level level)
 {
         struct wm_hubs_data *hubs = snd_soc_codec_get_drvdata(codec);
-        int val;
+        int mask, val;
 
         switch (level) {
         case SND_SOC_BIAS_STANDBY:
@@ -1047,6 +1047,13 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
         case SND_SOC_BIAS_ON:
                 /* Turn off any unneded single ended outputs */
                 val = 0;
+                mask = 0;
+
+                if (hubs->lineout1_se)
+                        mask |= WM8993_LINEOUT1N_ENA | WM8993_LINEOUT1P_ENA;
+
+                if (hubs->lineout2_se)
+                        mask |= WM8993_LINEOUT2N_ENA | WM8993_LINEOUT2P_ENA;
 
                 if (hubs->lineout1_se && hubs->lineout1n_ena)
                         val |= WM8993_LINEOUT1N_ENA;
@@ -1061,11 +1068,7 @@ void wm_hubs_set_bias_level(struct snd_soc_codec *codec,
                         val |= WM8993_LINEOUT2P_ENA;
 
                 snd_soc_update_bits(codec, WM8993_POWER_MANAGEMENT_3,
-                                    WM8993_LINEOUT1N_ENA |
-                                    WM8993_LINEOUT1P_ENA |
-                                    WM8993_LINEOUT2N_ENA |
-                                    WM8993_LINEOUT2P_ENA,
-                                    val);
+                                    mask, val);
 
                 /* Remove the input clamps */
                 snd_soc_update_bits(codec, WM8993_INPUTS_CLAMP_REG,
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index a59bd352d342..5a649da9122a 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -401,6 +401,10 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
         }
 
 out:
+        /* free preallocated buffers in case of error */
+        if (ret)
+                omap_pcm_free_dma_buffers(pcm);
+
         return ret;
 }
 
diff --git a/sound/soc/samsung/s3c2412-i2s.c b/sound/soc/samsung/s3c2412-i2s.c
index 72185078ddf8..79fbeea99d46 100644
--- a/sound/soc/samsung/s3c2412-i2s.c
+++ b/sound/soc/samsung/s3c2412-i2s.c
@@ -166,7 +166,7 @@ static struct snd_soc_dai_driver s3c2412_i2s_dai = {
 
 static __devinit int s3c2412_iis_dev_probe(struct platform_device *pdev)
 {
-        return snd_soc_register_dai(&pdev->dev, &s3c2412_i2s_dai);
+        return s3c_i2sv2_register_dai(&pdev->dev, -1, &s3c2412_i2s_dai);
 }
 
 static __devexit int s3c2412_iis_dev_remove(struct platform_device *pdev)
diff --git a/sound/soc/sh/migor.c b/sound/soc/sh/migor.c
index 9d9ad8d61c0a..8526e1edaf45 100644
--- a/sound/soc/sh/migor.c
+++ b/sound/soc/sh/migor.c
@@ -35,7 +35,7 @@ static unsigned long siumckb_recalc(struct clk *clk)
         return codec_freq;
 }
 
-static struct clk_ops siumckb_clk_ops = {
+static struct sh_clk_ops siumckb_clk_ops = {
         .recalc = siumckb_recalc,
 };
 
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 1d6a80c9f4c2..c88d9741b9e7 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -3625,10 +3625,10 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card,
         int i, ret;
 
         num_routes = of_property_count_strings(np, propname);
-        if (num_routes & 1) {
+        if (num_routes < 0 || num_routes & 1) {
                 dev_err(card->dev,
-                        "Property '%s's length is not even\n",
-                        propname);
+                     "Property '%s' does not exist or its length is not even\n",
+                     propname);
                 return -EINVAL;
         }
         num_routes /= 2;
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 95d6a6f7c33a..4915408f6a98 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -183,6 +183,9 @@ my %force_config;
 # do not force reboots on config problems
 my $no_reboot = 1;
 
+# reboot on success
+my $reboot_success = 0;
+
 my %option_map = (
     "MACHINE"                   => \$machine,
     "SSH_USER"                  => \$ssh_user,
@@ -2192,7 +2195,7 @@ sub run_bisect {
     }
 
     # Are we looking for where it worked, not failed?
-    if ($reverse_bisect) {
+    if ($reverse_bisect && $ret >= 0) {
         $ret = !$ret;
     }
 
@@ -3469,6 +3472,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
     # Do not reboot on failing test options
     $no_reboot = 1;
+    $reboot_success = 0;
 
     $iteration = $i;
 
@@ -3554,9 +3558,11 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
             die "failed to checkout $checkout";
     }
 
+    $no_reboot = 0;
+
     # A test may opt to not reboot the box
     if ($reboot_on_success) {
-        $no_reboot = 0;
+        $reboot_success = 1;
     }
 
     if ($test_type eq "bisect") {
@@ -3600,7 +3606,7 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
 
 if ($opt{"POWEROFF_ON_SUCCESS"}) {
     halt;
-} elsif ($opt{"REBOOT_ON_SUCCESS"} && !do_not_reboot) {
+} elsif ($opt{"REBOOT_ON_SUCCESS"} && !do_not_reboot && $reboot_success) {
     reboot_to_good;
 } elsif (defined($switch_to_good)) {
     # still need to get to the good kernel