180 files changed, 1511 insertions, 901 deletions
diff --git a/CREDITS b/CREDITS
index 72b487869788..41d8e63d5165 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3554,12 +3554,12 @@ E: cvance@nai.com
 D: portions of the Linux Security Module (LSM) framework and security modules
 N: Petr Vandrovec
-E: vandrove@vc.cvut.cz
+E: petr@vandrovec.name
 D: Small contributions to ncpfs
 D: Matrox framebuffer driver
-S: Chudenicka 8
+S: 21513 Conradia Ct
-S: 10200 Prague 10, Hostivar
+S: Cupertino, CA 95014
-S: Czech Republic
+S: USA
 N: Thibaut Varene
 E: T-Bone@parisc-linux.org
diff --git a/Documentation/networking/e1000.txt b/Documentation/networking/e1000.txt
index 2df71861e578..d9271e74e488 100644
--- a/Documentation/networking/e1000.txt
+++ b/Documentation/networking/e1000.txt
@@ -1,82 +1,35 @@
 Linux* Base Driver for the Intel(R) PRO/1000 Family of Adapters
 ===============================================================
-September 26, 2006
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 Contents
 ========
- In This Release
 - Identifying Your Adapter
- Building and Installation
 - Command Line Parameters
 - Speed and Duplex Configuration
 - Additional Configurations
- Known Issues
 - Support
-In This Release
-===============
-This file describes the Linux* Base Driver for the Intel(R) PRO/1000 Family
-of Adapters.  This driver includes support for Itanium(R)2-based systems.
-For questions related to hardware requirements, refer to the documentation
-supplied with your Intel PRO/1000 adapter. All hardware requirements listed
-apply to use with Linux.
-The following features are now available in supported kernels:
- - Native VLANs
- - Channel Bonding (teaming)
- - SNMP
-Channel Bonding documentation can be found in the Linux kernel source:
-/Documentation/networking/bonding.txt
-The driver information previously displayed in the /proc filesystem is not
-supported in this release.  Alternatively, you can use ethtool (version 1.6
-or later), lspci, and ifconfig to obtain the same information.
-Instructions on updating ethtool can be found in the section "Additional
-Configurations" later in this document.
-NOTE: The Intel(R) 82562v 10/100 Network Connection only provides 10/100
-support.
 Identifying Your Adapter
 ========================
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
-    http://support.intel.com/support/network/adapter/pro100/21397.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 For the latest Intel network drivers for Linux, refer to the following
 website.  In the search field, enter your adapter name or type, or use the
 networking link on the left to search for your adapter:
-    http://downloadfinder.intel.com/scripts-df/support_intel.asp
+    http://support.intel.com/support/go/network/adapter/home.htm
 Command Line Parameters
 =======================
-If the driver is built as a module, the  following optional parameters
-are used by entering them on the command line with the modprobe command
-using this syntax:
-     modprobe e1000 [<option>=<VAL1>,<VAL2>,...]
-For example, with two PRO/1000 PCI adapters, entering:
-     modprobe e1000 TxDescriptors=80,128
-loads the e1000 driver with 80 TX descriptors for the first adapter and
-128 TX descriptors for the second adapter.
 The default value for each parameter is generally the recommended setting,
 unless otherwise noted.
@@ -89,10 +42,6 @@ NOTES:  For more information about the AutoNeg, Duplex, and Speed
        parameters, see the application note at:
        http://www.intel.com/design/network/applnots/ap450.htm
-        A descriptor describes a data buffer and attributes related to
-        the data buffer.  This information is accessed by the hardware.
 AutoNeg
 -------
 (Supported only on adapters with copper connections)
@@ -106,7 +55,6 @@ Duplex parameters must not be specified.
 NOTE:  Refer to the Speed and Duplex section of this readme for more
       information on the AutoNeg parameter.
 Duplex
 ------
 (Supported only on adapters with copper connections)
@@ -119,7 +67,6 @@ set to auto-negotiate, the board auto-detects the correct duplex.  If the
 link partner is forced (either full or half), Duplex defaults to half-
 duplex.
 FlowControl
 -----------
 Valid Range:   0-3 (0=none, 1=Rx only, 2=Tx only, 3=Rx&Tx)
@@ -128,16 +75,16 @@ Default Value: Reads flow control settings from the EEPROM
 This parameter controls the automatic generation(Tx) and response(Rx)
 to Ethernet PAUSE frames.
 InterruptThrottleRate
 ---------------------
 (not supported on Intel(R) 82542, 82543 or 82544-based adapters)
-Valid Range:   0,1,3,100-100000 (0=off, 1=dynamic, 3=dynamic conservative)
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
 Default Value: 3
 The driver can limit the amount of interrupts per second that the adapter
-will generate for incoming packets. It does this by writing a value to the 
+will generate for incoming packets. It does this by writing a value to the
-adapter that is based on the maximum amount of interrupts that the adapter 
+adapter that is based on the maximum amount of interrupts that the adapter
 will generate per second.
 Setting InterruptThrottleRate to a value greater or equal to 100
@@ -146,37 +93,43 @@ per second, even if more packets have come in. This reduces interrupt
 load on the system and can lower CPU utilization under heavy load,
 but will increase latency as packets are not processed as quickly.
-The default behaviour of the driver previously assumed a static 
+The default behaviour of the driver previously assumed a static
-InterruptThrottleRate value of 8000, providing a good fallback value for 
+InterruptThrottleRate value of 8000, providing a good fallback value for
-all traffic types,but lacking in small packet performance and latency. 
+all traffic types,but lacking in small packet performance and latency.
-The hardware can handle many more small packets per second however, and 
+The hardware can handle many more small packets per second however, and
 for this reason an adaptive interrupt moderation algorithm was implemented.
 Since 7.3.x, the driver has two adaptive modes (setting 1 or 3) in which
-it dynamically adjusts the InterruptThrottleRate value based on the traffic 
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
 that it receives. After determining the type of incoming traffic in the last
-timeframe, it will adjust the InterruptThrottleRate to an appropriate value 
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
 for that traffic.
 The algorithm classifies the incoming traffic every interval into
-classes.  Once the class is determined, the InterruptThrottleRate value is 
+classes.  Once the class is determined, the InterruptThrottleRate value is
-adjusted to suit that traffic type the best. There are three classes defined: 
+adjusted to suit that traffic type the best. There are three classes defined:
 "Bulk traffic", for large amounts of packets of normal size; "Low latency",
 for small amounts of traffic and/or a significant percentage of small
-packets; and "Lowest latency", for almost completely small packets or 
+packets; and "Lowest latency", for almost completely small packets or
 minimal traffic.
-In dynamic conservative mode, the InterruptThrottleRate value is set to 4000 
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
-for traffic that falls in class "Bulk traffic". If traffic falls in the "Low 
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
-latency" or "Lowest latency" class, the InterruptThrottleRate is increased 
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
 stepwise to 20000. This default mode is suitable for most applications.
 For situations where low latency is vital such as cluster or
 grid computing, the algorithm can reduce latency even more when
 InterruptThrottleRate is set to mode 1. In this mode, which operates
-the same as mode 3, the InterruptThrottleRate will be increased stepwise to 
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
 70000 for traffic in class "Lowest latency".
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal, the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
 Setting InterruptThrottleRate to 0 turns off any interrupt moderation
 and may improve small packet latency, but is generally not suitable
 for bulk throughput traffic.
@@ -212,8 +165,6 @@ NOTE:  When e1000 is loaded with default settings and multiple adapters
       be platform-specific.  If CPU utilization is not a concern, use
       RX_POLLING (NAPI) and default driver settings.
 RxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -225,15 +176,14 @@ by the driver.  Increasing this value allows the driver to buffer more
 incoming packets, at the expense of increased system memory utilization.
 Each descriptor is 16 bytes.  A receive buffer is also allocated for each
-descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending 
+descriptor and can be either 2048, 4096, 8192, or 16384 bytes, depending
 on the MTU setting. The maximum MTU size is 16110.
-NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo 
+NOTE:  MTU designates the frame size.  It only needs to be set for Jumbo
-       Frames.  Depending on the available system resources, the request 
+       Frames.  Depending on the available system resources, the request
-       for a higher number of receive descriptors may be denied.  In this 
+       for a higher number of receive descriptors may be denied.  In this
       case, use a lower number.
 RxIntDelay
 ----------
 Valid Range:   0-65535 (0=off)
@@ -254,7 +204,6 @@ CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
          restoring the network connection.  To eliminate the potential
          for the hang ensure that RxIntDelay is set to 0.
 RxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -268,7 +217,6 @@ packet is received within the set amount of time.  Proper tuning,
 along with RxIntDelay, may improve traffic throughput in specific network
 conditions.
 Speed
 -----
 (This parameter is supported only on adapters with copper connections.)
@@ -280,7 +228,6 @@ Speed forces the line speed to the specified value in megabits per second
 partner is set to auto-negotiate, the board will auto-detect the correct
 speed.  Duplex should also be set when Speed is set to either 10 or 100.
 TxDescriptors
 -------------
 Valid Range:   80-256 for 82542 and 82543-based adapters
@@ -295,6 +242,36 @@ NOTE:  Depending on the available system resources, the request for a
       higher number of transmit descriptors may be denied.  In this case,
       use a lower number.
+TxDescriptorStep
+----------------
+Valid Range:    1 (use every Tx Descriptor)
+                4 (use every 4th Tx Descriptor)
+Default Value:  1 (use every Tx Descriptor)
+On certain non-Intel architectures, it has been observed that intense TX
+traffic bursts of short packets may result in an improper descriptor
+writeback. If this occurs, the driver will report a "TX Timeout" and reset
+the adapter, after which the transmit flow will restart, though data may
+have stalled for as much as 10 seconds before it resumes.
+The improper writeback does not occur on the first descriptor in a system
+memory cache-line, which is typically 32 bytes, or 4 descriptors long.
+Setting TxDescriptorStep to a value of 4 will ensure that all TX descriptors
+are aligned to the start of a system memory cache line, and so this problem
+will not occur.
+NOTES: Setting TxDescriptorStep to 4 effectively reduces the number of
+       TxDescriptors available for transmits to 1/4 of the normal allocation.
+       This has a possible negative performance impact, which may be
+       compensated for by allocating more descriptors using the TxDescriptors
+       module parameter.
+       There are other conditions which may result in "TX Timeout", which will
+       not be resolved by the use of the TxDescriptorStep parameter. As the
+       issue addressed by this parameter has never been observed on Intel
+       Architecture platforms, it should not be used on Intel platforms.
 TxIntDelay
 ----------
@@ -307,7 +284,6 @@ efficiency if properly tuned for specific network traffic.  If the
 system is reporting dropped transmits, this value may be set too high
 causing the driver to run out of available transmit descriptors.
 TxAbsIntDelay
 -------------
 (This parameter is supported only on 82540, 82545 and later adapters.)
@@ -330,6 +306,35 @@ Default Value: 1
 A value of '1' indicates that the driver should enable IP checksum
 offload for received packets (both UDP and TCP) to the adapter hardware.
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+Usage: insmod e1000.ko copybreak=128
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000/parameters/copybreak
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+Allows PHY to turn off in lower power states. The user can turn off
+this parameter in supported chipsets.
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
 Speed and Duplex Configuration
 ==============================
@@ -385,40 +390,9 @@ If the link partner is forced to a specific speed and duplex, then this
 parameter should not be used.  Instead, use the Speed and Duplex parameters
 previously mentioned to force the adapter to the same speed and duplex.
 Additional Configurations
 =========================
-  Configuring the Driver on Different Distributions
-  -------------------------------------------------
-  Configuring a network driver to load properly when the system is started
-  is distribution dependent.  Typically, the configuration process involves
-  adding an alias line to /etc/modules.conf or /etc/modprobe.conf as well
-  as editing other system startup scripts and/or configuration files.  Many
-  popular Linux distributions ship with tools to make these changes for you.
-  To learn the proper way to configure a network device for your system,
-  refer to your distribution documentation.  If during this process you are
-  asked for the driver or module name, the name for the Linux Base Driver
-  for the Intel(R) PRO/1000 Family of Adapters is e1000.
-  As an example, if you install the e1000 driver for two PRO/1000 adapters
-  (eth0 and eth1) and set the speed and duplex to 10full and 100half, add
-  the following to modules.conf or or modprobe.conf:
-       alias eth0 e1000
-       alias eth1 e1000
-       options e1000 Speed=10,100 Duplex=2,1
-  Viewing Link Messages
-  ---------------------
-  Link messages will not be displayed to the console if the distribution is
-  restricting system messages.  In order to see network driver link messages
-  on your console, set dmesg to eight by entering the following:
-       dmesg -n 8
-  NOTE: This setting is not saved across reboots.
  Jumbo Frames
  ------------
  Jumbo Frames support is enabled by changing the MTU to a value larger than
@@ -437,9 +411,11 @@ Additional Configurations
   setting in a different location.
  Notes:
+  Degradation in throughput performance may be observed in some Jumbo frames
-  - To enable Jumbo Frames, increase the MTU size on the interface beyond
+  environments. If this is observed, increasing the application's socket buffer
-    1500.
+  size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values may help.
+  See the specific application manual and /usr/src/linux*/Documentation/
+  networking/ip-sysctl.txt for more details.
  - The maximum MTU setting for Jumbo Frames is 16110.  This value coincides
    with the maximum Jumbo Frames size of 16128.
@@ -447,40 +423,11 @@ Additional Configurations
  - Using Jumbo Frames at 10 or 100 Mbps may result in poor performance or
    loss of link.
-  - Some Intel gigabit adapters that support Jumbo Frames have a frame size
-    limit of 9238 bytes, with a corresponding MTU size limit of 9216 bytes.
-    The adapters with this limitation are based on the Intel(R) 82571EB,
-    82572EI, 82573L and 80003ES2LAN controller.  These correspond to the
-    following product names:
-     Intel(R) PRO/1000 PT Server Adapter
-     Intel(R) PRO/1000 PT Desktop Adapter
-     Intel(R) PRO/1000 PT Network Connection
-     Intel(R) PRO/1000 PT Dual Port Server Adapter
-     Intel(R) PRO/1000 PT Dual Port Network Connection
-     Intel(R) PRO/1000 PF Server Adapter
-     Intel(R) PRO/1000 PF Network Connection
-     Intel(R) PRO/1000 PF Dual Port Server Adapter
-     Intel(R) PRO/1000 PB Server Connection
-     Intel(R) PRO/1000 PL Network Connection
-     Intel(R) PRO/1000 EB Network Connection with I/O Acceleration
-     Intel(R) PRO/1000 EB Backplane Connection with I/O Acceleration
-     Intel(R) PRO/1000 PT Quad Port Server Adapter
  - Adapters based on the Intel(R) 82542 and 82573V/E controller do not
    support Jumbo Frames. These correspond to the following product names:
     Intel(R) PRO/1000 Gigabit Server Adapter
     Intel(R) PRO/1000 PM Network Connection
-  - The following adapters do not support Jumbo Frames:
-     Intel(R) 82562V 10/100 Network Connection
-     Intel(R) 82566DM Gigabit Network Connection
-     Intel(R) 82566DC Gigabit Network Connection
-     Intel(R) 82566MM Gigabit Network Connection
-     Intel(R) 82566MC Gigabit Network Connection
-     Intel(R) 82562GT 10/100 Network Connection
-     Intel(R) 82562G 10/100 Network Connection
  Ethtool
  -------
  The driver utilizes the ethtool interface for driver configuration and
@@ -490,142 +437,14 @@ Additional Configurations
  The latest release of ethtool can be found from
  http://sourceforge.net/projects/gkernel.
-  NOTE: Ethtool 1.6 only supports a limited set of ethtool options.  Support
-  for a more complete ethtool feature set can be enabled by upgrading
-  ethtool to ethtool-1.8.1.
  Enabling Wake on LAN* (WoL)
  ---------------------------
-  WoL is configured through the Ethtool* utility.  Ethtool is included with
+  WoL is configured through the Ethtool* utility.
-  all versions of Red Hat after Red Hat 7.2.  For other Linux distributions,
-  download and install Ethtool from the following website:
-  http://sourceforge.net/projects/gkernel.
-  For instructions on enabling WoL with Ethtool, refer to the website listed
-  above.
  WoL will be enabled on the system during the next shut down or reboot.
  For this driver version, in order to enable WoL, the e1000 driver must be
  loaded when shutting down or rebooting the system.
-  Wake On LAN is only supported on port A for the following devices:
-  Intel(R) PRO/1000 PT Dual Port Network Connection
-  Intel(R) PRO/1000 PT Dual Port Server Connection
-  Intel(R) PRO/1000 PT Dual Port Server Adapter
-  Intel(R) PRO/1000 PF Dual Port Server Adapter
-  Intel(R) PRO/1000 PT Quad Port Server Adapter
-  NAPI
-  ----
-  NAPI (Rx polling mode) is enabled in the e1000 driver.
-  See www.cyberus.ca/~hadi/usenix-paper.tgz for more information on NAPI.
-Known Issues
-============
-Dropped Receive Packets on Half-duplex 10/100 Networks
------------------------------------------------------
-If you have an Intel PCI Express adapter running at 10mbps or 100mbps, half-
-duplex, you may observe occasional dropped receive packets.  There are no
-workarounds for this problem in this network configuration.  The network must
-be updated to operate in full-duplex, and/or 1000mbps only.
-Jumbo Frames System Requirement
-------------------------------
-Memory allocation failures have been observed on Linux systems with 64 MB
-of RAM or less that are running Jumbo Frames.  If you are using Jumbo
-Frames, your system may require more than the advertised minimum
-requirement of 64 MB of system memory.
-Performance Degradation with Jumbo Frames
-----------------------------------------
-Degradation in throughput performance may be observed in some Jumbo frames
-environments.  If this is observed, increasing the application's socket
-buffer size and/or increasing the /proc/sys/net/ipv4/tcp_*mem entry values
-may help.  See the specific application manual and
-/usr/src/linux*/Documentation/
-networking/ip-sysctl.txt for more details.
-Jumbo Frames on Foundry BigIron 8000 switch
-------------------------------------------
-There is a known issue using Jumbo frames when connected to a Foundry
-BigIron 8000 switch.  This is a 3rd party limitation.  If you experience
-loss of packets, lower the MTU size.
-Allocating Rx Buffers when Using Jumbo Frames 
---------------------------------------------
-Allocating Rx buffers when using Jumbo Frames on 2.6.x kernels may fail if 
-the available memory is heavily fragmented. This issue may be seen with PCI-X 
-adapters or with packet split disabled. This can be reduced or eliminated 
-by changing the amount of available memory for receive buffer allocation, by
-increasing /proc/sys/vm/min_free_kbytes. 
-Multiple Interfaces on Same Ethernet Broadcast Network
------------------------------------------------------
-Due to the default ARP behavior on Linux, it is not possible to have
-one system on two IP networks in the same Ethernet broadcast domain
-(non-partitioned switch) behave as expected.  All Ethernet interfaces
-will respond to IP traffic for any IP address assigned to the system.
-This results in unbalanced receive traffic.
-If you have multiple interfaces in a server, either turn on ARP
-filtering by entering:
-    echo 1 > /proc/sys/net/ipv4/conf/all/arp_filter
-(this only works if your kernel's version is higher than 2.4.5),
-NOTE: This setting is not saved across reboots.  The configuration
-change can be made permanent by adding the line:
-    net.ipv4.conf.all.arp_filter = 1
-to the file /etc/sysctl.conf
-      or,
-install the interfaces in separate broadcast domains (either in
-different switches or in a switch partitioned to VLANs).
-82541/82547 can't link or are slow to link with some link partners
-----------------------------------------------------------------
-There is a known compatibility issue with 82541/82547 and some
-low-end switches where the link will not be established, or will
-be slow to establish.  In particular, these switches are known to
-be incompatible with 82541/82547:
-    Planex FXG-08TE
-    I-O Data ETG-SH8
-To workaround this issue, the driver can be compiled with an override
-of the PHY's master/slave setting.  Forcing master or forcing slave
-mode will improve time-to-link.
-    # make CFLAGS_EXTRA=-DE1000_MASTER_SLAVE=<n>
-Where <n> is:
-    0 = Hardware default
-    1 = Master mode
-    2 = Slave mode
-    3 = Auto master/slave
-Disable rx flow control with ethtool
------------------------------------
-In order to disable receive flow control using ethtool, you must turn
-off auto-negotiation on the same command line.
-For example:
-   ethtool -A eth? autoneg off rx off
-Unplugging network cable while ethtool -p is running
----------------------------------------------------
-In kernel versions 2.5.50 and later (including 2.6 kernel), unplugging
-the network cable while ethtool -p is running will cause the system to
-become unresponsive to keyboard commands, except for control-alt-delete.
-Restarting the system appears to be the only remedy.
 Support
 =======
diff --git a/Documentation/networking/e1000e.txt b/Documentation/networking/e1000e.txt
new file mode 100644
index 000000000000..6aa048badf32
--- /dev/null
+++ b/Documentation/networking/e1000e.txt
@@ -0,0 +1,302 @@
+Linux* Driver for Intel(R) Network Connection
+===============================================================
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
+Contents
+========
+- Identifying Your Adapter
+- Command Line Parameters
+- Additional Configurations
+- Support
+Identifying Your Adapter
+========================
+The e1000e driver supports all PCI Express Intel(R) Gigabit Network
+Connections, except those that are 82575, 82576 and 82580-based*.
+* NOTE: The Intel(R) PRO/1000 P Dual Port Server Adapter is supported by
+  the e1000 driver, not the e1000e driver due to the 82546 part being used
+  behind a PCI Express bridge.
+For more information on how to identify your adapter, go to the Adapter &
+Driver ID Guide at:
+    http://support.intel.com/support/go/network/adapter/idguide.htm
+For the latest Intel network drivers for Linux, refer to the following
+website.  In the search field, enter your adapter name or type, or use the
+networking link on the left to search for your adapter:
+    http://support.intel.com/support/go/network/adapter/home.htm
+Command Line Parameters
+=======================
+The default value for each parameter is generally the recommended setting,
+unless otherwise noted.
+NOTES:  For more information about the InterruptThrottleRate,
+        RxIntDelay, TxIntDelay, RxAbsIntDelay, and TxAbsIntDelay
+        parameters, see the application note at:
+        http://www.intel.com/design/network/applnots/ap450.htm
+InterruptThrottleRate
+---------------------
+Valid Range:   0,1,3,4,100-100000 (0=off, 1=dynamic, 3=dynamic conservative,
+                                   4=simplified balancing)
+Default Value: 3
+The driver can limit the amount of interrupts per second that the adapter
+will generate for incoming packets. It does this by writing a value to the
+adapter that is based on the maximum amount of interrupts that the adapter
+will generate per second.
+Setting InterruptThrottleRate to a value greater or equal to 100
+will program the adapter to send out a maximum of that many interrupts
+per second, even if more packets have come in. This reduces interrupt
+load on the system and can lower CPU utilization under heavy load,
+but will increase latency as packets are not processed as quickly.
+The driver has two adaptive modes (setting 1 or 3) in which
+it dynamically adjusts the InterruptThrottleRate value based on the traffic
+that it receives. After determining the type of incoming traffic in the last
+timeframe, it will adjust the InterruptThrottleRate to an appropriate value
+for that traffic.
+The algorithm classifies the incoming traffic every interval into
+classes.  Once the class is determined, the InterruptThrottleRate value is
+adjusted to suit that traffic type the best. There are three classes defined:
+"Bulk traffic", for large amounts of packets of normal size; "Low latency",
+for small amounts of traffic and/or a significant percentage of small
+packets; and "Lowest latency", for almost completely small packets or
+minimal traffic.
+In dynamic conservative mode, the InterruptThrottleRate value is set to 4000
+for traffic that falls in class "Bulk traffic". If traffic falls in the "Low
+latency" or "Lowest latency" class, the InterruptThrottleRate is increased
+stepwise to 20000. This default mode is suitable for most applications.
+For situations where low latency is vital such as cluster or
+grid computing, the algorithm can reduce latency even more when
+InterruptThrottleRate is set to mode 1. In this mode, which operates
+the same as mode 3, the InterruptThrottleRate will be increased stepwise to
+70000 for traffic in class "Lowest latency".
+In simplified mode the interrupt rate is based on the ratio of Tx and
+Rx traffic.  If the bytes per second rate is approximately equal the
+interrupt rate will drop as low as 2000 interrupts per second.  If the
+traffic is mostly transmit or mostly receive, the interrupt rate could
+be as high as 8000.
+Setting InterruptThrottleRate to 0 turns off any interrupt moderation
+and may improve small packet latency, but is generally not suitable
+for bulk throughput traffic.
+NOTE:  InterruptThrottleRate takes precedence over the TxAbsIntDelay and
+       RxAbsIntDelay parameters.  In other words, minimizing the receive
+       and/or transmit absolute delays does not force the controller to
+       generate more interrupts than what the Interrupt Throttle Rate
+       allows.
+NOTE:  When e1000e is loaded with default settings and multiple adapters
+       are in use simultaneously, the CPU utilization may increase non-
+       linearly.  In order to limit the CPU utilization without impacting
+       the overall throughput, we recommend that you load the driver as
+       follows:
+           modprobe e1000e InterruptThrottleRate=3000,3000,3000
+       This sets the InterruptThrottleRate to 3000 interrupts/sec for
+       the first, second, and third instances of the driver.  The range
+       of 2000 to 3000 interrupts per second works on a majority of
+       systems and is a good starting point, but the optimal value will
+       be platform-specific.  If CPU utilization is not a concern, use
+       RX_POLLING (NAPI) and default driver settings.
+RxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 0
+This value delays the generation of receive interrupts in units of 1.024
+microseconds.  Receive interrupt reduction can improve CPU efficiency if
+properly tuned for specific network traffic.  Increasing this value adds
+extra latency to frame reception and can end up decreasing the throughput
+of TCP traffic.  If the system is reporting dropped receives, this value
+may be set too high, causing the driver to run out of available receive
+descriptors.
+CAUTION:  When setting RxIntDelay to a value other than 0, adapters may
+          hang (stop transmitting) under certain network conditions.  If
+          this occurs a NETDEV WATCHDOG message is logged in the system
+          event log.  In addition, the controller is automatically reset,
+          restoring the network connection.  To eliminate the potential
+          for the hang ensure that RxIntDelay is set to 0.
+RxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+This value, in units of 1.024 microseconds, limits the delay in which a
+receive interrupt is generated.  Useful only if RxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is received within the set amount of time.  Proper tuning,
+along with RxIntDelay, may improve traffic throughput in specific network
+conditions.
+TxIntDelay
+----------
+Valid Range:   0-65535 (0=off)
+Default Value: 8
+This value delays the generation of transmit interrupts in units of
+1.024 microseconds.  Transmit interrupt reduction can improve CPU
+efficiency if properly tuned for specific network traffic.  If the
+system is reporting dropped transmits, this value may be set too high
+causing the driver to run out of available transmit descriptors.
+TxAbsIntDelay
+-------------
+Valid Range:   0-65535 (0=off)
+Default Value: 32
+This value, in units of 1.024 microseconds, limits the delay in which a
+transmit interrupt is generated.  Useful only if TxIntDelay is non-zero,
+this value ensures that an interrupt is generated after the initial
+packet is sent on the wire within the set amount of time.  Proper tuning,
+along with TxIntDelay, may improve traffic throughput in specific
+network conditions.
+Copybreak
+---------
+Valid Range:   0-xxxxxxx (0=off)
+Default Value: 256
+Driver copies all packets below or equaling this size to a fresh Rx
+buffer before handing it up the stack.
+This parameter is different than other parameters, in that it is a
+single (not 1,1,1 etc.) parameter applied to all driver instances and
+it is also available during runtime at
+/sys/module/e1000e/parameters/copybreak
+SmartPowerDownEnable
+--------------------
+Valid Range: 0-1
+Default Value:  0 (disabled)
+Allows PHY to turn off in lower power states. The user can set this parameter
+in supported chipsets.
+KumeranLockLoss
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+This workaround skips resetting the PHY at shutdown for the initial
+silicon releases of ICH8 systems.
+IntMode
+-------
+Valid Range: 0-2 (0=legacy, 1=MSI, 2=MSI-X)
+Default Value: 2
+Allows changing the interrupt mode at module load time, without requiring a
+recompile. If the driver load fails to enable a specific interrupt mode, the
+driver will try other interrupt modes, from least to most compatible.  The
+interrupt order is MSI-X, MSI, Legacy.  If specifying MSI (IntMode=1)
+interrupts, only MSI and Legacy will be attempted.
+CrcStripping
+------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+Strip the CRC from received packets before sending up the network stack.  If
+you have a machine with a BMC enabled but cannot receive IPMI traffic after
+loading or enabling the driver, try disabling this feature.
+WriteProtectNVM
+---------------
+Valid Range: 0-1
+Default Value: 1 (enabled)
+Set the hardware to ignore all write/erase cycles to the GbE region in the
+ICHx NVM (non-volatile memory).  This feature can be disabled by the
+WriteProtectNVM module parameter (enabled by default) only after a hardware
+reset, but the machine must be power cycled before trying to enable writes.
+Note: the kernel boot option iomem=relaxed may need to be set if the kernel
+config option CONFIG_STRICT_DEVMEM=y, if the root user wants to write the
+NVM from user space via ethtool.
+Additional Configurations
+=========================
+  Jumbo Frames
+  ------------
+  Jumbo Frames support is enabled by changing the MTU to a value larger than
+  the default of 1500.  Use the ifconfig command to increase the MTU size.
+  For example:
+       ifconfig eth<x> mtu 9000 up
+  This setting is not saved across reboots.
+  Notes:
+  - The maximum MTU setting for Jumbo Frames is 9216.  This value coincides
+    with the maximum Jumbo Frames size of 9234 bytes.
+  - Using Jumbo Frames at 10 or 100 Mbps is not supported and may result in
+    poor performance or loss of link.
+  - Some adapters limit Jumbo Frames sized packets to a maximum of
+    4096 bytes and some adapters do not support Jumbo Frames.
+  Ethtool
+  -------
+  The driver utilizes the ethtool interface for driver configuration and
+  diagnostics, as well as displaying statistical information.  We
+  strongly recommend downloading the latest version of Ethtool at:
+  http://sourceforge.net/projects/gkernel.
+  Speed and Duplex
+  ----------------
+  Speed and Duplex are configured through the Ethtool* utility. For
+  instructions,  refer to the Ethtool man page.
+  Enabling Wake on LAN* (WoL)
+  ---------------------------
+  WoL is configured through the Ethtool* utility. For instructions on
+  enabling WoL with Ethtool, refer to the Ethtool man page.
+  WoL will be enabled on the system during the next shut down or reboot.
+  For this driver version, in order to enable WoL, the e1000e driver must be
+  loaded when shutting down or rebooting the system.
+  In most cases Wake On LAN is only supported on port A for multiple port
+  adapters. To verify if a port supports Wake on LAN run ethtool eth<X>.
+Support
+=======
+For general information, go to the Intel support website at:
+    www.intel.com/support/
+or the Intel Wired Networking project hosted by Sourceforge at:
+    http://sourceforge.net/projects/e1000
+If an issue is identified with the released source code on the supported
+kernel with a supported adapter, email the specific information related
+to the issue to e1000-devel@lists.sf.net
diff --git a/Documentation/networking/ixgbevf.txt b/Documentation/networking/ixgbevf.txt
index 19015de6725f..21dd5d15b6b4 100755..100644
--- a/Documentation/networking/ixgbevf.txt
+++ b/Documentation/networking/ixgbevf.txt
@@ -1,19 +1,16 @@
 Linux* Base Driver for Intel(R) Network Connection
 ==================================================
-November 24, 2009
+Intel Gigabit Linux driver.
+Copyright(c) 1999 - 2010 Intel Corporation.
 Contents
 ========
- In This Release
 - Identifying Your Adapter
 - Known Issues/Troubleshooting
 - Support
-In This Release
-===============
 This file describes the ixgbevf Linux* Base Driver for Intel Network
 Connection.
@@ -33,7 +30,7 @@ Identifying Your Adapter
 For more information on how to identify your adapter, go to the Adapter &
 Driver ID Guide at:
-    http://support.intel.com/support/network/sb/CS-008441.htm
+    http://support.intel.com/support/go/network/adapter/idguide.htm
 Known Issues/Troubleshooting
 ============================
@@ -57,34 +54,3 @@ or the Intel Wired Networking project hosted by Sourceforge at:
 If an issue is identified with the released source code on the supported
 kernel with a supported adapter, email the specific information related
 to the issue to e1000-devel@lists.sf.net
-License
-=======
-Intel 10 Gigabit Linux driver.
-Copyright(c) 1999 - 2009 Intel Corporation.
-This program is free software; you can redistribute it and/or modify it
-under the terms and conditions of the GNU General Public License,
-version 2, as published by the Free Software Foundation.
-This program is distributed in the hope it will be useful, but WITHOUT
-ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
-more details.
-You should have received a copy of the GNU General Public License along with
-this program; if not, write to the Free Software Foundation, Inc.,
-51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
-The full GNU General Public License is included in this distribution in
-the file called "COPYING".
-Trademarks
-==========
-Intel, Itanium, and Pentium are trademarks or registered trademarks of
-Intel Corporation or its subsidiaries in the United States and other
-countries.
-* Other names and brands may be claimed as the property of others.
diff --git a/MAINTAINERS b/MAINTAINERS
index 668682d1f5fa..ae95fd4efbd4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -962,6 +962,13 @@ W:	http://www.fluff.org/ben/linux/
 S:      Maintained
 F:      arch/arm/mach-s3c6410/
+ARM/S5P ARM ARCHITECTURES
+M:      Kukjin Kim <kgene.kim@samsung.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+L:      linux-samsung-soc@vger.kernel.org (moderated for non-subscribers)
+S:      Maintained
+F:      arch/arm/mach-s5p*/
 ARM/SHMOBILE ARM ARCHITECTURE
 M:      Paul Mundt <lethal@linux-sh.org>
 M:      Magnus Damm <magnus.damm@gmail.com>
@@ -3056,16 +3063,27 @@ L:	netdev@vger.kernel.org
 S:      Maintained
 F:      drivers/net/ixp2000/
-INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe)
+INTEL ETHERNET DRIVERS (e100/e1000/e1000e/igb/igbvf/ixgb/ixgbe/ixgbevf)
 M:      Jeff Kirsher <jeffrey.t.kirsher@intel.com>
 M:      Jesse Brandeburg <jesse.brandeburg@intel.com>
 M:      Bruce Allan <bruce.w.allan@intel.com>
-M:      Alex Duyck <alexander.h.duyck@intel.com>
+M:      Carolyn Wyborny <carolyn.wyborny@intel.com>
+M:      Don Skidmore <donald.c.skidmore@intel.com>
+M:      Greg Rose <gregory.v.rose@intel.com>
 M:      PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>
+M:      Alex Duyck <alexander.h.duyck@intel.com>
 M:      John Ronciak <john.ronciak@intel.com>
 L:      e1000-devel@lists.sourceforge.net
 W:      http://e1000.sourceforge.net/
 S:      Supported
+F:      Documentation/networking/e100.txt
+F:      Documentation/networking/e1000.txt
+F:      Documentation/networking/e1000e.txt
+F:      Documentation/networking/igb.txt
+F:      Documentation/networking/igbvf.txt
+F:      Documentation/networking/ixgb.txt
+F:      Documentation/networking/ixgbe.txt
+F:      Documentation/networking/ixgbevf.txt
 F:      drivers/net/e100.c
 F:      drivers/net/e1000/
 F:      drivers/net/e1000e/
@@ -3073,6 +3091,7 @@ F:	drivers/net/igb/
 F:      drivers/net/igbvf/
 F:      drivers/net/ixgb/
 F:      drivers/net/ixgbe/
+F:      drivers/net/ixgbevf/
 INTEL PRO/WIRELESS 2100 NETWORK CONNECTION SUPPORT
 L:      linux-wireless@vger.kernel.org
@@ -3781,9 +3800,8 @@ W:	http://www.syskonnect.com
 S:      Supported
 MATROX FRAMEBUFFER DRIVER
-M:      Petr Vandrovec <vandrove@vc.cvut.cz>
 L:      linux-fbdev@vger.kernel.org
-S:      Maintained
+S:      Orphan
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
@@ -3970,8 +3988,8 @@ S:	Maintained
 F:      drivers/net/natsemi.c
 NCP FILESYSTEM
-M:      Petr Vandrovec <vandrove@vc.cvut.cz>
+M:      Petr Vandrovec <petr@vandrovec.name>
-S:      Maintained
+S:      Odd Fixes
 F:      fs/ncpfs/
 NCR DUAL 700 SCSI DRIVER (MICROCHANNEL)
diff --git a/Makefile b/Makefile
index 471c49fd2f43..77b5c6ed0ce5 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 36
-EXTRAVERSION = -rc6
+EXTRAVERSION = -rc7
 NAME = Sheep on Meth
 # *DOCUMENTATION*
diff --git a/arch/alpha/kernel/signal.c b/arch/alpha/kernel/signal.c
index d290845aef59..6f7feb5db271 100644
--- a/arch/alpha/kernel/signal.c
+++ b/arch/alpha/kernel/signal.c
@@ -48,7 +48,7 @@ SYSCALL_DEFINE2(osf_sigprocmask, int, how, unsigned long, newmask)
        sigset_t mask;
        unsigned long res;
-        siginitset(&mask, newmask & ~_BLOCKABLE);
+        siginitset(&mask, newmask & _BLOCKABLE);
        res = sigprocmask(how, &mask, &oldmask);
        if (!res) {
                force_successful_syscall_return();
diff --git a/arch/arm/oprofile/common.c b/arch/arm/oprofile/common.c
index 0691176899ff..72e09eb642dd 100644
--- a/arch/arm/oprofile/common.c
+++ b/arch/arm/oprofile/common.c
@@ -102,6 +102,7 @@ static int op_create_counter(int cpu, int event)
        if (IS_ERR(pevent)) {
                ret = PTR_ERR(pevent);
        } else if (pevent->state != PERF_EVENT_STATE_ACTIVE) {
+                perf_event_release_kernel(pevent);
                pr_warning("oprofile: failed to enable event %d "
                                "on CPU %d\n", event, cpu);
                ret = -EBUSY;
@@ -365,6 +366,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
        ret = init_driverfs();
        if (ret) {
                kfree(counter_config);
+                counter_config = NULL;
                return ret;
        }
@@ -402,7 +404,6 @@ void oprofile_arch_exit(void)
        struct perf_event *event;
        if (*perf_events) {
-                exit_driverfs();
                for_each_possible_cpu(cpu) {
                        for (id = 0; id < perf_num_counters; ++id) {
                                event = perf_events[cpu][id];
@@ -413,8 +414,10 @@ void oprofile_arch_exit(void)
                }
        }
-        if (counter_config)
+        if (counter_config) {
                kfree(counter_config);
+                exit_driverfs();
+        }
 }
 #else
 int __init oprofile_arch_init(struct oprofile_operations *ops)
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index e39a417a368d..a92cb499313f 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -33,7 +33,7 @@ config OMAP_DEBUG_DEVICES
 config OMAP_DEBUG_LEDS
        bool
        depends on OMAP_DEBUG_DEVICES
-        default y if LEDS
+        default y if LEDS_CLASS
 config OMAP_RESET_CLOCKS
        bool "Reset unused clocks during boot"
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index e31496e35b0f..0c8612fd8312 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -156,7 +156,7 @@ static irqreturn_t omap_mcbsp_rx_irq_handler(int irq, void *dev_id)
                /* Writing zero to RSYNC_ERR clears the IRQ */
                MCBSP_WRITE(mcbsp_rx, SPCR1, MCBSP_READ_CACHE(mcbsp_rx, SPCR1));
        } else {
-                complete(&mcbsp_rx->tx_irq_completion);
+                complete(&mcbsp_rx->rx_irq_completion);
        }
        return IRQ_HANDLED;
diff --git a/arch/avr32/kernel/module.c b/arch/avr32/kernel/module.c
index 98f94d041d9c..a727f54d64d6 100644
--- a/arch/avr32/kernel/module.c
+++ b/arch/avr32/kernel/module.c
@@ -314,10 +314,9 @@ int module_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
        vfree(module->arch.syminfo);
        module->arch.syminfo = NULL;
-        return module_bug_finalize(hdr, sechdrs, module);
+        return 0;
 }
 void module_arch_cleanup(struct module *module)
 {
-        module_bug_cleanup(module);
 }
diff --git a/arch/h8300/kernel/module.c b/arch/h8300/kernel/module.c
index 0865e291c20d..db4953dc4e1b 100644
--- a/arch/h8300/kernel/module.c
+++ b/arch/h8300/kernel/module.c
@@ -112,10 +112,9 @@ int module_finalize(const Elf_Ehdr *hdr,
                    const Elf_Shdr *sechdrs,
                    struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/m68k/mac/macboing.c b/arch/m68k/mac/macboing.c
index 8f0640847ad2..05285d08e547 100644
--- a/arch/m68k/mac/macboing.c
+++ b/arch/m68k/mac/macboing.c
@@ -162,7 +162,7 @@ static void mac_init_asc( void )
 void mac_mksound( unsigned int freq, unsigned int length )
 {
        __u32 cfreq = ( freq << 5 ) / 468;
-        __u32 flags;
+        unsigned long flags;
        int i;
        if ( mac_special_bell == NULL )
@@ -224,7 +224,7 @@ static void mac_nosound( unsigned long ignored )
 */
 static void mac_quadra_start_bell( unsigned int freq, unsigned int length, unsigned int volume )
 {
-        __u32 flags;
+        unsigned long flags;
        /* if the bell is already ringing, ring longer */
        if ( mac_bell_duration > 0 )
@@ -271,7 +271,7 @@ static void mac_quadra_start_bell( unsigned int freq, unsigned int length, unsig
 static void mac_quadra_ring_bell( unsigned long ignored )
 {
        int     i, count = mac_asc_samplespersec / HZ;
-        __u32 flags;
+        unsigned long flags;
        /*
         * we neither want a sound buffer overflow nor underflow, so we need to match
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 3ad59dde4852..5526faabfc21 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -13,6 +13,7 @@ config MIPS
        select HAVE_KPROBES
        select HAVE_KRETPROBES
        select RTC_LIB if !MACH_LOONGSON
+        select GENERIC_ATOMIC64 if !64BIT
 mainmenu "Linux/MIPS Kernel Configuration"
@@ -1646,8 +1647,16 @@ config MIPS_MT_SMP
        select SYS_SUPPORTS_SMP
        select SMP_UP
        help
-          This is a kernel model which is also known a VSMP or lately
+          This is a kernel model which is known a VSMP but lately has been
-          has been marketesed into SMVP.
+          marketesed into SMVP.
+          Virtual SMP uses the processor's VPEs  to implement virtual
+          processors. In currently available configuration of the 34K processor
+          this allows for a dual processor. Both processors will share the same
+          primary caches; each will obtain the half of the TLB for it's own
+          exclusive use. For a layman this model can be described as similar to
+          what Intel calls Hyperthreading.
+          For further information see http://www.linux-mips.org/wiki/34K#VSMP
 config MIPS_MT_SMTC
        bool "SMTC: Use all TCs on all VPEs for SMP"
@@ -1664,6 +1673,14 @@ config MIPS_MT_SMTC
        help
          This is a kernel model which is known a SMTC or lately has been
          marketesed into SMVP.
+          is presenting the available TC's of the core as processors to Linux.
+          On currently available 34K processors this means a Linux system will
+          see up to 5 processors. The implementation of the SMTC kernel differs
+          significantly from VSMP and cannot efficiently coexist in the same
+          kernel binary so the choice between VSMP and SMTC is a compile time
+          decision.
+          For further information see http://www.linux-mips.org/wiki/34K#SMTC
 endchoice
diff --git a/arch/mips/alchemy/common/prom.c b/arch/mips/alchemy/common/prom.c
index c29511b11d44..534021059629 100644
--- a/arch/mips/alchemy/common/prom.c
+++ b/arch/mips/alchemy/common/prom.c
@@ -43,7 +43,7 @@ int prom_argc;
 char **prom_argv;
 char **prom_envp;
-void prom_init_cmdline(void)
+void __init prom_init_cmdline(void)
 {
        int i;
@@ -104,7 +104,7 @@ static inline void str2eaddr(unsigned char *ea, unsigned char *str)
        }
 }
-int prom_get_ethernet_addr(char *ethernet_addr)
+int __init prom_get_ethernet_addr(char *ethernet_addr)
 {
        char *ethaddr_str;
@@ -123,7 +123,6 @@ int prom_get_ethernet_addr(char *ethernet_addr)
        return 0;
 }
-EXPORT_SYMBOL(prom_get_ethernet_addr);
 void __init prom_free_prom_memory(void)
 {
diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile
index ed9bb709c9a3..5fd7f7a58b7e 100644
--- a/arch/mips/boot/compressed/Makefile
+++ b/arch/mips/boot/compressed/Makefile
@@ -59,7 +59,7 @@ $(obj)/piggy.o: $(obj)/dummy.o $(obj)/vmlinux.bin.z FORCE
 hostprogs-y := calc_vmlinuz_load_addr
 VMLINUZ_LOAD_ADDRESS = $(shell $(obj)/calc_vmlinuz_load_addr \
-                $(objtree)/$(KBUILD_IMAGE) $(VMLINUX_LOAD_ADDRESS))
+                $(obj)/vmlinux.bin $(VMLINUX_LOAD_ADDRESS))
 vmlinuzobjs-y += $(obj)/piggy.o
diff --git a/arch/mips/cavium-octeon/Kconfig b/arch/mips/cavium-octeon/Kconfig
index 094c17e38e16..47323ca452dc 100644
--- a/arch/mips/cavium-octeon/Kconfig
+++ b/arch/mips/cavium-octeon/Kconfig
@@ -83,3 +83,7 @@ config ARCH_SPARSEMEM_ENABLE
        def_bool y
        select SPARSEMEM_STATIC
        depends on CPU_CAVIUM_OCTEON
+config CAVIUM_OCTEON_HELPER
+        def_bool y
+        depends on OCTEON_ETHERNET || PCI
diff --git a/arch/mips/cavium-octeon/cpu.c b/arch/mips/cavium-octeon/cpu.c
index c664c8cc2b42..a5b427909b5c 100644
--- a/arch/mips/cavium-octeon/cpu.c
+++ b/arch/mips/cavium-octeon/cpu.c
@@ -41,7 +41,7 @@ static int cnmips_cu2_call(struct notifier_block *nfb, unsigned long action,
        return NOTIFY_OK;               /* Let default notifier send signals */
 }
-static int cnmips_cu2_setup(void)
+static int __init cnmips_cu2_setup(void)
 {
        return cu2_notifier(cnmips_cu2_call, 0);
 }
diff --git a/arch/mips/cavium-octeon/executive/Makefile b/arch/mips/cavium-octeon/executive/Makefile
index 2fd66db6939e..7f41c5be2190 100644
--- a/arch/mips/cavium-octeon/executive/Makefile
+++ b/arch/mips/cavium-octeon/executive/Makefile
@@ -11,4 +11,4 @@
 obj-y += cvmx-bootmem.o cvmx-l2c.o cvmx-sysinfo.o octeon-model.o
-obj-$(CONFIG_PCI) += cvmx-helper-errata.o cvmx-helper-jtag.o
+obj-$(CONFIG_CAVIUM_OCTEON_HELPER) += cvmx-helper-errata.o cvmx-helper-jtag.o
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index c63c56bfd184..47d87da379f9 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -782,6 +782,10 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
 */
 #define atomic64_add_negative(i, v) (atomic64_add_return(i, (v)) < 0)
+#else /* !CONFIG_64BIT */
+#include <asm-generic/atomic64.h>
 #endif /* CONFIG_64BIT */
 /*
diff --git a/arch/mips/include/asm/cop2.h b/arch/mips/include/asm/cop2.h
index 2cb2f0c2c4f8..3532e2c5f098 100644
--- a/arch/mips/include/asm/cop2.h
+++ b/arch/mips/include/asm/cop2.h
@@ -24,7 +24,7 @@ extern int cu2_notifier_call_chain(unsigned long val, void *v);
 #define cu2_notifier(fn, pri)                                           \
 ({                                                                      \
-        static struct notifier_block fn##_nb __cpuinitdata = {          \
+        static struct notifier_block fn##_nb = {                        \
                .notifier_call = fn,                                    \
                .priority = pri                                         \
        };                                                              \
diff --git a/arch/mips/include/asm/gic.h b/arch/mips/include/asm/gic.h
index 9b9436a4d816..86548da650e7 100644
--- a/arch/mips/include/asm/gic.h
+++ b/arch/mips/include/asm/gic.h
@@ -321,6 +321,7 @@ struct gic_intrmask_regs {
 */
 struct gic_intr_map {
        unsigned int cpunum;    /* Directed to this CPU */
+#define GIC_UNUSED              0xdead                  /* Dummy data */
        unsigned int pin;       /* Directed to this Pin */
        unsigned int polarity;  /* Polarity : +/-       */
        unsigned int trigtype;  /* Trigger  : Edge/Levl */
diff --git a/arch/mips/include/asm/mach-tx49xx/kmalloc.h b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
index b74caf65482b..ff9a8b86cb93 100644
--- a/arch/mips/include/asm/mach-tx49xx/kmalloc.h
+++ b/arch/mips/include/asm/mach-tx49xx/kmalloc.h
@@ -1,6 +1,6 @@
 #ifndef __ASM_MACH_TX49XX_KMALLOC_H
 #define __ASM_MACH_TX49XX_KMALLOC_H
-#define ARCH_KMALLOC_MINALIGN   L1_CACHE_BYTES
+#define ARCH_DMA_MINALIGN L1_CACHE_BYTES
 #endif /* __ASM_MACH_TX49XX_KMALLOC_H */
diff --git a/arch/mips/include/asm/mips-boards/maltaint.h b/arch/mips/include/asm/mips-boards/maltaint.h
index cea872fc6f5c..d11aa02a956a 100644
--- a/arch/mips/include/asm/mips-boards/maltaint.h
+++ b/arch/mips/include/asm/mips-boards/maltaint.h
@@ -88,9 +88,6 @@
 #define GIC_EXT_INTR(x)         x
-/* Dummy data */
-#define X                       0xdead
 /* External Interrupts used for IPI */
 #define GIC_IPI_EXT_INTR_RESCHED_VPE0   16
 #define GIC_IPI_EXT_INTR_CALLFNC_VPE0   17
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index a16beafcea91..e59cd1ac09c2 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -150,6 +150,20 @@ typedef struct { unsigned long pgprot; } pgprot_t;
    ((unsigned long)(x) - PAGE_OFFSET + PHYS_OFFSET)
 #endif
 #define __va(x)         ((void *)((unsigned long)(x) + PAGE_OFFSET - PHYS_OFFSET))
+/*
+ * RELOC_HIDE was originally added by 6007b903dfe5f1d13e0c711ac2894bdd4a61b1ad
+ * (lmo) rsp. 8431fd094d625b94d364fe393076ccef88e6ce18 (kernel.org).  The
+ * discussion can be found in lkml posting
+ * <a2ebde260608230500o3407b108hc03debb9da6e62c@mail.gmail.com> which is
+ * archived at http://lists.linuxcoding.com/kernel/2006-q3/msg17360.html
+ *
+ * It is unclear if the misscompilations mentioned in
+ * http://lkml.org/lkml/2010/8/8/138 also affect MIPS so we keep this one
+ * until GCC 3.x has been retired before we can apply
+ * https://patchwork.linux-mips.org/patch/1541/
+ */
 #define __pa_symbol(x)  __pa(RELOC_HIDE((unsigned long)(x), 0))
 #define pfn_to_kaddr(pfn)       __va((pfn) << PAGE_SHIFT)
diff --git a/arch/mips/include/asm/thread_info.h b/arch/mips/include/asm/thread_info.h
index 2376f2e06e47..70df9c0d3c5b 100644
--- a/arch/mips/include/asm/thread_info.h
+++ b/arch/mips/include/asm/thread_info.h
@@ -146,7 +146,8 @@ register struct thread_info *__current_thread_info __asm__("$28");
 #define _TIF_LOAD_WATCH         (1<<TIF_LOAD_WATCH)
 /* work to do on interrupt/exception return */
-#define _TIF_WORK_MASK          (0x0000ffef & ~_TIF_SECCOMP)
+#define _TIF_WORK_MASK          (0x0000ffef &                           \
+                                        ~(_TIF_SECCOMP | _TIF_SYSCALL_AUDIT))
 /* work to do on any return to u-space */
 #define _TIF_ALLWORK_MASK       (0x8000ffff & ~_TIF_SECCOMP)
diff --git a/arch/mips/include/asm/unistd.h b/arch/mips/include/asm/unistd.h
index baa318a59c97..550725b881d5 100644
--- a/arch/mips/include/asm/unistd.h
+++ b/arch/mips/include/asm/unistd.h
@@ -356,16 +356,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 333)
 #define __NR_accept4                    (__NR_Linux + 334)
 #define __NR_recvmmsg                   (__NR_Linux + 335)
+#define __NR_fanotify_init              (__NR_Linux + 336)
+#define __NR_fanotify_mark              (__NR_Linux + 337)
+#define __NR_prlimit64                  (__NR_Linux + 338)
 /*
 * Offset of the last Linux o32 flavoured syscall
 */
-#define __NR_Linux_syscalls             335
+#define __NR_Linux_syscalls             338
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI32 */
 #define __NR_O32_Linux                  4000
-#define __NR_O32_Linux_syscalls         335
+#define __NR_O32_Linux_syscalls         338
 #if _MIPS_SIM == _MIPS_SIM_ABI64
@@ -668,16 +671,19 @@
 #define __NR_perf_event_open            (__NR_Linux + 292)
 #define __NR_accept4                    (__NR_Linux + 293)
 #define __NR_recvmmsg                   (__NR_Linux + 294)
+#define __NR_fanotify_init              (__NR_Linux + 295)
+#define __NR_fanotify_mark              (__NR_Linux + 296)
+#define __NR_prlimit64                  (__NR_Linux + 297)
 /*
 * Offset of the last Linux 64-bit flavoured syscall
 */
-#define __NR_Linux_syscalls             294
+#define __NR_Linux_syscalls             297
 #endif /* _MIPS_SIM == _MIPS_SIM_ABI64 */
 #define __NR_64_Linux                   5000
-#define __NR_64_Linux_syscalls          294
+#define __NR_64_Linux_syscalls          297
 #if _MIPS_SIM == _MIPS_SIM_NABI32
@@ -985,16 +991,19 @@
 #define __NR_accept4                    (__NR_Linux + 297)
 #define __NR_recvmmsg                   (__NR_Linux + 298)
 #define __NR_getdents64                 (__NR_Linux + 299)
+#define __NR_fanotify_init              (__NR_Linux + 300)
+#define __NR_fanotify_mark              (__NR_Linux + 301)
+#define __NR_prlimit64                  (__NR_Linux + 302)
 /*
 * Offset of the last N32 flavoured syscall
 */
-#define __NR_Linux_syscalls             299
+#define __NR_Linux_syscalls             302
 #endif /* _MIPS_SIM == _MIPS_SIM_NABI32 */
 #define __NR_N32_Linux                  6000
-#define __NR_N32_Linux_syscalls         299
+#define __NR_N32_Linux_syscalls         302
 #ifdef __KERNEL__
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index b181f2f0ea8e..82ba9f62f49e 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -7,7 +7,6 @@
 #include <asm/io.h>
 #include <asm/gic.h>
 #include <asm/gcmpregs.h>
-#include <asm/mips-boards/maltaint.h>
 #include <asm/irq.h>
 #include <linux/hardirq.h>
 #include <asm-generic/bitops/find.h>
@@ -131,7 +130,7 @@ static int gic_set_affinity(unsigned int irq, const struct cpumask *cpumask)
        int             i;
        irq -= _irqbase;
-        pr_debug(KERN_DEBUG "%s(%d) called\n", __func__, irq);
+        pr_debug("%s(%d) called\n", __func__, irq);
        cpumask_and(&tmp, cpumask, cpu_online_mask);
        if (cpus_empty(tmp))
                return -1;
@@ -222,7 +221,7 @@ static void __init gic_basic_init(int numintrs, int numvpes,
        /* Setup specifics */
        for (i = 0; i < mapsize; i++) {
                cpu = intrmap[i].cpunum;
-                if (cpu == X)
+                if (cpu == GIC_UNUSED)
                        continue;
                if (cpu == 0 && i != 0 && intrmap[i].flags == 0)
                        continue;
diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c
index 1f4e2fa64140..f4546e97c60d 100644
--- a/arch/mips/kernel/kgdb.c
+++ b/arch/mips/kernel/kgdb.c
@@ -283,7 +283,7 @@ static int kgdb_mips_notify(struct notifier_block *self, unsigned long cmd,
        struct pt_regs *regs = args->regs;
        int trap = (regs->cp0_cause & 0x7c) >> 2;
-        /* Userpace events, ignore. */
+        /* Userspace events, ignore. */
        if (user_mode(regs))
                return NOTIFY_DONE;
diff --git a/arch/mips/kernel/kspd.c b/arch/mips/kernel/kspd.c
index 80e2ba694bab..29811f043399 100644
--- a/arch/mips/kernel/kspd.c
+++ b/arch/mips/kernel/kspd.c
@@ -251,7 +251,7 @@ void sp_work_handle_request(void)
                memset(&tz, 0, sizeof(tz));
                if ((ret.retval = sp_syscall(__NR_gettimeofday, (int)&tv,
                                             (int)&tz, 0, 0)) == 0)
-                ret.retval = tv.tv_sec;
+                        ret.retval = tv.tv_sec;
                break;
        case MTSP_SYSCALL_EXIT:
diff --git a/arch/mips/kernel/linux32.c b/arch/mips/kernel/linux32.c
index c2dab140dc98..6343b4a5b835 100644
--- a/arch/mips/kernel/linux32.c
+++ b/arch/mips/kernel/linux32.c
@@ -341,3 +341,10 @@ asmlinkage long sys32_lookup_dcookie(u32 a0, u32 a1, char __user *buf,
 {
        return sys_lookup_dcookie(merge_64(a0, a1), buf, len);
 }
+SYSCALL_DEFINE6(32_fanotify_mark, int, fanotify_fd, unsigned int, flags,
+                u64, a3, u64, a4, int, dfd, const char  __user *, pathname)
+{
+        return sys_fanotify_mark(fanotify_fd, flags, merge_64(a3, a4),
+                                 dfd, pathname);
+}
diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S
index 17202bbe843f..584415eef8c9 100644
--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -583,7 +583,10 @@ einval:	li	v0, -ENOSYS
        sys     sys_rt_tgsigqueueinfo   4
        sys     sys_perf_event_open     5
        sys     sys_accept4             4
-        sys     sys_recvmmsg            5
+        sys     sys_recvmmsg            5       /* 4335 */
+        sys     sys_fanotify_init       2
+        sys     sys_fanotify_mark       6
+        sys     sys_prlimit64           4
        .endm
        /* We pre-compute the number of _instruction_ bytes needed to
diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S
index a8a6c596eb04..5573f8e4e326 100644
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -416,9 +416,12 @@ sys_call_table:
        PTR     sys_pipe2
        PTR     sys_inotify_init1
        PTR     sys_preadv
-        PTR     sys_pwritev                     /* 5390 */
+        PTR     sys_pwritev                     /* 5290 */
        PTR     sys_rt_tgsigqueueinfo
        PTR     sys_perf_event_open
        PTR     sys_accept4
-        PTR     sys_recvmmsg
+        PTR     sys_recvmmsg
+        PTR     sys_fanotify_init               /* 5295 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S
index a3d66137731a..1e38ec97672e 100644
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -419,5 +419,8 @@ EXPORT(sysn32_call_table)
        PTR     sys_perf_event_open
        PTR     sys_accept4
        PTR     compat_sys_recvmmsg
-        PTR     sys_getdents
+        PTR     sys_getdents64
+        PTR     sys_fanotify_init               /* 6300 */
+        PTR     sys_fanotify_mark
+        PTR     sys_prlimit64
        .size   sysn32_call_table,.-sysn32_call_table
diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S
index 813689ef2384..171979fc98e5 100644
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -538,5 +538,8 @@ sys_call_table:
        PTR     compat_sys_rt_tgsigqueueinfo
        PTR     sys_perf_event_open
        PTR     sys_accept4
-        PTR     compat_sys_recvmmsg
+        PTR     compat_sys_recvmmsg             /* 4335 */
+        PTR     sys_fanotify_init
+        PTR     sys_32_fanotify_mark
+        PTR     sys_prlimit64
        .size   sys_call_table,.-sys_call_table
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index 7ba890860d98..469d4019f795 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -44,27 +44,39 @@ static inline int cpu_is_noncoherent_r10000(struct device *dev)
 static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
 {
+        gfp_t dma_flag;
        /* ignore region specifiers */
        gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
-#ifdef CONFIG_ZONE_DMA
+#ifdef CONFIG_ISA
        if (dev == NULL)
-                gfp |= __GFP_DMA;
+                dma_flag = __GFP_DMA;
-        else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
-                gfp |= __GFP_DMA;
        else
 #endif
-#ifdef CONFIG_ZONE_DMA32
+#if defined(CONFIG_ZONE_DMA32) && defined(CONFIG_ZONE_DMA)
             if (dev->coherent_dma_mask < DMA_BIT_MASK(32))
-                gfp |= __GFP_DMA32;
+                        dma_flag = __GFP_DMA;
+        else if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                        dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA32) && !defined(CONFIG_ZONE_DMA)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA32;
+        else
+#endif
+#if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+             if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
+                dma_flag = __GFP_DMA;
        else
 #endif
-                ;
+                dma_flag = 0;
        /* Don't invoke OOM killer */
        gfp |= __GFP_NORETRY;
-        return gfp;
+        return gfp | dma_flag;
 }
 void *dma_alloc_noncoherent(struct device *dev, size_t size,
diff --git a/arch/mips/mm/sc-rm7k.c b/arch/mips/mm/sc-rm7k.c
index 1ef75cd80a0d..274af3be1442 100644
--- a/arch/mips/mm/sc-rm7k.c
+++ b/arch/mips/mm/sc-rm7k.c
@@ -30,7 +30,7 @@
 #define tc_lsize        32
 extern unsigned long icache_way_size, dcache_way_size;
-unsigned long tcache_size;
+static unsigned long tcache_size;
 #include <asm/r4kcache.h>
diff --git a/arch/mips/mti-malta/malta-int.c b/arch/mips/mti-malta/malta-int.c
index 15949b0be811..b79b24afe3a2 100644
--- a/arch/mips/mti-malta/malta-int.c
+++ b/arch/mips/mti-malta/malta-int.c
@@ -385,6 +385,8 @@ static int __initdata msc_nr_eicirqs = ARRAY_SIZE(msc_eicirqmap);
 */
 #define GIC_CPU_NMI GIC_MAP_TO_NMI_MSK
+#define X GIC_UNUSED
 static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
        { X, X,            X,           X,              0 },
        { X, X,            X,           X,              0 },
@@ -404,6 +406,7 @@ static struct gic_intr_map gic_intr_map[GIC_NUM_INTRS] = {
        { X, X,            X,           X,              0 },
        /* The remainder of this table is initialised by fill_ipi_map */
 };
+#undef X
 /*
 * GCMP needs to be detected before any SMP initialisation
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index 71f7d27b0d4c..f31218e17d3c 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -118,7 +118,7 @@ static int __init rc32434_pcibridge_init(void)
        if (!((pcicvalue == PCIM_H_EA) ||
              (pcicvalue == PCIM_H_IA_FIX) ||
              (pcicvalue == PCIM_H_IA_RR))) {
-                pr_err(KERN_ERR "PCI init error!!!\n");
+                pr_err("PCI init error!!!\n");
                /* Not in Host Mode, return ERROR */
                return -1;
        }
diff --git a/arch/mips/pnx8550/common/reset.c b/arch/mips/pnx8550/common/reset.c
index fadd8744a6bc..e7a12ff304b9 100644
--- a/arch/mips/pnx8550/common/reset.c
+++ b/arch/mips/pnx8550/common/reset.c
@@ -22,29 +22,19 @@
 */
 #include <linux/kernel.h>
+#include <asm/processor.h>
 #include <asm/reboot.h>
 #include <glb.h>
 void pnx8550_machine_restart(char *command)
 {
-        char head[] = "************* Machine restart *************";
-        char foot[] = "*******************************************";
-        printk("\n\n");
-        printk("%s\n", head);
-        if (command != NULL)
-                printk("* %s\n", command);
-        printk("%s\n", foot);
        PNX8550_RST_CTL = PNX8550_RST_DO_SW_RST;
 }
 void pnx8550_machine_halt(void)
 {
-        printk("*** Machine halt. (Not implemented) ***\n");
+        while (1) {
-}
+                if (cpu_wait)
+                        cpu_wait();
-void pnx8550_machine_power_off(void)
+        }
-{
-        printk("*** Machine power off.  (Not implemented) ***\n");
 }
diff --git a/arch/mips/pnx8550/common/setup.c b/arch/mips/pnx8550/common/setup.c
index 64246c9c875c..43cb3945fdbf 100644
--- a/arch/mips/pnx8550/common/setup.c
+++ b/arch/mips/pnx8550/common/setup.c
@@ -44,7 +44,6 @@
 extern void __init board_setup(void);
 extern void pnx8550_machine_restart(char *);
 extern void pnx8550_machine_halt(void);
-extern void pnx8550_machine_power_off(void);
 extern struct resource ioport_resource;
 extern struct resource iomem_resource;
 extern char *prom_getcmdline(void);
@@ -100,7 +99,7 @@ void __init plat_mem_setup(void)
        _machine_restart = pnx8550_machine_restart;
        _machine_halt = pnx8550_machine_halt;
-        pm_power_off = pnx8550_machine_power_off;
+        pm_power_off = pnx8550_machine_halt;
        /* Clear the Global 2 Register, PCI Inta Output Enable Registers
           Bit 1:Enable DAC Powerdown
diff --git a/arch/mn10300/kernel/module.c b/arch/mn10300/kernel/module.c
index 6aea7fd76993..196a111e2e29 100644
--- a/arch/mn10300/kernel/module.c
+++ b/arch/mn10300/kernel/module.c
@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                    const Elf_Shdr *sechdrs,
                    struct module *me)
 {
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 /*
@@ -214,5 +214,4 @@ int module_finalize(const Elf_Ehdr *hdr,
 */
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/mn10300/mm/cache.c b/arch/mn10300/mm/cache.c
index 1b76719ec1c3..9261217e8d2c 100644
--- a/arch/mn10300/mm/cache.c
+++ b/arch/mn10300/mm/cache.c
@@ -54,13 +54,30 @@ EXPORT_SYMBOL(flush_icache_page);
 void flush_icache_range(unsigned long start, unsigned long end)
 {
 #ifdef CONFIG_MN10300_CACHE_WBACK
-        unsigned long addr, size, off;
+        unsigned long addr, size, base, off;
        struct page *page;
        pgd_t *pgd;
        pud_t *pud;
        pmd_t *pmd;
        pte_t *ppte, pte;
+        if (end > 0x80000000UL) {
+                /* addresses above 0xa0000000 do not go through the cache */
+                if (end > 0xa0000000UL) {
+                        end = 0xa0000000UL;
+                        if (start >= end)
+                                return;
+                }
+                /* kernel addresses between 0x80000000 and 0x9fffffff do not
+                 * require page tables, so we just map such addresses directly */
+                base = (start >= 0x80000000UL) ? start : 0x80000000UL;
+                mn10300_dcache_flush_range(base, end);
+                if (base == start)
+                        goto invalidate;
+                end = base;
+        }
        for (; start < end; start += size) {
                /* work out how much of the page to flush */
                off = start & (PAGE_SIZE - 1);
@@ -104,6 +121,7 @@ void flush_icache_range(unsigned long start, unsigned long end)
        }
 #endif
+invalidate:
        mn10300_icache_inv();
 }
 EXPORT_SYMBOL(flush_icache_range);
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 159a2b81e90c..6e81bb596e5b 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -941,11 +941,10 @@ int module_finalize(const Elf_Ehdr *hdr,
        nsyms = newptr - (Elf_Sym *)symhdr->sh_addr;
        DEBUGP("NEW num_symtab %lu\n", nsyms);
        symhdr->sh_size = nsyms * sizeof(Elf_Sym);
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
        deregister_unwind_table(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/kernel/module.c b/arch/powerpc/kernel/module.c
index 477c663e0140..49cee9df225b 100644
--- a/arch/powerpc/kernel/module.c
+++ b/arch/powerpc/kernel/module.c
@@ -63,11 +63,6 @@ int module_finalize(const Elf_Ehdr *hdr,
                const Elf_Shdr *sechdrs, struct module *me)
 {
        const Elf_Shdr *sect;
-        int err;
-        err = module_bug_finalize(hdr, sechdrs, me);
-        if (err)
-                return err;
        /* Apply feature fixups */
        sect = find_section(hdr, sechdrs, "__ftr_fixup");
@@ -101,5 +96,4 @@ int module_finalize(const Elf_Ehdr *hdr,
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/powerpc/platforms/512x/clock.c b/arch/powerpc/platforms/512x/clock.c
index 5b243bd3eb3b..3dc2a8d262b8 100644
--- a/arch/powerpc/platforms/512x/clock.c
+++ b/arch/powerpc/platforms/512x/clock.c
@@ -57,7 +57,7 @@ static struct clk *mpc5121_clk_get(struct device *dev, const char *id)
        int id_match = 0;
        if (dev == NULL || id == NULL)
-                return NULL;
+                return clk;
        mutex_lock(&clocks_mutex);
        list_for_each_entry(p, &clocks, node) {
diff --git a/arch/powerpc/platforms/52xx/efika.c b/arch/powerpc/platforms/52xx/efika.c
index 45c0cb9b67e6..18c104820198 100644
--- a/arch/powerpc/platforms/52xx/efika.c
+++ b/arch/powerpc/platforms/52xx/efika.c
@@ -99,7 +99,7 @@ static void __init efika_pcisetup(void)
        if (bus_range == NULL || len < 2 * sizeof(int)) {
                printk(KERN_WARNING EFIKA_PLATFORM_NAME
                       ": Can't get bus-range for %s\n", pcictrl->full_name);
-                return;
+                goto out_put;
        }
        if (bus_range[1] == bus_range[0])
@@ -111,12 +111,12 @@ static void __init efika_pcisetup(void)
        printk(" controlled by %s\n", pcictrl->full_name);
        printk("\n");
-        hose = pcibios_alloc_controller(of_node_get(pcictrl));
+        hose = pcibios_alloc_controller(pcictrl);
        if (!hose) {
                printk(KERN_WARNING EFIKA_PLATFORM_NAME
                       ": Can't allocate PCI controller structure for %s\n",
                       pcictrl->full_name);
-                return;
+                goto out_put;
        }
        hose->first_busno = bus_range[0];
@@ -124,6 +124,9 @@ static void __init efika_pcisetup(void)
        hose->ops = &rtas_pci_ops;
        pci_process_bridge_OF_ranges(hose, pcictrl, 0);
+        return;
+out_put:
+        of_node_put(pcictrl);
 }
 #else
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_common.c b/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 6e905314ad5d..41f3a7eda1de 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -325,12 +325,16 @@ int mpc5200_psc_ac97_gpio_reset(int psc_number)
        clrbits32(&simple_gpio->simple_dvo, sync | out);
        clrbits8(&wkup_gpio->wkup_dvo, reset);
-        /* wait at lease 1 us */
+        /* wait for 1 us */
-        udelay(2);
+        udelay(1);
        /* Deassert reset */
        setbits8(&wkup_gpio->wkup_dvo, reset);
+        /* wait at least 200ns */
+        /* 7 ~= (200ns * timebase) / ns2sec */
+        __delay(7);
        /* Restore pin-muxing */
        out_be32(&simple_gpio->port_config, mux);
diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c
index 22cfd634c355..f7167ee4604c 100644
--- a/arch/s390/kernel/module.c
+++ b/arch/s390/kernel/module.c
@@ -407,10 +407,9 @@ int module_finalize(const Elf_Ehdr *hdr,
 {
        vfree(me->arch.syminfo);
        me->arch.syminfo = NULL;
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
 }
diff --git a/arch/sh/kernel/module.c b/arch/sh/kernel/module.c
index 43adddfe4c04..ae0be697a89e 100644
--- a/arch/sh/kernel/module.c
+++ b/arch/sh/kernel/module.c
@@ -149,13 +149,11 @@ int module_finalize(const Elf_Ehdr *hdr,
        int ret = 0;
        ret |= module_dwarf_finalize(hdr, sechdrs, me);
-        ret |= module_bug_finalize(hdr, sechdrs, me);
        return ret;
 }
 void module_arch_cleanup(struct module *mod)
 {
-        module_bug_cleanup(mod);
        module_dwarf_cleanup(mod);
 }
diff --git a/arch/um/drivers/net_kern.c b/arch/um/drivers/net_kern.c
index 2ab233ba32c1..47d0c37897d5 100644
--- a/arch/um/drivers/net_kern.c
+++ b/arch/um/drivers/net_kern.c
@@ -255,18 +255,6 @@ static void uml_net_tx_timeout(struct net_device *dev)
        netif_wake_queue(dev);
 }
-static int uml_net_set_mac(struct net_device *dev, void *addr)
-{
-        struct uml_net_private *lp = netdev_priv(dev);
-        struct sockaddr *hwaddr = addr;
-        spin_lock_irq(&lp->lock);
-        eth_mac_addr(dev, hwaddr->sa_data);
-        spin_unlock_irq(&lp->lock);
-        return 0;
-}
 static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
 {
        dev->mtu = new_mtu;
@@ -373,7 +361,7 @@ static const struct net_device_ops uml_netdev_ops = {
        .ndo_start_xmit         = uml_net_start_xmit,
        .ndo_set_multicast_list = uml_net_set_multicast_list,
        .ndo_tx_timeout         = uml_net_tx_timeout,
-        .ndo_set_mac_address    = uml_net_set_mac,
+        .ndo_set_mac_address    = eth_mac_addr,
        .ndo_change_mtu         = uml_net_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
 };
@@ -472,7 +460,8 @@ static void eth_configure(int n, void *init, char *mac,
            ((*transport->user->init)(&lp->user, dev) != 0))
                goto out_unregister;
-        eth_mac_addr(dev, device->mac);
+        /* don't use eth_mac_addr, it will not work here */
+        memcpy(dev->dev_addr, device->mac, ETH_ALEN);
        dev->mtu = transport->user->mtu;
        dev->netdev_ops = &uml_netdev_ops;
        dev->ethtool_ops = &uml_net_ethtool_ops;
diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index fb7a5f052e2b..fb16f17e59be 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -61,7 +61,7 @@ struct cstate_entry {
                unsigned int ecx;
        } states[ACPI_PROCESSOR_MAX_POWER];
 };
-static struct cstate_entry *cpu_cstate_entry;   /* per CPU ptr */
+static struct cstate_entry __percpu *cpu_cstate_entry;  /* per CPU ptr */
 static short mwait_supported[ACPI_PROCESSOR_MAX_POWER];
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index f1efebaf5510..5c5b8f3dddb5 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -306,14 +306,19 @@ void arch_init_copy_chip_data(struct irq_desc *old_desc,
        old_cfg = old_desc->chip_data;
-        memcpy(cfg, old_cfg, sizeof(struct irq_cfg));
+        cfg->vector = old_cfg->vector;
+        cfg->move_in_progress = old_cfg->move_in_progress;
+        cpumask_copy(cfg->domain, old_cfg->domain);
+        cpumask_copy(cfg->old_domain, old_cfg->old_domain);
        init_copy_irq_2_pin(old_cfg, cfg, node);
 }
-static void free_irq_cfg(struct irq_cfg *old_cfg)
+static void free_irq_cfg(struct irq_cfg *cfg)
 {
-        kfree(old_cfg);
+        free_cpumask_var(cfg->domain);
+        free_cpumask_var(cfg->old_domain);
+        kfree(cfg);
 }
 void arch_free_chip_data(struct irq_desc *old_desc, struct irq_desc *desc)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 490dac63c2d2..f2f9ac7da25c 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -545,7 +545,7 @@ void __cpuinit cpu_detect(struct cpuinfo_x86 *c)
        }
 }
-static void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
+void __cpuinit get_cpu_cap(struct cpuinfo_x86 *c)
 {
        u32 tfms, xlvl;
        u32 ebx;
diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h
index 3624e8a0f71b..f668bb1f7d43 100644
--- a/arch/x86/kernel/cpu/cpu.h
+++ b/arch/x86/kernel/cpu/cpu.h
@@ -33,5 +33,6 @@ extern const struct cpu_dev *const __x86_cpu_dev_start[],
                            *const __x86_cpu_dev_end[];
 extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c);
+extern void get_cpu_cap(struct cpuinfo_x86 *c);
 #endif
diff --git a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
index 994230d4dc4e..4f6f679f2799 100644
--- a/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
+++ b/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
@@ -368,16 +368,22 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
                return -ENODEV;
        out_obj = output.pointer;
-        if (out_obj->type != ACPI_TYPE_BUFFER)
+        if (out_obj->type != ACPI_TYPE_BUFFER) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
        errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
-        if (errors)
+        if (errors) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
        supported = *((u32 *)(out_obj->buffer.pointer + 4));
-        if (!(supported & 0x1))
+        if (!(supported & 0x1)) {
-                return -ENODEV;
+                ret = -ENODEV;
+                goto out_free;
+        }
 out_free:
        kfree(output.pointer);
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 85f69cdeae10..b4389441efbb 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -39,6 +39,7 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
                        misc_enable &= ~MSR_IA32_MISC_ENABLE_LIMIT_CPUID;
                        wrmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
                        c->cpuid_level = cpuid_eax(0);
+                        get_cpu_cap(c);
                }
        }
diff --git a/arch/x86/kernel/cpu/perf_event_p4.c b/arch/x86/kernel/cpu/perf_event_p4.c
index b560db3305be..249015173992 100644
--- a/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/arch/x86/kernel/cpu/perf_event_p4.c
@@ -660,8 +660,12 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
        for (idx = 0; idx < x86_pmu.num_counters; idx++) {
                int overflow;
-                if (!test_bit(idx, cpuc->active_mask))
+                if (!test_bit(idx, cpuc->active_mask)) {
+                        /* catch in-flight IRQs */
+                        if (__test_and_clear_bit(idx, cpuc->running))
+                                handled++;
                        continue;
+                }
                event = cpuc->events[idx];
                hwc = &event->hw;
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 410fdb3f1939..7494999141b3 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -506,7 +506,7 @@ static int hpet_assign_irq(struct hpet_dev *dev)
 {
        unsigned int irq;
-        irq = create_irq();
+        irq = create_irq_nr(0, -1);
        if (!irq)
                return -EINVAL;
diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index e0bc186d7501..1c355c550960 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -239,11 +239,10 @@ int module_finalize(const Elf_Ehdr *hdr,
                apply_paravirt(pseg, pseg + para->sh_size);
        }
-        return module_bug_finalize(hdr, sechdrs, me);
+        return 0;
 }
 void module_arch_cleanup(struct module *mod)
 {
        alternatives_smp_module_del(mod);
-        module_bug_cleanup(mod);
 }
diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c
index 009b819f48d0..f1575c9a2572 100644
--- a/arch/x86/oprofile/nmi_int.c
+++ b/arch/x86/oprofile/nmi_int.c
@@ -674,6 +674,7 @@ static int __init ppro_init(char **cpu_type)
        case 0x0f:
        case 0x16:
        case 0x17:
+        case 0x1d:
                *cpu_type = "i386/core_2";
                break;
        case 0x1a:
diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
index 1a5353a753fc..b2bb5aa3b054 100644
--- a/arch/x86/xen/time.c
+++ b/arch/x86/xen/time.c
@@ -489,8 +489,9 @@ static void xen_hvm_setup_cpu_clockevents(void)
 __init void xen_hvm_init_time_ops(void)
 {
        /* vector callback is needed otherwise we cannot receive interrupts
-         * on cpu > 0 */
+         * on cpu > 0 and at this point we don't know how many cpus are
-        if (!xen_have_vector_callback && num_present_cpus() > 1)
+         * available */
+        if (!xen_have_vector_callback)
                return;
        if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
                printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index b811f2173f6f..88681aca88c5 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -105,7 +105,7 @@ config ACPI_EC_DEBUGFS
          Be aware that using this interface can confuse your Embedded
          Controller in a way that a normal reboot is not enough. You then
-          have to power of your system, and remove the laptop battery for
+          have to power off your system, and remove the laptop battery for
          some seconds.
          An Embedded Controller typically is available on laptops and reads
          sensor values like battery state and temperature.
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index b76848c80be3..6b115f6c4313 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -382,31 +382,32 @@ static void acpi_pad_remove_sysfs(struct acpi_device *device)
        device_remove_file(&device->dev, &dev_attr_rrtime);
 }
-/* Query firmware how many CPUs should be idle */
+/*
-static int acpi_pad_pur(acpi_handle handle, int *num_cpus)
+ * Query firmware how many CPUs should be idle
+ * return -1 on failure
+ */
+static int acpi_pad_pur(acpi_handle handle)
 {
        struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
        union acpi_object *package;
-        int rev, num, ret = -EINVAL;
+        int num = -1;
        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_PUR", NULL, &buffer)))
-                return -EINVAL;
+                return num;
        if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
+                return num;
        package = buffer.pointer;
-        if (package->type != ACPI_TYPE_PACKAGE || package->package.count != 2)
-                goto out;
+        if (package->type == ACPI_TYPE_PACKAGE &&
-        rev = package->package.elements[0].integer.value;
+                package->package.count == 2 &&
-        num = package->package.elements[1].integer.value;
+                package->package.elements[0].integer.value == 1) /* rev 1 */
-        if (rev != 1 || num < 0)
-                goto out;
+                num = package->package.elements[1].integer.value;
-        *num_cpus = num;
-        ret = 0;
-out:
        kfree(buffer.pointer);
-        return ret;
+        return num;
 }
 /* Notify firmware how many CPUs are idle */
@@ -433,7 +434,8 @@ static void acpi_pad_handle_notify(acpi_handle handle)
        uint32_t idle_cpus;
        mutex_lock(&isolated_cpus_lock);
-        if (acpi_pad_pur(handle, &num_cpus)) {
+        num_cpus = acpi_pad_pur(handle);
+        if (num_cpus < 0) {
                mutex_unlock(&isolated_cpus_lock);
                return;
        }
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index df85b53a674f..7dad9160f209 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -854,6 +854,7 @@ struct acpi_bit_register_info {
        ACPI_BITMASK_POWER_BUTTON_STATUS   | \
        ACPI_BITMASK_SLEEP_BUTTON_STATUS   | \
        ACPI_BITMASK_RT_CLOCK_STATUS       | \
+        ACPI_BITMASK_PCIEXP_WAKE_DISABLE   | \
        ACPI_BITMASK_WAKE_STATUS)
 #define ACPI_BITMASK_TIMER_ENABLE               0x0001
diff --git a/drivers/acpi/acpica/exutils.c b/drivers/acpi/acpica/exutils.c
index 74c24d517f81..4093522eed45 100644
--- a/drivers/acpi/acpica/exutils.c
+++ b/drivers/acpi/acpica/exutils.c
@@ -109,7 +109,7 @@ void acpi_ex_enter_interpreter(void)
 *
 * DESCRIPTION: Reacquire the interpreter execution region from within the
 *              interpreter code. Failure to enter the interpreter region is a
- *              fatal system error. Used in  conjuction with
+ *              fatal system error. Used in  conjunction with
 *              relinquish_interpreter
 *
 ******************************************************************************/
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 22cfcfbd9fff..491191e6cf69 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -149,7 +149,7 @@ acpi_rs_move_data(void *destination, void *source, u16 item_count, u8 move_type)
                        /*
                         * 16-, 32-, and 64-bit cases must use the move macros that perform
-                         * endian conversion and/or accomodate hardware that cannot perform
+                         * endian conversion and/or accommodate hardware that cannot perform
                         * misaligned memory transfers
                         */
                case ACPI_RSC_MOVE16:
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 907e350f1c7d..fca34ccfd294 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -34,6 +34,6 @@ config ACPI_APEI_ERST_DEBUG
        depends on ACPI_APEI
        help
          ERST is a way provided by APEI to save and retrieve hardware
-          error infomation to and from a persistent store. Enable this
+          error information to and from a persistent store. Enable this
          if you want to debugging and testing the ERST kernel support
          and firmware implementation.
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 73fd0c7487c1..4a904a4bf05f 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -445,11 +445,15 @@ EXPORT_SYMBOL_GPL(apei_resources_sub);
 int apei_resources_request(struct apei_resources *resources,
                           const char *desc)
 {
-        struct apei_res *res, *res_bak;
+        struct apei_res *res, *res_bak = NULL;
        struct resource *r;
+        int rc;
-        apei_resources_sub(resources, &apei_resources_all);
+        rc = apei_resources_sub(resources, &apei_resources_all);
+        if (rc)
+                return rc;
+        rc = -EINVAL;
        list_for_each_entry(res, &resources->iomem, list) {
                r = request_mem_region(res->start, res->end - res->start,
                                       desc);
@@ -475,7 +479,11 @@ int apei_resources_request(struct apei_resources *resources,
                }
        }
-        apei_resources_merge(&apei_resources_all, resources);
+        rc = apei_resources_merge(&apei_resources_all, resources);
+        if (rc) {
+                pr_err(APEI_PFX "Fail to merge resources!\n");
+                goto err_unmap_ioport;
+        }
        return 0;
 err_unmap_ioport:
@@ -491,12 +499,13 @@ err_unmap_iomem:
                        break;
                release_mem_region(res->start, res->end - res->start);
        }
-        return -EINVAL;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(apei_resources_request);
 void apei_resources_release(struct apei_resources *resources)
 {
+        int rc;
        struct apei_res *res;
        list_for_each_entry(res, &resources->iomem, list)
@@ -504,7 +513,9 @@ void apei_resources_release(struct apei_resources *resources)
        list_for_each_entry(res, &resources->ioport, list)
                release_region(res->start, res->end - res->start);
-        apei_resources_sub(&apei_resources_all, resources);
+        rc = apei_resources_sub(&apei_resources_all, resources);
+        if (rc)
+                pr_err(APEI_PFX "Fail to sub resources!\n");
 }
 EXPORT_SYMBOL_GPL(apei_resources_release);
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index 465c885938ee..cf29df69380b 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -426,7 +426,9 @@ DEFINE_SIMPLE_ATTRIBUTE(error_inject_fops, NULL,
 static int einj_check_table(struct acpi_table_einj *einj_tab)
 {
-        if (einj_tab->header_length != sizeof(struct acpi_table_einj))
+        if ((einj_tab->header_length !=
+             (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header)))
+            && (einj_tab->header_length != sizeof(struct acpi_table_einj)))
                return -EINVAL;
        if (einj_tab->header.length < sizeof(struct acpi_table_einj))
                return -EINVAL;
diff --git a/drivers/acpi/apei/erst-dbg.c b/drivers/acpi/apei/erst-dbg.c
index 5281ddda2777..da1228a9a544 100644
--- a/drivers/acpi/apei/erst-dbg.c
+++ b/drivers/acpi/apei/erst-dbg.c
@@ -2,7 +2,7 @@
 * APEI Error Record Serialization Table debug support
 *
 * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store. This file provide the
+ * information to and from a persistent store. This file provide the
 * debugging/testing support for ERST kernel support and firmware
 * implementation.
 *
@@ -111,11 +111,13 @@ retry:
                goto out;
        }
        if (len > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(len, GFP_KERNEL);
+                p = kmalloc(len, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                if (!p)
                        goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                erst_dbg_buf_len = len;
                goto retry;
        }
@@ -150,11 +152,13 @@ static ssize_t erst_dbg_write(struct file *filp, const char __user *ubuf,
        if (mutex_lock_interruptible(&erst_dbg_mutex))
                return -EINTR;
        if (usize > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(usize, GFP_KERNEL);
+                p = kmalloc(usize, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                if (!p)
                        goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                erst_dbg_buf_len = usize;
        }
        rc = copy_from_user(erst_dbg_buf, ubuf, usize);
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 18645f4e83cd..1211c03149e8 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -2,7 +2,7 @@
 * APEI Error Record Serialization Table support
 *
 * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store.
+ * information to and from a persistent store.
 *
 * For more information about ERST, please refer to ACPI Specification
 * version 4.0, section 17.4.
@@ -266,13 +266,30 @@ static int erst_exec_move_data(struct apei_exec_context *ctx,
 {
        int rc;
        u64 offset;
+        void *src, *dst;
+        /* ioremap does not work in interrupt context */
+        if (in_interrupt()) {
+                pr_warning(ERST_PFX
+                           "MOVE_DATA can not be used in interrupt context");
+                return -EBUSY;
+        }
        rc = __apei_exec_read_register(entry, &offset);
        if (rc)
                return rc;
-        memmove((void *)ctx->dst_base + offset,
-                (void *)ctx->src_base + offset,
+        src = ioremap(ctx->src_base + offset, ctx->var2);
-                ctx->var2);
+        if (!src)
+                return -ENOMEM;
+        dst = ioremap(ctx->dst_base + offset, ctx->var2);
+        if (!dst)
+                return -ENOMEM;
+        memmove(dst, src, ctx->var2);
+        iounmap(src);
+        iounmap(dst);
        return 0;
 }
@@ -750,7 +767,9 @@ __setup("erst_disable", setup_erst_disable);
 static int erst_check_table(struct acpi_table_erst *erst_tab)
 {
-        if (erst_tab->header_length != sizeof(struct acpi_table_erst))
+        if ((erst_tab->header_length !=
+             (sizeof(struct acpi_table_erst) - sizeof(erst_tab->header)))
+            && (erst_tab->header_length != sizeof(struct acpi_table_einj)))
                return -EINVAL;
        if (erst_tab->header.length < sizeof(struct acpi_table_erst))
                return -EINVAL;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 385a6059714a..0d505e59214d 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -302,7 +302,7 @@ static int __devinit ghes_probe(struct platform_device *ghes_dev)
        struct ghes *ghes = NULL;
        int rc = -EINVAL;
-        generic = ghes_dev->dev.platform_data;
+        generic = *(struct acpi_hest_generic **)ghes_dev->dev.platform_data;
        if (!generic->enabled)
                return -ENODEV;
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 343168d18266..1a3508a7fe03 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -137,20 +137,23 @@ static int hest_parse_ghes_count(struct acpi_hest_header *hest_hdr, void *data)
 static int hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
-        struct acpi_hest_generic *generic;
        struct platform_device *ghes_dev;
        struct ghes_arr *ghes_arr = data;
        int rc;
        if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                return 0;
-        generic = (struct acpi_hest_generic *)hest_hdr;
-        if (!generic->enabled)
+        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                return 0;
        ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
        if (!ghes_dev)
                return -ENOMEM;
-        ghes_dev->dev.platform_data = generic;
+        rc = platform_device_add_data(ghes_dev, &hest_hdr, sizeof(void *));
+        if (rc)
+                goto err;
        rc = platform_device_add(ghes_dev);
        if (rc)
                goto err;
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 8f8bd736d4ff..542e53903891 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -142,7 +142,7 @@ static void __iomem *acpi_pre_map(phys_addr_t paddr,
        list_add_tail_rcu(&map->list, &acpi_iomaps);
        spin_unlock_irqrestore(&acpi_iomaps_lock, flags);
-        return vaddr + (paddr - pg_off);
+        return map->vaddr + (paddr - map->paddr);
 err_unmap:
        iounmap(vaddr);
        return NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index dc58402b0a17..98417201e9ce 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -273,7 +273,6 @@ static enum power_supply_property energy_battery_props[] = {
        POWER_SUPPLY_PROP_CYCLE_COUNT,
        POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
        POWER_SUPPLY_PROP_VOLTAGE_NOW,
-        POWER_SUPPLY_PROP_CURRENT_NOW,
        POWER_SUPPLY_PROP_POWER_NOW,
        POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN,
        POWER_SUPPLY_PROP_ENERGY_FULL,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 2bb28b9d91c4..f7619600270a 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -183,6 +183,8 @@ static int __init dmi_disable_osi_vista(const struct dmi_system_id *d)
 {
        printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
        acpi_osi_setup("!Windows 2006");
+        acpi_osi_setup("!Windows 2006 SP1");
+        acpi_osi_setup("!Windows 2006 SP2");
        return 0;
 }
 static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
@@ -226,6 +228,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                },
        },
        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba Satellite L355",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"),
+                },
+        },
+        {
        .callback = dmi_disable_osi_win7,
        .ident = "ASUS K50IJ",
        .matches = {
@@ -233,6 +243,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
                },
        },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba P305D",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"),
+                },
+        },
        /*
         * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c221ab535d5..310e3b9749cb 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -55,7 +55,7 @@ EXPORT_SYMBOL(acpi_root_dir);
 static int set_power_nocheck(const struct dmi_system_id *id)
 {
        printk(KERN_NOTICE PREFIX "%s detected - "
-                "disable power check in power transistion\n", id->ident);
+                "disable power check in power transition\n", id->ident);
        acpi_power_nocheck = 1;
        return 0;
 }
@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
 static struct dmi_system_id dsdt_dmi_table[] __initdata = {
        /*
-         * Insyde BIOS on some TOSHIBA machines corrupt the DSDT.
+         * Invoke DSDT corruption work-around on all Toshiba Satellite.
         * https://bugzilla.kernel.org/show_bug.cgi?id=14679
         */
        {
         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite A505",
+         .ident = "TOSHIBA Satellite",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
-                },
-        },
-        {
-         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite L505D",
-         .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"),
                },
        },
        {}
@@ -1027,7 +1019,7 @@ static int __init acpi_init(void)
        /*
         * If the laptop falls into the DMI check table, the power state check
-         * will be disabled in the course of device power transistion.
+         * will be disabled in the course of device power transition.
         */
        dmi_check_system(power_nocheck_dmi_table);
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 8a3b840c0bb2..d94d2953c974 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -369,7 +369,9 @@ static void __exit acpi_fan_exit(void)
        acpi_bus_unregister_driver(&acpi_fan_driver);
+#ifdef CONFIG_ACPI_PROCFS
        remove_proc_entry(ACPI_FAN_CLASS, acpi_root_dir);
+#endif
        return;
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index e9699aaed109..b618f888d66b 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -29,12 +29,6 @@ static int set_no_mwait(const struct dmi_system_id *id)
 static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
        {
-        set_no_mwait, "IFL91 board", {
-        DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
-        DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
-        DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
-        {
        set_no_mwait, "Extensa 5220", {
        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 156021892389..347eb21b2353 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -850,7 +850,7 @@ static int __init acpi_processor_init(void)
                printk(KERN_DEBUG "ACPI: %s registered with cpuidle\n",
                        acpi_idle_driver.name);
        } else {
-                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s",
+                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s\n",
                        cpuidle_get_driver()->name);
        }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index ba1bd263d903..3a73a93596e8 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -447,8 +447,8 @@ int acpi_processor_notify_smm(struct module *calling_module)
        if (!try_module_get(calling_module))
                return -EINVAL;
-        /* is_done is set to negative if an error occured,
+        /* is_done is set to negative if an error occurred,
-         * and to postitive if _no_ error occured, but SMM
+         * and to postitive if _no_ error occurred, but SMM
         * was already notified. This avoids double notification
         * which might lead to unexpected results...
         */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index cf82989ae756..4754ff6e70e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -363,6 +363,12 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
        return 0;
 }
+static int __init init_nvs_nosave(const struct dmi_system_id *d)
+{
+        acpi_nvs_nosave();
+        return 0;
+}
 static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
        {
        .callback = init_old_suspend_ordering,
@@ -397,6 +403,22 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                },
        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-SR11M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Everex StepNote Series",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
+                },
+        },
        {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 68e2e4582fa2..f8588f81048a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -100,7 +100,7 @@ static const struct acpi_dlevel acpi_debug_levels[] = {
        ACPI_DEBUG_INIT(ACPI_LV_EVENTS),
 };
-static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
+static int param_get_debug_layer(char *buffer, const struct kernel_param *kp)
 {
        int result = 0;
        int i;
@@ -128,7 +128,7 @@ static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
        return result;
 }
-static int param_get_debug_level(char *buffer, struct kernel_param *kp)
+static int param_get_debug_level(char *buffer, const struct kernel_param *kp)
 {
        int result = 0;
        int i;
@@ -149,10 +149,18 @@ static int param_get_debug_level(char *buffer, struct kernel_param *kp)
        return result;
 }
-module_param_call(debug_layer, param_set_uint, param_get_debug_layer,
+static struct kernel_param_ops param_ops_debug_layer = {
-                  &acpi_dbg_layer, 0644);
+        .set = param_set_uint,
-module_param_call(debug_level, param_set_uint, param_get_debug_level,
+        .get = param_get_debug_layer,
-                  &acpi_dbg_level, 0644);
+};
+static struct kernel_param_ops param_ops_debug_level = {
+        .set = param_set_uint,
+        .get = param_get_debug_level,
+};
+module_param_cb(debug_layer, &param_ops_debug_layer, &acpi_dbg_layer, 0644);
+module_param_cb(debug_level, &param_ops_debug_level, &acpi_dbg_level, 0644);
 static char trace_method_name[6];
 module_param_string(trace_method_name, trace_method_name, 6, 0644);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index c5fef01b3c95..b83676126598 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -59,8 +59,8 @@ acpi_backlight_cap_match(acpi_handle handle, u32 level, void *context,
                                  "support\n"));
                *cap |= ACPI_VIDEO_BACKLIGHT;
                if (ACPI_FAILURE(acpi_get_handle(handle, "_BQC", &h_dummy)))
-                        printk(KERN_WARNING FW_BUG PREFIX "ACPI brightness "
+                        printk(KERN_WARNING FW_BUG PREFIX "No _BQC method, "
-                                        "control misses _BQC function\n");
+                                "cannot determine initial brightness\n");
                /* We have backlight support, no need to scan further */
                return AE_CTRL_TERMINATE;
        }
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index c2408bbe9c2e..f508690eb958 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -80,7 +80,7 @@
 * Limiting Performance Impact
 * ---------------------------
 * C states, especially those with large exit latencies, can have a real
- * noticable impact on workloads, which is not acceptable for most sysadmins,
+ * noticeable impact on workloads, which is not acceptable for most sysadmins,
 * and in addition, less performance has a power price of its own.
 *
 * As a general rule of thumb, menu assumes that the following heuristic
diff --git a/drivers/dma/shdma.c b/drivers/dma/shdma.c
index fb64cf36ba61..eb6b54dbb806 100644
--- a/drivers/dma/shdma.c
+++ b/drivers/dma/shdma.c
@@ -580,7 +580,6 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
        sh_chan = to_sh_chan(chan);
        param = chan->private;
-        slave_addr = param->config->addr;
        /* Someone calling slave DMA on a public channel? */
        if (!param || !sg_len) {
@@ -589,6 +588,8 @@ static struct dma_async_tx_descriptor *sh_dmae_prep_slave_sg(
                return NULL;
        }
+        slave_addr = param->config->addr;
        /*
         * if (param != NULL), this is a successfully requested slave channel,
         * therefore param->config != NULL too.
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index e0187d16dd7c..0fd5b85a0f75 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1140,6 +1140,7 @@ static struct mcidev_sysfs_attribute i7core_udimm_counters_attrs[] = {
        ATTR_COUNTER(0),
        ATTR_COUNTER(1),
        ATTR_COUNTER(2),
+        { .attr = { .name = NULL } }
 };
 static struct mcidev_sysfs_group i7core_udimm_counters = {
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index bf92d07510df..5663d2719063 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -148,7 +148,7 @@ int drm_gem_object_init(struct drm_device *dev,
                return -ENOMEM;
        kref_init(&obj->refcount);
-        kref_init(&obj->handlecount);
+        atomic_set(&obj->handle_count, 0);
        obj->size = size;
        atomic_inc(&dev->object_count);
@@ -462,28 +462,6 @@ drm_gem_object_free(struct kref *kref)
 }
 EXPORT_SYMBOL(drm_gem_object_free);
-/**
- * Called after the last reference to the object has been lost.
- * Must be called without holding struct_mutex
- *
- * Frees the object
- */
-void
-drm_gem_object_free_unlocked(struct kref *kref)
-{
-        struct drm_gem_object *obj = (struct drm_gem_object *) kref;
-        struct drm_device *dev = obj->dev;
-        if (dev->driver->gem_free_object_unlocked != NULL)
-                dev->driver->gem_free_object_unlocked(obj);
-        else if (dev->driver->gem_free_object != NULL) {
-                mutex_lock(&dev->struct_mutex);
-                dev->driver->gem_free_object(obj);
-                mutex_unlock(&dev->struct_mutex);
-        }
-}
-EXPORT_SYMBOL(drm_gem_object_free_unlocked);
 static void drm_gem_object_ref_bug(struct kref *list_kref)
 {
        BUG();
@@ -496,12 +474,8 @@ static void drm_gem_object_ref_bug(struct kref *list_kref)
 * called before drm_gem_object_free or we'll be touching
 * freed memory
 */
-void
+void drm_gem_object_handle_free(struct drm_gem_object *obj)
-drm_gem_object_handle_free(struct kref *kref)
 {
-        struct drm_gem_object *obj = container_of(kref,
-                                                  struct drm_gem_object,
-                                                  handlecount);
        struct drm_device *dev = obj->dev;
        /* Remove any name for this object */
@@ -528,6 +502,10 @@ void drm_gem_vm_open(struct vm_area_struct *vma)
        struct drm_gem_object *obj = vma->vm_private_data;
        drm_gem_object_reference(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_open_locked(vma);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_open);
@@ -535,7 +513,10 @@ void drm_gem_vm_close(struct vm_area_struct *vma)
 {
        struct drm_gem_object *obj = vma->vm_private_data;
-        drm_gem_object_unreference_unlocked(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_close_locked(vma);
+        drm_gem_object_unreference(obj);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_close);
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 2ef2c7827243..974e970ce3f8 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -255,7 +255,7 @@ int drm_gem_one_name_info(int id, void *ptr, void *data)
        seq_printf(m, "%6d %8zd %7d %8d\n",
                   obj->name, obj->size,
-                   atomic_read(&obj->handlecount.refcount),
+                   atomic_read(&obj->handle_count),
                   atomic_read(&obj->refcount.refcount));
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index fda67468e603..5df450683aab 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -433,15 +433,7 @@ static void drm_vm_open(struct vm_area_struct *vma)
        mutex_unlock(&dev->struct_mutex);
 }
-/**
+void drm_vm_close_locked(struct vm_area_struct *vma)
- * \c close method for all virtual memory types.
- *
- * \param vma virtual memory area.
- *
- * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
- * free it.
- */
-static void drm_vm_close(struct vm_area_struct *vma)
 {
        struct drm_file *priv = vma->vm_file->private_data;
        struct drm_device *dev = priv->minor->dev;
@@ -451,7 +443,6 @@ static void drm_vm_close(struct vm_area_struct *vma)
                  vma->vm_start, vma->vm_end - vma->vm_start);
        atomic_dec(&dev->vma_count);
-        mutex_lock(&dev->struct_mutex);
        list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
                if (pt->vma == vma) {
                        list_del(&pt->head);
@@ -459,6 +450,23 @@ static void drm_vm_close(struct vm_area_struct *vma)
                        break;
                }
        }
+}
+/**
+ * \c close method for all virtual memory types.
+ *
+ * \param vma virtual memory area.
+ *
+ * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
+ * free it.
+ */
+static void drm_vm_close(struct vm_area_struct *vma)
+{
+        struct drm_file *priv = vma->vm_file->private_data;
+        struct drm_device *dev = priv->minor->dev;
+        mutex_lock(&dev->struct_mutex);
+        drm_vm_close_locked(vma);
        mutex_unlock(&dev->struct_mutex);
 }
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 61b4caf220fa..fb07e73581e8 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -116,7 +116,7 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i810_buffer_fops = {
        .open = drm_open,
        .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i810_ioctl,
        .mmap = i810_mmap_buffers,
        .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i830/i830_dma.c b/drivers/gpu/drm/i830/i830_dma.c
index 671aa18415ac..cc92c7e6236f 100644
--- a/drivers/gpu/drm/i830/i830_dma.c
+++ b/drivers/gpu/drm/i830/i830_dma.c
@@ -118,7 +118,7 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i830_buffer_fops = {
        .open = drm_open,
        .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i830_ioctl,
        .mmap = i830_mmap_buffers,
        .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9d67b4853030..c74e4e8006d4 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
                }
        }
-        div_u64(diff, diff1);
+        diff = div_u64(diff, diff1);
        ret = ((m * diff) + c);
-        div_u64(ret, 10);
+        ret = div_u64(ret, 10);
        dev_priv->last_count1 = total_count;
        dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
        /* More magic constants... */
        diff = diff * 1181;
-        div_u64(diff, diffms * 10);
+        diff = div_u64(diff, diffms * 10);
        dev_priv->gfx_power = diff;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index bced9b25c71e..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -136,14 +136,12 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
                return -ENOMEM;
        ret = drm_gem_handle_create(file_priv, obj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(obj);
        if (ret) {
-                drm_gem_object_unreference_unlocked(obj);
                return ret;
        }
-        /* Sink the floating reference from kref_init(handlecount) */
-        drm_gem_object_handle_unreference_unlocked(obj);
        args->handle = handle;
        return 0;
 }
@@ -471,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check source.
+        /* Bounds check source.  */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_WRITE,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -490,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                        file_priv);
        }
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -580,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
        mutex_lock(&dev->struct_mutex);
@@ -934,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check destination.
+        /* Bounds check destination. */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_READ,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -975,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                DRM_INFO("pwrite failed %d\n", ret);
 #endif
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -3258,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                  (int) reloc->offset,
                                  reloc->read_domains,
                                  reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                        return -EINVAL;
                }
                if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index e85246ef691c..5c428fa3e0b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -93,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
+        struct drm_i915_gem_object *obj_priv;
        struct list_head *render_iter, *bsd_iter;
        int ret = 0;
@@ -175,39 +175,34 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
        return -ENOSPC;
 found:
+        /* drm_mm doesn't allow any other other operations while
+         * scanning, therefore store to be evicted objects on a
+         * temporary list. */
        INIT_LIST_HEAD(&eviction_list);
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&unwind_list)) {
-                                 &unwind_list, evict_list) {
+                obj_priv = list_first_entry(&unwind_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
                if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
-                        /* drm_mm doesn't allow any other other operations while
-                         * scanning, therefore store to be evicted objects on a
-                         * temporary list. */
                        list_move(&obj_priv->evict_list, &eviction_list);
-                } else
+                        continue;
-                        drm_gem_object_unreference(&obj_priv->base);
+                }
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
        }
        /* Unbinding will emit any required flushes */
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&eviction_list)) {
-                                 &eviction_list, evict_list) {
+                obj_priv = list_first_entry(&eviction_list,
-#if WATCH_LRU
+                                            struct drm_i915_gem_object,
-                DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
+                                            evict_list);
-#endif
+                if (ret == 0)
-                ret = i915_gem_object_unbind(&obj_priv->base);
+                        ret = i915_gem_object_unbind(&obj_priv->base);
-                if (ret)
+                list_del(&obj_priv->evict_list);
-                        return ret;
                drm_gem_object_unreference(&obj_priv->base);
        }
-        /* The just created free hole should be on the top of the free stack
+        return ret;
-         * maintained by drm_mm, so this BUG_ON actually executes in O(1).
-         * Furthermore all accessed data has just recently been used, so it
-         * should be really fast, too. */
-        BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
-                                   alignment, 0));
-        return 0;
 }
 int
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index b5bf51a4502d..979228594599 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
                DRM_DEBUG_KMS("vblank wait timed out\n");
 }
-/**
+/*
- * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
+ * intel_wait_for_pipe_off - wait for pipe to turn off
 * @dev: drm device
 * @pipe: pipe to wait for
 *
@@ -1022,25 +1022,39 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
 * spinning on the vblank interrupt status bit, since we won't actually
 * see an interrupt when the pipe is disabled.
 *
- * So this function waits for the display line value to settle (it
+ * On Gen4 and above:
- * usually ends up stopping at the start of the next frame).
+ *   wait for the pipe register state bit to turn off
+ *
+ * Otherwise:
+ *   wait for the display line value to settle (it usually
+ *   ends up stopping at the start of the next frame).
+ *  
 */
-void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
+static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        unsigned long timeout = jiffies + msecs_to_jiffies(100);
+        if (INTEL_INFO(dev)->gen >= 4) {
-        u32 last_line;
+                int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
-        /* Wait for the display line to settle */
+                /* Wait for the Pipe State to go off */
-        do {
+                if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
-                last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                             100, 0))
-                mdelay(5);
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
-        } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+        } else {
-                 time_after(timeout, jiffies));
+                u32 last_line;
+                int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        if (time_after(jiffies, timeout))
+                unsigned long timeout = jiffies + msecs_to_jiffies(100);
-                DRM_DEBUG_KMS("vblank wait timed out\n");
+                /* Wait for the display line to settle */
+                do {
+                        last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                        mdelay(5);
+                } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+                         time_after(timeout, jiffies));
+                if (time_after(jiffies, timeout))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        }
 }
 /* Parameters have changed, update FBC info */
@@ -2328,13 +2342,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(dspbase_reg);
                }
-                /* Wait for vblank for the disable to take effect */
-                intel_wait_for_vblank_off(dev, pipe);
                /* Don't disable pipe A or pipe A PLLs if needed */
                if (pipeconf_reg == PIPEACONF &&
-                    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
+                        /* Wait for vblank for the disable to take effect */
+                        intel_wait_for_vblank(dev, pipe);
                        goto skip_pipe_off;
+                }
                /* Next, disable display pipes */
                temp = I915_READ(pipeconf_reg);
@@ -2343,8 +2357,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(pipeconf_reg);
                }
-                /* Wait for vblank for the disable to take effect. */
+                /* Wait for the pipe to turn off */
-                intel_wait_for_vblank_off(dev, pipe);
+                intel_wait_for_pipe_off(dev, pipe);
                temp = I915_READ(dpll_reg);
                if ((temp & DPLL_VCO_ENABLE) != 0) {
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1a51ee07de3e..9ab8708ac6ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,18 +1138,14 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                        uint32_t dp_reg_value,
                        uint8_t dp_train_pat,
-                        uint8_t train_set[4],
+                        uint8_t train_set[4])
-                        bool first)
 {
        struct drm_device *dev = intel_dp->base.enc.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
        int ret;
        I915_WRITE(intel_dp->output_reg, dp_reg_value);
        POSTING_READ(intel_dp->output_reg);
-        if (first)
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
        intel_dp_aux_native_write_1(intel_dp,
                                    DP_TRAINING_PATTERN_SET,
@@ -1174,10 +1170,15 @@ intel_dp_link_train(struct intel_dp *intel_dp)
        uint8_t voltage;
        bool clock_recovery = false;
        bool channel_eq = false;
-        bool first = true;
        int tries;
        u32 reg;
        uint32_t DP = intel_dp->DP;
+        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
+        /* Enable output, wait for it to become active */
+        I915_WRITE(intel_dp->output_reg, intel_dp->DP);
+        POSTING_READ(intel_dp->output_reg);
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
        /* Write the link configuration data */
        intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1210,9 +1211,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                        reg = DP | DP_LINK_TRAIN_PAT_1;
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_1, train_set, first))
+                                             DP_TRAINING_PATTERN_1, train_set))
                        break;
-                first = false;
                /* Set training pattern 1 */
                udelay(100);
@@ -1266,8 +1266,7 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                /* channel eq pattern */
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_2, train_set,
+                                             DP_TRAINING_PATTERN_2, train_set))
-                                             false))
                        break;
                udelay(400);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ad312ca6b3e5..8828b3ac6414 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -229,7 +229,6 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                    struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
-extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 7bdc96256bf5..56ad9df2ccb5 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -237,8 +237,10 @@ int intel_fbdev_destroy(struct drm_device *dev,
        drm_fb_helper_fini(&ifbdev->helper);
        drm_framebuffer_cleanup(&ifb->base);
-        if (ifb->obj)
+        if (ifb->obj) {
+                drm_gem_object_handle_unreference(ifb->obj);
                drm_gem_object_unreference(ifb->obj);
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index dbd30b2e43fd..d2047713dc59 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,6 +352,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
        if (nouveau_fb->nvbo) {
                nouveau_bo_unmap(nouveau_fb->nvbo);
+                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                nouveau_fb->nvbo = NULL;
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index ead7b8fc53fc..19620a6709f5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -167,11 +167,9 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
                goto out;
        ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(nvbo->gem);
 out:
-        drm_gem_object_handle_unreference_unlocked(nvbo->gem);
-        if (ret)
-                drm_gem_object_unreference_unlocked(nvbo->gem);
        return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3ec181ff50ce..3c9964a8fbad 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,6 +79,7 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
        mutex_lock(&dev->struct_mutex);
        nouveau_bo_unpin(chan->notifier_bo);
        mutex_unlock(&dev->struct_mutex);
+        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
        drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
        drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index ddc3adea1dda..7a04959ba0ee 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3528,7 +3528,8 @@ void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
        /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
         * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
         */
-        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+            rdev->vram_scratch.ptr) {
                void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
                u32 tmp;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index ebae14c4b768..68932ba7b8a4 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -317,6 +317,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                        *connector_type = DRM_MODE_CONNECTOR_DVID;
        }
+        /* MSI K9A2GM V2/V3 board has no HDMI or DVI */
+        if ((dev->pdev->device == 0x796e) &&
+            (dev->pdev->subsystem_vendor == 0x1462) &&
+            (dev->pdev->subsystem_device == 0x7302)) {
+                if ((supported_device == ATOM_DEVICE_DFP2_SUPPORT) ||
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        return false;
+        }
        /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
        if ((dev->pdev->device == 0x7941) &&
            (dev->pdev->subsystem_vendor == 0x147b) &&
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 127a395f70fb..b92d2f2fcbed 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -349,6 +349,8 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                        DRM_INFO("    DFP4: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_DFP5_SUPPORT)
                                        DRM_INFO("    DFP5: %s\n", encoder_names[radeon_encoder->encoder_id]);
+                                if (devices & ATOM_DEVICE_DFP6_SUPPORT)
+                                        DRM_INFO("    DFP6: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_TV1_SUPPORT)
                                        DRM_INFO("    TV1: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_CV_SUPPORT)
@@ -841,8 +843,9 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
        struct radeon_framebuffer *radeon_fb = to_radeon_framebuffer(fb);
-        if (radeon_fb->obj)
+        if (radeon_fb->obj) {
                drm_gem_object_unreference_unlocked(radeon_fb->obj);
+        }
        drm_framebuffer_cleanup(fb);
        kfree(radeon_fb);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index c74a8b20d941..9cdf6a35bc2c 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -94,8 +94,10 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
        ret = radeon_bo_reserve(rbo, false);
        if (likely(ret == 0)) {
                radeon_bo_kunmap(rbo);
+                radeon_bo_unpin(rbo);
                radeon_bo_unreserve(rbo);
        }
+        drm_gem_object_handle_unreference(gobj);
        drm_gem_object_unreference_unlocked(gobj);
 }
@@ -325,8 +327,6 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
 {
        struct fb_info *info;
        struct radeon_framebuffer *rfb = &rfbdev->rfb;
-        struct radeon_bo *rbo;
-        int r;
        if (rfbdev->helper.fbdev) {
                info = rfbdev->helper.fbdev;
@@ -338,14 +338,8 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
        }
        if (rfb->obj) {
-                rbo = rfb->obj->driver_private;
+                radeonfb_destroy_pinned_object(rfb->obj);
-                r = radeon_bo_reserve(rbo, false);
+                rfb->obj = NULL;
-                if (likely(r == 0)) {
-                        radeon_bo_kunmap(rbo);
-                        radeon_bo_unpin(rbo);
-                        radeon_bo_unreserve(rbo);
-                }
-                drm_gem_object_unreference_unlocked(rfb->obj);
        }
        drm_fb_helper_fini(&rfbdev->helper);
        drm_framebuffer_cleanup(&rfb->base);
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index c578f265b24c..d1e595d91723 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -201,11 +201,11 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data,
                return r;
        }
        r = drm_gem_handle_create(filp, gobj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(gobj);
        if (r) {
-                drm_gem_object_unreference_unlocked(gobj);
                return r;
        }
-        drm_gem_object_handle_unreference_unlocked(gobj);
        args->handle = handle;
        return 0;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 72ec2e2b6e97..a96ed6d9d010 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -148,13 +148,16 @@ static struct pci_device_id vmw_pci_id_list[] = {
        {0, 0, 0}
 };
-static char *vmw_devname = "vmwgfx";
+static int enable_fbdev;
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
 static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
                              void *ptr);
+MODULE_PARM_DESC(enable_fbdev, "Enable vmwgfx fbdev");
+module_param_named(enable_fbdev, enable_fbdev, int, 0600);
 static void vmw_print_capabilities(uint32_t capabilities)
 {
        DRM_INFO("Capabilities:\n");
@@ -192,8 +195,6 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 {
        int ret;
-        vmw_kms_save_vga(dev_priv);
        ret = vmw_fifo_init(dev_priv, &dev_priv->fifo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Unable to initialize FIFO.\n");
@@ -206,9 +207,35 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 static void vmw_release_device(struct vmw_private *dev_priv)
 {
        vmw_fifo_release(dev_priv, &dev_priv->fifo);
-        vmw_kms_restore_vga(dev_priv);
 }
+int vmw_3d_resource_inc(struct vmw_private *dev_priv)
+{
+        int ret = 0;
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(dev_priv->num_3d_resources++ == 0)) {
+                ret = vmw_request_device(dev_priv);
+                if (unlikely(ret != 0))
+                        --dev_priv->num_3d_resources;
+        }
+        mutex_unlock(&dev_priv->release_mutex);
+        return ret;
+}
+void vmw_3d_resource_dec(struct vmw_private *dev_priv)
+{
+        int32_t n3d;
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(--dev_priv->num_3d_resources == 0))
+                vmw_release_device(dev_priv);
+        n3d = (int32_t) dev_priv->num_3d_resources;
+        mutex_unlock(&dev_priv->release_mutex);
+        BUG_ON(n3d < 0);
+}
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
@@ -228,6 +255,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->last_read_sequence = (uint32_t) -100;
        mutex_init(&dev_priv->hw_mutex);
        mutex_init(&dev_priv->cmdbuf_mutex);
+        mutex_init(&dev_priv->release_mutex);
        rwlock_init(&dev_priv->resource_lock);
        idr_init(&dev_priv->context_idr);
        idr_init(&dev_priv->surface_idr);
@@ -244,6 +272,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
        dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
+        dev_priv->enable_fb = enable_fbdev;
        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
@@ -343,17 +373,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev->dev_private = dev_priv;
-        if (!dev->devname)
-                dev->devname = vmw_devname;
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
-                ret = drm_irq_install(dev);
-                if (unlikely(ret != 0)) {
-                        DRM_ERROR("Failed installing irq: %d\n", ret);
-                        goto out_no_irq;
-                }
-        }
        ret = pci_request_regions(dev->pdev, "vmwgfx probe");
        dev_priv->stealth = (ret != 0);
        if (dev_priv->stealth) {
@@ -369,26 +388,52 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                        goto out_no_device;
                }
        }
-        ret = vmw_request_device(dev_priv);
+        ret = vmw_kms_init(dev_priv);
        if (unlikely(ret != 0))
-                goto out_no_device;
+                goto out_no_kms;
-        vmw_kms_init(dev_priv);
        vmw_overlay_init(dev_priv);
-        vmw_fb_init(dev_priv);
+        if (dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        goto out_no_fifo;
+                vmw_kms_save_vga(dev_priv);
+                vmw_fb_init(dev_priv);
+                DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ?
+                         "Detected device 3D availability.\n" :
+                         "Detected no device 3D availability.\n");
+        } else {
+                DRM_INFO("Delayed 3D detection since we're not "
+                         "running the device in SVGA mode yet.\n");
+        }
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
+                ret = drm_irq_install(dev);
+                if (unlikely(ret != 0)) {
+                        DRM_ERROR("Failed installing irq: %d\n", ret);
+                        goto out_no_irq;
+                }
+        }
        dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
        register_pm_notifier(&dev_priv->pm_nb);
-        DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ? "Have 3D\n" : "No 3D\n");
        return 0;
-out_no_device:
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
 out_no_irq:
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+out_no_fifo:
+        vmw_overlay_close(dev_priv);
+        vmw_kms_close(dev_priv);
+out_no_kms:
+        if (dev_priv->stealth)
+                pci_release_region(dev->pdev, 2);
+        else
+                pci_release_regions(dev->pdev);
+out_no_device:
        ttm_object_device_release(&dev_priv->tdev);
 out_err4:
        iounmap(dev_priv->mmio_virt);
@@ -415,19 +460,20 @@ static int vmw_driver_unload(struct drm_device *dev)
        unregister_pm_notifier(&dev_priv->pm_nb);
-        vmw_fb_close(dev_priv);
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+                drm_irq_uninstall(dev_priv->dev);
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        vmw_kms_close(dev_priv);
        vmw_overlay_close(dev_priv);
-        vmw_release_device(dev_priv);
        if (dev_priv->stealth)
                pci_release_region(dev->pdev, 2);
        else
                pci_release_regions(dev->pdev);
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
        ttm_object_device_release(&dev_priv->tdev);
        iounmap(dev_priv->mmio_virt);
        drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
@@ -500,7 +546,7 @@ static long vmw_unlocked_ioctl(struct file *filp, unsigned int cmd,
                struct drm_ioctl_desc *ioctl =
                    &vmw_ioctls[nr - DRM_COMMAND_BASE];
-                if (unlikely(ioctl->cmd != cmd)) {
+                if (unlikely(ioctl->cmd_drv != cmd)) {
                        DRM_ERROR("Invalid command format, ioctl %d\n",
                                  nr - DRM_COMMAND_BASE);
                        return -EINVAL;
@@ -589,6 +635,16 @@ static int vmw_master_set(struct drm_device *dev,
        struct vmw_master *vmaster = vmw_master(file_priv->master);
        int ret = 0;
+        if (!dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        return ret;
+                vmw_kms_save_vga(dev_priv);
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 0);
+                mutex_unlock(&dev_priv->hw_mutex);
+        }
        if (active) {
                BUG_ON(active != &dev_priv->fbdev_master);
                ret = ttm_vt_lock(&active->lock, false, vmw_fp->tfile);
@@ -617,7 +673,13 @@ static int vmw_master_set(struct drm_device *dev,
        return 0;
 out_no_active_lock:
-        vmw_release_device(dev_priv);
+        if (!dev_priv->enable_fb) {
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        return ret;
 }
@@ -645,11 +707,23 @@ static void vmw_master_drop(struct drm_device *dev,
        ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+        if (!dev_priv->enable_fb) {
+                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+                if (unlikely(ret != 0))
+                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        dev_priv->active_master = &dev_priv->fbdev_master;
        ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
        ttm_vt_unlock(&dev_priv->fbdev_master.lock);
-        vmw_fb_on(dev_priv);
+        if (dev_priv->enable_fb)
+                vmw_fb_on(dev_priv);
 }
@@ -722,6 +796,7 @@ static struct drm_driver driver = {
        .irq_postinstall = vmw_irq_postinstall,
        .irq_uninstall = vmw_irq_uninstall,
        .irq_handler = vmw_irq_handler,
+        .get_vblank_counter = vmw_get_vblank_counter,
        .reclaim_buffers_locked = NULL,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 429f917b60bf..58de6393f611 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -277,6 +277,7 @@ struct vmw_private {
        bool stealth;
        bool is_opened;
+        bool enable_fb;
        /**
         * Master management.
@@ -285,6 +286,9 @@ struct vmw_private {
        struct vmw_master *active_master;
        struct vmw_master fbdev_master;
        struct notifier_block pm_nb;
+        struct mutex release_mutex;
+        uint32_t num_3d_resources;
 };
 static inline struct vmw_private *vmw_priv(struct drm_device *dev)
@@ -319,6 +323,9 @@ static inline uint32_t vmw_read(struct vmw_private *dev_priv,
        return val;
 }
+int vmw_3d_resource_inc(struct vmw_private *dev_priv);
+void vmw_3d_resource_dec(struct vmw_private *dev_priv);
 /**
 * GMR utilities - vmwgfx_gmr.c
 */
@@ -511,6 +518,7 @@ void vmw_kms_write_svga(struct vmw_private *vmw_priv,
                        unsigned bbp, unsigned depth);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc);
 /**
 * Overlay control - vmwgfx_overlay.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 870967a97c15..409e172f4abf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -615,6 +615,11 @@ int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
        if (unlikely(ret != 0))
                goto err_unlock;
+        if (bo->mem.mem_type == TTM_PL_VRAM &&
+            bo->mem.mm_node->start < bo->num_pages)
+                (void) ttm_bo_validate(bo, &vmw_sys_placement, false,
+                                       false, false);
        ret = ttm_bo_validate(bo, &ne_placement, false, false, false);
        /* Could probably bug on */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index e6a1eb7ea954..0fe31766e4cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -106,6 +106,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        mutex_lock(&dev_priv->hw_mutex);
        dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
        dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+        dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
        vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
        min = 4;
@@ -175,6 +176,8 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                  dev_priv->config_done_state);
        vmw_write(dev_priv, SVGA_REG_ENABLE,
                  dev_priv->enable_state);
+        vmw_write(dev_priv, SVGA_REG_TRACES,
+                  dev_priv->traces_state);
        mutex_unlock(&dev_priv->hw_mutex);
        vmw_fence_queue_takedown(&fifo->fence_queue);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 64d7f47df868..e882ba099f0c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -898,7 +898,19 @@ int vmw_kms_save_vga(struct vmw_private *vmw_priv)
                save->width = vmw_read(vmw_priv, SVGA_REG_DISPLAY_WIDTH);
                save->height = vmw_read(vmw_priv, SVGA_REG_DISPLAY_HEIGHT);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+                if (i == 0 && vmw_priv->num_displays == 1 &&
+                    save->width == 0 && save->height == 0) {
+                        /*
+                         * It should be fairly safe to assume that these
+                         * values are uninitialized.
+                         */
+                        save->width = vmw_priv->vga_width - save->pos_x;
+                        save->height = vmw_priv->vga_height - save->pos_y;
+                }
        }
        return 0;
 }
@@ -984,3 +996,8 @@ out_unlock:
        ttm_read_unlock(&vmaster->lock);
        return ret;
 }
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc)
+{
+        return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 7083b1a24df3..11cb39e3accb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -27,6 +27,8 @@
 #include "vmwgfx_kms.h"
+#define VMWGFX_LDU_NUM_DU 8
 #define vmw_crtc_to_ldu(x) \
        container_of(x, struct vmw_legacy_display_unit, base.crtc)
 #define vmw_encoder_to_ldu(x) \
@@ -536,6 +538,10 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        int i;
+        int ret;
        if (dev_priv->ldu_priv) {
                DRM_INFO("ldu system already on\n");
                return -EINVAL;
@@ -553,23 +559,24 @@ int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
        drm_mode_create_dirty_info_property(dev_priv->dev);
-        vmw_ldu_init(dev_priv, 0);
-        /* for old hardware without multimon only enable one display */
        if (dev_priv->capabilities & SVGA_CAP_MULTIMON) {
-                vmw_ldu_init(dev_priv, 1);
+                for (i = 0; i < VMWGFX_LDU_NUM_DU; ++i)
-                vmw_ldu_init(dev_priv, 2);
+                        vmw_ldu_init(dev_priv, i);
-                vmw_ldu_init(dev_priv, 3);
+                ret = drm_vblank_init(dev, VMWGFX_LDU_NUM_DU);
-                vmw_ldu_init(dev_priv, 4);
+        } else {
-                vmw_ldu_init(dev_priv, 5);
+                /* for old hardware without multimon only enable one display */
-                vmw_ldu_init(dev_priv, 6);
+                vmw_ldu_init(dev_priv, 0);
-                vmw_ldu_init(dev_priv, 7);
+                ret = drm_vblank_init(dev, 1);
        }
-        return 0;
+        return ret;
 }
 int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        drm_vblank_cleanup(dev);
        if (!dev_priv->ldu_priv)
                return -ENOSYS;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 5f2d5df01e5c..c8c40e9979db 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -211,6 +211,7 @@ static void vmw_hw_context_destroy(struct vmw_resource *res)
        cmd->body.cid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 static int vmw_context_init(struct vmw_private *dev_priv,
@@ -247,6 +248,7 @@ static int vmw_context_init(struct vmw_private *dev_priv,
        cmd->body.cid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        (void) vmw_3d_resource_inc(dev_priv);
        vmw_resource_activate(res, vmw_hw_context_destroy);
        return 0;
 }
@@ -406,6 +408,7 @@ static void vmw_hw_surface_destroy(struct vmw_resource *res)
        cmd->body.sid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 void vmw_surface_res_free(struct vmw_resource *res)
@@ -473,6 +476,7 @@ int vmw_surface_init(struct vmw_private *dev_priv,
        }
        vmw_fifo_commit(dev_priv, submit_size);
+        (void) vmw_3d_resource_inc(dev_priv);
        vmw_resource_activate(res, vmw_hw_surface_destroy);
        return 0;
 }
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..75afb3b0e076 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline void superio_enter(int base);
+static inline int superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
@@ -861,11 +861,20 @@ static int superio_inw(int base, int reg)
        return val;
 }
-static inline void superio_enter(int base)
+static inline int superio_enter(int base)
 {
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                base);
+                return -EBUSY;
+        }
        /* according to the datasheet the key must be send twice! */
        outb(SIO_UNLOCK_KEY, base);
        outb(SIO_UNLOCK_KEY, base);
+        return 0;
 }
 static inline void superio_select(int base, int ld)
@@ -877,6 +886,7 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
        outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
 }
 static inline int fan_from_reg(u16 reg)
@@ -2175,21 +2185,15 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
        struct f71882fg_sio_data *sio_data)
 {
-        int err = -ENODEV;
        u16 devid;
+        int err = superio_enter(sioaddr);
-        /* Don't step on other drivers' I/O space by accident */
+        if (err)
-        if (!request_region(sioaddr, 2, DRVNAME)) {
+                return err;
-                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-                                (int)sioaddr);
-                return -EBUSY;
-        }
-        superio_enter(sioaddr);
        devid = superio_inw(sioaddr, SIO_REG_MANID);
        if (devid != SIO_FINTEK_ID) {
                pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
                goto exit;
        }
@@ -2213,6 +2217,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        default:
                printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
                       (unsigned int)devid);
+                err = -ENODEV;
                goto exit;
        }
@@ -2223,12 +2228,14 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
                printk(KERN_WARNING DRVNAME ": Device not activated\n");
+                err = -ENODEV;
                goto exit;
        }
        *address = superio_inw(sioaddr, SIO_REG_ADDR);
        if (*address == 0) {
                printk(KERN_WARNING DRVNAME ": Base address not set\n");
+                err = -ENODEV;
                goto exit;
        }
        *address &= ~(REGION_LENGTH - 1);       /* Ignore 3 LSB */
@@ -2239,7 +2246,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
                (int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
        superio_exit(sioaddr);
-        release_region(sioaddr, 2);
        return err;
 }
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 2222c87876b9..b8feac5f2ef4 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -357,9 +357,6 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
        dev->terminate = 0;
-        /* write the data into mode register */
-        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
        /*
         * First byte should be set here, not after interrupt,
         * because transmit-data-ready interrupt can come before
@@ -371,6 +368,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
                dev->buf_len--;
        }
+        /* write the data into mode register; start transmitting */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
        r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                      dev->adapter.timeout);
        if (r == 0) {
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index 0e9f85d0a835..56dbe54e8811 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -218,7 +218,7 @@ static int octeon_i2c_wait(struct octeon_i2c *i2c)
                return result;
        } else if (result == 0) {
                dev_dbg(i2c->dev, "%s: timeout\n", __func__);
-                result = -ETIMEDOUT;
+                return -ETIMEDOUT;
        }
        return 0;
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 72902e0bbfa7..bf831bf81587 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -662,8 +662,8 @@ static int s3c24xx_i2c_clockrate(struct s3c24xx_i2c *i2c, unsigned int *got)
                unsigned long sda_delay;
                if (pdata->sda_delay) {
-                        sda_delay = (freq / 1000) * pdata->sda_delay;
+                        sda_delay = clkin * pdata->sda_delay;
-                        sda_delay /= 1000000;
+                        sda_delay = DIV_ROUND_UP(sda_delay, 1000000);
                        sda_delay = DIV_ROUND_UP(sda_delay, 5);
                        if (sda_delay > 3)
                                sda_delay = 3;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a10152bb1427..0906fc5b69b9 100755..100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -83,7 +83,7 @@ static unsigned int mwait_substates;
 /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
 static unsigned int lapic_timer_reliable_states;
-static struct cpuidle_device *intel_idle_cpuidle_devices;
+static struct cpuidle_device __percpu *intel_idle_cpuidle_devices;
 static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 static struct cpuidle_state *cpuidle_state_table;
@@ -108,7 +108,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "NHM-C3",
                .desc = "MWAIT 0x10",
                .driver_data = (void *) 0x10,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 20,
                .power_usage = 500,
                .target_residency = 80,
@@ -117,7 +117,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "NHM-C6",
                .desc = "MWAIT 0x20",
                .driver_data = (void *) 0x20,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 200,
                .power_usage = 350,
                .target_residency = 800,
@@ -149,7 +149,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "ATM-C4",
                .desc = "MWAIT 0x30",
                .driver_data = (void *) 0x30,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 100,
                .power_usage = 250,
                .target_residency = 400,
@@ -159,7 +159,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "ATM-C6",
                .desc = "MWAIT 0x40",
                .driver_data = (void *) 0x40,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 200,
                .power_usage = 150,
                .target_residency = 800,
@@ -185,6 +185,16 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state)
        local_irq_disable();
+        /*
+         * If the state flag indicates that the TLB will be flushed or if this
+         * is the deepest c-state supported, do a voluntary leave mm to avoid
+         * costly and mostly unnecessary wakeups for flushing the user TLB's
+         * associated with the active mm.
+         */
+        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED ||
+            (&dev->states[dev->state_count - 1] == state))
+                leave_mm(cpu);
        if (!(lapic_timer_reliable_states & (1 << (cstate))))
                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 04028a9ee082..428377a5a6f5 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -429,24 +429,25 @@ static void max8925_irq_sync_unlock(unsigned int irq)
        irq_tsc = cache_tsc;
        for (i = 0; i < ARRAY_SIZE(max8925_irqs); i++) {
                irq_data = &max8925_irqs[i];
+                /* 1 -- disable, 0 -- enable */
                switch (irq_data->mask_reg) {
                case MAX8925_CHG_IRQ1_MASK:
-                        irq_chg[0] &= irq_data->enable;
+                        irq_chg[0] &= ~irq_data->enable;
                        break;
                case MAX8925_CHG_IRQ2_MASK:
-                        irq_chg[1] &= irq_data->enable;
+                        irq_chg[1] &= ~irq_data->enable;
                        break;
                case MAX8925_ON_OFF_IRQ1_MASK:
-                        irq_on[0] &= irq_data->enable;
+                        irq_on[0] &= ~irq_data->enable;
                        break;
                case MAX8925_ON_OFF_IRQ2_MASK:
-                        irq_on[1] &= irq_data->enable;
+                        irq_on[1] &= ~irq_data->enable;
                        break;
                case MAX8925_RTC_IRQ_MASK:
-                        irq_rtc &= irq_data->enable;
+                        irq_rtc &= ~irq_data->enable;
                        break;
                case MAX8925_TSC_IRQ_MASK:
-                        irq_tsc &= irq_data->enable;
+                        irq_tsc &= ~irq_data->enable;
                        break;
                default:
                        dev_err(chip->dev, "wrong IRQ\n");
diff --git a/drivers/mfd/wm831x-irq.c b/drivers/mfd/wm831x-irq.c
index 7dabe4dbd373..294183b6260b 100644
--- a/drivers/mfd/wm831x-irq.c
+++ b/drivers/mfd/wm831x-irq.c
@@ -394,8 +394,13 @@ static int wm831x_irq_set_type(unsigned int irq, unsigned int type)
        irq = irq - wm831x->irq_base;
-        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11)
+        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11) {
-                return -EINVAL;
+                /* Ignore internal-only IRQs */
+                if (irq >= 0 && irq < WM831X_NUM_IRQS)
+                        return 0;
+                else
+                        return -EINVAL;
+        }
        switch (type) {
        case IRQ_TYPE_EDGE_BOTH:
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 133d51528f8d..513e0a76a4a7 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -413,7 +413,7 @@ static inline int omap_nand_dma_transfer(struct mtd_info *mtd, void *addr,
                prefetch_status = gpmc_read_status(GPMC_PREFETCH_COUNT);
        } while (prefetch_status);
        /* disable and stop the PFPW engine */
-        gpmc_prefetch_reset();
+        gpmc_prefetch_reset(info->gpmc_cs);
        dma_unmap_single(&info->pdev->dev, dma_addr, len, dir);
        return 0;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..5db667c0b371 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 config MV643XX_ETH
        tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
        select INET_LRO
        select PHYLIB
        help
@@ -2803,7 +2803,7 @@ config NIU
 config PASEMI_MAC
        tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
        select PHYLIB
        select INET_LRO
        help
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                res = dev_alloc_name(bond_dev, "bond%d");
                if (res < 0)
                        goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
        }
        res = register_netdevice(bond_dev);
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
        netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
+static int only_32bit_dma;
 static int __devinit skge_probe(struct pci_dev *pdev,
                                const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
        pci_set_master(pdev);
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                using_dac = 1;
                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
        } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
        .shutdown =     skge_shutdown,
 };
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
        skge_debug_init();
        return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 9dd9e64c2b0b..8fd00a6e5120 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCAN_HW, &priv->status);
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 59a308b02f95..d31661c1ce77 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 static void iwl3945_bg_restart(struct work_struct *data)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 89ed181cd90c..857ae01734a6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -163,6 +163,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,	PCI_DEVICE_ID_NEC_CBUS_2,	quirk_isa_d
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_3,       quirk_isa_dma_hangs);
 /*
+ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
+ * for some HT machines to use C4 w/o hanging.
+ */
+static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev)
+{
+        u32 pmbase;
+        u16 pm1a;
+        pci_read_config_dword(dev, 0x40, &pmbase);
+        pmbase = pmbase & 0xff80;
+        pm1a = inw(pmbase);
+        if (pm1a & 0x10) {
+                dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n");
+                outw(0x10, pmbase);
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
+/*
 *      Chipsets where PCI->PCI transfers vanish or hang
 */
 static void __devinit quirk_nopcipci(struct pci_dev *dev)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 422a709d271d..cc8b337b9119 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
            constraints->min_uA != constraints->max_uA) {
                ret = _regulator_get_current_limit(rdev);
                if (ret > 0)
-                        count += sprintf(buf + count, "at %d uA ", ret / 1000);
+                        count += sprintf(buf + count, "at %d mA ", ret / 1000);
        }
        if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,8 +2302,10 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
        dev_set_name(&rdev->dev, "regulator.%d",
                     atomic_inc_return(&regulator_no) - 1);
        ret = device_register(&rdev->dev);
-        if (ret != 0)
+        if (ret != 0) {
+                put_device(&rdev->dev);
                goto clean;
+        }
        dev_set_drvdata(&rdev->dev, rdev);
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 4520ace3f7e7..6b60a9c0366b 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
                /* set external clock frequency */
                info->extclk_freq = pdata->extclk_freq;
                max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-                                 info->extclk_freq);
+                                 info->extclk_freq << 6);
        }
        if (pdata->ramp_timing) {
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index 324c385a653d..5dff45c76d32 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
+#include <linux/slab.h>
 #include <linux/serial_reg.h>
 #include <linux/circ_buf.h>
 #include <linux/delay.h>
diff --git a/drivers/serial/mrst_max3110.c b/drivers/serial/mrst_max3110.c
index f6ad1ecbff79..51c15f58e01e 100644
--- a/drivers/serial/mrst_max3110.c
+++ b/drivers/serial/mrst_max3110.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/ioport.h>
+#include <linux/irq.h>
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 0bcf4c1601a2..b5a78a1f4421 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -86,6 +87,10 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
        const struct spi_device *spi = to_spi_device(dev);
        const struct spi_driver *sdrv = to_spi_driver(drv);
+        /* Attempt an OF style match */
+        if (of_driver_match_device(dev, drv))
+                return 1;
        if (sdrv->id_table)
                return !!spi_match_id(sdrv->id_table, spi);
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index e24a63498acb..63e51b011d50 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
        spi_gpio->bitbang.master = spi_master_get(master);
        spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
-        if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
+        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
                spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
                spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
                spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index d31b57f7baaf..1dd86b835cd8 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
        xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
-        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        if (mspi->rx_dma == mspi->dma_dummy_rx)
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
+        else
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
        out_be16(&rx_bd->cbd_datlen, 0);
        out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
-        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        if (mspi->tx_dma == mspi->dma_dummy_tx)
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
+        else
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
        out_be16(&tx_bd->cbd_datlen, xfer_len);
        out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
                                 BD_SC_LAST);
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 29bac5118877..d409495876f1 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -755,7 +755,10 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
        int ret = 0;
-        blocking_notifier_chain_register(&xenstore_chain, nb);
+        if (xenstored_ready > 0)
+                ret = nb->notifier_call(nb, 0, NULL);
+        else
+                blocking_notifier_chain_register(&xenstore_chain, nb);
        return ret;
 }
@@ -769,7 +772,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 void xenbus_probe(struct work_struct *unused)
 {
-        BUG_ON((xenstored_ready <= 0));
+        xenstored_ready = 1;
        /* Enumerate devices in xenstore and watch for changes. */
        xenbus_probe_devices(&xenbus_frontend);
@@ -835,8 +838,8 @@ static int __init xenbus_init(void)
                        xen_store_evtchn = xen_start_info->store_evtchn;
                        xen_store_mfn = xen_start_info->store_mfn;
                        xen_store_interface = mfn_to_virt(xen_store_mfn);
+                        xenstored_ready = 1;
                }
-                xenstored_ready = 1;
        }
        /* Initialize the interface to xenstore. */
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index c65c3419dd37..7e83b356cc9e 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -232,7 +232,7 @@ static int
 small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
                void **request_buf)
 {
-        int rc = 0;
+        int rc;
        rc = cifs_reconnect_tcon(tcon, smb_command);
        if (rc)
@@ -250,7 +250,7 @@ small_smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
        if (tcon != NULL)
                cifs_stats_inc(&tcon->num_smbs_sent);
-        return rc;
+        return 0;
 }
 int
@@ -281,16 +281,9 @@ small_smb_init_no_tc(const int smb_command, const int wct,
 /* If the return code is zero, this function must fill in request_buf pointer */
 static int
-smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
+__smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
-         void **request_buf /* returned */ ,
+                        void **request_buf, void **response_buf)
-         void **response_buf /* returned */ )
 {
-        int rc = 0;
-        rc = cifs_reconnect_tcon(tcon, smb_command);
-        if (rc)
-                return rc;
        *request_buf = cifs_buf_get();
        if (*request_buf == NULL) {
                /* BB should we add a retry in here if not a writepage? */
@@ -309,7 +302,31 @@ smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
        if (tcon != NULL)
                cifs_stats_inc(&tcon->num_smbs_sent);
-        return rc;
+        return 0;
+}
+/* If the return code is zero, this function must fill in request_buf pointer */
+static int
+smb_init(int smb_command, int wct, struct cifsTconInfo *tcon,
+         void **request_buf, void **response_buf)
+{
+        int rc;
+        rc = cifs_reconnect_tcon(tcon, smb_command);
+        if (rc)
+                return rc;
+        return __smb_init(smb_command, wct, tcon, request_buf, response_buf);
+}
+static int
+smb_init_no_reconnect(int smb_command, int wct, struct cifsTconInfo *tcon,
+                        void **request_buf, void **response_buf)
+{
+        if (tcon->ses->need_reconnect || tcon->need_reconnect)
+                return -EHOSTDOWN;
+        return __smb_init(smb_command, wct, tcon, request_buf, response_buf);
 }
 static int validate_t2(struct smb_t2_rsp *pSMB)
@@ -4534,8 +4551,8 @@ CIFSSMBQFSUnixInfo(const int xid, struct cifsTconInfo *tcon)
        cFYI(1, "In QFSUnixInfo");
 QFSUnixRetry:
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+        rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, tcon,
-                      (void **) &pSMBr);
+                                   (void **) &pSMB, (void **) &pSMBr);
        if (rc)
                return rc;
@@ -4604,8 +4621,8 @@ CIFSSMBSetFSUnixInfo(const int xid, struct cifsTconInfo *tcon, __u64 cap)
        cFYI(1, "In SETFSUnixInfo");
 SETFSUnixRetry:
        /* BB switch to small buf init to save memory */
-        rc = smb_init(SMB_COM_TRANSACTION2, 15, tcon, (void **) &pSMB,
+        rc = smb_init_no_reconnect(SMB_COM_TRANSACTION2, 15, tcon,
-                      (void **) &pSMBr);
+                                        (void **) &pSMB, (void **) &pSMBr);
        if (rc)
                return rc;
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 93f77d438d3c..53cce8cc2224 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -801,6 +801,8 @@ retry_iget5_locked:
                        inode->i_flags |= S_NOATIME | S_NOCMTIME;
                if (inode->i_state & I_NEW) {
                        inode->i_ino = hash;
+                        if (S_ISREG(inode->i_mode))
+                                inode->i_data.backing_dev_info = sb->s_bdi;
 #ifdef CONFIG_CIFS_FSCACHE
                        /* initialize per-inode cache cookie pointer */
                        CIFS_I(inode)->fscache = NULL;
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 5581122bd2c0..ab38fef1c9a1 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -72,22 +72,11 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 static inline struct backing_dev_info *inode_to_bdi(struct inode *inode)
 {
        struct super_block *sb = inode->i_sb;
-        struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
-        /*
+        if (strcmp(sb->s_type->name, "bdev") == 0)
-         * For inodes on standard filesystems, we use superblock's bdi. For
+                return inode->i_mapping->backing_dev_info;
-         * inodes on virtual filesystems, we want to use inode mapping's bdi
-         * because they can possibly point to something useful (think about
+        return sb->s_bdi;
-         * block_dev filesystem).
-         */
-        if (sb->s_bdi && sb->s_bdi != &noop_backing_dev_info) {
-                /* Some device inodes could play dirty tricks. Catch them... */
-                WARN(bdi != sb->s_bdi && bdi_cap_writeback_dirty(bdi),
-                        "Dirtiable inode bdi %s != sb bdi %s\n",
-                        bdi->name, sb->s_bdi->name);
-                return sb->s_bdi;
-        }
-        return bdi;
 }
 static void bdi_queue_work(struct backing_dev_info *bdi,
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index d367af1514ef..cde755cca564 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1354,7 +1354,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
        loff_t file_size;
        unsigned int num;
        unsigned int offset;
-        size_t total_len;
+        size_t total_len = 0;
        req = fuse_get_req(fc);
        if (IS_ERR(req))
diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c
index 32499d213fc4..9975457c981f 100644
--- a/fs/ocfs2/symlink.c
+++ b/fs/ocfs2/symlink.c
@@ -128,7 +128,7 @@ static void *ocfs2_fast_follow_link(struct dentry *dentry,
        }
        /* Fast symlinks can't be large */
-        len = strlen(target);
+        len = strnlen(target, ocfs2_fast_symlink_chars(inode->i_sb));
        link = kzalloc(len + 1, GFP_NOFS);
        if (!link) {
                status = -ENOMEM;
diff --git a/fs/proc/base.c b/fs/proc/base.c
index a1c43e7c8a7b..8e4addaa5424 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2675,7 +2675,7 @@ static const struct pid_entry tgid_base_stuff[] = {
        INF("auxv",       S_IRUSR, proc_pid_auxv),
        ONE("status",     S_IRUGO, proc_pid_status),
        ONE("personality", S_IRUSR, proc_pid_personality),
-        INF("limits",     S_IRUSR, proc_pid_limits),
+        INF("limits",     S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
        REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
@@ -3011,7 +3011,7 @@ static const struct pid_entry tid_base_stuff[] = {
        INF("auxv",      S_IRUSR, proc_pid_auxv),
        ONE("status",    S_IRUGO, proc_pid_status),
        ONE("personality", S_IRUSR, proc_pid_personality),
-        INF("limits",    S_IRUSR, proc_pid_limits),
+        INF("limits",    S_IRUGO, proc_pid_limits),
 #ifdef CONFIG_SCHED_DEBUG
        REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index f53505de0712..5cbb81e134ac 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -170,6 +170,7 @@ int reiserfs_prepare_write(struct file *f, struct page *page,
 int reiserfs_unpack(struct inode *inode, struct file *filp)
 {
        int retval = 0;
+        int depth;
        int index;
        struct page *page;
        struct address_space *mapping;
@@ -188,8 +189,8 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
        /* we need to make sure nobody is changing the file size beneath
         ** us
         */
-        mutex_lock(&inode->i_mutex);
+        reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
-        reiserfs_write_lock(inode->i_sb);
+        depth = reiserfs_write_lock_once(inode->i_sb);
        write_from = inode->i_size & (blocksize - 1);
        /* if we are on a block boundary, we are already unpacked.  */
@@ -224,6 +225,6 @@ int reiserfs_unpack(struct inode *inode, struct file *filp)
      out:
        mutex_unlock(&inode->i_mutex);
-        reiserfs_write_unlock(inode->i_sb);
+        reiserfs_write_unlock_once(inode->i_sb, depth);
        return retval;
 }
diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
index ed575fb4b495..7e206fc1fa36 100644
--- a/fs/xfs/xfs_log_cil.c
+++ b/fs/xfs/xfs_log_cil.c
@@ -405,9 +405,15 @@ xlog_cil_push(
        new_ctx = kmem_zalloc(sizeof(*new_ctx), KM_SLEEP|KM_NOFS);
        new_ctx->ticket = xlog_cil_ticket_alloc(log);
-        /* lock out transaction commit, but don't block on background push */
+        /*
+         * Lock out transaction commit, but don't block for background pushes
+         * unless we are well over the CIL space limit. See the definition of
+         * XLOG_CIL_HARD_SPACE_LIMIT() for the full explanation of the logic
+         * used here.
+         */
        if (!down_write_trylock(&cil->xc_ctx_lock)) {
-                if (!push_seq)
+                if (!push_seq &&
+                    cil->xc_ctx->space_used < XLOG_CIL_HARD_SPACE_LIMIT(log))
                        goto out_free_ticket;
                down_write(&cil->xc_ctx_lock);
        }
@@ -422,7 +428,7 @@ xlog_cil_push(
                goto out_skip;
        /* check for a previously pushed seqeunce */
-        if (push_seq < cil->xc_ctx->sequence)
+        if (push_seq && push_seq < cil->xc_ctx->sequence)
                goto out_skip;
        /*
diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
index ced52b98b322..edcdfe01617f 100644
--- a/fs/xfs/xfs_log_priv.h
+++ b/fs/xfs/xfs_log_priv.h
@@ -426,13 +426,13 @@ struct xfs_cil {
 };
 /*
- * The amount of log space we should the CIL to aggregate is difficult to size.
+ * The amount of log space we allow the CIL to aggregate is difficult to size.
- * Whatever we chose we have to make we can get a reservation for the log space
+ * Whatever we choose, we have to make sure we can get a reservation for the
- * effectively, that it is large enough to capture sufficient relogging to
+ * log space effectively, that it is large enough to capture sufficient
- * reduce log buffer IO significantly, but it is not too large for the log or
+ * relogging to reduce log buffer IO significantly, but it is not too large for
- * induces too much latency when writing out through the iclogs. We track both
+ * the log or induces too much latency when writing out through the iclogs. We
- * space consumed and the number of vectors in the checkpoint context, so we
+ * track both space consumed and the number of vectors in the checkpoint
- * need to decide which to use for limiting.
+ * context, so we need to decide which to use for limiting.
 *
 * Every log buffer we write out during a push needs a header reserved, which
 * is at least one sector and more for v2 logs. Hence we need a reservation of
@@ -459,16 +459,21 @@ struct xfs_cil {
 * checkpoint transaction ticket is specific to the checkpoint context, rather
 * than the CIL itself.
 *
- * With dynamic reservations, we can basically make up arbitrary limits for the
+ * With dynamic reservations, we can effectively make up arbitrary limits for
- * checkpoint size so long as they don't violate any other size rules.  Hence
+ * the checkpoint size so long as they don't violate any other size rules.
- * the initial maximum size for the checkpoint transaction will be set to a
+ * Recovery imposes a rule that no transaction exceed half the log, so we are
- * quarter of the log or 8MB, which ever is smaller. 8MB is an arbitrary limit
+ * limited by that.  Furthermore, the log transaction reservation subsystem
- * right now based on the latency of writing out a large amount of data through
+ * tries to keep 25% of the log free, so we need to keep below that limit or we
- * the circular iclog buffers.
+ * risk running out of free log space to start any new transactions.
+ *
+ * In order to keep background CIL push efficient, we will set a lower
+ * threshold at which background pushing is attempted without blocking current
+ * transaction commits.  A separate, higher bound defines when CIL pushes are
+ * enforced to ensure we stay within our maximum checkpoint size bounds.
+ * threshold, yet give us plenty of space for aggregation on large logs.
 */
+#define XLOG_CIL_SPACE_LIMIT(log)       (log->l_logsize >> 3)
-#define XLOG_CIL_SPACE_LIMIT(log)       \
+#define XLOG_CIL_HARD_SPACE_LIMIT(log)  (3 * (log->l_logsize >> 4))
-        (min((log->l_logsize >> 2), (8 * 1024 * 1024)))
 /*
 * The reservation head lsn is not made up of a cycle number and block number.
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index c0786d446a00..984cdc62e30b 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -55,7 +55,7 @@
 extern u8 acpi_gbl_permanent_mmap;
 /*
- * Globals that are publically available, allowing for
+ * Globals that are publicly available, allowing for
 * run time configuration
 */
 extern u32 acpi_dbg_level;
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index 7809d230adee..4c9461a4f9e6 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -612,7 +612,7 @@ struct drm_gem_object {
        struct kref refcount;
        /** Handle count of this object. Each handle also holds a reference */
-        struct kref handlecount;
+        atomic_t handle_count; /* number of handles on this object */
        /** Related drm device */
        struct drm_device *dev;
@@ -808,7 +808,6 @@ struct drm_driver {
         */
        int (*gem_init_object) (struct drm_gem_object *obj);
        void (*gem_free_object) (struct drm_gem_object *obj);
-        void (*gem_free_object_unlocked) (struct drm_gem_object *obj);
        /* vga arb irq handler */
        void (*vgaarb_irq)(struct drm_device *dev, bool state);
@@ -1175,6 +1174,7 @@ extern int drm_release(struct inode *inode, struct file *filp);
 extern int drm_mmap(struct file *filp, struct vm_area_struct *vma);
 extern int drm_mmap_locked(struct file *filp, struct vm_area_struct *vma);
 extern void drm_vm_open_locked(struct vm_area_struct *vma);
+extern void drm_vm_close_locked(struct vm_area_struct *vma);
 extern resource_size_t drm_core_get_map_ofs(struct drm_local_map * map);
 extern resource_size_t drm_core_get_reg_ofs(struct drm_device *dev);
 extern unsigned int drm_poll(struct file *filp, struct poll_table_struct *wait);
@@ -1455,12 +1455,11 @@ int drm_gem_init(struct drm_device *dev);
 void drm_gem_destroy(struct drm_device *dev);
 void drm_gem_object_release(struct drm_gem_object *obj);
 void drm_gem_object_free(struct kref *kref);
-void drm_gem_object_free_unlocked(struct kref *kref);
 struct drm_gem_object *drm_gem_object_alloc(struct drm_device *dev,
                                            size_t size);
 int drm_gem_object_init(struct drm_device *dev,
                        struct drm_gem_object *obj, size_t size);
-void drm_gem_object_handle_free(struct kref *kref);
+void drm_gem_object_handle_free(struct drm_gem_object *obj);
 void drm_gem_vm_open(struct vm_area_struct *vma);
 void drm_gem_vm_close(struct vm_area_struct *vma);
 int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma);
@@ -1483,8 +1482,12 @@ drm_gem_object_unreference(struct drm_gem_object *obj)
 static inline void
 drm_gem_object_unreference_unlocked(struct drm_gem_object *obj)
 {
-        if (obj != NULL)
+        if (obj != NULL) {
-                kref_put(&obj->refcount, drm_gem_object_free_unlocked);
+                struct drm_device *dev = obj->dev;
+                mutex_lock(&dev->struct_mutex);
+                kref_put(&obj->refcount, drm_gem_object_free);
+                mutex_unlock(&dev->struct_mutex);
+        }
 }
 int drm_gem_handle_create(struct drm_file *file_priv,
@@ -1495,7 +1498,7 @@ static inline void
 drm_gem_object_handle_reference(struct drm_gem_object *obj)
 {
        drm_gem_object_reference(obj);
-        kref_get(&obj->handlecount);
+        atomic_inc(&obj->handle_count);
 }
 static inline void
@@ -1504,12 +1507,15 @@ drm_gem_object_handle_unreference(struct drm_gem_object *obj)
        if (obj == NULL)
                return;
+        if (atomic_read(&obj->handle_count) == 0)
+                return;
        /*
         * Must bump handle count first as this may be the last
         * ref, in which case the object would disappear before we
         * checked for a name
         */
-        kref_put(&obj->handlecount, drm_gem_object_handle_free);
+        if (atomic_dec_and_test(&obj->handle_count))
+                drm_gem_object_handle_free(obj);
        drm_gem_object_unreference(obj);
 }
@@ -1519,12 +1525,17 @@ drm_gem_object_handle_unreference_unlocked(struct drm_gem_object *obj)
        if (obj == NULL)
                return;
+        if (atomic_read(&obj->handle_count) == 0)
+                return;
        /*
        * Must bump handle count first as this may be the last
        * ref, in which case the object would disappear before we
        * checked for a name
        */
-        kref_put(&obj->handlecount, drm_gem_object_handle_free);
+        if (atomic_dec_and_test(&obj->handle_count))
+                drm_gem_object_handle_free(obj);
        drm_gem_object_unreference_unlocked(obj);
 }
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 3a9940ef728b..883c1d439899 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -85,7 +85,6 @@
        {0x1002, 0x5460, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
        {0x1002, 0x5462, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
        {0x1002, 0x5464, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
-        {0x1002, 0x5657, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x5548, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R423|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x5549, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R423|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x554A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R423|RADEON_NEW_MEMMAP}, \
@@ -103,6 +102,7 @@
        {0x1002, 0x564F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x5652, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x5653, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x5657, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV410|RADEON_NEW_MEMMAP}, \
        {0x1002, 0x5834, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|RADEON_IS_IGP}, \
        {0x1002, 0x5835, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS300|RADEON_IS_IGP|RADEON_IS_MOBILITY}, \
        {0x1002, 0x5954, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS480|RADEON_IS_IGP|RADEON_IS_MOBILITY|RADEON_IS_IGPGART}, \
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 36ca9721a0c2..1be416bbbb82 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -53,6 +53,7 @@ struct cpuidle_state {
 #define CPUIDLE_FLAG_BALANCED   (0x40) /* medium latency, moderate savings */
 #define CPUIDLE_FLAG_DEEP       (0x80) /* high latency, large savings */
 #define CPUIDLE_FLAG_IGNORE     (0x100) /* ignore during this idle period */
+#define CPUIDLE_FLAG_TLB_FLUSHED (0x200) /* tlb will be flushed */
 #define CPUIDLE_DRIVER_FLAGS_MASK (0xFFFF0000)
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index c61d4ca27bcc..e2106495cc11 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -548,7 +548,7 @@ static inline bool dma_dev_has_pq_continue(struct dma_device *dma)
        return (dma->max_pq & DMA_HAS_PQ_CONTINUE) == DMA_HAS_PQ_CONTINUE;
 }
-static unsigned short dma_dev_to_maxpq(struct dma_device *dma)
+static inline unsigned short dma_dev_to_maxpq(struct dma_device *dma)
 {
        return dma->max_pq & ~DMA_HAS_PQ_CONTINUE;
 }
diff --git a/include/linux/module.h b/include/linux/module.h
index 8a6b9fdc7ffa..aace066bad8f 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -686,17 +686,16 @@ extern int module_sysfs_initialized;
 #ifdef CONFIG_GENERIC_BUG
-int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
                         struct module *);
 void module_bug_cleanup(struct module *);
 #else   /* !CONFIG_GENERIC_BUG */
-static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
+static inline void module_bug_finalize(const Elf_Ehdr *hdr,
                                        const Elf_Shdr *sechdrs,
                                        struct module *mod)
 {
-        return 0;
 }
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif  /* CONFIG_GENERIC_BUG */
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 9fbc54a2585d..83af1f8d8b74 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -454,7 +454,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 * Makes rcu_dereference_check() do the dirty work.
 */
 #define rcu_dereference_bh(p) \
-                rcu_dereference_check(p, rcu_read_lock_bh_held())
+                rcu_dereference_check(p, rcu_read_lock_bh_held() || irqs_disabled())
 /**
 * rcu_dereference_sched - fetch RCU-protected pointer, checking for RCU-sched
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 0836ccc57121..3efc9f3f43a0 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -614,6 +614,7 @@ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
                (wait)->private = current;                              \
                (wait)->func = autoremove_wake_function;                \
                INIT_LIST_HEAD(&(wait)->task_list);                     \
+                (wait)->flags = 0;                                      \
        } while (0)
 /**
diff --git a/ipc/sem.c b/ipc/sem.c
index 40a8f462a822..0e0d49bbb867 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -743,6 +743,8 @@ static unsigned long copy_semid_to_user(void __user *buf, struct semid64_ds *in,
            {
                struct semid_ds out;
+                memset(&out, 0, sizeof(out));
                ipc64_perm_to_ipc_perm(&in->sem_perm, &out.sem_perm);
                out.sem_otime   = in->sem_otime;
diff --git a/kernel/kfifo.c b/kernel/kfifo.c
index 6b5580c57644..01a0700e873f 100644
--- a/kernel/kfifo.c
+++ b/kernel/kfifo.c
@@ -365,8 +365,6 @@ static unsigned int setup_sgl(struct __kfifo *fifo, struct scatterlist *sgl,
        n = setup_sgl_buf(sgl, fifo->data + off, nents, l);
        n += setup_sgl_buf(sgl + n, fifo->data, nents - n, len - l);
-        if (n)
-                sg_mark_end(sgl + n - 1);
        return n;
 }
diff --git a/kernel/module.c b/kernel/module.c
index d0b5f8db11b4..ccd641991842 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1537,6 +1537,7 @@ static int __unlink_module(void *_mod)
 {
        struct module *mod = _mod;
        list_del(&mod->list);
+        module_bug_cleanup(mod);
        return 0;
 }
@@ -2625,6 +2626,7 @@ static struct module *load_module(void __user *umod,
        if (err < 0)
                goto ddebug;
+        module_bug_finalize(info.hdr, info.sechdrs, mod);
        list_add_rcu(&mod->list, &modules);
        mutex_unlock(&module_mutex);
@@ -2650,6 +2652,8 @@ static struct module *load_module(void __user *umod,
        mutex_lock(&module_mutex);
        /* Unlink carefully: kallsyms could be walking list. */
        list_del_rcu(&mod->list);
+        module_bug_cleanup(mod);
 ddebug:
        if (!mod->taints)
                dynamic_debug_remove(info.debug);
diff --git a/kernel/smp.c b/kernel/smp.c
index 75c970c715d3..ed6aacfcb7ef 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -365,9 +365,10 @@ call:
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 /**
- * __smp_call_function_single(): Run a function on another CPU
+ * __smp_call_function_single(): Run a function on a specific CPU
 * @cpu: The CPU to run on.
 * @data: Pre-allocated and setup data structure
+ * @wait: If true, wait until function has completed on specified CPU.
 *
 * Like smp_call_function_single(), but allow caller to pass in a
 * pre-allocated data structure. Useful for embedding @data inside
@@ -376,8 +377,10 @@ EXPORT_SYMBOL_GPL(smp_call_function_any);
 void __smp_call_function_single(int cpu, struct call_single_data *data,
                                int wait)
 {
-        csd_lock(data);
+        unsigned int this_cpu;
+        unsigned long flags;
+        this_cpu = get_cpu();
        /*
         * Can deadlock when called with interrupts disabled.
         * We allow cpu's that are not yet online though, as no one else can
@@ -387,7 +390,15 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
        WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
                     && !oops_in_progress);
-        generic_exec_single(cpu, data, wait);
+        if (cpu == this_cpu) {
+                local_irq_save(flags);
+                data->func(data->info);
+                local_irq_restore(flags);
+        } else {
+                csd_lock(data);
+                generic_exec_single(cpu, data, wait);
+        }
+        put_cpu();
 }
 /**
diff --git a/lib/bug.c b/lib/bug.c
index 7cdfad88128f..19552096d16b 100644
--- a/lib/bug.c
+++ b/lib/bug.c
@@ -72,8 +72,8 @@ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
        return NULL;
 }
-int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-                        struct module *mod)
+                         struct module *mod)
 {
        char *secstrings;
        unsigned int i;
@@ -97,8 +97,6 @@ int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
         * could potentially lead to deadlock and thus be counter-productive.
         */
        list_add(&mod->bug_list, &module_bug_list);
-        return 0;
 }
 void module_bug_cleanup(struct module *mod)
diff --git a/lib/list_sort.c b/lib/list_sort.c
index 4b5cb794c38b..a7616fa3162e 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -70,7 +70,7 @@ static void merge_and_restore_back_links(void *priv,
                 * element comparison is needed, so the client's cmp()
                 * routine can invoke cond_resched() periodically.
                 */
-                (*cmp)(priv, tail, tail);
+                (*cmp)(priv, tail->next, tail->next);
                tail->next->prev = tail;
                tail = tail->next;
diff --git a/mm/ksm.c b/mm/ksm.c
index b1873cf03ed9..65ab5c7067d9 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -712,7 +712,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
        if (!ptep)
                goto out;
-        if (pte_write(*ptep)) {
+        if (pte_write(*ptep) || pte_dirty(*ptep)) {
                pte_t entry;
                swapped = PageSwapCache(page);
@@ -735,7 +735,9 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
                        set_pte_at(mm, addr, ptep, entry);
                        goto out_unlock;
                }
-                entry = pte_wrprotect(entry);
+                if (pte_dirty(entry))
+                        set_page_dirty(page);
+                entry = pte_mkclean(pte_wrprotect(entry));
                set_pte_at_notify(mm, addr, ptep, entry);
        }
        *orig_pte = *ptep;
diff --git a/mm/rmap.c b/mm/rmap.c
index 9d2ba01bd4f9..92e6757f196e 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -381,7 +381,13 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
        if (PageAnon(page)) {
-                if (vma->anon_vma->root != page_anon_vma(page)->root)
+                struct anon_vma *page__anon_vma = page_anon_vma(page);
+                /*
+                 * Note: swapoff's unuse_vma() is more efficient with this
+                 * check, and needs it to match anon_vma when KSM is active.
+                 */
+                if (!vma->anon_vma || !page__anon_vma ||
+                    vma->anon_vma->root != page__anon_vma->root)
                        return -EFAULT;
        } else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
                if (!vma->vm_file ||
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 01ddb0472f86..0eb96f7e44be 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -24,8 +24,11 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
        if (vlan_dev)
                skb->dev = vlan_dev;
-        else if (vlan_id)
+        else if (vlan_id) {
-                goto drop;
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
        return (polling ? netif_receive_skb(skb) : netif_rx(skb));
@@ -102,8 +105,11 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
        if (vlan_dev)
                skb->dev = vlan_dev;
-        else if (vlan_id)
+        else if (vlan_id) {
-                goto drop;
+                if (!(skb->dev->flags & IFF_PROMISC))
+                        goto drop;
+                skb->pkt_type = PACKET_OTHERHOST;
+        }
        for (p = napi->gro_list; p; p = p->next) {
                NAPI_GRO_CB(p)->same_flow =
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 8ce904786116..4bf28f25f368 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -827,6 +827,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
        long timeo;
        int err;
        int ifindex, headroom, tailroom;
+        unsigned int mtu;
        struct net_device *dev;
        lock_sock(sk);
@@ -896,15 +897,23 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
                cf_sk->sk.sk_state = CAIF_DISCONNECTED;
                goto out;
        }
-        dev = dev_get_by_index(sock_net(sk), ifindex);
+        err = -ENODEV;
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+        if (!dev) {
+                rcu_read_unlock();
+                goto out;
+        }
        cf_sk->headroom = LL_RESERVED_SPACE_EXTRA(dev, headroom);
+        mtu = dev->mtu;
+        rcu_read_unlock();
        cf_sk->tailroom = tailroom;
-        cf_sk->maxframe = dev->mtu - (headroom + tailroom);
+        cf_sk->maxframe = mtu - (headroom + tailroom);
-        dev_put(dev);
        if (cf_sk->maxframe < 1) {
-                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%d)\n",
+                pr_warning("CAIF: %s(): CAIF Interface MTU too small (%u)\n",
-                        __func__, dev->mtu);
+                           __func__, mtu);
-                err = -ENODEV;
                goto out;
        }
diff --git a/net/core/stream.c b/net/core/stream.c
index d959e0f41528..f5df85dcd20b 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -141,10 +141,10 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                sk->sk_write_pending++;
-                sk_wait_event(sk, &current_timeo, !sk->sk_err &&
+                sk_wait_event(sk, &current_timeo, sk->sk_err ||
-                                                  !(sk->sk_shutdown & SEND_SHUTDOWN) &&
+                                                  (sk->sk_shutdown & SEND_SHUTDOWN) ||
-                                                  sk_stream_memory_free(sk) &&
+                                                  (sk_stream_memory_free(sk) &&
-                                                  vm_wait);
+                                                  !vm_wait));
                sk->sk_write_pending--;
                if (vm_wait) {
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 571f8950ed06..7cd7760144f7 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -217,6 +217,7 @@ config NET_IPIP
 config NET_IPGRE
        tristate "IP: GRE tunnels over IP"
+        depends on IPV6 || IPV6=n
        help
          Tunneling means encapsulating data of one protocol type within
          another protocol and sending it over a channel that understands the
@@ -412,7 +413,7 @@ config INET_XFRM_MODE_BEET
          If unsure, say Y.
 config INET_LRO
-        bool "Large Receive Offload (ipv4/tcp)"
+        tristate "Large Receive Offload (ipv4/tcp)"
        default y
        ---help---
          Support for Large Receive Offload (ipv4/tcp).
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1fdcacd36ce7..2a4bb76f2132 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -834,7 +834,7 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
        int                     mark = 0;
-        if (len == 8 || IGMP_V2_SEEN(in_dev)) {
+        if (len == 8) {
                if (ih->code == 0) {
                        /* Alas, old v1 router presents here. */
@@ -856,6 +856,18 @@ static void igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,
                igmpv3_clear_delrec(in_dev);
        } else if (len < 12) {
                return; /* ignore bogus packet; freed by caller */
+        } else if (IGMP_V1_SEEN(in_dev)) {
+                /* This is a v3 query with v1 queriers present */
+                max_delay = IGMP_Query_Response_Interval;
+                group = 0;
+        } else if (IGMP_V2_SEEN(in_dev)) {
+                /* this is a v3 query with v2 queriers present;
+                 * Interpretation of the max_delay code is problematic here.
+                 * A real v2 host would use ih_code directly, while v3 has a
+                 * different encoding. We use the v3 encoding as more likely
+                 * to be intended in a v3 query.
+                 */
+                max_delay = IGMPV3_MRC(ih3->code)*(HZ/IGMP_TIMER_SCALE);
        } else { /* v3 */
                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
                        return;
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c35b469e851c..74c54b30600f 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -135,13 +135,16 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 /* This function calculates a "timeout" which is equivalent to the timeout of a
 * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN.
+ * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
+ * syn_set flag is set.
 */
 static bool retransmits_timed_out(struct sock *sk,
-                                  unsigned int boundary)
+                                  unsigned int boundary,
+                                  bool syn_set)
 {
        unsigned int timeout, linear_backoff_thresh;
        unsigned int start_ts;
+        unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
        if (!inet_csk(sk)->icsk_retransmits)
                return false;
@@ -151,12 +154,12 @@ static bool retransmits_timed_out(struct sock *sk,
        else
                start_ts = tcp_sk(sk)->retrans_stamp;
-        linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
+        linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
        if (boundary <= linear_backoff_thresh)
-                timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
+                timeout = ((2 << boundary) - 1) * rto_base;
        else
-                timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
+                timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
                          (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
        return (tcp_time_stamp - start_ts) >= timeout;
@@ -167,14 +170,15 @@ static int tcp_write_timeout(struct sock *sk)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
        int retry_until;
-        bool do_reset;
+        bool do_reset, syn_set = 0;
        if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                if (icsk->icsk_retransmits)
                        dst_negative_advice(sk);
                retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
+                syn_set = 1;
        } else {
-                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
                        /* Black hole detection */
                        tcp_mtu_probing(icsk, sk);
@@ -187,14 +191,14 @@ static int tcp_write_timeout(struct sock *sk)
                        retry_until = tcp_orphan_retries(sk, alive);
                        do_reset = alive ||
-                                   !retransmits_timed_out(sk, retry_until);
+                                   !retransmits_timed_out(sk, retry_until, 0);
                        if (tcp_out_of_resources(sk, do_reset))
                                return 1;
                }
        }
-        if (retransmits_timed_out(sk, retry_until)) {
+        if (retransmits_timed_out(sk, retry_until, syn_set)) {
                /* Has it gone just too far? */
                tcp_write_err(sk);
                return 1;
@@ -436,7 +440,7 @@ out_reset_timer:
                icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
        }
        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
                __sk_dst_reset(sk);
 out:;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8323136bdc54..a275c6e1e25c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1556,14 +1556,13 @@ out:
 *      i.e. Path MTU discovery
 */
-void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+static void rt6_do_pmtu_disc(struct in6_addr *daddr, struct in6_addr *saddr,
-                        struct net_device *dev, u32 pmtu)
+                             struct net *net, u32 pmtu, int ifindex)
 {
        struct rt6_info *rt, *nrt;
-        struct net *net = dev_net(dev);
        int allfrag = 0;
-        rt = rt6_lookup(net, daddr, saddr, dev->ifindex, 0);
+        rt = rt6_lookup(net, daddr, saddr, ifindex, 0);
        if (rt == NULL)
                return;
@@ -1631,6 +1630,27 @@ out:
        dst_release(&rt->dst);
 }
+void rt6_pmtu_discovery(struct in6_addr *daddr, struct in6_addr *saddr,
+                        struct net_device *dev, u32 pmtu)
+{
+        struct net *net = dev_net(dev);
+        /*
+         * RFC 1981 states that a node "MUST reduce the size of the packets it
+         * is sending along the path" that caused the Packet Too Big message.
+         * Since it's not possible in the general case to determine which
+         * interface was used to send the original packet, we update the MTU
+         * on the interface that will be used to send future packets. We also
+         * update the MTU on the interface that received the Packet Too Big in
+         * case the original packet was forced out that interface with
+         * SO_BINDTODEVICE or similar. This is the next best thing to the
+         * correct behaviour, which would be to update the MTU on all
+         * interfaces.
+         */
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, 0);
+        rt6_do_pmtu_disc(daddr, saddr, net, pmtu, dev->ifindex);
+}
 /*
 *      Misc support functions
 */
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index fa0f37e4afe4..28624282c5f3 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2199,9 +2199,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        struct net_device *prev_dev = NULL;
        struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        if (status->flag & RX_FLAG_INTERNAL_CMTR)
-                goto out_free_skb;
        if (skb_headroom(skb) < sizeof(*rthdr) &&
            pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
                goto out_free_skb;
@@ -2260,7 +2257,6 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
        } else
                goto out_free_skb;
-        status->flag |= RX_FLAG_INTERNAL_CMTR;
        return;
 out_free_skb:
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index b2a3ae6cad78..15003021f4f0 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -225,12 +225,13 @@ static void pipe_grant_credits(struct sock *sk)
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
        struct pep_sock *pn = pep_sk(sk);
-        struct pnpipehdr *hdr = pnp_hdr(skb);
+        struct pnpipehdr *hdr;
        int wake = 0;
        if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
                return -EINVAL;
+        hdr = pnp_hdr(skb);
        if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
                LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
                                (unsigned)hdr->data[0]);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index 7416a5c73b2a..b0c2a82178af 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -137,7 +137,7 @@ next_knode:
                        int toff = off + key->off + (off2 & key->offmask);
                        __be32 *data, _data;
-                        if (skb_headroom(skb) + toff < 0)
+                        if (skb_headroom(skb) + toff > INT_MAX)
                                goto out;
                        data = skb_header_pointer(skb, toff, 4, &_data);
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 86366390038a..ddbbf7c81fa1 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -543,16 +543,20 @@ struct sctp_hmac *sctp_auth_asoc_get_hmac(const struct sctp_association *asoc)
                id = ntohs(hmacs->hmac_ids[i]);
                /* Check the id is in the supported range */
-                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                if (id > SCTP_AUTH_HMAC_ID_MAX) {
+                        id = 0;
                        continue;
+                }
                /* See is we support the id.  Supported IDs have name and
                 * length fields set, so that we can allocated and use
                 * them.  We can safely just check for name, for without the
                 * name, we can't allocate the TFM.
                 */
-                if (!sctp_hmac_list[id].hmac_name)
+                if (!sctp_hmac_list[id].hmac_name) {
+                        id = 0;
                        continue;
+                }
                break;
        }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index ca44917872d2..fbb70770ad05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -916,6 +916,11 @@ SCTP_STATIC int sctp_setsockopt_bindx(struct sock* sk,
        /* Walk through the addrs buffer and count the number of addresses. */
        addr_buf = kaddrs;
        while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        kfree(kaddrs);
+                        return -EINVAL;
+                }
                sa_addr = (struct sockaddr *)addr_buf;
                af = sctp_get_af_specific(sa_addr->sa_family);
@@ -1002,9 +1007,13 @@ static int __sctp_connect(struct sock* sk,
        /* Walk through the addrs buffer and count the number of addresses. */
        addr_buf = kaddrs;
        while (walk_size < addrs_size) {
+                if (walk_size + sizeof(sa_family_t) > addrs_size) {
+                        err = -EINVAL;
+                        goto out_free;
+                }
                sa_addr = (union sctp_addr *)addr_buf;
                af = sctp_get_af_specific(sa_addr->sa.sa_family);
-                port = ntohs(sa_addr->v4.sin_port);
                /* If the address family is not supported or if this address
                 * causes the address buffer to overflow return EINVAL.
@@ -1014,6 +1023,8 @@ static int __sctp_connect(struct sock* sk,
                        goto out_free;
                }
+                port = ntohs(sa_addr->v4.sin_port);
                /* Save current address so we can work with it */
                memcpy(&to, sa_addr, af->sockaddr_len);
diff --git a/samples/kfifo/dma-example.c b/samples/kfifo/dma-example.c
index ee03a4f0b64f..06473791c08a 100644
--- a/samples/kfifo/dma-example.c
+++ b/samples/kfifo/dma-example.c
@@ -24,6 +24,7 @@ static int __init example_init(void)
 {
        int                     i;
        unsigned int            ret;
+        unsigned int            nents;
        struct scatterlist      sg[10];
        printk(KERN_INFO "DMA fifo test start\n");
@@ -61,9 +62,9 @@ static int __init example_init(void)
         * byte at the beginning, after the kfifo_skip().
         */
        sg_init_table(sg, ARRAY_SIZE(sg));
-        ret = kfifo_dma_in_prepare(&fifo, sg, ARRAY_SIZE(sg), FIFO_SIZE);
+        nents = kfifo_dma_in_prepare(&fifo, sg, ARRAY_SIZE(sg), FIFO_SIZE);
-        printk(KERN_INFO "DMA sgl entries: %d\n", ret);
+        printk(KERN_INFO "DMA sgl entries: %d\n", nents);
-        if (!ret) {
+        if (!nents) {
                /* fifo is full and no sgl was created */
                printk(KERN_WARNING "error kfifo_dma_in_prepare\n");
                return -EIO;
@@ -71,7 +72,7 @@ static int __init example_init(void)
        /* receive data */
        printk(KERN_INFO "scatterlist for receive:\n");
-        for (i = 0; i < ARRAY_SIZE(sg); i++) {
+        for (i = 0; i < nents; i++) {
                printk(KERN_INFO
                "sg[%d] -> "
                "page_link 0x%.8lx offset 0x%.8x length 0x%.8x\n",
@@ -91,16 +92,16 @@ static int __init example_init(void)
        kfifo_dma_in_finish(&fifo, ret);
        /* Prepare to transmit data, example: 8 bytes */
-        ret = kfifo_dma_out_prepare(&fifo, sg, ARRAY_SIZE(sg), 8);
+        nents = kfifo_dma_out_prepare(&fifo, sg, ARRAY_SIZE(sg), 8);
-        printk(KERN_INFO "DMA sgl entries: %d\n", ret);
+        printk(KERN_INFO "DMA sgl entries: %d\n", nents);
-        if (!ret) {
+        if (!nents) {
                /* no data was available and no sgl was created */
                printk(KERN_WARNING "error kfifo_dma_out_prepare\n");
                return -EIO;
        }
        printk(KERN_INFO "scatterlist for transmit:\n");
-        for (i = 0; i < ARRAY_SIZE(sg); i++) {
+        for (i = 0; i < nents; i++) {
                printk(KERN_INFO
                "sg[%d] -> "
                "page_link 0x%.8lx offset 0x%.8x length 0x%.8x\n",
diff --git a/sound/core/control.c b/sound/core/control.c
index 070aab490191..45a818002d99 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -31,6 +31,7 @@
 /* max number of user-defined controls */
 #define MAX_USER_CONTROLS       32
+#define MAX_CONTROL_COUNT       1028
 struct snd_kctl_ioctl {
        struct list_head list;          /* list of all ioctls */
@@ -195,6 +196,10 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
        
        if (snd_BUG_ON(!control || !control->count))
                return NULL;
+        if (control->count > MAX_CONTROL_COUNT)
+                return NULL;
        kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
        if (kctl == NULL) {
                snd_printk(KERN_ERR "Cannot allocate control instance\n");
diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
index 1adb8a3c2b62..42d7844ecd0b 100644
--- a/sound/i2c/other/ak4xxx-adda.c
+++ b/sound/i2c/other/ak4xxx-adda.c
@@ -900,7 +900,7 @@ static int proc_init(struct snd_akm4xxx *ak)
        return 0;
 }
 #else /* !CONFIG_PROC_FS */
-static int proc_init(struct snd_akm4xxx *ak) {}
+static int proc_init(struct snd_akm4xxx *ak) { return 0; }
 #endif
 int snd_akm4xxx_build_controls(struct snd_akm4xxx *ak)
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 4f1fa77c1feb..1950e19af1cf 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -1017,7 +1017,7 @@ builtin-revert.o wt-status.o: wt-status.h
 # we compile into subdirectories. if the target directory is not the source directory, they might not exists. So
 # we depend the various files onto their directories.
 DIRECTORY_DEPS = $(LIB_OBJS) $(BUILTIN_OBJS) $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)common-cmds.h
-$(DIRECTORY_DEPS): $(sort $(dir $(DIRECTORY_DEPS)))
+$(DIRECTORY_DEPS): | $(sort $(dir $(DIRECTORY_DEPS)))
 # In the second step, we make a rule to actually create these directories
 $(sort $(dir $(DIRECTORY_DEPS))):
        $(QUIET_MKDIR)$(MKDIR) -p $@ 2>/dev/null
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index 7ea983acfaea..f7af2fca965d 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -97,7 +97,7 @@ void setup_python_scripting(void)
        register_python_scripting(&python_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops python_scripting_ops;
+extern struct scripting_ops python_scripting_ops;
 void setup_python_scripting(void)
 {
@@ -158,7 +158,7 @@ void setup_perl_scripting(void)
        register_perl_scripting(&perl_scripting_unsupported_ops);
 }
 #else
-struct scripting_ops perl_scripting_ops;
+extern struct scripting_ops perl_scripting_ops;
 void setup_perl_scripting(void)
 {
diff --git a/tools/perf/util/ui/browsers/hists.c b/tools/perf/util/ui/browsers/hists.c
index dafdf6775d77..6866aa4c41e0 100644
--- a/tools/perf/util/ui/browsers/hists.c
+++ b/tools/perf/util/ui/browsers/hists.c
@@ -773,7 +773,7 @@ int hists__browse(struct hists *self, const char *helpline, const char *ev_name)
                        switch (key) {
                        case 'a':
-                                if (browser->selection->map == NULL &&
+                                if (browser->selection->map == NULL ||
                                    browser->selection->map->dso->annotate_warned)
                                        continue;
                                goto do_annotate;