198 files changed, 1342 insertions, 979 deletions
diff --git a/Documentation/hwmon/coretemp b/Documentation/hwmon/coretemp
index fa8776ab9b18..84d46c0c71a3 100644
--- a/Documentation/hwmon/coretemp
+++ b/Documentation/hwmon/coretemp
@@ -35,13 +35,6 @@ the Out-Of-Spec bit. Following table summarizes the exported sysfs files:
 All Sysfs entries are named with their core_id (represented here by 'X').
 tempX_input      - Core temperature (in millidegrees Celsius).
 tempX_max        - All cooling devices should be turned on (on Core2).
-                   Initialized with IA32_THERM_INTERRUPT. When the CPU
-                   temperature reaches this temperature, an interrupt is
-                   generated and tempX_max_alarm is set.
-tempX_max_hyst   - If the CPU temperature falls below than temperature,
-                   an interrupt is generated and tempX_max_alarm is reset.
-tempX_max_alarm  - Set if the temperature reaches or exceeds tempX_max.
-                   Reset if the temperature drops to or below tempX_max_hyst.
 tempX_crit       - Maximum junction temperature (in millidegrees Celsius).
 tempX_crit_alarm - Set when Out-of-spec bit is set, never clears.
                   Correct CPU operation is no longer guaranteed.
@@ -49,9 +42,10 @@ tempX_label	 - Contains string "Core X", where X is processor
                   number. For Package temp, this will be "Physical id Y",
                   where Y is the package number.
-The TjMax temperature is set to 85 degrees C if undocumented model specific
+On CPU models which support it, TjMax is read from a model-specific register.
-register (UMSR) 0xee has bit 30 set. If not the TjMax is 100 degrees C as
+On other models, it is set to an arbitrary value based on weak heuristics.
-(sometimes) documented in processor datasheet.
+If these heuristics don't work for you, you can pass the correct TjMax value
+as a module parameter (tjmax).
 Appendix A. Known TjMax lists (TBD):
 Some information comes from ark.intel.com
diff --git a/Documentation/networking/scaling.txt b/Documentation/networking/scaling.txt
index 58fd7414e6c0..8ce7c30e7230 100644
--- a/Documentation/networking/scaling.txt
+++ b/Documentation/networking/scaling.txt
@@ -243,7 +243,7 @@ configured. The number of entries in the global flow table is set through:
 The number of entries in the per-queue flow table are set through:
- /sys/class/net/<dev>/queues/tx-<n>/rps_flow_cnt
+ /sys/class/net/<dev>/queues/rx-<n>/rps_flow_cnt
 == Suggested Configuration
diff --git a/Documentation/vm/transhuge.txt b/Documentation/vm/transhuge.txt
index 0924aaca3302..29bdf62aac09 100644
--- a/Documentation/vm/transhuge.txt
+++ b/Documentation/vm/transhuge.txt
@@ -123,10 +123,11 @@ be automatically shutdown if it's set to "never".
 khugepaged runs usually at low frequency so while one may not want to
 invoke defrag algorithms synchronously during the page faults, it
 should be worth invoking defrag at least in khugepaged. However it's
-also possible to disable defrag in khugepaged:
+also possible to disable defrag in khugepaged by writing 0 or enable
+defrag in khugepaged by writing 1:
-echo yes >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 0 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
-echo no >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
+echo 1 >/sys/kernel/mm/transparent_hugepage/khugepaged/defrag
 You can also control how many pages khugepaged should scan at each
 pass:
diff --git a/Makefile b/Makefile
index 522fa4784e69..73bb458ecfd3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 1
 SUBLEVEL = 0
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc8
 NAME = "Divemaster Edition"
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3269576dbfa8..3146ed3f6eca 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1283,6 +1283,20 @@ config ARM_ERRATA_364296
          processor into full low interrupt latency mode. ARM11MPCore
          is not affected.
+config ARM_ERRATA_764369
+        bool "ARM errata: Data cache line maintenance operation by MVA may not succeed"
+        depends on CPU_V7 && SMP
+        help
+          This option enables the workaround for erratum 764369
+          affecting Cortex-A9 MPCore with two or more processors (all
+          current revisions). Under certain timing circumstances, a data
+          cache line maintenance operation by MVA targeting an Inner
+          Shareable memory region may fail to proceed up to either the
+          Point of Coherency or to the Point of Unification of the
+          system. This workaround adds a DSB instruction before the
+          relevant cache maintenance functions and sets a specific bit
+          in the diagnostic control register of the SCU.
 endmenu
 source "arch/arm/common/Kconfig"
diff --git a/arch/arm/boot/dts/tegra-harmony.dts b/arch/arm/boot/dts/tegra-harmony.dts
index 4c053340ce33..e5818668d091 100644
--- a/arch/arm/boot/dts/tegra-harmony.dts
+++ b/arch/arm/boot/dts/tegra-harmony.dts
@@ -57,14 +57,14 @@
        };
        sdhci@c8000200 {
-                gpios = <&gpio 69 0>, /* cd, gpio PI5 */
+                cd-gpios = <&gpio 69 0>; /* gpio PI5 */
-                        <&gpio 57 0>, /* wp, gpio PH1 */
+                wp-gpios = <&gpio 57 0>; /* gpio PH1 */
-                        <&gpio 155 0>; /* power, gpio PT3 */
+                power-gpios = <&gpio 155 0>; /* gpio PT3 */
        };
        sdhci@c8000600 {
-                gpios = <&gpio 58 0>, /* cd, gpio PH2 */
+                cd-gpios = <&gpio 58 0>; /* gpio PH2 */
-                        <&gpio 59 0>, /* wp, gpio PH3 */
+                wp-gpios = <&gpio 59 0>; /* gpio PH3 */
-                        <&gpio 70 0>; /* power, gpio PI6 */
+                power-gpios = <&gpio 70 0>; /* gpio PI6 */
        };
 };
diff --git a/arch/arm/boot/dts/tegra-seaboard.dts b/arch/arm/boot/dts/tegra-seaboard.dts
index 1940cae00748..64cedca6fc79 100644
--- a/arch/arm/boot/dts/tegra-seaboard.dts
+++ b/arch/arm/boot/dts/tegra-seaboard.dts
@@ -21,8 +21,8 @@
        };
        sdhci@c8000400 {
-                gpios = <&gpio 69 0>, /* cd, gpio PI5 */
+                cd-gpios = <&gpio 69 0>; /* gpio PI5 */
-                        <&gpio 57 0>, /* wp, gpio PH1 */
+                wp-gpios = <&gpio 57 0>; /* gpio PH1 */
-                        <&gpio 70 0>; /* power, gpio PI6 */
+                power-gpios = <&gpio 70 0>; /* gpio PI6 */
        };
 };
diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
index 8c73900da9ed..253cc86318bf 100644
--- a/arch/arm/include/asm/futex.h
+++ b/arch/arm/include/asm/futex.h
@@ -25,17 +25,17 @@
 #ifdef CONFIG_SMP
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        smp_mb();                                               \
        __asm__ __volatile__(                                   \
-        "1:     ldrex   %1, [%2]\n"                             \
+        "1:     ldrex   %1, [%3]\n"                             \
        "       " insn "\n"                                     \
-        "2:     strex   %1, %0, [%2]\n"                         \
+        "2:     strex   %2, %0, [%3]\n"                         \
-        "       teq     %1, #0\n"                               \
+        "       teq     %2, #0\n"                               \
        "       bne     1b\n"                                   \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -73,14 +73,14 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
 #include <linux/preempt.h>
 #include <asm/domain.h>
-#define __futex_atomic_op(insn, ret, oldval, uaddr, oparg)      \
+#define __futex_atomic_op(insn, ret, oldval, tmp, uaddr, oparg) \
        __asm__ __volatile__(                                   \
-        "1:     " T(ldr) "      %1, [%2]\n"                     \
+        "1:     " T(ldr) "      %1, [%3]\n"                     \
        "       " insn "\n"                                     \
-        "2:     " T(str) "      %0, [%2]\n"                     \
+        "2:     " T(str) "      %0, [%3]\n"                     \
        "       mov     %0, #0\n"                               \
-        __futex_atomic_ex_table("%4")                           \
+        __futex_atomic_ex_table("%5")                           \
-        : "=&r" (ret), "=&r" (oldval)                           \
+        : "=&r" (ret), "=&r" (oldval), "=&r" (tmp)              \
        : "r" (uaddr), "r" (oparg), "Ir" (-EFAULT)              \
        : "cc", "memory")
@@ -117,7 +117,7 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        int cmp = (encoded_op >> 24) & 15;
        int oparg = (encoded_op << 8) >> 20;
        int cmparg = (encoded_op << 20) >> 20;
-        int oldval = 0, ret;
+        int oldval = 0, ret, tmp;
        if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
                oparg = 1 << oparg;
@@ -129,19 +129,19 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
        switch (op) {
        case FUTEX_OP_SET:
-                __futex_atomic_op("mov  %0, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("mov  %0, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ADD:
-                __futex_atomic_op("add  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("add  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_OR:
-                __futex_atomic_op("orr  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("orr  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        case FUTEX_OP_ANDN:
-                __futex_atomic_op("and  %0, %1, %3", ret, oldval, uaddr, ~oparg);
+                __futex_atomic_op("and  %0, %1, %4", ret, oldval, tmp, uaddr, ~oparg);
                break;
        case FUTEX_OP_XOR:
-                __futex_atomic_op("eor  %0, %1, %3", ret, oldval, uaddr, oparg);
+                __futex_atomic_op("eor  %0, %1, %4", ret, oldval, tmp, uaddr, oparg);
                break;
        default:
                ret = -ENOSYS;
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 2c04ed5efeb5..c60a2944f95b 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -478,8 +478,8 @@
 /*
 * Unimplemented (or alternatively implemented) syscalls
 */
-#define __IGNORE_fadvise64_64           1
+#define __IGNORE_fadvise64_64
-#define __IGNORE_migrate_pages          1
+#define __IGNORE_migrate_pages
 #endif /* __KERNEL__ */
 #endif /* __ASM_ARM_UNISTD_H */
diff --git a/arch/arm/kernel/smp_scu.c b/arch/arm/kernel/smp_scu.c
index 79ed5e7f204a..7fcddb75c877 100644
--- a/arch/arm/kernel/smp_scu.c
+++ b/arch/arm/kernel/smp_scu.c
@@ -13,6 +13,7 @@
 #include <asm/smp_scu.h>
 #include <asm/cacheflush.h>
+#include <asm/cputype.h>
 #define SCU_CTRL                0x00
 #define SCU_CONFIG              0x04
@@ -37,6 +38,15 @@ void __init scu_enable(void __iomem *scu_base)
 {
        u32 scu_ctrl;
+#ifdef CONFIG_ARM_ERRATA_764369
+        /* Cortex-A9 only */
+        if ((read_cpuid(CPUID_ID) & 0xff0ffff0) == 0x410fc090) {
+                scu_ctrl = __raw_readl(scu_base + 0x30);
+                if (!(scu_ctrl & 1))
+                        __raw_writel(scu_ctrl | 0x1, scu_base + 0x30);
+        }
+#endif
        scu_ctrl = __raw_readl(scu_base + SCU_CTRL);
        /* already enabled? */
        if (scu_ctrl & 1)
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index bf977f8514f6..4e66f62b8d41 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -23,8 +23,10 @@
 #if defined(CONFIG_SMP_ON_UP) && !defined(CONFIG_DEBUG_SPINLOCK)
 #define ARM_EXIT_KEEP(x)        x
+#define ARM_EXIT_DISCARD(x)
 #else
 #define ARM_EXIT_KEEP(x)
+#define ARM_EXIT_DISCARD(x)     x
 #endif
 OUTPUT_ARCH(arm)
@@ -39,6 +41,11 @@ jiffies = jiffies_64 + 4;
 SECTIONS
 {
        /*
+         * XXX: The linker does not define how output sections are
+         * assigned to input sections when there are multiple statements
+         * matching the same input section name.  There is no documented
+         * order of matching.
+         *
         * unwind exit sections must be discarded before the rest of the
         * unwind sections get included.
         */
@@ -47,6 +54,9 @@ SECTIONS
                *(.ARM.extab.exit.text)
                ARM_CPU_DISCARD(*(.ARM.exidx.cpuexit.text))
                ARM_CPU_DISCARD(*(.ARM.extab.cpuexit.text))
+                ARM_EXIT_DISCARD(EXIT_TEXT)
+                ARM_EXIT_DISCARD(EXIT_DATA)
+                EXIT_CALL
 #ifndef CONFIG_HOTPLUG
                *(.ARM.exidx.devexit.text)
                *(.ARM.extab.devexit.text)
@@ -58,6 +68,8 @@ SECTIONS
 #ifndef CONFIG_SMP_ON_UP
                *(.alt.smp.init)
 #endif
+                *(.discard)
+                *(.discard.*)
        }
 #ifdef CONFIG_XIP_KERNEL
@@ -279,9 +291,6 @@ SECTIONS
        STABS_DEBUG
        .comment 0 : { *(.comment) }
-        /* Default discards */
-        DISCARDS
 }
 /*
diff --git a/arch/arm/mach-dove/common.c b/arch/arm/mach-dove/common.c
index 83dce859886d..a9e0dae86a26 100644
--- a/arch/arm/mach-dove/common.c
+++ b/arch/arm/mach-dove/common.c
@@ -158,7 +158,7 @@ void __init dove_spi0_init(void)
 void __init dove_spi1_init(void)
 {
-        orion_spi_init(DOVE_SPI1_PHYS_BASE, get_tclk());
+        orion_spi_1_init(DOVE_SPI1_PHYS_BASE, get_tclk());
 }
 /*****************************************************************************
diff --git a/arch/arm/mach-exynos4/clock.c b/arch/arm/mach-exynos4/clock.c
index 1561b036a9bf..86964d2e9e1b 100644
--- a/arch/arm/mach-exynos4/clock.c
+++ b/arch/arm/mach-exynos4/clock.c
@@ -899,8 +899,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 28, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "exynos4-fimc.0",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 16),
                },
@@ -909,8 +908,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLKDIV_CAM, .shift = 16, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "exynos4-fimc.1",
                        .enable         = exynos4_clksrc_mask_cam_ctrl,
                        .ctrlbit        = (1 << 20),
                },
@@ -1160,7 +1158,7 @@ void __init_or_cpufreq exynos4_setup_clocks(void)
        vpllsrc = clk_get_rate(&clk_vpllsrc.clk);
        vpll = s5p_get_pll46xx(vpllsrc, __raw_readl(S5P_VPLL_CON0),
-                                __raw_readl(S5P_VPLL_CON1), pll_4650);
+                                __raw_readl(S5P_VPLL_CON1), pll_4650c);
        clk_fout_apll.ops = &exynos4_fout_apll_ops;
        clk_fout_mpll.rate = mpll;
diff --git a/arch/arm/mach-exynos4/mct.c b/arch/arm/mach-exynos4/mct.c
index 1ae059b7ad7b..ddd86864fb83 100644
--- a/arch/arm/mach-exynos4/mct.c
+++ b/arch/arm/mach-exynos4/mct.c
@@ -132,12 +132,18 @@ static cycle_t exynos4_frc_read(struct clocksource *cs)
        return ((cycle_t)hi << 32) | lo;
 }
+static void exynos4_frc_resume(struct clocksource *cs)
+{
+        exynos4_mct_frc_start(0, 0);
+}
 struct clocksource mct_frc = {
        .name           = "mct-frc",
        .rating         = 400,
        .read           = exynos4_frc_read,
        .mask           = CLOCKSOURCE_MASK(64),
        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+        .resume         = exynos4_frc_resume,
 };
 static void __init exynos4_clocksource_init(void)
@@ -389,9 +395,11 @@ static void exynos4_mct_tick_init(struct clock_event_device *evt)
 }
 /* Setup the local clock events for a CPU */
-void __cpuinit local_timer_setup(struct clock_event_device *evt)
+int __cpuinit local_timer_setup(struct clock_event_device *evt)
 {
        exynos4_mct_tick_init(evt);
+        return 0;
 }
 int local_timer_ack(void)
diff --git a/arch/arm/mach-exynos4/platsmp.c b/arch/arm/mach-exynos4/platsmp.c
index 7c2282c6ba81..df6ef1b2f98b 100644
--- a/arch/arm/mach-exynos4/platsmp.c
+++ b/arch/arm/mach-exynos4/platsmp.c
@@ -106,6 +106,8 @@ void __cpuinit platform_secondary_init(unsigned int cpu)
         */
        spin_lock(&boot_lock);
        spin_unlock(&boot_lock);
+        set_cpu_online(cpu, true);
 }
 int __cpuinit boot_secondary(unsigned int cpu, struct task_struct *idle)
diff --git a/arch/arm/mach-exynos4/setup-keypad.c b/arch/arm/mach-exynos4/setup-keypad.c
index 1ee0ebff111f..7862bfb5933d 100644
--- a/arch/arm/mach-exynos4/setup-keypad.c
+++ b/arch/arm/mach-exynos4/setup-keypad.c
@@ -19,15 +19,16 @@ void samsung_keypad_cfg_gpio(unsigned int rows, unsigned int cols)
        if (rows > 8) {
                /* Set all the necessary GPX2 pins: KP_ROW[0~7] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX2(0), 8, S3C_GPIO_SFN(3));
+                s3c_gpio_cfgall_range(EXYNOS4_GPX2(0), 8, S3C_GPIO_SFN(3),
+                                        S3C_GPIO_PULL_UP);
                /* Set all the necessary GPX3 pins: KP_ROW[8~] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX3(0), (rows - 8),
+                s3c_gpio_cfgall_range(EXYNOS4_GPX3(0), (rows - 8),
-                                         S3C_GPIO_SFN(3));
+                                         S3C_GPIO_SFN(3), S3C_GPIO_PULL_UP);
        } else {
                /* Set all the necessary GPX2 pins: KP_ROW[x] */
-                s3c_gpio_cfgrange_nopull(EXYNOS4_GPX2(0), rows,
+                s3c_gpio_cfgall_range(EXYNOS4_GPX2(0), rows, S3C_GPIO_SFN(3),
-                                         S3C_GPIO_SFN(3));
+                                        S3C_GPIO_PULL_UP);
        }
        /* Set all the necessary GPX1 pins to special-function 3: KP_COL[x] */
diff --git a/arch/arm/mach-integrator/integrator_ap.c b/arch/arm/mach-integrator/integrator_ap.c
index fcf0ae95651f..8cdc730dcb3a 100644
--- a/arch/arm/mach-integrator/integrator_ap.c
+++ b/arch/arm/mach-integrator/integrator_ap.c
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/mtd/physmap.h>
+#include <video/vga.h>
 #include <mach/hardware.h>
 #include <mach/platform.h>
@@ -154,6 +155,7 @@ static struct map_desc ap_io_desc[] __initdata = {
 static void __init ap_map_io(void)
 {
        iotable_init(ap_io_desc, ARRAY_SIZE(ap_io_desc));
+        vga_base = PCI_MEMORY_VADDR;
 }
 #define INTEGRATOR_SC_VALID_INT 0x003fffff
diff --git a/arch/arm/mach-integrator/pci_v3.c b/arch/arm/mach-integrator/pci_v3.c
index dd56bfb351e3..11b86e5b71c2 100644
--- a/arch/arm/mach-integrator/pci_v3.c
+++ b/arch/arm/mach-integrator/pci_v3.c
@@ -27,7 +27,6 @@
 #include <linux/spinlock.h>
 #include <linux/init.h>
 #include <linux/io.h>
-#include <video/vga.h>
 #include <mach/hardware.h>
 #include <mach/platform.h>
@@ -505,7 +504,6 @@ void __init pci_v3_preinit(void)
        pcibios_min_io = 0x6000;
        pcibios_min_mem = 0x00100000;
-        vga_base = PCI_MEMORY_VADDR;
        /*
         * Hook in our fault handler for PCI errors
diff --git a/arch/arm/mach-s3c2443/clock.c b/arch/arm/mach-s3c2443/clock.c
index a1a7176675b9..38058af48972 100644
--- a/arch/arm/mach-s3c2443/clock.c
+++ b/arch/arm/mach-s3c2443/clock.c
@@ -128,7 +128,7 @@ static int s3c2443_armclk_setrate(struct clk *clk, unsigned long rate)
                unsigned long clkcon0;
                clkcon0 = __raw_readl(S3C2443_CLKDIV0);
-                clkcon0 &= S3C2443_CLKDIV0_ARMDIV_MASK;
+                clkcon0 &= ~S3C2443_CLKDIV0_ARMDIV_MASK;
                clkcon0 |= val << S3C2443_CLKDIV0_ARMDIV_SHIFT;
                __raw_writel(clkcon0, S3C2443_CLKDIV0);
        }
diff --git a/arch/arm/mach-s3c64xx/mach-smdk6410.c b/arch/arm/mach-s3c64xx/mach-smdk6410.c
index ecbea92bf83b..a9f3183e0290 100644
--- a/arch/arm/mach-s3c64xx/mach-smdk6410.c
+++ b/arch/arm/mach-s3c64xx/mach-smdk6410.c
@@ -262,45 +262,6 @@ static struct samsung_keypad_platdata smdk6410_keypad_data __initdata = {
        .cols           = 8,
 };
-static int smdk6410_backlight_init(struct device *dev)
-{
-        int ret;
-        ret = gpio_request(S3C64XX_GPF(15), "Backlight");
-        if (ret) {
-                printk(KERN_ERR "failed to request GPF for PWM-OUT1\n");
-                return ret;
-        }
-        /* Configure GPIO pin with S3C64XX_GPF15_PWM_TOUT1 */
-        s3c_gpio_cfgpin(S3C64XX_GPF(15), S3C_GPIO_SFN(2));
-        return 0;
-}
-static void smdk6410_backlight_exit(struct device *dev)
-{
-        s3c_gpio_cfgpin(S3C64XX_GPF(15), S3C_GPIO_OUTPUT);
-        gpio_free(S3C64XX_GPF(15));
-}
-static struct platform_pwm_backlight_data smdk6410_backlight_data = {
-        .pwm_id         = 1,
-        .max_brightness = 255,
-        .dft_brightness = 255,
-        .pwm_period_ns  = 78770,
-        .init           = smdk6410_backlight_init,
-        .exit           = smdk6410_backlight_exit,
-};
-static struct platform_device smdk6410_backlight_device = {
-        .name           = "pwm-backlight",
-        .dev            = {
-                .parent         = &s3c_device_timer[1].dev,
-                .platform_data  = &smdk6410_backlight_data,
-        },
-};
 static struct map_desc smdk6410_iodesc[] = {};
 static struct platform_device *smdk6410_devices[] __initdata = {
diff --git a/arch/arm/mach-s5pv210/clock.c b/arch/arm/mach-s5pv210/clock.c
index 52a8e607bcc2..f5f8fa89679c 100644
--- a/arch/arm/mach-s5pv210/clock.c
+++ b/arch/arm/mach-s5pv210/clock.c
@@ -815,8 +815,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV3, .shift = 20, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam0",
-                        .devname        = "s5pv210-fimc.0",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 3),
                },
@@ -825,8 +824,7 @@ static struct clksrc_clk clksrcs[] = {
                .reg_div = { .reg = S5P_CLK_DIV1, .shift = 12, .size = 4 },
        }, {
                .clk            = {
-                        .name           = "sclk_cam",
+                        .name           = "sclk_cam1",
-                        .devname        = "s5pv210-fimc.1",
                        .enable         = s5pv210_clk_mask0_ctrl,
                        .ctrlbit        = (1 << 4),
                },
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index 3b24bfa3b828..07c4bc8ea0a4 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -174,6 +174,10 @@ ENTRY(v7_coherent_user_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r12, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
 USER(  mcr     p15, 0, r12, c7, c11, 1 )       @ clean D line to the point of unification
        add     r12, r12, r2
@@ -223,6 +227,10 @@ ENTRY(v7_flush_kern_dcache_area)
        add     r1, r0, r1
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D line / unified line
        add     r0, r0, r2
@@ -247,6 +255,10 @@ v7_dma_inv_range:
        sub     r3, r2, #1
        tst     r0, r3
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
        mcrne   p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        tst     r1, r3
@@ -270,6 +282,10 @@ v7_dma_clean_range:
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c10, 1          @ clean D / U line
        add     r0, r0, r2
@@ -288,6 +304,10 @@ ENTRY(v7_dma_flush_range)
        dcache_line_size r2, r3
        sub     r3, r2, #1
        bic     r0, r0, r3
+#ifdef CONFIG_ARM_ERRATA_764369
+        ALT_SMP(W(dsb))
+        ALT_UP(W(nop))
+#endif
 1:
        mcr     p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
        add     r0, r0, r2
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 0a0a1e7c20d2..c3ff82f92d9c 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -324,6 +324,8 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
        if (addr)
                *handle = pfn_to_dma(dev, page_to_pfn(page));
+        else
+                __dma_free_buffer(page, size);
        return addr;
 }
diff --git a/arch/arm/plat-s5p/irq-gpioint.c b/arch/arm/plat-s5p/irq-gpioint.c
index f71078ef6bb5..f88216d23991 100644
--- a/arch/arm/plat-s5p/irq-gpioint.c
+++ b/arch/arm/plat-s5p/irq-gpioint.c
@@ -114,17 +114,18 @@ static __init int s5p_gpioint_add(struct s3c_gpio_chip *chip)
 {
        static int used_gpioint_groups = 0;
        int group = chip->group;
-        struct s5p_gpioint_bank *bank = NULL;
+        struct s5p_gpioint_bank *b, *bank = NULL;
        struct irq_chip_generic *gc;
        struct irq_chip_type *ct;
        if (used_gpioint_groups >= S5P_GPIOINT_GROUP_COUNT)
                return -ENOMEM;
-        list_for_each_entry(bank, &banks, list) {
+        list_for_each_entry(b, &banks, list) {
-                if (group >= bank->start &&
+                if (group >= b->start && group < b->start + b->nr_groups) {
-                    group < bank->start + bank->nr_groups)
+                        bank = b;
                        break;
+                }
        }
        if (!bank)
                return -EINVAL;
diff --git a/arch/arm/plat-samsung/clock.c b/arch/arm/plat-samsung/clock.c
index 302c42670bd1..3b4451979d1b 100644
--- a/arch/arm/plat-samsung/clock.c
+++ b/arch/arm/plat-samsung/clock.c
@@ -64,6 +64,17 @@ static LIST_HEAD(clocks);
 */
 DEFINE_SPINLOCK(clocks_lock);
+/* Global watchdog clock used by arch_wtd_reset() callback */
+struct clk *s3c2410_wdtclk;
+static int __init s3c_wdt_reset_init(void)
+{
+        s3c2410_wdtclk = clk_get(NULL, "watchdog");
+        if (IS_ERR(s3c2410_wdtclk))
+                printk(KERN_WARNING "%s: warning: cannot get watchdog clock\n", __func__);
+        return 0;
+}
+arch_initcall(s3c_wdt_reset_init);
 /* enable and disable calls for use with the clk struct */
 static int clk_null_enable(struct clk *clk, int enable)
diff --git a/arch/arm/plat-samsung/include/plat/clock.h b/arch/arm/plat-samsung/include/plat/clock.h
index 87d5b38a86fb..73c66d4d10fa 100644
--- a/arch/arm/plat-samsung/include/plat/clock.h
+++ b/arch/arm/plat-samsung/include/plat/clock.h
@@ -9,6 +9,9 @@
 * published by the Free Software Foundation.
 */
+#ifndef __ASM_PLAT_CLOCK_H
+#define __ASM_PLAT_CLOCK_H __FILE__
 #include <linux/spinlock.h>
 #include <linux/clkdev.h>
@@ -121,3 +124,8 @@ extern int s3c64xx_sclk_ctrl(struct clk *clk, int enable);
 extern void s3c_pwmclk_init(void);
+/* Global watchdog clock used by arch_wtd_reset() callback */
+extern struct clk *s3c2410_wdtclk;
+#endif /* __ASM_PLAT_CLOCK_H */
diff --git a/arch/arm/plat-samsung/include/plat/watchdog-reset.h b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
index 54b762acb5a0..40dbb2b0ae22 100644
--- a/arch/arm/plat-samsung/include/plat/watchdog-reset.h
+++ b/arch/arm/plat-samsung/include/plat/watchdog-reset.h
@@ -10,6 +10,7 @@
 * published by the Free Software Foundation.
 */
+#include <plat/clock.h>
 #include <plat/regs-watchdog.h>
 #include <mach/map.h>
@@ -19,17 +20,12 @@
 static inline void arch_wdt_reset(void)
 {
-        struct clk *wdtclk;
        printk("arch_reset: attempting watchdog reset\n");
        __raw_writel(0, S3C2410_WTCON);   /* disable watchdog, to be safe  */
-        wdtclk = clk_get(NULL, "watchdog");
+        if (s3c2410_wdtclk)
-        if (!IS_ERR(wdtclk)) {
+                clk_enable(s3c2410_wdtclk);
-                clk_enable(wdtclk);
-        } else
-                printk(KERN_WARNING "%s: warning: cannot get watchdog clock\n", __func__);
        /* put initial values into count and data */
        __raw_writel(0x80, S3C2410_WTCNT);
diff --git a/arch/powerpc/platforms/powermac/pci.c b/arch/powerpc/platforms/powermac/pci.c
index 5cc83851ad06..31a7d3a7ce25 100644
--- a/arch/powerpc/platforms/powermac/pci.c
+++ b/arch/powerpc/platforms/powermac/pci.c
@@ -561,6 +561,20 @@ static struct pci_ops u4_pcie_pci_ops =
        .write = u4_pcie_write_config,
 };
+static void __devinit pmac_pci_fixup_u4_of_node(struct pci_dev *dev)
+{
+        /* Apple's device-tree "hides" the root complex virtual P2P bridge
+         * on U4. However, Linux sees it, causing the PCI <-> OF matching
+         * code to fail to properly match devices below it. This works around
+         * it by setting the node of the bridge to point to the PHB node,
+         * which is not entirely correct but fixes the matching code and
+         * doesn't break anything else. It's also the simplest possible fix.
+         */
+        if (dev->dev.of_node == NULL)
+                dev->dev.of_node = pcibios_get_phb_of_node(dev->bus);
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_APPLE, 0x5b, pmac_pci_fixup_u4_of_node);
 #endif /* CONFIG_PPC64 */
 #ifdef CONFIG_PPC32
diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
index 64b61bf72e93..547f1a6a35d4 100644
--- a/arch/s390/include/asm/elf.h
+++ b/arch/s390/include/asm/elf.h
@@ -188,7 +188,8 @@ extern char elf_platform[];
 #define SET_PERSONALITY(ex)                                     \
 do {                                                            \
        if (personality(current->personality) != PER_LINUX32)   \
-                set_personality(PER_LINUX);                     \
+                set_personality(PER_LINUX |                     \
+                        (current->personality & ~PER_MASK));    \
        if ((ex).e_ident[EI_CLASS] == ELFCLASS32)               \
                set_thread_flag(TIF_31BIT);                     \
        else                                                    \
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index 519eb5f187ef..c0cb794bb365 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -658,12 +658,14 @@ static inline void pgste_set_pte(pte_t *ptep, pgste_t pgste)
 * struct gmap_struct - guest address space
 * @mm: pointer to the parent mm_struct
 * @table: pointer to the page directory
+ * @asce: address space control element for gmap page table
 * @crst_list: list of all crst tables used in the guest address space
 */
 struct gmap {
        struct list_head list;
        struct mm_struct *mm;
        unsigned long *table;
+        unsigned long asce;
        struct list_head crst_list;
 };
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 532fd4322156..2b45591e1582 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -10,6 +10,7 @@
 #include <linux/sched.h>
 #include <asm/vdso.h>
 #include <asm/sigp.h>
+#include <asm/pgtable.h>
 /*
 * Make sure that the compiler is new enough. We want a compiler that
@@ -126,6 +127,7 @@ int main(void)
        DEFINE(__LC_KERNEL_STACK, offsetof(struct _lowcore, kernel_stack));
        DEFINE(__LC_ASYNC_STACK, offsetof(struct _lowcore, async_stack));
        DEFINE(__LC_PANIC_STACK, offsetof(struct _lowcore, panic_stack));
+        DEFINE(__LC_USER_ASCE, offsetof(struct _lowcore, user_asce));
        DEFINE(__LC_INT_CLOCK, offsetof(struct _lowcore, int_clock));
        DEFINE(__LC_MCCK_CLOCK, offsetof(struct _lowcore, mcck_clock));
        DEFINE(__LC_MACHINE_FLAGS, offsetof(struct _lowcore, machine_flags));
@@ -151,6 +153,7 @@ int main(void)
        DEFINE(__LC_VDSO_PER_CPU, offsetof(struct _lowcore, vdso_per_cpu_data));
        DEFINE(__LC_GMAP, offsetof(struct _lowcore, gmap));
        DEFINE(__LC_CMF_HPP, offsetof(struct _lowcore, cmf_hpp));
+        DEFINE(__GMAP_ASCE, offsetof(struct gmap, asce));
 #endif /* CONFIG_32BIT */
        return 0;
 }
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index 5f729d627cef..713da0760538 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -1076,6 +1076,11 @@ sie_loop:
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
        tm      __TI_flags+7(%r14),_TIF_EXIT_SIE
        jnz     sie_exit
+        lg      %r14,__LC_GMAP                  # get gmap pointer
+        ltgr    %r14,%r14
+        jz      sie_gmap
+        lctlg   %c1,%c1,__GMAP_ASCE(%r14)       # load primary asce
+sie_gmap:
        lg      %r14,__SF_EMPTY(%r15)           # get control block pointer
        SPP     __SF_EMPTY(%r15)                # set guest id
        sie     0(%r14)
@@ -1083,6 +1088,7 @@ sie_done:
        SPP     __LC_CMF_HPP                    # set host id
        lg      %r14,__LC_THREAD_INFO           # pointer thread_info struct
 sie_exit:
+        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
        ni      __TI_flags+6(%r14),255-(_TIF_SIE>>8)
        lg      %r14,__SF_EMPTY+8(%r15)         # load guest register save area
        stmg    %r0,%r13,0(%r14)                # save guest gprs 0-13
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index f17296e4fc89..dc2b580e27bc 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -123,6 +123,7 @@ int kvm_dev_ioctl_check_extension(long ext)
        switch (ext) {
        case KVM_CAP_S390_PSW:
+        case KVM_CAP_S390_GMAP:
                r = 1;
                break;
        default:
@@ -263,10 +264,12 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
        vcpu->arch.guest_fpregs.fpc &= FPC_VALID_MASK;
        restore_fp_regs(&vcpu->arch.guest_fpregs);
        restore_access_regs(vcpu->arch.guest_acrs);
+        gmap_enable(vcpu->arch.gmap);
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
 {
+        gmap_disable(vcpu->arch.gmap);
        save_fp_regs(&vcpu->arch.guest_fpregs);
        save_access_regs(vcpu->arch.guest_acrs);
        restore_fp_regs(&vcpu->arch.host_fpregs);
@@ -461,7 +464,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        local_irq_disable();
        kvm_guest_enter();
        local_irq_enable();
-        gmap_enable(vcpu->arch.gmap);
        VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                   atomic_read(&vcpu->arch.sie_block->cpuflags));
        if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
@@ -470,7 +472,6 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
        }
        VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
                   vcpu->arch.sie_block->icptcode);
-        gmap_disable(vcpu->arch.gmap);
        local_irq_disable();
        kvm_guest_exit();
        local_irq_enable();
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index 4d1f2bce87b3..5d56c2b95b14 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -160,6 +160,8 @@ struct gmap *gmap_alloc(struct mm_struct *mm)
        table = (unsigned long *) page_to_phys(page);
        crst_table_init(table, _REGION1_ENTRY_EMPTY);
        gmap->table = table;
+        gmap->asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
+                     _ASCE_USER_BITS | __pa(table);
        list_add(&gmap->list, &mm->context.gmap_list);
        return gmap;
@@ -240,10 +242,6 @@ EXPORT_SYMBOL_GPL(gmap_free);
 */
 void gmap_enable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce = _ASCE_TYPE_REGION1 | _ASCE_TABLE_LENGTH |
-                                 _ASCE_USER_BITS | __pa(gmap->table);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = (unsigned long) gmap;
 }
 EXPORT_SYMBOL_GPL(gmap_enable);
@@ -254,10 +252,6 @@ EXPORT_SYMBOL_GPL(gmap_enable);
 */
 void gmap_disable(struct gmap *gmap)
 {
-        /* Load primary space page table origin. */
-        S390_lowcore.user_asce =
-                gmap->mm->context.asce_bits | __pa(gmap->mm->pgd);
-        asm volatile("lctlg 1,1,%0\n" : : "m" (S390_lowcore.user_asce) );
        S390_lowcore.gmap = 0UL;
 }
 EXPORT_SYMBOL_GPL(gmap_disable);
@@ -309,15 +303,15 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                /* Walk the guest addr space page table */
                table = gmap->table + (((to + off) >> 53) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 42) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 31) & 0x7ff);
                if (*table & _REGION_ENTRY_INV)
-                        return 0;
+                        goto out;
                table = (unsigned long *)(*table & _REGION_ENTRY_ORIGIN);
                table = table + (((to + off) >> 20) & 0x7ff);
@@ -325,6 +319,7 @@ int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
                flush |= gmap_unlink_segment(gmap, table);
                *table = _SEGMENT_ENTRY_INV;
        }
+out:
        up_read(&gmap->mm->mmap_sem);
        if (flush)
                gmap_flush_tlb(gmap);
diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
index 55a17c6efeb8..d06a26601753 100644
--- a/arch/sparc/include/asm/spitfire.h
+++ b/arch/sparc/include/asm/spitfire.h
@@ -43,6 +43,8 @@
 #define SUN4V_CHIP_NIAGARA1     0x01
 #define SUN4V_CHIP_NIAGARA2     0x02
 #define SUN4V_CHIP_NIAGARA3     0x03
+#define SUN4V_CHIP_NIAGARA4     0x04
+#define SUN4V_CHIP_NIAGARA5     0x05
 #define SUN4V_CHIP_UNKNOWN      0xff
 #ifndef __ASSEMBLY__
diff --git a/arch/sparc/include/asm/xor_64.h b/arch/sparc/include/asm/xor_64.h
index 9ed6ff679ab7..ee8edc68423e 100644
--- a/arch/sparc/include/asm/xor_64.h
+++ b/arch/sparc/include/asm/xor_64.h
@@ -66,6 +66,8 @@ static struct xor_block_template xor_block_niagara = {
        ((tlb_type == hypervisor && \
          (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 || \
           sun4v_chip_type == SUN4V_CHIP_NIAGARA2 || \
-           sun4v_chip_type == SUN4V_CHIP_NIAGARA3)) ? \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA3 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA4 || \
+           sun4v_chip_type == SUN4V_CHIP_NIAGARA5)) ? \
         &xor_block_niagara : \
         &xor_block_VIS)
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 9810fd881058..ba9b1cec4e6b 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -481,6 +481,18 @@ static void __init sun4v_cpu_probe(void)
                sparc_pmu_type = "niagara3";
                break;
+        case SUN4V_CHIP_NIAGARA4:
+                sparc_cpu_type = "UltraSparc T4 (Niagara4)";
+                sparc_fpu_type = "UltraSparc T4 integrated FPU";
+                sparc_pmu_type = "niagara4";
+                break;
+        case SUN4V_CHIP_NIAGARA5:
+                sparc_cpu_type = "UltraSparc T5 (Niagara5)";
+                sparc_fpu_type = "UltraSparc T5 integrated FPU";
+                sparc_pmu_type = "niagara5";
+                break;
        default:
                printk(KERN_WARNING "CPU: Unknown sun4v cpu type [%s]\n",
                       prom_cpu_compatible);
diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
index 4197e8d62d4c..9323eafccb93 100644
--- a/arch/sparc/kernel/cpumap.c
+++ b/arch/sparc/kernel/cpumap.c
@@ -325,6 +325,8 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
        case SUN4V_CHIP_NIAGARA1:
        case SUN4V_CHIP_NIAGARA2:
        case SUN4V_CHIP_NIAGARA3:
+        case SUN4V_CHIP_NIAGARA4:
+        case SUN4V_CHIP_NIAGARA5:
                rover_inc_table = niagara_iterate_method;
                break;
        default:
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 0eac1b2fc53d..0d810c2f1d00 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -133,7 +133,7 @@ prom_sun4v_name:
 prom_niagara_prefix:
        .asciz  "SUNW,UltraSPARC-T"
 prom_sparc_prefix:
-        .asciz  "SPARC-T"
+        .asciz  "SPARC-"
        .align  4
 prom_root_compatible:
        .skip   64
@@ -396,7 +396,7 @@ sun4v_chip_type:
        or      %g1, %lo(prom_cpu_compatible), %g1
        sethi   %hi(prom_sparc_prefix), %g7
        or      %g7, %lo(prom_sparc_prefix), %g7
-        mov     7, %g3
+        mov     6, %g3
 90:     ldub    [%g7], %g2
        ldub    [%g1], %g4
        cmp     %g2, %g4
@@ -408,10 +408,23 @@ sun4v_chip_type:
        sethi   %hi(prom_cpu_compatible), %g1
        or      %g1, %lo(prom_cpu_compatible), %g1
-        ldub    [%g1 + 7], %g2
+        ldub    [%g1 + 6], %g2
+        cmp     %g2, 'T'
+        be,pt   %xcc, 70f
+         cmp    %g2, 'M'
+        bne,pn  %xcc, 4f
+         nop
+70:     ldub    [%g1 + 7], %g2
        cmp     %g2, '3'
        be,pt   %xcc, 5f
         mov    SUN4V_CHIP_NIAGARA3, %g4
+        cmp     %g2, '4'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA4, %g4
+        cmp     %g2, '5'
+        be,pt   %xcc, 5f
+         mov    SUN4V_CHIP_NIAGARA5, %g4
        ba,pt   %xcc, 4f
         nop
@@ -545,6 +558,12 @@ niagara_tlb_fixup:
        cmp     %g1, SUN4V_CHIP_NIAGARA3
        be,pt   %xcc, niagara2_patch
         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA4
+        be,pt   %xcc, niagara2_patch
+         nop
+        cmp     %g1, SUN4V_CHIP_NIAGARA5
+        be,pt   %xcc, niagara2_patch
+         nop
        call    generic_patch_copyops
         nop
diff --git a/arch/sparc/kernel/process_32.c b/arch/sparc/kernel/process_32.c
index c8cc461ff75f..f793742eec2b 100644
--- a/arch/sparc/kernel/process_32.c
+++ b/arch/sparc/kernel/process_32.c
@@ -380,8 +380,7 @@ void flush_thread(void)
 #endif
        }
-        /* Now, this task is no longer a kernel thread. */
+        /* This task is no longer a kernel thread. */
-        current->thread.current_ds = USER_DS;
        if (current->thread.flags & SPARC_FLAG_KTHREAD) {
                current->thread.flags &= ~SPARC_FLAG_KTHREAD;
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index c158a95ec664..d959cd0a4aa4 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -368,9 +368,6 @@ void flush_thread(void)
        /* Clear FPU register state. */
        t->fpsaved[0] = 0;
-        
-        if (get_thread_current_ds() != ASI_AIUS)
-                set_fs(USER_DS);
 }
 /* It's a bit more tricky when 64-bit tasks are involved... */
diff --git a/arch/sparc/kernel/setup_32.c b/arch/sparc/kernel/setup_32.c
index d26e1f6c717a..3e3e2914c70b 100644
--- a/arch/sparc/kernel/setup_32.c
+++ b/arch/sparc/kernel/setup_32.c
@@ -137,7 +137,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        default:
                printk("Unknown boot switch (-%c)\n", c);
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 3c5bb784214f..c965595aa7e9 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -106,7 +106,7 @@ static void __init process_switch(char c)
                prom_halt();
                break;
        case 'p':
-                /* Just ignore, this behavior is now the default.  */
+                prom_early_console.flags &= ~CON_BOOT;
                break;
        case 'P':
                /* Force UltraSPARC-III P-Cache on. */
@@ -425,10 +425,14 @@ static void __init init_sparc64_elf_hwcap(void)
        else if (tlb_type == hypervisor) {
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1 ||
                    sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_BLKINIT;
                if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                    sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                        cap |= HWCAP_SPARC_N2;
        }
@@ -452,11 +456,15 @@ static void __init init_sparc64_elf_hwcap(void)
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA1)
                                cap |= AV_SPARC_ASI_BLK_INIT;
                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
-                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
                                        AV_SPARC_ASI_BLK_INIT |
                                        AV_SPARC_POPC);
-                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3)
+                        if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
+                            sun4v_chip_type == SUN4V_CHIP_NIAGARA5)
                                cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
                                        AV_SPARC_FMAF);
                }
diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
index 581531dbc8b5..8e073d802139 100644
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -511,6 +511,11 @@ static void __init read_obp_translations(void)
                for (i = 0; i < prom_trans_ents; i++)
                        prom_trans[i].data &= ~0x0003fe0000000000UL;
        }
+        /* Force execute bit on.  */
+        for (i = 0; i < prom_trans_ents; i++)
+                prom_trans[i].data |= (tlb_type == hypervisor ?
+                                       _PAGE_EXEC_4V : _PAGE_EXEC_4U);
 }
 static void __init hypervisor_tlb_lock(unsigned long vaddr,
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 6f08bc940fa8..8b4cc5f067de 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3603,7 +3603,7 @@ done_prefixes:
                break;
        case Src2CL:
                ctxt->src2.bytes = 1;
-                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0x8;
+                ctxt->src2.val = ctxt->regs[VCPU_REGS_RCX] & 0xff;
                break;
        case Src2ImmByte:
                rc = decode_imm(ctxt, &ctxt->src2, 1, true);
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 1c5b69373a00..8e8da7960dbe 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -400,7 +400,8 @@ static u64 __update_clear_spte_slow(u64 *sptep, u64 spte)
        /* xchg acts as a barrier before the setting of the high bits */
        orig.spte_low = xchg(&ssptep->spte_low, sspte.spte_low);
-        orig.spte_high = ssptep->spte_high = sspte.spte_high;
+        orig.spte_high = ssptep->spte_high;
+        ssptep->spte_high = sspte.spte_high;
        count_spte_clear(sptep, spte);
        return orig.spte;
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index bcaf16ee6ad1..b596e54ddd71 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -785,10 +785,10 @@ static int blkio_policy_parse_and_set(char *buf,
 {
        char *s[4], *p, *major_s = NULL, *minor_s = NULL;
        int ret;
-        unsigned long major, minor, temp;
+        unsigned long major, minor;
        int i = 0;
        dev_t dev;
-        u64 bps, iops;
+        u64 temp;
        memset(s, 0, sizeof(s));
@@ -826,20 +826,23 @@ static int blkio_policy_parse_and_set(char *buf,
        dev = MKDEV(major, minor);
-        ret = blkio_check_dev_num(dev);
+        ret = strict_strtoull(s[1], 10, &temp);
        if (ret)
-                return ret;
+                return -EINVAL;
-        newpn->dev = dev;
+        /* For rule removal, do not check for device presence. */
+        if (temp) {
+                ret = blkio_check_dev_num(dev);
+                if (ret)
+                        return ret;
+        }
-        if (s[1] == NULL)
+        newpn->dev = dev;
-                return -EINVAL;
        switch (plid) {
        case BLKIO_POLICY_PROP:
-                ret = strict_strtoul(s[1], 10, &temp);
+                if ((temp < BLKIO_WEIGHT_MIN && temp > 0) ||
-                if (ret || (temp < BLKIO_WEIGHT_MIN && temp > 0) ||
+                     temp > BLKIO_WEIGHT_MAX)
-                        temp > BLKIO_WEIGHT_MAX)
                        return -EINVAL;
                newpn->plid = plid;
@@ -850,26 +853,18 @@ static int blkio_policy_parse_and_set(char *buf,
                switch(fileid) {
                case BLKIO_THROTL_read_bps_device:
                case BLKIO_THROTL_write_bps_device:
-                        ret = strict_strtoull(s[1], 10, &bps);
-                        if (ret)
-                                return -EINVAL;
                        newpn->plid = plid;
                        newpn->fileid = fileid;
-                        newpn->val.bps = bps;
+                        newpn->val.bps = temp;
                        break;
                case BLKIO_THROTL_read_iops_device:
                case BLKIO_THROTL_write_iops_device:
-                        ret = strict_strtoull(s[1], 10, &iops);
+                        if (temp > THROTL_IOPS_MAX)
-                        if (ret)
-                                return -EINVAL;
-                        if (iops > THROTL_IOPS_MAX)
                                return -EINVAL;
                        newpn->plid = plid;
                        newpn->fileid = fileid;
-                        newpn->val.iops = (unsigned int)iops;
+                        newpn->val.iops = (unsigned int)temp;
                        break;
                }
                break;
diff --git a/block/blk-core.c b/block/blk-core.c
index 90e1ffdeb415..d34433ae7917 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
 EXPORT_SYMBOL(blk_put_queue);
 /*
- * Note: If a driver supplied the queue lock, it should not zap that lock
+ * Note: If a driver supplied the queue lock, it is disconnected
- * unexpectedly as some queue cleanup components like elevator_exit() and
+ * by this function. The actual state of the lock doesn't matter
- * blk_throtl_exit() need queue lock.
+ * here as the request_queue isn't accessible after this point
+ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
 */
 void blk_cleanup_queue(struct request_queue *q)
 {
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
        queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
        mutex_unlock(&q->sysfs_lock);
-        if (q->elevator)
+        if (q->queue_lock != &q->__queue_lock)
-                elevator_exit(q->elevator);
+                q->queue_lock = &q->__queue_lock;
-        blk_throtl_exit(q);
        blk_put_queue(q);
 }
@@ -1167,7 +1166,7 @@ static bool bio_attempt_front_merge(struct request_queue *q,
 * true if merge was successful, otherwise false.
 */
 static bool attempt_plug_merge(struct task_struct *tsk, struct request_queue *q,
-                               struct bio *bio)
+                               struct bio *bio, unsigned int *request_count)
 {
        struct blk_plug *plug;
        struct request *rq;
@@ -1176,10 +1175,13 @@ static bool attempt_plug_merge(struct task_struct *tsk, struct request_queue *q,
        plug = tsk->plug;
        if (!plug)
                goto out;
+        *request_count = 0;
        list_for_each_entry_reverse(rq, &plug->list, queuelist) {
                int el_ret;
+                (*request_count)++;
                if (rq->q != q)
                        continue;
@@ -1219,6 +1221,7 @@ static int __make_request(struct request_queue *q, struct bio *bio)
        struct blk_plug *plug;
        int el_ret, rw_flags, where = ELEVATOR_INSERT_SORT;
        struct request *req;
+        unsigned int request_count = 0;
        /*
         * low level driver can indicate that it wants pages above a
@@ -1237,7 +1240,7 @@ static int __make_request(struct request_queue *q, struct bio *bio)
         * Check if we can merge with the plugged list before grabbing
         * any locks.
         */
-        if (attempt_plug_merge(current, q, bio))
+        if (attempt_plug_merge(current, q, bio, &request_count))
                goto out;
        spin_lock_irq(q->queue_lock);
@@ -1302,11 +1305,10 @@ get_rq:
                        if (__rq->q != q)
                                plug->should_sort = 1;
                }
+                if (request_count >= BLK_MAX_REQUEST_COUNT)
+                        blk_flush_plug_list(plug, false);
                list_add_tail(&req->queuelist, &plug->list);
-                plug->count++;
                drive_stat_acct(req, 1);
-                if (plug->count >= BLK_MAX_REQUEST_COUNT)
-                        blk_flush_plug_list(plug, false);
        } else {
                spin_lock_irq(q->queue_lock);
                add_acct_request(q, req, where);
@@ -2634,7 +2636,6 @@ void blk_start_plug(struct blk_plug *plug)
        INIT_LIST_HEAD(&plug->list);
        INIT_LIST_HEAD(&plug->cb_list);
        plug->should_sort = 0;
-        plug->count = 0;
        /*
         * If this is a nested plug, don't actually assign it. It will be
@@ -2718,7 +2719,6 @@ void blk_flush_plug_list(struct blk_plug *plug, bool from_schedule)
                return;
        list_splice_init(&plug->list, &list);
-        plug->count = 0;
        if (plug->should_sort) {
                list_sort(NULL, &list, plug_rq_cmp);
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 58340d0cb23a..1366a89d8e66 100644
--- a/block/blk-softirq.c
+++ b/block/blk-softirq.c
@@ -115,7 +115,7 @@ void __blk_complete_request(struct request *req)
        /*
         * Select completion CPU
         */
-        if (test_bit(QUEUE_FLAG_SAME_COMP, &q->queue_flags) && req->cpu != -1) {
+        if (req->cpu != -1) {
                ccpu = req->cpu;
                if (!test_bit(QUEUE_FLAG_SAME_FORCE, &q->queue_flags)) {
                        ccpu = blk_cpu_to_group(ccpu);
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index 0ee17b5e7fb6..60fda88c57f0 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -258,11 +258,13 @@ queue_rq_affinity_store(struct request_queue *q, const char *page, size_t count)
        ret = queue_var_store(&val, page, count);
        spin_lock_irq(q->queue_lock);
-        if (val) {
+        if (val == 2) {
                queue_flag_set(QUEUE_FLAG_SAME_COMP, q);
-                if (val == 2)
+                queue_flag_set(QUEUE_FLAG_SAME_FORCE, q);
-                        queue_flag_set(QUEUE_FLAG_SAME_FORCE, q);
+        } else if (val == 1) {
-        } else {
+                queue_flag_set(QUEUE_FLAG_SAME_COMP, q);
+                queue_flag_clear(QUEUE_FLAG_SAME_FORCE, q);
+        } else if (val == 0) {
                queue_flag_clear(QUEUE_FLAG_SAME_COMP, q);
                queue_flag_clear(QUEUE_FLAG_SAME_FORCE, q);
        }
@@ -477,6 +479,11 @@ static void blk_release_queue(struct kobject *kobj)
        blk_sync_queue(q);
+        if (q->elevator)
+                elevator_exit(q->elevator);
+        blk_throtl_exit(q);
        if (rl->rq_pool)
                mempool_destroy(rl->rq_pool);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index a33bd4377c61..16ace89613bc 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -130,8 +130,8 @@ struct cfq_queue {
        unsigned long slice_end;
        long slice_resid;
-        /* pending metadata requests */
+        /* pending priority requests */
-        int meta_pending;
+        int prio_pending;
        /* number of requests that are on the dispatch list or inside driver */
        int dispatched;
@@ -684,8 +684,8 @@ cfq_choose_req(struct cfq_data *cfqd, struct request *rq1, struct request *rq2,
        if (rq_is_sync(rq1) != rq_is_sync(rq2))
                return rq_is_sync(rq1) ? rq1 : rq2;
-        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_META)
+        if ((rq1->cmd_flags ^ rq2->cmd_flags) & REQ_PRIO)
-                return rq1->cmd_flags & REQ_META ? rq1 : rq2;
+                return rq1->cmd_flags & REQ_PRIO ? rq1 : rq2;
        s1 = blk_rq_pos(rq1);
        s2 = blk_rq_pos(rq2);
@@ -1612,9 +1612,9 @@ static void cfq_remove_request(struct request *rq)
        cfqq->cfqd->rq_queued--;
        cfq_blkiocg_update_io_remove_stats(&(RQ_CFQG(rq))->blkg,
                                        rq_data_dir(rq), rq_is_sync(rq));
-        if (rq->cmd_flags & REQ_META) {
+        if (rq->cmd_flags & REQ_PRIO) {
-                WARN_ON(!cfqq->meta_pending);
+                WARN_ON(!cfqq->prio_pending);
-                cfqq->meta_pending--;
+                cfqq->prio_pending--;
        }
 }
@@ -3372,7 +3372,7 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
         * So both queues are sync. Let the new request get disk time if
         * it's a metadata request and the current queue is doing regular IO.
         */
-        if ((rq->cmd_flags & REQ_META) && !cfqq->meta_pending)
+        if ((rq->cmd_flags & REQ_PRIO) && !cfqq->prio_pending)
                return true;
        /*
@@ -3439,8 +3439,8 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
        struct cfq_io_context *cic = RQ_CIC(rq);
        cfqd->rq_queued++;
-        if (rq->cmd_flags & REQ_META)
+        if (rq->cmd_flags & REQ_PRIO)
-                cfqq->meta_pending++;
+                cfqq->prio_pending++;
        cfq_update_io_thinktime(cfqd, cfqq, cic);
        cfq_update_io_seektime(cfqd, cfqq, rq);
diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
index 2c18d584066d..b97294e2d95b 100644
--- a/drivers/base/power/clock_ops.c
+++ b/drivers/base/power/clock_ops.c
@@ -42,6 +42,22 @@ static struct pm_clk_data *__to_pcd(struct device *dev)
 }
 /**
+ * pm_clk_acquire - Acquire a device clock.
+ * @dev: Device whose clock is to be acquired.
+ * @ce: PM clock entry corresponding to the clock.
+ */
+static void pm_clk_acquire(struct device *dev, struct pm_clock_entry *ce)
+{
+        ce->clk = clk_get(dev, ce->con_id);
+        if (IS_ERR(ce->clk)) {
+                ce->status = PCE_STATUS_ERROR;
+        } else {
+                ce->status = PCE_STATUS_ACQUIRED;
+                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
+        }
+}
+/**
 * pm_clk_add - Start using a device clock for power management.
 * @dev: Device whose clock is going to be used for power management.
 * @con_id: Connection ID of the clock.
@@ -73,6 +89,8 @@ int pm_clk_add(struct device *dev, const char *con_id)
                }
        }
+        pm_clk_acquire(dev, ce);
        spin_lock_irq(&pcd->lock);
        list_add_tail(&ce->node, &pcd->clock_list);
        spin_unlock_irq(&pcd->lock);
@@ -82,17 +100,12 @@ int pm_clk_add(struct device *dev, const char *con_id)
 /**
 * __pm_clk_remove - Destroy PM clock entry.
 * @ce: PM clock entry to destroy.
- *
- * This routine must be called under the spinlock protecting the PM list of
- * clocks corresponding the the @ce's device.
 */
 static void __pm_clk_remove(struct pm_clock_entry *ce)
 {
        if (!ce)
                return;
-        list_del(&ce->node);
        if (ce->status < PCE_STATUS_ERROR) {
                if (ce->status == PCE_STATUS_ENABLED)
                        clk_disable(ce->clk);
@@ -126,18 +139,22 @@ void pm_clk_remove(struct device *dev, const char *con_id)
        spin_lock_irq(&pcd->lock);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (!con_id && !ce->con_id) {
+                if (!con_id && !ce->con_id)
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
+                else if (!con_id || !ce->con_id)
-                } else if (!con_id || !ce->con_id) {
                        continue;
-                } else if (!strcmp(con_id, ce->con_id)) {
+                else if (!strcmp(con_id, ce->con_id))
-                        __pm_clk_remove(ce);
+                        goto remove;
-                        break;
-                }
        }
        spin_unlock_irq(&pcd->lock);
+        return;
+ remove:
+        list_del(&ce->node);
+        spin_unlock_irq(&pcd->lock);
+        __pm_clk_remove(ce);
 }
 /**
@@ -175,20 +192,27 @@ void pm_clk_destroy(struct device *dev)
 {
        struct pm_clk_data *pcd = __to_pcd(dev);
        struct pm_clock_entry *ce, *c;
+        struct list_head list;
        if (!pcd)
                return;
        dev->power.subsys_data = NULL;
+        INIT_LIST_HEAD(&list);
        spin_lock_irq(&pcd->lock);
        list_for_each_entry_safe_reverse(ce, c, &pcd->clock_list, node)
-                __pm_clk_remove(ce);
+                list_move(&ce->node, &list);
        spin_unlock_irq(&pcd->lock);
        kfree(pcd);
+        list_for_each_entry_safe_reverse(ce, c, &list, node) {
+                list_del(&ce->node);
+                __pm_clk_remove(ce);
+        }
 }
 #endif /* CONFIG_PM */
@@ -196,23 +220,6 @@ void pm_clk_destroy(struct device *dev)
 #ifdef CONFIG_PM_RUNTIME
 /**
- * pm_clk_acquire - Acquire a device clock.
- * @dev: Device whose clock is to be acquired.
- * @con_id: Connection ID of the clock.
- */
-static void pm_clk_acquire(struct device *dev,
-                                    struct pm_clock_entry *ce)
-{
-        ce->clk = clk_get(dev, ce->con_id);
-        if (IS_ERR(ce->clk)) {
-                ce->status = PCE_STATUS_ERROR;
-        } else {
-                ce->status = PCE_STATUS_ACQUIRED;
-                dev_dbg(dev, "Clock %s managed by runtime PM.\n", ce->con_id);
-        }
-}
-/**
 * pm_clk_suspend - Disable clocks in a device's PM clock list.
 * @dev: Device to disable the clocks for.
 */
@@ -230,9 +237,6 @@ int pm_clk_suspend(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry_reverse(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_disable(ce->clk);
                        ce->status = PCE_STATUS_ACQUIRED;
@@ -262,9 +266,6 @@ int pm_clk_resume(struct device *dev)
        spin_lock_irqsave(&pcd->lock, flags);
        list_for_each_entry(ce, &pcd->clock_list, node) {
-                if (ce->status == PCE_STATUS_NONE)
-                        pm_clk_acquire(dev, ce);
                if (ce->status < PCE_STATUS_ERROR) {
                        clk_enable(ce->clk);
                        ce->status = PCE_STATUS_ENABLED;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 98de8f418676..9955a53733b2 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4250,7 +4250,7 @@ static int __init floppy_init(void)
        use_virtual_dma = can_use_virtual_dma & 1;
        fdc_state[0].address = FDC1;
        if (fdc_state[0].address == -1) {
-                del_timer(&fd_timeout);
+                del_timer_sync(&fd_timeout);
                err = -ENODEV;
                goto out_unreg_region;
        }
@@ -4261,7 +4261,7 @@ static int __init floppy_init(void)
        fdc = 0;                /* reset fdc in case of unexpected interrupt */
        err = floppy_grab_irq_and_dma();
        if (err) {
-                del_timer(&fd_timeout);
+                del_timer_sync(&fd_timeout);
                err = -EBUSY;
                goto out_unreg_region;
        }
@@ -4318,7 +4318,7 @@ static int __init floppy_init(void)
                user_reset_fdc(-1, FD_RESET_ALWAYS, false);
        }
        fdc = 0;
-        del_timer(&fd_timeout);
+        del_timer_sync(&fd_timeout);
        current_drive = 0;
        initialized = true;
        if (have_no_fdc) {
@@ -4368,7 +4368,7 @@ out_unreg_blkdev:
        unregister_blkdev(FLOPPY_MAJOR, "fd");
 out_put_disk:
        while (dr--) {
-                del_timer(&motor_off_timer[dr]);
+                del_timer_sync(&motor_off_timer[dr]);
                if (disks[dr]->queue)
                        blk_cleanup_queue(disks[dr]->queue);
                put_disk(disks[dr]);
diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
index 9e40b283a468..00c57c90e2d6 100644
--- a/drivers/block/xen-blkback/common.h
+++ b/drivers/block/xen-blkback/common.h
@@ -46,7 +46,7 @@
 #define DRV_PFX "xen-blkback:"
 #define DPRINTK(fmt, args...)                           \
-        pr_debug(DRV_PFX "(%s:%d) " fmt ".\n",  \
+        pr_debug(DRV_PFX "(%s:%d) " fmt ".\n",          \
                 __func__, __LINE__, ##args)
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 3f129b45451a..5fd2010f7d2b 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -590,7 +590,7 @@ static void frontend_changed(struct xenbus_device *dev,
                /*
                 * Enforce precondition before potential leak point.
-                 * blkif_disconnect() is idempotent.
+                 * xen_blkif_disconnect() is idempotent.
                 */
                xen_blkif_disconnect(be->blkif);
@@ -601,17 +601,17 @@ static void frontend_changed(struct xenbus_device *dev,
                break;
        case XenbusStateClosing:
-                xen_blkif_disconnect(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosing);
                break;
        case XenbusStateClosed:
+                xen_blkif_disconnect(be->blkif);
                xenbus_switch_state(dev, XenbusStateClosed);
                if (xenbus_dev_is_online(dev))
                        break;
                /* fall through if not online */
        case XenbusStateUnknown:
-                /* implies blkif_disconnect() via blkback_remove() */
+                /* implies xen_blkif_disconnect() via xen_blkbk_remove() */
                device_unregister(&dev->dev);
                break;
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3ef476070baf..9cbac6b445e1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -72,9 +72,15 @@ static struct usb_device_id btusb_table[] = {
        /* Apple MacBookAir3,1, MacBookAir3,2 */
        { USB_DEVICE(0x05ac, 0x821b) },
+        /* Apple MacBookAir4,1 */
+        { USB_DEVICE(0x05ac, 0x821f) },
        /* Apple MacBookPro8,2 */
        { USB_DEVICE(0x05ac, 0x821a) },
+        /* Apple MacMini5,1 */
+        { USB_DEVICE(0x05ac, 0x8281) },
        /* AVM BlueFRITZ! USB v2.0 */
        { USB_DEVICE(0x057c, 0x3800) },
diff --git a/drivers/bluetooth/btwilink.c b/drivers/bluetooth/btwilink.c
index 65d27aff553a..04d353f58d71 100644
--- a/drivers/bluetooth/btwilink.c
+++ b/drivers/bluetooth/btwilink.c
@@ -125,6 +125,13 @@ static long st_receive(void *priv_data, struct sk_buff *skb)
 /* protocol structure registered with shared transport */
 static struct st_proto_s ti_st_proto[MAX_BT_CHNL_IDS] = {
        {
+                .chnl_id = HCI_EVENT_PKT, /* HCI Events */
+                .hdr_len = sizeof(struct hci_event_hdr),
+                .offset_len_in_hdr = offsetof(struct hci_event_hdr, plen),
+                .len_size = 1, /* sizeof(plen) in struct hci_event_hdr */
+                .reserve = 8,
+        },
+        {
                .chnl_id = HCI_ACLDATA_PKT, /* ACL */
                .hdr_len = sizeof(struct hci_acl_hdr),
                .offset_len_in_hdr = offsetof(struct hci_acl_hdr, dlen),
@@ -138,13 +145,6 @@ static struct st_proto_s ti_st_proto[MAX_BT_CHNL_IDS] = {
                .len_size = 1, /* sizeof(dlen) in struct hci_sco_hdr */
                .reserve = 8,
        },
-        {
-                .chnl_id = HCI_EVENT_PKT, /* HCI Events */
-                .hdr_len = sizeof(struct hci_event_hdr),
-                .offset_len_in_hdr = offsetof(struct hci_event_hdr, plen),
-                .len_size = 1, /* sizeof(plen) in struct hci_event_hdr */
-                .reserve = 8,
-        },
 };
 /* Called from HCI core to initialize the device */
@@ -240,7 +240,7 @@ static int ti_st_close(struct hci_dev *hdev)
        if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
                return 0;
-        for (i = 0; i < MAX_BT_CHNL_IDS; i++) {
+        for (i = MAX_BT_CHNL_IDS-1; i >= 0; i--) {
                err = st_unregister(&ti_st_proto[i]);
                if (err)
                        BT_ERR("st_unregister(%d) failed with error %d",
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f6595aba4f0f..fa567f1158c2 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -43,6 +43,7 @@ config TCG_NSC
 config TCG_ATMEL
        tristate "Atmel TPM Interface"
+        depends on PPC64 || HAS_IOPORT
        ---help---
          If you have a TPM security chip from Atmel say Yes and it 
          will be accessible from within Linux.  To compile this driver 
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index caf8012ef47c..9ca5c021d0b6 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
        u32 count, ordinal;
        unsigned long stop;
+        if (bufsiz > TPM_BUFSIZE)
+                bufsiz = TPM_BUFSIZE;
        count = be32_to_cpu(*((__be32 *) (buf + 2)));
        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
        if (count == 0)
@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
        struct tpm_chip *chip = file->private_data;
        ssize_t ret_size;
+        int rc;
        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;
                mutex_lock(&chip->buffer_mutex);
-                if (copy_to_user(buf, chip->data_buffer, ret_size))
+                rc = copy_to_user(buf, chip->data_buffer, ret_size);
+                memset(chip->data_buffer, 0, ret_size);
+                if (rc)
                        ret_size = -EFAULT;
                mutex_unlock(&chip->buffer_mutex);
        }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 82facc9104c7..4d2464871ada 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
        if (pdev) {
                tpm_nsc_remove(&pdev->dev);
                platform_device_unregister(pdev);
-                kfree(pdev);
-                pdev = NULL;
        }
        platform_driver_unregister(&nsc_drv);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index ce045a8cf82c..f07e4252b708 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -67,11 +67,11 @@ module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
 MODULE_PARM_DESC(i915_enable_rc6,
                "Enable power-saving render C-state 6 (default: true)");
-unsigned int i915_enable_fbc __read_mostly = 1;
+unsigned int i915_enable_fbc __read_mostly = -1;
 module_param_named(i915_enable_fbc, i915_enable_fbc, int, 0600);
 MODULE_PARM_DESC(i915_enable_fbc,
                "Enable frame buffer compression for power savings "
-                "(default: false)");
+                "(default: -1 (use per-chip default))");
 unsigned int i915_lvds_downclock __read_mostly = 0;
 module_param_named(lvds_downclock, i915_lvds_downclock, int, 0400);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 56a8554d9039..04411ad2e779 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1799,6 +1799,7 @@ static void intel_update_fbc(struct drm_device *dev)
        struct drm_framebuffer *fb;
        struct intel_framebuffer *intel_fb;
        struct drm_i915_gem_object *obj;
+        int enable_fbc;
        DRM_DEBUG_KMS("\n");
@@ -1839,8 +1840,15 @@ static void intel_update_fbc(struct drm_device *dev)
        intel_fb = to_intel_framebuffer(fb);
        obj = intel_fb->obj;
-        if (!i915_enable_fbc) {
+        enable_fbc = i915_enable_fbc;
-                DRM_DEBUG_KMS("fbc disabled per module param (default off)\n");
+        if (enable_fbc < 0) {
+                DRM_DEBUG_KMS("fbc set to per-chip default\n");
+                enable_fbc = 1;
+                if (INTEL_INFO(dev)->gen <= 5)
+                        enable_fbc = 0;
+        }
+        if (!enable_fbc) {
+                DRM_DEBUG_KMS("fbc disabled per module param\n");
                dev_priv->no_fbc_reason = FBC_MODULE_PARAM;
                goto out_disable;
        }
@@ -4687,13 +4695,13 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                bpc = 6; /* min is 18bpp */
                break;
        case 24:
-                bpc = min((unsigned int)8, display_bpc);
+                bpc = 8;
                break;
        case 30:
-                bpc = min((unsigned int)10, display_bpc);
+                bpc = 10;
                break;
        case 48:
-                bpc = min((unsigned int)12, display_bpc);
+                bpc = 12;
                break;
        default:
                DRM_DEBUG("unsupported depth, assuming 24 bits\n");
@@ -4701,10 +4709,12 @@ static bool intel_choose_pipe_bpp_dither(struct drm_crtc *crtc,
                break;
        }
+        display_bpc = min(display_bpc, bpc);
        DRM_DEBUG_DRIVER("setting pipe bpc to %d (max display bpc %d)\n",
                         bpc, display_bpc);
-        *pipe_bpp = bpc * 3;
+        *pipe_bpp = display_bpc * 3;
        return display_bpc != bpc;
 }
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 0b2ee9d39980..fe1099d8817e 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -337,9 +337,6 @@ extern void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder,
                                           struct drm_connector *connector,
                                           struct intel_load_detect_pipe *old);
-extern struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB);
-extern int intel_sdvo_supports_hotplug(struct drm_connector *connector);
-extern void intel_sdvo_set_hotplug(struct drm_connector *connector, int enable);
 extern void intelfb_restore(void);
 extern void intel_crtc_fb_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                    u16 blue, int regno);
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 30fe554d8936..6348c499616f 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -92,6 +92,11 @@ struct intel_sdvo {
        */
        uint16_t attached_output;
+        /*
+         * Hotplug activation bits for this device
+         */
+        uint8_t hotplug_active[2];
        /**
         * This is used to select the color range of RBG outputs in HDMI mode.
         * It is only valid when using TMDS encoding and 8 bit per color mode.
@@ -1208,74 +1213,20 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
        return true;
 }
-/* No use! */
+static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
-#if 0
-struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB)
-{
-        struct drm_connector *connector = NULL;
-        struct intel_sdvo *iout = NULL;
-        struct intel_sdvo *sdvo;
-        /* find the sdvo connector */
-        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                iout = to_intel_sdvo(connector);
-                if (iout->type != INTEL_OUTPUT_SDVO)
-                        continue;
-                sdvo = iout->dev_priv;
-                if (sdvo->sdvo_reg == SDVOB && sdvoB)
-                        return connector;
-                if (sdvo->sdvo_reg == SDVOC && !sdvoB)
-                        return connector;
-        }
-        return NULL;
-}
-int intel_sdvo_supports_hotplug(struct drm_connector *connector)
 {
        u8 response[2];
-        u8 status;
-        struct intel_sdvo *intel_sdvo;
-        DRM_DEBUG_KMS("\n");
-        if (!connector)
-                return 0;
-        intel_sdvo = to_intel_sdvo(connector);
        return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
                                    &response, 2) && response[0];
 }
-void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
+static void intel_sdvo_enable_hotplug(struct intel_encoder *encoder)
 {
-        u8 response[2];
+        struct intel_sdvo *intel_sdvo = to_intel_sdvo(&encoder->base);
-        u8 status;
-        struct intel_sdvo *intel_sdvo = to_intel_sdvo(connector);
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
-        if (on) {
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
-                status = intel_sdvo_read_response(intel_sdvo, &response, 2);
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        } else {
-                response[0] = 0;
-                response[1] = 0;
-                intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
-        }
-        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
+        intel_sdvo_write_cmd(intel_sdvo, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &intel_sdvo->hotplug_active, 2);
-        intel_sdvo_read_response(intel_sdvo, &response, 2);
 }
-#endif
 static bool
 intel_sdvo_multifunc_encoder(struct intel_sdvo *intel_sdvo)
@@ -2045,6 +1996,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
 {
        struct drm_encoder *encoder = &intel_sdvo->base.base;
        struct drm_connector *connector;
+        struct intel_encoder *intel_encoder = to_intel_encoder(encoder);
        struct intel_connector *intel_connector;
        struct intel_sdvo_connector *intel_sdvo_connector;
@@ -2062,7 +2014,17 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device)
        intel_connector = &intel_sdvo_connector->base;
        connector = &intel_connector->base;
-        connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
+        if (intel_sdvo_supports_hotplug(intel_sdvo) & (1 << device)) {
+                connector->polled = DRM_CONNECTOR_POLL_HPD;
+                intel_sdvo->hotplug_active[0] |= 1 << device;
+                /* Some SDVO devices have one-shot hotplug interrupts.
+                 * Ensure that they get re-enabled when an interrupt happens.
+                 */
+                intel_encoder->hot_plug = intel_sdvo_enable_hotplug;
+                intel_sdvo_enable_hotplug(intel_encoder);
+        }
+        else
+                connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT;
        encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
        connector->connector_type = DRM_MODE_CONNECTOR_DVID;
@@ -2569,6 +2531,14 @@ bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
        if (!intel_sdvo_get_capabilities(intel_sdvo, &intel_sdvo->caps))
                goto err;
+        /* Set up hotplug command - note paranoia about contents of reply.
+         * We assume that the hardware is in a sane state, and only touch
+         * the bits we think we understand.
+         */
+        intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ACTIVE_HOT_PLUG,
+                             &intel_sdvo->hotplug_active, 2);
+        intel_sdvo->hotplug_active[0] &= ~0x3;
        if (intel_sdvo_output_setup(intel_sdvo,
                                    intel_sdvo->caps.output_flags) != true) {
                DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 5b1837b4aacf..7fcdbbbf2979 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -773,8 +773,8 @@ int r100_copy_blit(struct radeon_device *rdev,
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
                radeon_ring_write(rdev, 0);
                radeon_ring_write(rdev, (0x1fff) | (0x1fff << 16));
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
-                radeon_ring_write(rdev, cur_pages);
+                radeon_ring_write(rdev, num_gpu_pages);
                radeon_ring_write(rdev, cur_pages | (stride_pixels << 16));
        }
        radeon_ring_write(rdev, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0));
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 319d85d7e759..13690f3eb4a4 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1507,7 +1507,14 @@ radeon_atom_encoder_dpms(struct drm_encoder *encoder, int mode)
                switch (mode) {
                case DRM_MODE_DPMS_ON:
                        args.ucAction = ATOM_ENABLE;
-                        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                        /* workaround for DVOOutputControl on some RS690 systems */
+                        if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_DDI) {
+                                u32 reg = RREG32(RADEON_BIOS_3_SCRATCH);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg & ~ATOM_S3_DFP2I_ACTIVE);
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+                                WREG32(RADEON_BIOS_3_SCRATCH, reg);
+                        } else
+                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
                        if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
                                args.ucAction = ATOM_LCD_BLON;
                                atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 411257676133..44b23917d4cc 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,17 +36,25 @@
 #include <linux/cpu.h>
 #include <linux/pci.h>
 #include <linux/smp.h>
+#include <linux/moduleparam.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 #define DRVNAME "coretemp"
+/*
+ * force_tjmax only matters when TjMax can't be read from the CPU itself.
+ * When set, it replaces the driver's suboptimal heuristic.
+ */
+static int force_tjmax;
+module_param_named(tjmax, force_tjmax, int, 0444);
+MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES          16      /* Number of Real cores per cpu */
 #define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
-#define MAX_THRESH_ATTRS        3       /* Maximum no of Threshold attrs */
+#define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
-#define TOTAL_ATTRS             (MAX_CORE_ATTRS + MAX_THRESH_ATTRS)
 #define MAX_CORE_DATA           (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
 #ifdef CONFIG_SMP
@@ -69,8 +77,6 @@
 *              This value is passed as "id" field to rdmsr/wrmsr functions.
 * @status_reg: One of IA32_THERM_STATUS or IA32_PACKAGE_THERM_STATUS,
 *              from where the temperature values should be read.
- * @intrpt_reg: One of IA32_THERM_INTERRUPT or IA32_PACKAGE_THERM_INTERRUPT,
- *              from where the thresholds are read.
 * @attr_size:  Total number of pre-core attrs displayed in the sysfs.
 * @is_pkg_data: If this is 1, the temp_data holds pkgtemp data.
 *              Otherwise, temp_data holds coretemp data.
@@ -79,13 +85,11 @@
 struct temp_data {
        int temp;
        int ttarget;
-        int tmin;
        int tjmax;
        unsigned long last_updated;
        unsigned int cpu;
        u32 cpu_core_id;
        u32 status_reg;
-        u32 intrpt_reg;
        int attr_size;
        bool is_pkg_data;
        bool valid;
@@ -143,19 +147,6 @@ static ssize_t show_crit_alarm(struct device *dev,
        return sprintf(buf, "%d\n", (eax >> 5) & 1);
 }
-static ssize_t show_max_alarm(struct device *dev,
-                                struct device_attribute *devattr, char *buf)
-{
-        u32 eax, edx;
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        rdmsr_on_cpu(tdata->cpu, tdata->status_reg, &eax, &edx);
-        return sprintf(buf, "%d\n", !!(eax & THERM_STATUS_THRESHOLD1));
-}
 static ssize_t show_tjmax(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -174,83 +165,6 @@ static ssize_t show_ttarget(struct device *dev,
        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->ttarget);
 }
-static ssize_t store_ttarget(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD1 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD1) |
-                                (diff << THERM_SHIFT_THRESHOLD1);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->ttarget = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
-static ssize_t show_tmin(struct device *dev,
-                        struct device_attribute *devattr, char *buf)
-{
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        return sprintf(buf, "%d\n", pdata->core_data[attr->index]->tmin);
-}
-static ssize_t store_tmin(struct device *dev,
-                                struct device_attribute *devattr,
-                                const char *buf, size_t count)
-{
-        struct platform_data *pdata = dev_get_drvdata(dev);
-        struct sensor_device_attribute *attr = to_sensor_dev_attr(devattr);
-        struct temp_data *tdata = pdata->core_data[attr->index];
-        u32 eax, edx;
-        unsigned long val;
-        int diff;
-        if (strict_strtoul(buf, 10, &val))
-                return -EINVAL;
-        /*
-         * THERM_MASK_THRESHOLD0 is 7 bits wide. Values are entered in terms
-         * of milli degree celsius. Hence don't accept val > (127 * 1000)
-         */
-        if (val > tdata->tjmax || val > 127000)
-                return -EINVAL;
-        diff = (tdata->tjmax - val) / 1000;
-        mutex_lock(&tdata->update_lock);
-        rdmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, &eax, &edx);
-        eax = (eax & ~THERM_MASK_THRESHOLD0) |
-                                (diff << THERM_SHIFT_THRESHOLD0);
-        wrmsr_on_cpu(tdata->cpu, tdata->intrpt_reg, eax, edx);
-        tdata->tmin = val;
-        mutex_unlock(&tdata->update_lock);
-        return count;
-}
 static ssize_t show_temp(struct device *dev,
                        struct device_attribute *devattr, char *buf)
 {
@@ -374,7 +288,6 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
 {
-        /* The 100C is default for both mobile and non mobile CPUs */
        int err;
        u32 eax, edx;
        u32 val;
@@ -385,7 +298,8 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
         */
        err = rdmsr_safe_on_cpu(id, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
        if (err) {
-                dev_warn(dev, "Unable to read TjMax from CPU.\n");
+                if (c->x86_model > 0xe && c->x86_model != 0x1c)
+                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
                val = (eax >> 16) & 0xff;
                /*
@@ -393,11 +307,17 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                 * will be used
                 */
                if (val) {
-                        dev_info(dev, "TjMax is %d C.\n", val);
+                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
        }
+        if (force_tjmax) {
+                dev_notice(dev, "TjMax forced to %d degrees C by user\n",
+                           force_tjmax);
+                return force_tjmax * 1000;
+        }
        /*
         * An assumption is made for early CPUs and unreadable MSR.
         * NOTE: the calculated value may not be correct.
@@ -414,21 +334,6 @@ static void __devinit get_ucode_rev_on_cpu(void *edx)
        rdmsr(MSR_IA32_UCODE_REV, eax, *(u32 *)edx);
 }
-static int get_pkg_tjmax(unsigned int cpu, struct device *dev)
-{
-        int err;
-        u32 eax, edx, val;
-        err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET, &eax, &edx);
-        if (!err) {
-                val = (eax >> 16) & 0xff;
-                if (val)
-                        return val * 1000;
-        }
-        dev_warn(dev, "Unable to read Pkg-TjMax from CPU:%u\n", cpu);
-        return 100000; /* Default TjMax: 100 degree celsius */
-}
 static int create_name_attr(struct platform_data *pdata, struct device *dev)
 {
        sysfs_attr_init(&pdata->name_attr.attr);
@@ -442,19 +347,14 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                                int attr_no)
 {
        int err, i;
-        static ssize_t (*rd_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static ssize_t (*const rd_ptr[TOTAL_ATTRS]) (struct device *dev,
                        struct device_attribute *devattr, char *buf) = {
                        show_label, show_crit_alarm, show_temp, show_tjmax,
-                        show_max_alarm, show_ttarget, show_tmin };
+                        show_ttarget };
-        static ssize_t (*rw_ptr[TOTAL_ATTRS]) (struct device *dev,
+        static const char *const names[TOTAL_ATTRS] = {
-                        struct device_attribute *devattr, const char *buf,
-                        size_t count) = { NULL, NULL, NULL, NULL, NULL,
-                                        store_ttarget, store_tmin };
-        static const char *names[TOTAL_ATTRS] = {
                                        "temp%d_label", "temp%d_crit_alarm",
                                        "temp%d_input", "temp%d_crit",
-                                        "temp%d_max_alarm", "temp%d_max",
+                                        "temp%d_max" };
-                                        "temp%d_max_hyst" };
        for (i = 0; i < tdata->attr_size; i++) {
                snprintf(tdata->attr_name[i], CORETEMP_NAME_LENGTH, names[i],
@@ -462,10 +362,6 @@ static int create_core_attrs(struct temp_data *tdata, struct device *dev,
                sysfs_attr_init(&tdata->sd_attrs[i].dev_attr.attr);
                tdata->sd_attrs[i].dev_attr.attr.name = tdata->attr_name[i];
                tdata->sd_attrs[i].dev_attr.attr.mode = S_IRUGO;
-                if (rw_ptr[i]) {
-                        tdata->sd_attrs[i].dev_attr.attr.mode |= S_IWUSR;
-                        tdata->sd_attrs[i].dev_attr.store = rw_ptr[i];
-                }
                tdata->sd_attrs[i].dev_attr.show = rd_ptr[i];
                tdata->sd_attrs[i].index = attr_no;
                err = device_create_file(dev, &tdata->sd_attrs[i].dev_attr);
@@ -538,8 +434,6 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        tdata->status_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_STATUS :
                                                        MSR_IA32_THERM_STATUS;
-        tdata->intrpt_reg = pkg_flag ? MSR_IA32_PACKAGE_THERM_INTERRUPT :
-                                                MSR_IA32_THERM_INTERRUPT;
        tdata->is_pkg_data = pkg_flag;
        tdata->cpu = cpu;
        tdata->cpu_core_id = TO_CORE_ID(cpu);
@@ -548,11 +442,11 @@ static struct temp_data *init_temp_data(unsigned int cpu, int pkg_flag)
        return tdata;
 }
-static int create_core_data(struct platform_data *pdata,
+static int create_core_data(struct platform_device *pdev,
-                                struct platform_device *pdev,
                                unsigned int cpu, int pkg_flag)
 {
        struct temp_data *tdata;
+        struct platform_data *pdata = platform_get_drvdata(pdev);
        struct cpuinfo_x86 *c = &cpu_data(cpu);
        u32 eax, edx;
        int err, attr_no;
@@ -588,25 +482,21 @@ static int create_core_data(struct platform_data *pdata,
                goto exit_free;
        /* We can access status register. Get Critical Temperature */
-        if (pkg_flag)
+        tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
-                tdata->tjmax = get_pkg_tjmax(pdev->id, &pdev->dev);
-        else
-                tdata->tjmax = get_tjmax(c, cpu, &pdev->dev);
        /*
-         * Test if we can access the intrpt register. If so, increase the
+         * Read the still undocumented bits 8:15 of IA32_TEMPERATURE_TARGET.
-         * 'size' enough to have ttarget/tmin/max_alarm interfaces.
+         * The target temperature is available on older CPUs but not in this
-         * Initialize ttarget with bits 16:22 of MSR_IA32_THERM_INTERRUPT
+         * register. Atoms don't have the register at all.
         */
-        err = rdmsr_safe_on_cpu(cpu, tdata->intrpt_reg, &eax, &edx);
+        if (c->x86_model > 0xe && c->x86_model != 0x1c) {
-        if (!err) {
+                err = rdmsr_safe_on_cpu(cpu, MSR_IA32_TEMPERATURE_TARGET,
-                tdata->attr_size += MAX_THRESH_ATTRS;
+                                        &eax, &edx);
-                tdata->tmin = tdata->tjmax -
+                if (!err) {
-                              ((eax & THERM_MASK_THRESHOLD0) >>
+                        tdata->ttarget
-                               THERM_SHIFT_THRESHOLD0) * 1000;
+                          = tdata->tjmax - ((eax >> 8) & 0xff) * 1000;
-                tdata->ttarget = tdata->tjmax -
+                        tdata->attr_size++;
-                                 ((eax & THERM_MASK_THRESHOLD1) >>
+                }
-                                  THERM_SHIFT_THRESHOLD1) * 1000;
        }
        pdata->core_data[attr_no] = tdata;
@@ -624,16 +514,13 @@ exit_free:
 static void coretemp_add_core(unsigned int cpu, int pkg_flag)
 {
-        struct platform_data *pdata;
        struct platform_device *pdev = coretemp_get_pdev(cpu);
        int err;
        if (!pdev)
                return;
-        pdata = platform_get_drvdata(pdev);
+        err = create_core_data(pdev, cpu, pkg_flag);
-        err = create_core_data(pdata, pdev, cpu, pkg_flag);
        if (err)
                dev_err(&pdev->dev, "Adding Core %u failed\n", cpu);
 }
@@ -671,7 +558,7 @@ static int __devinit coretemp_probe(struct platform_device *pdev)
        if (err)
                goto exit_free;
-        pdata->phys_proc_id = TO_PHYS_ID(pdev->id);
+        pdata->phys_proc_id = pdev->id;
        platform_set_drvdata(pdev, pdata);
        pdata->hwmon_dev = hwmon_device_register(&pdev->dev);
@@ -723,7 +610,7 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        mutex_lock(&pdev_list_mutex);
-        pdev = platform_device_alloc(DRVNAME, cpu);
+        pdev = platform_device_alloc(DRVNAME, TO_PHYS_ID(cpu));
        if (!pdev) {
                err = -ENOMEM;
                pr_err("Device allocation failed\n");
diff --git a/drivers/hwmon/ds620.c b/drivers/hwmon/ds620.c
index 257957c69d92..4f7c3fc40a89 100644
--- a/drivers/hwmon/ds620.c
+++ b/drivers/hwmon/ds620.c
@@ -72,7 +72,7 @@ struct ds620_data {
        char valid;             /* !=0 if following fields are valid */
        unsigned long last_updated;     /* In jiffies */
-        u16 temp[3];            /* Register values, word */
+        s16 temp[3];            /* Register values, word */
 };
 /*
diff --git a/drivers/hwmon/w83791d.c b/drivers/hwmon/w83791d.c
index 17cf1ab95521..8c2844e5691c 100644
--- a/drivers/hwmon/w83791d.c
+++ b/drivers/hwmon/w83791d.c
@@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_client *client,
                          struct i2c_board_info *info);
 static int w83791d_remove(struct i2c_client *client);
-static int w83791d_read(struct i2c_client *client, u8 register);
+static int w83791d_read(struct i2c_client *client, u8 reg);
-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
 static struct w83791d_data *w83791d_update_device(struct device *dev);
 #ifdef DEBUG
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index 17bf9d95463c..6cd642aaa4de 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -287,7 +287,7 @@ void __free_ep(struct kref *kref)
        if (test_bit(RELEASE_RESOURCES, &ep->com.flags)) {
                cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
                dst_release(ep->dst);
-                l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+                l2t_release(ep->com.tdev, ep->l2t);
        }
        kfree(ep);
 }
@@ -1178,7 +1178,7 @@ static int act_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
                release_tid(ep->com.tdev, GET_TID(rpl), NULL);
        cxgb3_free_atid(ep->com.tdev, ep->atid);
        dst_release(ep->dst);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        put_ep(&ep->com);
        return CPL_RET_BUF_DONE;
 }
@@ -1377,7 +1377,7 @@ static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
        if (!child_ep) {
                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
                       __func__);
-                l2t_release(L2DATA(tdev), l2t);
+                l2t_release(tdev, l2t);
                dst_release(dst);
                goto reject;
        }
@@ -1956,7 +1956,7 @@ int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
        if (!err)
                goto out;
-        l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
+        l2t_release(h->rdev.t3cdev_p, ep->l2t);
 fail4:
        dst_release(ep->dst);
 fail3:
@@ -2127,7 +2127,7 @@ int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
        PDBG("%s ep %p redirect to dst %p l2t %p\n", __func__, ep, new,
             l2t);
        dst_hold(new);
-        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        l2t_release(ep->com.tdev, ep->l2t);
        ep->l2t = l2t;
        dst_release(old);
        ep->dst = new;
diff --git a/drivers/media/video/omap/omap_vout.c b/drivers/media/video/omap/omap_vout.c
index b5ef36222440..b3a5ecdb33ac 100644
--- a/drivers/media/video/omap/omap_vout.c
+++ b/drivers/media/video/omap/omap_vout.c
@@ -2194,19 +2194,6 @@ static int __init omap_vout_probe(struct platform_device *pdev)
                                        "'%s' Display already enabled\n",
                                        def_display->name);
                        }
-                        /* set the update mode */
-                        if (def_display->caps &
-                                        OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE) {
-                                if (dssdrv->enable_te)
-                                        dssdrv->enable_te(def_display, 0);
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_MANUAL);
-                        } else {
-                                if (dssdrv->set_update_mode)
-                                        dssdrv->set_update_mode(def_display,
-                                                        OMAP_DSS_UPDATE_AUTO);
-                        }
                }
        }
diff --git a/drivers/media/video/omap3isp/ispccdc.c b/drivers/media/video/omap3isp/ispccdc.c
index 9d3459de04b2..80796eb0c53e 100644
--- a/drivers/media/video/omap3isp/ispccdc.c
+++ b/drivers/media/video/omap3isp/ispccdc.c
@@ -31,6 +31,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/slab.h>
 #include <media/v4l2-event.h>
 #include "isp.h"
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index d29f9c2d0854..e4100b1f68df 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1961,7 +1961,7 @@ static int __uvc_resume(struct usb_interface *intf, int reset)
        list_for_each_entry(stream, &dev->streams, list) {
                if (stream->intf == intf)
-                        return uvc_video_resume(stream);
+                        return uvc_video_resume(stream, reset);
        }
        uvc_trace(UVC_TRACE_SUSPEND, "Resume: video streaming USB interface "
diff --git a/drivers/media/video/uvc/uvc_entity.c b/drivers/media/video/uvc/uvc_entity.c
index 48fea373c25a..29e239911d0e 100644
--- a/drivers/media/video/uvc/uvc_entity.c
+++ b/drivers/media/video/uvc/uvc_entity.c
@@ -49,7 +49,7 @@ static int uvc_mc_register_entity(struct uvc_video_chain *chain,
                if (remote == NULL)
                        return -EINVAL;
-                source = (UVC_ENTITY_TYPE(remote) != UVC_TT_STREAMING)
+                source = (UVC_ENTITY_TYPE(remote) == UVC_TT_STREAMING)
                       ? (remote->vdev ? &remote->vdev->entity : NULL)
                       : &remote->subdev.entity;
                if (source == NULL)
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index 8244167c8915..ffd1158628b6 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1104,10 +1104,18 @@ int uvc_video_suspend(struct uvc_streaming *stream)
 * buffers, making sure userspace applications are notified of the problem
 * instead of waiting forever.
 */
-int uvc_video_resume(struct uvc_streaming *stream)
+int uvc_video_resume(struct uvc_streaming *stream, int reset)
 {
        int ret;
+        /* If the bus has been reset on resume, set the alternate setting to 0.
+         * This should be the default value, but some devices crash or otherwise
+         * misbehave if they don't receive a SET_INTERFACE request before any
+         * other video control request.
+         */
+        if (reset)
+                usb_set_interface(stream->dev->udev, stream->intfnum, 0);
        stream->frozen = 0;
        ret = uvc_commit_video(stream, &stream->ctrl);
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index df32a43ca86a..cbdd49bf8b67 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -638,7 +638,7 @@ extern void uvc_mc_cleanup_entity(struct uvc_entity *entity);
 /* Video */
 extern int uvc_video_init(struct uvc_streaming *stream);
 extern int uvc_video_suspend(struct uvc_streaming *stream);
-extern int uvc_video_resume(struct uvc_streaming *stream);
+extern int uvc_video_resume(struct uvc_streaming *stream, int reset);
 extern int uvc_video_enable(struct uvc_streaming *stream, int enable);
 extern int uvc_probe_video(struct uvc_streaming *stream,
                struct uvc_streaming_control *probe);
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index 06f14008b346..d72156517726 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -173,6 +173,17 @@ static void v4l2_device_release(struct device *cd)
                media_device_unregister_entity(&vdev->entity);
 #endif
+        /* Do not call v4l2_device_put if there is no release callback set.
+         * Drivers that have no v4l2_device release callback might free the
+         * v4l2_dev instance in the video_device release callback below, so we
+         * must perform this check here.
+         *
+         * TODO: In the long run all drivers that use v4l2_device should use the
+         * v4l2_device release callback. This check will then be unnecessary.
+         */
+        if (v4l2_dev->release == NULL)
+                v4l2_dev = NULL;
        /* Release video_device and perform other
           cleanups as needed. */
        vdev->release(vdev);
diff --git a/drivers/media/video/v4l2-device.c b/drivers/media/video/v4l2-device.c
index c72856c41434..e6a2c3b302d4 100644
--- a/drivers/media/video/v4l2-device.c
+++ b/drivers/media/video/v4l2-device.c
@@ -38,6 +38,7 @@ int v4l2_device_register(struct device *dev, struct v4l2_device *v4l2_dev)
        mutex_init(&v4l2_dev->ioctl_lock);
        v4l2_prio_init(&v4l2_dev->prio);
        kref_init(&v4l2_dev->ref);
+        get_device(dev);
        v4l2_dev->dev = dev;
        if (dev == NULL) {
                /* If dev == NULL, then name must be filled in by the caller */
@@ -93,6 +94,7 @@ void v4l2_device_disconnect(struct v4l2_device *v4l2_dev)
        if (dev_get_drvdata(v4l2_dev->dev) == v4l2_dev)
                dev_set_drvdata(v4l2_dev->dev, NULL);
+        put_device(v4l2_dev->dev);
        v4l2_dev->dev = NULL;
 }
 EXPORT_SYMBOL_GPL(v4l2_device_disconnect);
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 1ff5486213fb..4c1a648d00fc 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -926,6 +926,9 @@ static void mmc_blk_rw_rq_prep(struct mmc_queue_req *mqrq,
        /*
         * Reliable writes are used to implement Forced Unit Access and
         * REQ_META accesses, and are supported only on MMCs.
+         *
+         * XXX: this really needs a good explanation of why REQ_META
+         * is treated special.
         */
        bool do_rel_wr = ((req->cmd_flags & REQ_FUA) ||
                          (req->cmd_flags & REQ_META)) &&
diff --git a/drivers/net/bnx2x/bnx2x_dcb.c b/drivers/net/bnx2x/bnx2x_dcb.c
index a1e004a82f7a..0b4acf67e0c6 100644
--- a/drivers/net/bnx2x/bnx2x_dcb.c
+++ b/drivers/net/bnx2x/bnx2x_dcb.c
@@ -2120,6 +2120,7 @@ static u8 bnx2x_dcbnl_get_cap(struct net_device *netdev, int capid, u8 *cap)
                        break;
                case DCB_CAP_ATTR_DCBX:
                        *cap = BNX2X_DCBX_CAPS;
+                        break;
                default:
                        rval = -EINVAL;
                        break;
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index c027e9341a1a..15f800085bb2 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -4943,7 +4943,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        int igu_seg_id;
        int port = BP_PORT(bp);
        int func = BP_FUNC(bp);
-        int reg_offset;
+        int reg_offset, reg_offset_en5;
        u64 section;
        int index;
        struct hc_sp_status_block_data sp_sb_data;
@@ -4966,6 +4966,8 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
        reg_offset = (port ? MISC_REG_AEU_ENABLE1_FUNC_1_OUT_0 :
                             MISC_REG_AEU_ENABLE1_FUNC_0_OUT_0);
+        reg_offset_en5 = (port ? MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0 :
+                                 MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0);
        for (index = 0; index < MAX_DYNAMIC_ATTN_GRPS; index++) {
                int sindex;
                /* take care of sig[0]..sig[4] */
@@ -4980,7 +4982,7 @@ static void bnx2x_init_def_sb(struct bnx2x *bp)
                         * and not 16 between the different groups
                         */
                        bp->attn_group[index].sig[4] = REG_RD(bp,
-                                        reg_offset + 0x10 + 0x4*index);
+                                        reg_offset_en5 + 0x4*index);
                else
                        bp->attn_group[index].sig[4] = 0;
        }
@@ -7625,8 +7627,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                u32 emac_base = port ? GRCBASE_EMAC1 : GRCBASE_EMAC0;
                u8 *mac_addr = bp->dev->dev_addr;
                u32 val;
+                u16 pmc;
                /* The mac address is written to entries 1-4 to
-                   preserve entry 0 which is used by the PMF */
+                 * preserve entry 0 which is used by the PMF
+                 */
                u8 entry = (BP_VN(bp) + 1)*8;
                val = (mac_addr[0] << 8) | mac_addr[1];
@@ -7636,6 +7641,11 @@ u32 bnx2x_send_unload_req(struct bnx2x *bp, int unload_mode)
                      (mac_addr[4] << 8) | mac_addr[5];
                EMAC_WR(bp, EMAC_REG_EMAC_MAC_MATCH + entry + 4, val);
+                /* Enable the PME and clear the status */
+                pci_read_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, &pmc);
+                pmc |= PCI_PM_CTRL_PME_ENABLE | PCI_PM_CTRL_PME_STATUS;
+                pci_write_config_word(bp->pdev, bp->pm_cap + PCI_PM_CTRL, pmc);
                reset_code = DRV_MSG_CODE_UNLOAD_REQ_WOL_EN;
        } else
diff --git a/drivers/net/bnx2x/bnx2x_reg.h b/drivers/net/bnx2x/bnx2x_reg.h
index 750e8445dac4..fc7bd0f23c0b 100644
--- a/drivers/net/bnx2x/bnx2x_reg.h
+++ b/drivers/net/bnx2x/bnx2x_reg.h
@@ -1384,6 +1384,18 @@
   Latched ump_tx_parity; [31] MCP Latched scpad_parity; */
 #define MISC_REG_AEU_ENABLE4_PXP_0                               0xa108
 #define MISC_REG_AEU_ENABLE4_PXP_1                               0xa1a8
+/* [RW 32] fifth 32b for enabling the output for function 0 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_0_OUT_0                        0xa688
+/* [RW 32] Fifth 32b for enabling the output for function 1 output0. Mapped
+ * as follows: [0] PGLUE config_space; [1] PGLUE misc_flr; [2] PGLUE B RBC
+ * attention [3] PGLUE B RBC parity; [4] ATC attention; [5] ATC parity; [6]
+ * mstat0 attention; [7] mstat0 parity; [8] mstat1 attention; [9] mstat1
+ * parity; [31-10] Reserved; */
+#define MISC_REG_AEU_ENABLE5_FUNC_1_OUT_0                        0xa6b0
 /* [RW 1] set/clr general attention 0; this will set/clr bit 94 in the aeu
   128 bit vector */
 #define MISC_REG_AEU_GENERAL_ATTN_0                              0xa000
diff --git a/drivers/net/cxgb3/cxgb3_offload.c b/drivers/net/cxgb3/cxgb3_offload.c
index 805076c54f1b..da5a5d9b8aff 100644
--- a/drivers/net/cxgb3/cxgb3_offload.c
+++ b/drivers/net/cxgb3/cxgb3_offload.c
@@ -1146,12 +1146,14 @@ static void cxgb_redirect(struct dst_entry *old, struct dst_entry *new)
                if (te && te->ctx && te->client && te->client->redirect) {
                        update_tcb = te->client->redirect(te->ctx, old, new, e);
                        if (update_tcb) {
+                                rcu_read_lock();
                                l2t_hold(L2DATA(tdev), e);
+                                rcu_read_unlock();
                                set_l2t_ix(tdev, tid, e);
                        }
                }
        }
-        l2t_release(L2DATA(tdev), e);
+        l2t_release(tdev, e);
 }
 /*
@@ -1264,7 +1266,7 @@ int cxgb3_offload_activate(struct adapter *adapter)
                goto out_free;
        err = -ENOMEM;
-        L2DATA(dev) = t3_init_l2t(l2t_capacity);
+        RCU_INIT_POINTER(dev->l2opt, t3_init_l2t(l2t_capacity));
        if (!L2DATA(dev))
                goto out_free;
@@ -1298,16 +1300,24 @@ int cxgb3_offload_activate(struct adapter *adapter)
 out_free_l2t:
        t3_free_l2t(L2DATA(dev));
-        L2DATA(dev) = NULL;
+        rcu_assign_pointer(dev->l2opt, NULL);
 out_free:
        kfree(t);
        return err;
 }
+static void clean_l2_data(struct rcu_head *head)
+{
+        struct l2t_data *d = container_of(head, struct l2t_data, rcu_head);
+        t3_free_l2t(d);
+}
 void cxgb3_offload_deactivate(struct adapter *adapter)
 {
        struct t3cdev *tdev = &adapter->tdev;
        struct t3c_data *t = T3C_DATA(tdev);
+        struct l2t_data *d;
        remove_adapter(adapter);
        if (list_empty(&adapter_list))
@@ -1315,8 +1325,11 @@ void cxgb3_offload_deactivate(struct adapter *adapter)
        free_tid_maps(&t->tid_maps);
        T3C_DATA(tdev) = NULL;
-        t3_free_l2t(L2DATA(tdev));
+        rcu_read_lock();
-        L2DATA(tdev) = NULL;
+        d = L2DATA(tdev);
+        rcu_read_unlock();
+        rcu_assign_pointer(tdev->l2opt, NULL);
+        call_rcu(&d->rcu_head, clean_l2_data);
        if (t->nofail_skb)
                kfree_skb(t->nofail_skb);
        kfree(t);
diff --git a/drivers/net/cxgb3/l2t.c b/drivers/net/cxgb3/l2t.c
index f452c4003253..41540978a173 100644
--- a/drivers/net/cxgb3/l2t.c
+++ b/drivers/net/cxgb3/l2t.c
@@ -300,14 +300,21 @@ static inline void reuse_entry(struct l2t_entry *e, struct neighbour *neigh)
 struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
                             struct net_device *dev)
 {
-        struct l2t_entry *e;
+        struct l2t_entry *e = NULL;
-        struct l2t_data *d = L2DATA(cdev);
+        struct l2t_data *d;
+        int hash;
        u32 addr = *(u32 *) neigh->primary_key;
        int ifidx = neigh->dev->ifindex;
-        int hash = arp_hash(addr, ifidx, d);
        struct port_info *p = netdev_priv(dev);
        int smt_idx = p->port_id;
+        rcu_read_lock();
+        d = L2DATA(cdev);
+        if (!d)
+                goto done_rcu;
+        hash = arp_hash(addr, ifidx, d);
        write_lock_bh(&d->lock);
        for (e = d->l2tab[hash].first; e; e = e->next)
                if (e->addr == addr && e->ifindex == ifidx &&
@@ -338,6 +345,8 @@ struct l2t_entry *t3_l2t_get(struct t3cdev *cdev, struct neighbour *neigh,
        }
 done:
        write_unlock_bh(&d->lock);
+done_rcu:
+        rcu_read_unlock();
        return e;
 }
diff --git a/drivers/net/cxgb3/l2t.h b/drivers/net/cxgb3/l2t.h
index 7a12d52ed4fc..c5f54796e2cb 100644
--- a/drivers/net/cxgb3/l2t.h
+++ b/drivers/net/cxgb3/l2t.h
@@ -76,6 +76,7 @@ struct l2t_data {
        atomic_t nfree;         /* number of free entries */
        rwlock_t lock;
        struct l2t_entry l2tab[0];
+        struct rcu_head rcu_head;       /* to handle rcu cleanup */
 };
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
@@ -99,7 +100,7 @@ static inline void set_arp_failure_handler(struct sk_buff *skb,
 /*
 * Getting to the L2 data from an offload device.
 */
-#define L2DATA(dev) ((dev)->l2opt)
+#define L2DATA(cdev) (rcu_dereference((cdev)->l2opt))
 #define W_TCB_L2T_IX    0
 #define S_TCB_L2T_IX    7
@@ -126,15 +127,22 @@ static inline int l2t_send(struct t3cdev *dev, struct sk_buff *skb,
        return t3_l2t_send_slow(dev, skb, e);
 }
-static inline void l2t_release(struct l2t_data *d, struct l2t_entry *e)
+static inline void l2t_release(struct t3cdev *t, struct l2t_entry *e)
 {
-        if (atomic_dec_and_test(&e->refcnt))
+        struct l2t_data *d;
+        rcu_read_lock();
+        d = L2DATA(t);
+        if (atomic_dec_and_test(&e->refcnt) && d)
                t3_l2e_free(d, e);
+        rcu_read_unlock();
 }
 static inline void l2t_hold(struct l2t_data *d, struct l2t_entry *e)
 {
-        if (atomic_add_return(1, &e->refcnt) == 1)      /* 0 -> 1 transition */
+        if (d && atomic_add_return(1, &e->refcnt) == 1) /* 0 -> 1 transition */
                atomic_dec(&d->nfree);
 }
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 25a8c2adb001..0caf3c323ec0 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -1669,10 +1669,10 @@ static int gfar_get_cls_all(struct gfar_private *priv,
        u32 i = 0;
        list_for_each_entry(comp, &priv->rx_list.list, list) {
-                if (i <= cmd->rule_cnt) {
+                if (i == cmd->rule_cnt)
-                        rule_locs[i] = comp->fs.location;
+                        return -EMSGSIZE;
-                        i++;
+                rule_locs[i] = comp->fs.location;
-                }
+                i++;
        }
        cmd->data = MAX_FILER_IDX;
diff --git a/drivers/net/greth.c b/drivers/net/greth.c
index 16ce45c11934..52a39000c42c 100644
--- a/drivers/net/greth.c
+++ b/drivers/net/greth.c
@@ -428,6 +428,7 @@ greth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_sync_single_for_device(greth->dev, dma_addr, skb->len, DMA_TO_DEVICE);
        status = GRETH_BD_EN | GRETH_BD_IE | (skb->len & GRETH_BD_LEN);
+        greth->tx_bufs_length[greth->tx_next] = skb->len & GRETH_BD_LEN;
        /* Wrap around descriptor ring */
        if (greth->tx_next == GRETH_TXBD_NUM_MASK) {
@@ -490,7 +491,8 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
        if (nr_frags != 0)
                status = GRETH_TXBD_MORE;
-        status |= GRETH_TXBD_CSALL;
+        if (skb->ip_summed == CHECKSUM_PARTIAL)
+                status |= GRETH_TXBD_CSALL;
        status |= skb_headlen(skb) & GRETH_BD_LEN;
        if (greth->tx_next == GRETH_TXBD_NUM_MASK)
                status |= GRETH_BD_WR;
@@ -513,7 +515,9 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)
                greth->tx_skbuff[curr_tx] = NULL;
                bdp = greth->tx_bd_base + curr_tx;
-                status = GRETH_TXBD_CSALL | GRETH_BD_EN;
+                status = GRETH_BD_EN;
+                if (skb->ip_summed == CHECKSUM_PARTIAL)
+                        status |= GRETH_TXBD_CSALL;
                status |= frag->size & GRETH_BD_LEN;
                /* Wrap around descriptor ring */
@@ -641,6 +645,7 @@ static void greth_clean_tx(struct net_device *dev)
                                dev->stats.tx_fifo_errors++;
                }
                dev->stats.tx_packets++;
+                dev->stats.tx_bytes += greth->tx_bufs_length[greth->tx_last];
                greth->tx_last = NEXT_TX(greth->tx_last);
                greth->tx_free++;
        }
@@ -695,6 +700,7 @@ static void greth_clean_tx_gbit(struct net_device *dev)
                greth->tx_skbuff[greth->tx_last] = NULL;
                greth_update_tx_stats(dev, stat);
+                dev->stats.tx_bytes += skb->len;
                bdp = greth->tx_bd_base + greth->tx_last;
@@ -796,6 +802,7 @@ static int greth_rx(struct net_device *dev, int limit)
                                memcpy(skb_put(skb, pkt_len), phys_to_virt(dma_addr), pkt_len);
                                skb->protocol = eth_type_trans(skb, dev);
+                                dev->stats.rx_bytes += pkt_len;
                                dev->stats.rx_packets++;
                                netif_receive_skb(skb);
                        }
@@ -910,6 +917,7 @@ static int greth_rx_gbit(struct net_device *dev, int limit)
                                skb->protocol = eth_type_trans(skb, dev);
                                dev->stats.rx_packets++;
+                                dev->stats.rx_bytes += pkt_len;
                                netif_receive_skb(skb);
                                greth->rx_skbuff[greth->rx_cur] = newskb;
diff --git a/drivers/net/greth.h b/drivers/net/greth.h
index 9a0040dee4da..232a622a85b7 100644
--- a/drivers/net/greth.h
+++ b/drivers/net/greth.h
@@ -103,6 +103,7 @@ struct greth_private {
        unsigned char *tx_bufs[GRETH_TXBD_NUM];
        unsigned char *rx_bufs[GRETH_RXBD_NUM];
+        u16 tx_bufs_length[GRETH_TXBD_NUM];
        u16 tx_next;
        u16 tx_last;
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 22790394318a..e1fcc9589278 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1321,8 +1321,8 @@ static void ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                if (ring_is_rsc_enabled(rx_ring))
                        pkt_is_rsc = ixgbe_get_rsc_state(rx_desc);
-                /* if this is a skb from previous receive DMA will be 0 */
+                /* linear means we are building an skb from multiple pages */
-                if (rx_buffer_info->dma) {
+                if (!skb_is_nonlinear(skb)) {
                        u16 hlen;
                        if (pkt_is_rsc &&
                            !(staterr & IXGBE_RXD_STAT_EOP) &&
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index dfc82720065a..ed2a3977c6e7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -799,5 +799,11 @@ static void __exit cleanup_netconsole(void)
        }
 }
-module_init(init_netconsole);
+/*
+ * Use late_initcall to ensure netconsole is
+ * initialized after network device driver if built-in.
+ *
+ * late_initcall() and module_init() are identical if built as module.
+ */
+late_initcall(init_netconsole);
 module_exit(cleanup_netconsole);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 10e5d985afa3..edfa15d2e795 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1465,7 +1465,12 @@ static int ppp_mp_explode(struct ppp *ppp, struct sk_buff *skb)
                        continue;
                }
-                mtu = pch->chan->mtu - hdrlen;
+                /*
+                 * hdrlen includes the 2-byte PPP protocol field, but the
+                 * MTU counts only the payload excluding the protocol field.
+                 * (RFC1661 Section 2)
+                 */
+                mtu = pch->chan->mtu - (hdrlen - 2);
                if (mtu < 4)
                        mtu = 4;
                if (flen > mtu)
diff --git a/drivers/net/pxa168_eth.c b/drivers/net/pxa168_eth.c
index 1a3033d8e7ed..d17d0624c5e6 100644
--- a/drivers/net/pxa168_eth.c
+++ b/drivers/net/pxa168_eth.c
@@ -40,6 +40,7 @@
 #include <linux/clk.h>
 #include <linux/phy.h>
 #include <linux/io.h>
+#include <linux/interrupt.h>
 #include <linux/types.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 02339b3352e7..c23667017922 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -407,6 +407,7 @@ enum rtl_register_content {
        RxOK            = 0x0001,
        /* RxStatusDesc */
+        RxBOVF  = (1 << 24),
        RxFOVF  = (1 << 23),
        RxRWT   = (1 << 22),
        RxRES   = (1 << 21),
@@ -682,6 +683,7 @@ struct rtl8169_private {
        struct mii_if_info mii;
        struct rtl8169_counters counters;
        u32 saved_wolopts;
+        u32 opts1_mask;
        struct rtl_fw {
                const struct firmware *fw;
@@ -710,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8168D_1);
 MODULE_FIRMWARE(FIRMWARE_8168D_2);
 MODULE_FIRMWARE(FIRMWARE_8168E_1);
 MODULE_FIRMWARE(FIRMWARE_8168E_2);
+MODULE_FIRMWARE(FIRMWARE_8168E_3);
 MODULE_FIRMWARE(FIRMWARE_8105E_1);
 static int rtl8169_open(struct net_device *dev);
@@ -3077,6 +3080,14 @@ static void rtl8169_phy_reset(struct net_device *dev,
        netif_err(tp, link, dev, "PHY reset failed\n");
 }
+static bool rtl_tbi_enabled(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+        return (tp->mac_version == RTL_GIGA_MAC_VER_01) &&
+            (RTL_R8(PHYstatus) & TBI_Enable);
+}
 static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
 {
        void __iomem *ioaddr = tp->mmio_addr;
@@ -3109,7 +3120,7 @@ static void rtl8169_init_phy(struct net_device *dev, struct rtl8169_private *tp)
                           ADVERTISED_1000baseT_Half |
                           ADVERTISED_1000baseT_Full : 0));
-        if (RTL_R8(PHYstatus) & TBI_Enable)
+        if (rtl_tbi_enabled(tp))
                netif_info(tp, link, dev, "TBI auto-negotiating\n");
 }
@@ -3319,9 +3330,16 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
                rtl_writephy(tp, 0x1f, 0x0000);
                rtl_writephy(tp, MII_BMCR, 0x0000);
+                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_30)
+                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
+                                AcceptMulticast | AcceptMyPhys);
                return;
        }
@@ -3417,7 +3435,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
                rtl_writephy(tp, MII_BMCR, 0x0000);
                if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33)
+                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
+                    tp->mac_version == RTL_GIGA_MAC_VER_34)
                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
                                AcceptMulticast | AcceptMyPhys);
                return;
@@ -3727,8 +3746,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
        RTL_W8(Cfg9346, Cfg9346_Lock);
-        if ((tp->mac_version <= RTL_GIGA_MAC_VER_06) &&
+        if (rtl_tbi_enabled(tp)) {
-            (RTL_R8(PHYstatus) & TBI_Enable)) {
                tp->set_speed = rtl8169_set_speed_tbi;
                tp->get_settings = rtl8169_gset_tbi;
                tp->phy_reset_enable = rtl8169_tbi_reset_enable;
@@ -3777,6 +3795,9 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        tp->intr_event = cfg->intr_event;
        tp->napi_event = cfg->napi_event;
+        tp->opts1_mask = (tp->mac_version != RTL_GIGA_MAC_VER_01) ?
+                ~(RxBOVF | RxFOVF) : ~0;
        init_timer(&tp->timer);
        tp->timer.data = (unsigned long) dev;
        tp->timer.function = rtl8169_phy_timer;
@@ -3988,6 +4009,7 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
                while (RTL_R8(TxPoll) & NPQ)
                        udelay(20);
        } else if (tp->mac_version == RTL_GIGA_MAC_VER_34) {
+                RTL_W8(ChipCmd, RTL_R8(ChipCmd) | StopReq);
                while (!(RTL_R32(TxConfig) & TXCFG_EMPTY))
                        udelay(100);
        } else {
@@ -5314,7 +5336,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                u32 status;
                rmb();
-                status = le32_to_cpu(desc->opts1);
+                status = le32_to_cpu(desc->opts1) & tp->opts1_mask;
                if (status & DescOwn)
                        break;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index dc3fbf61910b..4a1374df6084 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -6234,12 +6234,10 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        }
-#ifdef BCM_KERNEL_SUPPORTS_8021Q
        if (vlan_tx_tag_present(skb)) {
                base_flags |= TXD_FLAG_VLAN;
                vlan = vlan_tx_tag_get(skb);
        }
-#endif
        if (tg3_flag(tp, USE_JUMBO_BDFLAG) &&
            !mss && skb->len > VLAN_ETH_FRAME_LEN)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 2339728a7306..3e69c631ebb4 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -1514,7 +1514,7 @@ static const u32 ar9300_2p2_mac_core[][2] = {
        {0x00008258, 0x00000000},
        {0x0000825c, 0x40000000},
        {0x00008260, 0x00080922},
-        {0x00008264, 0x9bc00010},
+        {0x00008264, 0x9d400010},
        {0x00008268, 0xffffffff},
        {0x0000826c, 0x0000ffff},
        {0x00008270, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 9a4850154fb2..4c21f8cbdeb5 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -205,14 +205,22 @@ static void ath_rx_remove_buffer(struct ath_softc *sc,
 static void ath_rx_edma_cleanup(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
        struct ath_buf *bf;
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
        list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                if (bf->bf_mpdu)
+                if (bf->bf_mpdu) {
+                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
+                                        common->rx_bufsize,
+                                        DMA_BIDIRECTIONAL);
                        dev_kfree_skb_any(bf->bf_mpdu);
+                        bf->bf_buf_addr = 0;
+                        bf->bf_mpdu = NULL;
+                }
        }
        INIT_LIST_HEAD(&sc->rx.rxbuf);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 26f1ab840cc7..e293a7921bf0 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1632,7 +1632,8 @@ static void handle_irq_beacon(struct b43_wldev *dev)
        u32 cmd, beacon0_valid, beacon1_valid;
        if (!b43_is_mode(wl, NL80211_IFTYPE_AP) &&
-            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT))
+            !b43_is_mode(wl, NL80211_IFTYPE_MESH_POINT) &&
+            !b43_is_mode(wl, NL80211_IFTYPE_ADHOC))
                return;
        /* This is the bottom half of the asynchronous beacon update. */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 3774dd034746..ef9ad79d1bfd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,15 +1903,17 @@ static void ipw2100_down(struct ipw2100_priv *priv)
 static int ipw2100_net_init(struct net_device *dev)
 {
        struct ipw2100_priv *priv = libipw_priv(dev);
+        return ipw2100_up(priv, 1);
+}
+static int ipw2100_wdev_init(struct net_device *dev)
+{
+        struct ipw2100_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        int ret;
        int i;
-        ret = ipw2100_up(priv, 1);
-        if (ret)
-                return ret;
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
        /* fill-out priv->ieee->bg_band */
@@ -6350,9 +6352,13 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                       "Error calling register_netdev.\n");
                goto fail;
        }
+        registered = 1;
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
        mutex_lock(&priv->action_mutex);
-        registered = 1;
        IPW_DEBUG_INFO("%s: Bound to %s\n", dev->name, pci_name(pci_dev));
@@ -6389,7 +6395,8 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
      fail_unlock:
        mutex_unlock(&priv->action_mutex);
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->bg_band.channels);
      fail:
        if (dev) {
                if (registered)
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 87813c33bdc2..4ffebede5e03 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11425,16 +11425,23 @@ static void ipw_bg_down(struct work_struct *work)
 /* Called by register_netdev() */
 static int ipw_net_init(struct net_device *dev)
 {
+        int rc = 0;
+        struct ipw_priv *priv = libipw_priv(dev);
+        mutex_lock(&priv->mutex);
+        if (ipw_up(priv))
+                rc = -EIO;
+        mutex_unlock(&priv->mutex);
+        return rc;
+}
+static int ipw_wdev_init(struct net_device *dev)
+{
        int i, rc = 0;
        struct ipw_priv *priv = libipw_priv(dev);
        const struct libipw_geo *geo = libipw_get_geo(priv->ieee);
        struct wireless_dev *wdev = &priv->ieee->wdev;
-        mutex_lock(&priv->mutex);
-        if (ipw_up(priv)) {
-                rc = -EIO;
-                goto out;
-        }
        memcpy(wdev->wiphy->perm_addr, priv->mac_addr, ETH_ALEN);
@@ -11519,13 +11526,9 @@ static int ipw_net_init(struct net_device *dev)
        set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
        /* With that information in place, we can now register the wiphy... */
-        if (wiphy_register(wdev->wiphy)) {
+        if (wiphy_register(wdev->wiphy))
                rc = -EIO;
-                goto out;
-        }
 out:
-        mutex_unlock(&priv->mutex);
        return rc;
 }
@@ -11832,14 +11835,22 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                goto out_remove_sysfs;
        }
+        err = ipw_wdev_init(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register wireless device\n");
+                goto out_unregister_netdev;
+        }
 #ifdef CONFIG_IPW2200_PROMISCUOUS
        if (rtap_iface) {
                err = ipw_prom_alloc(priv);
                if (err) {
                        IPW_ERROR("Failed to register promiscuous network "
                                  "device (error %d).\n", err);
-                        unregister_netdev(priv->net_dev);
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
-                        goto out_remove_sysfs;
+                        kfree(priv->ieee->a_band.channels);
+                        kfree(priv->ieee->bg_band.channels);
+                        goto out_unregister_netdev;
                }
        }
 #endif
@@ -11851,6 +11862,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
        return 0;
+      out_unregister_netdev:
+        unregister_netdev(priv->net_dev);
      out_remove_sysfs:
        sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
      out_release_irq:
diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
index 35cd2537e7fd..e5971fe9d169 100644
--- a/drivers/net/wireless/iwlegacy/iwl-core.c
+++ b/drivers/net/wireless/iwlegacy/iwl-core.c
@@ -937,7 +937,7 @@ void iwl_legacy_irq_handle_error(struct iwl_priv *priv)
                                        &priv->contexts[IWL_RXON_CTX_BSS]);
 #endif
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /* Keep the restart process from trying to send host
         * commands by clearing the INIT status bit */
@@ -1746,7 +1746,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external)
        /* Set the FW error flag -- cleared on iwl_down */
        set_bit(STATUS_FW_ERROR, &priv->status);
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        /*
         * Keep the restart process from trying to send host
         * commands by clearing the INIT status bit
diff --git a/drivers/net/wireless/iwlegacy/iwl-hcmd.c b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
index 62b4b09122cb..ce1fc9feb61f 100644
--- a/drivers/net/wireless/iwlegacy/iwl-hcmd.c
+++ b/drivers/net/wireless/iwlegacy/iwl-hcmd.c
@@ -167,7 +167,7 @@ int iwl_legacy_send_cmd_sync(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
                goto out;
        }
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        !test_bit(STATUS_HCMD_ACTIVE, &priv->status),
                        HOST_COMPLETE_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl-tx.c b/drivers/net/wireless/iwlegacy/iwl-tx.c
index 4fff995c6f3e..ef9e268bf8a0 100644
--- a/drivers/net/wireless/iwlegacy/iwl-tx.c
+++ b/drivers/net/wireless/iwlegacy/iwl-tx.c
@@ -625,6 +625,8 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
        cmd = txq->cmd[cmd_index];
        meta = &txq->meta[cmd_index];
+        txq->time_stamp = jiffies;
        pci_unmap_single(priv->pci_dev,
                         dma_unmap_addr(meta, mapping),
                         dma_unmap_len(meta, len),
@@ -645,7 +647,7 @@ iwl_legacy_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
                clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
                IWL_DEBUG_INFO(priv, "Clearing HCMD_ACTIVE for command %s\n",
                               iwl_legacy_get_cmd_string(cmd->hdr.cmd));
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        /* Mark as unmapped */
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index 795826a014ed..66ee15629a76 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -841,7 +841,7 @@ static void iwl3945_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                                test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -2269,7 +2269,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
        iwl3945_reg_txpower_periodic(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        return;
@@ -2300,7 +2300,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2853,7 +2853,7 @@ static int iwl3945_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
index 14334668034e..aa0c2539761e 100644
--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
+++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
@@ -576,7 +576,7 @@ static void iwl4965_rx_card_state_notif(struct iwl_priv *priv,
                wiphy_rfkill_set_hw_state(priv->hw->wiphy,
                        test_bit(STATUS_RF_KILL_HW, &priv->status));
        else
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
 }
 /**
@@ -926,7 +926,7 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
                handled |= CSR_INT_BIT_FH_TX;
                /* Wake up uCode load routine, now that load is complete */
                priv->ucode_write_complete = 1;
-                wake_up_interruptible(&priv->wait_command_queue);
+                wake_up(&priv->wait_command_queue);
        }
        if (inta & ~handled) {
@@ -1795,7 +1795,7 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
        iwl4965_rf_kill_ct_config(priv);
        IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
-        wake_up_interruptible(&priv->wait_command_queue);
+        wake_up(&priv->wait_command_queue);
        iwl_legacy_power_update_mode(priv, true);
        IWL_DEBUG_INFO(priv, "Updated power mode\n");
@@ -1828,7 +1828,7 @@ static void __iwl4965_down(struct iwl_priv *priv)
        iwl_legacy_clear_driver_stations(priv);
        /* Unblock any waiting calls */
-        wake_up_interruptible_all(&priv->wait_command_queue);
+        wake_up_all(&priv->wait_command_queue);
        /* Wipe out the EXIT_PENDING status bit if we are not actually
         * exiting the module */
@@ -2266,7 +2266,7 @@ int iwl4965_mac_start(struct ieee80211_hw *hw)
        /* Wait for START_ALIVE from Run Time ucode. Otherwise callbacks from
         * mac80211 will not be run successfully. */
-        ret = wait_event_interruptible_timeout(priv->wait_command_queue,
+        ret = wait_event_timeout(priv->wait_command_queue,
                        test_bit(STATUS_READY, &priv->status),
                        UCODE_READY_TIMEOUT);
        if (!ret) {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index b0ae4de7f083..f9c3cd95d614 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2140,7 +2140,12 @@ static int iwl_mac_setup_register(struct iwl_priv *priv,
                    IEEE80211_HW_SPECTRUM_MGMT |
                    IEEE80211_HW_REPORTS_TX_ACK_STATUS;
+        /*
+         * Including the following line will crash some AP's.  This
+         * workaround removes the stimulus which causes the crash until
+         * the AP software can be fixed.
        hw->max_tx_aggregation_subframes = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+         */
        hw->flags |= IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS;
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index dd6937e97055..77e528f5db88 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -405,31 +405,33 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
        mutex_lock(&priv->mutex);
-        if (test_bit(STATUS_SCANNING, &priv->status) &&
-            priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
-        /* mac80211 will only ask for one band at a time */
-        priv->scan_request = req;
-        priv->scan_vif = vif;
        /*
         * If an internal scan is in progress, just set
         * up the scan_request as per above.
         */
        if (priv->scan_type != IWL_SCAN_NORMAL) {
-                IWL_DEBUG_SCAN(priv, "SCAN request during internal scan\n");
+                IWL_DEBUG_SCAN(priv,
+                               "SCAN request during internal scan - defer\n");
+                priv->scan_request = req;
+                priv->scan_vif = vif;
                ret = 0;
-        } else
+        } else {
+                priv->scan_request = req;
+                priv->scan_vif = vif;
+                /*
+                 * mac80211 will only ask for one band at a time
+                 * so using channels[0] here is ok
+                 */
                ret = iwl_scan_initiate(priv, vif, IWL_SCAN_NORMAL,
                                        req->channels[0]->band);
+                if (ret) {
+                        priv->scan_request = NULL;
+                        priv->scan_vif = NULL;
+                }
+        }
        IWL_DEBUG_MAC80211(priv, "leave\n");
-out_unlock:
        mutex_unlock(&priv->mutex);
        return ret;
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index ef67f6786a84..0019dfd8fb01 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -3697,14 +3697,15 @@ static void rt2800_efuse_read(struct rt2x00_dev *rt2x00dev, unsigned int i)
        rt2800_regbusy_read(rt2x00dev, EFUSE_CTRL, EFUSE_CTRL_KICK, &reg);
        /* Apparently the data is read from end to start */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3,
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA3, &reg);
-                                        (u32 *)&rt2x00dev->eeprom[i]);
+        /* The returned value is in CPU order, but eeprom is le */
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2,
+        rt2x00dev->eeprom[i] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 2]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA2, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1,
+        *(u32 *)&rt2x00dev->eeprom[i + 2] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 4]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA1, &reg);
-        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0,
+        *(u32 *)&rt2x00dev->eeprom[i + 4] = cpu_to_le32(reg);
-                                        (u32 *)&rt2x00dev->eeprom[i + 6]);
+        rt2800_register_read_lock(rt2x00dev, EFUSE_DATA0, &reg);
+        *(u32 *)&rt2x00dev->eeprom[i + 6] = cpu_to_le32(reg);
        mutex_unlock(&rt2x00dev->csr_mutex);
 }
@@ -3870,19 +3871,23 @@ int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
                return -ENODEV;
        }
-        if (!rt2x00_rf(rt2x00dev, RF2820) &&
+        switch (rt2x00dev->chip.rf) {
-            !rt2x00_rf(rt2x00dev, RF2850) &&
+        case RF2820:
-            !rt2x00_rf(rt2x00dev, RF2720) &&
+        case RF2850:
-            !rt2x00_rf(rt2x00dev, RF2750) &&
+        case RF2720:
-            !rt2x00_rf(rt2x00dev, RF3020) &&
+        case RF2750:
-            !rt2x00_rf(rt2x00dev, RF2020) &&
+        case RF3020:
-            !rt2x00_rf(rt2x00dev, RF3021) &&
+        case RF2020:
-            !rt2x00_rf(rt2x00dev, RF3022) &&
+        case RF3021:
-            !rt2x00_rf(rt2x00dev, RF3052) &&
+        case RF3022:
-            !rt2x00_rf(rt2x00dev, RF3320) &&
+        case RF3052:
-            !rt2x00_rf(rt2x00dev, RF5370) &&
+        case RF3320:
-            !rt2x00_rf(rt2x00dev, RF5390)) {
+        case RF5370:
-                ERROR(rt2x00dev, "Invalid RF chipset detected.\n");
+        case RF5390:
+                break;
+        default:
+                ERROR(rt2x00dev, "Invalid RF chipset 0x%x detected.\n",
+                      rt2x00dev->chip.rf);
                return -ENODEV;
        }
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 8b1cef0ffde6..4bf3cf457ef0 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -863,6 +863,7 @@ static void _rtl_usb_tx_preprocess(struct ieee80211_hw *hw, struct sk_buff *skb,
        u8 tid = 0;
        u16 seq_number = 0;
+        memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc));
        if (ieee80211_is_auth(fc)) {
                RT_TRACE(rtlpriv, COMP_SEND, DBG_DMESG, ("MAC80211_LINKING\n"));
                rtl_ips_nic_on(hw);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index cbde448f9947..eb3140ee821e 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -654,8 +654,8 @@ static struct io_subchannel_private console_priv;
 static int console_subchannel_in_use;
 /*
- * Use tpi to get a pending interrupt, call the interrupt handler and
+ * Use cio_tpi to get a pending interrupt and call the interrupt handler.
- * return a pointer to the subchannel structure.
+ * Return non-zero if an interrupt was processed, zero otherwise.
 */
 static int cio_tpi(void)
 {
@@ -667,6 +667,10 @@ static int cio_tpi(void)
        tpi_info = (struct tpi_info *)&S390_lowcore.subchannel_id;
        if (tpi(NULL) != 1)
                return 0;
+        if (tpi_info->adapter_IO) {
+                do_adapter_IO(tpi_info->isc);
+                return 1;
+        }
        irb = (struct irb *)&S390_lowcore.irb;
        /* Store interrupt response block to lowcore. */
        if (tsch(tpi_info->schid, irb) != 0)
diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index b7bd5b0cc7aa..3868ab2397c6 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -1800,10 +1800,12 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
        switch (retval) {
        case SCSI_MLQUEUE_HOST_BUSY:
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                break;
        case 1:
                tw_dev->state[request_id] = TW_S_COMPLETED;
                twa_free_request_id(tw_dev, request_id);
+                twa_unmap_scsi_data(tw_dev, request_id);
                SCpnt->result = (DID_ERROR << 16);
                done(SCpnt);
                retval = 0;
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 8d9dae89f065..3878b7395081 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -837,6 +837,7 @@ config SCSI_ISCI
        # (temporary): known alpha quality driver
        depends on EXPERIMENTAL
        select SCSI_SAS_LIBSAS
+        select SCSI_SAS_HOST_SMP
        ---help---
          This driver supports the 6Gb/s SAS capabilities of the storage
          control unit found in the Intel(R) C600 series chipset.
diff --git a/drivers/scsi/Makefile b/drivers/scsi/Makefile
index 3c08f5352b2d..6153a66a8a31 100644
--- a/drivers/scsi/Makefile
+++ b/drivers/scsi/Makefile
@@ -88,7 +88,7 @@ obj-$(CONFIG_SCSI_QLOGIC_FAS)	+= qlogicfas408.o	qlogicfas.o
 obj-$(CONFIG_PCMCIA_QLOGIC)     += qlogicfas408.o
 obj-$(CONFIG_SCSI_QLOGIC_1280)  += qla1280.o 
 obj-$(CONFIG_SCSI_QLA_FC)       += qla2xxx/
-obj-$(CONFIG_SCSI_QLA_ISCSI)    += qla4xxx/
+obj-$(CONFIG_SCSI_QLA_ISCSI)    += libiscsi.o qla4xxx/
 obj-$(CONFIG_SCSI_LPFC)         += lpfc/
 obj-$(CONFIG_SCSI_BFA_FC)       += bfa/
 obj-$(CONFIG_SCSI_PAS16)        += pas16.o
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index e7d0d47b9185..e5f2d7d9002e 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -1283,6 +1283,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced)
        kfree(aac->queues);
        aac->queues = NULL;
        free_irq(aac->pdev->irq, aac);
+        if (aac->msi)
+                pci_disable_msi(aac->pdev);
        kfree(aac->fsa_dev);
        aac->fsa_dev = NULL;
        quirks = aac_get_driver_ident(index)->quirks;
diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
index bd22041e2789..f58644850333 100644
--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
+++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c
@@ -913,7 +913,7 @@ static void l2t_put(struct cxgbi_sock *csk)
        struct t3cdev *t3dev = (struct t3cdev *)csk->cdev->lldev;
        if (csk->l2t) {
-                l2t_release(L2DATA(t3dev), csk->l2t);
+                l2t_release(t3dev, csk->l2t);
                csk->l2t = NULL;
                cxgbi_sock_put(csk);
        }
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index f84084bba2f0..c9e3dc024bc3 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -1721,7 +1721,7 @@ static int sas_find_bcast_dev(struct domain_device *dev,
        list_for_each_entry(ch, &ex->children, siblings) {
                if (ch->dev_type == EDGE_DEV || ch->dev_type == FANOUT_DEV) {
                        res = sas_find_bcast_dev(ch, src_dev);
-                        if (src_dev)
+                        if (*src_dev)
                                return res;
                }
        }
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 646fc5263d50..8a7591f035e6 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1507,8 +1507,8 @@ qla2x00_handle_dif_error(srb_t *sp, struct sts_entry_24xx *sts24)
                        if (k != blocks_done) {
                                qla_printk(KERN_WARNING, sp->fcport->vha->hw,
-                                    "unexpected tag values tag:lba=%x:%lx)\n",
+                                    "unexpected tag values tag:lba=%x:%llx)\n",
-                                    e_ref_tag, lba_s);
+                                    e_ref_tag, (unsigned long long)lba_s);
                                return 1;
                        }
diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
index d2407558773f..24cacff57786 100644
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -825,6 +825,9 @@ static void fsl_spi_cpm_free(struct mpc8xxx_spi *mspi)
 {
        struct device *dev = mspi->dev;
+        if (!(mspi->flags & SPI_CPM_MODE))
+                return;
        dma_unmap_single(dev, mspi->dma_dummy_rx, SPI_MRBLR, DMA_FROM_DEVICE);
        dma_unmap_single(dev, mspi->dma_dummy_tx, PAGE_SIZE, DMA_TO_DEVICE);
        cpm_muram_free(cpm_muram_offset(mspi->tx_bd));
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 8ac6542aedcd..fa594d604aca 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -786,9 +786,11 @@ static int __devinit spi_imx_probe(struct platform_device *pdev)
                int cs_gpio = of_get_named_gpio(np, "cs-gpios", i);
                if (cs_gpio < 0)
                        cs_gpio = mxc_platform_info->chipselect[i];
+                spi_imx->chipselect[i] = cs_gpio;
                if (cs_gpio < 0)
                        continue;
-                spi_imx->chipselect[i] = cs_gpio;
                ret = gpio_request(spi_imx->chipselect[i], DRIVER_NAME);
                if (ret) {
                        while (i > 0) {
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index a3f5162bfedc..462fbc20561f 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -1242,7 +1242,7 @@ static int zcache_pampd_get_data_and_free(char *data, size_t *bufsize, bool raw,
        int ret = 0;
        BUG_ON(!is_ephemeral(pool));
-        zbud_decompress(virt_to_page(data), pampd);
+        zbud_decompress((struct page *)(data), pampd);
        zbud_free_and_delist((struct zbud_hdr *)pampd);
        atomic_dec(&zcache_curr_eph_pampd_count);
        return ret;
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 410fba45378d..809cbda03d7a 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -494,15 +494,16 @@ static int hpwdt_pretimeout(struct notifier_block *nb, unsigned long ulReason,
                asminline_call(&cmn_regs, cru_rom_addr);
        die_nmi_called = 1;
        spin_unlock_irqrestore(&rom_lock, rom_pl);
+        if (allow_kdump)
+                hpwdt_stop();
        if (!is_icru) {
                if (cmn_regs.u1.ral == 0) {
-                        printk(KERN_WARNING "hpwdt: An NMI occurred, "
+                        panic("An NMI occurred, "
                                "but unable to determine source.\n");
                }
        }
-        if (allow_kdump)
-                hpwdt_stop();
        panic("An NMI occurred, please see the Integrated "
                "Management Log for details.\n");
diff --git a/drivers/watchdog/lantiq_wdt.c b/drivers/watchdog/lantiq_wdt.c
index 7d82adac1cb2..102aed0efbf1 100644
--- a/drivers/watchdog/lantiq_wdt.c
+++ b/drivers/watchdog/lantiq_wdt.c
@@ -51,16 +51,16 @@ static int ltq_wdt_ok_to_close;
 static void
 ltq_wdt_enable(void)
 {
-        ltq_wdt_timeout = ltq_wdt_timeout *
+        unsigned long int timeout = ltq_wdt_timeout *
                        (ltq_io_region_clk_rate / LTQ_WDT_DIVIDER) + 0x1000;
-        if (ltq_wdt_timeout > LTQ_MAX_TIMEOUT)
+        if (timeout > LTQ_MAX_TIMEOUT)
-                ltq_wdt_timeout = LTQ_MAX_TIMEOUT;
+                timeout = LTQ_MAX_TIMEOUT;
        /* write the first password magic */
        ltq_w32(LTQ_WDT_PW1, ltq_wdt_membase + LTQ_WDT_CR);
        /* write the second magic plus the configuration and new timeout */
        ltq_w32(LTQ_WDT_SR_EN | LTQ_WDT_SR_PWD | LTQ_WDT_SR_CLKDIV |
-                LTQ_WDT_PW2 | ltq_wdt_timeout, ltq_wdt_membase + LTQ_WDT_CR);
+                LTQ_WDT_PW2 | timeout, ltq_wdt_membase + LTQ_WDT_CR);
 }
 static void
diff --git a/drivers/watchdog/sbc_epx_c3.c b/drivers/watchdog/sbc_epx_c3.c
index 3066a5127ca8..eaca366b7234 100644
--- a/drivers/watchdog/sbc_epx_c3.c
+++ b/drivers/watchdog/sbc_epx_c3.c
@@ -173,7 +173,7 @@ static struct notifier_block epx_c3_notifier = {
        .notifier_call = epx_c3_notify_sys,
 };
-static const char banner[] __initdata = KERN_INFO PFX
+static const char banner[] __initconst = KERN_INFO PFX
        "Hardware Watchdog Timer for Winsystems EPX-C3 SBC: 0.1\n";
 static int __init watchdog_init(void)
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index d33520d0b4c9..1199da0f98cf 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -59,7 +59,7 @@ static struct watchdog_device *wdd;
 static int watchdog_ping(struct watchdog_device *wddev)
 {
-        if (test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (test_bit(WDOG_ACTIVE, &wddev->status)) {
                if (wddev->ops->ping)
                        return wddev->ops->ping(wddev);  /* ping the watchdog */
                else
@@ -81,12 +81,12 @@ static int watchdog_start(struct watchdog_device *wddev)
 {
        int err;
-        if (!test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (!test_bit(WDOG_ACTIVE, &wddev->status)) {
                err = wddev->ops->start(wddev);
                if (err < 0)
                        return err;
-                set_bit(WDOG_ACTIVE, &wdd->status);
+                set_bit(WDOG_ACTIVE, &wddev->status);
        }
        return 0;
 }
@@ -105,18 +105,18 @@ static int watchdog_stop(struct watchdog_device *wddev)
 {
        int err = -EBUSY;
-        if (test_bit(WDOG_NO_WAY_OUT, &wdd->status)) {
+        if (test_bit(WDOG_NO_WAY_OUT, &wddev->status)) {
                pr_info("%s: nowayout prevents watchdog to be stopped!\n",
-                                                        wdd->info->identity);
+                                                        wddev->info->identity);
                return err;
        }
-        if (test_bit(WDOG_ACTIVE, &wdd->status)) {
+        if (test_bit(WDOG_ACTIVE, &wddev->status)) {
                err = wddev->ops->stop(wddev);
                if (err < 0)
                        return err;
-                clear_bit(WDOG_ACTIVE, &wdd->status);
+                clear_bit(WDOG_ACTIVE, &wddev->status);
        }
        return 0;
 }
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index e0c2807b0970..181fa8158a8b 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -148,10 +148,10 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
        }
        platform_set_drvdata(pdev, bus);
-        /* Register all devices */
        pr_info("Zorro: Probing AutoConfig expansion devices: %u device%s\n",
                 zorro_num_autocon, zorro_num_autocon == 1 ? "" : "s");
+        /* First identify all devices ... */
        for (i = 0; i < zorro_num_autocon; i++) {
                z = &zorro_autocon[i];
                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
@@ -172,6 +172,11 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
                dev_set_name(&z->dev, "%02x", i);
                z->dev.parent = &bus->dev;
                z->dev.bus = &zorro_bus_type;
+        }
+        /* ... then register them */
+        for (i = 0; i < zorro_num_autocon; i++) {
+                z = &zorro_autocon[i];
                error = device_register(&z->dev);
                if (error) {
                        dev_err(&bus->dev, "Error registering device %s\n",
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index d11fd28efa6a..538f65a79ec5 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -2328,7 +2328,12 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
                        else
                                new_key.offset = destoff;
-                        trans = btrfs_start_transaction(root, 1);
+                        /*
+                         * 1 - adjusting old extent (we may have to split it)
+                         * 1 - add new extent
+                         * 1 - inode update
+                         */
+                        trans = btrfs_start_transaction(root, 3);
                        if (IS_ERR(trans)) {
                                ret = PTR_ERR(trans);
                                goto out;
diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index e76bfeb68267..30acd22147e1 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -351,9 +351,7 @@ static int
 build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
 {
        unsigned int dlen;
-        unsigned int wlen;
+        unsigned int size = 2 * sizeof(struct ntlmssp2_name);
-        unsigned int size = 6 * sizeof(struct ntlmssp2_name);
-        __le64  curtime;
        char *defdmname = "WORKGROUP";
        unsigned char *blobptr;
        struct ntlmssp2_name *attrptr;
@@ -365,15 +363,14 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
        }
        dlen = strlen(ses->domainName);
-        wlen = strlen(ses->server->hostname);
-        /* The length of this blob is a size which is
+        /*
-         * six times the size of a structure which holds name/size +
+         * The length of this blob is two times the size of a
-         * two times the unicode length of a domain name +
+         * structure (av pair) which holds name/size
-         * two times the unicode length of a server name +
+         * ( for NTLMSSP_AV_NB_DOMAIN_NAME followed by NTLMSSP_AV_EOL ) +
-         * size of a timestamp (which is 8 bytes).
+         * unicode length of a netbios domain name
         */
-        ses->auth_key.len = size + 2 * (2 * dlen) + 2 * (2 * wlen) + 8;
+        ses->auth_key.len = size + 2 * dlen;
        ses->auth_key.response = kzalloc(ses->auth_key.len, GFP_KERNEL);
        if (!ses->auth_key.response) {
                ses->auth_key.len = 0;
@@ -384,44 +381,15 @@ build_avpair_blob(struct cifs_ses *ses, const struct nls_table *nls_cp)
        blobptr = ses->auth_key.response;
        attrptr = (struct ntlmssp2_name *) blobptr;
+        /*
+         * As defined in MS-NTLM 3.3.2, just this av pair field
+         * is sufficient as part of the temp
+         */
        attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_DOMAIN_NAME);
        attrptr->length = cpu_to_le16(2 * dlen);
        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_NB_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_DOMAIN_NAME);
-        attrptr->length = cpu_to_le16(2 * dlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->domainName, dlen, nls_cp);
-        blobptr += 2 * dlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_DNS_COMPUTER_NAME);
-        attrptr->length = cpu_to_le16(2 * wlen);
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        cifs_strtoUCS((__le16 *)blobptr, ses->server->hostname, wlen, nls_cp);
-        blobptr += 2 * wlen;
-        attrptr = (struct ntlmssp2_name *) blobptr;
-        attrptr->type = cpu_to_le16(NTLMSSP_AV_TIMESTAMP);
-        attrptr->length = cpu_to_le16(sizeof(__le64));
-        blobptr = (unsigned char *)attrptr + sizeof(struct ntlmssp2_name);
-        curtime = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
-        memcpy(blobptr, &curtime, sizeof(__le64));
        return 0;
 }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index f93eb948d071..54b8f1e7da94 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -548,6 +548,12 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                struct inode *dir = dentry->d_inode;
                struct dentry *child;
+                if (!dir) {
+                        dput(dentry);
+                        dentry = ERR_PTR(-ENOENT);
+                        break;
+                }
                /* skip separators */
                while (*s == sep)
                        s++;
@@ -563,10 +569,6 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb)
                mutex_unlock(&dir->i_mutex);
                dput(dentry);
                dentry = child;
-                if (!dentry->d_inode) {
-                        dput(dentry);
-                        dentry = ERR_PTR(-ENOENT);
-                }
        } while (!IS_ERR(dentry));
        _FreeXid(xid);
        kfree(full_path);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index aac37d99a487..a80f7bd97b90 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4079,7 +4079,8 @@ int CIFSFindNext(const int xid, struct cifs_tcon *tcon,
        T2_FNEXT_RSP_PARMS *parms;
        char *response_data;
        int rc = 0;
-        int bytes_returned, name_len;
+        int bytes_returned;
+        unsigned int name_len;
        __u16 params, byte_count;
        cFYI(1, "In FindNext");
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 633c246b6775..f4af4cc37500 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1298,7 +1298,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        /* ignore */
                } else if (strnicmp(data, "guest", 5) == 0) {
                        /* ignore */
-                } else if (strnicmp(data, "rw", 2) == 0) {
+                } else if (strnicmp(data, "rw", 2) == 0 && strlen(data) == 2) {
                        /* ignore */
                } else if (strnicmp(data, "ro", 2) == 0) {
                        /* ignore */
@@ -1401,7 +1401,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
                        vol->server_ino = 1;
                } else if (strnicmp(data, "noserverino", 9) == 0) {
                        vol->server_ino = 0;
-                } else if (strnicmp(data, "rwpidforward", 4) == 0) {
+                } else if (strnicmp(data, "rwpidforward", 12) == 0) {
                        vol->rwpidforward = 1;
                } else if (strnicmp(data, "cifsacl", 7) == 0) {
                        vol->cifs_acl = 1;
diff --git a/fs/ext3/inode.c b/fs/ext3/inode.c
index 04da6acde85d..12661e1deedd 100644
--- a/fs/ext3/inode.c
+++ b/fs/ext3/inode.c
@@ -1134,7 +1134,7 @@ struct buffer_head *ext3_bread(handle_t *handle, struct inode *inode,
                return bh;
        if (buffer_uptodate(bh))
                return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
        wait_on_buffer(bh);
        if (buffer_uptodate(bh))
                return bh;
@@ -2807,7 +2807,7 @@ make_io:
                trace_ext3_load_inode(inode);
                get_bh(bh);
                bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh)) {
                        ext3_error(inode->i_sb, "ext3_get_inode_loc",
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 5571708b6a58..0629e09f6511 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -922,7 +922,8 @@ restart:
                                bh = ext3_getblk(NULL, dir, b++, 0, &err);
                                bh_use[ra_max] = bh;
                                if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                        }
                }
                if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 18d2558b7624..986e2388f031 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -647,7 +647,7 @@ struct buffer_head *ext4_bread(handle_t *handle, struct inode *inode,
                return bh;
        if (buffer_uptodate(bh))
                return bh;
-        ll_rw_block(READ_META, 1, &bh);
+        ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
        wait_on_buffer(bh);
        if (buffer_uptodate(bh))
                return bh;
@@ -3298,7 +3298,7 @@ make_io:
                trace_ext4_load_inode(inode);
                get_bh(bh);
                bh->b_end_io = end_buffer_read_sync;
-                submit_bh(READ_META, bh);
+                submit_bh(READ | REQ_META | REQ_PRIO, bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh)) {
                        EXT4_ERROR_INODE_BLOCK(inode, block,
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index f8068c7bae9f..1c924faeb6c8 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -922,7 +922,8 @@ restart:
                                bh = ext4_getblk(NULL, dir, b++, 0, &err);
                                bh_use[ra_max] = bh;
                                if (bh)
-                                        ll_rw_block(READ_META, 1, &bh);
+                                        ll_rw_block(READ | REQ_META | REQ_PRIO,
+                                                    1, &bh);
                        }
                }
                if ((bh = bh_use[ra_ptr++]) == NULL)
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 85c62923ee29..598646434362 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -624,9 +624,9 @@ static void log_write_header(struct gfs2_sbd *sdp, u32 flags, int pull)
        bh->b_end_io = end_buffer_write_sync;
        get_bh(bh);
        if (test_bit(SDF_NOBARRIERS, &sdp->sd_flags))
-                submit_bh(WRITE_SYNC | REQ_META, bh);
+                submit_bh(WRITE_SYNC | REQ_META | REQ_PRIO, bh);
        else
-                submit_bh(WRITE_FLUSH_FUA | REQ_META, bh);
+                submit_bh(WRITE_FLUSH_FUA | REQ_META | REQ_PRIO, bh);
        wait_on_buffer(bh);
        if (!buffer_uptodate(bh))
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 747238cd9f96..be29858900f6 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -37,7 +37,7 @@ static int gfs2_aspace_writepage(struct page *page, struct writeback_control *wb
 {
        struct buffer_head *bh, *head;
        int nr_underway = 0;
-        int write_op = REQ_META |
+        int write_op = REQ_META | REQ_PRIO |
                (wbc->sync_mode == WB_SYNC_ALL ? WRITE_SYNC : WRITE);
        BUG_ON(!PageLocked(page));
@@ -225,7 +225,7 @@ int gfs2_meta_read(struct gfs2_glock *gl, u64 blkno, int flags,
        }
        bh->b_end_io = end_buffer_read_sync;
        get_bh(bh);
-        submit_bh(READ_SYNC | REQ_META, bh);
+        submit_bh(READ_SYNC | REQ_META | REQ_PRIO, bh);
        if (!(flags & DIO_WAIT))
                return 0;
@@ -435,7 +435,7 @@ struct buffer_head *gfs2_meta_ra(struct gfs2_glock *gl, u64 dblock, u32 extlen)
        if (buffer_uptodate(first_bh))
                goto out;
        if (!buffer_locked(first_bh))
-                ll_rw_block(READ_SYNC | REQ_META, 1, &first_bh);
+                ll_rw_block(READ_SYNC | REQ_META | REQ_PRIO, 1, &first_bh);
        dblock++;
        extlen--;
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 3bc073a4cf82..079587e53849 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -224,7 +224,7 @@ static int gfs2_read_super(struct gfs2_sbd *sdp, sector_t sector, int silent)
        bio->bi_end_io = end_bio_io_page;
        bio->bi_private = page;
-        submit_bio(READ_SYNC | REQ_META, bio);
+        submit_bio(READ_SYNC | REQ_META | REQ_PRIO, bio);
        wait_on_page_locked(page);
        bio_put(bio);
        if (!PageUptodate(page)) {
diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
index 42e8d23bc047..0e8bb13381e4 100644
--- a/fs/gfs2/quota.c
+++ b/fs/gfs2/quota.c
@@ -709,7 +709,7 @@ get_a_page:
                set_buffer_uptodate(bh);
        if (!buffer_uptodate(bh)) {
-                ll_rw_block(READ_META, 1, &bh);
+                ll_rw_block(READ | REQ_META | REQ_PRIO, 1, &bh);
                wait_on_buffer(bh);
                if (!buffer_uptodate(bh))
                        goto unlock_out;
diff --git a/fs/namei.c b/fs/namei.c
index f4788365ea22..0b3138de2a3b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -721,12 +721,6 @@ static int follow_automount(struct path *path, unsigned flags,
        if (!path->dentry->d_op || !path->dentry->d_op->d_automount)
                return -EREMOTE;
-        /* We don't want to mount if someone supplied AT_NO_AUTOMOUNT
-         * and this is the terminal part of the path.
-         */
-        if ((flags & LOOKUP_NO_AUTOMOUNT) && !(flags & LOOKUP_PARENT))
-                return -EISDIR; /* we actually want to stop here */
        /* We don't want to mount if someone's just doing a stat -
         * unless they're stat'ing a directory and appended a '/' to
         * the name.
@@ -739,7 +733,7 @@ static int follow_automount(struct path *path, unsigned flags,
         * of the daemon to instantiate them before they can be used.
         */
        if (!(flags & (LOOKUP_PARENT | LOOKUP_DIRECTORY |
-                     LOOKUP_OPEN | LOOKUP_CREATE)) &&
+                     LOOKUP_OPEN | LOOKUP_CREATE | LOOKUP_AUTOMOUNT)) &&
            path->dentry->d_inode)
                return -EISDIR;
diff --git a/fs/namespace.c b/fs/namespace.c
index 22bfe8273c68..b4febb29d3bb 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1757,7 +1757,7 @@ static int do_loopback(struct path *path, char *old_name,
                return err;
        if (!old_name || !*old_name)
                return -EINVAL;
-        err = kern_path(old_name, LOOKUP_FOLLOW, &old_path);
+        err = kern_path(old_name, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &old_path);
        if (err)
                return err;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index 9b7dd7013b15..5b19b6aabe18 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -2798,7 +2798,7 @@ static struct dentry *nfs_follow_remote_path(struct vfsmount *root_mnt,
                goto out_put_mnt_ns;
        ret = vfs_path_lookup(root_mnt->mnt_root, root_mnt,
-                        export_path, LOOKUP_FOLLOW, &path);
+                        export_path, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
        nfs_referral_loop_unprotect();
        put_mnt_ns(ns_private);
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 25b6a887adb9..5afaa58a8630 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -877,30 +877,54 @@ struct numa_maps_private {
        struct numa_maps md;
 };
-static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty)
+static void gather_stats(struct page *page, struct numa_maps *md, int pte_dirty,
+                        unsigned long nr_pages)
 {
        int count = page_mapcount(page);
-        md->pages++;
+        md->pages += nr_pages;
        if (pte_dirty || PageDirty(page))
-                md->dirty++;
+                md->dirty += nr_pages;
        if (PageSwapCache(page))
-                md->swapcache++;
+                md->swapcache += nr_pages;
        if (PageActive(page) || PageUnevictable(page))
-                md->active++;
+                md->active += nr_pages;
        if (PageWriteback(page))
-                md->writeback++;
+                md->writeback += nr_pages;
        if (PageAnon(page))
-                md->anon++;
+                md->anon += nr_pages;
        if (count > md->mapcount_max)
                md->mapcount_max = count;
-        md->node[page_to_nid(page)]++;
+        md->node[page_to_nid(page)] += nr_pages;
+}
+static struct page *can_gather_numa_stats(pte_t pte, struct vm_area_struct *vma,
+                unsigned long addr)
+{
+        struct page *page;
+        int nid;
+        if (!pte_present(pte))
+                return NULL;
+        page = vm_normal_page(vma, addr, pte);
+        if (!page)
+                return NULL;
+        if (PageReserved(page))
+                return NULL;
+        nid = page_to_nid(page);
+        if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
+                return NULL;
+        return page;
 }
 static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
@@ -912,26 +936,32 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
        pte_t *pte;
        md = walk->private;
-        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        spin_lock(&walk->mm->page_table_lock);
-        do {
+        if (pmd_trans_huge(*pmd)) {
-                struct page *page;
+                if (pmd_trans_splitting(*pmd)) {
-                int nid;
+                        spin_unlock(&walk->mm->page_table_lock);
+                        wait_split_huge_page(md->vma->anon_vma, pmd);
+                } else {
+                        pte_t huge_pte = *(pte_t *)pmd;
+                        struct page *page;
-                if (!pte_present(*pte))
+                        page = can_gather_numa_stats(huge_pte, md->vma, addr);
-                        continue;
+                        if (page)
+                                gather_stats(page, md, pte_dirty(huge_pte),
+                                                HPAGE_PMD_SIZE/PAGE_SIZE);
+                        spin_unlock(&walk->mm->page_table_lock);
+                        return 0;
+                }
+        } else {
+                spin_unlock(&walk->mm->page_table_lock);
+        }
-                page = vm_normal_page(md->vma, addr, *pte);
+        orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+        do {
+                struct page *page = can_gather_numa_stats(*pte, md->vma, addr);
                if (!page)
                        continue;
+                gather_stats(page, md, pte_dirty(*pte), 1);
-                if (PageReserved(page))
-                        continue;
-                nid = page_to_nid(page);
-                if (!node_isset(nid, node_states[N_HIGH_MEMORY]))
-                        continue;
-                gather_stats(page, md, pte_dirty(*pte));
        } while (pte++, addr += PAGE_SIZE, addr != end);
        pte_unmap_unlock(orig_pte, ptl);
@@ -952,7 +982,7 @@ static int gather_hugetbl_stats(pte_t *pte, unsigned long hmask,
                return 0;
        md = walk->private;
-        gather_stats(page, md, pte_dirty(*pte));
+        gather_stats(page, md, pte_dirty(*pte), 1);
        return 0;
 }
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b34bdb25490c..10b6be3ca280 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -355,7 +355,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
         * resolution (think about autofs) and thus deadlocks could arise.
         */
        if (cmds == Q_QUOTAON) {
-                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW|LOOKUP_AUTOMOUNT, &path);
                if (ret)
                        pathp = ERR_PTR(ret);
                else
diff --git a/fs/stat.c b/fs/stat.c
index ba5316ffac61..78a3aa83c7ea 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -81,8 +81,6 @@ int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat,
        if (!(flag & AT_SYMLINK_NOFOLLOW))
                lookup_flags |= LOOKUP_FOLLOW;
-        if (flag & AT_NO_AUTOMOUNT)
-                lookup_flags |= LOOKUP_NO_AUTOMOUNT;
        if (flag & AT_EMPTY_PATH)
                lookup_flags |= LOOKUP_EMPTY;
diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
index 32f0076e844b..71fc53bb8f1c 100644
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -124,6 +124,7 @@ enum rq_flag_bits {
        __REQ_SYNC,             /* request is sync (sync write or read) */
        __REQ_META,             /* metadata io request */
+        __REQ_PRIO,             /* boost priority in cfq */
        __REQ_DISCARD,          /* request to discard sectors */
        __REQ_SECURE,           /* secure discard (used with __REQ_DISCARD) */
@@ -161,14 +162,15 @@ enum rq_flag_bits {
 #define REQ_FAILFAST_DRIVER     (1 << __REQ_FAILFAST_DRIVER)
 #define REQ_SYNC                (1 << __REQ_SYNC)
 #define REQ_META                (1 << __REQ_META)
+#define REQ_PRIO                (1 << __REQ_PRIO)
 #define REQ_DISCARD             (1 << __REQ_DISCARD)
 #define REQ_NOIDLE              (1 << __REQ_NOIDLE)
 #define REQ_FAILFAST_MASK \
        (REQ_FAILFAST_DEV | REQ_FAILFAST_TRANSPORT | REQ_FAILFAST_DRIVER)
 #define REQ_COMMON_MASK \
-        (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_DISCARD | \
+        (REQ_WRITE | REQ_FAILFAST_MASK | REQ_SYNC | REQ_META | REQ_PRIO | \
-         REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
+         REQ_DISCARD | REQ_NOIDLE | REQ_FLUSH | REQ_FUA | REQ_SECURE)
 #define REQ_CLONE_MASK          REQ_COMMON_MASK
 #define REQ_RAHEAD              (1 << __REQ_RAHEAD)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 84b15d54f8c2..7fbaa9103344 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -873,7 +873,6 @@ struct blk_plug {
        struct list_head list;
        struct list_head cb_list;
        unsigned int should_sort;
-        unsigned int count;
 };
 #define BLK_MAX_REQUEST_COUNT 16
diff --git a/include/linux/fs.h b/include/linux/fs.h
index c2bd68f2277a..277f497923a2 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -162,10 +162,8 @@ struct inodes_stat_t {
 #define READA                   RWA_MASK
 #define READ_SYNC               (READ | REQ_SYNC)
-#define READ_META               (READ | REQ_META)
 #define WRITE_SYNC              (WRITE | REQ_SYNC | REQ_NOIDLE)
 #define WRITE_ODIRECT           (WRITE | REQ_SYNC)
-#define WRITE_META              (WRITE | REQ_META)
 #define WRITE_FLUSH             (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FLUSH)
 #define WRITE_FUA               (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FUA)
 #define WRITE_FLUSH_FUA         (WRITE | REQ_SYNC | REQ_NOIDLE | REQ_FLUSH | REQ_FUA)
diff --git a/include/linux/irqdomain.h b/include/linux/irqdomain.h
index e807ad687a07..3ad553e8eae2 100644
--- a/include/linux/irqdomain.h
+++ b/include/linux/irqdomain.h
@@ -80,6 +80,7 @@ extern void irq_domain_del(struct irq_domain *domain);
 #endif /* CONFIG_IRQ_DOMAIN */
 #if defined(CONFIG_IRQ_DOMAIN) && defined(CONFIG_OF_IRQ)
+extern struct irq_domain_ops irq_domain_simple_ops;
 extern void irq_domain_add_simple(struct device_node *controller, int irq_base);
 extern void irq_domain_generate_simple(const struct of_device_id *match,
                                        u64 phys_base, unsigned int irq_start);
diff --git a/include/linux/kvm.h b/include/linux/kvm.h
index 2c366b52f505..aace6b8691a2 100644
--- a/include/linux/kvm.h
+++ b/include/linux/kvm.h
@@ -553,6 +553,7 @@ struct kvm_ppc_pvinfo {
 #define KVM_CAP_SPAPR_TCE 63
 #define KVM_CAP_PPC_SMT 64
 #define KVM_CAP_PPC_RMA 65
+#define KVM_CAP_S390_GMAP 71
 #ifdef KVM_CAP_IRQ_ROUTING
diff --git a/include/linux/namei.h b/include/linux/namei.h
index 76fe2c62ae71..409328d1cbbb 100644
--- a/include/linux/namei.h
+++ b/include/linux/namei.h
@@ -48,11 +48,12 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
 */
 #define LOOKUP_FOLLOW           0x0001
 #define LOOKUP_DIRECTORY        0x0002
+#define LOOKUP_AUTOMOUNT        0x0004
 #define LOOKUP_PARENT           0x0010
 #define LOOKUP_REVAL            0x0020
 #define LOOKUP_RCU              0x0040
-#define LOOKUP_NO_AUTOMOUNT     0x0080
 /*
 * Intent data
 */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4ac2c0578e0f..41d0237fd449 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1956,7 +1956,6 @@ static inline void disable_sched_clock_irqtime(void) {}
 extern unsigned long long
 task_sched_runtime(struct task_struct *task);
-extern unsigned long long thread_group_sched_runtime(struct task_struct *task);
 /* sched_exec is called by processes performing an exec */
 #ifdef CONFIG_SMP
diff --git a/include/trace/events/writeback.h b/include/trace/events/writeback.h
index 6bca4cc0063c..5f172703eb4f 100644
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -298,7 +298,7 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                __array(char, name, 32)
                __field(unsigned long, ino)
                __field(unsigned long, state)
-                __field(unsigned long, age)
+                __field(unsigned long, dirtied_when)
                __field(unsigned long, writeback_index)
                __field(long, nr_to_write)
                __field(unsigned long, wrote)
@@ -309,19 +309,19 @@ DECLARE_EVENT_CLASS(writeback_single_inode_template,
                        dev_name(inode->i_mapping->backing_dev_info->dev), 32);
                __entry->ino            = inode->i_ino;
                __entry->state          = inode->i_state;
-                __entry->age            = (jiffies - inode->dirtied_when) *
+                __entry->dirtied_when   = inode->dirtied_when;
-                                                                1000 / HZ;
                __entry->writeback_index = inode->i_mapping->writeback_index;
                __entry->nr_to_write    = nr_to_write;
                __entry->wrote          = nr_to_write - wbc->nr_to_write;
        ),
-        TP_printk("bdi %s: ino=%lu state=%s age=%lu "
+        TP_printk("bdi %s: ino=%lu state=%s dirtied_when=%lu age=%lu "
                  "index=%lu to_write=%ld wrote=%lu",
                  __entry->name,
                  __entry->ino,
                  show_inode_state(__entry->state),
-                  __entry->age,
+                  __entry->dirtied_when,
+                  (jiffies - __entry->dirtied_when) / HZ,
                  __entry->writeback_index,
                  __entry->nr_to_write,
                  __entry->wrote
diff --git a/init/main.c b/init/main.c
index 9c51ee7adf3d..03b408dff825 100644
--- a/init/main.c
+++ b/init/main.c
@@ -209,8 +209,19 @@ early_param("quiet", quiet_kernel);
 static int __init loglevel(char *str)
 {
-        get_option(&str, &console_loglevel);
+        int newlevel;
-        return 0;
+        /*
+         * Only update loglevel value when a correct setting was passed,
+         * to prevent blind crashes (when loglevel being set to 0) that
+         * are quite hard to debug
+         */
+        if (get_option(&str, &newlevel)) {
+                console_loglevel = newlevel;
+                return 0;
+        }
+        return -EINVAL;
 }
 early_param("loglevel", loglevel);
@@ -370,9 +381,6 @@ static noinline void __init_refok rest_init(void)
        preempt_enable_no_resched();
        schedule();
-        /* At this point, we can enable user mode helper functionality */
-        usermodehelper_enable();
        /* Call into cpu_idle with preempt disabled */
        preempt_disable();
        cpu_idle();
@@ -722,6 +730,7 @@ static void __init do_basic_setup(void)
        driver_init();
        init_irq_proc();
        do_ctors();
+        usermodehelper_enable();
        do_initcalls();
 }
diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c
index d5828da3fd38..b57a3776de44 100644
--- a/kernel/irq/irqdomain.c
+++ b/kernel/irq/irqdomain.c
@@ -29,7 +29,11 @@ void irq_domain_add(struct irq_domain *domain)
         */
        for (hwirq = 0; hwirq < domain->nr_irq; hwirq++) {
                d = irq_get_irq_data(irq_domain_to_irq(domain, hwirq));
-                if (d || d->domain) {
+                if (!d) {
+                        WARN(1, "error: assigning domain to non existant irq_desc");
+                        return;
+                }
+                if (d->domain) {
                        /* things are broken; just report, don't clean up */
                        WARN(1, "error: irq_desc already assigned to a domain");
                        return;
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index 58f405b581e7..c8008dd58ef2 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -250,7 +250,7 @@ void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
        do {
                times->utime = cputime_add(times->utime, t->utime);
                times->stime = cputime_add(times->stime, t->stime);
-                times->sum_exec_runtime += t->se.sum_exec_runtime;
+                times->sum_exec_runtime += task_sched_runtime(t);
        } while_each_thread(tsk, t);
 out:
        rcu_read_unlock();
@@ -312,7 +312,8 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
                cpu->cpu = cputime.utime;
                break;
        case CPUCLOCK_SCHED:
-                cpu->sched = thread_group_sched_runtime(p);
+                thread_group_cputime(p, &cputime);
+                cpu->sched = cputime.sum_exec_runtime;
                break;
        }
        return 0;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 9de3ecfd20f9..a70d2a5d8c7b 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -744,20 +744,17 @@ int ptrace_request(struct task_struct *child, long request,
                        break;
                si = child->last_siginfo;
-                if (unlikely(!si || si->si_code >> 8 != PTRACE_EVENT_STOP))
+                if (likely(si && (si->si_code >> 8) == PTRACE_EVENT_STOP)) {
-                        break;
+                        child->jobctl |= JOBCTL_LISTENING;
+                        /*
-                child->jobctl |= JOBCTL_LISTENING;
+                         * If NOTIFY is set, it means event happened between
+                         * start of this trap and now.  Trigger re-trap.
-                /*
+                         */
-                 * If NOTIFY is set, it means event happened between start
+                        if (child->jobctl & JOBCTL_TRAP_NOTIFY)
-                 * of this trap and now.  Trigger re-trap immediately.
+                                signal_wake_up(child, true);
-                 */
+                        ret = 0;
-                if (child->jobctl & JOBCTL_TRAP_NOTIFY)
+                }
-                        signal_wake_up(child, true);
                unlock_task_sighand(child, &flags);
-                ret = 0;
                break;
        case PTRACE_DETACH:      /* detach a process that was attached. */
diff --git a/kernel/resource.c b/kernel/resource.c
index 3b3cedc52592..c8dc249da5ce 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -419,6 +419,9 @@ static int __find_resource(struct resource *root, struct resource *old,
                else
                        tmp.end = root->end;
+                if (tmp.end < tmp.start)
+                        goto next;
                resource_clip(&tmp, constraint->min, constraint->max);
                arch_remove_reservations(&tmp);
@@ -436,8 +439,10 @@ static int __find_resource(struct resource *root, struct resource *old,
                                return 0;
                        }
                }
-                if (!this)
+next:           if (!this || this->end == root->end)
                        break;
                if (this != old)
                        tmp.start = this->end + 1;
                this = this->sibling;
diff --git a/kernel/sched.c b/kernel/sched.c
index ec5f472bc5b9..b50b0f0c9aa9 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3725,30 +3725,6 @@ unsigned long long task_sched_runtime(struct task_struct *p)
 }
 /*
- * Return sum_exec_runtime for the thread group.
- * In case the task is currently running, return the sum plus current's
- * pending runtime that have not been accounted yet.
- *
- * Note that the thread group might have other running tasks as well,
- * so the return value not includes other pending runtime that other
- * running tasks might have.
- */
-unsigned long long thread_group_sched_runtime(struct task_struct *p)
-{
-        struct task_cputime totals;
-        unsigned long flags;
-        struct rq *rq;
-        u64 ns;
-        rq = task_rq_lock(p, &flags);
-        thread_group_cputime(p, &totals);
-        ns = totals.sum_exec_runtime + do_task_delta_exec(p, rq);
-        task_rq_unlock(rq, p, &flags);
-        return ns;
-}
-/*
 * Account user cpu time to a process.
 * @p: the process that the cpu time gets accounted to
 * @cputime: the cpu time spent in user space since the last update
@@ -4372,7 +4348,7 @@ static inline void sched_submit_work(struct task_struct *tsk)
                blk_schedule_flush_plug(tsk);
 }
-asmlinkage void schedule(void)
+asmlinkage void __sched schedule(void)
 {
        struct task_struct *tsk = current;
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 97540f0c9e47..af1177858be3 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -1050,7 +1050,7 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
         */
        if (curr && unlikely(rt_task(curr)) &&
            (curr->rt.nr_cpus_allowed < 2 ||
-             curr->prio < p->prio) &&
+             curr->prio <= p->prio) &&
            (p->rt.nr_cpus_allowed > 1)) {
                int target = find_lowest_rq(p);
@@ -1581,7 +1581,7 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
            p->rt.nr_cpus_allowed > 1 &&
            rt_task(rq->curr) &&
            (rq->curr->rt.nr_cpus_allowed < 2 ||
-             rq->curr->prio < p->prio))
+             rq->curr->prio <= p->prio))
                push_rt_tasks(rq);
 }
diff --git a/lib/xz/xz_dec_bcj.c b/lib/xz/xz_dec_bcj.c
index e51e2558ca9d..a768e6d28bbb 100644
--- a/lib/xz/xz_dec_bcj.c
+++ b/lib/xz/xz_dec_bcj.c
@@ -441,8 +441,12 @@ XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s,
         * next filter in the chain. Apply the BCJ filter on the new data
         * in the output buffer. If everything cannot be filtered, copy it
         * to temp and rewind the output buffer position accordingly.
+         *
+         * This needs to be always run when temp.size == 0 to handle a special
+         * case where the output buffer is full and the next filter has no
+         * more output coming but hasn't returned XZ_STREAM_END yet.
         */
-        if (s->temp.size < b->out_size - b->out_pos) {
+        if (s->temp.size < b->out_size - b->out_pos || s->temp.size == 0) {
                out_start = b->out_pos;
                memcpy(b->out + b->out_pos, s->temp.buf, s->temp.size);
                b->out_pos += s->temp.size;
@@ -465,16 +469,25 @@ XZ_EXTERN enum xz_ret xz_dec_bcj_run(struct xz_dec_bcj *s,
                s->temp.size = b->out_pos - out_start;
                b->out_pos -= s->temp.size;
                memcpy(s->temp.buf, b->out + b->out_pos, s->temp.size);
+                /*
+                 * If there wasn't enough input to the next filter to fill
+                 * the output buffer with unfiltered data, there's no point
+                 * to try decoding more data to temp.
+                 */
+                if (b->out_pos + s->temp.size < b->out_size)
+                        return XZ_OK;
        }
        /*
-         * If we have unfiltered data in temp, try to fill by decoding more
+         * We have unfiltered data in temp. If the output buffer isn't full
-         * data from the next filter. Apply the BCJ filter on temp. Then we
+         * yet, try to fill the temp buffer by decoding more data from the
-         * hopefully can fill the actual output buffer by copying filtered
+         * next filter. Apply the BCJ filter on temp. Then we hopefully can
-         * data from temp. A mix of filtered and unfiltered data may be left
+         * fill the actual output buffer by copying filtered data from temp.
-         * in temp; it will be taken care on the next call to this function.
+         * A mix of filtered and unfiltered data may be left in temp; it will
+         * be taken care on the next call to this function.
         */
-        if (s->temp.size > 0) {
+        if (b->out_pos < b->out_size) {
                /* Make b->out{,_pos,_size} temporarily point to s->temp. */
                s->out = b->out;
                s->out_pos = b->out_pos;
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index d6edf8d14f9c..a87da524a4a0 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -359,6 +359,17 @@ static unsigned long bdi_longest_inactive(void)
        return max(5UL * 60 * HZ, interval);
 }
+/*
+ * Clear pending bit and wakeup anybody waiting for flusher thread creation or
+ * shutdown
+ */
+static void bdi_clear_pending(struct backing_dev_info *bdi)
+{
+        clear_bit(BDI_pending, &bdi->state);
+        smp_mb__after_clear_bit();
+        wake_up_bit(&bdi->state, BDI_pending);
+}
 static int bdi_forker_thread(void *ptr)
 {
        struct bdi_writeback *me = ptr;
@@ -390,6 +401,13 @@ static int bdi_forker_thread(void *ptr)
                }
                spin_lock_bh(&bdi_lock);
+                /*
+                 * In the following loop we are going to check whether we have
+                 * some work to do without any synchronization with tasks
+                 * waking us up to do work for them. So we have to set task
+                 * state already here so that we don't miss wakeups coming
+                 * after we verify some condition.
+                 */
                set_current_state(TASK_INTERRUPTIBLE);
                list_for_each_entry(bdi, &bdi_list, bdi_list) {
@@ -469,11 +487,13 @@ static int bdi_forker_thread(void *ptr)
                                spin_unlock_bh(&bdi->wb_lock);
                                wake_up_process(task);
                        }
+                        bdi_clear_pending(bdi);
                        break;
                case KILL_THREAD:
                        __set_current_state(TASK_RUNNING);
                        kthread_stop(task);
+                        bdi_clear_pending(bdi);
                        break;
                case NO_ACTION:
@@ -489,16 +509,8 @@ static int bdi_forker_thread(void *ptr)
                        else
                                schedule_timeout(msecs_to_jiffies(dirty_writeback_interval * 10));
                        try_to_freeze();
-                        /* Back to the main loop */
+                        break;
-                        continue;
                }
-                /*
-                 * Clear pending bit and wakeup anybody waiting to tear us down.
-                 */
-                clear_bit(BDI_pending, &bdi->state);
-                smp_mb__after_clear_bit();
-                wake_up_bit(&bdi->state, BDI_pending);
        }
        return 0;
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 3e2f91ffa4e2..05dd35114a27 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -565,7 +565,7 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        struct orig_node *orig_node = NULL;
        int data_len = skb->len, ret;
        short vid = -1;
-        bool do_bcast = false;
+        bool do_bcast;
        if (atomic_read(&bat_priv->mesh_state) != MESH_ACTIVE)
                goto dropped;
@@ -598,15 +598,15 @@ static int interface_tx(struct sk_buff *skb, struct net_device *soft_iface)
        tt_local_add(soft_iface, ethhdr->h_source);
        orig_node = transtable_search(bat_priv, ethhdr->h_dest);
-        if (is_multicast_ether_addr(ethhdr->h_dest) ||
+        do_bcast = is_multicast_ether_addr(ethhdr->h_dest);
-                                (orig_node && orig_node->gw_flags)) {
+        if (do_bcast || (orig_node && orig_node->gw_flags)) {
                ret = gw_is_target(bat_priv, skb, orig_node);
                if (ret < 0)
                        goto dropped;
-                if (ret == 0)
+                if (ret)
-                        do_bcast = true;
+                        do_bcast = false;
        }
        /* ethernet packet should be broadcasted */
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index a40170e022e8..7ef4eb4435fb 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -58,8 +58,8 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
        if (status)
                return;
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                        test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
@@ -76,8 +76,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
        if (status)
                return;
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                                test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_conn_check_pending(hdev);
@@ -959,9 +959,8 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
                return;
        }
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
-                                        !test_and_set_bit(HCI_INQUIRY,
+                                test_bit(HCI_MGMT, &hdev->flags))
-                                                        &hdev->flags))
                mgmt_discovering(hdev->id, 1);
 }
@@ -1340,8 +1339,8 @@ static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff
        BT_DBG("%s status %d", hdev->name, status);
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+                                test_bit(HCI_MGMT, &hdev->flags))
                mgmt_discovering(hdev->id, 0);
        hci_req_complete(hdev, HCI_OP_INQUIRY, status);
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index 132963abc266..2883ea01e680 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -232,6 +232,7 @@ void ceph_destroy_options(struct ceph_options *opt)
                ceph_crypto_key_destroy(opt->key);
                kfree(opt->key);
        }
+        kfree(opt->mon_addr);
        kfree(opt);
 }
 EXPORT_SYMBOL(ceph_destroy_options);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index c340e2e0765b..9918e9eb276e 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -2307,6 +2307,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
        m->front_max = front_len;
        m->front_is_vmalloc = false;
        m->more_to_follow = false;
+        m->ack_stamp = 0;
        m->pool = NULL;
        /* middle */
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 16836a7df7a6..88ad8a2501b5 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -217,6 +217,7 @@ struct ceph_osd_request *ceph_osdc_alloc_request(struct ceph_osd_client *osdc,
        INIT_LIST_HEAD(&req->r_unsafe_item);
        INIT_LIST_HEAD(&req->r_linger_item);
        INIT_LIST_HEAD(&req->r_linger_osd);
+        INIT_LIST_HEAD(&req->r_req_lru_item);
        req->r_flags = flags;
        WARN_ON((flags & (CEPH_OSD_FLAG_READ|CEPH_OSD_FLAG_WRITE)) == 0);
@@ -816,13 +817,10 @@ static void __register_request(struct ceph_osd_client *osdc,
 {
        req->r_tid = ++osdc->last_tid;
        req->r_request->hdr.tid = cpu_to_le64(req->r_tid);
-        INIT_LIST_HEAD(&req->r_req_lru_item);
        dout("__register_request %p tid %lld\n", req, req->r_tid);
        __insert_request(osdc, req);
        ceph_osdc_get_request(req);
        osdc->num_requests++;
        if (osdc->num_requests == 1) {
                dout(" first request, scheduling timeout\n");
                __schedule_osd_timeout(osdc);
diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
index e97c3588c3ec..fd863fe76934 100644
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -339,6 +339,7 @@ static int __insert_pg_mapping(struct ceph_pg_mapping *new,
        struct ceph_pg_mapping *pg = NULL;
        int c;
+        dout("__insert_pg_mapping %llx %p\n", *(u64 *)&new->pgid, new);
        while (*p) {
                parent = *p;
                pg = rb_entry(parent, struct ceph_pg_mapping, node);
@@ -366,16 +367,33 @@ static struct ceph_pg_mapping *__lookup_pg_mapping(struct rb_root *root,
        while (n) {
                pg = rb_entry(n, struct ceph_pg_mapping, node);
                c = pgid_cmp(pgid, pg->pgid);
-                if (c < 0)
+                if (c < 0) {
                        n = n->rb_left;
-                else if (c > 0)
+                } else if (c > 0) {
                        n = n->rb_right;
-                else
+                } else {
+                        dout("__lookup_pg_mapping %llx got %p\n",
+                             *(u64 *)&pgid, pg);
                        return pg;
+                }
        }
        return NULL;
 }
+static int __remove_pg_mapping(struct rb_root *root, struct ceph_pg pgid)
+{
+        struct ceph_pg_mapping *pg = __lookup_pg_mapping(root, pgid);
+        if (pg) {
+                dout("__remove_pg_mapping %llx %p\n", *(u64 *)&pgid, pg);
+                rb_erase(&pg->node, root);
+                kfree(pg);
+                return 0;
+        }
+        dout("__remove_pg_mapping %llx dne\n", *(u64 *)&pgid);
+        return -ENOENT;
+}
 /*
 * rbtree of pg pool info
 */
@@ -711,7 +729,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        void *start = *p;
        int err = -EINVAL;
        u16 version;
-        struct rb_node *rbp;
        ceph_decode_16_safe(p, end, version, bad);
        if (version > CEPH_OSDMAP_INC_VERSION) {
@@ -861,7 +878,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
        }
        /* new_pg_temp */
-        rbp = rb_first(&map->pg_temp);
        ceph_decode_32_safe(p, end, len, bad);
        while (len--) {
                struct ceph_pg_mapping *pg;
@@ -872,18 +888,6 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                ceph_decode_copy(p, &pgid, sizeof(pgid));
                pglen = ceph_decode_32(p);
-                /* remove any? */
-                while (rbp && pgid_cmp(rb_entry(rbp, struct ceph_pg_mapping,
-                                                node)->pgid, pgid) <= 0) {
-                        struct ceph_pg_mapping *cur =
-                                rb_entry(rbp, struct ceph_pg_mapping, node);
-                        rbp = rb_next(rbp);
-                        dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                        rb_erase(&cur->node, &map->pg_temp);
-                        kfree(cur);
-                }
                if (pglen) {
                        /* insert */
                        ceph_decode_need(p, end, pglen*sizeof(u32), bad);
@@ -903,17 +907,11 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                        }
                        dout(" added pg_temp %llx len %d\n", *(u64 *)&pgid,
                             pglen);
+                } else {
+                        /* remove */
+                        __remove_pg_mapping(&map->pg_temp, pgid);
                }
        }
-        while (rbp) {
-                struct ceph_pg_mapping *cur =
-                        rb_entry(rbp, struct ceph_pg_mapping, node);
-                rbp = rb_next(rbp);
-                dout(" removed pg_temp %llx\n", *(u64 *)&cur->pgid);
-                rb_erase(&cur->node, &map->pg_temp);
-                kfree(cur);
-        }
        /* ignore the rest */
        *p = end;
@@ -1046,10 +1044,25 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        struct ceph_pg_mapping *pg;
        struct ceph_pg_pool_info *pool;
        int ruleno;
-        unsigned poolid, ps, pps;
+        unsigned poolid, ps, pps, t;
        int preferred;
+        poolid = le32_to_cpu(pgid.pool);
+        ps = le16_to_cpu(pgid.ps);
+        preferred = (s16)le16_to_cpu(pgid.preferred);
+        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
+        if (!pool)
+                return NULL;
        /* pg_temp? */
+        if (preferred >= 0)
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.lpg_num),
+                                    pool->lpgp_num_mask);
+        else
+                t = ceph_stable_mod(ps, le32_to_cpu(pool->v.pg_num),
+                                    pool->pgp_num_mask);
+        pgid.ps = cpu_to_le16(t);
        pg = __lookup_pg_mapping(&osdmap->pg_temp, pgid);
        if (pg) {
                *num = pg->len;
@@ -1057,18 +1070,6 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
        }
        /* crush */
-        poolid = le32_to_cpu(pgid.pool);
-        ps = le16_to_cpu(pgid.ps);
-        preferred = (s16)le16_to_cpu(pgid.preferred);
-        /* don't forcefeed bad device ids to crush */
-        if (preferred >= osdmap->max_osd ||
-            preferred >= osdmap->crush->max_devices)
-                preferred = -1;
-        pool = __lookup_pg_pool(&osdmap->pg_pools, poolid);
-        if (!pool)
-                return NULL;
        ruleno = crush_find_rule(osdmap->crush, pool->v.crush_ruleset,
                                 pool->v.type, pool->v.size);
        if (ruleno < 0) {
@@ -1078,6 +1079,11 @@ static int *calc_pg_raw(struct ceph_osdmap *osdmap, struct ceph_pg pgid,
                return NULL;
        }
+        /* don't forcefeed bad device ids to crush */
+        if (preferred >= osdmap->max_osd ||
+            preferred >= osdmap->crush->max_devices)
+                preferred = -1;
        if (preferred >= 0)
                pps = ceph_stable_mod(ps,
                                      le32_to_cpu(pool->v.lpgp_num),
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e7ab0c0285b5..3231b468bb72 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -384,8 +384,8 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 */
                list_for_each_entry(r, &ops->rules_list, list) {
                        if (r->action == FR_ACT_GOTO &&
-                            r->target == rule->pref) {
+                            r->target == rule->pref &&
-                                BUG_ON(rtnl_dereference(r->ctarget) != NULL);
+                            rtnl_dereference(r->ctarget) == NULL) {
                                rcu_assign_pointer(r->ctarget, rule);
                                if (--ops->unresolved_rules == 0)
                                        break;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f012ebd87b43..12368c586068 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -374,8 +374,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                        "%s(): cannot allocate memory for statistics; dev=%s.\n",
                        __func__, dev->name));
                neigh_parms_release(&nd_tbl, ndev->nd_parms);
-                ndev->dead = 1;
+                dev_put(dev);
-                in6_dev_finish_destroy(ndev);
+                kfree(ndev);
                return NULL;
        }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 705c82886281..def0538e2413 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -696,8 +696,10 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        dev->stats.tx_bytes += skb->len;
@@ -2052,8 +2054,10 @@ int ip6_mr_input(struct sk_buff *skb)
        int err;
        err = ip6mr_fib_lookup(net, &fl6, &mrt);
-        if (err < 0)
+        if (err < 0) {
+                kfree_skb(skb);
                return err;
+        }
        read_lock(&mrt_lock);
        cache = ip6mr_cache_find(mrt,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1250f9020670..fb545edef6ea 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -244,7 +244,9 @@ static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops,
 {
        struct rt6_info *rt = dst_alloc(ops, dev, 0, 0, flags);
-        memset(&rt->rt6i_table, 0, sizeof(*rt) - sizeof(struct dst_entry));
+        if (rt != NULL)
+                memset(&rt->rt6i_table, 0,
+                        sizeof(*rt) - sizeof(struct dst_entry));
        return rt;
 }
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index e83e7fee3bc0..ea40d540a990 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4113,9 +4113,12 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
                if (len % sizeof(u32))
                        return -EINVAL;
+                if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
+                        return -EINVAL;
                memcpy(settings->akm_suites, data, len);
-                for (i = 0; i < settings->n_ciphers_pairwise; i++)
+                for (i = 0; i < settings->n_akm_suites; i++)
                        if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
                                return -EINVAL;
        }
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 02751dbc5a97..68a471ba193f 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -852,6 +852,7 @@ static void handle_channel(struct wiphy *wiphy,
                return;
        }
+        chan->beacon_found = false;
        chan->flags = flags | bw_flags | map_regdom_flags(reg_rule->flags);
        chan->max_antenna_gain = min(chan->orig_mag,
                (int) MBI_TO_DBI(power_rule->max_antenna_gain));
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index b7b6ff8be553..dec0fa28372e 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -118,6 +118,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
                             i++, j++)
                                request->channels[i] =
                                        &wdev->wiphy->bands[band]->channels[j];
+                        request->rates[band] =
+                                (1 << wdev->wiphy->bands[band]->n_bitrates) - 1;
                }
        }
        request->n_channels = n_channels;
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index a026b0ef2443..54a0dc2e2f8d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -212,6 +212,11 @@ resume:
                /* only the first xfrm gets the encap type */
                encap_type = 0;
+                if (async && x->repl->check(x, skb, seq)) {
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
+                        goto drop_unlock;
+                }
                x->repl->advance(x, seq);
                x->curlft.bytes += skb->len;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 94fdcc7f1030..552df27dcf53 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1349,14 +1349,16 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
                BUG();
        }
        xdst = dst_alloc(dst_ops, NULL, 0, 0, 0);
-        memset(&xdst->u.rt6.rt6i_table, 0, sizeof(*xdst) - sizeof(struct dst_entry));
-        xfrm_policy_put_afinfo(afinfo);
-        if (likely(xdst))
+        if (likely(xdst)) {
+                memset(&xdst->u.rt6.rt6i_table, 0,
+                        sizeof(*xdst) - sizeof(struct dst_entry));
                xdst->flo.ops = &xfrm_bundle_fc_ops;
-        else
+        } else
                xdst = ERR_PTR(-ENOBUFS);
+        xfrm_policy_put_afinfo(afinfo);
        return xdst;
 }
diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c
index f9123f09e83e..32b02d906703 100644
--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -68,6 +68,7 @@ MODULE_PARM_DESC(enable, "Enable FM801 soundcard.");
 module_param_array(tea575x_tuner, int, NULL, 0444);
 MODULE_PARM_DESC(tea575x_tuner, "TEA575x tuner access method (0 = auto, 1 = SF256-PCS, 2=SF256-PCP, 3=SF64-PCR, 8=disable, +16=tuner-only).");
+#define TUNER_DISABLED          (1<<3)
 #define TUNER_ONLY              (1<<4)
 #define TUNER_TYPE_MASK         (~TUNER_ONLY & 0xFFFF)
@@ -1150,7 +1151,8 @@ static int snd_fm801_free(struct fm801 *chip)
      __end_hw:
 #ifdef CONFIG_SND_FM801_TEA575X_BOOL
-        snd_tea575x_exit(&chip->tea);
+        if (!(chip->tea575x_tuner & TUNER_DISABLED))
+                snd_tea575x_exit(&chip->tea);
 #endif
        if (chip->irq >= 0)
                free_irq(chip->irq, chip);
@@ -1236,7 +1238,6 @@ static int __devinit snd_fm801_create(struct snd_card *card,
            (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
                if (snd_tea575x_init(&chip->tea)) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
                        return -ENODEV;
                }
        } else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
@@ -1251,11 +1252,15 @@ static int __devinit snd_fm801_create(struct snd_card *card,
                }
                if (tea575x_tuner == 4) {
                        snd_printk(KERN_ERR "TEA575x radio not found\n");
-                        snd_fm801_free(chip);
+                        chip->tea575x_tuner = TUNER_DISABLED;
-                        return -ENODEV;
                }
        }
-        strlcpy(chip->tea.card, snd_fm801_tea575x_gpios[(tea575x_tuner & TUNER_TYPE_MASK) - 1].name, sizeof(chip->tea.card));
+        if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
+                strlcpy(chip->tea.card,
+                        snd_fm801_tea575x_gpios[(tea575x_tuner &
+                                                 TUNER_TYPE_MASK) - 1].name,
+                        sizeof(chip->tea.card));
+        }
 #endif
        *rchip = chip;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7cabd7317163..7a73621a8909 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -168,7 +168,7 @@ struct alc_spec {
        unsigned int auto_mic_valid_imux:1;     /* valid imux for auto-mic */
        unsigned int automute:1;        /* HP automute enabled */
        unsigned int detect_line:1;     /* Line-out detection enabled */
-        unsigned int automute_lines:1;  /* automute line-out as well */
+        unsigned int automute_lines:1;  /* automute line-out as well; NOP when automute_hp_lo isn't set */
        unsigned int automute_hp_lo:1;  /* both HP and LO available */
        /* other flags */
@@ -551,7 +551,7 @@ static void update_speakers(struct hda_codec *codec)
        if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0] ||
            spec->autocfg.line_out_pins[0] == spec->autocfg.speaker_pins[0])
                return;
-        if (!spec->automute_lines || !spec->automute)
+        if (!spec->automute || (spec->automute_hp_lo && !spec->automute_lines))
                on = 0;
        else
                on = spec->jack_present;
@@ -578,6 +578,10 @@ static void alc_line_automute(struct hda_codec *codec)
 {
        struct alc_spec *spec = codec->spec;
+        /* check LO jack only when it's different from HP */
+        if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0])
+                return;
        spec->line_jack_present =
                detect_jacks(codec, ARRAY_SIZE(spec->autocfg.line_out_pins),
                             spec->autocfg.line_out_pins);
@@ -803,7 +807,7 @@ static int alc_automute_mode_get(struct snd_kcontrol *kcontrol,
        unsigned int val;
        if (!spec->automute)
                val = 0;
-        else if (!spec->automute_lines)
+        else if (!spec->automute_hp_lo || !spec->automute_lines)
                val = 1;
        else
                val = 2;
@@ -824,7 +828,8 @@ static int alc_automute_mode_put(struct snd_kcontrol *kcontrol,
                spec->automute = 0;
                break;
        case 1:
-                if (spec->automute && !spec->automute_lines)
+                if (spec->automute &&
+                    (!spec->automute_hp_lo || !spec->automute_lines))
                        return 0;
                spec->automute = 1;
                spec->automute_lines = 0;
@@ -1320,7 +1325,9 @@ do_sku:
         * 15   : 1 --> enable the function "Mute internal speaker
         *              when the external headphone out jack is plugged"
         */
-        if (!spec->autocfg.hp_pins[0]) {
+        if (!spec->autocfg.hp_pins[0] &&
+            !(spec->autocfg.line_out_pins[0] &&
+              spec->autocfg.line_out_type == AUTO_PIN_HP_OUT)) {
                hda_nid_t nid;
                tmp = (ass >> 11) & 0x3;        /* HP to chassis */
                if (tmp == 0)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index 5145b663ef6e..987e3cf71a0b 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -5630,6 +5630,7 @@ again:
        switch (codec->vendor_id) {
        case 0x111d76d1:
        case 0x111d76d9:
+        case 0x111d76df:
        case 0x111d76e5:
        case 0x111d7666:
        case 0x111d7667:
@@ -6573,6 +6574,7 @@ static const struct hda_codec_preset snd_hda_preset_sigmatel[] = {
        { .id = 0x111d76cc, .name = "92HD89F3", .patch = patch_stac92hd73xx },
        { .id = 0x111d76cd, .name = "92HD89F2", .patch = patch_stac92hd73xx },
        { .id = 0x111d76ce, .name = "92HD89F1", .patch = patch_stac92hd73xx },
+        { .id = 0x111d76df, .name = "92HD93BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e0, .name = "92HD91BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e3, .name = "92HD98BXX", .patch = patch_stac92hd83xxx},
        { .id = 0x111d76e5, .name = "92HD99BXX", .patch = patch_stac92hd83xxx},
diff --git a/sound/soc/blackfin/bf5xx-ad73311.c b/sound/soc/blackfin/bf5xx-ad73311.c
index 732a247f2527..b94eb7ef7d16 100644
--- a/sound/soc/blackfin/bf5xx-ad73311.c
+++ b/sound/soc/blackfin/bf5xx-ad73311.c
@@ -128,7 +128,7 @@ static int snd_ad73311_configure(void)
        return 0;
 }
-static int bf5xx_probe(struct platform_device *pdev)
+static int bf5xx_probe(struct snd_soc_card *card)
 {
        int err;
        if (gpio_request(GPIO_SE, "AD73311_SE")) {
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index 84f4ad568556..9801cd7cfcb5 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -431,7 +431,8 @@ static int ssm2602_set_dai_fmt(struct snd_soc_dai *codec_dai,
 static int ssm2602_set_bias_level(struct snd_soc_codec *codec,
                                 enum snd_soc_bias_level level)
 {
-        u16 reg = snd_soc_read(codec, SSM2602_PWR) & 0xff7f;
+        u16 reg = snd_soc_read(codec, SSM2602_PWR);
+        reg &= ~(PWR_POWER_OFF | PWR_OSC_PDN);
        switch (level) {
        case SND_SOC_BIAS_ON:
diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index 1725550c293e..d2c315fa1b9b 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -3479,31 +3479,6 @@ int wm8962_mic_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack)
 }
 EXPORT_SYMBOL_GPL(wm8962_mic_detect);
-#ifdef CONFIG_PM
-static int wm8962_resume(struct snd_soc_codec *codec)
-{
-        u16 *reg_cache = codec->reg_cache;
-        int i;
-        /* Restore the registers */
-        for (i = 1; i < codec->driver->reg_cache_size; i++) {
-                switch (i) {
-                case WM8962_SOFTWARE_RESET:
-                        continue;
-                default:
-                        break;
-                }
-                if (reg_cache[i] != wm8962_reg[i])
-                        snd_soc_write(codec, i, reg_cache[i]);
-        }
-        return 0;
-}
-#else
-#define wm8962_resume NULL
-#endif
 #if defined(CONFIG_INPUT) || defined(CONFIG_INPUT_MODULE)
 static int beep_rates[] = {
        500, 1000, 2000, 4000,
@@ -4015,7 +3990,6 @@ static int wm8962_remove(struct snd_soc_codec *codec)
 static struct snd_soc_codec_driver soc_codec_dev_wm8962 = {
        .probe =        wm8962_probe,
        .remove =       wm8962_remove,
-        .resume =       wm8962_resume,
        .set_bias_level = wm8962_set_bias_level,
        .reg_cache_size = WM8962_MAX_REGISTER + 1,
        .reg_word_size = sizeof(u16),
diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
index ebcc2d4d2b18..478d60778453 100644
--- a/sound/soc/omap/omap-mcbsp.c
+++ b/sound/soc/omap/omap-mcbsp.c
@@ -516,6 +516,12 @@ static int omap_mcbsp_dai_set_dai_sysclk(struct snd_soc_dai *cpu_dai,
        struct omap_mcbsp_reg_cfg *regs = &mcbsp_data->regs;
        int err = 0;
+        if (mcbsp_data->active)
+                if (freq == mcbsp_data->in_freq)
+                        return 0;
+                else
+                        return -EBUSY;
        /* The McBSP signal muxing functions are only available on McBSP1 */
        if (clk_id == OMAP_MCBSP_CLKR_SRC_CLKR ||
            clk_id == OMAP_MCBSP_CLKR_SRC_CLKX ||
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index d2ef014af215..ef69f5a02709 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -30,6 +30,7 @@
 #include <linux/bitops.h>
 #include <linux/debugfs.h>
 #include <linux/platform_device.h>
+#include <linux/ctype.h>
 #include <linux/slab.h>
 #include <sound/ac97_codec.h>
 #include <sound/core.h>
@@ -1434,9 +1435,20 @@ static void snd_soc_instantiate_card(struct snd_soc_card *card)
                 "%s", card->name);
        snprintf(card->snd_card->longname, sizeof(card->snd_card->longname),
                 "%s", card->long_name ? card->long_name : card->name);
-        if (card->driver_name)
+        snprintf(card->snd_card->driver, sizeof(card->snd_card->driver),
-                strlcpy(card->snd_card->driver, card->driver_name,
+                 "%s", card->driver_name ? card->driver_name : card->name);
-                        sizeof(card->snd_card->driver));
+        for (i = 0; i < ARRAY_SIZE(card->snd_card->driver); i++) {
+                switch (card->snd_card->driver[i]) {
+                case '_':
+                case '-':
+                case '\0':
+                        break;
+                default:
+                        if (!isalnum(card->snd_card->driver[i]))
+                                card->snd_card->driver[i] = '_';
+                        break;
+                }
+        }
        if (card->late_probe) {
                ret = card->late_probe(card);
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 781d9e61adfb..d8f2bf401458 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -530,8 +530,11 @@ snd_usb_audio_probe(struct usb_device *dev,
        return chip;
 __error:
-        if (chip && !chip->num_interfaces)
+        if (chip) {
-                snd_card_free(chip->card);
+                if (!chip->num_interfaces)
+                        snd_card_free(chip->card);
+                chip->probing = 0;
+        }
        mutex_unlock(&register_mutex);
 __err_val:
        return NULL;
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 3b8f7b80376b..e9d5c271db69 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -30,6 +30,8 @@ endif
 # Define EXTRA_CFLAGS=-m64 or EXTRA_CFLAGS=-m32 as appropriate for cross-builds.
 #
 # Define NO_DWARF if you do not want debug-info analysis feature at all.
+#
+# Define WERROR=0 to disable treating any warnings as errors.
 $(OUTPUT)PERF-VERSION-FILE: .FORCE-PERF-VERSION-FILE
        @$(SHELL_PATH) util/PERF-VERSION-GEN $(OUTPUT)
@@ -63,6 +65,11 @@ ifeq ($(ARCH),x86_64)
        endif
 endif
+# Treat warnings as errors unless directed not to
+ifneq ($(WERROR),0)
+        CFLAGS_WERROR := -Werror
+endif
 #
 # Include saner warnings here, which can catch bugs:
 #
@@ -95,7 +102,7 @@ ifndef PERF_DEBUG
  CFLAGS_OPTIMIZE = -O6
 endif
-CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 -Werror $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
+CFLAGS = -fno-omit-frame-pointer -ggdb3 -Wall -Wextra -std=gnu99 $(CFLAGS_WERROR) $(CFLAGS_OPTIMIZE) -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS)
 EXTLIBS = -lpthread -lrt -lelf -lm
 ALL_CFLAGS = $(CFLAGS) -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
 ALL_LDFLAGS = $(LDFLAGS)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 6b0519f885e4..f4c3fbee4bad 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -161,6 +161,7 @@ static void config_attr(struct perf_evsel *evsel, struct perf_evlist *evlist)
        struct perf_event_attr *attr = &evsel->attr;
        int track = !evsel->idx; /* only the first counter needs these */
+        attr->disabled          = 1;
        attr->inherit           = !no_inherit;
        attr->read_format       = PERF_FORMAT_TOTAL_TIME_ENABLED |
                                  PERF_FORMAT_TOTAL_TIME_RUNNING |
@@ -671,6 +672,8 @@ static int __cmd_record(int argc, const char **argv)
                }
        }
+        perf_evlist__enable(evsel_list);
        /*
         * Let the child rip
         */
diff --git a/tools/perf/builtin-test.c b/tools/perf/builtin-test.c
index 55f4c76f2821..efe696f936e2 100644
--- a/tools/perf/builtin-test.c
+++ b/tools/perf/builtin-test.c
@@ -561,7 +561,7 @@ static int test__basic_mmap(void)
                }
                err = perf_event__parse_sample(event, attr.sample_type, sample_size,
-                                               false, &sample);
+                                               false, &sample, false);
                if (err) {
                        pr_err("Can't parse sample, err = %d\n", err);
                        goto out_munmap;
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index a43433f08300..d28013b7d61c 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -191,7 +191,8 @@ static void __zero_source_counters(struct sym_entry *syme)
        symbol__annotate_zero_histograms(sym);
 }
-static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
+static void record_precise_ip(struct sym_entry *syme, struct map *map,
+                              int counter, u64 ip)
 {
        struct annotation *notes;
        struct symbol *sym;
@@ -205,8 +206,8 @@ static void record_precise_ip(struct sym_entry *syme, int counter, u64 ip)
        if (pthread_mutex_trylock(&notes->lock))
                return;
-        ip = syme->map->map_ip(syme->map, ip);
+        ip = map->map_ip(map, ip);
-        symbol__inc_addr_samples(sym, syme->map, counter, ip);
+        symbol__inc_addr_samples(sym, map, counter, ip);
        pthread_mutex_unlock(&notes->lock);
 }
@@ -810,7 +811,7 @@ static void perf_event__process_sample(const union perf_event *event,
                evsel = perf_evlist__id2evsel(top.evlist, sample->id);
                assert(evsel != NULL);
                syme->count[evsel->idx]++;
-                record_precise_ip(syme, evsel->idx, ip);
+                record_precise_ip(syme, al.map, evsel->idx, ip);
                pthread_mutex_lock(&top.active_symbols_lock);
                if (list_empty(&syme->node) || !syme->node.next) {
                        static bool first = true;
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 3c1b8a632101..437f8ca679a0 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -169,12 +169,17 @@ static int perf_event__synthesize_mmap_events(union perf_event *event,
                        continue;
                pbf += n + 3;
                if (*pbf == 'x') { /* vm_exec */
+                        char anonstr[] = "//anon\n";
                        char *execname = strchr(bf, '/');
                        /* Catch VDSO */
                        if (execname == NULL)
                                execname = strstr(bf, "[vdso]");
+                        /* Catch anonymous mmaps */
+                        if ((execname == NULL) && !strstr(bf, "["))
+                                execname = anonstr;
                        if (execname == NULL)
                                continue;
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 1d7f66488a88..357a85b85248 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -186,6 +186,6 @@ const char *perf_event__name(unsigned int id);
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *sample);
+                             struct perf_sample *sample, bool swapped);
 #endif /* __PERF_RECORD_H */
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index c12bd476c6f7..72e9f4886b6d 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -113,6 +113,19 @@ void perf_evlist__disable(struct perf_evlist *evlist)
        }
 }
+void perf_evlist__enable(struct perf_evlist *evlist)
+{
+        int cpu, thread;
+        struct perf_evsel *pos;
+        for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
+                list_for_each_entry(pos, &evlist->entries, node) {
+                        for (thread = 0; thread < evlist->threads->nr; thread++)
+                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                }
+        }
+}
 int perf_evlist__alloc_pollfd(struct perf_evlist *evlist)
 {
        int nfds = evlist->cpus->nr * evlist->threads->nr * evlist->nr_entries;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index ce85ae9ae57a..f34915002745 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,7 @@ int perf_evlist__mmap(struct perf_evlist *evlist, int pages, bool overwrite);
 void perf_evlist__munmap(struct perf_evlist *evlist);
 void perf_evlist__disable(struct perf_evlist *evlist);
+void perf_evlist__enable(struct perf_evlist *evlist);
 static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
                                         struct cpu_map *cpus,
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index a03a36b7908a..c5748c52318f 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -7,6 +7,8 @@
 * Released under the GPL v2. (and only v2, not any later version)
 */
+#include <byteswap.h>
+#include "asm/bug.h"
 #include "evsel.h"
 #include "evlist.h"
 #include "util.h"
@@ -342,10 +344,20 @@ static bool sample_overlap(const union perf_event *event,
 int perf_event__parse_sample(const union perf_event *event, u64 type,
                             int sample_size, bool sample_id_all,
-                             struct perf_sample *data)
+                             struct perf_sample *data, bool swapped)
 {
        const u64 *array;
+        /*
+         * used for cross-endian analysis. See git commit 65014ab3
+         * for why this goofiness is needed.
+         */
+        union {
+                u64 val64;
+                u32 val32[2];
+        } u;
        data->cpu = data->pid = data->tid = -1;
        data->stream_id = data->id = data->time = -1ULL;
@@ -366,9 +378,16 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
-                data->pid = p[0];
+                if (swapped) {
-                data->tid = p[1];
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+                data->pid = u.val32[0];
+                data->tid = u.val32[1];
                array++;
        }
@@ -395,8 +414,15 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                data->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+                data->cpu = u.val32[0];
                array++;
        }
@@ -423,18 +449,24 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
        }
        if (type & PERF_SAMPLE_RAW) {
-                u32 *p = (u32 *)array;
+                u.val64 = *array;
+                if (WARN_ONCE(swapped,
+                              "Endianness of raw data not corrected!\n")) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
                if (sample_overlap(event, array, sizeof(u32)))
                        return -EFAULT;
-                data->raw_size = *p;
+                data->raw_size = u.val32[0];
-                p++;
-                if (sample_overlap(event, p, data->raw_size))
+                if (sample_overlap(event, &u.val32[1], data->raw_size))
                        return -EFAULT;
-                data->raw_data = p;
+                data->raw_data = &u.val32[1];
        }
        return 0;
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index 555fc3864b90..5d732621a462 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -659,7 +659,7 @@ static int find_variable(Dwarf_Die *sc_die, struct probe_finder *pf)
                if (!die_find_variable_at(&pf->cu_die, pf->pvar->var, 0, &vr_die))
                        ret = -ENOENT;
        }
-        if (ret == 0)
+        if (ret >= 0)
                ret = convert_variable(&vr_die, pf);
        if (ret < 0)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index cbc8f215d4b7..7624324efad4 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -803,7 +803,7 @@ static PyObject *pyrf_evlist__read_on_cpu(struct pyrf_evlist *pevlist,
                first = list_entry(evlist->entries.next, struct perf_evsel, node);
                err = perf_event__parse_sample(event, first->attr.sample_type,
                                               perf_evsel__sample_size(first),
-                                               sample_id_all, &pevent->sample);
+                                               sample_id_all, &pevent->sample, false);
                if (err)
                        return PyErr_Format(PyExc_OSError,
                                            "perf: can't parse sample, err=%d", err);
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 170601e67d6b..974d0cbee5e9 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -162,7 +162,8 @@ static inline int perf_session__parse_sample(struct perf_session *session,
 {
        return perf_event__parse_sample(event, session->sample_type,
                                        session->sample_size,
-                                        session->sample_id_all, sample);
+                                        session->sample_id_all, sample,
+                                        session->header.needs_swap);
 }
 struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 401e220566fd..1ee8f1e40f18 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -151,11 +151,17 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
 {
        u64 ip_l, ip_r;
+        if (!left->ms.sym && !right->ms.sym)
+                return right->level - left->level;
+        if (!left->ms.sym || !right->ms.sym)
+                return cmp_null(left->ms.sym, right->ms.sym);
        if (left->ms.sym == right->ms.sym)
                return 0;
-        ip_l = left->ms.sym ? left->ms.sym->start : left->ip;
+        ip_l = left->ms.sym->start;
-        ip_r = right->ms.sym ? right->ms.sym->start : right->ip;
+        ip_r = right->ms.sym->start;
        return (int64_t)(ip_r - ip_l);
 }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 469c0264ed29..40eeaf07725b 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -74,16 +74,104 @@ static void dso__set_sorted_by_name(struct dso *dso, enum map_type type)
 bool symbol_type__is_a(char symbol_type, enum map_type map_type)
 {
+        symbol_type = toupper(symbol_type);
        switch (map_type) {
        case MAP__FUNCTION:
                return symbol_type == 'T' || symbol_type == 'W';
        case MAP__VARIABLE:
-                return symbol_type == 'D' || symbol_type == 'd';
+                return symbol_type == 'D';
        default:
                return false;
        }
 }
+static int prefix_underscores_count(const char *str)
+{
+        const char *tail = str;
+        while (*tail == '_')
+                tail++;
+        return tail - str;
+}
+#define SYMBOL_A 0
+#define SYMBOL_B 1
+static int choose_best_symbol(struct symbol *syma, struct symbol *symb)
+{
+        s64 a;
+        s64 b;
+        /* Prefer a symbol with non zero length */
+        a = syma->end - syma->start;
+        b = symb->end - symb->start;
+        if ((b == 0) && (a > 0))
+                return SYMBOL_A;
+        else if ((a == 0) && (b > 0))
+                return SYMBOL_B;
+        /* Prefer a non weak symbol over a weak one */
+        a = syma->binding == STB_WEAK;
+        b = symb->binding == STB_WEAK;
+        if (b && !a)
+                return SYMBOL_A;
+        if (a && !b)
+                return SYMBOL_B;
+        /* Prefer a global symbol over a non global one */
+        a = syma->binding == STB_GLOBAL;
+        b = symb->binding == STB_GLOBAL;
+        if (a && !b)
+                return SYMBOL_A;
+        if (b && !a)
+                return SYMBOL_B;
+        /* Prefer a symbol with less underscores */
+        a = prefix_underscores_count(syma->name);
+        b = prefix_underscores_count(symb->name);
+        if (b > a)
+                return SYMBOL_A;
+        else if (a > b)
+                return SYMBOL_B;
+        /* If all else fails, choose the symbol with the longest name */
+        if (strlen(syma->name) >= strlen(symb->name))
+                return SYMBOL_A;
+        else
+                return SYMBOL_B;
+}
+static void symbols__fixup_duplicate(struct rb_root *symbols)
+{
+        struct rb_node *nd;
+        struct symbol *curr, *next;
+        nd = rb_first(symbols);
+        while (nd) {
+                curr = rb_entry(nd, struct symbol, rb_node);
+again:
+                nd = rb_next(&curr->rb_node);
+                next = rb_entry(nd, struct symbol, rb_node);
+                if (!nd)
+                        break;
+                if (curr->start != next->start)
+                        continue;
+                if (choose_best_symbol(curr, next) == SYMBOL_A) {
+                        rb_erase(&next->rb_node, symbols);
+                        goto again;
+                } else {
+                        nd = rb_next(&curr->rb_node);
+                        rb_erase(&curr->rb_node, symbols);
+                }
+        }
+}
 static void symbols__fixup_end(struct rb_root *symbols)
 {
        struct rb_node *nd, *prevnd = rb_first(symbols);
@@ -438,18 +526,11 @@ int kallsyms__parse(const char *filename, void *arg,
        char *line = NULL;
        size_t n;
        int err = -1;
-        u64 prev_start = 0;
-        char prev_symbol_type = 0;
-        char *prev_symbol_name;
        FILE *file = fopen(filename, "r");
        if (file == NULL)
                goto out_failure;
-        prev_symbol_name = malloc(KSYM_NAME_LEN);
-        if (prev_symbol_name == NULL)
-                goto out_close;
        err = 0;
        while (!feof(file)) {
@@ -470,7 +551,7 @@ int kallsyms__parse(const char *filename, void *arg,
                if (len + 2 >= line_len)
                        continue;
-                symbol_type = toupper(line[len]);
+                symbol_type = line[len];
                len += 2;
                symbol_name = line + len;
                len = line_len - len;
@@ -480,24 +561,18 @@ int kallsyms__parse(const char *filename, void *arg,
                        break;
                }
-                if (prev_symbol_type) {
+                /*
-                        u64 end = start;
+                 * module symbols are not sorted so we add all
-                        if (end != prev_start)
+                 * symbols with zero length and rely on
-                                --end;
+                 * symbols__fixup_end() to fix it up.
-                        err = process_symbol(arg, prev_symbol_name,
+                 */
-                                             prev_symbol_type, prev_start, end);
+                err = process_symbol(arg, symbol_name,
-                        if (err)
+                                     symbol_type, start, start);
-                                break;
+                if (err)
-                }
+                        break;
-                memcpy(prev_symbol_name, symbol_name, len + 1);
-                prev_symbol_type = symbol_type;
-                prev_start = start;
        }
-        free(prev_symbol_name);
        free(line);
-out_close:
        fclose(file);
        return err;
@@ -703,6 +778,9 @@ int dso__load_kallsyms(struct dso *dso, const char *filename,
        if (dso__load_all_kallsyms(dso, filename, map) < 0)
                return -1;
+        symbols__fixup_duplicate(&dso->symbols[map->type]);
+        symbols__fixup_end(&dso->symbols[map->type]);
        if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
                dso->symtab_type = SYMTAB__GUEST_KALLSYMS;
        else
@@ -1092,8 +1170,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        if (dso->has_build_id) {
                u8 build_id[BUILD_ID_SIZE];
-                if (elf_read_build_id(elf, build_id,
+                if (elf_read_build_id(elf, build_id, BUILD_ID_SIZE) < 0)
-                                      BUILD_ID_SIZE) != BUILD_ID_SIZE)
                        goto out_elf_end;
                if (!dso__build_id_equal(dso, build_id))
@@ -1111,6 +1188,8 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
        }
        opdsec = elf_section_by_name(elf, &ehdr, &opdshdr, ".opd", &opdidx);
+        if (opdshdr.sh_type != SHT_PROGBITS)
+                opdsec = NULL;
        if (opdsec)
                opddata = elf_rawdata(opdsec, NULL);
@@ -1276,6 +1355,7 @@ new_symbol:
         * For misannotated, zeroed, ASM function sizes.
         */
        if (nr > 0) {
+                symbols__fixup_duplicate(&dso->symbols[map->type]);
                symbols__fixup_end(&dso->symbols[map->type]);
                if (kmap) {
                        /*
@@ -1362,8 +1442,8 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
        ptr = data->d_buf;
        while (ptr < (data->d_buf + data->d_size)) {
                GElf_Nhdr *nhdr = ptr;
-                int namesz = NOTE_ALIGN(nhdr->n_namesz),
+                size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
-                    descsz = NOTE_ALIGN(nhdr->n_descsz);
+                       descsz = NOTE_ALIGN(nhdr->n_descsz);
                const char *name;
                ptr += sizeof(*nhdr);
@@ -1372,8 +1452,10 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
                if (nhdr->n_type == NT_GNU_BUILD_ID &&
                    nhdr->n_namesz == sizeof("GNU")) {
                        if (memcmp(name, "GNU", sizeof("GNU")) == 0) {
-                                memcpy(bf, ptr, BUILD_ID_SIZE);
+                                size_t sz = min(size, descsz);
-                                err = BUILD_ID_SIZE;
+                                memcpy(bf, ptr, sz);
+                                memset(bf + sz, 0, size - sz);
+                                err = descsz;
                                break;
                        }
                }
@@ -1425,7 +1507,7 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
        while (1) {
                char bf[BUFSIZ];
                GElf_Nhdr nhdr;
-                int namesz, descsz;
+                size_t namesz, descsz;
                if (read(fd, &nhdr, sizeof(nhdr)) != sizeof(nhdr))
                        break;
@@ -1434,15 +1516,16 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size)
                descsz = NOTE_ALIGN(nhdr.n_descsz);
                if (nhdr.n_type == NT_GNU_BUILD_ID &&
                    nhdr.n_namesz == sizeof("GNU")) {
-                        if (read(fd, bf, namesz) != namesz)
+                        if (read(fd, bf, namesz) != (ssize_t)namesz)
                                break;
                        if (memcmp(bf, "GNU", sizeof("GNU")) == 0) {
-                                if (read(fd, build_id,
+                                size_t sz = min(descsz, size);
-                                    BUILD_ID_SIZE) == BUILD_ID_SIZE) {
+                                if (read(fd, build_id, sz) == (ssize_t)sz) {
+                                        memset(build_id + sz, 0, size - sz);
                                        err = 0;
                                        break;
                                }
-                        } else if (read(fd, bf, descsz) != descsz)
+                        } else if (read(fd, bf, descsz) != (ssize_t)descsz)
                                break;
                } else {
                        int n = namesz + descsz;