581 files changed, 4066 insertions, 2423 deletions

diff --git a/Documentation/devicetree/bindings/gpio/led.txt b/Documentation/devicetree/bindings/gpio/led.txt
index 141087cf3107..fd2bd56e7195 100644
--- a/Documentation/devicetree/bindings/gpio/led.txt
+++ b/Documentation/devicetree/bindings/gpio/led.txt
@@ -7,9 +7,9 @@ Each LED is represented as a sub-node of the gpio-leds device.  Each
 node's name represents the name of the corresponding LED.
 
 LED sub-node properties:
-- gpios :  Should specify the LED's GPIO, see "Specifying GPIO information
-  for devices" in Documentation/devicetree/booting-without-of.txt.  Active
-  low LEDs should be indicated using flags in the GPIO specifier.
+- gpios :  Should specify the LED's GPIO, see "gpios property" in
+  Documentation/devicetree/gpio.txt.  Active low LEDs should be
+  indicated using flags in the GPIO specifier.
 - label :  (optional) The label for this LED.  If omitted, the label is
   taken from the node name (excluding the unit address).
 - linux,default-trigger :  (optional) This parameter, if present, is a
diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
index ecc6a6cd26c1..a20008ab319a 100644
--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
@@ -30,6 +30,7 @@ national	National Semiconductor
 nintendo        Nintendo
 nvidia  NVIDIA
 nxp     NXP Semiconductors
+picochip        Picochip Ltd
 powervr Imagination Technologies
 qcom    Qualcomm, Inc.
 ramtron Ramtron International
diff --git a/Documentation/hwmon/jc42 b/Documentation/hwmon/jc42
index a22ecf48f255..52729a756c1b 100644
--- a/Documentation/hwmon/jc42
+++ b/Documentation/hwmon/jc42
@@ -7,21 +7,29 @@ Supported chips:
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
         http://www.analog.com/static/imported-files/data_sheets/ADT7408.pdf
-  * IDT TSE2002B3, TS3000B3
-    Prefix: 'tse2002b3', 'ts3000b3'
+  * Atmel AT30TS00
+    Prefix: 'at30ts00'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
-        http://www.idt.com/products/getdoc.cfm?docid=18715691
-        http://www.idt.com/products/getdoc.cfm?docid=18715692
+        http://www.atmel.com/Images/doc8585.pdf
+  * IDT TSE2002B3, TSE2002GB2, TS3000B3, TS3000GB2
+    Prefix: 'tse2002', 'ts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002B3C_DST_20100512_120303152056.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TSE2002GB2A1_DST_20111107_120303145914.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000B3A_DST_20101129_120303152013.pdf
+        http://www.idt.com/sites/default/files/documents/IDT_TS3000GB2A1_DST_20111104_120303151012.pdf
   * Maxim MAX6604
     Prefix: 'max6604'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
         http://datasheets.maxim-ic.com/en/ds/MAX6604.pdf
-  * Microchip MCP9805, MCP98242, MCP98243, MCP9843
-    Prefixes: 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
+  * Microchip MCP9804, MCP9805, MCP98242, MCP98243, MCP9843
+    Prefixes: 'mcp9804', 'mcp9805', 'mcp98242', 'mcp98243', 'mcp9843'
     Addresses scanned: I2C 0x18 - 0x1f
     Datasheets:
+        http://ww1.microchip.com/downloads/en/DeviceDoc/22203C.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/21977b.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/21996a.pdf
         http://ww1.microchip.com/downloads/en/DeviceDoc/22153c.pdf
@@ -48,6 +56,12 @@ Supported chips:
     Datasheets:
         http://www.st.com/stonline/products/literature/ds/13447/stts424.pdf
         http://www.st.com/stonline/products/literature/ds/13448/stts424e02.pdf
+  * ST Microelectronics STTS2002, STTS3000
+    Prefix: 'stts2002', 'stts3000'
+    Addresses scanned: I2C 0x18 - 0x1f
+    Datasheets:
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATASHEET/CD00225278.pdf
+        http://www.st.com/internet/com/TECHNICAL_RESOURCES/TECHNICAL_LITERATURE/DATA_BRIEF/CD00270920.pdf
   * JEDEC JC 42.4 compliant temperature sensor chips
     Prefix: 'jc42'
     Addresses scanned: I2C 0x18 - 0x1f
diff --git a/Documentation/input/alps.txt b/Documentation/input/alps.txt
index f274c28b5103..2f95308251d4 100644
--- a/Documentation/input/alps.txt
+++ b/Documentation/input/alps.txt
@@ -13,7 +13,8 @@ Detection
 
 All ALPS touchpads should respond to the "E6 report" command sequence:
 E8-E6-E6-E6-E9. An ALPS touchpad should respond with either 00-00-0A or
-00-00-64.
+00-00-64 if no buttons are pressed. The bits 0-2 of the first byte will be 1s
+if some buttons are pressed.
 
 If the E6 report is successful, the touchpad model is identified using the "E7
 report" sequence: E8-E7-E7-E7-E9. The response is the model signature and is
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 033d4e69b43b..d99fd9c0ec0e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2211,6 +2211,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
 
                         default: off.
 
+        printk.always_kmsg_dump=
+                        Trigger kmsg_dump for cases other than kernel oops or
+                        panics
+                        Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
+                        default: disabled
+
         printk.time=    Show timing data prefixed to each printk message line
                         Format: <bool>  (1/Y/y=enable, 0/N/n=disable)
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 9a648eb8e213..3321d75c6c7f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -269,7 +269,6 @@ S:	Orphan
 F:      drivers/platform/x86/wmi.c
 
 AD1889 ALSA SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 M:      Thibaut Varene <T-Bone@parisc-linux.org>
 W:      http://wiki.parisc-linux.org/AD1889
 L:      linux-parisc@vger.kernel.org
@@ -963,7 +962,7 @@ F:	drivers/tty/serial/msm_serial.c
 F:      drivers/platform/msm/
 F:      drivers/*/pm8???-*
 F:      include/linux/mfd/pm8xxx/
-T:      git git://codeaurora.org/quic/kernel/davidb/linux-msm.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/davidb/linux-msm.git
 S:      Maintained
 
 ARM/TOSA MACHINE SUPPORT
@@ -1311,7 +1310,7 @@ F:	drivers/atm/
 F:      include/linux/atm*
 
 ATMEL AT91 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.atmel.com/products/AT91/
 W:      http://www.at91.com/
@@ -1319,7 +1318,7 @@ S:	Maintained
 F:      drivers/mmc/host/at91_mci.c
 
 ATMEL AT91 / AT32 MCI DRIVER
-M:      Nicolas Ferre <nicolas.ferre@atmel.com>
+M:      Ludovic Desroches <ludovic.desroches@atmel.com>
 S:      Maintained
 F:      drivers/mmc/host/atmel-mci.c
 F:      drivers/mmc/host/atmel-mci-regs.h
@@ -3047,7 +3046,6 @@ F:	drivers/hwspinlock/hwspinlock_*
 F:      include/linux/hwspinlock.h
 
 HARMONY SOUND DRIVER
-M:      Kyle McMartin <kyle@mcmartin.ca>
 L:      linux-parisc@vger.kernel.org
 S:      Maintained
 F:      sound/parisc/harmony.*
@@ -3782,7 +3780,7 @@ F:	Documentation/kdump/
 
 KERNEL AUTOMOUNTER v4 (AUTOFS4)
 M:      Ian Kent <raven@themaw.net>
-L:      autofs@linux.kernel.org
+L:      autofs@vger.kernel.org
 S:      Maintained
 F:      fs/autofs4/
 
@@ -4687,7 +4685,7 @@ NTFS FILESYSTEM
 M:      Anton Altaparmakov <anton@tuxera.com>
 L:      linux-ntfs-dev@lists.sourceforge.net
 W:      http://www.tuxera.com/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs-2.6.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs.git
 S:      Supported
 F:      Documentation/filesystems/ntfs.txt
 F:      fs/ntfs/
@@ -5000,9 +4998,8 @@ F:	Documentation/blockdev/paride.txt
 F:      drivers/block/paride/
 
 PARISC ARCHITECTURE
-M:      Kyle McMartin <kyle@mcmartin.ca>
-M:      Helge Deller <deller@gmx.de>
 M:      "James E.J. Bottomley" <jejb@parisc-linux.org>
+M:      Helge Deller <deller@gmx.de>
 L:      linux-parisc@vger.kernel.org
 W:      http://www.parisc-linux.org/
 Q:      http://patchwork.kernel.org/project/linux-parisc/list/
@@ -5861,7 +5858,7 @@ S:	Maintained
 F:      drivers/mmc/host/sdhci-spear.c
 
 SECURITY SUBSYSTEM
-M:      James Morris <jmorris@namei.org>
+M:      James Morris <james.l.morris@oracle.com>
 L:      linux-security-module@vger.kernel.org (suggested Cc:)
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git
 W:      http://security.wiki.kernel.org/
@@ -5874,7 +5871,7 @@ S:	Supported
 
 SELINUX SECURITY MODULE
 M:      Stephen Smalley <sds@tycho.nsa.gov>
-M:      James Morris <jmorris@namei.org>
+M:      James Morris <james.l.morris@oracle.com>
 M:      Eric Paris <eparis@parisplace.org>
 L:      selinux@tycho.nsa.gov (subscribers-only, general discussion)
 W:      http://selinuxproject.org
@@ -7274,7 +7271,7 @@ WATCHDOG DEVICE DRIVERS
 M:      Wim Van Sebroeck <wim@iguana.be>
 L:      linux-watchdog@vger.kernel.org
 W:      http://www.linux-watchdog.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog.git
+T:      git git://www.linux-watchdog.org/linux-watchdog.git
 S:      Maintained
 F:      Documentation/watchdog/
 F:      drivers/watchdog/
diff --git a/Makefile b/Makefile
index 4ddd641ab615..56d481727c30 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 3
 SUBLEVEL = 0
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc7
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/alpha/include/asm/futex.h b/arch/alpha/include/asm/futex.h
index e8a761aee088..f939794363ac 100644
--- a/arch/alpha/include/asm/futex.h
+++ b/arch/alpha/include/asm/futex.h
@@ -108,7 +108,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
         "       lda     $31,3b-2b(%0)\n"
         "       .previous\n"
         :       "+r"(ret), "=&r"(prev), "=&r"(cmp)
-        :       "r"(uaddr), "r"((long)oldval), "r"(newval)
+        :       "r"(uaddr), "r"((long)(int)oldval), "r"(newval)
         :       "memory");
 
         *uval = prev;
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index a48aecc17eac..dfb0312f4e73 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1280,7 +1280,7 @@ config ARM_ERRATA_743622
         depends on CPU_V7
         help
           This option enables the workaround for the 743622 Cortex-A9
-          (r2p0..r2p2) erratum. Under very rare conditions, a faulty
+          (r2p*) erratum. Under very rare conditions, a faulty
           optimisation in the Cortex-A9 Store Buffer may lead to data
           corruption. This workaround sets a specific bit in the diagnostic
           register of the Cortex-A9 which disables the Store Buffer
diff --git a/arch/arm/boot/.gitignore b/arch/arm/boot/.gitignore
index ce1c5ff746e7..3c79f85975aa 100644
--- a/arch/arm/boot/.gitignore
+++ b/arch/arm/boot/.gitignore
@@ -3,3 +3,4 @@ zImage
 xipImage
 bootpImage
 uImage
+*.dtb
diff --git a/arch/arm/common/it8152.c b/arch/arm/common/it8152.c
index d1bcd7b13ebc..fb1f1cfce60c 100644
--- a/arch/arm/common/it8152.c
+++ b/arch/arm/common/it8152.c
@@ -320,13 +320,6 @@ err0:
         return -EBUSY;
 }
 
-/*
- * If we set up a device for bus mastering, we need to check the latency
- * timer as we don't have even crappy BIOSes to set it properly.
- * The implementation is from arch/i386/pci/i386.c
- */
-unsigned int pcibios_max_latency = 255;
-
 /* ITE bridge requires setting latency timer to avoid early bus access
    termination by PCI bus master devices
 */
diff --git a/arch/arm/common/pl330.c b/arch/arm/common/pl330.c
index d8e44a43047c..ff3ad2244824 100644
--- a/arch/arm/common/pl330.c
+++ b/arch/arm/common/pl330.c
@@ -1502,12 +1502,13 @@ int pl330_chan_ctrl(void *ch_id, enum pl330_chan_op op)
         struct pl330_thread *thrd = ch_id;
         struct pl330_dmac *pl330;
         unsigned long flags;
-        int ret = 0, active = thrd->req_running;
+        int ret = 0, active;
 
         if (!thrd || thrd->free || thrd->dmac->state == DYING)
                 return -EINVAL;
 
         pl330 = thrd->dmac;
+        active = thrd->req_running;
 
         spin_lock_irqsave(&pl330->lock, flags);
 
diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h
index 62f8095d46de..23371b17b23e 100644
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -137,6 +137,11 @@
         disable_irq
         .endm
 
+        .macro  save_and_disable_irqs_notrace, oldcpsr
+        mrs     \oldcpsr, cpsr
+        disable_irq_notrace
+        .endm
+
 /*
  * Restore interrupt state previously stored in a register.  We don't
  * guarantee that this will preserve the flags.
diff --git a/arch/arm/include/asm/hardware/pl330.h b/arch/arm/include/asm/hardware/pl330.h
index 575fa8186ca0..c1821385abfa 100644
--- a/arch/arm/include/asm/hardware/pl330.h
+++ b/arch/arm/include/asm/hardware/pl330.h
@@ -41,7 +41,7 @@ enum pl330_dstcachectrl {
         DCCTRL1, /* Bufferable only */
         DCCTRL2, /* Cacheable, but do not allocate */
         DCCTRL3, /* Cacheable and bufferable, but do not allocate */
-        DINVALID1 = 8,
+        DINVALID1,              /* AWCACHE = 0x1000 */
         DINVALID2,
         DCCTRL6, /* Cacheable write-through, allocate on writes only */
         DCCTRL7, /* Cacheable write-back, allocate on writes only */
diff --git a/arch/arm/include/asm/pmu.h b/arch/arm/include/asm/pmu.h
index b5a5be2536c1..90114faa9f3c 100644
--- a/arch/arm/include/asm/pmu.h
+++ b/arch/arm/include/asm/pmu.h
@@ -134,7 +134,7 @@ int __init armpmu_register(struct arm_pmu *armpmu, char *name, int type);
 
 u64 armpmu_event_update(struct perf_event *event,
                         struct hw_perf_event *hwc,
-                        int idx, int overflow);
+                        int idx);
 
 int armpmu_event_set_period(struct perf_event *event,
                             struct hw_perf_event *hwc,
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index ce280b8d613c..cb8d638924fd 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -22,6 +22,7 @@
 #include <asm/hw_breakpoint.h>
 #include <asm/ptrace.h>
 #include <asm/types.h>
+#include <asm/system.h>
 
 #ifdef __KERNEL__
 #define STACK_TOP       ((current->personality & ADDR_LIMIT_32BIT) ? \
diff --git a/arch/arm/kernel/ecard.c b/arch/arm/kernel/ecard.c
index 4dd0edab6a65..1651d4950744 100644
--- a/arch/arm/kernel/ecard.c
+++ b/arch/arm/kernel/ecard.c
@@ -242,6 +242,7 @@ static void ecard_init_pgtables(struct mm_struct *mm)
 
         memcpy(dst_pgd, src_pgd, sizeof(pgd_t) * (EASI_SIZE / PGDIR_SIZE));
 
+        vma.vm_flags = VM_EXEC;
         vma.vm_mm = mm;
 
         flush_tlb_range(&vma, IO_START, IO_START + IO_SIZE);
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index 5bb91bf3d47f..b2abfa18f137 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -180,7 +180,7 @@ armpmu_event_set_period(struct perf_event *event,
 u64
 armpmu_event_update(struct perf_event *event,
                     struct hw_perf_event *hwc,
-                    int idx, int overflow)
+                    int idx)
 {
         struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
         u64 delta, prev_raw_count, new_raw_count;
@@ -193,13 +193,7 @@ again:
                              new_raw_count) != prev_raw_count)
                 goto again;
 
-        new_raw_count &= armpmu->max_period;
-        prev_raw_count &= armpmu->max_period;
-
-        if (overflow)
-                delta = armpmu->max_period - prev_raw_count + new_raw_count + 1;
-        else
-                delta = new_raw_count - prev_raw_count;
+        delta = (new_raw_count - prev_raw_count) & armpmu->max_period;
 
         local64_add(delta, &event->count);
         local64_sub(delta, &hwc->period_left);
@@ -216,7 +210,7 @@ armpmu_read(struct perf_event *event)
         if (hwc->idx < 0)
                 return;
 
-        armpmu_event_update(event, hwc, hwc->idx, 0);
+        armpmu_event_update(event, hwc, hwc->idx);
 }
 
 static void
@@ -232,7 +226,7 @@ armpmu_stop(struct perf_event *event, int flags)
         if (!(hwc->state & PERF_HES_STOPPED)) {
                 armpmu->disable(hwc, hwc->idx);
                 barrier(); /* why? */
-                armpmu_event_update(event, hwc, hwc->idx, 0);
+                armpmu_event_update(event, hwc, hwc->idx);
                 hwc->state |= PERF_HES_STOPPED | PERF_HES_UPTODATE;
         }
 }
@@ -518,7 +512,13 @@ __hw_perf_event_init(struct perf_event *event)
         hwc->config_base            |= (unsigned long)mapping;
 
         if (!hwc->sample_period) {
-                hwc->sample_period  = armpmu->max_period;
+                /*
+                 * For non-sampling runs, limit the sample_period to half
+                 * of the counter width. That way, the new counter value
+                 * is far less likely to overtake the previous one unless
+                 * you have some serious IRQ latency issues.
+                 */
+                hwc->sample_period  = armpmu->max_period >> 1;
                 hwc->last_period    = hwc->sample_period;
                 local64_set(&hwc->period_left, hwc->sample_period);
         }
@@ -680,6 +680,28 @@ static void __init cpu_pmu_init(struct arm_pmu *armpmu)
 }
 
 /*
+ * PMU hardware loses all context when a CPU goes offline.
+ * When a CPU is hotplugged back in, since some hardware registers are
+ * UNKNOWN at reset, the PMU must be explicitly reset to avoid reading
+ * junk values out of them.
+ */
+static int __cpuinit pmu_cpu_notify(struct notifier_block *b,
+                                        unsigned long action, void *hcpu)
+{
+        if ((action & ~CPU_TASKS_FROZEN) != CPU_STARTING)
+                return NOTIFY_DONE;
+
+        if (cpu_pmu && cpu_pmu->reset)
+                cpu_pmu->reset(NULL);
+
+        return NOTIFY_OK;
+}
+
+static struct notifier_block __cpuinitdata pmu_cpu_notifier = {
+        .notifier_call = pmu_cpu_notify,
+};
+
+/*
  * CPU PMU identification and registration.
  */
 static int __init
@@ -730,6 +752,7 @@ init_hw_perf_events(void)
                 pr_info("enabled with %s PMU driver, %d counters available\n",
                         cpu_pmu->name, cpu_pmu->num_events);
                 cpu_pmu_init(cpu_pmu);
+                register_cpu_notifier(&pmu_cpu_notifier);
                 armpmu_register(cpu_pmu, "cpu", PERF_TYPE_RAW);
         } else {
                 pr_info("no hardware support available\n");
diff --git a/arch/arm/kernel/perf_event_v6.c b/arch/arm/kernel/perf_event_v6.c
index 533be9930ec2..b78af0cc6ef3 100644
--- a/arch/arm/kernel/perf_event_v6.c
+++ b/arch/arm/kernel/perf_event_v6.c
@@ -467,23 +467,6 @@ armv6pmu_enable_event(struct hw_perf_event *hwc,
         raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
 
-static int counter_is_active(unsigned long pmcr, int idx)
-{
-        unsigned long mask = 0;
-        if (idx == ARMV6_CYCLE_COUNTER)
-                mask = ARMV6_PMCR_CCOUNT_IEN;
-        else if (idx == ARMV6_COUNTER0)
-                mask = ARMV6_PMCR_COUNT0_IEN;
-        else if (idx == ARMV6_COUNTER1)
-                mask = ARMV6_PMCR_COUNT1_IEN;
-
-        if (mask)
-                return pmcr & mask;
-
-        WARN_ONCE(1, "invalid counter number (%d)\n", idx);
-        return 0;
-}
-
 static irqreturn_t
 armv6pmu_handle_irq(int irq_num,
                     void *dev)
@@ -513,7 +496,8 @@ armv6pmu_handle_irq(int irq_num,
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
-                if (!counter_is_active(pmcr, idx))
+                /* Ignore if we don't have an event. */
+                if (!event)
                         continue;
 
                 /*
@@ -524,7 +508,7 @@ armv6pmu_handle_irq(int irq_num,
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
diff --git a/arch/arm/kernel/perf_event_v7.c b/arch/arm/kernel/perf_event_v7.c
index 6933244c68f9..4d7095af2ab3 100644
--- a/arch/arm/kernel/perf_event_v7.c
+++ b/arch/arm/kernel/perf_event_v7.c
@@ -809,6 +809,11 @@ static inline int armv7_pmnc_disable_intens(int idx)
 
         counter = ARMV7_IDX_TO_COUNTER(idx);
         asm volatile("mcr p15, 0, %0, c9, c14, 2" : : "r" (BIT(counter)));
+        isb();
+        /* Clear the overflow flag in case an interrupt is pending. */
+        asm volatile("mcr p15, 0, %0, c9, c12, 3" : : "r" (BIT(counter)));
+        isb();
+
         return idx;
 }
 
@@ -955,6 +960,10 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
+                /* Ignore if we don't have an event. */
+                if (!event)
+                        continue;
+
                 /*
                  * We have a single interrupt for all counters. Check that
                  * each counter has overflowed before we process it.
@@ -963,7 +972,7 @@ static irqreturn_t armv7pmu_handle_irq(int irq_num, void *dev)
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
diff --git a/arch/arm/kernel/perf_event_xscale.c b/arch/arm/kernel/perf_event_xscale.c
index 3b99d8269829..71a21e6712f5 100644
--- a/arch/arm/kernel/perf_event_xscale.c
+++ b/arch/arm/kernel/perf_event_xscale.c
@@ -255,11 +255,14 @@ xscale1pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
+                if (!event)
+                        continue;
+
                 if (!xscale1_pmnc_counter_has_overflowed(pmnc, idx))
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
@@ -592,11 +595,14 @@ xscale2pmu_handle_irq(int irq_num, void *dev)
                 struct perf_event *event = cpuc->events[idx];
                 struct hw_perf_event *hwc;
 
-                if (!xscale2_pmnc_counter_has_overflowed(pmnc, idx))
+                if (!event)
+                        continue;
+
+                if (!xscale2_pmnc_counter_has_overflowed(of_flags, idx))
                         continue;
 
                 hwc = &event->hw;
-                armpmu_event_update(event, hwc, idx, 1);
+                armpmu_event_update(event, hwc, idx);
                 data.period = event->hw.last_period;
                 if (!armpmu_event_set_period(event, hwc, idx))
                         continue;
@@ -663,7 +669,7 @@ xscale2pmu_enable_event(struct hw_perf_event *hwc, int idx)
 static void
 xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
 {
-        unsigned long flags, ien, evtsel;
+        unsigned long flags, ien, evtsel, of_flags;
         struct pmu_hw_events *events = cpu_pmu->get_hw_events();
 
         ien = xscale2pmu_read_int_enable();
@@ -672,26 +678,31 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
         switch (idx) {
         case XSCALE_CYCLE_COUNTER:
                 ien &= ~XSCALE2_CCOUNT_INT_EN;
+                of_flags = XSCALE2_CCOUNT_OVERFLOW;
                 break;
         case XSCALE_COUNTER0:
                 ien &= ~XSCALE2_COUNT0_INT_EN;
                 evtsel &= ~XSCALE2_COUNT0_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT0_EVT_SHFT;
+                of_flags = XSCALE2_COUNT0_OVERFLOW;
                 break;
         case XSCALE_COUNTER1:
                 ien &= ~XSCALE2_COUNT1_INT_EN;
                 evtsel &= ~XSCALE2_COUNT1_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT1_EVT_SHFT;
+                of_flags = XSCALE2_COUNT1_OVERFLOW;
                 break;
         case XSCALE_COUNTER2:
                 ien &= ~XSCALE2_COUNT2_INT_EN;
                 evtsel &= ~XSCALE2_COUNT2_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT2_EVT_SHFT;
+                of_flags = XSCALE2_COUNT2_OVERFLOW;
                 break;
         case XSCALE_COUNTER3:
                 ien &= ~XSCALE2_COUNT3_INT_EN;
                 evtsel &= ~XSCALE2_COUNT3_EVT_MASK;
                 evtsel |= XSCALE_PERFCTR_UNUSED << XSCALE2_COUNT3_EVT_SHFT;
+                of_flags = XSCALE2_COUNT3_OVERFLOW;
                 break;
         default:
                 WARN_ONCE(1, "invalid counter number (%d)\n", idx);
@@ -701,6 +712,7 @@ xscale2pmu_disable_event(struct hw_perf_event *hwc, int idx)
         raw_spin_lock_irqsave(&events->pmu_lock, flags);
         xscale2pmu_write_event_select(evtsel);
         xscale2pmu_write_int_enable(ien);
+        xscale2pmu_write_overflow_flags(of_flags);
         raw_spin_unlock_irqrestore(&events->pmu_lock, flags);
 }
 
diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c
index e33870ff0ac0..ede6443c34d9 100644
--- a/arch/arm/kernel/ptrace.c
+++ b/arch/arm/kernel/ptrace.c
@@ -23,6 +23,7 @@
 #include <linux/perf_event.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/regset.h>
+#include <linux/audit.h>
 
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -904,6 +905,12 @@ long arch_ptrace(struct task_struct *child, long request,
         return ret;
 }
 
+#ifdef __ARMEB__
+#define AUDIT_ARCH_NR AUDIT_ARCH_ARMEB
+#else
+#define AUDIT_ARCH_NR AUDIT_ARCH_ARM
+#endif
+
 asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
 {
         unsigned long ip;
@@ -918,7 +925,7 @@ asmlinkage int syscall_trace(int why, struct pt_regs *regs, int scno)
         if (!ip)
                 audit_syscall_exit(regs);
         else
-                audit_syscall_entry(AUDIT_ARCH_ARMEB, scno, regs->ARM_r0,
+                audit_syscall_entry(AUDIT_ARCH_NR, scno, regs->ARM_r0,
                                     regs->ARM_r1, regs->ARM_r2, regs->ARM_r3);
 
         if (!test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/arm/kernel/smp_twd.c b/arch/arm/kernel/smp_twd.c
index 4285daa077b0..7a79b24597b2 100644
--- a/arch/arm/kernel/smp_twd.c
+++ b/arch/arm/kernel/smp_twd.c
@@ -129,7 +129,7 @@ static struct notifier_block twd_cpufreq_nb = {
 
 static int twd_cpufreq_init(void)
 {
-        if (!IS_ERR(twd_clk))
+        if (twd_evt && *__this_cpu_ptr(twd_evt) && !IS_ERR(twd_clk))
                 return cpufreq_register_notifier(&twd_cpufreq_nb,
                         CPUFREQ_TRANSITION_NOTIFIER);
 
diff --git a/arch/arm/mach-at91/at91sam9g45_devices.c b/arch/arm/mach-at91/at91sam9g45_devices.c
index b7582dd10dc3..96e2adcd5a84 100644
--- a/arch/arm/mach-at91/at91sam9g45_devices.c
+++ b/arch/arm/mach-at91/at91sam9g45_devices.c
@@ -38,10 +38,6 @@
 #if defined(CONFIG_AT_HDMAC) || defined(CONFIG_AT_HDMAC_MODULE)
 static u64 hdmac_dmamask = DMA_BIT_MASK(32);
 
-static struct at_dma_platform_data atdma_pdata = {
-        .nr_channels    = 8,
-};
-
 static struct resource hdmac_resources[] = {
         [0] = {
                 .start  = AT91SAM9G45_BASE_DMA,
@@ -56,12 +52,11 @@ static struct resource hdmac_resources[] = {
 };
 
 static struct platform_device at_hdmac_device = {
-        .name           = "at_hdmac",
+        .name           = "at91sam9g45_dma",
         .id             = -1,
         .dev            = {
                                 .dma_mask               = &hdmac_dmamask,
                                 .coherent_dma_mask      = DMA_BIT_MASK(32),
-                                .platform_data          = &atdma_pdata,
         },
         .resource       = hdmac_resources,
         .num_resources  = ARRAY_SIZE(hdmac_resources),
@@ -69,9 +64,15 @@ static struct platform_device at_hdmac_device = {
 
 void __init at91_add_device_hdmac(void)
 {
-        dma_cap_set(DMA_MEMCPY, atdma_pdata.cap_mask);
-        dma_cap_set(DMA_SLAVE, atdma_pdata.cap_mask);
-        platform_device_register(&at_hdmac_device);
+#if defined(CONFIG_OF)
+        struct device_node *of_node =
+                of_find_node_by_name(NULL, "dma-controller");
+
+        if (of_node)
+                of_node_put(of_node);
+        else
+#endif
+                platform_device_register(&at_hdmac_device);
 }
 #else
 void __init at91_add_device_hdmac(void) {}
diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c
index 61908dce9784..9be71c11d0f0 100644
--- a/arch/arm/mach-at91/at91sam9rl_devices.c
+++ b/arch/arm/mach-at91/at91sam9rl_devices.c
@@ -33,10 +33,6 @@
 #if defined(CONFIG_AT_HDMAC) || defined(CONFIG_AT_HDMAC_MODULE)
 static u64 hdmac_dmamask = DMA_BIT_MASK(32);
 
-static struct at_dma_platform_data atdma_pdata = {
-        .nr_channels    = 2,
-};
-
 static struct resource hdmac_resources[] = {
         [0] = {
                 .start  = AT91SAM9RL_BASE_DMA,
@@ -51,12 +47,11 @@ static struct resource hdmac_resources[] = {
 };
 
 static struct platform_device at_hdmac_device = {
-        .name           = "at_hdmac",
+        .name           = "at91sam9rl_dma",
         .id             = -1,
         .dev            = {
                                 .dma_mask               = &hdmac_dmamask,
                                 .coherent_dma_mask      = DMA_BIT_MASK(32),
-                                .platform_data          = &atdma_pdata,
         },
         .resource       = hdmac_resources,
         .num_resources  = ARRAY_SIZE(hdmac_resources),
@@ -64,7 +59,6 @@ static struct platform_device at_hdmac_device = {
 
 void __init at91_add_device_hdmac(void)
 {
-        dma_cap_set(DMA_MEMCPY, atdma_pdata.cap_mask);
         platform_device_register(&at_hdmac_device);
 }
 #else
diff --git a/arch/arm/mach-ep93xx/vision_ep9307.c b/arch/arm/mach-ep93xx/vision_ep9307.c
index d5fb44f16d31..d67d0b4feb6f 100644
--- a/arch/arm/mach-ep93xx/vision_ep9307.c
+++ b/arch/arm/mach-ep93xx/vision_ep9307.c
@@ -34,6 +34,7 @@
 #include <mach/ep93xx_spi.h>
 #include <mach/gpio-ep93xx.h>
 
+#include <asm/hardware/vic.h>
 #include <asm/mach-types.h>
 #include <asm/mach/map.h>
 #include <asm/mach/arch.h>
@@ -361,6 +362,7 @@ MACHINE_START(VISION_EP9307, "Vision Engraving Systems EP9307")
         .atag_offset    = 0x100,
         .map_io         = vision_map_io,
         .init_irq       = ep93xx_init_irq,
+        .handle_irq     = vic_handle_irq,
         .timer          = &ep93xx_timer,
         .init_machine   = vision_init_machine,
         .restart        = ep93xx_restart,
diff --git a/arch/arm/mach-exynos/mach-universal_c210.c b/arch/arm/mach-exynos/mach-universal_c210.c
index 0fc65ffde8ff..38939956c34f 100644
--- a/arch/arm/mach-exynos/mach-universal_c210.c
+++ b/arch/arm/mach-exynos/mach-universal_c210.c
@@ -13,6 +13,7 @@
 #include <linux/i2c.h>
 #include <linux/gpio_keys.h>
 #include <linux/gpio.h>
+#include <linux/interrupt.h>
 #include <linux/fb.h>
 #include <linux/mfd/max8998.h>
 #include <linux/regulator/machine.h>
@@ -595,6 +596,7 @@ static struct mxt_platform_data qt602240_platform_data = {
         .threshold      = 0x28,
         .voltage        = 2800000,              /* 2.8V */
         .orient         = MXT_DIAGONAL,
+        .irqflags       = IRQF_TRIGGER_FALLING,
 };
 
 static struct i2c_board_info i2c3_devs[] __initdata = {
diff --git a/arch/arm/mach-lpc32xx/include/mach/irqs.h b/arch/arm/mach-lpc32xx/include/mach/irqs.h
index 2667f52e3b04..9e3b90df32e1 100644
--- a/arch/arm/mach-lpc32xx/include/mach/irqs.h
+++ b/arch/arm/mach-lpc32xx/include/mach/irqs.h
@@ -61,7 +61,7 @@
  */
 #define IRQ_LPC32XX_JTAG_COMM_TX        LPC32XX_SIC1_IRQ(1)
 #define IRQ_LPC32XX_JTAG_COMM_RX        LPC32XX_SIC1_IRQ(2)
-#define IRQ_LPC32XX_GPI_11              LPC32XX_SIC1_IRQ(4)
+#define IRQ_LPC32XX_GPI_28              LPC32XX_SIC1_IRQ(4)
 #define IRQ_LPC32XX_TS_P                LPC32XX_SIC1_IRQ(6)
 #define IRQ_LPC32XX_TS_IRQ              LPC32XX_SIC1_IRQ(7)
 #define IRQ_LPC32XX_TS_AUX              LPC32XX_SIC1_IRQ(8)
diff --git a/arch/arm/mach-lpc32xx/irq.c b/arch/arm/mach-lpc32xx/irq.c
index 4eae566dfdc7..c74de01ab5b6 100644
--- a/arch/arm/mach-lpc32xx/irq.c
+++ b/arch/arm/mach-lpc32xx/irq.c
@@ -118,6 +118,10 @@ static const struct lpc32xx_event_info lpc32xx_events[NR_IRQS] = {
                 .event_group = &lpc32xx_event_pin_regs,
                 .mask = LPC32XX_CLKPWR_EXTSRC_GPI_06_BIT,
         },
+        [IRQ_LPC32XX_GPI_28] = {
+                .event_group = &lpc32xx_event_pin_regs,
+                .mask = LPC32XX_CLKPWR_EXTSRC_GPI_28_BIT,
+        },
         [IRQ_LPC32XX_GPIO_00] = {
                 .event_group = &lpc32xx_event_int_regs,
                 .mask = LPC32XX_CLKPWR_INTSRC_GPIO_00_BIT,
@@ -305,9 +309,18 @@ static int lpc32xx_irq_wake(struct irq_data *d, unsigned int state)
 
                 if (state)
                         eventreg |= lpc32xx_events[d->irq].mask;
-                else
+                else {
                         eventreg &= ~lpc32xx_events[d->irq].mask;
 
+                        /*
+                         * When disabling the wakeup, clear the latched
+                         * event
+                         */
+                        __raw_writel(lpc32xx_events[d->irq].mask,
+                                lpc32xx_events[d->irq].
+                                event_group->rawstat_reg);
+                }
+
                 __raw_writel(eventreg,
                         lpc32xx_events[d->irq].event_group->enab_reg);
 
@@ -380,13 +393,15 @@ void __init lpc32xx_init_irq(void)
 
         /* Setup SIC1 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC1_BASE));
+        __raw_writel(SIC1_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC1_BASE));
 
         /* Setup SIC2 */
         __raw_writel(0, LPC32XX_INTC_MASK(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
-        __raw_writel(MIC_ATR_DEFAULT, LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_APR_DEFAULT, LPC32XX_INTC_POLAR(LPC32XX_SIC2_BASE));
+        __raw_writel(SIC2_ATR_DEFAULT,
+                                LPC32XX_INTC_ACT_TYPE(LPC32XX_SIC2_BASE));
 
         /* Configure supported IRQ's */
         for (i = 0; i < NR_IRQS; i++) {
diff --git a/arch/arm/mach-lpc32xx/serial.c b/arch/arm/mach-lpc32xx/serial.c
index 429cfdbb2b3d..f2735281616a 100644
--- a/arch/arm/mach-lpc32xx/serial.c
+++ b/arch/arm/mach-lpc32xx/serial.c
@@ -88,6 +88,7 @@ struct uartinit {
         char *uart_ck_name;
         u32 ck_mode_mask;
         void __iomem *pdiv_clk_reg;
+        resource_size_t mapbase;
 };
 
 static struct uartinit uartinit_data[] __initdata = {
@@ -97,6 +98,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 5),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART5_CLK_CTRL,
+                .mapbase = LPC32XX_UART5_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART3_SELECT
@@ -105,6 +107,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 3),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART3_CLK_CTRL,
+                .mapbase = LPC32XX_UART3_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART4_SELECT
@@ -113,6 +116,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 4),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART4_CLK_CTRL,
+                .mapbase = LPC32XX_UART4_BASE,
         },
 #endif
 #ifdef CONFIG_ARCH_LPC32XX_UART6_SELECT
@@ -121,6 +125,7 @@ static struct uartinit uartinit_data[] __initdata = {
                 .ck_mode_mask =
                         LPC32XX_UART_CLKMODE_LOAD(LPC32XX_UART_CLKMODE_ON, 6),
                 .pdiv_clk_reg = LPC32XX_CLKPWR_UART6_CLK_CTRL,
+                .mapbase = LPC32XX_UART6_BASE,
         },
 #endif
 };
@@ -165,11 +170,24 @@ void __init lpc32xx_serial_init(void)
 
                 /* pre-UART clock divider set to 1 */
                 __raw_writel(0x0101, uartinit_data[i].pdiv_clk_reg);
+
+                /*
+                 * Force a flush of the RX FIFOs to work around a
+                 * HW bug
+                 */
+                puart = uartinit_data[i].mapbase;
+                __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
+                __raw_writel(0x00, LPC32XX_UART_DLL_FIFO(puart));
+                j = LPC32XX_SUART_FIFO_SIZE;
+                while (j--)
+                        tmp = __raw_readl(
+                                LPC32XX_UART_DLL_FIFO(puart));
+                __raw_writel(0, LPC32XX_UART_IIR_FCR(puart));
         }
 
         /* This needs to be done after all UART clocks are setup */
         __raw_writel(clkmodes, LPC32XX_UARTCTL_CLKMODE);
-        for (i = 0; i < ARRAY_SIZE(uartinit_data) - 1; i++) {
+        for (i = 0; i < ARRAY_SIZE(uartinit_data); i++) {
                 /* Force a flush of the RX FIFOs to work around a HW bug */
                 puart = serial_std_platform_data[i].mapbase;
                 __raw_writel(0xC1, LPC32XX_UART_IIR_FCR(puart));
diff --git a/arch/arm/mach-mmp/aspenite.c b/arch/arm/mach-mmp/aspenite.c
index 17cb76060125..3588a5584153 100644
--- a/arch/arm/mach-mmp/aspenite.c
+++ b/arch/arm/mach-mmp/aspenite.c
@@ -17,7 +17,6 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/nand.h>
 #include <linux/interrupt.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c
index 7bc17eaa12eb..ada1213982b4 100644
--- a/arch/arm/mach-mmp/pxa168.c
+++ b/arch/arm/mach-mmp/pxa168.c
@@ -24,7 +24,6 @@
 #include <mach/dma.h>
 #include <mach/devices.h>
 #include <mach/mfp.h>
-#include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <mach/pxa168.h>
 
diff --git a/arch/arm/mach-mmp/tavorevb.c b/arch/arm/mach-mmp/tavorevb.c
index 8e3b5af04a57..bc97170125bf 100644
--- a/arch/arm/mach-mmp/tavorevb.c
+++ b/arch/arm/mach-mmp/tavorevb.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/smc91x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index 309369ea6978..be2002f42dea 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -416,13 +416,13 @@ static void __init innovator_init(void)
 #ifdef CONFIG_ARCH_OMAP15XX
         if (cpu_is_omap1510()) {
                 omap1_usb_init(&innovator1510_usb_config);
-                innovator_config[1].data = &innovator1510_lcd_config;
+                innovator_config[0].data = &innovator1510_lcd_config;
         }
 #endif
 #ifdef CONFIG_ARCH_OMAP16XX
         if (cpu_is_omap1610()) {
                 omap1_usb_init(&h2_usb_config);
-                innovator_config[1].data = &innovator1610_lcd_config;
+                innovator_config[0].data = &innovator1610_lcd_config;
         }
 #endif
         omap_board_config = innovator_config;
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index d965da45160e..e20c8ab80b0e 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -364,8 +364,8 @@ config OMAP3_SDRC_AC_TIMING
           going on could result in system crashes;
 
 config OMAP4_ERRATA_I688
-        bool "OMAP4 errata: Async Bridge Corruption (BROKEN)"
-        depends on ARCH_OMAP4 && BROKEN
+        bool "OMAP4 errata: Async Bridge Corruption"
+        depends on ARCH_OMAP4
         select ARCH_HAS_BARRIERS
         help
           If a data is stalled inside asynchronous bridge because of back
diff --git a/arch/arm/mach-omap2/board-n8x0.c b/arch/arm/mach-omap2/board-n8x0.c
index 42a4d11fad23..672262717601 100644
--- a/arch/arm/mach-omap2/board-n8x0.c
+++ b/arch/arm/mach-omap2/board-n8x0.c
@@ -371,7 +371,11 @@ static void n8x0_mmc_callback(void *data, u8 card_mask)
         else
                 *openp = 0;
 
+#ifdef CONFIG_MMC_OMAP
         omap_mmc_notify_cover_event(mmc_device, index, *openp);
+#else
+        pr_warn("MMC: notify cover event not available\n");
+#endif
 }
 
 static int n8x0_mmc_late_init(struct device *dev)
diff --git a/arch/arm/mach-omap2/board-omap3evm.c b/arch/arm/mach-omap2/board-omap3evm.c
index c775bead1497..c877236a8442 100644
--- a/arch/arm/mach-omap2/board-omap3evm.c
+++ b/arch/arm/mach-omap2/board-omap3evm.c
@@ -381,7 +381,7 @@ static int omap3evm_twl_gpio_setup(struct device *dev,
         gpio_request_one(gpio + 7, GPIOF_OUT_INIT_LOW, "EN_DVI");
 
         /* TWL4030_GPIO_MAX + 1 == ledB (out, active low LED) */
-        gpio_leds[2].gpio = gpio + TWL4030_GPIO_MAX + 1;
+        gpio_leds[0].gpio = gpio + TWL4030_GPIO_MAX + 1;
 
         platform_device_register(&leds_gpio);
 
diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
index febffde2ff10..7e9338e8d684 100644
--- a/arch/arm/mach-omap2/common.h
+++ b/arch/arm/mach-omap2/common.h
@@ -132,6 +132,7 @@ void omap3_map_io(void);
 void am33xx_map_io(void);
 void omap4_map_io(void);
 void ti81xx_map_io(void);
+void omap_barriers_init(void);
 
 /**
  * omap_test_timeout - busy-loop, testing a condition
diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c
index cfdbb86bc84e..72e018b9b260 100644
--- a/arch/arm/mach-omap2/cpuidle44xx.c
+++ b/arch/arm/mach-omap2/cpuidle44xx.c
@@ -65,7 +65,6 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
         struct timespec ts_preidle, ts_postidle, ts_idle;
         u32 cpu1_state;
         int idle_time;
-        int new_state_idx;
         int cpu_id = smp_processor_id();
 
         /* Used to keep track of the total time in idle */
@@ -84,8 +83,8 @@ static int omap4_enter_idle(struct cpuidle_device *dev,
          */
         cpu1_state = pwrdm_read_pwrst(cpu1_pd);
         if (cpu1_state != PWRDM_POWER_OFF) {
-                new_state_idx = drv->safe_state_index;
-                cx = cpuidle_get_statedata(&dev->states_usage[new_state_idx]);
+                index = drv->safe_state_index;
+                cx = cpuidle_get_statedata(&dev->states_usage[index]);
         }
 
         if (index > 0)
diff --git a/arch/arm/mach-omap2/gpmc-smsc911x.c b/arch/arm/mach-omap2/gpmc-smsc911x.c
index 997033129d26..bbb870c04a5e 100644
--- a/arch/arm/mach-omap2/gpmc-smsc911x.c
+++ b/arch/arm/mach-omap2/gpmc-smsc911x.c
@@ -19,6 +19,8 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/smsc911x.h>
+#include <linux/regulator/fixed.h>
+#include <linux/regulator/machine.h>
 
 #include <plat/board.h>
 #include <plat/gpmc.h>
@@ -42,6 +44,50 @@ static struct smsc911x_platform_config gpmc_smsc911x_config = {
         .flags          = SMSC911X_USE_16BIT,
 };
 
+static struct regulator_consumer_supply gpmc_smsc911x_supply[] = {
+        REGULATOR_SUPPLY("vddvario", "smsc911x.0"),
+        REGULATOR_SUPPLY("vdd33a", "smsc911x.0"),
+};
+
+/* Generic regulator definition to satisfy smsc911x */
+static struct regulator_init_data gpmc_smsc911x_reg_init_data = {
+        .constraints = {
+                .min_uV                 = 3300000,
+                .max_uV                 = 3300000,
+                .valid_modes_mask       = REGULATOR_MODE_NORMAL
+                                        | REGULATOR_MODE_STANDBY,
+                .valid_ops_mask         = REGULATOR_CHANGE_MODE
+                                        | REGULATOR_CHANGE_STATUS,
+        },
+        .num_consumer_supplies  = ARRAY_SIZE(gpmc_smsc911x_supply),
+        .consumer_supplies      = gpmc_smsc911x_supply,
+};
+
+static struct fixed_voltage_config gpmc_smsc911x_fixed_reg_data = {
+        .supply_name            = "gpmc_smsc911x",
+        .microvolts             = 3300000,
+        .gpio                   = -EINVAL,
+        .startup_delay          = 0,
+        .enable_high            = 0,
+        .enabled_at_boot        = 1,
+        .init_data              = &gpmc_smsc911x_reg_init_data,
+};
+
+/*
+ * Platform device id of 42 is a temporary fix to avoid conflicts
+ * with other reg-fixed-voltage devices. The real fix should
+ * involve the driver core providing a way of dynamically
+ * assigning a unique id on registration for platform devices
+ * in the same name space.
+ */
+static struct platform_device gpmc_smsc911x_regulator = {
+        .name           = "reg-fixed-voltage",
+        .id             = 42,
+        .dev = {
+                .platform_data  = &gpmc_smsc911x_fixed_reg_data,
+        },
+};
+
 /*
  * Initialize smsc911x device connected to the GPMC. Note that we
  * assume that pin multiplexing is done in the board-*.c file,
@@ -55,6 +101,12 @@ void __init gpmc_smsc911x_init(struct omap_smsc911x_platform_data *board_data)
 
         gpmc_cfg = board_data;
 
+        ret = platform_device_register(&gpmc_smsc911x_regulator);
+        if (ret < 0) {
+                pr_err("Unable to register smsc911x regulators: %d\n", ret);
+                return;
+        }
+
         if (gpmc_cs_request(gpmc_cfg->cs, SZ_16M, &cs_mem_base) < 0) {
                 pr_err("Failed to request GPMC mem region\n");
                 return;
diff --git a/arch/arm/mach-omap2/hsmmc.c b/arch/arm/mach-omap2/hsmmc.c
index b40c28895298..19dd1657245c 100644
--- a/arch/arm/mach-omap2/hsmmc.c
+++ b/arch/arm/mach-omap2/hsmmc.c
@@ -428,6 +428,7 @@ static int omap_hsmmc_pdata_init(struct omap2_hsmmc_info *c,
         return 0;
 }
 
+static int omap_hsmmc_done;
 #define MAX_OMAP_MMC_HWMOD_NAME_LEN             16
 
 void omap_init_hsmmc(struct omap2_hsmmc_info *hsmmcinfo, int ctrl_nr)
@@ -491,6 +492,11 @@ void omap2_hsmmc_init(struct omap2_hsmmc_info *controllers)
 {
         u32 reg;
 
+        if (omap_hsmmc_done)
+                return;
+
+        omap_hsmmc_done = 1;
+
         if (!cpu_is_omap44xx()) {
                 if (cpu_is_omap2430()) {
                         control_pbias_offset = OMAP243X_CONTROL_PBIAS_LITE;
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 6c5826605eae..719ee423abe2 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -343,6 +343,7 @@ static void __init omap3_check_revision(const char **cpu_rev)
         case 0xb944:
                 omap_revision = AM335X_REV_ES1_0;
                 *cpu_rev = "1.0";
+                break;
         case 0xb8f2:
                 switch (rev) {
                 case 0:
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index eb50c29fb644..fb11b44fbdec 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -307,6 +307,7 @@ void __init omapam33xx_map_common_io(void)
 void __init omap44xx_map_common_io(void)
 {
         iotable_init(omap44xx_io_desc, ARRAY_SIZE(omap44xx_io_desc));
+        omap_barriers_init();
 }
 #endif
 
diff --git a/arch/arm/mach-omap2/mailbox.c b/arch/arm/mach-omap2/mailbox.c
index 609ea2ded7e3..415a6f1cf419 100644
--- a/arch/arm/mach-omap2/mailbox.c
+++ b/arch/arm/mach-omap2/mailbox.c
@@ -281,8 +281,16 @@ static struct omap_mbox mbox_iva_info = {
         .ops    = &omap2_mbox_ops,
         .priv   = &omap2_mbox_iva_priv,
 };
+#endif
 
-struct omap_mbox *omap2_mboxes[] = { &mbox_dsp_info, &mbox_iva_info, NULL };
+#ifdef CONFIG_ARCH_OMAP2
+struct omap_mbox *omap2_mboxes[] = {
+        &mbox_dsp_info,
+#ifdef CONFIG_SOC_OMAP2420
+        &mbox_iva_info,
+#endif
+        NULL
+};
 #endif
 
 #if defined(CONFIG_ARCH_OMAP4)
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index fb8bc9fa43b1..611a0e3d54ca 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -218,7 +218,7 @@ static int _omap_mux_get_by_name(struct omap_mux_partition *partition,
         return -ENODEV;
 }
 
-static int __init
+static int
 omap_mux_get_by_name(const char *muxname,
                         struct omap_mux_partition **found_partition,
                         struct omap_mux **found_mux)
diff --git a/arch/arm/mach-omap2/omap-iommu.c b/arch/arm/mach-omap2/omap-iommu.c
index b8822048e409..ac49384d0285 100644
--- a/arch/arm/mach-omap2/omap-iommu.c
+++ b/arch/arm/mach-omap2/omap-iommu.c
@@ -150,7 +150,8 @@ err_out:
                 platform_device_put(omap_iommu_pdev[i]);
         return err;
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index 40a8fbc07e4b..70de277f5c15 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -24,12 +24,14 @@
 
 #include <plat/irqs.h>
 #include <plat/sram.h>
+#include <plat/omap-secure.h>
 
 #include <mach/hardware.h>
 #include <mach/omap-wakeupgen.h>
 
 #include "common.h"
 #include "omap4-sar-layout.h"
+#include <linux/export.h>
 
 #ifdef CONFIG_CACHE_L2X0
 static void __iomem *l2cache_base;
@@ -43,6 +45,9 @@ static void __iomem *sar_ram_base;
 
 void __iomem *dram_sync, *sram_sync;
 
+static phys_addr_t paddr;
+static u32 size;
+
 void omap_bus_sync(void)
 {
         if (dram_sync && sram_sync) {
@@ -51,19 +56,22 @@ void omap_bus_sync(void)
                 isb();
         }
 }
+EXPORT_SYMBOL(omap_bus_sync);
 
-static int __init omap_barriers_init(void)
+/* Steal one page physical memory for barrier implementation */
+int __init omap_barrier_reserve_memblock(void)
 {
-        struct map_desc dram_io_desc[1];
-        phys_addr_t paddr;
-        u32 size;
-
-        if (!cpu_is_omap44xx())
-                return -ENODEV;
 
         size = ALIGN(PAGE_SIZE, SZ_1M);
         paddr = arm_memblock_steal(size, SZ_1M);
 
+        return 0;
+}
+
+void __init omap_barriers_init(void)
+{
+        struct map_desc dram_io_desc[1];
+
         dram_io_desc[0].virtual = OMAP4_DRAM_BARRIER_VA;
         dram_io_desc[0].pfn = __phys_to_pfn(paddr);
         dram_io_desc[0].length = size;
@@ -75,9 +83,10 @@ static int __init omap_barriers_init(void)
         pr_info("OMAP4: Map 0x%08llx to 0x%08lx for dram barrier\n",
                 (long long) paddr, dram_io_desc[0].virtual);
 
-        return 0;
 }
-core_initcall(omap_barriers_init);
+#else
+void __init omap_barriers_init(void)
+{}
 #endif
 
 void __init gic_init_irq(void)
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
index 1881fe915149..5a65dd04aa38 100644
--- a/arch/arm/mach-omap2/pm.c
+++ b/arch/arm/mach-omap2/pm.c
@@ -174,14 +174,17 @@ static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name,
         freq = clk->rate;
         clk_put(clk);
 
+        rcu_read_lock();
         opp = opp_find_freq_ceil(dev, &freq);
         if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 pr_err("%s: unable to find boot up OPP for vdd_%s\n",
                         __func__, vdd_name);
                 goto exit;
         }
 
         bootup_volt = opp_get_voltage(opp);
+        rcu_read_unlock();
         if (!bootup_volt) {
                 pr_err("%s: unable to find voltage corresponding "
                         "to the bootup OPP for vdd_%s\n", __func__, vdd_name);
diff --git a/arch/arm/mach-omap2/twl-common.c b/arch/arm/mach-omap2/twl-common.c
index 10b20c652e5d..4b57757bf9d1 100644
--- a/arch/arm/mach-omap2/twl-common.c
+++ b/arch/arm/mach-omap2/twl-common.c
@@ -270,7 +270,6 @@ static struct regulator_init_data omap4_vusb_idata = {
         .constraints = {
                 .min_uV                 = 3300000,
                 .max_uV                 = 3300000,
-                .apply_uV               = true,
                 .valid_modes_mask       = REGULATOR_MODE_NORMAL
                                         | REGULATOR_MODE_STANDBY,
                 .valid_ops_mask         = REGULATOR_CHANGE_MODE
diff --git a/arch/arm/mach-omap2/usb-host.c b/arch/arm/mach-omap2/usb-host.c
index 771dc781b746..f51348dafafd 100644
--- a/arch/arm/mach-omap2/usb-host.c
+++ b/arch/arm/mach-omap2/usb-host.c
@@ -486,7 +486,7 @@ static void setup_4430ohci_io_mux(const enum usbhs_omap_port_mode *port_mode)
 void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
 {
         struct omap_hwmod       *oh[2];
-        struct omap_device      *od;
+        struct platform_device  *pdev;
         int                     bus_id = -1;
         int                     i;
 
@@ -522,11 +522,11 @@ void __init usbhs_init(const struct usbhs_omap_board_data *pdata)
                 return;
         }
 
-        od = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
+        pdev = omap_device_build_ss(OMAP_USBHS_DEVICE, bus_id, oh, 2,
                                 (void *)&usbhs_data, sizeof(usbhs_data),
                                 omap_uhhtll_latency,
                                 ARRAY_SIZE(omap_uhhtll_latency), false);
-        if (IS_ERR(od)) {
+        if (IS_ERR(pdev)) {
                 pr_err("Could not build hwmod devices %s,%s\n",
                         USBHS_UHH_HWMODNAME, USBHS_TLL_HWMODNAME);
                 return;
diff --git a/arch/arm/mach-omap2/voltagedomains3xxx_data.c b/arch/arm/mach-omap2/voltagedomains3xxx_data.c
index c005e2f5e383..57db2038b23c 100644
--- a/arch/arm/mach-omap2/voltagedomains3xxx_data.c
+++ b/arch/arm/mach-omap2/voltagedomains3xxx_data.c
@@ -108,6 +108,7 @@ void __init omap3xxx_voltagedomains_init(void)
          * XXX Will depend on the process, validation, and binning
          * for the currently-running IC
          */
+#ifdef CONFIG_PM_OPP
         if (cpu_is_omap3630()) {
                 omap3_voltdm_mpu.volt_data = omap36xx_vddmpu_volt_data;
                 omap3_voltdm_core.volt_data = omap36xx_vddcore_volt_data;
@@ -115,6 +116,7 @@ void __init omap3xxx_voltagedomains_init(void)
                 omap3_voltdm_mpu.volt_data = omap34xx_vddmpu_volt_data;
                 omap3_voltdm_core.volt_data = omap34xx_vddcore_volt_data;
         }
+#endif
 
         if (cpu_is_omap3517() || cpu_is_omap3505())
                 voltdms = voltagedomains_am35xx;
diff --git a/arch/arm/mach-omap2/voltagedomains44xx_data.c b/arch/arm/mach-omap2/voltagedomains44xx_data.c
index 4e11d022595d..c3115f6853d4 100644
--- a/arch/arm/mach-omap2/voltagedomains44xx_data.c
+++ b/arch/arm/mach-omap2/voltagedomains44xx_data.c
@@ -100,9 +100,11 @@ void __init omap44xx_voltagedomains_init(void)
          * XXX Will depend on the process, validation, and binning
          * for the currently-running IC
          */
+#ifdef CONFIG_PM_OPP
         omap4_voltdm_mpu.volt_data = omap44xx_vdd_mpu_volt_data;
         omap4_voltdm_iva.volt_data = omap44xx_vdd_iva_volt_data;
         omap4_voltdm_core.volt_data = omap44xx_vdd_core_volt_data;
+#endif
 
         for (i = 0; voltdm = voltagedomains_omap4[i], voltdm; i++)
                 voltdm->sys_clk.name = sys_clk_name;
diff --git a/arch/arm/mach-pxa/generic.h b/arch/arm/mach-pxa/generic.h
index 0d729e6619df..42d5cca66257 100644
--- a/arch/arm/mach-pxa/generic.h
+++ b/arch/arm/mach-pxa/generic.h
@@ -49,7 +49,6 @@ extern unsigned pxa3xx_get_clk_frequency_khz(int);
 #endif
 
 extern struct syscore_ops pxa_irq_syscore_ops;
-extern struct syscore_ops pxa_gpio_syscore_ops;
 extern struct syscore_ops pxa2xx_mfp_syscore_ops;
 extern struct syscore_ops pxa3xx_mfp_syscore_ops;
 
diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
index fb9b62dcf4ca..208eef1c0485 100644
--- a/arch/arm/mach-pxa/hx4700.c
+++ b/arch/arm/mach-pxa/hx4700.c
@@ -45,6 +45,7 @@
 #include <mach/hx4700.h>
 #include <mach/irda.h>
 
+#include <sound/ak4641.h>
 #include <video/platform_lcd.h>
 #include <video/w100fb.h>
 
@@ -765,6 +766,28 @@ static struct i2c_board_info __initdata pi2c_board_info[] = {
 };
 
 /*
+ * Asahi Kasei AK4641 on I2C
+ */
+
+static struct ak4641_platform_data ak4641_info = {
+        .gpio_power = GPIO27_HX4700_CODEC_ON,
+        .gpio_npdn  = GPIO109_HX4700_CODEC_nPDN,
+};
+
+static struct i2c_board_info i2c_board_info[] __initdata = {
+        {
+                I2C_BOARD_INFO("ak4641", 0x12),
+                .platform_data = &ak4641_info,
+        },
+};
+
+static struct platform_device audio = {
+        .name   = "hx4700-audio",
+        .id     = -1,
+};
+
+
+/*
  * PCMCIA
  */
 
@@ -790,6 +813,7 @@ static struct platform_device *devices[] __initdata = {
         &gpio_vbus,
         &power_supply,
         &strataflash,
+        &audio,
         &pcmcia,
 };
 
@@ -827,6 +851,7 @@ static void __init hx4700_init(void)
         pxa_set_ficp_info(&ficp_info);
         pxa27x_set_i2c_power_info(NULL);
         pxa_set_i2c_info(NULL);
+        i2c_register_board_info(0, ARRAY_AND_SIZE(i2c_board_info));
         i2c_register_board_info(1, ARRAY_AND_SIZE(pi2c_board_info));
         pxa2xx_set_spi_info(2, &pxa_ssp2_master_info);
         spi_register_board_info(ARRAY_AND_SIZE(tsc2046_board_info));
diff --git a/arch/arm/mach-pxa/mfp-pxa2xx.c b/arch/arm/mach-pxa/mfp-pxa2xx.c
index f14775536b83..29b62afc6f7c 100644
--- a/arch/arm/mach-pxa/mfp-pxa2xx.c
+++ b/arch/arm/mach-pxa/mfp-pxa2xx.c
@@ -226,6 +226,12 @@ static void __init pxa25x_mfp_init(void)
 {
         int i;
 
+        /* running before pxa_gpio_probe() */
+#ifdef CONFIG_CPU_PXA26x
+        pxa_last_gpio = 89;
+#else
+        pxa_last_gpio = 84;
+#endif
         for (i = 0; i <= pxa_last_gpio; i++)
                 gpio_desc[i].valid = 1;
 
@@ -295,6 +301,7 @@ static void __init pxa27x_mfp_init(void)
 {
         int i, gpio;
 
+        pxa_last_gpio = 120;    /* running before pxa_gpio_probe() */
         for (i = 0; i <= pxa_last_gpio; i++) {
                 /* skip GPIO2, 5, 6, 7, 8, they are not
                  * valid pins allow configuration
diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c
index 91e4f6c03766..3352b37b60cf 100644
--- a/arch/arm/mach-pxa/pxa25x.c
+++ b/arch/arm/mach-pxa/pxa25x.c
@@ -25,7 +25,6 @@
 #include <linux/suspend.h>
 #include <linux/syscore_ops.h>
 #include <linux/irq.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <asm/suspend.h>
@@ -209,6 +208,7 @@ static struct clk_lookup pxa25x_clkregs[] = {
         INIT_CLKREG(&clk_pxa25x_gpio11, NULL, "GPIO11_CLK"),
         INIT_CLKREG(&clk_pxa25x_gpio12, NULL, "GPIO12_CLK"),
         INIT_CLKREG(&clk_pxa25x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 
 static struct clk_lookup pxa25x_hwuart_clkreg =
@@ -368,7 +368,6 @@ static int __init pxa25x_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa2xx_clock_syscore_ops);
 
                 ret = platform_add_devices(pxa25x_devices,
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index aed6cbcf3866..6bce78edce7a 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -22,7 +22,6 @@
 #include <linux/io.h>
 #include <linux/irq.h>
 #include <linux/i2c/pxa-i2c.h>
-#include <linux/gpio.h>
 
 #include <asm/mach/map.h>
 #include <mach/hardware.h>
@@ -230,6 +229,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
         INIT_CLKREG(&clk_pxa27x_im, NULL, "IMCLK"),
         INIT_CLKREG(&clk_pxa27x_memc, NULL, "MEMCLK"),
         INIT_CLKREG(&clk_pxa27x_mem, "pxa2xx-pcmcia", NULL),
+        INIT_CLKREG(&clk_dummy, "pxa-gpio", NULL),
 };
 
 #ifdef CONFIG_PM
@@ -456,7 +456,6 @@ static int __init pxa27x_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa2xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa2xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c
index 4f402afa6609..3918a672238e 100644
--- a/arch/arm/mach-pxa/pxa3xx.c
+++ b/arch/arm/mach-pxa/pxa3xx.c
@@ -462,7 +462,6 @@ static int __init pxa3xx_init(void)
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
                 register_syscore_ops(&pxa3xx_mfp_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa3xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/pxa95x.c b/arch/arm/mach-pxa/pxa95x.c
index d082a583df78..5ce434b95e87 100644
--- a/arch/arm/mach-pxa/pxa95x.c
+++ b/arch/arm/mach-pxa/pxa95x.c
@@ -283,7 +283,6 @@ static int __init pxa95x_init(void)
                         return ret;
 
                 register_syscore_ops(&pxa_irq_syscore_ops);
-                register_syscore_ops(&pxa_gpio_syscore_ops);
                 register_syscore_ops(&pxa3xx_clock_syscore_ops);
 
                 ret = platform_add_devices(devices, ARRAY_SIZE(devices));
diff --git a/arch/arm/mach-pxa/saarb.c b/arch/arm/mach-pxa/saarb.c
index febc809ed5a6..5aded5e6148f 100644
--- a/arch/arm/mach-pxa/saarb.c
+++ b/arch/arm/mach-pxa/saarb.c
@@ -15,7 +15,6 @@
 #include <linux/i2c.h>
 #include <linux/i2c/pxa-i2c.h>
 #include <linux/mfd/88pm860x.h>
-#include <linux/gpio.h>
 
 #include <asm/mach-types.h>
 #include <asm/mach/arch.h>
diff --git a/arch/arm/mach-pxa/sharpsl_pm.c b/arch/arm/mach-pxa/sharpsl_pm.c
index 8d5168d253a9..30989baf7f2a 100644
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -168,6 +168,7 @@ struct battery_thresh sharpsl_battery_levels_noac[] = {
 #define MAXCTRL_SEL_SH   4
 #define MAXCTRL_STR      (1u << 7)
 
+extern int max1111_read_channel(int);
 /*
  * Read MAX1111 ADC
  */
@@ -177,8 +178,6 @@ int sharpsl_pm_pxa_read_max1111(int channel)
         if (machine_is_tosa())
             return 0;
 
-        extern int max1111_read_channel(int);
-
         /* max1111 accepts channels from 0-3, however,
          * it is encoded from 0-7 here in the code.
          */
diff --git a/arch/arm/mach-pxa/spitz_pm.c b/arch/arm/mach-pxa/spitz_pm.c
index 34cbdac51525..438f02fe122a 100644
--- a/arch/arm/mach-pxa/spitz_pm.c
+++ b/arch/arm/mach-pxa/spitz_pm.c
@@ -172,10 +172,9 @@ static int spitz_should_wakeup(unsigned int resume_on_alarm)
 static unsigned long spitz_charger_wakeup(void)
 {
         unsigned long ret;
-        ret = (!gpio_get_value(SPITZ_GPIO_KEY_INT)
+        ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT)
                 << GPIO_bit(SPITZ_GPIO_KEY_INT))
-                | (!gpio_get_value(SPITZ_GPIO_SYNC)
-                << GPIO_bit(SPITZ_GPIO_SYNC));
+                | gpio_get_value(SPITZ_GPIO_SYNC));
         return ret;
 }
 
diff --git a/arch/arm/mach-s3c2440/common.h b/arch/arm/mach-s3c2440/common.h
index db8a98ac68c5..0c1eb1dfc534 100644
--- a/arch/arm/mach-s3c2440/common.h
+++ b/arch/arm/mach-s3c2440/common.h
@@ -12,6 +12,6 @@
 #ifndef __ARCH_ARM_MACH_S3C2440_COMMON_H
 #define __ARCH_ARM_MACH_S3C2440_COMMON_H
 
-void s3c2440_restart(char mode, const char *cmd);
+void s3c244x_restart(char mode, const char *cmd);
 
 #endif /* __ARCH_ARM_MACH_S3C2440_COMMON_H */
diff --git a/arch/arm/mach-s3c2440/mach-anubis.c b/arch/arm/mach-s3c2440/mach-anubis.c
index 24569550de1a..19b577bc09b8 100644
--- a/arch/arm/mach-s3c2440/mach-anubis.c
+++ b/arch/arm/mach-s3c2440/mach-anubis.c
@@ -487,5 +487,5 @@ MACHINE_START(ANUBIS, "Simtec-Anubis")
         .init_machine   = anubis_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-at2440evb.c b/arch/arm/mach-s3c2440/mach-at2440evb.c
index d6a9763110cd..d7ae49c90118 100644
--- a/arch/arm/mach-s3c2440/mach-at2440evb.c
+++ b/arch/arm/mach-s3c2440/mach-at2440evb.c
@@ -222,5 +222,5 @@ MACHINE_START(AT2440EVB, "AT2440EVB")
         .init_machine   = at2440evb_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-gta02.c b/arch/arm/mach-s3c2440/mach-gta02.c
index 5859e609d28c..9a4a5bc008e6 100644
--- a/arch/arm/mach-s3c2440/mach-gta02.c
+++ b/arch/arm/mach-s3c2440/mach-gta02.c
@@ -601,5 +601,5 @@ MACHINE_START(NEO1973_GTA02, "GTA02")
         .init_irq       = s3c24xx_init_irq,
         .init_machine   = gta02_machine_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-mini2440.c b/arch/arm/mach-s3c2440/mach-mini2440.c
index adbbb85bc4cd..5d66fb218a41 100644
--- a/arch/arm/mach-s3c2440/mach-mini2440.c
+++ b/arch/arm/mach-s3c2440/mach-mini2440.c
@@ -701,5 +701,5 @@ MACHINE_START(MINI2440, "MINI2440")
         .init_machine   = mini2440_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-nexcoder.c b/arch/arm/mach-s3c2440/mach-nexcoder.c
index 40eaf844bc1f..5198e3e1c5be 100644
--- a/arch/arm/mach-s3c2440/mach-nexcoder.c
+++ b/arch/arm/mach-s3c2440/mach-nexcoder.c
@@ -158,5 +158,5 @@ MACHINE_START(NEXCODER_2440, "NexVision - Nexcoder 2440")
         .init_machine   = nexcoder_init,
         .init_irq       = s3c24xx_init_irq,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-osiris.c b/arch/arm/mach-s3c2440/mach-osiris.c
index 4c480ef734f6..c5daeb612a88 100644
--- a/arch/arm/mach-s3c2440/mach-osiris.c
+++ b/arch/arm/mach-s3c2440/mach-osiris.c
@@ -436,5 +436,5 @@ MACHINE_START(OSIRIS, "Simtec-OSIRIS")
         .init_irq       = s3c24xx_init_irq,
         .init_machine   = osiris_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx1950.c b/arch/arm/mach-s3c2440/mach-rx1950.c
index 80077f6472ee..6f68abf44fab 100644
--- a/arch/arm/mach-s3c2440/mach-rx1950.c
+++ b/arch/arm/mach-s3c2440/mach-rx1950.c
@@ -822,5 +822,5 @@ MACHINE_START(RX1950, "HP iPAQ RX1950")
         .init_irq = s3c24xx_init_irq,
         .init_machine = rx1950_init_machine,
         .timer = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-rx3715.c b/arch/arm/mach-s3c2440/mach-rx3715.c
index 20103bafbd4b..56af35447598 100644
--- a/arch/arm/mach-s3c2440/mach-rx3715.c
+++ b/arch/arm/mach-s3c2440/mach-rx3715.c
@@ -213,5 +213,5 @@ MACHINE_START(RX3715, "IPAQ-RX3715")
         .init_irq       = rx3715_init_irq,
         .init_machine   = rx3715_init_machine,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/mach-smdk2440.c b/arch/arm/mach-s3c2440/mach-smdk2440.c
index 1deb60d12a60..83a1036d7dcb 100644
--- a/arch/arm/mach-s3c2440/mach-smdk2440.c
+++ b/arch/arm/mach-s3c2440/mach-smdk2440.c
@@ -183,5 +183,5 @@ MACHINE_START(S3C2440, "SMDK2440")
         .map_io         = smdk2440_map_io,
         .init_machine   = smdk2440_machine_init,
         .timer          = &s3c24xx_timer,
-        .restart        = s3c2440_restart,
+        .restart        = s3c244x_restart,
 MACHINE_END
diff --git a/arch/arm/mach-s3c2440/s3c2440.c b/arch/arm/mach-s3c2440/s3c2440.c
index 517623a09fc5..2b3dddb49af7 100644
--- a/arch/arm/mach-s3c2440/s3c2440.c
+++ b/arch/arm/mach-s3c2440/s3c2440.c
@@ -35,7 +35,6 @@
 #include <plat/cpu.h>
 #include <plat/s3c244x.h>
 #include <plat/pm.h>
-#include <plat/watchdog-reset.h>
 
 #include <plat/gpio-core.h>
 #include <plat/gpio-cfg.h>
@@ -74,15 +73,3 @@ void __init s3c2440_map_io(void)
         s3c24xx_gpiocfg_default.set_pull = s3c24xx_gpio_setpull_1up;
         s3c24xx_gpiocfg_default.get_pull = s3c24xx_gpio_getpull_1up;
 }
-
-void s3c2440_restart(char mode, const char *cmd)
-{
-        if (mode == 's') {
-                soft_restart(0);
-        }
-
-        arch_wdt_reset();
-
-        /* we'll take a jump through zero as a poor second */
-        soft_restart(0);
-}
diff --git a/arch/arm/mach-s3c2440/s3c244x.c b/arch/arm/mach-s3c2440/s3c244x.c
index 36bc60f61d0a..d15852f642b7 100644
--- a/arch/arm/mach-s3c2440/s3c244x.c
+++ b/arch/arm/mach-s3c2440/s3c244x.c
@@ -46,6 +46,7 @@
 #include <plat/pm.h>
 #include <plat/pll.h>
 #include <plat/nand-core.h>
+#include <plat/watchdog-reset.h>
 
 static struct map_desc s3c244x_iodesc[] __initdata = {
         IODESC_ENT(CLKPWR),
@@ -196,3 +197,14 @@ struct syscore_ops s3c244x_pm_syscore_ops = {
         .suspend        = s3c244x_suspend,
         .resume         = s3c244x_resume,
 };
+
+void s3c244x_restart(char mode, const char *cmd)
+{
+        if (mode == 's')
+                soft_restart(0);
+
+        arch_wdt_reset();
+
+        /* we'll take a jump through zero as a poor second */
+        soft_restart(0);
+}
diff --git a/arch/arm/mach-shmobile/board-ag5evm.c b/arch/arm/mach-shmobile/board-ag5evm.c
index eff8a96c75ee..068b754bc348 100644
--- a/arch/arm/mach-shmobile/board-ag5evm.c
+++ b/arch/arm/mach-shmobile/board-ag5evm.c
@@ -30,6 +30,7 @@
 #include <linux/serial_sci.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/mmc/host.h>
@@ -37,7 +38,6 @@
 #include <linux/mmc/sh_mobile_sdhi.h>
 #include <linux/mfd/tmio.h>
 #include <linux/sh_clk.h>
-#include <linux/dma-mapping.h>
 #include <video/sh_mobile_lcdc.h>
 #include <video/sh_mipi_dsi.h>
 #include <sound/sh_fsi.h>
@@ -159,19 +159,12 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
 static struct sh_mmcif_plat_data sh_mmcif_platdata = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195,
         .caps           = MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device mmc_device = {
@@ -321,12 +314,11 @@ static struct resource mipidsi0_resources[] = {
         },
 };
 
-#define DSI0PHYCR       0xe615006c
 static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                                  void __iomem *base,
                                  int enable)
 {
-        struct clk *pck;
+        struct clk *pck, *phy;
         int ret;
 
         pck = clk_get(&pdev->dev, "dsip_clk");
@@ -335,18 +327,27 @@ static int sh_mipi_set_dot_clock(struct platform_device *pdev,
                 goto sh_mipi_set_dot_clock_pck_err;
         }
 
+        phy = clk_get(&pdev->dev, "dsiphy_clk");
+        if (IS_ERR(phy)) {
+                ret = PTR_ERR(phy);
+                goto sh_mipi_set_dot_clock_phy_err;
+        }
+
         if (enable) {
                 clk_set_rate(pck, clk_round_rate(pck,  24000000));
-                __raw_writel(0x2a809010, DSI0PHYCR);
+                clk_set_rate(phy, clk_round_rate(pck, 510000000));
                 clk_enable(pck);
+                clk_enable(phy);
         } else {
                 clk_disable(pck);
+                clk_disable(phy);
         }
 
         ret = 0;
 
+        clk_put(phy);
+sh_mipi_set_dot_clock_phy_err:
         clk_put(pck);
-
 sh_mipi_set_dot_clock_pck_err:
         return ret;
 }
diff --git a/arch/arm/mach-shmobile/board-ap4evb.c b/arch/arm/mach-shmobile/board-ap4evb.c
index aab0a349f759..eeb4d9664584 100644
--- a/arch/arm/mach-shmobile/board-ap4evb.c
+++ b/arch/arm/mach-shmobile/board-ap4evb.c
@@ -295,15 +295,6 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -311,7 +302,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                           MMC_CAP_8_BIT_DATA |
                           MMC_CAP_NEEDS_POLL,
         .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/arm/mach-shmobile/board-kota2.c b/arch/arm/mach-shmobile/board-kota2.c
index 857ceeec1bb0..c8e7ca23fc06 100644
--- a/arch/arm/mach-shmobile/board-kota2.c
+++ b/arch/arm/mach-shmobile/board-kota2.c
@@ -143,11 +143,10 @@ static struct gpio_keys_button gpio_buttons[] = {
 static struct gpio_keys_platform_data gpio_key_info = {
         .buttons        = gpio_buttons,
         .nbuttons       = ARRAY_SIZE(gpio_buttons),
-        .poll_interval  = 250, /* polled for now */
 };
 
 static struct platform_device gpio_keys_device = {
-        .name   = "gpio-keys-polled", /* polled for now */
+        .name   = "gpio-keys",
         .id     = -1,
         .dev    = {
                 .platform_data  = &gpio_key_info,
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index 9b42fbd10f8e..a2813247b455 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -43,7 +43,6 @@
 #include <linux/smsc911x.h>
 #include <linux/sh_intc.h>
 #include <linux/tca6416_keypad.h>
-#include <linux/usb/r8a66597.h>
 #include <linux/usb/renesas_usbhs.h>
 #include <linux/dma-mapping.h>
 
@@ -145,11 +144,6 @@
  * 1-2 short | VBUS 5V       | Host
  * open      | external VBUS | Function
  *
- * *1
- * CN31 is used as
- * CONFIG_USB_R8A66597_HCD      Host
- * CONFIG_USB_RENESAS_USBHS     Function
- *
  * CAUTION
  *
  * renesas_usbhs driver can use external interrupt mode
@@ -161,15 +155,6 @@
  * mackerel can not use external interrupt (IRQ7-PORT167) mode on "USB0",
  * because Touchscreen is using IRQ7-PORT40.
  * It is impossible to use IRQ7 demux on this board.
- *
- * We can use external interrupt mode USB-Function on "USB1".
- * USB1 can become Host by r8a66597, and become Function by renesas_usbhs.
- * But don't select both drivers in same time.
- * These uses same IRQ number for request_irq(), and aren't supporting
- * IRQF_SHARED / IORESOURCE_IRQ_SHAREABLE.
- *
- * Actually these are old/new version of USB driver.
- * This mean its register will be broken if it supports shared IRQ,
  */
 
 /*
@@ -208,6 +193,16 @@
  */
 
 /*
+ * FSI - AK4642
+ *
+ * it needs amixer settings for playing
+ *
+ * amixer set "Headphone" on
+ * amixer set "HPOUTL Mixer DACH" on
+ * amixer set "HPOUTR Mixer DACH" on
+ */
+
+/*
  * FIXME !!
  *
  * gpio_no_direction
@@ -676,51 +671,16 @@ static struct platform_device usbhs0_device = {
  * Use J30 to select between Host and Function. This setting
  * can however not be detected by software. Hotplug of USBHS1
  * is provided via IRQ8.
+ *
+ * Current USB1 works as "USB Host".
+ *  - set J30 "short"
+ *
+ * If you want to use it as "USB gadget",
+ *  - J30 "open"
+ *  - modify usbhs1_get_id() USBHS_HOST -> USBHS_GADGET
+ *  - add .get_vbus = usbhs_get_vbus in usbhs1_private
  */
 #define IRQ8 evt2irq(0x0300)
-
-/* USBHS1 USB Host support via r8a66597_hcd */
-static void usb1_host_port_power(int port, int power)
-{
-        if (!power) /* only power-on is supported for now */
-                return;
-
-        /* set VBOUT/PWEN and EXTLP1 in DVSTCTR */
-        __raw_writew(__raw_readw(0xE68B0008) | 0x600, 0xE68B0008);
-}
-
-static struct r8a66597_platdata usb1_host_data = {
-        .on_chip        = 1,
-        .port_power     = usb1_host_port_power,
-};
-
-static struct resource usb1_host_resources[] = {
-        [0] = {
-                .name   = "USBHS1",
-                .start  = 0xe68b0000,
-                .end    = 0xe68b00e6 - 1,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = evt2irq(0x1ce0) /* USB1_USB1I0 */,
-                .flags  = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device usb1_host_device = {
-        .name   = "r8a66597_hcd",
-        .id     = 1,
-        .dev = {
-                .dma_mask               = NULL,         /*  not use dma */
-                .coherent_dma_mask      = 0xffffffff,
-                .platform_data          = &usb1_host_data,
-        },
-        .num_resources  = ARRAY_SIZE(usb1_host_resources),
-        .resource       = usb1_host_resources,
-};
-
-/* USBHS1 USB Function support via renesas_usbhs */
-
 #define USB_PHY_MODE            (1 << 4)
 #define USB_PHY_INT_EN          ((1 << 3) | (1 << 2))
 #define USB_PHY_ON              (1 << 1)
@@ -776,7 +736,7 @@ static void usbhs1_hardware_exit(struct platform_device *pdev)
 
 static int usbhs1_get_id(struct platform_device *pdev)
 {
-        return USBHS_GADGET;
+        return USBHS_HOST;
 }
 
 static u32 usbhs1_pipe_cfg[] = {
@@ -807,7 +767,6 @@ static struct usbhs_private usbhs1_private = {
                         .hardware_exit  = usbhs1_hardware_exit,
                         .get_id         = usbhs1_get_id,
                         .phy_reset      = usbhs_phy_reset,
-                        .get_vbus       = usbhs_get_vbus,
                 },
                 .driver_param = {
                         .buswait_bwait  = 4,
@@ -1184,15 +1143,6 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh_mmcif_dma = {
-        .chan_priv_rx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_RX,
-        },
-        .chan_priv_tx   = {
-                .slave_id       = SHDMA_SLAVE_MMCIF_TX,
-        },
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
         .sup_pclk       = 0,
         .ocr            = MMC_VDD_165_195 | MMC_VDD_32_33 | MMC_VDD_33_34,
@@ -1200,7 +1150,8 @@ static struct sh_mmcif_plat_data sh_mmcif_plat = {
                           MMC_CAP_8_BIT_DATA |
                           MMC_CAP_NEEDS_POLL,
         .get_cd         = slot_cn7_get_cd,
-        .dma            = &sh_mmcif_dma,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
@@ -1311,7 +1262,6 @@ static struct platform_device *mackerel_devices[] __initdata = {
         &nor_flash_device,
         &smc911x_device,
         &lcdc_device,
-        &usb1_host_device,
         &usbhs1_device,
         &usbhs0_device,
         &leds_device,
@@ -1473,9 +1423,6 @@ static void __init mackerel_init(void)
         gpio_pull_down(GPIO_PORT167CR); /* VBUS0_1 pull down */
         gpio_request(GPIO_FN_IDIN_1_113, NULL);
 
-        /* USB phy tweak to make the r8a66597_hcd host driver work */
-        __raw_writew(0x8a0a, 0xe6058130);       /* USBCR4 */
-
         /* enable FSI2 port A (ak4643) */
         gpio_request(GPIO_FN_FSIAIBT,   NULL);
         gpio_request(GPIO_FN_FSIAILR,   NULL);
diff --git a/arch/arm/mach-shmobile/clock-sh73a0.c b/arch/arm/mach-shmobile/clock-sh73a0.c
index afbead6a6e17..7727cca6136c 100644
--- a/arch/arm/mach-shmobile/clock-sh73a0.c
+++ b/arch/arm/mach-shmobile/clock-sh73a0.c
@@ -365,6 +365,114 @@ static struct clk div6_clks[DIV6_NR] = {
                         dsi_parent, ARRAY_SIZE(dsi_parent), 12, 3),
 };
 
+/* DSI DIV */
+static unsigned long dsiphy_recalc(struct clk *clk)
+{
+        u32 value;
+
+        value = __raw_readl(clk->mapping->base);
+
+        /* FIXME */
+        if (!(value & 0x000B8000))
+                return clk->parent->rate;
+
+        value &= 0x3f;
+        value += 1;
+
+        if ((value < 12) ||
+            (value > 33)) {
+                pr_err("DSIPHY has wrong value (%d)", value);
+                return 0;
+        }
+
+        return clk->parent->rate / value;
+}
+
+static long dsiphy_round_rate(struct clk *clk, unsigned long rate)
+{
+        return clk_rate_mult_range_round(clk, 12, 33, rate);
+}
+
+static void dsiphy_disable(struct clk *clk)
+{
+        u32 value;
+
+        value = __raw_readl(clk->mapping->base);
+        value &= ~0x000B8000;
+
+        __raw_writel(value , clk->mapping->base);
+}
+
+static int dsiphy_enable(struct clk *clk)
+{
+        u32 value;
+        int multi;
+
+        value = __raw_readl(clk->mapping->base);
+        multi = (value & 0x3f) + 1;
+
+        if ((multi < 12) || (multi > 33))
+                return -EIO;
+
+        __raw_writel(value | 0x000B8000, clk->mapping->base);
+
+        return 0;
+}
+
+static int dsiphy_set_rate(struct clk *clk, unsigned long rate)
+{
+        u32 value;
+        int idx;
+
+        idx = rate / clk->parent->rate;
+        if ((idx < 12) || (idx > 33))
+                return -EINVAL;
+
+        idx += -1;
+
+        value = __raw_readl(clk->mapping->base);
+        value = (value & ~0x3f) + idx;
+
+        __raw_writel(value, clk->mapping->base);
+
+        return 0;
+}
+
+static struct clk_ops dsiphy_clk_ops = {
+        .recalc         = dsiphy_recalc,
+        .round_rate     = dsiphy_round_rate,
+        .set_rate       = dsiphy_set_rate,
+        .enable         = dsiphy_enable,
+        .disable        = dsiphy_disable,
+};
+
+static struct clk_mapping dsi0phy_clk_mapping = {
+        .phys   = DSI0PHYCR,
+        .len    = 4,
+};
+
+static struct clk_mapping dsi1phy_clk_mapping = {
+        .phys   = DSI1PHYCR,
+        .len    = 4,
+};
+
+static struct clk dsi0phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI0P], /* late install */
+        .mapping        = &dsi0phy_clk_mapping,
+};
+
+static struct clk dsi1phy_clk = {
+        .ops            = &dsiphy_clk_ops,
+        .parent         = &div6_clks[DIV6_DSI1P], /* late install */
+        .mapping        = &dsi1phy_clk_mapping,
+};
+
+static struct clk *late_main_clks[] = {
+        &dsi0phy_clk,
+        &dsi1phy_clk,
+};
+
 enum { MSTP001,
         MSTP129, MSTP128, MSTP127, MSTP126, MSTP125, MSTP118, MSTP116, MSTP100,
         MSTP219,
@@ -429,6 +537,8 @@ static struct clk_lookup lookups[] = {
         CLKDEV_ICK_ID("dsit_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSIT]),
         CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.0", &div6_clks[DIV6_DSI0P]),
         CLKDEV_ICK_ID("dsip_clk", "sh-mipi-dsi.1", &div6_clks[DIV6_DSI1P]),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.0", &dsi0phy_clk),
+        CLKDEV_ICK_ID("dsiphy_clk", "sh-mipi-dsi.1", &dsi1phy_clk),
 
         /* MSTP32 clocks */
         CLKDEV_DEV_ID("i2c-sh_mobile.2", &mstp_clks[MSTP001]), /* I2C2 */
@@ -504,6 +614,9 @@ void __init sh73a0_clock_init(void)
         if (!ret)
                 ret = sh_clk_mstp32_register(mstp_clks, MSTP_NR);
 
+        for (k = 0; !ret && (k < ARRAY_SIZE(late_main_clks)); k++)
+                ret = clk_register(late_main_clks[k]);
+
         clkdev_add_table(lookups, ARRAY_SIZE(lookups));
 
         if (!ret)
diff --git a/arch/arm/mach-shmobile/include/mach/sh73a0.h b/arch/arm/mach-shmobile/include/mach/sh73a0.h
index 881d515a9686..cad57578ceed 100644
--- a/arch/arm/mach-shmobile/include/mach/sh73a0.h
+++ b/arch/arm/mach-shmobile/include/mach/sh73a0.h
@@ -515,8 +515,8 @@ enum {
         SHDMA_SLAVE_MMCIF_RX,
 };
 
-/* PINT interrupts are located at Linux IRQ 768 and up */
-#define SH73A0_PINT0_IRQ(irq) ((irq) + 768)
-#define SH73A0_PINT1_IRQ(irq) ((irq) + 800)
+/* PINT interrupts are located at Linux IRQ 800 and up */
+#define SH73A0_PINT0_IRQ(irq) ((irq) + 800)
+#define SH73A0_PINT1_IRQ(irq) ((irq) + 832)
 
 #endif /* __ASM_SH73A0_H__ */
diff --git a/arch/arm/mach-shmobile/intc-sh73a0.c b/arch/arm/mach-shmobile/intc-sh73a0.c
index 1eda6b0b69e3..9857595eaa79 100644
--- a/arch/arm/mach-shmobile/intc-sh73a0.c
+++ b/arch/arm/mach-shmobile/intc-sh73a0.c
@@ -19,6 +19,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 #include <linux/irq.h>
 #include <linux/io.h>
 #include <linux/sh_intc.h>
@@ -445,6 +446,7 @@ void __init sh73a0_init_irq(void)
                 setup_irq(gic_spi(1 + k), &sh73a0_irq_pin_cascade[k]);
 
                 n = intcs_evt2irq(to_intc_vect(gic_spi(1 + k)));
+                WARN_ON(irq_alloc_desc_at(n, numa_node_id()) != n);
                 irq_set_chip_and_handler_name(n, &intca_gic_irq_chip,
                                               handle_level_irq, "level");
                 set_irq_flags(n, IRQF_VALID); /* yuck */
diff --git a/arch/arm/mach-shmobile/pfc-r8a7779.c b/arch/arm/mach-shmobile/pfc-r8a7779.c
index 963532f2b2c4..d14c9b048077 100644
--- a/arch/arm/mach-shmobile/pfc-r8a7779.c
+++ b/arch/arm/mach-shmobile/pfc-r8a7779.c
@@ -2120,7 +2120,7 @@ static struct pinmux_cfg_reg pinmux_config_regs[] = {
             FN_AUDATA3, 0, 0, 0 }
         },
         { PINMUX_CFG_REG_VAR("IPSR4", 0xfffc0030, 32,
-                             3, 1, 1, 1, 1, 1, 1, 3, 3, 1,
+                             3, 1, 1, 1, 1, 1, 1, 3, 3,
                              1, 1, 1, 1, 1, 1, 3, 3, 3, 2) {
             /* IP4_31_29 [3] */
             FN_DU1_DB0, FN_VI2_DATA4_VI2_B4, FN_SCL2_B, FN_SD3_DAT0,
diff --git a/arch/arm/mach-shmobile/pfc-sh7372.c b/arch/arm/mach-shmobile/pfc-sh7372.c
index 1bd6585a6acf..336093f9210a 100644
--- a/arch/arm/mach-shmobile/pfc-sh7372.c
+++ b/arch/arm/mach-shmobile/pfc-sh7372.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/gpio.h>
+#include <mach/irqs.h>
 #include <mach/sh7372.h>
 
 #define CPU_ALL_PORT(fn, pfx, sfx) \
@@ -1594,6 +1595,43 @@ static struct pinmux_data_reg pinmux_data_regs[] = {
         { },
 };
 
+#define EXT_IRQ16L(n) evt2irq(0x200 + ((n) << 5))
+#define EXT_IRQ16H(n) evt2irq(0x3200 + (((n) - 16) << 5))
+static struct pinmux_irq pinmux_irqs[] = {
+        PINMUX_IRQ(EXT_IRQ16L(0), PORT6_FN0, PORT162_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(1), PORT12_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(2), PORT4_FN0, PORT5_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(3), PORT8_FN0, PORT16_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(4), PORT17_FN0, PORT163_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(5), PORT18_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(6), PORT39_FN0, PORT164_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(7), PORT40_FN0, PORT167_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(8), PORT41_FN0, PORT168_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(9), PORT42_FN0, PORT169_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(10), PORT65_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(11), PORT67_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(12), PORT80_FN0, PORT137_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(13), PORT81_FN0, PORT145_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(14), PORT82_FN0, PORT146_FN0),
+        PINMUX_IRQ(EXT_IRQ16L(15), PORT83_FN0, PORT147_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(16), PORT84_FN0, PORT170_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(17), PORT85_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(18), PORT86_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(19), PORT87_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(20), PORT92_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(21), PORT93_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(22), PORT94_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(23), PORT95_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(24), PORT112_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(25), PORT119_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(26), PORT121_FN0, PORT172_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(27), PORT122_FN0, PORT180_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(28), PORT123_FN0, PORT181_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(29), PORT129_FN0, PORT182_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(30), PORT130_FN0, PORT183_FN0),
+        PINMUX_IRQ(EXT_IRQ16H(31), PORT138_FN0, PORT184_FN0),
+};
+
 static struct pinmux_info sh7372_pinmux_info = {
         .name = "sh7372_pfc",
         .reserved_id = PINMUX_RESERVED,
@@ -1614,6 +1652,9 @@ static struct pinmux_info sh7372_pinmux_info = {
 
         .gpio_data = pinmux_data,
         .gpio_data_size = ARRAY_SIZE(pinmux_data),
+
+        .gpio_irq = pinmux_irqs,
+        .gpio_irq_size = ARRAY_SIZE(pinmux_irqs),
 };
 
 void sh7372_pinmux_init(void)
diff --git a/arch/arm/mach-shmobile/smp-sh73a0.c b/arch/arm/mach-shmobile/smp-sh73a0.c
index 0d159d64a345..2d0d4212be41 100644
--- a/arch/arm/mach-shmobile/smp-sh73a0.c
+++ b/arch/arm/mach-shmobile/smp-sh73a0.c
@@ -80,7 +80,7 @@ int __cpuinit sh73a0_boot_secondary(unsigned int cpu)
         /* enable cache coherency */
         modify_scu_cpu_psr(0, 3 << (cpu * 8));
 
-        if (((__raw_readw(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
+        if (((__raw_readl(__io(PSTR)) >> (4 * cpu)) & 3) == 3)
                 __raw_writel(1 << cpu, __io(WUPCR));    /* wake up */
         else
                 __raw_writel(1 << cpu, __io(SRESCR));   /* reset */
diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
index 52af00446a63..c59e8b892d6b 100644
--- a/arch/arm/mach-ux500/Kconfig
+++ b/arch/arm/mach-ux500/Kconfig
@@ -5,7 +5,7 @@ config UX500_SOC_COMMON
         default y
         select ARM_GIC
         select HAS_MTU
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
         select ARM_ERRATA_754322
         select ARM_ERRATA_764369
 
diff --git a/arch/arm/mach-vexpress/Kconfig b/arch/arm/mach-vexpress/Kconfig
index 9b3d0fbaee72..88c3ba151e87 100644
--- a/arch/arm/mach-vexpress/Kconfig
+++ b/arch/arm/mach-vexpress/Kconfig
@@ -7,7 +7,7 @@ config ARCH_VEXPRESS_CA9X4
         select ARM_GIC
         select ARM_ERRATA_720789
         select ARM_ERRATA_751472
-        select ARM_ERRATA_753970
+        select PL310_ERRATA_753970
         select HAVE_SMP
         select MIGHT_HAVE_CACHE_L2X0
 
diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
index 1a3ca2488164..7edef9121632 100644
--- a/arch/arm/mm/Kconfig
+++ b/arch/arm/mm/Kconfig
@@ -631,7 +631,8 @@ comment "Processor Features"
 
 config ARM_LPAE
         bool "Support for the Large Physical Address Extension"
-        depends on MMU && CPU_V7
+        depends on MMU && CPU_32v7 && !CPU_32v6 && !CPU_32v5 && \
+                !CPU_32v4 && !CPU_32v3
         help
           Say Y if you have an ARMv7 processor supporting the LPAE page
           table format and you would like to access memory beyond the
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 7a24d39661f0..a655d3da386d 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -55,7 +55,7 @@ loop1:
         cmp     r1, #2                          @ see what cache we have at this level
         blt     skip                            @ skip if no cache, or just i-cache
 #ifdef CONFIG_PREEMPT
-        save_and_disable_irqs r9                @ make cssr&csidr read atomic
+        save_and_disable_irqs_notrace r9        @ make cssr&csidr read atomic
 #endif
         mcr     p15, 2, r10, c0, c0, 0          @ select current cache level in cssr
         isb                                     @ isb to sych the new cssr&csidr
diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 0404ccbb8aa3..f1c8486f7501 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -230,9 +230,7 @@ __v7_setup:
         mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
 #endif
 #ifdef CONFIG_ARM_ERRATA_743622
-        teq     r6, #0x20                       @ present in r2p0
-        teqne   r6, #0x21                       @ present in r2p1
-        teqne   r6, #0x22                       @ present in r2p2
+        teq     r5, #0x00200000                 @ only present in r2p*
         mrceq   p15, 0, r10, c15, c0, 1         @ read diagnostic register
         orreq   r10, r10, #1 << 6               @ set bit #6
         mcreq   p15, 0, r10, c15, c0, 1         @ write diagnostic register
diff --git a/arch/arm/plat-omap/common.c b/arch/arm/plat-omap/common.c
index 06383b51e655..4de7d1e79e73 100644
--- a/arch/arm/plat-omap/common.c
+++ b/arch/arm/plat-omap/common.c
@@ -69,6 +69,7 @@ void __init omap_reserve(void)
         omap_vram_reserve_sdram_memblock();
         omap_dsp_reserve_sdram_memblock();
         omap_secure_ram_reserve_memblock();
+        omap_barrier_reserve_memblock();
 }
 
 void __init omap_init_consistent_dma_size(void)
diff --git a/arch/arm/plat-omap/include/plat/irqs.h b/arch/arm/plat-omap/include/plat/irqs.h
index 2efd6454bce0..37bbbbb981b2 100644
--- a/arch/arm/plat-omap/include/plat/irqs.h
+++ b/arch/arm/plat-omap/include/plat/irqs.h
@@ -428,8 +428,16 @@
 #define OMAP_GPMC_NR_IRQS       8
 #define OMAP_GPMC_IRQ_END       (OMAP_GPMC_IRQ_BASE + OMAP_GPMC_NR_IRQS)
 
+/* PRCM IRQ handler */
+#ifdef CONFIG_ARCH_OMAP2PLUS
+#define OMAP_PRCM_IRQ_BASE      (OMAP_GPMC_IRQ_END)
+#define OMAP_PRCM_NR_IRQS       64
+#define OMAP_PRCM_IRQ_END       (OMAP_PRCM_IRQ_BASE + OMAP_PRCM_NR_IRQS)
+#else
+#define OMAP_PRCM_IRQ_END       OMAP_GPMC_IRQ_END
+#endif
 
-#define NR_IRQS                 OMAP_GPMC_IRQ_END
+#define NR_IRQS                 OMAP_PRCM_IRQ_END
 
 #define OMAP_IRQ_BIT(irq)       (1 << ((irq) % 32))
 
diff --git a/arch/arm/plat-omap/include/plat/omap-secure.h b/arch/arm/plat-omap/include/plat/omap-secure.h
index 3047ff923a63..8c7994ce9869 100644
--- a/arch/arm/plat-omap/include/plat/omap-secure.h
+++ b/arch/arm/plat-omap/include/plat/omap-secure.h
@@ -10,4 +10,10 @@ static inline void omap_secure_ram_reserve_memblock(void)
 { }
 #endif
 
+#ifdef CONFIG_OMAP4_ERRATA_I688
+extern int omap_barrier_reserve_memblock(void);
+#else
+static inline void omap_barrier_reserve_memblock(void)
+{ }
+#endif
 #endif /* __OMAP_SECURE_H__ */
diff --git a/arch/arm/plat-s3c24xx/dma.c b/arch/arm/plat-s3c24xx/dma.c
index 9fe35348e03b..2bab4c99a234 100644
--- a/arch/arm/plat-s3c24xx/dma.c
+++ b/arch/arm/plat-s3c24xx/dma.c
@@ -1249,7 +1249,7 @@ static void s3c2410_dma_resume(void)
         struct s3c2410_dma_chan *cp = s3c2410_chans + dma_channels - 1;
         int channel;
 
-        for (channel = dma_channels - 1; channel >= 0; cp++, channel--)
+        for (channel = dma_channels - 1; channel >= 0; cp--, channel--)
                 s3c2410_dma_resume_chan(cp);
 }
 
diff --git a/arch/arm/plat-samsung/devs.c b/arch/arm/plat-samsung/devs.c
index f10768e988d4..d21d744e4d99 100644
--- a/arch/arm/plat-samsung/devs.c
+++ b/arch/arm/plat-samsung/devs.c
@@ -1409,7 +1409,7 @@ void __init s5p_ehci_set_platdata(struct s5p_ehci_platdata *pd)
 
 #ifdef CONFIG_S3C_DEV_USB_HSOTG
 static struct resource s3c_usb_hsotg_resources[] = {
-        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_16K),
+        [0] = DEFINE_RES_MEM(S3C_PA_USB_HSOTG, SZ_128K),
         [1] = DEFINE_RES_IRQ(IRQ_OTG),
 };
 
diff --git a/arch/arm/plat-spear/time.c b/arch/arm/plat-spear/time.c
index 0c77e4298675..abb5bdecd509 100644
--- a/arch/arm/plat-spear/time.c
+++ b/arch/arm/plat-spear/time.c
@@ -145,11 +145,13 @@ static void clockevent_set_mode(enum clock_event_mode mode,
 static int clockevent_next_event(unsigned long cycles,
                                  struct clock_event_device *clk_event_dev)
 {
-        u16 val;
+        u16 val = readw(gpt_base + CR(CLKEVT));
+
+        if (val & CTRL_ENABLE)
+                writew(val & ~CTRL_ENABLE, gpt_base + CR(CLKEVT));
 
         writew(cycles, gpt_base + LOAD(CLKEVT));
 
-        val = readw(gpt_base + CR(CLKEVT));
         val |= CTRL_ENABLE | CTRL_INT_ENABLE;
         writew(val, gpt_base + CR(CLKEVT));
 
diff --git a/arch/c6x/boot/Makefile b/arch/c6x/boot/Makefile
index ecca820e6041..6891257d514c 100644
--- a/arch/c6x/boot/Makefile
+++ b/arch/c6x/boot/Makefile
@@ -13,7 +13,7 @@ obj-y += linked_dtb.o
 endif
 
 $(obj)/%.dtb: $(src)/dts/%.dts FORCE
-        $(call cmd,dtc)
+        $(call if_changed_dep,dtc)
 
 quiet_cmd_cp = CP      $< $@$2
         cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false)
diff --git a/arch/c6x/include/asm/processor.h b/arch/c6x/include/asm/processor.h
index 8154c4ee8c9c..77ecbded1f37 100644
--- a/arch/c6x/include/asm/processor.h
+++ b/arch/c6x/include/asm/processor.h
@@ -122,8 +122,8 @@ extern int kernel_thread(int (*fn)(void *), void * arg, unsigned long flags);
 
 extern unsigned long get_wchan(struct task_struct *p);
 
-#define KSTK_EIP(tsk)   (task_pt_regs(task)->pc)
-#define KSTK_ESP(tsk)   (task_pt_regs(task)->sp)
+#define KSTK_EIP(task)  (task_pt_regs(task)->pc)
+#define KSTK_ESP(task)  (task_pt_regs(task)->sp)
 
 #define cpu_relax()             do { } while (0)
 
diff --git a/arch/m68k/include/asm/mcf_pgtable.h b/arch/m68k/include/asm/mcf_pgtable.h
index 756bde4fb4f8..3c793682e5d9 100644
--- a/arch/m68k/include/asm/mcf_pgtable.h
+++ b/arch/m68k/include/asm/mcf_pgtable.h
@@ -78,7 +78,8 @@
                                  | CF_PAGE_READABLE \
                                  | CF_PAGE_WRITABLE \
                                  | CF_PAGE_EXEC \
-                                 | CF_PAGE_SYSTEM)
+                                 | CF_PAGE_SYSTEM \
+                                 | CF_PAGE_SHARED)
 
 #define PAGE_COPY       __pgprot(CF_PAGE_VALID \
                                  | CF_PAGE_ACCESSED \
diff --git a/arch/m68k/mm/mcfmmu.c b/arch/m68k/mm/mcfmmu.c
index babd5a97cdcb..875b800ef0dd 100644
--- a/arch/m68k/mm/mcfmmu.c
+++ b/arch/m68k/mm/mcfmmu.c
@@ -87,7 +87,7 @@ void __init paging_init(void)
 
 int cf_tlb_miss(struct pt_regs *regs, int write, int dtlb, int extension_word)
 {
-        unsigned long flags, mmuar;
+        unsigned long flags, mmuar, mmutr;
         struct mm_struct *mm;
         pgd_t *pgd;
         pmd_t *pmd;
@@ -137,9 +137,10 @@ int cf_tlb_miss(struct pt_regs *regs, int write, int dtlb, int extension_word)
         if (!pte_dirty(*pte) && !KMAPAREA(mmuar))
                 set_pte(pte, pte_wrprotect(*pte));
 
-        mmu_write(MMUTR, (mmuar & PAGE_MASK) | (asid << MMUTR_IDN) |
-                (((int)(pte->pte) & (int)CF_PAGE_MMUTR_MASK)
-                >> CF_PAGE_MMUTR_SHIFT) | MMUTR_V);
+        mmutr = (mmuar & PAGE_MASK) | (asid << MMUTR_IDN) | MMUTR_V;
+        if ((mmuar < TASK_UNMAPPED_BASE) || (mmuar >= TASK_SIZE))
+                mmutr |= (pte->pte & CF_PAGE_MMUTR_MASK) >> CF_PAGE_MMUTR_SHIFT;
+        mmu_write(MMUTR, mmutr);
 
         mmu_write(MMUDR, (pte_val(*pte) & PAGE_MASK) |
                 ((pte->pte) & CF_PAGE_MMUDR_MASK) | MMUDR_SZ_8KB | MMUDR_X);
diff --git a/arch/m68k/platform/coldfire/entry.S b/arch/m68k/platform/coldfire/entry.S
index 863889fc31c9..281e38c2b6c7 100644
--- a/arch/m68k/platform/coldfire/entry.S
+++ b/arch/m68k/platform/coldfire/entry.S
@@ -136,7 +136,7 @@ Luser_return:
         movel   %sp,%d1                 /* get thread_info pointer */
         andl    #-THREAD_SIZE,%d1       /* at base of kernel stack */
         movel   %d1,%a0
-        movel   %a0@(TINFO_FLAGS),%d1   /* get thread_info->flags */
+        moveb   %a0@(TINFO_FLAGS+3),%d1 /* thread_info->flags (low 8 bits) */
         jne     Lwork_to_do             /* still work to do */
 
 Lreturn:
@@ -148,8 +148,6 @@ Lwork_to_do:
         btst    #TIF_NEED_RESCHED,%d1
         jne     reschedule
 
-        /* GERG: do we need something here for TRACEing?? */
-
 Lsignal_return:
         subql   #4,%sp                  /* dummy return address */
         SAVE_SWITCH_STACK
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 7da4d0081487..a7193ae13a5d 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -146,7 +146,7 @@ static int __init alchemy_time_init(unsigned int m2int)
         cd->shift = 32;
         cd->mult = div_sc(32768, NSEC_PER_SEC, cd->shift);
         cd->max_delta_ns = clockevent_delta2ns(0xffffffff, cd);
-        cd->min_delta_ns = clockevent_delta2ns(8, cd);  /* ~0.25ms */
+        cd->min_delta_ns = clockevent_delta2ns(9, cd);  /* ~0.28ms */
         clockevents_register_device(cd);
         setup_irq(m2int, &au1x_rtcmatch2_irqaction);
 
diff --git a/arch/mips/ath79/dev-wmac.c b/arch/mips/ath79/dev-wmac.c
index 24f546985b69..e21507052066 100644
--- a/arch/mips/ath79/dev-wmac.c
+++ b/arch/mips/ath79/dev-wmac.c
@@ -96,7 +96,7 @@ void __init ath79_register_wmac(u8 *cal_data)
 {
         if (soc_is_ar913x())
                 ar913x_wmac_setup();
-        if (soc_is_ar933x())
+        else if (soc_is_ar933x())
                 ar933x_wmac_setup();
         else
                 BUG();
diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig
index 4479fd669ac1..28c6b276c216 100644
--- a/arch/mips/configs/nlm_xlp_defconfig
+++ b/arch/mips/configs/nlm_xlp_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 # CONFIG_SECCOMP is not set
 CONFIG_USE_OF=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_CGROUPS=y
 CONFIG_NAMESPACES=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlp"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_LZMA=y
diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig
index 7c68666fdd64..d0b857d98c91 100644
--- a/arch/mips/configs/nlm_xlr_defconfig
+++ b/arch/mips/configs/nlm_xlr_defconfig
@@ -8,7 +8,7 @@ CONFIG_HIGH_RES_TIMERS=y
 CONFIG_PREEMPT_VOLUNTARY=y
 CONFIG_KEXEC=y
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-gnu-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
@@ -22,7 +22,7 @@ CONFIG_AUDIT=y
 CONFIG_NAMESPACES=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
-CONFIG_INITRAMFS_SOURCE="usr/dev_file_list usr/rootfs.xlr"
+CONFIG_INITRAMFS_SOURCE=""
 CONFIG_RD_BZIP2=y
 CONFIG_RD_LZMA=y
 CONFIG_INITRAMFS_COMPRESSION_GZIP=y
diff --git a/arch/mips/configs/powertv_defconfig b/arch/mips/configs/powertv_defconfig
index 3b0b6e8c8533..7fda0ce5f692 100644
--- a/arch/mips/configs/powertv_defconfig
+++ b/arch/mips/configs/powertv_defconfig
@@ -6,7 +6,7 @@ CONFIG_HZ_1000=y
 CONFIG_PREEMPT=y
 # CONFIG_SECCOMP is not set
 CONFIG_EXPERIMENTAL=y
-CONFIG_CROSS_COMPILE="mips-linux-"
+CONFIG_CROSS_COMPILE=""
 # CONFIG_SWAP is not set
 CONFIG_SYSVIPC=y
 CONFIG_LOG_BUF_SHIFT=16
diff --git a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
index 556e1be20bf6..fb9975c74c57 100644
--- a/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
+++ b/arch/mips/include/asm/mach-au1x00/gpio-au1300.h
@@ -11,6 +11,9 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1000.h>
 
+struct gpio;
+struct gpio_chip;
+
 /* with the current GPIC design, up to 128 GPIOs are possible.
  * The only implementation so far is in the Au1300, which has 75 externally
  * available GPIOs.
@@ -203,7 +206,22 @@ static inline int gpio_request(unsigned int gpio, const char *label)
         return 0;
 }
 
-static inline void gpio_free(unsigned int gpio)
+static inline int gpio_request_one(unsigned gpio,
+                                        unsigned long flags, const char *label)
+{
+        return 0;
+}
+
+static inline int gpio_request_array(struct gpio *array, size_t num)
+{
+        return 0;
+}
+
+static inline void gpio_free(unsigned gpio)
+{
+}
+
+static inline void gpio_free_array(struct gpio *array, size_t num)
 {
 }
 
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index d41790928c64..da9bd7d270d1 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -39,9 +39,6 @@
 #define HPAGE_MASK      (~(HPAGE_SIZE - 1))
 #define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
 #else /* !CONFIG_HUGETLB_PAGE */
-# ifndef BUILD_BUG
-#  define BUILD_BUG() do { extern void __build_bug(void); __build_bug(); } while (0)
-# endif
 #define HPAGE_SHIFT     ({BUILD_BUG(); 0; })
 #define HPAGE_SIZE      ({BUILD_BUG(); 0; })
 #define HPAGE_MASK      ({BUILD_BUG(); 0; })
diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c
index 58fe71afd879..d5e950ab8527 100644
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -8,7 +8,6 @@
  * SMP support for BMIPS
  */
 
-#include <linux/version.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/mm.h>
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index cc4a3f120f54..d79ae5437b58 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1135,7 +1135,7 @@ asmlinkage void do_mt(struct pt_regs *regs)
                 printk(KERN_DEBUG "YIELD Scheduler Exception\n");
                 break;
         case 5:
-                printk(KERN_DEBUG "Gating Storage Schedulier Exception\n");
+                printk(KERN_DEBUG "Gating Storage Scheduler Exception\n");
                 break;
         default:
                 printk(KERN_DEBUG "*** UNKNOWN THREAD EXCEPTION %d ***\n",
diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
index a81176f44c74..924da5eb7031 100644
--- a/arch/mips/kernel/vmlinux.lds.S
+++ b/arch/mips/kernel/vmlinux.lds.S
@@ -69,7 +69,6 @@ SECTIONS
         RODATA
 
         /* writeable */
-        _sdata = .;                             /* Start of data section */
         .data : {       /* Data */
                 . = . + DATAOFFSET;             /* for CONFIG_MAPPED_KERNEL */
 
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index 937cf3368164..69ebd586d7ff 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -42,6 +42,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         const int field = sizeof(unsigned long) * 2;
         siginfo_t info;
         int fault;
+        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
+                                                 (write ? FAULT_FLAG_WRITE : 0);
 
 #if 0
         printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
@@ -91,6 +93,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs, unsigned long writ
         if (in_atomic() || !mm)
                 goto bad_area_nosemaphore;
 
+retry:
         down_read(&mm->mmap_sem);
         vma = find_vma(mm, address);
         if (!vma)
@@ -144,7 +147,11 @@ good_area:
          * make sure we exit gracefully rather than endlessly redo
          * the fault.
          */
-        fault = handle_mm_fault(mm, vma, address, write ? FAULT_FLAG_WRITE : 0);
+        fault = handle_mm_fault(mm, vma, address, flags);
+
+        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
+                return;
+
         perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
         if (unlikely(fault & VM_FAULT_ERROR)) {
                 if (fault & VM_FAULT_OOM)
@@ -153,12 +160,27 @@ good_area:
                         goto do_sigbus;
                 BUG();
         }
-        if (fault & VM_FAULT_MAJOR) {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, address);
-                tsk->maj_flt++;
-        } else {
-                perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, address);
-                tsk->min_flt++;
+        if (flags & FAULT_FLAG_ALLOW_RETRY) {
+                if (fault & VM_FAULT_MAJOR) {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
+                                                  regs, address);
+                        tsk->maj_flt++;
+                } else {
+                        perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
+                                                  regs, address);
+                        tsk->min_flt++;
+                }
+                if (fault & VM_FAULT_RETRY) {
+                        flags &= ~FAULT_FLAG_ALLOW_RETRY;
+
+                        /*
+                         * No need to up_read(&mm->mmap_sem) as we would
+                         * have already released it in __lock_page_or_retry
+                         * in mm/filemap.c.
+                         */
+
+                        goto retry;
+                }
         }
 
         up_read(&mm->mmap_sem);
diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c
index aec2b111d35b..15521505ebe8 100644
--- a/arch/mips/pci/pci.c
+++ b/arch/mips/pci/pci.c
@@ -279,7 +279,6 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
 {
         /* Propagate hose info into the subordinate devices.  */
 
-        struct list_head *ln;
         struct pci_dev *dev = bus->self;
 
         if (pci_probe_only && dev &&
@@ -288,9 +287,7 @@ void __devinit pcibios_fixup_bus(struct pci_bus *bus)
                 pcibios_fixup_device_resources(dev, bus);
         }
 
-        for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
-                dev = pci_dev_b(ln);
-
+        list_for_each_entry(dev, &bus->devices, bus_list) {
                 if ((dev->class >> 8) != PCI_CLASS_BRIDGE_PCI)
                         pcibios_fixup_device_resources(dev, bus);
         }
diff --git a/arch/mips/pmc-sierra/yosemite/ht-irq.c b/arch/mips/pmc-sierra/yosemite/ht-irq.c
index 86b98e98fb4f..62ead6601c69 100644
--- a/arch/mips/pmc-sierra/yosemite/ht-irq.c
+++ b/arch/mips/pmc-sierra/yosemite/ht-irq.c
@@ -35,16 +35,6 @@
  */
 void __init titan_ht_pcibios_fixup_bus(struct pci_bus *bus)
 {
-        struct pci_bus *current_bus = bus;
-        struct pci_dev *devices;
-        struct list_head *devices_link;
-
-        list_for_each(devices_link, &(current_bus->devices)) {
-                devices = pci_dev_b(devices_link);
-                if (devices == NULL)
-                        continue;
-        }
-
         /*
          * PLX and SPKT related changes go here
          */
diff --git a/arch/mips/txx9/generic/7segled.c b/arch/mips/txx9/generic/7segled.c
index 8e93b2122524..4642f56e70e5 100644
--- a/arch/mips/txx9/generic/7segled.c
+++ b/arch/mips/txx9/generic/7segled.c
@@ -102,7 +102,7 @@ static int __init tx_7segled_init_sysfs(void)
                         break;
                 }
                 dev->id = i;
-                dev->dev = &tx_7segled_subsys;
+                dev->bus = &tx_7segled_subsys;
                 error = device_register(dev);
                 if (!error) {
                         device_create_file(dev, &dev_attr_ascii);
diff --git a/arch/openrisc/include/asm/ptrace.h b/arch/openrisc/include/asm/ptrace.h
index 054537c5f9c9..e612ce4512c7 100644
--- a/arch/openrisc/include/asm/ptrace.h
+++ b/arch/openrisc/include/asm/ptrace.h
@@ -77,7 +77,6 @@ struct pt_regs {
         long  syscallno;        /* Syscall number (used by strace) */
         long dummy;             /* Cheap alignment fix */
 };
-#endif /* __ASSEMBLY__ */
 
 /* TODO: Rename this to REDZONE because that's what it is */
 #define STACK_FRAME_OVERHEAD  128  /* size of minimum stack frame */
@@ -87,6 +86,13 @@ struct pt_regs {
 #define user_stack_pointer(regs)        ((unsigned long)(regs)->sp)
 #define profile_pc(regs)                instruction_pointer(regs)
 
+static inline long regs_return_value(struct pt_regs *regs)
+{
+        return regs->gpr[11];
+}
+
+#endif /* __ASSEMBLY__ */
+
 /*
  * Offsets used by 'ptrace' system call interface.
  */
diff --git a/arch/openrisc/kernel/init_task.c b/arch/openrisc/kernel/init_task.c
index 45744a384927..ca534082d5f3 100644
--- a/arch/openrisc/kernel/init_task.c
+++ b/arch/openrisc/kernel/init_task.c
@@ -17,6 +17,7 @@
 
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/export.h>
 
 static struct signal_struct init_signals = INIT_SIGNALS(init_signals);
 static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
index 59b302338331..4bfead220956 100644
--- a/arch/openrisc/kernel/irq.c
+++ b/arch/openrisc/kernel/irq.c
@@ -23,6 +23,7 @@
 #include <linux/irq.h>
 #include <linux/seq_file.h>
 #include <linux/kernel_stat.h>
+#include <linux/export.h>
 
 #include <linux/irqflags.h>
 
diff --git a/arch/openrisc/kernel/ptrace.c b/arch/openrisc/kernel/ptrace.c
index 656b94beab89..7259047d5f9d 100644
--- a/arch/openrisc/kernel/ptrace.c
+++ b/arch/openrisc/kernel/ptrace.c
@@ -188,11 +188,9 @@ asmlinkage long do_syscall_trace_enter(struct pt_regs *regs)
                  */
                 ret = -1L;
 
-        /* Are these regs right??? */
-        if (unlikely(current->audit_context))
-                audit_syscall_entry(audit_arch(), regs->syscallno,
-                                    regs->gpr[3], regs->gpr[4],
-                                    regs->gpr[5], regs->gpr[6]);
+        audit_syscall_entry(audit_arch(), regs->syscallno,
+                            regs->gpr[3], regs->gpr[4],
+                            regs->gpr[5], regs->gpr[6]);
 
         return ret ? : regs->syscallno;
 }
@@ -201,9 +199,7 @@ asmlinkage void do_syscall_trace_leave(struct pt_regs *regs)
 {
         int step;
 
-        if (unlikely(current->audit_context))
-                audit_syscall_exit(AUDITSC_RESULT(regs->gpr[11]),
-                                   regs->gpr[11]);
+        audit_syscall_exit(regs);
 
         step = test_thread_flag(TIF_SINGLESTEP);
         if (step || test_thread_flag(TIF_SYSCALL_TRACE))
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index 55cca1dac431..19ab7b2ea1cd 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -31,7 +31,11 @@ ifdef CONFIG_64BIT
 UTS_MACHINE     := parisc64
 CHECKFLAGS      += -D__LP64__=1 -m64
 WIDTH           := 64
+
+# FIXME: if no default set, should really try to locate dynamically
+ifeq ($(CROSS_COMPILE),)
 CROSS_COMPILE   := hppa64-linux-gnu-
+endif
 else # 32-bit
 WIDTH           :=
 endif
diff --git a/arch/powerpc/kernel/entry_32.S b/arch/powerpc/kernel/entry_32.S
index 4f80cf1ce77b..3e57a00b8cba 100644
--- a/arch/powerpc/kernel/entry_32.S
+++ b/arch/powerpc/kernel/entry_32.S
@@ -1213,7 +1213,7 @@ do_user_signal:			/* r10 contains MSR_KERNEL here */
         stw     r3,_TRAP(r1)
 2:      addi    r3,r1,STACK_FRAME_OVERHEAD
         mr      r4,r9
-        bl      do_signal
+        bl      do_notify_resume
         REST_NVGPRS(r1)
         b       recheck
 
diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
index d834425186ae..866462cbe2d8 100644
--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -751,12 +751,16 @@ user_work:
 
         andi.   r0,r4,_TIF_NEED_RESCHED
         beq     1f
+        li      r5,1
+        TRACE_AND_RESTORE_IRQ(r5);
         bl      .schedule
         b       .ret_from_except_lite
 
 1:      bl      .save_nvgprs
+        li      r5,1
+        TRACE_AND_RESTORE_IRQ(r5);
         addi    r3,r1,STACK_FRAME_OVERHEAD
-        bl      .do_signal
+        bl      .do_notify_resume
         b       .ret_from_except
 
 unrecov_restore:
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 3844ca7c5099..15c5a4f6de01 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -774,8 +774,8 @@ alignment_common:
 program_check_common:
         EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
         bl      .save_nvgprs
-        addi    r3,r1,STACK_FRAME_OVERHEAD
         DISABLE_INTS
+        addi    r3,r1,STACK_FRAME_OVERHEAD
         bl      .program_check_exception
         b       .ret_from_except
 
diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c
index 2300426e531a..ac6e437b1021 100644
--- a/arch/powerpc/kernel/signal.c
+++ b/arch/powerpc/kernel/signal.c
@@ -11,6 +11,7 @@
 
 #include <linux/tracehook.h>
 #include <linux/signal.h>
+#include <linux/key.h>
 #include <asm/hw_breakpoint.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -113,8 +114,9 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka,
         }
 }
 
-static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
+static int do_signal(struct pt_regs *regs)
 {
+        sigset_t *oldset;
         siginfo_t info;
         int signr;
         struct k_sigaction ka;
@@ -123,7 +125,7 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
 
         if (current_thread_info()->local_flags & _TLF_RESTORE_SIGMASK)
                 oldset = &current->saved_sigmask;
-        else if (!oldset)
+        else
                 oldset = &current->blocked;
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
@@ -191,14 +193,16 @@ static int do_signal_pending(sigset_t *oldset, struct pt_regs *regs)
         return ret;
 }
 
-void do_signal(struct pt_regs *regs, unsigned long thread_info_flags)
+void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags)
 {
         if (thread_info_flags & _TIF_SIGPENDING)
-                do_signal_pending(NULL, regs);
+                do_signal(regs);
 
         if (thread_info_flags & _TIF_NOTIFY_RESUME) {
                 clear_thread_flag(TIF_NOTIFY_RESUME);
                 tracehook_notify_resume(regs);
+                if (current->replacement_session_keyring)
+                        key_replace_session_keyring();
         }
 }
 
diff --git a/arch/powerpc/kernel/signal.h b/arch/powerpc/kernel/signal.h
index 6c0ddfc0603e..8dde973aaaf5 100644
--- a/arch/powerpc/kernel/signal.h
+++ b/arch/powerpc/kernel/signal.h
@@ -12,7 +12,7 @@
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
 
-extern void do_signal(struct pt_regs *regs, unsigned long thread_info_flags);
+extern void do_notify_resume(struct pt_regs *regs, unsigned long thread_info_flags);
 
 extern void __user * get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
                                   size_t frame_size, int is_32);
diff --git a/arch/powerpc/platforms/wsp/smp.c b/arch/powerpc/platforms/wsp/smp.c
index 71bd105f3863..0ba103ae83a5 100644
--- a/arch/powerpc/platforms/wsp/smp.c
+++ b/arch/powerpc/platforms/wsp/smp.c
@@ -71,7 +71,7 @@ int __devinit smp_a2_kick_cpu(int nr)
 
 static int __init smp_a2_probe(void)
 {
-        return cpus_weight(cpu_possible_map);
+        return num_possible_cpus();
 }
 
 static struct smp_ops_t a2_smp_ops = {
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index d1727584230a..6d99a5fcc090 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -227,6 +227,9 @@ config COMPAT
 config SYSVIPC_COMPAT
         def_bool y if COMPAT && SYSVIPC
 
+config KEYS_COMPAT
+        def_bool y if COMPAT && KEYS
+
 config AUDIT_ARCH
         def_bool y
 
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index 2e49748b27da..234f1d859cea 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -172,13 +172,6 @@ static inline int is_compat_task(void)
         return is_32bit_task();
 }
 
-#else
-
-static inline int is_compat_task(void)
-{
-        return 0;
-}
-
 #endif
 
 static inline void __user *arch_compat_alloc_user_space(long len)
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 18c51df9fe06..ff605a39cf43 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -662,7 +662,7 @@ ENTRY(sys32_getresuid16_wrapper)
 ENTRY(sys32_poll_wrapper)
         llgtr   %r2,%r2                 # struct pollfd *
         llgfr   %r3,%r3                 # unsigned int
-        lgfr    %r4,%r4                 # long
+        lgfr    %r4,%r4                 # int
         jg      sys_poll                # branch to system call
 
 ENTRY(sys32_setresgid16_wrapper)
diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
index 39f8fd4438fc..c383ce440d99 100644
--- a/arch/s390/kernel/crash_dump.c
+++ b/arch/s390/kernel/crash_dump.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
-#include <linux/crash_dump.h>
 #include <linux/bootmem.h>
 #include <linux/elf.h>
 #include <asm/ipl.h>
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 3201ae447990..e795933eb2cb 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -29,7 +29,6 @@
 #include <asm/irq.h>
 #include <asm/timer.h>
 #include <asm/nmi.h>
-#include <asm/compat.h>
 #include <asm/smp.h>
 #include "entry.h"
 
@@ -76,7 +75,6 @@ static void default_idle(void)
         if (test_thread_flag(TIF_MCCK_PENDING)) {
                 local_mcck_enable();
                 local_irq_enable();
-                s390_handle_mcck();
                 return;
         }
         trace_hardirqs_on();
@@ -93,10 +91,12 @@ void cpu_idle(void)
         for (;;) {
                 tick_nohz_idle_enter();
                 rcu_idle_enter();
-                while (!need_resched())
+                while (!need_resched() && !test_thread_flag(TIF_MCCK_PENDING))
                         default_idle();
                 rcu_idle_exit();
                 tick_nohz_idle_exit();
+                if (test_thread_flag(TIF_MCCK_PENDING))
+                        s390_handle_mcck();
                 preempt_enable_no_resched();
                 schedule();
                 preempt_disable();
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 9d82ed4bcb27..61f95489d70c 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -20,8 +20,8 @@
 #include <linux/regset.h>
 #include <linux/tracehook.h>
 #include <linux/seccomp.h>
+#include <linux/compat.h>
 #include <trace/syscall.h>
-#include <asm/compat.h>
 #include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 354de0763eff..3b2efc81f34e 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -46,6 +46,7 @@
 #include <linux/kexec.h>
 #include <linux/crash_dump.h>
 #include <linux/memory.h>
+#include <linux/compat.h>
 
 #include <asm/ipl.h>
 #include <asm/uaccess.h>
@@ -59,7 +60,6 @@
 #include <asm/ptrace.h>
 #include <asm/sections.h>
 #include <asm/ebcdic.h>
-#include <asm/compat.h>
 #include <asm/kvm_virtio.h>
 #include <asm/diag.h>
 
diff --git a/arch/s390/kernel/signal.c b/arch/s390/kernel/signal.c
index a8ba840294ff..2d421d90fada 100644
--- a/arch/s390/kernel/signal.c
+++ b/arch/s390/kernel/signal.c
@@ -30,7 +30,6 @@
 #include <asm/ucontext.h>
 #include <asm/uaccess.h>
 #include <asm/lowcore.h>
-#include <asm/compat.h>
 #include "entry.h"
 
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index fa02f443f5f6..14da278febbf 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -113,11 +113,14 @@ static void fixup_clock_comparator(unsigned long long delta)
 static int s390_next_ktime(ktime_t expires,
                            struct clock_event_device *evt)
 {
+        struct timespec ts;
         u64 nsecs;
 
-        nsecs = ktime_to_ns(ktime_sub(expires, ktime_get_monotonic_offset()));
+        ts.tv_sec = ts.tv_nsec = 0;
+        monotonic_to_bootbased(&ts);
+        nsecs = ktime_to_ns(ktime_add(timespec_to_ktime(ts), expires));
         do_div(nsecs, 125);
-        S390_lowcore.clock_comparator = TOD_UNIX_EPOCH + (nsecs << 9);
+        S390_lowcore.clock_comparator = sched_clock_base_cc + (nsecs << 9);
         set_clock_comparator(S390_lowcore.clock_comparator);
         return 0;
 }
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 354dd39073ef..e8fcd928dc78 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -36,7 +36,6 @@
 #include <asm/pgtable.h>
 #include <asm/irq.h>
 #include <asm/mmu_context.h>
-#include <asm/compat.h>
 #include "../kernel/entry.h"
 
 #ifndef CONFIG_64BIT
diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c
index 5d633019d8f3..50236610de83 100644
--- a/arch/s390/mm/init.c
+++ b/arch/s390/mm/init.c
@@ -223,16 +223,38 @@ void free_initrd_mem(unsigned long start, unsigned long end)
 #ifdef CONFIG_MEMORY_HOTPLUG
 int arch_add_memory(int nid, u64 start, u64 size)
 {
-        struct pglist_data *pgdat;
+        unsigned long zone_start_pfn, zone_end_pfn, nr_pages;
+        unsigned long start_pfn = PFN_DOWN(start);
+        unsigned long size_pages = PFN_DOWN(size);
         struct zone *zone;
         int rc;
 
-        pgdat = NODE_DATA(nid);
-        zone = pgdat->node_zones + ZONE_MOVABLE;
         rc = vmem_add_mapping(start, size);
         if (rc)
                 return rc;
-        rc = __add_pages(nid, zone, PFN_DOWN(start), PFN_DOWN(size));
+        for_each_zone(zone) {
+                if (zone_idx(zone) != ZONE_MOVABLE) {
+                        /* Add range within existing zone limits */
+                        zone_start_pfn = zone->zone_start_pfn;
+                        zone_end_pfn = zone->zone_start_pfn +
+                                       zone->spanned_pages;
+                } else {
+                        /* Add remaining range to ZONE_MOVABLE */
+                        zone_start_pfn = start_pfn;
+                        zone_end_pfn = start_pfn + size_pages;
+                }
+                if (start_pfn < zone_start_pfn || start_pfn >= zone_end_pfn)
+                        continue;
+                nr_pages = (start_pfn + size_pages > zone_end_pfn) ?
+                           zone_end_pfn - start_pfn : size_pages;
+                rc = __add_pages(nid, zone, start_pfn, nr_pages);
+                if (rc)
+                        break;
+                start_pfn += nr_pages;
+                size_pages -= nr_pages;
+                if (!size_pages)
+                        break;
+        }
         if (rc)
                 vmem_remove_mapping(start, size);
         return rc;
diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c
index f09c74881b7e..a0155c02e324 100644
--- a/arch/s390/mm/mmap.c
+++ b/arch/s390/mm/mmap.c
@@ -29,8 +29,8 @@
 #include <linux/mman.h>
 #include <linux/module.h>
 #include <linux/random.h>
+#include <linux/compat.h>
 #include <asm/pgalloc.h>
-#include <asm/compat.h>
 
 static unsigned long stack_maxrandom_size(void)
 {
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 9a4d02f64f16..51b0738e13d1 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -574,7 +574,7 @@ static inline void page_table_free_pgste(unsigned long *table)
         page = pfn_to_page(__pa(table) >> PAGE_SHIFT);
         mp = (struct gmap_pgtable *) page->index;
         BUG_ON(!list_empty(&mp->mapper));
-        pgtable_page_ctor(page);
+        pgtable_page_dtor(page);
         atomic_set(&page->_mapcount, -1);
         kfree(mp);
         __free_page(page);
diff --git a/arch/sh/boards/board-sh7757lcr.c b/arch/sh/boards/board-sh7757lcr.c
index 0838154dd216..24b1ee410daa 100644
--- a/arch/sh/boards/board-sh7757lcr.c
+++ b/arch/sh/boards/board-sh7757lcr.c
@@ -169,6 +169,11 @@ static struct resource sh_eth_giga1_resources[] = {
                 .end    = 0xfee00fff,
                 .flags  = IORESOURCE_MEM,
         }, {
+                /* TSU */
+                .start  = 0xfee01800,
+                .end    = 0xfee01fff,
+                .flags  = IORESOURCE_MEM,
+        }, {
                 .start  = 316,
                 .end    = 316,
                 .flags  = IORESOURCE_IRQ,
@@ -210,20 +215,13 @@ static struct resource sh_mmcif_resources[] = {
         },
 };
 
-static struct sh_mmcif_dma sh7757lcr_mmcif_dma = {
-        .chan_priv_tx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_TX,
-        },
-        .chan_priv_rx   = {
-                .slave_id = SHDMA_SLAVE_MMCIF_RX,
-        }
-};
-
 static struct sh_mmcif_plat_data sh_mmcif_plat = {
-        .dma            = &sh7757lcr_mmcif_dma,
         .sup_pclk       = 0x0f,
-        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA,
+        .caps           = MMC_CAP_4_BIT_DATA | MMC_CAP_8_BIT_DATA |
+                          MMC_CAP_NONREMOVABLE,
         .ocr            = MMC_VDD_32_33 | MMC_VDD_33_34,
+        .slave_id_tx    = SHDMA_SLAVE_MMCIF_TX,
+        .slave_id_rx    = SHDMA_SLAVE_MMCIF_RX,
 };
 
 static struct platform_device sh_mmcif_device = {
diff --git a/arch/sh/boards/mach-ap325rxa/setup.c b/arch/sh/boards/mach-ap325rxa/setup.c
index 6418e95c2b6b..ebd0f818a25f 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -22,6 +22,7 @@
 #include <linux/i2c.h>
 #include <linux/smsc911x.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <media/ov772x.h>
 #include <media/soc_camera.h>
 #include <media/soc_camera_platform.h>
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 033ef2ba621f..cde7c0085ced 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -29,9 +29,11 @@
 #include <linux/input.h>
 #include <linux/input/sh_keysc.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <sound/sh_fsi.h>
 #include <media/sh_mobile_ceu.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <media/mt9t112.h>
 #include <asm/heartbeat.h>
diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index 2a18b06abdaf..5b382e1afaea 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -22,6 +22,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/i2c.h>
 #include <linux/usb/r8a66597.h>
+#include <linux/videodev2.h>
 #include <media/rj54n1cb0c.h>
 #include <media/soc_camera.h>
 #include <media/sh_mobile_ceu.h>
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index 68c3d6f42896..d37ba2720527 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -21,9 +21,11 @@
 #include <linux/delay.h>
 #include <linux/clk.h>
 #include <linux/gpio.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <media/ov772x.h>
+#include <media/soc_camera.h>
 #include <media/tw9910.h>
 #include <asm/clock.h>
 #include <asm/machvec.h>
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 036fe1adaef1..2b07fc016950 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -24,6 +24,7 @@
 #include <linux/input/sh_keysc.h>
 #include <linux/usb/r8a66597.h>
 #include <linux/sh_eth.h>
+#include <linux/videodev2.h>
 #include <video/sh_mobile_lcdc.h>
 #include <media/sh_mobile_ceu.h>
 #include <sound/sh_fsi.h>
diff --git a/arch/sh/drivers/pci/pci-sh7780.c b/arch/sh/drivers/pci/pci-sh7780.c
index fa7b978cc727..fb8f14990743 100644
--- a/arch/sh/drivers/pci/pci-sh7780.c
+++ b/arch/sh/drivers/pci/pci-sh7780.c
@@ -74,7 +74,7 @@ struct pci_errors {
         { SH4_PCIINT_MLCK,      "master lock error" },
         { SH4_PCIINT_TABT,      "target-target abort" },
         { SH4_PCIINT_TRET,      "target retry time out" },
-        { SH4_PCIINT_MFDE,      "master function disable erorr" },
+        { SH4_PCIINT_MFDE,      "master function disable error" },
         { SH4_PCIINT_PRTY,      "address parity error" },
         { SH4_PCIINT_SERR,      "SERR" },
         { SH4_PCIINT_TWDP,      "data parity error for target write" },
diff --git a/arch/sh/include/asm/device.h b/arch/sh/include/asm/device.h
index a1c9c0daec10..071bcb4d4bfd 100644
--- a/arch/sh/include/asm/device.h
+++ b/arch/sh/include/asm/device.h
@@ -3,9 +3,10 @@
  *
  * This file is released under the GPLv2
  */
+#ifndef __ASM_SH_DEVICE_H
+#define __ASM_SH_DEVICE_H
 
-struct dev_archdata {
-};
+#include <asm-generic/device.h>
 
 struct platform_device;
 /* allocate contiguous memory chunk and fill in struct resource */
@@ -14,5 +15,4 @@ int platform_resource_setup_memory(struct platform_device *pdev,
 
 void plat_early_device_setup(void);
 
-struct pdev_archdata {
-};
+#endif /* __ASM_SH_DEVICE_H */
diff --git a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
index b3c039a5064a..70bd96646f42 100644
--- a/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
+++ b/arch/sh/kernel/cpu/sh4a/clock-sh7724.c
@@ -343,7 +343,7 @@ static struct clk_lookup lookups[] = {
         CLKDEV_DEV_ID("sh_mobile_ceu.1", &mstp_clks[HWBLK_CEU1]),
         CLKDEV_CON_ID("beu1", &mstp_clks[HWBLK_BEU1]),
         CLKDEV_CON_ID("2ddmac0", &mstp_clks[HWBLK_2DDMAC]),
-        CLKDEV_CON_ID("spu0", &mstp_clks[HWBLK_SPU]),
+        CLKDEV_DEV_ID("sh_fsi.0", &mstp_clks[HWBLK_SPU]),
         CLKDEV_CON_ID("jpu0", &mstp_clks[HWBLK_JPU]),
         CLKDEV_DEV_ID("sh-vou.0", &mstp_clks[HWBLK_VOU]),
         CLKDEV_CON_ID("beu0", &mstp_clks[HWBLK_BEU0]),
diff --git a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
index a7b2da6b3a1a..2875e8be4f72 100644
--- a/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
+++ b/arch/sh/kernel/cpu/sh4a/setup-sh7757.c
@@ -133,7 +133,7 @@ static struct resource spi0_resources[] = {
         [0] = {
                 .start  = 0xfe002000,
                 .end    = 0xfe0020ff,
-                .flags  = IORESOURCE_MEM,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_32BIT,
         },
         [1] = {
                 .start  = 86,
@@ -661,6 +661,25 @@ static struct platform_device spi0_device = {
         .resource       = spi0_resources,
 };
 
+static struct resource spi1_resources[] = {
+        {
+                .start  = 0xffd8ee70,
+                .end    = 0xffd8eeff,
+                .flags  = IORESOURCE_MEM | IORESOURCE_MEM_8BIT,
+        },
+        {
+                .start  = 54,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device spi1_device = {
+        .name   = "sh_spi",
+        .id     = 1,
+        .num_resources  = ARRAY_SIZE(spi1_resources),
+        .resource       = spi1_resources,
+};
+
 static struct resource usb_ehci_resources[] = {
         [0] = {
                 .start  = 0xfe4f1000,
@@ -720,6 +739,7 @@ static struct platform_device *sh7757_devices[] __initdata = {
         &dma2_device,
         &dma3_device,
         &spi0_device,
+        &spi1_device,
         &usb_ehci_device,
         &usb_ohci_device,
 };
diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c
index 3147a9a6fb8b..f624174bf239 100644
--- a/arch/sh/kernel/smp.c
+++ b/arch/sh/kernel/smp.c
@@ -63,7 +63,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         mp_ops->prepare_cpus(max_cpus);
 
 #ifndef CONFIG_HOTPLUG_CPU
-        init_cpu_present(&cpu_possible_map);
+        init_cpu_present(cpu_possible_mask);
 #endif
 }
 
diff --git a/arch/sh/kernel/topology.c b/arch/sh/kernel/topology.c
index 4649a6ff0cfe..772caffba22f 100644
--- a/arch/sh/kernel/topology.c
+++ b/arch/sh/kernel/topology.c
@@ -27,7 +27,7 @@ static cpumask_t cpu_coregroup_map(unsigned int cpu)
          * Presently all SH-X3 SMP cores are multi-cores, so just keep it
          * simple until we have a method for determining topology..
          */
-        return cpu_possible_map;
+        return *cpu_possible_mask;
 }
 
 const struct cpumask *cpu_coregroup_mask(unsigned int cpu)
diff --git a/arch/sh/mm/cache-sh2a.c b/arch/sh/mm/cache-sh2a.c
index ae08cbbfa569..949e2d3138a0 100644
--- a/arch/sh/mm/cache-sh2a.c
+++ b/arch/sh/mm/cache-sh2a.c
@@ -23,6 +23,7 @@
 #define MAX_OCACHE_PAGES        32
 #define MAX_ICACHE_PAGES        32
 
+#ifdef CONFIG_CACHE_WRITEBACK
 static void sh2a_flush_oc_line(unsigned long v, int way)
 {
         unsigned long addr = (v & 0x000007f0) | (way << 11);
@@ -34,6 +35,7 @@ static void sh2a_flush_oc_line(unsigned long v, int way)
                 __raw_writel(data, CACHE_OC_ADDRESS_ARRAY | addr);
         }
 }
+#endif
 
 static void sh2a_invalidate_line(unsigned long cache_addr, unsigned long v)
 {
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index fd843877e841..39e49091f648 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -315,6 +315,13 @@ static int load_aout_binary(struct linux_binprm *bprm, struct pt_regs *regs)
         current->mm->free_area_cache = TASK_UNMAPPED_BASE;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -410,13 +417,6 @@ beyond_if:
 
         set_brk(current->mm->start_brk, current->mm->brk);
 
-        retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) {
-                /* Someone check-me: is this error path enough? */
-                send_sig(SIGKILL, current, 0);
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
         /* start thread */
diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
index a850b4d8d14d..247904945d3f 100644
--- a/arch/x86/include/asm/i387.h
+++ b/arch/x86/include/asm/i387.h
@@ -29,10 +29,11 @@ extern unsigned int sig_xstate_size;
 extern void fpu_init(void);
 extern void mxcsr_feature_mask_init(void);
 extern int init_fpu(struct task_struct *child);
-extern void __math_state_restore(struct task_struct *);
 extern void math_state_restore(void);
 extern int dump_fpu(struct pt_regs *, struct user_i387_struct *);
 
+DECLARE_PER_CPU(struct task_struct *, fpu_owner_task);
+
 extern user_regset_active_fn fpregs_active, xfpregs_active;
 extern user_regset_get_fn fpregs_get, xfpregs_get, fpregs_soft_get,
                                 xstateregs_get;
@@ -269,6 +270,16 @@ static inline int fpu_restore_checking(struct fpu *fpu)
 
 static inline int restore_fpu_checking(struct task_struct *tsk)
 {
+        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
+           is pending.  Clear the x87 state here by setting it to fixed
+           values. "m" is a random variable that should be in L1 */
+        alternative_input(
+                ASM_NOP8 ASM_NOP2,
+                "emms\n\t"              /* clear stack tags */
+                "fildl %P[addr]",       /* set F?P to defined value */
+                X86_FEATURE_FXSAVE_LEAK,
+                [addr] "m" (tsk->thread.fpu.has_fpu));
+
         return fpu_restore_checking(&tsk->thread.fpu);
 }
 
@@ -279,19 +290,21 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
  */
 static inline int __thread_has_fpu(struct task_struct *tsk)
 {
-        return tsk->thread.has_fpu;
+        return tsk->thread.fpu.has_fpu;
 }
 
 /* Must be paired with an 'stts' after! */
 static inline void __thread_clear_has_fpu(struct task_struct *tsk)
 {
-        tsk->thread.has_fpu = 0;
+        tsk->thread.fpu.has_fpu = 0;
+        percpu_write(fpu_owner_task, NULL);
 }
 
 /* Must be paired with a 'clts' before! */
 static inline void __thread_set_has_fpu(struct task_struct *tsk)
 {
-        tsk->thread.has_fpu = 1;
+        tsk->thread.fpu.has_fpu = 1;
+        percpu_write(fpu_owner_task, tsk);
 }
 
 /*
@@ -336,30 +349,36 @@ typedef struct { int preload; } fpu_switch_t;
  * We don't do that yet, so "fpu_lazy_restore()" always returns
  * false, but some day..
  */
-#define fpu_lazy_restore(tsk) (0)
-#define fpu_lazy_state_intact(tsk) do { } while (0)
+static inline int fpu_lazy_restore(struct task_struct *new, unsigned int cpu)
+{
+        return new == percpu_read_stable(fpu_owner_task) &&
+                cpu == new->thread.fpu.last_cpu;
+}
 
-static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct task_struct *new)
+static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct task_struct *new, int cpu)
 {
         fpu_switch_t fpu;
 
         fpu.preload = tsk_used_math(new) && new->fpu_counter > 5;
         if (__thread_has_fpu(old)) {
-                if (__save_init_fpu(old))
-                        fpu_lazy_state_intact(old);
-                __thread_clear_has_fpu(old);
-                old->fpu_counter++;
+                if (!__save_init_fpu(old))
+                        cpu = ~0;
+                old->thread.fpu.last_cpu = cpu;
+                old->thread.fpu.has_fpu = 0;    /* But leave fpu_owner_task! */
 
                 /* Don't change CR0.TS if we just switch! */
                 if (fpu.preload) {
+                        new->fpu_counter++;
                         __thread_set_has_fpu(new);
                         prefetch(new->thread.fpu.state);
                 } else
                         stts();
         } else {
                 old->fpu_counter = 0;
+                old->thread.fpu.last_cpu = ~0;
                 if (fpu.preload) {
-                        if (fpu_lazy_restore(new))
+                        new->fpu_counter++;
+                        if (fpu_lazy_restore(new, cpu))
                                 fpu.preload = 0;
                         else
                                 prefetch(new->thread.fpu.state);
@@ -377,8 +396,10 @@ static inline fpu_switch_t switch_fpu_prepare(struct task_struct *old, struct ta
  */
 static inline void switch_fpu_finish(struct task_struct *new, fpu_switch_t fpu)
 {
-        if (fpu.preload)
-                __math_state_restore(new);
+        if (fpu.preload) {
+                if (unlikely(restore_fpu_checking(new)))
+                        __thread_fpu_end(new);
+        }
 }
 
 /*
@@ -451,8 +472,10 @@ static inline void kernel_fpu_begin(void)
                 __save_init_fpu(me);
                 __thread_clear_has_fpu(me);
                 /* We do 'stts()' in kernel_fpu_end() */
-        } else
+        } else {
+                percpu_write(fpu_owner_task, NULL);
                 clts();
+        }
 }
 
 static inline void kernel_fpu_end(void)
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 096c975e099f..461ce432b1c2 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -242,4 +242,12 @@ static inline void perf_get_x86_pmu_capability(struct x86_pmu_capability *cap)
 static inline void perf_events_lapic_init(void) { }
 #endif
 
+#if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_AMD)
+ extern void amd_pmu_enable_virt(void);
+ extern void amd_pmu_disable_virt(void);
+#else
+ static inline void amd_pmu_enable_virt(void) { }
+ static inline void amd_pmu_disable_virt(void) { }
+#endif
+
 #endif /* _ASM_X86_PERF_EVENT_H */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index f7c89e231c6c..58545c97d071 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -374,6 +374,8 @@ union thread_xstate {
 };
 
 struct fpu {
+        unsigned int last_cpu;
+        unsigned int has_fpu;
         union thread_xstate *state;
 };
 
@@ -454,7 +456,6 @@ struct thread_struct {
         unsigned long           trap_no;
         unsigned long           error_code;
         /* floating point and extended processor state */
-        unsigned long           has_fpu;
         struct fpu              fpu;
 #ifdef CONFIG_X86_32
         /* Virtual 86 mode info */
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index d43cad74f166..c0f7d68d318f 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1044,6 +1044,9 @@ DEFINE_PER_CPU(char *, irq_stack_ptr) =
 
 DEFINE_PER_CPU(unsigned int, irq_count) = -1;
 
+DEFINE_PER_CPU(struct task_struct *, fpu_owner_task);
+EXPORT_PER_CPU_SYMBOL(fpu_owner_task);
+
 /*
  * Special IST stacks which the CPU switches to when it calls
  * an IST-marked descriptor entry. Up to 7 stacks (hardware
@@ -1111,6 +1114,8 @@ void debug_stack_reset(void)
 
 DEFINE_PER_CPU(struct task_struct *, current_task) = &init_task;
 EXPORT_PER_CPU_SYMBOL(current_task);
+DEFINE_PER_CPU(struct task_struct *, fpu_owner_task);
+EXPORT_PER_CPU_SYMBOL(fpu_owner_task);
 
 #ifdef CONFIG_CC_STACKPROTECTOR
 DEFINE_PER_CPU_ALIGNED(struct stack_canary, stack_canary);
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 6b45e5e7a901..73d08ed98a64 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -326,8 +326,7 @@ static void __cpuinit amd_calc_l3_indices(struct amd_northbridge *nb)
         l3->indices = (max(max3(sc0, sc1, sc2), sc3) << 10) - 1;
 }
 
-static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf,
-                                        int index)
+static void __cpuinit amd_init_l3_cache(struct _cpuid4_info_regs *this_leaf, int index)
 {
         int node;
 
@@ -725,14 +724,16 @@ static DEFINE_PER_CPU(struct _cpuid4_info *, ici_cpuid4_info);
 #define CPUID4_INFO_IDX(x, y)   (&((per_cpu(ici_cpuid4_info, x))[y]))
 
 #ifdef CONFIG_SMP
-static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
+
+static int __cpuinit cache_shared_amd_cpu_map_setup(unsigned int cpu, int index)
 {
-        struct _cpuid4_info     *this_leaf, *sibling_leaf;
-        unsigned long num_threads_sharing;
-        int index_msb, i, sibling;
+        struct _cpuid4_info *this_leaf;
+        int ret, i, sibling;
         struct cpuinfo_x86 *c = &cpu_data(cpu);
 
-        if ((index == 3) && (c->x86_vendor == X86_VENDOR_AMD)) {
+        ret = 0;
+        if (index == 3) {
+                ret = 1;
                 for_each_cpu(i, cpu_llc_shared_mask(cpu)) {
                         if (!per_cpu(ici_cpuid4_info, i))
                                 continue;
@@ -743,8 +744,35 @@ static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
                                 set_bit(sibling, this_leaf->shared_cpu_map);
                         }
                 }
-                return;
+        } else if ((c->x86 == 0x15) && ((index == 1) || (index == 2))) {
+                ret = 1;
+                for_each_cpu(i, cpu_sibling_mask(cpu)) {
+                        if (!per_cpu(ici_cpuid4_info, i))
+                                continue;
+                        this_leaf = CPUID4_INFO_IDX(i, index);
+                        for_each_cpu(sibling, cpu_sibling_mask(cpu)) {
+                                if (!cpu_online(sibling))
+                                        continue;
+                                set_bit(sibling, this_leaf->shared_cpu_map);
+                        }
+                }
         }
+
+        return ret;
+}
+
+static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
+{
+        struct _cpuid4_info *this_leaf, *sibling_leaf;
+        unsigned long num_threads_sharing;
+        int index_msb, i;
+        struct cpuinfo_x86 *c = &cpu_data(cpu);
+
+        if (c->x86_vendor == X86_VENDOR_AMD) {
+                if (cache_shared_amd_cpu_map_setup(cpu, index))
+                        return;
+        }
+
         this_leaf = CPUID4_INFO_IDX(cpu, index);
         num_threads_sharing = 1 + this_leaf->base.eax.split.num_threads_sharing;
 
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
index 786e76a86322..e4eeaaf58a47 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
@@ -528,6 +528,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
         sprintf(name, "threshold_bank%i", bank);
 
+#ifdef CONFIG_SMP
         if (cpu_data(cpu).cpu_core_id && shared_bank[bank]) {   /* symlink */
                 i = cpumask_first(cpu_llc_shared_mask(cpu));
 
@@ -553,6 +554,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
                 goto out;
         }
+#endif
 
         b = kzalloc(sizeof(struct threshold_bank), GFP_KERNEL);
         if (!b) {
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 8944062f46e2..c30c807ddc72 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -147,7 +147,9 @@ struct cpu_hw_events {
         /*
          * AMD specific bits
          */
-        struct amd_nb           *amd_nb;
+        struct amd_nb                   *amd_nb;
+        /* Inverted mask of bits to clear in the perf_ctr ctrl registers */
+        u64                             perf_ctr_virt_mask;
 
         void                            *kfree_on_online;
 };
@@ -417,9 +419,11 @@ void x86_pmu_disable_all(void);
 static inline void __x86_pmu_enable_event(struct hw_perf_event *hwc,
                                           u64 enable_mask)
 {
+        u64 disable_mask = __this_cpu_read(cpu_hw_events.perf_ctr_virt_mask);
+
         if (hwc->extra_reg.reg)
                 wrmsrl(hwc->extra_reg.reg, hwc->extra_reg.config);
-        wrmsrl(hwc->config_base, hwc->config | enable_mask);
+        wrmsrl(hwc->config_base, (hwc->config | enable_mask) & ~disable_mask);
 }
 
 void x86_pmu_enable_all(int added);
diff --git a/arch/x86/kernel/cpu/perf_event_amd.c b/arch/x86/kernel/cpu/perf_event_amd.c
index 0397b23be8e9..67250a52430b 100644
--- a/arch/x86/kernel/cpu/perf_event_amd.c
+++ b/arch/x86/kernel/cpu/perf_event_amd.c
@@ -1,4 +1,5 @@
 #include <linux/perf_event.h>
+#include <linux/export.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/slab.h>
@@ -357,7 +358,9 @@ static void amd_pmu_cpu_starting(int cpu)
         struct amd_nb *nb;
         int i, nb_id;
 
-        if (boot_cpu_data.x86_max_cores < 2)
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+
+        if (boot_cpu_data.x86_max_cores < 2 || boot_cpu_data.x86 == 0x15)
                 return;
 
         nb_id = amd_get_nb_id(cpu);
@@ -587,9 +590,9 @@ static __initconst const struct x86_pmu amd_pmu_f15h = {
         .put_event_constraints  = amd_put_event_constraints,
 
         .cpu_prepare            = amd_pmu_cpu_prepare,
-        .cpu_starting           = amd_pmu_cpu_starting,
         .cpu_dead               = amd_pmu_cpu_dead,
 #endif
+        .cpu_starting           = amd_pmu_cpu_starting,
 };
 
 __init int amd_pmu_init(void)
@@ -621,3 +624,33 @@ __init int amd_pmu_init(void)
 
         return 0;
 }
+
+void amd_pmu_enable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+
+        cpuc->perf_ctr_virt_mask = 0;
+
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
+
+void amd_pmu_disable_virt(void)
+{
+        struct cpu_hw_events *cpuc = &__get_cpu_var(cpu_hw_events);
+
+        /*
+         * We only mask out the Host-only bit so that host-only counting works
+         * when SVM is disabled. If someone sets up a guest-only counter when
+         * SVM is disabled the Guest-only bits still gets set and the counter
+         * will not count anything.
+         */
+        cpuc->perf_ctr_virt_mask = AMD_PERFMON_EVENTSEL_HOSTONLY;
+
+        /* Reload all events */
+        x86_pmu_disable_all();
+        x86_pmu_enable_all(0);
+}
+EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 3fe8239fd8fb..1333d9851778 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -1532,10 +1532,17 @@ ENTRY(nmi)
         pushq_cfi %rdx
 
         /*
+         * If %cs was not the kernel segment, then the NMI triggered in user
+         * space, which means it is definitely not nested.
+         */
+        cmpl $__KERNEL_CS, 16(%rsp)
+        jne first_nmi
+
+        /*
          * Check the special variable on the stack to see if NMIs are
          * executing.
          */
-        cmp $1, -8(%rsp)
+        cmpl $1, -8(%rsp)
         je nested_nmi
 
         /*
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
index ac0417be9131..73465aab28f8 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/microcode_amd.c
@@ -360,7 +360,6 @@ out:
 static enum ucode_state
 request_microcode_user(int cpu, const void __user *buf, size_t size)
 {
-        pr_info("AMD microcode update via /dev/cpu/microcode not supported\n");
         return UCODE_ERROR;
 }
 
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 80bfe1ab0031..c08d1ff12b7c 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -214,6 +214,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
 
         task_user_gs(p) = get_user_gs(regs);
 
+        p->fpu_counter = 0;
         p->thread.io_bitmap_ptr = NULL;
         tsk = current;
         err = -ENOMEM;
@@ -303,7 +304,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
 
         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
 
-        fpu = switch_fpu_prepare(prev_p, next_p);
+        fpu = switch_fpu_prepare(prev_p, next_p, cpu);
 
         /*
          * Reload esp0.
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 1fd94bc4279d..cfa5c90c01db 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -286,6 +286,7 @@ int copy_thread(unsigned long clone_flags, unsigned long sp,
 
         set_tsk_thread_flag(p, TIF_FORK);
 
+        p->fpu_counter = 0;
         p->thread.io_bitmap_ptr = NULL;
 
         savesegment(gs, p->thread.gsindex);
@@ -388,7 +389,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         unsigned fsindex, gsindex;
         fpu_switch_t fpu;
 
-        fpu = switch_fpu_prepare(prev_p, next_p);
+        fpu = switch_fpu_prepare(prev_p, next_p, cpu);
 
         /*
          * Reload esp0, LDT and the page table pointer:
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 77da5b475ad2..4bbe04d96744 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -571,37 +571,6 @@ asmlinkage void __attribute__((weak)) smp_threshold_interrupt(void)
 }
 
 /*
- * This gets called with the process already owning the
- * FPU state, and with CR0.TS cleared. It just needs to
- * restore the FPU register state.
- */
-void __math_state_restore(struct task_struct *tsk)
-{
-        /* We need a safe address that is cheap to find and that is already
-           in L1. We've just brought in "tsk->thread.has_fpu", so use that */
-#define safe_address (tsk->thread.has_fpu)
-
-        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
-           is pending.  Clear the x87 state here by setting it to fixed
-           values. safe_address is a random variable that should be in L1 */
-        alternative_input(
-                ASM_NOP8 ASM_NOP2,
-                "emms\n\t"              /* clear stack tags */
-                "fildl %P[addr]",       /* set F?P to defined value */
-                X86_FEATURE_FXSAVE_LEAK,
-                [addr] "m" (safe_address));
-
-        /*
-         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
-         */
-        if (unlikely(restore_fpu_checking(tsk))) {
-                __thread_fpu_end(tsk);
-                force_sig(SIGSEGV, tsk);
-                return;
-        }
-}
-
-/*
  * 'math_state_restore()' saves the current math information in the
  * old math state array, and gets the new ones from the current task
  *
@@ -631,7 +600,14 @@ void math_state_restore(void)
         }
 
         __thread_fpu_begin(tsk);
-        __math_state_restore(tsk);
+        /*
+         * Paranoid restore. send a SIGSEGV if we fail to restore the state.
+         */
+        if (unlikely(restore_fpu_checking(tsk))) {
+                __thread_fpu_end(tsk);
+                force_sig(SIGSEGV, tsk);
+                return;
+        }
 
         tsk->fpu_counter++;
 }
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 5fa553babe56..e385214711cb 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -29,6 +29,7 @@
 #include <linux/ftrace_event.h>
 #include <linux/slab.h>
 
+#include <asm/perf_event.h>
 #include <asm/tlbflush.h>
 #include <asm/desc.h>
 #include <asm/kvm_para.h>
@@ -575,6 +576,8 @@ static void svm_hardware_disable(void *garbage)
                 wrmsrl(MSR_AMD64_TSC_RATIO, TSC_RATIO_DEFAULT);
 
         cpu_svm_disable();
+
+        amd_pmu_disable_virt();
 }
 
 static int svm_hardware_enable(void *garbage)
@@ -622,6 +625,8 @@ static int svm_hardware_enable(void *garbage)
 
         svm_init_erratum_383();
 
+        amd_pmu_enable_virt();
+
         return 0;
 }
 
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index fc45ba887d05..e395693abdb1 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -48,9 +48,9 @@ static void delay_loop(unsigned long loops)
 }
 
 /* TSC based delay: */
-static void delay_tsc(unsigned long loops)
+static void delay_tsc(unsigned long __loops)
 {
-        unsigned long bclock, now;
+        u32 bclock, now, loops = __loops;
         int cpu;
 
         preempt_disable();
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index f581a18c0d4d..8ecbb4bba4b3 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -333,13 +333,15 @@ try_again:
                  * Lookup failure means no vma is above this address,
                  * i.e. return with success:
                  */
-                if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
+                vma = find_vma(mm, addr);
+                if (!vma)
                         return addr;
 
                 /*
                  * new region fits between prev_vma->vm_end and
                  * vma->vm_start, use it:
                  */
+                prev_vma = vma->vm_prev;
                 if (addr + len <= vma->vm_start &&
                             (!prev_vma || (addr >= prev_vma->vm_end))) {
                         /* remember the address as a hint for next time */
diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index a312e76063a7..49a5cb55429b 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -60,6 +60,16 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
                         DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
                 },
         },
+        /* https://bugzilla.kernel.org/show_bug.cgi?id=42619 */
+        {
+                .callback = set_use_crs,
+                .ident = "MSI MS-7253",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+                        DMI_MATCH(DMI_BOARD_NAME, "MS-7253"),
+                        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+                },
+        },
 
         /* Now for the blacklist.. */
 
@@ -282,9 +292,6 @@ static void add_resources(struct pci_root_info *info)
         int i;
         struct resource *res, *root, *conflict;
 
-        if (!pci_use_crs)
-                return;
-
         coalesce_windows(info, IORESOURCE_MEM);
         coalesce_windows(info, IORESOURCE_IO);
 
@@ -336,8 +343,13 @@ get_current_resources(struct acpi_device *device, int busnum,
         acpi_walk_resources(device->handle, METHOD_NAME__CRS, setup_resource,
                                 &info);
 
-        add_resources(&info);
-        return;
+        if (pci_use_crs) {
+                add_resources(&info);
+
+                return;
+        }
+
+        kfree(info.name);
 
 name_alloc_fail:
         kfree(info.res);
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 12eb07bfb267..4172af8ceeb3 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -1141,7 +1141,9 @@ asmlinkage void __init xen_start_kernel(void)
 
         /* Prevent unwanted bits from being set in PTEs. */
         __supported_pte_mask &= ~_PAGE_GLOBAL;
+#if 0
         if (!xen_initial_domain())
+#endif
                 __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
 
         __supported_pte_mask |= _PAGE_IOMAP;
@@ -1204,10 +1206,6 @@ asmlinkage void __init xen_start_kernel(void)
 
         pgd = (pgd_t *)xen_start_info->pt_base;
 
-        if (!xen_initial_domain())
-                __supported_pte_mask &= ~(_PAGE_PWT | _PAGE_PCD);
-
-        __supported_pte_mask |= _PAGE_IOMAP;
         /* Don't do the full vcpu_info placement stuff until we have a
            possible map and a non-dummy shared_info. */
         per_cpu(xen_vcpu, 0) = &HYPERVISOR_shared_info->vcpu_info[0];
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 58a0e46c404d..95c1cf60c669 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -415,13 +415,13 @@ static pteval_t iomap_pte(pteval_t val)
 static pteval_t xen_pte_val(pte_t pte)
 {
         pteval_t pteval = pte.pte;
-
+#if 0
         /* If this is a WC pte, convert back from Xen WC to Linux WC */
         if ((pteval & (_PAGE_PAT | _PAGE_PCD | _PAGE_PWT)) == _PAGE_PAT) {
                 WARN_ON(!pat_enabled);
                 pteval = (pteval & ~_PAGE_PAT) | _PAGE_PWT;
         }
-
+#endif
         if (xen_initial_domain() && (pteval & _PAGE_IOMAP))
                 return pteval;
 
@@ -463,7 +463,7 @@ void xen_set_pat(u64 pat)
 static pte_t xen_make_pte(pteval_t pte)
 {
         phys_addr_t addr = (pte & PTE_PFN_MASK);
-
+#if 0
         /* If Linux is trying to set a WC pte, then map to the Xen WC.
          * If _PAGE_PAT is set, then it probably means it is really
          * _PAGE_PSE, so avoid fiddling with the PAT mapping and hope
@@ -476,7 +476,7 @@ static pte_t xen_make_pte(pteval_t pte)
                 if ((pte & (_PAGE_PCD | _PAGE_PWT)) == _PAGE_PWT)
                         pte = (pte & ~(_PAGE_PCD | _PAGE_PWT)) | _PAGE_PAT;
         }
-
+#endif
         /*
          * Unprivileged domains are allowed to do IOMAPpings for
          * PCI passthrough, but not map ISA space.  The ISA
diff --git a/block/partitions/ldm.c b/block/partitions/ldm.c
index bd8ae788f689..e507cfbd044e 100644
--- a/block/partitions/ldm.c
+++ b/block/partitions/ldm.c
@@ -2,7 +2,7 @@
  * ldm - Support for Windows Logical Disk Manager (Dynamic Disks)
  *
  * Copyright (C) 2001,2002 Richard Russon <ldm@flatcap.org>
- * Copyright (c) 2001-2007 Anton Altaparmakov
+ * Copyright (c) 2001-2012 Anton Altaparmakov
  * Copyright (C) 2001,2002 Jakob Kemi <jakob.kemi@telia.com>
  *
  * Documentation is available at http://www.linux-ntfs.org/doku.php?id=downloads 
@@ -1341,20 +1341,17 @@ found:
                 ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
                 return false;
         }
-
         if (f->map & (1 << rec)) {
                 ldm_error ("Duplicate VBLK, part %d.", rec);
                 f->map &= 0x7F;                 /* Mark the group as broken */
                 return false;
         }
-
         f->map |= (1 << rec);
-
+        if (!rec)
+                memcpy(f->data, data, VBLK_SIZE_HEAD);
         data += VBLK_SIZE_HEAD;
         size -= VBLK_SIZE_HEAD;
-
-        memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);
-
+        memcpy(f->data + VBLK_SIZE_HEAD + rec * size, data, size);
         return true;
 }
 
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 5d1d07645132..e8cd652d2017 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -1206,9 +1206,9 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
         
  out_unmap_both:
         pci_set_drvdata(dev, NULL);
-        pci_iounmap(dev, card->config_regs);
- out_unmap_config:
         pci_iounmap(dev, card->buffers);
+ out_unmap_config:
+        pci_iounmap(dev, card->config_regs);
  out_release_regions:
         pci_release_regions(dev);
  out:
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 9baf11e86362..744f078f4dd8 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3832,7 +3832,7 @@ static int __floppy_read_block_0(struct block_device *bdev)
         bio.bi_size = size;
         bio.bi_bdev = bdev;
         bio.bi_sector = 0;
-        bio.bi_flags = BIO_QUIET;
+        bio.bi_flags = (1 << BIO_QUIET);
         init_completion(&complete);
         bio.bi_private = &complete;
         bio.bi_end_io = floppy_rb0_complete;
diff --git a/drivers/block/nvme.c b/drivers/block/nvme.c
index c1dc4d86c221..1f3c1a7d132a 100644
--- a/drivers/block/nvme.c
+++ b/drivers/block/nvme.c
@@ -41,6 +41,8 @@
 #include <linux/types.h>
 #include <linux/version.h>
 
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
+
 #define NVME_Q_DEPTH 1024
 #define SQ_SIZE(depth)          (depth * sizeof(struct nvme_command))
 #define CQ_SIZE(depth)          (depth * sizeof(struct nvme_completion))
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index f00f596c1029..789c9b579aea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -102,6 +102,7 @@ static struct usb_device_id btusb_table[] = {
 
         /* Broadcom BCM20702A0 */
         { USB_DEVICE(0x0a5c, 0x21e3) },
+        { USB_DEVICE(0x0a5c, 0x21f3) },
         { USB_DEVICE(0x413c, 0x8197) },
 
         { }     /* Terminating entry */
@@ -726,9 +727,6 @@ static int btusb_send_frame(struct sk_buff *skb)
                 usb_fill_bulk_urb(urb, data->udev, pipe,
                                 skb->data, skb->len, btusb_tx_complete, skb);
 
-                if (skb->priority >= HCI_PRIO_MAX - 1)
-                        urb->transfer_flags  = URB_ISO_ASAP;
-
                 hdev->stat.acl_tx++;
                 break;
 
diff --git a/drivers/cpuidle/Kconfig b/drivers/cpuidle/Kconfig
index 7dbc4a83c45c..78a666d1e5f5 100644
--- a/drivers/cpuidle/Kconfig
+++ b/drivers/cpuidle/Kconfig
@@ -1,7 +1,7 @@
 
 config CPU_IDLE
         bool "CPU idle PM support"
-        default ACPI
+        default y if ACPI || PPC_PSERIES
         help
           CPU idle is a generic framework for supporting software-controlled
           idle processor power management.  It includes modular cross-platform
diff --git a/drivers/crypto/mv_cesa.c b/drivers/crypto/mv_cesa.c
index 597235a2f8f9..0d40cf66b3cc 100644
--- a/drivers/crypto/mv_cesa.c
+++ b/drivers/crypto/mv_cesa.c
@@ -714,6 +714,7 @@ static int mv_hash_final(struct ahash_request *req)
 {
         struct mv_req_hash_ctx *ctx = ahash_request_ctx(req);
 
+        ahash_request_set_crypt(req, NULL, req->result, 0);
         mv_update_hash_req_ctx(ctx, 1, 0);
         return mv_handle_req(&req->base);
 }
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index aa08497a075a..73f55e2008c2 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -15,6 +15,8 @@
 #include <linux/io.h>
 #include "edac_core.h"
 
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
+
 #define I3200_REVISION        "1.1"
 
 #define EDAC_MOD_STR        "i3200_edac"
@@ -101,19 +103,6 @@ struct i3200_priv {
 
 static int nr_channels;
 
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-
-        low = readl(p);
-        high = readl(p + 1);
-
-        return low + ((u64)high << 32);
-}
-#endif
-
 static int how_many_channels(struct pci_dev *pdev)
 {
         unsigned char capid0_8b; /* 8th byte of CAPID0 */
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index d620b0784257..618bd4d87d28 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -28,6 +28,7 @@
 #include "drmP.h"
 #include "drm_crtc_helper.h"
 
+#include <drm/exynos_drm.h>
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
@@ -44,8 +45,9 @@ struct exynos_drm_connector {
 /* convert exynos_video_timings to drm_display_mode */
 static inline void
 convert_to_display_mode(struct drm_display_mode *mode,
-                        struct fb_videomode *timing)
+                        struct exynos_drm_panel_info *panel)
 {
+        struct fb_videomode *timing = &panel->timing;
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         mode->clock = timing->pixclock / 1000;
@@ -60,6 +62,8 @@ convert_to_display_mode(struct drm_display_mode *mode,
         mode->vsync_start = mode->vdisplay + timing->upper_margin;
         mode->vsync_end = mode->vsync_start + timing->vsync_len;
         mode->vtotal = mode->vsync_end + timing->lower_margin;
+        mode->width_mm = panel->width_mm;
+        mode->height_mm = panel->height_mm;
 
         if (timing->vmode & FB_VMODE_INTERLACED)
                 mode->flags |= DRM_MODE_FLAG_INTERLACE;
@@ -148,16 +152,18 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 connector->display_info.raw_edid = edid;
         } else {
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
-                struct fb_videomode *timing;
+                struct exynos_drm_panel_info *panel;
 
-                if (display_ops->get_timing)
-                        timing = display_ops->get_timing(manager->dev);
+                if (display_ops->get_panel)
+                        panel = display_ops->get_panel(manager->dev);
                 else {
                         drm_mode_destroy(connector->dev, mode);
                         return 0;
                 }
 
-                convert_to_display_mode(mode, timing);
+                convert_to_display_mode(mode, panel);
+                connector->display_info.width_mm = mode->width_mm;
+                connector->display_info.height_mm = mode->height_mm;
 
                 mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED;
                 drm_mode_set_name(mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
index 661a03571d0c..d08a55896d50 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_core.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
@@ -193,6 +193,9 @@ int exynos_drm_subdrv_register(struct exynos_drm_subdrv *subdrv)
                         return err;
                 }
 
+                /* setup possible_clones. */
+                exynos_drm_encoder_setup(drm_dev);
+
                 /*
                  * if any specific driver such as fimd or hdmi driver called
                  * exynos_drm_subdrv_register() later than drm_load(),
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index e3861ac49295..de818831a511 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -307,9 +307,6 @@ static int exynos_drm_crtc_page_flip(struct drm_crtc *crtc,
                  */
                 event->pipe = exynos_crtc->pipe;
 
-                list_add_tail(&event->base.link,
-                                &dev_priv->pageflip_event_list);
-
                 ret = drm_vblank_get(dev, exynos_crtc->pipe);
                 if (ret) {
                         DRM_DEBUG("failed to acquire vblank counter\n");
@@ -318,6 +315,9 @@ static int exynos_drm_crtc_page_flip(struct drm_crtc *crtc,
                         goto out;
                 }
 
+                list_add_tail(&event->base.link,
+                                &dev_priv->pageflip_event_list);
+
                 crtc->fb = fb;
                 ret = exynos_drm_crtc_update(crtc);
                 if (ret) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 35889ca255e9..58820ebd3558 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -33,6 +33,7 @@
 
 #include "exynos_drm_drv.h"
 #include "exynos_drm_crtc.h"
+#include "exynos_drm_encoder.h"
 #include "exynos_drm_fbdev.h"
 #include "exynos_drm_fb.h"
 #include "exynos_drm_gem.h"
@@ -99,6 +100,9 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_vblank;
 
+        /* setup possible_clones. */
+        exynos_drm_encoder_setup(dev);
+
         /*
          * create and configure fb helper and also exynos specific
          * fbdev object.
@@ -141,16 +145,21 @@ static int exynos_drm_unload(struct drm_device *dev)
 }
 
 static void exynos_drm_preclose(struct drm_device *dev,
-                                        struct drm_file *file_priv)
+                                        struct drm_file *file)
 {
-        struct exynos_drm_private *dev_priv = dev->dev_private;
+        DRM_DEBUG_DRIVER("%s\n", __FILE__);
 
-        /*
-         * drm framework frees all events at release time,
-         * so private event list should be cleared.
-         */
-        if (!list_empty(&dev_priv->pageflip_event_list))
-                INIT_LIST_HEAD(&dev_priv->pageflip_event_list);
+}
+
+static void exynos_drm_postclose(struct drm_device *dev, struct drm_file *file)
+{
+        DRM_DEBUG_DRIVER("%s\n", __FILE__);
+
+        if (!file->driver_priv)
+                return;
+
+        kfree(file->driver_priv);
+        file->driver_priv = NULL;
 }
 
 static void exynos_drm_lastclose(struct drm_device *dev)
@@ -195,6 +204,7 @@ static struct drm_driver exynos_drm_driver = {
         .unload                 = exynos_drm_unload,
         .preclose               = exynos_drm_preclose,
         .lastclose              = exynos_drm_lastclose,
+        .postclose              = exynos_drm_postclose,
         .get_vblank_counter     = drm_vblank_count,
         .enable_vblank          = exynos_drm_crtc_enable_vblank,
         .disable_vblank         = exynos_drm_crtc_disable_vblank,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index e685e1e33055..13540de90bfc 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -136,7 +136,7 @@ struct exynos_drm_overlay {
  * @type: one of EXYNOS_DISPLAY_TYPE_LCD and HDMI.
  * @is_connected: check for that display is connected or not.
  * @get_edid: get edid modes from display driver.
- * @get_timing: get timing object from display driver.
+ * @get_panel: get panel object from display driver.
  * @check_timing: check if timing is valid or not.
  * @power_on: display device on or off.
  */
@@ -145,7 +145,7 @@ struct exynos_drm_display_ops {
         bool (*is_connected)(struct device *dev);
         int (*get_edid)(struct device *dev, struct drm_connector *connector,
                                 u8 *edid, int len);
-        void *(*get_timing)(struct device *dev);
+        void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
 };
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 86b93dde219a..ef4754f1519b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -195,6 +195,40 @@ static struct drm_encoder_funcs exynos_encoder_funcs = {
         .destroy = exynos_drm_encoder_destroy,
 };
 
+static unsigned int exynos_drm_encoder_clones(struct drm_encoder *encoder)
+{
+        struct drm_encoder *clone;
+        struct drm_device *dev = encoder->dev;
+        struct exynos_drm_encoder *exynos_encoder = to_exynos_encoder(encoder);
+        struct exynos_drm_display_ops *display_ops =
+                                exynos_encoder->manager->display_ops;
+        unsigned int clone_mask = 0;
+        int cnt = 0;
+
+        list_for_each_entry(clone, &dev->mode_config.encoder_list, head) {
+                switch (display_ops->type) {
+                case EXYNOS_DISPLAY_TYPE_LCD:
+                case EXYNOS_DISPLAY_TYPE_HDMI:
+                        clone_mask |= (1 << (cnt++));
+                        break;
+                default:
+                        continue;
+                }
+        }
+
+        return clone_mask;
+}
+
+void exynos_drm_encoder_setup(struct drm_device *dev)
+{
+        struct drm_encoder *encoder;
+
+        DRM_DEBUG_KMS("%s\n", __FILE__);
+
+        list_for_each_entry(encoder, &dev->mode_config.encoder_list, head)
+                encoder->possible_clones = exynos_drm_encoder_clones(encoder);
+}
+
 struct drm_encoder *
 exynos_drm_encoder_create(struct drm_device *dev,
                            struct exynos_drm_manager *manager,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.h b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
index 97b087a51cb6..eb7d2316847e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.h
@@ -30,6 +30,7 @@
 
 struct exynos_drm_manager;
 
+void exynos_drm_encoder_setup(struct drm_device *dev);
 struct drm_encoder *exynos_drm_encoder_create(struct drm_device *dev,
                                                struct exynos_drm_manager *mgr,
                                                unsigned int possible_crtcs);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index d7ae29d2f3d6..3508700e529b 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -195,66 +195,6 @@ out:
         return ret;
 }
 
-static bool
-exynos_drm_fbdev_is_samefb(struct drm_framebuffer *fb,
-                            struct drm_fb_helper_surface_size *sizes)
-{
-        if (fb->width != sizes->surface_width)
-                return false;
-        if (fb->height != sizes->surface_height)
-                return false;
-        if (fb->bits_per_pixel != sizes->surface_bpp)
-                return false;
-        if (fb->depth != sizes->surface_depth)
-                return false;
-
-        return true;
-}
-
-static int exynos_drm_fbdev_recreate(struct drm_fb_helper *helper,
-                                      struct drm_fb_helper_surface_size *sizes)
-{
-        struct drm_device *dev = helper->dev;
-        struct exynos_drm_fbdev *exynos_fbdev = to_exynos_fbdev(helper);
-        struct exynos_drm_gem_obj *exynos_gem_obj;
-        struct drm_framebuffer *fb = helper->fb;
-        struct drm_mode_fb_cmd2 mode_cmd = { 0 };
-        unsigned long size;
-
-        DRM_DEBUG_KMS("%s\n", __FILE__);
-
-        if (exynos_drm_fbdev_is_samefb(fb, sizes))
-                return 0;
-
-        mode_cmd.width = sizes->surface_width;
-        mode_cmd.height = sizes->surface_height;
-        mode_cmd.pitches[0] = sizes->surface_width * (sizes->surface_bpp >> 3);
-        mode_cmd.pixel_format = drm_mode_legacy_fb_format(sizes->surface_bpp,
-                                                          sizes->surface_depth);
-
-        if (exynos_fbdev->exynos_gem_obj)
-                exynos_drm_gem_destroy(exynos_fbdev->exynos_gem_obj);
-
-        if (fb->funcs->destroy)
-                fb->funcs->destroy(fb);
-
-        size = mode_cmd.pitches[0] * mode_cmd.height;
-        exynos_gem_obj = exynos_drm_gem_create(dev, size);
-        if (IS_ERR(exynos_gem_obj))
-                return PTR_ERR(exynos_gem_obj);
-
-        exynos_fbdev->exynos_gem_obj = exynos_gem_obj;
-
-        helper->fb = exynos_drm_framebuffer_init(dev, &mode_cmd,
-                        &exynos_gem_obj->base);
-        if (IS_ERR_OR_NULL(helper->fb)) {
-                DRM_ERROR("failed to create drm framebuffer.\n");
-                return PTR_ERR(helper->fb);
-        }
-
-        return exynos_drm_fbdev_update(helper, helper->fb);
-}
-
 static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
                                    struct drm_fb_helper_surface_size *sizes)
 {
@@ -262,6 +202,10 @@ static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
+        /*
+         * with !helper->fb, it means that this funcion is called first time
+         * and after that, the helper->fb would be used as clone mode.
+         */
         if (!helper->fb) {
                 ret = exynos_drm_fbdev_create(helper, sizes);
                 if (ret < 0) {
@@ -274,12 +218,6 @@ static int exynos_drm_fbdev_probe(struct drm_fb_helper *helper,
                  * because register_framebuffer() should be called.
                  */
                 ret = 1;
-        } else {
-                ret = exynos_drm_fbdev_recreate(helper, sizes);
-                if (ret < 0) {
-                        DRM_ERROR("failed to reconfigure fbdev\n");
-                        return ret;
-                }
         }
 
         return ret;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fimd.c b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
index b6a737d196ae..360adf2bba04 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fimd.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fimd.c
@@ -89,7 +89,7 @@ struct fimd_context {
         bool                            suspended;
         struct mutex                    lock;
 
-        struct fb_videomode             *timing;
+        struct exynos_drm_panel_info *panel;
 };
 
 static bool fimd_display_is_connected(struct device *dev)
@@ -101,13 +101,13 @@ static bool fimd_display_is_connected(struct device *dev)
         return true;
 }
 
-static void *fimd_get_timing(struct device *dev)
+static void *fimd_get_panel(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
-        return ctx->timing;
+        return ctx->panel;
 }
 
 static int fimd_check_timing(struct device *dev, void *timing)
@@ -131,7 +131,7 @@ static int fimd_display_power_on(struct device *dev, int mode)
 static struct exynos_drm_display_ops fimd_display_ops = {
         .type = EXYNOS_DISPLAY_TYPE_LCD,
         .is_connected = fimd_display_is_connected,
-        .get_timing = fimd_get_timing,
+        .get_panel = fimd_get_panel,
         .check_timing = fimd_check_timing,
         .power_on = fimd_display_power_on,
 };
@@ -193,7 +193,8 @@ static void fimd_apply(struct device *subdrv_dev)
 static void fimd_commit(struct device *dev)
 {
         struct fimd_context *ctx = get_fimd_context(dev);
-        struct fb_videomode *timing = ctx->timing;
+        struct exynos_drm_panel_info *panel = ctx->panel;
+        struct fb_videomode *timing = &panel->timing;
         u32 val;
 
         if (ctx->suspended)
@@ -604,7 +605,12 @@ static void fimd_finish_pageflip(struct drm_device *drm_dev, int crtc)
         }
 
         if (is_checked) {
-                drm_vblank_put(drm_dev, crtc);
+                /*
+                 * call drm_vblank_put only in case that drm_vblank_get was
+                 * called.
+                 */
+                if (atomic_read(&drm_dev->vblank_refcount[crtc]) > 0)
+                        drm_vblank_put(drm_dev, crtc);
 
                 /*
                  * don't off vblank if vblank_disable_allowed is 1,
@@ -781,7 +787,7 @@ static int __devinit fimd_probe(struct platform_device *pdev)
         struct fimd_context *ctx;
         struct exynos_drm_subdrv *subdrv;
         struct exynos_drm_fimd_pdata *pdata;
-        struct fb_videomode *timing;
+        struct exynos_drm_panel_info *panel;
         struct resource *res;
         int win;
         int ret = -EINVAL;
@@ -794,9 +800,9 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        timing = &pdata->timing;
-        if (!timing) {
-                dev_err(dev, "timing is null.\n");
+        panel = &pdata->panel;
+        if (!panel) {
+                dev_err(dev, "panel is null.\n");
                 return -EINVAL;
         }
 
@@ -858,16 +864,16 @@ static int __devinit fimd_probe(struct platform_device *pdev)
                 goto err_req_irq;
         }
 
-        ctx->clkdiv = fimd_calc_clkdiv(ctx, timing);
+        ctx->clkdiv = fimd_calc_clkdiv(ctx, &panel->timing);
         ctx->vidcon0 = pdata->vidcon0;
         ctx->vidcon1 = pdata->vidcon1;
         ctx->default_win = pdata->default_win;
-        ctx->timing = timing;
+        ctx->panel = panel;
 
-        timing->pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
+        panel->timing.pixclock = clk_get_rate(ctx->lcd_clk) / ctx->clkdiv;
 
         DRM_DEBUG_KMS("pixel clock = %d, clkdiv = %d\n",
-                        timing->pixclock, ctx->clkdiv);
+                        panel->timing.pixclock, ctx->clkdiv);
 
         subdrv = &ctx->subdrv;
 
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index ac24cff39775..93846e810e38 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -712,7 +712,12 @@ static void mixer_finish_pageflip(struct drm_device *drm_dev, int crtc)
         }
 
         if (is_checked)
-                drm_vblank_put(drm_dev, crtc);
+                /*
+                 * call drm_vblank_put only in case that drm_vblank_get was
+                 * called.
+                 */
+                if (atomic_read(&drm_dev->vblank_refcount[crtc]) > 0)
+                        drm_vblank_put(drm_dev, crtc);
 
         spin_unlock_irqrestore(&drm_dev->event_lock, flags);
 }
@@ -779,15 +784,15 @@ static void mixer_win_reset(struct mixer_context *ctx)
         mixer_reg_writemask(res, MXR_STATUS, MXR_STATUS_16_BURST,
                 MXR_STATUS_BURST_MASK);
 
-        /* setting default layer priority: layer1 > video > layer0
+        /* setting default layer priority: layer1 > layer0 > video
          * because typical usage scenario would be
+         * layer1 - OSD
          * layer0 - framebuffer
          * video - video overlay
-         * layer1 - OSD
          */
-        val  = MXR_LAYER_CFG_GRP0_VAL(1);
-        val |= MXR_LAYER_CFG_VP_VAL(2);
-        val |= MXR_LAYER_CFG_GRP1_VAL(3);
+        val = MXR_LAYER_CFG_GRP1_VAL(3);
+        val |= MXR_LAYER_CFG_GRP0_VAL(2);
+        val |= MXR_LAYER_CFG_VP_VAL(1);
         mixer_reg_write(res, MXR_LAYER_CFG, val);
 
         /* setting background color */
@@ -1044,7 +1049,7 @@ static int mixer_remove(struct platform_device *pdev)
                                         platform_get_drvdata(pdev);
         struct mixer_context *ctx = (struct mixer_context *)drm_hdmi_ctx->ctx;
 
-        dev_info(dev, "remove sucessful\n");
+        dev_info(dev, "remove successful\n");
 
         mixer_resource_poweroff(ctx);
         mixer_resources_cleanup(ctx);
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 4a5b099c3bc5..53404af2e748 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -321,6 +321,8 @@ static int cdv_chip_setup(struct drm_device *dev)
         cdv_get_core_freq(dev);
         gma_intel_opregion_init(dev);
         psb_intel_init_bios(dev);
+        REG_WRITE(PORT_HOTPLUG_EN, 0);
+        REG_WRITE(PORT_HOTPLUG_STAT, REG_READ(PORT_HOTPLUG_STAT));
         return 0;
 }
 
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index 830dfdd6bf15..be616735ec91 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -247,7 +247,6 @@ static struct fb_ops psbfb_roll_ops = {
         .fb_imageblit = cfb_imageblit,
         .fb_pan_display = psbfb_pan,
         .fb_mmap = psbfb_mmap,
-        .fb_sync = psbfb_sync,
         .fb_ioctl = psbfb_ioctl,
 };
 
diff --git a/drivers/gpu/drm/gma500/gtt.c b/drivers/gpu/drm/gma500/gtt.c
index 5d5330f667f1..aff194fbe9f3 100644
--- a/drivers/gpu/drm/gma500/gtt.c
+++ b/drivers/gpu/drm/gma500/gtt.c
@@ -446,10 +446,9 @@ int psb_gtt_init(struct drm_device *dev, int resume)
         pg->gtt_start = pci_resource_start(dev->pdev, PSB_GTT_RESOURCE);
         gtt_pages = pci_resource_len(dev->pdev, PSB_GTT_RESOURCE)
                                                                 >> PAGE_SHIFT;
-        /* Some CDV firmware doesn't report this currently. In which case the
-           system has 64 gtt pages */
+        /* CDV doesn't report this. In which case the system has 64 gtt pages */
         if (pg->gtt_start == 0 || gtt_pages == 0) {
-                dev_err(dev->dev, "GTT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GTT PCI BAR not initialized.\n");
                 gtt_pages = 64;
                 pg->gtt_start = dev_priv->pge_ctl;
         }
@@ -461,10 +460,10 @@ int psb_gtt_init(struct drm_device *dev, int resume)
 
         if (pg->gatt_pages == 0 || pg->gatt_start == 0) {
                 static struct resource fudge;   /* Preferably peppermint */
-                /* This can occur on CDV SDV systems. Fudge it in this case.
+                /* This can occur on CDV systems. Fudge it in this case.
                    We really don't care what imaginary space is being allocated
                    at this point */
-                dev_err(dev->dev, "GATT PCI BAR not initialized.\n");
+                dev_dbg(dev->dev, "GATT PCI BAR not initialized.\n");
                 pg->gatt_start = 0x40000000;
                 pg->gatt_pages = (128 * 1024 * 1024) >> PAGE_SHIFT;
                 /* This is a little confusing but in fact the GTT is providing
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index c3afb783cb9d..03c53fcf8653 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -3028,6 +3028,20 @@
 #define  DISP_TILE_SURFACE_SWIZZLING    (1<<13)
 #define  DISP_FBC_WM_DIS                (1<<15)
 
+/* GEN7 chicken */
+#define GEN7_COMMON_SLICE_CHICKEN1              0x7010
+# define GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC      ((1<<10) | (1<<26))
+
+#define GEN7_L3CNTLREG1                         0xB01C
+#define  GEN7_WA_FOR_GEN7_L3_CONTROL                    0x3C4FFF8C
+
+#define GEN7_L3_CHICKEN_MODE_REGISTER           0xB030
+#define  GEN7_WA_L3_CHICKEN_MODE                                0x20000000
+
+/* WaCatErrorRejectionIssue */
+#define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG          0x9030
+#define  GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB       (1<<11)
+
 /* PCH */
 
 /* south display engine interrupt */
@@ -3618,6 +3632,7 @@
 #define    GT_FIFO_NUM_RESERVED_ENTRIES         20
 
 #define GEN6_UCGCTL2                            0x9404
+# define GEN6_RCZUNIT_CLOCK_GATE_DISABLE                (1 << 13)
 # define GEN6_RCPBUNIT_CLOCK_GATE_DISABLE               (1 << 12)
 # define GEN6_RCCUNIT_CLOCK_GATE_DISABLE                (1 << 11)
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 00fbff5ddd81..f851db7be2cc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4680,8 +4680,17 @@ sandybridge_compute_sprite_srwm(struct drm_device *dev, int plane,
 
         crtc = intel_get_crtc_for_plane(dev, plane);
         clock = crtc->mode.clock;
+        if (!clock) {
+                *sprite_wm = 0;
+                return false;
+        }
 
         line_time_us = (sprite_width * 1000) / clock;
+        if (!line_time_us) {
+                *sprite_wm = 0;
+                return false;
+        }
+
         line_count = (latency_ns / line_time_us + 1000) / 1000;
         line_size = sprite_width * pixel_size;
 
@@ -6175,7 +6184,7 @@ void intel_crtc_load_lut(struct drm_crtc *crtc)
         int i;
 
         /* The clocks have to be on to load the palette. */
-        if (!crtc->enabled)
+        if (!crtc->enabled || !intel_crtc->active)
                 return;
 
         /* use legacy palette for Ironlake */
@@ -6561,7 +6570,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
         mode_cmd.height = mode->vdisplay;
         mode_cmd.pitches[0] = intel_framebuffer_pitch_for_width(mode_cmd.width,
                                                                 bpp);
-        mode_cmd.pixel_format = 0;
+        mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
 
         return intel_framebuffer_create(dev, &mode_cmd, obj);
 }
@@ -8184,8 +8193,8 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
         I915_WRITE(GEN6_RC6pp_THRESHOLD, 64000); /* unused */
 
         if (intel_enable_rc6(dev_priv->dev))
-                rc6_mask = GEN6_RC_CTL_RC6p_ENABLE |
-                        GEN6_RC_CTL_RC6_ENABLE;
+                rc6_mask = GEN6_RC_CTL_RC6_ENABLE |
+                        ((IS_GEN7(dev_priv->dev)) ? GEN6_RC_CTL_RC6p_ENABLE : 0);
 
         I915_WRITE(GEN6_RC_CONTROL,
                    rc6_mask |
@@ -8463,12 +8472,32 @@ static void ivybridge_init_clock_gating(struct drm_device *dev)
         I915_WRITE(WM2_LP_ILK, 0);
         I915_WRITE(WM1_LP_ILK, 0);
 
+        /* According to the spec, bit 13 (RCZUNIT) must be set on IVB.
+         * This implements the WaDisableRCZUnitClockGating workaround.
+         */
+        I915_WRITE(GEN6_UCGCTL2, GEN6_RCZUNIT_CLOCK_GATE_DISABLE);
+
         I915_WRITE(ILK_DSPCLK_GATE, IVB_VRHUNIT_CLK_GATE);
 
         I915_WRITE(IVB_CHICKEN3,
                    CHICKEN3_DGMG_REQ_OUT_FIX_DISABLE |
                    CHICKEN3_DGMG_DONE_FIX_DISABLE);
 
+        /* Apply the WaDisableRHWOOptimizationForRenderHang workaround. */
+        I915_WRITE(GEN7_COMMON_SLICE_CHICKEN1,
+                   GEN7_CSC1_RHWO_OPT_DISABLE_IN_RCC);
+
+        /* WaApplyL3ControlAndL3ChickenMode requires those two on Ivy Bridge */
+        I915_WRITE(GEN7_L3CNTLREG1,
+                        GEN7_WA_FOR_GEN7_L3_CONTROL);
+        I915_WRITE(GEN7_L3_CHICKEN_MODE_REGISTER,
+                        GEN7_WA_L3_CHICKEN_MODE);
+
+        /* This is required by WaCatErrorRejectionIssue */
+        I915_WRITE(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG,
+                        I915_READ(GEN7_SQ_CHICKEN_MBCUNIT_CONFIG) |
+                        GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB);
+
         for_each_pipe(pipe) {
                 I915_WRITE(DSPCNTR(pipe),
                            I915_READ(DSPCNTR(pipe)) |
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index 1ab842c6032e..536191540b03 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -301,7 +301,7 @@ static int init_ring_common(struct intel_ring_buffer *ring)
 
         I915_WRITE_CTL(ring,
                         ((ring->size - PAGE_SIZE) & RING_NR_PAGES)
-                        | RING_REPORT_64K | RING_VALID);
+                        | RING_VALID);
 
         /* If the head is still not zero, the ring is dead */
         if ((I915_READ_CTL(ring) & RING_VALID) == 0 ||
@@ -1132,18 +1132,6 @@ int intel_wait_ring_buffer(struct intel_ring_buffer *ring, int n)
         struct drm_device *dev = ring->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long end;
-        u32 head;
-
-        /* If the reported head position has wrapped or hasn't advanced,
-         * fallback to the slow and accurate path.
-         */
-        head = intel_read_status_page(ring, 4);
-        if (head > ring->head) {
-                ring->head = head;
-                ring->space = ring_space(ring);
-                if (ring->space >= n)
-                        return 0;
-        }
 
         trace_i915_ring_wait_begin(ring);
         if (drm_core_check_feature(dev, DRIVER_GEM))
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 9be353b894cc..f58254a3fb01 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -3223,6 +3223,7 @@ int evergreen_resume(struct radeon_device *rdev)
         r = evergreen_startup(rdev);
         if (r) {
                 DRM_ERROR("evergreen startup failed on resume\n");
+                rdev->accel_working = false;
                 return r;
         }
 
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index db09065e68fd..2509c505acb8 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1547,6 +1547,7 @@ int cayman_resume(struct radeon_device *rdev)
         r = cayman_startup(rdev);
         if (r) {
                 DRM_ERROR("cayman startup failed on resume\n");
+                rdev->accel_working = false;
                 return r;
         }
         return r;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 18cd84fae99c..333cde9d4e7b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3928,6 +3928,8 @@ static int r100_startup(struct radeon_device *rdev)
 
 int r100_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         if (rdev->flags & RADEON_IS_PCI)
                 r100_pci_gart_disable(rdev);
@@ -3947,7 +3949,11 @@ int r100_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return r100_startup(rdev);
+        r = r100_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int r100_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 3fc0d29a5f39..6829638cca40 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -1431,6 +1431,8 @@ static int r300_startup(struct radeon_device *rdev)
 
 int r300_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         if (rdev->flags & RADEON_IS_PCIE)
                 rv370_pcie_gart_disable(rdev);
@@ -1452,7 +1454,11 @@ int r300_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return r300_startup(rdev);
+        r = r300_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int r300_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 666e28fe509c..b14323053bad 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -291,6 +291,8 @@ static int r420_startup(struct radeon_device *rdev)
 
 int r420_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         if (rdev->flags & RADEON_IS_PCIE)
                 rv370_pcie_gart_disable(rdev);
@@ -316,7 +318,11 @@ int r420_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return r420_startup(rdev);
+        r = r420_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int r420_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 4ae1615e752f..25084e824dbc 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -218,6 +218,8 @@ static int r520_startup(struct radeon_device *rdev)
 
 int r520_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         if (rdev->flags & RADEON_IS_PCIE)
                 rv370_pcie_gart_disable(rdev);
@@ -237,7 +239,11 @@ int r520_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return r520_startup(rdev);
+        r = r520_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int r520_init(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 4f08e5e6ee9d..17ca72ce3027 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2362,6 +2362,9 @@ void r600_semaphore_ring_emit(struct radeon_device *rdev,
         uint64_t addr = semaphore->gpu_addr;
         unsigned sel = emit_wait ? PACKET3_SEM_SEL_WAIT : PACKET3_SEM_SEL_SIGNAL;
 
+        if (rdev->family < CHIP_CAYMAN)
+                sel |= PACKET3_SEM_WAIT_ON_SIGNAL;
+
         radeon_ring_write(ring, PACKET3(PACKET3_MEM_SEMAPHORE, 1));
         radeon_ring_write(ring, addr & 0xffffffff);
         radeon_ring_write(ring, (upper_32_bits(addr) & 0xff) | sel);
@@ -2529,6 +2532,7 @@ int r600_resume(struct radeon_device *rdev)
         r = r600_startup(rdev);
         if (r) {
                 DRM_ERROR("r600 startup failed on resume\n");
+                rdev->accel_working = false;
                 return r;
         }
 
diff --git a/drivers/gpu/drm/radeon/r600_blit_shaders.c b/drivers/gpu/drm/radeon/r600_blit_shaders.c
index 2d1f6c5ee2a7..73e2c7c6edbc 100644
--- a/drivers/gpu/drm/radeon/r600_blit_shaders.c
+++ b/drivers/gpu/drm/radeon/r600_blit_shaders.c
@@ -314,6 +314,10 @@ const u32 r6xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
@@ -626,6 +630,10 @@ const u32 r7xx_default_state[] =
         0x00000000, /* VGT_VTX_CNT_EN */
 
         0xc0016900,
+        0x000000d4,
+        0x00000000, /* SX_MISC */
+
+        0xc0016900,
         0x000002c8,
         0x00000000, /* VGT_STRMOUT_BUFFER_EN */
 
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 38ce5d0427e3..387fcc9f03ef 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1304,6 +1304,7 @@ static int r600_check_texture_resource(struct radeon_cs_parser *p,  u32 idx,
         h0 = G_038004_TEX_HEIGHT(word1) + 1;
         d0 = G_038004_TEX_DEPTH(word1);
         nfaces = 1;
+        array = 0;
         switch (G_038000_DIM(word0)) {
         case V_038000_SQ_TEX_DIM_1D:
         case V_038000_SQ_TEX_DIM_2D:
diff --git a/drivers/gpu/drm/radeon/r600d.h b/drivers/gpu/drm/radeon/r600d.h
index 3ee1fd7ef394..9b23670716f1 100644
--- a/drivers/gpu/drm/radeon/r600d.h
+++ b/drivers/gpu/drm/radeon/r600d.h
@@ -831,6 +831,7 @@
 #define PACKET3_STRMOUT_BUFFER_UPDATE                   0x34
 #define PACKET3_INDIRECT_BUFFER_MP                      0x38
 #define PACKET3_MEM_SEMAPHORE                           0x39
+#              define PACKET3_SEM_WAIT_ON_SIGNAL    (0x1 << 12)
 #              define PACKET3_SEM_SEL_SIGNAL        (0x6 << 29)
 #              define PACKET3_SEM_SEL_WAIT          (0x7 << 29)
 #define PACKET3_MPEG_INDEX                              0x3A
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 9e72daeeddc6..1f53ae74ada1 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -3020,6 +3020,9 @@ radeon_atombios_encoder_dpms_scratch_regs(struct drm_encoder *encoder, bool on)
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         uint32_t bios_2_scratch;
 
+        if (ASIC_IS_DCE4(rdev))
+                return;
+
         if (rdev->family >= CHIP_R600)
                 bios_2_scratch = RREG32(R600_BIOS_2_SCRATCH);
         else
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index e7cb3ab09243..8c9a8115b632 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1057,7 +1057,7 @@ static int radeon_dvi_mode_valid(struct drm_connector *connector,
                     (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_B))
                         return MODE_OK;
                 else if (radeon_connector->connector_object_id == CONNECTOR_OBJECT_ID_HDMI_TYPE_A) {
-                        if (ASIC_IS_DCE3(rdev)) {
+                        if (0) {
                                 /* HDMI 1.3+ supports max clock of 340 Mhz */
                                 if (mode->clock > 340000)
                                         return MODE_CLOCK_HIGH;
@@ -1117,13 +1117,23 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
             (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)) {
                 struct drm_display_mode *mode;
 
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_ON);
-                ret = radeon_ddc_get_modes(radeon_connector);
-                if (!radeon_dig_connector->edp_on)
-                        atombios_set_edp_panel_power(connector,
-                                                     ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                if (connector->connector_type == DRM_MODE_CONNECTOR_eDP) {
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_ON);
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                        if (!radeon_dig_connector->edp_on)
+                                atombios_set_edp_panel_power(connector,
+                                                             ATOM_TRANSMITTER_ACTION_POWER_OFF);
+                } else {
+                        /* need to setup ddc on the bridge */
+                        if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) !=
+                            ENCODER_OBJECT_ID_NONE) {
+                                if (encoder)
+                                        radeon_atom_ext_encoder_setup_ddc(encoder);
+                        }
+                        ret = radeon_ddc_get_modes(radeon_connector);
+                }
 
                 if (ret > 0) {
                         if (encoder) {
@@ -1134,7 +1144,6 @@ static int radeon_dp_get_modes(struct drm_connector *connector)
                         return ret;
                 }
 
-                encoder = radeon_best_single_encoder(connector);
                 if (!encoder)
                         return 0;
 
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 435a3d970ab8..e64bec488ed8 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -453,6 +453,10 @@ int radeon_cs_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
         int r;
 
         radeon_mutex_lock(&rdev->cs_mutex);
+        if (!rdev->accel_working) {
+                radeon_mutex_unlock(&rdev->cs_mutex);
+                return -EBUSY;
+        }
         /* initialize parser */
         memset(&parser, 0, sizeof(struct radeon_cs_parser));
         parser.filp = filp;
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 8c49fef1ce78..3d314338d843 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1078,15 +1078,21 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
         .create_handle = radeon_user_framebuffer_create_handle,
 };
 
-void
+int
 radeon_framebuffer_init(struct drm_device *dev,
                         struct radeon_framebuffer *rfb,
                         struct drm_mode_fb_cmd2 *mode_cmd,
                         struct drm_gem_object *obj)
 {
+        int ret;
         rfb->obj = obj;
-        drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        ret = drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
+        if (ret) {
+                rfb->obj = NULL;
+                return ret;
+        }
         drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
+        return 0;
 }
 
 static struct drm_framebuffer *
@@ -1096,6 +1102,7 @@ radeon_user_framebuffer_create(struct drm_device *dev,
 {
         struct drm_gem_object *obj;
         struct radeon_framebuffer *radeon_fb;
+        int ret;
 
         obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
         if (obj ==  NULL) {
@@ -1108,7 +1115,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
         if (radeon_fb == NULL)
                 return ERR_PTR(-ENOMEM);
 
-        radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
+        if (ret) {
+                kfree(radeon_fb);
+                drm_gem_object_unreference_unlocked(obj);
+                return NULL;
+        }
 
         return &radeon_fb->base;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9419c51bcf50..26e92708d114 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -307,8 +307,6 @@ void radeon_panel_mode_fixup(struct drm_encoder *encoder,
 bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                                     u32 pixel_clock)
 {
-        struct drm_device *dev = encoder->dev;
-        struct radeon_device *rdev = dev->dev_private;
         struct drm_connector *connector;
         struct radeon_connector *radeon_connector;
         struct radeon_connector_atom_dig *dig_connector;
@@ -326,7 +324,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
         case DRM_MODE_CONNECTOR_HDMIB:
                 if (radeon_connector->use_digital) {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
@@ -348,7 +346,7 @@ bool radeon_dig_monitor_is_duallink(struct drm_encoder *encoder,
                         return false;
                 else {
                         /* HDMI 1.3 supports up to 340 Mhz over single link */
-                        if (ASIC_IS_DCE3(rdev) && drm_detect_hdmi_monitor(radeon_connector->edid)) {
+                        if (0 && drm_detect_hdmi_monitor(radeon_connector->edid)) {
                                 if (pixel_clock > 340000)
                                         return true;
                                 else
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cf2bf35b56b8..195471cf65d3 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -209,6 +209,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
                                                           sizes->surface_depth);
 
         ret = radeonfb_create_pinned_object(rfbdev, &mode_cmd, &gobj);
+        if (ret) {
+                DRM_ERROR("failed to create fbcon object %d\n", ret);
+                return ret;
+        }
+
         rbo = gem_to_radeon_bo(gobj);
 
         /* okay we have an object now allocate the framebuffer */
@@ -220,7 +225,11 @@ static int radeonfb_create(struct radeon_fbdev *rfbdev,
 
         info->par = rfbdev;
 
-        radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
+        if (ret) {
+                DRM_ERROR("failed to initalise framebuffer %d\n", ret);
+                goto out_unref;
+        }
 
         fb = &rfbdev->rfb.base;
 
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 010dad8b66ae..c58a036233fb 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -597,13 +597,13 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        list_del(&bo_va->bo_list);
         mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
         mutex_unlock(&vm->mutex);
+        list_del(&bo_va->bo_list);
 
         kfree(bo_va);
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 4330e3253573..8a85598fb242 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -649,7 +649,7 @@ extern void radeon_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                      u16 blue, int regno);
 extern void radeon_crtc_fb_gamma_get(struct drm_crtc *crtc, u16 *red, u16 *green,
                                      u16 *blue, int regno);
-void radeon_framebuffer_init(struct drm_device *dev,
+int radeon_framebuffer_init(struct drm_device *dev,
                              struct radeon_framebuffer *rfb,
                              struct drm_mode_fb_cmd2 *mode_cmd,
                              struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 30a4c5014c8b..92c9ea4751fb 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -500,8 +500,11 @@ static char radeon_debugfs_ib_names[RADEON_IB_POOL_SIZE][32];
 int radeon_debugfs_ring_init(struct radeon_device *rdev)
 {
 #if defined(CONFIG_DEBUG_FS)
-        return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list,
-                                        ARRAY_SIZE(radeon_debugfs_ring_info_list));
+        if (rdev->family >= CHIP_CAYMAN)
+                return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list,
+                                                ARRAY_SIZE(radeon_debugfs_ring_info_list));
+        else
+                return radeon_debugfs_add_files(rdev, radeon_debugfs_ring_info_list, 1);
 #else
         return 0;
 #endif
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index b0ce84a20a68..866a05be75f2 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -442,6 +442,8 @@ static int rs400_startup(struct radeon_device *rdev)
 
 int rs400_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         rs400_gart_disable(rdev);
         /* Resume clock before doing reset */
@@ -462,7 +464,11 @@ int rs400_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return rs400_startup(rdev);
+        r = rs400_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int rs400_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index c05865e5521f..4fc700684dcd 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -876,6 +876,8 @@ static int rs600_startup(struct radeon_device *rdev)
 
 int rs600_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         rs600_gart_disable(rdev);
         /* Resume clock before doing reset */
@@ -894,7 +896,11 @@ int rs600_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return rs600_startup(rdev);
+        r = rs600_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int rs600_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 4f24a0fa8c82..f68dff2fadcb 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -659,6 +659,8 @@ static int rs690_startup(struct radeon_device *rdev)
 
 int rs690_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         rs400_gart_disable(rdev);
         /* Resume clock before doing reset */
@@ -677,7 +679,11 @@ int rs690_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return rs690_startup(rdev);
+        r = rs690_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int rs690_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 880637fd1946..959bf4483bea 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -424,6 +424,8 @@ static int rv515_startup(struct radeon_device *rdev)
 
 int rv515_resume(struct radeon_device *rdev)
 {
+        int r;
+
         /* Make sur GART are not working */
         if (rdev->flags & RADEON_IS_PCIE)
                 rv370_pcie_gart_disable(rdev);
@@ -443,7 +445,11 @@ int rv515_resume(struct radeon_device *rdev)
         radeon_surface_init(rdev);
 
         rdev->accel_working = true;
-        return rv515_startup(rdev);
+        r =  rv515_startup(rdev);
+        if (r) {
+                rdev->accel_working = false;
+        }
+        return r;
 }
 
 int rv515_suspend(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index a1668b659ddd..c049c0c51841 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -1139,6 +1139,7 @@ int rv770_resume(struct radeon_device *rdev)
         r = rv770_startup(rdev);
         if (r) {
                 DRM_ERROR("r600 startup failed on resume\n");
+                rdev->accel_working = false;
                 return r;
         }
 
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index b8574cddd953..63552e30d0c3 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -59,6 +59,9 @@
 #define USB_VENDOR_ID_AIRCABLE          0x16CA
 #define USB_DEVICE_ID_AIRCABLE1         0x1502
 
+#define USB_VENDOR_ID_AIREN             0x1a2c
+#define USB_DEVICE_ID_AIREN_SLIMPLUS    0x0002
+
 #define USB_VENDOR_ID_ALCOR             0x058f
 #define USB_DEVICE_ID_ALCOR_USBRS232    0x9720
 
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 9333d692a786..627850a54d34 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -986,8 +986,13 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct
                 return;
         }
 
-        /* Ignore out-of-range values as per HID specification, section 5.10 */
-        if (value < field->logical_minimum || value > field->logical_maximum) {
+        /*
+         * Ignore out-of-range values as per HID specification,
+         * section 5.10 and 6.2.25
+         */
+        if ((field->flags & HID_MAIN_ITEM_VARIABLE) &&
+            (value < field->logical_minimum ||
+             value > field->logical_maximum)) {
                 dbg_hid("Ignoring out-of-range value %x\n", value);
                 return;
         }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index c831af937481..57d4e1e1df48 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -54,6 +54,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
 
+        { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 02260406b9e4..dad895fec62a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -497,8 +497,9 @@ config SENSORS_JC42
           If you say yes here, you get support for JEDEC JC42.4 compliant
           temperature sensors, which are used on many DDR3 memory modules for
           mobile devices and servers.  Support will include, but not be limited
-          to, ADT7408, CAT34TS02, CAT6095, MAX6604, MCP9805, MCP98242, MCP98243,
-          MCP9843, SE97, SE98, STTS424(E), TSE2002B3, and TS3000B3.
+          to, ADT7408, AT30TS00, CAT34TS02, CAT6095, MAX6604, MCP9804, MCP9805,
+          MCP98242, MCP98243, MCP9843, SE97, SE98, STTS424(E), STTS2002,
+          STTS3000, TSE2002B3, TSE2002GB2, TS3000B3, and TS3000GB2.
 
           This driver can also be built as a module.  If so, the module
           will be called jc42.
diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
index eedca3cf9968..dd87ae96c262 100644
--- a/drivers/hwmon/ads1015.c
+++ b/drivers/hwmon/ads1015.c
@@ -271,7 +271,7 @@ static int ads1015_probe(struct i2c_client *client,
                         continue;
                 err = device_create_file(&client->dev, &ads1015_in[k].dev_attr);
                 if (err)
-                        goto exit_free;
+                        goto exit_remove;
         }
 
         data->hwmon_dev = hwmon_device_register(&client->dev);
@@ -285,7 +285,6 @@ static int ads1015_probe(struct i2c_client *client,
 exit_remove:
         for (k = 0; k < ADS1015_CHANNELS; ++k)
                 device_remove_file(&client->dev, &ads1015_in[k].dev_attr);
-exit_free:
         kfree(data);
 exit:
         return err;
diff --git a/drivers/hwmon/f75375s.c b/drivers/hwmon/f75375s.c
index f609b5727ba9..6aa5a9fad879 100644
--- a/drivers/hwmon/f75375s.c
+++ b/drivers/hwmon/f75375s.c
@@ -178,6 +178,16 @@ static inline void f75375_write16(struct i2c_client *client, u8 reg,
         i2c_smbus_write_byte_data(client, reg + 1, (value & 0xFF));
 }
 
+static void f75375_write_pwm(struct i2c_client *client, int nr)
+{
+        struct f75375_data *data = i2c_get_clientdata(client);
+        if (data->kind == f75387)
+                f75375_write16(client, F75375_REG_FAN_EXP(nr), data->pwm[nr]);
+        else
+                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
+                              data->pwm[nr]);
+}
+
 static struct f75375_data *f75375_update_device(struct device *dev)
 {
         struct i2c_client *client = to_i2c_client(dev);
@@ -254,6 +264,36 @@ static inline u16 rpm_to_reg(int rpm)
         return 1500000 / rpm;
 }
 
+static bool duty_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        case 2: /* Auto, speed mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        default:
+                BUG();
+        }
+}
+
+static bool auto_mode_enabled(u8 pwm_enable)
+{
+        switch (pwm_enable) {
+        case 0: /* Manual, duty mode (full speed) */
+        case 1: /* Manual, duty mode */
+        case 3: /* Manual, speed mode */
+                return false;
+        case 2: /* Auto, speed mode */
+        case 4: /* Auto, duty mode */
+                return true;
+        default:
+                BUG();
+        }
+}
+
 static ssize_t set_fan_min(struct device *dev, struct device_attribute *attr,
                 const char *buf, size_t count)
 {
@@ -287,6 +327,11 @@ static ssize_t set_fan_target(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+        if (data->kind == f75387 && duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->fan_target[nr] = rpm_to_reg(val);
         f75375_write16(client, F75375_REG_FAN_EXP(nr), data->fan_target[nr]);
@@ -307,9 +352,13 @@ static ssize_t set_pwm(struct device *dev, struct device_attribute *attr,
         if (err < 0)
                 return err;
 
+        if (auto_mode_enabled(data->pwm_enable[nr]) ||
+            !duty_mode_enabled(data->pwm_enable[nr]))
+                return -EINVAL;
+
         mutex_lock(&data->update_lock);
         data->pwm[nr] = SENSORS_LIMIT(val, 0, 255);
-        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr), data->pwm[nr]);
+        f75375_write_pwm(client, nr);
         mutex_unlock(&data->update_lock);
         return count;
 }
@@ -327,11 +376,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
         struct f75375_data *data = i2c_get_clientdata(client);
         u8 fanmode;
 
-        if (val < 0 || val > 3)
+        if (val < 0 || val > 4)
                 return -EINVAL;
 
         fanmode = f75375_read8(client, F75375_REG_FAN_TIMER);
         if (data->kind == f75387) {
+                /* For now, deny dangerous toggling of duty mode */
+                if (duty_mode_enabled(data->pwm_enable[nr]) !=
+                                duty_mode_enabled(val))
+                        return -EOPNOTSUPP;
                 /* clear each fanX_mode bit before setting them properly */
                 fanmode &= ~(1 << F75387_FAN_DUTY_MODE(nr));
                 fanmode &= ~(1 << F75387_FAN_MANU_MODE(nr));
@@ -340,19 +393,19 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
                         data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                         break;
                 case 1: /* PWM */
                         fanmode  |= (1 << F75387_FAN_MANU_MODE(nr));
                         fanmode  |= (1 << F75387_FAN_DUTY_MODE(nr));
                         break;
-                case 2: /* AUTOMATIC*/
-                        fanmode  |=  (1 << F75387_FAN_DUTY_MODE(nr));
+                case 2: /* Automatic, speed mode */
                         break;
                 case 3: /* fan speed */
                         fanmode |= (1 << F75387_FAN_MANU_MODE(nr));
                         break;
+                case 4: /* Automatic, pwm */
+                        fanmode |= (1 << F75387_FAN_DUTY_MODE(nr));
+                        break;
                 }
         } else {
                 /* clear each fanX_mode bit before setting them properly */
@@ -361,8 +414,6 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                 case 0: /* full speed */
                         fanmode  |= (3 << FAN_CTRL_MODE(nr));
                         data->pwm[nr] = 255;
-                        f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                                        data->pwm[nr]);
                         break;
                 case 1: /* PWM */
                         fanmode  |= (3 << FAN_CTRL_MODE(nr));
@@ -372,11 +423,15 @@ static int set_pwm_enable_direct(struct i2c_client *client, int nr, int val)
                         break;
                 case 3: /* fan speed */
                         break;
+                case 4: /* Automatic pwm */
+                        return -EINVAL;
                 }
         }
 
         f75375_write8(client, F75375_REG_FAN_TIMER, fanmode);
         data->pwm_enable[nr] = val;
+        if (val == 0)
+                f75375_write_pwm(client, nr);
         return 0;
 }
 
@@ -727,14 +782,17 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
 
                                 manu = ((mode >> F75387_FAN_MANU_MODE(nr)) & 1);
                                 duty = ((mode >> F75387_FAN_DUTY_MODE(nr)) & 1);
-                                if (manu && duty)
-                                        /* speed */
+                                if (!manu && duty)
+                                        /* auto, pwm */
+                                        data->pwm_enable[nr] = 4;
+                                else if (manu && !duty)
+                                        /* manual, speed */
                                         data->pwm_enable[nr] = 3;
-                                else if (!manu && duty)
-                                        /* automatic */
+                                else if (!manu && !duty)
+                                        /* automatic, speed */
                                         data->pwm_enable[nr] = 2;
                                 else
-                                        /* manual */
+                                        /* manual, pwm */
                                         data->pwm_enable[nr] = 1;
                         } else {
                                 if (!(conf & (1 << F75375_FAN_CTRL_LINEAR(nr))))
@@ -759,9 +817,11 @@ static void f75375_init(struct i2c_client *client, struct f75375_data *data,
         set_pwm_enable_direct(client, 0, f75375s_pdata->pwm_enable[0]);
         set_pwm_enable_direct(client, 1, f75375s_pdata->pwm_enable[1]);
         for (nr = 0; nr < 2; nr++) {
+                if (auto_mode_enabled(f75375s_pdata->pwm_enable[nr]) ||
+                    !duty_mode_enabled(f75375s_pdata->pwm_enable[nr]))
+                        continue;
                 data->pwm[nr] = SENSORS_LIMIT(f75375s_pdata->pwm[nr], 0, 255);
-                f75375_write8(client, F75375_REG_FAN_PWM_DUTY(nr),
-                        data->pwm[nr]);
+                f75375_write_pwm(client, nr);
         }
 
 }
@@ -788,7 +848,7 @@ static int f75375_probe(struct i2c_client *client,
         if (err)
                 goto exit_free;
 
-        if (data->kind == f75375) {
+        if (data->kind != f75373) {
                 err = sysfs_chmod_file(&client->dev.kobj,
                         &sensor_dev_attr_pwm1_mode.dev_attr.attr,
                         S_IRUGO | S_IWUSR);
diff --git a/drivers/hwmon/jc42.c b/drivers/hwmon/jc42.c
index 28c09eead36b..b927ee5ccdd7 100644
--- a/drivers/hwmon/jc42.c
+++ b/drivers/hwmon/jc42.c
@@ -64,6 +64,7 @@ static const unsigned short normal_i2c[] = {
 
 /* Manufacturer IDs */
 #define ADT_MANID               0x11d4  /* Analog Devices */
+#define ATMEL_MANID             0x001f  /* Atmel */
 #define MAX_MANID               0x004d  /* Maxim */
 #define IDT_MANID               0x00b3  /* IDT */
 #define MCP_MANID               0x0054  /* Microchip */
@@ -77,15 +78,25 @@ static const unsigned short normal_i2c[] = {
 #define ADT7408_DEVID           0x0801
 #define ADT7408_DEVID_MASK      0xffff
 
+/* Atmel */
+#define AT30TS00_DEVID          0x8201
+#define AT30TS00_DEVID_MASK     0xffff
+
 /* IDT */
 #define TS3000B3_DEVID          0x2903  /* Also matches TSE2002B3 */
 #define TS3000B3_DEVID_MASK     0xffff
 
+#define TS3000GB2_DEVID         0x2912  /* Also matches TSE2002GB2 */
+#define TS3000GB2_DEVID_MASK    0xffff
+
 /* Maxim */
 #define MAX6604_DEVID           0x3e00
 #define MAX6604_DEVID_MASK      0xffff
 
 /* Microchip */
+#define MCP9804_DEVID           0x0200
+#define MCP9804_DEVID_MASK      0xfffc
+
 #define MCP98242_DEVID          0x2000
 #define MCP98242_DEVID_MASK     0xfffc
 
@@ -113,6 +124,12 @@ static const unsigned short normal_i2c[] = {
 #define STTS424E_DEVID          0x0000
 #define STTS424E_DEVID_MASK     0xfffe
 
+#define STTS2002_DEVID          0x0300
+#define STTS2002_DEVID_MASK     0xffff
+
+#define STTS3000_DEVID          0x0200
+#define STTS3000_DEVID_MASK     0xffff
+
 static u16 jc42_hysteresis[] = { 0, 1500, 3000, 6000 };
 
 struct jc42_chips {
@@ -123,8 +140,11 @@ struct jc42_chips {
 
 static struct jc42_chips jc42_chips[] = {
         { ADT_MANID, ADT7408_DEVID, ADT7408_DEVID_MASK },
+        { ATMEL_MANID, AT30TS00_DEVID, AT30TS00_DEVID_MASK },
         { IDT_MANID, TS3000B3_DEVID, TS3000B3_DEVID_MASK },
+        { IDT_MANID, TS3000GB2_DEVID, TS3000GB2_DEVID_MASK },
         { MAX_MANID, MAX6604_DEVID, MAX6604_DEVID_MASK },
+        { MCP_MANID, MCP9804_DEVID, MCP9804_DEVID_MASK },
         { MCP_MANID, MCP98242_DEVID, MCP98242_DEVID_MASK },
         { MCP_MANID, MCP98243_DEVID, MCP98243_DEVID_MASK },
         { MCP_MANID, MCP9843_DEVID, MCP9843_DEVID_MASK },
@@ -133,6 +153,8 @@ static struct jc42_chips jc42_chips[] = {
         { NXP_MANID, SE98_DEVID, SE98_DEVID_MASK },
         { STM_MANID, STTS424_DEVID, STTS424_DEVID_MASK },
         { STM_MANID, STTS424E_DEVID, STTS424E_DEVID_MASK },
+        { STM_MANID, STTS2002_DEVID, STTS2002_DEVID_MASK },
+        { STM_MANID, STTS3000_DEVID, STTS3000_DEVID_MASK },
 };
 
 /* Each client has this additional data */
@@ -159,10 +181,12 @@ static struct jc42_data *jc42_update_device(struct device *dev);
 
 static const struct i2c_device_id jc42_id[] = {
         { "adt7408", 0 },
+        { "at30ts00", 0 },
         { "cat94ts02", 0 },
         { "cat6095", 0 },
         { "jc42", 0 },
         { "max6604", 0 },
+        { "mcp9804", 0 },
         { "mcp9805", 0 },
         { "mcp98242", 0 },
         { "mcp98243", 0 },
@@ -171,8 +195,10 @@ static const struct i2c_device_id jc42_id[] = {
         { "se97b", 0 },
         { "se98", 0 },
         { "stts424", 0 },
-        { "tse2002b3", 0 },
-        { "ts3000b3", 0 },
+        { "stts2002", 0 },
+        { "stts3000", 0 },
+        { "tse2002", 0 },
+        { "ts3000", 0 },
         { }
 };
 MODULE_DEVICE_TABLE(i2c, jc42_id);
diff --git a/drivers/hwmon/max6639.c b/drivers/hwmon/max6639.c
index e10a092c603c..a6760bacd915 100644
--- a/drivers/hwmon/max6639.c
+++ b/drivers/hwmon/max6639.c
@@ -72,8 +72,8 @@ static unsigned short normal_i2c[] = { 0x2c, 0x2e, 0x2f, I2C_CLIENT_END };
 
 static const int rpm_ranges[] = { 2000, 4000, 8000, 16000 };
 
-#define FAN_FROM_REG(val, div, rpm_range)       ((val) == 0 ? -1 : \
-        (val) == 255 ? 0 : (rpm_ranges[rpm_range] * 30) / ((div + 1) * (val)))
+#define FAN_FROM_REG(val, rpm_range)    ((val) == 0 || (val) == 255 ? \
+                                0 : (rpm_ranges[rpm_range] * 30) / (val))
 #define TEMP_LIMIT_TO_REG(val)  SENSORS_LIMIT((val) / 1000, 0, 255)
 
 /*
@@ -333,7 +333,7 @@ static ssize_t show_fan_input(struct device *dev,
                 return PTR_ERR(data);
 
         return sprintf(buf, "%d\n", FAN_FROM_REG(data->fan[attr->index],
-                       data->ppr, data->rpm_range));
+                       data->rpm_range));
 }
 
 static ssize_t show_alarm(struct device *dev,
@@ -429,9 +429,9 @@ static int max6639_init_client(struct i2c_client *client)
         struct max6639_data *data = i2c_get_clientdata(client);
         struct max6639_platform_data *max6639_info =
                 client->dev.platform_data;
-        int i = 0;
+        int i;
         int rpm_range = 1; /* default: 4000 RPM */
-        int err = 0;
+        int err;
 
         /* Reset chip to default values, see below for GCONFIG setup */
         err = i2c_smbus_write_byte_data(client, MAX6639_REG_GCONFIG,
@@ -446,11 +446,6 @@ static int max6639_init_client(struct i2c_client *client)
         else
                 data->ppr = 2;
         data->ppr -= 1;
-        err = i2c_smbus_write_byte_data(client,
-                        MAX6639_REG_FAN_PPR(i),
-                        data->ppr << 5);
-        if (err)
-                goto exit;
 
         if (max6639_info)
                 rpm_range = rpm_range_to_reg(max6639_info->rpm_range);
@@ -458,6 +453,13 @@ static int max6639_init_client(struct i2c_client *client)
 
         for (i = 0; i < 2; i++) {
 
+                /* Set Fan pulse per revolution */
+                err = i2c_smbus_write_byte_data(client,
+                                MAX6639_REG_FAN_PPR(i),
+                                data->ppr << 6);
+                if (err)
+                        goto exit;
+
                 /* Fans config PWM, RPM */
                 err = i2c_smbus_write_byte_data(client,
                         MAX6639_REG_FAN_CONFIG1(i),
diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c
index beaf5a8d9c45..9b97a5b3cf3d 100644
--- a/drivers/hwmon/pmbus/max34440.c
+++ b/drivers/hwmon/pmbus/max34440.c
@@ -82,7 +82,7 @@ static int max34440_write_word_data(struct i2c_client *client, int page,
         case PMBUS_VIRT_RESET_TEMP_HISTORY:
                 ret = pmbus_write_word_data(client, page,
                                             MAX34440_MFR_TEMPERATURE_PEAK,
-                                            0xffff);
+                                            0x8000);
                 break;
         default:
                 ret = -ENODATA;
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index 00460d8d8423..d89b33967a85 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
+++ b/drivers/hwmon/pmbus/pmbus_core.c
@@ -54,7 +54,8 @@
                                                    lcrit_alarm, crit_alarm */
 #define PMBUS_IOUT_BOOLEANS_PER_PAGE    3       /* alarm, lcrit_alarm,
                                                    crit_alarm */
-#define PMBUS_POUT_BOOLEANS_PER_PAGE    2       /* alarm, crit_alarm */
+#define PMBUS_POUT_BOOLEANS_PER_PAGE    3       /* cap_alarm, alarm, crit_alarm
+                                                 */
 #define PMBUS_MAX_BOOLEANS_PER_FAN      2       /* alarm, fault */
 #define PMBUS_MAX_BOOLEANS_PER_TEMP     4       /* min_alarm, max_alarm,
                                                    lcrit_alarm, crit_alarm */
diff --git a/drivers/hwmon/pmbus/zl6100.c b/drivers/hwmon/pmbus/zl6100.c
index 48c7b4a716ae..880b90cf4d32 100644
--- a/drivers/hwmon/pmbus/zl6100.c
+++ b/drivers/hwmon/pmbus/zl6100.c
@@ -33,6 +33,7 @@ enum chips { zl2004, zl2005, zl2006, zl2008, zl2105, zl2106, zl6100, zl6105 };
 struct zl6100_data {
         int id;
         ktime_t access;         /* chip access time */
+        int delay;              /* Delay between chip accesses in uS */
         struct pmbus_driver_info info;
 };
 
@@ -52,10 +53,10 @@ MODULE_PARM_DESC(delay, "Delay between chip accesses in uS");
 /* Some chips need a delay between accesses */
 static inline void zl6100_wait(const struct zl6100_data *data)
 {
-        if (delay) {
+        if (data->delay) {
                 s64 delta = ktime_us_delta(ktime_get(), data->access);
-                if (delta < delay)
-                        udelay(delay - delta);
+                if (delta < data->delay)
+                        udelay(data->delay - delta);
         }
 }
 
@@ -207,8 +208,9 @@ static int zl6100_probe(struct i2c_client *client,
          * can be cleared later for additional chips if tests show that it
          * is not needed (in other words, better be safe than sorry).
          */
+        data->delay = delay;
         if (data->id == zl2004 || data->id == zl6105)
-                delay = 0;
+                data->delay = 0;
 
         /*
          * Since there was a direct I2C device access above, wait before
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 7e78f7c87857..3d471d56bf15 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -72,6 +72,7 @@
 
 #define MXS_I2C_QUEUESTAT       (0x70)
 #define MXS_I2C_QUEUESTAT_RD_QUEUE_EMPTY        0x00002000
+#define MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK  0x0000001F
 
 #define MXS_I2C_QUEUECMD        (0x80)
 
@@ -219,14 +220,14 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         int ret;
         int flags;
 
-        init_completion(&i2c->cmd_complete);
-
         dev_dbg(i2c->dev, "addr: 0x%04x, len: %d, flags: 0x%x, stop: %d\n",
                 msg->addr, msg->len, msg->flags, stop);
 
         if (msg->len == 0)
                 return -EINVAL;
 
+        init_completion(&i2c->cmd_complete);
+
         flags = stop ? MXS_I2C_CTRL0_POST_SEND_STOP : 0;
 
         if (msg->flags & I2C_M_RD)
@@ -286,6 +287,7 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
 {
         struct mxs_i2c_dev *i2c = dev_id;
         u32 stat = readl(i2c->regs + MXS_I2C_CTRL1) & MXS_I2C_IRQ_MASK;
+        bool is_last_cmd;
 
         if (!stat)
                 return IRQ_NONE;
@@ -300,9 +302,14 @@ static irqreturn_t mxs_i2c_isr(int this_irq, void *dev_id)
         else
                 i2c->cmd_err = 0;
 
-        complete(&i2c->cmd_complete);
+        is_last_cmd = (readl(i2c->regs + MXS_I2C_QUEUESTAT) &
+                MXS_I2C_QUEUESTAT_WRITE_QUEUE_CNT_MASK) == 0;
+
+        if (is_last_cmd || i2c->cmd_err)
+                complete(&i2c->cmd_complete);
 
         writel(stat, i2c->regs + MXS_I2C_CTRL1_CLR);
+
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index afc166fcc3d9..7df5bfef2624 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -332,7 +332,7 @@ static ssize_t evdev_write(struct file *file, const char __user *buffer,
         struct evdev_client *client = file->private_data;
         struct evdev *evdev = client->evdev;
         struct input_event event;
-        int retval;
+        int retval = 0;
 
         if (count < input_event_size())
                 return -EINVAL;
diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c
index 37651373a95b..f3bc4189a7ba 100644
--- a/drivers/input/misc/twl4030-vibra.c
+++ b/drivers/input/misc/twl4030-vibra.c
@@ -172,7 +172,7 @@ static void twl4030_vibra_close(struct input_dev *input)
 }
 
 /*** Module ***/
-#if CONFIG_PM
+#if CONFIG_PM_SLEEP
 static int twl4030_vibra_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -189,10 +189,10 @@ static int twl4030_vibra_resume(struct device *dev)
         vibra_disable_leds();
         return 0;
 }
+#endif
 
 static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops,
                          twl4030_vibra_suspend, twl4030_vibra_resume);
-#endif
 
 static int __devinit twl4030_vibra_probe(struct platform_device *pdev)
 {
@@ -273,9 +273,7 @@ static struct platform_driver twl4030_vibra_driver = {
         .driver         = {
                 .name   = "twl4030-vibra",
                 .owner  = THIS_MODULE,
-#ifdef CONFIG_PM
                 .pm     = &twl4030_vibra_pm_ops,
-#endif
         },
 };
 module_platform_driver(twl4030_vibra_driver);
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index bd87380bd879..4c6a72d3d48c 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -952,7 +952,9 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
 
         /*
          * First try "E6 report".
-         * ALPS should return 0,0,10 or 0,0,100
+         * ALPS should return 0,0,10 or 0,0,100 if no buttons are pressed.
+         * The bits 0-2 of the first byte will be 1s if some buttons are
+         * pressed.
          */
         param[0] = 0;
         if (ps2_command(ps2dev, param, PSMOUSE_CMD_SETRES) ||
@@ -968,7 +970,8 @@ static const struct alps_model_info *alps_get_model(struct psmouse *psmouse, int
         psmouse_dbg(psmouse, "E6 report: %2.2x %2.2x %2.2x",
                     param[0], param[1], param[2]);
 
-        if (param[0] != 0 || param[1] != 0 || (param[2] != 10 && param[2] != 100))
+        if ((param[0] & 0xf8) != 0 || param[1] != 0 ||
+            (param[2] != 10 && param[2] != 100))
                 return NULL;
 
         /*
diff --git a/drivers/input/tablet/Kconfig b/drivers/input/tablet/Kconfig
index 58a87755b936..e53f4081a586 100644
--- a/drivers/input/tablet/Kconfig
+++ b/drivers/input/tablet/Kconfig
@@ -77,6 +77,8 @@ config TABLET_USB_WACOM
         tristate "Wacom Intuos/Graphire tablet support (USB)"
         depends on USB_ARCH_HAS_HCD
         select USB
+        select NEW_LEDS
+        select LEDS_CLASS
         help
           Say Y here if you want to use the USB version of the Wacom Intuos
           or Graphire tablet.  Make sure to say Y to "Mouse support"
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 88672ec296c1..cd3ed29e0801 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -926,7 +926,7 @@ static int wacom_bpt3_touch(struct wacom_wac *wacom)
 {
         struct input_dev *input = wacom->input;
         unsigned char *data = wacom->data;
-        int count = data[1] & 0x03;
+        int count = data[1] & 0x07;
         int i;
 
         if (data[0] != 0x02)
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index bdea288dc185..a35e98ad9725 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -275,7 +275,7 @@ static void iommu_set_exclusion_range(struct amd_iommu *iommu)
 }
 
 /* Programs the physical address of the device table into the IOMMU hardware */
-static void __init iommu_set_device_table(struct amd_iommu *iommu)
+static void iommu_set_device_table(struct amd_iommu *iommu)
 {
         u64 entry;
 
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 288da5c1499d..103dbd92e256 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -44,7 +44,8 @@ static ssize_t debug_read_ver(struct file *file, char __user *userbuf,
 static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes;
 
@@ -67,7 +68,8 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf,
 static ssize_t debug_read_tlb(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         ssize_t bytes, rest;
 
@@ -97,7 +99,8 @@ static ssize_t debug_write_pagetable(struct file *file,
         struct iotlb_entry e;
         struct cr_regs cr;
         int err;
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char buf[MAXCOLUMN], *p = buf;
 
         count = min(count, sizeof(buf));
@@ -184,7 +187,8 @@ out:
 static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
                                     size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         size_t bytes;
 
@@ -212,7 +216,8 @@ static ssize_t debug_read_pagetable(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
+        struct omap_iommu *obj = dev_to_omap_iommu(dev);
         char *p, *buf;
         struct iovm_struct *tmp;
         int uninitialized_var(i);
@@ -254,7 +259,7 @@ static ssize_t debug_read_mmap(struct file *file, char __user *userbuf,
 static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
                               size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         char *p, *buf;
         struct iovm_struct *area;
         ssize_t bytes;
@@ -268,8 +273,8 @@ static ssize_t debug_read_mem(struct file *file, char __user *userbuf,
 
         mutex_lock(&iommu_debug_lock);
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 bytes = -EINVAL;
                 goto err_out;
         }
@@ -287,7 +292,7 @@ err_out:
 static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                                size_t count, loff_t *ppos)
 {
-        struct omap_iommu *obj = file->private_data;
+        struct device *dev = file->private_data;
         struct iovm_struct *area;
         char *p, *buf;
 
@@ -305,8 +310,8 @@ static ssize_t debug_write_mem(struct file *file, const char __user *userbuf,
                 goto err_out;
         }
 
-        area = omap_find_iovm_area(obj, (u32)ppos);
-        if (IS_ERR(area)) {
+        area = omap_find_iovm_area(dev, (u32)ppos);
+        if (!area) {
                 count = -EINVAL;
                 goto err_out;
         }
@@ -350,7 +355,7 @@ DEBUG_FOPS(mem);
         {                                                               \
                 struct dentry *dent;                                    \
                 dent = debugfs_create_file(#attr, mode, parent,         \
-                                           obj, &debug_##attr##_fops);  \
+                                           dev, &debug_##attr##_fops);  \
                 if (!dent)                                              \
                         return -ENOMEM;                                 \
         }
@@ -362,20 +367,29 @@ static int iommu_debug_register(struct device *dev, void *data)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct omap_iommu *obj = platform_get_drvdata(pdev);
+        struct omap_iommu_arch_data *arch_data;
         struct dentry *d, *parent;
 
         if (!obj || !obj->dev)
                 return -EINVAL;
 
+        arch_data = kzalloc(sizeof(*arch_data), GFP_KERNEL);
+        if (!arch_data)
+                return -ENOMEM;
+
+        arch_data->iommu_dev = obj;
+
+        dev->archdata.iommu = arch_data;
+
         d = debugfs_create_dir(obj->name, iommu_debug_root);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
         parent = d;
 
         d = debugfs_create_u8("nr_tlb_entries", 400, parent,
                               (u8 *)&obj->nr_tlb_entries);
         if (!d)
-                return -ENOMEM;
+                goto nomem;
 
         DEBUG_ADD_FILE_RO(ver);
         DEBUG_ADD_FILE_RO(regs);
@@ -385,6 +399,22 @@ static int iommu_debug_register(struct device *dev, void *data)
         DEBUG_ADD_FILE(mem);
 
         return 0;
+
+nomem:
+        kfree(arch_data);
+        return -ENOMEM;
+}
+
+static int iommu_debug_unregister(struct device *dev, void *data)
+{
+        if (!dev->archdata.iommu)
+                return 0;
+
+        kfree(dev->archdata.iommu);
+
+        dev->archdata.iommu = NULL;
+
+        return 0;
 }
 
 static int __init iommu_debug_init(void)
@@ -411,6 +441,7 @@ module_init(iommu_debug_init)
 static void __exit iommu_debugfs_exit(void)
 {
         debugfs_remove_recursive(iommu_debug_root);
+        omap_foreach_iommu_device(NULL, iommu_debug_unregister);
 }
 module_exit(iommu_debugfs_exit)
 
diff --git a/drivers/iommu/omap-iommu.c b/drivers/iommu/omap-iommu.c
index d8edd979d01b..6899dcd02dfa 100644
--- a/drivers/iommu/omap-iommu.c
+++ b/drivers/iommu/omap-iommu.c
@@ -1223,7 +1223,8 @@ static int __init omap_iommu_init(void)
 
         return platform_driver_register(&omap_iommu_driver);
 }
-module_init(omap_iommu_init);
+/* must be ready before omap3isp is probed */
+subsys_initcall(omap_iommu_init);
 
 static void __exit omap_iommu_exit(void)
 {
diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c
index 9fb18c147825..b280c433e4a0 100644
--- a/drivers/md/dm-flakey.c
+++ b/drivers/md/dm-flakey.c
@@ -323,7 +323,7 @@ static int flakey_end_io(struct dm_target *ti, struct bio *bio,
          * Corrupt successful READs while in down state.
          * If flags were specified, only corrupt those that match.
          */
-        if (!error && bio_submitted_while_down &&
+        if (fc->corrupt_bio_byte && !error && bio_submitted_while_down &&
             (bio_data_dir(bio) == READ) && (fc->corrupt_bio_rw == READ) &&
             all_corrupt_bio_flags_match(bio, fc))
                 corrupt_bio_data(bio, fc);
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index ad2eba40e319..ea5dd289fe2a 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -296,6 +296,8 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
         unsigned offset;
         unsigned num_bvecs;
         sector_t remaining = where->count;
+        struct request_queue *q = bdev_get_queue(where->bdev);
+        sector_t discard_sectors;
 
         /*
          * where->count may be zero if rw holds a flush and we need to
@@ -305,9 +307,12 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 /*
                  * Allocate a suitably sized-bio.
                  */
-                num_bvecs = dm_sector_div_up(remaining,
-                                             (PAGE_SIZE >> SECTOR_SHIFT));
-                num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev), num_bvecs);
+                if (rw & REQ_DISCARD)
+                        num_bvecs = 1;
+                else
+                        num_bvecs = min_t(int, bio_get_nr_vecs(where->bdev),
+                                          dm_sector_div_up(remaining, (PAGE_SIZE >> SECTOR_SHIFT)));
+
                 bio = bio_alloc_bioset(GFP_NOIO, num_bvecs, io->client->bios);
                 bio->bi_sector = where->sector + (where->count - remaining);
                 bio->bi_bdev = where->bdev;
@@ -315,10 +320,14 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
                 bio->bi_destructor = dm_bio_destructor;
                 store_io_and_region_in_bio(bio, io, region);
 
-                /*
-                 * Try and add as many pages as possible.
-                 */
-                while (remaining) {
+                if (rw & REQ_DISCARD) {
+                        discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
+                        bio->bi_size = discard_sectors << SECTOR_SHIFT;
+                        remaining -= discard_sectors;
+                } else while (remaining) {
+                        /*
+                         * Try and add as many pages as possible.
+                         */
                         dp->get_page(dp, &page, &len, &offset);
                         len = min(len, to_bytes(remaining));
                         if (!bio_add_page(bio, page, len, offset))
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 31c2dc25886d..1ce84ed0b765 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1437,7 +1437,7 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
 
         if (!argc) {
                 DMWARN("Empty message received.");
-                goto out;
+                goto out_argv;
         }
 
         table = dm_get_live_table(md);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 86cb7e5d83d5..787022c18187 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -668,7 +668,14 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
                 return ret;
 
         sb = page_address(rdev->sb_page);
-        if (sb->magic != cpu_to_le32(DM_RAID_MAGIC)) {
+
+        /*
+         * Two cases that we want to write new superblocks and rebuild:
+         * 1) New device (no matching magic number)
+         * 2) Device specified for rebuild (!In_sync w/ offset == 0)
+         */
+        if ((sb->magic != cpu_to_le32(DM_RAID_MAGIC)) ||
+            (!test_bit(In_sync, &rdev->flags) && !rdev->recovery_offset)) {
                 super_sync(rdev->mddev, rdev);
 
                 set_bit(FirstUse, &rdev->flags);
@@ -745,11 +752,8 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
          */
         rdev_for_each(r, t, mddev) {
                 if (!test_bit(In_sync, &r->flags)) {
-                        if (!test_bit(FirstUse, &r->flags))
-                                DMERR("Superblock area of "
-                                      "rebuild device %d should have been "
-                                      "cleared.", r->raid_disk);
-                        set_bit(FirstUse, &r->flags);
+                        DMINFO("Device %d specified for rebuild: "
+                               "Clearing superblock", r->raid_disk);
                         rebuilds++;
                 } else if (test_bit(FirstUse, &r->flags))
                         new_devs++;
@@ -971,6 +975,7 @@ static int raid_ctr(struct dm_target *ti, unsigned argc, char **argv)
 
         INIT_WORK(&rs->md.event_work, do_table_event);
         ti->private = rs;
+        ti->num_flush_requests = 1;
 
         mutex_lock(&rs->md.reconfig_mutex);
         ret = md_run(&rs->md);
diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index 59c4f0446ffa..237571af77fd 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -385,6 +385,7 @@ static int init_pmd(struct dm_pool_metadata *pmd,
                 data_sm = dm_sm_disk_create(tm, nr_blocks);
                 if (IS_ERR(data_sm)) {
                         DMERR("sm_disk_create failed");
+                        dm_tm_unlock(tm, sblock);
                         r = PTR_ERR(data_sm);
                         goto bad;
                 }
@@ -789,6 +790,11 @@ int dm_pool_metadata_close(struct dm_pool_metadata *pmd)
         return 0;
 }
 
+/*
+ * __open_device: Returns @td corresponding to device with id @dev,
+ * creating it if @create is set and incrementing @td->open_count.
+ * On failure, @td is undefined.
+ */
 static int __open_device(struct dm_pool_metadata *pmd,
                          dm_thin_id dev, int create,
                          struct dm_thin_device **td)
@@ -799,10 +805,16 @@ static int __open_device(struct dm_pool_metadata *pmd,
         struct disk_device_details details_le;
 
         /*
-         * Check the device isn't already open.
+         * If the device is already open, return it.
          */
         list_for_each_entry(td2, &pmd->thin_devices, list)
                 if (td2->id == dev) {
+                        /*
+                         * May not create an already-open device.
+                         */
+                        if (create)
+                                return -EEXIST;
+
                         td2->open_count++;
                         *td = td2;
                         return 0;
@@ -817,6 +829,9 @@ static int __open_device(struct dm_pool_metadata *pmd,
                 if (r != -ENODATA || !create)
                         return r;
 
+                /*
+                 * Create new device.
+                 */
                 changed = 1;
                 details_le.mapped_blocks = 0;
                 details_le.transaction_id = cpu_to_le64(pmd->trans_id);
@@ -882,12 +897,10 @@ static int __create_thin(struct dm_pool_metadata *pmd,
 
         r = __open_device(pmd, dev, 1, &td);
         if (r) {
-                __close_device(td);
                 dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
                 dm_btree_del(&pmd->bl_info, dev_root);
                 return r;
         }
-        td->changed = 1;
         __close_device(td);
 
         return r;
@@ -967,14 +980,14 @@ static int __create_snap(struct dm_pool_metadata *pmd,
                 goto bad;
 
         r = __set_snapshot_details(pmd, td, origin, pmd->time);
+        __close_device(td);
+
         if (r)
                 goto bad;
 
-        __close_device(td);
         return 0;
 
 bad:
-        __close_device(td);
         dm_btree_remove(&pmd->tl_info, pmd->root, &key, &pmd->root);
         dm_btree_remove(&pmd->details_info, pmd->details_root,
                         &key, &pmd->details_root);
@@ -1211,6 +1224,8 @@ static int __remove(struct dm_thin_device *td, dm_block_t block)
         if (r)
                 return r;
 
+        td->mapped_blocks--;
+        td->changed = 1;
         pmd->need_commit = 1;
 
         return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a368db2431a5..a0b225eb4ac4 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -624,7 +624,7 @@ int md_raid1_congested(struct mddev *mddev, int bits)
                 return 1;
 
         rcu_read_lock();
-        for (i = 0; i < conf->raid_disks; i++) {
+        for (i = 0; i < conf->raid_disks * 2; i++) {
                 struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
                 if (rdev && !test_bit(Faulty, &rdev->flags)) {
                         struct request_queue *q = bdev_get_queue(rdev->bdev);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 6e8aa213f0d5..58c44d6453a0 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -67,6 +67,7 @@ static int max_queued_requests = 1024;
 
 static void allow_barrier(struct r10conf *conf);
 static void lower_barrier(struct r10conf *conf);
+static int enough(struct r10conf *conf, int ignore);
 
 static void * r10bio_pool_alloc(gfp_t gfp_flags, void *data)
 {
@@ -347,6 +348,19 @@ static void raid10_end_read_request(struct bio *bio, int error)
                  * wait for the 'master' bio.
                  */
                 set_bit(R10BIO_Uptodate, &r10_bio->state);
+        } else {
+                /* If all other devices that store this block have
+                 * failed, we want to return the error upwards rather
+                 * than fail the last device.  Here we redefine
+                 * "uptodate" to mean "Don't want to retry"
+                 */
+                unsigned long flags;
+                spin_lock_irqsave(&conf->device_lock, flags);
+                if (!enough(conf, rdev->raid_disk))
+                        uptodate = 1;
+                spin_unlock_irqrestore(&conf->device_lock, flags);
+        }
+        if (uptodate) {
                 raid_end_bio_io(r10_bio);
                 rdev_dec_pending(rdev, conf->mddev);
         } else {
@@ -2052,6 +2066,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                        "md/raid10:%s: %s: Failing raid device\n",
                        mdname(mddev), b);
                 md_error(mddev, conf->mirrors[d].rdev);
+                r10_bio->devs[r10_bio->read_slot].bio = IO_BLOCKED;
                 return;
         }
 
@@ -2105,8 +2120,11 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
                                     rdev,
                                     r10_bio->devs[r10_bio->read_slot].addr
                                     + sect,
-                                    s, 0))
+                                    s, 0)) {
                                 md_error(mddev, rdev);
+                                r10_bio->devs[r10_bio->read_slot].bio
+                                        = IO_BLOCKED;
+                        }
                         break;
                 }
 
@@ -2299,17 +2317,20 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio)
          * This is all done synchronously while the array is
          * frozen.
          */
+        bio = r10_bio->devs[slot].bio;
+        bdevname(bio->bi_bdev, b);
+        bio_put(bio);
+        r10_bio->devs[slot].bio = NULL;
+
         if (mddev->ro == 0) {
                 freeze_array(conf);
                 fix_read_error(conf, mddev, r10_bio);
                 unfreeze_array(conf);
-        }
+        } else
+                r10_bio->devs[slot].bio = IO_BLOCKED;
+
         rdev_dec_pending(rdev, mddev);
 
-        bio = r10_bio->devs[slot].bio;
-        bdevname(bio->bi_bdev, b);
-        r10_bio->devs[slot].bio =
-                mddev->ro ? IO_BLOCKED : NULL;
 read_more:
         rdev = read_balance(conf, r10_bio, &max_sectors);
         if (rdev == NULL) {
@@ -2318,13 +2339,10 @@ read_more:
                        mdname(mddev), b,
                        (unsigned long long)r10_bio->sector);
                 raid_end_bio_io(r10_bio);
-                bio_put(bio);
                 return;
         }
 
         do_sync = (r10_bio->master_bio->bi_rw & REQ_SYNC);
-        if (bio)
-                bio_put(bio);
         slot = r10_bio->read_slot;
         printk_ratelimited(
                 KERN_ERR
@@ -2360,7 +2378,6 @@ read_more:
                         mbio->bi_phys_segments++;
                 spin_unlock_irq(&conf->device_lock);
                 generic_make_request(bio);
-                bio = NULL;
 
                 r10_bio = mempool_alloc(conf->r10bio_pool,
                                         GFP_NOIO);
@@ -3243,7 +3260,6 @@ static int run(struct mddev *mddev)
                         disk->rdev = rdev;
                 }
 
-                disk->rdev = rdev;
                 disk_stack_limits(mddev->gendisk, rdev->bdev,
                                   rdev->data_offset << 9);
                 /* as we don't honour merge_bvec_fn, we must never risk
diff --git a/drivers/media/radio/wl128x/Kconfig b/drivers/media/radio/wl128x/Kconfig
index 86b28579f0c7..ea1e6545df36 100644
--- a/drivers/media/radio/wl128x/Kconfig
+++ b/drivers/media/radio/wl128x/Kconfig
@@ -4,8 +4,8 @@
 menu "Texas Instruments WL128x FM driver (ST based)"
 config RADIO_WL128X
         tristate "Texas Instruments WL128x FM Radio"
-        depends on VIDEO_V4L2 && RFKILL
-        select TI_ST if NET && GPIOLIB
+        depends on VIDEO_V4L2 && RFKILL && GPIOLIB
+        select TI_ST if NET
         help
         Choose Y here if you have this FM radio chip.
 
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 3aeb29a7ce11..7f26fdf2e54e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -47,7 +47,7 @@
 #define MOD_AUTHOR      "Jarod Wilson <jarod@wilsonet.com>"
 #define MOD_DESC        "Driver for SoundGraph iMON MultiMedia IR/Display"
 #define MOD_NAME        "imon"
-#define MOD_VERSION     "0.9.3"
+#define MOD_VERSION     "0.9.4"
 
 #define DISPLAY_MINOR_BASE      144
 #define DEVICE_NAME     "lcd%d"
@@ -1658,9 +1658,17 @@ static void usb_rx_callback_intf0(struct urb *urb)
                 return;
 
         ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf0)
+        if (!ictx)
                 return;
 
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf0)
+                goto out;
+
         switch (urb->status) {
         case -ENOENT:           /* usbcore unlink successful! */
                 return;
@@ -1678,6 +1686,7 @@ static void usb_rx_callback_intf0(struct urb *urb)
                 break;
         }
 
+out:
         usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
 }
 
@@ -1690,9 +1699,17 @@ static void usb_rx_callback_intf1(struct urb *urb)
                 return;
 
         ictx = (struct imon_context *)urb->context;
-        if (!ictx || !ictx->dev_present_intf1)
+        if (!ictx)
                 return;
 
+        /*
+         * if we get a callback before we're done configuring the hardware, we
+         * can't yet process the data, as there's nowhere to send it, but we
+         * still need to submit a new rx URB to avoid wedging the hardware
+         */
+        if (!ictx->dev_present_intf1)
+                goto out;
+
         switch (urb->status) {
         case -ENOENT:           /* usbcore unlink successful! */
                 return;
@@ -1710,6 +1727,7 @@ static void usb_rx_callback_intf1(struct urb *urb)
                 break;
         }
 
+out:
         usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
 }
 
@@ -2242,7 +2260,7 @@ find_endpoint_failed:
         mutex_unlock(&ictx->lock);
         usb_free_urb(rx_urb);
 rx_urb_alloc_failed:
-        dev_err(ictx->dev, "unable to initialize intf0, err %d\n", ret);
+        dev_err(ictx->dev, "unable to initialize intf1, err %d\n", ret);
 
         return NULL;
 }
diff --git a/drivers/media/video/hdpvr/hdpvr-core.c b/drivers/media/video/hdpvr/hdpvr-core.c
index e5eb56a5b618..6510110f53d0 100644
--- a/drivers/media/video/hdpvr/hdpvr-core.c
+++ b/drivers/media/video/hdpvr/hdpvr-core.c
@@ -154,10 +154,20 @@ static int device_authorization(struct hdpvr_device *dev)
         }
 #endif
 
+        dev->fw_ver = dev->usbc_buf[1];
+
         v4l2_info(&dev->v4l2_dev, "firmware version 0x%x dated %s\n",
-                          dev->usbc_buf[1], &dev->usbc_buf[2]);
+                          dev->fw_ver, &dev->usbc_buf[2]);
+
+        if (dev->fw_ver > 0x15) {
+                dev->options.brightness = 0x80;
+                dev->options.contrast   = 0x40;
+                dev->options.hue        = 0xf;
+                dev->options.saturation = 0x40;
+                dev->options.sharpness  = 0x80;
+        }
 
-        switch (dev->usbc_buf[1]) {
+        switch (dev->fw_ver) {
         case HDPVR_FIRMWARE_VERSION:
                 dev->flags &= ~HDPVR_FLAG_AC3_CAP;
                 break;
@@ -169,7 +179,7 @@ static int device_authorization(struct hdpvr_device *dev)
         default:
                 v4l2_info(&dev->v4l2_dev, "untested firmware, the driver might"
                           " not work.\n");
-                if (dev->usbc_buf[1] >= HDPVR_FIRMWARE_VERSION_AC3)
+                if (dev->fw_ver >= HDPVR_FIRMWARE_VERSION_AC3)
                         dev->flags |= HDPVR_FLAG_AC3_CAP;
                 else
                         dev->flags &= ~HDPVR_FLAG_AC3_CAP;
@@ -270,6 +280,8 @@ static const struct hdpvr_options hdpvr_default_options = {
         .bitrate_mode   = HDPVR_CONSTANT,
         .gop_mode       = HDPVR_SIMPLE_IDR_GOP,
         .audio_codec    = V4L2_MPEG_AUDIO_ENCODING_AAC,
+        /* original picture controls for firmware version <= 0x15 */
+        /* updated in device_authorization() for newer firmware */
         .brightness     = 0x86,
         .contrast       = 0x80,
         .hue            = 0x80,
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index 087f7c08cb85..11ffe9cc1780 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -283,12 +283,13 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev)
 
                 hdpvr_config_call(dev, CTRL_START_STREAMING_VALUE, 0x00);
 
+                dev->status = STATUS_STREAMING;
+
                 INIT_WORK(&dev->worker, hdpvr_transmit_buffers);
                 queue_work(dev->workqueue, &dev->worker);
 
                 v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev,
                          "streaming started\n");
-                dev->status = STATUS_STREAMING;
 
                 return 0;
         }
@@ -722,21 +723,39 @@ static const s32 supported_v4l2_ctrls[] = {
 };
 
 static int fill_queryctrl(struct hdpvr_options *opt, struct v4l2_queryctrl *qc,
-                          int ac3)
+                          int ac3, int fw_ver)
 {
         int err;
 
+        if (fw_ver > 0x15) {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x40);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0x1e, 1, 0xf);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        } else {
+                switch (qc->id) {
+                case V4L2_CID_BRIGHTNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
+                case V4L2_CID_CONTRAST:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SATURATION:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_HUE:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                case V4L2_CID_SHARPNESS:
+                        return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
+                }
+        }
+
         switch (qc->id) {
-        case V4L2_CID_BRIGHTNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x86);
-        case V4L2_CID_CONTRAST:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SATURATION:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_HUE:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
-        case V4L2_CID_SHARPNESS:
-                return v4l2_ctrl_query_fill(qc, 0x0, 0xff, 1, 0x80);
         case V4L2_CID_MPEG_AUDIO_ENCODING:
                 return v4l2_ctrl_query_fill(
                         qc, V4L2_MPEG_AUDIO_ENCODING_AAC,
@@ -794,7 +813,8 @@ static int vidioc_queryctrl(struct file *file, void *private_data,
 
                 if (qc->id == supported_v4l2_ctrls[i])
                         return fill_queryctrl(&dev->options, qc,
-                                              dev->flags & HDPVR_FLAG_AC3_CAP);
+                                              dev->flags & HDPVR_FLAG_AC3_CAP,
+                                              dev->fw_ver);
 
                 if (qc->id < supported_v4l2_ctrls[i])
                         break;
diff --git a/drivers/media/video/hdpvr/hdpvr.h b/drivers/media/video/hdpvr/hdpvr.h
index d6439db1d18b..fea3c6926997 100644
--- a/drivers/media/video/hdpvr/hdpvr.h
+++ b/drivers/media/video/hdpvr/hdpvr.h
@@ -113,6 +113,7 @@ struct hdpvr_device {
         /* usb control transfer buffer and lock */
         struct mutex            usbc_mutex;
         u8                      *usbc_buf;
+        u8                      fw_ver;
 };
 
 static inline struct hdpvr_device *to_hdpvr_dev(struct v4l2_device *v4l2_dev)
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index a74a79701d34..eaabc27f0fa2 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -1407,7 +1407,7 @@ static int __ccdc_handle_stopping(struct isp_ccdc_device *ccdc, u32 event)
 static void ccdc_hs_vs_isr(struct isp_ccdc_device *ccdc)
 {
         struct isp_pipeline *pipe = to_isp_pipeline(&ccdc->subdev.entity);
-        struct video_device *vdev = &ccdc->subdev.devnode;
+        struct video_device *vdev = ccdc->subdev.devnode;
         struct v4l2_event event;
 
         memset(&event, 0, sizeof(event));
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index 53e2a80f42fa..d295941c9a3d 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -956,11 +956,12 @@ int __devinit ab8500_init(struct ab8500 *ab8500)
         return ret;
 
 out_freeirq:
-        if (ab8500->irq_base) {
+        if (ab8500->irq_base)
                 free_irq(ab8500->irq, ab8500);
 out_removeirq:
+        if (ab8500->irq_base)
                 ab8500_irq_remove(ab8500);
-        }
+
         return ret;
 }
 
diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
index 0f5922812bff..411f523d4878 100644
--- a/drivers/mfd/mfd-core.c
+++ b/drivers/mfd/mfd-core.c
@@ -123,7 +123,7 @@ static int mfd_add_device(struct device *parent, int id,
                 }
 
                 if (!cell->ignore_resource_conflicts) {
-                        ret = acpi_check_resource_conflict(res);
+                        ret = acpi_check_resource_conflict(&res[r]);
                         if (ret)
                                 goto fail_res;
                 }
diff --git a/drivers/mfd/s5m-core.c b/drivers/mfd/s5m-core.c
index e075c113eec6..caadabeed8e9 100644
--- a/drivers/mfd/s5m-core.c
+++ b/drivers/mfd/s5m-core.c
@@ -105,7 +105,7 @@ static int s5m87xx_i2c_probe(struct i2c_client *i2c,
         s5m87xx->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR);
         i2c_set_clientdata(s5m87xx->rtc, s5m87xx);
 
-        if (pdata->cfg_pmic_irq)
+        if (pdata && pdata->cfg_pmic_irq)
                 pdata->cfg_pmic_irq();
 
         s5m_irq_init(s5m87xx);
diff --git a/drivers/mfd/tps65910.c b/drivers/mfd/tps65910.c
index 01cf5012a08f..4392f6bca156 100644
--- a/drivers/mfd/tps65910.c
+++ b/drivers/mfd/tps65910.c
@@ -168,7 +168,7 @@ static int tps65910_i2c_probe(struct i2c_client *i2c,
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
 
         tps65910_gpio_init(tps65910, pmic_plat_data->gpio_base);
 
diff --git a/drivers/mfd/tps65912-core.c b/drivers/mfd/tps65912-core.c
index 5fec23a9ac03..74fd8cb5f372 100644
--- a/drivers/mfd/tps65912-core.c
+++ b/drivers/mfd/tps65912-core.c
@@ -151,7 +151,7 @@ int tps65912_device_init(struct tps65912 *tps65912)
                 goto err;
 
         init_data->irq = pmic_plat_data->irq;
-        init_data->irq_base = pmic_plat_data->irq;
+        init_data->irq_base = pmic_plat_data->irq_base;
         ret = tps65912_irq_init(tps65912, init_data->irq, init_data);
         if (ret < 0)
                 goto err;
diff --git a/drivers/mfd/wm8350-irq.c b/drivers/mfd/wm8350-irq.c
index 8a1fafd0bf7d..9fd01bf63c51 100644
--- a/drivers/mfd/wm8350-irq.c
+++ b/drivers/mfd/wm8350-irq.c
@@ -496,7 +496,6 @@ int wm8350_irq_init(struct wm8350 *wm8350, int irq,
 
         mutex_init(&wm8350->irq_lock);
         wm8350->chip_irq = irq;
-        wm8350->irq_base = pdata->irq_base;
 
         if (pdata && pdata->irq_base > 0)
                 irq_base = pdata->irq_base;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index f117e7fb9321..a04b3c108c8c 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -256,6 +256,20 @@ static int wm8994_suspend(struct device *dev)
                 break;
         }
 
+        switch (wm8994->type) {
+        case WM1811:
+                ret = wm8994_reg_read(wm8994, WM8994_ANTIPOP_2);
+                if (ret < 0) {
+                        dev_err(dev, "Failed to read jackdet: %d\n", ret);
+                } else if (ret & WM1811_JACKDET_MODE_MASK) {
+                        dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                        return 0;
+                }
+                break;
+        default:
+                break;
+        }
+
         /* Disable LDO pulldowns while the device is suspended if we
          * don't know that something will be driving them. */
         if (!wm8994->ldo_ena_always_driven)
diff --git a/drivers/mfd/wm8994-regmap.c b/drivers/mfd/wm8994-regmap.c
index c598ae69b8ff..bc0c5096539a 100644
--- a/drivers/mfd/wm8994-regmap.c
+++ b/drivers/mfd/wm8994-regmap.c
@@ -806,6 +806,7 @@ static bool wm1811_readable_register(struct device *dev, unsigned int reg)
         case WM8994_DC_SERVO_2:
         case WM8994_DC_SERVO_READBACK:
         case WM8994_DC_SERVO_4:
+        case WM8994_DC_SERVO_4E:
         case WM8994_ANALOGUE_HP_1:
         case WM8958_MIC_DETECT_1:
         case WM8958_MIC_DETECT_2:
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index 19fc7c1cb428..f428d86bfc10 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -984,9 +984,9 @@ static int __init c2port_init(void)
                 " - (C) 2007 Rodolfo Giometti\n");
 
         c2port_class = class_create(THIS_MODULE, "c2port");
-        if (!c2port_class) {
+        if (IS_ERR(c2port_class)) {
                 printk(KERN_ERR "c2port: failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(c2port_class);
         }
         c2port_class->dev_attrs = c2port_attrs;
 
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 690255c7d4dc..132378b89d76 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -2068,6 +2068,9 @@ static int mmc_rescan_try_freq(struct mmc_host *host, unsigned freq)
          */
         mmc_hw_reset_for_init(host);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * sdio_reset sends CMD52 to reset card.  Since we do not know
          * if the card is being re-initialized, just send it.  CMD52
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 30055f2b0d44..c3704e293a7b 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -238,10 +238,10 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
         /* Hold MCI clock for 8 cycles by default */
         host->clk_delay = 8;
         /*
-         * Default clock gating delay is 200ms.
+         * Default clock gating delay is 0ms to avoid wasting power.
          * This value can be tuned by writing into sysfs entry.
          */
-        host->clkgate_delay = 200;
+        host->clkgate_delay = 0;
         host->clk_gated = false;
         INIT_DELAYED_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
         spin_lock_init(&host->clk_lock);
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index a48066344fa8..2b9ed1401dc4 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -816,6 +816,9 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr,
         if (!mmc_host_is_spi(host))
                 mmc_set_bus_mode(host, MMC_BUSMODE_OPENDRAIN);
 
+        /* Initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         /*
          * Since we're changing the OCR value, we seem to
          * need to tell some cards to go back to the idle
diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 5017f9354ce2..c272c6868ecf 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -911,6 +911,9 @@ static int mmc_sd_init_card(struct mmc_host *host, u32 ocr,
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         err = mmc_sd_get_cid(host, ocr, cid, &rocr);
         if (err)
                 return err;
@@ -1156,11 +1159,6 @@ int mmc_attach_sd(struct mmc_host *host)
         BUG_ON(!host);
         WARN_ON(!host->claimed);
 
-        /* Make sure we are at 3.3V signalling voltage */
-        err = mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, false);
-        if (err)
-                return err;
-
         /* Disable preset value enable if already set since last time */
         if (host->ops->enable_preset_value) {
                 mmc_host_clk_hold(host);
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 12cde6ee17f5..2c7c83f832d2 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -585,6 +585,9 @@ static int mmc_sdio_init_card(struct mmc_host *host, u32 ocr,
          * Inform the card of the voltage
          */
         if (!powered_resume) {
+                /* The initialization should be done at 3.3 V I/O voltage. */
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
                 err = mmc_send_io_op_cond(host, host->ocr, &ocr);
                 if (err)
                         goto err;
@@ -996,6 +999,11 @@ static int mmc_sdio_power_restore(struct mmc_host *host)
          * With these steps taken, mmc_select_voltage() is also required to
          * restore the correct voltage setting of the card.
          */
+
+        /* The initialization should be done at 3.3 V I/O voltage. */
+        if (!mmc_card_keep_power(host))
+                mmc_set_signal_voltage(host, MMC_SIGNAL_VOLTAGE_330, 0);
+
         sdio_reset(host);
         mmc_go_idle(host);
         mmc_send_if_cond(host, host->ocr_avail);
diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 6985cdb0bb26..e4449a54ae8f 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -1948,12 +1948,12 @@ static bool atmci_filter(struct dma_chan *chan, void *slave)
         }
 }
 
-static void atmci_configure_dma(struct atmel_mci *host)
+static bool atmci_configure_dma(struct atmel_mci *host)
 {
         struct mci_platform_data        *pdata;
 
         if (host == NULL)
-                return;
+                return false;
 
         pdata = host->pdev->dev.platform_data;
 
@@ -1970,12 +1970,15 @@ static void atmci_configure_dma(struct atmel_mci *host)
                 host->dma.chan =
                         dma_request_channel(mask, atmci_filter, pdata->dma_slave);
         }
-        if (!host->dma.chan)
-                dev_notice(&host->pdev->dev, "DMA not available, using PIO\n");
-        else
+        if (!host->dma.chan) {
+                dev_warn(&host->pdev->dev, "no DMA channel available\n");
+                return false;
+        } else {
                 dev_info(&host->pdev->dev,
                                         "Using %s for DMA transfers\n",
                                         dma_chan_name(host->dma.chan));
+                return true;
+        }
 }
 
 static inline unsigned int atmci_get_version(struct atmel_mci *host)
@@ -2085,8 +2088,7 @@ static int __init atmci_probe(struct platform_device *pdev)
 
         /* Get MCI capabilities and set operations according to it */
         atmci_get_cap(host);
-        if (host->caps.has_dma) {
-                dev_info(&pdev->dev, "using DMA\n");
+        if (host->caps.has_dma && atmci_configure_dma(host)) {
                 host->prepare_data = &atmci_prepare_data_dma;
                 host->submit_data = &atmci_submit_data_dma;
                 host->stop_transfer = &atmci_stop_transfer_dma;
@@ -2096,15 +2098,12 @@ static int __init atmci_probe(struct platform_device *pdev)
                 host->submit_data = &atmci_submit_data_pdc;
                 host->stop_transfer = &atmci_stop_transfer_pdc;
         } else {
-                dev_info(&pdev->dev, "no DMA, no PDC\n");
+                dev_info(&pdev->dev, "using PIO\n");
                 host->prepare_data = &atmci_prepare_data;
                 host->submit_data = &atmci_submit_data;
                 host->stop_transfer = &atmci_stop_transfer;
         }
 
-        if (host->caps.has_dma)
-                atmci_configure_dma(host);
-
         platform_set_drvdata(pdev, host);
 
         /* We need at least one slot to succeed */
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 0d955ffaf44e..11e589cd8233 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1271,12 +1271,13 @@ static int __devinit mmci_probe(struct amba_device *dev,
         /*
          * Block size can be up to 2048 bytes, but must be a power of two.
          */
-        mmc->max_blk_size = 2048;
+        mmc->max_blk_size = 1 << 11;
 
         /*
-         * No limit on the number of blocks transferred.
+         * Limit the number of blocks transferred so that we don't overflow
+         * the maximum request size.
          */
-        mmc->max_blk_count = mmc->max_req_size;
+        mmc->max_blk_count = mmc->max_req_size >> 11;
 
         spin_lock_init(&host->lock);
 
diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
index d601e41af282..0be4e2013632 100644
--- a/drivers/mmc/host/sdhci-esdhc-imx.c
+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
@@ -269,8 +269,9 @@ static void esdhc_writew_le(struct sdhci_host *host, u16 val, int reg)
                 imx_data->scratchpad = val;
                 return;
         case SDHCI_COMMAND:
-                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION)
-                        && (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
+                if ((host->cmd->opcode == MMC_STOP_TRANSMISSION ||
+                     host->cmd->opcode == MMC_SET_BLOCK_COUNT) &&
+                    (imx_data->flags & ESDHC_FLAG_MULTIBLK_NO_INT))
                         val |= SDHCI_CMD_ABORTCMD;
 
                 if (is_imx6q_usdhc(imx_data)) {
diff --git a/drivers/net/caif/caif_hsi.c b/drivers/net/caif/caif_hsi.c
index 0a4fc62a381d..c998e1afebc6 100644
--- a/drivers/net/caif/caif_hsi.c
+++ b/drivers/net/caif/caif_hsi.c
@@ -978,7 +978,7 @@ static void cfhsi_setup(struct net_device *dev)
         dev->netdev_ops = &cfhsi_ops;
         dev->type = ARPHRD_CAIF;
         dev->flags = IFF_POINTOPOINT | IFF_NOARP;
-        dev->mtu = CFHSI_MAX_PAYLOAD_SZ;
+        dev->mtu = CFHSI_MAX_CAIF_FRAME_SZ;
         dev->tx_queue_len = 0;
         dev->destructor = free_netdev;
         skb_queue_head_init(&cfhsi->qhead);
diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
index 04a3f1b756a8..192b0d118df4 100644
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -95,11 +95,16 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
         spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
 }
 
+static int sja1000_is_absent(struct sja1000_priv *priv)
+{
+        return (priv->read_reg(priv, REG_MOD) == 0xFF);
+}
+
 static int sja1000_probe_chip(struct net_device *dev)
 {
         struct sja1000_priv *priv = netdev_priv(dev);
 
-        if (priv->reg_base && (priv->read_reg(priv, 0) == 0xFF)) {
+        if (priv->reg_base && sja1000_is_absent(priv)) {
                 printk(KERN_INFO "%s: probing @0x%lX failed\n",
                        DRV_NAME, dev->base_addr);
                 return 0;
@@ -493,6 +498,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
         while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
                 n++;
                 status = priv->read_reg(priv, REG_SR);
+                /* check for absent controller due to hw unplug */
+                if (status == 0xFF && sja1000_is_absent(priv))
+                        return IRQ_NONE;
 
                 if (isrc & IRQ_WUI)
                         dev_warn(dev->dev.parent, "wakeup interrupt\n");
@@ -509,6 +517,9 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
                         while (status & SR_RBS) {
                                 sja1000_rx(dev);
                                 status = priv->read_reg(priv, REG_SR);
+                                /* check for absent controller */
+                                if (status == 0xFF && sja1000_is_absent(priv))
+                                        return IRQ_NONE;
                         }
                 }
                 if (isrc & (IRQ_DOI | IRQ_EI | IRQ_BEI | IRQ_EPI | IRQ_ALI)) {
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index b8591246eb4c..47a9bb2c813c 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1710,7 +1710,7 @@ static irqreturn_t atl1c_intr(int irq, void *data)
                                         "atl1c hardware error (status = 0x%x)\n",
                                         status & ISR_ERROR);
                         /* reset MAC */
-                        adapter->work_event |= ATL1C_WORK_EVENT_RESET;
+                        set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
                         schedule_work(&adapter->common_task);
                         return IRQ_HANDLED;
                 }
@@ -2244,10 +2244,6 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
                         dev_info(&adapter->pdev->dev, "tx locked\n");
                 return NETDEV_TX_LOCKED;
         }
-        if (skb->mark == 0x01)
-                type = atl1c_trans_high;
-        else
-                type = atl1c_trans_normal;
 
         if (atl1c_tpd_avail(adapter, type) < tpd_req) {
                 /* no enough descriptor, just stop queue */
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 3fb66d09ece5..cab87456a34a 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2339,7 +2339,7 @@ static inline int __init b44_pci_init(void)
         return err;
 }
 
-static inline void __exit b44_pci_exit(void)
+static inline void b44_pci_exit(void)
 {
 #ifdef CONFIG_B44_PCI
         ssb_pcihost_unregister(&b44_pci_driver);
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index dd3a0a232ea0..818a573669e6 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -3584,7 +3584,11 @@ static int cnic_get_v6_route(struct sockaddr_in6 *dst_addr,
                 fl6.flowi6_oif = dst_addr->sin6_scope_id;
 
         *dst = ip6_route_output(&init_net, NULL, &fl6);
-        if (*dst)
+        if ((*dst)->error) {
+                dst_release(*dst);
+                *dst = NULL;
+                return -ENETUNREACH;
+        } else
                 return 0;
 #endif
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index a1f2e0fed78b..35c2a202d67a 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -5352,7 +5352,7 @@ static void tg3_tx(struct tg3_napi *tnapi)
                 }
         }
 
-        netdev_completed_queue(tp->dev, pkts_compl, bytes_compl);
+        netdev_tx_completed_queue(txq, pkts_compl, bytes_compl);
 
         tnapi->tx_cons = sw_idx;
 
@@ -6793,7 +6793,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 
         skb_tx_timestamp(skb);
-        netdev_sent_queue(tp->dev, skb->len);
+        netdev_tx_sent_queue(txq, skb->len);
 
         /* Packets are ready, update Tx producer idx local and on card. */
         tw32_tx_mbox(tnapi->prodmbox, entry);
@@ -7275,8 +7275,8 @@ static void tg3_free_rings(struct tg3 *tp)
 
                         dev_kfree_skb_any(skb);
                 }
+                netdev_tx_reset_queue(netdev_get_tx_queue(tp->dev, j));
         }
-        netdev_reset_queue(tp->dev);
 }
 
 /* Initialize tx/rx rings for packet processing.
@@ -7886,10 +7886,8 @@ static int tg3_chip_reset(struct tg3 *tp)
         return 0;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *,
-                                                 struct rtnl_link_stats64 *);
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *,
-                                                struct tg3_ethtool_stats *);
+static void tg3_get_nstats(struct tg3 *, struct rtnl_link_stats64 *);
+static void tg3_get_estats(struct tg3 *, struct tg3_ethtool_stats *);
 
 /* tp->lock is held. */
 static int tg3_halt(struct tg3 *tp, int kind, int silent)
@@ -7910,7 +7908,7 @@ static int tg3_halt(struct tg3 *tp, int kind, int silent)
 
         if (tp->hw_stats) {
                 /* Save the stats across chip resets... */
-                tg3_get_stats64(tp->dev, &tp->net_stats_prev),
+                tg3_get_nstats(tp, &tp->net_stats_prev),
                 tg3_get_estats(tp, &tp->estats_prev);
 
                 /* And make sure the next sample is new data */
@@ -9847,7 +9845,7 @@ static inline u64 get_stat64(tg3_stat64_t *val)
        return ((u64)val->high << 32) | ((u64)val->low);
 }
 
-static u64 calc_crc_errors(struct tg3 *tp)
+static u64 tg3_calc_crc_errors(struct tg3 *tp)
 {
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
@@ -9856,14 +9854,12 @@ static u64 calc_crc_errors(struct tg3 *tp)
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) {
                 u32 val;
 
-                spin_lock_bh(&tp->lock);
                 if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
                         tg3_writephy(tp, MII_TG3_TEST1,
                                      val | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, MII_TG3_RXR_COUNTERS, &val);
                 } else
                         val = 0;
-                spin_unlock_bh(&tp->lock);
 
                 tp->phy_crc_errors += val;
 
@@ -9877,14 +9873,13 @@ static u64 calc_crc_errors(struct tg3 *tp)
         estats->member =        old_estats->member + \
                                 get_stat64(&hw_stats->member)
 
-static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
-                                               struct tg3_ethtool_stats *estats)
+static void tg3_get_estats(struct tg3 *tp, struct tg3_ethtool_stats *estats)
 {
         struct tg3_ethtool_stats *old_estats = &tp->estats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
         if (!hw_stats)
-                return old_estats;
+                return;
 
         ESTAT_ADD(rx_octets);
         ESTAT_ADD(rx_fragments);
@@ -9963,20 +9958,13 @@ static struct tg3_ethtool_stats *tg3_get_estats(struct tg3 *tp,
         ESTAT_ADD(nic_tx_threshold_hit);
 
         ESTAT_ADD(mbuf_lwm_thresh_hit);
-
-        return estats;
 }
 
-static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
-                                                 struct rtnl_link_stats64 *stats)
+static void tg3_get_nstats(struct tg3 *tp, struct rtnl_link_stats64 *stats)
 {
-        struct tg3 *tp = netdev_priv(dev);
         struct rtnl_link_stats64 *old_stats = &tp->net_stats_prev;
         struct tg3_hw_stats *hw_stats = tp->hw_stats;
 
-        if (!hw_stats)
-                return old_stats;
-
         stats->rx_packets = old_stats->rx_packets +
                 get_stat64(&hw_stats->rx_ucast_packets) +
                 get_stat64(&hw_stats->rx_mcast_packets) +
@@ -10019,15 +10007,13 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
                 get_stat64(&hw_stats->tx_carrier_sense_errors);
 
         stats->rx_crc_errors = old_stats->rx_crc_errors +
-                calc_crc_errors(tp);
+                tg3_calc_crc_errors(tp);
 
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
         stats->rx_dropped = tp->rx_dropped;
         stats->tx_dropped = tp->tx_dropped;
-
-        return stats;
 }
 
 static inline u32 calc_crc(unsigned char *buf, int len)
@@ -15409,6 +15395,21 @@ static void __devinit tg3_init_coal(struct tg3 *tp)
         }
 }
 
+static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
+                                                struct rtnl_link_stats64 *stats)
+{
+        struct tg3 *tp = netdev_priv(dev);
+
+        if (!tp->hw_stats)
+                return &tp->net_stats_prev;
+
+        spin_lock_bh(&tp->lock);
+        tg3_get_nstats(tp, stats);
+        spin_unlock_bh(&tp->lock);
+
+        return stats;
+}
+
 static const struct net_device_ops tg3_netdev_ops = {
         .ndo_open               = tg3_open,
         .ndo_stop               = tg3_close,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index e83d12c7bf20..9d76e59d9526 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -196,6 +196,8 @@ static DEFINE_PCI_DEVICE_TABLE(cxgb4_pci_tbl) = {
         CH_DEVICE(0x4408, 4),
         CH_DEVICE(0x4409, 4),
         CH_DEVICE(0x440a, 4),
+        CH_DEVICE(0x440d, 4),
+        CH_DEVICE(0x440e, 4),
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index e53365a71484..d963c1d57f71 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2892,6 +2892,8 @@ static struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x4808, 0),   /* T420-cx */
         CH_DEVICE(0x4809, 0),   /* T420-bt */
         CH_DEVICE(0x480a, 0),   /* T404-bt */
+        CH_DEVICE(0x480d, 0),   /* T480-cr */
+        CH_DEVICE(0x480e, 0),   /* T440-lp-cr */
         { 0, }
 };
 
diff --git a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
index c2c0680a1146..ac37cacc6136 100644
--- a/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
+++ b/drivers/net/ethernet/cisco/enic/cq_enet_desc.h
@@ -157,7 +157,7 @@ static inline void cq_enet_rq_desc_dec(struct cq_enet_rq_desc *desc,
                         CQ_ENET_RQ_DESC_FCOE_FC_CRC_OK) ? 1 : 0;
                 *fcoe_enc_error = (desc->flags &
                         CQ_ENET_RQ_DESC_FCOE_ENC_ERROR) ? 1 : 0;
-                *fcoe_eof = (u8)((desc->checksum_fcoe >>
+                *fcoe_eof = (u8)((le16_to_cpu(desc->checksum_fcoe) >>
                         CQ_ENET_RQ_DESC_FCOE_EOF_SHIFT) &
                         CQ_ENET_RQ_DESC_FCOE_EOF_MASK);
                 *checksum = 0;
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index ee93a2087fe6..c52295cd05ef 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -94,7 +94,7 @@ struct enic {
         u32 rx_coalesce_usecs;
         u32 tx_coalesce_usecs;
 #ifdef CONFIG_PCI_IOV
-        u32 num_vfs;
+        u16 num_vfs;
 #endif
         struct enic_port_profile *pp;
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index ab3f67f980d8..0e4edd3b6bee 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2370,7 +2370,7 @@ static int __devinit enic_probe(struct pci_dev *pdev,
         pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_SRIOV);
         if (pos) {
                 pci_read_config_word(pdev, pos + PCI_SRIOV_TOTAL_VF,
-                        (u16 *)&enic->num_vfs);
+                        &enic->num_vfs);
                 if (enic->num_vfs) {
                         err = pci_enable_sriov(pdev, enic->num_vfs);
                         if (err) {
diff --git a/drivers/net/ethernet/cisco/enic/enic_pp.c b/drivers/net/ethernet/cisco/enic/enic_pp.c
index 22bf03a1829e..c347b6236f8f 100644
--- a/drivers/net/ethernet/cisco/enic/enic_pp.c
+++ b/drivers/net/ethernet/cisco/enic/enic_pp.c
@@ -72,7 +72,7 @@ static int enic_set_port_profile(struct enic *enic, int vf)
         struct enic_port_profile *pp;
         struct vic_provinfo *vp;
         const u8 oui[3] = VIC_PROVINFO_CISCO_OUI;
-        const u16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
+        const __be16 os_type = htons(VIC_GENERIC_PROV_OS_TYPE_LINUX);
         char uuid_str[38];
         char client_mac_str[18];
         u8 *client_mac;
diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
index 5d5fb2627184..e6893cdfd13b 100644
--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -336,7 +336,9 @@ static struct rtnl_link_stats64 *ehea_get_stats64(struct net_device *dev,
         stats->tx_bytes = tx_bytes;
         stats->rx_packets = rx_packets;
 
-        return &port->stats;
+        stats->multicast = port->stats.multicast;
+        stats->rx_errors = port->stats.rx_errors;
+        return stats;
 }
 
 static void ehea_update_stats(struct work_struct *work)
diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
index 27d651a80f3f..55cbf65512c3 100644
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -2328,19 +2328,11 @@ jme_change_mtu(struct net_device *netdev, int new_mtu)
                 ((new_mtu) < IPV6_MIN_MTU))
                 return -EINVAL;
 
-        if (new_mtu > 4000) {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_64QW;
-                jme_restart_rx_engine(jme);
-        } else {
-                jme->reg_rxcs &= ~RXCS_FIFOTHNP;
-                jme->reg_rxcs |= RXCS_FIFOTHNP_128QW;
-                jme_restart_rx_engine(jme);
-        }
 
         netdev->mtu = new_mtu;
         netdev_update_features(netdev);
 
+        jme_restart_rx_engine(jme);
         jme_reset_link(jme);
 
         return 0;
diff --git a/drivers/net/ethernet/jme.h b/drivers/net/ethernet/jme.h
index 4304072bd3c5..3efc897c9913 100644
--- a/drivers/net/ethernet/jme.h
+++ b/drivers/net/ethernet/jme.h
@@ -730,7 +730,7 @@ enum jme_rxcs_values {
         RXCS_RETRYCNT_60        = 0x00000F00,
 
         RXCS_DEFAULT            = RXCS_FIFOTHTP_128T |
-                                  RXCS_FIFOTHNP_128QW |
+                                  RXCS_FIFOTHNP_16QW |
                                   RXCS_DMAREQSZ_128B |
                                   RXCS_RETRYGAP_256ns |
                                   RXCS_RETRYCNT_32,
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index 8fa41f3082cf..9129ace02560 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1036,7 +1036,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int vec = 0, err = 0, i;
 
-        spin_lock(&priv->msix_ctl.pool_lock);
+        mutex_lock(&priv->msix_ctl.pool_lock);
         for (i = 0; !vec && i < dev->caps.comp_pool; i++) {
                 if (~priv->msix_ctl.pool_bm & 1ULL << i) {
                         priv->msix_ctl.pool_bm |= 1ULL << i;
@@ -1058,7 +1058,7 @@ int mlx4_assign_eq(struct mlx4_dev *dev, char* name, int * vector)
                         eq_set_ci(&priv->eq_table.eq[vec], 1);
                 }
         }
-        spin_unlock(&priv->msix_ctl.pool_lock);
+        mutex_unlock(&priv->msix_ctl.pool_lock);
 
         if (vec) {
                 *vector = vec;
@@ -1079,13 +1079,13 @@ void mlx4_release_eq(struct mlx4_dev *dev, int vec)
         if (likely(i >= 0)) {
                 /*sanity check , making sure were not trying to free irq's
                   Belonging to a legacy EQ*/
-                spin_lock(&priv->msix_ctl.pool_lock);
+                mutex_lock(&priv->msix_ctl.pool_lock);
                 if (priv->msix_ctl.pool_bm & 1ULL << i) {
                         free_irq(priv->eq_table.eq[vec].irq,
                                  &priv->eq_table.eq[vec]);
                         priv->msix_ctl.pool_bm &= ~(1ULL << i);
                 }
-                spin_unlock(&priv->msix_ctl.pool_lock);
+                mutex_unlock(&priv->msix_ctl.pool_lock);
         }
 
 }
diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
index 8a21e10952ea..9ea7cabcaf3c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -685,7 +685,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_dev *dev, int slave,
         return err;
 }
 
-static int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
+int mlx4_QUERY_PORT(struct mlx4_dev *dev, void *ptr, u8 port)
 {
         struct mlx4_cmd_mailbox *outbox = ptr;
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index 678558b502fc..d498f049c74e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -531,15 +531,14 @@ int mlx4_change_port_types(struct mlx4_dev *dev,
         for (port = 0; port <  dev->caps.num_ports; port++) {
                 /* Change the port type only if the new type is different
                  * from the current, and not set to Auto */
-                if (port_types[port] != dev->caps.port_type[port + 1]) {
+                if (port_types[port] != dev->caps.port_type[port + 1])
                         change = 1;
-                        dev->caps.port_type[port + 1] = port_types[port];
-                }
         }
         if (change) {
                 mlx4_unregister_device(dev);
                 for (port = 1; port <= dev->caps.num_ports; port++) {
                         mlx4_CLOSE_PORT(dev, port);
+                        dev->caps.port_type[port] = port_types[port - 1];
                         err = mlx4_SET_PORT(dev, port);
                         if (err) {
                                 mlx4_err(dev, "Failed to set port %d, "
@@ -986,6 +985,9 @@ static int map_bf_area(struct mlx4_dev *dev)
         resource_size_t bf_len;
         int err = 0;
 
+        if (!dev->caps.bf_reg_size)
+                return -ENXIO;
+
         bf_start = pci_resource_start(dev->pdev, 2) +
                         (dev->caps.num_uars << PAGE_SHIFT);
         bf_len = pci_resource_len(dev->pdev, 2) -
@@ -1825,7 +1827,7 @@ slave_start:
                 goto err_master_mfunc;
 
         priv->msix_ctl.pool_bm = 0;
-        spin_lock_init(&priv->msix_ctl.pool_lock);
+        mutex_init(&priv->msix_ctl.pool_lock);
 
         mlx4_enable_msi_x(dev);
         if ((mlx4_is_mfunc(dev)) &&
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
index c92269f8c057..28f8251561f4 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -697,7 +697,7 @@ struct mlx4_sense {
 
 struct mlx4_msix_ctl {
         u64             pool_bm;
-        spinlock_t      pool_lock;
+        struct mutex    pool_lock;
 };
 
 struct mlx4_steer {
diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
index 8deeef98280c..25a80d71fb2a 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
@@ -304,7 +304,7 @@ static int mlx4_HW2SW_MPT(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox
                             MLX4_CMD_TIME_CLASS_B, MLX4_CMD_WRAPPED);
 }
 
-static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
+int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
                           u32 *base_mridx)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
@@ -320,14 +320,14 @@ static int mlx4_mr_reserve_range(struct mlx4_dev *dev, int cnt, int align,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_reserve_range);
 
-static void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
+void mlx4_mr_release_range(struct mlx4_dev *dev, u32 base_mridx, int cnt)
 {
         struct mlx4_priv *priv = mlx4_priv(dev);
         mlx4_bitmap_free_range(&priv->mr_table.mpt_bitmap, base_mridx, cnt);
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_release_range);
 
-static int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
+int mlx4_mr_alloc_reserved(struct mlx4_dev *dev, u32 mridx, u32 pd,
                            u64 iova, u64 size, u32 access, int npages,
                            int page_shift, struct mlx4_mr *mr)
 {
@@ -457,7 +457,7 @@ int mlx4_mr_alloc(struct mlx4_dev *dev, u32 pd, u64 iova, u64 size, u32 access,
 }
 EXPORT_SYMBOL_GPL(mlx4_mr_alloc);
 
-static void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
+void mlx4_mr_free_reserved(struct mlx4_dev *dev, struct mlx4_mr *mr)
 {
         int err;
 
@@ -852,7 +852,7 @@ err_free:
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_alloc);
 
-static int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
+int mlx4_fmr_alloc_reserved(struct mlx4_dev *dev, u32 mridx,
                             u32 pd, u32 access, int max_pages,
                             int max_maps, u8 page_shift, struct mlx4_fmr *fmr)
 {
@@ -954,7 +954,7 @@ int mlx4_fmr_free(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 }
 EXPORT_SYMBOL_GPL(mlx4_fmr_free);
 
-static int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
+int mlx4_fmr_free_reserved(struct mlx4_dev *dev, struct mlx4_fmr *fmr)
 {
         if (fmr->maps)
                 return -EBUSY;
diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
index 738f950a1ce5..fb2b36759cbf 100644
--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
@@ -151,11 +151,6 @@ static int __mlx4_qp_modify(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
                 context->log_page_size   = mtt->page_shift - MLX4_ICM_PAGE_SHIFT;
         }
 
-        port = ((context->pri_path.sched_queue >> 6) & 1) + 1;
-        if (dev->caps.port_type[port] == MLX4_PORT_TYPE_ETH)
-                context->pri_path.sched_queue = (context->pri_path.sched_queue &
-                                                0xc3);
-
         *(__be32 *) mailbox->buf = cpu_to_be32(optpar);
         memcpy(mailbox->buf + 8, context, sizeof *context);
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index bfdb7af19e49..8752e6e08169 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2255,8 +2255,7 @@ int mlx4_MODIFY_CQ_wrapper(struct mlx4_dev *dev, int slave,
 
         if (vhcr->op_modifier == 0) {
                 err = handle_resize(dev, slave, vhcr, inbox, outbox, cmd, cq);
-                if (err)
-                        goto ex_put;
+                goto ex_put;
         }
 
         err = mlx4_DMA_wrapper(dev, slave, vhcr, inbox, outbox, cmd);
diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
index 231176fcd2ba..2784bc706f1e 100644
--- a/drivers/net/ethernet/micrel/ks8851_mll.c
+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
@@ -1545,7 +1545,7 @@ static int __devinit ks8851_probe(struct platform_device *pdev)
 
         netdev->irq = platform_get_irq(pdev, 0);
 
-        if (netdev->irq < 0) {
+        if ((int)netdev->irq < 0) {
                 err = netdev->irq;
                 goto err_get_irq;
         }
diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
index 9cb5f912e489..29e23bec809c 100644
--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_param.c
@@ -321,10 +321,10 @@ static void pch_gbe_check_copper_options(struct pch_gbe_adapter *adapter)
                         pr_debug("AutoNeg specified along with Speed or Duplex, AutoNeg parameter ignored\n");
                         hw->phy.autoneg_advertised = opt.def;
                 } else {
-                        hw->phy.autoneg_advertised = AutoNeg;
-                        pch_gbe_validate_option(
-                                (int *)(&hw->phy.autoneg_advertised),
-                                &opt, adapter);
+                        int tmp = AutoNeg;
+
+                        pch_gbe_validate_option(&tmp, &opt, adapter);
+                        hw->phy.autoneg_advertised = tmp;
                 }
         }
 
@@ -495,9 +495,10 @@ void pch_gbe_check_options(struct pch_gbe_adapter *adapter)
                         .arg  = { .l = { .nr = (int)ARRAY_SIZE(fc_list),
                                          .p = fc_list } }
                 };
-                hw->mac.fc = FlowControl;
-                pch_gbe_validate_option((int *)(&hw->mac.fc),
-                                                &opt, adapter);
+                int tmp = FlowControl;
+
+                pch_gbe_validate_option(&tmp, &opt, adapter);
+                hw->mac.fc = tmp;
         }
 
         pch_gbe_check_copper_options(adapter);
diff --git a/drivers/net/ethernet/packetengines/Kconfig b/drivers/net/ethernet/packetengines/Kconfig
index b97132d9dff0..8f29feb35548 100644
--- a/drivers/net/ethernet/packetengines/Kconfig
+++ b/drivers/net/ethernet/packetengines/Kconfig
@@ -4,6 +4,7 @@
 
 config NET_PACKET_ENGINE
         bool "Packet Engine devices"
+        default y
         depends on PCI
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c
index 7931531c3a40..e61560e16385 100644
--- a/drivers/net/ethernet/qlogic/qla3xxx.c
+++ b/drivers/net/ethernet/qlogic/qla3xxx.c
@@ -3017,7 +3017,6 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 (void __iomem *)port_regs;
         u32 delay = 10;
         int status = 0;
-        unsigned long hw_flags = 0;
 
         if (ql_mii_setup(qdev))
                 return -1;
@@ -3228,9 +3227,9 @@ static int ql_adapter_initialize(struct ql3_adapter *qdev)
                 value = ql_read_page0_reg(qdev, &port_regs->portStatus);
                 if (value & PORT_STATUS_IC)
                         break;
-                spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+                spin_unlock_irq(&qdev->hw_lock);
                 msleep(500);
-                spin_lock_irqsave(&qdev->hw_lock, hw_flags);
+                spin_lock_irq(&qdev->hw_lock);
         } while (--delay);
 
         if (delay == 0) {
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 7a0c800b50ad..bbacb3741ec0 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -3781,12 +3781,20 @@ static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
 
 static void rtl_hw_jumbo_enable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.enable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void rtl_hw_jumbo_disable(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
         rtl_generic_op(tp, tp->jumbo_ops.disable);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
 }
 
 static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
@@ -6186,6 +6194,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct rtl8169_private *tp = netdev_priv(dev);
+        struct device *d = &pdev->dev;
+
+        pm_runtime_get_sync(d);
 
         rtl8169_net_suspend(dev);
 
@@ -6207,6 +6218,8 @@ static void rtl_shutdown(struct pci_dev *pdev)
                 pci_wake_from_d3(pdev, true);
                 pci_set_power_state(pdev, PCI_D3hot);
         }
+
+        pm_runtime_put_noidle(d);
 }
 
 static struct pci_driver rtl8169_pci_driver = {
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index aca349861767..fc52fca74193 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -156,11 +156,10 @@ static int efx_init_rx_buffers_skb(struct efx_rx_queue *rx_queue)
                 if (unlikely(!skb))
                         return -ENOMEM;
 
-                /* Adjust the SKB for padding and checksum */
+                /* Adjust the SKB for padding */
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_buf->len = skb_len - NET_IP_ALIGN;
                 rx_buf->is_page = false;
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 rx_buf->dma_addr = pci_map_single(efx->pci_dev,
                                                   skb->data, rx_buf->len,
@@ -496,6 +495,7 @@ static void efx_rx_packet_gro(struct efx_channel *channel,
 
                 EFX_BUG_ON_PARANOID(!checksummed);
                 rx_buf->u.skb = NULL;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 
                 gro_result = napi_gro_receive(napi, skb);
         }
diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index 4fa0bcb25dfc..4b2f54565f64 100644
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1009,7 +1009,7 @@ static void emac_rx_handler(void *token, int len, int status)
         int                     ret;
 
         /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
+        if (unlikely(!netif_running(ndev))) {
                 dev_kfree_skb_any(skb);
                 return;
         }
@@ -1038,7 +1038,9 @@ static void emac_rx_handler(void *token, int len, int status)
 recycle:
         ret = cpdma_chan_submit(priv->rxchan, skb, skb->data,
                         skb_tailroom(skb), GFP_KERNEL);
-        if (WARN_ON(ret < 0))
+
+        WARN_ON(ret == -ENOMEM);
+        if (unlikely(ret < 0))
                 dev_kfree_skb_any(skb);
 }
 
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 466c58a7353d..bf01841bda5b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -313,7 +313,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
 static void netvsc_get_drvinfo(struct net_device *net,
                                struct ethtool_drvinfo *info)
 {
-        strcpy(info->driver, "hv_netvsc");
+        strcpy(info->driver, KBUILD_MODNAME);
         strcpy(info->version, HV_DRV_VERSION);
         strcpy(info->fw_version, "N/A");
 }
@@ -485,7 +485,7 @@ MODULE_DEVICE_TABLE(vmbus, id_table);
 
 /* The one and only one */
 static struct  hv_driver netvsc_drv = {
-        .name = "netvsc",
+        .name = KBUILD_MODNAME,
         .id_table = id_table,
         .probe = netvsc_probe,
         .remove = netvsc_remove,
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index c81f136ae670..0856e1b7a849 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -30,16 +30,16 @@
 #include <asm/irq.h>
 #include <asm/uaccess.h>
 
-MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IC1001 PHY drivers");
+MODULE_DESCRIPTION("ICPlus IP175C/IP101A/IP101G/IC1001 PHY drivers");
 MODULE_AUTHOR("Michael Barkowski");
 MODULE_LICENSE("GPL");
 
-/* IP101A/IP1001 */
-#define IP10XX_SPEC_CTRL_STATUS         16  /* Spec. Control Register */
-#define IP1001_SPEC_CTRL_STATUS_2       20  /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3 /* IP1001 RX/TXPHASE_SEL */
-#define IP1001_APS_ON                   11  /* IP1001 APS Mode  bit */
-#define IP101A_APS_ON                   2   /* IP101A APS Mode bit */
+/* IP101A/G - IP1001 */
+#define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
+#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
+#define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
+#define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -98,20 +98,24 @@ static int ip175c_config_init(struct phy_device *phydev)
 
 static int ip1xx_reset(struct phy_device *phydev)
 {
-        int err, bmcr;
+        int bmcr;
 
         /* Software Reset PHY */
         bmcr = phy_read(phydev, MII_BMCR);
+        if (bmcr < 0)
+                return bmcr;
         bmcr |= BMCR_RESET;
-        err = phy_write(phydev, MII_BMCR, bmcr);
-        if (err < 0)
-                return err;
+        bmcr = phy_write(phydev, MII_BMCR, bmcr);
+        if (bmcr < 0)
+                return bmcr;
 
         do {
                 bmcr = phy_read(phydev, MII_BMCR);
+                if (bmcr < 0)
+                        return bmcr;
         } while (bmcr & BMCR_RESET);
 
-        return err;
+        return 0;
 }
 
 static int ip1001_config_init(struct phy_device *phydev)
@@ -124,7 +128,10 @@ static int ip1001_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP1001_SPEC_CTRL_STATUS_2);
+        if (c < 0)
+                return c;
         c |= IP1001_APS_ON;
+        c = phy_write(phydev, IP1001_SPEC_CTRL_STATUS_2, c);
         if (c < 0)
                 return c;
 
@@ -132,14 +139,19 @@ static int ip1001_config_init(struct phy_device *phydev)
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
+                if (c < 0)
+                        return c;
+
                 c |= IP1001_PHASE_SEL_MASK;
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
+                if (c < 0)
+                        return c;
         }
 
-        return c;
+        return 0;
 }
 
-static int ip101a_config_init(struct phy_device *phydev)
+static int ip101a_g_config_init(struct phy_device *phydev)
 {
         int c;
 
@@ -149,7 +161,7 @@ static int ip101a_config_init(struct phy_device *phydev)
 
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
-        c |= IP101A_APS_ON;
+        c |= IP101A_G_APS_ON;
         return c;
 }
 
@@ -191,6 +203,7 @@ static struct phy_driver ip1001_driver = {
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
+        .flags          = PHY_HAS_INTERRUPT,
         .config_init    = &ip1001_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
@@ -199,13 +212,14 @@ static struct phy_driver ip1001_driver = {
         .driver         = { .owner = THIS_MODULE,},
 };
 
-static struct phy_driver ip101a_driver = {
+static struct phy_driver ip101a_g_driver = {
         .phy_id         = 0x02430c54,
-        .name           = "ICPlus IP101A",
+        .name           = "ICPlus IP101A/G",
         .phy_id_mask    = 0x0ffffff0,
         .features       = PHY_BASIC_FEATURES | SUPPORTED_Pause |
                           SUPPORTED_Asym_Pause,
-        .config_init    = &ip101a_config_init,
+        .flags          = PHY_HAS_INTERRUPT,
+        .config_init    = &ip101a_g_config_init,
         .config_aneg    = &genphy_config_aneg,
         .read_status    = &genphy_read_status,
         .suspend        = genphy_suspend,
@@ -221,7 +235,7 @@ static int __init icplus_init(void)
         if (ret < 0)
                 return -ENODEV;
 
-        ret = phy_driver_register(&ip101a_driver);
+        ret = phy_driver_register(&ip101a_g_driver);
         if (ret < 0)
                 return -ENODEV;
 
@@ -231,7 +245,7 @@ static int __init icplus_init(void)
 static void __exit icplus_exit(void)
 {
         phy_driver_unregister(&ip1001_driver);
-        phy_driver_unregister(&ip101a_driver);
+        phy_driver_unregister(&ip101a_g_driver);
         phy_driver_unregister(&ip175c_driver);
 }
 
@@ -241,6 +255,7 @@ module_exit(icplus_exit);
 static struct mdio_device_id __maybe_unused icplus_tbl[] = {
         { 0x02430d80, 0x0ffffff0 },
         { 0x02430d90, 0x0ffffff0 },
+        { 0x02430c54, 0x0ffffff0 },
         { }
 };
 
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index edfa15d2e795..486b4048850d 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2024,14 +2024,22 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         continue;
                 }
                 if (PPP_MP_CB(p)->sequence != seq) {
+                        u32 oldseq;
                         /* Fragment `seq' is missing.  If it is after
                            minseq, it might arrive later, so stop here. */
                         if (seq_after(seq, minseq))
                                 break;
                         /* Fragment `seq' is lost, keep going. */
                         lost = 1;
+                        oldseq = seq;
                         seq = seq_before(minseq, PPP_MP_CB(p)->sequence)?
                                 minseq + 1: PPP_MP_CB(p)->sequence;
+
+                        if (ppp->debug & 1)
+                                netdev_printk(KERN_DEBUG, ppp->dev,
+                                              "lost frag %u..%u\n",
+                                              oldseq, seq-1);
+
                         goto again;
                 }
 
@@ -2076,6 +2084,10 @@ ppp_mp_reconstruct(struct ppp *ppp)
                         struct sk_buff *tmp2;
 
                         skb_queue_reverse_walk_from_safe(list, p, tmp2) {
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
                                 __skb_unlink(p, list);
                                 kfree_skb(p);
                         }
@@ -2091,6 +2103,17 @@ ppp_mp_reconstruct(struct ppp *ppp)
                 /* If we have discarded any fragments,
                    signal a receive error. */
                 if (PPP_MP_CB(head)->sequence != ppp->nextseq) {
+                        skb_queue_walk_safe(list, p, tmp) {
+                                if (p == head)
+                                        break;
+                                if (ppp->debug & 1)
+                                        netdev_printk(KERN_DEBUG, ppp->dev,
+                                                      "discarding frag %u\n",
+                                                      PPP_MP_CB(p)->sequence);
+                                __skb_unlink(p, list);
+                                kfree_skb(p);
+                        }
+
                         if (ppp->debug & 1)
                                 netdev_printk(KERN_DEBUG, ppp->dev,
                                               "  missed pkts %u..%u\n",
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 41a61efc331e..90a30026a931 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -573,6 +573,13 @@ static const struct usb_device_id	products [] = {
         .driver_info = 0,
 },
 
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info            = 0,
+},
+
 /*
  * WHITELIST!!!
  *
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 304fe78ff60e..e1324b4a0f66 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1632,7 +1632,7 @@ static int hso_get_count(struct tty_struct *tty,
         struct hso_serial *serial = get_serial_by_tty(tty);
         struct hso_tiocmget  *tiocmget = serial->tiocmget;
 
-        memset(&icount, 0, sizeof(struct serial_icounter_struct));
+        memset(icount, 0, sizeof(struct serial_icounter_struct));
 
         if (!tiocmget)
                  return -ENOENT;
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index fae0fbd8bc88..81b96e303757 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -589,6 +589,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                 entry = (struct skb_data *) skb->cb;
                 urb = entry->urb;
 
+                spin_unlock_irqrestore(&q->lock, flags);
                 // during some PM-driven resume scenarios,
                 // these (async) unlinks complete immediately
                 retval = usb_unlink_urb (urb);
@@ -596,6 +597,7 @@ static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
                         netdev_dbg(dev->net, "unlink urb err, %d\n", retval);
                 else
                         count++;
+                spin_lock_irqsave(&q->lock, flags);
         }
         spin_unlock_irqrestore (&q->lock, flags);
         return count;
diff --git a/drivers/net/usb/zaurus.c b/drivers/net/usb/zaurus.c
index f701d4127087..c3197ce0e2ad 100644
--- a/drivers/net/usb/zaurus.c
+++ b/drivers/net/usb/zaurus.c
@@ -316,6 +316,11 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = ZAURUS_PXA_INFO,
 }, {
+        /* C-750/C-760/C-860/SL-C3000 PDA in MDLM mode */
+        USB_DEVICE_AND_INTERFACE_INFO(0x04DD, 0x9031, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+}, {
         .match_flags    =   USB_DEVICE_ID_MATCH_INT_INFO
                  | USB_DEVICE_ID_MATCH_DEVICE,
         .idVendor               = 0x04DD,
@@ -349,6 +354,13 @@ static const struct usb_device_id	products [] = {
         ZAURUS_MASTER_INTERFACE,
         .driver_info = OLYMPUS_MXL_INFO,
 },
+
+/* Logitech Harmony 900 - uses the pseudo-MDLM (BLAN) driver */
+{
+        USB_DEVICE_AND_INTERFACE_INFO(0x046d, 0xc11f, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &bogus_mdlm_info,
+},
         { },            // END
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index de7fc345148a..756c0f5565a5 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -830,21 +830,16 @@ vmxnet3_parse_and_copy_hdr(struct sk_buff *skb, struct vmxnet3_tx_queue *tq,
                                         ctx->l4_hdr_size = ((struct tcphdr *)
                                            skb_transport_header(skb))->doff * 4;
                                 else if (iph->protocol == IPPROTO_UDP)
-                                        /*
-                                         * Use tcp header size so that bytes to
-                                         * be copied are more than required by
-                                         * the device.
-                                         */
                                         ctx->l4_hdr_size =
-                                                        sizeof(struct tcphdr);
+                                                        sizeof(struct udphdr);
                                 else
                                         ctx->l4_hdr_size = 0;
                         } else {
                                 /* for simplicity, don't copy L4 headers */
                                 ctx->l4_hdr_size = 0;
                         }
-                        ctx->copy_size = ctx->eth_ip_hdr_size +
-                                         ctx->l4_hdr_size;
+                        ctx->copy_size = min(ctx->eth_ip_hdr_size +
+                                         ctx->l4_hdr_size, skb->len);
                 } else {
                         ctx->eth_ip_hdr_size = 0;
                         ctx->l4_hdr_size = 0;
diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
index ed54797db191..fc46a81ad538 100644
--- a/drivers/net/vmxnet3/vmxnet3_int.h
+++ b/drivers/net/vmxnet3/vmxnet3_int.h
@@ -70,10 +70,10 @@
 /*
  * Version numbers
  */
-#define VMXNET3_DRIVER_VERSION_STRING   "1.1.18.0-k"
+#define VMXNET3_DRIVER_VERSION_STRING   "1.1.29.0-k"
 
 /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
-#define VMXNET3_DRIVER_VERSION_NUM      0x01011200
+#define VMXNET3_DRIVER_VERSION_NUM      0x01011D00
 
 #if defined(CONFIG_PCI_MSI)
         /* RSS only makes sense if MSI-X is supported. */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index f901a17f76ba..86a891f93fc9 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -489,8 +489,6 @@ static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
         ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
         ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
         ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
 
         return 0;
@@ -519,7 +517,6 @@ static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
         ATH_FREE_BANK(ah->analogBank6Data);
         ATH_FREE_BANK(ah->analogBank6TPCData);
         ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
         ATH_FREE_BANK(ah->bank6Temp);
 
 #undef ATH_FREE_BANK
@@ -805,27 +802,7 @@ static int ar5008_hw_process_ini(struct ath_hw *ah,
         if (ah->eep_ops->set_addac)
                 ah->eep_ops->set_addac(ah, chan);
 
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
-
+        REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
         REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
 
         ENABLE_REGWRITE_BUFFER(ah);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 11f192a1ceb7..d190411ac8f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -180,6 +180,25 @@ static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
                                ARRAY_SIZE(ar5416Addac), 2);
         }
+
+        /* iniAddac needs to be modified for these chips */
+        if (AR_SREV_9160(ah) || !AR_SREV_5416_22_OR_LATER(ah)) {
+                struct ar5416IniArray *addac = &ah->iniAddac;
+                u32 size = sizeof(u32) * addac->ia_rows * addac->ia_columns;
+                u32 *data;
+
+                data = kmalloc(size, GFP_KERNEL);
+                if (!data)
+                        return;
+
+                memcpy(data, addac->ia_array, size);
+                addac->ia_array = data;
+
+                if (!AR_SREV_5416_22_OR_LATER(ah)) {
+                        /* override CLKDRV value */
+                        INI_RA(addac, 31,1) = 0;
+                }
+        }
 }
 
 /* Support for Japan ch.14 (2484) spread */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 6a29004a71b0..c8261d4fc780 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -940,7 +940,6 @@ struct ath_hw {
         u32 *analogBank6Data;
         u32 *analogBank6TPCData;
         u32 *analogBank7Data;
-        u32 *addac5416_21;
         u32 *bank6Temp;
 
         u8 txpower_limit;
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index 635b592ad961..a427a16bb739 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -1346,7 +1346,7 @@ static void ath_tx_status(void *priv, struct ieee80211_supported_band *sband,
         fc = hdr->frame_control;
         for (i = 0; i < sc->hw->max_rates; i++) {
                 struct ieee80211_tx_rate *rate = &tx_info->status.rates[i];
-                if (!rate->count)
+                if (rate->idx < 0 || !rate->count)
                         break;
 
                 final_ts_idx = i;
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index d19a9ee9d057..bbc813dee983 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -1234,6 +1234,7 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
 {
         struct ieee80211_sta *sta;
         struct carl9170_sta_info *sta_info;
+        struct ieee80211_tx_info *tx_info;
 
         rcu_read_lock();
         sta = __carl9170_get_tx_sta(ar, skb);
@@ -1241,16 +1242,18 @@ static bool carl9170_tx_ps_drop(struct ar9170 *ar, struct sk_buff *skb)
                 goto out_rcu;
 
         sta_info = (void *) sta->drv_priv;
-        if (unlikely(sta_info->sleeping)) {
-                struct ieee80211_tx_info *tx_info;
+        tx_info = IEEE80211_SKB_CB(skb);
 
+        if (unlikely(sta_info->sleeping) &&
+            !(tx_info->flags & (IEEE80211_TX_CTL_POLL_RESPONSE |
+                                IEEE80211_TX_CTL_CLEAR_PS_FILT))) {
                 rcu_read_unlock();
 
-                tx_info = IEEE80211_SKB_CB(skb);
                 if (tx_info->flags & IEEE80211_TX_CTL_AMPDU)
                         atomic_dec(&ar->tx_ampdu_upload);
 
                 tx_info->flags |= IEEE80211_TX_STAT_TX_FILTERED;
+                carl9170_release_dev_space(ar, skb);
                 carl9170_tx_status(ar, skb, false);
                 return true;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 90911eec0cf5..30b58870b1b6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -1051,17 +1051,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                 }
                 /* either retransmit or send bar if ack not recd */
                 if (!ack_recd) {
-                        struct ieee80211_tx_rate *txrate =
-                            tx_info->status.rates;
-                        if (retry && (txrate[0].count < (int)retry_limit)) {
+                        if (retry && (ini->txretry[index] < (int)retry_limit)) {
                                 ini->txretry[index]++;
                                 ini->tx_in_transit--;
                                 /*
                                  * Use high prededence for retransmit to
                                  * give some punch
                                  */
-                                /* brcms_c_txq_enq(wlc, scb, p,
-                                 * BRCMS_PRIO_TO_PREC(tid)); */
                                 brcms_c_txq_enq(wlc, scb, p,
                                                 BRCMS_PRIO_TO_HI_PREC(tid));
                         } else {
@@ -1074,9 +1070,9 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                                     IEEE80211_TX_STAT_AMPDU_NO_BACK;
                                 skb_pull(p, D11_PHY_HDR_LEN);
                                 skb_pull(p, D11_TXH_LEN);
-                                wiphy_err(wiphy, "%s: BA Timeout, seq %d, in_"
-                                        "transit %d\n", "AMPDU status", seq,
-                                        ini->tx_in_transit);
+                                BCMMSG(wiphy,
+                                       "BA Timeout, seq %d, in_transit %d\n",
+                                       seq, ini->tx_in_transit);
                                 ieee80211_tx_status_irqsafe(wlc->pub->ieee_hw,
                                                             p);
                         }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 64cf439035c3..ca78e91de86c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1240,7 +1240,7 @@ int iwlagn_suspend(struct iwl_priv *priv,
                                 .flags = CMD_SYNC,
                                 .data[0] = key_data.rsc_tsc,
                                 .dataflags[0] = IWL_HCMD_DFL_NOCOPY,
-                                .len[0] = sizeof(key_data.rsc_tsc),
+                                .len[0] = sizeof(*key_data.rsc_tsc),
                         };
 
                         ret = iwl_trans_send_cmd(trans(priv), &rsc_tsc_cmd);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index 7353826095f1..e483cfa8d14e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1187,6 +1187,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
         unsigned long flags;
         struct iwl_addsta_cmd sta_cmd;
         u8 sta_id = iwlagn_key_sta_id(priv, ctx->vif, sta);
+        __le16 key_flags;
 
         /* if station isn't there, neither is the key */
         if (sta_id == IWL_INVALID_STATION)
@@ -1212,7 +1213,14 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 IWL_ERR(priv, "offset %d not used in uCode key table.\n",
                         keyconf->hw_key_idx);
 
-        sta_cmd.key.key_flags = STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
+        key_flags = cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags |= STA_KEY_FLG_MAP_KEY_MSK | STA_KEY_FLG_NO_ENC |
+                     STA_KEY_FLG_INVALID;
+
+        if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
+                key_flags |= STA_KEY_MULTICAST_MSK;
+
+        sta_cmd.key.key_flags = key_flags;
         sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index c3b6c4652cd6..2210a0f9af2d 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -841,7 +841,13 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                 ret = mwifiex_set_rf_channel(priv, channel,
                                                 priv->adapter->channel_type);
 
-        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);  /* Disable keys */
+        /* As this is new association, clear locally stored
+         * keys and security related flags */
+        priv->sec_info.wpa_enabled = false;
+        priv->sec_info.wpa2_enabled = false;
+        priv->wep_key_curr_index = 0;
+        priv->sec_info.encryption_mode = 0;
+        ret = mwifiex_set_encode(priv, NULL, 0, 0, 1);
 
         if (mode == NL80211_IFTYPE_ADHOC) {
                 /* "privacy" is set only for ad-hoc mode */
@@ -886,6 +892,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
                         dev_dbg(priv->adapter->dev,
                                 "info: setting wep encryption"
                                 " with key len %d\n", sme->key_len);
+                        priv->wep_key_curr_index = sme->key_idx;
                         ret = mwifiex_set_encode(priv, sme->key, sme->key_len,
                                                         sme->key_idx, 0);
                 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index c3e1aa7c1a80..d2a1ea98d0f2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1220,7 +1220,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
                 cancel_work_sync(&rt2x00dev->rxdone_work);
                 cancel_work_sync(&rt2x00dev->txdone_work);
         }
-        destroy_workqueue(rt2x00dev->workqueue);
+        if (rt2x00dev->workqueue)
+                destroy_workqueue(rt2x00dev->workqueue);
 
         /*
          * Free the tx status fifo.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index ea2bd1be2640..91a375fb6ae6 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -23,7 +23,6 @@
 #include <asm/machdep.h>
 #endif /* CONFIG_PPC */
 
-#include <asm/setup.h>
 #include <asm/page.h>
 
 char *of_fdt_get_string(struct boot_param_header *blob, u32 offset)
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 980c079e4443..483c0adcad87 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -182,7 +182,7 @@ struct phy_device *of_phy_connect_fixed_link(struct net_device *dev,
         if (!phy_id || sz < sizeof(*phy_id))
                 return NULL;
 
-        sprintf(bus_id, PHY_ID_FMT, "0", be32_to_cpu(phy_id[0]));
+        sprintf(bus_id, PHY_ID_FMT, "fixed-0", be32_to_cpu(phy_id[0]));
 
         phy = phy_connect(dev, bus_id, hndlr, 0, iface);
         return IS_ERR(phy) ? NULL : phy;
diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
index a9c46cc2db37..8c33491b21fe 100644
--- a/drivers/parisc/iommu-helpers.h
+++ b/drivers/parisc/iommu-helpers.h
@@ -1,3 +1,5 @@
+#include <linux/prefetch.h>
+
 /**
  * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
  * @ioc: The I/O Controller.
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index a87e2728b2c3..64d433ec4fc6 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -328,21 +328,15 @@ static int pxa2xx_drv_pcmcia_probe(struct platform_device *dev)
                         goto err1;
         }
 
-        if (ret) {
-                while (--i >= 0)
-                        soc_pcmcia_remove_one(&sinfo->skt[i]);
-                kfree(sinfo);
-                clk_put(clk);
-        } else {
-                pxa2xx_configure_sockets(&dev->dev);
-                dev_set_drvdata(&dev->dev, sinfo);
-        }
+        pxa2xx_configure_sockets(&dev->dev);
+        dev_set_drvdata(&dev->dev, sinfo);
 
         return 0;
 
 err1:
         while (--i >= 0)
                 soc_pcmcia_remove_one(&sinfo->skt[i]);
+        clk_put(clk);
         kfree(sinfo);
 err0:
         return ret;
diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 42a7d603c870..7481146a5b47 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -33,6 +33,8 @@
 #include <linux/mutex.h>
 #include <asm/bios_ebda.h>
 
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
+
 static bool force;
 module_param(force, bool, 0);
 MODULE_PARM_DESC(force, "Force driver load, ignore DMI data");
@@ -83,19 +85,6 @@ static void __iomem *rtl_cmd_addr;
 static u8 rtl_cmd_type;
 static u8 rtl_cmd_width;
 
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-
-        low = readl(p);
-        high = readl(p + 1);
-
-        return low + ((u64)high << 32);
-}
-#endif
-
 static void __iomem *rtl_port_map(phys_addr_t addr, unsigned long len)
 {
         if (rtl_cmd_type == RTL_ADDR_TYPE_MMIO)
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 809a3ae943c6..88a98cff5a44 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -77,6 +77,8 @@
 #include <asm/processor.h>
 #include "intel_ips.h"
 
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
+
 #define PCI_DEVICE_ID_INTEL_THERMAL_SENSOR 0x3b32
 
 /*
@@ -344,19 +346,6 @@ struct ips_driver {
 static bool
 ips_gpu_turbo_enabled(struct ips_driver *ips);
 
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-
-        low = readl(p);
-        high = readl(p + 1);
-
-        return low + ((u64)high << 32);
-}
-#endif
-
 /**
  * ips_cpu_busy - is CPU busy?
  * @ips: IPS driver struct
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index 2baadd21b7a6..98fbe62694d4 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -369,9 +369,9 @@ static int __init pps_init(void)
         int err;
 
         pps_class = class_create(THIS_MODULE, "pps");
-        if (!pps_class) {
+        if (IS_ERR(pps_class)) {
                 pr_err("failed to allocate class\n");
-                return -ENOMEM;
+                return PTR_ERR(pps_class);
         }
         pps_class->dev_attrs = pps_attrs;
 
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 691b1ab1a3d0..30d2072f480b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -410,13 +410,14 @@ static void tsi721_db_dpc(struct work_struct *work)
          */
         mport = priv->mport;
 
-        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE));
-        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE));
+        wr_ptr = ioread32(priv->regs + TSI721_IDQ_WP(IDB_QUEUE)) % IDB_QSIZE;
+        rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
 
         while (wr_ptr != rd_ptr) {
                 idb_entry = (u64 *)(priv->idb_base +
                                         (TSI721_IDB_ENTRY_SIZE * rd_ptr));
                 rd_ptr++;
+                rd_ptr %= IDB_QSIZE;
                 idb.msg = *idb_entry;
                 *idb_entry = 0;
 
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index df33530cec4a..28b81ae4cf7f 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -196,7 +196,7 @@ static const unsigned int LDO12_suspend_table[] = {
 };
 
 static const unsigned int LDO13_table[] = {
-        1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0, 0,
+        1200000, 1300000, 1800000, 2000000, 2500000, 2800000, 3000000, 0,
 };
 
 static const unsigned int LDO13_suspend_table[] = {
@@ -389,10 +389,10 @@ static struct pm8607_regulator_info pm8607_regulator_info[] = {
         PM8607_LDO( 7,         LDO7, 0, 3, SUPPLIES_EN12, 1),
         PM8607_LDO( 8,         LDO8, 0, 3, SUPPLIES_EN12, 2),
         PM8607_LDO( 9,         LDO9, 0, 3, SUPPLIES_EN12, 3),
-        PM8607_LDO(10,        LDO10, 0, 3, SUPPLIES_EN12, 4),
+        PM8607_LDO(10,        LDO10, 0, 4, SUPPLIES_EN12, 4),
         PM8607_LDO(12,        LDO12, 0, 4, SUPPLIES_EN12, 5),
         PM8607_LDO(13, VIBRATOR_SET, 1, 3,  VIBRATOR_SET, 0),
-        PM8607_LDO(14,        LDO14, 0, 4, SUPPLIES_EN12, 6),
+        PM8607_LDO(14,        LDO14, 0, 3, SUPPLIES_EN12, 6),
 };
 
 static int __devinit pm8607_regulator_probe(struct platform_device *pdev)
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index 3767364452fd..ea4d8f575ac6 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -260,8 +260,8 @@ static int da9052_set_ldo5_6_voltage(struct regulator_dev *rdev,
          * the LDO activate bit to implment the changes on the
          * LDO output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
@@ -280,8 +280,8 @@ static int da9052_set_dcdc_voltage(struct regulator_dev *rdev,
          * the DCDC activate bit to implment the changes on the
          * DCDC output.
         */
-        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG, 0,
-                                 info->activate_bit);
+        return da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
+                                 info->activate_bit, info->activate_bit);
 }
 
 static int da9052_get_regulator_voltage_sel(struct regulator_dev *rdev)
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 5c15ba01e9c7..40ecf5165899 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -662,7 +662,7 @@ static int tps65910_set_voltage_dcdc(struct regulator_dev *dev,
                 tps65910_reg_write(pmic, TPS65910_VDD2_OP, vsel);
                 break;
         case TPS65911_REG_VDDCTRL:
-                vsel = selector;
+                vsel = selector + 3;
                 tps65910_reg_write(pmic, TPS65911_VDDCTRL_OP, vsel);
         }
 
diff --git a/drivers/rtc/rtc-r9701.c b/drivers/rtc/rtc-r9701.c
index 9beba49c3c5b..2853c2a6f10f 100644
--- a/drivers/rtc/rtc-r9701.c
+++ b/drivers/rtc/rtc-r9701.c
@@ -125,6 +125,13 @@ static int __devinit r9701_probe(struct spi_device *spi)
         unsigned char tmp;
         int res;
 
+        tmp = R100CNT;
+        res = read_regs(&spi->dev, &tmp, 1);
+        if (res || tmp != 0x20) {
+                dev_err(&spi->dev, "cannot read RTC register\n");
+                return -ENODEV;
+        }
+
         rtc = rtc_device_register("r9701",
                                 &spi->dev, &r9701_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc))
@@ -132,13 +139,6 @@ static int __devinit r9701_probe(struct spi_device *spi)
 
         dev_set_drvdata(&spi->dev, rtc);
 
-        tmp = R100CNT;
-        res = read_regs(&spi->dev, &tmp, 1);
-        if (res || tmp != 0x20) {
-                rtc_device_unregister(rtc);
-                return res;
-        }
-
         return 0;
 }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 70880be26015..2617b1ed4709 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -18,12 +18,12 @@
 #include <linux/hdreg.h>        /* HDIO_GETGEO                      */
 #include <linux/bio.h>
 #include <linux/module.h>
+#include <linux/compat.h>
 #include <linux/init.h>
 
 #include <asm/debug.h>
 #include <asm/idals.h>
 #include <asm/ebcdic.h>
-#include <asm/compat.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/cio.h>
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index f1a2016829fc..792c69e78fe2 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -13,6 +13,7 @@
 #define KMSG_COMPONENT "dasd"
 
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/major.h>
 #include <linux/fs.h>
 #include <linux/blkpg.h>
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 934458ad55e5..e71a50d4b221 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -87,6 +87,7 @@ struct raw3215_info {
         struct tty_struct *tty;       /* pointer to tty structure if present */
         struct raw3215_req *queued_read; /* pointer to queued read requests */
         struct raw3215_req *queued_write;/* pointer to queued write requests */
+        struct tasklet_struct tlet;   /* tasklet to invoke tty_wakeup */
         wait_queue_head_t empty_wait; /* wait queue for flushing */
         struct timer_list timer;      /* timer for delayed output */
         int line_pos;                 /* position on the line (for tabs) */
@@ -334,19 +335,23 @@ static inline void raw3215_try_io(struct raw3215_info *raw)
 }
 
 /*
+ * Call tty_wakeup from tasklet context
+ */
+static void raw3215_wakeup(unsigned long data)
+{
+        struct raw3215_info *raw = (struct raw3215_info *) data;
+        tty_wakeup(raw->tty);
+}
+
+/*
  * Try to start the next IO and wake up processes waiting on the tty.
  */
 static void raw3215_next_io(struct raw3215_info *raw)
 {
-        struct tty_struct *tty;
-
         raw3215_mk_write_req(raw);
         raw3215_try_io(raw);
-        tty = raw->tty;
-        if (tty != NULL &&
-            RAW3215_BUFFER_SIZE - raw->count >= RAW3215_MIN_SPACE) {
-                tty_wakeup(tty);
-        }
+        if (raw->tty && RAW3215_BUFFER_SIZE - raw->count >= RAW3215_MIN_SPACE)
+                tasklet_schedule(&raw->tlet);
 }
 
 /*
@@ -682,6 +687,7 @@ static int raw3215_probe (struct ccw_device *cdev)
                 return -ENOMEM;
         }
         init_waitqueue_head(&raw->empty_wait);
+        tasklet_init(&raw->tlet, raw3215_wakeup, (unsigned long) raw);
 
         dev_set_drvdata(&cdev->dev, raw);
         cdev->handler = raw3215_irq;
@@ -901,6 +907,7 @@ static int __init con3215_init(void)
 
         raw->flags |= RAW3215_FIXED;
         init_waitqueue_head(&raw->empty_wait);
+        tasklet_init(&raw->tlet, raw3215_wakeup, (unsigned long) raw);
 
         /* Request the console irq */
         if (raw3215_startup(raw) != 0) {
@@ -966,6 +973,7 @@ static void tty3215_close(struct tty_struct *tty, struct file * filp)
         tty->closing = 1;
         /* Shutdown the terminal */
         raw3215_shutdown(raw);
+        tasklet_kill(&raw->tlet);
         tty->closing = 0;
         raw->tty = NULL;
 }
diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
index e71298158f9e..911704571b9c 100644
--- a/drivers/s390/char/fs3270.c
+++ b/drivers/s390/char/fs3270.c
@@ -11,6 +11,7 @@
 #include <linux/console.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
+#include <linux/compat.h>
 #include <linux/module.h>
 #include <linux/list.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 75bde6a8b7dc..89c03e6b1c0c 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -13,6 +13,7 @@
 
 #include <linux/fs.h>
 #include <linux/init.h>
+#include <linux/compat.h>
 #include <linux/kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/slab.h>
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 0c87b0fc7714..8f9a1a384496 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/slab.h>
+#include <linux/compat.h>
 #include <linux/device.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3ef8d071c64a..770a740a393c 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -167,7 +167,7 @@ again:
         DBF_ERROR("%4x EQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
@@ -215,7 +215,7 @@ again:
         DBF_ERROR("%4x SQBS ERROR", SCH_NO(q));
         DBF_ERROR("%3d%3d%2d", count, tmp_count, nr);
         q->handler(q->irq_ptr->cdev, QDIO_ERROR_ACTIVATE_CHECK_CONDITION,
-                   0, -1, -1, q->irq_ptr->int_parm);
+                   q->nr, q->first_to_kick, count, q->irq_ptr->int_parm);
         return 0;
 }
 
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 303dde09d294..fab2c2592a97 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -11,6 +11,7 @@
 #define KMSG_COMPONENT "zfcp"
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
+#include <linux/compat.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 53a31c753cb1..20c4557f5abd 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -364,10 +364,7 @@ static void release_controller(struct kref *kref)
         struct rdac_controller *ctlr;
         ctlr = container_of(kref, struct rdac_controller, kref);
 
-        flush_workqueue(kmpath_rdacd);
-        spin_lock(&list_lock);
         list_del(&ctlr->node);
-        spin_unlock(&list_lock);
         kfree(ctlr);
 }
 
@@ -376,20 +373,17 @@ static struct rdac_controller *get_controller(int index, char *array_name,
 {
         struct rdac_controller *ctlr, *tmp;
 
-        spin_lock(&list_lock);
-
         list_for_each_entry(tmp, &ctlr_list, node) {
                 if ((memcmp(tmp->array_id, array_id, UNIQUE_ID_LEN) == 0) &&
                           (tmp->index == index) &&
                           (tmp->host == sdev->host)) {
                         kref_get(&tmp->kref);
-                        spin_unlock(&list_lock);
                         return tmp;
                 }
         }
         ctlr = kmalloc(sizeof(*ctlr), GFP_ATOMIC);
         if (!ctlr)
-                goto done;
+                return NULL;
 
         /* initialize fields of controller */
         memcpy(ctlr->array_id, array_id, UNIQUE_ID_LEN);
@@ -405,8 +399,7 @@ static struct rdac_controller *get_controller(int index, char *array_name,
         INIT_WORK(&ctlr->ms_work, send_mode_select);
         INIT_LIST_HEAD(&ctlr->ms_head);
         list_add(&ctlr->node, &ctlr_list);
-done:
-        spin_unlock(&list_lock);
+
         return ctlr;
 }
 
@@ -517,9 +510,12 @@ static int initialize_controller(struct scsi_device *sdev,
                         index = 0;
                 else
                         index = 1;
+
+                spin_lock(&list_lock);
                 h->ctlr = get_controller(index, array_name, array_id, sdev);
                 if (!h->ctlr)
                         err = SCSI_DH_RES_TEMP_UNAVAIL;
+                spin_unlock(&list_lock);
         }
         return err;
 }
@@ -906,7 +902,9 @@ static int rdac_bus_attach(struct scsi_device *sdev)
         return 0;
 
 clean_ctlr:
+        spin_lock(&list_lock);
         kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
 
 failed:
         kfree(scsi_dh_data);
@@ -921,14 +919,19 @@ static void rdac_bus_detach( struct scsi_device *sdev )
         struct rdac_dh_data *h;
         unsigned long flags;
 
-        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
         scsi_dh_data = sdev->scsi_dh_data;
+        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        if (h->ctlr && h->ctlr->ms_queued)
+                flush_workqueue(kmpath_rdacd);
+
+        spin_lock_irqsave(sdev->request_queue->queue_lock, flags);
         sdev->scsi_dh_data = NULL;
         spin_unlock_irqrestore(sdev->request_queue->queue_lock, flags);
 
-        h = (struct rdac_dh_data *) scsi_dh_data->buf;
+        spin_lock(&list_lock);
         if (h->ctlr)
                 kref_put(&h->ctlr->kref, release_controller);
+        spin_unlock(&list_lock);
         kfree(scsi_dh_data);
         module_put(THIS_MODULE);
         sdev_printk(KERN_NOTICE, sdev, "%s: Detached\n", RDAC_NAME);
diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c
index 67b169b7a5be..b538f0883fd2 100644
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -4613,11 +4613,13 @@ static int __ipr_eh_host_reset(struct scsi_cmnd * scsi_cmd)
         ENTER;
         ioa_cfg = (struct ipr_ioa_cfg *) scsi_cmd->device->host->hostdata;
 
-        dev_err(&ioa_cfg->pdev->dev,
-                "Adapter being reset as a result of error recovery.\n");
+        if (!ioa_cfg->in_reset_reload) {
+                dev_err(&ioa_cfg->pdev->dev,
+                        "Adapter being reset as a result of error recovery.\n");
 
-        if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
-                ioa_cfg->sdt_state = GET_DUMP;
+                if (WAIT_FOR_DUMP == ioa_cfg->sdt_state)
+                        ioa_cfg->sdt_state = GET_DUMP;
+        }
 
         rc = ipr_reset_reload(ioa_cfg, IPR_SHUTDOWN_ABBREV);
 
@@ -4907,7 +4909,7 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
         struct ipr_ioa_cfg *ioa_cfg;
         struct ipr_resource_entry *res;
         struct ipr_cmd_pkt *cmd_pkt;
-        u32 ioasc;
+        u32 ioasc, int_reg;
         int op_found = 0;
 
         ENTER;
@@ -4920,7 +4922,17 @@ static int ipr_cancel_op(struct scsi_cmnd * scsi_cmd)
          */
         if (ioa_cfg->in_reset_reload || ioa_cfg->ioa_is_dead)
                 return FAILED;
-        if (!res || !ipr_is_gscsi(res))
+        if (!res)
+                return FAILED;
+
+        /*
+         * If we are aborting a timed out op, chances are that the timeout was caused
+         * by a still not detected EEH error. In such cases, reading a register will
+         * trigger the EEH recovery infrastructure.
+         */
+        int_reg = readl(ioa_cfg->regs.sense_interrupt_reg);
+
+        if (!ipr_is_gscsi(res))
                 return FAILED;
 
         list_for_each_entry(ipr_cmd, &ioa_cfg->pending_q, queue) {
diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c
index 1a65d6514237..418391b1c361 100644
--- a/drivers/scsi/isci/host.c
+++ b/drivers/scsi/isci/host.c
@@ -1848,9 +1848,11 @@ static enum sci_status sci_oem_parameters_set(struct isci_host *ihost)
         if (state == SCIC_RESET ||
             state == SCIC_INITIALIZING ||
             state == SCIC_INITIALIZED) {
+                u8 oem_version = pci_info->orom ? pci_info->orom->hdr.version :
+                        ISCI_ROM_VER_1_0;
 
                 if (sci_oem_parameters_validate(&ihost->oem_parameters,
-                                                pci_info->orom->hdr.version))
+                                                oem_version))
                         return SCI_FAILURE_INVALID_PARAMETER_VALUE;
 
                 return SCI_SUCCESS;
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 0b2c95583660..a78036f5e1a6 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -4548,7 +4548,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
                 printk(MPT2SAS_ERR_FMT "%s: pci error recovery reset\n",
                     ioc->name, __func__);
                 r = 0;
-                goto out;
+                goto out_unlocked;
         }
 
         if (mpt2sas_fwfault_debug)
@@ -4604,6 +4604,7 @@ mpt2sas_base_hard_reset_handler(struct MPT2SAS_ADAPTER *ioc, int sleep_flag,
         spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
         mutex_unlock(&ioc->reset_in_progress_mutex);
 
+ out_unlocked:
         dtmprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: exit\n", ioc->name,
             __func__));
         return r;
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index b31a8e3841d7..d4ed9eb52657 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -69,10 +69,10 @@
 #ifndef SCSI_OSD_MAJOR
 #  define SCSI_OSD_MAJOR 260
 #endif
-#define SCSI_OSD_MAX_MINOR 64
+#define SCSI_OSD_MAX_MINOR MINORMASK
 
 static const char osd_name[] = "osd";
-static const char *osd_version_string = "open-osd 0.2.0";
+static const char *osd_version_string = "open-osd 0.2.1";
 
 MODULE_AUTHOR("Boaz Harrosh <bharrosh@panasas.com>");
 MODULE_DESCRIPTION("open-osd Upper-Layer-Driver osd.ko");
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index a2f1b3043dfb..9f41b3b4358f 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -1036,8 +1036,7 @@ qla2x00_link_state_show(struct device *dev, struct device_attribute *attr,
             vha->device_flags & DFLG_NO_CABLE)
                 len = snprintf(buf, PAGE_SIZE, "Link Down\n");
         else if (atomic_read(&vha->loop_state) != LOOP_READY ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+            qla2x00_reset_active(vha))
                 len = snprintf(buf, PAGE_SIZE, "Unknown Link State\n");
         else {
                 len = snprintf(buf, PAGE_SIZE, "Link Up - ");
@@ -1359,8 +1358,7 @@ qla2x00_thermal_temp_show(struct device *dev,
                 return snprintf(buf, PAGE_SIZE, "\n");
 
         temp = frac = 0;
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+        if (qla2x00_reset_active(vha))
                 ql_log(ql_log_warn, vha, 0x707b,
                     "ISP reset active.\n");
         else if (!vha->hw->flags.eeh_busy)
@@ -1379,8 +1377,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr,
         int rval = QLA_FUNCTION_FAILED;
         uint16_t state[5];
 
-        if (test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags))
+        if (qla2x00_reset_active(vha))
                 ql_log(ql_log_warn, vha, 0x707c,
                     "ISP reset active.\n");
         else if (!vha->hw->flags.eeh_busy)
@@ -1693,9 +1690,7 @@ qla2x00_get_fc_host_stats(struct Scsi_Host *shost)
         if (IS_FWI2_CAPABLE(ha)) {
                 rval = qla24xx_get_isp_stats(base_vha, stats, stats_dma);
         } else if (atomic_read(&base_vha->loop_state) == LOOP_READY &&
-                    !test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) &&
-                    !test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) &&
-                    !ha->dpc_active) {
+            !qla2x00_reset_active(vha) && !ha->dpc_active) {
                 /* Must be in a 'READY' state for statistics retrieval. */
                 rval = qla2x00_get_link_status(base_vha, base_vha->loop_id,
                                                 stats, stats_dma);
diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
index b1d0f936bf2d..1682e2e4201d 100644
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -108,13 +108,6 @@ qla24xx_proc_fcp_prio_cfg_cmd(struct fc_bsg_job *bsg_job)
                 goto exit_fcp_prio_cfg;
         }
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ret = -EBUSY;
-                goto exit_fcp_prio_cfg;
-        }
-
         /* Get the sub command */
         oper = bsg_job->request->rqst_data.h_vendor.vendor_cmd[1];
 
@@ -646,13 +639,6 @@ qla2x00_process_loopback(struct fc_bsg_job *bsg_job)
         dma_addr_t rsp_data_dma;
         uint32_t rsp_data_len;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7018, "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!vha->flags.online) {
                 ql_log(ql_log_warn, vha, 0x7019, "Host is not online.\n");
                 return -EIO;
@@ -874,13 +860,6 @@ qla84xx_reset(struct fc_bsg_job *bsg_job)
         int rval = 0;
         uint32_t flag;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-            test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x702e, "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_QLA84XX(ha)) {
                 ql_dbg(ql_dbg_user, vha, 0x702f, "Not 84xx, exiting.\n");
                 return -EINVAL;
@@ -922,11 +901,6 @@ qla84xx_updatefw(struct fc_bsg_job *bsg_job)
         uint32_t flag;
         uint32_t fw_ver;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags))
-                return -EBUSY;
-
         if (!IS_QLA84XX(ha)) {
                 ql_dbg(ql_dbg_user, vha, 0x7032,
                     "Not 84xx, exiting.\n");
@@ -1036,14 +1010,6 @@ qla84xx_mgmt_cmd(struct fc_bsg_job *bsg_job)
         uint32_t data_len = 0;
         uint32_t dma_direction = DMA_NONE;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7039,
-                    "Abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_QLA84XX(ha)) {
                 ql_log(ql_log_warn, vha, 0x703a,
                     "Not 84xx, exiting.\n");
@@ -1246,13 +1212,6 @@ qla24xx_iidma(struct fc_bsg_job *bsg_job)
 
         bsg_job->reply->reply_payload_rcv_len = 0;
 
-        if (test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
-                test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags) ||
-                test_bit(ISP_ABORT_RETRY, &vha->dpc_flags)) {
-                ql_log(ql_log_warn, vha, 0x7045, "abort active or needed.\n");
-                return -EBUSY;
-        }
-
         if (!IS_IIDMA_CAPABLE(vha->hw)) {
                 ql_log(ql_log_info, vha, 0x7046, "iiDMA not supported.\n");
                 return -EINVAL;
@@ -1668,6 +1627,15 @@ qla24xx_bsg_request(struct fc_bsg_job *bsg_job)
                 vha = shost_priv(host);
         }
 
+        if (qla2x00_reset_active(vha)) {
+                ql_dbg(ql_dbg_user, vha, 0x709f,
+                    "BSG: ISP abort active/needed -- cmd=%d.\n",
+                    bsg_job->request->msgcode);
+                bsg_job->reply->result = (DID_ERROR << 16);
+                bsg_job->job_done(bsg_job);
+                return -EBUSY;
+        }
+
         ql_dbg(ql_dbg_user, vha, 0x7000,
             "Entered %s msgcode=0x%x.\n", __func__, bsg_job->request->msgcode);
 
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 7c54624b5b13..45cbf0ba624d 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -19,7 +19,8 @@
  * | DPC Thread                   |       0x401c       |                |
  * | Async Events                 |       0x5057       | 0x5052         |
  * | Timer Routines               |       0x6011       | 0x600e,0x600f  |
- * | User Space Interactions      |       0x709e       |                |
+ * | User Space Interactions      |       0x709e       | 0x7018,0x702e  |
+ * |                              |                    | 0x7039,0x7045  |
  * | Task Management              |       0x803c       | 0x8025-0x8026  |
  * |                              |                    | 0x800b,0x8039  |
  * | AER/EEH                      |       0x900f       |                |
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index a6a4eebce4a8..af1003f9de1e 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -44,6 +44,7 @@
  * ISP2100 HBAs.
  */
 #define MAILBOX_REGISTER_COUNT_2100     8
+#define MAILBOX_REGISTER_COUNT_2200     24
 #define MAILBOX_REGISTER_COUNT          32
 
 #define QLA2200A_RISC_ROM_VER   4
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 9902834e0b74..7cc4f36cd539 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -131,3 +131,16 @@ qla2x00_hba_err_chk_enabled(srb_t *sp)
         }
         return 0;
 }
+
+static inline int
+qla2x00_reset_active(scsi_qla_host_t *vha)
+{
+        scsi_qla_host_t *base_vha = pci_get_drvdata(vha->hw->pdev);
+
+        /* Test appropriate base-vha and vha flags. */
+        return test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_RETRY, &base_vha->dpc_flags) ||
+            test_bit(ISP_ABORT_NEEDED, &vha->dpc_flags) ||
+            test_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
+}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index e804585cc59c..349843ea32f6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -2090,7 +2090,6 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
                         break;
                 case CT_IOCB_TYPE:
                         qla24xx_els_ct_entry(vha, rsp->req, pkt, CT_IOCB_TYPE);
-                        clear_bit(MBX_INTERRUPT, &vha->hw->mbx_cmd_flags);
                         break;
                 case ELS_IOCB_TYPE:
                         qla24xx_els_ct_entry(vha, rsp->req, pkt, ELS_IOCB_TYPE);
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 34344d3f8658..08f1d01bdc1c 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -342,6 +342,8 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
 
                                 set_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                 clear_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+                                /* Allow next mbx cmd to come in. */
+                                complete(&ha->mbx_cmd_comp);
                                 if (ha->isp_ops->abort_isp(vha)) {
                                         /* Failed. retry later. */
                                         set_bit(ISP_ABORT_NEEDED,
@@ -350,6 +352,7 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
                                 clear_bit(ABORT_ISP_ACTIVE, &vha->dpc_flags);
                                 ql_dbg(ql_dbg_mbx, base_vha, 0x101f,
                                     "Finished abort_isp.\n");
+                                goto mbx_done;
                         }
                 }
         }
@@ -358,6 +361,7 @@ premature_exit:
         /* Allow next mbx cmd to come in. */
         complete(&ha->mbx_cmd_comp);
 
+mbx_done:
         if (rval) {
                 ql_dbg(ql_dbg_mbx, base_vha, 0x1020,
                     "**** Failed mbx[0]=%x, mb[1]=%x, mb[2]=%x, cmd=%x ****.\n",
@@ -2581,7 +2585,8 @@ qla2x00_stop_firmware(scsi_qla_host_t *vha)
         ql_dbg(ql_dbg_mbx, vha, 0x10a1, "Entered %s.\n", __func__);
 
         mcp->mb[0] = MBC_STOP_FIRMWARE;
-        mcp->out_mb = MBX_0;
+        mcp->mb[1] = 0;
+        mcp->out_mb = MBX_1|MBX_0;
         mcp->in_mb = MBX_0;
         mcp->tov = 5;
         mcp->flags = 0;
diff --git a/drivers/scsi/qla2xxx/qla_nx.c b/drivers/scsi/qla2xxx/qla_nx.c
index 1cd46cd7ff90..270ba3130fde 100644
--- a/drivers/scsi/qla2xxx/qla_nx.c
+++ b/drivers/scsi/qla2xxx/qla_nx.c
@@ -1165,19 +1165,6 @@ qla82xx_pinit_from_rom(scsi_qla_host_t *vha)
                 qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xfeffffff);
         else
                 qla82xx_wr_32(ha, QLA82XX_ROMUSB_GLB_SW_RESET, 0xffffffff);
-
-        /* reset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val |= (1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
-
-        /* unreset ms */
-        val = qla82xx_rd_32(ha, QLA82XX_CRB_QDR_NET + 0xe4);
-        val &= ~(1 << 1);
-        qla82xx_wr_32(ha, QLA82XX_CRB_QDR_NET + 0xe4, val);
-        msleep(20);
-
         qla82xx_rom_unlock(ha);
 
         /* Read the signature value from the flash.
@@ -3392,7 +3379,7 @@ void qla82xx_watchdog(scsi_qla_host_t *vha)
                                             QLA82XX_CRB_PEG_NET_3 + 0x3c),
                                     qla82xx_rd_32(ha,
                                             QLA82XX_CRB_PEG_NET_4 + 0x3c));
-                                if (LSW(MSB(halt_status)) == 0x67)
+                                if (((halt_status & 0x1fffff00) >> 8) == 0x67)
                                         ql_log(ql_log_warn, vha, 0xb052,
                                             "Firmware aborted with "
                                             "error code 0x00006700. Device is "
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 4ed1e4a96b95..036030c95339 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -625,6 +625,12 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
                         cmd->result = DID_NO_CONNECT << 16;
                         goto qc24_fail_command;
         }
+
+        if (!fcport) {
+                cmd->result = DID_NO_CONNECT << 16;
+                goto qc24_fail_command;
+        }
+
         if (atomic_read(&fcport->state) != FCS_ONLINE) {
                 if (atomic_read(&fcport->state) == FCS_DEVICE_DEAD ||
                         atomic_read(&base_vha->loop_state) == LOOP_DEAD) {
@@ -877,6 +883,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
 
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         if (ha->isp_ops->abort_command(sp)) {
+                ret = FAILED;
                 ql_dbg(ql_dbg_taskm, vha, 0x8003,
                     "Abort command mbx failed cmd=%p.\n", cmd);
         } else {
@@ -1124,7 +1131,6 @@ static int
 qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
 {
         scsi_qla_host_t *vha = shost_priv(cmd->device->host);
-        fc_port_t *fcport = (struct fc_port *) cmd->device->hostdata;
         struct qla_hw_data *ha = vha->hw;
         int ret = FAILED;
         unsigned int id, lun;
@@ -1133,15 +1139,6 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
         id = cmd->device->id;
         lun = cmd->device->lun;
 
-        if (!fcport) {
-                return ret;
-        }
-
-        ret = fc_block_scsi_eh(cmd);
-        if (ret != 0)
-                return ret;
-        ret = FAILED;
-
         ql_log(ql_log_info, vha, 0x8018,
             "ADAPTER RESET ISSUED nexus=%ld:%d:%d.\n", vha->host_no, id, lun);
 
@@ -2047,7 +2044,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
                 ha->nvram_data_off = ~0;
                 ha->isp_ops = &qla2100_isp_ops;
         } else if (IS_QLA2200(ha)) {
-                ha->mbx_count = MAILBOX_REGISTER_COUNT;
+                ha->mbx_count = MAILBOX_REGISTER_COUNT_2200;
                 req_length = REQUEST_ENTRY_CNT_2200;
                 rsp_length = RESPONSE_ENTRY_CNT_2100;
                 ha->max_loop_id = SNS_LAST_LOOP_ID_2100;
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index 23f33a6d52d7..29d780c38040 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.03.07.12-k"
+#define QLA2XXX_VERSION      "8.03.07.13-k"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/qla4xxx/ql4_nx.c b/drivers/scsi/qla4xxx/ql4_nx.c
index 78f1111158d7..65253dfbe962 100644
--- a/drivers/scsi/qla4xxx/ql4_nx.c
+++ b/drivers/scsi/qla4xxx/ql4_nx.c
@@ -10,6 +10,8 @@
 #include "ql4_def.h"
 #include "ql4_glbl.h"
 
+#include <asm-generic/io-64-nonatomic-lo-hi.h>
+
 #define MASK(n)         DMA_BIT_MASK(n)
 #define MN_WIN(addr)    (((addr & 0x1fc0000) >> 1) | ((addr >> 25) & 0x3ff))
 #define OCM_WIN(addr)   (((addr & 0x1ff0000) >> 1) | ((addr >> 25) & 0x3ff))
@@ -655,27 +657,6 @@ static int qla4_8xxx_pci_is_same_window(struct scsi_qla_host *ha,
         return 0;
 }
 
-#ifndef readq
-static inline __u64 readq(const volatile void __iomem *addr)
-{
-        const volatile u32 __iomem *p = addr;
-        u32 low, high;
-
-        low = readl(p);
-        high = readl(p + 1);
-
-        return low + ((u64)high << 32);
-}
-#endif
-
-#ifndef writeq
-static inline void writeq(__u64 val, volatile void __iomem *addr)
-{
-        writel(val, addr);
-        writel(val >> 32, addr+4);
-}
-#endif
-
 static int qla4_8xxx_pci_mem_read_direct(struct scsi_qla_host *ha,
                 u64 off, void *data, int size)
 {
diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index bf8bf79e6a1f..c4670642d023 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -7,6 +7,7 @@
 
 #include <linux/pm_runtime.h>
 #include <linux/export.h>
+#include <linux/async.h>
 
 #include <scsi/scsi.h>
 #include <scsi/scsi_device.h>
@@ -92,6 +93,19 @@ static int scsi_bus_resume_common(struct device *dev)
         return err;
 }
 
+static int scsi_bus_prepare(struct device *dev)
+{
+        if (scsi_is_sdev_device(dev)) {
+                /* sd probing uses async_schedule.  Wait until it finishes. */
+                async_synchronize_full();
+
+        } else if (scsi_is_host_device(dev)) {
+                /* Wait until async scanning is finished */
+                scsi_complete_async_scans();
+        }
+        return 0;
+}
+
 static int scsi_bus_suspend(struct device *dev)
 {
         return scsi_bus_suspend_common(dev, PMSG_SUSPEND);
@@ -110,6 +124,7 @@ static int scsi_bus_poweroff(struct device *dev)
 #else /* CONFIG_PM_SLEEP */
 
 #define scsi_bus_resume_common          NULL
+#define scsi_bus_prepare                NULL
 #define scsi_bus_suspend                NULL
 #define scsi_bus_freeze                 NULL
 #define scsi_bus_poweroff               NULL
@@ -218,6 +233,7 @@ void scsi_autopm_put_host(struct Scsi_Host *shost)
 #endif /* CONFIG_PM_RUNTIME */
 
 const struct dev_pm_ops scsi_bus_pm_ops = {
+        .prepare =              scsi_bus_prepare,
         .suspend =              scsi_bus_suspend,
         .resume =               scsi_bus_resume_common,
         .freeze =               scsi_bus_freeze,
diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h
index 68eadd1c67fd..be4fa6d179b1 100644
--- a/drivers/scsi/scsi_priv.h
+++ b/drivers/scsi/scsi_priv.h
@@ -109,6 +109,7 @@ extern void scsi_exit_procfs(void);
 #endif /* CONFIG_PROC_FS */
 
 /* scsi_scan.c */
+extern int scsi_complete_async_scans(void);
 extern int scsi_scan_host_selected(struct Scsi_Host *, unsigned int,
                                    unsigned int, unsigned int, int);
 extern void scsi_forget_host(struct Scsi_Host *);
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 89da43f73c00..29c4c0480976 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1815,6 +1815,7 @@ static void scsi_finish_async_scan(struct async_scan_data *data)
         }
         spin_unlock(&async_scan_lock);
 
+        scsi_autopm_put_host(shost);
         scsi_host_put(shost);
         kfree(data);
 }
@@ -1841,7 +1842,6 @@ static int do_scan_async(void *_data)
 
         do_scsi_scan_host(shost);
         scsi_finish_async_scan(data);
-        scsi_autopm_put_host(shost);
         return 0;
 }
 
@@ -1869,7 +1869,7 @@ void scsi_scan_host(struct Scsi_Host *shost)
         p = kthread_run(do_scan_async, data, "scsi_scan_%d", shost->host_no);
         if (IS_ERR(p))
                 do_scan_async(data);
-        /* scsi_autopm_put_host(shost) is called in do_scan_async() */
+        /* scsi_autopm_put_host(shost) is called in scsi_finish_async_scan() */
 }
 EXPORT_SYMBOL(scsi_scan_host);
 
diff --git a/drivers/scsi/sd_dif.c b/drivers/scsi/sd_dif.c
index 0cb39ff21171..f8fb2d691c0a 100644
--- a/drivers/scsi/sd_dif.c
+++ b/drivers/scsi/sd_dif.c
@@ -408,7 +408,7 @@ int sd_dif_prepare(struct request *rq, sector_t hw_sector, unsigned int sector_s
                         kunmap_atomic(sdt, KM_USER0);
                 }
 
-                bio->bi_flags |= BIO_MAPPED_INTEGRITY;
+                bio->bi_flags |= (1 << BIO_MAPPED_INTEGRITY);
         }
 
         return 0;
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 45fee368b092..92d314a73f69 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -190,7 +190,7 @@ static int __init sh_clk_init_parent(struct clk *clk)
                 return -EINVAL;
         }
 
-        clk->parent = clk->parent_table[val];
+        clk_reparent(clk, clk->parent_table[val]);
         if (!clk->parent) {
                 pr_err("sh_clk_init_parent: unable to set parent");
                 return -EINVAL;
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index 2f9cb43a2398..f37ad2271ad5 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1083,7 +1083,7 @@ err_alloc_rx_sg:
         return -ENOMEM;
 }
 
-static int __init pl022_dma_probe(struct pl022 *pl022)
+static int __devinit pl022_dma_probe(struct pl022 *pl022)
 {
         dma_cap_mask_t mask;
 
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b3d17416d86a..830cd62d8492 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -365,7 +365,7 @@ config PPC_EPAPR_HV_BYTECHAN
 
 config PPC_EARLY_DEBUG_EHV_BC
         bool "Early console (udbg) support for ePAPR hypervisors"
-        depends on PPC_EPAPR_HV_BYTECHAN
+        depends on PPC_EPAPR_HV_BYTECHAN=y
         help
           Select this option to enable early console (a.k.a. "udbg") support
           via an ePAPR byte channel.  You also need to choose the byte channel
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index d136b8f4c8a7..81e2c0d9c17d 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -187,7 +187,10 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
                 return -ENODEV;
         dev->current_state = PCI_D0;
 
-        if (!dev->irq) {
+        /* The xHCI driver supports MSI and MSI-X,
+         * so don't fail if the BIOS doesn't provide a legacy IRQ.
+         */
+        if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
                 dev_err(&dev->dev,
                         "Found HC with no IRQ.  Check BIOS/PCI %s setup!\n",
                         pci_name(dev));
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index eb19cba34ac9..e1282328fc27 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2447,8 +2447,10 @@ int usb_add_hcd(struct usb_hcd *hcd,
                         && device_can_wakeup(&hcd->self.root_hub->dev))
                 dev_dbg(hcd->self.controller, "supports USB remote wakeup\n");
 
-        /* enable irqs just before we start the controller */
-        if (usb_hcd_is_primary_hcd(hcd)) {
+        /* enable irqs just before we start the controller,
+         * if the BIOS provides legacy PCI irqs.
+         */
+        if (usb_hcd_is_primary_hcd(hcd) && irqnum) {
                 retval = usb_hcd_request_irqs(hcd, irqnum, irqflags);
                 if (retval)
                         goto err_request_irq;
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a0613d8f9be7..265c2f675d04 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -705,10 +705,26 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
         if (type == HUB_INIT3)
                 goto init3;
 
-        /* After a resume, port power should still be on.
+        /* The superspeed hub except for root hub has to use Hub Depth
+         * value as an offset into the route string to locate the bits
+         * it uses to determine the downstream port number. So hub driver
+         * should send a set hub depth request to superspeed hub after
+         * the superspeed hub is set configuration in initialization or
+         * reset procedure.
+         *
+         * After a resume, port power should still be on.
          * For any other type of activation, turn it on.
          */
         if (type != HUB_RESUME) {
+                if (hdev->parent && hub_is_superspeed(hdev)) {
+                        ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
+                                        HUB_SET_DEPTH, USB_RT_HUB,
+                                        hdev->level - 1, 0, NULL, 0,
+                                        USB_CTRL_SET_TIMEOUT);
+                        if (ret < 0)
+                                dev_err(hub->intfdev,
+                                                "set hub depth failed\n");
+                }
 
                 /* Speed up system boot by using a delayed_work for the
                  * hub's initial power-up delays.  This is pretty awkward
@@ -987,18 +1003,6 @@ static int hub_configure(struct usb_hub *hub,
                 goto fail;
         }
 
-        if (hub_is_superspeed(hdev) && (hdev->parent != NULL)) {
-                ret = usb_control_msg(hdev, usb_sndctrlpipe(hdev, 0),
-                                HUB_SET_DEPTH, USB_RT_HUB,
-                                hdev->level - 1, 0, NULL, 0,
-                                USB_CTRL_SET_TIMEOUT);
-
-                if (ret < 0) {
-                        message = "can't set hub depth";
-                        goto fail;
-                }
-        }
-
         /* Request the entire hub descriptor.
          * hub->descriptor can handle USB_MAXCHILDREN ports,
          * but the hub can/will return fewer bytes here.
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index c26a82e83f6e..b556a72264d1 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -239,7 +239,7 @@ static void ehci_fsl_setup_phy(struct ehci_hcd *ehci,
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 }
 
-static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
+static void ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 {
         struct usb_hcd *hcd = ehci_to_hcd(ehci);
         struct fsl_usb2_platform_data *pdata;
@@ -299,19 +299,12 @@ static int ehci_fsl_usb_setup(struct ehci_hcd *ehci)
 #endif
                 out_be32(non_ehci + FSL_SOC_USB_SICTRL, 0x00000001);
         }
-
-        if (!(in_be32(non_ehci + FSL_SOC_USB_CTRL) & CTRL_PHY_CLK_VALID)) {
-                printk(KERN_WARNING "fsl-ehci: USB PHY clock invalid\n");
-                return -ENODEV;
-        }
-        return 0;
 }
 
 /* called after powerup, by probe or system-pm "wakeup" */
 static int ehci_fsl_reinit(struct ehci_hcd *ehci)
 {
-        if (ehci_fsl_usb_setup(ehci))
-                return -ENODEV;
+        ehci_fsl_usb_setup(ehci);
         ehci_port_power(ehci, 0);
 
         return 0;
diff --git a/drivers/usb/host/ehci-fsl.h b/drivers/usb/host/ehci-fsl.h
index bdf43e2adc51..491806221165 100644
--- a/drivers/usb/host/ehci-fsl.h
+++ b/drivers/usb/host/ehci-fsl.h
@@ -45,6 +45,5 @@
 #define FSL_SOC_USB_PRICTRL     0x40c   /* NOTE: big-endian */
 #define FSL_SOC_USB_SICTRL      0x410   /* NOTE: big-endian */
 #define FSL_SOC_USB_CTRL        0x500   /* NOTE: big-endian */
-#define CTRL_PHY_CLK_VALID      (1 << 17)
 #define SNOOP_SIZE_2GB          0x1e
 #endif                          /* _EHCI_FSL_H */
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index ac53a662a6a3..7732d69e49e0 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -872,7 +872,17 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
          */
         if (pdev->vendor == 0x184e)     /* vendor Netlogic */
                 return;
+        if (pdev->class != PCI_CLASS_SERIAL_USB_UHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_OHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_EHCI &&
+                        pdev->class != PCI_CLASS_SERIAL_USB_XHCI)
+                return;
 
+        if (pci_enable_device(pdev) < 0) {
+                dev_warn(&pdev->dev, "Can't enable PCI device, "
+                                "BIOS handoff failed.\n");
+                return;
+        }
         if (pdev->class == PCI_CLASS_SERIAL_USB_UHCI)
                 quirk_usb_handoff_uhci(pdev);
         else if (pdev->class == PCI_CLASS_SERIAL_USB_OHCI)
@@ -881,5 +891,6 @@ static void __devinit quirk_usb_early_handoff(struct pci_dev *pdev)
                 quirk_usb_disable_ehci(pdev);
         else if (pdev->class == PCI_CLASS_SERIAL_USB_XHCI)
                 quirk_usb_handoff_xhci(pdev);
+        pci_disable_device(pdev);
 }
 DECLARE_PCI_FIXUP_FINAL(PCI_ANY_ID, PCI_ANY_ID, quirk_usb_early_handoff);
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 35e257f79c7b..557b6f32db86 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -93,7 +93,7 @@ static void xhci_usb2_hub_descriptor(struct usb_hcd *hcd, struct xhci_hcd *xhci,
          */
         memset(port_removable, 0, sizeof(port_removable));
         for (i = 0; i < ports; i++) {
-                portsc = xhci_readl(xhci, xhci->usb3_ports[i]);
+                portsc = xhci_readl(xhci, xhci->usb2_ports[i]);
                 /* If a device is removable, PORTSC reports a 0, same as in the
                  * hub descriptor DeviceRemovable bits.
                  */
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 36cbe2226a44..383fc857491c 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1126,26 +1126,42 @@ static unsigned int xhci_parse_exponent_interval(struct usb_device *udev,
 }
 
 /*
- * Convert bInterval expressed in frames (in 1-255 range) to exponent of
+ * Convert bInterval expressed in microframes (in 1-255 range) to exponent of
  * microframes, rounded down to nearest power of 2.
  */
-static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
-                struct usb_host_endpoint *ep)
+static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
+                struct usb_host_endpoint *ep, unsigned int desc_interval,
+                unsigned int min_exponent, unsigned int max_exponent)
 {
         unsigned int interval;
 
-        interval = fls(8 * ep->desc.bInterval) - 1;
-        interval = clamp_val(interval, 3, 10);
-        if ((1 << interval) != 8 * ep->desc.bInterval)
+        interval = fls(desc_interval) - 1;
+        interval = clamp_val(interval, min_exponent, max_exponent);
+        if ((1 << interval) != desc_interval)
                 dev_warn(&udev->dev,
                          "ep %#x - rounding interval to %d microframes, ep desc says %d microframes\n",
                          ep->desc.bEndpointAddress,
                          1 << interval,
-                         8 * ep->desc.bInterval);
+                         desc_interval);
 
         return interval;
 }
 
+static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        return xhci_microframes_to_exponent(udev, ep,
+                        ep->desc.bInterval, 0, 15);
+}
+
+
+static unsigned int xhci_parse_frame_interval(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        return xhci_microframes_to_exponent(udev, ep,
+                        ep->desc.bInterval * 8, 3, 10);
+}
+
 /* Return the polling or NAK interval.
  *
  * The polling interval is expressed in "microframes".  If xHCI's Interval field
@@ -1164,7 +1180,7 @@ static unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
                 /* Max NAK rate */
                 if (usb_endpoint_xfer_control(&ep->desc) ||
                     usb_endpoint_xfer_bulk(&ep->desc)) {
-                        interval = ep->desc.bInterval;
+                        interval = xhci_parse_microframe_interval(udev, ep);
                         break;
                 }
                 /* Fall through - SS and HS isoc/int have same decoding */
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 6bbe3c3a7111..c939f5fdef9e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -352,6 +352,11 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
                 /* hcd->irq is -1, we have MSI */
                 return 0;
 
+        if (!pdev->irq) {
+                xhci_err(xhci, "No msi-x/msi found and no IRQ in BIOS\n");
+                return -EINVAL;
+        }
+
         /* fall back to legacy interrupt*/
         ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
                         hcd->irq_descr, hcd);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 8dbf51a43c45..08a5575724cd 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -136,6 +136,8 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
         { USB_DEVICE(0x16DC, 0x0012) }, /* W-IE-NE-R Plein & Baus GmbH MPOD Multi Channel Power Supply */
         { USB_DEVICE(0x16DC, 0x0015) }, /* W-IE-NE-R Plein & Baus GmbH CML Control, Monitoring and Data Logger */
+        { USB_DEVICE(0x17A8, 0x0001) }, /* Kamstrup Optical Eye/3-wire */
+        { USB_DEVICE(0x17A8, 0x0005) }, /* Kamstrup M-Bus Master MultiPort 250D */
         { USB_DEVICE(0x17F4, 0xAAAA) }, /* Wavesense Jazz blood glucose meter */
         { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 39ed1f46cec0..b54afceb9611 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -788,7 +788,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0012, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0013, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0016, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0017, 0xff, 0xff, 0xff),
@@ -803,7 +802,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0024, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0025, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
-        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0026, 0xff, 0xff, 0xff) }, */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0028, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0029, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0030, 0xff, 0xff, 0xff) },
@@ -828,7 +826,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0051, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0052, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        /* { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0053, 0xff, 0xff, 0xff) }, */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0054, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0055, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -836,7 +833,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0058, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0061, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0062, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0063, 0xff, 0xff, 0xff),
@@ -846,7 +842,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0066, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0067, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0069, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0076, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0077, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0078, 0xff, 0xff, 0xff) },
@@ -865,8 +860,6 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0095, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0096, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0097, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0098, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0099, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0104, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0105, 0xff, 0xff, 0xff) },
@@ -887,28 +880,18 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0144, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0145, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0146, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0148, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0149, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0150, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0151, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0153, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0155, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0160, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0164, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
@@ -1083,127 +1066,27 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1403, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1404, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1405, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1406, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1407, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1408, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1409, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1410, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1411, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1412, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1413, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1414, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1415, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1416, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1417, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1418, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1419, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1420, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1421, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1422, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1423, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1427, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1429, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1430, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1431, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1432, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1433, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1434, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1435, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1436, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1437, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1438, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1439, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1440, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1441, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1442, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1443, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1444, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1445, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1446, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1447, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1448, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1449, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1450, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1451, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1452, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1453, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1454, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1455, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1456, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1457, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1458, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1459, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1460, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1461, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1462, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1463, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1464, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1465, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1466, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1467, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1468, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1469, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1470, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1471, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1472, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1473, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1474, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1475, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1476, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1477, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1478, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1479, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1480, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1481, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1482, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1483, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1484, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1485, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1486, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1487, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1488, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1489, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1490, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1491, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1492, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1493, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1494, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1495, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1496, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1497, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1498, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1499, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1500, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1501, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1502, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1503, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1504, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1505, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1506, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1507, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1508, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1509, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1510, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
+          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0014, 0xff, 0xff, 0xff) }, /* ZTE CDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0027, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0059, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
-          0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) },
+
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 8468eb769a29..75b838eff178 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -165,7 +165,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[14+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -179,6 +179,7 @@ static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
 };
 
 static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
@@ -188,7 +189,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[18+2*TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -206,6 +207,7 @@ static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1]
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
+        { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
         { }
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index 2aac1953993b..f140f1b9d5c0 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -49,6 +49,10 @@
 #define MTS_MT9234ZBA_PRODUCT_ID        0xF115
 #define MTS_MT9234ZBAOLD_PRODUCT_ID     0x0319
 
+/* Abbott Diabetics vendor and product ids */
+#define ABBOTT_VENDOR_ID                0x1a61
+#define ABBOTT_PRODUCT_ID               0x3410
+
 /* Commands */
 #define TI_GET_VERSION                  0x01
 #define TI_GET_PORT_STATUS              0x02
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 3dd7da9fd504..db51ba16dc07 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -788,15 +788,19 @@ static void quiesce_and_remove_host(struct us_data *us)
         struct Scsi_Host *host = us_to_host(us);
 
         /* If the device is really gone, cut short reset delays */
-        if (us->pusb_dev->state == USB_STATE_NOTATTACHED)
+        if (us->pusb_dev->state == USB_STATE_NOTATTACHED) {
                 set_bit(US_FLIDX_DISCONNECTING, &us->dflags);
+                wake_up(&us->delay_wait);
+        }
 
-        /* Prevent SCSI-scanning (if it hasn't started yet)
-         * and wait for the SCSI-scanning thread to stop.
+        /* Prevent SCSI scanning (if it hasn't started yet)
+         * or wait for the SCSI-scanning routine to stop.
          */
-        set_bit(US_FLIDX_DONT_SCAN, &us->dflags);
-        wake_up(&us->delay_wait);
-        wait_for_completion(&us->scanning_done);
+        cancel_delayed_work_sync(&us->scan_dwork);
+
+        /* Balance autopm calls if scanning was cancelled */
+        if (test_bit(US_FLIDX_SCAN_PENDING, &us->dflags))
+                usb_autopm_put_interface_no_suspend(us->pusb_intf);
 
         /* Removing the host will perform an orderly shutdown: caches
          * synchronized, disks spun down, etc.
@@ -823,53 +827,28 @@ static void release_everything(struct us_data *us)
         scsi_host_put(us_to_host(us));
 }
 
-/* Thread to carry out delayed SCSI-device scanning */
-static int usb_stor_scan_thread(void * __us)
+/* Delayed-work routine to carry out SCSI-device scanning */
+static void usb_stor_scan_dwork(struct work_struct *work)
 {
-        struct us_data *us = (struct us_data *)__us;
+        struct us_data *us = container_of(work, struct us_data,
+                        scan_dwork.work);
         struct device *dev = &us->pusb_intf->dev;
 
-        dev_dbg(dev, "device found\n");
-
-        set_freezable();
+        dev_dbg(dev, "starting scan\n");
 
-        /*
-         * Wait for the timeout to expire or for a disconnect
-         *
-         * We can't freeze in this thread or we risk causing khubd to
-         * fail to freeze, but we can't be non-freezable either. Nor can
-         * khubd freeze while waiting for scanning to complete as it may
-         * hold the device lock, causing a hang when suspending devices.
-         * So instead of using wait_event_freezable(), explicitly test
-         * for (DONT_SCAN || freezing) in interruptible wait and proceed
-         * if any of DONT_SCAN, freezing or timeout has happened.
-         */
-        if (delay_use > 0) {
-                dev_dbg(dev, "waiting for device to settle "
-                                "before scanning\n");
-                wait_event_interruptible_timeout(us->delay_wait,
-                                test_bit(US_FLIDX_DONT_SCAN, &us->dflags) ||
-                                freezing(current), delay_use * HZ);
+        /* For bulk-only devices, determine the max LUN value */
+        if (us->protocol == USB_PR_BULK && !(us->fflags & US_FL_SINGLE_LUN)) {
+                mutex_lock(&us->dev_mutex);
+                us->max_lun = usb_stor_Bulk_max_lun(us);
+                mutex_unlock(&us->dev_mutex);
         }
+        scsi_scan_host(us_to_host(us));
+        dev_dbg(dev, "scan complete\n");
 
-        /* If the device is still connected, perform the scanning */
-        if (!test_bit(US_FLIDX_DONT_SCAN, &us->dflags)) {
-
-                /* For bulk-only devices, determine the max LUN value */
-                if (us->protocol == USB_PR_BULK &&
-                                !(us->fflags & US_FL_SINGLE_LUN)) {
-                        mutex_lock(&us->dev_mutex);
-                        us->max_lun = usb_stor_Bulk_max_lun(us);
-                        mutex_unlock(&us->dev_mutex);
-                }
-                scsi_scan_host(us_to_host(us));
-                dev_dbg(dev, "scan complete\n");
-
-                /* Should we unbind if no devices were detected? */
-        }
+        /* Should we unbind if no devices were detected? */
 
         usb_autopm_put_interface(us->pusb_intf);
-        complete_and_exit(&us->scanning_done, 0);
+        clear_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
 }
 
 static unsigned int usb_stor_sg_tablesize(struct usb_interface *intf)
@@ -916,7 +895,7 @@ int usb_stor_probe1(struct us_data **pus,
         init_completion(&us->cmnd_ready);
         init_completion(&(us->notify));
         init_waitqueue_head(&us->delay_wait);
-        init_completion(&us->scanning_done);
+        INIT_DELAYED_WORK(&us->scan_dwork, usb_stor_scan_dwork);
 
         /* Associate the us_data structure with the USB device */
         result = associate_dev(us, intf);
@@ -947,7 +926,6 @@ EXPORT_SYMBOL_GPL(usb_stor_probe1);
 /* Second part of general USB mass-storage probing */
 int usb_stor_probe2(struct us_data *us)
 {
-        struct task_struct *th;
         int result;
         struct device *dev = &us->pusb_intf->dev;
 
@@ -988,20 +966,14 @@ int usb_stor_probe2(struct us_data *us)
                 goto BadDevice;
         }
 
-        /* Start up the thread for delayed SCSI-device scanning */
-        th = kthread_create(usb_stor_scan_thread, us, "usb-stor-scan");
-        if (IS_ERR(th)) {
-                dev_warn(dev,
-                                "Unable to start the device-scanning thread\n");
-                complete(&us->scanning_done);
-                quiesce_and_remove_host(us);
-                result = PTR_ERR(th);
-                goto BadDevice;
-        }
-
+        /* Submit the delayed_work for SCSI-device scanning */
         usb_autopm_get_interface_no_resume(us->pusb_intf);
-        wake_up_process(th);
+        set_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
 
+        if (delay_use > 0)
+                dev_dbg(dev, "waiting for device to settle before scanning\n");
+        queue_delayed_work(system_freezable_wq, &us->scan_dwork,
+                        delay_use * HZ);
         return 0;
 
         /* We come here if there are any problems */
diff --git a/drivers/usb/storage/usb.h b/drivers/usb/storage/usb.h
index 7b0f2113632e..75f70f04f37b 100644
--- a/drivers/usb/storage/usb.h
+++ b/drivers/usb/storage/usb.h
@@ -47,6 +47,7 @@
 #include <linux/blkdev.h>
 #include <linux/completion.h>
 #include <linux/mutex.h>
+#include <linux/workqueue.h>
 #include <scsi/scsi_host.h>
 
 struct us_data;
@@ -72,7 +73,7 @@ struct us_unusual_dev {
 #define US_FLIDX_DISCONNECTING  3       /* disconnect in progress   */
 #define US_FLIDX_RESETTING      4       /* device reset in progress */
 #define US_FLIDX_TIMED_OUT      5       /* SCSI midlayer timed out  */
-#define US_FLIDX_DONT_SCAN      6       /* don't scan (disconnect)  */
+#define US_FLIDX_SCAN_PENDING   6       /* scanning not yet done    */
 #define US_FLIDX_REDO_READ10    7       /* redo READ(10) command    */
 #define US_FLIDX_READ10_WORKED  8       /* previous READ(10) succeeded */
 
@@ -147,8 +148,8 @@ struct us_data {
         /* mutual exclusion and synchronization structures */
         struct completion       cmnd_ready;      /* to sleep thread on      */
         struct completion       notify;          /* thread begin/end        */
-        wait_queue_head_t       delay_wait;      /* wait during scan, reset */
-        struct completion       scanning_done;   /* wait for scan thread    */
+        wait_queue_head_t       delay_wait;      /* wait during reset       */
+        struct delayed_work     scan_dwork;      /* for async scanning      */
 
         /* subdriver information */
         void                    *extra;          /* Any extra data          */
diff --git a/drivers/video/omap2/displays/Kconfig b/drivers/video/omap2/displays/Kconfig
index 74d29b552901..408a9927be92 100644
--- a/drivers/video/omap2/displays/Kconfig
+++ b/drivers/video/omap2/displays/Kconfig
@@ -12,7 +12,7 @@ config PANEL_GENERIC_DPI
 
 config PANEL_DVI
         tristate "DVI output"
-        depends on OMAP2_DSS_DPI
+        depends on OMAP2_DSS_DPI && I2C
         help
           Driver for external monitors, connected via DVI. The driver uses i2c
           to read EDID information from the monitor.
diff --git a/drivers/video/omap2/dss/apply.c b/drivers/video/omap2/dss/apply.c
index 052dc874cd3d..87b3e25294cf 100644
--- a/drivers/video/omap2/dss/apply.c
+++ b/drivers/video/omap2/dss/apply.c
@@ -1276,6 +1276,9 @@ int dss_ovl_enable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for overlay to be enabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
@@ -1313,6 +1316,9 @@ int dss_ovl_disable(struct omap_overlay *ovl)
 
         spin_unlock_irqrestore(&data_lock, flags);
 
+        /* wait for the overlay to be disabled */
+        wait_pending_extra_info_updates();
+
         mutex_unlock(&apply_lock);
 
         return 0;
diff --git a/drivers/video/omap2/dss/hdmi.c b/drivers/video/omap2/dss/hdmi.c
index d7aa3b056529..a36b934b2db4 100644
--- a/drivers/video/omap2/dss/hdmi.c
+++ b/drivers/video/omap2/dss/hdmi.c
@@ -165,9 +165,25 @@ static int hdmi_runtime_get(void)
 
         DSSDBG("hdmi_runtime_get\n");
 
+        /*
+         * HACK: Add dss_runtime_get() to ensure DSS clock domain is enabled.
+         * This should be removed later.
+         */
+        r = dss_runtime_get();
+        if (r < 0)
+                goto err_get_dss;
+
         r = pm_runtime_get_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
-        return r < 0 ? r : 0;
+        if (r < 0)
+                goto err_get_hdmi;
+
+        return 0;
+
+err_get_hdmi:
+        dss_runtime_put();
+err_get_dss:
+        return r;
 }
 
 static void hdmi_runtime_put(void)
@@ -178,6 +194,12 @@ static void hdmi_runtime_put(void)
 
         r = pm_runtime_put_sync(&hdmi.pdev->dev);
         WARN_ON(r < 0);
+
+        /*
+         * HACK: This is added to complement the dss_runtime_get() call in
+         * hdmi_runtime_get(). This should be removed later.
+         */
+        dss_runtime_put();
 }
 
 int hdmi_init_display(struct omap_dss_device *dssdev)
diff --git a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
index 2d72334ca3da..6847a478b459 100644
--- a/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
+++ b/drivers/video/omap2/dss/ti_hdmi_4xxx_ip.c
@@ -479,14 +479,7 @@ int ti_hdmi_4xxx_read_edid(struct hdmi_ip_data *ip_data,
 
 bool ti_hdmi_4xxx_detect(struct hdmi_ip_data *ip_data)
 {
-        int r;
-
-        void __iomem *base = hdmi_core_sys_base(ip_data);
-
-        /* HPD */
-        r = REG_GET(base, HDMI_CORE_SYS_SYS_STAT, 1, 1);
-
-        return r == 1;
+        return gpio_get_value(ip_data->hpd_gpio);
 }
 
 static void hdmi_core_init(struct hdmi_core_video_config *video_cfg,
diff --git a/drivers/video/pvr2fb.c b/drivers/video/pvr2fb.c
index f9975100d56d..3a3fdc62c75b 100644
--- a/drivers/video/pvr2fb.c
+++ b/drivers/video/pvr2fb.c
@@ -1061,7 +1061,7 @@ static struct pvr2_board {
         int (*init)(void);
         void (*exit)(void);
         char name[16];
-} board_driver[] = {
+} board_driver[] __refdata = {
 #ifdef CONFIG_SH_DREAMCAST
         { pvr2fb_dc_init, pvr2fb_dc_exit, "Sega DC PVR2" },
 #endif
diff --git a/drivers/video/via/hw.c b/drivers/video/via/hw.c
index d5aaca9cfa7e..8497727d66de 100644
--- a/drivers/video/via/hw.c
+++ b/drivers/video/via/hw.c
@@ -1810,7 +1810,11 @@ static void hw_init(void)
                 break;
         }
 
+        /* magic required on VX900 for correct modesetting on IGA1 */
+        via_write_reg_mask(VIACR, 0x45, 0x00, 0x01);
+
         /* probably this should go to the scaling code one day */
+        via_write_reg_mask(VIACR, 0xFD, 0, 0x80); /* VX900 hw scale on IGA2 */
         viafb_write_regx(scaling_parameters, ARRAY_SIZE(scaling_parameters));
 
         /* Fill VPIT Parameters */
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 95aeedf198f8..958e5129c601 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -367,29 +367,45 @@ static void __devexit virtballoon_remove(struct virtio_device *vdev)
 #ifdef CONFIG_PM
 static int virtballoon_freeze(struct virtio_device *vdev)
 {
+        struct virtio_balloon *vb = vdev->priv;
+
         /*
          * The kthread is already frozen by the PM core before this
          * function is called.
          */
 
+        while (vb->num_pages)
+                leak_balloon(vb, vb->num_pages);
+        update_balloon_size(vb);
+
         /* Ensure we don't get any more requests from the host */
         vdev->config->reset(vdev);
         vdev->config->del_vqs(vdev);
         return 0;
 }
 
+static int restore_common(struct virtio_device *vdev)
+{
+        struct virtio_balloon *vb = vdev->priv;
+        int ret;
+
+        ret = init_vqs(vdev->priv);
+        if (ret)
+                return ret;
+
+        fill_balloon(vb, towards_target(vb));
+        update_balloon_size(vb);
+        return 0;
+}
+
 static int virtballoon_thaw(struct virtio_device *vdev)
 {
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 
 static int virtballoon_restore(struct virtio_device *vdev)
 {
         struct virtio_balloon *vb = vdev->priv;
-        struct page *page, *page2;
-
-        /* We're starting from a clean slate */
-        vb->num_pages = 0;
 
         /*
          * If a request wasn't complete at the time of freezing, this
@@ -397,12 +413,7 @@ static int virtballoon_restore(struct virtio_device *vdev)
          */
         vb->need_stats_update = 0;
 
-        /* We don't have these pages in the balloon anymore! */
-        list_for_each_entry_safe(page, page2, &vb->pages, lru) {
-                list_del(&page->lru);
-                totalram_pages++;
-        }
-        return init_vqs(vdev->priv);
+        return restore_common(vdev);
 }
 #endif
 
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 877b107f77a7..df9e8f0e327d 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1098,7 +1098,7 @@ config BOOKE_WDT_DEFAULT_TIMEOUT
           For Freescale Book-E processors, this is a number between 0 and 63.
           For other Book-E processors, this is a number between 0 and 3.
 
-          The value can be overidden by the wdt_period command-line parameter.
+          The value can be overridden by the wdt_period command-line parameter.
 
 # PPC64 Architecture
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 337265b47305..7c0fdfca2646 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -198,9 +198,13 @@ static long booke_wdt_ioctl(struct file *file,
                 booke_wdt_period = tmp;
 #endif
                 booke_wdt_set();
-                return 0;
+                /* Fall */
         case WDIOC_GETTIMEOUT:
+#ifdef  CONFIG_FSL_BOOKE
+                return put_user(period_to_sec(booke_wdt_period), p);
+#else
                 return put_user(booke_wdt_period, p);
+#endif
         default:
                 return -ENOTTY;
         }
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 8464ea1c36a1..3c166d3f4e55 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -231,7 +231,7 @@ static int __devinit cru_detect(unsigned long map_entry,
 
         cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE;
 
-        set_memory_x((unsigned long)bios32_entrypoint, (2 * PAGE_SIZE));
+        set_memory_x((unsigned long)bios32_map, 2);
         asminline_call(&cmn_regs, bios32_entrypoint);
 
         if (cmn_regs.u1.ral != 0) {
@@ -250,7 +250,8 @@ static int __devinit cru_detect(unsigned long map_entry,
                         cru_rom_addr =
                                 ioremap(cru_physical_address, cru_length);
                         if (cru_rom_addr) {
-                                set_memory_x((unsigned long)cru_rom_addr, cru_length);
+                                set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK,
+                                        (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT);
                                 retval = 0;
                         }
                 }
diff --git a/drivers/watchdog/pnx4008_wdt.c b/drivers/watchdog/pnx4008_wdt.c
index 8e210aafdfd0..dfae030a7ef2 100644
--- a/drivers/watchdog/pnx4008_wdt.c
+++ b/drivers/watchdog/pnx4008_wdt.c
@@ -264,7 +264,7 @@ static int __devinit pnx4008_wdt_probe(struct platform_device *pdev)
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 printk(KERN_INFO MODULE_NAME
-                        "failed to get memory region resouce\n");
+                        "failed to get memory region resource\n");
                 return -ENOENT;
         }
 
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 4bc3744e14e4..404172f02c9b 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -312,18 +312,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
         dev = &pdev->dev;
         wdt_dev = &pdev->dev;
 
-        /* get the memory region for the watchdog timer */
-
         wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (wdt_mem == NULL) {
                 dev_err(dev, "no memory resource specified\n");
                 return -ENOENT;
         }
 
+        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+        if (wdt_irq == NULL) {
+                dev_err(dev, "no irq resource specified\n");
+                ret = -ENOENT;
+                goto err;
+        }
+
+        /* get the memory region for the watchdog timer */
+
         size = resource_size(wdt_mem);
         if (!request_mem_region(wdt_mem->start, size, pdev->name)) {
                 dev_err(dev, "failed to get memory region\n");
-                return -EBUSY;
+                ret = -EBUSY;
+                goto err;
         }
 
         wdt_base = ioremap(wdt_mem->start, size);
@@ -335,29 +343,17 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         DBG("probe: mapped wdt_base=%p\n", wdt_base);
 
-        wdt_irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (wdt_irq == NULL) {
-                dev_err(dev, "no irq resource specified\n");
-                ret = -ENOENT;
-                goto err_map;
-        }
-
-        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
-        if (ret != 0) {
-                dev_err(dev, "failed to install irq (%d)\n", ret);
-                goto err_map;
-        }
-
         wdt_clock = clk_get(&pdev->dev, "watchdog");
         if (IS_ERR(wdt_clock)) {
                 dev_err(dev, "failed to find watchdog clock source\n");
                 ret = PTR_ERR(wdt_clock);
-                goto err_irq;
+                goto err_map;
         }
 
         clk_enable(wdt_clock);
 
-        if (s3c2410wdt_cpufreq_register() < 0) {
+        ret = s3c2410wdt_cpufreq_register();
+        if (ret < 0) {
                 printk(KERN_ERR PFX "failed to register cpufreq\n");
                 goto err_clk;
         }
@@ -378,12 +374,18 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
                                                         "cannot start\n");
         }
 
+        ret = request_irq(wdt_irq->start, s3c2410wdt_irq, 0, pdev->name, pdev);
+        if (ret != 0) {
+                dev_err(dev, "failed to install irq (%d)\n", ret);
+                goto err_cpufreq;
+        }
+
         watchdog_set_nowayout(&s3c2410_wdd, nowayout);
 
         ret = watchdog_register_device(&s3c2410_wdd);
         if (ret) {
                 dev_err(dev, "cannot register watchdog (%d)\n", ret);
-                goto err_cpufreq;
+                goto err_irq;
         }
 
         if (tmr_atboot && started == 0) {
@@ -408,23 +410,26 @@ static int __devinit s3c2410wdt_probe(struct platform_device *pdev)
 
         return 0;
 
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
+
  err_cpufreq:
         s3c2410wdt_cpufreq_deregister();
 
  err_clk:
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
-
- err_irq:
-        free_irq(wdt_irq->start, pdev);
+        wdt_clock = NULL;
 
  err_map:
         iounmap(wdt_base);
 
  err_req:
         release_mem_region(wdt_mem->start, size);
-        wdt_mem = NULL;
 
+ err:
+        wdt_irq = NULL;
+        wdt_mem = NULL;
         return ret;
 }
 
@@ -432,18 +437,18 @@ static int __devexit s3c2410wdt_remove(struct platform_device *dev)
 {
         watchdog_unregister_device(&s3c2410_wdd);
 
+        free_irq(wdt_irq->start, dev);
+
         s3c2410wdt_cpufreq_deregister();
 
         clk_disable(wdt_clock);
         clk_put(wdt_clock);
         wdt_clock = NULL;
 
-        free_irq(wdt_irq->start, dev);
-        wdt_irq = NULL;
-
         iounmap(wdt_base);
 
         release_mem_region(wdt_mem->start, resource_size(wdt_mem));
+        wdt_irq = NULL;
         wdt_mem = NULL;
         return 0;
 }
diff --git a/fs/aio.c b/fs/aio.c
index 969beb0e2231..b9d64d89a043 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-        BUG_ON(atomic_read(&kioctx->users) <= 0);
-        atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
         return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         mm = ctx->mm = current->mm;
         atomic_inc(&mm->mm_count);
 
-        atomic_set(&ctx->users, 1);
+        atomic_set(&ctx->users, 2);
         spin_lock_init(&ctx->ctx_lock);
         spin_lock_init(&ctx->ring_info.ring_lock);
         init_waitqueue_head(&ctx->wait);
@@ -490,6 +484,8 @@ static void kiocb_batch_free(struct kioctx *ctx, struct kiocb_batch *batch)
                 kmem_cache_free(kiocb_cachep, req);
                 ctx->reqs_active--;
         }
+        if (unlikely(!ctx->reqs_active && ctx->dead))
+                wake_up_all(&ctx->wait);
         spin_unlock_irq(&ctx->ctx_lock);
 }
 
@@ -607,11 +603,16 @@ static void aio_fput_routine(struct work_struct *data)
                         fput(req->ki_filp);
 
                 /* Link the iocb into the context's free list */
+                rcu_read_lock();
                 spin_lock_irq(&ctx->ctx_lock);
                 really_put_req(ctx, req);
+                /*
+                 * at that point ctx might've been killed, but actual
+                 * freeing is RCU'd
+                 */
                 spin_unlock_irq(&ctx->ctx_lock);
+                rcu_read_unlock();
 
-                put_ioctx(ctx);
                 spin_lock_irq(&fput_lock);
         }
         spin_unlock_irq(&fput_lock);
@@ -642,7 +643,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
          * this function will be executed w/out any aio kthread wakeup.
          */
         if (unlikely(!fput_atomic(req->ki_filp))) {
-                get_ioctx(ctx);
                 spin_lock(&fput_lock);
                 list_add(&req->ki_list, &fput_head);
                 spin_unlock(&fput_lock);
@@ -1336,10 +1336,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
         ret = PTR_ERR(ioctx);
         if (!IS_ERR(ioctx)) {
                 ret = put_user(ioctx->user_id, ctxp);
-                if (!ret)
+                if (!ret) {
+                        put_ioctx(ioctx);
                         return 0;
-
-                get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+                }
                 io_destroy(ioctx);
         }
 
diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index d8d8e7ba6a1e..eb1cc92cd67d 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -110,6 +110,7 @@ struct autofs_sb_info {
         int sub_version;
         int min_proto;
         int max_proto;
+        int compat_daemon;
         unsigned long exp_timeout;
         unsigned int type;
         int reghost_enabled;
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 76741d8d7786..85f1fcdb30e7 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -385,6 +385,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 sbi->pipefd = pipefd;
                 sbi->pipe = pipe;
                 sbi->catatonic = 0;
+                sbi->compat_daemon = is_compat_task();
         }
 out:
         mutex_unlock(&sbi->wq_mutex);
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index 450f529a4eae..1feb68ecef95 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -124,6 +124,7 @@ start:
         /* Negative dentry - try next */
         if (!simple_positive(q)) {
                 spin_unlock(&p->d_lock);
+                lock_set_subclass(&q->d_lock.dep_map, 0, _RET_IP_);
                 p = q;
                 goto again;
         }
@@ -186,6 +187,7 @@ again:
         /* Negative dentry - try next */
         if (!simple_positive(ret)) {
                 spin_unlock(&p->d_lock);
+                lock_set_subclass(&ret->d_lock.dep_map, 0, _RET_IP_);
                 p = ret;
                 goto again;
         }
diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
index e16980b00b8d..06858d955120 100644
--- a/fs/autofs4/inode.c
+++ b/fs/autofs4/inode.c
@@ -19,6 +19,7 @@
 #include <linux/parser.h>
 #include <linux/bitops.h>
 #include <linux/magic.h>
+#include <linux/compat.h>
 #include "autofs_i.h"
 #include <linux/module.h>
 
@@ -224,6 +225,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
         set_autofs_type_indirect(&sbi->type);
         sbi->min_proto = 0;
         sbi->max_proto = 0;
+        sbi->compat_daemon = is_compat_task();
         mutex_init(&sbi->wq_mutex);
         mutex_init(&sbi->pipe_mutex);
         spin_lock_init(&sbi->fs_lock);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index da8876d38a7b..9c098db43344 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -91,7 +91,24 @@ static int autofs4_write(struct autofs_sb_info *sbi,
 
         return (bytes > 0);
 }
-        
+
+/*
+ * The autofs_v5 packet was misdesigned.
+ *
+ * The packets are identical on x86-32 and x86-64, but have different
+ * alignment. Which means that 'sizeof()' will give different results.
+ * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
+ */
+static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
+{
+        size_t pktsz = sizeof(struct autofs_v5_packet);
+#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
+        if (sbi->compat_daemon > 0)
+                pktsz -= 4;
+#endif
+        return pktsz;
+}
+
 static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                                  struct autofs_wait_queue *wq,
                                  int type)
@@ -155,8 +172,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
         {
                 struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
 
-                pktsz = sizeof(*packet);
-
+                pktsz = autofs_v5_packet_size(sbi);
                 packet->wait_queue_token = wq->wait_queue_token;
                 packet->len = wq->name.len;
                 memcpy(packet->name, wq->name.name, wq->name.len);
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index a6395bdb26ae..1ff94054d35a 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -259,6 +259,13 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         current->mm->free_area_cache = current->mm->mmap_base;
         current->mm->cached_hole_size = 0;
 
+        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
+        if (retval < 0) {
+                /* Someone check-me: is this error path enough? */
+                send_sig(SIGKILL, current, 0);
+                return retval;
+        }
+
         install_exec_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 
@@ -352,13 +359,6 @@ beyond_if:
                 return retval;
         }
 
-        retval = setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
-        if (retval < 0) { 
-                /* Someone check-me: is this error path enough? */ 
-                send_sig(SIGKILL, current, 0); 
-                return retval;
-        }
-
         current->mm->start_stack =
                 (unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
 #ifdef __alpha__
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index bcb884e2d613..07d096c49920 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1421,7 +1421,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
         for (i = 1; i < view->n; ++i) {
                 const struct user_regset *regset = &view->regsets[i];
                 do_thread_regset_writeback(t->task, regset);
-                if (regset->core_note_type &&
+                if (regset->core_note_type && regset->get &&
                     (!regset->active || regset->active(t->task, regset))) {
                         int ret;
                         size_t size = regset->n * regset->size;
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 633c701a287d..0436c12da8c2 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -583,7 +583,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
         struct btrfs_path *path;
         struct btrfs_key info_key = { 0 };
         struct btrfs_delayed_ref_root *delayed_refs = NULL;
-        struct btrfs_delayed_ref_head *head = NULL;
+        struct btrfs_delayed_ref_head *head;
         int info_level = 0;
         int ret;
         struct list_head prefs_delayed;
@@ -607,6 +607,8 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
          * at a specified point in time
          */
 again:
+        head = NULL;
+
         ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0);
         if (ret < 0)
                 goto out;
@@ -635,8 +637,10 @@ again:
                         goto again;
                 }
                 ret = __add_delayed_refs(head, seq, &info_key, &prefs_delayed);
-                if (ret)
+                if (ret) {
+                        spin_unlock(&delayed_refs->lock);
                         goto out;
+                }
         }
         spin_unlock(&delayed_refs->lock);
 
@@ -892,6 +896,8 @@ static char *iref_to_path(struct btrfs_root *fs_root, struct btrfs_path *path,
                 if (eb != eb_in)
                         free_extent_buffer(eb);
                 ret = inode_ref_info(parent, 0, fs_root, path, &found_key);
+                if (ret > 0)
+                        ret = -ENOENT;
                 if (ret)
                         break;
                 next_inum = found_key.offset;
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index b669a7d8e499..d986824bb2b4 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -644,7 +644,7 @@ static struct btrfsic_dev_state *btrfsic_dev_state_hashtable_lookup(
 static int btrfsic_process_superblock(struct btrfsic_state *state,
                                       struct btrfs_fs_devices *fs_devices)
 {
-        int ret;
+        int ret = 0;
         struct btrfs_super_block *selected_super;
         struct list_head *dev_head = &fs_devices->devices;
         struct btrfs_device *device;
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index 14f1c5a0b2d2..d02c27cd14c7 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -588,6 +588,8 @@ int btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,
                                    page_offset(bio->bi_io_vec->bv_page),
                                    PAGE_CACHE_SIZE);
         read_unlock(&em_tree->lock);
+        if (!em)
+                return -EIO;
 
         compressed_len = em->block_len;
         cb = kmalloc(compressed_bio_size(root, compressed_len), GFP_NOFS);
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 27ebe61d3ccc..80b6486fd5e6 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -886,7 +886,7 @@ struct btrfs_block_rsv {
         u64 reserved;
         struct btrfs_space_info *space_info;
         spinlock_t lock;
-        unsigned int full:1;
+        unsigned int full;
 };
 
 /*
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 811d9f918b1c..534266fe505f 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2260,6 +2260,12 @@ int open_ctree(struct super_block *sb,
                 goto fail_sb_buffer;
         }
 
+        if (sectorsize < PAGE_SIZE) {
+                printk(KERN_WARNING "btrfs: Incompatible sector size "
+                       "found on %s\n", sb->s_id);
+                goto fail_sb_buffer;
+        }
+
         mutex_lock(&fs_info->chunk_mutex);
         ret = btrfs_read_sys_array(tree_root);
         mutex_unlock(&fs_info->chunk_mutex);
@@ -2301,6 +2307,12 @@ int open_ctree(struct super_block *sb,
 
         btrfs_close_extra_devices(fs_devices);
 
+        if (!fs_devices->latest_bdev) {
+                printk(KERN_CRIT "btrfs: failed to read devices on %s\n",
+                       sb->s_id);
+                goto fail_tree_roots;
+        }
+
 retry_root_backup:
         blocksize = btrfs_level_size(tree_root,
                                      btrfs_super_root_level(disk_super));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 283af7a676a3..37e0a800d34e 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3312,7 +3312,8 @@ commit_trans:
         }
         data_sinfo->bytes_may_use += bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 1);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 1);
         spin_unlock(&data_sinfo->lock);
 
         return 0;
@@ -3333,7 +3334,8 @@ void btrfs_free_reserved_data_space(struct inode *inode, u64 bytes)
         spin_lock(&data_sinfo->lock);
         data_sinfo->bytes_may_use -= bytes;
         trace_btrfs_space_reservation(root->fs_info, "space_info",
-                                      (u64)data_sinfo, bytes, 0);
+                                      (u64)(unsigned long)data_sinfo,
+                                      bytes, 0);
         spin_unlock(&data_sinfo->lock);
 }
 
@@ -3611,12 +3613,15 @@ static int may_commit_transaction(struct btrfs_root *root,
         if (space_info != delayed_rsv->space_info)
                 return -ENOSPC;
 
+        spin_lock(&space_info->lock);
         spin_lock(&delayed_rsv->lock);
-        if (delayed_rsv->size < bytes) {
+        if (space_info->bytes_pinned + delayed_rsv->size < bytes) {
                 spin_unlock(&delayed_rsv->lock);
+                spin_unlock(&space_info->lock);
                 return -ENOSPC;
         }
         spin_unlock(&delayed_rsv->lock);
+        spin_unlock(&space_info->lock);
 
 commit:
         trans = btrfs_join_transaction(root);
@@ -3695,9 +3700,9 @@ again:
                 if (used + orig_bytes <= space_info->total_bytes) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         /*
@@ -3766,9 +3771,9 @@ again:
                 if (used + num_bytes < space_info->total_bytes + avail) {
                         space_info->bytes_may_use += orig_bytes;
                         trace_btrfs_space_reservation(root->fs_info,
-                                                      "space_info",
-                                                      (u64)space_info,
-                                                      orig_bytes, 1);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              orig_bytes, 1);
                         ret = 0;
                 } else {
                         wait_ordered = true;
@@ -3913,8 +3918,8 @@ static void block_rsv_release_bytes(struct btrfs_fs_info *fs_info,
                         spin_lock(&space_info->lock);
                         space_info->bytes_may_use -= num_bytes;
                         trace_btrfs_space_reservation(fs_info, "space_info",
-                                                      (u64)space_info,
-                                                      num_bytes, 0);
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                         space_info->reservation_progress++;
                         spin_unlock(&space_info->lock);
                 }
@@ -4105,7 +4110,7 @@ static u64 calc_global_metadata_size(struct btrfs_fs_info *fs_info)
         num_bytes += div64_u64(data_used + meta_used, 50);
 
         if (num_bytes * 3 > meta_used)
-                num_bytes = div64_u64(meta_used, 3);
+                num_bytes = div64_u64(meta_used, 3) * 2;
 
         return ALIGN(num_bytes, fs_info->extent_root->leafsize << 10);
 }
@@ -4132,14 +4137,14 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
                 block_rsv->reserved += num_bytes;
                 sinfo->bytes_may_use += num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 1);
+                                      (u64)(unsigned long)sinfo, num_bytes, 1);
         }
 
         if (block_rsv->reserved >= block_rsv->size) {
                 num_bytes = block_rsv->reserved - block_rsv->size;
                 sinfo->bytes_may_use -= num_bytes;
                 trace_btrfs_space_reservation(fs_info, "space_info",
-                                              (u64)sinfo, num_bytes, 0);
+                                      (u64)(unsigned long)sinfo, num_bytes, 0);
                 sinfo->reservation_progress++;
                 block_rsv->reserved = block_rsv->size;
                 block_rsv->full = 1;
@@ -4192,7 +4197,8 @@ void btrfs_trans_release_metadata(struct btrfs_trans_handle *trans,
         if (!trans->bytes_reserved)
                 return;
 
-        trace_btrfs_space_reservation(root->fs_info, "transaction", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "transaction",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
         trans->bytes_reserved = 0;
@@ -4710,9 +4716,9 @@ static int btrfs_update_reserved_bytes(struct btrfs_block_group_cache *cache,
                         space_info->bytes_reserved += num_bytes;
                         if (reserve == RESERVE_ALLOC) {
                                 trace_btrfs_space_reservation(cache->fs_info,
-                                                              "space_info",
-                                                              (u64)space_info,
-                                                              num_bytes, 0);
+                                              "space_info",
+                                              (u64)(unsigned long)space_info,
+                                              num_bytes, 0);
                                 space_info->bytes_may_use -= num_bytes;
                         }
                 }
@@ -7886,9 +7892,16 @@ int btrfs_trim_fs(struct btrfs_root *root, struct fstrim_range *range)
         u64 start;
         u64 end;
         u64 trimmed = 0;
+        u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
         int ret = 0;
 
-        cache = btrfs_lookup_block_group(fs_info, range->start);
+        /*
+         * try to trim all FS space, our block group may start from non-zero.
+         */
+        if (range->len == total_bytes)
+                cache = btrfs_lookup_first_block_group(fs_info, range->start);
+        else
+                cache = btrfs_lookup_block_group(fs_info, range->start);
 
         while (cache) {
                 if (cache->key.objectid >= (range->start + range->len)) {
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index fcf77e1ded40..a55fbe6252de 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -513,6 +513,15 @@ hit_next:
         WARN_ON(state->end < start);
         last_end = state->end;
 
+        if (state->end < end && !need_resched())
+                next_node = rb_next(&state->rb_node);
+        else
+                next_node = NULL;
+
+        /* the state doesn't have the wanted bits, go ahead */
+        if (!(state->state & bits))
+                goto next;
+
         /*
          *     | ---- desired range ---- |
          *  | state | or
@@ -565,20 +574,15 @@ hit_next:
                 goto out;
         }
 
-        if (state->end < end && prealloc && !need_resched())
-                next_node = rb_next(&state->rb_node);
-        else
-                next_node = NULL;
-
         set |= clear_state_bit(tree, state, &bits, wake);
+next:
         if (last_end == (u64)-1)
                 goto out;
         start = last_end + 1;
         if (start <= end && next_node) {
                 state = rb_entry(next_node, struct extent_state,
                                  rb_node);
-                if (state->start == start)
-                        goto hit_next;
+                goto hit_next;
         }
         goto search_again;
 
@@ -961,8 +965,6 @@ hit_next:
 
                 set_state_bits(tree, state, &bits);
                 clear_state_bit(tree, state, &clear_bits, 0);
-
-                merge_state(tree, state);
                 if (last_end == (u64)-1)
                         goto out;
 
@@ -1007,7 +1009,6 @@ hit_next:
                 if (state->end <= end) {
                         set_state_bits(tree, state, &bits);
                         clear_state_bit(tree, state, &clear_bits, 0);
-                        merge_state(tree, state);
                         if (last_end == (u64)-1)
                                 goto out;
                         start = last_end + 1;
@@ -1068,8 +1069,6 @@ hit_next:
 
                 set_state_bits(tree, prealloc, &bits);
                 clear_state_bit(tree, prealloc, &clear_bits, 0);
-
-                merge_state(tree, prealloc);
                 prealloc = NULL;
                 goto out;
         }
@@ -2154,13 +2153,46 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
                  "this_mirror=%d, num_copies=%d, in_validation=%d\n", read_mode,
                  failrec->this_mirror, num_copies, failrec->in_validation);
 
-        tree->ops->submit_bio_hook(inode, read_mode, bio, failrec->this_mirror,
-                                        failrec->bio_flags, 0);
-        return 0;
+        ret = tree->ops->submit_bio_hook(inode, read_mode, bio,
+                                         failrec->this_mirror,
+                                         failrec->bio_flags, 0);
+        return ret;
 }
 
 /* lots and lots of room for performance fixes in the end_bio funcs */
 
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+{
+        int uptodate = (err == 0);
+        struct extent_io_tree *tree;
+        int ret;
+
+        tree = &BTRFS_I(page->mapping->host)->io_tree;
+
+        if (tree->ops && tree->ops->writepage_end_io_hook) {
+                ret = tree->ops->writepage_end_io_hook(page, start,
+                                               end, NULL, uptodate);
+                if (ret)
+                        uptodate = 0;
+        }
+
+        if (!uptodate && tree->ops &&
+            tree->ops->writepage_io_failed_hook) {
+                ret = tree->ops->writepage_io_failed_hook(NULL, page,
+                                                 start, end, NULL);
+                /* Writeback already completed */
+                if (ret == 0)
+                        return 1;
+        }
+
+        if (!uptodate) {
+                clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
+                ClearPageUptodate(page);
+                SetPageError(page);
+        }
+        return 0;
+}
+
 /*
  * after a writepage IO is done, we need to:
  * clear the uptodate bits on error
@@ -2172,13 +2204,11 @@ static int bio_readpage_error(struct bio *failed_bio, struct page *page,
  */
 static void end_bio_extent_writepage(struct bio *bio, int err)
 {
-        int uptodate = err == 0;
         struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
         struct extent_io_tree *tree;
         u64 start;
         u64 end;
         int whole_page;
-        int ret;
 
         do {
                 struct page *page = bvec->bv_page;
@@ -2195,28 +2225,9 @@ static void end_bio_extent_writepage(struct bio *bio, int err)
 
                 if (--bvec >= bio->bi_io_vec)
                         prefetchw(&bvec->bv_page->flags);
-                if (tree->ops && tree->ops->writepage_end_io_hook) {
-                        ret = tree->ops->writepage_end_io_hook(page, start,
-                                                       end, NULL, uptodate);
-                        if (ret)
-                                uptodate = 0;
-                }
-
-                if (!uptodate && tree->ops &&
-                    tree->ops->writepage_io_failed_hook) {
-                        ret = tree->ops->writepage_io_failed_hook(bio, page,
-                                                         start, end, NULL);
-                        if (ret == 0) {
-                                uptodate = (err == 0);
-                                continue;
-                        }
-                }
 
-                if (!uptodate) {
-                        clear_extent_uptodate(tree, start, end, NULL, GFP_NOFS);
-                        ClearPageUptodate(page);
-                        SetPageError(page);
-                }
+                if (end_extent_writepage(page, err, start, end))
+                        continue;
 
                 if (whole_page)
                         end_page_writeback(page);
@@ -2779,9 +2790,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
                                 delalloc_start = delalloc_end + 1;
                                 continue;
                         }
-                        tree->ops->fill_delalloc(inode, page, delalloc_start,
-                                                 delalloc_end, &page_started,
-                                                 &nr_written);
+                        ret = tree->ops->fill_delalloc(inode, page,
+                                                       delalloc_start,
+                                                       delalloc_end,
+                                                       &page_started,
+                                                       &nr_written);
+                        BUG_ON(ret);
                         /*
                          * delalloc_end is already one less than the total
                          * length, so we don't subtract one from
@@ -2818,8 +2832,12 @@ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
         if (tree->ops && tree->ops->writepage_start_hook) {
                 ret = tree->ops->writepage_start_hook(page, start,
                                                       page_end);
-                if (ret == -EAGAIN) {
-                        redirty_page_for_writepage(wbc, page);
+                if (ret) {
+                        /* Fixup worker will requeue */
+                        if (ret == -EBUSY)
+                                wbc->pages_skipped++;
+                        else
+                                redirty_page_for_writepage(wbc, page);
                         update_nr_written(page, wbc, nr_written);
                         unlock_page(page);
                         ret = 0;
@@ -3289,7 +3307,7 @@ int try_release_extent_mapping(struct extent_map_tree *map,
                         len = end - start + 1;
                         write_lock(&map->lock);
                         em = lookup_extent_mapping(map, start, len);
-                        if (IS_ERR_OR_NULL(em)) {
+                        if (!em) {
                                 write_unlock(&map->lock);
                                 break;
                         }
@@ -3853,10 +3871,9 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         num_pages = num_extent_pages(eb->start, eb->len);
         clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
-        if (eb_straddles_pages(eb)) {
-                clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
-                                      cached_state, GFP_NOFS);
-        }
+        clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
+                              cached_state, GFP_NOFS);
+
         for (i = 0; i < num_pages; i++) {
                 page = extent_buffer_page(eb, i);
                 if (page)
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index bc6a042cb6fc..cecc3518c121 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -319,4 +319,5 @@ struct btrfs_mapping_tree;
 int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                         u64 length, u64 logical, struct page *page,
                         int mirror_num);
+int end_extent_writepage(struct page *page, int err, u64 start, u64 end);
 #endif
diff --git a/fs/btrfs/extent_map.h b/fs/btrfs/extent_map.h
index 33a7890b1f40..1195f09761fe 100644
--- a/fs/btrfs/extent_map.h
+++ b/fs/btrfs/extent_map.h
@@ -26,8 +26,8 @@ struct extent_map {
         unsigned long flags;
         struct block_device *bdev;
         atomic_t refs;
-        unsigned int in_tree:1;
-        unsigned int compress_type:4;
+        unsigned int in_tree;
+        unsigned int compress_type;
 };
 
 struct extent_map_tree {
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 859ba2dd8890..e8d06b6b9194 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1605,6 +1605,14 @@ static long btrfs_fallocate(struct file *file, int mode,
                 return -EOPNOTSUPP;
 
         /*
+         * Make sure we have enough space before we do the
+         * allocation.
+         */
+        ret = btrfs_check_data_free_space(inode, len);
+        if (ret)
+                return ret;
+
+        /*
          * wait for ordered IO before we have any locks.  We'll loop again
          * below with the locks held.
          */
@@ -1667,27 +1675,12 @@ static long btrfs_fallocate(struct file *file, int mode,
                 if (em->block_start == EXTENT_MAP_HOLE ||
                     (cur_offset >= inode->i_size &&
                      !test_bit(EXTENT_FLAG_PREALLOC, &em->flags))) {
-
-                        /*
-                         * Make sure we have enough space before we do the
-                         * allocation.
-                         */
-                        ret = btrfs_check_data_free_space(inode, last_byte -
-                                                          cur_offset);
-                        if (ret) {
-                                free_extent_map(em);
-                                break;
-                        }
-
                         ret = btrfs_prealloc_file_range(inode, mode, cur_offset,
                                                         last_byte - cur_offset,
                                                         1 << inode->i_blkbits,
                                                         offset + len,
                                                         &alloc_hint);
 
-                        /* Let go of our reservation. */
-                        btrfs_free_reserved_data_space(inode, last_byte -
-                                                       cur_offset);
                         if (ret < 0) {
                                 free_extent_map(em);
                                 break;
@@ -1715,6 +1708,8 @@ static long btrfs_fallocate(struct file *file, int mode,
                              &cached_state, GFP_NOFS);
 out:
         mutex_unlock(&inode->i_mutex);
+        /* Let go of our reservation. */
+        btrfs_free_reserved_data_space(inode, len);
         return ret;
 }
 
@@ -1761,7 +1756,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
                                                      start - root->sectorsize,
                                                      root->sectorsize, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         goto out;
                 }
                 last_end = em->start + em->len;
@@ -1773,7 +1768,7 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int origin)
         while (1) {
                 em = btrfs_get_extent_fiemap(inode, NULL, 0, start, len, 0);
                 if (IS_ERR(em)) {
-                        ret = -ENXIO;
+                        ret = PTR_ERR(em);
                         break;
                 }
 
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c2f20594c9f7..710ea380c7ed 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -777,6 +777,7 @@ int load_free_space_cache(struct btrfs_fs_info *fs_info,
         spin_lock(&block_group->lock);
         if (block_group->disk_cache_state != BTRFS_DC_WRITTEN) {
                 spin_unlock(&block_group->lock);
+                btrfs_free_path(path);
                 goto out;
         }
         spin_unlock(&block_group->lock);
diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
index 213ffa86ce1b..ee15d88b33d2 100644
--- a/fs/btrfs/inode-map.c
+++ b/fs/btrfs/inode-map.c
@@ -438,7 +438,8 @@ int btrfs_save_ino_cache(struct btrfs_root *root,
                                           trans->bytes_reserved);
         if (ret)
                 goto out;
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 1);
 again:
         inode = lookup_free_ino_inode(root, path);
@@ -500,7 +501,8 @@ again:
 out_put:
         iput(inode);
 out_release:
-        trace_btrfs_space_reservation(root->fs_info, "ino_cache", (u64)trans,
+        trace_btrfs_space_reservation(root->fs_info, "ino_cache",
+                                      (u64)(unsigned long)trans,
                                       trans->bytes_reserved, 0);
         btrfs_block_rsv_release(root, trans->block_rsv, trans->bytes_reserved);
 out:
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 32214fe0f7e3..892b34785ccc 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -1555,6 +1555,7 @@ static void btrfs_writepage_fixup_worker(struct btrfs_work *work)
         struct inode *inode;
         u64 page_start;
         u64 page_end;
+        int ret;
 
         fixup = container_of(work, struct btrfs_writepage_fixup, work);
         page = fixup->page;
@@ -1582,12 +1583,21 @@ again:
                                      page_end, &cached_state, GFP_NOFS);
                 unlock_page(page);
                 btrfs_start_ordered_extent(inode, ordered, 1);
+                btrfs_put_ordered_extent(ordered);
                 goto again;
         }
 
-        BUG();
+        ret = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
+        if (ret) {
+                mapping_set_error(page->mapping, ret);
+                end_extent_writepage(page, ret, page_start, page_end);
+                ClearPageChecked(page);
+                goto out;
+         }
+
         btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state);
         ClearPageChecked(page);
+        set_page_dirty(page);
 out:
         unlock_extent_cached(&BTRFS_I(inode)->io_tree, page_start, page_end,
                              &cached_state, GFP_NOFS);
@@ -1630,7 +1640,7 @@ static int btrfs_writepage_start_hook(struct page *page, u64 start, u64 end)
         fixup->work.func = btrfs_writepage_fixup_worker;
         fixup->page = page;
         btrfs_queue_worker(&root->fs_info->fixup_workers, &fixup->work);
-        return -EAGAIN;
+        return -EBUSY;
 }
 
 static int insert_reserved_file_extent(struct btrfs_trans_handle *trans,
@@ -4575,7 +4585,8 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_insert_dir_item(trans, root, name, name_len,
                                             parent_inode, &key,
                                             btrfs_inode_type(inode), index);
-                BUG_ON(ret);
+                if (ret)
+                        goto fail_dir_item;
 
                 btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                    name_len * 2);
@@ -4583,6 +4594,23 @@ int btrfs_add_link(struct btrfs_trans_handle *trans,
                 ret = btrfs_update_inode(trans, root, parent_inode);
         }
         return ret;
+
+fail_dir_item:
+        if (unlikely(ino == BTRFS_FIRST_FREE_OBJECTID)) {
+                u64 local_index;
+                int err;
+                err = btrfs_del_root_ref(trans, root->fs_info->tree_root,
+                                 key.objectid, root->root_key.objectid,
+                                 parent_ino, &local_index, name, name_len);
+
+        } else if (add_backref) {
+                u64 local_index;
+                int err;
+
+                err = btrfs_del_inode_ref(trans, root, name, name_len,
+                                          ino, parent_ino, &local_index);
+        }
+        return ret;
 }
 
 static int btrfs_add_nondir(struct btrfs_trans_handle *trans,
@@ -6696,8 +6724,10 @@ int btrfs_create_subvol_root(struct btrfs_trans_handle *trans,
         int err;
         u64 index = 0;
 
-        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2, new_dirid,
-                                new_dirid, S_IFDIR | 0700, &index);
+        inode = btrfs_new_inode(trans, new_root, NULL, "..", 2,
+                                new_dirid, new_dirid,
+                                S_IFDIR | (~current_umask() & S_IRWXUGO),
+                                &index);
         if (IS_ERR(inode))
                 return PTR_ERR(inode);
         inode->i_op = &btrfs_dir_inode_operations;
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 03bb62a9ee24..d8b54715c2de 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -861,6 +861,7 @@ static int cluster_pages_for_defrag(struct inode *inode,
         int i_done;
         struct btrfs_ordered_extent *ordered;
         struct extent_state *cached_state = NULL;
+        struct extent_io_tree *tree;
         gfp_t mask = btrfs_alloc_write_mask(inode->i_mapping);
 
         if (isize == 0)
@@ -871,18 +872,34 @@ static int cluster_pages_for_defrag(struct inode *inode,
                                            num_pages << PAGE_CACHE_SHIFT);
         if (ret)
                 return ret;
-again:
-        ret = 0;
         i_done = 0;
+        tree = &BTRFS_I(inode)->io_tree;
 
         /* step one, lock all the pages */
         for (i = 0; i < num_pages; i++) {
                 struct page *page;
+again:
                 page = find_or_create_page(inode->i_mapping,
-                                            start_index + i, mask);
+                                           start_index + i, mask);
                 if (!page)
                         break;
 
+                page_start = page_offset(page);
+                page_end = page_start + PAGE_CACHE_SIZE - 1;
+                while (1) {
+                        lock_extent(tree, page_start, page_end, GFP_NOFS);
+                        ordered = btrfs_lookup_ordered_extent(inode,
+                                                              page_start);
+                        unlock_extent(tree, page_start, page_end, GFP_NOFS);
+                        if (!ordered)
+                                break;
+
+                        unlock_page(page);
+                        btrfs_start_ordered_extent(inode, ordered, 1);
+                        btrfs_put_ordered_extent(ordered);
+                        lock_page(page);
+                }
+
                 if (!PageUptodate(page)) {
                         btrfs_readpage(NULL, page);
                         lock_page(page);
@@ -893,15 +910,22 @@ again:
                                 break;
                         }
                 }
+
                 isize = i_size_read(inode);
                 file_end = (isize - 1) >> PAGE_CACHE_SHIFT;
-                if (!isize || page->index > file_end ||
-                    page->mapping != inode->i_mapping) {
+                if (!isize || page->index > file_end) {
                         /* whoops, we blew past eof, skip this page */
                         unlock_page(page);
                         page_cache_release(page);
                         break;
                 }
+
+                if (page->mapping != inode->i_mapping) {
+                        unlock_page(page);
+                        page_cache_release(page);
+                        goto again;
+                }
+
                 pages[i] = page;
                 i_done++;
         }
@@ -924,25 +948,6 @@ again:
         lock_extent_bits(&BTRFS_I(inode)->io_tree,
                          page_start, page_end - 1, 0, &cached_state,
                          GFP_NOFS);
-        ordered = btrfs_lookup_first_ordered_extent(inode, page_end - 1);
-        if (ordered &&
-            ordered->file_offset + ordered->len > page_start &&
-            ordered->file_offset < page_end) {
-                btrfs_put_ordered_extent(ordered);
-                unlock_extent_cached(&BTRFS_I(inode)->io_tree,
-                                     page_start, page_end - 1,
-                                     &cached_state, GFP_NOFS);
-                for (i = 0; i < i_done; i++) {
-                        unlock_page(pages[i]);
-                        page_cache_release(pages[i]);
-                }
-                btrfs_wait_ordered_range(inode, page_start,
-                                         page_end - page_start);
-                goto again;
-        }
-        if (ordered)
-                btrfs_put_ordered_extent(ordered);
-
         clear_extent_bit(&BTRFS_I(inode)->io_tree, page_start,
                           page_end - 1, EXTENT_DIRTY | EXTENT_DELALLOC |
                           EXTENT_DO_ACCOUNTING, 0, 0, &cached_state,
@@ -1327,6 +1332,12 @@ static noinline int btrfs_ioctl_snap_create_transid(struct file *file,
                 goto out;
         }
 
+        if (name[0] == '.' &&
+           (namelen == 1 || (name[1] == '.' && namelen == 2))) {
+                ret = -EEXIST;
+                goto out;
+        }
+
         if (subvol) {
                 ret = btrfs_mksubvol(&file->f_path, name, namelen,
                                      NULL, transid, readonly);
diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
index 2373b39a132b..22db04550f6a 100644
--- a/fs/btrfs/reada.c
+++ b/fs/btrfs/reada.c
@@ -305,7 +305,7 @@ again:
 
         spin_lock(&fs_info->reada_lock);
         ret = radix_tree_insert(&dev->reada_zones,
-                                (unsigned long)zone->end >> PAGE_CACHE_SHIFT,
+                                (unsigned long)(zone->end >> PAGE_CACHE_SHIFT),
                                 zone);
         spin_unlock(&fs_info->reada_lock);
 
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index 9770cc5bfb76..abc0fbffa510 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -1367,7 +1367,8 @@ out:
 }
 
 static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
-        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length)
+        u64 chunk_tree, u64 chunk_objectid, u64 chunk_offset, u64 length,
+        u64 dev_offset)
 {
         struct btrfs_mapping_tree *map_tree =
                 &sdev->dev->dev_root->fs_info->mapping_tree;
@@ -1391,7 +1392,8 @@ static noinline_for_stack int scrub_chunk(struct scrub_dev *sdev,
                 goto out;
 
         for (i = 0; i < map->num_stripes; ++i) {
-                if (map->stripes[i].dev == sdev->dev) {
+                if (map->stripes[i].dev == sdev->dev &&
+                    map->stripes[i].physical == dev_offset) {
                         ret = scrub_stripe(sdev, map, i, chunk_offset, length);
                         if (ret)
                                 goto out;
@@ -1487,7 +1489,7 @@ int scrub_enumerate_chunks(struct scrub_dev *sdev, u64 start, u64 end)
                         break;
                 }
                 ret = scrub_chunk(sdev, chunk_tree, chunk_objectid,
-                                  chunk_offset, length);
+                                  chunk_offset, length, found_key.offset);
                 btrfs_put_block_group(cache);
                 if (ret)
                         break;
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 287a6728b1ad..04b77e3ceb7a 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -327,7 +327,8 @@ again:
 
         if (num_bytes) {
                 trace_btrfs_space_reservation(root->fs_info, "transaction",
-                                              (u64)h, num_bytes, 1);
+                                              (u64)(unsigned long)h,
+                                              num_bytes, 1);
                 h->block_rsv = &root->fs_info->trans_block_rsv;
                 h->bytes_reserved = num_bytes;
         }
@@ -915,7 +916,11 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
                                 dentry->d_name.name, dentry->d_name.len,
                                 parent_inode, &key,
                                 BTRFS_FT_DIR, index);
-        BUG_ON(ret);
+        if (ret) {
+                pending->error = -EEXIST;
+                dput(parent);
+                goto fail;
+        }
 
         btrfs_i_size_write(parent_inode, parent_inode->i_size +
                                          dentry->d_name.len * 2);
@@ -993,12 +998,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
         struct btrfs_pending_snapshot *pending;
         struct list_head *head = &trans->transaction->pending_snapshots;
-        int ret;
 
-        list_for_each_entry(pending, head, list) {
-                ret = create_pending_snapshot(trans, fs_info, pending);
-                BUG_ON(ret);
-        }
+        list_for_each_entry(pending, head, list)
+                create_pending_snapshot(trans, fs_info, pending);
         return 0;
 }
 
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 0b4e2af7954d..ef41f285a475 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -459,12 +459,23 @@ int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
         struct btrfs_device *device, *next;
 
+        struct block_device *latest_bdev = NULL;
+        u64 latest_devid = 0;
+        u64 latest_transid = 0;
+
         mutex_lock(&uuid_mutex);
 again:
         /* This is the initialized path, it is safe to release the devices. */
         list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
-                if (device->in_fs_metadata)
+                if (device->in_fs_metadata) {
+                        if (!latest_transid ||
+                            device->generation > latest_transid) {
+                                latest_devid = device->devid;
+                                latest_transid = device->generation;
+                                latest_bdev = device->bdev;
+                        }
                         continue;
+                }
 
                 if (device->bdev) {
                         blkdev_put(device->bdev, device->mode);
@@ -487,6 +498,10 @@ again:
                 goto again;
         }
 
+        fs_devices->latest_bdev = latest_bdev;
+        fs_devices->latest_devid = latest_devid;
+        fs_devices->latest_trans = latest_transid;
+
         mutex_unlock(&uuid_mutex);
         return 0;
 }
@@ -1953,7 +1968,7 @@ static int btrfs_relocate_chunk(struct btrfs_root *root,
         em = lookup_extent_mapping(em_tree, chunk_offset, 1);
         read_unlock(&em_tree->lock);
 
-        BUG_ON(em->start > chunk_offset ||
+        BUG_ON(!em || em->start > chunk_offset ||
                em->start + em->len < chunk_offset);
         map = (struct map_lookup *)em->bdev;
 
@@ -4356,6 +4371,20 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                 return -ENOMEM;
         btrfs_set_buffer_uptodate(sb);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
+        /*
+         * The sb extent buffer is artifical and just used to read the system array.
+         * btrfs_set_buffer_uptodate() call does not properly mark all it's
+         * pages up-to-date when the page is larger: extent does not cover the
+         * whole page and consequently check_page_uptodate does not find all
+         * the page's extents up-to-date (the hole beyond sb),
+         * write_extent_buffer then triggers a WARN_ON.
+         *
+         * Regular short extents go through mark_extent_buffer_dirty/writeback cycle,
+         * but sb spans only this function. Add an explicit SetPageUptodate call
+         * to silence the warning eg. on PowerPC 64.
+         */
+        if (PAGE_CACHE_SIZE > BTRFS_SUPER_INFO_SIZE)
+                SetPageUptodate(sb->first_page);
 
         write_extent_buffer(sb, super_copy, 0, BTRFS_SUPER_INFO_SIZE);
         array_size = btrfs_super_sys_array_size(super_copy);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 63a196b97d50..bc7e24420ac0 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -584,10 +584,26 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
                          * If either that or op not supported returned, follow
                          * the normal lookup.
                          */
-                        if ((rc == 0) || (rc == -ENOENT))
+                        switch (rc) {
+                        case 0:
+                                /*
+                                 * The server may allow us to open things like
+                                 * FIFOs, but the client isn't set up to deal
+                                 * with that. If it's not a regular file, just
+                                 * close it and proceed as if it were a normal
+                                 * lookup.
+                                 */
+                                if (newInode && !S_ISREG(newInode->i_mode)) {
+                                        CIFSSMBClose(xid, pTcon, fileHandle);
+                                        break;
+                                }
+                        case -ENOENT:
                                 posix_open = true;
-                        else if ((rc == -EINVAL) || (rc != -EOPNOTSUPP))
+                        case -EOPNOTSUPP:
+                                break;
+                        default:
                                 pTcon->broken_posix_open = true;
+                        }
                 }
                 if (!posix_open)
                         rc = cifs_get_inode_info_unix(&newInode, full_path,
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index a5f54b7d9822..745da3d0653e 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -534,6 +534,11 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
         if (fattr->cf_cifsattrs & ATTR_DIRECTORY) {
                 fattr->cf_mode = S_IFDIR | cifs_sb->mnt_dir_mode;
                 fattr->cf_dtype = DT_DIR;
+                /*
+                 * Server can return wrong NumberOfLinks value for directories
+                 * when Unix extensions are disabled - fake it.
+                 */
+                fattr->cf_nlink = 2;
         } else {
                 fattr->cf_mode = S_IFREG | cifs_sb->mnt_file_mode;
                 fattr->cf_dtype = DT_REG;
@@ -541,9 +546,9 @@ cifs_all_info_to_fattr(struct cifs_fattr *fattr, FILE_ALL_INFO *info,
                 /* clear write bits if ATTR_READONLY is set */
                 if (fattr->cf_cifsattrs & ATTR_READONLY)
                         fattr->cf_mode &= ~(S_IWUGO);
-        }
 
-        fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+                fattr->cf_nlink = le32_to_cpu(info->NumberOfLinks);
+        }
 
         fattr->cf_uid = cifs_sb->mnt_uid;
         fattr->cf_gid = cifs_sb->mnt_gid;
@@ -1322,7 +1327,6 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)
                         }
 /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need
         to set uid/gid */
-                        inc_nlink(inode);
 
                         cifs_unix_basic_to_fattr(&fattr, pInfo, cifs_sb);
                         cifs_fill_uniqueid(inode->i_sb, &fattr);
@@ -1355,7 +1359,6 @@ mkdir_retry_old:
                 d_drop(direntry);
         } else {
 mkdir_get_info:
-                inc_nlink(inode);
                 if (pTcon->unix_ext)
                         rc = cifs_get_inode_info_unix(&newinode, full_path,
                                                       inode->i_sb, xid);
@@ -1436,6 +1439,11 @@ mkdir_get_info:
                 }
         }
 mkdir_out:
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        CIFS_I(inode)->time = 0;
         kfree(full_path);
         FreeXid(xid);
         cifs_put_tlink(tlink);
@@ -1475,7 +1483,6 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         cifs_put_tlink(tlink);
 
         if (!rc) {
-                drop_nlink(inode);
                 spin_lock(&direntry->d_inode->i_lock);
                 i_size_write(direntry->d_inode, 0);
                 clear_nlink(direntry->d_inode);
@@ -1483,12 +1490,15 @@ int cifs_rmdir(struct inode *inode, struct dentry *direntry)
         }
 
         cifsInode = CIFS_I(direntry->d_inode);
-        cifsInode->time = 0;    /* force revalidate to go get info when
-                                   needed */
+        /* force revalidate to go get info when needed */
+        cifsInode->time = 0;
 
         cifsInode = CIFS_I(inode);
-        cifsInode->time = 0;    /* force revalidate to get parent dir info
-                                   since cached search results now invalid */
+        /*
+         * Force revalidate to get parent dir info when needed since cached
+         * attributes are invalid now.
+         */
+        cifsInode->time = 0;
 
         direntry->d_inode->i_ctime = inode->i_ctime = inode->i_mtime =
                 current_fs_time(inode->i_sb);
diff --git a/fs/compat.c b/fs/compat.c
index fa9d721ecfee..07880bae28a9 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -131,41 +131,35 @@ asmlinkage long compat_sys_utimes(const char __user *filename, struct compat_tim
 
 static int cp_compat_stat(struct kstat *stat, struct compat_stat __user *ubuf)
 {
-        compat_ino_t ino = stat->ino;
-        typeof(ubuf->st_uid) uid = 0;
-        typeof(ubuf->st_gid) gid = 0;
-        int err;
+        struct compat_stat tmp;
 
-        SET_UID(uid, stat->uid);
-        SET_GID(gid, stat->gid);
+        if (!old_valid_dev(stat->dev) || !old_valid_dev(stat->rdev))
+                return -EOVERFLOW;
 
-        if ((u64) stat->size > MAX_NON_LFS ||
-            !old_valid_dev(stat->dev) ||
-            !old_valid_dev(stat->rdev))
+        memset(&tmp, 0, sizeof(tmp));
+        tmp.st_dev = old_encode_dev(stat->dev);
+        tmp.st_ino = stat->ino;
+        if (sizeof(tmp.st_ino) < sizeof(stat->ino) && tmp.st_ino != stat->ino)
                 return -EOVERFLOW;
-        if (sizeof(ino) < sizeof(stat->ino) && ino != stat->ino)
+        tmp.st_mode = stat->mode;
+        tmp.st_nlink = stat->nlink;
+        if (tmp.st_nlink != stat->nlink)
                 return -EOVERFLOW;
-
-        if (clear_user(ubuf, sizeof(*ubuf)))
-                return -EFAULT;
-
-        err  = __put_user(old_encode_dev(stat->dev), &ubuf->st_dev);
-        err |= __put_user(ino, &ubuf->st_ino);
-        err |= __put_user(stat->mode, &ubuf->st_mode);
-        err |= __put_user(stat->nlink, &ubuf->st_nlink);
-        err |= __put_user(uid, &ubuf->st_uid);
-        err |= __put_user(gid, &ubuf->st_gid);
-        err |= __put_user(old_encode_dev(stat->rdev), &ubuf->st_rdev);
-        err |= __put_user(stat->size, &ubuf->st_size);
-        err |= __put_user(stat->atime.tv_sec, &ubuf->st_atime);
-        err |= __put_user(stat->atime.tv_nsec, &ubuf->st_atime_nsec);
-        err |= __put_user(stat->mtime.tv_sec, &ubuf->st_mtime);
-        err |= __put_user(stat->mtime.tv_nsec, &ubuf->st_mtime_nsec);
-        err |= __put_user(stat->ctime.tv_sec, &ubuf->st_ctime);
-        err |= __put_user(stat->ctime.tv_nsec, &ubuf->st_ctime_nsec);
-        err |= __put_user(stat->blksize, &ubuf->st_blksize);
-        err |= __put_user(stat->blocks, &ubuf->st_blocks);
-        return err;
+        SET_UID(tmp.st_uid, stat->uid);
+        SET_GID(tmp.st_gid, stat->gid);
+        tmp.st_rdev = old_encode_dev(stat->rdev);
+        if ((u64) stat->size > MAX_NON_LFS)
+                return -EOVERFLOW;
+        tmp.st_size = stat->size;
+        tmp.st_atime = stat->atime.tv_sec;
+        tmp.st_atime_nsec = stat->atime.tv_nsec;
+        tmp.st_mtime = stat->mtime.tv_sec;
+        tmp.st_mtime_nsec = stat->mtime.tv_nsec;
+        tmp.st_ctime = stat->ctime.tv_sec;
+        tmp.st_ctime_nsec = stat->ctime.tv_nsec;
+        tmp.st_blocks = stat->blocks;
+        tmp.st_blksize = stat->blksize;
+        return copy_to_user(ubuf, &tmp, sizeof(tmp)) ? -EFAULT : 0;
 }
 
 asmlinkage long compat_sys_newstat(const char __user * filename,
diff --git a/fs/dcache.c b/fs/dcache.c
index 16a53cc2cc02..bcbdb33fcc20 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -104,7 +104,7 @@ static unsigned int d_hash_shift __read_mostly;
 
 static struct hlist_bl_head *dentry_hashtable __read_mostly;
 
-static inline struct hlist_bl_head *d_hash(struct dentry *parent,
+static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
                                         unsigned long hash)
 {
         hash += ((unsigned long) parent ^ GOLDEN_RATIO_PRIME) / L1_CACHE_BYTES;
@@ -137,6 +137,26 @@ int proc_nr_dentry(ctl_table *table, int write, void __user *buffer,
 }
 #endif
 
+/*
+ * Compare 2 name strings, return 0 if they match, otherwise non-zero.
+ * The strings are both count bytes long, and count is non-zero.
+ */
+static inline int dentry_cmp(const unsigned char *cs, size_t scount,
+                                const unsigned char *ct, size_t tcount)
+{
+        if (scount != tcount)
+                return 1;
+
+        do {
+                if (*cs != *ct)
+                        return 1;
+                cs++;
+                ct++;
+                tcount--;
+        } while (tcount);
+        return 0;
+}
+
 static void __d_free(struct rcu_head *head)
 {
         struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
@@ -1717,8 +1737,9 @@ EXPORT_SYMBOL(d_add_ci);
  * child is looked up. Thus, an interlocking stepping of sequence lock checks
  * is formed, giving integrity down the path walk.
  */
-struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
-                                unsigned *seq, struct inode **inode)
+struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
+                                unsigned *seqp, struct inode **inode)
 {
         unsigned int len = name->len;
         unsigned int hash = name->hash;
@@ -1748,6 +1769,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
          * See Documentation/filesystems/path-lookup.txt for more details.
          */
         hlist_bl_for_each_entry_rcu(dentry, node, b, d_hash) {
+                unsigned seq;
                 struct inode *i;
                 const char *tname;
                 int tlen;
@@ -1756,7 +1778,7 @@ struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
                         continue;
 
 seqretry:
-                *seq = read_seqcount_begin(&dentry->d_seq);
+                seq = read_seqcount_begin(&dentry->d_seq);
                 if (dentry->d_parent != parent)
                         continue;
                 if (d_unhashed(dentry))
@@ -1771,7 +1793,7 @@ seqretry:
                  * edge of memory when walking. If we could load this
                  * atomically some other way, we could drop this check.
                  */
-                if (read_seqcount_retry(&dentry->d_seq, *seq))
+                if (read_seqcount_retry(&dentry->d_seq, seq))
                         goto seqretry;
                 if (unlikely(parent->d_flags & DCACHE_OP_COMPARE)) {
                         if (parent->d_op->d_compare(parent, *inode,
@@ -1788,6 +1810,7 @@ seqretry:
                  * order to do anything useful with the returned dentry
                  * anyway.
                  */
+                *seqp = seq;
                 *inode = i;
                 return dentry;
         }
@@ -2968,7 +2991,7 @@ __setup("dhash_entries=", set_dhash_entries);
 
 static void __init dcache_init_early(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* If hashes are distributed across NUMA nodes, defer
          * hash allocation until vmalloc space is available.
@@ -2986,13 +3009,13 @@ static void __init dcache_init_early(void)
                                         &d_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                 INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
 static void __init dcache_init(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* 
          * A constructor could be added for stable state like the lists,
@@ -3016,7 +3039,7 @@ static void __init dcache_init(void)
                                         &d_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << d_hash_shift); loop++)
+        for (loop = 0; loop < (1U << d_hash_shift); loop++)
                 INIT_HLIST_BL_HEAD(dentry_hashtable + loop);
 }
 
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 4a588dbd11bf..f4aadd15b613 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -173,7 +173,7 @@ void inode_dio_wait(struct inode *inode)
         if (atomic_read(&inode->i_dio_count))
                 __inode_dio_wait(inode);
 }
-EXPORT_SYMBOL_GPL(inode_dio_wait);
+EXPORT_SYMBOL(inode_dio_wait);
 
 /*
  * inode_dio_done - signal finish of a direct I/O requests
@@ -187,7 +187,7 @@ void inode_dio_done(struct inode *inode)
         if (atomic_dec_and_test(&inode->i_dio_count))
                 wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
 }
-EXPORT_SYMBOL_GPL(inode_dio_done);
+EXPORT_SYMBOL(inode_dio_done);
 
 /*
  * How many pages are in the queue?
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
index 349209dc6a91..3a06f4043df4 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -429,7 +429,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
                 goto memdup;
         } else if (count < MIN_MSG_PKT_SIZE || count > MAX_MSG_PKT_SIZE) {
                 printk(KERN_WARNING "%s: Acceptable packet size range is "
-                       "[%d-%lu], but amount of data written is [%zu].",
+                       "[%d-%zu], but amount of data written is [%zu].",
                        __func__, MIN_MSG_PKT_SIZE, MAX_MSG_PKT_SIZE, count);
                 return -EINVAL;
         }
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index aabdfc38cf24..ea54cdef04dd 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -320,6 +320,11 @@ static inline int ep_is_linked(struct list_head *p)
         return !list_empty(p);
 }
 
+static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_t *p)
+{
+        return container_of(p, struct eppoll_entry, wait);
+}
+
 /* Get the "struct epitem" from a wait queue pointer */
 static inline struct epitem *ep_item_from_wait(wait_queue_t *p)
 {
@@ -467,6 +472,18 @@ static void ep_poll_safewake(wait_queue_head_t *wq)
         put_cpu();
 }
 
+static void ep_remove_wait_queue(struct eppoll_entry *pwq)
+{
+        wait_queue_head_t *whead;
+
+        rcu_read_lock();
+        /* If it is cleared by POLLFREE, it should be rcu-safe */
+        whead = rcu_dereference(pwq->whead);
+        if (whead)
+                remove_wait_queue(whead, &pwq->wait);
+        rcu_read_unlock();
+}
+
 /*
  * This function unregisters poll callbacks from the associated file
  * descriptor.  Must be called with "mtx" held (or "epmutex" if called from
@@ -481,7 +498,7 @@ static void ep_unregister_pollwait(struct eventpoll *ep, struct epitem *epi)
                 pwq = list_first_entry(lsthead, struct eppoll_entry, llink);
 
                 list_del(&pwq->llink);
-                remove_wait_queue(pwq->whead, &pwq->wait);
+                ep_remove_wait_queue(pwq);
                 kmem_cache_free(pwq_cache, pwq);
         }
 }
@@ -842,6 +859,17 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k
         struct epitem *epi = ep_item_from_wait(wait);
         struct eventpoll *ep = epi->ep;
 
+        if ((unsigned long)key & POLLFREE) {
+                ep_pwq_from_wait(wait)->whead = NULL;
+                /*
+                 * whead = NULL above can race with ep_remove_wait_queue()
+                 * which can do another remove_wait_queue() after us, so we
+                 * can't use __remove_wait_queue(). whead->lock is held by
+                 * the caller.
+                 */
+                list_del_init(&wait->task_list);
+        }
+
         spin_lock_irqsave(&ep->lock, flags);
 
         /*
diff --git a/fs/exec.c b/fs/exec.c
index 92ce83a11e90..153dee14fe55 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1915,7 +1915,6 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
 {
         struct task_struct *tsk = current;
         struct mm_struct *mm = tsk->mm;
-        struct completion *vfork_done;
         int core_waiters = -EBUSY;
 
         init_completion(&core_state->startup);
@@ -1927,22 +1926,9 @@ static int coredump_wait(int exit_code, struct core_state *core_state)
                 core_waiters = zap_threads(tsk, mm, core_state, exit_code);
         up_write(&mm->mmap_sem);
 
-        if (unlikely(core_waiters < 0))
-                goto fail;
-
-        /*
-         * Make sure nobody is waiting for us to release the VM,
-         * otherwise we can deadlock when we wait on each other
-         */
-        vfork_done = tsk->vfork_done;
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
-
-        if (core_waiters)
+        if (core_waiters > 0)
                 wait_for_completion(&core_state->startup);
-fail:
+
         return core_waiters;
 }
 
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index 376816fcd040..351a3e797789 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -167,14 +167,19 @@ void gfs2_glock_add_to_lru(struct gfs2_glock *gl)
         spin_unlock(&lru_lock);
 }
 
-static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+static void __gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
 {
-        spin_lock(&lru_lock);
         if (!list_empty(&gl->gl_lru)) {
                 list_del_init(&gl->gl_lru);
                 atomic_dec(&lru_count);
                 clear_bit(GLF_LRU, &gl->gl_flags);
         }
+}
+
+static void gfs2_glock_remove_from_lru(struct gfs2_glock *gl)
+{
+        spin_lock(&lru_lock);
+        __gfs2_glock_remove_from_lru(gl);
         spin_unlock(&lru_lock);
 }
 
@@ -217,11 +222,12 @@ void gfs2_glock_put(struct gfs2_glock *gl)
         struct gfs2_sbd *sdp = gl->gl_sbd;
         struct address_space *mapping = gfs2_glock2aspace(gl);
 
-        if (atomic_dec_and_test(&gl->gl_ref)) {
+        if (atomic_dec_and_lock(&gl->gl_ref, &lru_lock)) {
+                __gfs2_glock_remove_from_lru(gl);
+                spin_unlock(&lru_lock);
                 spin_lock_bucket(gl->gl_hash);
                 hlist_bl_del_rcu(&gl->gl_list);
                 spin_unlock_bucket(gl->gl_hash);
-                gfs2_glock_remove_from_lru(gl);
                 GLOCK_BUG_ON(gl, !list_empty(&gl->gl_holders));
                 GLOCK_BUG_ON(gl, mapping && mapping->nrpages);
                 trace_gfs2_glock_put(gl);
diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c
index a7d611b93f0f..56987460cdae 100644
--- a/fs/gfs2/inode.c
+++ b/fs/gfs2/inode.c
@@ -391,10 +391,6 @@ static int alloc_dinode(struct gfs2_inode *dip, u64 *no_addr, u64 *generation)
         int error;
         int dblocks = 1;
 
-        error = gfs2_rindex_update(sdp);
-        if (error)
-                fs_warn(sdp, "rindex update returns %d\n", error);
-
         error = gfs2_inplace_reserve(dip, RES_DINODE);
         if (error)
                 goto out;
@@ -1043,6 +1039,7 @@ static int gfs2_unlink(struct inode *dir, struct dentry *dentry)
         rgd = gfs2_blk2rgrpd(sdp, ip->i_no_addr);
         if (!rgd)
                 goto out_inodes;
+
         gfs2_holder_init(rgd->rd_gl, LM_ST_EXCLUSIVE, 0, ghs + 2);
 
 
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 6aacf3f230a2..24f609c9ef91 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -800,6 +800,11 @@ static int init_inodes(struct gfs2_sbd *sdp, int undo)
                 fs_err(sdp, "can't get quota file inode: %d\n", error);
                 goto fail_rindex;
         }
+
+        error = gfs2_rindex_update(sdp);
+        if (error)
+                goto fail_qinode;
+
         return 0;
 
 fail_qinode:
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 981bfa32121a..49ada95209d0 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -683,16 +683,21 @@ int gfs2_rindex_update(struct gfs2_sbd *sdp)
         struct gfs2_glock *gl = ip->i_gl;
         struct gfs2_holder ri_gh;
         int error = 0;
+        int unlock_required = 0;
 
         /* Read new copy from disk if we don't have the latest */
         if (!sdp->sd_rindex_uptodate) {
                 mutex_lock(&sdp->sd_rindex_mutex);
-                error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
-                if (error)
-                        return error;
+                if (!gfs2_glock_is_locked_by_me(gl)) {
+                        error = gfs2_glock_nq_init(gl, LM_ST_SHARED, 0, &ri_gh);
+                        if (error)
+                                return error;
+                        unlock_required = 1;
+                }
                 if (!sdp->sd_rindex_uptodate)
                         error = gfs2_ri_update(ip);
-                gfs2_glock_dq_uninit(&ri_gh);
+                if (unlock_required)
+                        gfs2_glock_dq_uninit(&ri_gh);
                 mutex_unlock(&sdp->sd_rindex_mutex);
         }
 
diff --git a/fs/inode.c b/fs/inode.c
index fb10d86ffad7..d3ebdbe723d0 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1651,7 +1651,7 @@ __setup("ihash_entries=", set_ihash_entries);
  */
 void __init inode_init_early(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* If hashes are distributed across NUMA nodes, defer
          * hash allocation until vmalloc space is available.
@@ -1669,13 +1669,13 @@ void __init inode_init_early(void)
                                         &i_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                 INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
 
 void __init inode_init(void)
 {
-        int loop;
+        unsigned int loop;
 
         /* inode slab cache */
         inode_cachep = kmem_cache_create("inode_cache",
@@ -1699,7 +1699,7 @@ void __init inode_init(void)
                                         &i_hash_mask,
                                         0);
 
-        for (loop = 0; loop < (1 << i_hash_shift); loop++)
+        for (loop = 0; loop < (1U << i_hash_shift); loop++)
                 INIT_HLIST_HEAD(&inode_hashtable[loop]);
 }
 
diff --git a/fs/namei.c b/fs/namei.c
index 208c6aa4a989..e2ba62820a0f 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1095,8 +1095,10 @@ static struct dentry *d_inode_lookup(struct dentry *parent, struct dentry *dentr
         struct dentry *old;
 
         /* Don't create child dentry for a dead directory. */
-        if (unlikely(IS_DEADDIR(inode)))
+        if (unlikely(IS_DEADDIR(inode))) {
+                dput(dentry);
                 return ERR_PTR(-ENOENT);
+        }
 
         old = inode->i_op->lookup(inode, dentry, nd);
         if (unlikely(old)) {
@@ -1372,6 +1374,34 @@ static inline int can_lookup(struct inode *inode)
         return 1;
 }
 
+unsigned int full_name_hash(const unsigned char *name, unsigned int len)
+{
+        unsigned long hash = init_name_hash();
+        while (len--)
+                hash = partial_name_hash(*name++, hash);
+        return end_name_hash(hash);
+}
+EXPORT_SYMBOL(full_name_hash);
+
+/*
+ * We know there's a real path component here of at least
+ * one character.
+ */
+static inline unsigned long hash_name(const char *name, unsigned int *hashp)
+{
+        unsigned long hash = init_name_hash();
+        unsigned long len = 0, c;
+
+        c = (unsigned char)*name;
+        do {
+                len++;
+                hash = partial_name_hash(c, hash);
+                c = (unsigned char)name[len];
+        } while (c && c != '/');
+        *hashp = end_name_hash(hash);
+        return len;
+}
+
 /*
  * Name resolution.
  * This is the basic name resolution function, turning a pathname into
@@ -1392,31 +1422,22 @@ static int link_path_walk(const char *name, struct nameidata *nd)
 
         /* At this point we know we have a real path component. */
         for(;;) {
-                unsigned long hash;
                 struct qstr this;
-                unsigned int c;
+                long len;
                 int type;
 
                 err = may_lookup(nd);
                 if (err)
                         break;
 
+                len = hash_name(name, &this.hash);
                 this.name = name;
-                c = *(const unsigned char *)name;
-
-                hash = init_name_hash();
-                do {
-                        name++;
-                        hash = partial_name_hash(c, hash);
-                        c = *(const unsigned char *)name;
-                } while (c && (c != '/'));
-                this.len = name - (const char *) this.name;
-                this.hash = end_name_hash(hash);
+                this.len = len;
 
                 type = LAST_NORM;
-                if (this.name[0] == '.') switch (this.len) {
+                if (name[0] == '.') switch (len) {
                         case 2:
-                                if (this.name[1] == '.') {
+                                if (name[1] == '.') {
                                         type = LAST_DOTDOT;
                                         nd->flags |= LOOKUP_JUMPED;
                                 }
@@ -1435,12 +1456,18 @@ static int link_path_walk(const char *name, struct nameidata *nd)
                         }
                 }
 
-                /* remove trailing slashes? */
-                if (!c)
+                if (!name[len])
                         goto last_component;
-                while (*++name == '/');
-                if (!*name)
+                /*
+                 * If it wasn't NUL, we know it was '/'. Skip that
+                 * slash, and continue until no more slashes.
+                 */
+                do {
+                        len++;
+                } while (unlikely(name[len] == '/'));
+                if (!name[len])
                         goto last_component;
+                name += len;
 
                 err = walk_component(nd, &next, &this, type, LOOKUP_FOLLOW);
                 if (err < 0)
@@ -1773,24 +1800,21 @@ static struct dentry *lookup_hash(struct nameidata *nd)
 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
 {
         struct qstr this;
-        unsigned long hash;
         unsigned int c;
 
         WARN_ON_ONCE(!mutex_is_locked(&base->d_inode->i_mutex));
 
         this.name = name;
         this.len = len;
+        this.hash = full_name_hash(name, len);
         if (!len)
                 return ERR_PTR(-EACCES);
 
-        hash = init_name_hash();
         while (len--) {
                 c = *(const unsigned char *)name++;
                 if (c == '/' || c == '\0')
                         return ERR_PTR(-EACCES);
-                hash = partial_name_hash(c, hash);
         }
-        this.hash = end_name_hash(hash);
         /*
          * See if the low-level filesystem might want
          * to use its own hash..
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index f0c849c98fe4..ec9f6ef6c5dd 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -3575,8 +3575,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
         }
         if (npages > 1) {
                 /* for decoding across pages */
-                args.acl_scratch = alloc_page(GFP_KERNEL);
-                if (!args.acl_scratch)
+                res.acl_scratch = alloc_page(GFP_KERNEL);
+                if (!res.acl_scratch)
                         goto out_free;
         }
         args.acl_len = npages * PAGE_SIZE;
@@ -3612,8 +3612,8 @@ out_free:
         for (i = 0; i < npages; i++)
                 if (pages[i])
                         __free_page(pages[i]);
-        if (args.acl_scratch)
-                __free_page(args.acl_scratch);
+        if (res.acl_scratch)
+                __free_page(res.acl_scratch);
         return ret;
 }
 
@@ -4883,8 +4883,10 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                                 clp->cl_rpcclient->cl_auth->au_flavor);
 
         res.server_scope = kzalloc(sizeof(struct server_scope), GFP_KERNEL);
-        if (unlikely(!res.server_scope))
-                return -ENOMEM;
+        if (unlikely(!res.server_scope)) {
+                status = -ENOMEM;
+                goto out;
+        }
 
         status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (!status)
@@ -4901,12 +4903,13 @@ int nfs4_proc_exchange_id(struct nfs_client *clp, struct rpc_cred *cred)
                         clp->server_scope = NULL;
                 }
 
-                if (!clp->server_scope)
+                if (!clp->server_scope) {
                         clp->server_scope = res.server_scope;
-                else
-                        kfree(res.server_scope);
+                        goto out;
+                }
         }
-
+        kfree(res.server_scope);
+out:
         dprintk("<-- %s status= %d\n", __func__, status);
         return status;
 }
@@ -5008,37 +5011,53 @@ int nfs4_proc_get_lease_time(struct nfs_client *clp, struct nfs_fsinfo *fsinfo)
         return status;
 }
 
+static struct nfs4_slot *nfs4_alloc_slots(u32 max_slots, gfp_t gfp_flags)
+{
+        return kcalloc(max_slots, sizeof(struct nfs4_slot), gfp_flags);
+}
+
+static void nfs4_add_and_init_slots(struct nfs4_slot_table *tbl,
+                struct nfs4_slot *new,
+                u32 max_slots,
+                u32 ivalue)
+{
+        struct nfs4_slot *old = NULL;
+        u32 i;
+
+        spin_lock(&tbl->slot_tbl_lock);
+        if (new) {
+                old = tbl->slots;
+                tbl->slots = new;
+                tbl->max_slots = max_slots;
+        }
+        tbl->highest_used_slotid = -1;  /* no slot is currently used */
+        for (i = 0; i < tbl->max_slots; i++)
+                tbl->slots[i].seq_nr = ivalue;
+        spin_unlock(&tbl->slot_tbl_lock);
+        kfree(old);
+}
+
 /*
- * Reset a slot table
+ * (re)Initialise a slot table
  */
-static int nfs4_reset_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
-                                 int ivalue)
+static int nfs4_realloc_slot_table(struct nfs4_slot_table *tbl, u32 max_reqs,
+                                 u32 ivalue)
 {
         struct nfs4_slot *new = NULL;
-        int i;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         dprintk("--> %s: max_reqs=%u, tbl->max_slots %d\n", __func__,
                 max_reqs, tbl->max_slots);
 
         /* Does the newly negotiated max_reqs match the existing slot table? */
         if (max_reqs != tbl->max_slots) {
-                ret = -ENOMEM;
-                new = kmalloc(max_reqs * sizeof(struct nfs4_slot),
-                              GFP_NOFS);
+                new = nfs4_alloc_slots(max_reqs, GFP_NOFS);
                 if (!new)
                         goto out;
-                ret = 0;
-                kfree(tbl->slots);
         }
-        spin_lock(&tbl->slot_tbl_lock);
-        if (new) {
-                tbl->slots = new;
-                tbl->max_slots = max_reqs;
-        }
-        for (i = 0; i < tbl->max_slots; ++i)
-                tbl->slots[i].seq_nr = ivalue;
-        spin_unlock(&tbl->slot_tbl_lock);
+        ret = 0;
+
+        nfs4_add_and_init_slots(tbl, new, max_reqs, ivalue);
         dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
                 tbl, tbl->slots, tbl->max_slots);
 out:
@@ -5061,36 +5080,6 @@ static void nfs4_destroy_slot_tables(struct nfs4_session *session)
 }
 
 /*
- * Initialize slot table
- */
-static int nfs4_init_slot_table(struct nfs4_slot_table *tbl,
-                int max_slots, int ivalue)
-{
-        struct nfs4_slot *slot;
-        int ret = -ENOMEM;
-
-        BUG_ON(max_slots > NFS4_MAX_SLOT_TABLE);
-
-        dprintk("--> %s: max_reqs=%u\n", __func__, max_slots);
-
-        slot = kcalloc(max_slots, sizeof(struct nfs4_slot), GFP_NOFS);
-        if (!slot)
-                goto out;
-        ret = 0;
-
-        spin_lock(&tbl->slot_tbl_lock);
-        tbl->max_slots = max_slots;
-        tbl->slots = slot;
-        tbl->highest_used_slotid = -1;  /* no slot is currently used */
-        spin_unlock(&tbl->slot_tbl_lock);
-        dprintk("%s: tbl=%p slots=%p max_slots=%d\n", __func__,
-                tbl, tbl->slots, tbl->max_slots);
-out:
-        dprintk("<-- %s: return %d\n", __func__, ret);
-        return ret;
-}
-
-/*
  * Initialize or reset the forechannel and backchannel tables
  */
 static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
@@ -5101,25 +5090,16 @@ static int nfs4_setup_session_slot_tables(struct nfs4_session *ses)
         dprintk("--> %s\n", __func__);
         /* Fore channel */
         tbl = &ses->fc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status) /* -ENOMEM */
-                        return status;
-        } else {
-                status = nfs4_reset_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
-                if (status)
-                        return status;
-        }
+        status = nfs4_realloc_slot_table(tbl, ses->fc_attrs.max_reqs, 1);
+        if (status) /* -ENOMEM */
+                return status;
         /* Back channel */
         tbl = &ses->bc_slot_table;
-        if (tbl->slots == NULL) {
-                status = nfs4_init_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
-                if (status)
-                        /* Fore and back channel share a connection so get
-                         * both slot tables or neither */
-                        nfs4_destroy_slot_tables(ses);
-        } else
-                status = nfs4_reset_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        status = nfs4_realloc_slot_table(tbl, ses->bc_attrs.max_reqs, 0);
+        if (status && tbl->slots == NULL)
+                /* Fore and back channel share a connection so get
+                 * both slot tables or neither */
+                nfs4_destroy_slot_tables(ses);
         return status;
 }
 
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index a53f33b4ac3a..45392032e7bd 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1132,6 +1132,8 @@ void nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4
 {
         struct nfs_client *clp = server->nfs_client;
 
+        if (test_and_clear_bit(NFS_DELEGATED_STATE, &state->flags))
+                nfs_async_inode_return_delegation(state->inode, &state->stateid);
         nfs4_state_mark_reclaim_nograce(clp, state);
         nfs4_schedule_state_manager(clp);
 }
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 95e92e438407..33bd8d0f745d 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -2522,7 +2522,6 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
 
         xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
                 args->acl_pages, args->acl_pgbase, args->acl_len);
-        xdr_set_scratch_buffer(xdr, page_address(args->acl_scratch), PAGE_SIZE);
 
         encode_nops(&hdr);
 }
@@ -6032,6 +6031,10 @@ nfs4_xdr_dec_getacl(struct rpc_rqst *rqstp, struct xdr_stream *xdr,
         struct compound_hdr hdr;
         int status;
 
+        if (res->acl_scratch != NULL) {
+                void *p = page_address(res->acl_scratch);
+                xdr_set_scratch_buffer(xdr, p, PAGE_SIZE);
+        }
         status = decode_compound_hdr(xdr, &hdr);
         if (status)
                 goto out;
diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
index f14fde2b03d6..e0281992ddc3 100644
--- a/fs/ntfs/attrib.c
+++ b/fs/ntfs/attrib.c
@@ -1,7 +1,7 @@
 /**
  * attrib.c - NTFS attribute operations.  Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2007 Anton Altaparmakov
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -345,10 +345,10 @@ LCN ntfs_attr_vcn_to_lcn_nolock(ntfs_inode *ni, const VCN vcn,
         unsigned long flags;
         bool is_retry = false;
 
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, vcn 0x%llx, %s_locked.",
                         ni->mft_no, (unsigned long long)vcn,
                         write_locked ? "write" : "read");
-        BUG_ON(!ni);
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(vcn < 0);
         if (!ni->runlist.rl) {
@@ -469,9 +469,9 @@ runlist_element *ntfs_attr_find_vcn_nolock(ntfs_inode *ni, const VCN vcn,
         int err = 0;
         bool is_retry = false;
 
+        BUG_ON(!ni);
         ntfs_debug("Entering for i_ino 0x%lx, vcn 0x%llx, with%s ctx.",
                         ni->mft_no, (unsigned long long)vcn, ctx ? "" : "out");
-        BUG_ON(!ni);
         BUG_ON(!NInoNonResident(ni));
         BUG_ON(vcn < 0);
         if (!ni->runlist.rl) {
diff --git a/fs/ntfs/mft.c b/fs/ntfs/mft.c
index 382857f9c7db..3014a36a255b 100644
--- a/fs/ntfs/mft.c
+++ b/fs/ntfs/mft.c
@@ -1,7 +1,7 @@
 /**
  * mft.c - NTFS kernel mft record operations. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -1367,7 +1367,7 @@ static int ntfs_mft_bitmap_extend_allocation_nolock(ntfs_volume *vol)
                         ntfs_error(vol->sb, "Failed to merge runlists for mft "
                                         "bitmap.");
                         if (ntfs_cluster_free_from_rl(vol, rl2)) {
-                                ntfs_error(vol->sb, "Failed to dealocate "
+                                ntfs_error(vol->sb, "Failed to deallocate "
                                                 "allocated cluster.%s", es);
                                 NVolSetErrors(vol);
                         }
@@ -1805,7 +1805,7 @@ static int ntfs_mft_data_extend_allocation_nolock(ntfs_volume *vol)
                 ntfs_error(vol->sb, "Failed to merge runlists for mft data "
                                 "attribute.");
                 if (ntfs_cluster_free_from_rl(vol, rl2)) {
-                        ntfs_error(vol->sb, "Failed to dealocate clusters "
+                        ntfs_error(vol->sb, "Failed to deallocate clusters "
                                         "from the mft data attribute.%s", es);
                         NVolSetErrors(vol);
                 }
diff --git a/fs/ntfs/super.c b/fs/ntfs/super.c
index 5a4a8af5c406..f907611cca73 100644
--- a/fs/ntfs/super.c
+++ b/fs/ntfs/super.c
@@ -1,7 +1,7 @@
 /*
  * super.c - NTFS kernel super block handling. Part of the Linux-NTFS project.
  *
- * Copyright (c) 2001-2011 Anton Altaparmakov and Tuxera Inc.
+ * Copyright (c) 2001-2012 Anton Altaparmakov and Tuxera Inc.
  * Copyright (c) 2001,2002 Richard Russon
  *
  * This program/include file is free software; you can redistribute it and/or
@@ -1239,7 +1239,6 @@ static int check_windows_hibernation_status(ntfs_volume *vol)
 {
         MFT_REF mref;
         struct inode *vi;
-        ntfs_inode *ni;
         struct page *page;
         u32 *kaddr, *kend;
         ntfs_name *name = NULL;
@@ -1290,7 +1289,6 @@ static int check_windows_hibernation_status(ntfs_volume *vol)
                                 "is not the system volume.", i_size_read(vi));
                 goto iput_out;
         }
-        ni = NTFS_I(vi);
         page = ntfs_map_page(vi->i_mapping, 0);
         if (IS_ERR(page)) {
                 ntfs_error(vol->sb, "Failed to read from hiberfil.sys.");
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index be244692550d..a9856e3eaaf0 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1053,7 +1053,7 @@ static int ocfs2_rename(struct inode *old_dir,
         handle_t *handle = NULL;
         struct buffer_head *old_dir_bh = NULL;
         struct buffer_head *new_dir_bh = NULL;
-        nlink_t old_dir_nlink = old_dir->i_nlink;
+        u32 old_dir_nlink = old_dir->i_nlink;
         struct ocfs2_dinode *old_di;
         struct ocfs2_dir_lookup_result old_inode_dot_dot_res = { NULL, };
         struct ocfs2_dir_lookup_result target_lookup_res = { NULL, };
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index 7898cd688a00..fc2c4388d126 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -292,11 +292,26 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
         }
 }
 
+/* Return 1 if 'cmd' will block on frozen filesystem */
+static int quotactl_cmd_write(int cmd)
+{
+        switch (cmd) {
+        case Q_GETFMT:
+        case Q_GETINFO:
+        case Q_SYNC:
+        case Q_XGETQSTAT:
+        case Q_XGETQUOTA:
+        case Q_XQUOTASYNC:
+                return 0;
+        }
+        return 1;
+}
+
 /*
  * look up a superblock on which quota ops will be performed
  * - use the name of a block device to find the superblock thereon
  */
-static struct super_block *quotactl_block(const char __user *special)
+static struct super_block *quotactl_block(const char __user *special, int cmd)
 {
 #ifdef CONFIG_BLOCK
         struct block_device *bdev;
@@ -309,7 +324,10 @@ static struct super_block *quotactl_block(const char __user *special)
         putname(tmp);
         if (IS_ERR(bdev))
                 return ERR_CAST(bdev);
-        sb = get_super(bdev);
+        if (quotactl_cmd_write(cmd))
+                sb = get_super_thawed(bdev);
+        else
+                sb = get_super(bdev);
         bdput(bdev);
         if (!sb)
                 return ERR_PTR(-ENODEV);
@@ -361,7 +379,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
                         pathp = &path;
         }
 
-        sb = quotactl_block(special);
+        sb = quotactl_block(special, cmds);
         if (IS_ERR(sb)) {
                 ret = PTR_ERR(sb);
                 goto out;
diff --git a/fs/select.c b/fs/select.c
index d33418fdc858..e782258d0de3 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -912,7 +912,7 @@ static long do_restart_poll(struct restart_block *restart_block)
 }
 
 SYSCALL_DEFINE3(poll, struct pollfd __user *, ufds, unsigned int, nfds,
-                long, timeout_msecs)
+                int, timeout_msecs)
 {
         struct timespec end_time, *to = NULL;
         int ret;
diff --git a/fs/signalfd.c b/fs/signalfd.c
index 492465b451dd..7ae2a574cb25 100644
--- a/fs/signalfd.c
+++ b/fs/signalfd.c
@@ -30,6 +30,21 @@
 #include <linux/signalfd.h>
 #include <linux/syscalls.h>
 
+void signalfd_cleanup(struct sighand_struct *sighand)
+{
+        wait_queue_head_t *wqh = &sighand->signalfd_wqh;
+        /*
+         * The lockless check can race with remove_wait_queue() in progress,
+         * but in this case its caller should run under rcu_read_lock() and
+         * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return.
+         */
+        if (likely(!waitqueue_active(wqh)))
+                return;
+
+        /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */
+        wake_up_poll(wqh, POLLHUP | POLLFREE);
+}
+
 struct signalfd_ctx {
         sigset_t sigmask;
 };
diff --git a/fs/super.c b/fs/super.c
index 6015c02296b7..6277ec6cb60a 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -634,6 +634,28 @@ rescan:
 EXPORT_SYMBOL(get_super);
 
 /**
+ *      get_super_thawed - get thawed superblock of a device
+ *      @bdev: device to get the superblock for
+ *
+ *      Scans the superblock list and finds the superblock of the file system
+ *      mounted on the device. The superblock is returned once it is thawed
+ *      (or immediately if it was not frozen). %NULL is returned if no match
+ *      is found.
+ */
+struct super_block *get_super_thawed(struct block_device *bdev)
+{
+        while (1) {
+                struct super_block *s = get_super(bdev);
+                if (!s || s->s_frozen == SB_UNFROZEN)
+                        return s;
+                up_read(&s->s_umount);
+                vfs_check_frozen(s, SB_FREEZE_WRITE);
+                put_super(s);
+        }
+}
+EXPORT_SYMBOL(get_super_thawed);
+
+/**
  * get_active_super - get an active reference to the superblock of a device
  * @bdev: device to get the superblock for
  *
diff --git a/fs/xfs/xfs_dquot.c b/fs/xfs/xfs_dquot.c
index cbcb7bea38e2..53db20ee3e77 100644
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -139,10 +139,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_btimer) {
                 if ((d->d_blk_softlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                       be64_to_cpu(d->d_blk_softlimit))) ||
                     (d->d_blk_hardlimit &&
-                     (be64_to_cpu(d->d_bcount) >=
+                     (be64_to_cpu(d->d_bcount) >
                       be64_to_cpu(d->d_blk_hardlimit)))) {
                         d->d_btimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_btimelimit);
@@ -151,10 +151,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_blk_softlimit ||
-                     (be64_to_cpu(d->d_bcount) <
+                     (be64_to_cpu(d->d_bcount) <=
                       be64_to_cpu(d->d_blk_softlimit))) &&
                     (!d->d_blk_hardlimit ||
-                    (be64_to_cpu(d->d_bcount) <
+                    (be64_to_cpu(d->d_bcount) <=
                      be64_to_cpu(d->d_blk_hardlimit)))) {
                         d->d_btimer = 0;
                 }
@@ -162,10 +162,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_itimer) {
                 if ((d->d_ino_softlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                       be64_to_cpu(d->d_ino_softlimit))) ||
                     (d->d_ino_hardlimit &&
-                     (be64_to_cpu(d->d_icount) >=
+                     (be64_to_cpu(d->d_icount) >
                       be64_to_cpu(d->d_ino_hardlimit)))) {
                         d->d_itimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_itimelimit);
@@ -174,10 +174,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_ino_softlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                       be64_to_cpu(d->d_ino_softlimit)))  &&
                     (!d->d_ino_hardlimit ||
-                     (be64_to_cpu(d->d_icount) <
+                     (be64_to_cpu(d->d_icount) <=
                       be64_to_cpu(d->d_ino_hardlimit)))) {
                         d->d_itimer = 0;
                 }
@@ -185,10 +185,10 @@ xfs_qm_adjust_dqtimers(
 
         if (!d->d_rtbtimer) {
                 if ((d->d_rtb_softlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                       be64_to_cpu(d->d_rtb_softlimit))) ||
                     (d->d_rtb_hardlimit &&
-                     (be64_to_cpu(d->d_rtbcount) >=
+                     (be64_to_cpu(d->d_rtbcount) >
                       be64_to_cpu(d->d_rtb_hardlimit)))) {
                         d->d_rtbtimer = cpu_to_be32(get_seconds() +
                                         mp->m_quotainfo->qi_rtbtimelimit);
@@ -197,10 +197,10 @@ xfs_qm_adjust_dqtimers(
                 }
         } else {
                 if ((!d->d_rtb_softlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                       be64_to_cpu(d->d_rtb_softlimit))) &&
                     (!d->d_rtb_hardlimit ||
-                     (be64_to_cpu(d->d_rtbcount) <
+                     (be64_to_cpu(d->d_rtbcount) <=
                       be64_to_cpu(d->d_rtb_hardlimit)))) {
                         d->d_rtbtimer = 0;
                 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 15ff5392fb65..0ed9ee77937c 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1981,7 +1981,7 @@ xfs_qm_dqcheck(
 
         if (!errs && ddq->d_id) {
                 if (ddq->d_blk_softlimit &&
-                    be64_to_cpu(ddq->d_bcount) >=
+                    be64_to_cpu(ddq->d_bcount) >
                                 be64_to_cpu(ddq->d_blk_softlimit)) {
                         if (!ddq->d_btimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
@@ -1992,7 +1992,7 @@ xfs_qm_dqcheck(
                         }
                 }
                 if (ddq->d_ino_softlimit &&
-                    be64_to_cpu(ddq->d_icount) >=
+                    be64_to_cpu(ddq->d_icount) >
                                 be64_to_cpu(ddq->d_ino_softlimit)) {
                         if (!ddq->d_itimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
@@ -2003,7 +2003,7 @@ xfs_qm_dqcheck(
                         }
                 }
                 if (ddq->d_rtb_softlimit &&
-                    be64_to_cpu(ddq->d_rtbcount) >=
+                    be64_to_cpu(ddq->d_rtbcount) >
                                 be64_to_cpu(ddq->d_rtb_softlimit)) {
                         if (!ddq->d_rtbtimer) {
                                 if (flags & XFS_QMOPT_DOWARN)
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index eafbcff81f3a..711a86e39ff0 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -813,11 +813,11 @@ xfs_qm_export_dquot(
              (XFS_IS_OQUOTA_ENFORCED(mp) &&
                         (dst->d_flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)))) &&
             dst->d_id != 0) {
-                if (((int) dst->d_bcount >= (int) dst->d_blk_softlimit) &&
+                if (((int) dst->d_bcount > (int) dst->d_blk_softlimit) &&
                     (dst->d_blk_softlimit > 0)) {
                         ASSERT(dst->d_btimer != 0);
                 }
-                if (((int) dst->d_icount >= (int) dst->d_ino_softlimit) &&
+                if (((int) dst->d_icount > (int) dst->d_ino_softlimit) &&
                     (dst->d_ino_softlimit > 0)) {
                         ASSERT(dst->d_itimer != 0);
                 }
diff --git a/fs/xfs/xfs_trans.c b/fs/xfs/xfs_trans.c
index 329b06aba1c2..7adcdf15ae0c 100644
--- a/fs/xfs/xfs_trans.c
+++ b/fs/xfs/xfs_trans.c
@@ -1151,8 +1151,8 @@ xfs_trans_add_item(
 {
         struct xfs_log_item_desc *lidp;
 
-        ASSERT(lip->li_mountp = tp->t_mountp);
-        ASSERT(lip->li_ailp = tp->t_mountp->m_ail);
+        ASSERT(lip->li_mountp == tp->t_mountp);
+        ASSERT(lip->li_ailp == tp->t_mountp->m_ail);
 
         lidp = kmem_zone_zalloc(xfs_log_item_desc_zone, KM_SLEEP | KM_NOFS);
 
diff --git a/fs/xfs/xfs_trans_dquot.c b/fs/xfs/xfs_trans_dquot.c
index 4d00ee67792d..c4ba366d24e6 100644
--- a/fs/xfs/xfs_trans_dquot.c
+++ b/fs/xfs/xfs_trans_dquot.c
@@ -649,12 +649,12 @@ xfs_trans_dqresv(
                          * nblks.
                          */
                         if (hardlimit > 0ULL &&
-                            hardlimit <= nblks + *resbcountp) {
+                            hardlimit < nblks + *resbcountp) {
                                 xfs_quota_warn(mp, dqp, QUOTA_NL_BHARDWARN);
                                 goto error_return;
                         }
                         if (softlimit > 0ULL &&
-                            softlimit <= nblks + *resbcountp) {
+                            softlimit < nblks + *resbcountp) {
                                 if ((timer != 0 && get_seconds() > timer) ||
                                     (warns != 0 && warns >= warnlimit)) {
                                         xfs_quota_warn(mp, dqp,
@@ -677,11 +677,13 @@ xfs_trans_dqresv(
                         if (!softlimit)
                                 softlimit = q->qi_isoftlimit;
 
-                        if (hardlimit > 0ULL && count >= hardlimit) {
+                        if (hardlimit > 0ULL &&
+                            hardlimit < ninos + count) {
                                 xfs_quota_warn(mp, dqp, QUOTA_NL_IHARDWARN);
                                 goto error_return;
                         }
-                        if (softlimit > 0ULL && count >= softlimit) {
+                        if (softlimit > 0ULL &&
+                            softlimit < ninos + count) {
                                 if  ((timer != 0 && get_seconds() > timer) ||
                                      (warns != 0 && warns >= warnlimit)) {
                                         xfs_quota_warn(mp, dqp,
diff --git a/include/asm-generic/io-64-nonatomic-hi-lo.h b/include/asm-generic/io-64-nonatomic-hi-lo.h
new file mode 100644
index 000000000000..a6806a94250d
--- /dev/null
+++ b/include/asm-generic/io-64-nonatomic-hi-lo.h
@@ -0,0 +1,28 @@
+#ifndef _ASM_IO_64_NONATOMIC_HI_LO_H_
+#define _ASM_IO_64_NONATOMIC_HI_LO_H_
+
+#include <linux/io.h>
+#include <asm-generic/int-ll64.h>
+
+#ifndef readq
+static inline __u64 readq(const volatile void __iomem *addr)
+{
+        const volatile u32 __iomem *p = addr;
+        u32 low, high;
+
+        high = readl(p + 1);
+        low = readl(p);
+
+        return low + ((u64)high << 32);
+}
+#endif
+
+#ifndef writeq
+static inline void writeq(__u64 val, volatile void __iomem *addr)
+{
+        writel(val >> 32, addr + 4);
+        writel(val, addr);
+}
+#endif
+
+#endif  /* _ASM_IO_64_NONATOMIC_HI_LO_H_ */
diff --git a/include/asm-generic/io-64-nonatomic-lo-hi.h b/include/asm-generic/io-64-nonatomic-lo-hi.h
new file mode 100644
index 000000000000..ca546b1ff8b5
--- /dev/null
+++ b/include/asm-generic/io-64-nonatomic-lo-hi.h
@@ -0,0 +1,28 @@
+#ifndef _ASM_IO_64_NONATOMIC_LO_HI_H_
+#define _ASM_IO_64_NONATOMIC_LO_HI_H_
+
+#include <linux/io.h>
+#include <asm-generic/int-ll64.h>
+
+#ifndef readq
+static inline __u64 readq(const volatile void __iomem *addr)
+{
+        const volatile u32 __iomem *p = addr;
+        u32 low, high;
+
+        low = readl(p);
+        high = readl(p + 1);
+
+        return low + ((u64)high << 32);
+}
+#endif
+
+#ifndef writeq
+static inline void writeq(__u64 val, volatile void __iomem *addr)
+{
+        writel(val, addr);
+        writel(val >> 32, addr + 4);
+}
+#endif
+
+#endif  /* _ASM_IO_64_NONATOMIC_LO_HI_H_ */
diff --git a/include/asm-generic/iomap.h b/include/asm-generic/iomap.h
index 8a3d4fde2604..6afd7d6a9899 100644
--- a/include/asm-generic/iomap.h
+++ b/include/asm-generic/iomap.h
@@ -70,7 +70,7 @@ extern void ioport_unmap(void __iomem *);
 /* Destroy a virtual mapping cookie for a PCI BAR (memory or IO) */
 struct pci_dev;
 extern void pci_iounmap(struct pci_dev *dev, void __iomem *);
-#else
+#elif defined(CONFIG_GENERIC_IOMAP)
 struct pci_dev;
 static inline void pci_iounmap(struct pci_dev *dev, void __iomem *addr)
 { }
diff --git a/include/asm-generic/pci_iomap.h b/include/asm-generic/pci_iomap.h
index e58fcf891370..ce37349860fe 100644
--- a/include/asm-generic/pci_iomap.h
+++ b/include/asm-generic/pci_iomap.h
@@ -25,7 +25,7 @@ extern void __iomem *__pci_ioport_map(struct pci_dev *dev, unsigned long port,
 #define __pci_ioport_map(dev, port, nr) ioport_map((port), (nr))
 #endif
 
-#else
+#elif defined(CONFIG_GENERIC_PCI_IOMAP)
 static inline void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long max)
 {
         return NULL;
diff --git a/include/asm-generic/poll.h b/include/asm-generic/poll.h
index 44bce836d350..9ce7f44aebd2 100644
--- a/include/asm-generic/poll.h
+++ b/include/asm-generic/poll.h
@@ -28,6 +28,8 @@
 #define POLLRDHUP       0x2000
 #endif
 
+#define POLLFREE        0x4000  /* currently only for epoll */
+
 struct pollfd {
         int fd;
         short events;
diff --git a/include/drm/Kbuild b/include/drm/Kbuild
index a5c0e10fd47d..1e38a19d68f6 100644
--- a/include/drm/Kbuild
+++ b/include/drm/Kbuild
@@ -2,6 +2,7 @@ header-y += drm.h
 header-y += drm_fourcc.h
 header-y += drm_mode.h
 header-y += drm_sarea.h
+header-y += exynos_drm.h
 header-y += i810_drm.h
 header-y += i915_drm.h
 header-y += mga_drm.h
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index 5e120f1c5cd9..1ed3aae893a5 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -97,15 +97,30 @@ struct drm_exynos_plane_set_zpos {
 #define DRM_IOCTL_EXYNOS_PLANE_SET_ZPOS DRM_IOWR(DRM_COMMAND_BASE + \
                 DRM_EXYNOS_PLANE_SET_ZPOS, struct drm_exynos_plane_set_zpos)
 
+#ifdef __KERNEL__
+
 /**
- * Platform Specific Structure for DRM based FIMD.
+ * A structure for lcd panel information.
  *
  * @timing: default video mode for initializing
+ * @width_mm: physical size of lcd width.
+ * @height_mm: physical size of lcd height.
+ */
+struct exynos_drm_panel_info {
+        struct fb_videomode timing;
+        u32 width_mm;
+        u32 height_mm;
+};
+
+/**
+ * Platform Specific Structure for DRM based FIMD.
+ *
+ * @panel: default panel info for initializing
  * @default_win: default window layer number to be used for UI.
  * @bpp: default bit per pixel.
  */
 struct exynos_drm_fimd_pdata {
-        struct fb_videomode             timing;
+        struct exynos_drm_panel_info panel;
         u32                             vidcon0;
         u32                             vidcon1;
         unsigned int                    default_win;
@@ -139,4 +154,5 @@ struct exynos_drm_hdmi_pdata {
         unsigned int                    bpp;
 };
 
-#endif
+#endif  /* __KERNEL__ */
+#endif  /* _EXYNOS_DRM_H_ */
diff --git a/include/linux/amba/serial.h b/include/linux/amba/serial.h
index 514ed45c462e..d117b29d1062 100644
--- a/include/linux/amba/serial.h
+++ b/include/linux/amba/serial.h
@@ -23,6 +23,8 @@
 #ifndef ASM_ARM_HARDWARE_SERIAL_AMBA_H
 #define ASM_ARM_HARDWARE_SERIAL_AMBA_H
 
+#include <linux/types.h>
+
 /* -------------------------------------------------------------------------------
  *  From AMBA UART (PL010) Block Specification
  * -------------------------------------------------------------------------------
diff --git a/include/linux/compat.h b/include/linux/compat.h
index 41c9f6515f46..7e05fcee75a1 100644
--- a/include/linux/compat.h
+++ b/include/linux/compat.h
@@ -561,5 +561,9 @@ asmlinkage ssize_t compat_sys_process_vm_writev(compat_pid_t pid,
                 unsigned long liovcnt, const struct compat_iovec __user *rvec,
                 unsigned long riovcnt, unsigned long flags);
 
+#else
+
+#define is_compat_task() (0)
+
 #endif /* CONFIG_COMPAT */
 #endif /* _LINUX_COMPAT_H */
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index d64a55b23afd..ff5f5256d175 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -47,27 +47,6 @@ struct dentry_stat_t {
 };
 extern struct dentry_stat_t dentry_stat;
 
-/*
- * Compare 2 name strings, return 0 if they match, otherwise non-zero.
- * The strings are both count bytes long, and count is non-zero.
- */
-static inline int dentry_cmp(const unsigned char *cs, size_t scount,
-                                const unsigned char *ct, size_t tcount)
-{
-        int ret;
-        if (scount != tcount)
-                return 1;
-        do {
-                ret = (*cs != *ct);
-                if (ret)
-                        break;
-                cs++;
-                ct++;
-                tcount--;
-        } while (tcount);
-        return ret;
-}
-
 /* Name hashing routines. Initial hash value */
 /* Hash courtesy of the R5 hash in reiserfs modulo sign bits */
 #define init_name_hash()                0
@@ -89,14 +68,7 @@ static inline unsigned long end_name_hash(unsigned long hash)
 }
 
 /* Compute the hash for a name string. */
-static inline unsigned int
-full_name_hash(const unsigned char *name, unsigned int len)
-{
-        unsigned long hash = init_name_hash();
-        while (len--)
-                hash = partial_name_hash(*name++, hash);
-        return end_name_hash(hash);
-}
+extern unsigned int full_name_hash(const unsigned char *, unsigned int);
 
 /*
  * Try to keep struct dentry aligned on 64 byte cachelines (this will
@@ -309,7 +281,8 @@ extern struct dentry *d_ancestor(struct dentry *, struct dentry *);
 extern struct dentry *d_lookup(struct dentry *, struct qstr *);
 extern struct dentry *d_hash_and_lookup(struct dentry *, struct qstr *);
 extern struct dentry *__d_lookup(struct dentry *, struct qstr *);
-extern struct dentry *__d_lookup_rcu(struct dentry *parent, struct qstr *name,
+extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
+                                const struct qstr *name,
                                 unsigned *seq, struct inode **inode);
 
 /**
diff --git a/include/linux/digsig.h b/include/linux/digsig.h
index b01558b15814..6f85a070bb45 100644
--- a/include/linux/digsig.h
+++ b/include/linux/digsig.h
@@ -30,7 +30,7 @@ enum digest_algo {
 
 struct pubkey_hdr {
         uint8_t         version;        /* key format version */
-        time_t          timestamp;      /* key made, always 0 for now */
+        uint32_t        timestamp;      /* key made, always 0 for now */
         uint8_t         algo;
         uint8_t         nmpi;
         char            mpi[0];
@@ -38,7 +38,7 @@ struct pubkey_hdr {
 
 struct signature_hdr {
         uint8_t         version;        /* signature format version */
-        time_t          timestamp;      /* signature made */
+        uint32_t        timestamp;      /* signature made */
         uint8_t         algo;
         uint8_t         hash;
         uint8_t         keyid[8];
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 386da09f229d..69cd5bb640f5 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2496,6 +2496,7 @@ extern void get_filesystem(struct file_system_type *fs);
 extern void put_filesystem(struct file_system_type *fs);
 extern struct file_system_type *get_fs_type(const char *name);
 extern struct super_block *get_super(struct block_device *);
+extern struct super_block *get_super_thawed(struct block_device *);
 extern struct super_block *get_active_super(struct block_device *bdev);
 extern void drop_super(struct super_block *sb);
 extern void iterate_supers(void (*)(struct super_block *, void *), void *);
diff --git a/include/linux/if_link.h b/include/linux/if_link.h
index c52d4b5f872a..4b24ff453aee 100644
--- a/include/linux/if_link.h
+++ b/include/linux/if_link.h
@@ -137,6 +137,7 @@ enum {
         IFLA_AF_SPEC,
         IFLA_GROUP,             /* Group the device belongs to */
         IFLA_NET_NS_FD,
+        IFLA_EXT_MASK,          /* Extended info mask, VFs, etc */
         __IFLA_MAX
 };
 
diff --git a/include/linux/kmsg_dump.h b/include/linux/kmsg_dump.h
index fee66317e071..35f7237ec972 100644
--- a/include/linux/kmsg_dump.h
+++ b/include/linux/kmsg_dump.h
@@ -15,13 +15,18 @@
 #include <linux/errno.h>
 #include <linux/list.h>
 
+/*
+ * Keep this list arranged in rough order of priority. Anything listed after
+ * KMSG_DUMP_OOPS will not be logged by default unless printk.always_kmsg_dump
+ * is passed to the kernel.
+ */
 enum kmsg_dump_reason {
-        KMSG_DUMP_OOPS,
         KMSG_DUMP_PANIC,
+        KMSG_DUMP_OOPS,
+        KMSG_DUMP_EMERG,
         KMSG_DUMP_RESTART,
         KMSG_DUMP_HALT,
         KMSG_DUMP_POWEROFF,
-        KMSG_DUMP_EMERG,
 };
 
 /**
diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h
index 4d34356fe644..b80de520670b 100644
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -129,7 +129,6 @@ extern void mem_cgroup_print_oom_info(struct mem_cgroup *memcg,
 extern void mem_cgroup_replace_page_cache(struct page *oldpage,
                                         struct page *newpage);
 
-extern void mem_cgroup_reset_owner(struct page *page);
 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_SWAP
 extern int do_swap_account;
 #endif
@@ -392,10 +391,6 @@ static inline void mem_cgroup_replace_page_cache(struct page *oldpage,
                                 struct page *newpage)
 {
 }
-
-static inline void mem_cgroup_reset_owner(struct page *page)
-{
-}
 #endif /* CONFIG_CGROUP_MEM_CONT */
 
 #if !defined(CONFIG_CGROUP_MEM_RES_CTLR) || !defined(CONFIG_DEBUG_VM)
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 8797ed16feb2..4dd5bd6994a8 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -285,8 +285,8 @@ struct ebt_table {
         struct module *me;
 };
 
-#define EBT_ALIGN(s) (((s) + (__alignof__(struct ebt_replace)-1)) & \
-                     ~(__alignof__(struct ebt_replace)-1))
+#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
+                     ~(__alignof__(struct _xt_align)-1))
 extern struct ebt_table *ebt_register_table(struct net *net,
                                             const struct ebt_table *table);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table);
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index a764cef06b73..d6ba9a12591e 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -614,7 +614,6 @@ struct nfs_getaclargs {
         size_t                          acl_len;
         unsigned int                    acl_pgbase;
         struct page **                  acl_pages;
-        struct page *                   acl_scratch;
         struct nfs4_sequence_args       seq_args;
 };
 
@@ -624,6 +623,7 @@ struct nfs_getaclres {
         size_t                          acl_len;
         size_t                          acl_data_offset;
         int                             acl_flags;
+        struct page *                   acl_scratch;
         struct nfs4_sequence_res        seq_res;
 };
 
diff --git a/include/linux/of.h b/include/linux/of.h
index a75a831e2057..92cf6ad35e0e 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -281,6 +281,14 @@ static inline struct property *of_find_property(const struct device_node *np,
         return NULL;
 }
 
+static inline struct device_node *of_find_compatible_node(
+                                                struct device_node *from,
+                                                const char *type,
+                                                const char *compat)
+{
+        return NULL;
+}
+
 static inline int of_property_read_u32_array(const struct device_node *np,
                                              const char *propname,
                                              u32 *out_values, size_t sz)
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 32cd1f67462e..21638ae14e07 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -348,9 +348,9 @@ do {									\
 #define _this_cpu_generic_to_op(pcp, val, op)                           \
 do {                                                                    \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         *__this_cpu_ptr(&(pcp)) op val;                                 \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
 } while (0)
 
 #ifndef this_cpu_write
@@ -449,10 +449,10 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         __this_cpu_add(pcp, val);                                       \
         ret__ = __this_cpu_read(pcp);                                   \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -479,10 +479,10 @@ do {									\
 #define _this_cpu_generic_xchg(pcp, nval)                               \
 ({      typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         __this_cpu_write(pcp, nval);                                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -507,11 +507,11 @@ do {									\
 ({                                                                      \
         typeof(pcp) ret__;                                              \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_read(pcp);                                   \
         if (ret__ == (oval))                                            \
                 __this_cpu_write(pcp, nval);                            \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -544,10 +544,10 @@ do {									\
 ({                                                                      \
         int ret__;                                                      \
         unsigned long flags;                                            \
-        local_irq_save(flags);                                          \
+        raw_local_irq_save(flags);                                      \
         ret__ = __this_cpu_generic_cmpxchg_double(pcp1, pcp2,           \
                         oval1, oval2, nval1, nval2);                    \
-        local_irq_restore(flags);                                       \
+        raw_local_irq_restore(flags);                                   \
         ret__;                                                          \
 })
 
@@ -718,12 +718,13 @@ do {									\
 # ifndef __this_cpu_add_return_8
 #  define __this_cpu_add_return_8(pcp, val)     __this_cpu_generic_add_return(pcp, val)
 # endif
-# define __this_cpu_add_return(pcp, val)        __pcpu_size_call_return2(this_cpu_add_return_, pcp, val)
+# define __this_cpu_add_return(pcp, val)        \
+        __pcpu_size_call_return2(__this_cpu_add_return_, pcp, val)
 #endif
 
-#define __this_cpu_sub_return(pcp, val) this_cpu_add_return(pcp, -(val))
-#define __this_cpu_inc_return(pcp)      this_cpu_add_return(pcp, 1)
-#define __this_cpu_dec_return(pcp)      this_cpu_add_return(pcp, -1)
+#define __this_cpu_sub_return(pcp, val) __this_cpu_add_return(pcp, -(val))
+#define __this_cpu_inc_return(pcp)      __this_cpu_add_return(pcp, 1)
+#define __this_cpu_dec_return(pcp)      __this_cpu_add_return(pcp, -1)
 
 #define __this_cpu_generic_xchg(pcp, nval)                              \
 ({      typeof(pcp) ret__;                                              \
diff --git a/include/linux/regset.h b/include/linux/regset.h
index 8abee6556223..686f37327a49 100644
--- a/include/linux/regset.h
+++ b/include/linux/regset.h
@@ -335,8 +335,11 @@ static inline int copy_regset_to_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->get)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_WRITE, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->get(target, regset, offset, size, NULL, data);
 }
@@ -358,8 +361,11 @@ static inline int copy_regset_from_user(struct task_struct *target,
 {
         const struct user_regset *regset = &view->regsets[setno];
 
+        if (!regset->set)
+                return -EOPNOTSUPP;
+
         if (!access_ok(VERIFY_READ, data, size))
-                return -EIO;
+                return -EFAULT;
 
         return regset->set(target, regset, offset, size, NULL, data);
 }
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 8e872ead88b5..577592ea0ea0 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -602,6 +602,9 @@ struct tcamsg {
 #define TCA_ACT_TAB 1 /* attr type must be >=1 */       
 #define TCAA_MAX 1
 
+/* New extended info filters for IFLA_EXT_MASK */
+#define RTEXT_FILTER_VF         (1 << 0)
+
 /* End of information exported to user level */
 
 #ifdef __KERNEL__
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 07f537a371ce..abb67cfa501c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1777,7 +1777,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
 /*
  * Per process flags
  */
-#define PF_STARTING     0x00000002      /* being created */
 #define PF_EXITING      0x00000004      /* getting shut down */
 #define PF_EXITPIDONE   0x00000008      /* pi exit done on shut down */
 #define PF_VCPU         0x00000010      /* I'm a virtual CPU */
@@ -2371,7 +2370,7 @@ static inline int thread_group_empty(struct task_struct *p)
  * Protects ->fs, ->files, ->mm, ->group_info, ->comm, keyring
  * subscriptions and synchronises with wait4().  Also used in procfs.  Also
  * pins the final release of task.io_context.  Also protects ->cpuset and
- * ->cgroup.subsys[].
+ * ->cgroup.subsys[]. And ->vfork_done.
  *
  * Nests both inside and outside of read_lock(&tasklist_lock).
  * It must not be nested with write_lock_irq(&tasklist_lock),
diff --git a/include/linux/signalfd.h b/include/linux/signalfd.h
index 3ff4961da9b5..247399b2979a 100644
--- a/include/linux/signalfd.h
+++ b/include/linux/signalfd.h
@@ -61,13 +61,16 @@ static inline void signalfd_notify(struct task_struct *tsk, int sig)
                 wake_up(&tsk->sighand->signalfd_wqh);
 }
 
+extern void signalfd_cleanup(struct sighand_struct *sighand);
+
 #else /* CONFIG_SIGNALFD */
 
 static inline void signalfd_notify(struct task_struct *tsk, int sig) { }
 
+static inline void signalfd_cleanup(struct sighand_struct *sighand) { }
+
 #endif /* CONFIG_SIGNALFD */
 
 #endif /* __KERNEL__ */
 
 #endif /* _LINUX_SIGNALFD_H */
-
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 50db9b04a552..ae86adee3746 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1465,6 +1465,16 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
 }
 #endif /* NET_SKBUFF_DATA_USES_OFFSET */
 
+static inline void skb_mac_header_rebuild(struct sk_buff *skb)
+{
+        if (skb_mac_header_was_set(skb)) {
+                const unsigned char *old_mac = skb_mac_header(skb);
+
+                skb_set_mac_header(skb, -skb->mac_len);
+                memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        }
+}
+
 static inline int skb_checksum_start_offset(const struct sk_buff *skb)
 {
         return skb->csum_start - skb_headroom(skb);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 515669fa3c1d..8ec1153ff57b 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -624,7 +624,7 @@ asmlinkage long sys_socketpair(int, int, int, int __user *);
 asmlinkage long sys_socketcall(int call, unsigned long __user *args);
 asmlinkage long sys_listen(int, int);
 asmlinkage long sys_poll(struct pollfd __user *ufds, unsigned int nfds,
-                                long timeout);
+                                int timeout);
 asmlinkage long sys_select(int n, fd_set __user *inp, fd_set __user *outp,
                         fd_set __user *exp, struct timeval __user *tvp);
 asmlinkage long sys_old_select(struct sel_arg_struct __user *arg);
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 46a85c9e1f25..3c7ffdb40dc6 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -412,7 +412,8 @@ struct tcp_sock {
 
         struct tcp_sack_block recv_sack_cache[4];
 
-        struct sk_buff *highest_sack;   /* highest skb with SACK received
+        struct sk_buff *highest_sack;   /* skb just after the highest
+                                         * skb with SACKed bit set
                                          * (validity guaranteed only if
                                          * sacked_out > 0)
                                          */
diff --git a/include/linux/usb/ch11.h b/include/linux/usb/ch11.h
index 31fdb4c6ee3d..0b83acd3360a 100644
--- a/include/linux/usb/ch11.h
+++ b/include/linux/usb/ch11.h
@@ -61,12 +61,6 @@
 #define USB_PORT_FEAT_TEST              21
 #define USB_PORT_FEAT_INDICATOR         22
 #define USB_PORT_FEAT_C_PORT_L1         23
-#define USB_PORT_FEAT_C_PORT_LINK_STATE 25
-#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR 26
-#define USB_PORT_FEAT_PORT_REMOTE_WAKE_MASK 27
-#define USB_PORT_FEAT_BH_PORT_RESET     28
-#define USB_PORT_FEAT_C_BH_PORT_RESET   29
-#define USB_PORT_FEAT_FORCE_LINKPM_ACCEPT 30
 
 /*
  * Port feature selectors added by USB 3.0 spec.
@@ -75,8 +69,8 @@
 #define USB_PORT_FEAT_LINK_STATE                5
 #define USB_PORT_FEAT_U1_TIMEOUT                23
 #define USB_PORT_FEAT_U2_TIMEOUT                24
-#define USB_PORT_FEAT_C_LINK_STATE              25
-#define USB_PORT_FEAT_C_CONFIG_ERR              26
+#define USB_PORT_FEAT_C_PORT_LINK_STATE         25
+#define USB_PORT_FEAT_C_PORT_CONFIG_ERROR       26
 #define USB_PORT_FEAT_REMOTE_WAKE_MASK          27
 #define USB_PORT_FEAT_BH_PORT_RESET             28
 #define USB_PORT_FEAT_C_BH_PORT_RESET           29
diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h
index abaad6ed9b83..4a82ca0bb0b2 100644
--- a/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -256,4 +256,6 @@ void l2cap_exit(void);
 int sco_init(void);
 void sco_exit(void);
 
+void bt_sock_reclassify_lock(struct sock *sk, int proto);
+
 #endif /* __BLUETOOTH_H */
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea9231f4935f..453893b3120e 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -540,7 +540,7 @@ void hci_conn_put_device(struct hci_conn *conn);
 static inline void hci_conn_hold(struct hci_conn *conn)
 {
         atomic_inc(&conn->refcnt);
-        cancel_delayed_work_sync(&conn->disc_work);
+        cancel_delayed_work(&conn->disc_work);
 }
 
 static inline void hci_conn_put(struct hci_conn *conn)
@@ -559,9 +559,9 @@ static inline void hci_conn_put(struct hci_conn *conn)
                 } else {
                         timeo = msecs_to_jiffies(10);
                 }
-                cancel_delayed_work_sync(&conn->disc_work);
+                cancel_delayed_work(&conn->disc_work);
                 queue_delayed_work(conn->hdev->workqueue,
-                                        &conn->disc_work, jiffies + timeo);
+                                        &conn->disc_work, timeo);
         }
 }
 
diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 68f589150692..b1664ed884e6 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -611,7 +611,7 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 {
         BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
 
-        if (!__cancel_delayed_work(work))
+        if (!cancel_delayed_work(work))
                 l2cap_chan_hold(chan);
         schedule_delayed_work(work, timeout);
 }
@@ -619,20 +619,20 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 static inline void l2cap_clear_timer(struct l2cap_chan *chan,
                                         struct delayed_work *work)
 {
-        if (__cancel_delayed_work(work))
+        if (cancel_delayed_work(work))
                 l2cap_chan_put(chan);
 }
 
 #define __set_chan_timer(c, t) l2cap_set_timer(c, &c->chan_timer, (t))
 #define __clear_chan_timer(c) l2cap_clear_timer(c, &c->chan_timer)
 #define __set_retrans_timer(c) l2cap_set_timer(c, &c->retrans_timer, \
-                L2CAP_DEFAULT_RETRANS_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_RETRANS_TO));
 #define __clear_retrans_timer(c) l2cap_clear_timer(c, &c->retrans_timer)
 #define __set_monitor_timer(c) l2cap_set_timer(c, &c->monitor_timer, \
-                L2CAP_DEFAULT_MONITOR_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_MONITOR_TO));
 #define __clear_monitor_timer(c) l2cap_clear_timer(c, &c->monitor_timer)
 #define __set_ack_timer(c) l2cap_set_timer(c, &chan->ack_timer, \
-                L2CAP_DEFAULT_ACK_TO);
+                msecs_to_jiffies(L2CAP_DEFAULT_ACK_TO));
 #define __clear_ack_timer(c) l2cap_clear_timer(c, &c->ack_timer)
 
 static inline int __seq_offset(struct l2cap_chan *chan, __u16 seq1, __u16 seq2)
@@ -834,7 +834,7 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 struct l2cap_chan *l2cap_chan_create(struct sock *sk);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
 void l2cap_chan_destroy(struct l2cap_chan *chan);
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
                                                                 bdaddr_t *dst);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
                                                                 u32 priority);
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index 06b795dd5906..b94765e38e80 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -35,12 +35,12 @@ struct inet_peer {
 
         u32                     metrics[RTAX_MAX];
         u32                     rate_tokens;    /* rate limiting for ICMP */
-        int                     redirect_genid;
         unsigned long           rate_last;
         unsigned long           pmtu_expires;
         u32                     pmtu_orig;
         u32                     pmtu_learned;
         struct inetpeer_addr_base redirect_learned;
+        struct list_head        gc_list;
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
          * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
@@ -96,6 +96,8 @@ static inline struct inet_peer *inet_getpeer_v6(const struct in6_addr *v6daddr,
 extern void inet_putpeer(struct inet_peer *p);
 extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
 
+extern void inetpeer_invalidate_tree(int family);
+
 /*
  * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
  * tcp_ts_stamp if no refcount is taken on inet_peer
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index 8a2b0ae7dbd2..ab86036bbf0c 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -209,7 +209,7 @@ extern struct nf_conntrack_tuple_hash *
 __nf_conntrack_find(struct net *net, u16 zone,
                     const struct nf_conntrack_tuple *tuple);
 
-extern void nf_conntrack_hash_insert(struct nf_conn *ct);
+extern int nf_conntrack_hash_check_insert(struct nf_conn *ct);
 extern void nf_ct_delete_from_lists(struct nf_conn *ct);
 extern void nf_ct_insert_dying_list(struct nf_conn *ct);
 
diff --git a/include/net/rtnetlink.h b/include/net/rtnetlink.h
index 678f1ffaf843..370293901971 100644
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -6,7 +6,7 @@
 
 typedef int (*rtnl_doit_func)(struct sk_buff *, struct nlmsghdr *, void *);
 typedef int (*rtnl_dumpit_func)(struct sk_buff *, struct netlink_callback *);
-typedef u16 (*rtnl_calcit_func)(struct sk_buff *);
+typedef u16 (*rtnl_calcit_func)(struct sk_buff *, struct nlmsghdr *);
 
 extern int      __rtnl_register(int protocol, int msgtype,
                                 rtnl_doit_func, rtnl_dumpit_func,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 42c29bfbcee3..2d80c291fffb 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1364,8 +1364,9 @@ static inline void tcp_push_pending_frames(struct sock *sk)
         }
 }
 
-/* Start sequence of the highest skb with SACKed bit, valid only if
- * sacked > 0 or when the caller has ensured validity by itself.
+/* Start sequence of the skb just after the highest skb with SACKed
+ * bit, valid only if sacked_out > 0 or when the caller has ensured
+ * validity by itself.
  */
 static inline u32 tcp_highest_sack_seq(struct tcp_sock *tp)
 {
diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 6ba596b07a72..e33ed1bfa113 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -370,56 +370,6 @@ TRACE_EVENT(sched_stat_runtime,
                         (unsigned long long)__entry->vruntime)
 );
 
-#ifdef CREATE_TRACE_POINTS
-static inline u64 trace_get_sleeptime(struct task_struct *tsk)
-{
-#ifdef CONFIG_SCHEDSTATS
-        u64 block, sleep;
-
-        block = tsk->se.statistics.block_start;
-        sleep = tsk->se.statistics.sleep_start;
-        tsk->se.statistics.block_start = 0;
-        tsk->se.statistics.sleep_start = 0;
-
-        return block ? block : sleep ? sleep : 0;
-#else
-        return 0;
-#endif
-}
-#endif
-
-/*
- * Tracepoint for accounting sleeptime (time the task is sleeping
- * or waiting for I/O).
- */
-TRACE_EVENT(sched_stat_sleeptime,
-
-        TP_PROTO(struct task_struct *tsk, u64 now),
-
-        TP_ARGS(tsk, now),
-
-        TP_STRUCT__entry(
-                __array( char,  comm,   TASK_COMM_LEN   )
-                __field( pid_t, pid                     )
-                __field( u64,   sleeptime               )
-        ),
-
-        TP_fast_assign(
-                memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN);
-                __entry->pid            = tsk->pid;
-                __entry->sleeptime = trace_get_sleeptime(tsk);
-                __entry->sleeptime = __entry->sleeptime ?
-                                now - __entry->sleeptime : 0;
-        )
-        TP_perf_assign(
-                __perf_count(__entry->sleeptime);
-        ),
-
-        TP_printk("comm=%s pid=%d sleeptime=%Lu [ns]",
-                        __entry->comm, __entry->pid,
-                        (unsigned long long)__entry->sleeptime)
-);
-
 /*
  * Tracepoint for showing priority inheritance modifying a tasks
  * priority.
diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c
index b7971d6f38bf..ee706ce44aa0 100644
--- a/kernel/events/hw_breakpoint.c
+++ b/kernel/events/hw_breakpoint.c
@@ -651,10 +651,10 @@ int __init init_hw_breakpoint(void)
 
  err_alloc:
         for_each_possible_cpu(err_cpu) {
-                if (err_cpu == cpu)
-                        break;
                 for (i = 0; i < TYPE_MAX; i++)
                         kfree(per_cpu(nr_task_bp_pinned[i], cpu));
+                if (err_cpu == cpu)
+                        break;
         }
 
         return -ENOMEM;
diff --git a/kernel/fork.c b/kernel/fork.c
index b77fd559c78e..26a7a6707fa7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -66,6 +66,7 @@
 #include <linux/user-return-notifier.h>
 #include <linux/oom.h>
 #include <linux/khugepaged.h>
+#include <linux/signalfd.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -667,6 +668,38 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
         return mm;
 }
 
+static void complete_vfork_done(struct task_struct *tsk)
+{
+        struct completion *vfork;
+
+        task_lock(tsk);
+        vfork = tsk->vfork_done;
+        if (likely(vfork)) {
+                tsk->vfork_done = NULL;
+                complete(vfork);
+        }
+        task_unlock(tsk);
+}
+
+static int wait_for_vfork_done(struct task_struct *child,
+                                struct completion *vfork)
+{
+        int killed;
+
+        freezer_do_not_count();
+        killed = wait_for_completion_killable(vfork);
+        freezer_count();
+
+        if (killed) {
+                task_lock(child);
+                child->vfork_done = NULL;
+                task_unlock(child);
+        }
+
+        put_task_struct(child);
+        return killed;
+}
+
 /* Please note the differences between mmput and mm_release.
  * mmput is called whenever we stop holding onto a mm_struct,
  * error success whatever.
@@ -682,8 +715,6 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode)
  */
 void mm_release(struct task_struct *tsk, struct mm_struct *mm)
 {
-        struct completion *vfork_done = tsk->vfork_done;
-
         /* Get rid of any futexes when releasing the mm */
 #ifdef CONFIG_FUTEX
         if (unlikely(tsk->robust_list)) {
@@ -703,17 +734,15 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
         /* Get rid of any cached register state */
         deactivate_mm(tsk, mm);
 
-        /* notify parent sleeping on vfork() */
-        if (vfork_done) {
-                tsk->vfork_done = NULL;
-                complete(vfork_done);
-        }
+        if (tsk->vfork_done)
+                complete_vfork_done(tsk);
 
         /*
          * If we're exiting normally, clear a user-space tid field if
          * requested.  We leave this alone when dying by signal, to leave
          * the value intact in a core dump, and to save the unnecessary
-         * trouble otherwise.  Userland only wants this done for a sys_exit.
+         * trouble, say, a killed vfork parent shouldn't touch this mm.
+         * Userland only wants this done for a sys_exit.
          */
         if (tsk->clear_child_tid) {
                 if (!(tsk->flags & PF_SIGNALED) &&
@@ -935,8 +964,10 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
 
 void __cleanup_sighand(struct sighand_struct *sighand)
 {
-        if (atomic_dec_and_test(&sighand->count))
+        if (atomic_dec_and_test(&sighand->count)) {
+                signalfd_cleanup(sighand);
                 kmem_cache_free(sighand_cachep, sighand);
+        }
 }
 
 
@@ -1015,7 +1046,6 @@ static void copy_flags(unsigned long clone_flags, struct task_struct *p)
 
         new_flags &= ~(PF_SUPERPRIV | PF_WQ_WORKER);
         new_flags |= PF_FORKNOEXEC;
-        new_flags |= PF_STARTING;
         p->flags = new_flags;
 }
 
@@ -1545,16 +1575,9 @@ long do_fork(unsigned long clone_flags,
                 if (clone_flags & CLONE_VFORK) {
                         p->vfork_done = &vfork;
                         init_completion(&vfork);
+                        get_task_struct(p);
                 }
 
-                /*
-                 * We set PF_STARTING at creation in case tracing wants to
-                 * use this to distinguish a fully live task from one that
-                 * hasn't finished SIGSTOP raising yet.  Now we clear it
-                 * and set the child going.
-                 */
-                p->flags &= ~PF_STARTING;
-
                 wake_up_new_task(p);
 
                 /* forking complete and child started to run, tell ptracer */
@@ -1562,10 +1585,8 @@ long do_fork(unsigned long clone_flags,
                         ptrace_event(trace, nr);
 
                 if (clone_flags & CLONE_VFORK) {
-                        freezer_do_not_count();
-                        wait_for_completion(&vfork);
-                        freezer_count();
-                        ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
+                        if (!wait_for_vfork_done(p, &vfork))
+                                ptrace_event(PTRACE_EVENT_VFORK_DONE, nr);
                 }
         } else {
                 nr = PTR_ERR(p);
diff --git a/kernel/hung_task.c b/kernel/hung_task.c
index 2e48ec0c2e91..c21449f85a2a 100644
--- a/kernel/hung_task.c
+++ b/kernel/hung_task.c
@@ -119,15 +119,20 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout)
  * For preemptible RCU it is sufficient to call rcu_read_unlock in order
  * to exit the grace period. For classic RCU, a reschedule is required.
  */
-static void rcu_lock_break(struct task_struct *g, struct task_struct *t)
+static bool rcu_lock_break(struct task_struct *g, struct task_struct *t)
 {
+        bool can_cont;
+
         get_task_struct(g);
         get_task_struct(t);
         rcu_read_unlock();
         cond_resched();
         rcu_read_lock();
+        can_cont = pid_alive(g) && pid_alive(t);
         put_task_struct(t);
         put_task_struct(g);
+
+        return can_cont;
 }
 
 /*
@@ -154,9 +159,7 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout)
                         goto unlock;
                 if (!--batch_count) {
                         batch_count = HUNG_TASK_BATCHING;
-                        rcu_lock_break(g, t);
-                        /* Exit if t or g was unhashed during refresh. */
-                        if (t->state == TASK_DEAD || g->state == TASK_DEAD)
+                        if (!rcu_lock_break(g, t))
                                 goto unlock;
                 }
                 /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */
diff --git a/kernel/irq/autoprobe.c b/kernel/irq/autoprobe.c
index 342d8f44e401..0119b9d467ae 100644
--- a/kernel/irq/autoprobe.c
+++ b/kernel/irq/autoprobe.c
@@ -53,7 +53,7 @@ unsigned long probe_irq_on(void)
                         if (desc->irq_data.chip->irq_set_type)
                                 desc->irq_data.chip->irq_set_type(&desc->irq_data,
                                                          IRQ_TYPE_PROBE);
-                        irq_startup(desc);
+                        irq_startup(desc, false);
                 }
                 raw_spin_unlock_irq(&desc->lock);
         }
@@ -70,7 +70,7 @@ unsigned long probe_irq_on(void)
                 raw_spin_lock_irq(&desc->lock);
                 if (!desc->action && irq_settings_can_probe(desc)) {
                         desc->istate |= IRQS_AUTODETECT | IRQS_WAITING;
-                        if (irq_startup(desc))
+                        if (irq_startup(desc, false))
                                 desc->istate |= IRQS_PENDING;
                 }
                 raw_spin_unlock_irq(&desc->lock);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index 4dbc9c9d641b..25784d630a12 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -156,19 +156,22 @@ static void irq_state_set_masked(struct irq_desc *desc)
         irqd_set(&desc->irq_data, IRQD_IRQ_MASKED);
 }
 
-int irq_startup(struct irq_desc *desc)
+int irq_startup(struct irq_desc *desc, bool resend)
 {
+        int ret = 0;
+
         irq_state_clr_disabled(desc);
         desc->depth = 0;
 
         if (desc->irq_data.chip->irq_startup) {
-                int ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
+                ret = desc->irq_data.chip->irq_startup(&desc->irq_data);
                 irq_state_clr_masked(desc);
-                return ret;
+        } else {
+                irq_enable(desc);
         }
-
-        irq_enable(desc);
-        return 0;
+        if (resend)
+                check_irq_resend(desc, desc->irq_data.irq);
+        return ret;
 }
 
 void irq_shutdown(struct irq_desc *desc)
@@ -329,6 +332,24 @@ out_unlock:
 }
 EXPORT_SYMBOL_GPL(handle_simple_irq);
 
+/*
+ * Called unconditionally from handle_level_irq() and only for oneshot
+ * interrupts from handle_fasteoi_irq()
+ */
+static void cond_unmask_irq(struct irq_desc *desc)
+{
+        /*
+         * We need to unmask in the following cases:
+         * - Standard level irq (IRQF_ONESHOT is not set)
+         * - Oneshot irq which did not wake the thread (caused by a
+         *   spurious interrupt or a primary handler handling it
+         *   completely).
+         */
+        if (!irqd_irq_disabled(&desc->irq_data) &&
+            irqd_irq_masked(&desc->irq_data) && !desc->threads_oneshot)
+                unmask_irq(desc);
+}
+
 /**
  *      handle_level_irq - Level type irq handler
  *      @irq:   the interrupt number
@@ -361,8 +382,8 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
 
         handle_irq_event(desc);
 
-        if (!irqd_irq_disabled(&desc->irq_data) && !(desc->istate & IRQS_ONESHOT))
-                unmask_irq(desc);
+        cond_unmask_irq(desc);
+
 out_unlock:
         raw_spin_unlock(&desc->lock);
 }
@@ -416,6 +437,9 @@ handle_fasteoi_irq(unsigned int irq, struct irq_desc *desc)
         preflow_handler(desc);
         handle_irq_event(desc);
 
+        if (desc->istate & IRQS_ONESHOT)
+                cond_unmask_irq(desc);
+
 out_eoi:
         desc->irq_data.chip->irq_eoi(&desc->irq_data);
 out_unlock:
@@ -624,7 +648,7 @@ __irq_set_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
                 irq_settings_set_noprobe(desc);
                 irq_settings_set_norequest(desc);
                 irq_settings_set_nothread(desc);
-                irq_startup(desc);
+                irq_startup(desc, true);
         }
 out:
         irq_put_desc_busunlock(desc, flags);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 5c233e0ea2c3..8e5c56b3b7d9 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -65,7 +65,7 @@ extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
 extern void __disable_irq(struct irq_desc *desc, unsigned int irq, bool susp);
 extern void __enable_irq(struct irq_desc *desc, unsigned int irq, bool resume);
 
-extern int irq_startup(struct irq_desc *desc);
+extern int irq_startup(struct irq_desc *desc, bool resend);
 extern void irq_shutdown(struct irq_desc *desc);
 extern void irq_enable(struct irq_desc *desc);
 extern void irq_disable(struct irq_desc *desc);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index a94466db73b2..1786cf7dac54 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -979,6 +979,11 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 
                 /* add new interrupt at end of irq queue */
                 do {
+                        /*
+                         * Or all existing action->thread_mask bits,
+                         * so we can find the next zero bit for this
+                         * new action.
+                         */
                         thread_mask |= old->thread_mask;
                         old_ptr = &old->next;
                         old = *old_ptr;
@@ -987,14 +992,41 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
         }
 
         /*
-         * Setup the thread mask for this irqaction. Unlikely to have
-         * 32 resp 64 irqs sharing one line, but who knows.
+         * Setup the thread mask for this irqaction for ONESHOT. For
+         * !ONESHOT irqs the thread mask is 0 so we can avoid a
+         * conditional in irq_wake_thread().
          */
-        if (new->flags & IRQF_ONESHOT && thread_mask == ~0UL) {
-                ret = -EBUSY;
-                goto out_mask;
+        if (new->flags & IRQF_ONESHOT) {
+                /*
+                 * Unlikely to have 32 resp 64 irqs sharing one line,
+                 * but who knows.
+                 */
+                if (thread_mask == ~0UL) {
+                        ret = -EBUSY;
+                        goto out_mask;
+                }
+                /*
+                 * The thread_mask for the action is or'ed to
+                 * desc->thread_active to indicate that the
+                 * IRQF_ONESHOT thread handler has been woken, but not
+                 * yet finished. The bit is cleared when a thread
+                 * completes. When all threads of a shared interrupt
+                 * line have completed desc->threads_active becomes
+                 * zero and the interrupt line is unmasked. See
+                 * handle.c:irq_wake_thread() for further information.
+                 *
+                 * If no thread is woken by primary (hard irq context)
+                 * interrupt handlers, then desc->threads_active is
+                 * also checked for zero to unmask the irq line in the
+                 * affected hard irq flow handlers
+                 * (handle_[fasteoi|level]_irq).
+                 *
+                 * The new action gets the first zero bit of
+                 * thread_mask assigned. See the loop above which or's
+                 * all existing action->thread_mask bits.
+                 */
+                new->thread_mask = 1 << ffz(thread_mask);
         }
-        new->thread_mask = 1 << ffz(thread_mask);
 
         if (!shared) {
                 init_waitqueue_head(&desc->wait_for_threads);
@@ -1021,7 +1053,7 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
                         desc->istate |= IRQS_ONESHOT;
 
                 if (irq_settings_can_autoenable(desc))
-                        irq_startup(desc);
+                        irq_startup(desc, true);
                 else
                         /* Undo nested disables: */
                         desc->depth = 1;
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 9788c0ec6f43..c62b8546cc90 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1334,8 +1334,10 @@ int __kprobes register_kprobe(struct kprobe *p)
         if (!kernel_text_address((unsigned long) p->addr) ||
             in_kprobes_functions((unsigned long) p->addr) ||
             ftrace_text_reserved(p->addr, p->addr) ||
-            jump_label_text_reserved(p->addr, p->addr))
-                goto fail_with_jump_label;
+            jump_label_text_reserved(p->addr, p->addr)) {
+                ret = -EINVAL;
+                goto cannot_probe;
+        }
 
         /* User can pass only KPROBE_FLAG_DISABLED to register_kprobe */
         p->flags &= KPROBE_FLAG_DISABLED;
@@ -1352,7 +1354,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                  * its code to prohibit unexpected unloading.
                  */
                 if (unlikely(!try_module_get(probed_mod)))
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
 
                 /*
                  * If the module freed .init.text, we couldn't insert
@@ -1361,7 +1363,7 @@ int __kprobes register_kprobe(struct kprobe *p)
                 if (within_module_init((unsigned long)p->addr, probed_mod) &&
                     probed_mod->state != MODULE_STATE_COMING) {
                         module_put(probed_mod);
-                        goto fail_with_jump_label;
+                        goto cannot_probe;
                 }
                 /* ret will be updated by following code */
         }
@@ -1409,7 +1411,7 @@ out:
 
         return ret;
 
-fail_with_jump_label:
+cannot_probe:
         preempt_enable();
         jump_label_unlock();
         return ret;
diff --git a/kernel/pid.c b/kernel/pid.c
index ce8e00deaccb..9f08dfabaf13 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -543,12 +543,12 @@ struct pid *find_ge_pid(int nr, struct pid_namespace *ns)
  */
 void __init pidhash_init(void)
 {
-        int i, pidhash_size;
+        unsigned int i, pidhash_size;
 
         pid_hash = alloc_large_system_hash("PID", sizeof(*pid_hash), 0, 18,
                                            HASH_EARLY | HASH_SMALL,
                                            &pidhash_shift, NULL, 4096);
-        pidhash_size = 1 << pidhash_shift;
+        pidhash_size = 1U << pidhash_shift;
 
         for (i = 0; i < pidhash_size; i++)
                 INIT_HLIST_HEAD(&pid_hash[i]);
diff --git a/kernel/printk.c b/kernel/printk.c
index 13c0a1143f49..32690a0b7a18 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -702,6 +702,9 @@ static bool printk_time = 0;
 #endif
 module_param_named(time, printk_time, bool, S_IRUGO | S_IWUSR);
 
+static bool always_kmsg_dump;
+module_param_named(always_kmsg_dump, always_kmsg_dump, bool, S_IRUGO | S_IWUSR);
+
 /* Check if we have any console registered that can be called early in boot. */
 static int have_callable_console(void)
 {
@@ -1732,6 +1735,9 @@ void kmsg_dump(enum kmsg_dump_reason reason)
         unsigned long l1, l2;
         unsigned long flags;
 
+        if ((reason > KMSG_DUMP_OOPS) && !always_kmsg_dump)
+                return;
+
         /* Theoretically, the log could move on after we do this, but
            there's not a lot we can do about that. The new messages
            will overwrite the start of what we dump. */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 5255c9d2e053..b342f57879e6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1932,7 +1932,6 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
         local_irq_enable();
 #endif /* __ARCH_WANT_INTERRUPTS_ON_CTXSW */
         finish_lock_switch(rq, prev);
-        trace_sched_stat_sleeptime(current, rq->clock);
 
         fire_sched_in_preempt_notifiers(current);
         if (mm)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 7c6414fc669d..aca16b843b7e 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1003,6 +1003,7 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 if (unlikely(delta > se->statistics.sleep_max))
                         se->statistics.sleep_max = delta;
 
+                se->statistics.sleep_start = 0;
                 se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
@@ -1019,6 +1020,7 @@ static void enqueue_sleeper(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 if (unlikely(delta > se->statistics.block_max))
                         se->statistics.block_max = delta;
 
+                se->statistics.block_start = 0;
                 se->statistics.sum_sleep_runtime += delta;
 
                 if (tsk) {
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 77cb245f8e7b..0ab9ae8057f0 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -818,17 +818,9 @@ static int __init fixup_activate(void *addr, enum debug_obj_state state)
                 if (obj->static_init == 1) {
                         debug_object_init(obj, &descr_type_test);
                         debug_object_activate(obj, &descr_type_test);
-                        /*
-                         * Real code should return 0 here ! This is
-                         * not a fixup of some bad behaviour. We
-                         * merily call the debug_init function to keep
-                         * track of the object.
-                         */
-                        return 1;
-                } else {
-                        /* Real code needs to emit a warning here */
+                        return 0;
                 }
-                return 0;
+                return 1;
 
         case ODEBUG_STATE_ACTIVE:
                 debug_object_deactivate(obj, &descr_type_test);
@@ -967,7 +959,7 @@ static void __init debug_objects_selftest(void)
 
         obj.static_init = 1;
         debug_object_activate(&obj, &descr_type_test);
-        if (check_results(&obj, ODEBUG_STATE_ACTIVE, ++fixups, warnings))
+        if (check_results(&obj, ODEBUG_STATE_ACTIVE, fixups, warnings))
                 goto out;
         debug_object_init(&obj, &descr_type_test);
         if (check_results(&obj, ODEBUG_STATE_INIT, ++fixups, ++warnings))
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 8e75003d62f6..38e612e66da5 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -891,9 +891,15 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
         case 'U':
                 return uuid_string(buf, end, ptr, spec, fmt);
         case 'V':
-                return buf + vsnprintf(buf, end > buf ? end - buf : 0,
-                                       ((struct va_format *)ptr)->fmt,
-                                       *(((struct va_format *)ptr)->va));
+                {
+                        va_list va;
+
+                        va_copy(va, *((struct va_format *)ptr)->va);
+                        buf += vsnprintf(buf, end > buf ? end - buf : 0,
+                                         ((struct va_format *)ptr)->fmt, va);
+                        va_end(va);
+                        return buf;
+                }
         case 'K':
                 /*
                  * %pK cannot be used in IRQ context because its test
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 91d3efb25d15..8f7fc394f636 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -671,6 +671,7 @@ static int __do_huge_pmd_anonymous_page(struct mm_struct *mm,
                 set_pmd_at(mm, haddr, pmd, entry);
                 prepare_pmd_huge_pte(pgtable, mm);
                 add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
+                mm->nr_ptes++;
                 spin_unlock(&mm->page_table_lock);
         }
 
@@ -789,6 +790,7 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
         pmd = pmd_mkold(pmd_wrprotect(pmd));
         set_pmd_at(dst_mm, addr, dst_pmd, pmd);
         prepare_pmd_huge_pte(pgtable, dst_mm);
+        dst_mm->nr_ptes++;
 
         ret = 0;
 out_unlock:
@@ -887,7 +889,6 @@ static int do_huge_pmd_wp_page_fallback(struct mm_struct *mm,
         }
         kfree(pages);
 
-        mm->nr_ptes++;
         smp_wmb(); /* make pte visible before pmd */
         pmd_populate(mm, pmd, pgtable);
         page_remove_rmap(page);
@@ -1047,6 +1048,7 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma,
                         VM_BUG_ON(page_mapcount(page) < 0);
                         add_mm_counter(tlb->mm, MM_ANONPAGES, -HPAGE_PMD_NR);
                         VM_BUG_ON(!PageHead(page));
+                        tlb->mm->nr_ptes--;
                         spin_unlock(&tlb->mm->page_table_lock);
                         tlb_remove_page(tlb, page);
                         pte_free(tlb->mm, pgtable);
@@ -1375,7 +1377,6 @@ static int __split_huge_page_map(struct page *page,
                         pte_unmap(pte);
                 }
 
-                mm->nr_ptes++;
                 smp_wmb(); /* make pte visible before pmd */
                 /*
                  * Up to this point the pmd is present and huge and
@@ -1988,7 +1989,6 @@ static void collapse_huge_page(struct mm_struct *mm,
         set_pmd_at(mm, address, pmd, _pmd);
         update_mmu_cache(vma, address, _pmd);
         prepare_pmd_huge_pte(pgtable, mm);
-        mm->nr_ptes--;
         spin_unlock(&mm->page_table_lock);
 
 #ifndef CONFIG_NUMA
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 5f34bd8dda34..a876871f6be5 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2277,8 +2277,8 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
                         set_page_dirty(page);
                 list_add(&page->lru, &page_list);
         }
-        spin_unlock(&mm->page_table_lock);
         flush_tlb_range(vma, start, end);
+        spin_unlock(&mm->page_table_lock);
         mmu_notifier_invalidate_range_end(mm, start, end);
         list_for_each_entry_safe(page, tmp, &page_list, lru) {
                 page_remove_rmap(page);
diff --git a/mm/ksm.c b/mm/ksm.c
index 1925ffbfb27f..310544a379ae 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -28,7 +28,6 @@
 #include <linux/kthread.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
-#include <linux/memcontrol.h>
 #include <linux/rbtree.h>
 #include <linux/memory.h>
 #include <linux/mmu_notifier.h>
@@ -1572,16 +1571,6 @@ struct page *ksm_does_need_to_copy(struct page *page,
 
         new_page = alloc_page_vma(GFP_HIGHUSER_MOVABLE, vma, address);
         if (new_page) {
-                /*
-                 * The memcg-specific accounting when moving
-                 * pages around the LRU lists relies on the
-                 * page's owner (memcg) to be valid.  Usually,
-                 * pages are assigned to a new owner before
-                 * being put on the LRU list, but since this
-                 * is not the case here, the stale owner from
-                 * a previous allocation cycle must be reset.
-                 */
-                mem_cgroup_reset_owner(new_page);
                 copy_user_highpage(new_page, page, address, vma);
 
                 SetPageDirty(new_page);
diff --git a/mm/memblock.c b/mm/memblock.c
index 77b5f227e1d8..99f285599501 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -99,9 +99,6 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t start,
         phys_addr_t this_start, this_end, cand;
         u64 i;
 
-        /* align @size to avoid excessive fragmentation on reserved array */
-        size = round_up(size, align);
-
         /* pump up @end */
         if (end == MEMBLOCK_ALLOC_ACCESSIBLE)
                 end = memblock.current_limit;
@@ -731,6 +728,9 @@ static phys_addr_t __init memblock_alloc_base_nid(phys_addr_t size,
 {
         phys_addr_t found;
 
+        /* align @size to avoid excessive fragmentation on reserved array */
+        size = round_up(size, align);
+
         found = memblock_find_in_range_node(0, max_addr, size, align, nid);
         if (found && !memblock_reserve(found, size))
                 return found;
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 6728a7ae6f2d..d0e57a3cda18 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1042,6 +1042,19 @@ struct lruvec *mem_cgroup_lru_add_list(struct zone *zone, struct page *page,
 
         pc = lookup_page_cgroup(page);
         memcg = pc->mem_cgroup;
+
+        /*
+         * Surreptitiously switch any uncharged page to root:
+         * an uncharged page off lru does nothing to secure
+         * its former mem_cgroup from sudden removal.
+         *
+         * Our caller holds lru_lock, and PageCgroupUsed is updated
+         * under page_cgroup lock: between them, they make all uses
+         * of pc->mem_cgroup safe.
+         */
+        if (!PageCgroupUsed(pc) && memcg != root_mem_cgroup)
+                pc->mem_cgroup = memcg = root_mem_cgroup;
+
         mz = page_cgroup_zoneinfo(memcg, page);
         /* compound_order() is stabilized through lru_lock */
         MEM_CGROUP_ZSTAT(mz, lru) += 1 << compound_order(page);
@@ -2408,8 +2421,12 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                                        struct page *page,
                                        unsigned int nr_pages,
                                        struct page_cgroup *pc,
-                                       enum charge_type ctype)
+                                       enum charge_type ctype,
+                                       bool lrucare)
 {
+        struct zone *uninitialized_var(zone);
+        bool was_on_lru = false;
+
         lock_page_cgroup(pc);
         if (unlikely(PageCgroupUsed(pc))) {
                 unlock_page_cgroup(pc);
@@ -2420,6 +2437,21 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
          * we don't need page_cgroup_lock about tail pages, becase they are not
          * accessed by any other context at this point.
          */
+
+        /*
+         * In some cases, SwapCache and FUSE(splice_buf->radixtree), the page
+         * may already be on some other mem_cgroup's LRU.  Take care of it.
+         */
+        if (lrucare) {
+                zone = page_zone(page);
+                spin_lock_irq(&zone->lru_lock);
+                if (PageLRU(page)) {
+                        ClearPageLRU(page);
+                        del_page_from_lru_list(zone, page, page_lru(page));
+                        was_on_lru = true;
+                }
+        }
+
         pc->mem_cgroup = memcg;
         /*
          * We access a page_cgroup asynchronously without lock_page_cgroup().
@@ -2443,9 +2475,18 @@ static void __mem_cgroup_commit_charge(struct mem_cgroup *memcg,
                 break;
         }
 
+        if (lrucare) {
+                if (was_on_lru) {
+                        VM_BUG_ON(PageLRU(page));
+                        SetPageLRU(page);
+                        add_page_to_lru_list(zone, page, page_lru(page));
+                }
+                spin_unlock_irq(&zone->lru_lock);
+        }
+
         mem_cgroup_charge_statistics(memcg, PageCgroupCache(pc), nr_pages);
         unlock_page_cgroup(pc);
-        WARN_ON_ONCE(PageLRU(page));
+
         /*
          * "charge_statistics" updated event counter. Then, check it.
          * Insert ancestor (and ancestor's ancestors), to softlimit RB-tree.
@@ -2643,7 +2684,7 @@ static int mem_cgroup_charge_common(struct page *page, struct mm_struct *mm,
         ret = __mem_cgroup_try_charge(mm, gfp_mask, nr_pages, &memcg, oom);
         if (ret == -ENOMEM)
                 return ret;
-        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, page, nr_pages, pc, ctype, false);
         return 0;
 }
 
@@ -2663,35 +2704,6 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *ptr,
                                         enum charge_type ctype);
 
-static void
-__mem_cgroup_commit_charge_lrucare(struct page *page, struct mem_cgroup *memcg,
-                                        enum charge_type ctype)
-{
-        struct page_cgroup *pc = lookup_page_cgroup(page);
-        struct zone *zone = page_zone(page);
-        unsigned long flags;
-        bool removed = false;
-
-        /*
-         * In some case, SwapCache, FUSE(splice_buf->radixtree), the page
-         * is already on LRU. It means the page may on some other page_cgroup's
-         * LRU. Take care of it.
-         */
-        spin_lock_irqsave(&zone->lru_lock, flags);
-        if (PageLRU(page)) {
-                del_page_from_lru_list(zone, page, page_lru(page));
-                ClearPageLRU(page);
-                removed = true;
-        }
-        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype);
-        if (removed) {
-                add_page_to_lru_list(zone, page, page_lru(page));
-                SetPageLRU(page);
-        }
-        spin_unlock_irqrestore(&zone->lru_lock, flags);
-        return;
-}
-
 int mem_cgroup_cache_charge(struct page *page, struct mm_struct *mm,
                                 gfp_t gfp_mask)
 {
@@ -2769,13 +2781,16 @@ static void
 __mem_cgroup_commit_charge_swapin(struct page *page, struct mem_cgroup *memcg,
                                         enum charge_type ctype)
 {
+        struct page_cgroup *pc;
+
         if (mem_cgroup_disabled())
                 return;
         if (!memcg)
                 return;
         cgroup_exclude_rmdir(&memcg->css);
 
-        __mem_cgroup_commit_charge_lrucare(page, memcg, ctype);
+        pc = lookup_page_cgroup(page);
+        __mem_cgroup_commit_charge(memcg, page, 1, pc, ctype, true);
         /*
          * Now swap is on-memory. This means this page may be
          * counted both as mem and swap....double count.
@@ -3027,23 +3042,6 @@ void mem_cgroup_uncharge_end(void)
         batch->memcg = NULL;
 }
 
-/*
- * A function for resetting pc->mem_cgroup for newly allocated pages.
- * This function should be called if the newpage will be added to LRU
- * before start accounting.
- */
-void mem_cgroup_reset_owner(struct page *newpage)
-{
-        struct page_cgroup *pc;
-
-        if (mem_cgroup_disabled())
-                return;
-
-        pc = lookup_page_cgroup(newpage);
-        VM_BUG_ON(PageCgroupUsed(pc));
-        pc->mem_cgroup = root_mem_cgroup;
-}
-
 #ifdef CONFIG_SWAP
 /*
  * called after __delete_from_swap_cache() and drop "page" account.
@@ -3248,7 +3246,7 @@ int mem_cgroup_prepare_migration(struct page *page,
                 ctype = MEM_CGROUP_CHARGE_TYPE_CACHE;
         else
                 ctype = MEM_CGROUP_CHARGE_TYPE_SHMEM;
-        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, ctype, false);
         return ret;
 }
 
@@ -3332,7 +3330,7 @@ void mem_cgroup_replace_page_cache(struct page *oldpage,
          * the newpage may be on LRU(or pagevec for LRU) already. We lock
          * LRU while we overwrite pc->mem_cgroup.
          */
-        __mem_cgroup_commit_charge_lrucare(newpage, memcg, type);
+        __mem_cgroup_commit_charge(memcg, newpage, 1, pc, type, true);
 }
 
 #ifdef CONFIG_DEBUG_VM
@@ -4414,6 +4412,9 @@ static void mem_cgroup_usage_unregister_event(struct cgroup *cgrp,
          */
         BUG_ON(!thresholds);
 
+        if (!thresholds->primary)
+                goto unlock;
+
         usage = mem_cgroup_usage(memcg, type == _MEMSWAP);
 
         /* Check if a threshold crossed before removing */
@@ -4462,7 +4463,7 @@ swap_buffers:
 
         /* To be sure that nobody uses thresholds */
         synchronize_rcu();
-
+unlock:
         mutex_unlock(&memcg->thresholds_lock);
 }
 
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 06b145fb64ab..47296fee23db 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -640,10 +640,11 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
         unsigned long vmstart;
         unsigned long vmend;
 
-        vma = find_vma_prev(mm, start, &prev);
+        vma = find_vma(mm, start);
         if (!vma || vma->vm_start > start)
                 return -EFAULT;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/migrate.c b/mm/migrate.c
index df141f60289e..1503b6b54ecb 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -839,8 +839,6 @@ static int unmap_and_move(new_page_t get_new_page, unsigned long private,
         if (!newpage)
                 return -ENOMEM;
 
-        mem_cgroup_reset_owner(newpage);
-
         if (page_count(page) == 1) {
                 /* page was freed from under us. So we are done. */
                 goto out;
diff --git a/mm/mlock.c b/mm/mlock.c
index 4f4f53bdc65d..ef726e8aa8e9 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -385,10 +385,11 @@ static int do_mlock(unsigned long start, size_t len, int on)
                 return -EINVAL;
         if (end == start)
                 return 0;
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         if (!vma || vma->vm_start > start)
                 return -ENOMEM;
 
+        prev = vma->vm_prev;
         if (start > vma->vm_start)
                 prev = vma;
 
diff --git a/mm/mmap.c b/mm/mmap.c
index 3f758c7f4c81..da15a79b1441 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1266,8 +1266,9 @@ munmap_back:
         vma->vm_pgoff = pgoff;
         INIT_LIST_HEAD(&vma->anon_vma_chain);
 
+        error = -EINVAL;        /* when rejecting VM_GROWSDOWN|VM_GROWSUP */
+
         if (file) {
-                error = -EINVAL;
                 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
                         goto free_vma;
                 if (vm_flags & VM_DENYWRITE) {
@@ -1293,6 +1294,8 @@ munmap_back:
                 pgoff = vma->vm_pgoff;
                 vm_flags = vma->vm_flags;
         } else if (vm_flags & VM_SHARED) {
+                if (unlikely(vm_flags & (VM_GROWSDOWN|VM_GROWSUP)))
+                        goto free_vma;
                 error = shmem_zero_setup(vma);
                 if (error)
                         goto free_vma;
@@ -1605,7 +1608,6 @@ EXPORT_SYMBOL(find_vma);
 
 /*
  * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
- * Note: pprev is set to NULL when return value is NULL.
  */
 struct vm_area_struct *
 find_vma_prev(struct mm_struct *mm, unsigned long addr,
@@ -1614,7 +1616,16 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
         struct vm_area_struct *vma;
 
         vma = find_vma(mm, addr);
-        *pprev = vma ? vma->vm_prev : NULL;
+        if (vma) {
+                *pprev = vma->vm_prev;
+        } else {
+                struct rb_node *rb_node = mm->mm_rb.rb_node;
+                *pprev = NULL;
+                while (rb_node) {
+                        *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
+                        rb_node = rb_node->rb_right;
+                }
+        }
         return vma;
 }
 
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 5a688a2756be..f437d054c3bf 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -262,10 +262,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
 
         down_write(&current->mm->mmap_sem);
 
-        vma = find_vma_prev(current->mm, start, &prev);
+        vma = find_vma(current->mm, start);
         error = -ENOMEM;
         if (!vma)
                 goto out;
+        prev = vma->vm_prev;
         if (unlikely(grows & PROT_GROWSDOWN)) {
                 if (vma->vm_start >= end)
                         goto out;
diff --git a/mm/nommu.c b/mm/nommu.c
index b982290fd962..f59e170fceb4 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -696,9 +696,11 @@ static void add_vma_to_mm(struct mm_struct *mm, struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_insert(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* add the VMA to the tree */
@@ -760,9 +762,11 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
         if (vma->vm_file) {
                 mapping = vma->vm_file->f_mapping;
 
+                mutex_lock(&mapping->i_mmap_mutex);
                 flush_dcache_mmap_lock(mapping);
                 vma_prio_tree_remove(vma, &mapping->i_mmap);
                 flush_dcache_mmap_unlock(mapping);
+                mutex_unlock(&mapping->i_mmap_mutex);
         }
 
         /* remove from the MM's tree and list */
@@ -775,8 +779,6 @@ static void delete_vma_from_mm(struct vm_area_struct *vma)
 
         if (vma->vm_next)
                 vma->vm_next->vm_prev = vma->vm_prev;
-
-        vma->vm_mm = NULL;
 }
 
 /*
@@ -2052,6 +2054,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
         high = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
 
         down_write(&nommu_region_sem);
+        mutex_lock(&inode->i_mapping->i_mmap_mutex);
 
         /* search for VMAs that fall within the dead zone */
         vma_prio_tree_foreach(vma, &iter, &inode->i_mapping->i_mmap,
@@ -2059,6 +2062,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 /* found one - only interested if it's shared out of the page
                  * cache */
                 if (vma->vm_flags & VM_SHARED) {
+                        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
                         up_write(&nommu_region_sem);
                         return -ETXTBSY; /* not quite true, but near enough */
                 }
@@ -2086,6 +2090,7 @@ int nommu_shrink_inode_mappings(struct inode *inode, size_t size,
                 }
         }
 
+        mutex_unlock(&inode->i_mapping->i_mmap_mutex);
         up_write(&nommu_region_sem);
         return 0;
 }
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d2186ecb36f7..a13ded1938f0 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5236,6 +5236,7 @@ void *__init alloc_large_system_hash(const char *tablename,
                 max = ((unsigned long long)nr_all_pages << PAGE_SHIFT) >> 4;
                 do_div(max, bucketsize);
         }
+        max = min(max, 0x80000000ULL);
 
         if (numentries > max)
                 numentries = max;
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index de1616aa9b1e..1ccbd714059c 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_cgroup(swp_entry_t ent,
         pgoff_t offset = swp_offset(ent);
         struct swap_cgroup_ctrl *ctrl;
         struct page *mappage;
+        struct swap_cgroup *sc;
 
         ctrl = &swap_cgroup_ctrl[swp_type(ent)];
         if (ctrlp)
                 *ctrlp = ctrl;
 
         mappage = ctrl->map[offset / SC_PER_PAGE];
-        return page_address(mappage) + offset % SC_PER_PAGE;
+        sc = page_address(mappage);
+        return sc + offset % SC_PER_PAGE;
 }
 
 /**
diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
index 12a48a88c0d8..405d331804c3 100644
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -184,8 +184,7 @@ static void pcpu_unmap_pages(struct pcpu_chunk *chunk,
                                    page_end - page_start);
         }
 
-        for (i = page_start; i < page_end; i++)
-                __clear_bit(i, populated);
+        bitmap_clear(populated, page_start, page_end - page_start);
 }
 
 /**
diff --git a/mm/swap.c b/mm/swap.c
index fff1ff7fb9ad..14380e9fbe33 100644
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -652,7 +652,7 @@ EXPORT_SYMBOL(__pagevec_release);
 void lru_add_page_tail(struct zone* zone,
                        struct page *page, struct page *page_tail)
 {
-        int active;
+        int uninitialized_var(active);
         enum lru_list lru;
         const int file = 0;
 
@@ -672,7 +672,6 @@ void lru_add_page_tail(struct zone* zone,
                         active = 0;
                         lru = LRU_INACTIVE_ANON;
                 }
-                update_page_reclaim_stat(zone, page_tail, file, active);
         } else {
                 SetPageUnevictable(page_tail);
                 lru = LRU_UNEVICTABLE;
@@ -693,6 +692,9 @@ void lru_add_page_tail(struct zone* zone,
                 list_head = page_tail->lru.prev;
                 list_move_tail(&page_tail->lru, list_head);
         }
+
+        if (!PageUnevictable(page))
+                update_page_reclaim_stat(zone, page_tail, file, active);
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
@@ -710,8 +712,8 @@ static void __pagevec_lru_add_fn(struct page *page, void *arg)
         SetPageLRU(page);
         if (active)
                 SetPageActive(page);
-        update_page_reclaim_stat(zone, page, file, active);
         add_page_to_lru_list(zone, page, lru);
+        update_page_reclaim_stat(zone, page, file, active);
 }
 
 /*
diff --git a/mm/swap_state.c b/mm/swap_state.c
index 470038a91873..ea6b32d61873 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -300,16 +300,6 @@ struct page *read_swap_cache_async(swp_entry_t entry, gfp_t gfp_mask,
                         new_page = alloc_page_vma(gfp_mask, vma, addr);
                         if (!new_page)
                                 break;          /* Out of memory */
-                        /*
-                         * The memcg-specific accounting when moving
-                         * pages around the LRU lists relies on the
-                         * page's owner (memcg) to be valid.  Usually,
-                         * pages are assigned to a new owner before
-                         * being put on the LRU list, but since this
-                         * is not the case here, the stale owner from
-                         * a previous allocation cycle must be reset.
-                         */
-                        mem_cgroup_reset_owner(new_page);
                 }
 
                 /*
diff --git a/net/atm/clip.c b/net/atm/clip.c
index c12c2582457c..127fe70a1baa 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -46,8 +46,8 @@
 
 static struct net_device *clip_devs;
 static struct atm_vcc *atmarpd;
-static struct neigh_table clip_tbl;
 static struct timer_list idle_timer;
+static const struct neigh_ops clip_neigh_ops;
 
 static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
 {
@@ -123,6 +123,8 @@ static int neigh_check_cb(struct neighbour *n)
         struct atmarp_entry *entry = neighbour_priv(n);
         struct clip_vcc *cv;
 
+        if (n->ops != &clip_neigh_ops)
+                return 0;
         for (cv = entry->vccs; cv; cv = cv->next) {
                 unsigned long exp = cv->last_use + cv->idle_timeout;
 
@@ -154,10 +156,10 @@ static int neigh_check_cb(struct neighbour *n)
 
 static void idle_timer_check(unsigned long dummy)
 {
-        write_lock(&clip_tbl.lock);
-        __neigh_for_each_release(&clip_tbl, neigh_check_cb);
+        write_lock(&arp_tbl.lock);
+        __neigh_for_each_release(&arp_tbl, neigh_check_cb);
         mod_timer(&idle_timer, jiffies + CLIP_CHECK_INTERVAL * HZ);
-        write_unlock(&clip_tbl.lock);
+        write_unlock(&arp_tbl.lock);
 }
 
 static int clip_arp_rcv(struct sk_buff *skb)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index ef92864ac625..72eb187a5f60 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -71,19 +71,16 @@ static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
         "slock-AF_BLUETOOTH-BTPROTO_AVDTP",
 };
 
-static inline void bt_sock_reclassify_lock(struct socket *sock, int proto)
+void bt_sock_reclassify_lock(struct sock *sk, int proto)
 {
-        struct sock *sk = sock->sk;
-
-        if (!sk)
-                return;
-
+        BUG_ON(!sk);
         BUG_ON(sock_owned_by_user(sk));
 
         sock_lock_init_class_and_name(sk,
                         bt_slock_key_strings[proto], &bt_slock_key[proto],
                                 bt_key_strings[proto], &bt_lock_key[proto]);
 }
+EXPORT_SYMBOL(bt_sock_reclassify_lock);
 
 int bt_sock_register(int proto, const struct net_proto_family *ops)
 {
@@ -145,7 +142,8 @@ static int bt_sock_create(struct net *net, struct socket *sock, int proto,
 
         if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
                 err = bt_proto[proto]->create(net, sock, proto, kern);
-                bt_sock_reclassify_lock(sock, proto);
+                if (!err)
+                        bt_sock_reclassify_lock(sock->sk, proto);
                 module_put(bt_proto[proto]->owner);
         }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3db432473ad5..07bc69ed9498 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -635,6 +635,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
 
         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
                 struct hci_cp_auth_requested cp;
+
+                /* encrypt must be pending if auth is also pending */
+                set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+
                 cp.handle = cpu_to_le16(conn->handle);
                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
                                                         sizeof(cp), &cp);
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 9de93714213a..5aeb62491198 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -640,7 +640,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         /* Reset device */
         skb_queue_purge(&hdev->cmd_q);
         atomic_set(&hdev->cmd_cnt, 1);
-        if (!test_bit(HCI_RAW, &hdev->flags)) {
+        if (!test_bit(HCI_RAW, &hdev->flags) &&
+                                test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
                 set_bit(HCI_INIT, &hdev->flags);
                 __hci_request(hdev, hci_reset_req, 0,
                                         msecs_to_jiffies(250));
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index faf0b11ac1d3..32d338c30e65 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
         hci_chan_del(conn->hchan);
 
         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work_sync(&conn->info_timer);
 
         if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work_sync(&conn->security_timer);
                 smp_chan_destroy(conn);
         }
 
@@ -1120,7 +1120,7 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr
         return c1;
 }
 
-inline int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
+int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
 {
         struct sock *sk = chan->sk;
         bdaddr_t *src = &bt_sk(sk)->src;
@@ -2574,7 +2574,7 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
                                         cmd->ident == conn->info_ident) {
-                __cancel_delayed_work(&conn->info_timer);
+                cancel_delayed_work(&conn->info_timer);
 
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
                 conn->info_ident = 0;
@@ -2970,7 +2970,8 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
         default:
                 sk->sk_err = ECONNRESET;
-                __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
+                __set_chan_timer(chan,
+                                msecs_to_jiffies(L2CAP_DISC_REJ_TIMEOUT));
                 l2cap_send_disconn_req(conn, chan, ECONNRESET);
                 goto done;
         }
@@ -3120,7 +3121,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
                         conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
                 return 0;
 
-        __cancel_delayed_work(&conn->info_timer);
+        cancel_delayed_work(&conn->info_timer);
 
         if (result != L2CAP_IR_SUCCESS) {
                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
@@ -4478,7 +4479,8 @@ static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
         if (encrypt == 0x00) {
                 if (chan->sec_level == BT_SECURITY_MEDIUM) {
                         __clear_chan_timer(chan);
-                        __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
+                        __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_ENC_TIMEOUT));
                 } else if (chan->sec_level == BT_SECURITY_HIGH)
                         l2cap_chan_close(chan, ECONNREFUSED);
         } else {
@@ -4499,7 +4501,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
         if (hcon->type == LE_LINK) {
                 smp_distribute_keys(conn, 0);
-                __cancel_delayed_work(&conn->security_timer);
+                cancel_delayed_work(&conn->security_timer);
         }
 
         rcu_read_lock();
@@ -4546,7 +4548,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                         L2CAP_CONN_REQ, sizeof(req), &req);
                         } else {
                                 __clear_chan_timer(chan);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                         }
                 } else if (chan->state == BT_CONNECT2) {
                         struct l2cap_conn_rsp rsp;
@@ -4566,7 +4569,8 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
                                 }
                         } else {
                                 l2cap_state_change(chan, BT_DISCONN);
-                                __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+                                __set_chan_timer(chan,
+                                        msecs_to_jiffies(L2CAP_DISC_TIMEOUT));
                                 res = L2CAP_CR_SEC_BLOCK;
                                 stat = L2CAP_CS_NO_INFO;
                         }
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c61d967012b2..401d9428ae4c 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -849,6 +849,8 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
         if (!sk)
                 return NULL;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
+
         l2cap_sock_init(sk, parent);
 
         return l2cap_pi(sk)->chan;
@@ -1002,7 +1004,7 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 
         sk->sk_destruct = l2cap_sock_destruct;
-        sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
+        sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 
         sock_reset_flag(sk, SOCK_ZAPPED);
 
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 501649bf5596..8a602388f1e7 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1164,12 +1164,18 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        /* When socket is closed and we are not RFCOMM
-                         * initiator rfcomm_process_rx already calls
-                         * rfcomm_session_put() */
-                        if (s->sock->sk->sk_state != BT_CLOSED)
-                                if (list_empty(&s->dlcs))
-                                        rfcomm_session_put(s);
+                        /* rfcomm_session_put is called later so don't do
+                         * anything here otherwise we will mess up the session
+                         * reference counter:
+                         *
+                         * (a) when we are the initiator dlc_unlink will drive
+                         * the reference counter to 0 (there is no initial put
+                         * after session_add)
+                         *
+                         * (b) when we are not the initiator rfcomm_rx_process
+                         * will explicitly call put to balance the initial hold
+                         * done after session add.
+                         */
                         break;
                 }
         }
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index f066678faeee..22169c3f1482 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -956,6 +956,8 @@ int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc *
         if (!sk)
                 goto done;
 
+        bt_sock_reclassify_lock(sk, BTPROTO_RFCOMM);
+
         rfcomm_sock_init(sk, parent);
         bacpy(&bt_sk(sk)->src, &src);
         bacpy(&bt_sk(sk)->dst, &dst);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 568d5bf17534..702a1ae9220b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -446,8 +446,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
         ip6h->nexthdr = IPPROTO_HOPOPTS;
         ip6h->hop_limit = 1;
         ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
-        ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
-                           &ip6h->saddr);
+        if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
+                               &ip6h->saddr)) {
+                kfree_skb(skb);
+                return NULL;
+        }
         ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
 
         hopopt = (u8 *)(ip6h + 1);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 84122472656c..dec4f3817133 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -62,6 +62,15 @@ static int brnf_filter_pppoe_tagged __read_mostly = 0;
 #define brnf_filter_pppoe_tagged 0
 #endif
 
+#define IS_IP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IP))
+
+#define IS_IPV6(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_IPV6))
+
+#define IS_ARP(skb) \
+        (!vlan_tx_tag_present(skb) && skb->protocol == htons(ETH_P_ARP))
+
 static inline __be16 vlan_proto(const struct sk_buff *skb)
 {
         if (vlan_tx_tag_present(skb))
@@ -639,8 +648,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
                 return NF_DROP;
         br = p->br;
 
-        if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-            IS_PPPOE_IPV6(skb)) {
+        if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb)) {
                 if (!brnf_call_ip6tables && !br->nf_call_ip6tables)
                         return NF_ACCEPT;
 
@@ -651,8 +659,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
         if (!brnf_call_iptables && !br->nf_call_iptables)
                 return NF_ACCEPT;
 
-        if (skb->protocol != htons(ETH_P_IP) && !IS_VLAN_IP(skb) &&
-            !IS_PPPOE_IP(skb))
+        if (!IS_IP(skb) && !IS_VLAN_IP(skb) && !IS_PPPOE_IP(skb))
                 return NF_ACCEPT;
 
         nf_bridge_pull_encap_header_rcsum(skb);
@@ -701,7 +708,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
         struct nf_bridge_info *nf_bridge = skb->nf_bridge;
         struct net_device *in;
 
-        if (skb->protocol != htons(ETH_P_ARP) && !IS_VLAN_ARP(skb)) {
+        if (!IS_ARP(skb) && !IS_VLAN_ARP(skb)) {
                 in = nf_bridge->physindev;
                 if (nf_bridge->mask & BRNF_PKT_TYPE) {
                         skb->pkt_type = PACKET_OTHERHOST;
@@ -718,6 +725,7 @@ static int br_nf_forward_finish(struct sk_buff *skb)
         return 0;
 }
 
+
 /* This is the 'purely bridged' case.  For IP, we pass the packet to
  * netfilter with indev and outdev set to the bridge device,
  * but we are still able to filter on the 'real' indev/outdev
@@ -744,11 +752,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
         if (!parent)
                 return NF_DROP;
 
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
-            IS_PPPOE_IP(skb))
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-                 IS_PPPOE_IPV6(skb))
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
         else
                 return NF_ACCEPT;
@@ -795,7 +801,7 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
         if (!brnf_call_arptables && !br->nf_call_arptables)
                 return NF_ACCEPT;
 
-        if (skb->protocol != htons(ETH_P_ARP)) {
+        if (!IS_ARP(skb)) {
                 if (!IS_VLAN_ARP(skb))
                         return NF_ACCEPT;
                 nf_bridge_pull_encap_header(skb);
@@ -853,11 +859,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
         if (!realoutdev)
                 return NF_DROP;
 
-        if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
-            IS_PPPOE_IP(skb))
+        if (IS_IP(skb) || IS_VLAN_IP(skb) || IS_PPPOE_IP(skb))
                 pf = PF_INET;
-        else if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
-                 IS_PPPOE_IPV6(skb))
+        else if (IS_IPV6(skb) || IS_VLAN_IPV6(skb) || IS_PPPOE_IPV6(skb))
                 pf = PF_INET6;
         else
                 return NF_ACCEPT;
diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
index dd147d78a588..8c836d96ba76 100644
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -17,9 +17,9 @@
 #include "br_private_stp.h"
 
 /* since time values in bpdu are in jiffies and then scaled (1/256)
- * before sending, make sure that is at least one.
+ * before sending, make sure that is at least one STP tick.
  */
-#define MESSAGE_AGE_INCR        ((HZ < 256) ? 1 : (HZ/256))
+#define MESSAGE_AGE_INCR        ((HZ / 256) + 1)
 
 static const char *const br_port_state_names[] = {
         [BR_STATE_DISABLED] = "disabled",
@@ -31,7 +31,7 @@ static const char *const br_port_state_names[] = {
 
 void br_log_state(const struct net_bridge_port *p)
 {
-        br_info(p->br, "port %u(%s) entering %s state\n",
+        br_info(p->br, "port %u(%s) entered %s state\n",
                 (unsigned) p->port_no, p->dev->name,
                 br_port_state_names[p->state]);
 }
@@ -186,7 +186,7 @@ static void br_record_config_information(struct net_bridge_port *p,
         p->designated_cost = bpdu->root_path_cost;
         p->designated_bridge = bpdu->bridge_id;
         p->designated_port = bpdu->port_id;
-        p->designated_age = jiffies + bpdu->message_age;
+        p->designated_age = jiffies - bpdu->message_age;
 
         mod_timer(&p->message_age_timer, jiffies
                   + (p->br->max_age - bpdu->message_age));
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 19308e305d85..f494496373d6 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -98,14 +98,13 @@ void br_stp_disable_port(struct net_bridge_port *p)
         struct net_bridge *br = p->br;
         int wasroot;
 
-        br_log_state(p);
-
         wasroot = br_is_root_bridge(br);
         br_become_designated_port(p);
         p->state = BR_STATE_DISABLED;
         p->topology_change_ack = 0;
         p->config_pending = 0;
 
+        br_log_state(p);
         br_ifinfo_notify(RTM_NEWLINK, p);
 
         del_timer(&p->message_age_timer);
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 5864cc491369..5fe2ff3b01ef 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1335,7 +1335,12 @@ static inline int ebt_make_matchname(const struct ebt_entry_match *m,
     const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)m - base);
-        if (copy_to_user(hlp, m->u.match->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+
+        /* ebtables expects 32 bytes long names but xt_match names are 29 bytes
+           long. Copy 29 bytes and fill remaining bytes with zeroes. */
+        strncpy(name, m->u.match->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1344,7 +1349,10 @@ static inline int ebt_make_watchername(const struct ebt_entry_watcher *w,
     const char *base, char __user *ubase)
 {
         char __user *hlp = ubase + ((char *)w - base);
-        if (copy_to_user(hlp , w->u.watcher->name, EBT_FUNCTION_MAXNAMELEN))
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
+
+        strncpy(name, w->u.watcher->name, sizeof(name));
+        if (copy_to_user(hlp , name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1355,6 +1363,7 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
         int ret;
         char __user *hlp;
         const struct ebt_entry_target *t;
+        char name[EBT_FUNCTION_MAXNAMELEN] = {};
 
         if (e->bitmask == 0)
                 return 0;
@@ -1368,7 +1377,8 @@ ebt_make_names(struct ebt_entry *e, const char *base, char __user *ubase)
         ret = EBT_WATCHER_ITERATE(e, ebt_make_watchername, base, ubase);
         if (ret != 0)
                 return ret;
-        if (copy_to_user(hlp, t->u.target->name, EBT_FUNCTION_MAXNAMELEN))
+        strncpy(name, t->u.target->name, sizeof(name));
+        if (copy_to_user(hlp, name, EBT_FUNCTION_MAXNAMELEN))
                 return -EFAULT;
         return 0;
 }
@@ -1893,10 +1903,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
 
         switch (compat_mwt) {
         case EBT_COMPAT_MATCH:
-                match = try_then_request_module(xt_find_match(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (match == NULL)
-                        return -ENOENT;
+                match = xt_request_find_match(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(match))
                         return PTR_ERR(match);
 
@@ -1915,10 +1922,7 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
                 break;
         case EBT_COMPAT_WATCHER: /* fallthrough */
         case EBT_COMPAT_TARGET:
-                wt = try_then_request_module(xt_find_target(NFPROTO_BRIDGE,
-                                                name, 0), "ebt_%s", name);
-                if (wt == NULL)
-                        return -ENOENT;
+                wt = xt_request_find_target(NFPROTO_BRIDGE, name, 0);
                 if (IS_ERR(wt))
                         return PTR_ERR(wt);
                 off = xt_compat_target_offset(wt);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index e287346e0934..2a83914b0277 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -826,6 +826,8 @@ next_elt:
                 write_unlock_bh(&tbl->lock);
                 cond_resched();
                 write_lock_bh(&tbl->lock);
+                nht = rcu_dereference_protected(tbl->nht,
+                                                lockdep_is_held(&tbl->lock));
         }
         /* Cycle through all hash buckets every base_reachable_time/2 ticks.
          * ARP entry timeouts range from 1/2 base_reachable_time to 3/2
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 65aebd450027..f965dce6f20f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -60,7 +60,6 @@ struct rtnl_link {
 };
 
 static DEFINE_MUTEX(rtnl_mutex);
-static u16 min_ifinfo_dump_size;
 
 void rtnl_lock(void)
 {
@@ -724,10 +723,11 @@ static void copy_rtnl_link_stats64(void *v, const struct rtnl_link_stats64 *b)
 }
 
 /* All VF info */
-static inline int rtnl_vfinfo_size(const struct net_device *dev)
+static inline int rtnl_vfinfo_size(const struct net_device *dev,
+                                   u32 ext_filter_mask)
 {
-        if (dev->dev.parent && dev_is_pci(dev->dev.parent)) {
-
+        if (dev->dev.parent && dev_is_pci(dev->dev.parent) &&
+            (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int num_vfs = dev_num_vf(dev->dev.parent);
                 size_t size = nla_total_size(sizeof(struct nlattr));
                 size += nla_total_size(num_vfs * sizeof(struct nlattr));
@@ -766,7 +766,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
                 return port_self_size;
 }
 
-static noinline size_t if_nlmsg_size(const struct net_device *dev)
+static noinline size_t if_nlmsg_size(const struct net_device *dev,
+                                     u32 ext_filter_mask)
 {
         return NLMSG_ALIGN(sizeof(struct ifinfomsg))
                + nla_total_size(IFNAMSIZ) /* IFLA_IFNAME */
@@ -784,8 +785,9 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev)
                + nla_total_size(4) /* IFLA_MASTER */
                + nla_total_size(1) /* IFLA_OPERSTATE */
                + nla_total_size(1) /* IFLA_LINKMODE */
-               + nla_total_size(4) /* IFLA_NUM_VF */
-               + rtnl_vfinfo_size(dev) /* IFLA_VFINFO_LIST */
+               + nla_total_size(ext_filter_mask
+                                & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+               + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
                + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
                + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
                + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
@@ -868,7 +870,7 @@ static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
 
 static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                             int type, u32 pid, u32 seq, u32 change,
-                            unsigned int flags)
+                            unsigned int flags, u32 ext_filter_mask)
 {
         struct ifinfomsg *ifm;
         struct nlmsghdr *nlh;
@@ -941,10 +943,11 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
                 goto nla_put_failure;
         copy_rtnl_link_stats64(nla_data(attr), stats);
 
-        if (dev->dev.parent)
+        if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF))
                 NLA_PUT_U32(skb, IFLA_NUM_VF, dev_num_vf(dev->dev.parent));
 
-        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent) {
+        if (dev->netdev_ops->ndo_get_vf_config && dev->dev.parent
+            && (ext_filter_mask & RTEXT_FILTER_VF)) {
                 int i;
 
                 struct nlattr *vfinfo, *vf;
@@ -1048,6 +1051,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         struct net_device *dev;
         struct hlist_head *head;
         struct hlist_node *node;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
 
         s_h = cb->args[0];
         s_idx = cb->args[1];
@@ -1055,6 +1060,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
         rcu_read_lock();
         cb->seq = net->dev_base_seq;
 
+        if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
+
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
+
         for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
                 idx = 0;
                 head = &net->dev_index_head[h];
@@ -1064,7 +1076,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                         if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
                                              NETLINK_CB(cb->skb).pid,
                                              cb->nlh->nlmsg_seq, 0,
-                                             NLM_F_MULTI) <= 0)
+                                             NLM_F_MULTI,
+                                             ext_filter_mask) <= 0)
                                 goto out;
 
                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
@@ -1100,6 +1113,7 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
         [IFLA_VF_PORTS]         = { .type = NLA_NESTED },
         [IFLA_PORT_SELF]        = { .type = NLA_NESTED },
         [IFLA_AF_SPEC]          = { .type = NLA_NESTED },
+        [IFLA_EXT_MASK]         = { .type = NLA_U32 },
 };
 EXPORT_SYMBOL(ifla_policy);
 
@@ -1509,8 +1523,6 @@ errout:
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
-        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
-                                     min_ifinfo_dump_size);
 
         return err;
 }
@@ -1842,6 +1854,7 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         struct net_device *dev = NULL;
         struct sk_buff *nskb;
         int err;
+        u32 ext_filter_mask = 0;
 
         err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFLA_MAX, ifla_policy);
         if (err < 0)
@@ -1850,6 +1863,9 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (tb[IFLA_IFNAME])
                 nla_strlcpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ);
 
+        if (tb[IFLA_EXT_MASK])
+                ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+
         ifm = nlmsg_data(nlh);
         if (ifm->ifi_index > 0)
                 dev = __dev_get_by_index(net, ifm->ifi_index);
@@ -1861,12 +1877,12 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (dev == NULL)
                 return -ENODEV;
 
-        nskb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
+        nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL);
         if (nskb == NULL)
                 return -ENOBUFS;
 
         err = rtnl_fill_ifinfo(nskb, dev, RTM_NEWLINK, NETLINK_CB(skb).pid,
-                               nlh->nlmsg_seq, 0, 0);
+                               nlh->nlmsg_seq, 0, 0, ext_filter_mask);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size */
                 WARN_ON(err == -EMSGSIZE);
@@ -1877,8 +1893,32 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         return err;
 }
 
-static u16 rtnl_calcit(struct sk_buff *skb)
+static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
+        struct net *net = sock_net(skb->sk);
+        struct net_device *dev;
+        struct nlattr *tb[IFLA_MAX+1];
+        u32 ext_filter_mask = 0;
+        u16 min_ifinfo_dump_size = 0;
+
+        if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
+                        ifla_policy) >= 0) {
+                if (tb[IFLA_EXT_MASK])
+                        ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+        }
+
+        if (!ext_filter_mask)
+                return NLMSG_GOODSIZE;
+        /*
+         * traverse the list of net devices and compute the minimum
+         * buffer size based upon the filter mask.
+         */
+        list_for_each_entry(dev, &net->dev_base_head, dev_list) {
+                min_ifinfo_dump_size = max_t(u16, min_ifinfo_dump_size,
+                                             if_nlmsg_size(dev,
+                                                           ext_filter_mask));
+        }
+
         return min_ifinfo_dump_size;
 }
 
@@ -1913,13 +1953,11 @@ void rtmsg_ifinfo(int type, struct net_device *dev, unsigned change)
         int err = -ENOBUFS;
         size_t if_info_size;
 
-        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev)), GFP_KERNEL);
+        skb = nlmsg_new((if_info_size = if_nlmsg_size(dev, 0)), GFP_KERNEL);
         if (skb == NULL)
                 goto errout;
 
-        min_ifinfo_dump_size = max_t(u16, if_info_size, min_ifinfo_dump_size);
-
-        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0);
+        err = rtnl_fill_ifinfo(skb, dev, type, 0, 0, change, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in if_nlmsg_size() */
                 WARN_ON(err == -EMSGSIZE);
@@ -1977,7 +2015,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
                         return -EOPNOTSUPP;
                 calcit = rtnl_get_calcit(family, type);
                 if (calcit)
-                        min_dump_alloc = calcit(skb);
+                        min_dump_alloc = calcit(skb, nlh);
 
                 __rtnl_unlock();
                 rtnl = net->rtnl;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index bf4a9c4808e1..d4d61b694fab 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -17,6 +17,7 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/net.h>
+#include <linux/workqueue.h>
 #include <net/ip.h>
 #include <net/inetpeer.h>
 #include <net/secure_seq.h>
@@ -66,6 +67,11 @@
 
 static struct kmem_cache *peer_cachep __read_mostly;
 
+static LIST_HEAD(gc_list);
+static const int gc_delay = 60 * HZ;
+static struct delayed_work gc_work;
+static DEFINE_SPINLOCK(gc_lock);
+
 #define node_height(x) x->avl_height
 
 #define peer_avl_empty ((struct inet_peer *)&peer_fake_node)
@@ -102,6 +108,50 @@ int inet_peer_threshold __read_mostly = 65536 + 128;	/* start to throw entries m
 int inet_peer_minttl __read_mostly = 120 * HZ;  /* TTL under high load: 120 sec */
 int inet_peer_maxttl __read_mostly = 10 * 60 * HZ;      /* usual time to live: 10 min */
 
+static void inetpeer_gc_worker(struct work_struct *work)
+{
+        struct inet_peer *p, *n;
+        LIST_HEAD(list);
+
+        spin_lock_bh(&gc_lock);
+        list_replace_init(&gc_list, &list);
+        spin_unlock_bh(&gc_lock);
+
+        if (list_empty(&list))
+                return;
+
+        list_for_each_entry_safe(p, n, &list, gc_list) {
+
+                if(need_resched())
+                        cond_resched();
+
+                if (p->avl_left != peer_avl_empty) {
+                        list_add_tail(&p->avl_left->gc_list, &list);
+                        p->avl_left = peer_avl_empty;
+                }
+
+                if (p->avl_right != peer_avl_empty) {
+                        list_add_tail(&p->avl_right->gc_list, &list);
+                        p->avl_right = peer_avl_empty;
+                }
+
+                n = list_entry(p->gc_list.next, struct inet_peer, gc_list);
+
+                if (!atomic_read(&p->refcnt)) {
+                        list_del(&p->gc_list);
+                        kmem_cache_free(peer_cachep, p);
+                }
+        }
+
+        if (list_empty(&list))
+                return;
+
+        spin_lock_bh(&gc_lock);
+        list_splice(&list, &gc_list);
+        spin_unlock_bh(&gc_lock);
+
+        schedule_delayed_work(&gc_work, gc_delay);
+}
 
 /* Called from ip_output.c:ip_init  */
 void __init inet_initpeers(void)
@@ -126,6 +176,7 @@ void __init inet_initpeers(void)
                         0, SLAB_HWCACHE_ALIGN | SLAB_PANIC,
                         NULL);
 
+        INIT_DELAYED_WORK_DEFERRABLE(&gc_work, inetpeer_gc_worker);
 }
 
 static int addr_compare(const struct inetpeer_addr *a,
@@ -447,9 +498,8 @@ relookup:
                 p->rate_last = 0;
                 p->pmtu_expires = 0;
                 p->pmtu_orig = 0;
-                p->redirect_genid = 0;
                 memset(&p->redirect_learned, 0, sizeof(p->redirect_learned));
-
+                INIT_LIST_HEAD(&p->gc_list);
 
                 /* Link the node. */
                 link_to_pool(p, base);
@@ -509,3 +559,30 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
         return rc;
 }
 EXPORT_SYMBOL(inet_peer_xrlim_allow);
+
+void inetpeer_invalidate_tree(int family)
+{
+        struct inet_peer *old, *new, *prev;
+        struct inet_peer_base *base = family_to_base(family);
+
+        write_seqlock_bh(&base->lock);
+
+        old = base->root;
+        if (old == peer_avl_empty_rcu)
+                goto out;
+
+        new = peer_avl_empty_rcu;
+
+        prev = cmpxchg(&base->root, old, new);
+        if (prev == old) {
+                base->total = 0;
+                spin_lock(&gc_lock);
+                list_add_tail(&prev->gc_list, &gc_list);
+                spin_unlock(&gc_lock);
+                schedule_delayed_work(&gc_work, gc_delay);
+        }
+
+out:
+        write_sequnlock_bh(&base->lock);
+}
+EXPORT_SYMBOL(inetpeer_invalidate_tree);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 6b3ca5ba4450..38673d2860e2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -65,7 +65,7 @@
    it is infeasible task. The most general solutions would be
    to keep skb->encapsulation counter (sort of local ttl),
    and silently drop packet when it expires. It is a good
-   solution, but it supposes maintaing new variable in ALL
+   solution, but it supposes maintaining new variable in ALL
    skb, even if no tunneling is used.
 
    Current solution: xmit_recursion breaks dead loops. This is a percpu
@@ -91,14 +91,14 @@
 
    One of them is to parse packet trying to detect inner encapsulation
    made by our node. It is difficult or even impossible, especially,
-   taking into account fragmentation. TO be short, tt is not solution at all.
+   taking into account fragmentation. TO be short, ttl is not solution at all.
 
    Current solution: The solution was UNEXPECTEDLY SIMPLE.
    We force DF flag on tunnels with preconfigured hop limit,
    that is ALL. :-) Well, it does not remove the problem completely,
    but exponential growth of network traffic is changed to linear
    (branches, that exceed pmtu are pruned) and tunnel mtu
-   fastly degrades to value <68, where looping stops.
+   rapidly degrades to value <68, where looping stops.
    Yes, it is not good if there exists a router in the loop,
    which does not force DF, even when encapsulating packets have DF set.
    But it is not our problem! Nobody could accuse us, we made
@@ -457,8 +457,8 @@ static void ipgre_err(struct sk_buff *skb, u32 info)
    GRE tunnels with enabled checksum. Tell them "thank you".
 
    Well, I wonder, rfc1812 was written by Cisco employee,
-   what the hell these idiots break standrads established
-   by themself???
+   what the hell these idiots break standards established
+   by themselves???
  */
 
         const struct iphdr *iph = (const struct iphdr *)skb->data;
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index aea5a199c37a..b072386cee21 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -630,6 +630,7 @@ static int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
         pr_debug("ping_recvmsg(sk=%p,sk->num=%u)\n", isk, isk->inet_num);
 
+        err = -EOPNOTSUPP;
         if (flags & MSG_OOB)
                 goto out;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index bcacf54e5418..019774796174 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -132,7 +132,6 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 static int rt_chain_length_max __read_mostly    = 20;
-static int redirect_genid;
 
 static struct delayed_work expires_work;
 static unsigned long expires_ljiffies;
@@ -937,7 +936,7 @@ static void rt_cache_invalidate(struct net *net)
 
         get_random_bytes(&shuffle, sizeof(shuffle));
         atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
-        redirect_genid++;
+        inetpeer_invalidate_tree(AF_INET);
 }
 
 /*
@@ -1485,10 +1484,8 @@ void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
 
                                 peer = rt->peer;
                                 if (peer) {
-                                        if (peer->redirect_learned.a4 != new_gw ||
-                                            peer->redirect_genid != redirect_genid) {
+                                        if (peer->redirect_learned.a4 != new_gw) {
                                                 peer->redirect_learned.a4 = new_gw;
-                                                peer->redirect_genid = redirect_genid;
                                                 atomic_inc(&__rt_peer_genid);
                                         }
                                         check_peer_redir(&rt->dst, peer);
@@ -1793,8 +1790,6 @@ static void ipv4_validate_peer(struct rtable *rt)
                 if (peer) {
                         check_peer_pmtu(&rt->dst, peer);
 
-                        if (peer->redirect_genid != redirect_genid)
-                                peer->redirect_learned.a4 = 0;
                         if (peer->redirect_learned.a4 &&
                             peer->redirect_learned.a4 != rt->rt_gateway)
                                 check_peer_redir(&rt->dst, peer);
@@ -1958,8 +1953,7 @@ static void rt_init_metrics(struct rtable *rt, const struct flowi4 *fl4,
                 dst_init_metrics(&rt->dst, peer->metrics, false);
 
                 check_peer_pmtu(&rt->dst, peer);
-                if (peer->redirect_genid != redirect_genid)
-                        peer->redirect_learned.a4 = 0;
+
                 if (peer->redirect_learned.a4 &&
                     peer->redirect_learned.a4 != rt->rt_gateway) {
                         rt->rt_gateway = peer->redirect_learned.a4;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 37755ccc0e96..22ef5f9fd2ff 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3240,7 +3240,8 @@ void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
         unsigned long limit;
-        int i, max_share, cnt;
+        int max_share, cnt;
+        unsigned int i;
         unsigned long jiffy = jiffies;
 
         BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
@@ -3283,7 +3284,7 @@ void __init tcp_init(void)
                                         &tcp_hashinfo.bhash_size,
                                         NULL,
                                         64 * 1024);
-        tcp_hashinfo.bhash_size = 1 << tcp_hashinfo.bhash_size;
+        tcp_hashinfo.bhash_size = 1U << tcp_hashinfo.bhash_size;
         for (i = 0; i < tcp_hashinfo.bhash_size; i++) {
                 spin_lock_init(&tcp_hashinfo.bhash[i].lock);
                 INIT_HLIST_HEAD(&tcp_hashinfo.bhash[i].chain);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 53c8ce4046b2..b5e315f13641 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1403,8 +1403,16 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
 
         BUG_ON(!pcount);
 
-        /* Adjust hint for FACK. Non-FACK is handled in tcp_sacktag_one(). */
-        if (tcp_is_fack(tp) && (skb == tp->lost_skb_hint))
+        /* Adjust counters and hints for the newly sacked sequence
+         * range but discard the return value since prev is already
+         * marked. We must tag the range first because the seq
+         * advancement below implicitly advances
+         * tcp_highest_sack_seq() when skb is highest_sack.
+         */
+        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
+                        start_seq, end_seq, dup_sack, pcount);
+
+        if (skb == tp->lost_skb_hint)
                 tp->lost_cnt_hint += pcount;
 
         TCP_SKB_CB(prev)->end_seq += shifted;
@@ -1430,12 +1438,6 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
                 skb_shinfo(skb)->gso_type = 0;
         }
 
-        /* Adjust counters and hints for the newly sacked sequence range but
-         * discard the return value since prev is already marked.
-         */
-        tcp_sacktag_one(sk, state, TCP_SKB_CB(skb)->sacked,
-                        start_seq, end_seq, dup_sack, pcount);
-
         /* Difference in this won't matter, both ACKed by the same cumul. ACK */
         TCP_SKB_CB(prev)->sacked |= (TCP_SKB_CB(skb)->sacked & TCPCB_EVER_RETRANS);
 
@@ -1583,6 +1585,10 @@ static struct sk_buff *tcp_shift_skb_data(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
+        /* tcp_sacktag_one() won't SACK-tag ranges below snd_una */
+        if (!after(TCP_SKB_CB(skb)->seq + len, tp->snd_una))
+                goto fallback;
+
         if (!skb_shift(prev, skb, len))
                 goto fallback;
         if (!tcp_shifted_skb(sk, skb, state, pcount, len, mss, dup_sack))
@@ -2567,6 +2573,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 
                 if (cnt > packets) {
                         if ((tcp_is_sack(tp) && !tcp_is_fack(tp)) ||
+                            (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED) ||
                             (oldcnt >= packets))
                                 break;
 
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 63418185f524..e3db3f915114 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -110,10 +110,7 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         skb_push(skb, sizeof(*iph));
         skb_reset_network_header(skb);
-
-        memmove(skb->data - skb->mac_len, skb_mac_header(skb),
-                skb->mac_len);
-        skb_set_mac_header(skb, -skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm4_beet_make_header(skb);
 
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 534972e114ac..ed4bf11ef9f4 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -66,7 +66,6 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 
 static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
-        const unsigned char *old_mac;
         int err = -EINVAL;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
@@ -84,10 +83,9 @@ static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c02280a4d126..6b8ebc5da0e1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
+        /* Join all-router multicast group if forwarding is set */
+        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
+
         return ndev;
 }
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c7e95c8c579f..5aa3981a3922 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1926,8 +1926,10 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
         };
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst)
+        if (dst->error) {
+                dst_release(dst);
                 goto out_free;
+        }
 
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8f02ef88e59..c964958ac470 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1545,9 +1545,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return;
-
+        }
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst))
                 return;
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index a81ce9450750..9949a356d62c 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 261e6e6f487e..9f2095b19ad0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
-        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out:
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 2406b3e7393f..d86217d56bd7 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -63,14 +63,14 @@ static ssize_t sta_flags_read(struct file *file, char __user *userbuf,
         test_sta_flag(sta, WLAN_STA_##flg) ? #flg "\n" : ""
 
         int res = scnprintf(buf, sizeof(buf),
-                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
+                            "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
                             TEST(AUTH), TEST(ASSOC), TEST(PS_STA),
                             TEST(PS_DRIVER), TEST(AUTHORIZED),
                             TEST(SHORT_PREAMBLE),
                             TEST(WME), TEST(WDS), TEST(CLEAR_PS_FILT),
                             TEST(MFP), TEST(BLOCK_BA), TEST(PSPOLL),
                             TEST(UAPSD), TEST(SP), TEST(TDLS_PEER),
-                            TEST(TDLS_PEER_AUTH));
+                            TEST(TDLS_PEER_AUTH), TEST(RATE_CONTROL));
 #undef TEST
         return simple_read_from_buffer(userbuf, count, ppos, buf, res);
 }
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 01a21c2f6ab3..8e2137bd87e2 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1332,6 +1332,9 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                 hw_roc = true;
 
         list_for_each_entry(sdata, &local->interfaces, list) {
+                if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
+                    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        continue;
                 if (sdata->old_idle == sdata->vif.bss_conf.idle)
                         continue;
                 if (!ieee80211_sdata_running(sdata))
diff --git a/net/mac80211/rate.c b/net/mac80211/rate.c
index 5a5a7767d541..f9b8e819ca63 100644
--- a/net/mac80211/rate.c
+++ b/net/mac80211/rate.c
@@ -336,7 +336,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         int i;
         u32 mask;
 
-        if (sta) {
+        if (sta && test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
                 ista = &sta->sta;
                 priv_sta = sta->rate_ctrl_priv;
         }
@@ -344,7 +344,7 @@ void rate_control_get_rate(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
                 info->control.rates[i].idx = -1;
                 info->control.rates[i].flags = 0;
-                info->control.rates[i].count = 1;
+                info->control.rates[i].count = 0;
         }
 
         if (sdata->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL)
diff --git a/net/mac80211/rate.h b/net/mac80211/rate.h
index 168427b0ffdc..80cfc006dd74 100644
--- a/net/mac80211/rate.h
+++ b/net/mac80211/rate.h
@@ -41,7 +41,7 @@ static inline void rate_control_tx_status(struct ieee80211_local *local,
         struct ieee80211_sta *ista = &sta->sta;
         void *priv_sta = sta->rate_ctrl_priv;
 
-        if (!ref)
+        if (!ref || !test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
                 return;
 
         ref->ops->tx_status(ref->priv, sband, ista, priv_sta, skb);
@@ -62,6 +62,7 @@ static inline void rate_control_rate_init(struct sta_info *sta)
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
         ref->ops->rate_init(ref->priv, sband, ista, priv_sta);
+        set_sta_flag(sta, WLAN_STA_RATE_CONTROL);
 }
 
 static inline void rate_control_rate_update(struct ieee80211_local *local,
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 6f77f12dc3fc..bfed851d0d36 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -52,6 +52,7 @@
  * @WLAN_STA_SP: Station is in a service period, so don't try to
  *      reply to other uAPSD trigger frames or PS-Poll.
  * @WLAN_STA_4ADDR_EVENT: 4-addr event was already sent for this frame.
+ * @WLAN_STA_RATE_CONTROL: rate control was initialized for this station.
  */
 enum ieee80211_sta_info_flags {
         WLAN_STA_AUTH,
@@ -71,6 +72,7 @@ enum ieee80211_sta_info_flags {
         WLAN_STA_UAPSD,
         WLAN_STA_SP,
         WLAN_STA_4ADDR_EVENT,
+        WLAN_STA_RATE_CONTROL,
 };
 
 enum ieee80211_sta_state {
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 611c3359b94d..2555816e7788 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,6 +232,7 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         __be16 dport = 0;               /* destination port to forward */
         unsigned int flags;
         struct ip_vs_conn_param param;
+        const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
         union nf_inet_addr snet;        /* source network of the client,
                                            after masking */
 
@@ -267,7 +268,6 @@ ip_vs_sched_persist(struct ip_vs_service *svc,
         {
                 int protocol = iph.protocol;
                 const union nf_inet_addr *vaddr = &iph.daddr;
-                const union nf_inet_addr fwmark = { .ip = htonl(svc->fwmark) };
                 __be16 vport = 0;
 
                 if (dst_port == svc->port) {
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 76613f5a55c0..fa4b82c8ae80 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -404,19 +404,49 @@ static void __nf_conntrack_hash_insert(struct nf_conn *ct,
                            &net->ct.hash[repl_hash]);
 }
 
-void nf_conntrack_hash_insert(struct nf_conn *ct)
+int
+nf_conntrack_hash_check_insert(struct nf_conn *ct)
 {
         struct net *net = nf_ct_net(ct);
         unsigned int hash, repl_hash;
+        struct nf_conntrack_tuple_hash *h;
+        struct hlist_nulls_node *n;
         u16 zone;
 
         zone = nf_ct_zone(ct);
-        hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
-        repl_hash = hash_conntrack(net, zone, &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+        hash = hash_conntrack(net, zone,
+                              &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
+        repl_hash = hash_conntrack(net, zone,
+                                   &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
+
+        spin_lock_bh(&nf_conntrack_lock);
+
+        /* See if there's one in the list already, including reverse */
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
+        hlist_nulls_for_each_entry(h, n, &net->ct.hash[repl_hash], hnnode)
+                if (nf_ct_tuple_equal(&ct->tuplehash[IP_CT_DIR_REPLY].tuple,
+                                      &h->tuple) &&
+                    zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
+                        goto out;
 
+        add_timer(&ct->timeout);
+        nf_conntrack_get(&ct->ct_general);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
+        NF_CT_STAT_INC(net, insert);
+        spin_unlock_bh(&nf_conntrack_lock);
+
+        return 0;
+
+out:
+        NF_CT_STAT_INC(net, insert_failed);
+        spin_unlock_bh(&nf_conntrack_lock);
+        return -EEXIST;
 }
-EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
+EXPORT_SYMBOL_GPL(nf_conntrack_hash_check_insert);
 
 /* Confirm a connection given skb; places it in hash table */
 int
@@ -605,8 +635,12 @@ static noinline int early_drop(struct net *net, unsigned int hash)
 
         if (del_timer(&ct->timeout)) {
                 death_by_timeout((unsigned long)ct);
-                dropped = 1;
-                NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                /* Check if we indeed killed this entry. Reliable event
+                   delivery may have inserted it into the dying list. */
+                if (test_bit(IPS_DYING_BIT, &ct->status)) {
+                        dropped = 1;
+                        NF_CT_STAT_INC_ATOMIC(net, early_drop);
+                }
         }
         nf_ct_put(ct);
         return dropped;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 9307b033c0c9..10687692831e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1041,16 +1041,13 @@ ctnetlink_parse_nat_setup(struct nf_conn *ct,
         if (!parse_nat_setup) {
 #ifdef CONFIG_MODULES
                 rcu_read_unlock();
-                spin_unlock_bh(&nf_conntrack_lock);
                 nfnl_unlock();
                 if (request_module("nf-nat-ipv4") < 0) {
                         nfnl_lock();
-                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         return -EOPNOTSUPP;
                 }
                 nfnl_lock();
-                spin_lock_bh(&nf_conntrack_lock);
                 rcu_read_lock();
                 if (nfnetlink_parse_nat_setup_hook)
                         return -EAGAIN;
@@ -1367,15 +1364,12 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
                                                     nf_ct_protonum(ct));
                 if (helper == NULL) {
                         rcu_read_unlock();
-                        spin_unlock_bh(&nf_conntrack_lock);
 #ifdef CONFIG_MODULES
                         if (request_module("nfct-helper-%s", helpname) < 0) {
-                                spin_lock_bh(&nf_conntrack_lock);
                                 err = -EOPNOTSUPP;
                                 goto err1;
                         }
 
-                        spin_lock_bh(&nf_conntrack_lock);
                         rcu_read_lock();
                         helper = __nf_conntrack_helper_find(helpname,
                                                             nf_ct_l3num(ct),
@@ -1468,8 +1462,10 @@ ctnetlink_create_conntrack(struct net *net, u16 zone,
         if (tstamp)
                 tstamp->start = ktime_to_ns(ktime_get_real());
 
-        add_timer(&ct->timeout);
-        nf_conntrack_hash_insert(ct);
+        err = nf_conntrack_hash_check_insert(ct);
+        if (err < 0)
+                goto err2;
+
         rcu_read_unlock();
 
         return ct;
@@ -1490,6 +1486,7 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct nf_conntrack_tuple otuple, rtuple;
         struct nf_conntrack_tuple_hash *h = NULL;
         struct nfgenmsg *nfmsg = nlmsg_data(nlh);
+        struct nf_conn *ct;
         u_int8_t u3 = nfmsg->nfgen_family;
         u16 zone;
         int err;
@@ -1510,27 +1507,22 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         return err;
         }
 
-        spin_lock_bh(&nf_conntrack_lock);
         if (cda[CTA_TUPLE_ORIG])
-                h = __nf_conntrack_find(net, zone, &otuple);
+                h = nf_conntrack_find_get(net, zone, &otuple);
         else if (cda[CTA_TUPLE_REPLY])
-                h = __nf_conntrack_find(net, zone, &rtuple);
+                h = nf_conntrack_find_get(net, zone, &rtuple);
 
         if (h == NULL) {
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
-                        struct nf_conn *ct;
                         enum ip_conntrack_events events;
 
                         ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
-                        if (IS_ERR(ct)) {
-                                err = PTR_ERR(ct);
-                                goto out_unlock;
-                        }
+                        if (IS_ERR(ct))
+                                return PTR_ERR(ct);
+
                         err = 0;
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         if (test_bit(IPS_EXPECTED_BIT, &ct->status))
                                 events = IPCT_RELATED;
                         else
@@ -1545,23 +1537,19 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
                         nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
+                }
 
                 return err;
         }
         /* implicit 'else' */
 
-        /* We manipulate the conntrack inside the global conntrack table lock,
-         * so there's no need to increase the refcount */
         err = -EEXIST;
+        ct = nf_ct_tuplehash_to_ctrack(h);
         if (!(nlh->nlmsg_flags & NLM_F_EXCL)) {
-                struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
-
+                spin_lock_bh(&nf_conntrack_lock);
                 err = ctnetlink_change_conntrack(ct, cda);
+                spin_unlock_bh(&nf_conntrack_lock);
                 if (err == 0) {
-                        nf_conntrack_get(&ct->ct_general);
-                        spin_unlock_bh(&nf_conntrack_lock);
                         nf_conntrack_eventmask_report((1 << IPCT_REPLY) |
                                                       (1 << IPCT_ASSURED) |
                                                       (1 << IPCT_HELPER) |
@@ -1570,15 +1558,10 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                                                       (1 << IPCT_MARK),
                                                       ct, NETLINK_CB(skb).pid,
                                                       nlmsg_report(nlh));
-                        nf_ct_put(ct);
-                } else
-                        spin_unlock_bh(&nf_conntrack_lock);
-
-                return err;
+                }
         }
 
-out_unlock:
-        spin_unlock_bh(&nf_conntrack_lock);
+        nf_ct_put(ct);
         return err;
 }
 
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index b3a7db678b8d..ce60cf0f6c11 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -203,6 +203,27 @@ err:
         return status;
 }
 
+#ifdef CONFIG_BRIDGE_NETFILTER
+/* When called from bridge netfilter, skb->data must point to MAC header
+ * before calling skb_gso_segment(). Else, original MAC header is lost
+ * and segmented skbs will be sent to wrong destination.
+ */
+static void nf_bridge_adjust_skb_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_push(skb, skb->network_header - skb->mac_header);
+}
+
+static void nf_bridge_adjust_segmented_data(struct sk_buff *skb)
+{
+        if (skb->nf_bridge)
+                __skb_pull(skb, skb->network_header - skb->mac_header);
+}
+#else
+#define nf_bridge_adjust_skb_data(s) do {} while (0)
+#define nf_bridge_adjust_segmented_data(s) do {} while (0)
+#endif
+
 int nf_queue(struct sk_buff *skb,
              struct list_head *elem,
              u_int8_t pf, unsigned int hook,
@@ -212,7 +233,7 @@ int nf_queue(struct sk_buff *skb,
              unsigned int queuenum)
 {
         struct sk_buff *segs;
-        int err;
+        int err = -EINVAL;
         unsigned int queued;
 
         if (!skb_is_gso(skb))
@@ -228,23 +249,25 @@ int nf_queue(struct sk_buff *skb,
                 break;
         }
 
+        nf_bridge_adjust_skb_data(skb);
         segs = skb_gso_segment(skb, 0);
         /* Does not use PTR_ERR to limit the number of error codes that can be
          * returned by nf_queue.  For instance, callers rely on -ECANCELED to mean
          * 'ignore this hook'.
          */
         if (IS_ERR(segs))
-                return -EINVAL;
-
+                goto out_err;
         queued = 0;
         err = 0;
         do {
                 struct sk_buff *nskb = segs->next;
 
                 segs->next = NULL;
-                if (err == 0)
+                if (err == 0) {
+                        nf_bridge_adjust_segmented_data(segs);
                         err = __nf_queue(segs, elem, pf, hook, indev,
                                            outdev, okfn, queuenum);
+                }
                 if (err == 0)
                         queued++;
                 else
@@ -252,11 +275,12 @@ int nf_queue(struct sk_buff *skb,
                 segs = nskb;
         } while (segs);
 
-        /* also free orig skb if only some segments were queued */
-        if (unlikely(err && queued))
-                err = 0;
-        if (err == 0)
+        if (queued) {
                 kfree_skb(skb);
+                return 0;
+        }
+  out_err:
+        nf_bridge_adjust_segmented_data(skb);
         return err;
 }
 
diff --git a/net/netfilter/xt_TEE.c b/net/netfilter/xt_TEE.c
index 3aae66facf9f..4d5057902839 100644
--- a/net/netfilter/xt_TEE.c
+++ b/net/netfilter/xt_TEE.c
@@ -152,9 +152,10 @@ tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
         fl6.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
                            (iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return false;
-
+        }
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
         skb->dev      = dst->dev;
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 2725d1bdf291..48badffaafc1 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007-2011 Nicira Networks.
+ * Copyright (c) 2007-2012 Nicira Networks.
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of version 2 of the GNU General Public
@@ -145,9 +145,16 @@ static void set_ip_addr(struct sk_buff *skb, struct iphdr *nh,
                         inet_proto_csum_replace4(&tcp_hdr(skb)->check, skb,
                                                  *addr, new_addr, 1);
         } else if (nh->protocol == IPPROTO_UDP) {
-                if (likely(transport_len >= sizeof(struct udphdr)))
-                        inet_proto_csum_replace4(&udp_hdr(skb)->check, skb,
-                                                 *addr, new_addr, 1);
+                if (likely(transport_len >= sizeof(struct udphdr))) {
+                        struct udphdr *uh = udp_hdr(skb);
+
+                        if (uh->check || skb->ip_summed == CHECKSUM_PARTIAL) {
+                                inet_proto_csum_replace4(&uh->check, skb,
+                                                         *addr, new_addr, 1);
+                                if (!uh->check)
+                                        uh->check = CSUM_MANGLED_0;
+                        }
+                }
         }
 
         csum_replace4(&nh->check, *addr, new_addr);
@@ -197,8 +204,22 @@ static void set_tp_port(struct sk_buff *skb, __be16 *port,
         skb->rxhash = 0;
 }
 
-static int set_udp_port(struct sk_buff *skb,
-                        const struct ovs_key_udp *udp_port_key)
+static void set_udp_port(struct sk_buff *skb, __be16 *port, __be16 new_port)
+{
+        struct udphdr *uh = udp_hdr(skb);
+
+        if (uh->check && skb->ip_summed != CHECKSUM_PARTIAL) {
+                set_tp_port(skb, port, new_port, &uh->check);
+
+                if (!uh->check)
+                        uh->check = CSUM_MANGLED_0;
+        } else {
+                *port = new_port;
+                skb->rxhash = 0;
+        }
+}
+
+static int set_udp(struct sk_buff *skb, const struct ovs_key_udp *udp_port_key)
 {
         struct udphdr *uh;
         int err;
@@ -210,16 +231,15 @@ static int set_udp_port(struct sk_buff *skb,
 
         uh = udp_hdr(skb);
         if (udp_port_key->udp_src != uh->source)
-                set_tp_port(skb, &uh->source, udp_port_key->udp_src, &uh->check);
+                set_udp_port(skb, &uh->source, udp_port_key->udp_src);
 
         if (udp_port_key->udp_dst != uh->dest)
-                set_tp_port(skb, &uh->dest, udp_port_key->udp_dst, &uh->check);
+                set_udp_port(skb, &uh->dest, udp_port_key->udp_dst);
 
         return 0;
 }
 
-static int set_tcp_port(struct sk_buff *skb,
-                        const struct ovs_key_tcp *tcp_port_key)
+static int set_tcp(struct sk_buff *skb, const struct ovs_key_tcp *tcp_port_key)
 {
         struct tcphdr *th;
         int err;
@@ -328,11 +348,11 @@ static int execute_set_action(struct sk_buff *skb,
                 break;
 
         case OVS_KEY_ATTR_TCP:
-                err = set_tcp_port(skb, nla_data(nested_attr));
+                err = set_tcp(skb, nla_data(nested_attr));
                 break;
 
         case OVS_KEY_ATTR_UDP:
-                err = set_udp_port(skb, nla_data(nested_attr));
+                err = set_udp(skb, nla_data(nested_attr));
                 break;
         }
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index ce64c18b8c79..2c030505b335 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -1521,6 +1521,9 @@ static struct vport *lookup_vport(struct ovs_header *ovs_header,
                 vport = ovs_vport_locate(nla_data(a[OVS_VPORT_ATTR_NAME]));
                 if (!vport)
                         return ERR_PTR(-ENODEV);
+                if (ovs_header->dp_ifindex &&
+                    ovs_header->dp_ifindex != get_dpifindex(vport->dp))
+                        return ERR_PTR(-ENODEV);
                 return vport;
         } else if (a[OVS_VPORT_ATTR_PORT_NO]) {
                 u32 port_no = nla_get_u32(a[OVS_VPORT_ATTR_PORT_NO]);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index e83d61ca78ca..5da548fa7ae9 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -501,9 +501,8 @@ tfifo_dequeue:
 
                 /* if more time remaining? */
                 if (cb->time_to_send <= psched_get_time()) {
-                        skb = qdisc_dequeue_tail(sch);
-                        if (unlikely(!skb))
-                                goto qdisc_dequeue;
+                        __skb_unlink(skb, &sch->q);
+                        sch->qstats.backlog -= qdisc_pkt_len(skb);
 
 #ifdef CONFIG_NET_CLS_ACT
                         /*
@@ -539,7 +538,6 @@ deliver:
                 qdisc_watchdog_schedule(&q->watchdog, cb->time_to_send);
         }
 
-qdisc_dequeue:
         if (q->qdisc) {
                 skb = q->qdisc->ops->dequeue(q->qdisc);
                 if (skb)
diff --git a/scripts/coccicheck b/scripts/coccicheck
index 3c2776466d87..823e972149e5 100755
--- a/scripts/coccicheck
+++ b/scripts/coccicheck
@@ -9,15 +9,10 @@ if [ "$C" = "1" -o "$C" = "2" ]; then
 #    FLAGS="-ignore_unknown_options -very_quiet"
 #    OPTIONS=$*
 
-    if [ "$KBUILD_EXTMOD" = "" ] ; then
-        # Workaround for Coccinelle < 0.2.3
-        FLAGS="-I $srctree/include -very_quiet"
-        shift $(( $# - 1 ))
-        OPTIONS=$1
-    else
-        echo M= is not currently supported when C=1 or C=2
-        exit 1
-    fi
+# Workaround for Coccinelle < 0.2.3
+        FLAGS="-I $srctree/include -very_quiet"
+        shift $(( $# - 1 ))
+        OPTIONS=$1
 else
     ONLINE=0
     FLAGS="-very_quiet"
diff --git a/scripts/depmod.sh b/scripts/depmod.sh
index a27235685949..2ae481703141 100755
--- a/scripts/depmod.sh
+++ b/scripts/depmod.sh
@@ -9,12 +9,6 @@ fi
 DEPMOD=$1
 KERNELRELEASE=$2
 
-if ! "$DEPMOD" -V 2>/dev/null | grep -q module-init-tools; then
-        echo "Warning: you may need to install module-init-tools" >&2
-        echo "See http://www.codemonkey.org.uk/docs/post-halloween-2.6.txt" >&2
-        sleep 1
-fi
-
 if ! test -r System.map -a -x "$DEPMOD"; then
         exit 0
 fi
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index d0de2a2c3a2d..b89efe6e4c85 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -46,11 +46,37 @@ struct devtable {
         void *function;
 };
 
+#define ___cat(a,b) a ## b
+#define __cat(a,b) ___cat(a,b)
+
+/* we need some special handling for this host tool running eventually on
+ * Darwin. The Mach-O section handling is a bit different than ELF section
+ * handling. The differnces in detail are:
+ *  a) we have segments which have sections
+ *  b) we need a API call to get the respective section symbols */
+#if defined(__MACH__)
+#include <mach-o/getsect.h>
+
+#define INIT_SECTION(name)  do {                                        \
+                unsigned long name ## _len;                             \
+                char *__cat(pstart_,name) = getsectdata("__TEXT",       \
+                        #name, &__cat(name,_len));                      \
+                char *__cat(pstop_,name) = __cat(pstart_,name) +        \
+                        __cat(name, _len);                              \
+                __cat(__start_,name) = (void *)__cat(pstart_,name);     \
+                __cat(__stop_,name) = (void *)__cat(pstop_,name);       \
+        } while (0)
+#define SECTION(name)   __attribute__((section("__TEXT, " #name)))
+
+struct devtable **__start___devtable, **__stop___devtable;
+#else
+#define INIT_SECTION(name) /* no-op for ELF */
+#define SECTION(name)   __attribute__((section(#name)))
+
 /* We construct a table of pointers in an ELF section (pointers generally
  * go unpadded by gcc).  ld creates boundary syms for us. */
 extern struct devtable *__start___devtable[], *__stop___devtable[];
-#define ___cat(a,b) a ## b
-#define __cat(a,b) ___cat(a,b)
+#endif /* __MACH__ */
 
 #if __GNUC__ == 3 && __GNUC_MINOR__ < 3
 # define __used                 __attribute__((__unused__))
@@ -65,8 +91,8 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
                                                 (type *)NULL,           \
                                                 (char *)NULL)),         \
                 sizeof(type), (function) };                             \
-        static struct devtable *__attribute__((section("__devtable"))) \
-                __used __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
+        static struct devtable *SECTION(__devtable) __used \
+                __cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
 
 #define ADD(str, sep, cond, field)                              \
 do {                                                            \
@@ -1080,6 +1106,7 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
                 do_pnp_card_entries(symval, sym->st_size, mod);
         else {
                 struct devtable **p;
+                INIT_SECTION(__devtable);
 
                 for (p = __start___devtable; p < __stop___devtable; p++) {
                         if (sym_is(name, namelen, (*p)->device_id)) {
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 2bd594e6d1b4..9adb667dd31a 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -1494,6 +1494,13 @@ static int addend_386_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
         return 0;
 }
 
+#ifndef R_ARM_CALL
+#define R_ARM_CALL      28
+#endif
+#ifndef R_ARM_JUMP24
+#define R_ARM_JUMP24    29
+#endif
+
 static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
 {
         unsigned int r_typ = ELF_R_TYPE(r->r_info);
@@ -1505,6 +1512,8 @@ static int addend_arm_rel(struct elf_info *elf, Elf_Shdr *sechdr, Elf_Rela *r)
                               (elf->symtab_start + ELF_R_SYM(r->r_info));
                 break;
         case R_ARM_PC24:
+        case R_ARM_CALL:
+        case R_ARM_JUMP24:
                 /* From ARM ABI: ((S + A) | T) - P */
                 r->r_addend = (int)(long)(elf->hdr +
                               sechdr->sh_offset +
diff --git a/scripts/package/builddeb b/scripts/package/builddeb
index f6cbc3ddb68b..3c6c0b14c807 100644
--- a/scripts/package/builddeb
+++ b/scripts/package/builddeb
@@ -238,14 +238,14 @@ EOF
 fi
 
 # Build header package
-(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > /tmp/files$$)
-(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> /tmp/files$$)
-(cd $objtree; find .config Module.symvers include scripts -type f >> /tmp/objfiles$$)
+(cd $srctree; find . -name Makefile -o -name Kconfig\* -o -name \*.pl > "$objtree/debian/hdrsrcfiles")
+(cd $srctree; find arch/$SRCARCH/include include scripts -type f >> "$objtree/debian/hdrsrcfiles")
+(cd $objtree; find .config Module.symvers include scripts -type f >> "$objtree/debian/hdrobjfiles")
 destdir=$kernel_headers_dir/usr/src/linux-headers-$version
 mkdir -p "$destdir"
-(cd $srctree; tar -c -f - -T /tmp/files$$) | (cd $destdir; tar -xf -)
-(cd $objtree; tar -c -f - -T /tmp/objfiles$$) | (cd $destdir; tar -xf -)
-rm -f /tmp/files$$ /tmp/objfiles$$
+(cd $srctree; tar -c -f - -T "$objtree/debian/hdrsrcfiles") | (cd $destdir; tar -xf -)
+(cd $objtree; tar -c -f - -T "$objtree/debian/hdrobjfiles") | (cd $destdir; tar -xf -)
+rm -f "$objtree/debian/hdrsrcfiles" "$objtree/debian/hdrobjfiles"
 arch=$(dpkg --print-architecture)
 
 cat <<EOF >> debian/control
diff --git a/sound/pci/azt3328.c b/sound/pci/azt3328.c
index 95ffa6a9db6e..496f14c1a731 100644
--- a/sound/pci/azt3328.c
+++ b/sound/pci/azt3328.c
@@ -2684,10 +2684,9 @@ snd_azf3328_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
                 err = snd_opl3_hwdep_new(opl3, 0, 1, NULL);
                 if (err < 0)
                         goto out_err;
+                opl3->private_data = chip;
         }
 
-        opl3->private_data = chip;
-
         sprintf(card->longname, "%s at 0x%lx, irq %i",
                 card->shortname, chip->ctrl_io, chip->irq);
 
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index c2c65f63bf06..684307372d73 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1759,7 +1759,11 @@ static void put_vol_mute(struct hda_codec *codec, struct hda_amp_info *info,
         parm = ch ? AC_AMP_SET_RIGHT : AC_AMP_SET_LEFT;
         parm |= direction == HDA_OUTPUT ? AC_AMP_SET_OUTPUT : AC_AMP_SET_INPUT;
         parm |= index << AC_AMP_SET_INDEX_SHIFT;
-        parm |= val;
+        if ((val & HDA_AMP_MUTE) && !(info->amp_caps & AC_AMPCAP_MUTE) &&
+            (info->amp_caps & AC_AMPCAP_MIN_MUTE))
+                ; /* set the zero value as a fake mute */
+        else
+                parm |= val;
         snd_hda_codec_write(codec, nid, 0, AC_VERB_SET_AMP_GAIN_MUTE, parm);
         info->vol[ch] = val;
 }
@@ -2026,7 +2030,7 @@ int snd_hda_mixer_amp_tlv(struct snd_kcontrol *kcontrol, int op_flag,
         val1 = -((caps & AC_AMPCAP_OFFSET) >> AC_AMPCAP_OFFSET_SHIFT);
         val1 += ofs;
         val1 = ((int)val1) * ((int)val2);
-        if (min_mute)
+        if (min_mute || (caps & AC_AMPCAP_MIN_MUTE))
                 val2 |= TLV_DB_SCALE_MUTE;
         if (put_user(SNDRV_CTL_TLVT_DB_SCALE, _tlv))
                 return -EFAULT;
@@ -5114,7 +5118,7 @@ static int fill_audio_out_name(struct hda_codec *codec, hda_nid_t nid,
         const char *pfx = "", *sfx = "";
 
         /* handle as a speaker if it's a fixed line-out */
-        if (!strcmp(name, "Line-Out") && attr == INPUT_PIN_ATTR_INT)
+        if (!strcmp(name, "Line Out") && attr == INPUT_PIN_ATTR_INT)
                 name = "Speaker";
         /* check the location */
         switch (attr) {
@@ -5173,7 +5177,7 @@ int snd_hda_get_pin_label(struct hda_codec *codec, hda_nid_t nid,
 
         switch (get_defcfg_device(def_conf)) {
         case AC_JACK_LINE_OUT:
-                return fill_audio_out_name(codec, nid, cfg, "Line-Out",
+                return fill_audio_out_name(codec, nid, cfg, "Line Out",
                                            label, maxlen, indexp);
         case AC_JACK_SPEAKER:
                 return fill_audio_out_name(codec, nid, cfg, "Speaker",
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index e9f71dc0d464..f0f1943a4b2c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -298,6 +298,9 @@ enum {
 #define AC_AMPCAP_MUTE                  (1<<31)    /* mute capable */
 #define AC_AMPCAP_MUTE_SHIFT            31
 
+/* driver-specific amp-caps: using bits 24-30 */
+#define AC_AMPCAP_MIN_MUTE              (1 << 30) /* min-volume = mute */
+
 /* Connection list */
 #define AC_CLIST_LENGTH                 (0x7f<<0)
 #define AC_CLIST_LONG                   (1<<7)
diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index bc5a993d1146..c83ccdba1e5a 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -609,7 +609,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 "Front Speaker", "Surround Speaker", "Bass Speaker"
         };
         static const char * const line_outs[] = {
-                "Front Line-Out", "Surround Line-Out", "Bass Line-Out"
+                "Front Line Out", "Surround Line Out", "Bass Line Out"
         };
 
         fix_volume_caps(codec, dac);
@@ -635,7 +635,7 @@ static int add_output(struct hda_codec *codec, hda_nid_t dac, int idx,
                 if (num_ctls > 1)
                         name = line_outs[idx];
                 else
-                        name = "Line-Out";
+                        name = "Line Out";
                 break;
         }
 
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index a7a5733aa4d2..d29d6d377904 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -3482,7 +3482,7 @@ static int cx_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -4079,7 +4079,8 @@ static int cx_auto_add_volume_idx(struct hda_codec *codec, const char *basename,
                 err = snd_hda_ctl_add(codec, nid, kctl);
                 if (err < 0)
                         return err;
-                if (!(query_amp_caps(codec, nid, hda_dir) & AC_AMPCAP_MUTE))
+                if (!(query_amp_caps(codec, nid, hda_dir) &
+                      (AC_AMPCAP_MUTE | AC_AMPCAP_MIN_MUTE)))
                         break;
         }
         return 0;
@@ -4379,6 +4380,22 @@ static const struct snd_pci_quirk cxt_fixups[] = {
         {}
 };
 
+/* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
+ * can be created (bko#42825)
+ */
+static void add_cx5051_fake_mutes(struct hda_codec *codec)
+{
+        static hda_nid_t out_nids[] = {
+                0x10, 0x11, 0
+        };
+        hda_nid_t *p;
+
+        for (p = out_nids; *p; p++)
+                snd_hda_override_amp_caps(codec, *p, HDA_OUTPUT,
+                                          AC_AMPCAP_MIN_MUTE |
+                                          query_amp_caps(codec, *p, HDA_OUTPUT));
+}
+
 static int patch_conexant_auto(struct hda_codec *codec)
 {
         struct conexant_spec *spec;
@@ -4397,6 +4414,9 @@ static int patch_conexant_auto(struct hda_codec *codec)
         case 0x14f15045:
                 spec->single_adc_amp = 1;
                 break;
+        case 0x14f15051:
+                add_cx5051_fake_mutes(codec);
+                break;
         }
 
         apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 1358987c49d8..22c73b78ac6f 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -80,6 +80,8 @@ enum {
         ALC_AUTOMUTE_MIXER,     /* mute/unmute mixer widget AMP */
 };
 
+#define MAX_VOL_NIDS    0x40
+
 struct alc_spec {
         /* codec parameterization */
         const struct snd_kcontrol_new *mixers[5];       /* mixer arrays */
@@ -118,8 +120,8 @@ struct alc_spec {
         const hda_nid_t *capsrc_nids;
         hda_nid_t dig_in_nid;           /* digital-in NID; optional */
         hda_nid_t mixer_nid;            /* analog-mixer NID */
-        DECLARE_BITMAP(vol_ctls, 0x20 << 1);
-        DECLARE_BITMAP(sw_ctls, 0x20 << 1);
+        DECLARE_BITMAP(vol_ctls, MAX_VOL_NIDS << 1);
+        DECLARE_BITMAP(sw_ctls, MAX_VOL_NIDS << 1);
 
         /* capture setup for dynamic dual-adc switch */
         hda_nid_t cur_adc;
@@ -800,7 +802,7 @@ static int alc_automute_mode_info(struct snd_kcontrol *kcontrol,
                 "Disabled", "Enabled"
         };
         static const char * const texts3[] = {
-                "Disabled", "Speaker Only", "Line-Out+Speaker"
+                "Disabled", "Speaker Only", "Line Out+Speaker"
         };
         const char * const *texts;
 
@@ -1854,7 +1856,7 @@ static const char * const alc_slave_vols[] = {
         "Headphone Playback Volume",
         "Speaker Playback Volume",
         "Mono Playback Volume",
-        "Line-Out Playback Volume",
+        "Line Out Playback Volume",
         "CLFE Playback Volume",
         "Bass Speaker Playback Volume",
         "PCM Playback Volume",
@@ -1871,7 +1873,7 @@ static const char * const alc_slave_sws[] = {
         "Speaker Playback Switch",
         "Mono Playback Switch",
         "IEC958 Playback Switch",
-        "Line-Out Playback Switch",
+        "Line Out Playback Switch",
         "CLFE Playback Switch",
         "Bass Speaker Playback Switch",
         "PCM Playback Switch",
@@ -2066,12 +2068,16 @@ static int alc_build_controls(struct hda_codec *codec)
  */
 
 static void alc_init_special_input_src(struct hda_codec *codec);
+static int alc269_fill_coef(struct hda_codec *codec);
 
 static int alc_init(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
         unsigned int i;
 
+        if (codec->vendor_id == 0x10ec0269)
+                alc269_fill_coef(codec);
+
         alc_fix_pll(codec);
         alc_auto_init_amp(codec, spec->init_amp);
 
@@ -3149,7 +3155,10 @@ static int alc_auto_fill_dac_nids(struct hda_codec *codec)
 static inline unsigned int get_ctl_pos(unsigned int data)
 {
         hda_nid_t nid = get_amp_nid_(data);
-        unsigned int dir = get_amp_direction_(data);
+        unsigned int dir;
+        if (snd_BUG_ON(nid >= MAX_VOL_NIDS))
+                return 0;
+        dir = get_amp_direction_(data);
         return (nid << 1) | dir;
 }
 
@@ -3792,7 +3801,7 @@ static void alc_auto_init_input_src(struct hda_codec *codec)
         else
                 nums = spec->num_adc_nids;
         for (c = 0; c < nums; c++)
-                alc_mux_select(codec, 0, spec->cur_mux[c], true);
+                alc_mux_select(codec, c, spec->cur_mux[c], true);
 }
 
 /* add mic boosts if needed */
@@ -4362,6 +4371,7 @@ enum {
         ALC882_FIXUP_PB_M5210,
         ALC882_FIXUP_ACER_ASPIRE_7736,
         ALC882_FIXUP_ASUS_W90V,
+        ALC889_FIXUP_CD,
         ALC889_FIXUP_VAIO_TT,
         ALC888_FIXUP_EEE1601,
         ALC882_FIXUP_EAPD,
@@ -4436,12 +4446,20 @@ static void alc889_fixup_dac_route(struct hda_codec *codec,
                                    const struct alc_fixup *fix, int action)
 {
         if (action == ALC_FIXUP_ACT_PRE_PROBE) {
+                /* fake the connections during parsing the tree */
                 hda_nid_t conn1[2] = { 0x0c, 0x0d };
                 hda_nid_t conn2[2] = { 0x0e, 0x0f };
                 snd_hda_override_conn_list(codec, 0x14, 2, conn1);
                 snd_hda_override_conn_list(codec, 0x15, 2, conn1);
                 snd_hda_override_conn_list(codec, 0x18, 2, conn2);
                 snd_hda_override_conn_list(codec, 0x1a, 2, conn2);
+        } else if (action == ALC_FIXUP_ACT_PROBE) {
+                /* restore the connections */
+                hda_nid_t conn[5] = { 0x0c, 0x0d, 0x0e, 0x0f, 0x26 };
+                snd_hda_override_conn_list(codec, 0x14, 5, conn);
+                snd_hda_override_conn_list(codec, 0x15, 5, conn);
+                snd_hda_override_conn_list(codec, 0x18, 5, conn);
+                snd_hda_override_conn_list(codec, 0x1a, 5, conn);
         }
 }
 
@@ -4481,6 +4499,13 @@ static const struct alc_fixup alc882_fixups[] = {
                         { }
                 }
         },
+        [ALC889_FIXUP_CD] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x1c, 0x993301f0 }, /* CD */
+                        { }
+                }
+        },
         [ALC889_FIXUP_VAIO_TT] = {
                 .type = ALC_FIXUP_PINS,
                 .v.pins = (const struct alc_pincfg[]) {
@@ -4637,6 +4662,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 
         SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+        SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3", ALC889_FIXUP_CD),
         SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
         SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
@@ -5454,8 +5480,12 @@ static const struct alc_model_fixup alc269_fixup_models[] = {
 
 static int alc269_fill_coef(struct hda_codec *codec)
 {
+        struct alc_spec *spec = codec->spec;
         int val;
 
+        if (spec->codec_variant != ALC269_TYPE_ALC269VB)
+                return 0;
+
         if ((alc_get_coef0(codec) & 0x00ff) < 0x015) {
                 alc_write_coef_idx(codec, 0xf, 0x960b);
                 alc_write_coef_idx(codec, 0xe, 0x8817);
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 6345df131a00..9dbb5735d778 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -4629,7 +4629,7 @@ static void stac92xx_hp_detect(struct hda_codec *codec)
                 unsigned int val = AC_PINCTL_OUT_EN | AC_PINCTL_HP_EN;
                 if (no_hp_sensing(spec, i))
                         continue;
-                if (presence)
+                if (1 /*presence*/)
                         stac92xx_set_pinctl(codec, cfg->hp_pins[i], val);
 #if 0 /* FIXME */
 /* Resetting the pinctl like below may lead to (a sort of) regressions
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index cc9f6c83d661..bc030a2088da 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -6333,6 +6333,7 @@ static int __devinit snd_hdspm_create_hwdep(struct snd_card *card,
 
         hw->ops.open = snd_hdspm_hwdep_dummy_op;
         hw->ops.ioctl = snd_hdspm_hwdep_ioctl;
+        hw->ops.ioctl_compat = snd_hdspm_hwdep_ioctl;
         hw->ops.release = snd_hdspm_hwdep_dummy_op;
 
         return 0;
diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
index 5ef70b5d27e4..278c0a0575f5 100644
--- a/sound/soc/codecs/ak4642.c
+++ b/sound/soc/codecs/ak4642.c
@@ -146,13 +146,10 @@ static const struct snd_kcontrol_new ak4642_snd_controls[] = {
 
         SOC_DOUBLE_R_TLV("Digital Playback Volume", L_DVC, R_DVC,
                          0, 0xFF, 1, out_tlv),
-
-        SOC_SINGLE("Headphone Switch", PW_MGMT2, 6, 1, 0),
 };
 
-static const struct snd_kcontrol_new ak4642_hpout_mixer_controls[] = {
-        SOC_DAPM_SINGLE("DACH", MD_CTL4, 0, 1, 0),
-};
+static const struct snd_kcontrol_new ak4642_headphone_control =
+        SOC_DAPM_SINGLE("Switch", PW_MGMT2, 6, 1, 0);
 
 static const struct snd_kcontrol_new ak4642_lout_mixer_controls[] = {
         SOC_DAPM_SINGLE("DACL", SG_SL1, 4, 1, 0),
@@ -165,13 +162,12 @@ static const struct snd_soc_dapm_widget ak4642_dapm_widgets[] = {
         SND_SOC_DAPM_OUTPUT("HPOUTR"),
         SND_SOC_DAPM_OUTPUT("LINEOUT"),
 
-        SND_SOC_DAPM_MIXER("HPOUTL Mixer", PW_MGMT2, 5, 0,
-                           &ak4642_hpout_mixer_controls[0],
-                           ARRAY_SIZE(ak4642_hpout_mixer_controls)),
+        SND_SOC_DAPM_PGA("HPL Out", PW_MGMT2, 5, 0, NULL, 0),
+        SND_SOC_DAPM_PGA("HPR Out", PW_MGMT2, 4, 0, NULL, 0),
+        SND_SOC_DAPM_SWITCH("Headphone Enable", SND_SOC_NOPM, 0, 0,
+                            &ak4642_headphone_control),
 
-        SND_SOC_DAPM_MIXER("HPOUTR Mixer", PW_MGMT2, 4, 0,
-                           &ak4642_hpout_mixer_controls[0],
-                           ARRAY_SIZE(ak4642_hpout_mixer_controls)),
+        SND_SOC_DAPM_PGA("DACH", MD_CTL4, 0, 0, NULL, 0),
 
         SND_SOC_DAPM_MIXER("LINEOUT Mixer", PW_MGMT1, 3, 0,
                            &ak4642_lout_mixer_controls[0],
@@ -184,12 +180,17 @@ static const struct snd_soc_dapm_widget ak4642_dapm_widgets[] = {
 static const struct snd_soc_dapm_route ak4642_intercon[] = {
 
         /* Outputs */
-        {"HPOUTL", NULL, "HPOUTL Mixer"},
-        {"HPOUTR", NULL, "HPOUTR Mixer"},
+        {"HPOUTL", NULL, "HPL Out"},
+        {"HPOUTR", NULL, "HPR Out"},
         {"LINEOUT", NULL, "LINEOUT Mixer"},
 
-        {"HPOUTL Mixer", "DACH", "DAC"},
-        {"HPOUTR Mixer", "DACH", "DAC"},
+        {"HPL Out", NULL, "Headphone Enable"},
+        {"HPR Out", NULL, "Headphone Enable"},
+
+        {"Headphone Enable", "Switch", "DACH"},
+
+        {"DACH", NULL, "DAC"},
+
         {"LINEOUT Mixer", "DACL", "DAC"},
 };
 
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 29c4b02c4790..0ac228b7dc04 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -2564,7 +2564,7 @@ static int dsp2_event(struct snd_soc_dapm_widget *w,
         return 0;
 }
 
-static const char *st_text[] = { "None", "Right", "Left" };
+static const char *st_text[] = { "None", "Left", "Right" };
 
 static const struct soc_enum str_enum =
         SOC_ENUM_SINGLE(WM8962_DAC_DSP_MIXING_1, 2, 3, st_text);
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 01d1f749cf02..b6adbed6e506 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -112,7 +112,7 @@ static int imx_ssi_set_dai_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt)
                 break;
         case SND_SOC_DAIFMT_DSP_A:
                 /* data on rising edge of bclk, frame high 1clk before data */
-                strcr |= SSI_STCR_TFSL | SSI_STCR_TEFS;
+                strcr |= SSI_STCR_TFSL | SSI_STCR_TXBIT0 | SSI_STCR_TEFS;
                 break;
         }
 
diff --git a/sound/soc/samsung/neo1973_wm8753.c b/sound/soc/samsung/neo1973_wm8753.c
index c6012ff5bd3e..d23b19a59d83 100644
--- a/sound/soc/samsung/neo1973_wm8753.c
+++ b/sound/soc/samsung/neo1973_wm8753.c
@@ -367,7 +367,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .platform_name = "samsung-audio",
         .cpu_dai_name = "s3c24xx-iis",
         .codec_dai_name = "wm8753-hifi",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
         .init = neo1973_wm8753_init,
         .ops = &neo1973_hifi_ops,
 },
@@ -376,7 +376,7 @@ static struct snd_soc_dai_link neo1973_dai[] = {
         .stream_name = "Voice",
         .cpu_dai_name = "dfbmcs320-pcm",
         .codec_dai_name = "wm8753-voice",
-        .codec_name = "wm8753-codec.0-001a",
+        .codec_name = "wm8753.0-001a",
         .ops = &neo1973_voice_ops,
 },
 };
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 1f55ded4047f..1315663c1c09 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -3068,9 +3068,13 @@ static void soc_dapm_shutdown_codec(struct snd_soc_dapm_context *dapm)
          * standby.
          */
         if (powerdown) {
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_PREPARE);
+                if (dapm->bias_level == SND_SOC_BIAS_ON)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_PREPARE);
                 dapm_seq_run(dapm, &down_list, 0, false);
-                snd_soc_dapm_set_bias_level(dapm, SND_SOC_BIAS_STANDBY);
+                if (dapm->bias_level == SND_SOC_BIAS_PREPARE)
+                        snd_soc_dapm_set_bias_level(dapm,
+                                                    SND_SOC_BIAS_STANDBY);
         }
 }
 
@@ -3083,7 +3087,9 @@ void snd_soc_dapm_shutdown(struct snd_soc_card *card)
 
         list_for_each_entry(codec, &card->codec_dev_list, list) {
                 soc_dapm_shutdown_codec(&codec->dapm);
-                snd_soc_dapm_set_bias_level(&codec->dapm, SND_SOC_BIAS_OFF);
+                if (codec->dapm.bias_level == SND_SOC_BIAS_STANDBY)
+                        snd_soc_dapm_set_bias_level(&codec->dapm,
+                                                    SND_SOC_BIAS_OFF);
         }
 }
 
diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
index 2cf87f5afed4..fde9a7a29cb6 100644
--- a/sound/usb/caiaq/audio.c
+++ b/sound/usb/caiaq/audio.c
@@ -311,8 +311,10 @@ snd_usb_caiaq_pcm_pointer(struct snd_pcm_substream *sub)
 
         spin_lock(&dev->spinlock);
 
-        if (dev->input_panic || dev->output_panic)
+        if (dev->input_panic || dev->output_panic) {
                 ptr = SNDRV_PCM_POS_XRUN;
+                goto unlock;
+        }
 
         if (sub->stream == SNDRV_PCM_STREAM_PLAYBACK)
                 ptr = bytes_to_frames(sub->runtime,
@@ -321,6 +323,7 @@ snd_usb_caiaq_pcm_pointer(struct snd_pcm_substream *sub)
                 ptr = bytes_to_frames(sub->runtime,
                                         dev->audio_in_buf_pos[index]);
 
+unlock:
         spin_unlock(&dev->spinlock);
         return ptr;
 }
diff --git a/sound/usb/card.h b/sound/usb/card.h
index a39edcc32a93..da5fa1ac4eda 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -1,6 +1,7 @@
 #ifndef __USBAUDIO_CARD_H
 #define __USBAUDIO_CARD_H
 
+#define MAX_NR_RATES    1024
 #define MAX_PACKS       20
 #define MAX_PACKS_HS    (MAX_PACKS * 8) /* in high speed mode */
 #define MAX_URBS        8
diff --git a/sound/usb/format.c b/sound/usb/format.c
index e09aba19375c..ddfef57c4c9f 100644
--- a/sound/usb/format.c
+++ b/sound/usb/format.c
@@ -209,8 +209,6 @@ static int parse_audio_format_rates_v1(struct snd_usb_audio *chip, struct audiof
         return 0;
 }
 
-#define MAX_UAC2_NR_RATES 1024
-
 /*
  * Helper function to walk the array of sample rate triplets reported by
  * the device. The problem is that we need to parse whole array first to
@@ -255,7 +253,7 @@ static int parse_uac2_sample_rate_range(struct audioformat *fp, int nr_triplets,
                         fp->rates |= snd_pcm_rate_to_rate_bit(rate);
 
                         nr_rates++;
-                        if (nr_rates >= MAX_UAC2_NR_RATES) {
+                        if (nr_rates >= MAX_NR_RATES) {
                                 snd_printk(KERN_ERR "invalid uac2 rates\n");
                                 break;
                         }
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index a3ddac0deffd..27817266867a 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -132,10 +132,14 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
         unsigned *rate_table = NULL;
 
         fp = kmemdup(quirk->data, sizeof(*fp), GFP_KERNEL);
-        if (! fp) {
+        if (!fp) {
                 snd_printk(KERN_ERR "cannot memdup\n");
                 return -ENOMEM;
         }
+        if (fp->nr_rates > MAX_NR_RATES) {
+                kfree(fp);
+                return -EINVAL;
+        }
         if (fp->nr_rates > 0) {
                 rate_table = kmemdup(fp->rate_table,
                                      sizeof(int) * fp->nr_rates, GFP_KERNEL);
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 0abfb18b911f..227b6ae99785 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -204,6 +204,9 @@ static void perf_record__open(struct perf_record *rec)
 
                 if (opts->group && pos != first)
                         group_fd = first->fd;
+fallback_missing_features:
+                if (opts->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                 attr->sample_id_all = opts->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -217,15 +220,23 @@ try_again:
                         } else if (err ==  ENODEV && opts->cpu_list) {
                                 die("No such device - did you specify"
                                         " an out-of-range profile CPU?\n");
-                        } else if (err == EINVAL && opts->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                opts->sample_id_all_avail = false;
-                                if (!opts->sample_time && !opts->raw_samples && !time_needed)
-                                        attr->sample_type &= ~PERF_SAMPLE_TIME;
-
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!opts->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        opts->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (opts->sample_id_all_avail) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        opts->sample_id_all_avail = false;
+                                        if (!opts->sample_time && !opts->raw_samples && !time_needed)
+                                                attr->sample_type &= ~PERF_SAMPLE_TIME;
+
+                                        goto retry_sample_id;
+                                }
                         }
 
                         /*
@@ -503,9 +514,9 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                         return err;
         }
 
-        if (!!rec->no_buildid
+        if (!rec->no_buildid
             && !perf_header__has_feat(&session->header, HEADER_BUILD_ID)) {
-                pr_err("Couldn't generating buildids. "
+                pr_err("Couldn't generate buildids. "
                        "Use --no-buildid to profile anyway.\n");
                 return -1;
         }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index dd162aa24baa..ecff31257eb3 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -857,6 +857,9 @@ static void perf_top__start_counters(struct perf_top *top)
                 attr->mmap = 1;
                 attr->comm = 1;
                 attr->inherit = top->inherit;
+fallback_missing_features:
+                if (top->exclude_guest_missing)
+                        attr->exclude_guest = attr->exclude_host = 0;
 retry_sample_id:
                 attr->sample_id_all = top->sample_id_all_avail ? 1 : 0;
 try_again:
@@ -868,12 +871,20 @@ try_again:
                         if (err == EPERM || err == EACCES) {
                                 ui__error_paranoid();
                                 goto out_err;
-                        } else if (err == EINVAL && top->sample_id_all_avail) {
-                                /*
-                                 * Old kernel, no attr->sample_id_type_all field
-                                 */
-                                top->sample_id_all_avail = false;
-                                goto retry_sample_id;
+                        } else if (err == EINVAL) {
+                                if (!top->exclude_guest_missing &&
+                                    (attr->exclude_guest || attr->exclude_host)) {
+                                        pr_debug("Old kernel, cannot exclude "
+                                                 "guest or host samples.\n");
+                                        top->exclude_guest_missing = true;
+                                        goto fallback_missing_features;
+                                } else if (top->sample_id_all_avail) {
+                                        /*
+                                         * Old kernel, no attr->sample_id_type_all field
+                                         */
+                                        top->sample_id_all_avail = false;
+                                        goto retry_sample_id;
+                                }
                         }
                         /*
                          * If it's cycles then fall back to hrtimer
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index 64f8bee31ced..16e7d20eee83 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -199,6 +199,7 @@ struct perf_record_opts {
         bool         sample_address;
         bool         sample_time;
         bool         sample_id_all_avail;
+        bool         exclude_guest_missing;
         bool         system_wide;
         bool         period;
         unsigned int freq;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 2044324b755a..2a6f33cd888c 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -74,6 +74,7 @@ static pid_t perf_event__get_comm_tgid(pid_t pid, char *comm, size_t len)
                         if (size >= len)
                                 size = len - 1;
                         memcpy(comm, name, size);
+                        comm[size] = '\0';
 
                 } else if (memcmp(bf, "Tgid:", 5) == 0) {
                         char *tgids = bf + 5;
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 3f16e08a5c8d..ea32a061f1c8 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -349,6 +349,10 @@ struct perf_evsel *perf_evlist__id2evsel(struct perf_evlist *evlist, u64 id)
         hlist_for_each_entry(sid, pos, head, node)
                 if (sid->id == id)
                         return sid->evsel;
+
+        if (!perf_evlist__sample_id_all(evlist))
+                return list_entry(evlist->entries.next, struct perf_evsel, node);
+
         return NULL;
 }
 
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 29cb65459811..e33554a562b3 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -1867,6 +1867,12 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                            tev->point.symbol);
                 ret = -ENOENT;
                 goto error;
+        } else if (tev->point.offset > sym->end - sym->start) {
+                pr_warning("Offset specified is greater than size of %s\n",
+                           tev->point.symbol);
+                ret = -ENOENT;
+                goto error;
+
         }
 
         return 1;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 5d732621a462..74bd2e63c4b4 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -672,7 +672,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
 static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                   bool retprobe, struct probe_trace_point *tp)
 {
-        Dwarf_Addr eaddr;
+        Dwarf_Addr eaddr, highaddr;
         const char *name;
 
         /* Copy the name of probe point */
@@ -683,6 +683,16 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwarf_Addr paddr,
                                    dwarf_diename(sp_die));
                         return -ENOENT;
                 }
+                if (dwarf_highpc(sp_die, &highaddr) != 0) {
+                        pr_warning("Failed to get end address of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -ENOENT;
+                }
+                if (paddr > highaddr) {
+                        pr_warning("Offset specified is greater than size of %s\n",
+                                   dwarf_diename(sp_die));
+                        return -EINVAL;
+                }
                 tp->symbol = strdup(name);
                 if (tp->symbol == NULL)
                         return -ENOMEM;
diff --git a/tools/perf/util/top.h b/tools/perf/util/top.h
index a248f3c2c60d..f2eab81435ae 100644
--- a/tools/perf/util/top.h
+++ b/tools/perf/util/top.h
@@ -34,6 +34,7 @@ struct perf_top {
         bool               inherit;
         bool               group;
         bool               sample_id_all_avail;
+        bool               exclude_guest_missing;
         bool               dump_symtab;
         const char         *cpu_list;
         struct hist_entry  *sym_filter_entry;
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 813141047fc2..fb25d1329218 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -6,7 +6,7 @@
  * XXX We need to find a better place for these things...
  */
 bool perf_host  = true;
-bool perf_guest = true;
+bool perf_guest = false;
 
 void event_attr_init(struct perf_event_attr *attr)
 {
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 62a134dc421a..9507c4b251a8 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -3244,9 +3244,11 @@ sub make_min_config {
         $in_bisect = 1;
 
         my $failed = 0;
-        build "oldconfig";
-        start_monitor_and_boot or $failed = 1;
-        end_monitor;
+        build "oldconfig" or $failed = 1;
+        if (!$failed) {
+                start_monitor_and_boot or $failed = 1;
+                end_monitor;
+        }
 
         $in_bisect = 0;