456 files changed, 6337 insertions, 2839 deletions

diff --git a/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
new file mode 100644
index 00000000000..ae8af1694e9
--- /dev/null
+++ b/Documentation/devicetree/bindings/i2c/i2c-mux-pinctrl.txt
@@ -0,0 +1,93 @@
+Pinctrl-based I2C Bus Mux
+
+This binding describes an I2C bus multiplexer that uses pin multiplexing to
+route the I2C signals, and represents the pin multiplexing configuration
+using the pinctrl device tree bindings.
+
+                                 +-----+  +-----+
+                                 | dev |  | dev |
+    +------------------------+   +-----+  +-----+
+    | SoC                    |      |        |
+    |                   /----|------+--------+
+    |   +---+   +------+     | child bus A, on first set of pins
+    |   |I2C|---|Pinmux|     |
+    |   +---+   +------+     | child bus B, on second set of pins
+    |                   \----|------+--------+--------+
+    |                        |      |        |        |
+    +------------------------+  +-----+  +-----+  +-----+
+                                | dev |  | dev |  | dev |
+                                +-----+  +-----+  +-----+
+
+Required properties:
+- compatible: i2c-mux-pinctrl
+- i2c-parent: The phandle of the I2C bus that this multiplexer's master-side
+  port is connected to.
+
+Also required are:
+
+* Standard pinctrl properties that specify the pin mux state for each child
+  bus. See ../pinctrl/pinctrl-bindings.txt.
+
+* Standard I2C mux properties. See mux.txt in this directory.
+
+* I2C child bus nodes. See mux.txt in this directory.
+
+For each named state defined in the pinctrl-names property, an I2C child bus
+will be created. I2C child bus numbers are assigned based on the index into
+the pinctrl-names property.
+
+The only exception is that no bus will be created for a state named "idle". If
+such a state is defined, it must be the last entry in pinctrl-names. For
+example:
+
+        pinctrl-names = "ddc", "pta", "idle"  ->  ddc = bus 0, pta = bus 1
+        pinctrl-names = "ddc", "idle", "pta"  ->  Invalid ("idle" not last)
+        pinctrl-names = "idle", "ddc", "pta"  ->  Invalid ("idle" not last)
+
+Whenever an access is made to a device on a child bus, the relevant pinctrl
+state will be programmed into hardware.
+
+If an idle state is defined, whenever an access is not being made to a device
+on a child bus, the idle pinctrl state will be programmed into hardware.
+
+If an idle state is not defined, the most recently used pinctrl state will be
+left programmed into hardware whenever no access is being made of a device on
+a child bus.
+
+Example:
+
+        i2cmux {
+                compatible = "i2c-mux-pinctrl";
+                #address-cells = <1>;
+                #size-cells = <0>;
+
+                i2c-parent = <&i2c1>;
+
+                pinctrl-names = "ddc", "pta", "idle";
+                pinctrl-0 = <&state_i2cmux_ddc>;
+                pinctrl-1 = <&state_i2cmux_pta>;
+                pinctrl-2 = <&state_i2cmux_idle>;
+
+                i2c@0 {
+                        reg = <0>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        eeprom {
+                                compatible = "eeprom";
+                                reg = <0x50>;
+                        };
+                };
+
+                i2c@1 {
+                        reg = <1>;
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        eeprom {
+                                compatible = "eeprom";
+                                reg = <0x50>;
+                        };
+                };
+        };
+
diff --git a/Documentation/networking/stmmac.txt b/Documentation/networking/stmmac.txt
index ab1e8d7004c..5cb9a197246 100644
--- a/Documentation/networking/stmmac.txt
+++ b/Documentation/networking/stmmac.txt
@@ -10,8 +10,8 @@ Currently this network device driver is for all STM embedded MAC/GMAC
 (i.e. 7xxx/5xxx SoCs), SPEAr (arm), Loongson1B (mips) and XLINX XC2V3000
 FF1152AMT0221 D1215994A VIRTEX FPGA board.
 
-DWC Ether MAC 10/100/1000 Universal version 3.60a (and older) and DWC Ether MAC 10/100
-Universal version 4.0 have been used for developing this driver.
+DWC Ether MAC 10/100/1000 Universal version 3.60a (and older) and DWC Ether
+MAC 10/100 Universal version 4.0 have been used for developing this driver.
 
 This driver supports both the platform bus and PCI.
 
@@ -54,27 +54,27 @@ net_device structure enabling the scatter/gather feature.
 When one or more packets are received, an interrupt happens. The interrupts
 are not queued so the driver has to scan all the descriptors in the ring during
 the receive process.
-This is based on NAPI so the interrupt handler signals only if there is work to be
-done, and it exits.
+This is based on NAPI so the interrupt handler signals only if there is work
+to be done, and it exits.
 Then the poll method will be scheduled at some future point.
 The incoming packets are stored, by the DMA, in a list of pre-allocated socket
 buffers in order to avoid the memcpy (Zero-copy).
 
 4.3) Timer-Driver Interrupt
-Instead of having the device that asynchronously notifies the frame receptions, the
-driver configures a timer to generate an interrupt at regular intervals.
-Based on the granularity of the timer, the frames that are received by the device
-will experience different levels of latency. Some NICs have dedicated timer
-device to perform this task. STMMAC can use either the RTC device or the TMU
-channel 2  on STLinux platforms.
+Instead of having the device that asynchronously notifies the frame receptions,
+the driver configures a timer to generate an interrupt at regular intervals.
+Based on the granularity of the timer, the frames that are received by the
+device will experience different levels of latency. Some NICs have dedicated
+timer device to perform this task. STMMAC can use either the RTC device or the
+TMU channel 2  on STLinux platforms.
 The timers frequency can be passed to the driver as parameter; when change it,
 take care of both hardware capability and network stability/performance impact.
-Several performance tests on STM platforms showed this optimisation allows to spare
-the CPU while having the maximum throughput.
+Several performance tests on STM platforms showed this optimisation allows to
+spare the CPU while having the maximum throughput.
 
 4.4) WOL
-Wake up on Lan feature through Magic and Unicast frames are supported for the GMAC
-core.
+Wake up on Lan feature through Magic and Unicast frames are supported for the
+GMAC core.
 
 4.5) DMA descriptors
 Driver handles both normal and enhanced descriptors. The latter has been only
@@ -106,7 +106,8 @@ Several driver's information can be passed through the platform
 These are included in the include/linux/stmmac.h header file
 and detailed below as well:
 
- struct plat_stmmacenet_data {
+struct plat_stmmacenet_data {
+        char *phy_bus_name;
         int bus_id;
         int phy_addr;
         int interface;
@@ -124,19 +125,24 @@ and detailed below as well:
         void (*bus_setup)(void __iomem *ioaddr);
         int (*init)(struct platform_device *pdev);
         void (*exit)(struct platform_device *pdev);
+        void *custom_cfg;
+        void *custom_data;
         void *bsp_priv;
  };
 
 Where:
+ o phy_bus_name: phy bus name to attach to the stmmac.
  o bus_id: bus identifier.
  o phy_addr: the physical address can be passed from the platform.
             If it is set to -1 the driver will automatically
             detect it at run-time by probing all the 32 addresses.
  o interface: PHY device's interface.
  o mdio_bus_data: specific platform fields for the MDIO bus.
- o pbl: the Programmable Burst Length is maximum number of beats to
+ o dma_cfg: internal DMA parameters
+   o pbl: the Programmable Burst Length is maximum number of beats to
        be transferred in one DMA transaction.
        GMAC also enables the 4xPBL by default.
+   o fixed_burst/mixed_burst/burst_len
  o clk_csr: fixed CSR Clock range selection.
  o has_gmac: uses the GMAC core.
  o enh_desc: if sets the MAC will use the enhanced descriptor structure.
@@ -160,8 +166,9 @@ Where:
              this is sometime necessary on some platforms (e.g. ST boxes)
              where the HW needs to have set some PIO lines or system cfg
              registers.
- o custom_cfg: this is a custom configuration that can be passed while
-              initialising the resources.
+ o custom_cfg/custom_data: this is a custom configuration that can be passed
+                           while initialising the resources.
+ o bsp_priv: another private poiter.
 
 For MDIO bus The we have:
 
@@ -180,7 +187,6 @@ Where:
  o irqs: list of IRQs, one per PHY.
  o probed_phy_irq: if irqs is NULL, use this for probed PHY.
 
-
 For DMA engine we have the following internal fields that should be
 tuned according to the HW capabilities.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 6a52bb4a4fc..3e30a3afe2a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1077,7 +1077,7 @@ F:	drivers/media/video/s5p-fimc/
 ARM/SAMSUNG S5P SERIES Multi Format Codec (MFC) SUPPORT
 M:      Kyungmin Park <kyungmin.park@samsung.com>
 M:      Kamil Debski <k.debski@samsung.com>
-M:     Jeongtae Park <jtp.park@samsung.com>
+M:      Jeongtae Park <jtp.park@samsung.com>
 L:      linux-arm-kernel@lists.infradead.org
 L:      linux-media@vger.kernel.org
 S:      Maintained
@@ -1646,11 +1646,11 @@ S:	Maintained
 F:      drivers/gpio/gpio-bt8xx.c
 
 BTRFS FILE SYSTEM
-M:      Chris Mason <chris.mason@oracle.com>
+M:      Chris Mason <chris.mason@fusionio.com>
 L:      linux-btrfs@vger.kernel.org
 W:      http://btrfs.wiki.kernel.org/
 Q:      http://patchwork.kernel.org/project/linux-btrfs/list/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs.git
 S:      Maintained
 F:      Documentation/filesystems/btrfs.txt
 F:      fs/btrfs/
@@ -1743,10 +1743,10 @@ F:	include/linux/can/platform/
 CAPABILITIES
 M:      Serge Hallyn <serge.hallyn@canonical.com>
 L:      linux-security-module@vger.kernel.org
-S:      Supported       
+S:      Supported
 F:      include/linux/capability.h
 F:      security/capability.c
-F:      security/commoncap.c 
+F:      security/commoncap.c
 F:      kernel/capability.c
 
 CELL BROADBAND ENGINE ARCHITECTURE
@@ -1800,6 +1800,9 @@ F:	include/linux/cfag12864b.h
 CFG80211 and NL80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      include/linux/nl80211.h
 F:      include/net/cfg80211.h
@@ -2146,11 +2149,11 @@ S:	Orphan
 F:      drivers/net/wan/pc300*
 
 CYTTSP TOUCHSCREEN DRIVER
-M:      Javier Martinez Canillas <javier@dowhile0.org>
-L:      linux-input@vger.kernel.org
-S:      Maintained
-F:      drivers/input/touchscreen/cyttsp*
-F:      include/linux/input/cyttsp.h
+M:      Javier Martinez Canillas <javier@dowhile0.org>
+L:      linux-input@vger.kernel.org
+S:      Maintained
+F:      drivers/input/touchscreen/cyttsp*
+F:      include/linux/input/cyttsp.h
 
 DAMA SLAVE for AX.25
 M:      Joerg Reuter <jreuter@yaina.de>
@@ -2270,7 +2273,7 @@ F:	include/linux/device-mapper.h
 F:      include/linux/dm-*.h
 
 DIOLAN U2C-12 I2C DRIVER
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/busses/i2c-diolan-u2c.c
@@ -3145,7 +3148,7 @@ F:	drivers/tty/hvc/
 
 HARDWARE MONITORING
 M:      Jean Delvare <khali@linux-fr.org>
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
 T:      quilt kernel.org/pub/linux/kernel/people/jdelvare/linux-2.6/jdelvare-hwmon/
@@ -4103,6 +4106,8 @@ F:	drivers/scsi/53c700*
 LED SUBSYSTEM
 M:      Bryan Wu <bryan.wu@canonical.com>
 M:      Richard Purdie <rpurdie@rpsys.net>
+L:      linux-leds@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds.git
 S:      Maintained
 F:      drivers/leds/
 F:      include/linux/leds.h
@@ -4347,7 +4352,8 @@ MAC80211
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
 W:      http://linuxwireless.org/
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/networking/mac80211-injection.txt
 F:      include/net/mac80211.h
@@ -4358,7 +4364,8 @@ M:	Stefano Brivio <stefano.brivio@polimi.it>
 M:      Mattias Nissler <mattias.nissler@gmx.de>
 L:      linux-wireless@vger.kernel.org
 W:      http://linuxwireless.org/en/developers/Documentation/mac80211/RateControl/PID
-T:      git git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      net/mac80211/rc80211_pid*
 
@@ -4418,6 +4425,13 @@ S:	Orphan
 F:      drivers/video/matrox/matroxfb_*
 F:      include/linux/matroxfb.h
 
+MAX16065 HARDWARE MONITOR DRIVER
+M:      Guenter Roeck <linux@roeck-us.net>
+L:      lm-sensors@lm-sensors.org
+S:      Maintained
+F:      Documentation/hwmon/max16065
+F:      drivers/hwmon/max16065.c
+
 MAX6650 HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:      "Hans J. Koch" <hjk@hansjkoch.de>
 L:      lm-sensors@lm-sensors.org
@@ -5156,7 +5170,7 @@ F:	drivers/leds/leds-pca9532.c
 F:      include/linux/leds-pca9532.h
 
 PCA9541 I2C BUS MASTER SELECTOR DRIVER
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      linux-i2c@vger.kernel.org
 S:      Maintained
 F:      drivers/i2c/muxes/i2c-mux-pca9541.c
@@ -5176,7 +5190,7 @@ S:	Maintained
 F:      drivers/firmware/pcdp.*
 
 PCI ERROR RECOVERY
-M:     Linas Vepstas <linasvepstas@gmail.com>
+M:      Linas Vepstas <linasvepstas@gmail.com>
 L:      linux-pci@vger.kernel.org
 S:      Supported
 F:      Documentation/PCI/pci-error-recovery.txt
@@ -5306,7 +5320,7 @@ F:	drivers/video/fb-puv3.c
 F:      drivers/rtc/rtc-puv3.c
 
 PMBUS HARDWARE MONITORING DRIVERS
-M:      Guenter Roeck <guenter.roeck@ericsson.com>
+M:      Guenter Roeck <linux@roeck-us.net>
 L:      lm-sensors@lm-sensors.org
 W:      http://www.lm-sensors.org/
 W:      http://www.roeck-us.net/linux/drivers/
@@ -5702,6 +5716,9 @@ F:	include/linux/remoteproc.h
 RFKILL
 M:      Johannes Berg <johannes@sipsolutions.net>
 L:      linux-wireless@vger.kernel.org
+W:      http://wireless.kernel.org/
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211.git
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git
 S:      Maintained
 F:      Documentation/rfkill.txt
 F:      net/rfkill/
@@ -7298,11 +7315,11 @@ F:	Documentation/DocBook/uio-howto.tmpl
 F:      drivers/uio/
 F:      include/linux/uio*.h
 
-UTIL-LINUX-NG PACKAGE
+UTIL-LINUX PACKAGE
 M:      Karel Zak <kzak@redhat.com>
-L:      util-linux-ng@vger.kernel.org
-W:      http://kernel.org/~kzak/util-linux-ng/
-T:      git git://git.kernel.org/pub/scm/utils/util-linux-ng/util-linux-ng.git
+L:      util-linux@vger.kernel.org
+W:      http://en.wikipedia.org/wiki/Util-linux
+T:      git git://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
 S:      Maintained
 
 UVESAFB DRIVER
diff --git a/Makefile b/Makefile
index 0d718ede9ea..b771af58338 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 5
 SUBLEVEL = 0
-EXTRAVERSION = -rc1
+EXTRAVERSION = -rc3
 NAME = Saber-toothed Squirrel
 
 # *DOCUMENTATION*
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index b649c5904a4..84449dd8f03 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -7,7 +7,6 @@ config ARM
         select HAVE_IDE if PCI || ISA || PCMCIA
         select HAVE_DMA_ATTRS
         select HAVE_DMA_CONTIGUOUS if (CPU_V6 || CPU_V6K || CPU_V7)
-        select CMA if (CPU_V6 || CPU_V6K || CPU_V7)
         select HAVE_MEMBLOCK
         select RTC_LIB
         select SYS_SUPPORTS_APM_EMULATION
diff --git a/arch/arm/common/dmabounce.c b/arch/arm/common/dmabounce.c
index 9d7eb530f95..aa07f5938f0 100644
--- a/arch/arm/common/dmabounce.c
+++ b/arch/arm/common/dmabounce.c
@@ -366,8 +366,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -377,8 +377,8 @@ static int __dmabounce_sync_for_cpu(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
@@ -406,8 +406,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
         struct safe_buffer *buf;
         unsigned long off;
 
-        dev_dbg(dev, "%s(dma=%#x,off=%#lx,sz=%zx,dir=%x)\n",
-                __func__, addr, off, sz, dir);
+        dev_dbg(dev, "%s(dma=%#x,sz=%zx,dir=%x)\n",
+                __func__, addr, sz, dir);
 
         buf = find_safe_buffer_dev(dev, addr, __func__);
         if (!buf)
@@ -417,8 +417,8 @@ static int __dmabounce_sync_for_device(struct device *dev, dma_addr_t addr,
 
         BUG_ON(buf->direction != dir);
 
-        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x) mapped to %p (dma=%#x)\n",
-                __func__, buf->ptr, virt_to_dma(dev, buf->ptr),
+        dev_dbg(dev, "%s: unsafe buffer %p (dma=%#x off=%#lx) mapped to %p (dma=%#x)\n",
+                __func__, buf->ptr, virt_to_dma(dev, buf->ptr), off,
                 buf->safe, buf->safe_dma_addr);
 
         DO_STATS(dev->archdata.dmabounce->bounce_count++);
diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c
index 54d49ddb9b8..5fb47a14f4b 100644
--- a/arch/arm/mach-omap2/display.c
+++ b/arch/arm/mach-omap2/display.c
@@ -271,9 +271,9 @@ static struct platform_device *create_simple_dss_pdev(const char *pdev_name,
                 goto err;
         }
 
-        r = omap_device_register(pdev);
+        r = platform_device_add(pdev);
         if (r) {
-                pr_err("Could not register omap_device for %s\n", pdev_name);
+                pr_err("Could not register platform_device for %s\n", pdev_name);
                 goto err;
         }
 
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index ea6b4315409..d766e4256b7 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -228,7 +228,7 @@ static pte_t **consistent_pte;
 
 #define DEFAULT_CONSISTENT_DMA_SIZE SZ_2M
 
-unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
+static unsigned long consistent_base = CONSISTENT_END - DEFAULT_CONSISTENT_DMA_SIZE;
 
 void __init init_consistent_dma_size(unsigned long size)
 {
@@ -268,10 +268,8 @@ static int __init consistent_init(void)
         unsigned long base = consistent_base;
         unsigned long num_ptes = (CONSISTENT_END - base) >> PMD_SHIFT;
 
-#ifndef CONFIG_ARM_DMA_USE_IOMMU
-        if (cpu_architecture() >= CPU_ARCH_ARMv6)
+        if (IS_ENABLED(CONFIG_CMA) && !IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU))
                 return 0;
-#endif
 
         consistent_pte = kmalloc(num_ptes * sizeof(pte_t), GFP_KERNEL);
         if (!consistent_pte) {
@@ -323,7 +321,7 @@ static struct arm_vmregion_head coherent_head = {
         .vm_list        = LIST_HEAD_INIT(coherent_head.vm_list),
 };
 
-size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
+static size_t coherent_pool_size = DEFAULT_CONSISTENT_DMA_SIZE / 8;
 
 static int __init early_coherent_pool(char *p)
 {
@@ -342,7 +340,7 @@ static int __init coherent_init(void)
         struct page *page;
         void *ptr;
 
-        if (cpu_architecture() < CPU_ARCH_ARMv6)
+        if (!IS_ENABLED(CONFIG_CMA))
                 return 0;
 
         ptr = __alloc_from_contiguous(NULL, size, prot, &page);
@@ -704,7 +702,7 @@ static void *__dma_alloc(struct device *dev, size_t size, dma_addr_t *handle,
 
         if (arch_is_coherent() || nommu())
                 addr = __alloc_simple_buffer(dev, size, gfp, &page);
-        else if (cpu_architecture() < CPU_ARCH_ARMv6)
+        else if (!IS_ENABLED(CONFIG_CMA))
                 addr = __alloc_remap_buffer(dev, size, gfp, prot, &page, caller);
         else if (gfp & GFP_ATOMIC)
                 addr = __alloc_from_pool(dev, size, &page, caller);
@@ -773,7 +771,7 @@ void arm_dma_free(struct device *dev, size_t size, void *cpu_addr,
 
         if (arch_is_coherent() || nommu()) {
                 __dma_free_buffer(page, size);
-        } else if (cpu_architecture() < CPU_ARCH_ARMv6) {
+        } else if (!IS_ENABLED(CONFIG_CMA)) {
                 __dma_free_remap(cpu_addr, size);
                 __dma_free_buffer(page, size);
         } else {
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c21d06c7dd7..f54d5921976 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -212,7 +212,7 @@ EXPORT_SYMBOL(arm_dma_zone_size);
  * allocations.  This must be the smallest DMA mask in the system,
  * so a successful GFP_DMA allocation will always satisfy this.
  */
-u32 arm_dma_limit;
+phys_addr_t arm_dma_limit;
 
 static void __init arm_adjust_dma_zone(unsigned long *size, unsigned long *hole,
         unsigned long dma_size)
diff --git a/arch/arm/mm/mm.h b/arch/arm/mm/mm.h
index 93dc0c17cdc..c471436c795 100644
--- a/arch/arm/mm/mm.h
+++ b/arch/arm/mm/mm.h
@@ -62,7 +62,7 @@ extern void __flush_dcache_page(struct address_space *mapping, struct page *page
 #endif
 
 #ifdef CONFIG_ZONE_DMA
-extern u32 arm_dma_limit;
+extern phys_addr_t arm_dma_limit;
 #else
 #define arm_dma_limit ((u32)~0)
 #endif
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index cac5b6be572..14712012826 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -7,6 +7,8 @@ config M68K
         select GENERIC_IRQ_SHOW
         select ARCH_HAVE_NMI_SAFE_CMPXCHG if RMW_INSNS
         select GENERIC_CPU_DEVICES
+        select GENERIC_STRNCPY_FROM_USER if MMU
+        select GENERIC_STRNLEN_USER if MMU
         select FPU if MMU
         select ARCH_USES_GETTIMEOFFSET if MMU && !COLDFIRE
 
diff --git a/arch/m68k/include/asm/Kbuild b/arch/m68k/include/asm/Kbuild
index 1a922fad76f..eafa2539a8e 100644
--- a/arch/m68k/include/asm/Kbuild
+++ b/arch/m68k/include/asm/Kbuild
@@ -1,2 +1,4 @@
 include include/asm-generic/Kbuild.asm
 header-y += cachectl.h
+
+generic-y += word-at-a-time.h
diff --git a/arch/m68k/include/asm/m528xsim.h b/arch/m68k/include/asm/m528xsim.h
index d63b99ff7ff..497c31c803f 100644
--- a/arch/m68k/include/asm/m528xsim.h
+++ b/arch/m68k/include/asm/m528xsim.h
@@ -86,7 +86,7 @@
 /*
  *      QSPI module.
  */
-#define MCFQSPI_IOBASE          (MCF_IPSBAR + 0x340)
+#define MCFQSPI_BASE            (MCF_IPSBAR + 0x340)
 #define MCFQSPI_SIZE            0x40
 
 #define MCFQSPI_CS0             147
diff --git a/arch/m68k/include/asm/uaccess_mm.h b/arch/m68k/include/asm/uaccess_mm.h
index 9c80cd515b2..472c891a4ae 100644
--- a/arch/m68k/include/asm/uaccess_mm.h
+++ b/arch/m68k/include/asm/uaccess_mm.h
@@ -379,12 +379,15 @@ __constant_copy_to_user(void __user *to, const void *from, unsigned long n)
 #define copy_from_user(to, from, n)     __copy_from_user(to, from, n)
 #define copy_to_user(to, from, n)       __copy_to_user(to, from, n)
 
-long strncpy_from_user(char *dst, const char __user *src, long count);
-long strnlen_user(const char __user *src, long n);
+#define user_addr_max() \
+        (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
+
+extern long strncpy_from_user(char *dst, const char __user *src, long count);
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 unsigned long __clear_user(void __user *to, unsigned long n);
 
 #define clear_user      __clear_user
 
-#define strlen_user(str) strnlen_user(str, 32767)
-
 #endif /* _M68K_UACCESS_H */
diff --git a/arch/m68k/kernel/ptrace.c b/arch/m68k/kernel/ptrace.c
index 8b4a2222e65..1bc10e62b9a 100644
--- a/arch/m68k/kernel/ptrace.c
+++ b/arch/m68k/kernel/ptrace.c
@@ -286,7 +286,7 @@ asmlinkage void syscall_trace(void)
         }
 }
 
-#ifdef CONFIG_COLDFIRE
+#if defined(CONFIG_COLDFIRE) || !defined(CONFIG_MMU)
 asmlinkage int syscall_trace_enter(void)
 {
         int ret = 0;
diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
index d7deb7fc7eb..707f0573ec6 100644
--- a/arch/m68k/kernel/time.c
+++ b/arch/m68k/kernel/time.c
@@ -85,7 +85,7 @@ void __init time_init(void)
         mach_sched_init(timer_interrupt);
 }
 
-#ifdef CONFIG_M68KCLASSIC
+#ifdef CONFIG_ARCH_USES_GETTIMEOFFSET
 
 u32 arch_gettimeoffset(void)
 {
@@ -108,4 +108,4 @@ static int __init rtc_init(void)
 
 module_init(rtc_init);
 
-#endif /* CONFIG_M68KCLASSIC */
+#endif /* CONFIG_ARCH_USES_GETTIMEOFFSET */
diff --git a/arch/m68k/lib/uaccess.c b/arch/m68k/lib/uaccess.c
index 5664386338d..5e97f2ee7c1 100644
--- a/arch/m68k/lib/uaccess.c
+++ b/arch/m68k/lib/uaccess.c
@@ -104,80 +104,6 @@ unsigned long __generic_copy_to_user(void __user *to, const void *from,
 EXPORT_SYMBOL(__generic_copy_to_user);
 
 /*
- * Copy a null terminated string from userspace.
- */
-long strncpy_from_user(char *dst, const char __user *src, long count)
-{
-        long res;
-        char c;
-
-        if (count <= 0)
-                return count;
-
-        asm volatile ("\n"
-                "1:     "MOVES".b       (%2)+,%4\n"
-                "       move.b  %4,(%1)+\n"
-                "       jeq     2f\n"
-                "       subq.l  #1,%3\n"
-                "       jne     1b\n"
-                "2:     sub.l   %3,%0\n"
-                "3:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "10:    move.l  %5,%0\n"
-                "       jra     3b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   1b,10b\n"
-                "       .previous"
-                : "=d" (res), "+a" (dst), "+a" (src), "+r" (count), "=&d" (c)
-                : "i" (-EFAULT), "0" (count));
-
-        return res;
-}
-EXPORT_SYMBOL(strncpy_from_user);
-
-/*
- * Return the size of a string (including the ending 0)
- *
- * Return 0 on exception, a value greater than N if too long
- */
-long strnlen_user(const char __user *src, long n)
-{
-        char c;
-        long res;
-
-        asm volatile ("\n"
-                "1:     subq.l  #1,%1\n"
-                "       jmi     3f\n"
-                "2:     "MOVES".b       (%0)+,%2\n"
-                "       tst.b   %2\n"
-                "       jne     1b\n"
-                "       jra     4f\n"
-                "\n"
-                "3:     addq.l  #1,%0\n"
-                "4:     sub.l   %4,%0\n"
-                "5:\n"
-                "       .section .fixup,\"ax\"\n"
-                "       .even\n"
-                "20:    sub.l   %0,%0\n"
-                "       jra     5b\n"
-                "       .previous\n"
-                "\n"
-                "       .section __ex_table,\"a\"\n"
-                "       .align  4\n"
-                "       .long   2b,20b\n"
-                "       .previous\n"
-                : "=&a" (res), "+d" (n), "=&d" (c)
-                : "0" (src), "r" (src));
-
-        return res;
-}
-EXPORT_SYMBOL(strnlen_user);
-
-/*
  * Zero Userspace
  */
 
diff --git a/arch/m68k/platform/68328/timers.c b/arch/m68k/platform/68328/timers.c
index c801c172b82..f4dc9b29560 100644
--- a/arch/m68k/platform/68328/timers.c
+++ b/arch/m68k/platform/68328/timers.c
@@ -53,6 +53,7 @@
 #endif
 
 static u32 m68328_tick_cnt;
+static irq_handler_t timer_interrupt;
 
 /***************************************************************************/
 
@@ -62,7 +63,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
         TSTAT &= 0;
 
         m68328_tick_cnt += TICKS_PER_JIFFY;
-        return arch_timer_interrupt(irq, dummy);
+        return timer_interrupt(irq, dummy);
 }
 
 /***************************************************************************/
@@ -99,7 +100,7 @@ static struct clocksource m68328_clk = {
 
 /***************************************************************************/
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
         /* disable timer 1 */
         TCTL = 0;
@@ -115,6 +116,7 @@ void hw_timer_init(void)
         /* Enable timer 1 */
         TCTL |= TCTL_TEN;
         clocksource_register_hz(&m68328_clk, TICKS_PER_JIFFY*HZ);
+        timer_interrupt = handler;
 }
 
 /***************************************************************************/
diff --git a/arch/m68k/platform/68360/config.c b/arch/m68k/platform/68360/config.c
index 255fc03913e..9877cefad1e 100644
--- a/arch/m68k/platform/68360/config.c
+++ b/arch/m68k/platform/68360/config.c
@@ -35,6 +35,7 @@ extern void m360_cpm_reset(void);
 #define OSCILLATOR  (unsigned long int)33000000
 #endif
 
+static irq_handler_t timer_interrupt;
 unsigned long int system_clock;
 
 extern QUICC *pquicc;
@@ -52,7 +53,7 @@ static irqreturn_t hw_tick(int irq, void *dummy)
 
   pquicc->timer_ter1 = 0x0002; /* clear timer event */
 
-  return arch_timer_interrupt(irq, dummy);
+  return timer_interrupt(irq, dummy);
 }
 
 static struct irqaction m68360_timer_irq = {
@@ -61,7 +62,7 @@ static struct irqaction m68360_timer_irq = {
         .handler = hw_tick,
 };
 
-void hw_timer_init(void)
+void hw_timer_init(irq_handler_t handler)
 {
   unsigned char prescaler;
   unsigned short tgcr_save;
@@ -94,6 +95,8 @@ void hw_timer_init(void)
 
   pquicc->timer_ter1 = 0x0003; /* clear timer events */
 
+  timer_interrupt = handler;
+
   /* enable timer 1 interrupt in CIMR */
   setup_irq(CPMVEC_TIMER1, &m68360_timer_irq);
 
diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
index dbc3850b1d0..5707f1a6234 100644
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -21,6 +21,7 @@ KBUILD_DEFCONFIG := default_defconfig
 
 NM              = sh $(srctree)/arch/parisc/nm
 CHECKFLAGS      += -D__hppa__=1
+LIBGCC          = $(shell $(CC) $(KBUILD_CFLAGS) -print-libgcc-file-name)
 
 MACHINE         := $(shell uname -m)
 ifeq ($(MACHINE),parisc*)
@@ -79,7 +80,7 @@ kernel-y			:= mm/ kernel/ math-emu/
 kernel-$(CONFIG_HPUX)           += hpux/
 
 core-y  += $(addprefix arch/parisc/, $(kernel-y))
-libs-y  += arch/parisc/lib/ `$(CC) -print-libgcc-file-name`
+libs-y  += arch/parisc/lib/ $(LIBGCC)
 
 drivers-$(CONFIG_OPROFILE)              += arch/parisc/oprofile/
 
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index 19a434f5505..4383707d980 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -1,3 +1,4 @@
 include include/asm-generic/Kbuild.asm
 
 header-y += pdc.h
+generic-y += word-at-a-time.h
diff --git a/arch/parisc/include/asm/bug.h b/arch/parisc/include/asm/bug.h
index 72cfdb0cfdd..62a33338549 100644
--- a/arch/parisc/include/asm/bug.h
+++ b/arch/parisc/include/asm/bug.h
@@ -1,6 +1,8 @@
 #ifndef _PARISC_BUG_H
 #define _PARISC_BUG_H
 
+#include <linux/kernel.h>       /* for BUGFLAG_TAINT */
+
 /*
  * Tell the user there is some problem.
  * The offending file and line are encoded in the __bug_table section.
diff --git a/arch/powerpc/include/asm/hw_irq.h b/arch/powerpc/include/asm/hw_irq.h
index c9aac24b02e..32b394f3b85 100644
--- a/arch/powerpc/include/asm/hw_irq.h
+++ b/arch/powerpc/include/asm/hw_irq.h
@@ -100,6 +100,9 @@ static inline void hard_irq_disable(void)
         get_paca()->irq_happened |= PACA_IRQ_HARD_DIS;
 }
 
+/* include/linux/interrupt.h needs hard_irq_disable to be a macro */
+#define hard_irq_disable        hard_irq_disable
+
 /*
  * This is called by asynchronous interrupts to conditionally
  * re-enable hard interrupts when soft-disabled after having
diff --git a/arch/powerpc/kernel/module_32.c b/arch/powerpc/kernel/module_32.c
index 0b6d79617d7..2e3200ca485 100644
--- a/arch/powerpc/kernel/module_32.c
+++ b/arch/powerpc/kernel/module_32.c
@@ -176,8 +176,8 @@ int module_frob_arch_sections(Elf32_Ehdr *hdr,
 
 static inline int entry_matches(struct ppc_plt_entry *entry, Elf32_Addr val)
 {
-        if (entry->jump[0] == 0x3d600000 + ((val + 0x8000) >> 16)
-            && entry->jump[1] == 0x396b0000 + (val & 0xffff))
+        if (entry->jump[0] == 0x3d800000 + ((val + 0x8000) >> 16)
+            && entry->jump[1] == 0x398c0000 + (val & 0xffff))
                 return 1;
         return 0;
 }
@@ -204,10 +204,9 @@ static uint32_t do_plt_call(void *location,
                 entry++;
         }
 
-        /* Stolen from Paul Mackerras as well... */
-        entry->jump[0] = 0x3d600000+((val+0x8000)>>16); /* lis r11,sym@ha */
-        entry->jump[1] = 0x396b0000 + (val&0xffff);     /* addi r11,r11,sym@l*/
-        entry->jump[2] = 0x7d6903a6;                    /* mtctr r11 */
+        entry->jump[0] = 0x3d800000+((val+0x8000)>>16); /* lis r12,sym@ha */
+        entry->jump[1] = 0x398c0000 + (val&0xffff);     /* addi r12,r12,sym@l*/
+        entry->jump[2] = 0x7d8903a6;                    /* mtctr r12 */
         entry->jump[3] = 0x4e800420;                    /* bctr */
 
         DEBUGP("Initialized plt for 0x%x at %p\n", val, entry);
diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
index 99a995c2a3f..be171ee73bf 100644
--- a/arch/powerpc/kernel/time.c
+++ b/arch/powerpc/kernel/time.c
@@ -475,6 +475,7 @@ void timer_interrupt(struct pt_regs * regs)
         struct pt_regs *old_regs;
         u64 *next_tb = &__get_cpu_var(decrementers_next_tb);
         struct clock_event_device *evt = &__get_cpu_var(decrementers);
+        u64 now;
 
         /* Ensure a positive value is written to the decrementer, or else
          * some CPUs will continue to take decrementer exceptions.
@@ -509,9 +510,16 @@ void timer_interrupt(struct pt_regs * regs)
                 irq_work_run();
         }
 
-        *next_tb = ~(u64)0;
-        if (evt->event_handler)
-                evt->event_handler(evt);
+        now = get_tb_or_rtc();
+        if (now >= *next_tb) {
+                *next_tb = ~(u64)0;
+                if (evt->event_handler)
+                        evt->event_handler(evt);
+        } else {
+                now = *next_tb - now;
+                if (now <= DECREMENTER_MAX)
+                        set_dec((int)now);
+        }
 
 #ifdef CONFIG_PPC64
         /* collect purr register values often, for accurate calculations */
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 99bcd0ee838..31d9db7913e 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -32,6 +32,8 @@ config SUPERH
         select GENERIC_SMP_IDLE_THREAD
         select GENERIC_CLOCKEVENTS
         select GENERIC_CMOS_UPDATE if SH_SH03 || SH_DREAMCAST
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
         help
           The SuperH is a RISC processor targeted for use in embedded systems
           and consumer electronics; it was also used in the Sega Dreamcast
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index 46edf070da1..aed701c7b11 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -9,6 +9,12 @@
 # License.  See the file "COPYING" in the main directory of this archive
 # for more details.
 #
+ifneq ($(SUBARCH),$(ARCH))
+  ifeq ($(CROSS_COMPILE),)
+    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
+  endif
+endif
+
 isa-y                                   := any
 isa-$(CONFIG_SH_DSP)                    := sh
 isa-$(CONFIG_CPU_SH2)                   := sh2
@@ -106,19 +112,13 @@ LDFLAGS_vmlinux		+= --defsym phys_stext=_stext-$(CONFIG_PAGE_OFFSET) \
 KBUILD_DEFCONFIG        := cayman_defconfig
 endif
 
-ifneq ($(SUBARCH),$(ARCH))
-  ifeq ($(CROSS_COMPILE),)
-    CROSS_COMPILE := $(call cc-cross-prefix, $(UTS_MACHINE)-linux-  $(UTS_MACHINE)-linux-gnu-  $(UTS_MACHINE)-unknown-linux-gnu-)
-  endif
-endif
-
 ifdef CONFIG_CPU_LITTLE_ENDIAN
 ld-bfd                  := elf32-$(UTS_MACHINE)-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64 --oformat $(ld-bfd)
 LDFLAGS                 += -EL
 else
 ld-bfd                  := elf32-$(UTS_MACHINE)big-linux
-LDFLAGS_vmlinux         += --defsym 'jiffies=jiffies_64+4' --oformat $(ld-bfd)
+LDFLAGS_vmlinux         += --defsym jiffies=jiffies_64+4 --oformat $(ld-bfd)
 LDFLAGS                 += -EB
 endif
 
diff --git a/arch/sh/include/asm/Kbuild b/arch/sh/include/asm/Kbuild
index 7beb42322f6..7b673ddcd55 100644
--- a/arch/sh/include/asm/Kbuild
+++ b/arch/sh/include/asm/Kbuild
@@ -1,5 +1,39 @@
 include include/asm-generic/Kbuild.asm
 
+generic-y += bitsperlong.h
+generic-y += cputime.h
+generic-y += current.h
+generic-y += delay.h
+generic-y += div64.h
+generic-y += emergency-restart.h
+generic-y += errno.h
+generic-y += fcntl.h
+generic-y += ioctl.h
+generic-y += ipcbuf.h
+generic-y += irq_regs.h
+generic-y += kvm_para.h
+generic-y += local.h
+generic-y += local64.h
+generic-y += param.h
+generic-y += parport.h
+generic-y += percpu.h
+generic-y += poll.h
+generic-y += mman.h
+generic-y += msgbuf.h
+generic-y += resource.h
+generic-y += scatterlist.h
+generic-y += sembuf.h
+generic-y += serial.h
+generic-y += shmbuf.h
+generic-y += siginfo.h
+generic-y += sizes.h
+generic-y += socket.h
+generic-y += statfs.h
+generic-y += termbits.h
+generic-y += termios.h
+generic-y += ucontext.h
+generic-y += xor.h
+
 header-y += cachectl.h
 header-y += cpu-features.h
 header-y += hw_breakpoint.h
diff --git a/arch/sh/include/asm/bitsperlong.h b/arch/sh/include/asm/bitsperlong.h
deleted file mode 100644
index 6dc0bb0c13b..00000000000
--- a/arch/sh/include/asm/bitsperlong.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/bitsperlong.h>
diff --git a/arch/sh/include/asm/cputime.h b/arch/sh/include/asm/cputime.h
deleted file mode 100644
index 6ca395d1393..00000000000
--- a/arch/sh/include/asm/cputime.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __SH_CPUTIME_H
-#define __SH_CPUTIME_H
-
-#include <asm-generic/cputime.h>
-
-#endif /* __SH_CPUTIME_H */
diff --git a/arch/sh/include/asm/current.h b/arch/sh/include/asm/current.h
deleted file mode 100644
index 4c51401b553..00000000000
--- a/arch/sh/include/asm/current.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/current.h>
diff --git a/arch/sh/include/asm/delay.h b/arch/sh/include/asm/delay.h
deleted file mode 100644
index 9670e127b7b..00000000000
--- a/arch/sh/include/asm/delay.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/delay.h>
diff --git a/arch/sh/include/asm/div64.h b/arch/sh/include/asm/div64.h
deleted file mode 100644
index 6cd978cefb2..00000000000
--- a/arch/sh/include/asm/div64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/div64.h>
diff --git a/arch/sh/include/asm/emergency-restart.h b/arch/sh/include/asm/emergency-restart.h
deleted file mode 100644
index 108d8c48e42..00000000000
--- a/arch/sh/include/asm/emergency-restart.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef _ASM_EMERGENCY_RESTART_H
-#define _ASM_EMERGENCY_RESTART_H
-
-#include <asm-generic/emergency-restart.h>
-
-#endif /* _ASM_EMERGENCY_RESTART_H */
diff --git a/arch/sh/include/asm/errno.h b/arch/sh/include/asm/errno.h
deleted file mode 100644
index 51cf6f9cebb..00000000000
--- a/arch/sh/include/asm/errno.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_ERRNO_H
-#define __ASM_SH_ERRNO_H
-
-#include <asm-generic/errno.h>
-
-#endif /* __ASM_SH_ERRNO_H */
diff --git a/arch/sh/include/asm/fcntl.h b/arch/sh/include/asm/fcntl.h
deleted file mode 100644
index 46ab12db573..00000000000
--- a/arch/sh/include/asm/fcntl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/fcntl.h>
diff --git a/arch/sh/include/asm/ioctl.h b/arch/sh/include/asm/ioctl.h
deleted file mode 100644
index b279fe06dfe..00000000000
--- a/arch/sh/include/asm/ioctl.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ioctl.h>
diff --git a/arch/sh/include/asm/ipcbuf.h b/arch/sh/include/asm/ipcbuf.h
deleted file mode 100644
index 84c7e51cb6d..00000000000
--- a/arch/sh/include/asm/ipcbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ipcbuf.h>
diff --git a/arch/sh/include/asm/irq_regs.h b/arch/sh/include/asm/irq_regs.h
deleted file mode 100644
index 3dd9c0b7027..00000000000
--- a/arch/sh/include/asm/irq_regs.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/sh/include/asm/kvm_para.h b/arch/sh/include/asm/kvm_para.h
deleted file mode 100644
index 14fab8f0b95..00000000000
--- a/arch/sh/include/asm/kvm_para.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/kvm_para.h>
diff --git a/arch/sh/include/asm/local.h b/arch/sh/include/asm/local.h
deleted file mode 100644
index 9ed9b9cb459..00000000000
--- a/arch/sh/include/asm/local.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef __ASM_SH_LOCAL_H
-#define __ASM_SH_LOCAL_H
-
-#include <asm-generic/local.h>
-
-#endif /* __ASM_SH_LOCAL_H */
-
diff --git a/arch/sh/include/asm/local64.h b/arch/sh/include/asm/local64.h
deleted file mode 100644
index 36c93b5cc23..00000000000
--- a/arch/sh/include/asm/local64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/local64.h>
diff --git a/arch/sh/include/asm/mman.h b/arch/sh/include/asm/mman.h
deleted file mode 100644
index 8eebf89f5ab..00000000000
--- a/arch/sh/include/asm/mman.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/mman.h>
diff --git a/arch/sh/include/asm/msgbuf.h b/arch/sh/include/asm/msgbuf.h
deleted file mode 100644
index 809134c644a..00000000000
--- a/arch/sh/include/asm/msgbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/msgbuf.h>
diff --git a/arch/sh/include/asm/param.h b/arch/sh/include/asm/param.h
deleted file mode 100644
index 965d4542797..00000000000
--- a/arch/sh/include/asm/param.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/param.h>
diff --git a/arch/sh/include/asm/parport.h b/arch/sh/include/asm/parport.h
deleted file mode 100644
index cf252af6459..00000000000
--- a/arch/sh/include/asm/parport.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/parport.h>
diff --git a/arch/sh/include/asm/percpu.h b/arch/sh/include/asm/percpu.h
deleted file mode 100644
index 4db4b39a439..00000000000
--- a/arch/sh/include/asm/percpu.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ARCH_SH_PERCPU
-#define __ARCH_SH_PERCPU
-
-#include <asm-generic/percpu.h>
-
-#endif /* __ARCH_SH_PERCPU */
diff --git a/arch/sh/include/asm/poll.h b/arch/sh/include/asm/poll.h
deleted file mode 100644
index c98509d3149..00000000000
--- a/arch/sh/include/asm/poll.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/poll.h>
diff --git a/arch/sh/include/asm/resource.h b/arch/sh/include/asm/resource.h
deleted file mode 100644
index 9c2499a86ec..00000000000
--- a/arch/sh/include/asm/resource.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_RESOURCE_H
-#define __ASM_SH_RESOURCE_H
-
-#include <asm-generic/resource.h>
-
-#endif /* __ASM_SH_RESOURCE_H */
diff --git a/arch/sh/include/asm/scatterlist.h b/arch/sh/include/asm/scatterlist.h
deleted file mode 100644
index 98dfc3510f1..00000000000
--- a/arch/sh/include/asm/scatterlist.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SCATTERLIST_H
-#define __ASM_SH_SCATTERLIST_H
-
-#include <asm-generic/scatterlist.h>
-
-#endif /* __ASM_SH_SCATTERLIST_H */
diff --git a/arch/sh/include/asm/sembuf.h b/arch/sh/include/asm/sembuf.h
deleted file mode 100644
index 7673b83cfef..00000000000
--- a/arch/sh/include/asm/sembuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sembuf.h>
diff --git a/arch/sh/include/asm/serial.h b/arch/sh/include/asm/serial.h
deleted file mode 100644
index a0cb0caff15..00000000000
--- a/arch/sh/include/asm/serial.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/serial.h>
diff --git a/arch/sh/include/asm/shmbuf.h b/arch/sh/include/asm/shmbuf.h
deleted file mode 100644
index 83c05fc2de3..00000000000
--- a/arch/sh/include/asm/shmbuf.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/shmbuf.h>
diff --git a/arch/sh/include/asm/siginfo.h b/arch/sh/include/asm/siginfo.h
deleted file mode 100644
index 813040ed68a..00000000000
--- a/arch/sh/include/asm/siginfo.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_SIGINFO_H
-#define __ASM_SH_SIGINFO_H
-
-#include <asm-generic/siginfo.h>
-
-#endif /* __ASM_SH_SIGINFO_H */
diff --git a/arch/sh/include/asm/sizes.h b/arch/sh/include/asm/sizes.h
deleted file mode 100644
index dd248c2e108..00000000000
--- a/arch/sh/include/asm/sizes.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/sizes.h>
diff --git a/arch/sh/include/asm/socket.h b/arch/sh/include/asm/socket.h
deleted file mode 100644
index 6b71384b9d8..00000000000
--- a/arch/sh/include/asm/socket.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/socket.h>
diff --git a/arch/sh/include/asm/statfs.h b/arch/sh/include/asm/statfs.h
deleted file mode 100644
index 9202a023328..00000000000
--- a/arch/sh/include/asm/statfs.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_SH_STATFS_H
-#define __ASM_SH_STATFS_H
-
-#include <asm-generic/statfs.h>
-
-#endif /* __ASM_SH_STATFS_H */
diff --git a/arch/sh/include/asm/termbits.h b/arch/sh/include/asm/termbits.h
deleted file mode 100644
index 3935b106de7..00000000000
--- a/arch/sh/include/asm/termbits.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termbits.h>
diff --git a/arch/sh/include/asm/termios.h b/arch/sh/include/asm/termios.h
deleted file mode 100644
index 280d78a9d96..00000000000
--- a/arch/sh/include/asm/termios.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/termios.h>
diff --git a/arch/sh/include/asm/uaccess.h b/arch/sh/include/asm/uaccess.h
index 050f221fa89..8698a80ed00 100644
--- a/arch/sh/include/asm/uaccess.h
+++ b/arch/sh/include/asm/uaccess.h
@@ -25,6 +25,8 @@
         (__chk_user_ptr(addr),          \
          __access_ok((unsigned long __force)(addr), (size)))
 
+#define user_addr_max() (current_thread_info()->addr_limit.seg)
+
 /*
  * Uh, these should become the main single-value transfer routines ...
  * They automatically use the right size if we just have the right
@@ -100,6 +102,11 @@ struct __large_struct { unsigned long buf[100]; };
 # include "uaccess_64.h"
 #endif
 
+extern long strncpy_from_user(char *dest, const char __user *src, long count);
+
+extern __must_check long strlen_user(const char __user *str);
+extern __must_check long strnlen_user(const char __user *str, long n);
+
 /* Generic arbitrary sized copy.  */
 /* Return the number of bytes NOT copied */
 __kernel_size_t __copy_user(void *to, const void *from, __kernel_size_t n);
@@ -137,37 +144,6 @@ __kernel_size_t __clear_user(void *addr, __kernel_size_t size);
         __cl_size;                                                      \
 })
 
-/**
- * strncpy_from_user: - Copy a NUL terminated string from userspace.
- * @dst:   Destination address, in kernel space.  This buffer must be at
- *         least @count bytes long.
- * @src:   Source address, in user space.
- * @count: Maximum number of bytes to copy, including the trailing NUL.
- *
- * Copies a NUL-terminated string from userspace to kernel space.
- *
- * On success, returns the length of the string (not including the trailing
- * NUL).
- *
- * If access to userspace fails, returns -EFAULT (some data may have been
- * copied).
- *
- * If @count is smaller than the length of the string, copies @count bytes
- * and returns @count.
- */
-#define strncpy_from_user(dest,src,count)                               \
-({                                                                      \
-        unsigned long __sfu_src = (unsigned long)(src);                 \
-        int __sfu_count = (int)(count);                                 \
-        long __sfu_res = -EFAULT;                                       \
-                                                                        \
-        if (__access_ok(__sfu_src, __sfu_count))                        \
-                __sfu_res = __strncpy_from_user((unsigned long)(dest),  \
-                                __sfu_src, __sfu_count);                \
-                                                                        \
-        __sfu_res;                                                      \
-})
-
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
@@ -192,43 +168,6 @@ copy_to_user(void __user *to, const void *from, unsigned long n)
         return __copy_size;
 }
 
-/**
- * strnlen_user: - Get the size of a string in user space.
- * @s: The string to measure.
- * @n: The maximum valid length
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- * If the string is too long, returns a value greater than @n.
- */
-static inline long strnlen_user(const char __user *s, long n)
-{
-        if (!__addr_ok(s))
-                return 0;
-        else
-                return __strnlen_user(s, n);
-}
-
-/**
- * strlen_user: - Get the size of a string in user space.
- * @str: The string to measure.
- *
- * Context: User context only.  This function may sleep.
- *
- * Get the size of a NUL-terminated string in user space.
- *
- * Returns the size of the string INCLUDING the terminating NUL.
- * On exception, returns 0.
- *
- * If there is a limit on the length of a valid string, you may wish to
- * consider using strnlen_user() instead.
- */
-#define strlen_user(str)        strnlen_user(str, ~0UL >> 1)
-
 /*
  * The exception table consists of pairs of addresses: the first is the
  * address of an instruction that is allowed to fault, and the second is
diff --git a/arch/sh/include/asm/uaccess_32.h b/arch/sh/include/asm/uaccess_32.h
index ae0d24f6653..c0de7ee35ab 100644
--- a/arch/sh/include/asm/uaccess_32.h
+++ b/arch/sh/include/asm/uaccess_32.h
@@ -170,79 +170,4 @@ __asm__ __volatile__( \
 
 extern void __put_user_unknown(void);
 
-static inline int
-__strncpy_from_user(unsigned long __dest, unsigned long __user __src, int __count)
-{
-        __kernel_size_t res;
-        unsigned long __dummy, _d, _s, _c;
-
-        __asm__ __volatile__(
-                "9:\n"
-                "mov.b  @%2+, %1\n\t"
-                "cmp/eq #0, %1\n\t"
-                "bt/s   2f\n"
-                "1:\n"
-                "mov.b  %1, @%3\n\t"
-                "dt     %4\n\t"
-                "bf/s   9b\n\t"
-                " add   #1, %3\n\t"
-                "2:\n\t"
-                "sub    %4, %0\n"
-                "3:\n"
-                ".section .fixup,\"ax\"\n"
-                "4:\n\t"
-                "mov.l  5f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   %9, %0\n\t"
-                ".balign 4\n"
-                "5:     .long 3b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 9b,4b\n"
-                ".previous"
-                : "=r" (res), "=&z" (__dummy), "=r" (_s), "=r" (_d), "=r"(_c)
-                : "0" (__count), "2" (__src), "3" (__dest), "4" (__count),
-                  "i" (-EFAULT)
-                : "memory", "t");
-
-        return res;
-}
-
-/*
- * Return the size of a string (including the ending 0 even when we have
- * exceeded the maximum string length).
- */
-static inline long __strnlen_user(const char __user *__s, long __n)
-{
-        unsigned long res;
-        unsigned long __dummy;
-
-        __asm__ __volatile__(
-                "1:\t"
-                "mov.b  @(%0,%3), %1\n\t"
-                "cmp/eq %4, %0\n\t"
-                "bt/s   2f\n\t"
-                " add   #1, %0\n\t"
-                "tst    %1, %1\n\t"
-                "bf     1b\n\t"
-                "2:\n"
-                ".section .fixup,\"ax\"\n"
-                "3:\n\t"
-                "mov.l  4f, %1\n\t"
-                "jmp    @%1\n\t"
-                " mov   #0, %0\n"
-                ".balign 4\n"
-                "4:     .long 2b\n"
-                ".previous\n"
-                ".section __ex_table,\"a\"\n"
-                "       .balign 4\n"
-                "       .long 1b,3b\n"
-                ".previous"
-                : "=z" (res), "=&r" (__dummy)
-                : "0" (0), "r" (__s), "r" (__n)
-                : "t");
-        return res;
-}
-
 #endif /* __ASM_SH_UACCESS_32_H */
diff --git a/arch/sh/include/asm/uaccess_64.h b/arch/sh/include/asm/uaccess_64.h
index 56fd20b8cdc..2e07e0f40c6 100644
--- a/arch/sh/include/asm/uaccess_64.h
+++ b/arch/sh/include/asm/uaccess_64.h
@@ -84,8 +84,4 @@ extern long __put_user_asm_l(void *, long);
 extern long __put_user_asm_q(void *, long);
 extern void __put_user_unknown(void);
 
-extern long __strnlen_user(const char *__s, long __n);
-extern int __strncpy_from_user(unsigned long __dest,
-               unsigned long __user __src, int __count);
-
 #endif /* __ASM_SH_UACCESS_64_H */
diff --git a/arch/sh/include/asm/ucontext.h b/arch/sh/include/asm/ucontext.h
deleted file mode 100644
index 9bc07b9f30f..00000000000
--- a/arch/sh/include/asm/ucontext.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/ucontext.h>
diff --git a/arch/sh/include/asm/word-at-a-time.h b/arch/sh/include/asm/word-at-a-time.h
new file mode 100644
index 00000000000..6e38953ff7f
--- /dev/null
+++ b/arch/sh/include/asm/word-at-a-time.h
@@ -0,0 +1,53 @@
+#ifndef __ASM_SH_WORD_AT_A_TIME_H
+#define __ASM_SH_WORD_AT_A_TIME_H
+
+#ifdef CONFIG_CPU_BIG_ENDIAN
+# include <asm-generic/word-at-a-time.h>
+#else
+/*
+ * Little-endian version cribbed from x86.
+ */
+struct word_at_a_time {
+        const unsigned long one_bits, high_bits;
+};
+
+#define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
+
+/* Carl Chatfield / Jan Achrenius G+ version for 32-bit */
+static inline long count_masked_bytes(long mask)
+{
+        /* (000000 0000ff 00ffff ffffff) -> ( 1 1 2 3 ) */
+        long a = (0x0ff0001+mask) >> 23;
+        /* Fix the 1 for 00 case */
+        return a & mask;
+}
+
+/* Return nonzero if it has a zero */
+static inline unsigned long has_zero(unsigned long a, unsigned long *bits, const struct word_at_a_time *c)
+{
+        unsigned long mask = ((a - c->one_bits) & ~a) & c->high_bits;
+        *bits = mask;
+        return mask;
+}
+
+static inline unsigned long prep_zero_mask(unsigned long a, unsigned long bits, const struct word_at_a_time *c)
+{
+        return bits;
+}
+
+static inline unsigned long create_zero_mask(unsigned long bits)
+{
+        bits = (bits - 1) & ~bits;
+        return bits >> 7;
+}
+
+/* The mask we created is directly usable as a bytemask */
+#define zero_bytemask(mask) (mask)
+
+static inline unsigned long find_zero(unsigned long mask)
+{
+        return count_masked_bytes(mask);
+}
+#endif
+
+#endif
diff --git a/arch/sh/include/asm/xor.h b/arch/sh/include/asm/xor.h
deleted file mode 100644
index c82eb12a5b1..00000000000
--- a/arch/sh/include/asm/xor.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/xor.h>
diff --git a/arch/sh/include/cpu-sh2a/cpu/ubc.h b/arch/sh/include/cpu-sh2a/cpu/ubc.h
deleted file mode 100644
index 1192e1c761a..00000000000
--- a/arch/sh/include/cpu-sh2a/cpu/ubc.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/*
- * SH-2A UBC definitions
- *
- * Copyright (C) 2008 Kieran Bingham
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License.  See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-
-#ifndef __ASM_CPU_SH2A_UBC_H
-#define __ASM_CPU_SH2A_UBC_H
-
-#define UBC_BARA                0xfffc0400
-#define UBC_BAMRA               0xfffc0404
-#define UBC_BBRA                0xfffc04a0      /* 16 bit access */
-#define UBC_BDRA                0xfffc0408
-#define UBC_BDMRA               0xfffc040c
-
-#define UBC_BARB                0xfffc0410
-#define UBC_BAMRB               0xfffc0414
-#define UBC_BBRB                0xfffc04b0      /* 16 bit access */
-#define UBC_BDRB                0xfffc0418
-#define UBC_BDMRB               0xfffc041c
-
-#define UBC_BRCR                0xfffc04c0
-
-#endif /* __ASM_CPU_SH2A_UBC_H */
diff --git a/arch/sh/kernel/cpu/sh5/entry.S b/arch/sh/kernel/cpu/sh5/entry.S
index ff1f0e6e9be..b7cf6a547f1 100644
--- a/arch/sh/kernel/cpu/sh5/entry.S
+++ b/arch/sh/kernel/cpu/sh5/entry.S
@@ -1569,86 +1569,6 @@ ___clear_user_exit:
 #endif /* CONFIG_MMU */
 
 /*
- * int __strncpy_from_user(unsigned long __dest, unsigned long __src,
- *                         int __count)
- *
- * Inputs:
- * (r2)  target address
- * (r3)  source address
- * (r4)  maximum size in bytes
- *
- * Ouputs:
- * (*r2) copied data
- * (r2)  -EFAULT (in case of faulting)
- *       copied data (otherwise)
- */
-        .global __strncpy_from_user
-__strncpy_from_user:
-        pta     ___strncpy_from_user1, tr0
-        pta     ___strncpy_from_user_done, tr1
-        or      r4, ZERO, r5            /* r5 = original count */
-        beq/u   r4, r63, tr1            /* early exit if r4==0 */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-
-___strncpy_from_user1:
-        ld.b    r3, 0, r7               /* Fault address: only in reading */
-        st.b    r2, 0, r7
-        addi    r2, 1, r2
-        addi    r3, 1, r3
-        beq/u   ZERO, r7, tr1
-        addi    r4, -1, r4              /* return real number of copied bytes */
-        bne/l   ZERO, r4, tr0
-
-___strncpy_from_user_done:
-        sub     r5, r4, r6              /* If done, return copied */
-
-___strncpy_from_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
- * extern long __strnlen_user(const char *__s, long __n)
- *
- * Inputs:
- * (r2)  source address
- * (r3)  source size in bytes
- *
- * Ouputs:
- * (r2)  -EFAULT (in case of faulting)
- *       string length (otherwise)
- */
-        .global __strnlen_user
-__strnlen_user:
-        pta     ___strnlen_user_set_reply, tr0
-        pta     ___strnlen_user1, tr1
-        or      ZERO, ZERO, r5          /* r5 = counter */
-        movi    -(EFAULT), r6           /* r6 = reply, no real fixup */
-        or      ZERO, ZERO, r7          /* r7 = data, clear top byte of data */
-        beq     r3, ZERO, tr0
-
-___strnlen_user1:
-        ldx.b   r2, r5, r7              /* Fault address: only in reading */
-        addi    r3, -1, r3              /* No real fixup */
-        addi    r5, 1, r5
-        beq     r3, ZERO, tr0
-        bne     r7, ZERO, tr1
-! The line below used to be active.  This meant led to a junk byte lying between each pair
-! of entries in the argv & envp structures in memory.  Whilst the program saw the right data
-! via the argv and envp arguments to main, it meant the 'flat' representation visible through
-! /proc/$pid/cmdline was corrupt, causing trouble with ps, for example.
-!       addi    r5, 1, r5               /* Include '\0' */
-
-___strnlen_user_set_reply:
-        or      r5, ZERO, r6            /* If done, return counter */
-
-___strnlen_user_exit:
-        or      r6, ZERO, r2
-        ptabs   LINK, tr0
-        blink   tr0, ZERO
-
-/*
  * extern long __get_user_asm_?(void *val, long addr)
  *
  * Inputs:
@@ -1982,8 +1902,6 @@ asm_uaccess_start:
         .long   ___copy_user2, ___copy_user_exit
         .long   ___clear_user1, ___clear_user_exit
 #endif
-        .long   ___strncpy_from_user1, ___strncpy_from_user_exit
-        .long   ___strnlen_user1, ___strnlen_user_exit
         .long   ___get_user_asm_b1, ___get_user_asm_b_exit
         .long   ___get_user_asm_w1, ___get_user_asm_w_exit
         .long   ___get_user_asm_l1, ___get_user_asm_l_exit
diff --git a/arch/sh/kernel/process.c b/arch/sh/kernel/process.c
index 9b7a459a461..055d91b7030 100644
--- a/arch/sh/kernel/process.c
+++ b/arch/sh/kernel/process.c
@@ -4,6 +4,7 @@
 #include <linux/sched.h>
 #include <linux/export.h>
 #include <linux/stackprotector.h>
+#include <asm/fpu.h>
 
 struct kmem_cache *task_xstate_cachep = NULL;
 unsigned int xstate_size;
diff --git a/arch/sh/kernel/process_64.c b/arch/sh/kernel/process_64.c
index 4264583eaba..602545b12a8 100644
--- a/arch/sh/kernel/process_64.c
+++ b/arch/sh/kernel/process_64.c
@@ -33,6 +33,7 @@
 #include <asm/switch_to.h>
 
 struct task_struct *last_task_used_math = NULL;
+struct pt_regs fake_swapper_regs = { 0, };
 
 void show_regs(struct pt_regs *regs)
 {
diff --git a/arch/sh/kernel/sh_ksyms_64.c b/arch/sh/kernel/sh_ksyms_64.c
index 45afa5c51f6..26a0774f527 100644
--- a/arch/sh/kernel/sh_ksyms_64.c
+++ b/arch/sh/kernel/sh_ksyms_64.c
@@ -32,8 +32,6 @@ EXPORT_SYMBOL(__get_user_asm_b);
 EXPORT_SYMBOL(__get_user_asm_w);
 EXPORT_SYMBOL(__get_user_asm_l);
 EXPORT_SYMBOL(__get_user_asm_q);
-EXPORT_SYMBOL(__strnlen_user);
-EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(__copy_user);
diff --git a/arch/sparc/include/asm/cmt.h b/arch/sparc/include/asm/cmt.h
deleted file mode 100644
index 870db592857..00000000000
--- a/arch/sparc/include/asm/cmt.h
+++ /dev/null
@@ -1,59 +0,0 @@
-#ifndef _SPARC64_CMT_H
-#define _SPARC64_CMT_H
-
-/* cmt.h: Chip Multi-Threading register definitions
- *
- * Copyright (C) 2004 David S. Miller (davem@redhat.com)
- */
-
-/* ASI_CORE_ID - private */
-#define LP_ID           0x0000000000000010UL
-#define  LP_ID_MAX      0x00000000003f0000UL
-#define  LP_ID_ID       0x000000000000003fUL
-
-/* ASI_INTR_ID - private */
-#define LP_INTR_ID      0x0000000000000000UL
-#define  LP_INTR_ID_ID  0x00000000000003ffUL
-
-/* ASI_CESR_ID - private */
-#define CESR_ID         0x0000000000000040UL
-#define  CESR_ID_ID     0x00000000000000ffUL
-
-/* ASI_CORE_AVAILABLE - shared */
-#define LP_AVAIL        0x0000000000000000UL
-#define  LP_AVAIL_1     0x0000000000000002UL
-#define  LP_AVAIL_0     0x0000000000000001UL
-
-/* ASI_CORE_ENABLE_STATUS - shared */
-#define LP_ENAB_STAT    0x0000000000000010UL
-#define  LP_ENAB_STAT_1 0x0000000000000002UL
-#define  LP_ENAB_STAT_0 0x0000000000000001UL
-
-/* ASI_CORE_ENABLE - shared */
-#define LP_ENAB         0x0000000000000020UL
-#define  LP_ENAB_1      0x0000000000000002UL
-#define  LP_ENAB_0      0x0000000000000001UL
-
-/* ASI_CORE_RUNNING - shared */
-#define LP_RUNNING_RW   0x0000000000000050UL
-#define LP_RUNNING_W1S  0x0000000000000060UL
-#define LP_RUNNING_W1C  0x0000000000000068UL
-#define  LP_RUNNING_1   0x0000000000000002UL
-#define  LP_RUNNING_0   0x0000000000000001UL
-
-/* ASI_CORE_RUNNING_STAT - shared */
-#define LP_RUN_STAT     0x0000000000000058UL
-#define  LP_RUN_STAT_1  0x0000000000000002UL
-#define  LP_RUN_STAT_0  0x0000000000000001UL
-
-/* ASI_XIR_STEERING - shared */
-#define LP_XIR_STEER    0x0000000000000030UL
-#define  LP_XIR_STEER_1 0x0000000000000002UL
-#define  LP_XIR_STEER_0 0x0000000000000001UL
-
-/* ASI_CMT_ERROR_STEERING - shared */
-#define CMT_ER_STEER    0x0000000000000040UL
-#define  CMT_ER_STEER_1 0x0000000000000002UL
-#define  CMT_ER_STEER_0 0x0000000000000001UL
-
-#endif /* _SPARC64_CMT_H */
diff --git a/arch/sparc/include/asm/mpmbox.h b/arch/sparc/include/asm/mpmbox.h
deleted file mode 100644
index f8423039b24..00000000000
--- a/arch/sparc/include/asm/mpmbox.h
+++ /dev/null
@@ -1,67 +0,0 @@
-/*
- * mpmbox.h:  Interface and defines for the OpenProm mailbox
- *               facilities for MP machines under Linux.
- *
- * Copyright (C) 1995 David S. Miller (davem@caip.rutgers.edu)
- */
-
-#ifndef _SPARC_MPMBOX_H
-#define _SPARC_MPMBOX_H
-
-/* The prom allocates, for each CPU on the machine an unsigned
- * byte in physical ram.  You probe the device tree prom nodes
- * for these values.  The purpose of this byte is to be able to
- * pass messages from one cpu to another.
- */
-
-/* These are the main message types we have to look for in our
- * Cpu mailboxes, based upon these values we decide what course
- * of action to take.
- */
-
-/* The CPU is executing code in the kernel. */
-#define MAILBOX_ISRUNNING     0xf0
-
-/* Another CPU called romvec->pv_exit(), you should call
- * prom_stopcpu() when you see this in your mailbox.
- */
-#define MAILBOX_EXIT          0xfb
-
-/* Another CPU called romvec->pv_enter(), you should call
- * prom_cpuidle() when this is seen.
- */
-#define MAILBOX_GOSPIN        0xfc
-
-/* Another CPU has hit a breakpoint either into kadb or the prom
- * itself.  Just like MAILBOX_GOSPIN, you should call prom_cpuidle()
- * at this point.
- */
-#define MAILBOX_BPT_SPIN      0xfd
-
-/* Oh geese, some other nitwit got a damn watchdog reset.  The party's
- * over so go call prom_stopcpu().
- */
-#define MAILBOX_WDOG_STOP     0xfe
-
-#ifndef __ASSEMBLY__
-
-/* Handy macro's to determine a cpu's state. */
-
-/* Is the cpu still in Power On Self Test? */
-#define MBOX_POST_P(letter)  ((letter) >= 0x00 && (letter) <= 0x7f)
-
-/* Is the cpu at the 'ok' prompt of the PROM? */
-#define MBOX_PROMPROMPT_P(letter) ((letter) >= 0x80 && (letter) <= 0x8f)
-
-/* Is the cpu spinning in the PROM? */
-#define MBOX_PROMSPIN_P(letter) ((letter) >= 0x90 && (letter) <= 0xef)
-
-/* Sanity check... This is junk mail, throw it out. */
-#define MBOX_BOGON_P(letter) ((letter) >= 0xf1 && (letter) <= 0xfa)
-
-/* Is the cpu actively running an application/kernel-code? */
-#define MBOX_RUNNING_P(letter) ((letter) == MAILBOX_ISRUNNING)
-
-#endif /* !(__ASSEMBLY__) */
-
-#endif /* !(_SPARC_MPMBOX_H) */
diff --git a/arch/tile/include/asm/thread_info.h b/arch/tile/include/asm/thread_info.h
index 7e1fef36bde..e9c670d7a7f 100644
--- a/arch/tile/include/asm/thread_info.h
+++ b/arch/tile/include/asm/thread_info.h
@@ -91,11 +91,6 @@ extern void smp_nap(void);
 /* Enable interrupts racelessly and nap forever: helper for cpu_idle(). */
 extern void _cpu_idle(void);
 
-/* Switch boot idle thread to a freshly-allocated stack and free old stack. */
-extern void cpu_idle_on_new_stack(struct thread_info *old_ti,
-                                  unsigned long new_sp,
-                                  unsigned long new_ss10);
-
 #else /* __ASSEMBLY__ */
 
 /*
diff --git a/arch/tile/include/asm/uaccess.h b/arch/tile/include/asm/uaccess.h
index c3dd275f25e..9ab078a4605 100644
--- a/arch/tile/include/asm/uaccess.h
+++ b/arch/tile/include/asm/uaccess.h
@@ -146,7 +146,7 @@ extern int fixup_exception(struct pt_regs *regs);
 #ifdef __tilegx__
 #define __get_user_1(x, ptr, ret) __get_user_asm(ld1u, x, ptr, ret)
 #define __get_user_2(x, ptr, ret) __get_user_asm(ld2u, x, ptr, ret)
-#define __get_user_4(x, ptr, ret) __get_user_asm(ld4u, x, ptr, ret)
+#define __get_user_4(x, ptr, ret) __get_user_asm(ld4s, x, ptr, ret)
 #define __get_user_8(x, ptr, ret) __get_user_asm(ld, x, ptr, ret)
 #else
 #define __get_user_1(x, ptr, ret) __get_user_asm(lb_u, x, ptr, ret)
diff --git a/arch/tile/kernel/entry.S b/arch/tile/kernel/entry.S
index 133c4b56a99..c31637baff2 100644
--- a/arch/tile/kernel/entry.S
+++ b/arch/tile/kernel/entry.S
@@ -68,20 +68,6 @@ STD_ENTRY(KBacktraceIterator_init_current)
         jrp lr   /* keep backtracer happy */
         STD_ENDPROC(KBacktraceIterator_init_current)
 
-/*
- * Reset our stack to r1/r2 (sp and ksp0+cpu respectively), then
- * free the old stack (passed in r0) and re-invoke cpu_idle().
- * We update sp and ksp0 simultaneously to avoid backtracer warnings.
- */
-STD_ENTRY(cpu_idle_on_new_stack)
-        {
-         move sp, r1
-         mtspr SPR_SYSTEM_SAVE_K_0, r2
-        }
-        jal free_thread_info
-        j cpu_idle
-        STD_ENDPROC(cpu_idle_on_new_stack)
-
 /* Loop forever on a nap during SMP boot. */
 STD_ENTRY(smp_nap)
         nap
diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
index 6098ccc59be..dd87f342039 100644
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -29,6 +29,7 @@
 #include <linux/smp.h>
 #include <linux/timex.h>
 #include <linux/hugetlb.h>
+#include <linux/start_kernel.h>
 #include <asm/setup.h>
 #include <asm/sections.h>
 #include <asm/cacheflush.h>
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 8bbea6aa40d..efe5acfc79c 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -94,10 +94,10 @@ bs_die:
 
         .section ".bsdata", "a"
 bugger_off_msg:
-        .ascii  "Direct booting from floppy is no longer supported.\r\n"
-        .ascii  "Please use a boot loader program instead.\r\n"
+        .ascii  "Direct floppy boot is not supported. "
+        .ascii  "Use a boot loader program instead.\r\n"
         .ascii  "\n"
-        .ascii  "Remove disk and press any key to reboot . . .\r\n"
+        .ascii  "Remove disk and press any key to reboot ...\r\n"
         .byte   0
 
 #ifdef CONFIG_EFI_STUB
@@ -111,7 +111,7 @@ coff_header:
 #else
         .word   0x8664                          # x86-64
 #endif
-        .word   2                               # nr_sections
+        .word   3                               # nr_sections
         .long   0                               # TimeDateStamp
         .long   0                               # PointerToSymbolTable
         .long   1                               # NumberOfSymbols
@@ -158,8 +158,8 @@ extra_header_fields:
 #else
         .quad   0                               # ImageBase
 #endif
-        .long   0x1000                          # SectionAlignment
-        .long   0x200                           # FileAlignment
+        .long   0x20                            # SectionAlignment
+        .long   0x20                            # FileAlignment
         .word   0                               # MajorOperatingSystemVersion
         .word   0                               # MinorOperatingSystemVersion
         .word   0                               # MajorImageVersion
@@ -200,8 +200,10 @@ extra_header_fields:
 
         # Section table
 section_table:
-        .ascii  ".text"
-        .byte   0
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".setup"
         .byte   0
         .byte   0
         .long   0
@@ -217,9 +219,8 @@ section_table:
 
         #
         # The EFI application loader requires a relocation section
-        # because EFI applications must be relocatable. But since
-        # we don't need the loader to fixup any relocs for us, we
-        # just create an empty (zero-length) .reloc section header.
+        # because EFI applications must be relocatable. The .reloc
+        # offset & size fields are filled in by build.c.
         #
         .ascii  ".reloc"
         .byte   0
@@ -233,6 +234,25 @@ section_table:
         .word   0                               # NumberOfRelocations
         .word   0                               # NumberOfLineNumbers
         .long   0x42100040                      # Characteristics (section flags)
+
+        #
+        # The offset & size fields are filled in by build.c.
+        #
+        .ascii  ".text"
+        .byte   0
+        .byte   0
+        .byte   0
+        .long   0
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # Size of initialized data
+                                                # on disk
+        .long   0x0                             # startup_{32,64}
+        .long   0                               # PointerToRelocations
+        .long   0                               # PointerToLineNumbers
+        .word   0                               # NumberOfRelocations
+        .word   0                               # NumberOfLineNumbers
+        .long   0x60500020                      # Characteristics (section flags)
+
 #endif /* CONFIG_EFI_STUB */
 
         # Kernel attributes; used by setup.  This is part 1 of the
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 3f61f6e2b46..4b8e165ee57 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -50,6 +50,8 @@ typedef unsigned int   u32;
 u8 buf[SETUP_SECT_MAX*512];
 int is_big_kernel;
 
+#define PECOFF_RELOC_RESERVE 0x20
+
 /*----------------------------------------------------------------------*/
 
 static const u32 crctab32[] = {
@@ -133,11 +135,103 @@ static void usage(void)
         die("Usage: build setup system [> image]");
 }
 
-int main(int argc, char ** argv)
-{
 #ifdef CONFIG_EFI_STUB
-        unsigned int file_sz, pe_header;
+
+static void update_pecoff_section_header(char *section_name, u32 offset, u32 size)
+{
+        unsigned int pe_header;
+        unsigned short num_sections;
+        u8 *section;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+        num_sections = get_unaligned_le16(&buf[pe_header + 6]);
+
+#ifdef CONFIG_X86_32
+        section = &buf[pe_header + 0xa8];
+#else
+        section = &buf[pe_header + 0xb8];
 #endif
+
+        while (num_sections > 0) {
+                if (strncmp((char*)section, section_name, 8) == 0) {
+                        /* section header size field */
+                        put_unaligned_le32(size, section + 0x8);
+
+                        /* section header vma field */
+                        put_unaligned_le32(offset, section + 0xc);
+
+                        /* section header 'size of initialised data' field */
+                        put_unaligned_le32(size, section + 0x10);
+
+                        /* section header 'file offset' field */
+                        put_unaligned_le32(offset, section + 0x14);
+
+                        break;
+                }
+                section += 0x28;
+                num_sections--;
+        }
+}
+
+static void update_pecoff_setup_and_reloc(unsigned int size)
+{
+        u32 setup_offset = 0x200;
+        u32 reloc_offset = size - PECOFF_RELOC_RESERVE;
+        u32 setup_size = reloc_offset - setup_offset;
+
+        update_pecoff_section_header(".setup", setup_offset, setup_size);
+        update_pecoff_section_header(".reloc", reloc_offset, PECOFF_RELOC_RESERVE);
+
+        /*
+         * Modify .reloc section contents with a single entry. The
+         * relocation is applied to offset 10 of the relocation section.
+         */
+        put_unaligned_le32(reloc_offset + 10, &buf[reloc_offset]);
+        put_unaligned_le32(10, &buf[reloc_offset + 4]);
+}
+
+static void update_pecoff_text(unsigned int text_start, unsigned int file_sz)
+{
+        unsigned int pe_header;
+        unsigned int text_sz = file_sz - text_start;
+
+        pe_header = get_unaligned_le32(&buf[0x3c]);
+
+        /* Size of image */
+        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
+
+        /*
+         * Size of code: Subtract the size of the first sector (512 bytes)
+         * which includes the header.
+         */
+        put_unaligned_le32(file_sz - 512, &buf[pe_header + 0x1c]);
+
+#ifdef CONFIG_X86_32
+        /*
+         * Address of entry point.
+         *
+         * The EFI stub entry point is +16 bytes from the start of
+         * the .text section.
+         */
+        put_unaligned_le32(text_start + 16, &buf[pe_header + 0x28]);
+#else
+        /*
+         * Address of entry point. startup_32 is at the beginning and
+         * the 64-bit entry point (startup_64) is always 512 bytes
+         * after. The EFI stub entry point is 16 bytes after that, as
+         * the first instruction allows legacy loaders to jump over
+         * the EFI stub initialisation
+         */
+        put_unaligned_le32(text_start + 528, &buf[pe_header + 0x28]);
+#endif /* CONFIG_X86_32 */
+
+        update_pecoff_section_header(".text", text_start, text_sz);
+}
+
+#endif /* CONFIG_EFI_STUB */
+
+int main(int argc, char ** argv)
+{
         unsigned int i, sz, setup_sectors;
         int c;
         u32 sys_size;
@@ -163,6 +257,12 @@ int main(int argc, char ** argv)
                 die("Boot block hasn't got boot flag (0xAA55)");
         fclose(file);
 
+#ifdef CONFIG_EFI_STUB
+        /* Reserve 0x20 bytes for .reloc section */
+        memset(buf+c, 0, PECOFF_RELOC_RESERVE);
+        c += PECOFF_RELOC_RESERVE;
+#endif
+
         /* Pad unused space with zeros */
         setup_sectors = (c + 511) / 512;
         if (setup_sectors < SETUP_SECT_MIN)
@@ -170,6 +270,10 @@ int main(int argc, char ** argv)
         i = setup_sectors*512;
         memset(buf+c, 0, i-c);
 
+#ifdef CONFIG_EFI_STUB
+        update_pecoff_setup_and_reloc(i);
+#endif
+
         /* Set the default root device */
         put_unaligned_le16(DEFAULT_ROOT_DEV, &buf[508]);
 
@@ -194,66 +298,8 @@ int main(int argc, char ** argv)
         put_unaligned_le32(sys_size, &buf[0x1f4]);
 
 #ifdef CONFIG_EFI_STUB
-        file_sz = sz + i + ((sys_size * 16) - sz);
-
-        pe_header = get_unaligned_le32(&buf[0x3c]);
-
-        /* Size of image */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x50]);
-
-        /*
-         * Subtract the size of the first section (512 bytes) which
-         * includes the header and .reloc section. The remaining size
-         * is that of the .text section.
-         */
-        file_sz -= 512;
-
-        /* Size of code */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0x1c]);
-
-#ifdef CONFIG_X86_32
-        /*
-         * Address of entry point.
-         *
-         * The EFI stub entry point is +16 bytes from the start of
-         * the .text section.
-         */
-        put_unaligned_le32(i + 16, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xb4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xb8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xbc]);
-#else
-        /*
-         * Address of entry point. startup_32 is at the beginning and
-         * the 64-bit entry point (startup_64) is always 512 bytes
-         * after. The EFI stub entry point is 16 bytes after that, as
-         * the first instruction allows legacy loaders to jump over
-         * the EFI stub initialisation
-         */
-        put_unaligned_le32(i + 528, &buf[pe_header + 0x28]);
-
-        /* .text size */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc0]);
-
-        /* .text vma */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xc4]);
-
-        /* .text size of initialised data */
-        put_unaligned_le32(file_sz, &buf[pe_header + 0xc8]);
-
-        /* .text file offset */
-        put_unaligned_le32(0x200, &buf[pe_header + 0xcc]);
-#endif /* CONFIG_X86_32 */
-#endif /* CONFIG_EFI_STUB */
+        update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz));
+#endif
 
         crc = partial_crc32(buf, i, crc);
         if (fwrite(buf, 1, i, stdout) != i)
diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S
index be6d9e365a8..3470624d783 100644
--- a/arch/x86/crypto/aesni-intel_asm.S
+++ b/arch/x86/crypto/aesni-intel_asm.S
@@ -2460,10 +2460,12 @@ ENTRY(aesni_cbc_dec)
         pxor IN3, STATE4
         movaps IN4, IV
 #else
-        pxor (INP), STATE2
-        pxor 0x10(INP), STATE3
         pxor IN1, STATE4
         movaps IN2, IV
+        movups (INP), IN1
+        pxor IN1, STATE2
+        movups 0x10(INP), IN2
+        pxor IN2, STATE3
 #endif
         movups STATE1, (OUTP)
         movups STATE2, 0x10(OUTP)
diff --git a/arch/x86/include/asm/nmi.h b/arch/x86/include/asm/nmi.h
index 0e3793b821e..dc580c42851 100644
--- a/arch/x86/include/asm/nmi.h
+++ b/arch/x86/include/asm/nmi.h
@@ -54,6 +54,20 @@ struct nmiaction {
         __register_nmi_handler((t), &fn##_na);  \
 })
 
+/*
+ * For special handlers that register/unregister in the
+ * init section only.  This should be considered rare.
+ */
+#define register_nmi_handler_initonly(t, fn, fg, n)             \
+({                                                      \
+        static struct nmiaction fn##_na __initdata = {          \
+                .handler = (fn),                        \
+                .name = (n),                            \
+                .flags = (fg),                          \
+        };                                              \
+        __register_nmi_handler((t), &fn##_na);  \
+})
+
 int __register_nmi_handler(unsigned int, struct nmiaction *);
 
 void unregister_nmi_handler(unsigned int, const char *);
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 04cd6882308..e1f3a17034f 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -33,9 +33,8 @@
 #define segment_eq(a, b)        ((a).seg == (b).seg)
 
 #define user_addr_max() (current_thread_info()->addr_limit.seg)
-#define __addr_ok(addr)                                 \
-        ((unsigned long __force)(addr) <                \
-         (current_thread_info()->addr_limit.seg))
+#define __addr_ok(addr)         \
+        ((unsigned long __force)(addr) < user_addr_max())
 
 /*
  * Test whether a block of memory is a valid user space address.
@@ -47,14 +46,14 @@
  * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
  */
 
-#define __range_not_ok(addr, size)                                      \
+#define __range_not_ok(addr, size, limit)                               \
 ({                                                                      \
         unsigned long flag, roksum;                                     \
         __chk_user_ptr(addr);                                           \
         asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"             \
             : "=&r" (flag), "=r" (roksum)                               \
             : "1" (addr), "g" ((long)(size)),                           \
-              "rm" (current_thread_info()->addr_limit.seg));            \
+              "rm" (limit));                                            \
         flag;                                                           \
 })
 
@@ -77,7 +76,8 @@
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define access_ok(type, addr, size) \
+        (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
 
 /*
  * The exception table consists of pairs of addresses relative to the
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index becf47b8173..6149b476d9d 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -149,7 +149,6 @@
 /* 4 bits of software ack period */
 #define UV2_ACK_MASK                    0x7UL
 #define UV2_ACK_UNITS_SHFT              3
-#define UV2_LEG_SHFT UV2H_LB_BAU_MISC_CONTROL_USE_LEGACY_DESCRIPTOR_FORMATS_SHFT
 #define UV2_EXT_SHFT UV2H_LB_BAU_MISC_CONTROL_ENABLE_EXTENDED_SB_STATUS_SHFT
 
 /*
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 6e76c191a83..d5fd66f0d4c 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -20,7 +20,6 @@
 #include <linux/bitops.h>
 #include <linux/ioport.h>
 #include <linux/suspend.h>
-#include <linux/kmemleak.h>
 #include <asm/e820.h>
 #include <asm/io.h>
 #include <asm/iommu.h>
@@ -95,11 +94,6 @@ static u32 __init allocate_aperture(void)
                 return 0;
         }
         memblock_reserve(addr, aper_size);
-        /*
-         * Kmemleak should not scan this block as it may not be mapped via the
-         * kernel direct mapping.
-         */
-        kmemleak_ignore(phys_to_virt(addr));
         printk(KERN_INFO "Mapping aperture over %d KB of RAM @ %lx\n",
                         aper_size >> 10, addr);
         insert_aperture_resource((u32)addr, aper_size);
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index 5155d6f806f..8704918514d 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1195,7 +1195,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
         BUG_ON(!cfg->vector);
 
         vector = cfg->vector;
-        for_each_cpu_and(cpu, cfg->domain, cpu_online_mask)
+        for_each_cpu(cpu, cfg->domain)
                 per_cpu(vector_irq, cpu)[vector] = -1;
 
         cfg->vector = 0;
@@ -1203,7 +1203,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
 
         if (likely(!cfg->move_in_progress))
                 return;
-        for_each_cpu_and(cpu, cfg->old_domain, cpu_online_mask) {
+        for_each_cpu(cpu, cfg->old_domain) {
                 for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
                                                                 vector++) {
                         if (per_cpu(vector_irq, cpu)[vector] != irq)
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 5623b4b5d51..5a5a5dc1ff1 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1278,7 +1278,7 @@ static void mce_timer_fn(unsigned long data)
          */
         iv = __this_cpu_read(mce_next_interval);
         if (mce_notify_irq())
-                iv = max(iv, (unsigned long) HZ/100);
+                iv = max(iv / 2, (unsigned long) HZ/100);
         else
                 iv = min(iv * 2, round_jiffies_relative(check_interval * HZ));
         __this_cpu_write(mce_next_interval, iv);
@@ -1560,7 +1560,7 @@ static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
 static void __mcheck_cpu_init_timer(void)
 {
         struct timer_list *t = &__get_cpu_var(mce_timer);
-        unsigned long iv = __this_cpu_read(mce_next_interval);
+        unsigned long iv = check_interval * HZ;
 
         setup_timer(t, mce_timer_fn, smp_processor_id());
 
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index e049d6da018..c4706cf9c01 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1496,6 +1496,7 @@ static struct cpu_hw_events *allocate_fake_cpuc(void)
                 if (!cpuc->shared_regs)
                         goto error;
         }
+        cpuc->is_fake = 1;
         return cpuc;
 error:
         free_fake_cpuc(cpuc);
@@ -1756,6 +1757,12 @@ perf_callchain_kernel(struct perf_callchain_entry *entry, struct pt_regs *regs)
         dump_trace(NULL, regs, NULL, 0, &backtrace_ops, entry);
 }
 
+static inline int
+valid_user_frame(const void __user *fp, unsigned long size)
+{
+        return (__range_not_ok(fp, size, TASK_SIZE) == 0);
+}
+
 #ifdef CONFIG_COMPAT
 
 #include <asm/compat.h>
@@ -1780,7 +1787,7 @@ perf_callchain_user32(struct pt_regs *regs, struct perf_callchain_entry *entry)
                 if (bytes != sizeof(frame))
                         break;
 
-                if (fp < compat_ptr(regs->sp))
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
@@ -1826,7 +1833,7 @@ perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs)
                 if (bytes != sizeof(frame))
                         break;
 
-                if ((unsigned long)fp < regs->sp)
+                if (!valid_user_frame(fp, sizeof(frame)))
                         break;
 
                 perf_callchain_store(entry, frame.return_address);
diff --git a/arch/x86/kernel/cpu/perf_event.h b/arch/x86/kernel/cpu/perf_event.h
index 6638aaf5449..7241e2fc3c1 100644
--- a/arch/x86/kernel/cpu/perf_event.h
+++ b/arch/x86/kernel/cpu/perf_event.h
@@ -117,6 +117,7 @@ struct cpu_hw_events {
         struct perf_event       *event_list[X86_PMC_IDX_MAX]; /* in enabled order */
 
         unsigned int            group_flag;
+        int                     is_fake;
 
         /*
          * Intel DebugStore bits
@@ -364,6 +365,7 @@ struct x86_pmu {
         int             pebs_record_size;
         void            (*drain_pebs)(struct pt_regs *regs);
         struct event_constraint *pebs_constraints;
+        void            (*pebs_aliases)(struct perf_event *event);
 
         /*
          * Intel LBR
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
index 9e3f5d6e3d2..5073bf1c1d8 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1121,27 +1121,33 @@ intel_bts_constraints(struct perf_event *event)
         return NULL;
 }
 
-static bool intel_try_alt_er(struct perf_event *event, int orig_idx)
+static int intel_alt_er(int idx)
 {
         if (!(x86_pmu.er_flags & ERF_HAS_RSP_1))
-                return false;
+                return idx;
 
-        if (event->hw.extra_reg.idx == EXTRA_REG_RSP_0) {
-                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
-                event->hw.config |= 0x01bb;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_1;
-                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
-        } else if (event->hw.extra_reg.idx == EXTRA_REG_RSP_1) {
+        if (idx == EXTRA_REG_RSP_0)
+                return EXTRA_REG_RSP_1;
+
+        if (idx == EXTRA_REG_RSP_1)
+                return EXTRA_REG_RSP_0;
+
+        return idx;
+}
+
+static void intel_fixup_er(struct perf_event *event, int idx)
+{
+        event->hw.extra_reg.idx = idx;
+
+        if (idx == EXTRA_REG_RSP_0) {
                 event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
                 event->hw.config |= 0x01b7;
-                event->hw.extra_reg.idx = EXTRA_REG_RSP_0;
                 event->hw.extra_reg.reg = MSR_OFFCORE_RSP_0;
+        } else if (idx == EXTRA_REG_RSP_1) {
+                event->hw.config &= ~INTEL_ARCH_EVENT_MASK;
+                event->hw.config |= 0x01bb;
+                event->hw.extra_reg.reg = MSR_OFFCORE_RSP_1;
         }
-
-        if (event->hw.extra_reg.idx == orig_idx)
-                return false;
-
-        return true;
 }
 
 /*
@@ -1159,14 +1165,18 @@ __intel_shared_reg_get_constraints(struct cpu_hw_events *cpuc,
         struct event_constraint *c = &emptyconstraint;
         struct er_account *era;
         unsigned long flags;
-        int orig_idx = reg->idx;
+        int idx = reg->idx;
 
-        /* already allocated shared msr */
-        if (reg->alloc)
+        /*
+         * reg->alloc can be set due to existing state, so for fake cpuc we
+         * need to ignore this, otherwise we might fail to allocate proper fake
+         * state for this extra reg constraint. Also see the comment below.
+         */
+        if (reg->alloc && !cpuc->is_fake)
                 return NULL; /* call x86_get_event_constraint() */
 
 again:
-        era = &cpuc->shared_regs->regs[reg->idx];
+        era = &cpuc->shared_regs->regs[idx];
         /*
          * we use spin_lock_irqsave() to avoid lockdep issues when
          * passing a fake cpuc
@@ -1175,6 +1185,29 @@ again:
 
         if (!atomic_read(&era->ref) || era->config == reg->config) {
 
+                /*
+                 * If its a fake cpuc -- as per validate_{group,event}() we
+                 * shouldn't touch event state and we can avoid doing so
+                 * since both will only call get_event_constraints() once
+                 * on each event, this avoids the need for reg->alloc.
+                 *
+                 * Not doing the ER fixup will only result in era->reg being
+                 * wrong, but since we won't actually try and program hardware
+                 * this isn't a problem either.
+                 */
+                if (!cpuc->is_fake) {
+                        if (idx != reg->idx)
+                                intel_fixup_er(event, idx);
+
+                        /*
+                         * x86_schedule_events() can call get_event_constraints()
+                         * multiple times on events in the case of incremental
+                         * scheduling(). reg->alloc ensures we only do the ER
+                         * allocation once.
+                         */
+                        reg->alloc = 1;
+                }
+
                 /* lock in msr value */
                 era->config = reg->config;
                 era->reg = reg->reg;
@@ -1182,17 +1215,17 @@ again:
                 /* one more user */
                 atomic_inc(&era->ref);
 
-                /* no need to reallocate during incremental event scheduling */
-                reg->alloc = 1;
-
                 /*
                  * need to call x86_get_event_constraint()
                  * to check if associated event has constraints
                  */
                 c = NULL;
-        } else if (intel_try_alt_er(event, orig_idx)) {
-                raw_spin_unlock_irqrestore(&era->lock, flags);
-                goto again;
+        } else {
+                idx = intel_alt_er(idx);
+                if (idx != reg->idx) {
+                        raw_spin_unlock_irqrestore(&era->lock, flags);
+                        goto again;
+                }
         }
         raw_spin_unlock_irqrestore(&era->lock, flags);
 
@@ -1206,11 +1239,14 @@ __intel_shared_reg_put_constraints(struct cpu_hw_events *cpuc,
         struct er_account *era;
 
         /*
-         * only put constraint if extra reg was actually
-         * allocated. Also takes care of event which do
-         * not use an extra shared reg
+         * Only put constraint if extra reg was actually allocated. Also takes
+         * care of event which do not use an extra shared reg.
+         *
+         * Also, if this is a fake cpuc we shouldn't touch any event state
+         * (reg->alloc) and we don't care about leaving inconsistent cpuc state
+         * either since it'll be thrown out.
          */
-        if (!reg->alloc)
+        if (!reg->alloc || cpuc->is_fake)
                 return;
 
         era = &cpuc->shared_regs->regs[reg->idx];
@@ -1302,15 +1338,9 @@ static void intel_put_event_constraints(struct cpu_hw_events *cpuc,
         intel_put_shared_regs_event_constraints(cpuc, event);
 }
 
-static int intel_pmu_hw_config(struct perf_event *event)
+static void intel_pebs_aliases_core2(struct perf_event *event)
 {
-        int ret = x86_pmu_hw_config(event);
-
-        if (ret)
-                return ret;
-
-        if (event->attr.precise_ip &&
-            (event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
                 /*
                  * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
                  * (0x003c) so that we can use it with PEBS.
@@ -1331,10 +1361,48 @@ static int intel_pmu_hw_config(struct perf_event *event)
                  */
                 u64 alt_config = X86_CONFIG(.event=0xc0, .inv=1, .cmask=16);
 
+                alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
+                event->hw.config = alt_config;
+        }
+}
+
+static void intel_pebs_aliases_snb(struct perf_event *event)
+{
+        if ((event->hw.config & X86_RAW_EVENT_MASK) == 0x003c) {
+                /*
+                 * Use an alternative encoding for CPU_CLK_UNHALTED.THREAD_P
+                 * (0x003c) so that we can use it with PEBS.
+                 *
+                 * The regular CPU_CLK_UNHALTED.THREAD_P event (0x003c) isn't
+                 * PEBS capable. However we can use UOPS_RETIRED.ALL
+                 * (0x01c2), which is a PEBS capable event, to get the same
+                 * count.
+                 *
+                 * UOPS_RETIRED.ALL counts the number of cycles that retires
+                 * CNTMASK micro-ops. By setting CNTMASK to a value (16)
+                 * larger than the maximum number of micro-ops that can be
+                 * retired per cycle (4) and then inverting the condition, we
+                 * count all cycles that retire 16 or less micro-ops, which
+                 * is every cycle.
+                 *
+                 * Thereby we gain a PEBS capable cycle counter.
+                 */
+                u64 alt_config = X86_CONFIG(.event=0xc2, .umask=0x01, .inv=1, .cmask=16);
 
                 alt_config |= (event->hw.config & ~X86_RAW_EVENT_MASK);
                 event->hw.config = alt_config;
         }
+}
+
+static int intel_pmu_hw_config(struct perf_event *event)
+{
+        int ret = x86_pmu_hw_config(event);
+
+        if (ret)
+                return ret;
+
+        if (event->attr.precise_ip && x86_pmu.pebs_aliases)
+                x86_pmu.pebs_aliases(event);
 
         if (intel_pmu_needs_lbr_smpl(event)) {
                 ret = intel_pmu_setup_lbr_filter(event);
@@ -1609,6 +1677,7 @@ static __initconst const struct x86_pmu intel_pmu = {
         .max_period             = (1ULL << 31) - 1,
         .get_event_constraints  = intel_get_event_constraints,
         .put_event_constraints  = intel_put_event_constraints,
+        .pebs_aliases           = intel_pebs_aliases_core2,
 
         .format_attrs           = intel_arch3_formats_attr,
 
@@ -1842,8 +1911,9 @@ __init int intel_pmu_init(void)
                 break;
 
         case 42: /* SandyBridge */
-                x86_add_quirk(intel_sandybridge_quirk);
         case 45: /* SandyBridge, "Romely-EP" */
+                x86_add_quirk(intel_sandybridge_quirk);
+        case 58: /* IvyBridge */
                 memcpy(hw_cache_event_ids, snb_hw_cache_event_ids,
                        sizeof(hw_cache_event_ids));
 
@@ -1851,6 +1921,7 @@ __init int intel_pmu_init(void)
 
                 x86_pmu.event_constraints = intel_snb_event_constraints;
                 x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
+                x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
                 x86_pmu.extra_regs = intel_snb_extra_regs;
                 /* all extra regs are per-cpu when HT is on */
                 x86_pmu.er_flags |= ERF_HAS_RSP_1;
diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 5a3edc27f6e..35e2192df9f 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -400,14 +400,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = {
         INTEL_EVENT_CONSTRAINT(0xc4, 0xf),    /* BR_INST_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xc5, 0xf),    /* BR_MISP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xcd, 0x8),    /* MEM_TRANS_RETIRED.* */
-        INTEL_UEVENT_CONSTRAINT(0x11d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x12d0, 0xf), /* MEM_UOP_RETIRED.STLB_MISS_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x21d0, 0xf), /* MEM_UOP_RETIRED.LOCK_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x22d0, 0xf), /* MEM_UOP_RETIRED.LOCK_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x41d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x42d0, 0xf), /* MEM_UOP_RETIRED.SPLIT_STORES */
-        INTEL_UEVENT_CONSTRAINT(0x81d0, 0xf), /* MEM_UOP_RETIRED.ANY_LOADS */
-        INTEL_UEVENT_CONSTRAINT(0x82d0, 0xf), /* MEM_UOP_RETIRED.ANY_STORES */
+        INTEL_EVENT_CONSTRAINT(0xd0, 0xf),    /* MEM_UOP_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd1, 0xf),    /* MEM_LOAD_UOPS_RETIRED.* */
         INTEL_EVENT_CONSTRAINT(0xd2, 0xf),    /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */
         INTEL_UEVENT_CONSTRAINT(0x02d4, 0xf), /* MEM_LOAD_UOPS_MISC_RETIRED.LLC_MISS */
diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 086eb58c6e8..f1b42b3a186 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -120,11 +120,6 @@ bool kvm_check_and_clear_guest_paused(void)
         bool ret = false;
         struct pvclock_vcpu_time_info *src;
 
-        /*
-         * per_cpu() is safe here because this function is only called from
-         * timer functions where preemption is already disabled.
-         */
-        WARN_ON(!in_atomic());
         src = &__get_cpu_var(hv_clock);
         if ((src->flags & PVCLOCK_GUEST_STOPPED) != 0) {
                 __this_cpu_and(hv_clock.flags, ~PVCLOCK_GUEST_STOPPED);
diff --git a/arch/x86/kernel/nmi_selftest.c b/arch/x86/kernel/nmi_selftest.c
index e31bf8d5c4d..149b8d9c6ad 100644
--- a/arch/x86/kernel/nmi_selftest.c
+++ b/arch/x86/kernel/nmi_selftest.c
@@ -42,7 +42,7 @@ static int __init nmi_unk_cb(unsigned int val, struct pt_regs *regs)
 static void __init init_nmi_testsuite(void)
 {
         /* trap all the unknown NMIs we may generate */
-        register_nmi_handler(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
+        register_nmi_handler_initonly(NMI_UNKNOWN, nmi_unk_cb, 0, "nmi_selftest_unk");
 }
 
 static void __init cleanup_nmi_testsuite(void)
@@ -64,7 +64,7 @@ static void __init test_nmi_ipi(struct cpumask *mask)
 {
         unsigned long timeout;
 
-        if (register_nmi_handler(NMI_LOCAL, test_nmi_ipi_callback,
+        if (register_nmi_handler_initonly(NMI_LOCAL, test_nmi_ipi_callback,
                                  NMI_FLAG_FIRST, "nmi_selftest")) {
                 nmi_fail = FAILURE;
                 return;
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 62c9457ccd2..c0f420f76cd 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -100,7 +100,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
                                  struct dma_attrs *attrs)
 {
         unsigned long dma_mask;
-        struct page *page = NULL;
+        struct page *page;
         unsigned int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
         dma_addr_t addr;
 
@@ -108,6 +108,7 @@ void *dma_generic_alloc_coherent(struct device *dev, size_t size,
 
         flag |= __GFP_ZERO;
 again:
+        page = NULL;
         if (!(flag & GFP_ATOMIC))
                 page = dma_alloc_from_contiguous(dev, count, get_order(size));
         if (!page)
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index ab3f0626071..10ae9be07b4 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -643,9 +643,11 @@ void native_machine_shutdown(void)
         set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
 
         /*
-         * O.K Now that I'm on the appropriate processor,
-         * stop all of the others.
+         * O.K Now that I'm on the appropriate processor, stop all of the
+         * others. Also disable the local irq to not receive the per-cpu
+         * timer interrupt which may trigger scheduler's load balance.
          */
+        local_irq_disable();
         stop_other_cpus();
 #endif
 
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 456d64806c8..54e938de713 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -351,9 +351,12 @@ static bool __cpuinit match_llc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 
 static bool __cpuinit match_mc(struct cpuinfo_x86 *c, struct cpuinfo_x86 *o)
 {
-        if (c->phys_proc_id == o->phys_proc_id)
-                return topology_sane(c, o, "mc");
+        if (c->phys_proc_id == o->phys_proc_id) {
+                if (cpu_has(c, X86_FEATURE_AMD_DCM))
+                        return true;
 
+                return topology_sane(c, o, "mc");
+        }
         return false;
 }
 
@@ -384,6 +387,15 @@ void __cpuinit set_cpu_sibling_map(int cpu)
                 if ((i == cpu) || (has_mc && match_llc(c, o)))
                         link_mask(llc_shared, cpu, i);
 
+        }
+
+        /*
+         * This needs a separate iteration over the cpus because we rely on all
+         * cpu_sibling_mask links to be set-up.
+         */
+        for_each_cpu(i, cpu_sibling_setup_mask) {
+                o = &cpu_data(i);
+
                 if ((i == cpu) || (has_mc && match_mc(c, o))) {
                         link_mask(core, cpu, i);
 
diff --git a/arch/x86/lib/usercopy.c b/arch/x86/lib/usercopy.c
index f61ee67ec00..4f74d94c8d9 100644
--- a/arch/x86/lib/usercopy.c
+++ b/arch/x86/lib/usercopy.c
@@ -8,6 +8,7 @@
 #include <linux/module.h>
 
 #include <asm/word-at-a-time.h>
+#include <linux/sched.h>
 
 /*
  * best effort, GUP based copy_from_user() that is NMI-safe
@@ -21,6 +22,9 @@ copy_from_user_nmi(void *to, const void __user *from, unsigned long n)
         void *map;
         int ret;
 
+        if (__range_not_ok(from, n, TASK_SIZE))
+                return len;
+
         do {
                 ret = __get_user_pages_fast(addr, 1, 0, &page);
                 if (!ret)
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 81913790442..5d7e51f3fd2 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -28,7 +28,7 @@
 #  - (66): the last prefix is 0x66
 #  - (F3): the last prefix is 0xF3
 #  - (F2): the last prefix is 0xF2
-#
+#  - (!F3) : the last prefix is not 0xF3 (including non-last prefix case)
 
 Table: one byte opcode
 Referrer:
@@ -515,12 +515,12 @@ b4: LFS Gv,Mp
 b5: LGS Gv,Mp
 b6: MOVZX Gv,Eb
 b7: MOVZX Gv,Ew
-b8: JMPE | POPCNT Gv,Ev (F3)
+b8: JMPE (!F3) | POPCNT Gv,Ev (F3)
 b9: Grp10 (1A)
 ba: Grp8 Ev,Ib (1A)
 bb: BTC Ev,Gv
-bc: BSF Gv,Ev | TZCNT Gv,Ev (F3)
-bd: BSR Gv,Ev | LZCNT Gv,Ev (F3)
+bc: BSF Gv,Ev (!F3) | TZCNT Gv,Ev (F3)
+bd: BSR Gv,Ev (!F3) | LZCNT Gv,Ev (F3)
 be: MOVSX Gv,Eb
 bf: MOVSX Gv,Ew
 # 0x0f 0xc0-0xcf
diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
index 97141c26a13..bc4e9d84157 100644
--- a/arch/x86/mm/init.c
+++ b/arch/x86/mm/init.c
@@ -62,7 +62,8 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en
                 extra += PMD_SIZE;
 #endif
                 /* The first 2/4M doesn't use large pages. */
-                extra += mr->end - mr->start;
+                if (mr->start < PMD_SIZE)
+                        extra += mr->end - mr->start;
 
                 ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
         } else
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index be1ef574ce9..78fe3f1ac49 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -180,7 +180,7 @@ err_free_memtype:
 
 /**
  * ioremap_nocache     -   map bus memory into CPU space
- * @offset:    bus address of the memory
+ * @phys_addr:    bus address of the memory
  * @size:      size of the resource to map
  *
  * ioremap_nocache performs a platform specific sequence of operations to
@@ -217,7 +217,7 @@ EXPORT_SYMBOL(ioremap_nocache);
 
 /**
  * ioremap_wc   -       map memory into CPU space write combined
- * @offset:     bus address of the memory
+ * @phys_addr:  bus address of the memory
  * @size:       size of the resource to map
  *
  * This version of ioremap ensures that the memory is marked write combining.
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index e1ebde31521..a718e0d2350 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -122,7 +122,7 @@ within(unsigned long addr, unsigned long start, unsigned long end)
 
 /**
  * clflush_cache_range - flush a cache range with clflush
- * @addr:       virtual start address
+ * @vaddr:      virtual start address
  * @size:       number of bytes to flush
  *
  * clflush is an unordered instruction which needs fencing with mfence
diff --git a/arch/x86/mm/srat.c b/arch/x86/mm/srat.c
index 732af3a9618..4599c3e8bcb 100644
--- a/arch/x86/mm/srat.c
+++ b/arch/x86/mm/srat.c
@@ -176,6 +176,8 @@ acpi_numa_memory_affinity_init(struct acpi_srat_mem_affinity *ma)
                 return;
         }
 
+        node_set(node, numa_nodes_parsed);
+
         printk(KERN_INFO "SRAT: Node %u PXM %u [mem %#010Lx-%#010Lx]\n",
                node, pxm,
                (unsigned long long) start, (unsigned long long) end - 1);
diff --git a/arch/x86/platform/mrst/mrst.c b/arch/x86/platform/mrst/mrst.c
index e31bcd8f2ee..fd41a9262d6 100644
--- a/arch/x86/platform/mrst/mrst.c
+++ b/arch/x86/platform/mrst/mrst.c
@@ -782,7 +782,7 @@ BLOCKING_NOTIFIER_HEAD(intel_scu_notifier);
 EXPORT_SYMBOL_GPL(intel_scu_notifier);
 
 /* Called by IPC driver */
-void intel_scu_devices_create(void)
+void __devinit intel_scu_devices_create(void)
 {
         int i;
 
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index 3ae0e61abd2..59880afa851 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -1295,7 +1295,6 @@ static void __init enable_timeouts(void)
                  */
                 mmr_image |= (1L << SOFTACK_MSHIFT);
                 if (is_uv2_hub()) {
-                        mmr_image &= ~(1L << UV2_LEG_SHFT);
                         mmr_image |= (1L << UV2_EXT_SHFT);
                 }
                 write_mmr_misc_control(pnode, mmr_image);
diff --git a/arch/x86/tools/gen-insn-attr-x86.awk b/arch/x86/tools/gen-insn-attr-x86.awk
index 5f6a5b6c3a1..ddcf39b1a18 100644
--- a/arch/x86/tools/gen-insn-attr-x86.awk
+++ b/arch/x86/tools/gen-insn-attr-x86.awk
@@ -66,9 +66,10 @@ BEGIN {
         rex_expr = "^REX(\\.[XRWB]+)*"
         fpu_expr = "^ESC" # TODO
 
-        lprefix1_expr = "\\(66\\)"
+        lprefix1_expr = "\\((66|!F3)\\)"
         lprefix2_expr = "\\(F3\\)"
-        lprefix3_expr = "\\(F2\\)"
+        lprefix3_expr = "\\((F2|!F3)\\)"
+        lprefix_expr = "\\((66|F2|F3)\\)"
         max_lprefix = 4
 
         # All opcodes starting with lower-case 'v' or with (v1) superscript
@@ -333,13 +334,16 @@ function convert_operands(count,opnd,       i,j,imm,mod)
                 if (match(ext, lprefix1_expr)) {
                         lptable1[idx] = add_flags(lptable1[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix2_expr)) {
+                }
+                if (match(ext, lprefix2_expr)) {
                         lptable2[idx] = add_flags(lptable2[idx],flags)
                         variant = "INAT_VARIANT"
-                } else if (match(ext, lprefix3_expr)) {
+                }
+                if (match(ext, lprefix3_expr)) {
                         lptable3[idx] = add_flags(lptable3[idx],flags)
                         variant = "INAT_VARIANT"
-                } else {
+                }
+                if (!match(ext, lprefix_expr)){
                         table[idx] = add_flags(table[idx],flags)
                 }
         }
diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
index 416bd40c0eb..68d1dc91b37 100644
--- a/arch/x86/um/sys_call_table_32.c
+++ b/arch/x86/um/sys_call_table_32.c
@@ -39,9 +39,9 @@
 #undef __SYSCALL_I386
 #define __SYSCALL_I386(nr, sym, compat) [ nr ] = sym,
 
-typedef void (*sys_call_ptr_t)(void);
+typedef asmlinkage void (*sys_call_ptr_t)(void);
 
-extern void sys_ni_syscall(void);
+extern asmlinkage void sys_ni_syscall(void);
 
 const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
         /*
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index e74df9548a0..ff962d4b821 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -209,6 +209,9 @@ static void __init xen_banner(void)
                xen_feature(XENFEAT_mmu_pt_update_preserve_ad) ? " (preserve-AD)" : "");
 }
 
+#define CPUID_THERM_POWER_LEAF 6
+#define APERFMPERF_PRESENT 0
+
 static __read_mostly unsigned int cpuid_leaf1_edx_mask = ~0;
 static __read_mostly unsigned int cpuid_leaf1_ecx_mask = ~0;
 
@@ -242,6 +245,11 @@ static void xen_cpuid(unsigned int *ax, unsigned int *bx,
                 *dx = cpuid_leaf5_edx_val;
                 return;
 
+        case CPUID_THERM_POWER_LEAF:
+                /* Disabling APERFMPERF for kernel usage */
+                maskecx = ~(1 << APERFMPERF_PRESENT);
+                break;
+
         case 0xb:
                 /* Suppress extended topology stuff */
                 maskebx = 0;
diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
index ffd08c414e9..64effdc6da9 100644
--- a/arch/x86/xen/p2m.c
+++ b/arch/x86/xen/p2m.c
@@ -706,6 +706,7 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         if (!PageHighMem(page)) {
@@ -741,6 +742,24 @@ int m2p_add_override(unsigned long mfn, struct page *page,
         list_add(&page->lru,  &m2p_overrides[mfn_hash(mfn)]);
         spin_unlock_irqrestore(&m2p_override_lock, flags);
 
+        /* p2m(m2p(mfn)) == mfn: the mfn is already present somewhere in
+         * this domain. Set the FOREIGN_FRAME_BIT in the p2m for the other
+         * pfn so that the following mfn_to_pfn(mfn) calls will return the
+         * pfn from the m2p_override (the backend pfn) instead.
+         * We need to do this because the pages shared by the frontend
+         * (xen-blkfront) can be already locked (lock_page, called by
+         * do_read_cache_page); when the userspace backend tries to use them
+         * with direct_IO, mfn_to_pfn returns the pfn of the frontend, so
+         * do_blockdev_direct_IO is going to try to lock the same pages
+         * again resulting in a deadlock.
+         * As a side effect get_user_pages_fast might not be safe on the
+         * frontend pages while they are being shared with the backend,
+         * because mfn_to_pfn (that ends up being called by GUPF) will
+         * return the backend pfn rather than the frontend pfn. */
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == mfn)
+                set_phys_to_machine(pfn, FOREIGN_FRAME(mfn));
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_add_override);
@@ -752,6 +771,7 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         unsigned long uninitialized_var(address);
         unsigned level;
         pte_t *ptep = NULL;
+        int ret = 0;
 
         pfn = page_to_pfn(page);
         mfn = get_phys_to_machine(pfn);
@@ -821,6 +841,22 @@ int m2p_remove_override(struct page *page, bool clear_pte)
         } else
                 set_phys_to_machine(pfn, page->index);
 
+        /* p2m(m2p(mfn)) == FOREIGN_FRAME(mfn): the mfn is already present
+         * somewhere in this domain, even before being added to the
+         * m2p_override (see comment above in m2p_add_override).
+         * If there are no other entries in the m2p_override corresponding
+         * to this mfn, then remove the FOREIGN_FRAME_BIT from the p2m for
+         * the original pfn (the one shared by the frontend): the backend
+         * cannot do any IO on this page anymore because it has been
+         * unshared. Removing the FOREIGN_FRAME_BIT from the p2m entry of
+         * the original pfn causes mfn_to_pfn(mfn) to return the frontend
+         * pfn again. */
+        mfn &= ~FOREIGN_FRAME_BIT;
+        ret = __get_user(pfn, &machine_to_phys_mapping[mfn]);
+        if (ret == 0 && get_phys_to_machine(pfn) == FOREIGN_FRAME(mfn) &&
+                        m2p_find_override(mfn) == NULL)
+                set_phys_to_machine(pfn, mfn);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(m2p_remove_override);
diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
index 3ebba0753d3..a4790bf22c5 100644
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -371,7 +371,8 @@ char * __init xen_memory_setup(void)
         populated = xen_populate_chunk(map, memmap.nr_entries,
                         max_pfn, &last_pfn, xen_released_pages);
 
-        extra_pages += (xen_released_pages - populated);
+        xen_released_pages -= populated;
+        extra_pages += xen_released_pages;
 
         if (last_pfn > max_pfn) {
                 max_pfn = min(MAX_DOMAIN_PAGES, last_pfn);
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 47768ff8734..80998958cf4 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -208,7 +208,7 @@ config ACPI_IPMI
 
 config ACPI_HOTPLUG_CPU
         bool
-        depends on ACPI_PROCESSOR && HOTPLUG_CPU
+        depends on EXPERIMENTAL && ACPI_PROCESSOR && HOTPLUG_CPU
         select ACPI_CONTAINER
         default y
 
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 86933ca8b47..7dd3f9fb9f3 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -643,11 +643,19 @@ static int acpi_battery_update(struct acpi_battery *battery)
 
 static void acpi_battery_refresh(struct acpi_battery *battery)
 {
+        int power_unit;
+
         if (!battery->bat.dev)
                 return;
 
+        power_unit = battery->power_unit;
+
         acpi_battery_get_info(battery);
-        /* The battery may have changed its reporting units. */
+
+        if (power_unit == battery->power_unit)
+                return;
+
+        /* The battery has changed its reporting units. */
         sysfs_remove_battery(battery);
         sysfs_add_battery(battery);
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 0af48a8554c..a093dc163a4 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -333,6 +333,7 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
         struct acpi_buffer state = { 0, NULL };
         union acpi_object *pss = NULL;
         int i;
+        int last_invalid = -1;
 
 
         status = acpi_evaluate_object(pr->handle, "_PSS", NULL, &buffer);
@@ -394,14 +395,33 @@ static int acpi_processor_get_performance_states(struct acpi_processor *pr)
                     ((u32)(px->core_frequency * 1000) !=
                      (px->core_frequency * 1000))) {
                         printk(KERN_ERR FW_BUG PREFIX
-                               "Invalid BIOS _PSS frequency: 0x%llx MHz\n",
-                               px->core_frequency);
-                        result = -EFAULT;
-                        kfree(pr->performance->states);
-                        goto end;
+                               "Invalid BIOS _PSS frequency found for processor %d: 0x%llx MHz\n",
+                               pr->id, px->core_frequency);
+                        if (last_invalid == -1)
+                                last_invalid = i;
+                } else {
+                        if (last_invalid != -1) {
+                                /*
+                                 * Copy this valid entry over last_invalid entry
+                                 */
+                                memcpy(&(pr->performance->states[last_invalid]),
+                                       px, sizeof(struct acpi_processor_px));
+                                ++last_invalid;
+                        }
                 }
         }
 
+        if (last_invalid == 0) {
+                printk(KERN_ERR FW_BUG PREFIX
+                       "No valid BIOS _PSS frequency found for processor %d\n", pr->id);
+                result = -EFAULT;
+                kfree(pr->performance->states);
+                pr->performance->states = NULL;
+        }
+
+        if (last_invalid > 0)
+                pr->performance->state_count = last_invalid;
+
       end:
         kfree(buffer.pointer);
 
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 9577b6fa265..a576575617d 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1687,10 +1687,6 @@ static int acpi_video_bus_add(struct acpi_device *device)
         set_bit(KEY_BRIGHTNESS_ZERO, input->keybit);
         set_bit(KEY_DISPLAY_OFF, input->keybit);
 
-        error = input_register_device(input);
-        if (error)
-                goto err_stop_video;
-
         printk(KERN_INFO PREFIX "%s [%s] (multi-head: %s  rom: %s  post: %s)\n",
                ACPI_VIDEO_DEVICE_NAME, acpi_device_bid(device),
                video->flags.multihead ? "yes" : "no",
@@ -1701,12 +1697,16 @@ static int acpi_video_bus_add(struct acpi_device *device)
         video->pm_nb.priority = 0;
         error = register_pm_notifier(&video->pm_nb);
         if (error)
-                goto err_unregister_input_dev;
+                goto err_stop_video;
+
+        error = input_register_device(input);
+        if (error)
+                goto err_unregister_pm_notifier;
 
         return 0;
 
- err_unregister_input_dev:
-        input_unregister_device(input);
+ err_unregister_pm_notifier:
+        unregister_pm_notifier(&video->pm_nb);
  err_stop_video:
         acpi_video_bus_stop_devices(video);
  err_free_input_dev:
@@ -1743,9 +1743,18 @@ static int acpi_video_bus_remove(struct acpi_device *device, int type)
         return 0;
 }
 
+static int __init is_i740(struct pci_dev *dev)
+{
+        if (dev->device == 0x00D1)
+                return 1;
+        if (dev->device == 0x7000)
+                return 1;
+        return 0;
+}
+
 static int __init intel_opregion_present(void)
 {
-#if defined(CONFIG_DRM_I915) || defined(CONFIG_DRM_I915_MODULE)
+        int opregion = 0;
         struct pci_dev *dev = NULL;
         u32 address;
 
@@ -1754,13 +1763,15 @@ static int __init intel_opregion_present(void)
                         continue;
                 if (dev->vendor != PCI_VENDOR_ID_INTEL)
                         continue;
+                /* We don't want to poke around undefined i740 registers */
+                if (is_i740(dev))
+                        continue;
                 pci_read_config_dword(dev, 0xfc, &address);
                 if (!address)
                         continue;
-                return 1;
+                opregion = 1;
         }
-#endif
-        return 0;
+        return opregion;
 }
 
 int acpi_video_register(void)
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 0bcda488f11..c89aa01fb1d 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -246,11 +246,11 @@ struct regmap *regmap_init(struct device *dev,
                 map->lock = regmap_lock_mutex;
                 map->unlock = regmap_unlock_mutex;
         }
-        map->format.buf_size = (config->reg_bits + config->val_bits) / 8;
         map->format.reg_bytes = DIV_ROUND_UP(config->reg_bits, 8);
         map->format.pad_bytes = config->pad_bits / 8;
         map->format.val_bytes = DIV_ROUND_UP(config->val_bits, 8);
-        map->format.buf_size += map->format.pad_bytes;
+        map->format.buf_size = DIV_ROUND_UP(config->reg_bits +
+                        config->val_bits + config->pad_bits, 8);
         map->reg_shift = config->pad_bits % 8;
         if (config->reg_stride)
                 map->reg_stride = config->reg_stride;
@@ -368,7 +368,7 @@ struct regmap *regmap_init(struct device *dev,
 
         ret = regcache_init(map, config);
         if (ret < 0)
-                goto err_free_workbuf;
+                goto err_debugfs;
 
         /* Add a devres resource for dev_get_regmap() */
         m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
@@ -383,7 +383,8 @@ struct regmap *regmap_init(struct device *dev,
 
 err_cache:
         regcache_exit(map);
-err_free_workbuf:
+err_debugfs:
+        regmap_debugfs_exit(map);
         kfree(map->work_buf);
 err_map:
         kfree(map);
@@ -471,6 +472,7 @@ int regmap_reinit_cache(struct regmap *map, const struct regmap_config *config)
 
         return ret;
 }
+EXPORT_SYMBOL_GPL(regmap_reinit_cache);
 
 /**
  * regmap_exit(): Free a previously allocated register map
diff --git a/drivers/bcma/driver_chipcommon_pmu.c b/drivers/bcma/driver_chipcommon_pmu.c
index a058842f14f..61ce4054b3c 100644
--- a/drivers/bcma/driver_chipcommon_pmu.c
+++ b/drivers/bcma/driver_chipcommon_pmu.c
@@ -139,7 +139,9 @@ void bcma_pmu_workarounds(struct bcma_drv_cc *cc)
                 bcma_chipco_chipctl_maskset(cc, 0, ~0, 0x7);
                 break;
         case 0x4331:
-                /* BCM4331 workaround is SPROM-related, we put it in sprom.c */
+        case 43431:
+                /* Ext PA lines must be enabled for tx on BCM4331 */
+                bcma_chipco_bcm4331_ext_pa_lines_ctl(cc, true);
                 break;
         case 43224:
                 if (bus->chipinfo.rev == 0) {
diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c
index 9a96f14c8f4..c32ebd537ab 100644
--- a/drivers/bcma/driver_pci.c
+++ b/drivers/bcma/driver_pci.c
@@ -232,17 +232,19 @@ void __devinit bcma_core_pci_init(struct bcma_drv_pci *pc)
 int bcma_core_pci_irq_ctl(struct bcma_drv_pci *pc, struct bcma_device *core,
                           bool enable)
 {
-        struct pci_dev *pdev = pc->core->bus->host_pci;
+        struct pci_dev *pdev;
         u32 coremask, tmp;
         int err = 0;
 
-        if (core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
+        if (!pc || core->bus->hosttype != BCMA_HOSTTYPE_PCI) {
                 /* This bcma device is not on a PCI host-bus. So the IRQs are
                  * not routed through the PCI core.
                  * So we must not enable routing through the PCI core. */
                 goto out;
         }
 
+        pdev = pc->core->bus->host_pci;
+
         err = pci_read_config_dword(pdev, BCMA_PCI_IRQMASK, &tmp);
         if (err)
                 goto out;
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index c7f93359acb..f16f42d3607 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -579,13 +579,13 @@ int bcma_sprom_get(struct bcma_bus *bus)
         if (!sprom)
                 return -ENOMEM;
 
-        if (bus->chipinfo.id == 0x4331)
+        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 
         pr_debug("SPROM offset 0x%x\n", offset);
         bcma_sprom_read(bus, offset, sprom);
 
-        if (bus->chipinfo.id == 0x4331)
+        if (bus->chipinfo.id == 0x4331 || bus->chipinfo.id == 43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
 
         err = bcma_sprom_valid(sprom);
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 764f70c5e69..0a418527941 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -898,6 +898,7 @@ static struct pci_device_id agp_intel_pci_table[] = {
         ID(PCI_DEVICE_ID_INTEL_B43_HB),
         ID(PCI_DEVICE_ID_INTEL_B43_1_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB),
+        ID(PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index c0091753a0d..8e2d9140f30 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -212,6 +212,7 @@
 #define PCI_DEVICE_ID_INTEL_G41_HB          0x2E30
 #define PCI_DEVICE_ID_INTEL_G41_IG          0x2E32
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB           0x0040
+#define PCI_DEVICE_ID_INTEL_IRONLAKE_D2_HB          0x0069
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG           0x0042
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB           0x0044
 #define PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB          0x0062
diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c
index f518b99f53f..6289f0eee24 100644
--- a/drivers/char/hw_random/atmel-rng.c
+++ b/drivers/char/hw_random/atmel-rng.c
@@ -36,6 +36,13 @@ static int atmel_trng_read(struct hwrng *rng, void *buf, size_t max,
         /* data ready? */
         if (readl(trng->base + TRNG_ODATA) & 1) {
                 *data = readl(trng->base + TRNG_ODATA);
+                /*
+                  ensure data ready is only set again AFTER the next data
+                  word is ready in case it got set between checking ISR
+                  and reading ODATA, so we don't risk re-reading the
+                  same word
+                */
+                readl(trng->base + TRNG_ISR);
                 return 4;
         } else
                 return 0;
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 32fe9ef5cc5..98b06baafcc 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -48,13 +48,13 @@ struct sh_cmt_priv {
         unsigned long next_match_value;
         unsigned long max_match_value;
         unsigned long rate;
-        spinlock_t lock;
+        raw_spinlock_t lock;
         struct clock_event_device ced;
         struct clocksource cs;
         unsigned long total_cycles;
 };
 
-static DEFINE_SPINLOCK(sh_cmt_lock);
+static DEFINE_RAW_SPINLOCK(sh_cmt_lock);
 
 #define CMSTR -1 /* shared register */
 #define CMCSR 0 /* channel register */
@@ -139,7 +139,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_cmt_lock, flags);
+        raw_spin_lock_irqsave(&sh_cmt_lock, flags);
         value = sh_cmt_read(p, CMSTR);
 
         if (start)
@@ -148,7 +148,7 @@ static void sh_cmt_start_stop_ch(struct sh_cmt_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_cmt_write(p, CMSTR, value);
-        spin_unlock_irqrestore(&sh_cmt_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_cmt_lock, flags);
 }
 
 static int sh_cmt_enable(struct sh_cmt_priv *p, unsigned long *rate)
@@ -328,9 +328,9 @@ static void sh_cmt_set_next(struct sh_cmt_priv *p, unsigned long delta)
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
         __sh_cmt_set_next(p, delta);
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static irqreturn_t sh_cmt_interrupt(int irq, void *dev_id)
@@ -385,7 +385,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
         int ret = 0;
         unsigned long flags;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
 
         if (!(p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE)))
                 ret = sh_cmt_enable(p, &p->rate);
@@ -398,7 +398,7 @@ static int sh_cmt_start(struct sh_cmt_priv *p, unsigned long flag)
         if ((flag == FLAG_CLOCKSOURCE) && (!(p->flags & FLAG_CLOCKEVENT)))
                 __sh_cmt_set_next(p, p->max_match_value);
  out:
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 
         return ret;
 }
@@ -408,7 +408,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
         unsigned long flags;
         unsigned long f;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
 
         f = p->flags & (FLAG_CLOCKEVENT | FLAG_CLOCKSOURCE);
         p->flags &= ~flag;
@@ -420,7 +420,7 @@ static void sh_cmt_stop(struct sh_cmt_priv *p, unsigned long flag)
         if ((flag == FLAG_CLOCKEVENT) && (p->flags & FLAG_CLOCKSOURCE))
                 __sh_cmt_set_next(p, p->max_match_value);
 
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 }
 
 static struct sh_cmt_priv *cs_to_sh_cmt(struct clocksource *cs)
@@ -435,13 +435,13 @@ static cycle_t sh_cmt_clocksource_read(struct clocksource *cs)
         unsigned long value;
         int has_wrapped;
 
-        spin_lock_irqsave(&p->lock, flags);
+        raw_spin_lock_irqsave(&p->lock, flags);
         value = p->total_cycles;
         raw = sh_cmt_get_counter(p, &has_wrapped);
 
         if (unlikely(has_wrapped))
                 raw += p->match_value + 1;
-        spin_unlock_irqrestore(&p->lock, flags);
+        raw_spin_unlock_irqrestore(&p->lock, flags);
 
         return value + raw;
 }
@@ -591,7 +591,7 @@ static int sh_cmt_register(struct sh_cmt_priv *p, char *name,
                 p->max_match_value = (1 << p->width) - 1;
 
         p->match_value = p->max_match_value;
-        spin_lock_init(&p->lock);
+        raw_spin_lock_init(&p->lock);
 
         if (clockevent_rating)
                 sh_cmt_register_clockevent(p, name, clockevent_rating);
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index a2172f69041..d9b76ca64a6 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -43,7 +43,7 @@ struct sh_mtu2_priv {
         struct clock_event_device ced;
 };
 
-static DEFINE_SPINLOCK(sh_mtu2_lock);
+static DEFINE_RAW_SPINLOCK(sh_mtu2_lock);
 
 #define TSTR -1 /* shared register */
 #define TCR  0 /* channel register */
@@ -107,7 +107,7 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_mtu2_lock, flags);
+        raw_spin_lock_irqsave(&sh_mtu2_lock, flags);
         value = sh_mtu2_read(p, TSTR);
 
         if (start)
@@ -116,7 +116,7 @@ static void sh_mtu2_start_stop_ch(struct sh_mtu2_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_mtu2_write(p, TSTR, value);
-        spin_unlock_irqrestore(&sh_mtu2_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_mtu2_lock, flags);
 }
 
 static int sh_mtu2_enable(struct sh_mtu2_priv *p)
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 97f54b634be..c1b51d49d10 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -45,7 +45,7 @@ struct sh_tmu_priv {
         struct clocksource cs;
 };
 
-static DEFINE_SPINLOCK(sh_tmu_lock);
+static DEFINE_RAW_SPINLOCK(sh_tmu_lock);
 
 #define TSTR -1 /* shared register */
 #define TCOR  0 /* channel register */
@@ -95,7 +95,7 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
         unsigned long flags, value;
 
         /* start stop register shared by multiple timer channels */
-        spin_lock_irqsave(&sh_tmu_lock, flags);
+        raw_spin_lock_irqsave(&sh_tmu_lock, flags);
         value = sh_tmu_read(p, TSTR);
 
         if (start)
@@ -104,7 +104,7 @@ static void sh_tmu_start_stop_ch(struct sh_tmu_priv *p, int start)
                 value &= ~(1 << cfg->timer_bit);
 
         sh_tmu_write(p, TSTR, value);
-        spin_unlock_irqrestore(&sh_tmu_lock, flags);
+        raw_spin_unlock_irqrestore(&sh_tmu_lock, flags);
 }
 
 static int sh_tmu_enable(struct sh_tmu_priv *p)
@@ -245,12 +245,7 @@ static void sh_tmu_clock_event_start(struct sh_tmu_priv *p, int periodic)
 
         sh_tmu_enable(p);
 
-        /* TODO: calculate good shift from rate and counter bit width */
-
-        ced->shift = 32;
-        ced->mult = div_sc(p->rate, NSEC_PER_SEC, ced->shift);
-        ced->max_delta_ns = clockevent_delta2ns(0xffffffff, ced);
-        ced->min_delta_ns = 5000;
+        clockevents_config(ced, p->rate);
 
         if (periodic) {
                 p->periodic = (p->rate + HZ/2) / HZ;
@@ -323,7 +318,8 @@ static void sh_tmu_register_clockevent(struct sh_tmu_priv *p,
         ced->set_mode = sh_tmu_clock_event_mode;
 
         dev_info(&p->pdev->dev, "used for clock events\n");
-        clockevents_register_device(ced);
+
+        clockevents_config_and_register(ced, 1, 0x300, 0xffffffff);
 
         ret = setup_irq(p->irqaction.irq, &p->irqaction);
         if (ret) {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 420953197d0..d6de2e07fa0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -244,8 +244,8 @@ static const struct file_operations exynos_drm_driver_fops = {
 };
 
 static struct drm_driver exynos_drm_driver = {
-        .driver_features        = DRIVER_HAVE_IRQ | DRIVER_BUS_PLATFORM |
-                                  DRIVER_MODESET | DRIVER_GEM | DRIVER_PRIME,
+        .driver_features        = DRIVER_HAVE_IRQ | DRIVER_MODESET |
+                                        DRIVER_GEM | DRIVER_PRIME,
         .load                   = exynos_drm_load,
         .unload                 = exynos_drm_unload,
         .open                   = exynos_drm_open,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_encoder.c b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
index 6e9ac7bd1dc..23d5ad379f8 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_encoder.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_encoder.c
@@ -172,19 +172,12 @@ static void exynos_drm_encoder_commit(struct drm_encoder *encoder)
                 manager_ops->commit(manager->dev);
 }
 
-static struct drm_crtc *
-exynos_drm_encoder_get_crtc(struct drm_encoder *encoder)
-{
-        return encoder->crtc;
-}
-
 static struct drm_encoder_helper_funcs exynos_encoder_helper_funcs = {
         .dpms           = exynos_drm_encoder_dpms,
         .mode_fixup     = exynos_drm_encoder_mode_fixup,
         .mode_set       = exynos_drm_encoder_mode_set,
         .prepare        = exynos_drm_encoder_prepare,
         .commit         = exynos_drm_encoder_commit,
-        .get_crtc       = exynos_drm_encoder_get_crtc,
 };
 
 static void exynos_drm_encoder_destroy(struct drm_encoder *encoder)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.c b/drivers/gpu/drm/exynos/exynos_drm_fb.c
index f82a299553f..4ccfe4328fa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.c
@@ -51,11 +51,22 @@ struct exynos_drm_fb {
 static void exynos_drm_fb_destroy(struct drm_framebuffer *fb)
 {
         struct exynos_drm_fb *exynos_fb = to_exynos_fb(fb);
+        unsigned int i;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         drm_framebuffer_cleanup(fb);
 
+        for (i = 0; i < ARRAY_SIZE(exynos_fb->exynos_gem_obj); i++) {
+                struct drm_gem_object *obj;
+
+                if (exynos_fb->exynos_gem_obj[i] == NULL)
+                        continue;
+
+                obj = &exynos_fb->exynos_gem_obj[i]->base;
+                drm_gem_object_unreference_unlocked(obj);
+        }
+
         kfree(exynos_fb);
         exynos_fb = NULL;
 }
@@ -134,11 +145,11 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                 return ERR_PTR(-ENOENT);
         }
 
-        drm_gem_object_unreference_unlocked(obj);
-
         fb = exynos_drm_framebuffer_init(dev, mode_cmd, obj);
-        if (IS_ERR(fb))
+        if (IS_ERR(fb)) {
+                drm_gem_object_unreference_unlocked(obj);
                 return fb;
+        }
 
         exynos_fb = to_exynos_fb(fb);
         nr = exynos_drm_format_num_buffers(fb->pixel_format);
@@ -152,8 +163,6 @@ exynos_user_fb_create(struct drm_device *dev, struct drm_file *file_priv,
                         return ERR_PTR(-ENOENT);
                 }
 
-                drm_gem_object_unreference_unlocked(obj);
-
                 exynos_fb->exynos_gem_obj[i] = to_exynos_gem_obj(obj);
         }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fb.h b/drivers/gpu/drm/exynos/exynos_drm_fb.h
index 3ecb30d9355..50823756cde 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fb.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_fb.h
@@ -31,10 +31,10 @@
 static inline int exynos_drm_format_num_buffers(uint32_t format)
 {
         switch (format) {
-        case DRM_FORMAT_NV12M:
+        case DRM_FORMAT_NV12:
         case DRM_FORMAT_NV12MT:
                 return 2;
-        case DRM_FORMAT_YUV420M:
+        case DRM_FORMAT_YUV420:
                 return 3;
         default:
                 return 1;
diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c
index fc91293c456..5c8b683029e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -689,7 +689,6 @@ int exynos_drm_gem_dumb_map_offset(struct drm_file *file_priv,
                                    struct drm_device *dev, uint32_t handle,
                                    uint64_t *offset)
 {
-        struct exynos_drm_gem_obj *exynos_gem_obj;
         struct drm_gem_object *obj;
         int ret = 0;
 
@@ -710,15 +709,13 @@ int exynos_drm_gem_dumb_map_offset(struct drm_file *file_priv,
                 goto unlock;
         }
 
-        exynos_gem_obj = to_exynos_gem_obj(obj);
-
-        if (!exynos_gem_obj->base.map_list.map) {
-                ret = drm_gem_create_mmap_offset(&exynos_gem_obj->base);
+        if (!obj->map_list.map) {
+                ret = drm_gem_create_mmap_offset(obj);
                 if (ret)
                         goto out;
         }
 
-        *offset = (u64)exynos_gem_obj->base.map_list.hash.key << PAGE_SHIFT;
+        *offset = (u64)obj->map_list.hash.key << PAGE_SHIFT;
         DRM_DEBUG_KMS("offset = 0x%lx\n", (unsigned long)*offset);
 
 out:
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index 68ef0102837..e2147a2ddce 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -365,7 +365,7 @@ static void vp_video_buffer(struct mixer_context *ctx, int win)
         switch (win_data->pixel_format) {
         case DRM_FORMAT_NV12MT:
                 tiled_mode = true;
-        case DRM_FORMAT_NV12M:
+        case DRM_FORMAT_NV12:
                 crcb_mode = false;
                 buf_num = 2;
                 break;
@@ -601,18 +601,20 @@ static void mixer_win_reset(struct mixer_context *ctx)
         mixer_reg_write(res, MXR_BG_COLOR2, 0x008080);
 
         /* setting graphical layers */
-
         val  = MXR_GRP_CFG_COLOR_KEY_DISABLE; /* no blank key */
         val |= MXR_GRP_CFG_WIN_BLEND_EN;
+        val |= MXR_GRP_CFG_BLEND_PRE_MUL;
+        val |= MXR_GRP_CFG_PIXEL_BLEND_EN;
         val |= MXR_GRP_CFG_ALPHA_VAL(0xff); /* non-transparent alpha */
 
         /* the same configuration for both layers */
         mixer_reg_write(res, MXR_GRAPHIC_CFG(0), val);
-
-        val |= MXR_GRP_CFG_BLEND_PRE_MUL;
-        val |= MXR_GRP_CFG_PIXEL_BLEND_EN;
         mixer_reg_write(res, MXR_GRAPHIC_CFG(1), val);
 
+        /* setting video layers */
+        val = MXR_GRP_CFG_ALPHA_VAL(0);
+        mixer_reg_write(res, MXR_VIDEO_CFG, val);
+
         /* configuration of Video Processor Registers */
         vp_win_reset(ctx);
         vp_default_filter(res);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 238a5216583..9fe9ebe52a7 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -233,6 +233,7 @@ static const struct intel_device_info intel_sandybridge_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_sandybridge_m_info = {
@@ -243,6 +244,7 @@ static const struct intel_device_info intel_sandybridge_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_ivybridge_d_info = {
@@ -252,6 +254,7 @@ static const struct intel_device_info intel_ivybridge_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_ivybridge_m_info = {
@@ -262,6 +265,7 @@ static const struct intel_device_info intel_ivybridge_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_valleyview_m_info = {
@@ -289,6 +293,7 @@ static const struct intel_device_info intel_haswell_d_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct intel_device_info intel_haswell_m_info = {
@@ -298,6 +303,7 @@ static const struct intel_device_info intel_haswell_m_info = {
         .has_blt_ring = 1,
         .has_llc = 1,
         .has_pch_split = 1,
+        .has_force_wake = 1,
 };
 
 static const struct pci_device_id pciidlist[] = {               /* aka */
@@ -1139,10 +1145,9 @@ MODULE_LICENSE("GPL and additional rights");
 
 /* We give fast paths for the really cool registers */
 #define NEEDS_FORCE_WAKE(dev_priv, reg) \
-       (((dev_priv)->info->gen >= 6) && \
-        ((reg) < 0x40000) &&            \
-        ((reg) != FORCEWAKE)) && \
-       (!IS_VALLEYVIEW((dev_priv)->dev))
+        ((HAS_FORCE_WAKE((dev_priv)->dev)) && \
+         ((reg) < 0x40000) &&            \
+         ((reg) != FORCEWAKE))
 
 #define __i915_read(x, y) \
 u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg) { \
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c9cfc67c2cf..b0b676abde0 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -285,6 +285,7 @@ struct intel_device_info {
         u8 is_ivybridge:1;
         u8 is_valleyview:1;
         u8 has_pch_split:1;
+        u8 has_force_wake:1;
         u8 is_haswell:1;
         u8 has_fbc:1;
         u8 has_pipe_cxsr:1;
@@ -1101,6 +1102,8 @@ struct drm_i915_file_private {
 #define HAS_PCH_CPT(dev) (INTEL_PCH_TYPE(dev) == PCH_CPT)
 #define HAS_PCH_IBX(dev) (INTEL_PCH_TYPE(dev) == PCH_IBX)
 
+#define HAS_FORCE_WAKE(dev) (INTEL_INFO(dev)->has_force_wake)
+
 #include "i915_trace.h"
 
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 1417660a93e..b1fe0edda95 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -510,7 +510,7 @@ out:
         return ret;
 }
 
-static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
+static void ibx_irq_handler(struct drm_device *dev, u32 pch_iir)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         int pipe;
@@ -550,6 +550,35 @@ static void pch_irq_handler(struct drm_device *dev, u32 pch_iir)
                 DRM_DEBUG_DRIVER("PCH transcoder A underrun interrupt\n");
 }
 
+static void cpt_irq_handler(struct drm_device *dev, u32 pch_iir)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        int pipe;
+
+        if (pch_iir & SDE_AUDIO_POWER_MASK_CPT)
+                DRM_DEBUG_DRIVER("PCH audio power change on port %d\n",
+                                 (pch_iir & SDE_AUDIO_POWER_MASK_CPT) >>
+                                 SDE_AUDIO_POWER_SHIFT_CPT);
+
+        if (pch_iir & SDE_AUX_MASK_CPT)
+                DRM_DEBUG_DRIVER("AUX channel interrupt\n");
+
+        if (pch_iir & SDE_GMBUS_CPT)
+                DRM_DEBUG_DRIVER("PCH GMBUS interrupt\n");
+
+        if (pch_iir & SDE_AUDIO_CP_REQ_CPT)
+                DRM_DEBUG_DRIVER("Audio CP request interrupt\n");
+
+        if (pch_iir & SDE_AUDIO_CP_CHG_CPT)
+                DRM_DEBUG_DRIVER("Audio CP change interrupt\n");
+
+        if (pch_iir & SDE_FDI_MASK_CPT)
+                for_each_pipe(pipe)
+                        DRM_DEBUG_DRIVER("  pipe %c FDI IIR: 0x%08x\n",
+                                         pipe_name(pipe),
+                                         I915_READ(FDI_RX_IIR(pipe)));
+}
+
 static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
@@ -591,7 +620,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
 
                         if (pch_iir & SDE_HOTPLUG_MASK_CPT)
                                 queue_work(dev_priv->wq, &dev_priv->hotplug_work);
-                        pch_irq_handler(dev, pch_iir);
+                        cpt_irq_handler(dev, pch_iir);
 
                         /* clear PCH hotplug event before clear CPU irq */
                         I915_WRITE(SDEIIR, pch_iir);
@@ -684,7 +713,10 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
         if (de_iir & DE_PCH_EVENT) {
                 if (pch_iir & hotplug_mask)
                         queue_work(dev_priv->wq, &dev_priv->hotplug_work);
-                pch_irq_handler(dev, pch_iir);
+                if (HAS_PCH_CPT(dev))
+                        cpt_irq_handler(dev, pch_iir);
+                else
+                        ibx_irq_handler(dev, pch_iir);
         }
 
         if (de_iir & DE_PCU_EVENT) {
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 2d49b9507ed..48d5e8e051c 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -210,6 +210,14 @@
 #define MI_DISPLAY_FLIP         MI_INSTR(0x14, 2)
 #define MI_DISPLAY_FLIP_I915    MI_INSTR(0x14, 1)
 #define   MI_DISPLAY_FLIP_PLANE(n) ((n) << 20)
+/* IVB has funny definitions for which plane to flip. */
+#define   MI_DISPLAY_FLIP_IVB_PLANE_A  (0 << 19)
+#define   MI_DISPLAY_FLIP_IVB_PLANE_B  (1 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_A (2 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_B (3 << 19)
+#define   MI_DISPLAY_FLIP_IVB_PLANE_C  (4 << 19)
+#define   MI_DISPLAY_FLIP_IVB_SPRITE_C (5 << 19)
+
 #define MI_SET_CONTEXT          MI_INSTR(0x18, 0)
 #define   MI_MM_SPACE_GTT               (1<<8)
 #define   MI_MM_SPACE_PHYSICAL          (0<<8)
@@ -3313,7 +3321,7 @@
 
 /* PCH */
 
-/* south display engine interrupt */
+/* south display engine interrupt: IBX */
 #define SDE_AUDIO_POWER_D       (1 << 27)
 #define SDE_AUDIO_POWER_C       (1 << 26)
 #define SDE_AUDIO_POWER_B       (1 << 25)
@@ -3349,15 +3357,44 @@
 #define SDE_TRANSA_CRC_ERR      (1 << 1)
 #define SDE_TRANSA_FIFO_UNDER   (1 << 0)
 #define SDE_TRANS_MASK          (0x3f)
-/* CPT */
-#define SDE_CRT_HOTPLUG_CPT     (1 << 19)
+
+/* south display engine interrupt: CPT/PPT */
+#define SDE_AUDIO_POWER_D_CPT   (1 << 31)
+#define SDE_AUDIO_POWER_C_CPT   (1 << 30)
+#define SDE_AUDIO_POWER_B_CPT   (1 << 29)
+#define SDE_AUDIO_POWER_SHIFT_CPT   29
+#define SDE_AUDIO_POWER_MASK_CPT    (7 << 29)
+#define SDE_AUXD_CPT            (1 << 27)
+#define SDE_AUXC_CPT            (1 << 26)
+#define SDE_AUXB_CPT            (1 << 25)
+#define SDE_AUX_MASK_CPT        (7 << 25)
 #define SDE_PORTD_HOTPLUG_CPT   (1 << 23)
 #define SDE_PORTC_HOTPLUG_CPT   (1 << 22)
 #define SDE_PORTB_HOTPLUG_CPT   (1 << 21)
+#define SDE_CRT_HOTPLUG_CPT     (1 << 19)
 #define SDE_HOTPLUG_MASK_CPT    (SDE_CRT_HOTPLUG_CPT |          \
                                  SDE_PORTD_HOTPLUG_CPT |        \
                                  SDE_PORTC_HOTPLUG_CPT |        \
                                  SDE_PORTB_HOTPLUG_CPT)
+#define SDE_GMBUS_CPT           (1 << 17)
+#define SDE_AUDIO_CP_REQ_C_CPT  (1 << 10)
+#define SDE_AUDIO_CP_CHG_C_CPT  (1 << 9)
+#define SDE_FDI_RXC_CPT         (1 << 8)
+#define SDE_AUDIO_CP_REQ_B_CPT  (1 << 6)
+#define SDE_AUDIO_CP_CHG_B_CPT  (1 << 5)
+#define SDE_FDI_RXB_CPT         (1 << 4)
+#define SDE_AUDIO_CP_REQ_A_CPT  (1 << 2)
+#define SDE_AUDIO_CP_CHG_A_CPT  (1 << 1)
+#define SDE_FDI_RXA_CPT         (1 << 0)
+#define SDE_AUDIO_CP_REQ_CPT    (SDE_AUDIO_CP_REQ_C_CPT | \
+                                 SDE_AUDIO_CP_REQ_B_CPT | \
+                                 SDE_AUDIO_CP_REQ_A_CPT)
+#define SDE_AUDIO_CP_CHG_CPT    (SDE_AUDIO_CP_CHG_C_CPT | \
+                                 SDE_AUDIO_CP_CHG_B_CPT | \
+                                 SDE_AUDIO_CP_CHG_A_CPT)
+#define SDE_FDI_MASK_CPT        (SDE_FDI_RXC_CPT | \
+                                 SDE_FDI_RXB_CPT | \
+                                 SDE_FDI_RXA_CPT)
 
 #define SDEISR  0xc4000
 #define SDEIMR  0xc4004
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 91478942090..e0aa064def3 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6158,17 +6158,34 @@ static int intel_gen7_queue_flip(struct drm_device *dev,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_ring_buffer *ring = &dev_priv->ring[BCS];
+        uint32_t plane_bit = 0;
         int ret;
 
         ret = intel_pin_and_fence_fb_obj(dev, obj, ring);
         if (ret)
                 goto err;
 
+        switch(intel_crtc->plane) {
+        case PLANE_A:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_A;
+                break;
+        case PLANE_B:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_B;
+                break;
+        case PLANE_C:
+                plane_bit = MI_DISPLAY_FLIP_IVB_PLANE_C;
+                break;
+        default:
+                WARN_ONCE(1, "unknown plane in flip command\n");
+                ret = -ENODEV;
+                goto err;
+        }
+
         ret = intel_ring_begin(ring, 4);
         if (ret)
                 goto err_unpin;
 
-        intel_ring_emit(ring, MI_DISPLAY_FLIP_I915 | (intel_crtc->plane << 19));
+        intel_ring_emit(ring, MI_DISPLAY_FLIP_I915 | plane_bit);
         intel_ring_emit(ring, (fb->pitches[0] | obj->tiling_mode));
         intel_ring_emit(ring, (obj->gtt_offset));
         intel_ring_emit(ring, (MI_NOOP));
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index b59b6d5b758..e5b84ff89ca 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -266,10 +266,15 @@ u32 intel_ring_get_active_head(struct intel_ring_buffer *ring)
 
 static int init_ring_common(struct intel_ring_buffer *ring)
 {
-        drm_i915_private_t *dev_priv = ring->dev->dev_private;
+        struct drm_device *dev = ring->dev;
+        drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj = ring->obj;
+        int ret = 0;
         u32 head;
 
+        if (HAS_FORCE_WAKE(dev))
+                gen6_gt_force_wake_get(dev_priv);
+
         /* Stop the ring if it's running. */
         I915_WRITE_CTL(ring, 0);
         I915_WRITE_HEAD(ring, 0);
@@ -317,7 +322,8 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                                 I915_READ_HEAD(ring),
                                 I915_READ_TAIL(ring),
                                 I915_READ_START(ring));
-                return -EIO;
+                ret = -EIO;
+                goto out;
         }
 
         if (!drm_core_check_feature(ring->dev, DRIVER_MODESET))
@@ -326,9 +332,14 @@ static int init_ring_common(struct intel_ring_buffer *ring)
                 ring->head = I915_READ_HEAD(ring);
                 ring->tail = I915_READ_TAIL(ring) & TAIL_ADDR;
                 ring->space = ring_space(ring);
+                ring->last_retired_head = -1;
         }
 
-        return 0;
+out:
+        if (HAS_FORCE_WAKE(dev))
+                gen6_gt_force_wake_put(dev_priv);
+
+        return ret;
 }
 
 static int
@@ -987,6 +998,10 @@ static int intel_init_ring_buffer(struct drm_device *dev,
         if (ret)
                 goto err_unref;
 
+        ret = i915_gem_object_set_to_gtt_domain(obj, true);
+        if (ret)
+                goto err_unpin;
+
         ring->virtual_start = ioremap_wc(dev->agp->base + obj->gtt_offset,
                                          ring->size);
         if (ring->virtual_start == NULL) {
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 4e7dd2b4843..c16554122cc 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -52,6 +52,7 @@ struct evergreen_cs_track {
         u32                     cb_color_view[12];
         u32                     cb_color_pitch[12];
         u32                     cb_color_slice[12];
+        u32                     cb_color_slice_idx[12];
         u32                     cb_color_attrib[12];
         u32                     cb_color_cmask_slice[8];/* unused */
         u32                     cb_color_fmask_slice[8];/* unused */
@@ -127,12 +128,14 @@ static void evergreen_cs_track_init(struct evergreen_cs_track *track)
                 track->cb_color_info[i] = 0;
                 track->cb_color_view[i] = 0xFFFFFFFF;
                 track->cb_color_pitch[i] = 0;
-                track->cb_color_slice[i] = 0;
+                track->cb_color_slice[i] = 0xfffffff;
+                track->cb_color_slice_idx[i] = 0;
         }
         track->cb_target_mask = 0xFFFFFFFF;
         track->cb_shader_mask = 0xFFFFFFFF;
         track->cb_dirty = true;
 
+        track->db_depth_slice = 0xffffffff;
         track->db_depth_view = 0xFFFFC000;
         track->db_depth_size = 0xFFFFFFFF;
         track->db_depth_control = 0xFFFFFFFF;
@@ -250,10 +253,9 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
 {
         struct evergreen_cs_track *track = p->track;
         unsigned palign, halign, tileb, slice_pt;
+        unsigned mtile_pr, mtile_ps, mtileb;
 
         tileb = 64 * surf->bpe * surf->nsamples;
-        palign = track->group_size / (8 * surf->bpe * surf->nsamples);
-        palign = MAX(8, palign);
         slice_pt = 1;
         if (tileb > surf->tsplit) {
                 slice_pt = tileb / surf->tsplit;
@@ -262,7 +264,10 @@ static int evergreen_surface_check_2d(struct radeon_cs_parser *p,
         /* macro tile width & height */
         palign = (8 * surf->bankw * track->npipes) * surf->mtilea;
         halign = (8 * surf->bankh * surf->nbanks) / surf->mtilea;
-        surf->layer_size = surf->nbx * surf->nby * surf->bpe * slice_pt;
+        mtileb = (palign / 8) * (halign / 8) * tileb;;
+        mtile_pr = surf->nbx / palign;
+        mtile_ps = (mtile_pr * surf->nby) / halign;
+        surf->layer_size = mtile_ps * mtileb * slice_pt;
         surf->base_align = (palign / 8) * (halign / 8) * tileb;
         surf->palign = palign;
         surf->halign = halign;
@@ -434,6 +439,39 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 
         offset += surf.layer_size * mslice;
         if (offset > radeon_bo_size(track->cb_color_bo[id])) {
+                /* old ddx are broken they allocate bo with w*h*bpp but
+                 * program slice with ALIGN(h, 8), catch this and patch
+                 * command stream.
+                 */
+                if (!surf.mode) {
+                        volatile u32 *ib = p->ib.ptr;
+                        unsigned long tmp, nby, bsize, size, min = 0;
+
+                        /* find the height the ddx wants */
+                        if (surf.nby > 8) {
+                                min = surf.nby - 8;
+                        }
+                        bsize = radeon_bo_size(track->cb_color_bo[id]);
+                        tmp = track->cb_color_bo_offset[id] << 8;
+                        for (nby = surf.nby; nby > min; nby--) {
+                                size = nby * surf.nbx * surf.bpe * surf.nsamples;
+                                if ((tmp + size * mslice) <= bsize) {
+                                        break;
+                                }
+                        }
+                        if (nby > min) {
+                                surf.nby = nby;
+                                slice = ((nby * surf.nbx) / 64) - 1;
+                                if (!evergreen_surface_check(p, &surf, "cb")) {
+                                        /* check if this one works */
+                                        tmp += surf.layer_size * mslice;
+                                        if (tmp <= bsize) {
+                                                ib[track->cb_color_slice_idx[id]] = slice;
+                                                goto old_ddx_ok;
+                                        }
+                                }
+                        }
+                }
                 dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
                          "offset %d, max layer %d, bo size %ld, slice %d)\n",
                          __func__, __LINE__, id, surf.layer_size,
@@ -446,6 +484,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
                         surf.tsplit, surf.mtilea);
                 return -EINVAL;
         }
+old_ddx_ok:
 
         return 0;
 }
@@ -1532,6 +1571,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
         case CB_COLOR7_SLICE:
                 tmp = (reg - CB_COLOR0_SLICE) / 0x3c;
                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
+                track->cb_color_slice_idx[tmp] = idx;
                 track->cb_dirty = true;
                 break;
         case CB_COLOR8_SLICE:
@@ -1540,6 +1580,7 @@ static int evergreen_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
         case CB_COLOR11_SLICE:
                 tmp = ((reg - CB_COLOR8_SLICE) / 0x1c) + 8;
                 track->cb_color_slice[tmp] = radeon_get_ib_value(p, idx);
+                track->cb_color_slice_idx[tmp] = idx;
                 track->cb_dirty = true;
                 break;
         case CB_COLOR0_ATTRIB:
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 3df4efa1194..3186522a445 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -460,15 +460,28 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                 rdev->config.cayman.max_pipes_per_simd = 4;
                 rdev->config.cayman.max_tile_pipes = 2;
                 if ((rdev->pdev->device == 0x9900) ||
-                    (rdev->pdev->device == 0x9901)) {
+                    (rdev->pdev->device == 0x9901) ||
+                    (rdev->pdev->device == 0x9905) ||
+                    (rdev->pdev->device == 0x9906) ||
+                    (rdev->pdev->device == 0x9907) ||
+                    (rdev->pdev->device == 0x9908) ||
+                    (rdev->pdev->device == 0x9909) ||
+                    (rdev->pdev->device == 0x9910) ||
+                    (rdev->pdev->device == 0x9917)) {
                         rdev->config.cayman.max_simds_per_se = 6;
                         rdev->config.cayman.max_backends_per_se = 2;
                 } else if ((rdev->pdev->device == 0x9903) ||
-                           (rdev->pdev->device == 0x9904)) {
+                           (rdev->pdev->device == 0x9904) ||
+                           (rdev->pdev->device == 0x990A) ||
+                           (rdev->pdev->device == 0x9913) ||
+                           (rdev->pdev->device == 0x9918)) {
                         rdev->config.cayman.max_simds_per_se = 4;
                         rdev->config.cayman.max_backends_per_se = 2;
-                } else if ((rdev->pdev->device == 0x9990) ||
-                           (rdev->pdev->device == 0x9991)) {
+                } else if ((rdev->pdev->device == 0x9919) ||
+                           (rdev->pdev->device == 0x9990) ||
+                           (rdev->pdev->device == 0x9991) ||
+                           (rdev->pdev->device == 0x9994) ||
+                           (rdev->pdev->device == 0x99A0)) {
                         rdev->config.cayman.max_simds_per_se = 3;
                         rdev->config.cayman.max_backends_per_se = 1;
                 } else {
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 45cfcea6350..f30dc95f83b 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -2426,6 +2426,12 @@ int r600_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio init failed\n");
+                return r;
+        }
+
         return 0;
 }
 
@@ -2462,12 +2468,6 @@ int r600_resume(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                DRM_ERROR("radeon: audio resume failed\n");
-                return r;
-        }
-
         return r;
 }
 
@@ -2577,9 +2577,6 @@ int r600_init(struct radeon_device *rdev)
                 rdev->accel_working = false;
         }
 
-        r = r600_audio_init(rdev);
-        if (r)
-                return r; /* TODO error handling */
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 7c4fa77f018..7479a5c503e 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -192,6 +192,7 @@ void r600_audio_set_clock(struct drm_encoder *encoder, int clock)
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
         struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
         int base_rate = 48000;
 
         switch (radeon_encoder->encoder_id) {
@@ -217,8 +218,8 @@ void r600_audio_set_clock(struct drm_encoder *encoder, int clock)
                 WREG32(EVERGREEN_AUDIO_PLL1_DIV, clock * 10);
                 WREG32(EVERGREEN_AUDIO_PLL1_UNK, 0x00000071);
 
-                /* Some magic trigger or src sel? */
-                WREG32_P(0x5ac, 0x01, ~0x77);
+                /* Select DTO source */
+                WREG32(0x5ac, radeon_crtc->crtc_id);
         } else {
                 switch (dig->dig_encoder) {
                 case 0:
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 226379e00ac..969c27529df 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -348,7 +348,6 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
                 WREG32(HDMI0_AUDIO_PACKET_CONTROL + offset,
                        HDMI0_AUDIO_SAMPLE_SEND | /* send audio packets */
                        HDMI0_AUDIO_DELAY_EN(1) | /* default audio delay */
-                       HDMI0_AUDIO_SEND_MAX_PACKETS | /* send NULL packets if no audio is available */
                        HDMI0_AUDIO_PACKETS_PER_LINE(3) | /* should be suffient for all audio modes and small enough for all hblanks */
                        HDMI0_60958_CS_UPDATE); /* allow 60958 channel status fields to be updated */
         }
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 85dac33e3cc..fefcca55c1e 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1374,9 +1374,9 @@ struct cayman_asic {
 
 struct si_asic {
         unsigned max_shader_engines;
-        unsigned max_pipes_per_simd;
         unsigned max_tile_pipes;
-        unsigned max_simds_per_se;
+        unsigned max_cu_per_sh;
+        unsigned max_sh_per_se;
         unsigned max_backends_per_se;
         unsigned max_texture_channel_caches;
         unsigned max_gprs;
@@ -1387,7 +1387,6 @@ struct si_asic {
         unsigned sc_hiz_tile_fifo_size;
         unsigned sc_earlyz_tile_fifo_size;
 
-        unsigned num_shader_engines;
         unsigned num_tile_pipes;
         unsigned num_backends_per_se;
         unsigned backend_disable_mask_per_asic;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index f0bb2b543b1..03e5f5df40f 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -57,9 +57,10 @@
  *   2.13.0 - virtual memory support, streamout
  *   2.14.0 - add evergreen tiling informations
  *   2.15.0 - add max_pipes query
+ *   2.16.0 - fix evergreen 2D tiled surface calculation
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        15
+#define KMS_DRIVER_MINOR        16
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
index 79db56e6c2a..59d44937dd9 100644
--- a/drivers/gpu/drm/radeon/radeon_gart.c
+++ b/drivers/gpu/drm/radeon/radeon_gart.c
@@ -476,12 +476,18 @@ int radeon_vm_bo_add(struct radeon_device *rdev,
 
         mutex_lock(&vm->mutex);
         if (last_pfn > vm->last_pfn) {
-                /* grow va space 32M by 32M */
-                unsigned align = ((32 << 20) >> 12) - 1;
+                /* release mutex and lock in right order */
+                mutex_unlock(&vm->mutex);
                 radeon_mutex_lock(&rdev->cs_mutex);
-                radeon_vm_unbind_locked(rdev, vm);
+                mutex_lock(&vm->mutex);
+                /* and check again */
+                if (last_pfn > vm->last_pfn) {
+                        /* grow va space 32M by 32M */
+                        unsigned align = ((32 << 20) >> 12) - 1;
+                        radeon_vm_unbind_locked(rdev, vm);
+                        vm->last_pfn = (last_pfn + align) & ~align;
+                }
                 radeon_mutex_unlock(&rdev->cs_mutex);
-                vm->last_pfn = (last_pfn + align) & ~align;
         }
         head = &vm->va;
         last_offset = 0;
@@ -595,8 +601,8 @@ int radeon_vm_bo_rmv(struct radeon_device *rdev,
         if (bo_va == NULL)
                 return 0;
 
-        mutex_lock(&vm->mutex);
         radeon_mutex_lock(&rdev->cs_mutex);
+        mutex_lock(&vm->mutex);
         radeon_vm_bo_update_pte(rdev, vm, bo, NULL);
         radeon_mutex_unlock(&rdev->cs_mutex);
         list_del(&bo_va->vm_list);
@@ -641,9 +647,8 @@ void radeon_vm_fini(struct radeon_device *rdev, struct radeon_vm *vm)
         struct radeon_bo_va *bo_va, *tmp;
         int r;
 
-        mutex_lock(&vm->mutex);
-
         radeon_mutex_lock(&rdev->cs_mutex);
+        mutex_lock(&vm->mutex);
         radeon_vm_unbind_locked(rdev, vm);
         radeon_mutex_unlock(&rdev->cs_mutex);
 
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index f1016a5820d..5c58d7d90cb 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -273,7 +273,7 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
                 break;
         case RADEON_INFO_MAX_PIPES:
                 if (rdev->family >= CHIP_TAHITI)
-                        value = rdev->config.si.max_pipes_per_simd;
+                        value = rdev->config.si.max_cu_per_sh;
                 else if (rdev->family >= CHIP_CAYMAN)
                         value = rdev->config.cayman.max_pipes_per_simd;
                 else if (rdev->family >= CHIP_CEDAR)
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 25f9eef12c4..e95c5e61d4e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -908,12 +908,6 @@ static int rs600_startup(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "failed initializing audio\n");
-                return r;
-        }
-
         r = radeon_ib_pool_start(rdev);
         if (r)
                 return r;
@@ -922,6 +916,12 @@ static int rs600_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                dev_err(rdev->dev, "failed initializing audio\n");
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3277ddecfe9..159b6a43fda 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -637,12 +637,6 @@ static int rs690_startup(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "failed initializing audio\n");
-                return r;
-        }
-
         r = radeon_ib_pool_start(rdev);
         if (r)
                 return r;
@@ -651,6 +645,12 @@ static int rs690_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                dev_err(rdev->dev, "failed initializing audio\n");
+                return r;
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 04ddc365a90..4ad0281fdc3 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -956,6 +956,12 @@ static int rv770_startup(struct radeon_device *rdev)
         if (r)
                 return r;
 
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio init failed\n");
+                return r;
+        }
+
         return 0;
 }
 
@@ -978,12 +984,6 @@ int rv770_resume(struct radeon_device *rdev)
                 return r;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "radeon: audio init failed\n");
-                return r;
-        }
-
         return r;
 
 }
@@ -1092,12 +1092,6 @@ int rv770_init(struct radeon_device *rdev)
                 rdev->accel_working = false;
         }
 
-        r = r600_audio_init(rdev);
-        if (r) {
-                dev_err(rdev->dev, "radeon: audio init failed\n");
-                return r;
-        }
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 549732e56ca..c7b61f16ecf 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -867,200 +867,6 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
 /*
  * Core functions
  */
-static u32 si_get_tile_pipe_to_backend_map(struct radeon_device *rdev,
-                                           u32 num_tile_pipes,
-                                           u32 num_backends_per_asic,
-                                           u32 *backend_disable_mask_per_asic,
-                                           u32 num_shader_engines)
-{
-        u32 backend_map = 0;
-        u32 enabled_backends_mask = 0;
-        u32 enabled_backends_count = 0;
-        u32 num_backends_per_se;
-        u32 cur_pipe;
-        u32 swizzle_pipe[SI_MAX_PIPES];
-        u32 cur_backend = 0;
-        u32 i;
-        bool force_no_swizzle;
-
-        /* force legal values */
-        if (num_tile_pipes < 1)
-                num_tile_pipes = 1;
-        if (num_tile_pipes > rdev->config.si.max_tile_pipes)
-                num_tile_pipes = rdev->config.si.max_tile_pipes;
-        if (num_shader_engines < 1)
-                num_shader_engines = 1;
-        if (num_shader_engines > rdev->config.si.max_shader_engines)
-                num_shader_engines = rdev->config.si.max_shader_engines;
-        if (num_backends_per_asic < num_shader_engines)
-                num_backends_per_asic = num_shader_engines;
-        if (num_backends_per_asic > (rdev->config.si.max_backends_per_se * num_shader_engines))
-                num_backends_per_asic = rdev->config.si.max_backends_per_se * num_shader_engines;
-
-        /* make sure we have the same number of backends per se */
-        num_backends_per_asic = ALIGN(num_backends_per_asic, num_shader_engines);
-        /* set up the number of backends per se */
-        num_backends_per_se = num_backends_per_asic / num_shader_engines;
-        if (num_backends_per_se > rdev->config.si.max_backends_per_se) {
-                num_backends_per_se = rdev->config.si.max_backends_per_se;
-                num_backends_per_asic = num_backends_per_se * num_shader_engines;
-        }
-
-        /* create enable mask and count for enabled backends */
-        for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                if (((*backend_disable_mask_per_asic >> i) & 1) == 0) {
-                        enabled_backends_mask |= (1 << i);
-                        ++enabled_backends_count;
-                }
-                if (enabled_backends_count == num_backends_per_asic)
-                        break;
-        }
-
-        /* force the backends mask to match the current number of backends */
-        if (enabled_backends_count != num_backends_per_asic) {
-                u32 this_backend_enabled;
-                u32 shader_engine;
-                u32 backend_per_se;
-
-                enabled_backends_mask = 0;
-                enabled_backends_count = 0;
-                *backend_disable_mask_per_asic = SI_MAX_BACKENDS_MASK;
-                for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                        /* calc the current se */
-                        shader_engine = i / rdev->config.si.max_backends_per_se;
-                        /* calc the backend per se */
-                        backend_per_se = i % rdev->config.si.max_backends_per_se;
-                        /* default to not enabled */
-                        this_backend_enabled = 0;
-                        if ((shader_engine < num_shader_engines) &&
-                            (backend_per_se < num_backends_per_se))
-                                this_backend_enabled = 1;
-                        if (this_backend_enabled) {
-                                enabled_backends_mask |= (1 << i);
-                                *backend_disable_mask_per_asic &= ~(1 << i);
-                                ++enabled_backends_count;
-                        }
-                }
-        }
-
-
-        memset((uint8_t *)&swizzle_pipe[0], 0, sizeof(u32) * SI_MAX_PIPES);
-        switch (rdev->family) {
-        case CHIP_TAHITI:
-        case CHIP_PITCAIRN:
-        case CHIP_VERDE:
-                force_no_swizzle = true;
-                break;
-        default:
-                force_no_swizzle = false;
-                break;
-        }
-        if (force_no_swizzle) {
-                bool last_backend_enabled = false;
-
-                force_no_swizzle = false;
-                for (i = 0; i < SI_MAX_BACKENDS; ++i) {
-                        if (((enabled_backends_mask >> i) & 1) == 1) {
-                                if (last_backend_enabled)
-                                        force_no_swizzle = true;
-                                last_backend_enabled = true;
-                        } else
-                                last_backend_enabled = false;
-                }
-        }
-
-        switch (num_tile_pipes) {
-        case 1:
-        case 3:
-        case 5:
-        case 7:
-                DRM_ERROR("odd number of pipes!\n");
-                break;
-        case 2:
-                swizzle_pipe[0] = 0;
-                swizzle_pipe[1] = 1;
-                break;
-        case 4:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 1;
-                        swizzle_pipe[3] = 3;
-                }
-                break;
-        case 6:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                        swizzle_pipe[4] = 4;
-                        swizzle_pipe[5] = 5;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 4;
-                        swizzle_pipe[3] = 1;
-                        swizzle_pipe[4] = 3;
-                        swizzle_pipe[5] = 5;
-                }
-                break;
-        case 8:
-                if (force_no_swizzle) {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 1;
-                        swizzle_pipe[2] = 2;
-                        swizzle_pipe[3] = 3;
-                        swizzle_pipe[4] = 4;
-                        swizzle_pipe[5] = 5;
-                        swizzle_pipe[6] = 6;
-                        swizzle_pipe[7] = 7;
-                } else {
-                        swizzle_pipe[0] = 0;
-                        swizzle_pipe[1] = 2;
-                        swizzle_pipe[2] = 4;
-                        swizzle_pipe[3] = 6;
-                        swizzle_pipe[4] = 1;
-                        swizzle_pipe[5] = 3;
-                        swizzle_pipe[6] = 5;
-                        swizzle_pipe[7] = 7;
-                }
-                break;
-        }
-
-        for (cur_pipe = 0; cur_pipe < num_tile_pipes; ++cur_pipe) {
-                while (((1 << cur_backend) & enabled_backends_mask) == 0)
-                        cur_backend = (cur_backend + 1) % SI_MAX_BACKENDS;
-
-                backend_map |= (((cur_backend & 0xf) << (swizzle_pipe[cur_pipe] * 4)));
-
-                cur_backend = (cur_backend + 1) % SI_MAX_BACKENDS;
-        }
-
-        return backend_map;
-}
-
-static u32 si_get_disable_mask_per_asic(struct radeon_device *rdev,
-                                        u32 disable_mask_per_se,
-                                        u32 max_disable_mask_per_se,
-                                        u32 num_shader_engines)
-{
-        u32 disable_field_width_per_se = r600_count_pipe_bits(disable_mask_per_se);
-        u32 disable_mask_per_asic = disable_mask_per_se & max_disable_mask_per_se;
-
-        if (num_shader_engines == 1)
-                return disable_mask_per_asic;
-        else if (num_shader_engines == 2)
-                return disable_mask_per_asic | (disable_mask_per_asic << disable_field_width_per_se);
-        else
-                return 0xffffffff;
-}
-
 static void si_tiling_mode_table_init(struct radeon_device *rdev)
 {
         const u32 num_tile_mode_states = 32;
@@ -1562,18 +1368,151 @@ static void si_tiling_mode_table_init(struct radeon_device *rdev)
                 DRM_ERROR("unknown asic: 0x%x\n", rdev->family);
 }
 
+static void si_select_se_sh(struct radeon_device *rdev,
+                            u32 se_num, u32 sh_num)
+{
+        u32 data = INSTANCE_BROADCAST_WRITES;
+
+        if ((se_num == 0xffffffff) && (sh_num == 0xffffffff))
+                data = SH_BROADCAST_WRITES | SE_BROADCAST_WRITES;
+        else if (se_num == 0xffffffff)
+                data |= SE_BROADCAST_WRITES | SH_INDEX(sh_num);
+        else if (sh_num == 0xffffffff)
+                data |= SH_BROADCAST_WRITES | SE_INDEX(se_num);
+        else
+                data |= SH_INDEX(sh_num) | SE_INDEX(se_num);
+        WREG32(GRBM_GFX_INDEX, data);
+}
+
+static u32 si_create_bitmask(u32 bit_width)
+{
+        u32 i, mask = 0;
+
+        for (i = 0; i < bit_width; i++) {
+                mask <<= 1;
+                mask |= 1;
+        }
+        return mask;
+}
+
+static u32 si_get_cu_enabled(struct radeon_device *rdev, u32 cu_per_sh)
+{
+        u32 data, mask;
+
+        data = RREG32(CC_GC_SHADER_ARRAY_CONFIG);
+        if (data & 1)
+                data &= INACTIVE_CUS_MASK;
+        else
+                data = 0;
+        data |= RREG32(GC_USER_SHADER_ARRAY_CONFIG);
+
+        data >>= INACTIVE_CUS_SHIFT;
+
+        mask = si_create_bitmask(cu_per_sh);
+
+        return ~data & mask;
+}
+
+static void si_setup_spi(struct radeon_device *rdev,
+                         u32 se_num, u32 sh_per_se,
+                         u32 cu_per_sh)
+{
+        int i, j, k;
+        u32 data, mask, active_cu;
+
+        for (i = 0; i < se_num; i++) {
+                for (j = 0; j < sh_per_se; j++) {
+                        si_select_se_sh(rdev, i, j);
+                        data = RREG32(SPI_STATIC_THREAD_MGMT_3);
+                        active_cu = si_get_cu_enabled(rdev, cu_per_sh);
+
+                        mask = 1;
+                        for (k = 0; k < 16; k++) {
+                                mask <<= k;
+                                if (active_cu & mask) {
+                                        data &= ~mask;
+                                        WREG32(SPI_STATIC_THREAD_MGMT_3, data);
+                                        break;
+                                }
+                        }
+                }
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+}
+
+static u32 si_get_rb_disabled(struct radeon_device *rdev,
+                              u32 max_rb_num, u32 se_num,
+                              u32 sh_per_se)
+{
+        u32 data, mask;
+
+        data = RREG32(CC_RB_BACKEND_DISABLE);
+        if (data & 1)
+                data &= BACKEND_DISABLE_MASK;
+        else
+                data = 0;
+        data |= RREG32(GC_USER_RB_BACKEND_DISABLE);
+
+        data >>= BACKEND_DISABLE_SHIFT;
+
+        mask = si_create_bitmask(max_rb_num / se_num / sh_per_se);
+
+        return data & mask;
+}
+
+static void si_setup_rb(struct radeon_device *rdev,
+                        u32 se_num, u32 sh_per_se,
+                        u32 max_rb_num)
+{
+        int i, j;
+        u32 data, mask;
+        u32 disabled_rbs = 0;
+        u32 enabled_rbs = 0;
+
+        for (i = 0; i < se_num; i++) {
+                for (j = 0; j < sh_per_se; j++) {
+                        si_select_se_sh(rdev, i, j);
+                        data = si_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        disabled_rbs |= data << ((i * sh_per_se + j) * TAHITI_RB_BITMAP_WIDTH_PER_SH);
+                }
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+
+        mask = 1;
+        for (i = 0; i < max_rb_num; i++) {
+                if (!(disabled_rbs & mask))
+                        enabled_rbs |= mask;
+                mask <<= 1;
+        }
+
+        for (i = 0; i < se_num; i++) {
+                si_select_se_sh(rdev, i, 0xffffffff);
+                data = 0;
+                for (j = 0; j < sh_per_se; j++) {
+                        switch (enabled_rbs & 3) {
+                        case 1:
+                                data |= (RASTER_CONFIG_RB_MAP_0 << (i * sh_per_se + j) * 2);
+                                break;
+                        case 2:
+                                data |= (RASTER_CONFIG_RB_MAP_3 << (i * sh_per_se + j) * 2);
+                                break;
+                        case 3:
+                        default:
+                                data |= (RASTER_CONFIG_RB_MAP_2 << (i * sh_per_se + j) * 2);
+                                break;
+                        }
+                        enabled_rbs >>= 2;
+                }
+                WREG32(PA_SC_RASTER_CONFIG, data);
+        }
+        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
+}
+
 static void si_gpu_init(struct radeon_device *rdev)
 {
-        u32 cc_rb_backend_disable = 0;
-        u32 cc_gc_shader_array_config;
         u32 gb_addr_config = 0;
         u32 mc_shared_chmap, mc_arb_ramcfg;
-        u32 gb_backend_map;
-        u32 cgts_tcc_disable;
         u32 sx_debug_1;
-        u32 gc_user_shader_array_config;
-        u32 gc_user_rb_backend_disable;
-        u32 cgts_user_tcc_disable;
         u32 hdp_host_path_cntl;
         u32 tmp;
         int i, j;
@@ -1581,9 +1520,9 @@ static void si_gpu_init(struct radeon_device *rdev)
         switch (rdev->family) {
         case CHIP_TAHITI:
                 rdev->config.si.max_shader_engines = 2;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 12;
-                rdev->config.si.max_simds_per_se = 8;
+                rdev->config.si.max_cu_per_sh = 8;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 12;
                 rdev->config.si.max_gprs = 256;
@@ -1594,12 +1533,13 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x100;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = TAHITI_GB_ADDR_CONFIG_GOLDEN;
                 break;
         case CHIP_PITCAIRN:
                 rdev->config.si.max_shader_engines = 2;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 8;
-                rdev->config.si.max_simds_per_se = 5;
+                rdev->config.si.max_cu_per_sh = 5;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 8;
                 rdev->config.si.max_gprs = 256;
@@ -1610,13 +1550,14 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x100;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = TAHITI_GB_ADDR_CONFIG_GOLDEN;
                 break;
         case CHIP_VERDE:
         default:
                 rdev->config.si.max_shader_engines = 1;
-                rdev->config.si.max_pipes_per_simd = 4;
                 rdev->config.si.max_tile_pipes = 4;
-                rdev->config.si.max_simds_per_se = 2;
+                rdev->config.si.max_cu_per_sh = 2;
+                rdev->config.si.max_sh_per_se = 2;
                 rdev->config.si.max_backends_per_se = 4;
                 rdev->config.si.max_texture_channel_caches = 4;
                 rdev->config.si.max_gprs = 256;
@@ -1627,6 +1568,7 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.sc_prim_fifo_size_backend = 0x40;
                 rdev->config.si.sc_hiz_tile_fifo_size = 0x30;
                 rdev->config.si.sc_earlyz_tile_fifo_size = 0x130;
+                gb_addr_config = VERDE_GB_ADDR_CONFIG_GOLDEN;
                 break;
         }
 
@@ -1648,31 +1590,7 @@ static void si_gpu_init(struct radeon_device *rdev)
         mc_shared_chmap = RREG32(MC_SHARED_CHMAP);
         mc_arb_ramcfg = RREG32(MC_ARB_RAMCFG);
 
-        cc_rb_backend_disable = RREG32(CC_RB_BACKEND_DISABLE);
-        cc_gc_shader_array_config = RREG32(CC_GC_SHADER_ARRAY_CONFIG);
-        cgts_tcc_disable = 0xffff0000;
-        for (i = 0; i < rdev->config.si.max_texture_channel_caches; i++)
-                cgts_tcc_disable &= ~(1 << (16 + i));
-        gc_user_rb_backend_disable = RREG32(GC_USER_RB_BACKEND_DISABLE);
-        gc_user_shader_array_config = RREG32(GC_USER_SHADER_ARRAY_CONFIG);
-        cgts_user_tcc_disable = RREG32(CGTS_USER_TCC_DISABLE);
-
-        rdev->config.si.num_shader_engines = rdev->config.si.max_shader_engines;
         rdev->config.si.num_tile_pipes = rdev->config.si.max_tile_pipes;
-        tmp = ((~gc_user_rb_backend_disable) & BACKEND_DISABLE_MASK) >> BACKEND_DISABLE_SHIFT;
-        rdev->config.si.num_backends_per_se = r600_count_pipe_bits(tmp);
-        tmp = (gc_user_rb_backend_disable & BACKEND_DISABLE_MASK) >> BACKEND_DISABLE_SHIFT;
-        rdev->config.si.backend_disable_mask_per_asic =
-                si_get_disable_mask_per_asic(rdev, tmp, SI_MAX_BACKENDS_PER_SE_MASK,
-                                             rdev->config.si.num_shader_engines);
-        rdev->config.si.backend_map =
-                si_get_tile_pipe_to_backend_map(rdev, rdev->config.si.num_tile_pipes,
-                                                rdev->config.si.num_backends_per_se *
-                                                rdev->config.si.num_shader_engines,
-                                                &rdev->config.si.backend_disable_mask_per_asic,
-                                                rdev->config.si.num_shader_engines);
-        tmp = ((~cgts_user_tcc_disable) & TCC_DISABLE_MASK) >> TCC_DISABLE_SHIFT;
-        rdev->config.si.num_texture_channel_caches = r600_count_pipe_bits(tmp);
         rdev->config.si.mem_max_burst_length_bytes = 256;
         tmp = (mc_arb_ramcfg & NOOFCOLS_MASK) >> NOOFCOLS_SHIFT;
         rdev->config.si.mem_row_size_in_kb = (4 * (1 << (8 + tmp))) / 1024;
@@ -1683,55 +1601,8 @@ static void si_gpu_init(struct radeon_device *rdev)
         rdev->config.si.num_gpus = 1;
         rdev->config.si.multi_gpu_tile_size = 64;
 
-        gb_addr_config = 0;
-        switch (rdev->config.si.num_tile_pipes) {
-        case 1:
-                gb_addr_config |= NUM_PIPES(0);
-                break;
-        case 2:
-                gb_addr_config |= NUM_PIPES(1);
-                break;
-        case 4:
-                gb_addr_config |= NUM_PIPES(2);
-                break;
-        case 8:
-        default:
-                gb_addr_config |= NUM_PIPES(3);
-                break;
-        }
-
-        tmp = (rdev->config.si.mem_max_burst_length_bytes / 256) - 1;
-        gb_addr_config |= PIPE_INTERLEAVE_SIZE(tmp);
-        gb_addr_config |= NUM_SHADER_ENGINES(rdev->config.si.num_shader_engines - 1);
-        tmp = (rdev->config.si.shader_engine_tile_size / 16) - 1;
-        gb_addr_config |= SHADER_ENGINE_TILE_SIZE(tmp);
-        switch (rdev->config.si.num_gpus) {
-        case 1:
-        default:
-                gb_addr_config |= NUM_GPUS(0);
-                break;
-        case 2:
-                gb_addr_config |= NUM_GPUS(1);
-                break;
-        case 4:
-                gb_addr_config |= NUM_GPUS(2);
-                break;
-        }
-        switch (rdev->config.si.multi_gpu_tile_size) {
-        case 16:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(0);
-                break;
-        case 32:
-        default:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(1);
-                break;
-        case 64:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(2);
-                break;
-        case 128:
-                gb_addr_config |= MULTI_GPU_TILE_SIZE(3);
-                break;
-        }
+        /* fix up row size */
+        gb_addr_config &= ~ROW_SIZE_MASK;
         switch (rdev->config.si.mem_row_size_in_kb) {
         case 1:
         default:
@@ -1745,26 +1616,6 @@ static void si_gpu_init(struct radeon_device *rdev)
                 break;
         }
 
-        tmp = (gb_addr_config & NUM_PIPES_MASK) >> NUM_PIPES_SHIFT;
-        rdev->config.si.num_tile_pipes = (1 << tmp);
-        tmp = (gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT;
-        rdev->config.si.mem_max_burst_length_bytes = (tmp + 1) * 256;
-        tmp = (gb_addr_config & NUM_SHADER_ENGINES_MASK) >> NUM_SHADER_ENGINES_SHIFT;
-        rdev->config.si.num_shader_engines = tmp + 1;
-        tmp = (gb_addr_config & NUM_GPUS_MASK) >> NUM_GPUS_SHIFT;
-        rdev->config.si.num_gpus = tmp + 1;
-        tmp = (gb_addr_config & MULTI_GPU_TILE_SIZE_MASK) >> MULTI_GPU_TILE_SIZE_SHIFT;
-        rdev->config.si.multi_gpu_tile_size = 1 << tmp;
-        tmp = (gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT;
-        rdev->config.si.mem_row_size_in_kb = 1 << tmp;
-
-        gb_backend_map =
-                si_get_tile_pipe_to_backend_map(rdev, rdev->config.si.num_tile_pipes,
-                                                rdev->config.si.num_backends_per_se *
-                                                rdev->config.si.num_shader_engines,
-                                                &rdev->config.si.backend_disable_mask_per_asic,
-                                                rdev->config.si.num_shader_engines);
-
         /* setup tiling info dword.  gb_addr_config is not adequate since it does
          * not have bank info, so create a custom tiling dword.
          * bits 3:0   num_pipes
@@ -1789,33 +1640,29 @@ static void si_gpu_init(struct radeon_device *rdev)
                 rdev->config.si.tile_config |= (3 << 0);
                 break;
         }
-        rdev->config.si.tile_config |=
-                ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT) << 4;
+        if ((mc_arb_ramcfg & NOOFBANK_MASK) >> NOOFBANK_SHIFT)
+                rdev->config.si.tile_config |= 1 << 4;
+        else
+                rdev->config.si.tile_config |= 0 << 4;
         rdev->config.si.tile_config |=
                 ((gb_addr_config & PIPE_INTERLEAVE_SIZE_MASK) >> PIPE_INTERLEAVE_SIZE_SHIFT) << 8;
         rdev->config.si.tile_config |=
                 ((gb_addr_config & ROW_SIZE_MASK) >> ROW_SIZE_SHIFT) << 12;
 
-        rdev->config.si.backend_map = gb_backend_map;
         WREG32(GB_ADDR_CONFIG, gb_addr_config);
         WREG32(DMIF_ADDR_CONFIG, gb_addr_config);
         WREG32(HDP_ADDR_CONFIG, gb_addr_config);
 
-        /* primary versions */
-        WREG32(CC_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(CC_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(CC_GC_SHADER_ARRAY_CONFIG, cc_gc_shader_array_config);
-
-        WREG32(CGTS_TCC_DISABLE, cgts_tcc_disable);
+        si_tiling_mode_table_init(rdev);
 
-        /* user versions */
-        WREG32(GC_USER_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(GC_USER_SYS_RB_BACKEND_DISABLE, cc_rb_backend_disable);
-        WREG32(GC_USER_SHADER_ARRAY_CONFIG, cc_gc_shader_array_config);
+        si_setup_rb(rdev, rdev->config.si.max_shader_engines,
+                    rdev->config.si.max_sh_per_se,
+                    rdev->config.si.max_backends_per_se);
 
-        WREG32(CGTS_USER_TCC_DISABLE, cgts_tcc_disable);
+        si_setup_spi(rdev, rdev->config.si.max_shader_engines,
+                     rdev->config.si.max_sh_per_se,
+                     rdev->config.si.max_cu_per_sh);
 
-        si_tiling_mode_table_init(rdev);
 
         /* set HW defaults for 3D engine */
         WREG32(CP_QUEUE_THRESHOLDS, (ROQ_IB1_START(0x16) |
diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
index 53ea2c42dbd..db406796286 100644
--- a/drivers/gpu/drm/radeon/sid.h
+++ b/drivers/gpu/drm/radeon/sid.h
@@ -24,6 +24,11 @@
 #ifndef SI_H
 #define SI_H
 
+#define TAHITI_RB_BITMAP_WIDTH_PER_SH  2
+
+#define TAHITI_GB_ADDR_CONFIG_GOLDEN        0x12011003
+#define VERDE_GB_ADDR_CONFIG_GOLDEN         0x12010002
+
 #define CG_MULT_THERMAL_STATUS                                  0x714
 #define         ASIC_MAX_TEMP(x)                                ((x) << 0)
 #define         ASIC_MAX_TEMP_MASK                              0x000001ff
@@ -408,6 +413,12 @@
 #define         SOFT_RESET_IA                                   (1 << 15)
 
 #define GRBM_GFX_INDEX                                  0x802C
+#define         INSTANCE_INDEX(x)                       ((x) << 0)
+#define         SH_INDEX(x)                             ((x) << 8)
+#define         SE_INDEX(x)                             ((x) << 16)
+#define         SH_BROADCAST_WRITES                     (1 << 29)
+#define         INSTANCE_BROADCAST_WRITES               (1 << 30)
+#define         SE_BROADCAST_WRITES                     (1 << 31)
 
 #define GRBM_INT_CNTL                                   0x8060
 #       define RDERR_INT_ENABLE                         (1 << 0)
@@ -480,6 +491,8 @@
 #define VGT_TF_MEMORY_BASE                              0x89B8
 
 #define CC_GC_SHADER_ARRAY_CONFIG                       0x89bc
+#define         INACTIVE_CUS_MASK                       0xFFFF0000
+#define         INACTIVE_CUS_SHIFT                      16
 #define GC_USER_SHADER_ARRAY_CONFIG                     0x89c0
 
 #define PA_CL_ENHANCE                                   0x8A14
@@ -688,6 +701,12 @@
 #define RLC_MC_CNTL                                       0xC344
 #define RLC_UCODE_CNTL                                    0xC348
 
+#define PA_SC_RASTER_CONFIG                             0x28350
+#       define RASTER_CONFIG_RB_MAP_0                   0
+#       define RASTER_CONFIG_RB_MAP_1                   1
+#       define RASTER_CONFIG_RB_MAP_2                   2
+#       define RASTER_CONFIG_RB_MAP_3                   3
+
 #define VGT_EVENT_INITIATOR                             0x28a90
 #       define SAMPLE_STREAMOUTSTATS1                   (1 << 0)
 #       define SAMPLE_STREAMOUTSTATS2                   (2 << 0)
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index b67cfcaa661..36f4b28c1b9 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1204,6 +1204,7 @@ int ttm_bo_init(struct ttm_bo_device *bdev,
                         (*destroy)(bo);
                 else
                         kfree(bo);
+                ttm_mem_global_free(mem_glob, acc_size);
                 return -EINVAL;
         }
         bo->destroy = destroy;
@@ -1307,22 +1308,14 @@ int ttm_bo_create(struct ttm_bo_device *bdev,
                         struct ttm_buffer_object **p_bo)
 {
         struct ttm_buffer_object *bo;
-        struct ttm_mem_global *mem_glob = bdev->glob->mem_glob;
         size_t acc_size;
         int ret;
 
-        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
-        ret = ttm_mem_global_alloc(mem_glob, acc_size, false, false);
-        if (unlikely(ret != 0))
-                return ret;
-
         bo = kzalloc(sizeof(*bo), GFP_KERNEL);
-
-        if (unlikely(bo == NULL)) {
-                ttm_mem_global_free(mem_glob, acc_size);
+        if (unlikely(bo == NULL))
                 return -ENOMEM;
-        }
 
+        acc_size = ttm_bo_acc_size(bdev, size, sizeof(struct ttm_buffer_object));
         ret = ttm_bo_init(bdev, bo, size, type, placement, page_alignment,
                                 buffer_start, interruptible,
                           persistent_swap_storage, acc_size, NULL, NULL);
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index 38f9534ac51..5b3c7d135dc 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -190,6 +190,19 @@ find_active_client(struct list_head *head)
         return NULL;
 }
 
+int vga_switcheroo_get_client_state(struct pci_dev *pdev)
+{
+        struct vga_switcheroo_client *client;
+
+        client = find_client_from_pci(&vgasr_priv.clients, pdev);
+        if (!client)
+                return VGA_SWITCHEROO_NOT_FOUND;
+        if (!vgasr_priv.active)
+                return VGA_SWITCHEROO_INIT;
+        return client->pwr_state;
+}
+EXPORT_SYMBOL(vga_switcheroo_get_client_state);
+
 void vga_switcheroo_unregister_client(struct pci_dev *pdev)
 {
         struct vga_switcheroo_client *client;
@@ -291,8 +304,6 @@ static int vga_switchto_stage1(struct vga_switcheroo_client *new_client)
                 vga_switchon(new_client);
 
         vga_set_default_device(new_client->pdev);
-        set_audio_state(new_client->id, VGA_SWITCHEROO_ON);
-
         return 0;
 }
 
@@ -308,6 +319,8 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
 
         active->active = false;
 
+        set_audio_state(active->id, VGA_SWITCHEROO_OFF);
+
         if (new_client->fb_info) {
                 struct fb_event event;
                 event.info = new_client->fb_info;
@@ -321,11 +334,11 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
         if (new_client->ops->reprobe)
                 new_client->ops->reprobe(new_client->pdev);
 
-        set_audio_state(active->id, VGA_SWITCHEROO_OFF);
-
         if (active->pwr_state == VGA_SWITCHEROO_ON)
                 vga_switchoff(active);
 
+        set_audio_state(new_client->id, VGA_SWITCHEROO_ON);
+
         new_client->active = true;
         return 0;
 }
@@ -371,8 +384,9 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
         /* pwr off the device not in use */
         if (strncmp(usercmd, "OFF", 3) == 0) {
                 list_for_each_entry(client, &vgasr_priv.clients, list) {
-                        if (client->active)
+                        if (client->active || client_is_audio(client))
                                 continue;
+                        set_audio_state(client->id, VGA_SWITCHEROO_OFF);
                         if (client->pwr_state == VGA_SWITCHEROO_ON)
                                 vga_switchoff(client);
                 }
@@ -381,10 +395,11 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
         /* pwr on the device not in use */
         if (strncmp(usercmd, "ON", 2) == 0) {
                 list_for_each_entry(client, &vgasr_priv.clients, list) {
-                        if (client->active)
+                        if (client->active || client_is_audio(client))
                                 continue;
                         if (client->pwr_state == VGA_SWITCHEROO_OFF)
                                 vga_switchon(client);
+                        set_audio_state(client->id, VGA_SWITCHEROO_ON);
                 }
                 goto out;
         }
diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
index beb2491db27..a0edd985421 100644
--- a/drivers/i2c/muxes/Kconfig
+++ b/drivers/i2c/muxes/Kconfig
@@ -37,4 +37,16 @@ config I2C_MUX_PCA954x
           This driver can also be built as a module.  If so, the module
           will be called i2c-mux-pca954x.
 
+config I2C_MUX_PINCTRL
+        tristate "pinctrl-based I2C multiplexer"
+        depends on PINCTRL
+        help
+          If you say yes to this option, support will be included for an I2C
+          multiplexer that uses the pinctrl subsystem, i.e. pin multiplexing.
+          This is useful for SoCs whose I2C module's signals can be routed to
+          different sets of pins at run-time.
+
+          This driver can also be built as a module. If so, the module will be
+          called pinctrl-i2cmux.
+
 endmenu
diff --git a/drivers/i2c/muxes/Makefile b/drivers/i2c/muxes/Makefile
index 5826249b29c..76da8692aff 100644
--- a/drivers/i2c/muxes/Makefile
+++ b/drivers/i2c/muxes/Makefile
@@ -4,5 +4,6 @@
 obj-$(CONFIG_I2C_MUX_GPIO)      += i2c-mux-gpio.o
 obj-$(CONFIG_I2C_MUX_PCA9541)   += i2c-mux-pca9541.o
 obj-$(CONFIG_I2C_MUX_PCA954x)   += i2c-mux-pca954x.o
+obj-$(CONFIG_I2C_MUX_PINCTRL)   += i2c-mux-pinctrl.o
 
 ccflags-$(CONFIG_I2C_DEBUG_BUS) := -DDEBUG
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
new file mode 100644
index 00000000000..46a66976347
--- /dev/null
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -0,0 +1,279 @@
+/*
+ * I2C multiplexer using pinctrl API
+ *
+ * Copyright (c) 2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/i2c.h>
+#include <linux/i2c-mux.h>
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/of_i2c.h>
+#include <linux/pinctrl/consumer.h>
+#include <linux/i2c-mux-pinctrl.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+
+struct i2c_mux_pinctrl {
+        struct device *dev;
+        struct i2c_mux_pinctrl_platform_data *pdata;
+        struct pinctrl *pinctrl;
+        struct pinctrl_state **states;
+        struct pinctrl_state *state_idle;
+        struct i2c_adapter *parent;
+        struct i2c_adapter **busses;
+};
+
+static int i2c_mux_pinctrl_select(struct i2c_adapter *adap, void *data,
+                                  u32 chan)
+{
+        struct i2c_mux_pinctrl *mux = data;
+
+        return pinctrl_select_state(mux->pinctrl, mux->states[chan]);
+}
+
+static int i2c_mux_pinctrl_deselect(struct i2c_adapter *adap, void *data,
+                                    u32 chan)
+{
+        struct i2c_mux_pinctrl *mux = data;
+
+        return pinctrl_select_state(mux->pinctrl, mux->state_idle);
+}
+
+#ifdef CONFIG_OF
+static int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
+                                struct platform_device *pdev)
+{
+        struct device_node *np = pdev->dev.of_node;
+        int num_names, i, ret;
+        struct device_node *adapter_np;
+        struct i2c_adapter *adapter;
+
+        if (!np)
+                return 0;
+
+        mux->pdata = devm_kzalloc(&pdev->dev, sizeof(*mux->pdata), GFP_KERNEL);
+        if (!mux->pdata) {
+                dev_err(mux->dev,
+                        "Cannot allocate i2c_mux_pinctrl_platform_data\n");
+                return -ENOMEM;
+        }
+
+        num_names = of_property_count_strings(np, "pinctrl-names");
+        if (num_names < 0) {
+                dev_err(mux->dev, "Cannot parse pinctrl-names: %d\n",
+                        num_names);
+                return num_names;
+        }
+
+        mux->pdata->pinctrl_states = devm_kzalloc(&pdev->dev,
+                sizeof(*mux->pdata->pinctrl_states) * num_names,
+                GFP_KERNEL);
+        if (!mux->pdata->pinctrl_states) {
+                dev_err(mux->dev, "Cannot allocate pinctrl_states\n");
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < num_names; i++) {
+                ret = of_property_read_string_index(np, "pinctrl-names", i,
+                        &mux->pdata->pinctrl_states[mux->pdata->bus_count]);
+                if (ret < 0) {
+                        dev_err(mux->dev, "Cannot parse pinctrl-names: %d\n",
+                                ret);
+                        return ret;
+                }
+                if (!strcmp(mux->pdata->pinctrl_states[mux->pdata->bus_count],
+                            "idle")) {
+                        if (i != num_names - 1) {
+                                dev_err(mux->dev, "idle state must be last\n");
+                                return -EINVAL;
+                        }
+                        mux->pdata->pinctrl_state_idle = "idle";
+                } else {
+                        mux->pdata->bus_count++;
+                }
+        }
+
+        adapter_np = of_parse_phandle(np, "i2c-parent", 0);
+        if (!adapter_np) {
+                dev_err(mux->dev, "Cannot parse i2c-parent\n");
+                return -ENODEV;
+        }
+        adapter = of_find_i2c_adapter_by_node(adapter_np);
+        if (!adapter) {
+                dev_err(mux->dev, "Cannot find parent bus\n");
+                return -ENODEV;
+        }
+        mux->pdata->parent_bus_num = i2c_adapter_id(adapter);
+        put_device(&adapter->dev);
+
+        return 0;
+}
+#else
+static inline int i2c_mux_pinctrl_parse_dt(struct i2c_mux_pinctrl *mux,
+                                           struct platform_device *pdev)
+{
+        return 0;
+}
+#endif
+
+static int __devinit i2c_mux_pinctrl_probe(struct platform_device *pdev)
+{
+        struct i2c_mux_pinctrl *mux;
+        int (*deselect)(struct i2c_adapter *, void *, u32);
+        int i, ret;
+
+        mux = devm_kzalloc(&pdev->dev, sizeof(*mux), GFP_KERNEL);
+        if (!mux) {
+                dev_err(&pdev->dev, "Cannot allocate i2c_mux_pinctrl\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        platform_set_drvdata(pdev, mux);
+
+        mux->dev = &pdev->dev;
+
+        mux->pdata = pdev->dev.platform_data;
+        if (!mux->pdata) {
+                ret = i2c_mux_pinctrl_parse_dt(mux, pdev);
+                if (ret < 0)
+                        goto err;
+        }
+        if (!mux->pdata) {
+                dev_err(&pdev->dev, "Missing platform data\n");
+                ret = -ENODEV;
+                goto err;
+        }
+
+        mux->states = devm_kzalloc(&pdev->dev,
+                                   sizeof(*mux->states) * mux->pdata->bus_count,
+                                   GFP_KERNEL);
+        if (!mux->states) {
+                dev_err(&pdev->dev, "Cannot allocate states\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        mux->busses = devm_kzalloc(&pdev->dev,
+                                   sizeof(mux->busses) * mux->pdata->bus_count,
+                                   GFP_KERNEL);
+        if (!mux->states) {
+                dev_err(&pdev->dev, "Cannot allocate busses\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        mux->pinctrl = devm_pinctrl_get(&pdev->dev);
+        if (IS_ERR(mux->pinctrl)) {
+                ret = PTR_ERR(mux->pinctrl);
+                dev_err(&pdev->dev, "Cannot get pinctrl: %d\n", ret);
+                goto err;
+        }
+        for (i = 0; i < mux->pdata->bus_count; i++) {
+                mux->states[i] = pinctrl_lookup_state(mux->pinctrl,
+                                                mux->pdata->pinctrl_states[i]);
+                        if (IS_ERR(mux->states[i])) {
+                                ret = PTR_ERR(mux->states[i]);
+                                dev_err(&pdev->dev,
+                                        "Cannot look up pinctrl state %s: %d\n",
+                                        mux->pdata->pinctrl_states[i], ret);
+                                goto err;
+                        }
+        }
+        if (mux->pdata->pinctrl_state_idle) {
+                mux->state_idle = pinctrl_lookup_state(mux->pinctrl,
+                                                mux->pdata->pinctrl_state_idle);
+                if (IS_ERR(mux->state_idle)) {
+                        ret = PTR_ERR(mux->state_idle);
+                        dev_err(&pdev->dev,
+                                "Cannot look up pinctrl state %s: %d\n",
+                                mux->pdata->pinctrl_state_idle, ret);
+                        goto err;
+                }
+
+                deselect = i2c_mux_pinctrl_deselect;
+        } else {
+                deselect = NULL;
+        }
+
+        mux->parent = i2c_get_adapter(mux->pdata->parent_bus_num);
+        if (!mux->parent) {
+                dev_err(&pdev->dev, "Parent adapter (%d) not found\n",
+                        mux->pdata->parent_bus_num);
+                ret = -ENODEV;
+                goto err;
+        }
+
+        for (i = 0; i < mux->pdata->bus_count; i++) {
+                u32 bus = mux->pdata->base_bus_num ?
+                                (mux->pdata->base_bus_num + i) : 0;
+
+                mux->busses[i] = i2c_add_mux_adapter(mux->parent, &pdev->dev,
+                                                     mux, bus, i,
+                                                     i2c_mux_pinctrl_select,
+                                                     deselect);
+                if (!mux->busses[i]) {
+                        ret = -ENODEV;
+                        dev_err(&pdev->dev, "Failed to add adapter %d\n", i);
+                        goto err_del_adapter;
+                }
+        }
+
+        return 0;
+
+err_del_adapter:
+        for (; i > 0; i--)
+                i2c_del_mux_adapter(mux->busses[i - 1]);
+        i2c_put_adapter(mux->parent);
+err:
+        return ret;
+}
+
+static int __devexit i2c_mux_pinctrl_remove(struct platform_device *pdev)
+{
+        struct i2c_mux_pinctrl *mux = platform_get_drvdata(pdev);
+        int i;
+
+        for (i = 0; i < mux->pdata->bus_count; i++)
+                i2c_del_mux_adapter(mux->busses[i]);
+
+        i2c_put_adapter(mux->parent);
+
+        return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id i2c_mux_pinctrl_of_match[] __devinitconst = {
+        { .compatible = "i2c-mux-pinctrl", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, i2c_mux_pinctrl_of_match);
+#endif
+
+static struct platform_driver i2c_mux_pinctrl_driver = {
+        .driver = {
+                .name   = "i2c-mux-pinctrl",
+                .owner  = THIS_MODULE,
+                .of_match_table = of_match_ptr(i2c_mux_pinctrl_of_match),
+        },
+        .probe  = i2c_mux_pinctrl_probe,
+        .remove = __devexit_p(i2c_mux_pinctrl_remove),
+};
+module_platform_driver(i2c_mux_pinctrl_driver);
+
+MODULE_DESCRIPTION("pinctrl-based I2C multiplexer driver");
+MODULE_AUTHOR("Stephen Warren <swarren@nvidia.com>");
+MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:i2c-mux-pinctrl");
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 8716066a2f2..bcb507b0cfd 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -236,7 +236,7 @@ static const struct ide_port_ops icside_v6_no_dma_port_ops = {
  */
 static void icside_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 {
-        unsigned long cycle_time;
+        unsigned long cycle_time = 0;
         int use_dma_info = 0;
         const u8 xfer_mode = drive->dma_mode;
 
@@ -271,9 +271,9 @@ static void icside_set_dma_mode(ide_hwif_t *hwif, ide_drive_t *drive)
 
         ide_set_drivedata(drive, (void *)cycle_time);
 
-        printk("%s: %s selected (peak %dMB/s)\n", drive->name,
-                ide_xfer_verbose(xfer_mode),
-                2000 / (unsigned long)ide_get_drivedata(drive));
+        printk(KERN_INFO "%s: %s selected (peak %luMB/s)\n",
+               drive->name, ide_xfer_verbose(xfer_mode),
+               2000 / (cycle_time ? cycle_time : (unsigned long) -1));
 }
 
 static const struct ide_port_ops icside_v6_port_ops = {
@@ -375,8 +375,6 @@ static const struct ide_dma_ops icside_v6_dma_ops = {
         .dma_test_irq           = icside_dma_test_irq,
         .dma_lost_irq           = ide_dma_lost_irq,
 };
-#else
-#define icside_v6_dma_ops NULL
 #endif
 
 static int icside_dma_off_init(ide_hwif_t *hwif, const struct ide_port_info *d)
@@ -456,7 +454,6 @@ err_free:
 static const struct ide_port_info icside_v6_port_info __initdata = {
         .init_dma               = icside_dma_off_init,
         .port_ops               = &icside_v6_no_dma_port_ops,
-        .dma_ops                = &icside_v6_dma_ops,
         .host_flags             = IDE_HFLAG_SERIALIZE | IDE_HFLAG_MMIO,
         .mwdma_mask             = ATA_MWDMA2,
         .swdma_mask             = ATA_SWDMA2,
@@ -518,11 +515,13 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
 
         ecard_set_drvdata(ec, state);
 
+#ifdef CONFIG_BLK_DEV_IDEDMA_ICS
         if (ec->dma != NO_DMA && !request_dma(ec->dma, DRV_NAME)) {
                 d.init_dma = icside_dma_init;
                 d.port_ops = &icside_v6_port_ops;
-        } else
-                d.dma_ops = NULL;
+                d.dma_ops  = &icside_v6_dma_ops;
+        }
+#endif
 
         ret = ide_host_register(host, &d, hws);
         if (ret)
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index 28e344ea514..f1e922e2479 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -167,7 +167,8 @@ static int pcmcia_check_one_config(struct pcmcia_device *pdev, void *priv_data)
 {
         int *is_kme = priv_data;
 
-        if (!(pdev->resource[0]->flags & IO_DATA_PATH_WIDTH_8)) {
+        if ((pdev->resource[0]->flags & IO_DATA_PATH_WIDTH)
+            != IO_DATA_PATH_WIDTH_8) {
                 pdev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
                 pdev->resource[0]->flags |= IO_DATA_PATH_WIDTH_AUTO;
         }
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 55ab284e22f..b18870c455a 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1593,6 +1593,10 @@ static int import_ep(struct c4iw_ep *ep, __be32 peer_ip, struct dst_entry *dst,
                 struct net_device *pdev;
 
                 pdev = ip_dev_find(&init_net, peer_ip);
+                if (!pdev) {
+                        err = -ENODEV;
+                        goto out;
+                }
                 ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
                                         n, pdev, 0);
                 if (!ep->l2t)
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index ee1c577238f..3530c41fcd1 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -140,7 +140,7 @@ static int mlx4_ib_query_device(struct ib_device *ibdev,
         props->max_mr_size         = ~0ull;
         props->page_size_cap       = dev->dev->caps.page_size_cap;
         props->max_qp              = dev->dev->caps.num_qps - dev->dev->caps.reserved_qps;
-        props->max_qp_wr           = dev->dev->caps.max_wqes;
+        props->max_qp_wr           = dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE;
         props->max_sge             = min(dev->dev->caps.max_sq_sg,
                                          dev->dev->caps.max_rq_sg);
         props->max_cq              = dev->dev->caps.num_cqs - dev->dev->caps.reserved_cqs;
@@ -1084,12 +1084,9 @@ static void mlx4_ib_alloc_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
         int total_eqs = 0;
         int i, j, eq;
 
-        /* Init eq table */
-        ibdev->eq_table = NULL;
-        ibdev->eq_added = 0;
-
-        /* Legacy mode? */
-        if (dev->caps.comp_pool == 0)
+        /* Legacy mode or comp_pool is not large enough */
+        if (dev->caps.comp_pool == 0 ||
+            dev->caps.num_ports > dev->caps.comp_pool)
                 return;
 
         eq_per_port = rounddown_pow_of_two(dev->caps.comp_pool/
@@ -1135,7 +1132,10 @@ static void mlx4_ib_alloc_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
 static void mlx4_ib_free_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
 {
         int i;
-        int total_eqs;
+
+        /* no additional eqs were added */
+        if (!ibdev->eq_table)
+                return;
 
         /* Reset the advertised EQ number */
         ibdev->ib_dev.num_comp_vectors = dev->caps.num_comp_vectors;
@@ -1148,12 +1148,7 @@ static void mlx4_ib_free_eqs(struct mlx4_dev *dev, struct mlx4_ib_dev *ibdev)
                 mlx4_release_eq(dev, ibdev->eq_table[i]);
         }
 
-        total_eqs = dev->caps.num_comp_vectors + ibdev->eq_added;
-        memset(ibdev->eq_table, 0, total_eqs * sizeof(int));
         kfree(ibdev->eq_table);
-
-        ibdev->eq_table = NULL;
-        ibdev->eq_added = 0;
 }
 
 static void *mlx4_ib_add(struct mlx4_dev *dev)
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index e62297cc77c..ff36655d23d 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -44,6 +44,14 @@
 #include <linux/mlx4/device.h>
 #include <linux/mlx4/doorbell.h>
 
+enum {
+        MLX4_IB_SQ_MIN_WQE_SHIFT = 6,
+        MLX4_IB_MAX_HEADROOM     = 2048
+};
+
+#define MLX4_IB_SQ_HEADROOM(shift)      ((MLX4_IB_MAX_HEADROOM >> (shift)) + 1)
+#define MLX4_IB_SQ_MAX_SPARE            (MLX4_IB_SQ_HEADROOM(MLX4_IB_SQ_MIN_WQE_SHIFT))
+
 struct mlx4_ib_ucontext {
         struct ib_ucontext      ibucontext;
         struct mlx4_uar         uar;
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index ceb33327091..8d4ed24aef9 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -310,8 +310,8 @@ static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                        int is_user, int has_rq, struct mlx4_ib_qp *qp)
 {
         /* Sanity check RQ size before proceeding */
-        if (cap->max_recv_wr  > dev->dev->caps.max_wqes  ||
-            cap->max_recv_sge > dev->dev->caps.max_rq_sg)
+        if (cap->max_recv_wr > dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE ||
+            cap->max_recv_sge > min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg))
                 return -EINVAL;
 
         if (!has_rq) {
@@ -329,8 +329,17 @@ static int set_rq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
                 qp->rq.wqe_shift = ilog2(qp->rq.max_gs * sizeof (struct mlx4_wqe_data_seg));
         }
 
-        cap->max_recv_wr  = qp->rq.max_post = qp->rq.wqe_cnt;
-        cap->max_recv_sge = qp->rq.max_gs;
+        /* leave userspace return values as they were, so as not to break ABI */
+        if (is_user) {
+                cap->max_recv_wr  = qp->rq.max_post = qp->rq.wqe_cnt;
+                cap->max_recv_sge = qp->rq.max_gs;
+        } else {
+                cap->max_recv_wr  = qp->rq.max_post =
+                        min(dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE, qp->rq.wqe_cnt);
+                cap->max_recv_sge = min(qp->rq.max_gs,
+                                        min(dev->dev->caps.max_sq_sg,
+                                            dev->dev->caps.max_rq_sg));
+        }
 
         return 0;
 }
@@ -341,8 +350,8 @@ static int set_kernel_sq_size(struct mlx4_ib_dev *dev, struct ib_qp_cap *cap,
         int s;
 
         /* Sanity check SQ size before proceeding */
-        if (cap->max_send_wr     > dev->dev->caps.max_wqes  ||
-            cap->max_send_sge    > dev->dev->caps.max_sq_sg ||
+        if (cap->max_send_wr  > (dev->dev->caps.max_wqes - MLX4_IB_SQ_MAX_SPARE) ||
+            cap->max_send_sge > min(dev->dev->caps.max_sq_sg, dev->dev->caps.max_rq_sg) ||
             cap->max_inline_data + send_wqe_overhead(type, qp->flags) +
             sizeof (struct mlx4_wqe_inline_seg) > dev->dev->caps.max_sq_desc_sz)
                 return -EINVAL;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma.h b/drivers/infiniband/hw/ocrdma/ocrdma.h
index 85a69c95855..037f5cea85b 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma.h
@@ -231,7 +231,6 @@ struct ocrdma_qp_hwq_info {
         u32 entry_size;
         u32 max_cnt;
         u32 max_wqe_idx;
-        u32 free_delta;
         u16 dbid;               /* qid, where to ring the doorbell. */
         u32 len;
         dma_addr_t pa;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
index a411a4e3193..517ab20b727 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_abi.h
@@ -101,8 +101,6 @@ struct ocrdma_create_qp_uresp {
         u32 rsvd1;
         u32 num_wqe_allocated;
         u32 num_rqe_allocated;
-        u32 free_wqe_delta;
-        u32 free_rqe_delta;
         u32 db_sq_offset;
         u32 db_rq_offset;
         u32 db_shift;
@@ -126,8 +124,7 @@ struct ocrdma_create_srq_uresp {
         u32 db_rq_offset;
         u32 db_shift;
 
-        u32 free_rqe_delta;
-        u32 rsvd2;
+        u64 rsvd2;
         u64 rsvd3;
 } __packed;
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
index 9b204b1ba33..9343a152297 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_hw.c
@@ -732,7 +732,7 @@ static void ocrdma_dispatch_ibevent(struct ocrdma_dev *dev,
                 break;
         case OCRDMA_SRQ_LIMIT_EVENT:
                 ib_evt.element.srq = &qp->srq->ibsrq;
-                ib_evt.event = IB_EVENT_QP_LAST_WQE_REACHED;
+                ib_evt.event = IB_EVENT_SRQ_LIMIT_REACHED;
                 srq_event = 1;
                 qp_event = 0;
                 break;
@@ -1990,19 +1990,12 @@ static void ocrdma_get_create_qp_rsp(struct ocrdma_create_qp_rsp *rsp,
         max_wqe_allocated = 1 << max_wqe_allocated;
         max_rqe_allocated = 1 << ((u16)rsp->max_wqe_rqe);
 
-        if (qp->dev->nic_info.dev_family == OCRDMA_GEN2_FAMILY) {
-                qp->sq.free_delta = 0;
-                qp->rq.free_delta = 1;
-        } else
-                qp->sq.free_delta = 1;
-
         qp->sq.max_cnt = max_wqe_allocated;
         qp->sq.max_wqe_idx = max_wqe_allocated - 1;
 
         if (!attrs->srq) {
                 qp->rq.max_cnt = max_rqe_allocated;
                 qp->rq.max_wqe_idx = max_rqe_allocated - 1;
-                qp->rq.free_delta = 1;
         }
 }
 
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index a20d16eaae7..04fef3de6d7 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -26,7 +26,6 @@
  *******************************************************************/
 
 #include <linux/module.h>
-#include <linux/version.h>
 #include <linux/idr.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/ib_user_verbs.h>
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index e9f74d1b48f..d16d172b6b6 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -940,8 +940,6 @@ static int ocrdma_copy_qp_uresp(struct ocrdma_qp *qp,
                 uresp.db_rq_offset = OCRDMA_DB_RQ_OFFSET;
                 uresp.db_shift = 16;
         }
-        uresp.free_wqe_delta = qp->sq.free_delta;
-        uresp.free_rqe_delta = qp->rq.free_delta;
 
         if (qp->dpp_enabled) {
                 uresp.dpp_credit = dpp_credit_lmt;
@@ -1307,8 +1305,6 @@ static int ocrdma_hwq_free_cnt(struct ocrdma_qp_hwq_info *q)
                 free_cnt = (q->max_cnt - q->head) + q->tail;
         else
                 free_cnt = q->tail - q->head;
-        if (q->free_delta)
-                free_cnt -= q->free_delta;
         return free_cnt;
 }
 
@@ -1501,7 +1497,6 @@ static int ocrdma_copy_srq_uresp(struct ocrdma_srq *srq, struct ib_udata *udata)
             (srq->pd->id * srq->dev->nic_info.db_page_size);
         uresp.db_page_size = srq->dev->nic_info.db_page_size;
         uresp.num_rqe_allocated = srq->rq.max_cnt;
-        uresp.free_rqe_delta = 1;
         if (srq->dev->nic_info.dev_family == OCRDMA_GEN2_FAMILY) {
                 uresp.db_rq_offset = OCRDMA_DB_GEN2_RQ1_OFFSET;
                 uresp.db_shift = 24;
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
index e6483439f25..633f03d8027 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h
@@ -28,7 +28,6 @@
 #ifndef __OCRDMA_VERBS_H__
 #define __OCRDMA_VERBS_H__
 
-#include <linux/version.h>
 int ocrdma_post_send(struct ib_qp *, struct ib_send_wr *,
                      struct ib_send_wr **bad_wr);
 int ocrdma_post_recv(struct ib_qp *, struct ib_recv_wr *,
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index d90a421e9ca..a2e418cba0f 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -547,26 +547,12 @@ static void iommu_poll_events(struct amd_iommu *iommu)
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u32 head)
+static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u64 *raw)
 {
         struct amd_iommu_fault fault;
-        volatile u64 *raw;
-        int i;
 
         INC_STATS_COUNTER(pri_requests);
 
-        raw = (u64 *)(iommu->ppr_log + head);
-
-        /*
-         * Hardware bug: Interrupt may arrive before the entry is written to
-         * memory. If this happens we need to wait for the entry to arrive.
-         */
-        for (i = 0; i < LOOP_TIMEOUT; ++i) {
-                if (PPR_REQ_TYPE(raw[0]) != 0)
-                        break;
-                udelay(1);
-        }
-
         if (PPR_REQ_TYPE(raw[0]) != PPR_REQ_FAULT) {
                 pr_err_ratelimited("AMD-Vi: Unknown PPR request received\n");
                 return;
@@ -578,12 +564,6 @@ static void iommu_handle_ppr_entry(struct amd_iommu *iommu, u32 head)
         fault.tag       = PPR_TAG(raw[0]);
         fault.flags     = PPR_FLAGS(raw[0]);
 
-        /*
-         * To detect the hardware bug we need to clear the entry
-         * to back to zero.
-         */
-        raw[0] = raw[1] = 0;
-
         atomic_notifier_call_chain(&ppr_notifier, 0, &fault);
 }
 
@@ -595,25 +575,62 @@ static void iommu_poll_ppr_log(struct amd_iommu *iommu)
         if (iommu->ppr_log == NULL)
                 return;
 
+        /* enable ppr interrupts again */
+        writel(MMIO_STATUS_PPR_INT_MASK, iommu->mmio_base + MMIO_STATUS_OFFSET);
+
         spin_lock_irqsave(&iommu->lock, flags);
 
         head = readl(iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
         tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
 
         while (head != tail) {
+                volatile u64 *raw;
+                u64 entry[2];
+                int i;
 
-                /* Handle PPR entry */
-                iommu_handle_ppr_entry(iommu, head);
+                raw = (u64 *)(iommu->ppr_log + head);
+
+                /*
+                 * Hardware bug: Interrupt may arrive before the entry is
+                 * written to memory. If this happens we need to wait for the
+                 * entry to arrive.
+                 */
+                for (i = 0; i < LOOP_TIMEOUT; ++i) {
+                        if (PPR_REQ_TYPE(raw[0]) != 0)
+                                break;
+                        udelay(1);
+                }
+
+                /* Avoid memcpy function-call overhead */
+                entry[0] = raw[0];
+                entry[1] = raw[1];
 
-                /* Update and refresh ring-buffer state*/
+                /*
+                 * To detect the hardware bug we need to clear the entry
+                 * back to zero.
+                 */
+                raw[0] = raw[1] = 0UL;
+
+                /* Update head pointer of hardware ring-buffer */
                 head = (head + PPR_ENTRY_SIZE) % PPR_LOG_SIZE;
                 writel(head, iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
+
+                /*
+                 * Release iommu->lock because ppr-handling might need to
+                 * re-aquire it
+                 */
+                spin_unlock_irqrestore(&iommu->lock, flags);
+
+                /* Handle PPR entry */
+                iommu_handle_ppr_entry(iommu, entry);
+
+                spin_lock_irqsave(&iommu->lock, flags);
+
+                /* Refresh ring-buffer information */
+                head = readl(iommu->mmio_base + MMIO_PPR_HEAD_OFFSET);
                 tail = readl(iommu->mmio_base + MMIO_PPR_TAIL_OFFSET);
         }
 
-        /* enable ppr interrupts again */
-        writel(MMIO_STATUS_PPR_INT_MASK, iommu->mmio_base + MMIO_STATUS_OFFSET);
-
         spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index c56790375e0..542024ba6db 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -1029,6 +1029,9 @@ static int __init init_iommu_one(struct amd_iommu *iommu, struct ivhd_header *h)
         if (!iommu->dev)
                 return 1;
 
+        iommu->root_pdev = pci_get_bus_and_slot(iommu->dev->bus->number,
+                                                PCI_DEVFN(0, 0));
+
         iommu->cap_ptr = h->cap_ptr;
         iommu->pci_seg = h->pci_seg;
         iommu->mmio_phys = h->mmio_phys;
@@ -1323,20 +1326,16 @@ static void iommu_apply_resume_quirks(struct amd_iommu *iommu)
 {
         int i, j;
         u32 ioc_feature_control;
-        struct pci_dev *pdev = NULL;
+        struct pci_dev *pdev = iommu->root_pdev;
 
         /* RD890 BIOSes may not have completely reconfigured the iommu */
-        if (!is_rd890_iommu(iommu->dev))
+        if (!is_rd890_iommu(iommu->dev) || !pdev)
                 return;
 
         /*
          * First, we need to ensure that the iommu is enabled. This is
          * controlled by a register in the northbridge
          */
-        pdev = pci_get_bus_and_slot(iommu->dev->bus->number, PCI_DEVFN(0, 0));
-
-        if (!pdev)
-                return;
 
         /* Select Northbridge indirect register 0x75 and enable writing */
         pci_write_config_dword(pdev, 0x60, 0x75 | (1 << 7));
@@ -1346,8 +1345,6 @@ static void iommu_apply_resume_quirks(struct amd_iommu *iommu)
         if (!(ioc_feature_control & 0x1))
                 pci_write_config_dword(pdev, 0x64, ioc_feature_control | 1);
 
-        pci_dev_put(pdev);
-
         /* Restore the iommu BAR */
         pci_write_config_dword(iommu->dev, iommu->cap_ptr + 4,
                                iommu->stored_addr_lo);
diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
index 2452f3b7173..24355559a2a 100644
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -481,6 +481,9 @@ struct amd_iommu {
         /* Pointer to PCI device of this IOMMU */
         struct pci_dev *dev;
 
+        /* Cache pdev to root device for resume quirks */
+        struct pci_dev *root_pdev;
+
         /* physical address of MMIO space */
         u64 mmio_phys;
         /* virtual address of MMIO space */
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 04cb8c88d74..12b2b55c519 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -379,7 +379,7 @@ config LEDS_NETXBIG
 
 config LEDS_ASIC3
         bool "LED support for the HTC ASIC3"
-        depends on LEDS_CLASS
+        depends on LEDS_CLASS=y
         depends on MFD_ASIC3
         default y
         help
@@ -390,7 +390,7 @@ config LEDS_ASIC3
 
 config LEDS_RENESAS_TPU
         bool "LED support for Renesas TPU"
-        depends on LEDS_CLASS && HAVE_CLK && GENERIC_GPIO
+        depends on LEDS_CLASS=y && HAVE_CLK && GENERIC_GPIO
         help
           This option enables build of the LED TPU platform driver,
           suitable to drive any TPU channel on newer Renesas SoCs.
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index 8ee92c81aec..e663e6f413e 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -29,7 +29,7 @@ static void led_update_brightness(struct led_classdev *led_cdev)
                 led_cdev->brightness = led_cdev->brightness_get(led_cdev);
 }
 
-static ssize_t led_brightness_show(struct device *dev, 
+static ssize_t led_brightness_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
         struct led_classdev *led_cdev = dev_get_drvdata(dev);
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index d6860043f6f..d65353d8d3f 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -44,13 +44,6 @@ static void led_set_software_blink(struct led_classdev *led_cdev,
         if (!led_cdev->blink_brightness)
                 led_cdev->blink_brightness = led_cdev->max_brightness;
 
-        if (led_get_trigger_data(led_cdev) &&
-            delay_on == led_cdev->blink_delay_on &&
-            delay_off == led_cdev->blink_delay_off)
-                return;
-
-        led_stop_software_blink(led_cdev);
-
         led_cdev->blink_delay_on = delay_on;
         led_cdev->blink_delay_off = delay_off;
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 835de7168cd..a9c7981ddd2 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2550,6 +2550,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
         err = -EINVAL;
         spin_lock_init(&conf->device_lock);
         rdev_for_each(rdev, mddev) {
+                struct request_queue *q;
                 int disk_idx = rdev->raid_disk;
                 if (disk_idx >= mddev->raid_disks
                     || disk_idx < 0)
@@ -2562,6 +2563,9 @@ static struct r1conf *setup_conf(struct mddev *mddev)
                 if (disk->rdev)
                         goto abort;
                 disk->rdev = rdev;
+                q = bdev_get_queue(rdev->bdev);
+                if (q->merge_bvec_fn)
+                        mddev->merge_check_needed = 1;
 
                 disk->head_position = 0;
         }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 987db37cb87..99ae6068e45 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3475,6 +3475,7 @@ static int run(struct mddev *mddev)
 
         rdev_for_each(rdev, mddev) {
                 long long diff;
+                struct request_queue *q;
 
                 disk_idx = rdev->raid_disk;
                 if (disk_idx < 0)
@@ -3493,6 +3494,9 @@ static int run(struct mddev *mddev)
                                 goto out_free_conf;
                         disk->rdev = rdev;
                 }
+                q = bdev_get_queue(rdev->bdev);
+                if (q->merge_bvec_fn)
+                        mddev->merge_check_needed = 1;
                 diff = (rdev->new_data_offset - rdev->data_offset);
                 if (!mddev->reshape_backwards)
                         diff = -diff;
diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c
index 9f957c2d48e..09d4f8d9d59 100644
--- a/drivers/mtd/ubi/debug.c
+++ b/drivers/mtd/ubi/debug.c
@@ -264,6 +264,9 @@ static struct dentry *dfs_rootdir;
  */
 int ubi_debugfs_init(void)
 {
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         dfs_rootdir = debugfs_create_dir("ubi", NULL);
         if (IS_ERR_OR_NULL(dfs_rootdir)) {
                 int err = dfs_rootdir ? -ENODEV : PTR_ERR(dfs_rootdir);
@@ -281,7 +284,8 @@ int ubi_debugfs_init(void)
  */
 void ubi_debugfs_exit(void)
 {
-        debugfs_remove(dfs_rootdir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove(dfs_rootdir);
 }
 
 /* Read an UBI debugfs file */
@@ -403,6 +407,9 @@ int ubi_debugfs_init_dev(struct ubi_device *ubi)
         struct dentry *dent;
         struct ubi_debug_info *d = ubi->dbg;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         n = snprintf(d->dfs_dir_name, UBI_DFS_DIR_LEN + 1, UBI_DFS_DIR_NAME,
                      ubi->ubi_num);
         if (n == UBI_DFS_DIR_LEN) {
@@ -470,5 +477,6 @@ out:
  */
 void ubi_debugfs_exit_dev(struct ubi_device *ubi)
 {
-        debugfs_remove_recursive(ubi->dbg->dfs_dir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(ubi->dbg->dfs_dir);
 }
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 9df100a4ec3..b6be644e7b8 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -1262,11 +1262,11 @@ int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
         dbg_wl("flush pending work for LEB %d:%d (%d pending works)",
                vol_id, lnum, ubi->works_count);
 
-        down_write(&ubi->work_sem);
         while (found) {
                 struct ubi_work *wrk;
                 found = 0;
 
+                down_read(&ubi->work_sem);
                 spin_lock(&ubi->wl_lock);
                 list_for_each_entry(wrk, &ubi->works, list) {
                         if ((vol_id == UBI_ALL || wrk->vol_id == vol_id) &&
@@ -1277,18 +1277,27 @@ int ubi_wl_flush(struct ubi_device *ubi, int vol_id, int lnum)
                                 spin_unlock(&ubi->wl_lock);
 
                                 err = wrk->func(ubi, wrk, 0);
-                                if (err)
-                                        goto out;
+                                if (err) {
+                                        up_read(&ubi->work_sem);
+                                        return err;
+                                }
+
                                 spin_lock(&ubi->wl_lock);
                                 found = 1;
                                 break;
                         }
                 }
                 spin_unlock(&ubi->wl_lock);
+                up_read(&ubi->work_sem);
         }
 
-out:
+        /*
+         * Make sure all the works which have been done in parallel are
+         * finished.
+         */
+        down_write(&ubi->work_sem);
         up_write(&ubi->work_sem);
+
         return err;
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 2ee8cf9e8a3..b9c2ae62166 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -76,6 +76,7 @@
 #include <net/route.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
+#include <net/pkt_sched.h>
 #include "bonding.h"
 #include "bond_3ad.h"
 #include "bond_alb.h"
@@ -381,8 +382,6 @@ struct vlan_entry *bond_next_vlan(struct bonding *bond, struct vlan_entry *curr)
         return next;
 }
 
-#define bond_queue_mapping(skb) (*(u16 *)((skb)->cb))
-
 /**
  * bond_dev_queue_xmit - Prepare skb for xmit.
  *
@@ -395,7 +394,9 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
 {
         skb->dev = slave_dev;
 
-        skb->queue_mapping = bond_queue_mapping(skb);
+        BUILD_BUG_ON(sizeof(skb->queue_mapping) !=
+                     sizeof(qdisc_skb_cb(skb)->bond_queue_mapping));
+        skb->queue_mapping = qdisc_skb_cb(skb)->bond_queue_mapping;
 
         if (unlikely(netpoll_tx_running(slave_dev)))
                 bond_netpoll_send_skb(bond_get_slave_by_dev(bond, slave_dev), skb);
@@ -4171,7 +4172,7 @@ static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
         /*
          * Save the original txq to restore before passing to the driver
          */
-        bond_queue_mapping(skb) = skb->queue_mapping;
+        qdisc_skb_cb(skb)->bond_queue_mapping = skb->queue_mapping;
 
         if (unlikely(txq >= dev->real_num_tx_queues)) {
                 do {
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index aef42f04532..485bedb8278 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1082,8 +1082,12 @@ static ssize_t bonding_store_primary(struct device *d,
                 }
         }
 
-        pr_info("%s: Unable to set %.*s as primary slave.\n",
-                bond->dev->name, (int)strlen(buf) - 1, buf);
+        strncpy(bond->params.primary, ifname, IFNAMSIZ);
+        bond->params.primary[IFNAMSIZ - 1] = 0;
+
+        pr_info("%s: Recording %s as primary, "
+                "but it has not been enslaved to %s yet.\n",
+                bond->dev->name, ifname, bond->dev->name);
 out:
         write_unlock_bh(&bond->curr_slave_lock);
         read_unlock(&bond->lock);
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 536bda072a1..8dc84d66eea 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -686,7 +686,7 @@ static int c_can_get_berr_counter(const struct net_device *dev,
  *
  * We iterate from priv->tx_echo to priv->tx_next and check if the
  * packet has been transmitted, echo it back to the CAN framework.
- * If we discover a not yet transmitted package, stop looking for more.
+ * If we discover a not yet transmitted packet, stop looking for more.
  */
 static void c_can_do_tx(struct net_device *dev)
 {
@@ -698,7 +698,7 @@ static void c_can_do_tx(struct net_device *dev)
         for (/* nix */; (priv->tx_next - priv->tx_echo) > 0; priv->tx_echo++) {
                 msg_obj_no = get_tx_echo_msg_obj(priv);
                 val = c_can_read_reg32(priv, &priv->regs->txrqst1);
-                if (!(val & (1 << msg_obj_no))) {
+                if (!(val & (1 << (msg_obj_no - 1)))) {
                         can_get_echo_skb(dev,
                                         msg_obj_no - C_CAN_MSG_OBJ_TX_FIRST);
                         stats->tx_bytes += priv->read_reg(priv,
@@ -706,6 +706,8 @@ static void c_can_do_tx(struct net_device *dev)
                                         & IF_MCONT_DLC_MASK;
                         stats->tx_packets++;
                         c_can_inval_msg_object(dev, 0, msg_obj_no);
+                } else {
+                        break;
                 }
         }
 
@@ -950,7 +952,7 @@ static int c_can_poll(struct napi_struct *napi, int quota)
         struct net_device *dev = napi->dev;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
+        irqstatus = priv->irqstatus;
         if (!irqstatus)
                 goto end;
 
@@ -1028,12 +1030,11 @@ end:
 
 static irqreturn_t c_can_isr(int irq, void *dev_id)
 {
-        u16 irqstatus;
         struct net_device *dev = (struct net_device *)dev_id;
         struct c_can_priv *priv = netdev_priv(dev);
 
-        irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
-        if (!irqstatus)
+        priv->irqstatus = priv->read_reg(priv, &priv->regs->interrupt);
+        if (!priv->irqstatus)
                 return IRQ_NONE;
 
         /* disable all interrupts and schedule the NAPI */
@@ -1063,10 +1064,11 @@ static int c_can_open(struct net_device *dev)
                 goto exit_irq_fail;
         }
 
+        napi_enable(&priv->napi);
+
         /* start the c_can controller */
         c_can_start(dev);
 
-        napi_enable(&priv->napi);
         netif_start_queue(dev);
 
         return 0;
diff --git a/drivers/net/can/c_can/c_can.h b/drivers/net/can/c_can/c_can.h
index 9b7fbef3d09..5f32d34af50 100644
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -76,6 +76,7 @@ struct c_can_priv {
         unsigned int tx_next;
         unsigned int tx_echo;
         void *priv;             /* for board-specific data */
+        u16 irqstatus;
 };
 
 struct net_device *alloc_c_can_dev(void);
diff --git a/drivers/net/can/cc770/cc770_platform.c b/drivers/net/can/cc770/cc770_platform.c
index 53115eee807..688371cda37 100644
--- a/drivers/net/can/cc770/cc770_platform.c
+++ b/drivers/net/can/cc770/cc770_platform.c
@@ -154,7 +154,7 @@ static int __devinit cc770_get_platform_data(struct platform_device *pdev,
         struct cc770_platform_data *pdata = pdev->dev.platform_data;
 
         priv->can.clock.freq = pdata->osc_freq;
-        if (priv->cpu_interface | CPUIF_DSC)
+        if (priv->cpu_interface & CPUIF_DSC)
                 priv->can.clock.freq /= 2;
         priv->clkout = pdata->cor;
         priv->bus_config = pdata->bcr;
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 442d91a2747..bab0158f1cc 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -187,8 +187,10 @@ static int __init dummy_init_module(void)
         rtnl_lock();
         err = __rtnl_link_register(&dummy_link_ops);
 
-        for (i = 0; i < numdummies && !err; i++)
+        for (i = 0; i < numdummies && !err; i++) {
                 err = dummy_init_one();
+                cond_resched();
+        }
         if (err < 0)
                 __rtnl_link_unregister(&dummy_link_ops);
         rtnl_unlock();
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index e30e2a2f354..7de82418497 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -747,21 +747,6 @@ struct bnx2x_fastpath {
 
 #define ETH_RX_ERROR_FALGS              ETH_FAST_PATH_RX_CQE_PHY_DECODE_ERR_FLG
 
-#define BNX2X_IP_CSUM_ERR(cqe) \
-                        (!((cqe)->fast_path_cqe.status_flags & \
-                           ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG) && \
-                         ((cqe)->fast_path_cqe.type_error_flags & \
-                          ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG))
-
-#define BNX2X_L4_CSUM_ERR(cqe) \
-                        (!((cqe)->fast_path_cqe.status_flags & \
-                           ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG) && \
-                         ((cqe)->fast_path_cqe.type_error_flags & \
-                          ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
-
-#define BNX2X_RX_CSUM_OK(cqe) \
-                        (!(BNX2X_L4_CSUM_ERR(cqe) || BNX2X_IP_CSUM_ERR(cqe)))
-
 #define BNX2X_PRS_FLAG_OVERETH_IPV4(flags) \
                                 (((le16_to_cpu(flags) & \
                                    PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) >> \
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ad0743bf4bd..cbc56f274e0 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -617,6 +617,25 @@ static int bnx2x_alloc_rx_data(struct bnx2x *bp,
         return 0;
 }
 
+static void bnx2x_csum_validate(struct sk_buff *skb, union eth_rx_cqe *cqe,
+                                struct bnx2x_fastpath *fp)
+{
+        /* Do nothing if no IP/L4 csum validation was done */
+
+        if (cqe->fast_path_cqe.status_flags &
+            (ETH_FAST_PATH_RX_CQE_IP_XSUM_NO_VALIDATION_FLG |
+             ETH_FAST_PATH_RX_CQE_L4_XSUM_NO_VALIDATION_FLG))
+                return;
+
+        /* If both IP/L4 validation were done, check if an error was found. */
+
+        if (cqe->fast_path_cqe.type_error_flags &
+            (ETH_FAST_PATH_RX_CQE_IP_BAD_XSUM_FLG |
+             ETH_FAST_PATH_RX_CQE_L4_BAD_XSUM_FLG))
+                fp->eth_q_stats.hw_csum_err++;
+        else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
 
 int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
 {
@@ -806,13 +825,9 @@ reuse_rx:
 
                 skb_checksum_none_assert(skb);
 
-                if (bp->dev->features & NETIF_F_RXCSUM) {
+                if (bp->dev->features & NETIF_F_RXCSUM)
+                        bnx2x_csum_validate(skb, cqe, fp);
 
-                        if (likely(BNX2X_RX_CSUM_OK(cqe)))
-                                skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        else
-                                fp->eth_q_stats.hw_csum_err++;
-                }
 
                 skb_record_rx_queue(skb, fp->rx_queue);
 
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index edeeb516807..e47ff8be1d7 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -14275,7 +14275,8 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 }
         }
 
-        if (tg3_flag(tp, 5755_PLUS))
+        if (tg3_flag(tp, 5755_PLUS) ||
+            GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)
                 tg3_flag_set(tp, SHORT_DMA_BUG);
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719)
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 08efd308d78..fdb50cec6b5 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -736,6 +736,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
 
         copied = make_tx_wrbs(adapter, txq, skb, wrb_cnt, dummy_wrb);
         if (copied) {
+                int gso_segs = skb_shinfo(skb)->gso_segs;
+
                 /* record the sent skb in the sent_skb table */
                 BUG_ON(txo->sent_skb_list[start]);
                 txo->sent_skb_list[start] = skb;
@@ -753,8 +755,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb,
 
                 be_txq_notify(adapter, txq->id, wrb_cnt);
 
-                be_tx_stats_update(txo, wrb_cnt, copied,
-                                skb_shinfo(skb)->gso_segs, stopped);
+                be_tx_stats_update(txo, wrb_cnt, copied, gso_segs, stopped);
         } else {
                 txq->head = start;
                 dev_kfree_skb_any(skb);
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index d863075df7a..905e2147d91 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -258,7 +258,8 @@ static int e1000_set_settings(struct net_device *netdev,
          * When SoL/IDER sessions are active, autoneg/speed/duplex
          * cannot be changed
          */
-        if (hw->phy.ops.check_reset_block(hw)) {
+        if (hw->phy.ops.check_reset_block &&
+            hw->phy.ops.check_reset_block(hw)) {
                 e_err("Cannot change link characteristics when SoL/IDER is active.\n");
                 return -EINVAL;
         }
@@ -1615,7 +1616,8 @@ static int e1000_loopback_test(struct e1000_adapter *adapter, u64 *data)
          * PHY loopback cannot be performed if SoL/IDER
          * sessions are active
          */
-        if (hw->phy.ops.check_reset_block(hw)) {
+        if (hw->phy.ops.check_reset_block &&
+            hw->phy.ops.check_reset_block(hw)) {
                 e_err("Cannot do PHY loopback test when SoL/IDER is active.\n");
                 *data = 0;
                 goto out;
diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c
index 026e8b3ab52..a1343992848 100644
--- a/drivers/net/ethernet/intel/e1000e/mac.c
+++ b/drivers/net/ethernet/intel/e1000e/mac.c
@@ -709,7 +709,7 @@ s32 e1000e_setup_link_generic(struct e1000_hw *hw)
          * In the case of the phy reset being blocked, we already have a link.
          * We do not need to set it up again.
          */
-        if (hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
                 return 0;
 
         /*
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index a4b0435b00d..31d37a2b5ba 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -6237,7 +6237,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 adapter->hw.phy.ms_type = e1000_ms_hw_default;
         }
 
-        if (hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && hw->phy.ops.check_reset_block(hw))
                 e_info("PHY reset is blocked due to SOL/IDER session.\n");
 
         /* Set initial default active device features */
@@ -6404,7 +6404,7 @@ err_register:
         if (!(adapter->flags & FLAG_HAS_AMT))
                 e1000e_release_hw_control(adapter);
 err_eeprom:
-        if (!hw->phy.ops.check_reset_block(hw))
+        if (hw->phy.ops.check_reset_block && !hw->phy.ops.check_reset_block(hw))
                 e1000_phy_hw_reset(&adapter->hw);
 err_hw_init:
         kfree(adapter->tx_ring);
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index 0334d013bc3..b860d4f7ea2 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -2155,9 +2155,11 @@ s32 e1000e_phy_hw_reset_generic(struct e1000_hw *hw)
         s32 ret_val;
         u32 ctrl;
 
-        ret_val = phy->ops.check_reset_block(hw);
-        if (ret_val)
-                return 0;
+        if (phy->ops.check_reset_block) {
+                ret_val = phy->ops.check_reset_block(hw);
+                if (ret_val)
+                        return 0;
+        }
 
         ret_val = phy->ops.acquire(hw);
         if (ret_val)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index bf20457ea23..17ad6a3c1be 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1390,6 +1390,8 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
                                      union ixgbe_adv_rx_desc *rx_desc,
                                      struct sk_buff *skb)
 {
+        struct net_device *dev = rx_ring->netdev;
+
         ixgbe_update_rsc_stats(rx_ring, skb);
 
         ixgbe_rx_hash(rx_ring, rx_desc, skb);
@@ -1401,14 +1403,15 @@ static void ixgbe_process_skb_fields(struct ixgbe_ring *rx_ring,
                 ixgbe_ptp_rx_hwtstamp(rx_ring->q_vector, skb);
 #endif
 
-        if (ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
+        if ((dev->features & NETIF_F_HW_VLAN_RX) &&
+            ixgbe_test_staterr(rx_desc, IXGBE_RXD_STAT_VP)) {
                 u16 vid = le16_to_cpu(rx_desc->wb.upper.vlan);
                 __vlan_hwaccel_put_tag(skb, vid);
         }
 
         skb_record_rx_queue(skb, rx_ring->queue_index);
 
-        skb->protocol = eth_type_trans(skb, rx_ring->netdev);
+        skb->protocol = eth_type_trans(skb, dev);
 }
 
 static void ixgbe_rx_skb(struct ixgbe_q_vector *q_vector,
@@ -3607,10 +3610,6 @@ static void ixgbe_configure_dcb(struct ixgbe_adapter *adapter)
         if (hw->mac.type == ixgbe_mac_82598EB)
                 netif_set_gso_max_size(adapter->netdev, 32768);
 
-
-        /* Enable VLAN tag insert/strip */
-        adapter->netdev->features |= NETIF_F_HW_VLAN_RX;
-
         hw->mac.ops.set_vfta(&adapter->hw, 0, 0, true);
 
 #ifdef IXGBE_FCOE
@@ -6701,11 +6700,6 @@ static netdev_features_t ixgbe_fix_features(struct net_device *netdev,
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
 
-#ifdef CONFIG_DCB
-        if (adapter->flags & IXGBE_FLAG_DCB_ENABLED)
-                features &= ~NETIF_F_HW_VLAN_RX;
-#endif
-
         /* return error if RXHASH is being enabled when RSS is not supported */
         if (!(adapter->flags & IXGBE_FLAG_RSS_ENABLED))
                 features &= ~NETIF_F_RXHASH;
@@ -6718,7 +6712,6 @@ static netdev_features_t ixgbe_fix_features(struct net_device *netdev,
         if (!(adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE))
                 features &= ~NETIF_F_LRO;
 
-
         return features;
 }
 
@@ -6766,6 +6759,11 @@ static int ixgbe_set_features(struct net_device *netdev,
                 need_reset = true;
         }
 
+        if (features & NETIF_F_HW_VLAN_RX)
+                ixgbe_vlan_strip_enable(adapter);
+        else
+                ixgbe_vlan_strip_disable(adapter);
+
         if (changed & NETIF_F_RXALL)
                 need_reset = true;
 
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 04d901d0ff6..f0f06b2bc28 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -436,7 +436,9 @@ struct mv643xx_eth_private {
         /*
          * Hardware-specific parameters.
          */
+#if defined(CONFIG_HAVE_CLK)
         struct clk *clk;
+#endif
         unsigned int t_clk;
 };
 
@@ -2895,17 +2897,17 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mp->dev = dev;
 
         /*
-         * Get the clk rate, if there is one, otherwise use the default.
+         * Start with a default rate, and if there is a clock, allow
+         * it to override the default.
          */
+        mp->t_clk = 133000000;
+#if defined(CONFIG_HAVE_CLK)
         mp->clk = clk_get(&pdev->dev, (pdev->id ? "1" : "0"));
         if (!IS_ERR(mp->clk)) {
                 clk_prepare_enable(mp->clk);
                 mp->t_clk = clk_get_rate(mp->clk);
-        } else {
-                mp->t_clk = 133000000;
-                printk(KERN_WARNING "Unable to get clock");
         }
-
+#endif
         set_params(mp, pd);
         netif_set_real_num_tx_queues(dev, mp->txq_count);
         netif_set_real_num_rx_queues(dev, mp->rxq_count);
@@ -2995,10 +2997,13 @@ static int mv643xx_eth_remove(struct platform_device *pdev)
                 phy_detach(mp->phy);
         cancel_work_sync(&mp->tx_timeout_task);
 
+#if defined(CONFIG_HAVE_CLK)
         if (!IS_ERR(mp->clk)) {
                 clk_disable_unprepare(mp->clk);
                 clk_put(mp->clk);
         }
+#endif
+
         free_netdev(mp->dev);
 
         platform_set_drvdata(pdev, NULL);
diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
index cace36f2ab9..28a54451a3e 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -4381,10 +4381,12 @@ static int sky2_set_features(struct net_device *dev, netdev_features_t features)
         struct sky2_port *sky2 = netdev_priv(dev);
         netdev_features_t changed = dev->features ^ features;
 
-        if (changed & NETIF_F_RXCSUM) {
-                bool on = features & NETIF_F_RXCSUM;
-                sky2_write32(sky2->hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
-                             on ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
+        if ((changed & NETIF_F_RXCSUM) &&
+            !(sky2->hw->flags & SKY2_HW_NEW_LE)) {
+                sky2_write32(sky2->hw,
+                             Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+                             (features & NETIF_F_RXCSUM)
+                             ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
         }
 
         if (changed & NETIF_F_RXHASH)
diff --git a/drivers/net/ethernet/mellanox/mlx4/port.c b/drivers/net/ethernet/mellanox/mlx4/port.c
index 1fe2c7a8b40..a8fb52992c6 100644
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -697,10 +697,10 @@ static int mlx4_common_set_port(struct mlx4_dev *dev, int slave, u32 in_mod,
         if (slave != dev->caps.function)
                 memset(inbox->buf, 0, 256);
         if (dev->flags & MLX4_FLAG_OLD_PORT_CMDS) {
-                *(u8 *) inbox->buf         = !!reset_qkey_viols << 6;
+                *(u8 *) inbox->buf         |= !!reset_qkey_viols << 6;
                 ((__be32 *) inbox->buf)[2] = agg_cap_mask;
         } else {
-                ((u8 *) inbox->buf)[3]     = !!reset_qkey_viols;
+                ((u8 *) inbox->buf)[3]     |= !!reset_qkey_viols;
                 ((__be32 *) inbox->buf)[1] = agg_cap_mask;
         }
 
diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
index 8d2666fcffd..083d6715335 100644
--- a/drivers/net/ethernet/nxp/lpc_eth.c
+++ b/drivers/net/ethernet/nxp/lpc_eth.c
@@ -946,16 +946,16 @@ static void __lpc_handle_xmit(struct net_device *ndev)
                         /* Update stats */
                         ndev->stats.tx_packets++;
                         ndev->stats.tx_bytes += skb->len;
-
-                        /* Free buffer */
-                        dev_kfree_skb_irq(skb);
                 }
+                dev_kfree_skb_irq(skb);
 
                 txcidx = readl(LPC_ENET_TXCONSUMEINDEX(pldat->net_base));
         }
 
-        if (netif_queue_stopped(ndev))
-                netif_wake_queue(ndev);
+        if (pldat->num_used_tx_buffs <= ENET_TX_DESC/2) {
+                if (netif_queue_stopped(ndev))
+                        netif_wake_queue(ndev);
+        }
 }
 
 static int __lpc_handle_recv(struct net_device *ndev, int budget)
@@ -1320,6 +1320,7 @@ static const struct net_device_ops lpc_netdev_ops = {
         .ndo_set_rx_mode        = lpc_eth_set_multicast_list,
         .ndo_do_ioctl           = lpc_eth_ioctl,
         .ndo_set_mac_address    = lpc_set_mac_address,
+        .ndo_change_mtu         = eth_change_mtu,
 };
 
 static int lpc_eth_drv_probe(struct platform_device *pdev)
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 9757ce3543a..7260aa79466 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5889,11 +5889,7 @@ static void rtl_slow_event_work(struct rtl8169_private *tp)
         if (status & LinkChg)
                 __rtl8169_check_link_status(dev, tp, tp->mmio_addr, true);
 
-        napi_disable(&tp->napi);
-        rtl_irq_disable(tp);
-
-        napi_enable(&tp->napi);
-        napi_schedule(&tp->napi);
+        rtl_irq_enable_all(tp);
 }
 
 static void rtl_task(struct work_struct *work)
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index 036428348fa..9f448279e12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -13,7 +13,7 @@ config STMMAC_ETH
 if STMMAC_ETH
 
 config STMMAC_PLATFORM
-        tristate "STMMAC platform bus support"
+        bool "STMMAC Platform bus support"
         depends on STMMAC_ETH
         default y
         ---help---
@@ -26,7 +26,7 @@ config STMMAC_PLATFORM
           If unsure, say N.
 
 config STMMAC_PCI
-        tristate "STMMAC support on PCI bus (EXPERIMENTAL)"
+        bool "STMMAC PCI bus support (EXPERIMENTAL)"
         depends on STMMAC_ETH && PCI && EXPERIMENTAL
         ---help---
           This is to select the Synopsys DWMAC available on PCI devices,
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index 6b5d060ee9d..dc20c56efc9 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -26,6 +26,7 @@
 #include <linux/clk.h>
 #include <linux/stmmac.h>
 #include <linux/phy.h>
+#include <linux/pci.h>
 #include "common.h"
 #ifdef CONFIG_STMMAC_TIMER
 #include "stmmac_timer.h"
@@ -95,7 +96,6 @@ extern int stmmac_mdio_register(struct net_device *ndev);
 extern void stmmac_set_ethtool_ops(struct net_device *netdev);
 extern const struct stmmac_desc_ops enh_desc_ops;
 extern const struct stmmac_desc_ops ndesc_ops;
-
 int stmmac_freeze(struct net_device *ndev);
 int stmmac_restore(struct net_device *ndev);
 int stmmac_resume(struct net_device *ndev);
@@ -109,7 +109,7 @@ struct stmmac_priv *stmmac_dvr_probe(struct device *device,
 static inline int stmmac_clk_enable(struct stmmac_priv *priv)
 {
         if (!IS_ERR(priv->stmmac_clk))
-                return clk_enable(priv->stmmac_clk);
+                return clk_prepare_enable(priv->stmmac_clk);
 
         return 0;
 }
@@ -119,7 +119,7 @@ static inline void stmmac_clk_disable(struct stmmac_priv *priv)
         if (IS_ERR(priv->stmmac_clk))
                 return;
 
-        clk_disable(priv->stmmac_clk);
+        clk_disable_unprepare(priv->stmmac_clk);
 }
 static inline int stmmac_clk_get(struct stmmac_priv *priv)
 {
@@ -143,3 +143,60 @@ static inline int stmmac_clk_get(struct stmmac_priv *priv)
         return 0;
 }
 #endif /* CONFIG_HAVE_CLK */
+
+
+#ifdef CONFIG_STMMAC_PLATFORM
+extern struct platform_driver stmmac_pltfr_driver;
+static inline int stmmac_register_platform(void)
+{
+        int err;
+
+        err = platform_driver_register(&stmmac_pltfr_driver);
+        if (err)
+                pr_err("stmmac: failed to register the platform driver\n");
+
+        return err;
+}
+static inline void stmmac_unregister_platform(void)
+{
+        platform_driver_register(&stmmac_pltfr_driver);
+}
+#else
+static inline int stmmac_register_platform(void)
+{
+        pr_debug("stmmac: do not register the platf driver\n");
+
+        return -EINVAL;
+}
+static inline void stmmac_unregister_platform(void)
+{
+}
+#endif /* CONFIG_STMMAC_PLATFORM */
+
+#ifdef CONFIG_STMMAC_PCI
+extern struct pci_driver stmmac_pci_driver;
+static inline int stmmac_register_pci(void)
+{
+        int err;
+
+        err = pci_register_driver(&stmmac_pci_driver);
+        if (err)
+                pr_err("stmmac: failed to register the PCI driver\n");
+
+        return err;
+}
+static inline void stmmac_unregister_pci(void)
+{
+        pci_unregister_driver(&stmmac_pci_driver);
+}
+#else
+static inline int stmmac_register_pci(void)
+{
+        pr_debug("stmmac: do not register the PCI driver\n");
+
+        return -EINVAL;
+}
+static inline void stmmac_unregister_pci(void)
+{
+}
+#endif /* CONFIG_STMMAC_PCI */
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 70966330f44..51b3b68528e 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -833,8 +833,9 @@ static u32 stmmac_get_synopsys_id(struct stmmac_priv *priv)
 
 /**
  * stmmac_selec_desc_mode
- * @dev : device pointer
- * Description: select the Enhanced/Alternate or Normal descriptors */
+ * @priv : private structure
+ * Description: select the Enhanced/Alternate or Normal descriptors
+ */
 static void stmmac_selec_desc_mode(struct stmmac_priv *priv)
 {
         if (priv->plat->enh_desc) {
@@ -1861,6 +1862,8 @@ static int stmmac_hw_init(struct stmmac_priv *priv)
 /**
  * stmmac_dvr_probe
  * @device: device pointer
+ * @plat_dat: platform data pointer
+ * @addr: iobase memory address
  * Description: this is the main probe function used to
  * call the alloc_etherdev, allocate the priv structure.
  */
@@ -2090,6 +2093,34 @@ int stmmac_restore(struct net_device *ndev)
 }
 #endif /* CONFIG_PM */
 
+/* Driver can be configured w/ and w/ both PCI and Platf drivers
+ * depending on the configuration selected.
+ */
+static int __init stmmac_init(void)
+{
+        int err_plt = 0;
+        int err_pci = 0;
+
+        err_plt = stmmac_register_platform();
+        err_pci = stmmac_register_pci();
+
+        if ((err_pci) && (err_plt)) {
+                pr_err("stmmac: driver registration failed\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void __exit stmmac_exit(void)
+{
+        stmmac_unregister_platform();
+        stmmac_unregister_pci();
+}
+
+module_init(stmmac_init);
+module_exit(stmmac_exit);
+
 #ifndef MODULE
 static int __init stmmac_cmdline_opt(char *str)
 {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 58fab5303e9..cf826e6b6aa 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -179,7 +179,7 @@ static DEFINE_PCI_DEVICE_TABLE(stmmac_id_table) = {
 
 MODULE_DEVICE_TABLE(pci, stmmac_id_table);
 
-static struct pci_driver stmmac_driver = {
+struct pci_driver stmmac_pci_driver = {
         .name = STMMAC_RESOURCE_NAME,
         .id_table = stmmac_id_table,
         .probe = stmmac_pci_probe,
@@ -190,33 +190,6 @@ static struct pci_driver stmmac_driver = {
 #endif
 };
 
-/**
- * stmmac_init_module - Entry point for the driver
- * Description: This function is the entry point for the driver.
- */
-static int __init stmmac_init_module(void)
-{
-        int ret;
-
-        ret = pci_register_driver(&stmmac_driver);
-        if (ret < 0)
-                pr_err("%s: ERROR: driver registration failed\n", __func__);
-
-        return ret;
-}
-
-/**
- * stmmac_cleanup_module - Cleanup routine for the driver
- * Description: This function is the cleanup routine for the driver.
- */
-static void __exit stmmac_cleanup_module(void)
-{
-        pci_unregister_driver(&stmmac_driver);
-}
-
-module_init(stmmac_init_module);
-module_exit(stmmac_cleanup_module);
-
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet PCI driver");
 MODULE_AUTHOR("Rayagond Kokatanur <rayagond.kokatanur@vayavyalabs.com>");
 MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 3dd8f080380..680d2b8dfe2 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -255,7 +255,7 @@ static const struct of_device_id stmmac_dt_ids[] = {
 };
 MODULE_DEVICE_TABLE(of, stmmac_dt_ids);
 
-static struct platform_driver stmmac_driver = {
+struct platform_driver stmmac_pltfr_driver = {
         .probe = stmmac_pltfr_probe,
         .remove = stmmac_pltfr_remove,
         .driver = {
@@ -266,8 +266,6 @@ static struct platform_driver stmmac_driver = {
                    },
 };
 
-module_platform_driver(stmmac_driver);
-
 MODULE_DESCRIPTION("STMMAC 10/100/1000 Ethernet PLATFORM driver");
 MODULE_AUTHOR("Giuseppe Cavallaro <peppe.cavallaro@st.com>");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
index 703c8cce2a2..8c726b7004d 100644
--- a/drivers/net/ethernet/sun/niu.c
+++ b/drivers/net/ethernet/sun/niu.c
@@ -3598,7 +3598,6 @@ static int release_tx_packet(struct niu *np, struct tx_ring_info *rp, int idx)
 static void niu_tx_work(struct niu *np, struct tx_ring_info *rp)
 {
         struct netdev_queue *txq;
-        unsigned int tx_bytes;
         u16 pkt_cnt, tmp;
         int cons, index;
         u64 cs;
@@ -3621,18 +3620,12 @@ static void niu_tx_work(struct niu *np, struct tx_ring_info *rp)
         netif_printk(np, tx_done, KERN_DEBUG, np->dev,
                      "%s() pkt_cnt[%u] cons[%d]\n", __func__, pkt_cnt, cons);
 
-        tx_bytes = 0;
-        tmp = pkt_cnt;
-        while (tmp--) {
-                tx_bytes += rp->tx_buffs[cons].skb->len;
+        while (pkt_cnt--)
                 cons = release_tx_packet(np, rp, cons);
-        }
 
         rp->cons = cons;
         smp_mb();
 
-        netdev_tx_completed_queue(txq, pkt_cnt, tx_bytes);
-
 out:
         if (unlikely(netif_tx_queue_stopped(txq) &&
                      (niu_tx_avail(rp) > NIU_TX_WAKEUP_THRESH(rp)))) {
@@ -4333,7 +4326,6 @@ static void niu_free_channels(struct niu *np)
                         struct tx_ring_info *rp = &np->tx_rings[i];
 
                         niu_free_tx_ring_info(np, rp);
-                        netdev_tx_reset_queue(netdev_get_tx_queue(np->dev, i));
                 }
                 kfree(np->tx_rings);
                 np->tx_rings = NULL;
@@ -6739,8 +6731,6 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb,
                 prod = NEXT_TX(rp, prod);
         }
 
-        netdev_tx_sent_queue(txq, skb->len);
-
         if (prod < rp->prod)
                 rp->wrap_bit ^= TX_RING_KICK_WRAP;
         rp->prod = prod;
diff --git a/drivers/net/ethernet/tile/Kconfig b/drivers/net/ethernet/tile/Kconfig
index 2d9218f86bc..098b1c42b39 100644
--- a/drivers/net/ethernet/tile/Kconfig
+++ b/drivers/net/ethernet/tile/Kconfig
@@ -7,6 +7,8 @@ config TILE_NET
         depends on TILE
         default y
         select CRC32
+        select TILE_GXIO_MPIPE if TILEGX
+        select HIGH_RES_TIMERS if TILEGX
         ---help---
           This is a standard Linux network device driver for the
           on-chip Tilera Gigabit Ethernet and XAUI interfaces.
diff --git a/drivers/net/ethernet/tile/Makefile b/drivers/net/ethernet/tile/Makefile
index f634f142cab..0ef9eefd321 100644
--- a/drivers/net/ethernet/tile/Makefile
+++ b/drivers/net/ethernet/tile/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_TILE_NET) += tile_net.o
 ifdef CONFIG_TILEGX
-tile_net-objs := tilegx.o mpipe.o iorpc_mpipe.o dma_queue.o
+tile_net-y := tilegx.o
 else
-tile_net-objs := tilepro.o
+tile_net-y := tilepro.o
 endif
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
new file mode 100644
index 00000000000..83b4b388ad4
--- /dev/null
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -0,0 +1,1898 @@
+/*
+ * Copyright 2012 Tilera Corporation. All Rights Reserved.
+ *
+ *   This program is free software; you can redistribute it and/or
+ *   modify it under the terms of the GNU General Public License
+ *   as published by the Free Software Foundation, version 2.
+ *
+ *   This program is distributed in the hope that it will be useful, but
+ *   WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ *   NON INFRINGEMENT.  See the GNU General Public License for
+ *   more details.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <linux/sched.h>
+#include <linux/kernel.h>      /* printk() */
+#include <linux/slab.h>        /* kmalloc() */
+#include <linux/errno.h>       /* error codes */
+#include <linux/types.h>       /* size_t */
+#include <linux/interrupt.h>
+#include <linux/in.h>
+#include <linux/irq.h>
+#include <linux/netdevice.h>   /* struct device, and other headers */
+#include <linux/etherdevice.h> /* eth_type_trans */
+#include <linux/skbuff.h>
+#include <linux/ioctl.h>
+#include <linux/cdev.h>
+#include <linux/hugetlb.h>
+#include <linux/in6.h>
+#include <linux/timer.h>
+#include <linux/hrtimer.h>
+#include <linux/ktime.h>
+#include <linux/io.h>
+#include <linux/ctype.h>
+#include <linux/ip.h>
+#include <linux/tcp.h>
+
+#include <asm/checksum.h>
+#include <asm/homecache.h>
+#include <gxio/mpipe.h>
+#include <arch/sim.h>
+
+/* Default transmit lockup timeout period, in jiffies. */
+#define TILE_NET_TIMEOUT (5 * HZ)
+
+/* The maximum number of distinct channels (idesc.channel is 5 bits). */
+#define TILE_NET_CHANNELS 32
+
+/* Maximum number of idescs to handle per "poll". */
+#define TILE_NET_BATCH 128
+
+/* Maximum number of packets to handle per "poll". */
+#define TILE_NET_WEIGHT 64
+
+/* Number of entries in each iqueue. */
+#define IQUEUE_ENTRIES 512
+
+/* Number of entries in each equeue. */
+#define EQUEUE_ENTRIES 2048
+
+/* Total header bytes per equeue slot.  Must be big enough for 2 bytes
+ * of NET_IP_ALIGN alignment, plus 14 bytes (?) of L2 header, plus up to
+ * 60 bytes of actual TCP header.  We round up to align to cache lines.
+ */
+#define HEADER_BYTES 128
+
+/* Maximum completions per cpu per device (must be a power of two).
+ * ISSUE: What is the right number here?  If this is too small, then
+ * egress might block waiting for free space in a completions array.
+ * ISSUE: At the least, allocate these only for initialized echannels.
+ */
+#define TILE_NET_MAX_COMPS 64
+
+#define MAX_FRAGS (MAX_SKB_FRAGS + 1)
+
+/* Size of completions data to allocate.
+ * ISSUE: Probably more than needed since we don't use all the channels.
+ */
+#define COMPS_SIZE (TILE_NET_CHANNELS * sizeof(struct tile_net_comps))
+
+/* Size of NotifRing data to allocate. */
+#define NOTIF_RING_SIZE (IQUEUE_ENTRIES * sizeof(gxio_mpipe_idesc_t))
+
+/* Timeout to wake the per-device TX timer after we stop the queue.
+ * We don't want the timeout too short (adds overhead, and might end
+ * up causing stop/wake/stop/wake cycles) or too long (affects performance).
+ * For the 10 Gb NIC, 30 usec means roughly 30+ 1500-byte packets.
+ */
+#define TX_TIMER_DELAY_USEC 30
+
+/* Timeout to wake the per-cpu egress timer to free completions. */
+#define EGRESS_TIMER_DELAY_USEC 1000
+
+MODULE_AUTHOR("Tilera Corporation");
+MODULE_LICENSE("GPL");
+
+/* A "packet fragment" (a chunk of memory). */
+struct frag {
+        void *buf;
+        size_t length;
+};
+
+/* A single completion. */
+struct tile_net_comp {
+        /* The "complete_count" when the completion will be complete. */
+        s64 when;
+        /* The buffer to be freed when the completion is complete. */
+        struct sk_buff *skb;
+};
+
+/* The completions for a given cpu and echannel. */
+struct tile_net_comps {
+        /* The completions. */
+        struct tile_net_comp comp_queue[TILE_NET_MAX_COMPS];
+        /* The number of completions used. */
+        unsigned long comp_next;
+        /* The number of completions freed. */
+        unsigned long comp_last;
+};
+
+/* The transmit wake timer for a given cpu and echannel. */
+struct tile_net_tx_wake {
+        struct hrtimer timer;
+        struct net_device *dev;
+};
+
+/* Info for a specific cpu. */
+struct tile_net_info {
+        /* The NAPI struct. */
+        struct napi_struct napi;
+        /* Packet queue. */
+        gxio_mpipe_iqueue_t iqueue;
+        /* Our cpu. */
+        int my_cpu;
+        /* True if iqueue is valid. */
+        bool has_iqueue;
+        /* NAPI flags. */
+        bool napi_added;
+        bool napi_enabled;
+        /* Number of small sk_buffs which must still be provided. */
+        unsigned int num_needed_small_buffers;
+        /* Number of large sk_buffs which must still be provided. */
+        unsigned int num_needed_large_buffers;
+        /* A timer for handling egress completions. */
+        struct hrtimer egress_timer;
+        /* True if "egress_timer" is scheduled. */
+        bool egress_timer_scheduled;
+        /* Comps for each egress channel. */
+        struct tile_net_comps *comps_for_echannel[TILE_NET_CHANNELS];
+        /* Transmit wake timer for each egress channel. */
+        struct tile_net_tx_wake tx_wake[TILE_NET_CHANNELS];
+};
+
+/* Info for egress on a particular egress channel. */
+struct tile_net_egress {
+        /* The "equeue". */
+        gxio_mpipe_equeue_t *equeue;
+        /* The headers for TSO. */
+        unsigned char *headers;
+};
+
+/* Info for a specific device. */
+struct tile_net_priv {
+        /* Our network device. */
+        struct net_device *dev;
+        /* The primary link. */
+        gxio_mpipe_link_t link;
+        /* The primary channel, if open, else -1. */
+        int channel;
+        /* The "loopify" egress link, if needed. */
+        gxio_mpipe_link_t loopify_link;
+        /* The "loopify" egress channel, if open, else -1. */
+        int loopify_channel;
+        /* The egress channel (channel or loopify_channel). */
+        int echannel;
+        /* Total stats. */
+        struct net_device_stats stats;
+};
+
+/* Egress info, indexed by "priv->echannel" (lazily created as needed). */
+static struct tile_net_egress egress_for_echannel[TILE_NET_CHANNELS];
+
+/* Devices currently associated with each channel.
+ * NOTE: The array entry can become NULL after ifconfig down, but
+ * we do not free the underlying net_device structures, so it is
+ * safe to use a pointer after reading it from this array.
+ */
+static struct net_device *tile_net_devs_for_channel[TILE_NET_CHANNELS];
+
+/* A mutex for "tile_net_devs_for_channel". */
+static DEFINE_MUTEX(tile_net_devs_for_channel_mutex);
+
+/* The per-cpu info. */
+static DEFINE_PER_CPU(struct tile_net_info, per_cpu_info);
+
+/* The "context" for all devices. */
+static gxio_mpipe_context_t context;
+
+/* Buffer sizes and mpipe enum codes for buffer stacks.
+ * See arch/tile/include/gxio/mpipe.h for the set of possible values.
+ */
+#define BUFFER_SIZE_SMALL_ENUM GXIO_MPIPE_BUFFER_SIZE_128
+#define BUFFER_SIZE_SMALL 128
+#define BUFFER_SIZE_LARGE_ENUM GXIO_MPIPE_BUFFER_SIZE_1664
+#define BUFFER_SIZE_LARGE 1664
+
+/* The small/large "buffer stacks". */
+static int small_buffer_stack = -1;
+static int large_buffer_stack = -1;
+
+/* Amount of memory allocated for each buffer stack. */
+static size_t buffer_stack_size;
+
+/* The actual memory allocated for the buffer stacks. */
+static void *small_buffer_stack_va;
+static void *large_buffer_stack_va;
+
+/* The buckets. */
+static int first_bucket = -1;
+static int num_buckets = 1;
+
+/* The ingress irq. */
+static int ingress_irq = -1;
+
+/* Text value of tile_net.cpus if passed as a module parameter. */
+static char *network_cpus_string;
+
+/* The actual cpus in "network_cpus". */
+static struct cpumask network_cpus_map;
+
+/* If "loopify=LINK" was specified, this is "LINK". */
+static char *loopify_link_name;
+
+/* If "tile_net.custom" was specified, this is non-NULL. */
+static char *custom_str;
+
+/* The "tile_net.cpus" argument specifies the cpus that are dedicated
+ * to handle ingress packets.
+ *
+ * The parameter should be in the form "tile_net.cpus=m-n[,x-y]", where
+ * m, n, x, y are integer numbers that represent the cpus that can be
+ * neither a dedicated cpu nor a dataplane cpu.
+ */
+static bool network_cpus_init(void)
+{
+        char buf[1024];
+        int rc;
+
+        if (network_cpus_string == NULL)
+                return false;
+
+        rc = cpulist_parse_crop(network_cpus_string, &network_cpus_map);
+        if (rc != 0) {
+                pr_warn("tile_net.cpus=%s: malformed cpu list\n",
+                        network_cpus_string);
+                return false;
+        }
+
+        /* Remove dedicated cpus. */
+        cpumask_and(&network_cpus_map, &network_cpus_map, cpu_possible_mask);
+
+        if (cpumask_empty(&network_cpus_map)) {
+                pr_warn("Ignoring empty tile_net.cpus='%s'.\n",
+                        network_cpus_string);
+                return false;
+        }
+
+        cpulist_scnprintf(buf, sizeof(buf), &network_cpus_map);
+        pr_info("Linux network CPUs: %s\n", buf);
+        return true;
+}
+
+module_param_named(cpus, network_cpus_string, charp, 0444);
+MODULE_PARM_DESC(cpus, "cpulist of cores that handle network interrupts");
+
+/* The "tile_net.loopify=LINK" argument causes the named device to
+ * actually use "loop0" for ingress, and "loop1" for egress.  This
+ * allows an app to sit between the actual link and linux, passing
+ * (some) packets along to linux, and forwarding (some) packets sent
+ * out by linux.
+ */
+module_param_named(loopify, loopify_link_name, charp, 0444);
+MODULE_PARM_DESC(loopify, "name the device to use loop0/1 for ingress/egress");
+
+/* The "tile_net.custom" argument causes us to ignore the "conventional"
+ * classifier metadata, in particular, the "l2_offset".
+ */
+module_param_named(custom, custom_str, charp, 0444);
+MODULE_PARM_DESC(custom, "indicates a (heavily) customized classifier");
+
+/* Atomically update a statistics field.
+ * Note that on TILE-Gx, this operation is fire-and-forget on the
+ * issuing core (single-cycle dispatch) and takes only a few cycles
+ * longer than a regular store when the request reaches the home cache.
+ * No expensive bus management overhead is required.
+ */
+static void tile_net_stats_add(unsigned long value, unsigned long *field)
+{
+        BUILD_BUG_ON(sizeof(atomic_long_t) != sizeof(unsigned long));
+        atomic_long_add(value, (atomic_long_t *)field);
+}
+
+/* Allocate and push a buffer. */
+static bool tile_net_provide_buffer(bool small)
+{
+        int stack = small ? small_buffer_stack : large_buffer_stack;
+        const unsigned long buffer_alignment = 128;
+        struct sk_buff *skb;
+        int len;
+
+        len = sizeof(struct sk_buff **) + buffer_alignment;
+        len += (small ? BUFFER_SIZE_SMALL : BUFFER_SIZE_LARGE);
+        skb = dev_alloc_skb(len);
+        if (skb == NULL)
+                return false;
+
+        /* Make room for a back-pointer to 'skb' and guarantee alignment. */
+        skb_reserve(skb, sizeof(struct sk_buff **));
+        skb_reserve(skb, -(long)skb->data & (buffer_alignment - 1));
+
+        /* Save a back-pointer to 'skb'. */
+        *(struct sk_buff **)(skb->data - sizeof(struct sk_buff **)) = skb;
+
+        /* Make sure "skb" and the back-pointer have been flushed. */
+        wmb();
+
+        gxio_mpipe_push_buffer(&context, stack,
+                               (void *)va_to_tile_io_addr(skb->data));
+
+        return true;
+}
+
+/* Convert a raw mpipe buffer to its matching skb pointer. */
+static struct sk_buff *mpipe_buf_to_skb(void *va)
+{
+        /* Acquire the associated "skb". */
+        struct sk_buff **skb_ptr = va - sizeof(*skb_ptr);
+        struct sk_buff *skb = *skb_ptr;
+
+        /* Paranoia. */
+        if (skb->data != va) {
+                /* Panic here since there's a reasonable chance
+                 * that corrupt buffers means generic memory
+                 * corruption, with unpredictable system effects.
+                 */
+                panic("Corrupt linux buffer! va=%p, skb=%p, skb->data=%p",
+                      va, skb, skb->data);
+        }
+
+        return skb;
+}
+
+static void tile_net_pop_all_buffers(int stack)
+{
+        for (;;) {
+                tile_io_addr_t addr =
+                        (tile_io_addr_t)gxio_mpipe_pop_buffer(&context, stack);
+                if (addr == 0)
+                        break;
+                dev_kfree_skb_irq(mpipe_buf_to_skb(tile_io_addr_to_va(addr)));
+        }
+}
+
+/* Provide linux buffers to mPIPE. */
+static void tile_net_provide_needed_buffers(void)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+
+        while (info->num_needed_small_buffers != 0) {
+                if (!tile_net_provide_buffer(true))
+                        goto oops;
+                info->num_needed_small_buffers--;
+        }
+
+        while (info->num_needed_large_buffers != 0) {
+                if (!tile_net_provide_buffer(false))
+                        goto oops;
+                info->num_needed_large_buffers--;
+        }
+
+        return;
+
+oops:
+        /* Add a description to the page allocation failure dump. */
+        pr_notice("Tile %d still needs some buffers\n", info->my_cpu);
+}
+
+static inline bool filter_packet(struct net_device *dev, void *buf)
+{
+        /* Filter packets received before we're up. */
+        if (dev == NULL || !(dev->flags & IFF_UP))
+                return true;
+
+        /* Filter out packets that aren't for us. */
+        if (!(dev->flags & IFF_PROMISC) &&
+            !is_multicast_ether_addr(buf) &&
+            compare_ether_addr(dev->dev_addr, buf) != 0)
+                return true;
+
+        return false;
+}
+
+static void tile_net_receive_skb(struct net_device *dev, struct sk_buff *skb,
+                                 gxio_mpipe_idesc_t *idesc, unsigned long len)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+
+        /* Encode the actual packet length. */
+        skb_put(skb, len);
+
+        skb->protocol = eth_type_trans(skb, dev);
+
+        /* Acknowledge "good" hardware checksums. */
+        if (idesc->cs && idesc->csum_seed_val == 0xFFFF)
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+        netif_receive_skb(skb);
+
+        /* Update stats. */
+        tile_net_stats_add(1, &priv->stats.rx_packets);
+        tile_net_stats_add(len, &priv->stats.rx_bytes);
+
+        /* Need a new buffer. */
+        if (idesc->size == BUFFER_SIZE_SMALL_ENUM)
+                info->num_needed_small_buffers++;
+        else
+                info->num_needed_large_buffers++;
+}
+
+/* Handle a packet.  Return true if "processed", false if "filtered". */
+static bool tile_net_handle_packet(gxio_mpipe_idesc_t *idesc)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct net_device *dev = tile_net_devs_for_channel[idesc->channel];
+        uint8_t l2_offset;
+        void *va;
+        void *buf;
+        unsigned long len;
+        bool filter;
+
+        /* Drop packets for which no buffer was available.
+         * NOTE: This happens under heavy load.
+         */
+        if (idesc->be) {
+                struct tile_net_priv *priv = netdev_priv(dev);
+                tile_net_stats_add(1, &priv->stats.rx_dropped);
+                gxio_mpipe_iqueue_consume(&info->iqueue, idesc);
+                if (net_ratelimit())
+                        pr_info("Dropping packet (insufficient buffers).\n");
+                return false;
+        }
+
+        /* Get the "l2_offset", if allowed. */
+        l2_offset = custom_str ? 0 : gxio_mpipe_idesc_get_l2_offset(idesc);
+
+        /* Get the raw buffer VA (includes "headroom"). */
+        va = tile_io_addr_to_va((unsigned long)(long)idesc->va);
+
+        /* Get the actual packet start/length. */
+        buf = va + l2_offset;
+        len = idesc->l2_size - l2_offset;
+
+        /* Point "va" at the raw buffer. */
+        va -= NET_IP_ALIGN;
+
+        filter = filter_packet(dev, buf);
+        if (filter) {
+                gxio_mpipe_iqueue_drop(&info->iqueue, idesc);
+        } else {
+                struct sk_buff *skb = mpipe_buf_to_skb(va);
+
+                /* Skip headroom, and any custom header. */
+                skb_reserve(skb, NET_IP_ALIGN + l2_offset);
+
+                tile_net_receive_skb(dev, skb, idesc, len);
+        }
+
+        gxio_mpipe_iqueue_consume(&info->iqueue, idesc);
+        return !filter;
+}
+
+/* Handle some packets for the current CPU.
+ *
+ * This function handles up to TILE_NET_BATCH idescs per call.
+ *
+ * ISSUE: Since we do not provide new buffers until this function is
+ * complete, we must initially provide enough buffers for each network
+ * cpu to fill its iqueue and also its batched idescs.
+ *
+ * ISSUE: The "rotting packet" race condition occurs if a packet
+ * arrives after the queue appears to be empty, and before the
+ * hypervisor interrupt is re-enabled.
+ */
+static int tile_net_poll(struct napi_struct *napi, int budget)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        unsigned int work = 0;
+        gxio_mpipe_idesc_t *idesc;
+        int i, n;
+
+        /* Process packets. */
+        while ((n = gxio_mpipe_iqueue_try_peek(&info->iqueue, &idesc)) > 0) {
+                for (i = 0; i < n; i++) {
+                        if (i == TILE_NET_BATCH)
+                                goto done;
+                        if (tile_net_handle_packet(idesc + i)) {
+                                if (++work >= budget)
+                                        goto done;
+                        }
+                }
+        }
+
+        /* There are no packets left. */
+        napi_complete(&info->napi);
+
+        /* Re-enable hypervisor interrupts. */
+        gxio_mpipe_enable_notif_ring_interrupt(&context, info->iqueue.ring);
+
+        /* HACK: Avoid the "rotting packet" problem. */
+        if (gxio_mpipe_iqueue_try_peek(&info->iqueue, &idesc) > 0)
+                napi_schedule(&info->napi);
+
+        /* ISSUE: Handle completions? */
+
+done:
+        tile_net_provide_needed_buffers();
+
+        return work;
+}
+
+/* Handle an ingress interrupt on the current cpu. */
+static irqreturn_t tile_net_handle_ingress_irq(int irq, void *unused)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        napi_schedule(&info->napi);
+        return IRQ_HANDLED;
+}
+
+/* Free some completions.  This must be called with interrupts blocked. */
+static int tile_net_free_comps(gxio_mpipe_equeue_t *equeue,
+                                struct tile_net_comps *comps,
+                                int limit, bool force_update)
+{
+        int n = 0;
+        while (comps->comp_last < comps->comp_next) {
+                unsigned int cid = comps->comp_last % TILE_NET_MAX_COMPS;
+                struct tile_net_comp *comp = &comps->comp_queue[cid];
+                if (!gxio_mpipe_equeue_is_complete(equeue, comp->when,
+                                                   force_update || n == 0))
+                        break;
+                dev_kfree_skb_irq(comp->skb);
+                comps->comp_last++;
+                if (++n == limit)
+                        break;
+        }
+        return n;
+}
+
+/* Add a completion.  This must be called with interrupts blocked.
+ * tile_net_equeue_try_reserve() will have ensured a free completion entry.
+ */
+static void add_comp(gxio_mpipe_equeue_t *equeue,
+                     struct tile_net_comps *comps,
+                     uint64_t when, struct sk_buff *skb)
+{
+        int cid = comps->comp_next % TILE_NET_MAX_COMPS;
+        comps->comp_queue[cid].when = when;
+        comps->comp_queue[cid].skb = skb;
+        comps->comp_next++;
+}
+
+static void tile_net_schedule_tx_wake_timer(struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+
+        hrtimer_start(&info->tx_wake[priv->echannel].timer,
+                      ktime_set(0, TX_TIMER_DELAY_USEC * 1000UL),
+                      HRTIMER_MODE_REL_PINNED);
+}
+
+static enum hrtimer_restart tile_net_handle_tx_wake_timer(struct hrtimer *t)
+{
+        struct tile_net_tx_wake *tx_wake =
+                container_of(t, struct tile_net_tx_wake, timer);
+        netif_wake_subqueue(tx_wake->dev, smp_processor_id());
+        return HRTIMER_NORESTART;
+}
+
+/* Make sure the egress timer is scheduled. */
+static void tile_net_schedule_egress_timer(void)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+
+        if (!info->egress_timer_scheduled) {
+                hrtimer_start(&info->egress_timer,
+                              ktime_set(0, EGRESS_TIMER_DELAY_USEC * 1000UL),
+                              HRTIMER_MODE_REL_PINNED);
+                info->egress_timer_scheduled = true;
+        }
+}
+
+/* The "function" for "info->egress_timer".
+ *
+ * This timer will reschedule itself as long as there are any pending
+ * completions expected for this tile.
+ */
+static enum hrtimer_restart tile_net_handle_egress_timer(struct hrtimer *t)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        unsigned long irqflags;
+        bool pending = false;
+        int i;
+
+        local_irq_save(irqflags);
+
+        /* The timer is no longer scheduled. */
+        info->egress_timer_scheduled = false;
+
+        /* Free all possible comps for this tile. */
+        for (i = 0; i < TILE_NET_CHANNELS; i++) {
+                struct tile_net_egress *egress = &egress_for_echannel[i];
+                struct tile_net_comps *comps = info->comps_for_echannel[i];
+                if (comps->comp_last >= comps->comp_next)
+                        continue;
+                tile_net_free_comps(egress->equeue, comps, -1, true);
+                pending = pending || (comps->comp_last < comps->comp_next);
+        }
+
+        /* Reschedule timer if needed. */
+        if (pending)
+                tile_net_schedule_egress_timer();
+
+        local_irq_restore(irqflags);
+
+        return HRTIMER_NORESTART;
+}
+
+/* Helper function for "tile_net_update()".
+ * "dev" (i.e. arg) is the device being brought up or down,
+ * or NULL if all devices are now down.
+ */
+static void tile_net_update_cpu(void *arg)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct net_device *dev = arg;
+
+        if (!info->has_iqueue)
+                return;
+
+        if (dev != NULL) {
+                if (!info->napi_added) {
+                        netif_napi_add(dev, &info->napi,
+                                       tile_net_poll, TILE_NET_WEIGHT);
+                        info->napi_added = true;
+                }
+                if (!info->napi_enabled) {
+                        napi_enable(&info->napi);
+                        info->napi_enabled = true;
+                }
+                enable_percpu_irq(ingress_irq, 0);
+        } else {
+                disable_percpu_irq(ingress_irq);
+                if (info->napi_enabled) {
+                        napi_disable(&info->napi);
+                        info->napi_enabled = false;
+                }
+                /* FIXME: Drain the iqueue. */
+        }
+}
+
+/* Helper function for tile_net_open() and tile_net_stop().
+ * Always called under tile_net_devs_for_channel_mutex.
+ */
+static int tile_net_update(struct net_device *dev)
+{
+        static gxio_mpipe_rules_t rules;  /* too big to fit on the stack */
+        bool saw_channel = false;
+        int channel;
+        int rc;
+        int cpu;
+
+        gxio_mpipe_rules_init(&rules, &context);
+
+        for (channel = 0; channel < TILE_NET_CHANNELS; channel++) {
+                if (tile_net_devs_for_channel[channel] == NULL)
+                        continue;
+                if (!saw_channel) {
+                        saw_channel = true;
+                        gxio_mpipe_rules_begin(&rules, first_bucket,
+                                               num_buckets, NULL);
+                        gxio_mpipe_rules_set_headroom(&rules, NET_IP_ALIGN);
+                }
+                gxio_mpipe_rules_add_channel(&rules, channel);
+        }
+
+        /* NOTE: This can fail if there is no classifier.
+         * ISSUE: Can anything else cause it to fail?
+         */
+        rc = gxio_mpipe_rules_commit(&rules);
+        if (rc != 0) {
+                netdev_warn(dev, "gxio_mpipe_rules_commit failed: %d\n", rc);
+                return -EIO;
+        }
+
+        /* Update all cpus, sequentially (to protect "netif_napi_add()"). */
+        for_each_online_cpu(cpu)
+                smp_call_function_single(cpu, tile_net_update_cpu,
+                                         (saw_channel ? dev : NULL), 1);
+
+        /* HACK: Allow packets to flow in the simulator. */
+        if (saw_channel)
+                sim_enable_mpipe_links(0, -1);
+
+        return 0;
+}
+
+/* Allocate and initialize mpipe buffer stacks, and register them in
+ * the mPIPE TLBs, for both small and large packet sizes.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int init_buffer_stacks(struct net_device *dev, int num_buffers)
+{
+        pte_t hash_pte = pte_set_home((pte_t) { 0 }, PAGE_HOME_HASH);
+        int rc;
+
+        /* Compute stack bytes; we round up to 64KB and then use
+         * alloc_pages() so we get the required 64KB alignment as well.
+         */
+        buffer_stack_size =
+                ALIGN(gxio_mpipe_calc_buffer_stack_bytes(num_buffers),
+                      64 * 1024);
+
+        /* Allocate two buffer stack indices. */
+        rc = gxio_mpipe_alloc_buffer_stacks(&context, 2, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_buffer_stacks failed: %d\n",
+                           rc);
+                return rc;
+        }
+        small_buffer_stack = rc;
+        large_buffer_stack = rc + 1;
+
+        /* Allocate the small memory stack. */
+        small_buffer_stack_va =
+                alloc_pages_exact(buffer_stack_size, GFP_KERNEL);
+        if (small_buffer_stack_va == NULL) {
+                netdev_err(dev,
+                           "Could not alloc %zd bytes for buffer stacks\n",
+                           buffer_stack_size);
+                return -ENOMEM;
+        }
+        rc = gxio_mpipe_init_buffer_stack(&context, small_buffer_stack,
+                                          BUFFER_SIZE_SMALL_ENUM,
+                                          small_buffer_stack_va,
+                                          buffer_stack_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init_buffer_stack: %d\n", rc);
+                return rc;
+        }
+        rc = gxio_mpipe_register_client_memory(&context, small_buffer_stack,
+                                               hash_pte, 0);
+        if (rc != 0) {
+                netdev_err(dev,
+                           "gxio_mpipe_register_buffer_memory failed: %d\n",
+                           rc);
+                return rc;
+        }
+
+        /* Allocate the large buffer stack. */
+        large_buffer_stack_va =
+                alloc_pages_exact(buffer_stack_size, GFP_KERNEL);
+        if (large_buffer_stack_va == NULL) {
+                netdev_err(dev,
+                           "Could not alloc %zd bytes for buffer stacks\n",
+                           buffer_stack_size);
+                return -ENOMEM;
+        }
+        rc = gxio_mpipe_init_buffer_stack(&context, large_buffer_stack,
+                                          BUFFER_SIZE_LARGE_ENUM,
+                                          large_buffer_stack_va,
+                                          buffer_stack_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init_buffer_stack failed: %d\n",
+                           rc);
+                return rc;
+        }
+        rc = gxio_mpipe_register_client_memory(&context, large_buffer_stack,
+                                               hash_pte, 0);
+        if (rc != 0) {
+                netdev_err(dev,
+                           "gxio_mpipe_register_buffer_memory failed: %d\n",
+                           rc);
+                return rc;
+        }
+
+        return 0;
+}
+
+/* Allocate per-cpu resources (memory for completions and idescs).
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int alloc_percpu_mpipe_resources(struct net_device *dev,
+                                        int cpu, int ring)
+{
+        struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+        int order, i, rc;
+        struct page *page;
+        void *addr;
+
+        /* Allocate the "comps". */
+        order = get_order(COMPS_SIZE);
+        page = homecache_alloc_pages(GFP_KERNEL, order, cpu);
+        if (page == NULL) {
+                netdev_err(dev, "Failed to alloc %zd bytes comps memory\n",
+                           COMPS_SIZE);
+                return -ENOMEM;
+        }
+        addr = pfn_to_kaddr(page_to_pfn(page));
+        memset(addr, 0, COMPS_SIZE);
+        for (i = 0; i < TILE_NET_CHANNELS; i++)
+                info->comps_for_echannel[i] =
+                        addr + i * sizeof(struct tile_net_comps);
+
+        /* If this is a network cpu, create an iqueue. */
+        if (cpu_isset(cpu, network_cpus_map)) {
+                order = get_order(NOTIF_RING_SIZE);
+                page = homecache_alloc_pages(GFP_KERNEL, order, cpu);
+                if (page == NULL) {
+                        netdev_err(dev,
+                                   "Failed to alloc %zd bytes iqueue memory\n",
+                                   NOTIF_RING_SIZE);
+                        return -ENOMEM;
+                }
+                addr = pfn_to_kaddr(page_to_pfn(page));
+                rc = gxio_mpipe_iqueue_init(&info->iqueue, &context, ring++,
+                                            addr, NOTIF_RING_SIZE, 0);
+                if (rc < 0) {
+                        netdev_err(dev,
+                                   "gxio_mpipe_iqueue_init failed: %d\n", rc);
+                        return rc;
+                }
+                info->has_iqueue = true;
+        }
+
+        return ring;
+}
+
+/* Initialize NotifGroup and buckets.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int init_notif_group_and_buckets(struct net_device *dev,
+                                        int ring, int network_cpus_count)
+{
+        int group, rc;
+
+        /* Allocate one NotifGroup. */
+        rc = gxio_mpipe_alloc_notif_groups(&context, 1, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_notif_groups failed: %d\n",
+                           rc);
+                return rc;
+        }
+        group = rc;
+
+        /* Initialize global num_buckets value. */
+        if (network_cpus_count > 4)
+                num_buckets = 256;
+        else if (network_cpus_count > 1)
+                num_buckets = 16;
+
+        /* Allocate some buckets, and set global first_bucket value. */
+        rc = gxio_mpipe_alloc_buckets(&context, num_buckets, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_buckets failed: %d\n", rc);
+                return rc;
+        }
+        first_bucket = rc;
+
+        /* Init group and buckets. */
+        rc = gxio_mpipe_init_notif_group_and_buckets(
+                &context, group, ring, network_cpus_count,
+                first_bucket, num_buckets,
+                GXIO_MPIPE_BUCKET_STICKY_FLOW_LOCALITY);
+        if (rc != 0) {
+                netdev_err(
+                        dev,
+                        "gxio_mpipe_init_notif_group_and_buckets failed: %d\n",
+                        rc);
+                return rc;
+        }
+
+        return 0;
+}
+
+/* Create an irq and register it, then activate the irq and request
+ * interrupts on all cores.  Note that "ingress_irq" being initialized
+ * is how we know not to call tile_net_init_mpipe() again.
+ * This routine supports tile_net_init_mpipe(), below.
+ */
+static int tile_net_setup_interrupts(struct net_device *dev)
+{
+        int cpu, rc;
+
+        rc = create_irq();
+        if (rc < 0) {
+                netdev_err(dev, "create_irq failed: %d\n", rc);
+                return rc;
+        }
+        ingress_irq = rc;
+        tile_irq_activate(ingress_irq, TILE_IRQ_PERCPU);
+        rc = request_irq(ingress_irq, tile_net_handle_ingress_irq,
+                         0, NULL, NULL);
+        if (rc != 0) {
+                netdev_err(dev, "request_irq failed: %d\n", rc);
+                destroy_irq(ingress_irq);
+                ingress_irq = -1;
+                return rc;
+        }
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                if (info->has_iqueue) {
+                        gxio_mpipe_request_notif_ring_interrupt(
+                                &context, cpu_x(cpu), cpu_y(cpu),
+                                1, ingress_irq, info->iqueue.ring);
+                }
+        }
+
+        return 0;
+}
+
+/* Undo any state set up partially by a failed call to tile_net_init_mpipe. */
+static void tile_net_init_mpipe_fail(void)
+{
+        int cpu;
+
+        /* Do cleanups that require the mpipe context first. */
+        if (small_buffer_stack >= 0)
+                tile_net_pop_all_buffers(small_buffer_stack);
+        if (large_buffer_stack >= 0)
+                tile_net_pop_all_buffers(large_buffer_stack);
+
+        /* Destroy mpipe context so the hardware no longer owns any memory. */
+        gxio_mpipe_destroy(&context);
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                free_pages((unsigned long)(info->comps_for_echannel[0]),
+                           get_order(COMPS_SIZE));
+                info->comps_for_echannel[0] = NULL;
+                free_pages((unsigned long)(info->iqueue.idescs),
+                           get_order(NOTIF_RING_SIZE));
+                info->iqueue.idescs = NULL;
+        }
+
+        if (small_buffer_stack_va)
+                free_pages_exact(small_buffer_stack_va, buffer_stack_size);
+        if (large_buffer_stack_va)
+                free_pages_exact(large_buffer_stack_va, buffer_stack_size);
+
+        small_buffer_stack_va = NULL;
+        large_buffer_stack_va = NULL;
+        large_buffer_stack = -1;
+        small_buffer_stack = -1;
+        first_bucket = -1;
+}
+
+/* The first time any tilegx network device is opened, we initialize
+ * the global mpipe state.  If this step fails, we fail to open the
+ * device, but if it succeeds, we never need to do it again, and since
+ * tile_net can't be unloaded, we never undo it.
+ *
+ * Note that some resources in this path (buffer stack indices,
+ * bindings from init_buffer_stack, etc.) are hypervisor resources
+ * that are freed implicitly by gxio_mpipe_destroy().
+ */
+static int tile_net_init_mpipe(struct net_device *dev)
+{
+        int i, num_buffers, rc;
+        int cpu;
+        int first_ring, ring;
+        int network_cpus_count = cpus_weight(network_cpus_map);
+
+        if (!hash_default) {
+                netdev_err(dev, "Networking requires hash_default!\n");
+                return -EIO;
+        }
+
+        rc = gxio_mpipe_init(&context, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_init failed: %d\n", rc);
+                return -EIO;
+        }
+
+        /* Set up the buffer stacks. */
+        num_buffers =
+                network_cpus_count * (IQUEUE_ENTRIES + TILE_NET_BATCH);
+        rc = init_buffer_stacks(dev, num_buffers);
+        if (rc != 0)
+                goto fail;
+
+        /* Provide initial buffers. */
+        rc = -ENOMEM;
+        for (i = 0; i < num_buffers; i++) {
+                if (!tile_net_provide_buffer(true)) {
+                        netdev_err(dev, "Cannot allocate initial sk_bufs!\n");
+                        goto fail;
+                }
+        }
+        for (i = 0; i < num_buffers; i++) {
+                if (!tile_net_provide_buffer(false)) {
+                        netdev_err(dev, "Cannot allocate initial sk_bufs!\n");
+                        goto fail;
+                }
+        }
+
+        /* Allocate one NotifRing for each network cpu. */
+        rc = gxio_mpipe_alloc_notif_rings(&context, network_cpus_count, 0, 0);
+        if (rc < 0) {
+                netdev_err(dev, "gxio_mpipe_alloc_notif_rings failed %d\n",
+                           rc);
+                goto fail;
+        }
+
+        /* Init NotifRings per-cpu. */
+        first_ring = rc;
+        ring = first_ring;
+        for_each_online_cpu(cpu) {
+                rc = alloc_percpu_mpipe_resources(dev, cpu, ring);
+                if (rc < 0)
+                        goto fail;
+                ring = rc;
+        }
+
+        /* Initialize NotifGroup and buckets. */
+        rc = init_notif_group_and_buckets(dev, first_ring, network_cpus_count);
+        if (rc != 0)
+                goto fail;
+
+        /* Create and enable interrupts. */
+        rc = tile_net_setup_interrupts(dev);
+        if (rc != 0)
+                goto fail;
+
+        return 0;
+
+fail:
+        tile_net_init_mpipe_fail();
+        return rc;
+}
+
+/* Create persistent egress info for a given egress channel.
+ * Note that this may be shared between, say, "gbe0" and "xgbe0".
+ * ISSUE: Defer header allocation until TSO is actually needed?
+ */
+static int tile_net_init_egress(struct net_device *dev, int echannel)
+{
+        struct page *headers_page, *edescs_page, *equeue_page;
+        gxio_mpipe_edesc_t *edescs;
+        gxio_mpipe_equeue_t *equeue;
+        unsigned char *headers;
+        int headers_order, edescs_order, equeue_order;
+        size_t edescs_size;
+        int edma;
+        int rc = -ENOMEM;
+
+        /* Only initialize once. */
+        if (egress_for_echannel[echannel].equeue != NULL)
+                return 0;
+
+        /* Allocate memory for the "headers". */
+        headers_order = get_order(EQUEUE_ENTRIES * HEADER_BYTES);
+        headers_page = alloc_pages(GFP_KERNEL, headers_order);
+        if (headers_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for TSO headers.\n",
+                            PAGE_SIZE << headers_order);
+                goto fail;
+        }
+        headers = pfn_to_kaddr(page_to_pfn(headers_page));
+
+        /* Allocate memory for the "edescs". */
+        edescs_size = EQUEUE_ENTRIES * sizeof(*edescs);
+        edescs_order = get_order(edescs_size);
+        edescs_page = alloc_pages(GFP_KERNEL, edescs_order);
+        if (edescs_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for eDMA ring.\n",
+                            edescs_size);
+                goto fail_headers;
+        }
+        edescs = pfn_to_kaddr(page_to_pfn(edescs_page));
+
+        /* Allocate memory for the "equeue". */
+        equeue_order = get_order(sizeof(*equeue));
+        equeue_page = alloc_pages(GFP_KERNEL, equeue_order);
+        if (equeue_page == NULL) {
+                netdev_warn(dev,
+                            "Could not alloc %zd bytes for equeue info.\n",
+                            PAGE_SIZE << equeue_order);
+                goto fail_edescs;
+        }
+        equeue = pfn_to_kaddr(page_to_pfn(equeue_page));
+
+        /* Allocate an edma ring.  Note that in practice this can't
+         * fail, which is good, because we will leak an edma ring if so.
+         */
+        rc = gxio_mpipe_alloc_edma_rings(&context, 1, 0, 0);
+        if (rc < 0) {
+                netdev_warn(dev, "gxio_mpipe_alloc_edma_rings failed: %d\n",
+                            rc);
+                goto fail_equeue;
+        }
+        edma = rc;
+
+        /* Initialize the equeue. */
+        rc = gxio_mpipe_equeue_init(equeue, &context, edma, echannel,
+                                    edescs, edescs_size, 0);
+        if (rc != 0) {
+                netdev_err(dev, "gxio_mpipe_equeue_init failed: %d\n", rc);
+                goto fail_equeue;
+        }
+
+        /* Done. */
+        egress_for_echannel[echannel].equeue = equeue;
+        egress_for_echannel[echannel].headers = headers;
+        return 0;
+
+fail_equeue:
+        __free_pages(equeue_page, equeue_order);
+
+fail_edescs:
+        __free_pages(edescs_page, edescs_order);
+
+fail_headers:
+        __free_pages(headers_page, headers_order);
+
+fail:
+        return rc;
+}
+
+/* Return channel number for a newly-opened link. */
+static int tile_net_link_open(struct net_device *dev, gxio_mpipe_link_t *link,
+                              const char *link_name)
+{
+        int rc = gxio_mpipe_link_open(link, &context, link_name, 0);
+        if (rc < 0) {
+                netdev_err(dev, "Failed to open '%s'\n", link_name);
+                return rc;
+        }
+        rc = gxio_mpipe_link_channel(link);
+        if (rc < 0 || rc >= TILE_NET_CHANNELS) {
+                netdev_err(dev, "gxio_mpipe_link_channel bad value: %d\n", rc);
+                gxio_mpipe_link_close(link);
+                return -EINVAL;
+        }
+        return rc;
+}
+
+/* Help the kernel activate the given network interface. */
+static int tile_net_open(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int cpu, rc;
+
+        mutex_lock(&tile_net_devs_for_channel_mutex);
+
+        /* Do one-time initialization the first time any device is opened. */
+        if (ingress_irq < 0) {
+                rc = tile_net_init_mpipe(dev);
+                if (rc != 0)
+                        goto fail;
+        }
+
+        /* Determine if this is the "loopify" device. */
+        if (unlikely((loopify_link_name != NULL) &&
+                     !strcmp(dev->name, loopify_link_name))) {
+                rc = tile_net_link_open(dev, &priv->link, "loop0");
+                if (rc < 0)
+                        goto fail;
+                priv->channel = rc;
+                rc = tile_net_link_open(dev, &priv->loopify_link, "loop1");
+                if (rc < 0)
+                        goto fail;
+                priv->loopify_channel = rc;
+                priv->echannel = rc;
+        } else {
+                rc = tile_net_link_open(dev, &priv->link, dev->name);
+                if (rc < 0)
+                        goto fail;
+                priv->channel = rc;
+                priv->echannel = rc;
+        }
+
+        /* Initialize egress info (if needed).  Once ever, per echannel. */
+        rc = tile_net_init_egress(dev, priv->echannel);
+        if (rc != 0)
+                goto fail;
+
+        tile_net_devs_for_channel[priv->channel] = dev;
+
+        rc = tile_net_update(dev);
+        if (rc != 0)
+                goto fail;
+
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        /* Initialize the transmit wake timer for this device for each cpu. */
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                struct tile_net_tx_wake *tx_wake =
+                        &info->tx_wake[priv->echannel];
+
+                hrtimer_init(&tx_wake->timer, CLOCK_MONOTONIC,
+                             HRTIMER_MODE_REL);
+                tx_wake->timer.function = tile_net_handle_tx_wake_timer;
+                tx_wake->dev = dev;
+        }
+
+        for_each_online_cpu(cpu)
+                netif_start_subqueue(dev, cpu);
+        netif_carrier_on(dev);
+        return 0;
+
+fail:
+        if (priv->loopify_channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->loopify_link) != 0)
+                        netdev_warn(dev, "Failed to close loopify link!\n");
+                priv->loopify_channel = -1;
+        }
+        if (priv->channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->link) != 0)
+                        netdev_warn(dev, "Failed to close link!\n");
+                priv->channel = -1;
+        }
+        priv->echannel = -1;
+        tile_net_devs_for_channel[priv->channel] = NULL;
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        /* Don't return raw gxio error codes to generic Linux. */
+        return (rc > -512) ? rc : -EIO;
+}
+
+/* Help the kernel deactivate the given network interface. */
+static int tile_net_stop(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int cpu;
+
+        for_each_online_cpu(cpu) {
+                struct tile_net_info *info = &per_cpu(per_cpu_info, cpu);
+                struct tile_net_tx_wake *tx_wake =
+                        &info->tx_wake[priv->echannel];
+
+                hrtimer_cancel(&tx_wake->timer);
+                netif_stop_subqueue(dev, cpu);
+        }
+
+        mutex_lock(&tile_net_devs_for_channel_mutex);
+        tile_net_devs_for_channel[priv->channel] = NULL;
+        (void)tile_net_update(dev);
+        if (priv->loopify_channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->loopify_link) != 0)
+                        netdev_warn(dev, "Failed to close loopify link!\n");
+                priv->loopify_channel = -1;
+        }
+        if (priv->channel >= 0) {
+                if (gxio_mpipe_link_close(&priv->link) != 0)
+                        netdev_warn(dev, "Failed to close link!\n");
+                priv->channel = -1;
+        }
+        priv->echannel = -1;
+        mutex_unlock(&tile_net_devs_for_channel_mutex);
+
+        return 0;
+}
+
+/* Determine the VA for a fragment. */
+static inline void *tile_net_frag_buf(skb_frag_t *f)
+{
+        unsigned long pfn = page_to_pfn(skb_frag_page(f));
+        return pfn_to_kaddr(pfn) + f->page_offset;
+}
+
+/* Acquire a completion entry and an egress slot, or if we can't,
+ * stop the queue and schedule the tx_wake timer.
+ */
+static s64 tile_net_equeue_try_reserve(struct net_device *dev,
+                                       struct tile_net_comps *comps,
+                                       gxio_mpipe_equeue_t *equeue,
+                                       int num_edescs)
+{
+        /* Try to acquire a completion entry. */
+        if (comps->comp_next - comps->comp_last < TILE_NET_MAX_COMPS - 1 ||
+            tile_net_free_comps(equeue, comps, 32, false) != 0) {
+
+                /* Try to acquire an egress slot. */
+                s64 slot = gxio_mpipe_equeue_try_reserve(equeue, num_edescs);
+                if (slot >= 0)
+                        return slot;
+
+                /* Freeing some completions gives the equeue time to drain. */
+                tile_net_free_comps(equeue, comps, TILE_NET_MAX_COMPS, false);
+
+                slot = gxio_mpipe_equeue_try_reserve(equeue, num_edescs);
+                if (slot >= 0)
+                        return slot;
+        }
+
+        /* Still nothing; give up and stop the queue for a short while. */
+        netif_stop_subqueue(dev, smp_processor_id());
+        tile_net_schedule_tx_wake_timer(dev);
+        return -1;
+}
+
+/* Determine how many edesc's are needed for TSO.
+ *
+ * Sometimes, if "sendfile()" requires copying, we will be called with
+ * "data" containing the header and payload, with "frags" being empty.
+ * Sometimes, for example when using NFS over TCP, a single segment can
+ * span 3 fragments.  This requires special care.
+ */
+static int tso_count_edescs(struct sk_buff *skb)
+{
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int data_len = skb->data_len;
+        unsigned int p_len = sh->gso_size;
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        int num_edescs = 0;
+        int segment;
+
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+
+                unsigned int p_used = 0;
+
+                /* One edesc for header and for each piece of the payload. */
+                for (num_edescs++; p_used < p_len; num_edescs++) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+                }
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        return num_edescs;
+}
+
+/* Prepare modified copies of the skbuff headers.
+ * FIXME: add support for IPv6.
+ */
+static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers,
+                                s64 slot)
+{
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        struct iphdr *ih;
+        struct tcphdr *th;
+        unsigned int data_len = skb->data_len;
+        unsigned char *data = skb->data;
+        unsigned int ih_off, th_off, sh_len, p_len;
+        unsigned int isum_seed, tsum_seed, id, seq;
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        int segment;
+
+        /* Locate original headers and compute various lengths. */
+        ih = ip_hdr(skb);
+        th = tcp_hdr(skb);
+        ih_off = skb_network_offset(skb);
+        th_off = skb_transport_offset(skb);
+        sh_len = th_off + tcp_hdrlen(skb);
+        p_len = sh->gso_size;
+
+        /* Set up seed values for IP and TCP csum and initialize id and seq. */
+        isum_seed = ((0xFFFF - ih->check) +
+                     (0xFFFF - ih->tot_len) +
+                     (0xFFFF - ih->id));
+        tsum_seed = th->check + (0xFFFF ^ htons(skb->len));
+        id = ntohs(ih->id);
+        seq = ntohl(th->seq);
+
+        /* Prepare all the headers. */
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+                unsigned char *buf;
+                unsigned int p_used = 0;
+
+                /* Copy to the header memory for this segment. */
+                buf = headers + (slot % EQUEUE_ENTRIES) * HEADER_BYTES +
+                        NET_IP_ALIGN;
+                memcpy(buf, data, sh_len);
+
+                /* Update copied ip header. */
+                ih = (struct iphdr *)(buf + ih_off);
+                ih->tot_len = htons(sh_len + p_len - ih_off);
+                ih->id = htons(id);
+                ih->check = csum_long(isum_seed + ih->tot_len +
+                                      ih->id) ^ 0xffff;
+
+                /* Update copied tcp header. */
+                th = (struct tcphdr *)(buf + th_off);
+                th->seq = htonl(seq);
+                th->check = csum_long(tsum_seed + htons(sh_len + p_len));
+                if (segment != sh->gso_segs - 1) {
+                        th->fin = 0;
+                        th->psh = 0;
+                }
+
+                /* Skip past the header. */
+                slot++;
+
+                /* Skip past the payload. */
+                while (p_used < p_len) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+
+                        slot++;
+                }
+
+                id++;
+                seq += p_len;
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        /* Flush the headers so they are ready for hardware DMA. */
+        wmb();
+}
+
+/* Pass all the data to mpipe for egress. */
+static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue,
+                       struct sk_buff *skb, unsigned char *headers, s64 slot)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        struct skb_shared_info *sh = skb_shinfo(skb);
+        unsigned int data_len = skb->data_len;
+        unsigned int p_len = sh->gso_size;
+        gxio_mpipe_edesc_t edesc_head = { { 0 } };
+        gxio_mpipe_edesc_t edesc_body = { { 0 } };
+        long f_id = -1;    /* id of the current fragment */
+        long f_size = -1;  /* size of the current fragment */
+        long f_used = -1;  /* bytes used from the current fragment */
+        long n;            /* size of the current piece of payload */
+        unsigned long tx_packets = 0, tx_bytes = 0;
+        unsigned int csum_start, sh_len;
+        int segment;
+
+        /* Prepare to egress the headers: set up header edesc. */
+        csum_start = skb_checksum_start_offset(skb);
+        sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb);
+        edesc_head.csum = 1;
+        edesc_head.csum_start = csum_start;
+        edesc_head.csum_dest = csum_start + skb->csum_offset;
+        edesc_head.xfer_size = sh_len;
+
+        /* This is only used to specify the TLB. */
+        edesc_head.stack_idx = large_buffer_stack;
+        edesc_body.stack_idx = large_buffer_stack;
+
+        /* Egress all the edescs. */
+        for (segment = 0; segment < sh->gso_segs; segment++) {
+                void *va;
+                unsigned char *buf;
+                unsigned int p_used = 0;
+
+                /* Egress the header. */
+                buf = headers + (slot % EQUEUE_ENTRIES) * HEADER_BYTES +
+                        NET_IP_ALIGN;
+                edesc_head.va = va_to_tile_io_addr(buf);
+                gxio_mpipe_equeue_put_at(equeue, edesc_head, slot);
+                slot++;
+
+                /* Egress the payload. */
+                while (p_used < p_len) {
+
+                        /* Advance as needed. */
+                        while (f_used >= f_size) {
+                                f_id++;
+                                f_size = sh->frags[f_id].size;
+                                f_used = 0;
+                        }
+
+                        va = tile_net_frag_buf(&sh->frags[f_id]) + f_used;
+
+                        /* Use bytes from the current fragment. */
+                        n = p_len - p_used;
+                        if (n > f_size - f_used)
+                                n = f_size - f_used;
+                        f_used += n;
+                        p_used += n;
+
+                        /* Egress a piece of the payload. */
+                        edesc_body.va = va_to_tile_io_addr(va);
+                        edesc_body.xfer_size = n;
+                        edesc_body.bound = !(p_used < p_len);
+                        gxio_mpipe_equeue_put_at(equeue, edesc_body, slot);
+                        slot++;
+                }
+
+                tx_packets++;
+                tx_bytes += sh_len + p_len;
+
+                /* The last segment may be less than gso_size. */
+                data_len -= p_len;
+                if (data_len < p_len)
+                        p_len = data_len;
+        }
+
+        /* Update stats. */
+        tile_net_stats_add(tx_packets, &priv->stats.tx_packets);
+        tile_net_stats_add(tx_bytes, &priv->stats.tx_bytes);
+}
+
+/* Do "TSO" handling for egress.
+ *
+ * Normally drivers set NETIF_F_TSO only to support hardware TSO;
+ * otherwise the stack uses scatter-gather to implement GSO in software.
+ * On our testing, enabling GSO support (via NETIF_F_SG) drops network
+ * performance down to around 7.5 Gbps on the 10G interfaces, although
+ * also dropping cpu utilization way down, to under 8%.  But
+ * implementing "TSO" in the driver brings performance back up to line
+ * rate, while dropping cpu usage even further, to less than 4%.  In
+ * practice, profiling of GSO shows that skb_segment() is what causes
+ * the performance overheads; we benefit in the driver from using
+ * preallocated memory to duplicate the TCP/IP headers.
+ */
+static int tile_net_tx_tso(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+        int channel = priv->echannel;
+        struct tile_net_egress *egress = &egress_for_echannel[channel];
+        struct tile_net_comps *comps = info->comps_for_echannel[channel];
+        gxio_mpipe_equeue_t *equeue = egress->equeue;
+        unsigned long irqflags;
+        int num_edescs;
+        s64 slot;
+
+        /* Determine how many mpipe edesc's are needed. */
+        num_edescs = tso_count_edescs(skb);
+
+        local_irq_save(irqflags);
+
+        /* Try to acquire a completion entry and an egress slot. */
+        slot = tile_net_equeue_try_reserve(dev, comps, equeue, num_edescs);
+        if (slot < 0) {
+                local_irq_restore(irqflags);
+                return NETDEV_TX_BUSY;
+        }
+
+        /* Set up copies of header data properly. */
+        tso_headers_prepare(skb, egress->headers, slot);
+
+        /* Actually pass the data to the network hardware. */
+        tso_egress(dev, equeue, skb, egress->headers, slot);
+
+        /* Add a completion record. */
+        add_comp(equeue, comps, slot + num_edescs - 1, skb);
+
+        local_irq_restore(irqflags);
+
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer();
+
+        return NETDEV_TX_OK;
+}
+
+/* Analyze the body and frags for a transmit request. */
+static unsigned int tile_net_tx_frags(struct frag *frags,
+                                       struct sk_buff *skb,
+                                       void *b_data, unsigned int b_len)
+{
+        unsigned int i, n = 0;
+
+        struct skb_shared_info *sh = skb_shinfo(skb);
+
+        if (b_len != 0) {
+                frags[n].buf = b_data;
+                frags[n++].length = b_len;
+        }
+
+        for (i = 0; i < sh->nr_frags; i++) {
+                skb_frag_t *f = &sh->frags[i];
+                frags[n].buf = tile_net_frag_buf(f);
+                frags[n++].length = skb_frag_size(f);
+        }
+
+        return n;
+}
+
+/* Help the kernel transmit a packet. */
+static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        struct tile_net_priv *priv = netdev_priv(dev);
+        struct tile_net_egress *egress = &egress_for_echannel[priv->echannel];
+        gxio_mpipe_equeue_t *equeue = egress->equeue;
+        struct tile_net_comps *comps =
+                info->comps_for_echannel[priv->echannel];
+        unsigned int len = skb->len;
+        unsigned char *data = skb->data;
+        unsigned int num_edescs;
+        struct frag frags[MAX_FRAGS];
+        gxio_mpipe_edesc_t edescs[MAX_FRAGS];
+        unsigned long irqflags;
+        gxio_mpipe_edesc_t edesc = { { 0 } };
+        unsigned int i;
+        s64 slot;
+
+        if (skb_is_gso(skb))
+                return tile_net_tx_tso(skb, dev);
+
+        num_edescs = tile_net_tx_frags(frags, skb, data, skb_headlen(skb));
+
+        /* This is only used to specify the TLB. */
+        edesc.stack_idx = large_buffer_stack;
+
+        /* Prepare the edescs. */
+        for (i = 0; i < num_edescs; i++) {
+                edesc.xfer_size = frags[i].length;
+                edesc.va = va_to_tile_io_addr(frags[i].buf);
+                edescs[i] = edesc;
+        }
+
+        /* Mark the final edesc. */
+        edescs[num_edescs - 1].bound = 1;
+
+        /* Add checksum info to the initial edesc, if needed. */
+        if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                unsigned int csum_start = skb_checksum_start_offset(skb);
+                edescs[0].csum = 1;
+                edescs[0].csum_start = csum_start;
+                edescs[0].csum_dest = csum_start + skb->csum_offset;
+        }
+
+        local_irq_save(irqflags);
+
+        /* Try to acquire a completion entry and an egress slot. */
+        slot = tile_net_equeue_try_reserve(dev, comps, equeue, num_edescs);
+        if (slot < 0) {
+                local_irq_restore(irqflags);
+                return NETDEV_TX_BUSY;
+        }
+
+        for (i = 0; i < num_edescs; i++)
+                gxio_mpipe_equeue_put_at(equeue, edescs[i], slot++);
+
+        /* Add a completion record. */
+        add_comp(equeue, comps, slot - 1, skb);
+
+        /* NOTE: Use ETH_ZLEN for short packets (e.g. 42 < 60). */
+        tile_net_stats_add(1, &priv->stats.tx_packets);
+        tile_net_stats_add(max_t(unsigned int, len, ETH_ZLEN),
+                           &priv->stats.tx_bytes);
+
+        local_irq_restore(irqflags);
+
+        /* Make sure the egress timer is scheduled. */
+        tile_net_schedule_egress_timer();
+
+        return NETDEV_TX_OK;
+}
+
+/* Return subqueue id on this core (one per core). */
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+{
+        return smp_processor_id();
+}
+
+/* Deal with a transmit timeout. */
+static void tile_net_tx_timeout(struct net_device *dev)
+{
+        int cpu;
+
+        for_each_online_cpu(cpu)
+                netif_wake_subqueue(dev, cpu);
+}
+
+/* Ioctl commands. */
+static int tile_net_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+{
+        return -EOPNOTSUPP;
+}
+
+/* Get system network statistics for device. */
+static struct net_device_stats *tile_net_get_stats(struct net_device *dev)
+{
+        struct tile_net_priv *priv = netdev_priv(dev);
+        return &priv->stats;
+}
+
+/* Change the MTU. */
+static int tile_net_change_mtu(struct net_device *dev, int new_mtu)
+{
+        if ((new_mtu < 68) || (new_mtu > 1500))
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
+/* Change the Ethernet address of the NIC.
+ *
+ * The hypervisor driver does not support changing MAC address.  However,
+ * the hardware does not do anything with the MAC address, so the address
+ * which gets used on outgoing packets, and which is accepted on incoming
+ * packets, is completely up to us.
+ *
+ * Returns 0 on success, negative on failure.
+ */
+static int tile_net_set_mac_address(struct net_device *dev, void *p)
+{
+        struct sockaddr *addr = p;
+
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EINVAL;
+        memcpy(dev->dev_addr, addr->sa_data, dev->addr_len);
+        return 0;
+}
+
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/* Polling 'interrupt' - used by things like netconsole to send skbs
+ * without having to re-enable interrupts. It's not called while
+ * the interrupt routine is executing.
+ */
+static void tile_net_netpoll(struct net_device *dev)
+{
+        disable_percpu_irq(ingress_irq);
+        tile_net_handle_ingress_irq(ingress_irq, NULL);
+        enable_percpu_irq(ingress_irq, 0);
+}
+#endif
+
+static const struct net_device_ops tile_net_ops = {
+        .ndo_open = tile_net_open,
+        .ndo_stop = tile_net_stop,
+        .ndo_start_xmit = tile_net_tx,
+        .ndo_select_queue = tile_net_select_queue,
+        .ndo_do_ioctl = tile_net_ioctl,
+        .ndo_get_stats = tile_net_get_stats,
+        .ndo_change_mtu = tile_net_change_mtu,
+        .ndo_tx_timeout = tile_net_tx_timeout,
+        .ndo_set_mac_address = tile_net_set_mac_address,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_poll_controller = tile_net_netpoll,
+#endif
+};
+
+/* The setup function.
+ *
+ * This uses ether_setup() to assign various fields in dev, including
+ * setting IFF_BROADCAST and IFF_MULTICAST, then sets some extra fields.
+ */
+static void tile_net_setup(struct net_device *dev)
+{
+        ether_setup(dev);
+        dev->netdev_ops = &tile_net_ops;
+        dev->watchdog_timeo = TILE_NET_TIMEOUT;
+        dev->features |= NETIF_F_LLTX;
+        dev->features |= NETIF_F_HW_CSUM;
+        dev->features |= NETIF_F_SG;
+        dev->features |= NETIF_F_TSO;
+        dev->mtu = 1500;
+}
+
+/* Allocate the device structure, register the device, and obtain the
+ * MAC address from the hypervisor.
+ */
+static void tile_net_dev_init(const char *name, const uint8_t *mac)
+{
+        int ret;
+        int i;
+        int nz_addr = 0;
+        struct net_device *dev;
+        struct tile_net_priv *priv;
+
+        /* HACK: Ignore "loop" links. */
+        if (strncmp(name, "loop", 4) == 0)
+                return;
+
+        /* Allocate the device structure.  Normally, "name" is a
+         * template, instantiated by register_netdev(), but not for us.
+         */
+        dev = alloc_netdev_mqs(sizeof(*priv), name, tile_net_setup,
+                               NR_CPUS, 1);
+        if (!dev) {
+                pr_err("alloc_netdev_mqs(%s) failed\n", name);
+                return;
+        }
+
+        /* Initialize "priv". */
+        priv = netdev_priv(dev);
+        memset(priv, 0, sizeof(*priv));
+        priv->dev = dev;
+        priv->channel = -1;
+        priv->loopify_channel = -1;
+        priv->echannel = -1;
+
+        /* Get the MAC address and set it in the device struct; this must
+         * be done before the device is opened.  If the MAC is all zeroes,
+         * we use a random address, since we're probably on the simulator.
+         */
+        for (i = 0; i < 6; i++)
+                nz_addr |= mac[i];
+
+        if (nz_addr) {
+                memcpy(dev->dev_addr, mac, 6);
+                dev->addr_len = 6;
+        } else {
+                random_ether_addr(dev->dev_addr);
+        }
+
+        /* Register the network device. */
+        ret = register_netdev(dev);
+        if (ret) {
+                netdev_err(dev, "register_netdev failed %d\n", ret);
+                free_netdev(dev);
+                return;
+        }
+}
+
+/* Per-cpu module initialization. */
+static void tile_net_init_module_percpu(void *unused)
+{
+        struct tile_net_info *info = &__get_cpu_var(per_cpu_info);
+        int my_cpu = smp_processor_id();
+
+        info->has_iqueue = false;
+
+        info->my_cpu = my_cpu;
+
+        /* Initialize the egress timer. */
+        hrtimer_init(&info->egress_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        info->egress_timer.function = tile_net_handle_egress_timer;
+}
+
+/* Module initialization. */
+static int __init tile_net_init_module(void)
+{
+        int i;
+        char name[GXIO_MPIPE_LINK_NAME_LEN];
+        uint8_t mac[6];
+
+        pr_info("Tilera Network Driver\n");
+
+        mutex_init(&tile_net_devs_for_channel_mutex);
+
+        /* Initialize each CPU. */
+        on_each_cpu(tile_net_init_module_percpu, NULL, 1);
+
+        /* Find out what devices we have, and initialize them. */
+        for (i = 0; gxio_mpipe_link_enumerate_mac(i, name, mac) >= 0; i++)
+                tile_net_dev_init(name, mac);
+
+        if (!network_cpus_init())
+                network_cpus_map = *cpu_online_mask;
+
+        return 0;
+}
+
+module_init(tile_net_init_module);
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 4ffcd57b011..2857ab078aa 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -478,6 +478,7 @@ struct netvsc_device {
         u32 nvsp_version;
 
         atomic_t num_outstanding_sends;
+        wait_queue_head_t wait_drain;
         bool start_remove;
         bool destroy;
         /*
diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
index 8b919471472..0c569831db5 100644
--- a/drivers/net/hyperv/netvsc.c
+++ b/drivers/net/hyperv/netvsc.c
@@ -42,6 +42,7 @@ static struct netvsc_device *alloc_net_device(struct hv_device *device)
         if (!net_device)
                 return NULL;
 
+        init_waitqueue_head(&net_device->wait_drain);
         net_device->start_remove = false;
         net_device->destroy = false;
         net_device->dev = device;
@@ -387,12 +388,8 @@ int netvsc_device_remove(struct hv_device *device)
         spin_unlock_irqrestore(&device->channel->inbound_lock, flags);
 
         /* Wait for all send completions */
-        while (atomic_read(&net_device->num_outstanding_sends)) {
-                dev_info(&device->device,
-                        "waiting for %d requests to complete...\n",
-                        atomic_read(&net_device->num_outstanding_sends));
-                udelay(100);
-        }
+        wait_event(net_device->wait_drain,
+                   atomic_read(&net_device->num_outstanding_sends) == 0);
 
         netvsc_disconnect_vsp(net_device);
 
@@ -486,6 +483,9 @@ static void netvsc_send_completion(struct hv_device *device,
                 num_outstanding_sends =
                         atomic_dec_return(&net_device->num_outstanding_sends);
 
+                if (net_device->destroy && num_outstanding_sends == 0)
+                        wake_up(&net_device->wait_drain);
+
                 if (netif_queue_stopped(ndev) && !net_device->start_remove &&
                         (hv_ringbuf_avail_percent(&device->channel->outbound)
                         > RING_AVAIL_PERCENT_HIWATER ||
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index 5ac46f5226f..47f8e893926 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -41,6 +41,8 @@ MODULE_LICENSE("GPL");
 #define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 #define IP101A_G_IRQ_CONF_STATUS        0x11    /* Conf Info IRQ & Status Reg */
+#define IP101A_G_IRQ_PIN_USED           (1<<15) /* INTR pin used */
+#define IP101A_G_IRQ_DEFAULT            IP101A_G_IRQ_PIN_USED
 
 static int ip175c_config_init(struct phy_device *phydev)
 {
@@ -136,6 +138,11 @@ static int ip1001_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
+        /* INTR pin used: speed/link/duplex will cause an interrupt */
+        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
+        if (c < 0)
+                return c;
+
         if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
                 /* Additional delay (2ns) used to adjust RX clock phase
                  * at RGMII interface */
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 683ef1ce551..5061608f408 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -96,7 +96,7 @@ static int of_mdio_bus_match(struct device *dev, void *mdio_bus_np)
 }
 /**
  * of_mdio_find_bus - Given an mii_bus node, find the mii_bus.
- * @mdio_np: Pointer to the mii_bus.
+ * @mdio_bus_np: Pointer to the mii_bus.
  *
  * Returns a pointer to the mii_bus, or NULL if none found.
  *
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
index 3faef5670d1..d75d1f56bec 100644
--- a/drivers/net/usb/sierra_net.c
+++ b/drivers/net/usb/sierra_net.c
@@ -946,7 +946,7 @@ struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 }
 
 static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
-static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+static const struct sierra_net_info_data sierra_net_info_data_direct_ip = {
         .rx_urb_size = 8 * 1024,
         .whitelist = {
                 .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
@@ -954,7 +954,7 @@ static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
         }
 };
 
-static const struct driver_info sierra_net_info_68A3 = {
+static const struct driver_info sierra_net_info_direct_ip = {
         .description = "Sierra Wireless USB-to-WWAN Modem",
         .flags = FLAG_WWAN | FLAG_SEND_ZLP,
         .bind = sierra_net_bind,
@@ -962,12 +962,18 @@ static const struct driver_info sierra_net_info_68A3 = {
         .status = sierra_net_status,
         .rx_fixup = sierra_net_rx_fixup,
         .tx_fixup = sierra_net_tx_fixup,
-        .data = (unsigned long)&sierra_net_info_data_68A3,
+        .data = (unsigned long)&sierra_net_info_data_direct_ip,
 };
 
 static const struct usb_device_id products[] = {
         {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
-        .driver_info = (unsigned long) &sierra_net_info_68A3},
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x0F3D, 0x68A3), /* AT&T Direct IP modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x1199, 0x68AA), /* Sierra Wireless Direct IP LTE modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
+        {USB_DEVICE(0x0F3D, 0x68AA), /* AT&T Direct IP LTE modem */
+        .driver_info = (unsigned long) &sierra_net_info_direct_ip},
 
         {}, /* last item */
 };
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 5214b1eceb9..f18149ae258 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -42,7 +42,8 @@ module_param(gso, bool, 0444);
 #define VIRTNET_DRIVER_VERSION "1.0.0"
 
 struct virtnet_stats {
-        struct u64_stats_sync syncp;
+        struct u64_stats_sync tx_syncp;
+        struct u64_stats_sync rx_syncp;
         u64 tx_bytes;
         u64 tx_packets;
 
@@ -300,10 +301,10 @@ static void receive_buf(struct net_device *dev, void *buf, unsigned int len)
 
         hdr = skb_vnet_hdr(skb);
 
-        u64_stats_update_begin(&stats->syncp);
+        u64_stats_update_begin(&stats->rx_syncp);
         stats->rx_bytes += skb->len;
         stats->rx_packets++;
-        u64_stats_update_end(&stats->syncp);
+        u64_stats_update_end(&stats->rx_syncp);
 
         if (hdr->hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
                 pr_debug("Needs csum!\n");
@@ -565,10 +566,10 @@ static unsigned int free_old_xmit_skbs(struct virtnet_info *vi)
         while ((skb = virtqueue_get_buf(vi->svq, &len)) != NULL) {
                 pr_debug("Sent skb %p\n", skb);
 
-                u64_stats_update_begin(&stats->syncp);
+                u64_stats_update_begin(&stats->tx_syncp);
                 stats->tx_bytes += skb->len;
                 stats->tx_packets++;
-                u64_stats_update_end(&stats->syncp);
+                u64_stats_update_end(&stats->tx_syncp);
 
                 tot_sgs += skb_vnet_hdr(skb)->num_sg;
                 dev_kfree_skb_any(skb);
@@ -703,12 +704,16 @@ static struct rtnl_link_stats64 *virtnet_stats(struct net_device *dev,
                 u64 tpackets, tbytes, rpackets, rbytes;
 
                 do {
-                        start = u64_stats_fetch_begin(&stats->syncp);
+                        start = u64_stats_fetch_begin(&stats->tx_syncp);
                         tpackets = stats->tx_packets;
                         tbytes   = stats->tx_bytes;
+                } while (u64_stats_fetch_retry(&stats->tx_syncp, start));
+
+                do {
+                        start = u64_stats_fetch_begin(&stats->rx_syncp);
                         rpackets = stats->rx_packets;
                         rbytes   = stats->rx_bytes;
-                } while (u64_stats_fetch_retry(&stats->syncp, start));
+                } while (u64_stats_fetch_retry(&stats->rx_syncp, start));
 
                 tot->rx_packets += rpackets;
                 tot->tx_packets += tpackets;
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 67c13af6f20..c06b6cb5c91 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -877,6 +877,10 @@ struct b43_wl {
          * from the mac80211 subsystem. */
         u16 mac80211_initially_registered_queues;
 
+        /* Set this if we call ieee80211_register_hw() and check if we call
+         * ieee80211_unregister_hw(). */
+        bool hw_registred;
+
         /* We can only have one operating interface (802.11 core)
          * at a time. General information about this interface follows.
          */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 5a39b226b2e..acd03a4f973 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2437,6 +2437,7 @@ start_ieee80211:
         err = ieee80211_register_hw(wl->hw);
         if (err)
                 goto err_one_core_detach;
+        wl->hw_registred = true;
         b43_leds_register(wl->current_dev);
         goto out;
 
@@ -5299,6 +5300,7 @@ static struct b43_wl *b43_wireless_init(struct b43_bus_dev *dev)
 
         hw->queues = modparam_qos ? B43_QOS_QUEUE_NUM : 1;
         wl->mac80211_initially_registered_queues = hw->queues;
+        wl->hw_registred = false;
         hw->max_rates = 2;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
@@ -5370,12 +5372,15 @@ static void b43_bcma_remove(struct bcma_device *core)
          * as the ieee80211 unreg will destroy the workqueue. */
         cancel_work_sync(&wldev->restart_work);
 
-        /* Restore the queues count before unregistering, because firmware detect
-         * might have modified it. Restoring is important, so the networking
-         * stack can properly free resources. */
-        wl->hw->queues = wl->mac80211_initially_registered_queues;
-        b43_leds_stop(wldev);
-        ieee80211_unregister_hw(wl->hw);
+        B43_WARN_ON(!wl);
+        if (wl->current_dev == wldev && wl->hw_registred) {
+                /* Restore the queues count before unregistering, because firmware detect
+                 * might have modified it. Restoring is important, so the networking
+                 * stack can properly free resources. */
+                wl->hw->queues = wl->mac80211_initially_registered_queues;
+                b43_leds_stop(wldev);
+                ieee80211_unregister_hw(wl->hw);
+        }
 
         b43_one_core_detach(wldev->dev);
 
@@ -5446,7 +5451,7 @@ static void b43_ssb_remove(struct ssb_device *sdev)
         cancel_work_sync(&wldev->restart_work);
 
         B43_WARN_ON(!wl);
-        if (wl->current_dev == wldev) {
+        if (wl->current_dev == wldev && wl->hw_registred) {
                 /* Restore the queues count before unregistering, because firmware detect
                  * might have modified it. Restoring is important, so the networking
                  * stack can properly free resources. */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index e2480d19627..8e7e6928c93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -89,9 +89,9 @@ int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
         data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
         brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
 
-        /* redirect, configure ane enable io for interrupt signal */
+        /* redirect, configure and enable io for interrupt signal */
         data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
-        if (sdiodev->irq_flags | IRQF_TRIGGER_HIGH)
+        if (sdiodev->irq_flags & IRQF_TRIGGER_HIGH)
                 data |= SDIO_SEPINT_ACT_HI;
         brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 9cfae0c0870..95aa8e1683e 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1903,14 +1903,6 @@ static void ipw2100_down(struct ipw2100_priv *priv)
         netif_stop_queue(priv->net_dev);
 }
 
-/* Called by register_netdev() */
-static int ipw2100_net_init(struct net_device *dev)
-{
-        struct ipw2100_priv *priv = libipw_priv(dev);
-
-        return ipw2100_up(priv, 1);
-}
-
 static int ipw2100_wdev_init(struct net_device *dev)
 {
         struct ipw2100_priv *priv = libipw_priv(dev);
@@ -6087,7 +6079,6 @@ static const struct net_device_ops ipw2100_netdev_ops = {
         .ndo_stop               = ipw2100_close,
         .ndo_start_xmit         = libipw_xmit,
         .ndo_change_mtu         = libipw_change_mtu,
-        .ndo_init               = ipw2100_net_init,
         .ndo_tx_timeout         = ipw2100_tx_timeout,
         .ndo_set_mac_address    = ipw2100_set_address,
         .ndo_validate_addr      = eth_validate_addr,
@@ -6329,6 +6320,10 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
         printk(KERN_INFO DRV_NAME
                ": Detected Intel PRO/Wireless 2100 Network Connection\n");
 
+        err = ipw2100_up(priv, 1);
+        if (err)
+                goto fail;
+
         err = ipw2100_wdev_init(dev);
         if (err)
                 goto fail;
@@ -6338,12 +6333,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
          * network device we would call ipw2100_up.  This introduced a race
          * condition with newer hotplug configurations (network was coming
          * up and making calls before the device was initialized).
-         *
-         * If we called ipw2100_up before we registered the device, then the
-         * device name wasn't registered.  So, we instead use the net_dev->init
-         * member to call a function that then just turns and calls ipw2100_up.
-         * net_dev->init is called after name allocation but before the
-         * notifier chain is called */
+         */
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_WARNING DRV_NAME
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 19f7ee84ae8..e5e8ada4aaf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -35,17 +35,20 @@
 #define IWL6000_UCODE_API_MAX 6
 #define IWL6050_UCODE_API_MAX 5
 #define IWL6000G2_UCODE_API_MAX 6
+#define IWL6035_UCODE_API_MAX 6
 
 /* Oldest version we won't warn about */
 #define IWL6000_UCODE_API_OK 4
 #define IWL6000G2_UCODE_API_OK 5
 #define IWL6050_UCODE_API_OK 5
 #define IWL6000G2B_UCODE_API_OK 6
+#define IWL6035_UCODE_API_OK 6
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
-#define IWL6000G2_UCODE_API_MIN 4
+#define IWL6000G2_UCODE_API_MIN 5
+#define IWL6035_UCODE_API_MIN 6
 
 /* EEPROM versions */
 #define EEPROM_6000_TX_POWER_VERSION    (4)
@@ -227,9 +230,25 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         IWL_DEVICE_6030,
 };
 
+#define IWL_DEVICE_6035                                         \
+        .fw_name_pre = IWL6030_FW_PRE,                          \
+        .ucode_api_max = IWL6035_UCODE_API_MAX,                 \
+        .ucode_api_ok = IWL6035_UCODE_API_OK,                   \
+        .ucode_api_min = IWL6035_UCODE_API_MIN,                 \
+        .device_family = IWL_DEVICE_FAMILY_6030,                \
+        .max_inst_size = IWL60_RTC_INST_SIZE,                   \
+        .max_data_size = IWL60_RTC_DATA_SIZE,                   \
+        .eeprom_ver = EEPROM_6030_EEPROM_VERSION,               \
+        .eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,       \
+        .base_params = &iwl6000_g2_base_params,                 \
+        .bt_params = &iwl6000_bt_params,                        \
+        .need_temp_offset_calib = true,                         \
+        .led_mode = IWL_LED_RF_STATE,                           \
+        .adv_pm = true
+
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
-        IWL_DEVICE_6030,
+        IWL_DEVICE_6035,
         .ht_params = &iwl6000_ht_params,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
index aea07aab3c9..eb6a8eaf42f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-sta.c
@@ -1267,7 +1267,7 @@ int iwl_remove_dynamic_key(struct iwl_priv *priv,
                 key_flags |= STA_KEY_MULTICAST_MSK;
 
         sta_cmd.key.key_flags = key_flags;
-        sta_cmd.key.key_offset = WEP_INVALID_OFFSET;
+        sta_cmd.key.key_offset = keyconf->hw_key_idx;
         sta_cmd.sta.modify_mask = STA_MODIFY_KEY_MASK;
         sta_cmd.mode = STA_CONTROL_MODIFY_MSK;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index d742900969e..fac67a526a3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -861,13 +861,18 @@ static void iwl_ucode_callback(const struct firmware *ucode_raw, void *context)
 
         /* We have our copies now, allow OS release its copies */
         release_firmware(ucode_raw);
-        complete(&drv->request_firmware_complete);
 
         drv->op_mode = iwl_dvm_ops.start(drv->trans, drv->cfg, &drv->fw);
 
         if (!drv->op_mode)
-                goto out_free_fw;
+                goto out_unbind;
 
+        /*
+         * Complete the firmware request last so that
+         * a driver unbind (stop) doesn't run while we
+         * are doing the start() above.
+         */
+        complete(&drv->request_firmware_complete);
         return;
 
  try_again:
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index 50c58911e71..b8e2b223ac3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -568,28 +568,28 @@ static int iwl_find_otp_image(struct iwl_trans *trans,
  * iwl_get_max_txpower_avg - get the highest tx power from all chains.
  *     find the highest tx power from all chains for the channel
  */
-static s8 iwl_get_max_txpower_avg(const struct iwl_cfg *cfg,
+static s8 iwl_get_max_txpower_avg(struct iwl_priv *priv,
                 struct iwl_eeprom_enhanced_txpwr *enhanced_txpower,
                 int element, s8 *max_txpower_in_half_dbm)
 {
         s8 max_txpower_avg = 0; /* (dBm) */
 
         /* Take the highest tx power from any valid chains */
-        if ((cfg->valid_tx_ant & ANT_A) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_A) &&
             (enhanced_txpower[element].chain_a_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_a_max;
-        if ((cfg->valid_tx_ant & ANT_B) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_B) &&
             (enhanced_txpower[element].chain_b_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_b_max;
-        if ((cfg->valid_tx_ant & ANT_C) &&
+        if ((priv->hw_params.valid_tx_ant & ANT_C) &&
             (enhanced_txpower[element].chain_c_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].chain_c_max;
-        if (((cfg->valid_tx_ant == ANT_AB) |
-            (cfg->valid_tx_ant == ANT_BC) |
-            (cfg->valid_tx_ant == ANT_AC)) &&
+        if (((priv->hw_params.valid_tx_ant == ANT_AB) |
+            (priv->hw_params.valid_tx_ant == ANT_BC) |
+            (priv->hw_params.valid_tx_ant == ANT_AC)) &&
             (enhanced_txpower[element].mimo2_max > max_txpower_avg))
                 max_txpower_avg =  enhanced_txpower[element].mimo2_max;
-        if ((cfg->valid_tx_ant == ANT_ABC) &&
+        if ((priv->hw_params.valid_tx_ant == ANT_ABC) &&
             (enhanced_txpower[element].mimo3_max > max_txpower_avg))
                 max_txpower_avg = enhanced_txpower[element].mimo3_max;
 
@@ -691,7 +691,7 @@ static void iwl_eeprom_enhanced_txpower(struct iwl_priv *priv)
                                  ((txp->delta_20_in_40 & 0xf0) >> 4),
                                  (txp->delta_20_in_40 & 0x0f));
 
-                max_txp_avg = iwl_get_max_txpower_avg(priv->cfg, txp_array, idx,
+                max_txp_avg = iwl_get_max_txpower_avg(priv, txp_array, idx,
                                                       &max_txp_avg_halfdbm);
 
                 /*
diff --git a/drivers/net/wireless/iwlwifi/iwl-mac80211.c b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
index ab2f4d7500a..3ee23134c02 100644
--- a/drivers/net/wireless/iwlwifi/iwl-mac80211.c
+++ b/drivers/net/wireless/iwlwifi/iwl-mac80211.c
@@ -199,6 +199,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                             WIPHY_FLAG_DISABLE_BEACON_HINTS |
                             WIPHY_FLAG_IBSS_RSN;
 
+#ifdef CONFIG_PM_SLEEP
         if (priv->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             priv->trans->ops->wowlan_suspend &&
             device_can_wakeup(priv->trans->dev)) {
@@ -217,6 +218,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                 hw->wiphy->wowlan.pattern_max_len =
                                         IWLAGN_WOWLAN_MAX_PATTERN_LEN;
         }
+#endif
 
         if (iwlwifi_mod_params.power_save)
                 hw->wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT;
@@ -249,6 +251,7 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
         ret = ieee80211_register_hw(priv->hw);
         if (ret) {
                 IWL_ERR(priv, "Failed to register hw (error %d)\n", ret);
+                iwl_leds_exit(priv);
                 return ret;
         }
         priv->mac80211_registered = 1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 3b1069290fa..dfd54662e3e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -224,6 +224,7 @@
 #define SCD_TXFACT              (SCD_BASE + 0x10)
 #define SCD_ACTIVE              (SCD_BASE + 0x14)
 #define SCD_QUEUECHAIN_SEL      (SCD_BASE + 0xe8)
+#define SCD_CHAINEXT_EN         (SCD_BASE + 0x244)
 #define SCD_AGGR_SEL            (SCD_BASE + 0x248)
 #define SCD_INTERRUPT_MASK      (SCD_BASE + 0x108)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index ec6fb395b84..79c6b91417f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -1058,6 +1058,11 @@ static void iwl_tx_start(struct iwl_trans *trans)
         iwl_write_prph(trans, SCD_DRAM_BASE_ADDR,
                        trans_pcie->scd_bc_tbls.dma >> 10);
 
+        /* The chain extension of the SCD doesn't work well. This feature is
+         * enabled by default by the HW, so we need to disable it manually.
+         */
+        iwl_write_prph(trans, SCD_CHAINEXT_EN, 0);
+
         /* Enable DMA channel */
         for (chan = 0; chan < FH_TCSR_CHNL_NUM ; chan++)
                 iwl_write_direct32(trans, FH_TCSR_CHNL_TX_CONFIG_REG(chan),
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index fb787df0166..a0b7cfd3468 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1555,6 +1555,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
                         hdr = (struct ieee80211_hdr *) skb->data;
                         mac80211_hwsim_monitor_ack(data2->hw, hdr->addr2);
                 }
+                txi->flags |= IEEE80211_TX_STAT_ACK;
         }
         ieee80211_tx_status_irqsafe(data2->hw, skb);
         return 0;
@@ -1721,6 +1722,24 @@ static void hwsim_exit_netlink(void)
                        "unregister family %i\n", ret);
 }
 
+static const struct ieee80211_iface_limit hwsim_if_limits[] = {
+        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
+};
+
+static const struct ieee80211_iface_combination hwsim_if_comb = {
+        .limits = hwsim_if_limits,
+        .n_limits = ARRAY_SIZE(hwsim_if_limits),
+        .max_interfaces = 2048,
+        .num_different_channels = 1,
+};
+
 static int __init init_mac80211_hwsim(void)
 {
         int i, err = 0;
@@ -1782,6 +1801,9 @@ static int __init init_mac80211_hwsim(void)
                 hw->wiphy->n_addresses = 2;
                 hw->wiphy->addresses = data->addresses;
 
+                hw->wiphy->iface_combinations = &hwsim_if_comb;
+                hw->wiphy->n_iface_combinations = 1;
+
                 if (fake_hw_scan) {
                         hw->wiphy->max_scan_ssids = 255;
                         hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 87671446e24..015fec3371a 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -948,6 +948,19 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
                 bss_cfg->ssid.ssid_len = params->ssid_len;
         }
 
+        switch (params->hidden_ssid) {
+        case NL80211_HIDDEN_SSID_NOT_IN_USE:
+                bss_cfg->bcast_ssid_ctl = 1;
+                break;
+        case NL80211_HIDDEN_SSID_ZERO_LEN:
+                bss_cfg->bcast_ssid_ctl = 0;
+                break;
+        case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
+                /* firmware doesn't support this type of hidden SSID */
+        default:
+                return -EINVAL;
+        }
+
         if (mwifiex_set_secure_params(priv, bss_cfg, params)) {
                 kfree(bss_cfg);
                 wiphy_err(wiphy, "Failed to parse secuirty parameters!\n");
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 9f674bbebe6..561452a5c81 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -122,6 +122,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define TLV_TYPE_CHANNELBANDLIST    (PROPRIETARY_TLV_BASE_ID + 42)
 #define TLV_TYPE_UAP_BEACON_PERIOD  (PROPRIETARY_TLV_BASE_ID + 44)
 #define TLV_TYPE_UAP_DTIM_PERIOD    (PROPRIETARY_TLV_BASE_ID + 45)
+#define TLV_TYPE_UAP_BCAST_SSID     (PROPRIETARY_TLV_BASE_ID + 48)
 #define TLV_TYPE_UAP_RTS_THRESHOLD  (PROPRIETARY_TLV_BASE_ID + 51)
 #define TLV_TYPE_UAP_WPA_PASSPHRASE (PROPRIETARY_TLV_BASE_ID + 60)
 #define TLV_TYPE_UAP_ENCRY_PROTOCOL (PROPRIETARY_TLV_BASE_ID + 64)
@@ -1209,6 +1210,11 @@ struct host_cmd_tlv_ssid {
         u8 ssid[0];
 } __packed;
 
+struct host_cmd_tlv_bcast_ssid {
+        struct host_cmd_tlv tlv;
+        u8 bcast_ctl;
+} __packed;
+
 struct host_cmd_tlv_beacon_period {
         struct host_cmd_tlv tlv;
         __le16 period;
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index 76dfbc42a73..8173ab66066 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -132,6 +132,7 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
         struct host_cmd_tlv_dtim_period *dtim_period;
         struct host_cmd_tlv_beacon_period *beacon_period;
         struct host_cmd_tlv_ssid *ssid;
+        struct host_cmd_tlv_bcast_ssid *bcast_ssid;
         struct host_cmd_tlv_channel_band *chan_band;
         struct host_cmd_tlv_frag_threshold *frag_threshold;
         struct host_cmd_tlv_rts_threshold *rts_threshold;
@@ -153,6 +154,14 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
                 cmd_size += sizeof(struct host_cmd_tlv) +
                             bss_cfg->ssid.ssid_len;
                 tlv += sizeof(struct host_cmd_tlv) + bss_cfg->ssid.ssid_len;
+
+                bcast_ssid = (struct host_cmd_tlv_bcast_ssid *)tlv;
+                bcast_ssid->tlv.type = cpu_to_le16(TLV_TYPE_UAP_BCAST_SSID);
+                bcast_ssid->tlv.len =
+                                cpu_to_le16(sizeof(bcast_ssid->bcast_ctl));
+                bcast_ssid->bcast_ctl = bss_cfg->bcast_ssid_ctl;
+                cmd_size += sizeof(struct host_cmd_tlv_bcast_ssid);
+                tlv += sizeof(struct host_cmd_tlv_bcast_ssid);
         }
         if (bss_cfg->channel && bss_cfg->channel <= MAX_CHANNEL_BAND_BG) {
                 chan_band = (struct host_cmd_tlv_channel_band *)tlv;
@@ -416,6 +425,7 @@ int mwifiex_uap_set_channel(struct mwifiex_private *priv, int channel)
         if (!bss_cfg)
                 return -ENOMEM;
 
+        mwifiex_set_sys_config_invalid_data(bss_cfg);
         bss_cfg->band_cfg = BAND_CONFIG_MANUAL;
         bss_cfg->channel = channel;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index ca36cccaba3..8f754025b06 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -396,8 +396,7 @@ struct rt2x00_intf {
          * for hardware which doesn't support hardware
          * sequence counting.
          */
-        spinlock_t seqlock;
-        u16 seqno;
+        atomic_t seqno;
 };
 
 static inline struct rt2x00_intf* vif_to_intf(struct ieee80211_vif *vif)
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index b49773ef72f..dd24b2663b5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -277,7 +277,6 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
         else
                 rt2x00dev->intf_sta_count++;
 
-        spin_lock_init(&intf->seqlock);
         mutex_init(&intf->beacon_skb_mutex);
         intf->beacon = entry;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 4c662eccf53..2fd83010341 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -207,6 +207,7 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct rt2x00_intf *intf = vif_to_intf(tx_info->control.vif);
+        u16 seqno;
 
         if (!(tx_info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ))
                 return;
@@ -238,15 +239,13 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
          * sequence counting per-frame, since those will override the
          * sequence counter given by mac80211.
          */
-        spin_lock(&intf->seqlock);
-
         if (test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags))
-                intf->seqno += 0x10;
-        hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
-        hdr->seq_ctrl |= cpu_to_le16(intf->seqno);
-
-        spin_unlock(&intf->seqlock);
+                seqno = atomic_add_return(0x10, &intf->seqno);
+        else
+                seqno = atomic_read(&intf->seqno);
 
+        hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+        hdr->seq_ctrl |= cpu_to_le16(seqno);
 }
 
 static void rt2x00queue_create_tx_descriptor_plcp(struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rtl818x/rtl8187/leds.c b/drivers/net/wireless/rtl818x/rtl8187/leds.c
index 2e0de2f5f0f..c2d5b495c17 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/leds.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/leds.c
@@ -117,7 +117,7 @@ static void rtl8187_led_brightness_set(struct led_classdev *led_dev,
                         radio_on = true;
                 } else if (radio_on) {
                         radio_on = false;
-                        cancel_delayed_work_sync(&priv->led_on);
+                        cancel_delayed_work(&priv->led_on);
                         ieee80211_queue_delayed_work(hw, &priv->led_off, 0);
                 }
         } else if (radio_on) {
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 447e83472c0..77cb54a65cd 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1744,6 +1744,11 @@ int pci_prepare_to_sleep(struct pci_dev *dev)
         if (target_state == PCI_POWER_ERROR)
                 return -EIO;
 
+        /* Some devices mustn't be in D3 during system sleep */
+        if (target_state == PCI_D3hot &&
+                        (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP))
+                return 0;
+
         pci_enable_wake(dev, target_state, device_may_wakeup(&dev->dev));
 
         error = pci_set_power_state(dev, target_state);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 2a752167754..194b243a281 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2929,6 +2929,32 @@ static void __devinit disable_igfx_irq(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
 
+/*
+ * The Intel 6 Series/C200 Series chipset's EHCI controllers on many
+ * ASUS motherboards will cause memory corruption or a system crash
+ * if they are in D3 while the system is put into S3 sleep.
+ */
+static void __devinit asus_ehci_no_d3(struct pci_dev *dev)
+{
+        const char *sys_info;
+        static const char good_Asus_board[] = "P8Z68-V";
+
+        if (dev->dev_flags & PCI_DEV_FLAGS_NO_D3_DURING_SLEEP)
+                return;
+        if (dev->subsystem_vendor != PCI_VENDOR_ID_ASUSTEK)
+                return;
+        sys_info = dmi_get_system_info(DMI_BOARD_NAME);
+        if (sys_info && memcmp(sys_info, good_Asus_board,
+                        sizeof(good_Asus_board) - 1) == 0)
+                return;
+
+        dev_info(&dev->dev, "broken D3 during system sleep on ASUS\n");
+        dev->dev_flags |= PCI_DEV_FLAGS_NO_D3_DURING_SLEEP;
+        device_set_wakeup_capable(&dev->dev, false);
+}
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c26, asus_ehci_no_d3);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1c2d, asus_ehci_no_d3);
+
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
                           struct pci_fixup *end)
 {
diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index c3b331b74fa..0cc053af70b 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -61,7 +61,7 @@ static LIST_HEAD(pinctrl_maps);
         list_for_each_entry(_maps_node_, &pinctrl_maps, node) \
                 for (_i_ = 0, _map_ = &_maps_node_->maps[_i_]; \
                         _i_ < _maps_node_->num_maps; \
-                        i++, _map_ = &_maps_node_->maps[_i_])
+                        _i_++, _map_ = &_maps_node_->maps[_i_])
 
 /**
  * pinctrl_provide_dummies() - indicate if pinctrl provides dummy state support
diff --git a/drivers/pinctrl/pinctrl-imx.c b/drivers/pinctrl/pinctrl-imx.c
index f6e7c670906..dd6d93aa533 100644
--- a/drivers/pinctrl/pinctrl-imx.c
+++ b/drivers/pinctrl/pinctrl-imx.c
@@ -27,16 +27,16 @@
 #include "core.h"
 #include "pinctrl-imx.h"
 
-#define IMX_PMX_DUMP(info, p, m, c, n)          \
-{                                               \
-        int i, j;                               \
-        printk("Format: Pin Mux Config\n");     \
-        for (i = 0; i < n; i++) {               \
-                j = p[i];                       \
-                printk("%s %d 0x%lx\n",         \
-                        info->pins[j].name,     \
-                        m[i], c[i]);            \
-        }                                       \
+#define IMX_PMX_DUMP(info, p, m, c, n)                  \
+{                                                       \
+        int i, j;                                       \
+        printk(KERN_DEBUG "Format: Pin Mux Config\n");  \
+        for (i = 0; i < n; i++) {                       \
+                j = p[i];                               \
+                printk(KERN_DEBUG "%s %d 0x%lx\n",      \
+                        info->pins[j].name,             \
+                        m[i], c[i]);                    \
+        }                                               \
 }
 
 /* The bits in CONFIG cell defined in binding doc*/
@@ -173,8 +173,10 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
 
         /* create mux map */
         parent = of_get_parent(np);
-        if (!parent)
+        if (!parent) {
+                kfree(new_map);
                 return -EINVAL;
+        }
         new_map[0].type = PIN_MAP_TYPE_MUX_GROUP;
         new_map[0].data.mux.function = parent->name;
         new_map[0].data.mux.group = np->name;
@@ -193,7 +195,7 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
         }
 
         dev_dbg(pctldev->dev, "maps: function %s group %s num %d\n",
-                new_map->data.mux.function, new_map->data.mux.group, map_num);
+                (*map)->data.mux.function, (*map)->data.mux.group, map_num);
 
         return 0;
 }
@@ -201,10 +203,7 @@ static int imx_dt_node_to_map(struct pinctrl_dev *pctldev,
 static void imx_dt_free_map(struct pinctrl_dev *pctldev,
                                 struct pinctrl_map *map, unsigned num_maps)
 {
-        int i;
-
-        for (i = 0; i < num_maps; i++)
-                kfree(map);
+        kfree(map);
 }
 
 static struct pinctrl_ops imx_pctrl_ops = {
@@ -475,9 +474,8 @@ static int __devinit imx_pinctrl_parse_groups(struct device_node *np,
                 grp->configs[j] = config & ~IMX_PAD_SION;
         }
 
-#ifdef DEBUG
         IMX_PMX_DUMP(info, grp->pins, grp->mux_mode, grp->configs, grp->npins);
-#endif
+
         return 0;
 }
 
diff --git a/drivers/pinctrl/pinctrl-mxs.c b/drivers/pinctrl/pinctrl-mxs.c
index 556e45a213e..afb50ee6459 100644
--- a/drivers/pinctrl/pinctrl-mxs.c
+++ b/drivers/pinctrl/pinctrl-mxs.c
@@ -107,8 +107,10 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
 
                 /* Compose group name */
                 group = kzalloc(length, GFP_KERNEL);
-                if (!group)
-                        return -ENOMEM;
+                if (!group) {
+                        ret = -ENOMEM;
+                        goto free;
+                }
                 snprintf(group, length, "%s.%d", np->name, reg);
                 new_map[i].data.mux.group = group;
                 i++;
@@ -118,7 +120,7 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
                 pconfig = kmemdup(&config, sizeof(config), GFP_KERNEL);
                 if (!pconfig) {
                         ret = -ENOMEM;
-                        goto free;
+                        goto free_group;
                 }
 
                 new_map[i].type = PIN_MAP_TYPE_CONFIGS_GROUP;
@@ -133,6 +135,9 @@ static int mxs_dt_node_to_map(struct pinctrl_dev *pctldev,
 
         return 0;
 
+free_group:
+        if (!purecfg)
+                free(group);
 free:
         kfree(new_map);
         return ret;
@@ -511,6 +516,7 @@ int __devinit mxs_pinctrl_probe(struct platform_device *pdev,
         return 0;
 
 err:
+        platform_set_drvdata(pdev, NULL);
         iounmap(d->base);
         return ret;
 }
@@ -520,6 +526,7 @@ int __devexit mxs_pinctrl_remove(struct platform_device *pdev)
 {
         struct mxs_pinctrl_data *d = platform_get_drvdata(pdev);
 
+        platform_set_drvdata(pdev, NULL);
         pinctrl_unregister(d->pctl);
         iounmap(d->base);
 
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index b26395d1634..e8937e7e499 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -673,7 +673,7 @@ static void __nmk_gpio_set_wake(struct nmk_gpio_chip *nmk_chip,
          * wakeup is anyhow controlled by the RIMSC and FIMSC registers.
          */
         if (nmk_chip->sleepmode && on) {
-                __nmk_gpio_set_slpm(nmk_chip, gpio % nmk_chip->chip.base,
+                __nmk_gpio_set_slpm(nmk_chip, gpio % NMK_GPIO_PER_CHIP,
                                     NMK_GPIO_SLPM_WAKEUP_ENABLE);
         }
 
@@ -1246,6 +1246,7 @@ static int __devinit nmk_gpio_probe(struct platform_device *dev)
                 ret = PTR_ERR(clk);
                 goto out_unmap;
         }
+        clk_prepare(clk);
 
         nmk_chip = kzalloc(sizeof(*nmk_chip), GFP_KERNEL);
         if (!nmk_chip) {
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index ba15b1a29e5..e9f8e7d1100 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1184,7 +1184,7 @@ out_no_gpio_remap:
         return ret;
 }
 
-static const struct of_device_id pinmux_ids[]  = {
+static const struct of_device_id pinmux_ids[] __devinitconst = {
         { .compatible = "sirf,prima2-gpio-pinmux" },
         {}
 };
diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c
index 639db4d0aa7..2fd9d36acd1 100644
--- a/drivers/platform/x86/acerhdf.c
+++ b/drivers/platform/x86/acerhdf.c
@@ -5,7 +5,7 @@
  *
  * (C) 2009 - Peter Feuerer     peter (a) piie.net
  *                              http://piie.net
- *     2009 Borislav Petkov <petkovbb@gmail.com>
+ *     2009 Borislav Petkov     bp (a) alien8.de
  *
  * Inspired by and many thanks to:
  *  o acerfand   - Rachel Greenham
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 3660bace123..e82e7eaac0f 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -224,7 +224,7 @@ static struct platform_driver anatop_regulator_driver = {
                 .of_match_table = of_anatop_regulator_match_tbl,
         },
         .probe  = anatop_regulator_probe,
-        .remove = anatop_regulator_remove,
+        .remove = __devexit_p(anatop_regulator_remove),
 };
 
 static int __init anatop_regulator_init(void)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 7584a74eec8..09a737c868b 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -2050,6 +2050,9 @@ int regulator_map_voltage_linear(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
+        if (min_uV < rdev->desc->min_uV)
+                min_uV = rdev->desc->min_uV;
+
         ret = DIV_ROUND_UP(min_uV - rdev->desc->min_uV, rdev->desc->uV_step);
         if (ret < 0)
                 return ret;
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index 9997d7aaca8..242851a4c1a 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -101,16 +101,20 @@ static int gpio_regulator_get_value(struct regulator_dev *dev)
 }
 
 static int gpio_regulator_set_value(struct regulator_dev *dev,
-                                        int min, int max)
+                                        int min, int max, unsigned *selector)
 {
         struct gpio_regulator_data *data = rdev_get_drvdata(dev);
-        int ptr, target, state, best_val = INT_MAX;
+        int ptr, target = 0, state, best_val = INT_MAX;
 
         for (ptr = 0; ptr < data->nr_states; ptr++)
                 if (data->states[ptr].value < best_val &&
                     data->states[ptr].value >= min &&
-                    data->states[ptr].value <= max)
+                    data->states[ptr].value <= max) {
                         target = data->states[ptr].gpios;
+                        best_val = data->states[ptr].value;
+                        if (selector)
+                                *selector = ptr;
+                }
 
         if (best_val == INT_MAX)
                 return -EINVAL;
@@ -128,7 +132,7 @@ static int gpio_regulator_set_voltage(struct regulator_dev *dev,
                                         int min_uV, int max_uV,
                                         unsigned *selector)
 {
-        return gpio_regulator_set_value(dev, min_uV, max_uV);
+        return gpio_regulator_set_value(dev, min_uV, max_uV, selector);
 }
 
 static int gpio_regulator_list_voltage(struct regulator_dev *dev,
@@ -145,7 +149,7 @@ static int gpio_regulator_list_voltage(struct regulator_dev *dev,
 static int gpio_regulator_set_current_limit(struct regulator_dev *dev,
                                         int min_uA, int max_uA)
 {
-        return gpio_regulator_set_value(dev, min_uA, max_uA);
+        return gpio_regulator_set_value(dev, min_uA, max_uA, NULL);
 }
 
 static struct regulator_ops gpio_regulator_voltage_ops = {
@@ -286,7 +290,7 @@ static int __devinit gpio_regulator_probe(struct platform_device *pdev)
 
         cfg.dev = &pdev->dev;
         cfg.init_data = config->init_data;
-        cfg.driver_data = &drvdata;
+        cfg.driver_data = drvdata;
 
         drvdata->dev = regulator_register(&drvdata->desc, &cfg);
         if (IS_ERR(drvdata->dev)) {
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 1f4bb80457b..9d540cd02da 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -259,6 +259,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
         config.dev = &client->dev;
         config.init_data = pdata->regulator;
         config.driver_data = info;
+        config.regmap = info->regmap;
 
         info->regulator = regulator_register(&dcdc_desc, &config);
         if (IS_ERR(info->regulator)) {
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index c4435f608df..9b7ca90057d 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -775,9 +775,6 @@ static __devinit int palmas_probe(struct platform_device *pdev)
 err_unregister_regulator:
         while (--id >= 0)
                 regulator_unregister(pmic->rdev[id]);
-        kfree(pmic->rdev);
-        kfree(pmic->desc);
-        kfree(pmic);
         return ret;
 }
 
@@ -788,10 +785,6 @@ static int __devexit palmas_remove(struct platform_device *pdev)
 
         for (id = 0; id < PALMAS_NUM_REGS; id++)
                 regulator_unregister(pmic->rdev[id]);
-
-        kfree(pmic->rdev);
-        kfree(pmic->desc);
-        kfree(pmic);
         return 0;
 }
 
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index 6102ef2cb2d..9d46fcbe775 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -1792,7 +1792,7 @@ static inline void _base_writeq(__u64 b, volatile void __iomem *addr,
 static inline u8
 _base_get_msix_index(struct MPT2SAS_ADAPTER *ioc)
 {
-        return ioc->cpu_msix_table[smp_processor_id()];
+        return ioc->cpu_msix_table[raw_smp_processor_id()];
 }
 
 /**
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 04f80ebf09e..6986552b47e 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -26,7 +26,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/version.h>
 #include <linux/blkdev.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
@@ -2477,11 +2476,9 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
         }
 
         cmd = qlt_ctio_to_cmd(vha, handle, ctio);
-        if (cmd == NULL) {
-                if (status != CTIO_SUCCESS)
-                        qlt_term_ctio_exchange(vha, ctio, NULL, status);
+        if (cmd == NULL)
                 return;
-        }
+
         se_cmd = &cmd->se_cmd;
         tfo = se_cmd->se_tfo;
 
@@ -2727,10 +2724,12 @@ static void qlt_do_work(struct work_struct *work)
 out_term:
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf020, "Terminating work cmd %p", cmd);
         /*
-         * cmd has not sent to target yet, so pass NULL as the second argument
+         * cmd has not sent to target yet, so pass NULL as the second
+         * argument to qlt_send_term_exchange() and free the memory here.
          */
         spin_lock_irqsave(&ha->hardware_lock, flags);
         qlt_send_term_exchange(vha, NULL, &cmd->atio, 1);
+        kmem_cache_free(qla_tgt_cmd_cachep, cmd);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         if (sess)
                 ha->tgt.tgt_ops->put_sess(sess);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 9ec19bc2f0f..9f9ef1644fd 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -919,7 +919,6 @@ struct qla_tgt_srr_ctio {
 #define QLA_TGT_XMIT_STATUS             2
 #define QLA_TGT_XMIT_ALL                (QLA_TGT_XMIT_STATUS|QLA_TGT_XMIT_DATA)
 
-#include <linux/version.h>
 
 extern struct qla_tgt_data qla_target;
 /*
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index 436598f5740..6e64314dbbb 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -137,13 +137,15 @@ static char *tcm_qla2xxx_get_fabric_name(void)
  */
 static int tcm_qla2xxx_npiv_extract_wwn(const char *ns, u64 *nm)
 {
-        unsigned int i, j, value;
+        unsigned int i, j;
         u8 wwn[8];
 
         memset(wwn, 0, sizeof(wwn));
 
         /* Validate and store the new name */
         for (i = 0, j = 0; i < 16; i++) {
+                int value;
+
                 value = hex_to_bin(*ns++);
                 if (value >= 0)
                         j = (j << 4) | value;
@@ -652,8 +654,8 @@ static int tcm_qla2xxx_handle_data(struct qla_tgt_cmd *cmd)
 /*
  * Called from qla_target.c:qlt_issue_task_mgmt()
  */
-int tcm_qla2xxx_handle_tmr(struct qla_tgt_mgmt_cmd *mcmd, uint32_t lun,
-                        uint8_t tmr_func, uint32_t tag)
+static int tcm_qla2xxx_handle_tmr(struct qla_tgt_mgmt_cmd *mcmd, uint32_t lun,
+        uint8_t tmr_func, uint32_t tag)
 {
         struct qla_tgt_sess *sess = mcmd->sess;
         struct se_cmd *se_cmd = &mcmd->se_cmd;
@@ -762,65 +764,8 @@ static u16 tcm_qla2xxx_set_fabric_sense_len(struct se_cmd *se_cmd,
 struct target_fabric_configfs *tcm_qla2xxx_fabric_configfs;
 struct target_fabric_configfs *tcm_qla2xxx_npiv_fabric_configfs;
 
-static int tcm_qla2xxx_setup_nacl_from_rport(
-        struct se_portal_group *se_tpg,
-        struct se_node_acl *se_nacl,
-        struct tcm_qla2xxx_lport *lport,
-        struct tcm_qla2xxx_nacl *nacl,
-        u64 rport_wwnn)
-{
-        struct scsi_qla_host *vha = lport->qla_vha;
-        struct Scsi_Host *sh = vha->host;
-        struct fc_host_attrs *fc_host = shost_to_fc_host(sh);
-        struct fc_rport *rport;
-        unsigned long flags;
-        void *node;
-        int rc;
-
-        /*
-         * Scan the existing rports, and create a session for the
-         * explict NodeACL is an matching rport->node_name already
-         * exists.
-         */
-        spin_lock_irqsave(sh->host_lock, flags);
-        list_for_each_entry(rport, &fc_host->rports, peers) {
-                if (rport_wwnn != rport->node_name)
-                        continue;
-
-                pr_debug("Located existing rport_wwpn and rport->node_name: 0x%016LX, port_id: 0x%04x\n",
-                    rport->node_name, rport->port_id);
-                nacl->nport_id = rport->port_id;
-
-                spin_unlock_irqrestore(sh->host_lock, flags);
-
-                spin_lock_irqsave(&vha->hw->hardware_lock, flags);
-                node = btree_lookup32(&lport->lport_fcport_map, rport->port_id);
-                if (node) {
-                        rc = btree_update32(&lport->lport_fcport_map,
-                                            rport->port_id, se_nacl);
-                } else {
-                        rc = btree_insert32(&lport->lport_fcport_map,
-                                            rport->port_id, se_nacl,
-                                            GFP_ATOMIC);
-                }
-                spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
-
-                if (rc) {
-                        pr_err("Unable to insert se_nacl into fcport_map");
-                        WARN_ON(rc > 0);
-                        return rc;
-                }
-
-                pr_debug("Inserted into fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%08x\n",
-                    se_nacl, rport_wwnn, nacl->nport_id);
-
-                return 1;
-        }
-        spin_unlock_irqrestore(sh->host_lock, flags);
-
-        return 0;
-}
-
+static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
+                        struct tcm_qla2xxx_nacl *, struct qla_tgt_sess *);
 /*
  * Expected to be called with struct qla_hw_data->hardware_lock held
  */
@@ -842,11 +787,40 @@ static void tcm_qla2xxx_clear_nacl_from_fcport_map(struct qla_tgt_sess *sess)
 
         pr_debug("Removed from fcport_map: %p for WWNN: 0x%016LX, port_id: 0x%06x\n",
             se_nacl, nacl->nport_wwnn, nacl->nport_id);
+        /*
+         * Now clear the se_nacl and session pointers from our HW lport lookup
+         * table mapping for this initiator's fabric S_ID and LOOP_ID entries.
+         *
+         * This is done ahead of callbacks into tcm_qla2xxx_free_session() ->
+         * target_wait_for_sess_cmds() before the session waits for outstanding
+         * I/O to complete, to avoid a race between session shutdown execution
+         * and incoming ATIOs or TMRs picking up a stale se_node_act reference.
+         */
+        tcm_qla2xxx_clear_sess_lookup(lport, nacl, sess);
+}
+
+static void tcm_qla2xxx_release_session(struct kref *kref)
+{
+        struct se_session *se_sess = container_of(kref,
+                        struct se_session, sess_kref);
+
+        qlt_unreg_sess(se_sess->fabric_sess_ptr);
+}
+
+static void tcm_qla2xxx_put_session(struct se_session *se_sess)
+{
+        struct qla_tgt_sess *sess = se_sess->fabric_sess_ptr;
+        struct qla_hw_data *ha = sess->vha->hw;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ha->hardware_lock, flags);
+        kref_put(&se_sess->sess_kref, tcm_qla2xxx_release_session);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
 
 static void tcm_qla2xxx_put_sess(struct qla_tgt_sess *sess)
 {
-        target_put_session(sess->se_sess);
+        tcm_qla2xxx_put_session(sess->se_sess);
 }
 
 static void tcm_qla2xxx_shutdown_sess(struct qla_tgt_sess *sess)
@@ -859,14 +833,10 @@ static struct se_node_acl *tcm_qla2xxx_make_nodeacl(
         struct config_group *group,
         const char *name)
 {
-        struct se_wwn *se_wwn = se_tpg->se_tpg_wwn;
-        struct tcm_qla2xxx_lport *lport = container_of(se_wwn,
-                                struct tcm_qla2xxx_lport, lport_wwn);
         struct se_node_acl *se_nacl, *se_nacl_new;
         struct tcm_qla2xxx_nacl *nacl;
         u64 wwnn;
         u32 qla2xxx_nexus_depth;
-        int rc;
 
         if (tcm_qla2xxx_parse_wwn(name, &wwnn, 1) < 0)
                 return ERR_PTR(-EINVAL);
@@ -893,16 +863,6 @@ static struct se_node_acl *tcm_qla2xxx_make_nodeacl(
         nacl = container_of(se_nacl, struct tcm_qla2xxx_nacl, se_node_acl);
         nacl->nport_wwnn = wwnn;
         tcm_qla2xxx_format_wwn(&nacl->nport_name[0], TCM_QLA2XXX_NAMELEN, wwnn);
-        /*
-         * Setup a se_nacl handle based on an a matching struct fc_rport setup
-         * via drivers/scsi/qla2xxx/qla_init.c:qla2x00_reg_remote_port()
-         */
-        rc = tcm_qla2xxx_setup_nacl_from_rport(se_tpg, se_nacl, lport,
-                                        nacl, wwnn);
-        if (rc < 0) {
-                tcm_qla2xxx_release_fabric_acl(se_tpg, se_nacl_new);
-                return ERR_PTR(rc);
-        }
 
         return se_nacl;
 }
@@ -1390,6 +1350,25 @@ static void tcm_qla2xxx_set_sess_by_loop_id(
             nacl->qla_tgt_sess, new_se_nacl, new_se_nacl->initiatorname);
 }
 
+/*
+ * Should always be called with qla_hw_data->hardware_lock held.
+ */
+static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *lport,
+                struct tcm_qla2xxx_nacl *nacl, struct qla_tgt_sess *sess)
+{
+        struct se_session *se_sess = sess->se_sess;
+        unsigned char be_sid[3];
+
+        be_sid[0] = sess->s_id.b.domain;
+        be_sid[1] = sess->s_id.b.area;
+        be_sid[2] = sess->s_id.b.al_pa;
+
+        tcm_qla2xxx_set_sess_by_s_id(lport, NULL, nacl, se_sess,
+                                sess, be_sid);
+        tcm_qla2xxx_set_sess_by_loop_id(lport, NULL, nacl, se_sess,
+                                sess, sess->loop_id);
+}
+
 static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
 {
         struct qla_tgt *tgt = sess->tgt;
@@ -1398,8 +1377,6 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
         struct se_node_acl *se_nacl;
         struct tcm_qla2xxx_lport *lport;
         struct tcm_qla2xxx_nacl *nacl;
-        unsigned char be_sid[3];
-        unsigned long flags;
 
         BUG_ON(in_interrupt());
 
@@ -1419,21 +1396,6 @@ static void tcm_qla2xxx_free_session(struct qla_tgt_sess *sess)
                 return;
         }
         target_wait_for_sess_cmds(se_sess, 0);
-        /*
-         * And now clear the se_nacl and session pointers from our HW lport
-         * mappings for fabric S_ID and LOOP_ID.
-         */
-        memset(&be_sid, 0, 3);
-        be_sid[0] = sess->s_id.b.domain;
-        be_sid[1] = sess->s_id.b.area;
-        be_sid[2] = sess->s_id.b.al_pa;
-
-        spin_lock_irqsave(&ha->hardware_lock, flags);
-        tcm_qla2xxx_set_sess_by_s_id(lport, NULL, nacl, se_sess,
-                        sess, be_sid);
-        tcm_qla2xxx_set_sess_by_loop_id(lport, NULL, nacl, se_sess,
-                        sess, sess->loop_id);
-        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         transport_deregister_session_configfs(sess->se_sess);
         transport_deregister_session(sess->se_sess);
@@ -1731,6 +1693,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_ops = {
         .new_cmd_map                    = NULL,
         .check_stop_free                = tcm_qla2xxx_check_stop_free,
         .release_cmd                    = tcm_qla2xxx_release_cmd,
+        .put_session                    = tcm_qla2xxx_put_session,
         .shutdown_session               = tcm_qla2xxx_shutdown_session,
         .close_session                  = tcm_qla2xxx_close_session,
         .sess_get_index                 = tcm_qla2xxx_sess_get_index,
@@ -1779,6 +1742,7 @@ static struct target_core_fabric_ops tcm_qla2xxx_npiv_ops = {
         .tpg_release_fabric_acl         = tcm_qla2xxx_release_fabric_acl,
         .tpg_get_inst_index             = tcm_qla2xxx_tpg_get_inst_index,
         .release_cmd                    = tcm_qla2xxx_release_cmd,
+        .put_session                    = tcm_qla2xxx_put_session,
         .shutdown_session               = tcm_qla2xxx_shutdown_session,
         .close_session                  = tcm_qla2xxx_close_session,
         .sess_get_index                 = tcm_qla2xxx_sess_get_index,
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index 61c82a345f8..bbbc9c918d4 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -90,11 +90,9 @@ unsigned int scsi_logging_level;
 EXPORT_SYMBOL(scsi_logging_level);
 #endif
 
-#if IS_ENABLED(CONFIG_PM) || IS_ENABLED(CONFIG_BLK_DEV_SD)
-/* sd and scsi_pm need to coordinate flushing async actions */
+/* sd, scsi core and power management need to coordinate flushing async actions */
 LIST_HEAD(scsi_sd_probe_domain);
 EXPORT_SYMBOL(scsi_sd_probe_domain);
-#endif
 
 /* NB: These are exposed through /proc/scsi/scsi and form part of the ABI.
  * You may not alter any existing entry (although adding new ones is
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index 37c609898f8..7e6136e2ce8 100644
--- a/drivers/target/sbp/sbp_target.c
+++ b/drivers/target/sbp/sbp_target.c
@@ -587,14 +587,14 @@ static void sbp_management_request_logout(
 {
         struct sbp_tport *tport = agent->tport;
         struct sbp_tpg *tpg = tport->tpg;
-        int login_id;
+        int id;
         struct sbp_login_descriptor *login;
 
-        login_id = LOGOUT_ORB_LOGIN_ID(be32_to_cpu(req->orb.misc));
+        id = LOGOUT_ORB_LOGIN_ID(be32_to_cpu(req->orb.misc));
 
-        login = sbp_login_find_by_id(tpg, login_id);
+        login = sbp_login_find_by_id(tpg, id);
         if (!login) {
-                pr_warn("cannot find login: %d\n", login_id);
+                pr_warn("cannot find login: %d\n", id);
 
                 req->status.status = cpu_to_be32(
                         STATUS_BLOCK_RESP(STATUS_RESP_REQUEST_COMPLETE) |
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index e624b836469..91799973081 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -374,8 +374,9 @@ int target_emulate_set_target_port_groups(struct se_cmd *cmd)
 
 out:
         transport_kunmap_data_sg(cmd);
-        target_complete_cmd(cmd, GOOD);
-        return 0;
+        if (!rc)
+                target_complete_cmd(cmd, GOOD);
+        return rc;
 }
 
 static inline int core_alua_state_nonoptimized(
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index 686dba189f8..9f99d040490 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -133,16 +133,11 @@ static struct se_device *fd_create_virtdevice(
                 ret = PTR_ERR(dev_p);
                 goto fail;
         }
-
-        /* O_DIRECT too? */
-        flags = O_RDWR | O_CREAT | O_LARGEFILE;
-
         /*
-         * If fd_buffered_io=1 has not been set explicitly (the default),
-         * use O_SYNC to force FILEIO writes to disk.
+         * Use O_DSYNC by default instead of O_SYNC to forgo syncing
+         * of pure timestamp updates.
          */
-        if (!(fd_dev->fbd_flags & FDBD_USE_BUFFERED_IO))
-                flags |= O_SYNC;
+        flags = O_RDWR | O_CREAT | O_LARGEFILE | O_DSYNC;
 
         file = filp_open(dev_p, flags, 0600);
         if (IS_ERR(file)) {
@@ -380,23 +375,6 @@ static void fd_emulate_sync_cache(struct se_cmd *cmd)
         }
 }
 
-static void fd_emulate_write_fua(struct se_cmd *cmd)
-{
-        struct se_device *dev = cmd->se_dev;
-        struct fd_dev *fd_dev = dev->dev_ptr;
-        loff_t start = cmd->t_task_lba *
-                dev->se_sub_dev->se_dev_attrib.block_size;
-        loff_t end = start + cmd->data_length;
-        int ret;
-
-        pr_debug("FILEIO: FUA WRITE LBA: %llu, bytes: %u\n",
-                cmd->t_task_lba, cmd->data_length);
-
-        ret = vfs_fsync_range(fd_dev->fd_file, start, end, 1);
-        if (ret != 0)
-                pr_err("FILEIO: vfs_fsync_range() failed: %d\n", ret);
-}
-
 static int fd_execute_cmd(struct se_cmd *cmd, struct scatterlist *sgl,
                 u32 sgl_nents, enum dma_data_direction data_direction)
 {
@@ -411,19 +389,21 @@ static int fd_execute_cmd(struct se_cmd *cmd, struct scatterlist *sgl,
                 ret = fd_do_readv(cmd, sgl, sgl_nents);
         } else {
                 ret = fd_do_writev(cmd, sgl, sgl_nents);
-
+                /*
+                 * Perform implict vfs_fsync_range() for fd_do_writev() ops
+                 * for SCSI WRITEs with Forced Unit Access (FUA) set.
+                 * Allow this to happen independent of WCE=0 setting.
+                 */
                 if (ret > 0 &&
-                    dev->se_sub_dev->se_dev_attrib.emulate_write_cache > 0 &&
                     dev->se_sub_dev->se_dev_attrib.emulate_fua_write > 0 &&
                     (cmd->se_cmd_flags & SCF_FUA)) {
-                        /*
-                         * We might need to be a bit smarter here
-                         * and return some sense data to let the initiator
-                         * know the FUA WRITE cache sync failed..?
-                         */
-                        fd_emulate_write_fua(cmd);
-                }
+                        struct fd_dev *fd_dev = dev->dev_ptr;
+                        loff_t start = cmd->t_task_lba *
+                                dev->se_sub_dev->se_dev_attrib.block_size;
+                        loff_t end = start + cmd->data_length;
 
+                        vfs_fsync_range(fd_dev->fd_file, start, end, 1);
+                }
         }
 
         if (ret < 0) {
@@ -442,7 +422,6 @@ enum {
 static match_table_t tokens = {
         {Opt_fd_dev_name, "fd_dev_name=%s"},
         {Opt_fd_dev_size, "fd_dev_size=%s"},
-        {Opt_fd_buffered_io, "fd_buffered_io=%d"},
         {Opt_err, NULL}
 };
 
@@ -454,7 +433,7 @@ static ssize_t fd_set_configfs_dev_params(
         struct fd_dev *fd_dev = se_dev->se_dev_su_ptr;
         char *orig, *ptr, *arg_p, *opts;
         substring_t args[MAX_OPT_ARGS];
-        int ret = 0, arg, token;
+        int ret = 0, token;
 
         opts = kstrdup(page, GFP_KERNEL);
         if (!opts)
@@ -498,19 +477,6 @@ static ssize_t fd_set_configfs_dev_params(
                                         " bytes\n", fd_dev->fd_dev_size);
                         fd_dev->fbd_flags |= FBDF_HAS_SIZE;
                         break;
-                case Opt_fd_buffered_io:
-                        match_int(args, &arg);
-                        if (arg != 1) {
-                                pr_err("bogus fd_buffered_io=%d value\n", arg);
-                                ret = -EINVAL;
-                                goto out;
-                        }
-
-                        pr_debug("FILEIO: Using buffered I/O"
-                                " operations for struct fd_dev\n");
-
-                        fd_dev->fbd_flags |= FDBD_USE_BUFFERED_IO;
-                        break;
                 default:
                         break;
                 }
@@ -542,10 +508,8 @@ static ssize_t fd_show_configfs_dev_params(
         ssize_t bl = 0;
 
         bl = sprintf(b + bl, "TCM FILEIO ID: %u", fd_dev->fd_dev_id);
-        bl += sprintf(b + bl, "        File: %s  Size: %llu  Mode: %s\n",
-                fd_dev->fd_dev_name, fd_dev->fd_dev_size,
-                (fd_dev->fbd_flags & FDBD_USE_BUFFERED_IO) ?
-                "Buffered" : "Synchronous");
+        bl += sprintf(b + bl, "        File: %s  Size: %llu  Mode: O_DSYNC\n",
+                fd_dev->fd_dev_name, fd_dev->fd_dev_size);
         return bl;
 }
 
diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
index fbd59ef7d8b..70ce7fd7111 100644
--- a/drivers/target/target_core_file.h
+++ b/drivers/target/target_core_file.h
@@ -14,7 +14,6 @@
 
 #define FBDF_HAS_PATH           0x01
 #define FBDF_HAS_SIZE           0x02
-#define FDBD_USE_BUFFERED_IO    0x04
 
 struct fd_dev {
         u32             fbd_flags;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index b05fdc0c05d..634d0f31a28 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -315,7 +315,7 @@ void transport_register_session(
 }
 EXPORT_SYMBOL(transport_register_session);
 
-static void target_release_session(struct kref *kref)
+void target_release_session(struct kref *kref)
 {
         struct se_session *se_sess = container_of(kref,
                         struct se_session, sess_kref);
@@ -332,6 +332,12 @@ EXPORT_SYMBOL(target_get_session);
 
 void target_put_session(struct se_session *se_sess)
 {
+        struct se_portal_group *tpg = se_sess->se_tpg;
+
+        if (tpg->se_tpg_tfo->put_session != NULL) {
+                tpg->se_tpg_tfo->put_session(se_sess);
+                return;
+        }
         kref_put(&se_sess->sess_kref, target_release_session);
 }
 EXPORT_SYMBOL(target_put_session);
diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
index d3d91dae065..944eaeb8e0c 100644
--- a/drivers/tty/hvc/hvc_xen.c
+++ b/drivers/tty/hvc/hvc_xen.c
@@ -214,24 +214,24 @@ static int xen_hvm_console_init(void)
         /* already configured */
         if (info->intf != NULL)
                 return 0;
-
+        /*
+         * If the toolstack (or the hypervisor) hasn't set these values, the
+         * default value is 0. Even though mfn = 0 and evtchn = 0 are
+         * theoretically correct values, in practice they never are and they
+         * mean that a legacy toolstack hasn't initialized the pv console correctly.
+         */
         r = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
-        if (r < 0) {
-                kfree(info);
-                return -ENODEV;
-        }
+        if (r < 0 || v == 0)
+                goto err;
         info->evtchn = v;
-        hvm_get_parameter(HVM_PARAM_CONSOLE_PFN, &v);
-        if (r < 0) {
-                kfree(info);
-                return -ENODEV;
-        }
+        v = 0;
+        r = hvm_get_parameter(HVM_PARAM_CONSOLE_PFN, &v);
+        if (r < 0 || v == 0)
+                goto err;
         mfn = v;
         info->intf = ioremap(mfn << PAGE_SHIFT, PAGE_SIZE);
-        if (info->intf == NULL) {
-                kfree(info);
-                return -ENODEV;
-        }
+        if (info->intf == NULL)
+                goto err;
         info->vtermno = HVC_COOKIE;
 
         spin_lock(&xencons_lock);
@@ -239,6 +239,9 @@ static int xen_hvm_console_init(void)
         spin_unlock(&xencons_lock);
 
         return 0;
+err:
+        kfree(info);
+        return -ENODEV;
 }
 
 static int xen_pv_console_init(void)
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 4604153b795..1bd9163bc11 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -2179,6 +2179,16 @@ static int __devinit sci_init_single(struct platform_device *dev,
         return 0;
 }
 
+static void sci_cleanup_single(struct sci_port *port)
+{
+        sci_free_gpios(port);
+
+        clk_put(port->iclk);
+        clk_put(port->fclk);
+
+        pm_runtime_disable(port->port.dev);
+}
+
 #ifdef CONFIG_SERIAL_SH_SCI_CONSOLE
 static void serial_console_putchar(struct uart_port *port, int ch)
 {
@@ -2360,14 +2370,10 @@ static int sci_remove(struct platform_device *dev)
         cpufreq_unregister_notifier(&port->freq_transition,
                                     CPUFREQ_TRANSITION_NOTIFIER);
 
-        sci_free_gpios(port);
-
         uart_remove_one_port(&sci_uart_driver, &port->port);
 
-        clk_put(port->iclk);
-        clk_put(port->fclk);
+        sci_cleanup_single(port);
 
-        pm_runtime_disable(&dev->dev);
         return 0;
 }
 
@@ -2385,14 +2391,20 @@ static int __devinit sci_probe_single(struct platform_device *dev,
                            index+1, SCI_NPORTS);
                 dev_notice(&dev->dev, "Consider bumping "
                            "CONFIG_SERIAL_SH_SCI_NR_UARTS!\n");
-                return 0;
+                return -EINVAL;
         }
 
         ret = sci_init_single(dev, sciport, index, p);
         if (ret)
                 return ret;
 
-        return uart_add_one_port(&sci_uart_driver, &sciport->port);
+        ret = uart_add_one_port(&sci_uart_driver, &sciport->port);
+        if (ret) {
+                sci_cleanup_single(sciport);
+                return ret;
+        }
+
+        return 0;
 }
 
 static int __devinit sci_probe(struct platform_device *dev)
@@ -2413,24 +2425,22 @@ static int __devinit sci_probe(struct platform_device *dev)
 
         ret = sci_probe_single(dev, dev->id, p, sp);
         if (ret)
-                goto err_unreg;
+                return ret;
 
         sp->freq_transition.notifier_call = sci_notifier;
 
         ret = cpufreq_register_notifier(&sp->freq_transition,
                                         CPUFREQ_TRANSITION_NOTIFIER);
-        if (unlikely(ret < 0))
-                goto err_unreg;
+        if (unlikely(ret < 0)) {
+                sci_cleanup_single(sp);
+                return ret;
+        }
 
 #ifdef CONFIG_SH_STANDARD_BIOS
         sh_bios_gdb_detach();
 #endif
 
         return 0;
-
-err_unreg:
-        sci_remove(dev);
-        return ret;
 }
 
 static int sci_suspend(struct device *dev)
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f2a120eea9d..36a2a0b7b82 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -567,6 +567,14 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
 
         usb_autopm_put_interface(acm->control);
 
+        /*
+         * Unthrottle device in case the TTY was closed while throttled.
+         */
+        spin_lock_irq(&acm->read_lock);
+        acm->throttled = 0;
+        acm->throttle_req = 0;
+        spin_unlock_irq(&acm->read_lock);
+
         if (acm_submit_read_urbs(acm, GFP_KERNEL))
                 goto error_submit_read_urbs;
 
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index ea8b304f0e8..8fd398dffce 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -55,6 +55,15 @@ static const struct usb_device_id wdm_ids[] = {
                 .bInterfaceSubClass = 1,
                 .bInterfaceProtocol = 9, /* NOTE: CDC ECM control interface! */
         },
+        {
+                 /* Vodafone/Huawei K5005 (12d1:14c8) and similar modems */
+                .match_flags        = USB_DEVICE_ID_MATCH_VENDOR |
+                                      USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = HUAWEI_VENDOR_ID,
+                .bInterfaceClass    = USB_CLASS_VENDOR_SPEC,
+                .bInterfaceSubClass = 1,
+                .bInterfaceProtocol = 57, /* NOTE: CDC ECM control interface! */
+        },
         { }
 };
 
diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
index 57ed9e400c0..622b4a48e73 100644
--- a/drivers/usb/core/hcd-pci.c
+++ b/drivers/usb/core/hcd-pci.c
@@ -493,15 +493,6 @@ static int hcd_pci_suspend_noirq(struct device *dev)
 
         pci_save_state(pci_dev);
 
-        /*
-         * Some systems crash if an EHCI controller is in D3 during
-         * a sleep transition.  We have to leave such controllers in D0.
-         */
-        if (hcd->broken_pci_sleep) {
-                dev_dbg(dev, "Staying in PCI D0\n");
-                return retval;
-        }
-
         /* If the root hub is dead rather than suspended, disallow remote
          * wakeup.  usb_hc_died() should ensure that both hosts are marked as
          * dying, so we only need to check the primary roothub.
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 04fb834c3fa..25a7422ee65 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -3379,7 +3379,7 @@ int usb_disable_lpm(struct usb_device *udev)
                 return 0;
 
         udev->lpm_disable_count++;
-        if ((udev->u1_params.timeout == 0 && udev->u1_params.timeout == 0))
+        if ((udev->u1_params.timeout == 0 && udev->u2_params.timeout == 0))
                 return 0;
 
         /* If LPM is enabled, attempt to disable it. */
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index b548cf1dbc6..bdd1c6749d8 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1838,7 +1838,6 @@ free_interfaces:
                 intfc = cp->intf_cache[i];
                 intf->altsetting = intfc->altsetting;
                 intf->num_altsetting = intfc->num_altsetting;
-                intf->intf_assoc = find_iad(dev, cp, i);
                 kref_get(&intfc->ref);
 
                 alt = usb_altnum_to_altsetting(intf, 0);
@@ -1851,6 +1850,8 @@ free_interfaces:
                 if (!alt)
                         alt = &intf->altsetting[0];
 
+                intf->intf_assoc =
+                        find_iad(dev, cp, alt->desc.bInterfaceNumber);
                 intf->cur_altsetting = alt;
                 usb_enable_interface(dev, intf, true);
                 intf->dev.parent = &dev->dev;
diff --git a/drivers/usb/gadget/atmel_usba_udc.c b/drivers/usb/gadget/atmel_usba_udc.c
index e23bf7984aa..9a9bced813e 100644
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -599,12 +599,6 @@ usba_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
 
         spin_lock_irqsave(&ep->udc->lock, flags);
 
-        if (ep->ep.desc) {
-                spin_unlock_irqrestore(&ep->udc->lock, flags);
-                DBG(DBG_ERR, "ep%d already enabled\n", ep->index);
-                return -EBUSY;
-        }
-
         ep->ep.desc = desc;
         ep->ep.maxpacket = maxpacket;
 
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index 51881f3bd07..b09452d6f33 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1596,7 +1596,7 @@ static int qe_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct qe_ep, ep);
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc || _ep->name == ep_name[0] ||
+        if (!_ep || !desc || _ep->name == ep_name[0] ||
                         (desc->bDescriptorType != USB_DT_ENDPOINT))
                 return -EINVAL;
 
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index 28316858208..bc6f9bb9994 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -567,7 +567,7 @@ static int fsl_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct fsl_ep, ep);
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || (desc->bDescriptorType != USB_DT_ENDPOINT))
                 return -EINVAL;
 
@@ -2575,7 +2575,7 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
         /* for ep0: the desc defined here;
          * for other eps, gadget layer called ep_enable with defined desc
          */
-        udc_controller->eps[0].desc = &fsl_ep0_desc;
+        udc_controller->eps[0].ep.desc = &fsl_ep0_desc;
         udc_controller->eps[0].ep.maxpacket = USB_MAX_CTRL_PAYLOAD;
 
         /* setup the udc->eps[] for non-control endpoints and link
diff --git a/drivers/usb/gadget/fsl_usb2_udc.h b/drivers/usb/gadget/fsl_usb2_udc.h
index 5cd7b7e7ddb..f61a967f708 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.h
+++ b/drivers/usb/gadget/fsl_usb2_udc.h
@@ -568,10 +568,10 @@ static void dump_msg(const char *label, const u8 * buf, unsigned int length)
 /*
  * ### internal used help routines.
  */
-#define ep_index(EP)            ((EP)->desc->bEndpointAddress&0xF)
+#define ep_index(EP)            ((EP)->ep.desc->bEndpointAddress&0xF)
 #define ep_maxpacket(EP)        ((EP)->ep.maxpacket)
 #define ep_is_in(EP)    ( (ep_index(EP) == 0) ? (EP->udc->ep0_dir == \
-                        USB_DIR_IN ):((EP)->desc->bEndpointAddress \
+                        USB_DIR_IN) : ((EP)->ep.desc->bEndpointAddress \
                         & USB_DIR_IN)==USB_DIR_IN)
 #define get_ep_by_pipe(udc, pipe)       ((pipe == 1)? &udc->eps[0]: \
                                         &udc->eps[pipe])
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index b241e6c6a7f..3d28fb976c7 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -102,7 +102,7 @@ goku_ep_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
         unsigned long   flags;
 
         ep = container_of(_ep, struct goku_ep, ep);
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
         dev = ep->dev;
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
index dbcd1329495..117a4bba1b8 100644
--- a/drivers/usb/gadget/mv_udc_core.c
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -464,7 +464,7 @@ static int mv_ep_enable(struct usb_ep *_ep,
         ep = container_of(_ep, struct mv_ep, ep);
         udc = ep->udc;
 
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
 
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 7ba32469c5b..a460e8c204f 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -153,7 +153,7 @@ static int omap_ep_enable(struct usb_ep *_ep,
         u16             maxp;
 
         /* catch various bogus parameters */
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || ep->bEndpointAddress != desc->bEndpointAddress
                         || ep->maxpacket < usb_endpoint_maxp(desc)) {
diff --git a/drivers/usb/gadget/pxa25x_udc.c b/drivers/usb/gadget/pxa25x_udc.c
index d7c8cb3bf75..f7ff9e8e746 100644
--- a/drivers/usb/gadget/pxa25x_udc.c
+++ b/drivers/usb/gadget/pxa25x_udc.c
@@ -218,7 +218,7 @@ static int pxa25x_ep_enable (struct usb_ep *_ep,
         struct pxa25x_udc       *dev;
 
         ep = container_of (_ep, struct pxa25x_ep, ep);
-        if (!_ep || !desc || ep->ep.desc || _ep->name == ep0name
+        if (!_ep || !desc || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT
                         || ep->bEndpointAddress != desc->bEndpointAddress
                         || ep->fifo_size < usb_endpoint_maxp (desc)) {
diff --git a/drivers/usb/gadget/s3c-hsudc.c b/drivers/usb/gadget/s3c-hsudc.c
index 36c6836eeb0..236b271871a 100644
--- a/drivers/usb/gadget/s3c-hsudc.c
+++ b/drivers/usb/gadget/s3c-hsudc.c
@@ -760,7 +760,7 @@ static int s3c_hsudc_ep_enable(struct usb_ep *_ep,
         u32 ecr = 0;
 
         hsep = our_ep(_ep);
-        if (!_ep || !desc || hsep->ep.desc || _ep->name == ep0name
+        if (!_ep || !desc || _ep->name == ep0name
                 || desc->bDescriptorType != USB_DT_ENDPOINT
                 || hsep->bEndpointAddress != desc->bEndpointAddress
                 || ep_maxpacket(hsep) < usb_endpoint_maxp(desc))
diff --git a/drivers/usb/gadget/s3c2410_udc.c b/drivers/usb/gadget/s3c2410_udc.c
index 3de71d37d75..f2e51f50e52 100644
--- a/drivers/usb/gadget/s3c2410_udc.c
+++ b/drivers/usb/gadget/s3c2410_udc.c
@@ -1062,7 +1062,7 @@ static int s3c2410_udc_ep_enable(struct usb_ep *_ep,
 
         ep = to_s3c2410_ep(_ep);
 
-        if (!_ep || !desc || ep->ep.desc
+        if (!_ep || !desc
                         || _ep->name == ep0name
                         || desc->bDescriptorType != USB_DT_ENDPOINT)
                 return -EINVAL;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index b100f5f9f4b..800be38c78b 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -671,7 +671,9 @@ static int ehci_init(struct usb_hcd *hcd)
         hw = ehci->async->hw;
         hw->hw_next = QH_NEXT(ehci, ehci->async->qh_dma);
         hw->hw_info1 = cpu_to_hc32(ehci, QH_HEAD);
+#if defined(CONFIG_PPC_PS3)
         hw->hw_info1 |= cpu_to_hc32(ehci, (1 << 7));    /* I = 1 */
+#endif
         hw->hw_token = cpu_to_hc32(ehci, QTD_STS_HALT);
         hw->hw_qtd_next = EHCI_LIST_END(ehci);
         ehci->async->qh_state = QH_STATE_LINKED;
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index a44294d1349..17cfb8a1131 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -43,6 +43,7 @@
 #include <linux/regulator/consumer.h>
 #include <linux/pm_runtime.h>
 #include <linux/gpio.h>
+#include <linux/clk.h>
 
 /* EHCI Register Set */
 #define EHCI_INSNREG04                                  (0xA0)
@@ -55,6 +56,15 @@
 #define EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT             8
 #define EHCI_INSNREG05_ULPI_WRDATA_SHIFT                0
 
+/* Errata i693 */
+static struct clk       *utmi_p1_fck;
+static struct clk       *utmi_p2_fck;
+static struct clk       *xclk60mhsp1_ck;
+static struct clk       *xclk60mhsp2_ck;
+static struct clk       *usbhost_p1_fck;
+static struct clk       *usbhost_p2_fck;
+static struct clk       *init_60m_fclk;
+
 /*-------------------------------------------------------------------------*/
 
 static const struct hc_driver ehci_omap_hc_driver;
@@ -70,6 +80,41 @@ static inline u32 ehci_read(void __iomem *base, u32 reg)
         return __raw_readl(base + reg);
 }
 
+/* Erratum i693 workaround sequence */
+static void omap_ehci_erratum_i693(struct ehci_hcd *ehci)
+{
+        int ret = 0;
+
+        /* Switch to the internal 60 MHz clock */
+        ret = clk_set_parent(utmi_p1_fck, init_60m_fclk);
+        if (ret != 0)
+                ehci_err(ehci, "init_60m_fclk set parent"
+                        "failed error:%d\n", ret);
+
+        ret = clk_set_parent(utmi_p2_fck, init_60m_fclk);
+        if (ret != 0)
+                ehci_err(ehci, "init_60m_fclk set parent"
+                        "failed error:%d\n", ret);
+
+        clk_enable(usbhost_p1_fck);
+        clk_enable(usbhost_p2_fck);
+
+        /* Wait 1ms and switch back to the external clock */
+        mdelay(1);
+        ret = clk_set_parent(utmi_p1_fck, xclk60mhsp1_ck);
+        if (ret != 0)
+                ehci_err(ehci, "xclk60mhsp1_ck set parent"
+                        "failed error:%d\n", ret);
+
+        ret = clk_set_parent(utmi_p2_fck, xclk60mhsp2_ck);
+        if (ret != 0)
+                ehci_err(ehci, "xclk60mhsp2_ck set parent"
+                        "failed error:%d\n", ret);
+
+        clk_disable(usbhost_p1_fck);
+        clk_disable(usbhost_p2_fck);
+}
+
 static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
 {
         struct usb_hcd  *hcd = dev_get_drvdata(&pdev->dev);
@@ -100,6 +145,50 @@ static void omap_ehci_soft_phy_reset(struct platform_device *pdev, u8 port)
         }
 }
 
+static int omap_ehci_hub_control(
+        struct usb_hcd  *hcd,
+        u16             typeReq,
+        u16             wValue,
+        u16             wIndex,
+        char            *buf,
+        u16             wLength
+)
+{
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        u32 __iomem *status_reg = &ehci->regs->port_status[
+                                (wIndex & 0xff) - 1];
+        u32             temp;
+        unsigned long   flags;
+        int             retval = 0;
+
+        spin_lock_irqsave(&ehci->lock, flags);
+
+        if (typeReq == SetPortFeature && wValue == USB_PORT_FEAT_SUSPEND) {
+                temp = ehci_readl(ehci, status_reg);
+                if ((temp & PORT_PE) == 0 || (temp & PORT_RESET) != 0) {
+                        retval = -EPIPE;
+                        goto done;
+                }
+
+                temp &= ~PORT_WKCONN_E;
+                temp |= PORT_WKDISC_E | PORT_WKOC_E;
+                ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
+
+                omap_ehci_erratum_i693(ehci);
+
+                set_bit((wIndex & 0xff) - 1, &ehci->suspended_ports);
+                goto done;
+        }
+
+        spin_unlock_irqrestore(&ehci->lock, flags);
+
+        /* Handle the hub control events here */
+        return ehci_hub_control(hcd, typeReq, wValue, wIndex, buf, wLength);
+done:
+        spin_unlock_irqrestore(&ehci->lock, flags);
+        return retval;
+}
+
 static void disable_put_regulator(
                 struct ehci_hcd_omap_platform_data *pdata)
 {
@@ -264,8 +353,76 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
         /* root ports should always stay powered */
         ehci_port_power(omap_ehci, 1);
 
+        /* get clocks */
+        utmi_p1_fck = clk_get(dev, "utmi_p1_gfclk");
+        if (IS_ERR(utmi_p1_fck)) {
+                ret = PTR_ERR(utmi_p1_fck);
+                dev_err(dev, "utmi_p1_gfclk failed error:%d\n", ret);
+                goto err_add_hcd;
+        }
+
+        xclk60mhsp1_ck = clk_get(dev, "xclk60mhsp1_ck");
+        if (IS_ERR(xclk60mhsp1_ck)) {
+                ret = PTR_ERR(xclk60mhsp1_ck);
+                dev_err(dev, "xclk60mhsp1_ck failed error:%d\n", ret);
+                goto err_utmi_p1_fck;
+        }
+
+        utmi_p2_fck = clk_get(dev, "utmi_p2_gfclk");
+        if (IS_ERR(utmi_p2_fck)) {
+                ret = PTR_ERR(utmi_p2_fck);
+                dev_err(dev, "utmi_p2_gfclk failed error:%d\n", ret);
+                goto err_xclk60mhsp1_ck;
+        }
+
+        xclk60mhsp2_ck = clk_get(dev, "xclk60mhsp2_ck");
+        if (IS_ERR(xclk60mhsp2_ck)) {
+                ret = PTR_ERR(xclk60mhsp2_ck);
+                dev_err(dev, "xclk60mhsp2_ck failed error:%d\n", ret);
+                goto err_utmi_p2_fck;
+        }
+
+        usbhost_p1_fck = clk_get(dev, "usb_host_hs_utmi_p1_clk");
+        if (IS_ERR(usbhost_p1_fck)) {
+                ret = PTR_ERR(usbhost_p1_fck);
+                dev_err(dev, "usbhost_p1_fck failed error:%d\n", ret);
+                goto err_xclk60mhsp2_ck;
+        }
+
+        usbhost_p2_fck = clk_get(dev, "usb_host_hs_utmi_p2_clk");
+        if (IS_ERR(usbhost_p2_fck)) {
+                ret = PTR_ERR(usbhost_p2_fck);
+                dev_err(dev, "usbhost_p2_fck failed error:%d\n", ret);
+                goto err_usbhost_p1_fck;
+        }
+
+        init_60m_fclk = clk_get(dev, "init_60m_fclk");
+        if (IS_ERR(init_60m_fclk)) {
+                ret = PTR_ERR(init_60m_fclk);
+                dev_err(dev, "init_60m_fclk failed error:%d\n", ret);
+                goto err_usbhost_p2_fck;
+        }
+
         return 0;
 
+err_usbhost_p2_fck:
+        clk_put(usbhost_p2_fck);
+
+err_usbhost_p1_fck:
+        clk_put(usbhost_p1_fck);
+
+err_xclk60mhsp2_ck:
+        clk_put(xclk60mhsp2_ck);
+
+err_utmi_p2_fck:
+        clk_put(utmi_p2_fck);
+
+err_xclk60mhsp1_ck:
+        clk_put(xclk60mhsp1_ck);
+
+err_utmi_p1_fck:
+        clk_put(utmi_p1_fck);
+
 err_add_hcd:
         disable_put_regulator(pdata);
         pm_runtime_put_sync(dev);
@@ -294,6 +451,15 @@ static int ehci_hcd_omap_remove(struct platform_device *pdev)
         disable_put_regulator(dev->platform_data);
         iounmap(hcd->regs);
         usb_put_hcd(hcd);
+
+        clk_put(utmi_p1_fck);
+        clk_put(utmi_p2_fck);
+        clk_put(xclk60mhsp1_ck);
+        clk_put(xclk60mhsp2_ck);
+        clk_put(usbhost_p1_fck);
+        clk_put(usbhost_p2_fck);
+        clk_put(init_60m_fclk);
+
         pm_runtime_put_sync(dev);
         pm_runtime_disable(dev);
 
@@ -364,7 +530,7 @@ static const struct hc_driver ehci_omap_hc_driver = {
          * root hub support
          */
         .hub_status_data        = ehci_hub_status_data,
-        .hub_control            = ehci_hub_control,
+        .hub_control            = omap_ehci_hub_control,
         .bus_suspend            = ehci_bus_suspend,
         .bus_resume             = ehci_bus_resume,
 
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index bc94d7bf072..123481793a4 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -144,14 +144,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                         hcd->has_tt = 1;
                         tdi_reset(ehci);
                 }
-                if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) {
-                        /* EHCI #1 or #2 on 6 Series/C200 Series chipset */
-                        if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) {
-                                ehci_info(ehci, "broken D3 during system sleep on ASUS\n");
-                                hcd->broken_pci_sleep = 1;
-                                device_set_wakeup_capable(&pdev->dev, false);
-                        }
-                }
                 break;
         case PCI_VENDOR_ID_TDI:
                 if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
diff --git a/drivers/usb/host/ehci-sh.c b/drivers/usb/host/ehci-sh.c
index ca819cdd0c5..e7cb3925abf 100644
--- a/drivers/usb/host/ehci-sh.c
+++ b/drivers/usb/host/ehci-sh.c
@@ -126,8 +126,7 @@ static int ehci_hcd_sh_probe(struct platform_device *pdev)
                 goto fail_create_hcd;
         }
 
-        if (pdev->dev.platform_data != NULL)
-                pdata = pdev->dev.platform_data;
+        pdata = pdev->dev.platform_data;
 
         /* initialize hcd */
         hcd = usb_create_hcd(&ehci_sh_hc_driver, &pdev->dev,
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index 9c2cc463389..e9713d589e3 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -270,14 +270,12 @@ static int ehci_hcd_xilinx_of_remove(struct platform_device *op)
  *
  * Properly shutdown the hcd, call driver's shutdown routine.
  */
-static int ehci_hcd_xilinx_of_shutdown(struct platform_device *op)
+static void ehci_hcd_xilinx_of_shutdown(struct platform_device *op)
 {
         struct usb_hcd *hcd = dev_get_drvdata(&op->dev);
 
         if (hcd->driver->shutdown)
                 hcd->driver->shutdown(hcd);
-
-        return 0;
 }
 
 
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 836772dfabd..2f3619eefef 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -317,7 +317,7 @@ static int ohci_bus_resume (struct usb_hcd *hcd)
 }
 
 /* Carry out the final steps of resuming the controller device */
-static void ohci_finish_controller_resume(struct usb_hcd *hcd)
+static void __maybe_unused ohci_finish_controller_resume(struct usb_hcd *hcd)
 {
         struct ohci_hcd         *ohci = hcd_to_ohci(hcd);
         int                     port;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index ec4338eec82..77689bd64ca 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -793,10 +793,9 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
                 struct xhci_virt_device *virt_dev,
                 int slot_id)
 {
-        struct list_head *tt;
         struct list_head *tt_list_head;
-        struct list_head *tt_next;
-        struct xhci_tt_bw_info *tt_info;
+        struct xhci_tt_bw_info *tt_info, *next;
+        bool slot_found = false;
 
         /* If the device never made it past the Set Address stage,
          * it may not have the real_port set correctly.
@@ -808,34 +807,16 @@ static void xhci_free_tt_info(struct xhci_hcd *xhci,
         }
 
         tt_list_head = &(xhci->rh_bw[virt_dev->real_port - 1].tts);
-        if (list_empty(tt_list_head))
-                return;
-
-        list_for_each(tt, tt_list_head) {
-                tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
-                if (tt_info->slot_id == slot_id)
+        list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
+                /* Multi-TT hubs will have more than one entry */
+                if (tt_info->slot_id == slot_id) {
+                        slot_found = true;
+                        list_del(&tt_info->tt_list);
+                        kfree(tt_info);
+                } else if (slot_found) {
                         break;
+                }
         }
-        /* Cautionary measure in case the hub was disconnected before we
-         * stored the TT information.
-         */
-        if (tt_info->slot_id != slot_id)
-                return;
-
-        tt_next = tt->next;
-        tt_info = list_entry(tt, struct xhci_tt_bw_info,
-                        tt_list);
-        /* Multi-TT hubs will have more than one entry */
-        do {
-                list_del(tt);
-                kfree(tt_info);
-                tt = tt_next;
-                if (list_empty(tt_list_head))
-                        break;
-                tt_next = tt->next;
-                tt_info = list_entry(tt, struct xhci_tt_bw_info,
-                                tt_list);
-        } while (tt_info->slot_id == slot_id);
 }
 
 int xhci_alloc_tt_info(struct xhci_hcd *xhci,
@@ -1791,17 +1772,9 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 {
         struct pci_dev  *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
         struct dev_info *dev_info, *next;
-        struct list_head *tt_list_head;
-        struct list_head *tt;
-        struct list_head *endpoints;
-        struct list_head *ep, *q;
-        struct xhci_tt_bw_info *tt_info;
-        struct xhci_interval_bw_table *bwt;
-        struct xhci_virt_ep *virt_ep;
-
         unsigned long   flags;
         int size;
-        int i;
+        int i, j, num_ports;
 
         /* Free the Event Ring Segment Table and the actual Event Ring */
         size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
@@ -1860,21 +1833,22 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
         }
         spin_unlock_irqrestore(&xhci->lock, flags);
 
-        bwt = &xhci->rh_bw->bw_table;
-        for (i = 0; i < XHCI_MAX_INTERVAL; i++) {
-                endpoints = &bwt->interval_bw[i].endpoints;
-                list_for_each_safe(ep, q, endpoints) {
-                        virt_ep = list_entry(ep, struct xhci_virt_ep, bw_endpoint_list);
-                        list_del(&virt_ep->bw_endpoint_list);
-                        kfree(virt_ep);
+        num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+                for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+                        struct list_head *ep = &bwt->interval_bw[j].endpoints;
+                        while (!list_empty(ep))
+                                list_del_init(ep->next);
                 }
         }
 
-        tt_list_head = &xhci->rh_bw->tts;
-        list_for_each_safe(tt, q, tt_list_head) {
-                tt_info = list_entry(tt, struct xhci_tt_bw_info, tt_list);
-                list_del(tt);
-                kfree(tt_info);
+        for (i = 0; i < num_ports; i++) {
+                struct xhci_tt_bw_info *tt, *n;
+                list_for_each_entry_safe(tt, n, &xhci->rh_bw[i].tts, tt_list) {
+                        list_del(&tt->tt_list);
+                        kfree(tt);
+                }
         }
 
         xhci->num_usb2_ports = 0;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index afdc73ee84a..a979cd0dbe0 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -795,8 +795,8 @@ int xhci_suspend(struct xhci_hcd *xhci)
         command = xhci_readl(xhci, &xhci->op_regs->command);
         command |= CMD_CSS;
         xhci_writel(xhci, command, &xhci->op_regs->command);
-        if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10*100)) {
-                xhci_warn(xhci, "WARN: xHC CMD_CSS timeout\n");
+        if (handshake(xhci, &xhci->op_regs->status, STS_SAVE, 0, 10 * 1000)) {
+                xhci_warn(xhci, "WARN: xHC save state timeout\n");
                 spin_unlock_irq(&xhci->lock);
                 return -ETIMEDOUT;
         }
@@ -848,8 +848,8 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                 command |= CMD_CRS;
                 xhci_writel(xhci, command, &xhci->op_regs->command);
                 if (handshake(xhci, &xhci->op_regs->status,
-                              STS_RESTORE, 0, 10*100)) {
-                        xhci_dbg(xhci, "WARN: xHC CMD_CSS timeout\n");
+                              STS_RESTORE, 0, 10 * 1000)) {
+                        xhci_warn(xhci, "WARN: xHC restore state timeout\n");
                         spin_unlock_irq(&xhci->lock);
                         return -ETIMEDOUT;
                 }
@@ -3906,7 +3906,7 @@ static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev,
         default:
                 dev_warn(&udev->dev, "%s: Can't get timeout for non-U1 or U2 state.\n",
                                 __func__);
-                return -EINVAL;
+                return USB3_LPM_DISABLED;
         }
 
         if (sel <= max_sel_pel && pel <= max_sel_pel)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 768b4b55c81..9d63ba4d10d 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -34,6 +34,7 @@
 #include <linux/dma-mapping.h>
 
 #include <mach/cputype.h>
+#include <mach/hardware.h>
 
 #include <asm/mach-types.h>
 
diff --git a/drivers/usb/musb/davinci.h b/drivers/usb/musb/davinci.h
index 046c84433ca..371baa0ee50 100644
--- a/drivers/usb/musb/davinci.h
+++ b/drivers/usb/musb/davinci.h
@@ -15,7 +15,7 @@
  */
 
 /* Integrated highspeed/otg PHY */
-#define USBPHY_CTL_PADDR        (DAVINCI_SYSTEM_MODULE_BASE + 0x34)
+#define USBPHY_CTL_PADDR        0x01c40034
 #define USBPHY_DATAPOL          BIT(11) /* (dm355) switch D+/D- */
 #define USBPHY_PHYCLKGD         BIT(8)
 #define USBPHY_SESNDEN          BIT(7)  /* v(sess_end) comparator */
@@ -27,7 +27,7 @@
 #define USBPHY_OTGPDWN          BIT(1)
 #define USBPHY_PHYPDWN          BIT(0)
 
-#define DM355_DEEPSLEEP_PADDR   (DAVINCI_SYSTEM_MODULE_BASE + 0x48)
+#define DM355_DEEPSLEEP_PADDR   0x01c40048
 #define DRVVBUS_FORCE           BIT(2)
 #define DRVVBUS_OVERRIDE        BIT(1)
 
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index f42c29b11f7..95918dacc99 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -1232,6 +1232,7 @@ static int musb_gadget_disable(struct usb_ep *ep)
         }
 
         musb_ep->desc = NULL;
+        musb_ep->end_point.desc = NULL;
 
         /* abort all pending DMA and requests */
         nuke(musb_ep, -ESHUTDOWN);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 1b1926200ba..73d25cd8cba 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -82,6 +82,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x10C4, 0x8066) }, /* Argussoft In-System Programmer */
         { USB_DEVICE(0x10C4, 0x806F) }, /* IMS USB to RS422 Converter Cable */
         { USB_DEVICE(0x10C4, 0x807A) }, /* Crumb128 board */
+        { USB_DEVICE(0x10C4, 0x80C4) }, /* Cygnal Integrated Products, Inc., Optris infrared thermometer */
         { USB_DEVICE(0x10C4, 0x80CA) }, /* Degree Controls Inc */
         { USB_DEVICE(0x10C4, 0x80DD) }, /* Tracient RFID */
         { USB_DEVICE(0x10C4, 0x80F6) }, /* Suunto sports instrument */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8c084ea34e2..bc912e5a3be 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -737,6 +737,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
         { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
         { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+        { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
         { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index f3c7c78ede3..5661c7e2d41 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -784,6 +784,7 @@
 #define RTSYSTEMS_VID                   0x2100  /* Vendor ID */
 #define RTSYSTEMS_SERIAL_VX7_PID        0x9e52  /* Serial converter for VX-7 Radios using FT232RL */
 #define RTSYSTEMS_CT29B_PID             0x9e54  /* CT29B Radio Cable */
+#define RTSYSTEMS_RTS01_PID             0x9e57  /* USB-RTS01 Radio Cable */
 
 
 /*
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index 105a6d898ca..9b026bf7afe 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -39,13 +39,6 @@ MODULE_PARM_DESC(product, "User specified USB idProduct");
 
 static struct usb_device_id generic_device_ids[2]; /* Initially all zeroes. */
 
-/* we want to look at all devices, as the vendor/product id can change
- * depending on the command line argument */
-static const struct usb_device_id generic_serial_ids[] = {
-        {.driver_info = 42},
-        {}
-};
-
 /* All of the device info needed for the Generic Serial Converter */
 struct usb_serial_driver usb_serial_generic_device = {
         .driver = {
@@ -79,7 +72,8 @@ int usb_serial_generic_register(int _debug)
                 USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_PRODUCT;
 
         /* register our generic driver with ourselves */
-        retval = usb_serial_register_drivers(serial_drivers, "usbserial_generic", generic_serial_ids);
+        retval = usb_serial_register_drivers(serial_drivers,
+                        "usbserial_generic", generic_device_ids);
 #endif
         return retval;
 }
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index d0ec1aa5271..a71fa0aa040 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -309,13 +309,16 @@ static int mct_u232_set_modem_ctrl(struct usb_serial *serial,
                         MCT_U232_SET_REQUEST_TYPE,
                         0, 0, buf, MCT_U232_SET_MODEM_CTRL_SIZE,
                         WDR_TIMEOUT);
-        if (rc < 0)
-                dev_err(&serial->dev->dev,
-                        "Set MODEM CTRL 0x%x failed (error = %d)\n", mcr, rc);
+        kfree(buf);
+
         dbg("set_modem_ctrl: state=0x%x ==> mcr=0x%x", control_state, mcr);
 
-        kfree(buf);
-        return rc;
+        if (rc < 0) {
+                dev_err(&serial->dev->dev,
+                        "Set MODEM CTRL 0x%x failed (error = %d)\n", mcr, rc);
+                return rc;
+        }
+        return 0;
 } /* mct_u232_set_modem_ctrl */
 
 static int mct_u232_get_modem_stat(struct usb_serial *serial,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 29160f8b510..57eca244842 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -190,7 +190,7 @@
 
 static int device_type;
 
-static const struct usb_device_id id_table[] __devinitconst = {
+static const struct usb_device_id id_table[] = {
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
         {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7810)},
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 1aae9028cd0..e668a2460bd 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -47,6 +47,7 @@
 /* Function prototypes */
 static int  option_probe(struct usb_serial *serial,
                         const struct usb_device_id *id);
+static void option_release(struct usb_serial *serial);
 static int option_send_setup(struct usb_serial_port *port);
 static void option_instat_callback(struct urb *urb);
 
@@ -150,6 +151,7 @@ static void option_instat_callback(struct urb *urb);
 #define HUAWEI_PRODUCT_E14AC                    0x14AC
 #define HUAWEI_PRODUCT_K3806                    0x14AE
 #define HUAWEI_PRODUCT_K4605                    0x14C6
+#define HUAWEI_PRODUCT_K5005                    0x14C8
 #define HUAWEI_PRODUCT_K3770                    0x14C9
 #define HUAWEI_PRODUCT_K3771                    0x14CA
 #define HUAWEI_PRODUCT_K4510                    0x14CB
@@ -425,7 +427,7 @@ static void option_instat_callback(struct urb *urb);
 #define SAMSUNG_VENDOR_ID                       0x04e8
 #define SAMSUNG_PRODUCT_GT_B3730                0x6889
 
-/* YUGA products  www.yuga-info.com*/
+/* YUGA products  www.yuga-info.com gavin.kx@qq.com */
 #define YUGA_VENDOR_ID                          0x257A
 #define YUGA_PRODUCT_CEM600                     0x1601
 #define YUGA_PRODUCT_CEM610                     0x1602
@@ -442,6 +444,8 @@ static void option_instat_callback(struct urb *urb);
 #define YUGA_PRODUCT_CEU516                     0x160C
 #define YUGA_PRODUCT_CEU528                     0x160D
 #define YUGA_PRODUCT_CEU526                     0x160F
+#define YUGA_PRODUCT_CEU881                     0x161F
+#define YUGA_PRODUCT_CEU882                     0x162F
 
 #define YUGA_PRODUCT_CWM600                     0x2601
 #define YUGA_PRODUCT_CWM610                     0x2602
@@ -457,23 +461,26 @@ static void option_instat_callback(struct urb *urb);
 #define YUGA_PRODUCT_CWU518                     0x260B
 #define YUGA_PRODUCT_CWU516                     0x260C
 #define YUGA_PRODUCT_CWU528                     0x260D
+#define YUGA_PRODUCT_CWU581                     0x260E
 #define YUGA_PRODUCT_CWU526                     0x260F
-
-#define YUGA_PRODUCT_CLM600                     0x2601
-#define YUGA_PRODUCT_CLM610                     0x2602
-#define YUGA_PRODUCT_CLM500                     0x2603
-#define YUGA_PRODUCT_CLM510                     0x2604
-#define YUGA_PRODUCT_CLM800                     0x2605
-#define YUGA_PRODUCT_CLM900                     0x2606
-
-#define YUGA_PRODUCT_CLU718                     0x2607
-#define YUGA_PRODUCT_CLU716                     0x2608
-#define YUGA_PRODUCT_CLU728                     0x2609
-#define YUGA_PRODUCT_CLU726                     0x260A
-#define YUGA_PRODUCT_CLU518                     0x260B
-#define YUGA_PRODUCT_CLU516                     0x260C
-#define YUGA_PRODUCT_CLU528                     0x260D
-#define YUGA_PRODUCT_CLU526                     0x260F
+#define YUGA_PRODUCT_CWU582                     0x261F
+#define YUGA_PRODUCT_CWU583                     0x262F
+
+#define YUGA_PRODUCT_CLM600                     0x3601
+#define YUGA_PRODUCT_CLM610                     0x3602
+#define YUGA_PRODUCT_CLM500                     0x3603
+#define YUGA_PRODUCT_CLM510                     0x3604
+#define YUGA_PRODUCT_CLM800                     0x3605
+#define YUGA_PRODUCT_CLM900                     0x3606
+
+#define YUGA_PRODUCT_CLU718                     0x3607
+#define YUGA_PRODUCT_CLU716                     0x3608
+#define YUGA_PRODUCT_CLU728                     0x3609
+#define YUGA_PRODUCT_CLU726                     0x360A
+#define YUGA_PRODUCT_CLU518                     0x360B
+#define YUGA_PRODUCT_CLU516                     0x360C
+#define YUGA_PRODUCT_CLU528                     0x360D
+#define YUGA_PRODUCT_CLU526                     0x360F
 
 /* Viettel products */
 #define VIETTEL_VENDOR_ID                       0x2262
@@ -666,6 +673,11 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3806, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t) &huawei_cdc12_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K4605, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x31) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x32) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K5005, 0xff, 0x01, 0x33) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x31) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3770, 0xff, 0x02, 0x32) },
         { USB_DEVICE_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, HUAWEI_PRODUCT_K3771, 0xff, 0x02, 0x31) },
@@ -1209,6 +1221,11 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU516) },
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU528) },
         { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU881) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEU882) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU581) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU582) },
+        { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CWU583) },
         { USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
         { USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
@@ -1245,7 +1262,7 @@ static struct usb_serial_driver option_1port_device = {
         .ioctl             = usb_wwan_ioctl,
         .attach            = usb_wwan_startup,
         .disconnect        = usb_wwan_disconnect,
-        .release           = usb_wwan_release,
+        .release           = option_release,
         .read_int_callback = option_instat_callback,
 #ifdef CONFIG_PM
         .suspend           = usb_wwan_suspend,
@@ -1259,35 +1276,6 @@ static struct usb_serial_driver * const serial_drivers[] = {
 
 static bool debug;
 
-/* per port private data */
-
-#define N_IN_URB 4
-#define N_OUT_URB 4
-#define IN_BUFLEN 4096
-#define OUT_BUFLEN 4096
-
-struct option_port_private {
-        /* Input endpoints and buffer for this port */
-        struct urb *in_urbs[N_IN_URB];
-        u8 *in_buffer[N_IN_URB];
-        /* Output endpoints and buffer for this port */
-        struct urb *out_urbs[N_OUT_URB];
-        u8 *out_buffer[N_OUT_URB];
-        unsigned long out_busy;         /* Bit vector of URBs in use */
-        int opened;
-        struct usb_anchor delayed;
-
-        /* Settings for the port */
-        int rts_state;  /* Handshaking pins (outputs) */
-        int dtr_state;
-        int cts_state;  /* Handshaking pins (inputs) */
-        int dsr_state;
-        int dcd_state;
-        int ri_state;
-
-        unsigned long tx_start_time[N_OUT_URB];
-};
-
 module_usb_serial_driver(serial_drivers, option_ids);
 
 static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason,
@@ -1356,12 +1344,22 @@ static int option_probe(struct usb_serial *serial,
         return 0;
 }
 
+static void option_release(struct usb_serial *serial)
+{
+        struct usb_wwan_intf_private *priv = usb_get_serial_data(serial);
+
+        usb_wwan_release(serial);
+
+        kfree(priv);
+}
+
 static void option_instat_callback(struct urb *urb)
 {
         int err;
         int status = urb->status;
         struct usb_serial_port *port =  urb->context;
-        struct option_port_private *portdata = usb_get_serial_port_data(port);
+        struct usb_wwan_port_private *portdata =
+                                        usb_get_serial_port_data(port);
 
         dbg("%s: urb %p port %p has data %p", __func__, urb, port, portdata);
 
@@ -1421,7 +1419,7 @@ static int option_send_setup(struct usb_serial_port *port)
         struct usb_serial *serial = port->serial;
         struct usb_wwan_intf_private *intfdata =
                 (struct usb_wwan_intf_private *) serial->private;
-        struct option_port_private *portdata;
+        struct usb_wwan_port_private *portdata;
         int ifNum = serial->interface->cur_altsetting->desc.bInterfaceNumber;
         int val = 0;
 
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 0d5fe59ebb9..996015c5f1a 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -105,7 +105,13 @@ static const struct usb_device_id id_table[] = {
         {USB_DEVICE(0x1410, 0xa021)},   /* Novatel Gobi 3000 Composite */
         {USB_DEVICE(0x413c, 0x8193)},   /* Dell Gobi 3000 QDL */
         {USB_DEVICE(0x413c, 0x8194)},   /* Dell Gobi 3000 Composite */
+        {USB_DEVICE(0x1199, 0x9010)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9012)},   /* Sierra Wireless Gobi 3000 QDL */
         {USB_DEVICE(0x1199, 0x9013)},   /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
+        {USB_DEVICE(0x1199, 0x9014)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9015)},   /* Sierra Wireless Gobi 3000 Modem device */
+        {USB_DEVICE(0x1199, 0x9018)},   /* Sierra Wireless Gobi 3000 QDL */
+        {USB_DEVICE(0x1199, 0x9019)},   /* Sierra Wireless Gobi 3000 Modem device */
         {USB_DEVICE(0x12D1, 0x14F0)},   /* Sony Gobi 3000 QDL */
         {USB_DEVICE(0x12D1, 0x14F1)},   /* Sony Gobi 3000 Composite */
         { }                             /* Terminating entry */
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ba54a0a8235..d423d36acc0 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -294,6 +294,10 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
+        /* AT&T Direct IP LTE modems */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+        },
         { USB_DEVICE(0x0f3d, 0x68A3),   /* Airprime/Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 6a1b609a0d9..27483f91a4a 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -659,12 +659,14 @@ exit:
 static struct usb_serial_driver *search_serial_device(
                                         struct usb_interface *iface)
 {
-        const struct usb_device_id *id;
+        const struct usb_device_id *id = NULL;
         struct usb_serial_driver *drv;
+        struct usb_driver *driver = to_usb_driver(iface->dev.driver);
 
         /* Check if the usb id matches a known device */
         list_for_each_entry(drv, &usb_serial_driver_list, driver_list) {
-                id = get_iface_id(drv, iface);
+                if (drv->usb_driver == driver)
+                        id = get_iface_id(drv, iface);
                 if (id)
                         return drv;
         }
@@ -755,7 +757,7 @@ static int usb_serial_probe(struct usb_interface *interface,
 
                 if (retval) {
                         dbg("sub driver rejected device");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return retval;
                 }
@@ -827,7 +829,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                  */
                 if (num_bulk_in == 0 || num_bulk_out == 0) {
                         dev_info(&interface->dev, "PL-2303 hack: descriptors matched but endpoints did not\n");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return -ENODEV;
                 }
@@ -841,7 +843,7 @@ static int usb_serial_probe(struct usb_interface *interface,
                 if (num_ports == 0) {
                         dev_err(&interface->dev,
                             "Generic device with no bulk out, not allowed.\n");
-                        kfree(serial);
+                        usb_serial_put(serial);
                         module_put(type->driver.owner);
                         return -EIO;
                 }
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 1719886bb9b..caf22bf5f82 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1107,6 +1107,13 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9999,
                 USB_SC_RBC, USB_PR_BULK, NULL,
                 0 ),
 
+/* Feiya QDI U2 DISK, reported by Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV( 0x090c, 0x1000, 0x0000, 0xffff,
+                "Feiya",
+                "QDI U2 DISK",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_READ_CAPACITY_16 ),
+
 /* aeb */
 UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff,
                 "Feiya",
diff --git a/drivers/video/backlight/Kconfig b/drivers/video/backlight/Kconfig
index fa2b0375031..2979292650d 100644
--- a/drivers/video/backlight/Kconfig
+++ b/drivers/video/backlight/Kconfig
@@ -88,7 +88,7 @@ config LCD_PLATFORM
 
 config LCD_TOSA
         tristate "Sharp SL-6000 LCD Driver"
-        depends on SPI && MACH_TOSA
+        depends on I2C && SPI && MACH_TOSA
         help
           If you have an Sharp SL-6000 Zaurus say Y to enable a driver
           for its LCD.
diff --git a/drivers/video/backlight/ili9320.c b/drivers/video/backlight/ili9320.c
index 6c9399341bc..9327cd1b314 100644
--- a/drivers/video/backlight/ili9320.c
+++ b/drivers/video/backlight/ili9320.c
@@ -263,7 +263,7 @@ int __devinit ili9320_probe_spi(struct spi_device *spi,
 
 EXPORT_SYMBOL_GPL(ili9320_probe_spi);
 
-int __devexit ili9320_remove(struct ili9320 *ili)
+int ili9320_remove(struct ili9320 *ili)
 {
         ili9320_power(ili, FB_BLANK_POWERDOWN);
 
diff --git a/drivers/video/bfin_adv7393fb.c b/drivers/video/bfin_adv7393fb.c
index 33ea874c87d..9bdd4b0c18c 100644
--- a/drivers/video/bfin_adv7393fb.c
+++ b/drivers/video/bfin_adv7393fb.c
@@ -353,18 +353,16 @@ adv7393_read_proc(char *page, char **start, off_t off,
 
 static int
 adv7393_write_proc(struct file *file, const char __user * buffer,
-                   unsigned long count, void *data)
+                   size_t count, void *data)
 {
         struct adv7393fb_device *fbdev = data;
-        char line[8];
         unsigned int val;
         int ret;
 
-        ret = copy_from_user(line, buffer, count);
+        ret = kstrtouint_from_user(buffer, count, 0, &val);
         if (ret)
                 return -EFAULT;
 
-        val = simple_strtoul(line, NULL, 0);
         adv7393_write(fbdev->client, val >> 8, val & 0xff);
 
         return count;
diff --git a/drivers/video/broadsheetfb.c b/drivers/video/broadsheetfb.c
index 377dde3d5bf..c95b417d0d4 100644
--- a/drivers/video/broadsheetfb.c
+++ b/drivers/video/broadsheetfb.c
@@ -1211,7 +1211,7 @@ static int __devexit broadsheetfb_remove(struct platform_device *dev)
 
 static struct platform_driver broadsheetfb_driver = {
         .probe  = broadsheetfb_probe,
-        .remove = broadsheetfb_remove,
+        .remove = __devexit_p(broadsheetfb_remove),
         .driver = {
                 .owner  = THIS_MODULE,
                 .name   = "broadsheetfb",
diff --git a/drivers/video/console/Kconfig b/drivers/video/console/Kconfig
index c2d11fef114..e2c96d01d8f 100644
--- a/drivers/video/console/Kconfig
+++ b/drivers/video/console/Kconfig
@@ -224,5 +224,19 @@ config FONT_10x18
           big letters. It fits between the sun 12x22 and the normal 8x16 font.
           If other fonts are too big or too small for you, say Y, otherwise say N.
 
+config FONT_AUTOSELECT
+        def_bool y
+        depends on FRAMEBUFFER_CONSOLE || SGI_NEWPORT_CONSOLE || STI_CONSOLE || USB_SISUSBVGA_CON
+        depends on !FONT_8x8
+        depends on !FONT_6x11
+        depends on !FONT_7x14
+        depends on !FONT_PEARL_8x8
+        depends on !FONT_ACORN_8x8
+        depends on !FONT_MINI_4x6
+        depends on !FONT_SUN8x16
+        depends on !FONT_SUN12x22
+        depends on !FONT_10x18
+        select FONT_8x16
+
 endmenu
 
diff --git a/drivers/video/mbx/mbxfb.c b/drivers/video/mbx/mbxfb.c
index ab0a8e52733..85e4f44bfa6 100644
--- a/drivers/video/mbx/mbxfb.c
+++ b/drivers/video/mbx/mbxfb.c
@@ -1045,7 +1045,7 @@ static int __devexit mbxfb_remove(struct platform_device *dev)
 
 static struct platform_driver mbxfb_driver = {
         .probe = mbxfb_probe,
-        .remove = mbxfb_remove,
+        .remove = __devexit_p(mbxfb_remove),
         .suspend = mbxfb_suspend,
         .resume = mbxfb_resume,
         .driver = {
diff --git a/drivers/video/omap2/displays/panel-taal.c b/drivers/video/omap2/displays/panel-taal.c
index 2ce9992f403..901576eb5a8 100644
--- a/drivers/video/omap2/displays/panel-taal.c
+++ b/drivers/video/omap2/displays/panel-taal.c
@@ -526,7 +526,7 @@ static ssize_t taal_num_errors_show(struct device *dev,
 {
         struct omap_dss_device *dssdev = to_dss_device(dev);
         struct taal_data *td = dev_get_drvdata(&dssdev->dev);
-        u8 errors;
+        u8 errors = 0;
         int r;
 
         mutex_lock(&td->lock);
diff --git a/drivers/video/omap2/dss/core.c b/drivers/video/omap2/dss/core.c
index 72ded9cd2cb..5066eee10cc 100644
--- a/drivers/video/omap2/dss/core.c
+++ b/drivers/video/omap2/dss/core.c
@@ -194,8 +194,7 @@ static inline int dss_initialize_debugfs(void)
 static inline void dss_uninitialize_debugfs(void)
 {
 }
-static inline int dss_debugfs_create_file(const char *name,
-                void (*write)(struct seq_file *))
+int dss_debugfs_create_file(const char *name, void (*write)(struct seq_file *))
 {
         return 0;
 }
diff --git a/drivers/video/omap2/dss/dsi.c b/drivers/video/omap2/dss/dsi.c
index ec363d8390e..ca8382d346e 100644
--- a/drivers/video/omap2/dss/dsi.c
+++ b/drivers/video/omap2/dss/dsi.c
@@ -3724,7 +3724,7 @@ static int dsi_compute_interleave_lp(int blank, int enter_hs, int exit_hs,
         /* CLKIN4DDR = 16 * TXBYTECLKHS */
         tlp_avail = thsbyte_clk * (blank - trans_lp);
 
-        ttxclkesc = tdsi_fclk / lp_clk_div;
+        ttxclkesc = tdsi_fclk * lp_clk_div;
 
         lp_inter = ((tlp_avail - 8 * thsbyte_clk - 5 * tdsi_fclk) / ttxclkesc -
                         26) / 16;
diff --git a/drivers/video/omap2/dss/dss.c b/drivers/video/omap2/dss/dss.c
index 6ea1ff149f6..770632359a1 100644
--- a/drivers/video/omap2/dss/dss.c
+++ b/drivers/video/omap2/dss/dss.c
@@ -731,7 +731,7 @@ static void dss_runtime_put(void)
         DSSDBG("dss_runtime_put\n");
 
         r = pm_runtime_put_sync(&dss.pdev->dev);
-        WARN_ON(r < 0);
+        WARN_ON(r < 0 && r != -EBUSY);
 }
 
 /* DEBUGFS */
diff --git a/drivers/video/s3c-fb.c b/drivers/video/s3c-fb.c
index 5f9d8e69029..ea7b661e722 100644
--- a/drivers/video/s3c-fb.c
+++ b/drivers/video/s3c-fb.c
@@ -361,7 +361,7 @@ static int s3c_fb_calc_pixclk(struct s3c_fb *sfb, unsigned int pixclk)
         result = (unsigned int)tmp / 1000;
 
         dev_dbg(sfb->dev, "pixclk=%u, clk=%lu, div=%d (%lu)\n",
-                pixclk, clk, result, clk / result);
+                pixclk, clk, result, result ? clk / result : clk);
 
         return result;
 }
@@ -1348,8 +1348,14 @@ static void s3c_fb_clear_win(struct s3c_fb *sfb, int win)
         writel(0, regs + VIDOSD_A(win, sfb->variant));
         writel(0, regs + VIDOSD_B(win, sfb->variant));
         writel(0, regs + VIDOSD_C(win, sfb->variant));
-        reg = readl(regs + SHADOWCON);
-        writel(reg & ~SHADOWCON_WINx_PROTECT(win), regs + SHADOWCON);
+
+        if (sfb->variant.has_shadowcon) {
+                reg = readl(sfb->regs + SHADOWCON);
+                reg &= ~(SHADOWCON_WINx_PROTECT(win) |
+                        SHADOWCON_CHx_ENABLE(win) |
+                        SHADOWCON_CHx_LOCAL_ENABLE(win));
+                writel(reg, sfb->regs + SHADOWCON);
+        }
 }
 
 static int __devinit s3c_fb_probe(struct platform_device *pdev)
diff --git a/drivers/video/savage/savagefb_driver.c b/drivers/video/savage/savagefb_driver.c
index cee7803a0a1..f3d3b9ce475 100644
--- a/drivers/video/savage/savagefb_driver.c
+++ b/drivers/video/savage/savagefb_driver.c
@@ -1351,7 +1351,7 @@ static void savagefb_set_par_int(struct savagefb_par  *par, struct savage_reg *r
         /* following part not present in X11 driver */
         cr67 = vga_in8(0x3d5, par) & 0xf;
         vga_out8(0x3d5, 0x50 | cr67, par);
-        udelay(10000);
+        mdelay(10);
         vga_out8(0x3d4, 0x67, par);
         /* end of part */
         vga_out8(0x3d5, reg->CR67 & ~0x0c, par);
@@ -1904,11 +1904,11 @@ static int savage_init_hw(struct savagefb_par *par)
         vga_out8(0x3d4, 0x66, par);
         cr66 = vga_in8(0x3d5, par);
         vga_out8(0x3d5, cr66 | 0x02, par);
-        udelay(10000);
+        mdelay(10);
 
         vga_out8(0x3d4, 0x66, par);
         vga_out8(0x3d5, cr66 & ~0x02, par);     /* clear reset flag */
-        udelay(10000);
+        mdelay(10);
 
 
         /*
@@ -1918,11 +1918,11 @@ static int savage_init_hw(struct savagefb_par *par)
         vga_out8(0x3d4, 0x3f, par);
         cr3f = vga_in8(0x3d5, par);
         vga_out8(0x3d5, cr3f | 0x08, par);
-        udelay(10000);
+        mdelay(10);
 
         vga_out8(0x3d4, 0x3f, par);
         vga_out8(0x3d5, cr3f & ~0x08, par);     /* clear reset flags */
-        udelay(10000);
+        mdelay(10);
 
         /* Savage ramdac speeds */
         par->numClocks = 4;
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 6908e4ce2a0..7595581d032 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -827,6 +827,9 @@ int bind_evtchn_to_irq(unsigned int evtchn)
                                               handle_edge_irq, "event");
 
                 xen_irq_info_evtchn_init(irq, evtchn);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_EVTCHN);
         }
 
 out:
@@ -862,6 +865,9 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
                 xen_irq_info_ipi_init(cpu, irq, evtchn, ipi);
 
                 bind_evtchn_to_cpu(evtchn, cpu);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_IPI);
         }
 
  out:
@@ -939,6 +945,9 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
                 xen_irq_info_virq_init(cpu, irq, evtchn, virq);
 
                 bind_evtchn_to_cpu(evtchn, cpu);
+        } else {
+                struct irq_info *info = info_for_irq(irq);
+                WARN_ON(info == NULL || info->type != IRQT_VIRQ);
         }
 
 out:
diff --git a/drivers/xen/pci.c b/drivers/xen/pci.c
index b84bf0b6cc3..18fff88254e 100644
--- a/drivers/xen/pci.c
+++ b/drivers/xen/pci.c
@@ -59,7 +59,7 @@ static int xen_add_device(struct device *dev)
 
 #ifdef CONFIG_ACPI
                 handle = DEVICE_ACPI_HANDLE(&pci_dev->dev);
-                if (!handle)
+                if (!handle && pci_dev->bus->bridge)
                         handle = DEVICE_ACPI_HANDLE(pci_dev->bus->bridge);
 #ifdef CONFIG_PCI_IOV
                 if (!handle && pci_dev->is_virtfn)
diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 3f75895c919..8f7d1237b7a 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -179,7 +179,8 @@ static int __add_prelim_ref(struct list_head *head, u64 root_id,
 
 static int add_all_parents(struct btrfs_root *root, struct btrfs_path *path,
                                 struct ulist *parents, int level,
-                                struct btrfs_key *key, u64 wanted_disk_byte,
+                                struct btrfs_key *key, u64 time_seq,
+                                u64 wanted_disk_byte,
                                 const u64 *extent_item_pos)
 {
         int ret;
@@ -212,7 +213,7 @@ add_parent:
          */
         while (1) {
                 eie = NULL;
-                ret = btrfs_next_leaf(root, path);
+                ret = btrfs_next_old_leaf(root, path, time_seq);
                 if (ret < 0)
                         return ret;
                 if (ret)
@@ -294,18 +295,10 @@ static int __resolve_indirect_ref(struct btrfs_fs_info *fs_info,
                 goto out;
         }
 
-        if (level == 0) {
-                if (ret == 1 && path->slots[0] >= btrfs_header_nritems(eb)) {
-                        ret = btrfs_next_leaf(root, path);
-                        if (ret)
-                                goto out;
-                        eb = path->nodes[0];
-                }
-
+        if (level == 0)
                 btrfs_item_key_to_cpu(eb, &key, path->slots[0]);
-        }
 
-        ret = add_all_parents(root, path, parents, level, &key,
+        ret = add_all_parents(root, path, parents, level, &key, time_seq,
                                 ref->wanted_disk_byte, extent_item_pos);
 out:
         btrfs_free_path(path);
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index e616f8872e6..12394a90d60 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -37,6 +37,7 @@
 #define BTRFS_INODE_IN_DEFRAG                   3
 #define BTRFS_INODE_DELALLOC_META_RESERVED      4
 #define BTRFS_INODE_HAS_ORPHAN_ITEM             5
+#define BTRFS_INODE_HAS_ASYNC_EXTENT            6
 
 /* in memory btrfs inode */
 struct btrfs_inode {
diff --git a/fs/btrfs/check-integrity.c b/fs/btrfs/check-integrity.c
index 9cebb1fd6a3..da6e9364a5e 100644
--- a/fs/btrfs/check-integrity.c
+++ b/fs/btrfs/check-integrity.c
@@ -93,6 +93,7 @@
 #include "print-tree.h"
 #include "locking.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 #define BTRFSIC_BLOCK_HASHTABLE_SIZE 0x10000
 #define BTRFSIC_BLOCK_LINK_HASHTABLE_SIZE 0x10000
@@ -843,13 +844,14 @@ static int btrfsic_process_superblock_dev_mirror(
                 superblock_tmp->never_written = 0;
                 superblock_tmp->mirror_num = 1 + superblock_mirror_num;
                 if (state->print_mask & BTRFSIC_PRINT_MASK_SUPERBLOCK_WRITE)
-                        printk(KERN_INFO "New initial S-block (bdev %p, %s)"
-                               " @%llu (%s/%llu/%d)\n",
-                               superblock_bdev, device->name,
-                               (unsigned long long)dev_bytenr,
-                               dev_state->name,
-                               (unsigned long long)dev_bytenr,
-                               superblock_mirror_num);
+                        printk_in_rcu(KERN_INFO "New initial S-block (bdev %p, %s)"
+                                     " @%llu (%s/%llu/%d)\n",
+                                     superblock_bdev,
+                                     rcu_str_deref(device->name),
+                                     (unsigned long long)dev_bytenr,
+                                     dev_state->name,
+                                     (unsigned long long)dev_bytenr,
+                                     superblock_mirror_num);
                 list_add(&superblock_tmp->all_blocks_node,
                          &state->all_blocks_list);
                 btrfsic_block_hashtable_add(superblock_tmp,
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index d7a96cfdc50..15cbc2bf4ff 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -467,6 +467,15 @@ static inline int tree_mod_dont_log(struct btrfs_fs_info *fs_info,
         return 0;
 }
 
+/*
+ * This allocates memory and gets a tree modification sequence number when
+ * needed.
+ *
+ * Returns 0 when no sequence number is needed, < 0 on error.
+ * Returns 1 when a sequence number was added. In this case,
+ * fs_info->tree_mod_seq_lock was acquired and must be released by the caller
+ * after inserting into the rb tree.
+ */
 static inline int tree_mod_alloc(struct btrfs_fs_info *fs_info, gfp_t flags,
                                  struct tree_mod_elem **tm_ret)
 {
@@ -491,11 +500,11 @@ static inline int tree_mod_alloc(struct btrfs_fs_info *fs_info, gfp_t flags,
                  */
                 kfree(tm);
                 seq = 0;
+                spin_unlock(&fs_info->tree_mod_seq_lock);
         } else {
                 __get_tree_mod_seq(fs_info, &tm->elem);
                 seq = tm->elem.seq;
         }
-        spin_unlock(&fs_info->tree_mod_seq_lock);
 
         return seq;
 }
@@ -521,7 +530,9 @@ tree_mod_log_insert_key_mask(struct btrfs_fs_info *fs_info,
         tm->slot = slot;
         tm->generation = btrfs_node_ptr_generation(eb, slot);
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static noinline int
@@ -559,7 +570,9 @@ tree_mod_log_insert_move(struct btrfs_fs_info *fs_info,
         tm->move.nr_items = nr_items;
         tm->op = MOD_LOG_MOVE_KEYS;
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static noinline int
@@ -580,7 +593,9 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
         tm->generation = btrfs_header_generation(old_root);
         tm->op = MOD_LOG_ROOT_REPLACE;
 
-        return __tree_mod_log_insert(fs_info, tm);
+        ret = __tree_mod_log_insert(fs_info, tm);
+        spin_unlock(&fs_info->tree_mod_seq_lock);
+        return ret;
 }
 
 static struct tree_mod_elem *
@@ -1023,6 +1038,10 @@ __tree_mod_log_oldest_root(struct btrfs_fs_info *fs_info,
                 looped = 1;
         }
 
+        /* if there's no old root to return, return what we found instead */
+        if (!found)
+                found = tm;
+
         return found;
 }
 
@@ -1143,22 +1162,36 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,
         return eb_rewin;
 }
 
+/*
+ * get_old_root() rewinds the state of @root's root node to the given @time_seq
+ * value. If there are no changes, the current root->root_node is returned. If
+ * anything changed in between, there's a fresh buffer allocated on which the
+ * rewind operations are done. In any case, the returned buffer is read locked.
+ * Returns NULL on error (with no locks held).
+ */
 static inline struct extent_buffer *
 get_old_root(struct btrfs_root *root, u64 time_seq)
 {
         struct tree_mod_elem *tm;
         struct extent_buffer *eb;
-        struct tree_mod_root *old_root;
-        u64 old_generation;
+        struct tree_mod_root *old_root = NULL;
+        u64 old_generation = 0;
+        u64 logical;
 
+        eb = btrfs_read_lock_root_node(root);
         tm = __tree_mod_log_oldest_root(root->fs_info, root, time_seq);
         if (!tm)
                 return root->node;
 
-        old_root = &tm->old_root;
-        old_generation = tm->generation;
+        if (tm->op == MOD_LOG_ROOT_REPLACE) {
+                old_root = &tm->old_root;
+                old_generation = tm->generation;
+                logical = old_root->logical;
+        } else {
+                logical = root->node->start;
+        }
 
-        tm = tree_mod_log_search(root->fs_info, old_root->logical, time_seq);
+        tm = tree_mod_log_search(root->fs_info, logical, time_seq);
         /*
          * there was an item in the log when __tree_mod_log_oldest_root
          * returned. this one must not go away, because the time_seq passed to
@@ -1166,22 +1199,25 @@ get_old_root(struct btrfs_root *root, u64 time_seq)
          */
         BUG_ON(!tm);
 
-        if (old_root->logical == root->node->start) {
-                /* there are logged operations for the current root */
-                eb = btrfs_clone_extent_buffer(root->node);
-        } else {
-                /* there's a root replace operation for the current root */
+        if (old_root)
                 eb = alloc_dummy_extent_buffer(tm->index << PAGE_CACHE_SHIFT,
                                                root->nodesize);
+        else
+                eb = btrfs_clone_extent_buffer(root->node);
+        btrfs_tree_read_unlock(root->node);
+        free_extent_buffer(root->node);
+        if (!eb)
+                return NULL;
+        btrfs_tree_read_lock(eb);
+        if (old_root) {
                 btrfs_set_header_bytenr(eb, eb->start);
                 btrfs_set_header_backref_rev(eb, BTRFS_MIXED_BACKREF_REV);
                 btrfs_set_header_owner(eb, root->root_key.objectid);
+                btrfs_set_header_level(eb, old_root->level);
+                btrfs_set_header_generation(eb, old_generation);
         }
-        if (!eb)
-                return NULL;
-        btrfs_set_header_level(eb, old_root->level);
-        btrfs_set_header_generation(eb, old_generation);
         __tree_mod_log_rewind(eb, time_seq, tm);
+        extent_buffer_get(eb);
 
         return eb;
 }
@@ -1650,8 +1686,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
             BTRFS_NODEPTRS_PER_BLOCK(root) / 4)
                 return 0;
 
-        btrfs_header_nritems(mid);
-
         left = read_node_slot(root, parent, pslot - 1);
         if (left) {
                 btrfs_tree_lock(left);
@@ -1681,7 +1715,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 wret = push_node_left(trans, root, left, mid, 1);
                 if (wret < 0)
                         ret = wret;
-                btrfs_header_nritems(mid);
         }
 
         /*
@@ -2615,9 +2648,7 @@ int btrfs_search_old_slot(struct btrfs_root *root, struct btrfs_key *key,
 
 again:
         b = get_old_root(root, time_seq);
-        extent_buffer_get(b);
         level = btrfs_header_level(b);
-        btrfs_tree_read_lock(b);
         p->locks[level] = BTRFS_READ_LOCK;
 
         while (b) {
@@ -5001,6 +5032,12 @@ next:
  */
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
 {
+        return btrfs_next_old_leaf(root, path, 0);
+}
+
+int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+                        u64 time_seq)
+{
         int slot;
         int level;
         struct extent_buffer *c;
@@ -5025,7 +5062,10 @@ again:
         path->keep_locks = 1;
         path->leave_spinning = 1;
 
-        ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
+        if (time_seq)
+                ret = btrfs_search_old_slot(root, &key, path, time_seq);
+        else
+                ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         path->keep_locks = 0;
 
         if (ret < 0)
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 0236d03c673..8b73b2d4deb 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -2753,6 +2753,8 @@ static inline int btrfs_insert_empty_item(struct btrfs_trans_handle *trans,
 }
 
 int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path);
+int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+                        u64 time_seq);
 static inline int btrfs_next_item(struct btrfs_root *root, struct btrfs_path *p)
 {
         ++p->slots[0];
diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
index c18d0442ae6..2399f408691 100644
--- a/fs/btrfs/delayed-inode.c
+++ b/fs/btrfs/delayed-inode.c
@@ -1879,3 +1879,21 @@ void btrfs_kill_all_delayed_nodes(struct btrfs_root *root)
                 }
         }
 }
+
+void btrfs_destroy_delayed_inodes(struct btrfs_root *root)
+{
+        struct btrfs_delayed_root *delayed_root;
+        struct btrfs_delayed_node *curr_node, *prev_node;
+
+        delayed_root = btrfs_get_delayed_root(root);
+
+        curr_node = btrfs_first_delayed_node(delayed_root);
+        while (curr_node) {
+                __btrfs_kill_delayed_node(curr_node);
+
+                prev_node = curr_node;
+                curr_node = btrfs_next_delayed_node(curr_node);
+                btrfs_release_delayed_node(prev_node);
+        }
+}
+
diff --git a/fs/btrfs/delayed-inode.h b/fs/btrfs/delayed-inode.h
index 7083d08b2a2..f5aa4023d3e 100644
--- a/fs/btrfs/delayed-inode.h
+++ b/fs/btrfs/delayed-inode.h
@@ -124,6 +124,9 @@ int btrfs_fill_inode(struct inode *inode, u32 *rdev);
 /* Used for drop dead root */
 void btrfs_kill_all_delayed_nodes(struct btrfs_root *root);
 
+/* Used for clean the transaction */
+void btrfs_destroy_delayed_inodes(struct btrfs_root *root);
+
 /* Used for readdir() */
 void btrfs_get_delayed_items(struct inode *inode, struct list_head *ins_list,
                              struct list_head *del_list);
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 7ae51decf6d..e1890b1d307 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -44,6 +44,7 @@
 #include "free-space-cache.h"
 #include "inode-map.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 static struct extent_io_ops btree_extent_io_ops;
 static void end_workqueue_fn(struct btrfs_work *work);
@@ -2118,7 +2119,7 @@ int open_ctree(struct super_block *sb,
 
         features = btrfs_super_incompat_flags(disk_super);
         features |= BTRFS_FEATURE_INCOMPAT_MIXED_BACKREF;
-        if (tree_root->fs_info->compress_type & BTRFS_COMPRESS_LZO)
+        if (tree_root->fs_info->compress_type == BTRFS_COMPRESS_LZO)
                 features |= BTRFS_FEATURE_INCOMPAT_COMPRESS_LZO;
 
         /*
@@ -2575,8 +2576,9 @@ static void btrfs_end_buffer_write_sync(struct buffer_head *bh, int uptodate)
                 struct btrfs_device *device = (struct btrfs_device *)
                         bh->b_private;
 
-                printk_ratelimited(KERN_WARNING "lost page write due to "
-                                   "I/O error on %s\n", device->name);
+                printk_ratelimited_in_rcu(KERN_WARNING "lost page write due to "
+                                          "I/O error on %s\n",
+                                          rcu_str_deref(device->name));
                 /* note, we dont' set_buffer_write_io_error because we have
                  * our own ways of dealing with the IO errors
                  */
@@ -2749,8 +2751,8 @@ static int write_dev_flush(struct btrfs_device *device, int wait)
                 wait_for_completion(&device->flush_wait);
 
                 if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
-                        printk("btrfs: disabling barriers on dev %s\n",
-                               device->name);
+                        printk_in_rcu("btrfs: disabling barriers on dev %s\n",
+                                      rcu_str_deref(device->name));
                         device->nobarriers = 1;
                 }
                 if (!bio_flagged(bio, BIO_UPTODATE)) {
@@ -3400,7 +3402,6 @@ int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
 
         delayed_refs = &trans->delayed_refs;
 
-again:
         spin_lock(&delayed_refs->lock);
         if (delayed_refs->num_entries == 0) {
                 spin_unlock(&delayed_refs->lock);
@@ -3408,31 +3409,36 @@ again:
                 return ret;
         }
 
-        node = rb_first(&delayed_refs->root);
-        while (node) {
+        while ((node = rb_first(&delayed_refs->root)) != NULL) {
                 ref = rb_entry(node, struct btrfs_delayed_ref_node, rb_node);
-                node = rb_next(node);
-
-                ref->in_tree = 0;
-                rb_erase(&ref->rb_node, &delayed_refs->root);
-                delayed_refs->num_entries--;
 
                 atomic_set(&ref->refs, 1);
                 if (btrfs_delayed_ref_is_head(ref)) {
                         struct btrfs_delayed_ref_head *head;
 
                         head = btrfs_delayed_node_to_head(ref);
-                        spin_unlock(&delayed_refs->lock);
-                        mutex_lock(&head->mutex);
+                        if (!mutex_trylock(&head->mutex)) {
+                                atomic_inc(&ref->refs);
+                                spin_unlock(&delayed_refs->lock);
+
+                                /* Need to wait for the delayed ref to run */
+                                mutex_lock(&head->mutex);
+                                mutex_unlock(&head->mutex);
+                                btrfs_put_delayed_ref(ref);
+
+                                continue;
+                        }
+
                         kfree(head->extent_op);
                         delayed_refs->num_heads--;
                         if (list_empty(&head->cluster))
                                 delayed_refs->num_heads_ready--;
                         list_del_init(&head->cluster);
-                        mutex_unlock(&head->mutex);
-                        btrfs_put_delayed_ref(ref);
-                        goto again;
                 }
+                ref->in_tree = 0;
+                rb_erase(&ref->rb_node, &delayed_refs->root);
+                delayed_refs->num_entries--;
+
                 spin_unlock(&delayed_refs->lock);
                 btrfs_put_delayed_ref(ref);
 
@@ -3520,11 +3526,9 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
                              &(&BTRFS_I(page->mapping->host)->io_tree)->buffer,
                                                offset >> PAGE_CACHE_SHIFT);
                         spin_unlock(&dirty_pages->buffer_lock);
-                        if (eb) {
+                        if (eb)
                                 ret = test_and_clear_bit(EXTENT_BUFFER_DIRTY,
                                                          &eb->bflags);
-                                atomic_set(&eb->refs, 1);
-                        }
                         if (PageWriteback(page))
                                 end_page_writeback(page);
 
@@ -3538,8 +3542,8 @@ static int btrfs_destroy_marked_extents(struct btrfs_root *root,
                                 spin_unlock_irq(&page->mapping->tree_lock);
                         }
 
-                        page->mapping->a_ops->invalidatepage(page, 0);
                         unlock_page(page);
+                        page_cache_release(page);
                 }
         }
 
@@ -3553,8 +3557,10 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
         u64 start;
         u64 end;
         int ret;
+        bool loop = true;
 
         unpin = pinned_extents;
+again:
         while (1) {
                 ret = find_first_extent_bit(unpin, 0, &start, &end,
                                             EXTENT_DIRTY);
@@ -3572,6 +3578,15 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
                 cond_resched();
         }
 
+        if (loop) {
+                if (unpin == &root->fs_info->freed_extents[0])
+                        unpin = &root->fs_info->freed_extents[1];
+                else
+                        unpin = &root->fs_info->freed_extents[0];
+                loop = false;
+                goto again;
+        }
+
         return 0;
 }
 
@@ -3585,21 +3600,23 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
         /* FIXME: cleanup wait for commit */
         cur_trans->in_commit = 1;
         cur_trans->blocked = 1;
-        if (waitqueue_active(&root->fs_info->transaction_blocked_wait))
-                wake_up(&root->fs_info->transaction_blocked_wait);
+        wake_up(&root->fs_info->transaction_blocked_wait);
 
         cur_trans->blocked = 0;
-        if (waitqueue_active(&root->fs_info->transaction_wait))
-                wake_up(&root->fs_info->transaction_wait);
+        wake_up(&root->fs_info->transaction_wait);
 
         cur_trans->commit_done = 1;
-        if (waitqueue_active(&cur_trans->commit_wait))
-                wake_up(&cur_trans->commit_wait);
+        wake_up(&cur_trans->commit_wait);
+
+        btrfs_destroy_delayed_inodes(root);
+        btrfs_assert_delayed_root_empty(root);
 
         btrfs_destroy_pending_snapshots(cur_trans);
 
         btrfs_destroy_marked_extents(root, &cur_trans->dirty_pages,
                                      EXTENT_DIRTY);
+        btrfs_destroy_pinned_extent(root,
+                                    root->fs_info->pinned_extents);
 
         /*
         memset(cur_trans, 0, sizeof(*cur_trans));
@@ -3648,6 +3665,9 @@ int btrfs_cleanup_transaction(struct btrfs_root *root)
                 if (waitqueue_active(&t->commit_wait))
                         wake_up(&t->commit_wait);
 
+                btrfs_destroy_delayed_inodes(root);
+                btrfs_assert_delayed_root_empty(root);
+
                 btrfs_destroy_pending_snapshots(t);
 
                 btrfs_destroy_delalloc_inodes(root);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 2c8f7b20461..aaa12c1eb34 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -20,6 +20,7 @@
 #include "volumes.h"
 #include "check-integrity.h"
 #include "locking.h"
+#include "rcu-string.h"
 
 static struct kmem_cache *extent_state_cache;
 static struct kmem_cache *extent_buffer_cache;
@@ -1917,9 +1918,9 @@ int repair_io_failure(struct btrfs_mapping_tree *map_tree, u64 start,
                 return -EIO;
         }
 
-        printk(KERN_INFO "btrfs read error corrected: ino %lu off %llu (dev %s "
-                        "sector %llu)\n", page->mapping->host->i_ino, start,
-                        dev->name, sector);
+        printk_in_rcu(KERN_INFO "btrfs read error corrected: ino %lu off %llu "
+                      "(dev %s sector %llu)\n", page->mapping->host->i_ino,
+                      start, rcu_str_deref(dev->name), sector);
 
         bio_put(bio);
         return 0;
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index f6ab6f5e635..a4f02501da4 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -830,7 +830,7 @@ static noinline int cow_file_range(struct inode *inode,
         if (IS_ERR(trans)) {
                 extent_clear_unlock_delalloc(inode,
                              &BTRFS_I(inode)->io_tree,
-                             start, end, NULL,
+                             start, end, locked_page,
                              EXTENT_CLEAR_UNLOCK_PAGE |
                              EXTENT_CLEAR_UNLOCK |
                              EXTENT_CLEAR_DELALLOC |
@@ -963,7 +963,7 @@ out:
 out_unlock:
         extent_clear_unlock_delalloc(inode,
                      &BTRFS_I(inode)->io_tree,
-                     start, end, NULL,
+                     start, end, locked_page,
                      EXTENT_CLEAR_UNLOCK_PAGE |
                      EXTENT_CLEAR_UNLOCK |
                      EXTENT_CLEAR_DELALLOC |
@@ -986,8 +986,10 @@ static noinline void async_cow_start(struct btrfs_work *work)
         compress_file_range(async_cow->inode, async_cow->locked_page,
                             async_cow->start, async_cow->end, async_cow,
                             &num_added);
-        if (num_added == 0)
+        if (num_added == 0) {
+                iput(async_cow->inode);
                 async_cow->inode = NULL;
+        }
 }
 
 /*
@@ -1020,6 +1022,8 @@ static noinline void async_cow_free(struct btrfs_work *work)
 {
         struct async_cow *async_cow;
         async_cow = container_of(work, struct async_cow, work);
+        if (async_cow->inode)
+                iput(async_cow->inode);
         kfree(async_cow);
 }
 
@@ -1038,7 +1042,7 @@ static int cow_file_range_async(struct inode *inode, struct page *locked_page,
         while (start < end) {
                 async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
                 BUG_ON(!async_cow); /* -ENOMEM */
-                async_cow->inode = inode;
+                async_cow->inode = igrab(inode);
                 async_cow->root = root;
                 async_cow->locked_page = locked_page;
                 async_cow->start = start;
@@ -1136,8 +1140,18 @@ static noinline int run_delalloc_nocow(struct inode *inode,
         u64 ino = btrfs_ino(inode);
 
         path = btrfs_alloc_path();
-        if (!path)
+        if (!path) {
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
                 return -ENOMEM;
+        }
 
         nolock = btrfs_is_free_space_inode(root, inode);
 
@@ -1147,6 +1161,15 @@ static noinline int run_delalloc_nocow(struct inode *inode,
                 trans = btrfs_join_transaction(root);
 
         if (IS_ERR(trans)) {
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             start, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
                 btrfs_free_path(path);
                 return PTR_ERR(trans);
         }
@@ -1327,8 +1350,11 @@ out_check:
         }
         btrfs_release_path(path);
 
-        if (cur_offset <= end && cow_start == (u64)-1)
+        if (cur_offset <= end && cow_start == (u64)-1) {
                 cow_start = cur_offset;
+                cur_offset = end;
+        }
+
         if (cow_start != (u64)-1) {
                 ret = cow_file_range(inode, locked_page, cow_start, end,
                                      page_started, nr_written, 1);
@@ -1347,6 +1373,17 @@ error:
         if (!ret)
                 ret = err;
 
+        if (ret && cur_offset < end)
+                extent_clear_unlock_delalloc(inode,
+                             &BTRFS_I(inode)->io_tree,
+                             cur_offset, end, locked_page,
+                             EXTENT_CLEAR_UNLOCK_PAGE |
+                             EXTENT_CLEAR_UNLOCK |
+                             EXTENT_CLEAR_DELALLOC |
+                             EXTENT_CLEAR_DIRTY |
+                             EXTENT_SET_WRITEBACK |
+                             EXTENT_END_WRITEBACK);
+
         btrfs_free_path(path);
         return ret;
 }
@@ -1361,20 +1398,23 @@ static int run_delalloc_range(struct inode *inode, struct page *locked_page,
         int ret;
         struct btrfs_root *root = BTRFS_I(inode)->root;
 
-        if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW)
+        if (BTRFS_I(inode)->flags & BTRFS_INODE_NODATACOW) {
                 ret = run_delalloc_nocow(inode, locked_page, start, end,
                                          page_started, 1, nr_written);
-        else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC)
+        } else if (BTRFS_I(inode)->flags & BTRFS_INODE_PREALLOC) {
                 ret = run_delalloc_nocow(inode, locked_page, start, end,
                                          page_started, 0, nr_written);
-        else if (!btrfs_test_opt(root, COMPRESS) &&
-                 !(BTRFS_I(inode)->force_compress) &&
-                 !(BTRFS_I(inode)->flags & BTRFS_INODE_COMPRESS))
+        } else if (!btrfs_test_opt(root, COMPRESS) &&
+                   !(BTRFS_I(inode)->force_compress) &&
+                   !(BTRFS_I(inode)->flags & BTRFS_INODE_COMPRESS)) {
                 ret = cow_file_range(inode, locked_page, start, end,
                                       page_started, nr_written, 1);
-        else
+        } else {
+                set_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
+                        &BTRFS_I(inode)->runtime_flags);
                 ret = cow_file_range_async(inode, locked_page, start, end,
                                            page_started, nr_written);
+        }
         return ret;
 }
 
@@ -7054,10 +7094,13 @@ static void fixup_inode_flags(struct inode *dir, struct inode *inode)
         else
                 b_inode->flags &= ~BTRFS_INODE_NODATACOW;
 
-        if (b_dir->flags & BTRFS_INODE_COMPRESS)
+        if (b_dir->flags & BTRFS_INODE_COMPRESS) {
                 b_inode->flags |= BTRFS_INODE_COMPRESS;
-        else
-                b_inode->flags &= ~BTRFS_INODE_COMPRESS;
+                b_inode->flags &= ~BTRFS_INODE_NOCOMPRESS;
+        } else {
+                b_inode->flags &= ~(BTRFS_INODE_COMPRESS |
+                                    BTRFS_INODE_NOCOMPRESS);
+        }
 }
 
 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 24b776c08d9..0e92e576300 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -52,6 +52,7 @@
 #include "locking.h"
 #include "inode-map.h"
 #include "backref.h"
+#include "rcu-string.h"
 
 /* Mask out flags that are inappropriate for the given type of inode. */
 static inline __u32 btrfs_mask_flags(umode_t mode, __u32 flags)
@@ -785,39 +786,57 @@ none:
         return -ENOENT;
 }
 
-/*
- * Validaty check of prev em and next em:
- * 1) no prev/next em
- * 2) prev/next em is an hole/inline extent
- */
-static int check_adjacent_extents(struct inode *inode, struct extent_map *em)
+static struct extent_map *defrag_lookup_extent(struct inode *inode, u64 start)
 {
         struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
-        struct extent_map *prev = NULL, *next = NULL;
-        int ret = 0;
+        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
+        struct extent_map *em;
+        u64 len = PAGE_CACHE_SIZE;
 
+        /*
+         * hopefully we have this extent in the tree already, try without
+         * the full extent lock
+         */
         read_lock(&em_tree->lock);
-        prev = lookup_extent_mapping(em_tree, em->start - 1, (u64)-1);
-        next = lookup_extent_mapping(em_tree, em->start + em->len, (u64)-1);
+        em = lookup_extent_mapping(em_tree, start, len);
         read_unlock(&em_tree->lock);
 
-        if ((!prev || prev->block_start >= EXTENT_MAP_LAST_BYTE) &&
-            (!next || next->block_start >= EXTENT_MAP_LAST_BYTE))
-                ret = 1;
-        free_extent_map(prev);
-        free_extent_map(next);
+        if (!em) {
+                /* get the big lock and read metadata off disk */
+                lock_extent(io_tree, start, start + len - 1);
+                em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
+                unlock_extent(io_tree, start, start + len - 1);
+
+                if (IS_ERR(em))
+                        return NULL;
+        }
+
+        return em;
+}
+
+static bool defrag_check_next_extent(struct inode *inode, struct extent_map *em)
+{
+        struct extent_map *next;
+        bool ret = true;
 
+        /* this is the last extent */
+        if (em->start + em->len >= i_size_read(inode))
+                return false;
+
+        next = defrag_lookup_extent(inode, em->start + em->len);
+        if (!next || next->block_start >= EXTENT_MAP_LAST_BYTE)
+                ret = false;
+
+        free_extent_map(next);
         return ret;
 }
 
-static int should_defrag_range(struct inode *inode, u64 start, u64 len,
-                               int thresh, u64 *last_len, u64 *skip,
-                               u64 *defrag_end)
+static int should_defrag_range(struct inode *inode, u64 start, int thresh,
+                               u64 *last_len, u64 *skip, u64 *defrag_end)
 {
-        struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
-        struct extent_map *em = NULL;
-        struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
+        struct extent_map *em;
         int ret = 1;
+        bool next_mergeable = true;
 
         /*
          * make sure that once we start defragging an extent, we keep on
@@ -828,23 +847,9 @@ static int should_defrag_range(struct inode *inode, u64 start, u64 len,
 
         *skip = 0;
 
-        /*
-         * hopefully we have this extent in the tree already, try without
-         * the full extent lock
-         */
-        read_lock(&em_tree->lock);
-        em = lookup_extent_mapping(em_tree, start, len);
-        read_unlock(&em_tree->lock);
-
-        if (!em) {
-                /* get the big lock and read metadata off disk */
-                lock_extent(io_tree, start, start + len - 1);
-                em = btrfs_get_extent(inode, NULL, 0, start, len, 0);
-                unlock_extent(io_tree, start, start + len - 1);
-
-                if (IS_ERR(em))
-                        return 0;
-        }
+        em = defrag_lookup_extent(inode, start);
+        if (!em)
+                return 0;
 
         /* this will cover holes, and inline extents */
         if (em->block_start >= EXTENT_MAP_LAST_BYTE) {
@@ -852,18 +857,15 @@ static int should_defrag_range(struct inode *inode, u64 start, u64 len,
                 goto out;
         }
 
-        /* If we have nothing to merge with us, just skip. */
-        if (check_adjacent_extents(inode, em)) {
-                ret = 0;
-                goto out;
-        }
+        next_mergeable = defrag_check_next_extent(inode, em);
 
         /*
-         * we hit a real extent, if it is big don't bother defragging it again
+         * we hit a real extent, if it is big or the next extent is not a
+         * real extent, don't bother defragging it
          */
-        if ((*last_len == 0 || *last_len >= thresh) && em->len >= thresh)
+        if ((*last_len == 0 || *last_len >= thresh) &&
+            (em->len >= thresh || !next_mergeable))
                 ret = 0;
-
 out:
         /*
          * last_len ends up being a counter of how many bytes we've defragged.
@@ -1142,8 +1144,8 @@ int btrfs_defrag_file(struct inode *inode, struct file *file,
                         break;
 
                 if (!should_defrag_range(inode, (u64)i << PAGE_CACHE_SHIFT,
-                                         PAGE_CACHE_SIZE, extent_thresh,
-                                         &last_len, &skip, &defrag_end)) {
+                                         extent_thresh, &last_len, &skip,
+                                         &defrag_end)) {
                         unsigned long next;
                         /*
                          * the should_defrag function tells us how much to skip
@@ -1304,6 +1306,14 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
                 ret = -EINVAL;
                 goto out_free;
         }
+        if (device->fs_devices && device->fs_devices->seeding) {
+                printk(KERN_INFO "btrfs: resizer unable to apply on "
+                       "seeding device %llu\n",
+                       (unsigned long long)devid);
+                ret = -EINVAL;
+                goto out_free;
+        }
+
         if (!strcmp(sizestr, "max"))
                 new_size = device->bdev->bd_inode->i_size;
         else {
@@ -1345,8 +1355,9 @@ static noinline int btrfs_ioctl_resize(struct btrfs_root *root,
         do_div(new_size, root->sectorsize);
         new_size *= root->sectorsize;
 
-        printk(KERN_INFO "btrfs: new size for %s is %llu\n",
-                device->name, (unsigned long long)new_size);
+        printk_in_rcu(KERN_INFO "btrfs: new size for %s is %llu\n",
+                      rcu_str_deref(device->name),
+                      (unsigned long long)new_size);
 
         if (new_size > old_size) {
                 trans = btrfs_start_transaction(root, 0);
@@ -2264,7 +2275,12 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg)
         di_args->total_bytes = dev->total_bytes;
         memcpy(di_args->uuid, dev->uuid, sizeof(di_args->uuid));
         if (dev->name) {
-                strncpy(di_args->path, dev->name, sizeof(di_args->path));
+                struct rcu_string *name;
+
+                rcu_read_lock();
+                name = rcu_dereference(dev->name);
+                strncpy(di_args->path, name->str, sizeof(di_args->path));
+                rcu_read_unlock();
                 di_args->path[sizeof(di_args->path) - 1] = 0;
         } else {
                 di_args->path[0] = '\0';
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index 9e138cdc36c..643335a4fe3 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -627,7 +627,27 @@ void btrfs_wait_ordered_range(struct inode *inode, u64 start, u64 len)
         /* start IO across the range first to instantiate any delalloc
          * extents
          */
-        filemap_write_and_wait_range(inode->i_mapping, start, orig_end);
+        filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
+
+        /*
+         * So with compression we will find and lock a dirty page and clear the
+         * first one as dirty, setup an async extent, and immediately return
+         * with the entire range locked but with nobody actually marked with
+         * writeback.  So we can't just filemap_write_and_wait_range() and
+         * expect it to work since it will just kick off a thread to do the
+         * actual work.  So we need to call filemap_fdatawrite_range _again_
+         * since it will wait on the page lock, which won't be unlocked until
+         * after the pages have been marked as writeback and so we're good to go
+         * from there.  We have to do this otherwise we'll miss the ordered
+         * extents and that results in badness.  Please Josef, do not think you
+         * know better and pull this out at some point in the future, it is
+         * right and you are wrong.
+         */
+        if (test_bit(BTRFS_INODE_HAS_ASYNC_EXTENT,
+                     &BTRFS_I(inode)->runtime_flags))
+                filemap_fdatawrite_range(inode->i_mapping, start, orig_end);
+
+        filemap_fdatawait_range(inode->i_mapping, start, orig_end);
 
         end = orig_end;
         found = 0;
diff --git a/fs/btrfs/rcu-string.h b/fs/btrfs/rcu-string.h
new file mode 100644
index 00000000000..9e111e4576d
--- /dev/null
+++ b/fs/btrfs/rcu-string.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Red Hat.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public
+ * License v2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public
+ * License along with this program; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 021110-1307, USA.
+ */
+
+struct rcu_string {
+        struct rcu_head rcu;
+        char str[0];
+};
+
+static inline struct rcu_string *rcu_string_strdup(const char *src, gfp_t mask)
+{
+        size_t len = strlen(src) + 1;
+        struct rcu_string *ret = kzalloc(sizeof(struct rcu_string) +
+                                         (len * sizeof(char)), mask);
+        if (!ret)
+                return ret;
+        strncpy(ret->str, src, len);
+        return ret;
+}
+
+static inline void rcu_string_free(struct rcu_string *str)
+{
+        if (str)
+                kfree_rcu(str, rcu);
+}
+
+#define printk_in_rcu(fmt, ...) do {    \
+        rcu_read_lock();                \
+        printk(fmt, __VA_ARGS__);       \
+        rcu_read_unlock();              \
+} while (0)
+
+#define printk_ratelimited_in_rcu(fmt, ...) do {        \
+        rcu_read_lock();                                \
+        printk_ratelimited(fmt, __VA_ARGS__);           \
+        rcu_read_unlock();                              \
+} while (0)
+
+#define rcu_str_deref(rcu_str) ({                               \
+        struct rcu_string *__str = rcu_dereference(rcu_str);    \
+        __str->str;                                             \
+})
diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index a38cfa4f251..b223620cd5a 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -26,6 +26,7 @@
 #include "backref.h"
 #include "extent_io.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 /*
  * This is only the first step towards a full-features scrub. It reads all
@@ -320,10 +321,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, void *ctx)
          * hold all of the paths here
          */
         for (i = 0; i < ipath->fspath->elem_cnt; ++i)
-                printk(KERN_WARNING "btrfs: %s at logical %llu on dev "
+                printk_in_rcu(KERN_WARNING "btrfs: %s at logical %llu on dev "
                         "%s, sector %llu, root %llu, inode %llu, offset %llu, "
                         "length %llu, links %u (path: %s)\n", swarn->errstr,
-                        swarn->logical, swarn->dev->name,
+                        swarn->logical, rcu_str_deref(swarn->dev->name),
                         (unsigned long long)swarn->sector, root, inum, offset,
                         min(isize - offset, (u64)PAGE_SIZE), nlink,
                         (char *)(unsigned long)ipath->fspath->val[i]);
@@ -332,10 +333,10 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, void *ctx)
         return 0;
 
 err:
-        printk(KERN_WARNING "btrfs: %s at logical %llu on dev "
+        printk_in_rcu(KERN_WARNING "btrfs: %s at logical %llu on dev "
                 "%s, sector %llu, root %llu, inode %llu, offset %llu: path "
                 "resolving failed with ret=%d\n", swarn->errstr,
-                swarn->logical, swarn->dev->name,
+                swarn->logical, rcu_str_deref(swarn->dev->name),
                 (unsigned long long)swarn->sector, root, inum, offset, ret);
 
         free_ipath(ipath);
@@ -390,10 +391,11 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
                 do {
                         ret = tree_backref_for_extent(&ptr, eb, ei, item_size,
                                                         &ref_root, &ref_level);
-                        printk(KERN_WARNING
+                        printk_in_rcu(KERN_WARNING
                                 "btrfs: %s at logical %llu on dev %s, "
                                 "sector %llu: metadata %s (level %d) in tree "
-                                "%llu\n", errstr, swarn.logical, dev->name,
+                                "%llu\n", errstr, swarn.logical,
+                                rcu_str_deref(dev->name),
                                 (unsigned long long)swarn.sector,
                                 ref_level ? "node" : "leaf",
                                 ret < 0 ? -1 : ref_level,
@@ -580,9 +582,11 @@ out:
                 spin_lock(&sdev->stat_lock);
                 ++sdev->stat.uncorrectable_errors;
                 spin_unlock(&sdev->stat_lock);
-                printk_ratelimited(KERN_ERR
+
+                printk_ratelimited_in_rcu(KERN_ERR
                         "btrfs: unable to fixup (nodatasum) error at logical %llu on dev %s\n",
-                        (unsigned long long)fixup->logical, sdev->dev->name);
+                        (unsigned long long)fixup->logical,
+                        rcu_str_deref(sdev->dev->name));
         }
 
         btrfs_free_path(path);
@@ -936,18 +940,20 @@ corrected_error:
                         spin_lock(&sdev->stat_lock);
                         sdev->stat.corrected_errors++;
                         spin_unlock(&sdev->stat_lock);
-                        printk_ratelimited(KERN_ERR
+                        printk_ratelimited_in_rcu(KERN_ERR
                                 "btrfs: fixed up error at logical %llu on dev %s\n",
-                                (unsigned long long)logical, sdev->dev->name);
+                                (unsigned long long)logical,
+                                rcu_str_deref(sdev->dev->name));
                 }
         } else {
 did_not_correct_error:
                 spin_lock(&sdev->stat_lock);
                 sdev->stat.uncorrectable_errors++;
                 spin_unlock(&sdev->stat_lock);
-                printk_ratelimited(KERN_ERR
+                printk_ratelimited_in_rcu(KERN_ERR
                         "btrfs: unable to fixup (regular) error at logical %llu on dev %s\n",
-                        (unsigned long long)logical, sdev->dev->name);
+                        (unsigned long long)logical,
+                        rcu_str_deref(sdev->dev->name));
         }
 
 out:
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 96eb9fef7bd..0eb9a4da069 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -54,6 +54,7 @@
 #include "version.h"
 #include "export.h"
 #include "compression.h"
+#include "rcu-string.h"
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/btrfs.h>
@@ -1482,12 +1483,44 @@ static void btrfs_fs_dirty_inode(struct inode *inode, int flags)
                                    "error %d\n", btrfs_ino(inode), ret);
 }
 
+static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
+{
+        struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
+        struct btrfs_fs_devices *cur_devices;
+        struct btrfs_device *dev, *first_dev = NULL;
+        struct list_head *head;
+        struct rcu_string *name;
+
+        mutex_lock(&fs_info->fs_devices->device_list_mutex);
+        cur_devices = fs_info->fs_devices;
+        while (cur_devices) {
+                head = &cur_devices->devices;
+                list_for_each_entry(dev, head, dev_list) {
+                        if (!first_dev || dev->devid < first_dev->devid)
+                                first_dev = dev;
+                }
+                cur_devices = cur_devices->seed;
+        }
+
+        if (first_dev) {
+                rcu_read_lock();
+                name = rcu_dereference(first_dev->name);
+                seq_escape(m, name->str, " \t\n\\");
+                rcu_read_unlock();
+        } else {
+                WARN_ON(1);
+        }
+        mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+        return 0;
+}
+
 static const struct super_operations btrfs_super_ops = {
         .drop_inode     = btrfs_drop_inode,
         .evict_inode    = btrfs_evict_inode,
         .put_super      = btrfs_put_super,
         .sync_fs        = btrfs_sync_fs,
         .show_options   = btrfs_show_options,
+        .show_devname   = btrfs_show_devname,
         .write_inode    = btrfs_write_inode,
         .dirty_inode    = btrfs_fs_dirty_inode,
         .alloc_inode    = btrfs_alloc_inode,
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 1791c6e3d83..b72b068183e 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -100,6 +100,10 @@ loop:
                 kmem_cache_free(btrfs_transaction_cachep, cur_trans);
                 cur_trans = fs_info->running_transaction;
                 goto loop;
+        } else if (root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
+                spin_unlock(&root->fs_info->trans_lock);
+                kmem_cache_free(btrfs_transaction_cachep, cur_trans);
+                return -EROFS;
         }
 
         atomic_set(&cur_trans->num_writers, 1);
@@ -1213,14 +1217,20 @@ int btrfs_commit_transaction_async(struct btrfs_trans_handle *trans,
 
 
 static void cleanup_transaction(struct btrfs_trans_handle *trans,
-                                struct btrfs_root *root)
+                                struct btrfs_root *root, int err)
 {
         struct btrfs_transaction *cur_trans = trans->transaction;
 
         WARN_ON(trans->use_count > 1);
 
+        btrfs_abort_transaction(trans, root, err);
+
         spin_lock(&root->fs_info->trans_lock);
         list_del_init(&cur_trans->list);
+        if (cur_trans == root->fs_info->running_transaction) {
+                root->fs_info->running_transaction = NULL;
+                root->fs_info->trans_no_join = 0;
+        }
         spin_unlock(&root->fs_info->trans_lock);
 
         btrfs_cleanup_one_transaction(trans->transaction, root);
@@ -1526,7 +1536,7 @@ cleanup_transaction:
 //      WARN_ON(1);
         if (current->journal_info == trans)
                 current->journal_info = NULL;
-        cleanup_transaction(trans, root);
+        cleanup_transaction(trans, root, ret);
 
         return ret;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 7782020996f..8a3d2594b80 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -35,6 +35,7 @@
 #include "volumes.h"
 #include "async-thread.h"
 #include "check-integrity.h"
+#include "rcu-string.h"
 
 static int init_first_rw_device(struct btrfs_trans_handle *trans,
                                 struct btrfs_root *root,
@@ -64,7 +65,7 @@ static void free_fs_devices(struct btrfs_fs_devices *fs_devices)
                 device = list_entry(fs_devices->devices.next,
                                     struct btrfs_device, dev_list);
                 list_del(&device->dev_list);
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
         }
         kfree(fs_devices);
@@ -334,8 +335,8 @@ static noinline int device_list_add(const char *path,
 {
         struct btrfs_device *device;
         struct btrfs_fs_devices *fs_devices;
+        struct rcu_string *name;
         u64 found_transid = btrfs_super_generation(disk_super);
-        char *name;
 
         fs_devices = find_fsid(disk_super->fsid);
         if (!fs_devices) {
@@ -369,11 +370,13 @@ static noinline int device_list_add(const char *path,
                 memcpy(device->uuid, disk_super->dev_item.uuid,
                        BTRFS_UUID_SIZE);
                 spin_lock_init(&device->io_lock);
-                device->name = kstrdup(path, GFP_NOFS);
-                if (!device->name) {
+
+                name = rcu_string_strdup(path, GFP_NOFS);
+                if (!name) {
                         kfree(device);
                         return -ENOMEM;
                 }
+                rcu_assign_pointer(device->name, name);
                 INIT_LIST_HEAD(&device->dev_alloc_list);
 
                 /* init readahead state */
@@ -390,12 +393,12 @@ static noinline int device_list_add(const char *path,
 
                 device->fs_devices = fs_devices;
                 fs_devices->num_devices++;
-        } else if (!device->name || strcmp(device->name, path)) {
-                name = kstrdup(path, GFP_NOFS);
+        } else if (!device->name || strcmp(device->name->str, path)) {
+                name = rcu_string_strdup(path, GFP_NOFS);
                 if (!name)
                         return -ENOMEM;
-                kfree(device->name);
-                device->name = name;
+                rcu_string_free(device->name);
+                rcu_assign_pointer(device->name, name);
                 if (device->missing) {
                         fs_devices->missing_devices--;
                         device->missing = 0;
@@ -430,15 +433,22 @@ static struct btrfs_fs_devices *clone_fs_devices(struct btrfs_fs_devices *orig)
 
         /* We have held the volume lock, it is safe to get the devices. */
         list_for_each_entry(orig_dev, &orig->devices, dev_list) {
+                struct rcu_string *name;
+
                 device = kzalloc(sizeof(*device), GFP_NOFS);
                 if (!device)
                         goto error;
 
-                device->name = kstrdup(orig_dev->name, GFP_NOFS);
-                if (!device->name) {
+                /*
+                 * This is ok to do without rcu read locked because we hold the
+                 * uuid mutex so nothing we touch in here is going to disappear.
+                 */
+                name = rcu_string_strdup(orig_dev->name->str, GFP_NOFS);
+                if (!name) {
                         kfree(device);
                         goto error;
                 }
+                rcu_assign_pointer(device->name, name);
 
                 device->devid = orig_dev->devid;
                 device->work.func = pending_bios_fn;
@@ -491,7 +501,7 @@ again:
                 }
                 list_del_init(&device->dev_list);
                 fs_devices->num_devices--;
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
         }
 
@@ -516,7 +526,7 @@ static void __free_device(struct work_struct *work)
         if (device->bdev)
                 blkdev_put(device->bdev, device->mode);
 
-        kfree(device->name);
+        rcu_string_free(device->name);
         kfree(device);
 }
 
@@ -540,6 +550,7 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
         mutex_lock(&fs_devices->device_list_mutex);
         list_for_each_entry(device, &fs_devices->devices, dev_list) {
                 struct btrfs_device *new_device;
+                struct rcu_string *name;
 
                 if (device->bdev)
                         fs_devices->open_devices--;
@@ -555,8 +566,11 @@ static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
                 new_device = kmalloc(sizeof(*new_device), GFP_NOFS);
                 BUG_ON(!new_device); /* -ENOMEM */
                 memcpy(new_device, device, sizeof(*new_device));
-                new_device->name = kstrdup(device->name, GFP_NOFS);
-                BUG_ON(device->name && !new_device->name); /* -ENOMEM */
+
+                /* Safe because we are under uuid_mutex */
+                name = rcu_string_strdup(device->name->str, GFP_NOFS);
+                BUG_ON(device->name && !name); /* -ENOMEM */
+                rcu_assign_pointer(new_device->name, name);
                 new_device->bdev = NULL;
                 new_device->writeable = 0;
                 new_device->in_fs_metadata = 0;
@@ -621,9 +635,9 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
                 if (!device->name)
                         continue;
 
-                bdev = blkdev_get_by_path(device->name, flags, holder);
+                bdev = blkdev_get_by_path(device->name->str, flags, holder);
                 if (IS_ERR(bdev)) {
-                        printk(KERN_INFO "open %s failed\n", device->name);
+                        printk(KERN_INFO "open %s failed\n", device->name->str);
                         goto error;
                 }
                 filemap_write_and_wait(bdev->bd_inode->i_mapping);
@@ -1632,6 +1646,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         struct block_device *bdev;
         struct list_head *devices;
         struct super_block *sb = root->fs_info->sb;
+        struct rcu_string *name;
         u64 total_bytes;
         int seeding_dev = 0;
         int ret = 0;
@@ -1671,23 +1686,24 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
                 goto error;
         }
 
-        device->name = kstrdup(device_path, GFP_NOFS);
-        if (!device->name) {
+        name = rcu_string_strdup(device_path, GFP_NOFS);
+        if (!name) {
                 kfree(device);
                 ret = -ENOMEM;
                 goto error;
         }
+        rcu_assign_pointer(device->name, name);
 
         ret = find_next_devid(root, &device->devid);
         if (ret) {
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
                 goto error;
         }
 
         trans = btrfs_start_transaction(root, 0);
         if (IS_ERR(trans)) {
-                kfree(device->name);
+                rcu_string_free(device->name);
                 kfree(device);
                 ret = PTR_ERR(trans);
                 goto error;
@@ -1796,7 +1812,7 @@ error_trans:
         unlock_chunks(root);
         btrfs_abort_transaction(trans, root, ret);
         btrfs_end_transaction(trans, root);
-        kfree(device->name);
+        rcu_string_free(device->name);
         kfree(device);
 error:
         blkdev_put(bdev, FMODE_EXCL);
@@ -4204,10 +4220,17 @@ int btrfs_map_bio(struct btrfs_root *root, int rw, struct bio *bio,
                 bio->bi_sector = bbio->stripes[dev_nr].physical >> 9;
                 dev = bbio->stripes[dev_nr].dev;
                 if (dev && dev->bdev && (rw != WRITE || dev->writeable)) {
+#ifdef DEBUG
+                        struct rcu_string *name;
+
+                        rcu_read_lock();
+                        name = rcu_dereference(dev->name);
                         pr_debug("btrfs_map_bio: rw %d, secor=%llu, dev=%lu "
                                  "(%s id %llu), size=%u\n", rw,
                                  (u64)bio->bi_sector, (u_long)dev->bdev->bd_dev,
-                                 dev->name, dev->devid, bio->bi_size);
+                                 name->str, dev->devid, bio->bi_size);
+                        rcu_read_unlock();
+#endif
                         bio->bi_bdev = dev->bdev;
                         if (async_submit)
                                 schedule_bio(root, dev, rw, bio);
@@ -4694,8 +4717,9 @@ int btrfs_init_dev_stats(struct btrfs_fs_info *fs_info)
                 key.offset = device->devid;
                 ret = btrfs_search_slot(NULL, dev_root, &key, path, 0, 0);
                 if (ret) {
-                        printk(KERN_WARNING "btrfs: no dev_stats entry found for device %s (devid %llu) (OK on first mount after mkfs)\n",
-                               device->name, (unsigned long long)device->devid);
+                        printk_in_rcu(KERN_WARNING "btrfs: no dev_stats entry found for device %s (devid %llu) (OK on first mount after mkfs)\n",
+                                      rcu_str_deref(device->name),
+                                      (unsigned long long)device->devid);
                         __btrfs_reset_dev_stats(device);
                         device->dev_stats_valid = 1;
                         btrfs_release_path(path);
@@ -4747,8 +4771,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
         BUG_ON(!path);
         ret = btrfs_search_slot(trans, dev_root, &key, path, -1, 1);
         if (ret < 0) {
-                printk(KERN_WARNING "btrfs: error %d while searching for dev_stats item for device %s!\n",
-                       ret, device->name);
+                printk_in_rcu(KERN_WARNING "btrfs: error %d while searching for dev_stats item for device %s!\n",
+                              ret, rcu_str_deref(device->name));
                 goto out;
         }
 
@@ -4757,8 +4781,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
                 /* need to delete old one and insert a new one */
                 ret = btrfs_del_item(trans, dev_root, path);
                 if (ret != 0) {
-                        printk(KERN_WARNING "btrfs: delete too small dev_stats item for device %s failed %d!\n",
-                               device->name, ret);
+                        printk_in_rcu(KERN_WARNING "btrfs: delete too small dev_stats item for device %s failed %d!\n",
+                                      rcu_str_deref(device->name), ret);
                         goto out;
                 }
                 ret = 1;
@@ -4770,8 +4794,8 @@ static int update_dev_stat_item(struct btrfs_trans_handle *trans,
                 ret = btrfs_insert_empty_item(trans, dev_root, path,
                                               &key, sizeof(*ptr));
                 if (ret < 0) {
-                        printk(KERN_WARNING "btrfs: insert dev_stats item for device %s failed %d!\n",
-                               device->name, ret);
+                        printk_in_rcu(KERN_WARNING "btrfs: insert dev_stats item for device %s failed %d!\n",
+                                      rcu_str_deref(device->name), ret);
                         goto out;
                 }
         }
@@ -4823,9 +4847,9 @@ void btrfs_dev_stat_print_on_error(struct btrfs_device *dev)
 {
         if (!dev->dev_stats_valid)
                 return;
-        printk_ratelimited(KERN_ERR
+        printk_ratelimited_in_rcu(KERN_ERR
                            "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
-                           dev->name,
+                           rcu_str_deref(dev->name),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_WRITE_ERRS),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_READ_ERRS),
                            btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_FLUSH_ERRS),
@@ -4837,8 +4861,8 @@ void btrfs_dev_stat_print_on_error(struct btrfs_device *dev)
 
 static void btrfs_dev_stat_print_on_load(struct btrfs_device *dev)
 {
-        printk(KERN_INFO "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
-               dev->name,
+        printk_in_rcu(KERN_INFO "btrfs: bdev %s errs: wr %u, rd %u, flush %u, corrupt %u, gen %u\n",
+               rcu_str_deref(dev->name),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_WRITE_ERRS),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_READ_ERRS),
                btrfs_dev_stat_read(dev, BTRFS_DEV_STAT_FLUSH_ERRS),
diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
index 3406a88ca83..74366f27a76 100644
--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
@@ -58,7 +58,7 @@ struct btrfs_device {
         /* the mode sent to blkdev_get */
         fmode_t mode;
 
-        char *name;
+        struct rcu_string *name;
 
         /* the internal btrfs device id */
         u64 devid;
diff --git a/fs/dcache.c b/fs/dcache.c
index 85c9e2bff8e..40469044088 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -683,6 +683,8 @@ EXPORT_SYMBOL(dget_parent);
 /**
  * d_find_alias - grab a hashed alias of inode
  * @inode: inode in question
+ * @want_discon:  flag, used by d_splice_alias, to request
+ *          that only a DISCONNECTED alias be returned.
  *
  * If inode has a hashed alias, or is a directory and has any alias,
  * acquire the reference to alias and return it. Otherwise return NULL.
@@ -691,9 +693,10 @@ EXPORT_SYMBOL(dget_parent);
  * of a filesystem.
  *
  * If the inode has an IS_ROOT, DCACHE_DISCONNECTED alias, then prefer
- * any other hashed alias over that.
+ * any other hashed alias over that one unless @want_discon is set,
+ * in which case only return an IS_ROOT, DCACHE_DISCONNECTED alias.
  */
-static struct dentry *__d_find_alias(struct inode *inode)
+static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
 {
         struct dentry *alias, *discon_alias;
 
@@ -705,7 +708,7 @@ again:
                         if (IS_ROOT(alias) &&
                             (alias->d_flags & DCACHE_DISCONNECTED)) {
                                 discon_alias = alias;
-                        } else {
+                        } else if (!want_discon) {
                                 __dget_dlock(alias);
                                 spin_unlock(&alias->d_lock);
                                 return alias;
@@ -736,7 +739,7 @@ struct dentry *d_find_alias(struct inode *inode)
 
         if (!list_empty(&inode->i_dentry)) {
                 spin_lock(&inode->i_lock);
-                de = __d_find_alias(inode);
+                de = __d_find_alias(inode, 0);
                 spin_unlock(&inode->i_lock);
         }
         return de;
@@ -1647,8 +1650,9 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
 
         if (inode && S_ISDIR(inode->i_mode)) {
                 spin_lock(&inode->i_lock);
-                new = __d_find_any_alias(inode);
+                new = __d_find_alias(inode, 1);
                 if (new) {
+                        BUG_ON(!(new->d_flags & DCACHE_DISCONNECTED));
                         spin_unlock(&inode->i_lock);
                         security_d_instantiate(new, inode);
                         d_move(new, dentry);
@@ -2478,7 +2482,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                 struct dentry *alias;
 
                 /* Does an aliased dentry already exist? */
-                alias = __d_find_alias(inode);
+                alias = __d_find_alias(inode, 0);
                 if (alias) {
                         actual = alias;
                         write_seqlock(&rename_lock);
diff --git a/fs/exofs/sys.c b/fs/exofs/sys.c
index e32bc919e4e..5a7b691e748 100644
--- a/fs/exofs/sys.c
+++ b/fs/exofs/sys.c
@@ -109,7 +109,7 @@ static struct kobj_type odev_ktype = {
 static struct kobj_type uuid_ktype = {
 };
 
-void exofs_sysfs_dbg_print()
+void exofs_sysfs_dbg_print(void)
 {
 #ifdef CONFIG_EXOFS_DEBUG
         struct kobject *k_name, *k_tmp;
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 99b6324290d..cee7812cc3c 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -90,8 +90,8 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
          * unusual file system layouts.
          */
         if (ext4_block_in_group(sb, ext4_block_bitmap(sb, gdp), block_group)) {
-                block_cluster = EXT4_B2C(sbi, (start -
-                                               ext4_block_bitmap(sb, gdp)));
+                block_cluster = EXT4_B2C(sbi,
+                                         ext4_block_bitmap(sb, gdp) - start);
                 if (block_cluster < num_clusters)
                         block_cluster = -1;
                 else if (block_cluster == num_clusters) {
@@ -102,7 +102,7 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
 
         if (ext4_block_in_group(sb, ext4_inode_bitmap(sb, gdp), block_group)) {
                 inode_cluster = EXT4_B2C(sbi,
-                                         start - ext4_inode_bitmap(sb, gdp));
+                                         ext4_inode_bitmap(sb, gdp) - start);
                 if (inode_cluster < num_clusters)
                         inode_cluster = -1;
                 else if (inode_cluster == num_clusters) {
@@ -114,7 +114,7 @@ unsigned ext4_num_overhead_clusters(struct super_block *sb,
         itbl_blk = ext4_inode_table(sb, gdp);
         for (i = 0; i < sbi->s_itb_per_group; i++) {
                 if (ext4_block_in_group(sb, itbl_blk + i, block_group)) {
-                        c = EXT4_B2C(sbi, start - itbl_blk + i);
+                        c = EXT4_B2C(sbi, itbl_blk + i - start);
                         if ((c < num_clusters) || (c == inode_cluster) ||
                             (c == block_cluster) || (c == itbl_cluster))
                                 continue;
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index 8ad112ae0ad..e34deac3f36 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -123,7 +123,6 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                         else
                                 ext4_clear_inode_flag(inode, i);
                 }
-                ei->i_flags = flags;
 
                 ext4_set_inode_flags(inode);
                 inode->i_ctime = ext4_current_time(inode);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 8d2fb8c88cf..41a3ccff18d 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -664,6 +664,7 @@ static long writeback_sb_inodes(struct super_block *sb,
                         /* Wait for I_SYNC. This function drops i_lock... */
                         inode_sleep_on_writeback(inode);
                         /* Inode may be gone, start again */
+                        spin_lock(&wb->list_lock);
                         continue;
                 }
                 inode->i_state |= I_SYNC;
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index 970659daa32..23ff18fe080 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -17,7 +17,6 @@
 #include <linux/kthread.h>
 #include <linux/sunrpc/svcauth_gss.h>
 #include <linux/sunrpc/bc_xprt.h>
-#include <linux/nsproxy.h>
 
 #include <net/inet_sock.h>
 
@@ -107,7 +106,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
 {
         int ret;
 
-        ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET,
+        ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret <= 0)
                 goto out_err;
@@ -115,7 +114,7 @@ nfs4_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
         dprintk("NFS: Callback listener port = %u (af %u)\n",
                         nfs_callback_tcpport, PF_INET);
 
-        ret = svc_create_xprt(serv, "tcp", xprt->xprt_net, PF_INET6,
+        ret = svc_create_xprt(serv, "tcp", &init_net, PF_INET6,
                                 nfs_callback_set_tcpport, SVC_SOCK_ANONYMOUS);
         if (ret > 0) {
                 nfs_callback_tcpport6 = ret;
@@ -184,7 +183,7 @@ nfs41_callback_up(struct svc_serv *serv, struct rpc_xprt *xprt)
          * fore channel connection.
          * Returns the input port (0) and sets the svc_serv bc_xprt on success
          */
-        ret = svc_create_xprt(serv, "tcp-bc", xprt->xprt_net, PF_INET, 0,
+        ret = svc_create_xprt(serv, "tcp-bc", &init_net, PF_INET, 0,
                               SVC_SOCK_ANONYMOUS);
         if (ret < 0) {
                 rqstp = ERR_PTR(ret);
@@ -254,7 +253,7 @@ int nfs_callback_up(u32 minorversion, struct rpc_xprt *xprt)
         char svc_name[12];
         int ret = 0;
         int minorversion_setup;
-        struct net *net = current->nsproxy->net_ns;
+        struct net *net = &init_net;
 
         mutex_lock(&nfs_callback_mutex);
         if (cb_info->users++ || cb_info->task != NULL) {
@@ -330,7 +329,7 @@ void nfs_callback_down(int minorversion)
         cb_info->users--;
         if (cb_info->users == 0 && cb_info->task != NULL) {
                 kthread_stop(cb_info->task);
-                svc_shutdown_net(cb_info->serv, current->nsproxy->net_ns);
+                svc_shutdown_net(cb_info->serv, &init_net);
                 svc_exit_thread(cb_info->rqst);
                 cb_info->serv = NULL;
                 cb_info->rqst = NULL;
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
index 95bfc243992..e64b01d2a33 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -455,9 +455,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
         args->csa_nrclists = ntohl(*p++);
         args->csa_rclists = NULL;
         if (args->csa_nrclists) {
-                args->csa_rclists = kmalloc(args->csa_nrclists *
-                                            sizeof(*args->csa_rclists),
-                                            GFP_KERNEL);
+                args->csa_rclists = kmalloc_array(args->csa_nrclists,
+                                                  sizeof(*args->csa_rclists),
+                                                  GFP_KERNEL);
                 if (unlikely(args->csa_rclists == NULL))
                         goto out;
 
@@ -696,7 +696,7 @@ static __be32 encode_cb_sequence_res(struct svc_rqst *rqstp,
                                        const struct cb_sequenceres *res)
 {
         __be32 *p;
-        unsigned status = res->csr_status;
+        __be32 status = res->csr_status;
 
         if (unlikely(status != 0))
                 goto out;
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 7d108753af8..17ba6b99565 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -544,8 +544,6 @@ nfs_found_client(const struct nfs_client_initdata *cl_init,
 
         smp_rmb();
 
-        BUG_ON(clp->cl_cons_state != NFS_CS_READY);
-
         dprintk("<-- %s found nfs_client %p for %s\n",
                 __func__, clp, cl_init->hostname ?: "");
         return clp;
diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
index ad2775d3e21..3168f6e3d4d 100644
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -523,9 +523,9 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)
                 nfs_list_remove_request(req);
                 if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES) {
                         /* Note the rewrite will go through mds */
-                        kref_get(&req->wb_kref);
                         nfs_mark_request_commit(req, NULL, &cinfo);
-                }
+                } else
+                        nfs_release_request(req);
                 nfs_unlock_and_release_request(req);
         }
 
@@ -716,12 +716,12 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr)
                         if (dreq->flags == NFS_ODIRECT_RESCHED_WRITES)
                                 bit = NFS_IOHDR_NEED_RESCHED;
                         else if (dreq->flags == 0) {
-                                memcpy(&dreq->verf, &req->wb_verf,
+                                memcpy(&dreq->verf, hdr->verf,
                                        sizeof(dreq->verf));
                                 bit = NFS_IOHDR_NEED_COMMIT;
                                 dreq->flags = NFS_ODIRECT_DO_COMMIT;
                         } else if (dreq->flags == NFS_ODIRECT_DO_COMMIT) {
-                                if (memcmp(&dreq->verf, &req->wb_verf, sizeof(dreq->verf))) {
+                                if (memcmp(&dreq->verf, hdr->verf, sizeof(dreq->verf))) {
                                         dreq->flags = NFS_ODIRECT_RESCHED_WRITES;
                                         bit = NFS_IOHDR_NEED_RESCHED;
                                 } else
diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h
index c6827f93ab5..cc5900ac61b 100644
--- a/fs/nfs/nfs4_fs.h
+++ b/fs/nfs/nfs4_fs.h
@@ -295,7 +295,7 @@ is_ds_client(struct nfs_client *clp)
 
 extern const struct nfs4_minor_version_ops *nfs_v4_minor_ops[];
 
-extern const u32 nfs4_fattr_bitmap[2];
+extern const u32 nfs4_fattr_bitmap[3];
 extern const u32 nfs4_statfs_bitmap[2];
 extern const u32 nfs4_pathconf_bitmap[2];
 extern const u32 nfs4_fsinfo_bitmap[3];
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index d48dbefa0e7..15fc7e4664e 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -105,6 +105,8 @@ static int nfs4_map_errors(int err)
                 return -EINVAL;
         case -NFS4ERR_SHARE_DENIED:
                 return -EACCES;
+        case -NFS4ERR_MINOR_VERS_MISMATCH:
+                return -EPROTONOSUPPORT;
         default:
                 dprintk("%s could not handle NFSv4 error %d\n",
                                 __func__, -err);
@@ -116,7 +118,7 @@ static int nfs4_map_errors(int err)
 /*
  * This is our standard bitmap for GETATTR requests.
  */
-const u32 nfs4_fattr_bitmap[2] = {
+const u32 nfs4_fattr_bitmap[3] = {
         FATTR4_WORD0_TYPE
         | FATTR4_WORD0_CHANGE
         | FATTR4_WORD0_SIZE
@@ -133,6 +135,24 @@ const u32 nfs4_fattr_bitmap[2] = {
         | FATTR4_WORD1_TIME_MODIFY
 };
 
+static const u32 nfs4_pnfs_open_bitmap[3] = {
+        FATTR4_WORD0_TYPE
+        | FATTR4_WORD0_CHANGE
+        | FATTR4_WORD0_SIZE
+        | FATTR4_WORD0_FSID
+        | FATTR4_WORD0_FILEID,
+        FATTR4_WORD1_MODE
+        | FATTR4_WORD1_NUMLINKS
+        | FATTR4_WORD1_OWNER
+        | FATTR4_WORD1_OWNER_GROUP
+        | FATTR4_WORD1_RAWDEV
+        | FATTR4_WORD1_SPACE_USED
+        | FATTR4_WORD1_TIME_ACCESS
+        | FATTR4_WORD1_TIME_METADATA
+        | FATTR4_WORD1_TIME_MODIFY,
+        FATTR4_WORD2_MDSTHRESHOLD
+};
+
 const u32 nfs4_statfs_bitmap[2] = {
         FATTR4_WORD0_FILES_AVAIL
         | FATTR4_WORD0_FILES_FREE
@@ -844,6 +864,7 @@ static struct nfs4_opendata *nfs4_opendata_alloc(struct dentry *dentry,
         p->o_arg.name = &dentry->d_name;
         p->o_arg.server = server;
         p->o_arg.bitmask = server->attr_bitmask;
+        p->o_arg.open_bitmap = &nfs4_fattr_bitmap[0];
         p->o_arg.claim = NFS4_OPEN_CLAIM_NULL;
         if (attrs != NULL && attrs->ia_valid != 0) {
                 __be32 verf[2];
@@ -1820,6 +1841,7 @@ static int _nfs4_do_open(struct inode *dir,
                 opendata->f_attr.mdsthreshold = pnfs_mdsthreshold_alloc();
                 if (!opendata->f_attr.mdsthreshold)
                         goto err_opendata_put;
+                opendata->o_arg.open_bitmap = &nfs4_pnfs_open_bitmap[0];
         }
         if (dentry->d_inode != NULL)
                 opendata->state = nfs4_get_open_state(dentry->d_inode, sp);
@@ -1880,6 +1902,7 @@ static struct nfs4_state *nfs4_do_open(struct inode *dir,
         struct nfs4_state *res;
         int status;
 
+        fmode &= FMODE_READ|FMODE_WRITE;
         do {
                 status = _nfs4_do_open(dir, dentry, fmode, flags, sattr, cred,
                                        &res, ctx_th);
@@ -2526,6 +2549,14 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
 
         nfs_fattr_init(fattr);
         
+        /* Deal with open(O_TRUNC) */
+        if (sattr->ia_valid & ATTR_OPEN)
+                sattr->ia_valid &= ~(ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
+
+        /* Optimization: if the end result is no change, don't RPC */
+        if ((sattr->ia_valid & ~(ATTR_FILE)) == 0)
+                return 0;
+
         /* Search for an existing open(O_WRITE) file */
         if (sattr->ia_valid & ATTR_FILE) {
                 struct nfs_open_context *ctx;
@@ -2537,10 +2568,6 @@ nfs4_proc_setattr(struct dentry *dentry, struct nfs_fattr *fattr,
                 }
         }
 
-        /* Deal with open(O_TRUNC) */
-        if (sattr->ia_valid & ATTR_OPEN)
-                sattr->ia_valid &= ~(ATTR_MTIME|ATTR_CTIME|ATTR_OPEN);
-
         status = nfs4_do_setattr(inode, cred, fattr, sattr, state);
         if (status == 0)
                 nfs_setattr_update_inode(inode, sattr);
@@ -5275,7 +5302,7 @@ static int _nfs4_proc_destroy_clientid(struct nfs_client *clp,
 
         status = rpc_call_sync(clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
         if (status)
-                pr_warn("NFS: Got error %d from the server %s on "
+                dprintk("NFS: Got error %d from the server %s on "
                         "DESTROY_CLIENTID.", status, clp->cl_hostname);
         return status;
 }
@@ -5746,8 +5773,7 @@ int nfs4_proc_destroy_session(struct nfs4_session *session,
         status = rpc_call_sync(session->clp->cl_rpcclient, &msg, RPC_TASK_TIMEOUT);
 
         if (status)
-                printk(KERN_WARNING
-                        "NFS: Got error %d from the server on DESTROY_SESSION. "
+                dprintk("NFS: Got error %d from the server on DESTROY_SESSION. "
                         "Session has been destroyed regardless...\n", status);
 
         dprintk("<-- nfs4_proc_destroy_session\n");
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index c679b9ecef6..f38300e9f17 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -244,6 +244,16 @@ static int nfs4_begin_drain_session(struct nfs_client *clp)
         return nfs4_wait_on_slot_tbl(&ses->fc_slot_table);
 }
 
+static void nfs41_finish_session_reset(struct nfs_client *clp)
+{
+        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
+        clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
+        /* create_session negotiated new slot table */
+        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
+        clear_bit(NFS4CLNT_BIND_CONN_TO_SESSION, &clp->cl_state);
+        nfs41_setup_state_renewal(clp);
+}
+
 int nfs41_init_clientid(struct nfs_client *clp, struct rpc_cred *cred)
 {
         int status;
@@ -259,8 +269,7 @@ do_confirm:
         status = nfs4_proc_create_session(clp, cred);
         if (status != 0)
                 goto out;
-        clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
-        nfs41_setup_state_renewal(clp);
+        nfs41_finish_session_reset(clp);
         nfs_mark_client_ready(clp, NFS_CS_READY);
 out:
         return status;
@@ -1772,16 +1781,9 @@ static int nfs4_reset_session(struct nfs_client *clp)
                 status = nfs4_handle_reclaim_lease_error(clp, status);
                 goto out;
         }
-        clear_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
-        /* create_session negotiated new slot table */
-        clear_bit(NFS4CLNT_RECALL_SLOT, &clp->cl_state);
-        clear_bit(NFS4CLNT_BIND_CONN_TO_SESSION, &clp->cl_state);
+        nfs41_finish_session_reset(clp);
         dprintk("%s: session reset was successful for server %s!\n",
                         __func__, clp->cl_hostname);
-
-         /* Let the state manager reestablish state */
-        if (!test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state))
-                nfs41_setup_state_renewal(clp);
 out:
         if (cred)
                 put_rpccred(cred);
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index ee4a74db95d..18fae29b030 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1198,12 +1198,13 @@ static void encode_getfattr(struct xdr_stream *xdr, const u32* bitmask, struct c
 }
 
 static void encode_getfattr_open(struct xdr_stream *xdr, const u32 *bitmask,
+                                 const u32 *open_bitmap,
                                  struct compound_hdr *hdr)
 {
         encode_getattr_three(xdr,
-                             bitmask[0] & nfs4_fattr_bitmap[0],
-                             bitmask[1] & nfs4_fattr_bitmap[1],
-                             bitmask[2] & FATTR4_WORD2_MDSTHRESHOLD,
+                             bitmask[0] & open_bitmap[0],
+                             bitmask[1] & open_bitmap[1],
+                             bitmask[2] & open_bitmap[2],
                              hdr);
 }
 
@@ -2221,7 +2222,7 @@ static void nfs4_xdr_enc_open(struct rpc_rqst *req, struct xdr_stream *xdr,
         encode_putfh(xdr, args->fh, &hdr);
         encode_open(xdr, args, &hdr);
         encode_getfh(xdr, &hdr);
-        encode_getfattr_open(xdr, args->bitmask, &hdr);
+        encode_getfattr_open(xdr, args->bitmask, args->open_bitmap, &hdr);
         encode_nops(&hdr);
 }
 
@@ -4359,7 +4360,10 @@ static int decode_attr_mdsthreshold(struct xdr_stream *xdr,
 
         if (unlikely(bitmap[2] & (FATTR4_WORD2_MDSTHRESHOLD - 1U)))
                 return -EIO;
-        if (likely(bitmap[2] & FATTR4_WORD2_MDSTHRESHOLD)) {
+        if (bitmap[2] & FATTR4_WORD2_MDSTHRESHOLD) {
+                /* Did the server return an unrequested attribute? */
+                if (unlikely(res == NULL))
+                        return -EREMOTEIO;
                 p = xdr_inline_decode(xdr, 4);
                 if (unlikely(!p))
                         goto out_overflow;
@@ -4372,6 +4376,7 @@ static int decode_attr_mdsthreshold(struct xdr_stream *xdr,
                                 __func__);
 
                 status = decode_first_threshold_item4(xdr, res);
+                bitmap[2] &= ~FATTR4_WORD2_MDSTHRESHOLD;
         }
         return status;
 out_overflow:
diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h
index 29fd23c0efd..64f90d845f6 100644
--- a/fs/nfs/pnfs.h
+++ b/fs/nfs/pnfs.h
@@ -365,7 +365,7 @@ static inline bool
 pnfs_use_threshold(struct nfs4_threshold **dst, struct nfs4_threshold *src,
                    struct nfs_server *nfss)
 {
-        return (dst && src && src->bm != 0 &&
+        return (dst && src && src->bm != 0 && nfss->pnfs_curr_ld &&
                                         nfss->pnfs_curr_ld->id == src->l_type);
 }
 
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index a706b6bcc28..617c7419a08 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -651,7 +651,7 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
                 /* Emulate the eof flag, which isn't normally needed in NFSv2
                  * as it is guaranteed to always return the file attributes
                  */
-                if (data->args.offset + data->args.count >= data->res.fattr->size)
+                if (data->args.offset + data->res.count >= data->res.fattr->size)
                         data->res.eof = 1;
         }
         return 0;
diff --git a/fs/nfs/super.c b/fs/nfs/super.c
index ff656c02268..906f09c7d84 100644
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1867,6 +1867,7 @@ static int nfs23_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
+        args->version = NFS_DEFAULT_VERSION;
         switch (data->version) {
         case 1:
                 data->namlen = 0;
@@ -2637,6 +2638,8 @@ static int nfs4_validate_mount_data(void *options,
         if (data == NULL)
                 goto out_no_data;
 
+        args->version = 4;
+
         switch (data->version) {
         case 1:
                 if (data->host_addrlen > sizeof(args->nfs_server.address))
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index e6fe3d69d14..4d6861c0dc1 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -80,6 +80,7 @@ struct nfs_write_header *nfs_writehdr_alloc(void)
                 INIT_LIST_HEAD(&hdr->rpc_list);
                 spin_lock_init(&hdr->lock);
                 atomic_set(&hdr->refcnt, 0);
+                hdr->verf = &p->verf;
         }
         return p;
 }
@@ -619,6 +620,7 @@ static void nfs_write_completion(struct nfs_pgio_header *hdr)
                         goto next;
                 }
                 if (test_bit(NFS_IOHDR_NEED_COMMIT, &hdr->flags)) {
+                        memcpy(&req->wb_verf, hdr->verf, sizeof(req->wb_verf));
                         nfs_mark_request_commit(req, hdr->lseg, &cinfo);
                         goto next;
                 }
@@ -1255,15 +1257,14 @@ static void nfs_writeback_release_common(void *calldata)
         struct nfs_write_data   *data = calldata;
         struct nfs_pgio_header *hdr = data->header;
         int status = data->task.tk_status;
-        struct nfs_page *req = hdr->req;
 
         if ((status >= 0) && nfs_write_need_commit(data)) {
                 spin_lock(&hdr->lock);
                 if (test_bit(NFS_IOHDR_NEED_RESCHED, &hdr->flags))
                         ; /* Do nothing */
                 else if (!test_and_set_bit(NFS_IOHDR_NEED_COMMIT, &hdr->flags))
-                        memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
-                else if (memcmp(&req->wb_verf, &data->verf, sizeof(req->wb_verf)))
+                        memcpy(hdr->verf, &data->verf, sizeof(*hdr->verf));
+                else if (memcmp(hdr->verf, &data->verf, sizeof(*hdr->verf)))
                         set_bit(NFS_IOHDR_NEED_RESCHED, &hdr->flags);
                 spin_unlock(&hdr->lock);
         }
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 8fdc9ec5c5d..94effd5bc4a 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -900,7 +900,7 @@ static void free_session(struct kref *kref)
         struct nfsd4_session *ses;
         int mem;
 
-        BUG_ON(!spin_is_locked(&client_lock));
+        lockdep_assert_held(&client_lock);
         ses = container_of(kref, struct nfsd4_session, se_ref);
         nfsd4_del_conns(ses);
         spin_lock(&nfsd_drc_lock);
@@ -1080,7 +1080,7 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
 static inline void
 free_client(struct nfs4_client *clp)
 {
-        BUG_ON(!spin_is_locked(&client_lock));
+        lockdep_assert_held(&client_lock);
         while (!list_empty(&clp->cl_sessions)) {
                 struct nfsd4_session *ses;
                 ses = list_entry(clp->cl_sessions.next, struct nfsd4_session,
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 685a83756b2..84a7e6f3c04 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -2918,6 +2918,9 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
         struct dentry *dent;
         struct ubifs_debug_info *d = c->dbg;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         n = snprintf(d->dfs_dir_name, UBIFS_DFS_DIR_LEN + 1, UBIFS_DFS_DIR_NAME,
                      c->vi.ubi_num, c->vi.vol_id);
         if (n == UBIFS_DFS_DIR_LEN) {
@@ -3010,7 +3013,8 @@ out:
  */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        debugfs_remove_recursive(c->dbg->dfs_dir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(c->dbg->dfs_dir);
 }
 
 struct ubifs_global_debug_info ubifs_dbg;
@@ -3095,6 +3099,9 @@ int dbg_debugfs_init(void)
         const char *fname;
         struct dentry *dent;
 
+        if (!IS_ENABLED(DEBUG_FS))
+                return 0;
+
         fname = "ubifs";
         dent = debugfs_create_dir(fname, NULL);
         if (IS_ERR_OR_NULL(dent))
@@ -3159,7 +3166,8 @@ out:
  */
 void dbg_debugfs_exit(void)
 {
-        debugfs_remove_recursive(dfs_rootdir);
+        if (IS_ENABLED(DEBUG_FS))
+                debugfs_remove_recursive(dfs_rootdir);
 }
 
 /**
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index b0d62820ada..9e6e1c6eb60 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -440,8 +440,8 @@ static inline int acpi_pm_device_sleep_wake(struct device *dev, bool enable)
 
 #else   /* CONFIG_ACPI */
 
-static int register_acpi_bus_type(struct acpi_bus_type *bus) { return 0; }
-static int unregister_acpi_bus_type(struct acpi_bus_type *bus) { return 0; }
+static inline int register_acpi_bus_type(void *bus) { return 0; }
+static inline int unregister_acpi_bus_type(void *bus) { return 0; }
 
 #endif                          /* CONFIG_ACPI */
 
diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h
index 2520a6e241d..9f02005f217 100644
--- a/include/asm-generic/bug.h
+++ b/include/asm-generic/bug.h
@@ -2,6 +2,7 @@
 #define _ASM_GENERIC_BUG_H
 
 #include <linux/compiler.h>
+#include <linux/kernel.h>
 
 #ifdef CONFIG_BUG
 
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 73e45600f95..bac55c21511 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -54,7 +54,7 @@ struct drm_mode_object {
         struct drm_object_properties *properties;
 };
 
-#define DRM_OBJECT_MAX_PROPERTY 16
+#define DRM_OBJECT_MAX_PROPERTY 24
 struct drm_object_properties {
         int count;
         uint32_t ids[DRM_OBJECT_MAX_PROPERTY];
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 58d0bdab68d..81368ab6c61 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -181,6 +181,7 @@
         {0x1002, 0x6747, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6748, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x674A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6750, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6751, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6758, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_NEW_MEMMAP}, \
@@ -198,6 +199,7 @@
         {0x1002, 0x6767, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6768, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6770, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6771, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6772, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6778, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6779, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CAICOS|RADEON_NEW_MEMMAP}, \
@@ -229,10 +231,11 @@
         {0x1002, 0x6827, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6828, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6829, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x682B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x682F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
-        {0x1002, 0x6831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6830, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x6831, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6837, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6838, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x6839, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_VERDE|RADEON_NEW_MEMMAP}, \
@@ -531,6 +534,7 @@
         {0x1002, 0x9645, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
         {0x1002, 0x9648, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+        {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
         {0x1002, 0x964a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x964b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x964c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -550,6 +554,7 @@
         {0x1002, 0x9807, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x980A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9900, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9901, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9903, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
@@ -561,11 +566,19 @@
         {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9918, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x9919, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9990, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9991, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
+        {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
         {0, 0, 0}
 
 #define r128_PCI_IDS \
diff --git a/include/drm/exynos_drm.h b/include/drm/exynos_drm.h
index b6d7ce92ead..68733587e70 100644
--- a/include/drm/exynos_drm.h
+++ b/include/drm/exynos_drm.h
@@ -64,6 +64,7 @@ struct drm_exynos_gem_map_off {
  * A structure for mapping buffer.
  *
  * @handle: a handle to gem object created.
+ * @pad: just padding to be 64-bit aligned.
  * @size: memory size to be mapped.
  * @mapped: having user virtual address mmaped.
  *      - this variable would be filled by exynos gem module
@@ -72,7 +73,8 @@ struct drm_exynos_gem_map_off {
  */
 struct drm_exynos_gem_mmap {
         unsigned int handle;
-        unsigned int size;
+        unsigned int pad;
+        uint64_t size;
         uint64_t mapped;
 };
 
diff --git a/include/linux/i2c-mux-pinctrl.h b/include/linux/i2c-mux-pinctrl.h
new file mode 100644
index 00000000000..a65c86429e8
--- /dev/null
+++ b/include/linux/i2c-mux-pinctrl.h
@@ -0,0 +1,41 @@
+/*
+ * i2c-mux-pinctrl platform data
+ *
+ * Copyright (c) 2012, NVIDIA CORPORATION.  All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _LINUX_I2C_MUX_PINCTRL_H
+#define _LINUX_I2C_MUX_PINCTRL_H
+
+/**
+ * struct i2c_mux_pinctrl_platform_data - Platform data for i2c-mux-pinctrl
+ * @parent_bus_num: Parent I2C bus number
+ * @base_bus_num: Base I2C bus number for the child busses. 0 for dynamic.
+ * @bus_count: Number of child busses. Also the number of elements in
+ *      @pinctrl_states
+ * @pinctrl_states: The names of the pinctrl state to select for each child bus
+ * @pinctrl_state_idle: The pinctrl state to select when no child bus is being
+ *      accessed. If NULL, the most recently used pinctrl state will be left
+ *      selected.
+ */
+struct i2c_mux_pinctrl_platform_data {
+        int parent_bus_num;
+        int base_bus_num;
+        int bus_count;
+        const char **pinctrl_states;
+        const char *pinctrl_state_idle;
+};
+
+#endif
diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index 1b14d25162c..d6a58065c09 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h
@@ -128,7 +128,7 @@ struct kparam_array
  * The ops can have NULL set or get functions.
  */
 #define module_param_cb(name, ops, arg, perm)                                 \
-        __module_param_call(MODULE_PARAM_PREFIX, name, ops, arg, perm, 0)
+        __module_param_call(MODULE_PARAM_PREFIX, name, ops, arg, perm, -1)
 
 /**
  * <level>_param_cb - general callback for a module/cmdline parameter
@@ -192,7 +192,7 @@ struct kparam_array
                  { (void *)set, (void *)get };                          \
         __module_param_call(MODULE_PARAM_PREFIX,                        \
                             name, &__param_ops_##name, arg,             \
-                            (perm) + sizeof(__check_old_set_param(set))*0, 0)
+                            (perm) + sizeof(__check_old_set_param(set))*0, -1)
 
 /* We don't get oldget: it's often a new-style param_get_uint, etc. */
 static inline int
@@ -272,7 +272,7 @@ static inline void __kernel_param_unlock(void)
  */
 #define core_param(name, var, type, perm)                               \
         param_check_##type(name, &(var));                               \
-        __module_param_call("", name, &param_ops_##type, &var, perm, 0)
+        __module_param_call("", name, &param_ops_##type, &var, perm, -1)
 #endif /* !MODULE */
 
 /**
@@ -290,7 +290,7 @@ static inline void __kernel_param_unlock(void)
                 = { len, string };                                      \
         __module_param_call(MODULE_PARAM_PREFIX, name,                  \
                             &param_ops_string,                          \
-                            .str = &__param_string_##name, perm, 0);    \
+                            .str = &__param_string_##name, perm, -1);   \
         __MODULE_PARM_TYPE(name, "string")
 
 /**
@@ -432,7 +432,7 @@ extern int param_set_bint(const char *val, const struct kernel_param *kp);
         __module_param_call(MODULE_PARAM_PREFIX, name,                  \
                             &param_array_ops,                           \
                             .arr = &__param_arr_##name,                 \
-                            perm, 0);                                   \
+                            perm, -1);                                  \
         __MODULE_PARM_TYPE(name, "array of " #type)
 
 extern struct kernel_param_ops param_array_ops;
diff --git a/include/linux/netfilter/xt_HMARK.h b/include/linux/netfilter/xt_HMARK.h
index abb1650940d..826fc580757 100644
--- a/include/linux/netfilter/xt_HMARK.h
+++ b/include/linux/netfilter/xt_HMARK.h
@@ -27,7 +27,12 @@ union hmark_ports {
                 __u16   src;
                 __u16   dst;
         } p16;
+        struct {
+                __be16  src;
+                __be16  dst;
+        } b16;
         __u32   v32;
+        __be32  b32;
 };
 
 struct xt_hmark_info {
diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
index d1a7bf51c32..8aadd90b808 100644
--- a/include/linux/nfs_xdr.h
+++ b/include/linux/nfs_xdr.h
@@ -348,6 +348,7 @@ struct nfs_openargs {
         const struct qstr *     name;
         const struct nfs_server *server;         /* Needed for ID mapping */
         const u32 *             bitmask;
+        const u32 *             open_bitmap;
         __u32                   claim;
         struct nfs4_sequence_args       seq_args;
 };
@@ -1236,6 +1237,7 @@ struct nfs_pgio_header {
         struct list_head        rpc_list;
         atomic_t                refcnt;
         struct nfs_page         *req;
+        struct nfs_writeverf    *verf;
         struct pnfs_layout_segment *lseg;
         loff_t                  io_start;
         const struct rpc_call_ops *mds_ops;
@@ -1273,6 +1275,7 @@ struct nfs_write_data {
 struct nfs_write_header {
         struct nfs_pgio_header  header;
         struct nfs_write_data   rpc_data;
+        struct nfs_writeverf    verf;
 };
 
 struct nfs_mds_commit_info {
diff --git a/include/linux/pci.h b/include/linux/pci.h
index d8c379dba6a..fefb4e19bf6 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -176,6 +176,8 @@ enum pci_dev_flags {
         PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
         /* Provide indication device is assigned by a Virtual Machine Manager */
         PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
+        /* Device causes system crash if in D3 during S3 sleep */
+        PCI_DEV_FLAGS_NO_D3_DURING_SLEEP = (__force pci_dev_flags_t) 8,
 };
 
 enum pci_irq_reroute_variant {
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index f32578634d9..45db49f64bb 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -555,6 +555,8 @@ enum perf_event_type {
         PERF_RECORD_MAX,                        /* non-ABI */
 };
 
+#define PERF_MAX_STACK_DEPTH            127
+
 enum perf_callchain_context {
         PERF_CONTEXT_HV                 = (__u64)-32,
         PERF_CONTEXT_KERNEL             = (__u64)-128,
@@ -609,8 +611,6 @@ struct perf_guest_info_callbacks {
 #include <linux/sysfs.h>
 #include <asm/local.h>
 
-#define PERF_MAX_STACK_DEPTH            255
-
 struct perf_callchain_entry {
         __u64                           nr;
         __u64                           ip[PERF_MAX_STACK_DEPTH];
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 711e0a30aac..3988012255d 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -127,8 +127,8 @@
 #define PR_SET_PTRACER 0x59616d61
 # define PR_SET_PTRACER_ANY ((unsigned long)-1)
 
-#define PR_SET_CHILD_SUBREAPER 36
-#define PR_GET_CHILD_SUBREAPER 37
+#define PR_SET_CHILD_SUBREAPER  36
+#define PR_GET_CHILD_SUBREAPER  37
 
 /*
  * If no_new_privs is set, then operations that grant new privileges (i.e.
@@ -142,7 +142,9 @@
  * asking selinux for a specific new context (e.g. with runcon) will result
  * in execve returning -EPERM.
  */
-#define PR_SET_NO_NEW_PRIVS 38
-#define PR_GET_NO_NEW_PRIVS 39
+#define PR_SET_NO_NEW_PRIVS     38
+#define PR_GET_NO_NEW_PRIVS     39
+
+#define PR_GET_TID_ADDRESS      40
 
 #endif /* _LINUX_PRCTL_H */
diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index 0d04cd69ab9..ffc444c38b0 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -368,8 +368,11 @@ radix_tree_next_slot(void **slot, struct radix_tree_iter *iter, unsigned flags)
                         iter->index++;
                         if (likely(*slot))
                                 return slot;
-                        if (flags & RADIX_TREE_ITER_CONTIG)
+                        if (flags & RADIX_TREE_ITER_CONTIG) {
+                                /* forbid switching to the next chunk */
+                                iter->next_index = 0;
                                 break;
+                        }
                 }
         }
         return NULL;
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index adb5e5a38ca..854dc4c5c27 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -87,8 +87,9 @@ static inline void kfree_call_rcu(struct rcu_head *head,
 
 #ifdef CONFIG_TINY_RCU
 
-static inline int rcu_needs_cpu(int cpu)
+static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return 0;
 }
 
@@ -96,8 +97,9 @@ static inline int rcu_needs_cpu(int cpu)
 
 int rcu_preempt_needs_cpu(void);
 
-static inline int rcu_needs_cpu(int cpu)
+static inline int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return rcu_preempt_needs_cpu();
 }
 
diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h
index 3c6083cde4f..952b7933930 100644
--- a/include/linux/rcutree.h
+++ b/include/linux/rcutree.h
@@ -32,7 +32,7 @@
 
 extern void rcu_init(void);
 extern void rcu_note_context_switch(int cpu);
-extern int rcu_needs_cpu(int cpu);
+extern int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies);
 extern void rcu_cpu_stall_reset(void);
 
 /*
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6029d8c5447..4059c0f33f0 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -439,6 +439,7 @@ extern int get_dumpable(struct mm_struct *mm);
                                         /* leave room for more dump flags */
 #define MMF_VM_MERGEABLE        16      /* KSM may merge identical pages */
 #define MMF_VM_HUGEPAGE         17      /* set when VM_HUGEPAGE is set on vma */
+#define MMF_EXE_FILE_CHANGED    18      /* see prctl_set_mm_exe_file() */
 
 #define MMF_INIT_MASK           (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK)
 
@@ -876,6 +877,8 @@ struct sched_group_power {
          * Number of busy cpus in this group.
          */
         atomic_t nr_busy_cpus;
+
+        unsigned long cpumask[0]; /* iteration mask */
 };
 
 struct sched_group {
@@ -900,6 +903,15 @@ static inline struct cpumask *sched_group_cpus(struct sched_group *sg)
         return to_cpumask(sg->cpumask);
 }
 
+/*
+ * cpumask masking which cpus in the group are allowed to iterate up the domain
+ * tree.
+ */
+static inline struct cpumask *sched_group_mask(struct sched_group *sg)
+{
+        return to_cpumask(sg->sgp->cpumask);
+}
+
 /**
  * group_first_cpu - Returns the first cpu in the cpumask of a sched_group.
  * @group: The group whose first cpu is to be returned.
diff --git a/include/linux/swapops.h b/include/linux/swapops.h
index 792d16d9cbc..47ead515c81 100644
--- a/include/linux/swapops.h
+++ b/include/linux/swapops.h
@@ -9,13 +9,15 @@
  * get good packing density in that tree, so the index should be dense in
  * the low-order bits.
  *
- * We arrange the `type' and `offset' fields so that `type' is at the five
+ * We arrange the `type' and `offset' fields so that `type' is at the seven
  * high-order bits of the swp_entry_t and `offset' is right-aligned in the
- * remaining bits.
+ * remaining bits.  Although `type' itself needs only five bits, we allow for
+ * shmem/tmpfs to shift it all up a further two bits: see swp_to_radix_entry().
  *
  * swp_entry_t's are *never* stored anywhere in their arch-dependent format.
  */
-#define SWP_TYPE_SHIFT(e)       (sizeof(e.val) * 8 - MAX_SWAPFILES_SHIFT)
+#define SWP_TYPE_SHIFT(e)       ((sizeof(e.val) * 8) - \
+                        (MAX_SWAPFILES_SHIFT + RADIX_TREE_EXCEPTIONAL_SHIFT))
 #define SWP_OFFSET_MASK(e)      ((1UL << SWP_TYPE_SHIFT(e)) - 1)
 
 /*
diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 4c5b6328337..5f359dbfcdc 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -69,16 +69,16 @@ union tcp_word_hdr {
 #define tcp_flag_word(tp) ( ((union tcp_word_hdr *)(tp))->words [3]) 
 
 enum { 
-        TCP_FLAG_CWR = __cpu_to_be32(0x00800000),
-        TCP_FLAG_ECE = __cpu_to_be32(0x00400000),
-        TCP_FLAG_URG = __cpu_to_be32(0x00200000),
-        TCP_FLAG_ACK = __cpu_to_be32(0x00100000),
-        TCP_FLAG_PSH = __cpu_to_be32(0x00080000),
-        TCP_FLAG_RST = __cpu_to_be32(0x00040000),
-        TCP_FLAG_SYN = __cpu_to_be32(0x00020000),
-        TCP_FLAG_FIN = __cpu_to_be32(0x00010000),
-        TCP_RESERVED_BITS = __cpu_to_be32(0x0F000000),
-        TCP_DATA_OFFSET = __cpu_to_be32(0xF0000000)
+        TCP_FLAG_CWR = __constant_cpu_to_be32(0x00800000),
+        TCP_FLAG_ECE = __constant_cpu_to_be32(0x00400000),
+        TCP_FLAG_URG = __constant_cpu_to_be32(0x00200000),
+        TCP_FLAG_ACK = __constant_cpu_to_be32(0x00100000),
+        TCP_FLAG_PSH = __constant_cpu_to_be32(0x00080000),
+        TCP_FLAG_RST = __constant_cpu_to_be32(0x00040000),
+        TCP_FLAG_SYN = __constant_cpu_to_be32(0x00020000),
+        TCP_FLAG_FIN = __constant_cpu_to_be32(0x00010000),
+        TCP_RESERVED_BITS = __constant_cpu_to_be32(0x0F000000),
+        TCP_DATA_OFFSET = __constant_cpu_to_be32(0xF0000000)
 }; 
 
 /*
diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
index 7f855d50cdf..49b3ac29726 100644
--- a/include/linux/usb/hcd.h
+++ b/include/linux/usb/hcd.h
@@ -126,8 +126,6 @@ struct usb_hcd {
         unsigned                wireless:1;     /* Wireless USB HCD */
         unsigned                authorized_default:1;
         unsigned                has_tt:1;       /* Integrated TT in root hub */
-        unsigned                broken_pci_sleep:1;     /* Don't put the
-                        controller in PCI-D3 for system sleep */
 
         unsigned int            irq;            /* irq allocated */
         void __iomem            *regs;          /* device memory/io */
diff --git a/include/linux/vga_switcheroo.h b/include/linux/vga_switcheroo.h
index b455c7c212e..60da41fe9dc 100644
--- a/include/linux/vga_switcheroo.h
+++ b/include/linux/vga_switcheroo.h
@@ -12,6 +12,9 @@
 enum vga_switcheroo_state {
         VGA_SWITCHEROO_OFF,
         VGA_SWITCHEROO_ON,
+        /* below are referred only from vga_switcheroo_get_client_state() */
+        VGA_SWITCHEROO_INIT,
+        VGA_SWITCHEROO_NOT_FOUND,
 };
 
 enum vga_switcheroo_client_id {
@@ -50,6 +53,8 @@ void vga_switcheroo_unregister_handler(void);
 
 int vga_switcheroo_process_delayed_switch(void);
 
+int vga_switcheroo_get_client_state(struct pci_dev *dev);
+
 #else
 
 static inline void vga_switcheroo_unregister_client(struct pci_dev *dev) {}
@@ -62,5 +67,7 @@ static inline int vga_switcheroo_register_audio_client(struct pci_dev *pdev,
         int id, bool active) { return 0; }
 static inline void vga_switcheroo_unregister_handler(void) {}
 static inline int vga_switcheroo_process_delayed_switch(void) { return 0; }
+static inline int vga_switcheroo_get_client_state(struct pci_dev *dev) { return VGA_SWITCHEROO_ON; }
+
 
 #endif
diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
index b94765e38e8..2040bff945d 100644
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -40,7 +40,10 @@ struct inet_peer {
         u32                     pmtu_orig;
         u32                     pmtu_learned;
         struct inetpeer_addr_base redirect_learned;
-        struct list_head        gc_list;
+        union {
+                struct list_head        gc_list;
+                struct rcu_head     gc_rcu;
+        };
         /*
          * Once inet_peer is queued for deletion (refcnt == -1), following fields
          * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
diff --git a/include/net/route.h b/include/net/route.h
index ed2b78e2375..98705468ac0 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -130,9 +130,9 @@ static inline struct rtable *ip_route_output(struct net *net, __be32 daddr,
 {
         struct flowi4 fl4 = {
                 .flowi4_oif = oif,
+                .flowi4_tos = tos,
                 .daddr = daddr,
                 .saddr = saddr,
-                .flowi4_tos = tos,
         };
         return ip_route_output_key(net, &fl4);
 }
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 55ce96b53b0..9d7d54a00e6 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -220,13 +220,16 @@ struct tcf_proto {
 
 struct qdisc_skb_cb {
         unsigned int            pkt_len;
-        unsigned char           data[24];
+        u16                     bond_queue_mapping;
+        u16                     _pad;
+        unsigned char           data[20];
 };
 
 static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
 {
         struct qdisc_skb_cb *qcb;
-        BUILD_BUG_ON(sizeof(skb->cb) < sizeof(unsigned int) + sz);
+
+        BUILD_BUG_ON(sizeof(skb->cb) < offsetof(struct qdisc_skb_cb, data) + sz);
         BUILD_BUG_ON(sizeof(qcb->data) < sz);
 }
 
diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h
index 116959933f4..c78a23333c4 100644
--- a/include/target/target_core_fabric.h
+++ b/include/target/target_core_fabric.h
@@ -47,6 +47,7 @@ struct target_core_fabric_ops {
          */
         int (*check_stop_free)(struct se_cmd *);
         void (*release_cmd)(struct se_cmd *);
+        void (*put_session)(struct se_session *);
         /*
          * Called with spin_lock_bh(struct se_portal_group->session_lock held.
          */
diff --git a/include/trace/events/rcu.h b/include/trace/events/rcu.h
index 1480900c511..d274734b2aa 100644
--- a/include/trace/events/rcu.h
+++ b/include/trace/events/rcu.h
@@ -289,6 +289,7 @@ TRACE_EVENT(rcu_dyntick,
  *      "In holdoff": Nothing to do, holding off after unsuccessful attempt.
  *      "Begin holdoff": Attempt failed, don't retry until next jiffy.
  *      "Dyntick with callbacks": Entering dyntick-idle despite callbacks.
+ *      "Dyntick with lazy callbacks": Entering dyntick-idle w/lazy callbacks.
  *      "More callbacks": Still more callbacks, try again to clear them out.
  *      "Callbacks drained": All callbacks processed, off to dyntick idle!
  *      "Timer": Timer fired to cause CPU to continue processing callbacks.
diff --git a/init/main.c b/init/main.c
index 1ca6b32c482..b5cc0a7c470 100644
--- a/init/main.c
+++ b/init/main.c
@@ -508,7 +508,7 @@ asmlinkage void __init start_kernel(void)
         parse_early_param();
         parse_args("Booting kernel", static_command_line, __start___param,
                    __stop___param - __start___param,
-                   0, 0, &unknown_bootoption);
+                   -1, -1, &unknown_bootoption);
 
         jump_label_init();
 
@@ -755,13 +755,8 @@ static void __init do_initcalls(void)
 {
         int level;
 
-        for (level = 0; level < ARRAY_SIZE(initcall_levels) - 1; level++) {
-                pr_info("initlevel:%d=%s, %d registered initcalls\n",
-                        level, initcall_level_names[level],
-                        (int) (initcall_levels[level+1]
-                                - initcall_levels[level]));
+        for (level = 0; level < ARRAY_SIZE(initcall_levels) - 1; level++)
                 do_initcall_level(level);
-        }
 }
 
 /*
diff --git a/ipc/shm.c b/ipc/shm.c
index 5e2cbfdab6f..41c1285d697 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -393,6 +393,16 @@ static int shm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
         return sfd->file->f_op->fsync(sfd->file, start, end, datasync);
 }
 
+static long shm_fallocate(struct file *file, int mode, loff_t offset,
+                          loff_t len)
+{
+        struct shm_file_data *sfd = shm_file_data(file);
+
+        if (!sfd->file->f_op->fallocate)
+                return -EOPNOTSUPP;
+        return sfd->file->f_op->fallocate(file, mode, offset, len);
+}
+
 static unsigned long shm_get_unmapped_area(struct file *file,
         unsigned long addr, unsigned long len, unsigned long pgoff,
         unsigned long flags)
@@ -410,6 +420,7 @@ static const struct file_operations shm_file_operations = {
         .get_unmapped_area      = shm_get_unmapped_area,
 #endif
         .llseek         = noop_llseek,
+        .fallocate      = shm_fallocate,
 };
 
 static const struct file_operations shm_file_operations_huge = {
@@ -418,6 +429,7 @@ static const struct file_operations shm_file_operations_huge = {
         .release        = shm_release,
         .get_unmapped_area      = shm_get_unmapped_area,
         .llseek         = noop_llseek,
+        .fallocate      = shm_fallocate,
 };
 
 int is_file_shm_hugepages(struct file *file)
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 0f3527d6184..72fcd3069a9 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -896,10 +896,13 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                 mutex_unlock(&cgroup_mutex);
 
                 /*
-                 * Drop the active superblock reference that we took when we
-                 * created the cgroup
+                 * We want to drop the active superblock reference from the
+                 * cgroup creation after all the dentry refs are gone -
+                 * kill_sb gets mighty unhappy otherwise.  Mark
+                 * dentry->d_fsdata with cgroup_diput() to tell
+                 * cgroup_d_release() to call deactivate_super().
                  */
-                deactivate_super(cgrp->root->sb);
+                dentry->d_fsdata = cgroup_diput;
 
                 /*
                  * if we're getting rid of the cgroup, refcount should ensure
@@ -925,6 +928,13 @@ static int cgroup_delete(const struct dentry *d)
         return 1;
 }
 
+static void cgroup_d_release(struct dentry *dentry)
+{
+        /* did cgroup_diput() tell me to deactivate super? */
+        if (dentry->d_fsdata == cgroup_diput)
+                deactivate_super(dentry->d_sb);
+}
+
 static void remove_dir(struct dentry *d)
 {
         struct dentry *parent = dget(d->d_parent);
@@ -1532,6 +1542,7 @@ static int cgroup_get_rootdir(struct super_block *sb)
         static const struct dentry_operations cgroup_dops = {
                 .d_iput = cgroup_diput,
                 .d_delete = cgroup_delete,
+                .d_release = cgroup_d_release,
         };
 
         struct inode *inode =
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5b06cbbf693..f85c0154b33 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3181,7 +3181,6 @@ static void perf_event_for_each(struct perf_event *event,
         event = event->group_leader;
 
         perf_event_for_each_child(event, func);
-        func(event);
         list_for_each_entry(sibling, &event->sibling_list, group_entry)
                 perf_event_for_each_child(sibling, func);
         mutex_unlock(&ctx->mutex);
diff --git a/kernel/panic.c b/kernel/panic.c
index 8ed89a175d7..d2a5f4ecc6d 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -27,7 +27,7 @@
 #define PANIC_TIMER_STEP 100
 #define PANIC_BLINK_SPD 18
 
-int panic_on_oops;
+int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE;
 static unsigned long tainted_mask;
 static int pause_on_oops;
 static int pause_on_oops_flag;
@@ -108,8 +108,6 @@ void panic(const char *fmt, ...)
          */
         crash_kexec(NULL);
 
-        kmsg_dump(KMSG_DUMP_PANIC);
-
         /*
          * Note smp_send_stop is the usual smp shutdown function, which
          * unfortunately means it may not be hardened to work in a panic
@@ -117,6 +115,8 @@ void panic(const char *fmt, ...)
          */
         smp_send_stop();
 
+        kmsg_dump(KMSG_DUMP_PANIC);
+
         atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 
         bust_spinlocks(0);
diff --git a/kernel/rcutree.c b/kernel/rcutree.c
index 0da7b88d92d..3b0f1337f75 100644
--- a/kernel/rcutree.c
+++ b/kernel/rcutree.c
@@ -1397,6 +1397,8 @@ static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
         rdp->qlen_lazy += rsp->qlen_lazy;
         rdp->qlen += rsp->qlen;
         rdp->n_cbs_adopted += rsp->qlen;
+        if (rsp->qlen_lazy != rsp->qlen)
+                rcu_idle_count_callbacks_posted();
         rsp->qlen_lazy = 0;
         rsp->qlen = 0;
 
diff --git a/kernel/rcutree.h b/kernel/rcutree.h
index 7f5d138dedf..ea056495783 100644
--- a/kernel/rcutree.h
+++ b/kernel/rcutree.h
@@ -84,6 +84,20 @@ struct rcu_dynticks {
                                     /* Process level is worth LLONG_MAX/2. */
         int dynticks_nmi_nesting;   /* Track NMI nesting level. */
         atomic_t dynticks;          /* Even value for idle, else odd. */
+#ifdef CONFIG_RCU_FAST_NO_HZ
+        int dyntick_drain;          /* Prepare-for-idle state variable. */
+        unsigned long dyntick_holdoff;
+                                    /* No retries for the jiffy of failure. */
+        struct timer_list idle_gp_timer;
+                                    /* Wake up CPU sleeping with callbacks. */
+        unsigned long idle_gp_timer_expires;
+                                    /* When to wake up CPU (for repost). */
+        bool idle_first_pass;       /* First pass of attempt to go idle? */
+        unsigned long nonlazy_posted;
+                                    /* # times non-lazy CBs posted to CPU. */
+        unsigned long nonlazy_posted_snap;
+                                    /* idle-period nonlazy_posted snapshot. */
+#endif /* #ifdef CONFIG_RCU_FAST_NO_HZ */
 };
 
 /* RCU's kthread states for tracing. */
diff --git a/kernel/rcutree_plugin.h b/kernel/rcutree_plugin.h
index 2411000d986..5271a020887 100644
--- a/kernel/rcutree_plugin.h
+++ b/kernel/rcutree_plugin.h
@@ -1886,8 +1886,9 @@ static void __cpuinit rcu_prepare_kthreads(int cpu)
  * Because we not have RCU_FAST_NO_HZ, just check whether this CPU needs
  * any flavor of RCU.
  */
-int rcu_needs_cpu(int cpu)
+int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
 {
+        *delta_jiffies = ULONG_MAX;
         return rcu_cpu_has_callbacks(cpu);
 }
 
@@ -1962,41 +1963,6 @@ static void rcu_idle_count_callbacks_posted(void)
 #define RCU_IDLE_GP_DELAY 6             /* Roughly one grace period. */
 #define RCU_IDLE_LAZY_GP_DELAY (6 * HZ) /* Roughly six seconds. */
 
-/* Loop counter for rcu_prepare_for_idle(). */
-static DEFINE_PER_CPU(int, rcu_dyntick_drain);
-/* If rcu_dyntick_holdoff==jiffies, don't try to enter dyntick-idle mode. */
-static DEFINE_PER_CPU(unsigned long, rcu_dyntick_holdoff);
-/* Timer to awaken the CPU if it enters dyntick-idle mode with callbacks. */
-static DEFINE_PER_CPU(struct timer_list, rcu_idle_gp_timer);
-/* Scheduled expiry time for rcu_idle_gp_timer to allow reposting. */
-static DEFINE_PER_CPU(unsigned long, rcu_idle_gp_timer_expires);
-/* Enable special processing on first attempt to enter dyntick-idle mode. */
-static DEFINE_PER_CPU(bool, rcu_idle_first_pass);
-/* Running count of non-lazy callbacks posted, never decremented. */
-static DEFINE_PER_CPU(unsigned long, rcu_nonlazy_posted);
-/* Snapshot of rcu_nonlazy_posted to detect meaningful exits from idle. */
-static DEFINE_PER_CPU(unsigned long, rcu_nonlazy_posted_snap);
-
-/*
- * Allow the CPU to enter dyntick-idle mode if either: (1) There are no
- * callbacks on this CPU, (2) this CPU has not yet attempted to enter
- * dyntick-idle mode, or (3) this CPU is in the process of attempting to
- * enter dyntick-idle mode.  Otherwise, if we have recently tried and failed
- * to enter dyntick-idle mode, we refuse to try to enter it.  After all,
- * it is better to incur scheduling-clock interrupts than to spin
- * continuously for the same time duration!
- */
-int rcu_needs_cpu(int cpu)
-{
-        /* Flag a new idle sojourn to the idle-entry state machine. */
-        per_cpu(rcu_idle_first_pass, cpu) = 1;
-        /* If no callbacks, RCU doesn't need the CPU. */
-        if (!rcu_cpu_has_callbacks(cpu))
-                return 0;
-        /* Otherwise, RCU needs the CPU only if it recently tried and failed. */
-        return per_cpu(rcu_dyntick_holdoff, cpu) == jiffies;
-}
-
 /*
  * Does the specified flavor of RCU have non-lazy callbacks pending on
  * the specified CPU?  Both RCU flavor and CPU are specified by the
@@ -2040,6 +2006,47 @@ static bool rcu_cpu_has_nonlazy_callbacks(int cpu)
 }
 
 /*
+ * Allow the CPU to enter dyntick-idle mode if either: (1) There are no
+ * callbacks on this CPU, (2) this CPU has not yet attempted to enter
+ * dyntick-idle mode, or (3) this CPU is in the process of attempting to
+ * enter dyntick-idle mode.  Otherwise, if we have recently tried and failed
+ * to enter dyntick-idle mode, we refuse to try to enter it.  After all,
+ * it is better to incur scheduling-clock interrupts than to spin
+ * continuously for the same time duration!
+ *
+ * The delta_jiffies argument is used to store the time when RCU is
+ * going to need the CPU again if it still has callbacks.  The reason
+ * for this is that rcu_prepare_for_idle() might need to post a timer,
+ * but if so, it will do so after tick_nohz_stop_sched_tick() has set
+ * the wakeup time for this CPU.  This means that RCU's timer can be
+ * delayed until the wakeup time, which defeats the purpose of posting
+ * a timer.
+ */
+int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies)
+{
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        /* Flag a new idle sojourn to the idle-entry state machine. */
+        rdtp->idle_first_pass = 1;
+        /* If no callbacks, RCU doesn't need the CPU. */
+        if (!rcu_cpu_has_callbacks(cpu)) {
+                *delta_jiffies = ULONG_MAX;
+                return 0;
+        }
+        if (rdtp->dyntick_holdoff == jiffies) {
+                /* RCU recently tried and failed, so don't try again. */
+                *delta_jiffies = 1;
+                return 1;
+        }
+        /* Set up for the possibility that RCU will post a timer. */
+        if (rcu_cpu_has_nonlazy_callbacks(cpu))
+                *delta_jiffies = RCU_IDLE_GP_DELAY;
+        else
+                *delta_jiffies = RCU_IDLE_LAZY_GP_DELAY;
+        return 0;
+}
+
+/*
  * Handler for smp_call_function_single().  The only point of this
  * handler is to wake the CPU up, so the handler does only tracing.
  */
@@ -2075,21 +2082,24 @@ static void rcu_idle_gp_timer_func(unsigned long cpu_in)
  */
 static void rcu_prepare_for_idle_init(int cpu)
 {
-        per_cpu(rcu_dyntick_holdoff, cpu) = jiffies - 1;
-        setup_timer(&per_cpu(rcu_idle_gp_timer, cpu),
-                    rcu_idle_gp_timer_func, cpu);
-        per_cpu(rcu_idle_gp_timer_expires, cpu) = jiffies - 1;
-        per_cpu(rcu_idle_first_pass, cpu) = 1;
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        rdtp->dyntick_holdoff = jiffies - 1;
+        setup_timer(&rdtp->idle_gp_timer, rcu_idle_gp_timer_func, cpu);
+        rdtp->idle_gp_timer_expires = jiffies - 1;
+        rdtp->idle_first_pass = 1;
 }
 
 /*
  * Clean up for exit from idle.  Because we are exiting from idle, there
- * is no longer any point to rcu_idle_gp_timer, so cancel it.  This will
+ * is no longer any point to ->idle_gp_timer, so cancel it.  This will
  * do nothing if this timer is not active, so just cancel it unconditionally.
  */
 static void rcu_cleanup_after_idle(int cpu)
 {
-        del_timer(&per_cpu(rcu_idle_gp_timer, cpu));
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+
+        del_timer(&rdtp->idle_gp_timer);
         trace_rcu_prep_idle("Cleanup after idle");
 }
 
@@ -2108,42 +2118,41 @@ static void rcu_cleanup_after_idle(int cpu)
  * Because it is not legal to invoke rcu_process_callbacks() with irqs
  * disabled, we do one pass of force_quiescent_state(), then do a
  * invoke_rcu_core() to cause rcu_process_callbacks() to be invoked
- * later.  The per-cpu rcu_dyntick_drain variable controls the sequencing.
+ * later.  The ->dyntick_drain field controls the sequencing.
  *
  * The caller must have disabled interrupts.
  */
 static void rcu_prepare_for_idle(int cpu)
 {
         struct timer_list *tp;
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
 
         /*
          * If this is an idle re-entry, for example, due to use of
          * RCU_NONIDLE() or the new idle-loop tracing API within the idle
          * loop, then don't take any state-machine actions, unless the
          * momentary exit from idle queued additional non-lazy callbacks.
-         * Instead, repost the rcu_idle_gp_timer if this CPU has callbacks
+         * Instead, repost the ->idle_gp_timer if this CPU has callbacks
          * pending.
          */
-        if (!per_cpu(rcu_idle_first_pass, cpu) &&
-            (per_cpu(rcu_nonlazy_posted, cpu) ==
-             per_cpu(rcu_nonlazy_posted_snap, cpu))) {
+        if (!rdtp->idle_first_pass &&
+            (rdtp->nonlazy_posted == rdtp->nonlazy_posted_snap)) {
                 if (rcu_cpu_has_callbacks(cpu)) {
-                        tp = &per_cpu(rcu_idle_gp_timer, cpu);
-                        mod_timer_pinned(tp, per_cpu(rcu_idle_gp_timer_expires, cpu));
+                        tp = &rdtp->idle_gp_timer;
+                        mod_timer_pinned(tp, rdtp->idle_gp_timer_expires);
                 }
                 return;
         }
-        per_cpu(rcu_idle_first_pass, cpu) = 0;
-        per_cpu(rcu_nonlazy_posted_snap, cpu) =
-                per_cpu(rcu_nonlazy_posted, cpu) - 1;
+        rdtp->idle_first_pass = 0;
+        rdtp->nonlazy_posted_snap = rdtp->nonlazy_posted - 1;
 
         /*
          * If there are no callbacks on this CPU, enter dyntick-idle mode.
          * Also reset state to avoid prejudicing later attempts.
          */
         if (!rcu_cpu_has_callbacks(cpu)) {
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies - 1;
-                per_cpu(rcu_dyntick_drain, cpu) = 0;
+                rdtp->dyntick_holdoff = jiffies - 1;
+                rdtp->dyntick_drain = 0;
                 trace_rcu_prep_idle("No callbacks");
                 return;
         }
@@ -2152,36 +2161,37 @@ static void rcu_prepare_for_idle(int cpu)
          * If in holdoff mode, just return.  We will presumably have
          * refrained from disabling the scheduling-clock tick.
          */
-        if (per_cpu(rcu_dyntick_holdoff, cpu) == jiffies) {
+        if (rdtp->dyntick_holdoff == jiffies) {
                 trace_rcu_prep_idle("In holdoff");
                 return;
         }
 
-        /* Check and update the rcu_dyntick_drain sequencing. */
-        if (per_cpu(rcu_dyntick_drain, cpu) <= 0) {
+        /* Check and update the ->dyntick_drain sequencing. */
+        if (rdtp->dyntick_drain <= 0) {
                 /* First time through, initialize the counter. */
-                per_cpu(rcu_dyntick_drain, cpu) = RCU_IDLE_FLUSHES;
-        } else if (per_cpu(rcu_dyntick_drain, cpu) <= RCU_IDLE_OPT_FLUSHES &&
+                rdtp->dyntick_drain = RCU_IDLE_FLUSHES;
+        } else if (rdtp->dyntick_drain <= RCU_IDLE_OPT_FLUSHES &&
                    !rcu_pending(cpu) &&
                    !local_softirq_pending()) {
                 /* Can we go dyntick-idle despite still having callbacks? */
-                trace_rcu_prep_idle("Dyntick with callbacks");
-                per_cpu(rcu_dyntick_drain, cpu) = 0;
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies;
-                if (rcu_cpu_has_nonlazy_callbacks(cpu))
-                        per_cpu(rcu_idle_gp_timer_expires, cpu) =
+                rdtp->dyntick_drain = 0;
+                rdtp->dyntick_holdoff = jiffies;
+                if (rcu_cpu_has_nonlazy_callbacks(cpu)) {
+                        trace_rcu_prep_idle("Dyntick with callbacks");
+                        rdtp->idle_gp_timer_expires =
                                            jiffies + RCU_IDLE_GP_DELAY;
-                else
-                        per_cpu(rcu_idle_gp_timer_expires, cpu) =
+                } else {
+                        rdtp->idle_gp_timer_expires =
                                            jiffies + RCU_IDLE_LAZY_GP_DELAY;
-                tp = &per_cpu(rcu_idle_gp_timer, cpu);
-                mod_timer_pinned(tp, per_cpu(rcu_idle_gp_timer_expires, cpu));
-                per_cpu(rcu_nonlazy_posted_snap, cpu) =
-                        per_cpu(rcu_nonlazy_posted, cpu);
+                        trace_rcu_prep_idle("Dyntick with lazy callbacks");
+                }
+                tp = &rdtp->idle_gp_timer;
+                mod_timer_pinned(tp, rdtp->idle_gp_timer_expires);
+                rdtp->nonlazy_posted_snap = rdtp->nonlazy_posted;
                 return; /* Nothing more to do immediately. */
-        } else if (--per_cpu(rcu_dyntick_drain, cpu) <= 0) {
+        } else if (--(rdtp->dyntick_drain) <= 0) {
                 /* We have hit the limit, so time to give up. */
-                per_cpu(rcu_dyntick_holdoff, cpu) = jiffies;
+                rdtp->dyntick_holdoff = jiffies;
                 trace_rcu_prep_idle("Begin holdoff");
                 invoke_rcu_core();  /* Force the CPU out of dyntick-idle. */
                 return;
@@ -2227,7 +2237,7 @@ static void rcu_prepare_for_idle(int cpu)
  */
 static void rcu_idle_count_callbacks_posted(void)
 {
-        __this_cpu_add(rcu_nonlazy_posted, 1);
+        __this_cpu_add(rcu_dynticks.nonlazy_posted, 1);
 }
 
 #endif /* #else #if !defined(CONFIG_RCU_FAST_NO_HZ) */
@@ -2238,11 +2248,12 @@ static void rcu_idle_count_callbacks_posted(void)
 
 static void print_cpu_stall_fast_no_hz(char *cp, int cpu)
 {
-        struct timer_list *tltp = &per_cpu(rcu_idle_gp_timer, cpu);
+        struct rcu_dynticks *rdtp = &per_cpu(rcu_dynticks, cpu);
+        struct timer_list *tltp = &rdtp->idle_gp_timer;
 
         sprintf(cp, "drain=%d %c timer=%lu",
-                per_cpu(rcu_dyntick_drain, cpu),
-                per_cpu(rcu_dyntick_holdoff, cpu) == jiffies ? 'H' : '.',
+                rdtp->dyntick_drain,
+                rdtp->dyntick_holdoff == jiffies ? 'H' : '.',
                 timer_pending(tltp) ? tltp->expires - jiffies : -1);
 }
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c46958e2612..d5594a4268d 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5556,15 +5556,20 @@ static cpumask_var_t sched_domains_tmpmask; /* sched_domains_mutex */
 
 #ifdef CONFIG_SCHED_DEBUG
 
-static __read_mostly int sched_domain_debug_enabled;
+static __read_mostly int sched_debug_enabled;
 
-static int __init sched_domain_debug_setup(char *str)
+static int __init sched_debug_setup(char *str)
 {
-        sched_domain_debug_enabled = 1;
+        sched_debug_enabled = 1;
 
         return 0;
 }
-early_param("sched_debug", sched_domain_debug_setup);
+early_param("sched_debug", sched_debug_setup);
+
+static inline bool sched_debug(void)
+{
+        return sched_debug_enabled;
+}
 
 static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
                                   struct cpumask *groupmask)
@@ -5604,7 +5609,12 @@ static int sched_domain_debug_one(struct sched_domain *sd, int cpu, int level,
                         break;
                 }
 
-                if (!group->sgp->power) {
+                /*
+                 * Even though we initialize ->power to something semi-sane,
+                 * we leave power_orig unset. This allows us to detect if
+                 * domain iteration is still funny without causing /0 traps.
+                 */
+                if (!group->sgp->power_orig) {
                         printk(KERN_CONT "\n");
                         printk(KERN_ERR "ERROR: domain->cpu_power not "
                                         "set\n");
@@ -5652,7 +5662,7 @@ static void sched_domain_debug(struct sched_domain *sd, int cpu)
 {
         int level = 0;
 
-        if (!sched_domain_debug_enabled)
+        if (!sched_debug_enabled)
                 return;
 
         if (!sd) {
@@ -5673,6 +5683,10 @@ static void sched_domain_debug(struct sched_domain *sd, int cpu)
 }
 #else /* !CONFIG_SCHED_DEBUG */
 # define sched_domain_debug(sd, cpu) do { } while (0)
+static inline bool sched_debug(void)
+{
+        return false;
+}
 #endif /* CONFIG_SCHED_DEBUG */
 
 static int sd_degenerate(struct sched_domain *sd)
@@ -5994,6 +6008,44 @@ struct sched_domain_topology_level {
         struct sd_data      data;
 };
 
+/*
+ * Build an iteration mask that can exclude certain CPUs from the upwards
+ * domain traversal.
+ *
+ * Asymmetric node setups can result in situations where the domain tree is of
+ * unequal depth, make sure to skip domains that already cover the entire
+ * range.
+ *
+ * In that case build_sched_domains() will have terminated the iteration early
+ * and our sibling sd spans will be empty. Domains should always include the
+ * cpu they're built on, so check that.
+ *
+ */
+static void build_group_mask(struct sched_domain *sd, struct sched_group *sg)
+{
+        const struct cpumask *span = sched_domain_span(sd);
+        struct sd_data *sdd = sd->private;
+        struct sched_domain *sibling;
+        int i;
+
+        for_each_cpu(i, span) {
+                sibling = *per_cpu_ptr(sdd->sd, i);
+                if (!cpumask_test_cpu(i, sched_domain_span(sibling)))
+                        continue;
+
+                cpumask_set_cpu(i, sched_group_mask(sg));
+        }
+}
+
+/*
+ * Return the canonical balance cpu for this group, this is the first cpu
+ * of this group that's also in the iteration mask.
+ */
+int group_balance_cpu(struct sched_group *sg)
+{
+        return cpumask_first_and(sched_group_cpus(sg), sched_group_mask(sg));
+}
+
 static int
 build_overlap_sched_groups(struct sched_domain *sd, int cpu)
 {
@@ -6012,6 +6064,12 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                 if (cpumask_test_cpu(i, covered))
                         continue;
 
+                child = *per_cpu_ptr(sdd->sd, i);
+
+                /* See the comment near build_group_mask(). */
+                if (!cpumask_test_cpu(i, sched_domain_span(child)))
+                        continue;
+
                 sg = kzalloc_node(sizeof(struct sched_group) + cpumask_size(),
                                 GFP_KERNEL, cpu_to_node(cpu));
 
@@ -6019,8 +6077,6 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                         goto fail;
 
                 sg_span = sched_group_cpus(sg);
-
-                child = *per_cpu_ptr(sdd->sd, i);
                 if (child->child) {
                         child = child->child;
                         cpumask_copy(sg_span, sched_domain_span(child));
@@ -6030,13 +6086,24 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
                 cpumask_or(covered, covered, sg_span);
 
                 sg->sgp = *per_cpu_ptr(sdd->sgp, i);
-                atomic_inc(&sg->sgp->ref);
+                if (atomic_inc_return(&sg->sgp->ref) == 1)
+                        build_group_mask(sd, sg);
 
+                /*
+                 * Initialize sgp->power such that even if we mess up the
+                 * domains and no possible iteration will get us here, we won't
+                 * die on a /0 trap.
+                 */
+                sg->sgp->power = SCHED_POWER_SCALE * cpumask_weight(sg_span);
+
+                /*
+                 * Make sure the first group of this domain contains the
+                 * canonical balance cpu. Otherwise the sched_domain iteration
+                 * breaks. See update_sg_lb_stats().
+                 */
                 if ((!groups && cpumask_test_cpu(cpu, sg_span)) ||
-                               cpumask_first(sg_span) == cpu) {
-                        WARN_ON_ONCE(!cpumask_test_cpu(cpu, sg_span));
+                    group_balance_cpu(sg) == cpu)
                         groups = sg;
-                }
 
                 if (!first)
                         first = sg;
@@ -6109,6 +6176,7 @@ build_sched_groups(struct sched_domain *sd, int cpu)
 
                 cpumask_clear(sched_group_cpus(sg));
                 sg->sgp->power = 0;
+                cpumask_setall(sched_group_mask(sg));
 
                 for_each_cpu(j, span) {
                         if (get_group(j, sdd, NULL) != group)
@@ -6150,7 +6218,7 @@ static void init_sched_groups_power(int cpu, struct sched_domain *sd)
                 sg = sg->next;
         } while (sg != sd->groups);
 
-        if (cpu != group_first_cpu(sg))
+        if (cpu != group_balance_cpu(sg))
                 return;
 
         update_group_power(sd, cpu);
@@ -6200,11 +6268,8 @@ int sched_domain_level_max;
 
 static int __init setup_relax_domain_level(char *str)
 {
-        unsigned long val;
-
-        val = simple_strtoul(str, NULL, 0);
-        if (val < sched_domain_level_max)
-                default_relax_domain_level = val;
+        if (kstrtoint(str, 0, &default_relax_domain_level))
+                pr_warn("Unable to set relax_domain_level\n");
 
         return 1;
 }
@@ -6314,14 +6379,13 @@ static struct sched_domain_topology_level *sched_domain_topology = default_topol
 #ifdef CONFIG_NUMA
 
 static int sched_domains_numa_levels;
-static int sched_domains_numa_scale;
 static int *sched_domains_numa_distance;
 static struct cpumask ***sched_domains_numa_masks;
 static int sched_domains_curr_level;
 
 static inline int sd_local_flags(int level)
 {
-        if (sched_domains_numa_distance[level] > REMOTE_DISTANCE)
+        if (sched_domains_numa_distance[level] > RECLAIM_DISTANCE)
                 return 0;
 
         return SD_BALANCE_EXEC | SD_BALANCE_FORK | SD_WAKE_AFFINE;
@@ -6379,6 +6443,42 @@ static const struct cpumask *sd_numa_mask(int cpu)
         return sched_domains_numa_masks[sched_domains_curr_level][cpu_to_node(cpu)];
 }
 
+static void sched_numa_warn(const char *str)
+{
+        static int done = false;
+        int i,j;
+
+        if (done)
+                return;
+
+        done = true;
+
+        printk(KERN_WARNING "ERROR: %s\n\n", str);
+
+        for (i = 0; i < nr_node_ids; i++) {
+                printk(KERN_WARNING "  ");
+                for (j = 0; j < nr_node_ids; j++)
+                        printk(KERN_CONT "%02d ", node_distance(i,j));
+                printk(KERN_CONT "\n");
+        }
+        printk(KERN_WARNING "\n");
+}
+
+static bool find_numa_distance(int distance)
+{
+        int i;
+
+        if (distance == node_distance(0, 0))
+                return true;
+
+        for (i = 0; i < sched_domains_numa_levels; i++) {
+                if (sched_domains_numa_distance[i] == distance)
+                        return true;
+        }
+
+        return false;
+}
+
 static void sched_init_numa(void)
 {
         int next_distance, curr_distance = node_distance(0, 0);
@@ -6386,7 +6486,6 @@ static void sched_init_numa(void)
         int level = 0;
         int i, j, k;
 
-        sched_domains_numa_scale = curr_distance;
         sched_domains_numa_distance = kzalloc(sizeof(int) * nr_node_ids, GFP_KERNEL);
         if (!sched_domains_numa_distance)
                 return;
@@ -6397,23 +6496,41 @@ static void sched_init_numa(void)
          *
          * Assumes node_distance(0,j) includes all distances in
          * node_distance(i,j) in order to avoid cubic time.
-         *
-         * XXX: could be optimized to O(n log n) by using sort()
          */
         next_distance = curr_distance;
         for (i = 0; i < nr_node_ids; i++) {
                 for (j = 0; j < nr_node_ids; j++) {
-                        int distance = node_distance(0, j);
-                        if (distance > curr_distance &&
-                                        (distance < next_distance ||
-                                         next_distance == curr_distance))
-                                next_distance = distance;
+                        for (k = 0; k < nr_node_ids; k++) {
+                                int distance = node_distance(i, k);
+
+                                if (distance > curr_distance &&
+                                    (distance < next_distance ||
+                                     next_distance == curr_distance))
+                                        next_distance = distance;
+
+                                /*
+                                 * While not a strong assumption it would be nice to know
+                                 * about cases where if node A is connected to B, B is not
+                                 * equally connected to A.
+                                 */
+                                if (sched_debug() && node_distance(k, i) != distance)
+                                        sched_numa_warn("Node-distance not symmetric");
+
+                                if (sched_debug() && i && !find_numa_distance(distance))
+                                        sched_numa_warn("Node-0 not representative");
+                        }
+                        if (next_distance != curr_distance) {
+                                sched_domains_numa_distance[level++] = next_distance;
+                                sched_domains_numa_levels = level;
+                                curr_distance = next_distance;
+                        } else break;
                 }
-                if (next_distance != curr_distance) {
-                        sched_domains_numa_distance[level++] = next_distance;
-                        sched_domains_numa_levels = level;
-                        curr_distance = next_distance;
-                } else break;
+
+                /*
+                 * In case of sched_debug() we verify the above assumption.
+                 */
+                if (!sched_debug())
+                        break;
         }
         /*
          * 'level' contains the number of unique distances, excluding the
@@ -6525,7 +6642,7 @@ static int __sdt_alloc(const struct cpumask *cpu_map)
 
                         *per_cpu_ptr(sdd->sg, j) = sg;
 
-                        sgp = kzalloc_node(sizeof(struct sched_group_power),
+                        sgp = kzalloc_node(sizeof(struct sched_group_power) + cpumask_size(),
                                         GFP_KERNEL, cpu_to_node(j));
                         if (!sgp)
                                 return -ENOMEM;
@@ -6578,7 +6695,6 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
         if (!sd)
                 return child;
 
-        set_domain_attribute(sd, attr);
         cpumask_and(sched_domain_span(sd), cpu_map, tl->mask(cpu));
         if (child) {
                 sd->level = child->level + 1;
@@ -6586,6 +6702,7 @@ struct sched_domain *build_sched_domain(struct sched_domain_topology_level *tl,
                 child->parent = sd;
         }
         sd->child = child;
+        set_domain_attribute(sd, attr);
 
         return sd;
 }
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index b2a2d236f27..c099cc6eebe 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3602,7 +3602,7 @@ void update_group_power(struct sched_domain *sd, int cpu)
                 } while (group != child->groups);
         }
 
-        sdg->sgp->power = power;
+        sdg->sgp->power_orig = sdg->sgp->power = power;
 }
 
 /*
@@ -3632,7 +3632,7 @@ fix_small_capacity(struct sched_domain *sd, struct sched_group *group)
 
 /**
  * update_sg_lb_stats - Update sched_group's statistics for load balancing.
- * @sd: The sched_domain whose statistics are to be updated.
+ * @env: The load balancing environment.
  * @group: sched_group whose statistics are to be updated.
  * @load_idx: Load index of sched_domain of this_cpu for load calc.
  * @local_group: Does group contain this_cpu.
@@ -3652,7 +3652,7 @@ static inline void update_sg_lb_stats(struct lb_env *env,
         int i;
 
         if (local_group)
-                balance_cpu = group_first_cpu(group);
+                balance_cpu = group_balance_cpu(group);
 
         /* Tally up the load of all CPUs in the group */
         max_cpu_load = 0;
@@ -3667,7 +3667,8 @@ static inline void update_sg_lb_stats(struct lb_env *env,
 
                 /* Bias balancing toward cpus of our domain */
                 if (local_group) {
-                        if (idle_cpu(i) && !first_idle_cpu) {
+                        if (idle_cpu(i) && !first_idle_cpu &&
+                                        cpumask_test_cpu(i, sched_group_mask(group))) {
                                 first_idle_cpu = 1;
                                 balance_cpu = i;
                         }
@@ -3741,11 +3742,10 @@ static inline void update_sg_lb_stats(struct lb_env *env,
 
 /**
  * update_sd_pick_busiest - return 1 on busiest group
- * @sd: sched_domain whose statistics are to be checked
+ * @env: The load balancing environment.
  * @sds: sched_domain statistics
  * @sg: sched_group candidate to be checked for being the busiest
  * @sgs: sched_group statistics
- * @this_cpu: the current cpu
  *
  * Determine if @sg is a busier group than the previously selected
  * busiest group.
@@ -3783,9 +3783,7 @@ static bool update_sd_pick_busiest(struct lb_env *env,
 
 /**
  * update_sd_lb_stats - Update sched_domain's statistics for load balancing.
- * @sd: sched_domain whose statistics are to be updated.
- * @this_cpu: Cpu for which load balance is currently performed.
- * @idle: Idle status of this_cpu
+ * @env: The load balancing environment.
  * @cpus: Set of cpus considered for load balancing.
  * @balance: Should we balance.
  * @sds: variable to hold the statistics for this sched_domain.
@@ -3874,10 +3872,8 @@ static inline void update_sd_lb_stats(struct lb_env *env,
  * Returns 1 when packing is required and a task should be moved to
  * this CPU.  The amount of the imbalance is returned in *imbalance.
  *
- * @sd: The sched_domain whose packing is to be checked.
+ * @env: The load balancing environment.
  * @sds: Statistics of the sched_domain which is to be packed
- * @this_cpu: The cpu at whose sched_domain we're performing load-balance.
- * @imbalance: returns amount of imbalanced due to packing.
  */
 static int check_asym_packing(struct lb_env *env, struct sd_lb_stats *sds)
 {
@@ -3903,9 +3899,8 @@ static int check_asym_packing(struct lb_env *env, struct sd_lb_stats *sds)
  * fix_small_imbalance - Calculate the minor imbalance that exists
  *                      amongst the groups of a sched_domain, during
  *                      load balancing.
+ * @env: The load balancing environment.
  * @sds: Statistics of the sched_domain whose imbalance is to be calculated.
- * @this_cpu: The cpu at whose sched_domain we're performing load-balance.
- * @imbalance: Variable to store the imbalance.
  */
 static inline
 void fix_small_imbalance(struct lb_env *env, struct sd_lb_stats *sds)
@@ -4048,11 +4043,7 @@ static inline void calculate_imbalance(struct lb_env *env, struct sd_lb_stats *s
  * Also calculates the amount of weighted load which should be moved
  * to restore balance.
  *
- * @sd: The sched_domain whose busiest group is to be returned.
- * @this_cpu: The cpu for which load balancing is currently being performed.
- * @imbalance: Variable which stores amount of weighted load which should
- *              be moved to restore balance/put a group to idle.
- * @idle: The idle status of this_cpu.
+ * @env: The load balancing environment.
  * @cpus: The set of CPUs under consideration for load-balancing.
  * @balance: Pointer to a variable indicating if this_cpu
  *      is the appropriate cpu to perform load balancing at this_level.
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 2a4e8dffbd6..573e1ca0110 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1562,7 +1562,7 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq)
                                      task_running(rq, task) ||
                                      !task->on_rq)) {
 
-                                raw_spin_unlock(&lowest_rq->lock);
+                                double_unlock_balance(rq, lowest_rq);
                                 lowest_rq = NULL;
                                 break;
                         }
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index ba9dccfd24c..6d52cea7f33 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -526,6 +526,8 @@ static inline struct sched_domain *highest_flag_domain(int cpu, int flag)
 DECLARE_PER_CPU(struct sched_domain *, sd_llc);
 DECLARE_PER_CPU(int, sd_llc_id);
 
+extern int group_balance_cpu(struct sched_group *sg);
+
 #endif /* CONFIG_SMP */
 
 #include "stats.h"
diff --git a/kernel/sys.c b/kernel/sys.c
index 9ff89cb9657..f0ec44dcd41 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1786,27 +1786,13 @@ SYSCALL_DEFINE1(umask, int, mask)
 }
 
 #ifdef CONFIG_CHECKPOINT_RESTORE
-static bool vma_flags_mismatch(struct vm_area_struct *vma,
-                               unsigned long required,
-                               unsigned long banned)
-{
-        return (vma->vm_flags & required) != required ||
-                (vma->vm_flags & banned);
-}
-
 static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
 {
+        struct vm_area_struct *vma;
         struct file *exe_file;
         struct dentry *dentry;
         int err;
 
-        /*
-         * Setting new mm::exe_file is only allowed when no VM_EXECUTABLE vma's
-         * remain. So perform a quick test first.
-         */
-        if (mm->num_exe_file_vmas)
-                return -EBUSY;
-
         exe_file = fget(fd);
         if (!exe_file)
                 return -EBADF;
@@ -1827,17 +1813,30 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
         if (err)
                 goto exit;
 
+        down_write(&mm->mmap_sem);
+
+        /*
+         * Forbid mm->exe_file change if there are mapped other files.
+         */
+        err = -EBUSY;
+        for (vma = mm->mmap; vma; vma = vma->vm_next) {
+                if (vma->vm_file && !path_equal(&vma->vm_file->f_path,
+                                                &exe_file->f_path))
+                        goto exit_unlock;
+        }
+
         /*
          * The symlink can be changed only once, just to disallow arbitrary
          * transitions malicious software might bring in. This means one
          * could make a snapshot over all processes running and monitor
          * /proc/pid/exe changes to notice unusual activity if needed.
          */
-        down_write(&mm->mmap_sem);
-        if (likely(!mm->exe_file))
-                set_mm_exe_file(mm, exe_file);
-        else
-                err = -EBUSY;
+        err = -EPERM;
+        if (test_and_set_bit(MMF_EXE_FILE_CHANGED, &mm->flags))
+                goto exit_unlock;
+
+        set_mm_exe_file(mm, exe_file);
+exit_unlock:
         up_write(&mm->mmap_sem);
 
 exit:
@@ -1862,7 +1861,7 @@ static int prctl_set_mm(int opt, unsigned long addr,
         if (opt == PR_SET_MM_EXE_FILE)
                 return prctl_set_mm_exe_file(mm, (unsigned int)addr);
 
-        if (addr >= TASK_SIZE)
+        if (addr >= TASK_SIZE || addr < mmap_min_addr)
                 return -EINVAL;
 
         error = -EINVAL;
@@ -1924,12 +1923,6 @@ static int prctl_set_mm(int opt, unsigned long addr,
                         error = -EFAULT;
                         goto out;
                 }
-#ifdef CONFIG_STACK_GROWSUP
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSUP, 0))
-#else
-                if (vma_flags_mismatch(vma, VM_READ | VM_WRITE | VM_GROWSDOWN, 0))
-#endif
-                        goto out;
                 if (opt == PR_SET_MM_START_STACK)
                         mm->start_stack = addr;
                 else if (opt == PR_SET_MM_ARG_START)
@@ -1981,12 +1974,22 @@ out:
         up_read(&mm->mmap_sem);
         return error;
 }
+
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return put_user(me->clear_child_tid, tid_addr);
+}
+
 #else /* CONFIG_CHECKPOINT_RESTORE */
 static int prctl_set_mm(int opt, unsigned long addr,
                         unsigned long arg4, unsigned long arg5)
 {
         return -EINVAL;
 }
+static int prctl_get_tid_address(struct task_struct *me, int __user **tid_addr)
+{
+        return -EINVAL;
+}
 #endif
 
 SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
@@ -2124,6 +2127,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
                                 else
                                         return -EINVAL;
                                 break;
+                case PR_GET_TID_ADDRESS:
+                        error = prctl_get_tid_address(me, (int __user **)arg2);
+                        break;
                         default:
                                 return -EINVAL;
                         }
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index da70c6db496..86999783392 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -274,6 +274,7 @@ EXPORT_SYMBOL_GPL(get_cpu_iowait_time_us);
 static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
 {
         unsigned long seq, last_jiffies, next_jiffies, delta_jiffies;
+        unsigned long rcu_delta_jiffies;
         ktime_t last_update, expires, now;
         struct clock_event_device *dev = __get_cpu_var(tick_cpu_device).evtdev;
         u64 time_delta;
@@ -322,7 +323,7 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
                 time_delta = timekeeping_max_deferment();
         } while (read_seqretry(&xtime_lock, seq));
 
-        if (rcu_needs_cpu(cpu) || printk_needs_cpu(cpu) ||
+        if (rcu_needs_cpu(cpu, &rcu_delta_jiffies) || printk_needs_cpu(cpu) ||
             arch_needs_cpu(cpu)) {
                 next_jiffies = last_jiffies + 1;
                 delta_jiffies = 1;
@@ -330,6 +331,10 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
                 /* Get the next timer wheel timer */
                 next_jiffies = get_next_timer_interrupt(last_jiffies);
                 delta_jiffies = next_jiffies - last_jiffies;
+                if (rcu_delta_jiffies < delta_jiffies) {
+                        next_jiffies = last_jiffies + rcu_delta_jiffies;
+                        delta_jiffies = rcu_delta_jiffies;
+                }
         }
         /*
          * Do not stop the tick, if we are only one off
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 6e46cacf596..6f46a00a1e8 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -962,6 +962,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         /* Accumulate raw time */
@@ -1077,6 +1078,7 @@ static void update_wall_time(void)
                 timekeeper.xtime.tv_sec++;
                 leap = second_overflow(timekeeper.xtime.tv_sec);
                 timekeeper.xtime.tv_sec += leap;
+                timekeeper.wall_to_monotonic.tv_sec -= leap;
         }
 
         timekeeping_update(false);
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 68032c6177d..49249c28690 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -371,7 +371,7 @@ EXPORT_SYMBOL_GPL(tracing_on);
 void tracing_off(void)
 {
         if (global_trace.buffer)
-                ring_buffer_record_on(global_trace.buffer);
+                ring_buffer_record_off(global_trace.buffer);
         /*
          * This flag is only looked at when buffers haven't been
          * allocated yet. We don't really care about the race
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index e5e1d85b8c7..4b1dfba70f7 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -372,6 +372,13 @@ static int watchdog(void *unused)
 
 
 #ifdef CONFIG_HARDLOCKUP_DETECTOR
+/*
+ * People like the simple clean cpu node info on boot.
+ * Reduce the watchdog noise by only printing messages
+ * that are different from what cpu0 displayed.
+ */
+static unsigned long cpu0_err;
+
 static int watchdog_nmi_enable(int cpu)
 {
         struct perf_event_attr *wd_attr;
@@ -390,11 +397,21 @@ static int watchdog_nmi_enable(int cpu)
 
         /* Try to register using hardware perf events */
         event = perf_event_create_kernel_counter(wd_attr, cpu, NULL, watchdog_overflow_callback, NULL);
+
+        /* save cpu0 error for future comparision */
+        if (cpu == 0 && IS_ERR(event))
+                cpu0_err = PTR_ERR(event);
+
         if (!IS_ERR(event)) {
-                pr_info("enabled, takes one hw-pmu counter.\n");
+                /* only print for cpu0 or different than cpu0 */
+                if (cpu == 0 || cpu0_err)
+                        pr_info("enabled on all CPUs, permanently consumes one hw-PMU counter.\n");
                 goto out_save;
         }
 
+        /* skip displaying the same error again */
+        if (cpu > 0 && (PTR_ERR(event) == cpu0_err))
+                return PTR_ERR(event);
 
         /* vary the KERN level based on the returned errno */
         if (PTR_ERR(event) == -EOPNOTSUPP)
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index a42d3ae3964..ff5bdee4716 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -241,6 +241,26 @@ config BOOTPARAM_SOFTLOCKUP_PANIC_VALUE
         default 0 if !BOOTPARAM_SOFTLOCKUP_PANIC
         default 1 if BOOTPARAM_SOFTLOCKUP_PANIC
 
+config PANIC_ON_OOPS
+        bool "Panic on Oops" if EXPERT
+        default n
+        help
+          Say Y here to enable the kernel to panic when it oopses. This
+          has the same effect as setting oops=panic on the kernel command
+          line.
+
+          This feature is useful to ensure that the kernel does not do
+          anything erroneous after an oops which could result in data
+          corruption or other issues.
+
+          Say N if unsure.
+
+config PANIC_ON_OOPS_VALUE
+        int
+        range 0 1
+        default 0 if !PANIC_ON_OOPS
+        default 1 if PANIC_ON_OOPS
+
 config DETECT_HUNG_TASK
         bool "Detect Hung Tasks"
         depends on DEBUG_KERNEL
diff --git a/lib/btree.c b/lib/btree.c
index e5ec1e9c1aa..f9a484676cb 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -319,8 +319,8 @@ void *btree_get_prev(struct btree_head *head, struct btree_geo *geo,
 
         if (head->height == 0)
                 return NULL;
-retry:
         longcpy(key, __key, geo->keylen);
+retry:
         dec_key(geo, key);
 
         node = head->node;
@@ -351,7 +351,7 @@ retry:
         }
 miss:
         if (retry_key) {
-                __key = retry_key;
+                longcpy(key, retry_key, geo->keylen);
                 retry_key = NULL;
                 goto retry;
         }
@@ -509,6 +509,7 @@ retry:
 int btree_insert(struct btree_head *head, struct btree_geo *geo,
                 unsigned long *key, void *val, gfp_t gfp)
 {
+        BUG_ON(!val);
         return btree_insert_level(head, geo, key, val, 1, gfp);
 }
 EXPORT_SYMBOL_GPL(btree_insert);
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index d7c878cc006..e7964296fd5 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -686,6 +686,9 @@ void **radix_tree_next_chunk(struct radix_tree_root *root,
          * during iterating; it can be zero only at the beginning.
          * And we cannot overflow iter->next_index in a single step,
          * because RADIX_TREE_MAP_SHIFT < BITS_PER_LONG.
+         *
+         * This condition also used by radix_tree_next_slot() to stop
+         * contiguous iterating, and forbid swithing to the next chunk.
          */
         index = iter->next_index;
         if (!index && iter->index)
diff --git a/lib/raid6/recov.c b/lib/raid6/recov.c
index 1805a5cc5da..a95bccb8497 100644
--- a/lib/raid6/recov.c
+++ b/lib/raid6/recov.c
@@ -22,8 +22,8 @@
 #include <linux/raid/pq.h>
 
 /* Recover two failed data blocks. */
-void raid6_2data_recov_intx1(int disks, size_t bytes, int faila, int failb,
-                       void **ptrs)
+static void raid6_2data_recov_intx1(int disks, size_t bytes, int faila,
+                int failb, void **ptrs)
 {
         u8 *p, *q, *dp, *dq;
         u8 px, qx, db;
@@ -66,7 +66,8 @@ void raid6_2data_recov_intx1(int disks, size_t bytes, int faila, int failb,
 }
 
 /* Recover failure of one data block plus the P block */
-void raid6_datap_recov_intx1(int disks, size_t bytes, int faila, void **ptrs)
+static void raid6_datap_recov_intx1(int disks, size_t bytes, int faila,
+                void **ptrs)
 {
         u8 *p, *q, *dq;
         const u8 *qmul;         /* Q multiplier table */
diff --git a/lib/raid6/recov_ssse3.c b/lib/raid6/recov_ssse3.c
index 37ae6193055..ecb710c0b4d 100644
--- a/lib/raid6/recov_ssse3.c
+++ b/lib/raid6/recov_ssse3.c
@@ -19,8 +19,8 @@ static int raid6_has_ssse3(void)
                 boot_cpu_has(X86_FEATURE_SSSE3);
 }
 
-void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila, int failb,
-                       void **ptrs)
+static void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila,
+                int failb, void **ptrs)
 {
         u8 *p, *q, *dp, *dq;
         const u8 *pbmul;        /* P multiplier table for B data */
@@ -194,7 +194,8 @@ void raid6_2data_recov_ssse3(int disks, size_t bytes, int faila, int failb,
 }
 
 
-void raid6_datap_recov_ssse3(int disks, size_t bytes, int faila, void **ptrs)
+static void raid6_datap_recov_ssse3(int disks, size_t bytes, int faila,
+                void **ptrs)
 {
         u8 *p, *q, *dq;
         const u8 *qmul;         /* Q multiplier table */
diff --git a/lib/spinlock_debug.c b/lib/spinlock_debug.c
index d0ec4f3d159..e91fbc23fff 100644
--- a/lib/spinlock_debug.c
+++ b/lib/spinlock_debug.c
@@ -118,7 +118,7 @@ static void __spin_lock_debug(raw_spinlock_t *lock)
                 /* lockup suspected: */
                 if (print_once) {
                         print_once = 0;
-                        spin_dump(lock, "lockup");
+                        spin_dump(lock, "lockup suspected");
 #ifdef CONFIG_SMP
                         trigger_all_cpu_backtrace();
 #endif
diff --git a/mm/memblock.c b/mm/memblock.c
index 952123eba43..32a0a5e4d79 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -867,6 +867,16 @@ int __init_memblock memblock_is_memory(phys_addr_t addr)
         return memblock_search(&memblock.memory, addr) != -1;
 }
 
+/**
+ * memblock_is_region_memory - check if a region is a subset of memory
+ * @base: base of region to check
+ * @size: size of region to check
+ *
+ * Check if the region [@base, @base+@size) is a subset of a memory block.
+ *
+ * RETURNS:
+ * 0 if false, non-zero if true
+ */
 int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size)
 {
         int idx = memblock_search(&memblock.memory, base);
@@ -879,6 +889,16 @@ int __init_memblock memblock_is_region_memory(phys_addr_t base, phys_addr_t size
                  memblock.memory.regions[idx].size) >= end;
 }
 
+/**
+ * memblock_is_region_reserved - check if a region intersects reserved memory
+ * @base: base of region to check
+ * @size: size of region to check
+ *
+ * Check if the region [@base, @base+@size) intersects a reserved memory block.
+ *
+ * RETURNS:
+ * 0 if false, non-zero if true
+ */
 int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t size)
 {
         memblock_cap_size(base, &size);
diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index ed0e1967736..416637f0e92 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -183,7 +183,7 @@ static bool oom_unkillable_task(struct task_struct *p,
 unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
                           const nodemask_t *nodemask, unsigned long totalpages)
 {
-        unsigned long points;
+        long points;
 
         if (oom_unkillable_task(p, memcg, nodemask))
                 return 0;
@@ -223,7 +223,7 @@ unsigned long oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
          * Never return 0 for an eligible task regardless of the root bonus and
          * oom_score_adj (oom_score_adj can't be OOM_SCORE_ADJ_MIN here).
          */
-        return points ? points : 1;
+        return points > 0 ? points : 1;
 }
 
 /*
diff --git a/mm/shmem.c b/mm/shmem.c
index 585bd220a21..a15a466d0d1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -683,10 +683,21 @@ static int shmem_unuse_inode(struct shmem_inode_info *info,
                 mutex_lock(&shmem_swaplist_mutex);
                 /*
                  * We needed to drop mutex to make that restrictive page
-                 * allocation; but the inode might already be freed by now,
-                 * and we cannot refer to inode or mapping or info to check.
-                 * However, we do hold page lock on the PageSwapCache page,
-                 * so can check if that still has our reference remaining.
+                 * allocation, but the inode might have been freed while we
+                 * dropped it: although a racing shmem_evict_inode() cannot
+                 * complete without emptying the radix_tree, our page lock
+                 * on this swapcache page is not enough to prevent that -
+                 * free_swap_and_cache() of our swap entry will only
+                 * trylock_page(), removing swap from radix_tree whatever.
+                 *
+                 * We must not proceed to shmem_add_to_page_cache() if the
+                 * inode has been freed, but of course we cannot rely on
+                 * inode or mapping or info to check that.  However, we can
+                 * safely check if our swap entry is still in use (and here
+                 * it can't have got reused for another page): if it's still
+                 * in use, then the inode cannot have been freed yet, and we
+                 * can safely proceed (if it's no longer in use, that tells
+                 * nothing about the inode, but we don't need to unuse swap).
                  */
                 if (!page_swapcount(*pagep))
                         error = -ENOENT;
@@ -730,9 +741,9 @@ int shmem_unuse(swp_entry_t swap, struct page *page)
 
         /*
          * There's a faint possibility that swap page was replaced before
-         * caller locked it: it will come back later with the right page.
+         * caller locked it: caller will come back later with the right page.
          */
-        if (unlikely(!PageSwapCache(page)))
+        if (unlikely(!PageSwapCache(page) || page_private(page) != swap.val))
                 goto out;
 
         /*
@@ -995,21 +1006,15 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         newpage = shmem_alloc_page(gfp, info, index);
         if (!newpage)
                 return -ENOMEM;
-        VM_BUG_ON(shmem_should_replace_page(newpage, gfp));
 
-        *pagep = newpage;
         page_cache_get(newpage);
         copy_highpage(newpage, oldpage);
+        flush_dcache_page(newpage);
 
-        VM_BUG_ON(!PageLocked(oldpage));
         __set_page_locked(newpage);
-        VM_BUG_ON(!PageUptodate(oldpage));
         SetPageUptodate(newpage);
-        VM_BUG_ON(!PageSwapBacked(oldpage));
         SetPageSwapBacked(newpage);
-        VM_BUG_ON(!swap_index);
         set_page_private(newpage, swap_index);
-        VM_BUG_ON(!PageSwapCache(oldpage));
         SetPageSwapCache(newpage);
 
         /*
@@ -1019,13 +1024,24 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         spin_lock_irq(&swap_mapping->tree_lock);
         error = shmem_radix_tree_replace(swap_mapping, swap_index, oldpage,
                                                                    newpage);
-        __inc_zone_page_state(newpage, NR_FILE_PAGES);
-        __dec_zone_page_state(oldpage, NR_FILE_PAGES);
+        if (!error) {
+                __inc_zone_page_state(newpage, NR_FILE_PAGES);
+                __dec_zone_page_state(oldpage, NR_FILE_PAGES);
+        }
         spin_unlock_irq(&swap_mapping->tree_lock);
-        BUG_ON(error);
 
-        mem_cgroup_replace_page_cache(oldpage, newpage);
-        lru_cache_add_anon(newpage);
+        if (unlikely(error)) {
+                /*
+                 * Is this possible?  I think not, now that our callers check
+                 * both PageSwapCache and page_private after getting page lock;
+                 * but be defensive.  Reverse old to newpage for clear and free.
+                 */
+                oldpage = newpage;
+        } else {
+                mem_cgroup_replace_page_cache(oldpage, newpage);
+                lru_cache_add_anon(newpage);
+                *pagep = newpage;
+        }
 
         ClearPageSwapCache(oldpage);
         set_page_private(oldpage, 0);
@@ -1033,7 +1049,7 @@ static int shmem_replace_page(struct page **pagep, gfp_t gfp,
         unlock_page(oldpage);
         page_cache_release(oldpage);
         page_cache_release(oldpage);
-        return 0;
+        return error;
 }
 
 /*
@@ -1107,7 +1123,8 @@ repeat:
 
                 /* We have to do this with page locked to prevent races */
                 lock_page(page);
-                if (!PageSwapCache(page) || page->mapping) {
+                if (!PageSwapCache(page) || page_private(page) != swap.val ||
+                    page->mapping) {
                         error = -EEXIST;        /* try again */
                         goto failed;
                 }
diff --git a/mm/swapfile.c b/mm/swapfile.c
index de5bc51c4a6..71373d03fce 100644
--- a/mm/swapfile.c
+++ b/mm/swapfile.c
@@ -1916,24 +1916,20 @@ static unsigned long read_swap_header(struct swap_info_struct *p,
 
         /*
          * Find out how many pages are allowed for a single swap
-         * device. There are three limiting factors: 1) the number
+         * device. There are two limiting factors: 1) the number
          * of bits for the swap offset in the swp_entry_t type, and
          * 2) the number of bits in the swap pte as defined by the
-         * the different architectures, and 3) the number of free bits
-         * in an exceptional radix_tree entry. In order to find the
+         * different architectures. In order to find the
          * largest possible bit mask, a swap entry with swap type 0
          * and swap offset ~0UL is created, encoded to a swap pte,
          * decoded to a swp_entry_t again, and finally the swap
          * offset is extracted. This will mask all the bits from
          * the initial ~0UL mask that can't be encoded in either
          * the swp_entry_t or the architecture definition of a
-         * swap pte.  Then the same is done for a radix_tree entry.
+         * swap pte.
          */
         maxpages = swp_offset(pte_to_swp_entry(
-                        swp_entry_to_pte(swp_entry(0, ~0UL))));
-        maxpages = swp_offset(radix_to_swp_entry(
-                        swp_to_radix_entry(swp_entry(0, maxpages)))) + 1;
-
+                        swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1;
         if (maxpages > swap_header->info.last_page) {
                 maxpages = swap_header->info.last_page + 1;
                 /* p->max is an unsigned int: don't overflow it */
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 0301b328cf0..86852963b7f 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1208,9 +1208,7 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
         if (addr->sat_addr.s_node == ATADDR_BCAST &&
             !sock_flag(sk, SOCK_BROADCAST)) {
 #if 1
-                printk(KERN_WARNING "%s is broken and did not set "
-                                    "SO_BROADCAST. It will break when 2.2 is "
-                                    "released.\n",
+                pr_warn("atalk_connect: %s is broken and did not set SO_BROADCAST.\n",
                         current->comm);
 #else
                 return -EACCES;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 46e7f86acfc..3e18af4dadc 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -210,7 +210,7 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
                 }
 
                 if (sk->sk_state == BT_CONNECTED || !newsock ||
-                    test_bit(BT_DEFER_SETUP, &bt_sk(parent)->flags)) {
+                    test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) {
                         bt_accept_unlink(sk);
                         if (newsock)
                                 sock_graft(sk, newsock);
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index ea5fb9fcc3f..d23b6682f4e 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -36,9 +36,6 @@
 #define TRACE_ON 1
 #define TRACE_OFF 0
 
-static void send_dm_alert(struct work_struct *unused);
-
-
 /*
  * Globals, our netlink socket pointer
  * and the work handle that will send up
@@ -48,11 +45,10 @@ static int trace_state = TRACE_OFF;
 static DEFINE_MUTEX(trace_state_mutex);
 
 struct per_cpu_dm_data {
-        struct work_struct dm_alert_work;
-        struct sk_buff __rcu *skb;
-        atomic_t dm_hit_count;
-        struct timer_list send_timer;
-        int cpu;
+        spinlock_t              lock;
+        struct sk_buff          *skb;
+        struct work_struct      dm_alert_work;
+        struct timer_list       send_timer;
 };
 
 struct dm_hw_stat_delta {
@@ -78,13 +74,13 @@ static int dm_delay = 1;
 static unsigned long dm_hw_check_delta = 2*HZ;
 static LIST_HEAD(hw_stats_list);
 
-static void reset_per_cpu_data(struct per_cpu_dm_data *data)
+static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
 {
         size_t al;
         struct net_dm_alert_msg *msg;
         struct nlattr *nla;
         struct sk_buff *skb;
-        struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1);
+        unsigned long flags;
 
         al = sizeof(struct net_dm_alert_msg);
         al += dm_hit_limit * sizeof(struct net_dm_drop_point);
@@ -99,65 +95,40 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
                                   sizeof(struct net_dm_alert_msg));
                 msg = nla_data(nla);
                 memset(msg, 0, al);
-        } else
-                schedule_work_on(data->cpu, &data->dm_alert_work);
-
-        /*
-         * Don't need to lock this, since we are guaranteed to only
-         * run this on a single cpu at a time.
-         * Note also that we only update data->skb if the old and new skb
-         * pointers don't match.  This ensures that we don't continually call
-         * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
-         */
-        if (skb != oskb) {
-                rcu_assign_pointer(data->skb, skb);
-
-                synchronize_rcu();
-
-                atomic_set(&data->dm_hit_count, dm_hit_limit);
+        } else {
+                mod_timer(&data->send_timer, jiffies + HZ / 10);
         }
 
+        spin_lock_irqsave(&data->lock, flags);
+        swap(data->skb, skb);
+        spin_unlock_irqrestore(&data->lock, flags);
+
+        return skb;
 }
 
-static void send_dm_alert(struct work_struct *unused)
+static void send_dm_alert(struct work_struct *work)
 {
         struct sk_buff *skb;
-        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
+        struct per_cpu_dm_data *data;
 
-        WARN_ON_ONCE(data->cpu != smp_processor_id());
+        data = container_of(work, struct per_cpu_dm_data, dm_alert_work);
 
-        /*
-         * Grab the skb we're about to send
-         */
-        skb = rcu_dereference_protected(data->skb, 1);
-
-        /*
-         * Replace it with a new one
-         */
-        reset_per_cpu_data(data);
+        skb = reset_per_cpu_data(data);
 
-        /*
-         * Ship it!
-         */
         if (skb)
                 genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
-
-        put_cpu_var(dm_cpu_data);
 }
 
 /*
  * This is the timer function to delay the sending of an alert
  * in the event that more drops will arrive during the
- * hysteresis period.  Note that it operates under the timer interrupt
- * so we don't need to disable preemption here
+ * hysteresis period.
  */
-static void sched_send_work(unsigned long unused)
+static void sched_send_work(unsigned long _data)
 {
-        struct per_cpu_dm_data *data =  &get_cpu_var(dm_cpu_data);
-
-        schedule_work_on(smp_processor_id(), &data->dm_alert_work);
+        struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data;
 
-        put_cpu_var(dm_cpu_data);
+        schedule_work(&data->dm_alert_work);
 }
 
 static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -167,33 +138,28 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
         struct nlattr *nla;
         int i;
         struct sk_buff *dskb;
-        struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data);
-
+        struct per_cpu_dm_data *data;
+        unsigned long flags;
 
-        rcu_read_lock();
-        dskb = rcu_dereference(data->skb);
+        local_irq_save(flags);
+        data = &__get_cpu_var(dm_cpu_data);
+        spin_lock(&data->lock);
+        dskb = data->skb;
 
         if (!dskb)
                 goto out;
 
-        if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
-                /*
-                 * we're already at zero, discard this hit
-                 */
-                goto out;
-        }
-
         nlh = (struct nlmsghdr *)dskb->data;
         nla = genlmsg_data(nlmsg_data(nlh));
         msg = nla_data(nla);
         for (i = 0; i < msg->entries; i++) {
                 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
                         msg->points[i].count++;
-                        atomic_inc(&data->dm_hit_count);
                         goto out;
                 }
         }
-
+        if (msg->entries == dm_hit_limit)
+                goto out;
         /*
          * We need to create a new entry
          */
@@ -205,13 +171,11 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
 
         if (!timer_pending(&data->send_timer)) {
                 data->send_timer.expires = jiffies + dm_delay * HZ;
-                add_timer_on(&data->send_timer, smp_processor_id());
+                add_timer(&data->send_timer);
         }
 
 out:
-        rcu_read_unlock();
-        put_cpu_var(dm_cpu_data);
-        return;
+        spin_unlock_irqrestore(&data->lock, flags);
 }
 
 static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location)
@@ -418,11 +382,11 @@ static int __init init_net_drop_monitor(void)
 
         for_each_possible_cpu(cpu) {
                 data = &per_cpu(dm_cpu_data, cpu);
-                data->cpu = cpu;
                 INIT_WORK(&data->dm_alert_work, send_dm_alert);
                 init_timer(&data->send_timer);
-                data->send_timer.data = cpu;
+                data->send_timer.data = (unsigned long)data;
                 data->send_timer.function = sched_send_work;
+                spin_lock_init(&data->lock);
                 reset_per_cpu_data(data);
         }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index a3eddb515d1..d4ce2dc712e 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -616,9 +616,9 @@ static int __sk_prepare_filter(struct sk_filter *fp)
 /**
  *      sk_unattached_filter_create - create an unattached filter
  *      @fprog: the filter program
- *      @sk: the socket to use
+ *      @pfp: the unattached filter that is created
  *
- * Create a filter independent ofr any socket. We first run some
+ * Create a filter independent of any socket. We first run some
  * sanity checks on it to make sure it does not explode on us later.
  * If an error occurs or there is insufficient memory for the filter
  * a negative errno code is returned. On success the return is zero.
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index eb09f8bbbf0..d81d026138f 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2219,9 +2219,7 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
         rcu_read_lock_bh();
         nht = rcu_dereference_bh(tbl->nht);
 
-        for (h = 0; h < (1 << nht->hash_shift); h++) {
-                if (h < s_h)
-                        continue;
+        for (h = s_h; h < (1 << nht->hash_shift); h++) {
                 if (h > s_h)
                         s_idx = 0;
                 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
@@ -2260,9 +2258,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
 
         read_lock_bh(&tbl->lock);
 
-        for (h = 0; h <= PNEIGH_HASHMASK; h++) {
-                if (h < s_h)
-                        continue;
+        for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
@@ -2297,7 +2293,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
         struct neigh_table *tbl;
         int t, family, s_t;
         int proxy = 0;
-        int err = 0;
+        int err;
 
         read_lock(&neigh_tbl_lock);
         family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
@@ -2311,7 +2307,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 
         s_t = cb->args[0];
 
-        for (tbl = neigh_tables, t = 0; tbl && (err >= 0);
+        for (tbl = neigh_tables, t = 0; tbl;
              tbl = tbl->next, t++) {
                 if (t < s_t || (family && tbl->family != family))
                         continue;
@@ -2322,6 +2318,8 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                         err = pneigh_dump_table(tbl, skb, cb);
                 else
                         err = neigh_dump_table(tbl, skb, cb);
+                if (err < 0)
+                        break;
         }
         read_unlock(&neigh_tbl_lock);
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 3d84fb9d887..f9f40b932e4 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -362,22 +362,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
 
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
 {
-        int total_len, eth_len, ip_len, udp_len;
+        int total_len, ip_len, udp_len;
         struct sk_buff *skb;
         struct udphdr *udph;
         struct iphdr *iph;
         struct ethhdr *eth;
 
         udp_len = len + sizeof(*udph);
-        ip_len = eth_len = udp_len + sizeof(*iph);
-        total_len = eth_len + ETH_HLEN + NET_IP_ALIGN;
+        ip_len = udp_len + sizeof(*iph);
+        total_len = ip_len + LL_RESERVED_SPACE(np->dev);
 
-        skb = find_skb(np, total_len, total_len - len);
+        skb = find_skb(np, total_len + np->dev->needed_tailroom,
+                       total_len - len);
         if (!skb)
                 return;
 
         skb_copy_to_linear_data(skb, msg, len);
-        skb->len += len;
+        skb_put(skb, len);
 
         skb_push(skb, sizeof(*udph));
         skb_reset_transport_header(skb);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 016694d6248..d78671e9d54 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3361,7 +3361,7 @@ EXPORT_SYMBOL(kfree_skb_partial);
  * @to: prior buffer
  * @from: buffer to add
  * @fragstolen: pointer to boolean
- *
+ * @delta_truesize: how much more was allocated than was requested
  */
 bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
                       bool *fragstolen, int *delta_truesize)
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d4d61b694fa..dfba343b250 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
 }
 EXPORT_SYMBOL(inet_peer_xrlim_allow);
 
+static void inetpeer_inval_rcu(struct rcu_head *head)
+{
+        struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
+
+        spin_lock_bh(&gc_lock);
+        list_add_tail(&p->gc_list, &gc_list);
+        spin_unlock_bh(&gc_lock);
+
+        schedule_delayed_work(&gc_work, gc_delay);
+}
+
 void inetpeer_invalidate_tree(int family)
 {
         struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family)
         prev = cmpxchg(&base->root, old, new);
         if (prev == old) {
                 base->total = 0;
-                spin_lock(&gc_lock);
-                list_add_tail(&prev->gc_list, &gc_list);
-                spin_unlock(&gc_lock);
-                schedule_delayed_work(&gc_work, gc_delay);
+                call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
         }
 
 out:
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e5c44fc586a..ab09b126423 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -44,6 +44,7 @@ static int ip_forward_finish(struct sk_buff *skb)
         struct ip_options *opt  = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
 
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index a9e519ad6db..c94bbc6f2ba 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1574,6 +1574,7 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
         struct ip_options *opt = &(IPCB(skb)->opt);
 
         IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
 
         if (unlikely(opt->optlen))
                 ip_forward_options(skb);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0c220a41662..74c21b924a7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1561,7 +1561,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                                 neigh_flags = neigh->flags;
                                 neigh_release(neigh);
                         }
-                        if (neigh_flags & NTF_ROUTER) {
+                        if (!(neigh_flags & NTF_ROUTER)) {
                                 RT6_TRACE("purging route %p via non-router but gateway\n",
                                           rt);
                                 return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 17b8c67998b..decc21d19c5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -526,6 +526,7 @@ int ip6_forward(struct sk_buff *skb)
         hdr->hop_limit--;
 
         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
                        ip6_forward_finish);
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index b15dc08643a..461e47c8e95 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1886,6 +1886,8 @@ static inline int ip6mr_forward2_finish(struct sk_buff *skb)
 {
         IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
                          IPSTATS_MIB_OUTFORWDATAGRAMS);
+        IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
+                         IPSTATS_MIB_OUTOCTETS, skb->len);
         return dst_output(skb);
 }
 
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 443591d629c..185f12f4a5f 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -162,6 +162,7 @@ static void l2tp_eth_delete(struct l2tp_session *session)
                 if (dev) {
                         unregister_netdev(dev);
                         spriv->dev = NULL;
+                        module_put(THIS_MODULE);
                 }
         }
 }
@@ -249,6 +250,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
         if (rc < 0)
                 goto out_del_dev;
 
+        __module_get(THIS_MODULE);
         /* Must be done after register_netdev() */
         strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 70614e7affa..61d8b75d268 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -464,10 +464,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                                            sk->sk_bound_dev_if);
                 if (IS_ERR(rt))
                         goto no_route;
-                if (connected)
+                if (connected) {
                         sk_setup_caps(sk, &rt->dst);
-                else
-                        dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
+                } else {
+                        skb_dst_set(skb, &rt->dst);
+                        goto xmit;
+                }
         }
 
         /* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -475,6 +477,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
          */
         skb_dst_set_noref(skb, &rt->dst);
 
+xmit:
         /* Queue the packet to IP for output */
         rc = ip_queue_xmit(skb, &inet->cork.fl);
         rcu_read_unlock();
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 26ddb699d69..c649188314c 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -145,15 +145,20 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
         struct tid_ampdu_rx *tid_rx;
         unsigned long timeout;
 
+        rcu_read_lock();
         tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
-        if (!tid_rx)
+        if (!tid_rx) {
+                rcu_read_unlock();
                 return;
+        }
 
         timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
         if (time_is_after_jiffies(timeout)) {
                 mod_timer(&tid_rx->session_timer, timeout);
+                rcu_read_unlock();
                 return;
         }
+        rcu_read_unlock();
 
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 495831ee48f..e9cecca5c44 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -533,16 +533,16 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
                 sinfo.filled = 0;
                 sta_set_sinfo(sta, &sinfo);
 
-                if (sinfo.filled | STATION_INFO_TX_BITRATE)
+                if (sinfo.filled & STATION_INFO_TX_BITRATE)
                         data[i] = 100000 *
                                 cfg80211_calculate_bitrate(&sinfo.txrate);
                 i++;
-                if (sinfo.filled | STATION_INFO_RX_BITRATE)
+                if (sinfo.filled & STATION_INFO_RX_BITRATE)
                         data[i] = 100000 *
                                 cfg80211_calculate_bitrate(&sinfo.rxrate);
                 i++;
 
-                if (sinfo.filled | STATION_INFO_SIGNAL_AVG)
+                if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
                         data[i] = (u8)sinfo.signal_avg;
                 i++;
         } else {
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d4c19a7773d..8664111d056 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -637,6 +637,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 ieee80211_configure_filter(local);
                 break;
         default:
+                mutex_lock(&local->mtx);
+                if (local->hw_roc_dev == sdata->dev &&
+                    local->hw_roc_channel) {
+                        /* ignore return value since this is racy */
+                        drv_cancel_remain_on_channel(local);
+                        ieee80211_queue_work(&local->hw, &local->hw_roc_done);
+                }
+                mutex_unlock(&local->mtx);
+
+                flush_work(&local->hw_roc_start);
+                flush_work(&local->hw_roc_done);
+
                 flush_work(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 04c30630898..91d84cc77bb 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1220,6 +1220,22 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
         sdata->vif.bss_conf.qos = true;
 }
 
+static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+        lockdep_assert_held(&sdata->local->mtx);
+
+        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
+                                IEEE80211_STA_BEACON_POLL);
+        ieee80211_run_deferred_scan(sdata->local);
+}
+
+static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
+{
+        mutex_lock(&sdata->local->mtx);
+        __ieee80211_stop_poll(sdata);
+        mutex_unlock(&sdata->local->mtx);
+}
+
 static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
                                            u16 capab, bool erp_valid, u8 erp)
 {
@@ -1285,8 +1301,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
         sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
 
         /* just to be sure */
-        sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                                IEEE80211_STA_BEACON_POLL);
+        ieee80211_stop_poll(sdata);
 
         ieee80211_led_assoc(local, 1);
 
@@ -1456,8 +1471,7 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
                 return;
         }
 
-        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                          IEEE80211_STA_BEACON_POLL);
+        __ieee80211_stop_poll(sdata);
 
         mutex_lock(&local->iflist_mtx);
         ieee80211_recalc_ps(local, -1);
@@ -1477,7 +1491,6 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
                   round_jiffies_up(jiffies +
                                    IEEE80211_CONNECTION_IDLE_TIME));
 out:
-        ieee80211_run_deferred_scan(local);
         mutex_unlock(&local->mtx);
 }
 
@@ -2408,7 +2421,11 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 net_dbg_ratelimited("%s: cancelling probereq poll due to a received beacon\n",
                                     sdata->name);
 #endif
+                mutex_lock(&local->mtx);
                 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
+                ieee80211_run_deferred_scan(local);
+                mutex_unlock(&local->mtx);
+
                 mutex_lock(&local->iflist_mtx);
                 ieee80211_recalc_ps(local, -1);
                 mutex_unlock(&local->iflist_mtx);
@@ -2595,8 +2612,7 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[DEAUTH_DISASSOC_LEN];
 
-        ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
-                          IEEE80211_STA_BEACON_POLL);
+        ieee80211_stop_poll(sdata);
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                false, frame_buf);
@@ -2874,8 +2890,7 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
         u32 flags;
 
         if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL |
-                                        IEEE80211_STA_CONNECTION_POLL);
+                __ieee80211_stop_poll(sdata);
 
                 /* let's probe the connection once */
                 flags = sdata->local->hw.flags;
@@ -2944,7 +2959,10 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
         if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
                 add_timer(&ifmgd->chswitch_timer);
         ieee80211_sta_reset_beacon_monitor(sdata);
+
+        mutex_lock(&sdata->local->mtx);
         ieee80211_restart_sta_timer(sdata);
+        mutex_unlock(&sdata->local->mtx);
 }
 #endif
 
@@ -3106,7 +3124,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
         }
 
         local->oper_channel = cbss->channel;
-        ieee80211_hw_config(local, 0);
+        ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
 
         if (!have_sta) {
                 u32 rates = 0, basic_rates = 0;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f054e94901a..935aa4b6dee 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -234,6 +234,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
                 return;
         }
 
+        /* was never transmitted */
+        if (local->hw_roc_skb) {
+                u64 cookie;
+
+                cookie = local->hw_roc_cookie ^ 2;
+
+                cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
+                                        local->hw_roc_skb->data,
+                                        local->hw_roc_skb->len, false,
+                                        GFP_KERNEL);
+
+                kfree_skb(local->hw_roc_skb);
+                local->hw_roc_skb = NULL;
+                local->hw_roc_skb_for_status = NULL;
+        }
+
         if (!local->hw_roc_for_tx)
                 cfg80211_remain_on_channel_expired(local->hw_roc_dev,
                                                    local->hw_roc_cookie,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f5b1638fbf8..de455f8bbb9 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -378,7 +378,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
         /* make the station visible */
         sta_info_hash_add(local, sta);
 
-        list_add(&sta->list, &local->sta_list);
+        list_add_rcu(&sta->list, &local->sta_list);
 
         set_sta_flag(sta, WLAN_STA_INSERTED);
 
@@ -688,7 +688,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
         if (ret)
                 return ret;
 
-        list_del(&sta->list);
+        list_del_rcu(&sta->list);
 
         mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 847215bb2a6..e453212fa17 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1737,7 +1737,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
         __le16 fc;
         struct ieee80211_hdr hdr;
         struct ieee80211s_hdr mesh_hdr __maybe_unused;
-        struct mesh_path __maybe_unused *mppath = NULL;
+        struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
         const u8 *encaps_data;
         int encaps_len, skip_header_bytes;
         int nh_pos, h_pos;
@@ -1803,8 +1803,11 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                         goto fail;
                 }
                 rcu_read_lock();
-                if (!is_multicast_ether_addr(skb->data))
-                        mppath = mpp_path_lookup(skb->data, sdata);
+                if (!is_multicast_ether_addr(skb->data)) {
+                        mpath = mesh_path_lookup(skb->data, sdata);
+                        if (!mpath)
+                                mppath = mpp_path_lookup(skb->data, sdata);
+                }
 
                 /*
                  * Use address extension if it is a packet from
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index a44c6807df0..8dd4712620f 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1271,7 +1271,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         enum ieee80211_sta_state state;
 
                         for (state = IEEE80211_STA_NOTEXIST;
-                             state < sta->sta_state - 1; state++)
+                             state < sta->sta_state; state++)
                                 WARN_ON(drv_sta_state(local, sta->sdata, sta,
                                                       state, state + 1));
                 }
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 46d69d7f1bb..31f50bc3a31 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
                 return 0;
 
         /* RTP port is even */
-        port &= htons(~1);
-        rtp_port = port;
-        rtcp_port = htons(ntohs(port) + 1);
+        rtp_port = port & ~htons(1);
+        rtcp_port = port | htons(1);
 
         /* Create expect for RTP */
         if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 0a96a43108e..1686ca1b53a 100644
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -32,13 +32,13 @@ MODULE_ALIAS("ipt_HMARK");
 MODULE_ALIAS("ip6t_HMARK");
 
 struct hmark_tuple {
-        u32                     src;
-        u32                     dst;
+        __be32                  src;
+        __be32                  dst;
         union hmark_ports       uports;
-        uint8_t                 proto;
+        u8                      proto;
 };
 
-static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
+static inline __be32 hmark_addr6_mask(const __be32 *addr32, const __be32 *mask)
 {
         return (addr32[0] & mask[0]) ^
                (addr32[1] & mask[1]) ^
@@ -46,8 +46,8 @@ static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
                (addr32[3] & mask[3]);
 }
 
-static inline u32
-hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
+static inline __be32
+hmark_addr_mask(int l3num, const __be32 *addr32, const __be32 *mask)
 {
         switch (l3num) {
         case AF_INET:
@@ -58,6 +58,22 @@ hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
         return 0;
 }
 
+static inline void hmark_swap_ports(union hmark_ports *uports,
+                                    const struct xt_hmark_info *info)
+{
+        union hmark_ports hp;
+        u16 src, dst;
+
+        hp.b32 = (uports->b32 & info->port_mask.b32) | info->port_set.b32;
+        src = ntohs(hp.b16.src);
+        dst = ntohs(hp.b16.dst);
+
+        if (dst > src)
+                uports->v32 = (dst << 16) | src;
+        else
+                uports->v32 = (src << 16) | dst;
+}
+
 static int
 hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
                     const struct xt_hmark_info *info)
@@ -74,22 +90,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
         otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
         rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
 
-        t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.all,
-                                 info->src_mask.all);
-        t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.all,
-                                 info->dst_mask.all);
+        t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.ip6,
+                                 info->src_mask.ip6);
+        t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.ip6,
+                                 info->dst_mask.ip6);
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
 
         t->proto = nf_ct_protonum(ct);
         if (t->proto != IPPROTO_ICMP) {
-                t->uports.p16.src = otuple->src.u.all;
-                t->uports.p16.dst = rtuple->src.u.all;
-                t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
-                                info->port_set.v32;
-                if (t->uports.p16.dst < t->uports.p16.src)
-                        swap(t->uports.p16.dst, t->uports.p16.src);
+                t->uports.b16.src = otuple->src.u.all;
+                t->uports.b16.dst = rtuple->src.u.all;
+                hmark_swap_ports(&t->uports, info);
         }
 
         return 0;
@@ -98,15 +111,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
 #endif
 }
 
+/* This hash function is endian independent, to ensure consistent hashing if
+ * the cluster is composed of big and little endian systems. */
 static inline u32
 hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info)
 {
         u32 hash;
+        u32 src = ntohl(t->src);
+        u32 dst = ntohl(t->dst);
 
-        if (t->dst < t->src)
-                swap(t->src, t->dst);
+        if (dst < src)
+                swap(src, dst);
 
-        hash = jhash_3words(t->src, t->dst, t->uports.v32, info->hashrnd);
+        hash = jhash_3words(src, dst, t->uports.v32, info->hashrnd);
         hash = hash ^ (t->proto & info->proto_mask);
 
         return (((u64)hash * info->hmodulus) >> 32) + info->hoffset;
@@ -126,11 +143,7 @@ hmark_set_tuple_ports(const struct sk_buff *skb, unsigned int nhoff,
         if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0)
                 return;
 
-        t->uports.v32 = (t->uports.v32 & info->port_mask.v32) |
-                        info->port_set.v32;
-
-        if (t->uports.p16.dst < t->uports.p16.src)
-                swap(t->uports.p16.dst, t->uports.p16.src);
+        hmark_swap_ports(&t->uports, info);
 }
 
 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
@@ -178,8 +191,8 @@ hmark_pkt_set_htuple_ipv6(const struct sk_buff *skb, struct hmark_tuple *t,
                         return -1;
         }
 noicmp:
-        t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.all);
-        t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.all);
+        t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.ip6);
+        t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.ip6);
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
@@ -255,11 +268,8 @@ hmark_pkt_set_htuple_ipv4(const struct sk_buff *skb, struct hmark_tuple *t,
                 }
         }
 
-        t->src = (__force u32) ip->saddr;
-        t->dst = (__force u32) ip->daddr;
-
-        t->src &= info->src_mask.ip;
-        t->dst &= info->dst_mask.ip;
+        t->src = ip->saddr & info->src_mask.ip;
+        t->dst = ip->daddr & info->dst_mask.ip;
 
         if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
                 return 0;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 3f339b19d14..17a707db40e 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,6 +292,9 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
 
         pr_debug("%p\n", sk);
 
+        if (llcp_sock == NULL)
+                return -EBADFD;
+
         addr->sa_family = AF_NFC;
         *len = sizeof(struct sockaddr_nfc_llcp);
 
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 04040476082..21fde99e5c5 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -71,7 +71,9 @@ static void rpc_purge_list(wait_queue_head_t *waitq, struct list_head *head,
                 msg->errno = err;
                 destroy_msg(msg);
         } while (!list_empty(head));
-        wake_up(waitq);
+
+        if (waitq)
+                wake_up(waitq);
 }
 
 static void
@@ -91,11 +93,9 @@ rpc_timeout_upcall_queue(struct work_struct *work)
         }
         dentry = dget(pipe->dentry);
         spin_unlock(&pipe->lock);
-        if (dentry) {
-                rpc_purge_list(&RPC_I(dentry->d_inode)->waitq,
-                               &free_list, destroy_msg, -ETIMEDOUT);
-                dput(dentry);
-        }
+        rpc_purge_list(dentry ? &RPC_I(dentry->d_inode)->waitq : NULL,
+                        &free_list, destroy_msg, -ETIMEDOUT);
+        dput(dentry);
 }
 
 ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 7e9baaa1e54..3ee7461926d 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1374,7 +1374,8 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
                                                 sizeof(req->rq_snd_buf));
                 return bc_send(req);
         } else {
-                /* Nothing to do to drop request */
+                /* drop request */
+                xprt_free_bc_request(req);
                 return 0;
         }
 }
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index d2a19b0ff71..89baa332841 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -42,6 +42,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
         cfg80211_hold_bss(bss_from_pub(bss));
         wdev->current_bss = bss_from_pub(bss);
 
+        wdev->sme_state = CFG80211_SME_CONNECTED;
         cfg80211_upload_connect_keys(wdev);
 
         nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
@@ -60,7 +61,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
         struct cfg80211_event *ev;
         unsigned long flags;
 
-        CFG80211_DEV_WARN_ON(!wdev->ssid_len);
+        CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
 
         ev = kzalloc(sizeof(*ev), gfp);
         if (!ev)
@@ -115,9 +116,11 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
 #ifdef CONFIG_CFG80211_WEXT
         wdev->wext.ibss.channel = params->channel;
 #endif
+        wdev->sme_state = CFG80211_SME_CONNECTING;
         err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
         if (err) {
                 wdev->connect_keys = NULL;
+                wdev->sme_state = CFG80211_SME_IDLE;
                 return err;
         }
 
@@ -169,6 +172,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
         }
 
         wdev->current_bss = NULL;
+        wdev->sme_state = CFG80211_SME_IDLE;
         wdev->ssid_len = 0;
 #ifdef CONFIG_CFG80211_WEXT
         if (!nowext)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 55d99466bab..8f2d68fc3a4 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -935,6 +935,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                   enum nl80211_iftype iftype)
 {
         struct wireless_dev *wdev_iter;
+        u32 used_iftypes = BIT(iftype);
         int num[NUM_NL80211_IFTYPES];
         int total = 1;
         int i, j;
@@ -961,6 +962,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
 
                 num[wdev_iter->iftype]++;
                 total++;
+                used_iftypes |= BIT(wdev_iter->iftype);
         }
         mutex_unlock(&rdev->devlist_mtx);
 
@@ -970,6 +972,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
         for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
                 const struct ieee80211_iface_combination *c;
                 struct ieee80211_iface_limit *limits;
+                u32 all_iftypes = 0;
 
                 c = &rdev->wiphy.iface_combinations[i];
 
@@ -984,6 +987,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                         if (rdev->wiphy.software_iftypes & BIT(iftype))
                                 continue;
                         for (j = 0; j < c->n_limits; j++) {
+                                all_iftypes |= limits[j].types;
                                 if (!(limits[j].types & BIT(iftype)))
                                         continue;
                                 if (limits[j].max < num[iftype])
@@ -991,7 +995,20 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
                                 limits[j].max -= num[iftype];
                         }
                 }
-                /* yay, it fits */
+
+                /*
+                 * Finally check that all iftypes that we're currently
+                 * using are actually part of this combination. If they
+                 * aren't then we can't use this combination and have
+                 * to continue to the next.
+                 */
+                if ((all_iftypes & used_iftypes) != used_iftypes)
+                        goto cont;
+
+                /*
+                 * This combination covered all interface types and
+                 * supported the requested numbers, so we're good.
+                 */
                 kfree(limits);
                 return 0;
  cont:
diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
index a68aed7fce0..ec2118d0e27 100644
--- a/sound/core/compress_offload.c
+++ b/sound/core/compress_offload.c
@@ -502,10 +502,8 @@ static int snd_compr_pause(struct snd_compr_stream *stream)
         if (stream->runtime->state != SNDRV_PCM_STATE_RUNNING)
                 return -EPERM;
         retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_PAUSE_PUSH);
-        if (!retval) {
+        if (!retval)
                 stream->runtime->state = SNDRV_PCM_STATE_PAUSED;
-                wake_up(&stream->runtime->sleep);
-        }
         return retval;
 }
 
@@ -544,6 +542,10 @@ static int snd_compr_stop(struct snd_compr_stream *stream)
         if (!retval) {
                 stream->runtime->state = SNDRV_PCM_STATE_SETUP;
                 wake_up(&stream->runtime->sleep);
+                stream->runtime->hw_pointer = 0;
+                stream->runtime->app_pointer = 0;
+                stream->runtime->total_bytes_available = 0;
+                stream->runtime->total_bytes_transferred = 0;
         }
         return retval;
 }
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 2b6392be451..02763827dde 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2484,9 +2484,9 @@ static void azx_notifier_unregister(struct azx *chip)
 static int DELAYED_INIT_MARK azx_first_init(struct azx *chip);
 static int DELAYED_INIT_MARK azx_probe_continue(struct azx *chip);
 
+#ifdef SUPPORT_VGA_SWITCHEROO
 static struct pci_dev __devinit *get_bound_vga(struct pci_dev *pci);
 
-#ifdef SUPPORT_VGA_SWITCHEROO
 static void azx_vs_set_state(struct pci_dev *pci,
                              enum vga_switcheroo_state state)
 {
@@ -2578,6 +2578,7 @@ static int __devinit register_vga_switcheroo(struct azx *chip)
 #else
 #define init_vga_switcheroo(chip)               /* NOP */
 #define register_vga_switcheroo(chip)           0
+#define check_hdmi_disabled(pci)        false
 #endif /* SUPPORT_VGA_SWITCHER */
 
 /*
@@ -2638,6 +2639,7 @@ static int azx_dev_free(struct snd_device *device)
         return azx_free(device->device_data);
 }
 
+#ifdef SUPPORT_VGA_SWITCHEROO
 /*
  * Check of disabled HDMI controller by vga-switcheroo
  */
@@ -2670,12 +2672,13 @@ static bool __devinit check_hdmi_disabled(struct pci_dev *pci)
         struct pci_dev *p = get_bound_vga(pci);
 
         if (p) {
-                if (vga_default_device() && p != vga_default_device())
+                if (vga_switcheroo_get_client_state(p) == VGA_SWITCHEROO_OFF)
                         vga_inactive = true;
                 pci_dev_put(p);
         }
         return vga_inactive;
 }
+#endif /* SUPPORT_VGA_SWITCHEROO */
 
 /*
  * white/black-listing for position_fix
@@ -3351,6 +3354,11 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         { PCI_DEVICE(0x6549, 0x1200),
           .driver_data = AZX_DRIVER_TERA | AZX_DCAPS_NO_64BIT },
         /* Creative X-Fi (CA0110-IBG) */
+        /* CTHDA chips */
+        { PCI_DEVICE(0x1102, 0x0010),
+          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
+        { PCI_DEVICE(0x1102, 0x0012),
+          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
 #if !defined(CONFIG_SND_CTXFI) && !defined(CONFIG_SND_CTXFI_MODULE)
         /* the following entry conflicts with snd-ctxfi driver,
          * as ctxfi driver mutates from HD-audio to native mode with
@@ -3367,11 +3375,6 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
           .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
           AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
 #endif
-        /* CTHDA chips */
-        { PCI_DEVICE(0x1102, 0x0010),
-          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
-        { PCI_DEVICE(0x1102, 0x0012),
-          .driver_data = AZX_DRIVER_CTHDA | AZX_DCAPS_PRESET_CTHDA },
         /* Vortex86MX */
         { PCI_DEVICE(0x17f3, 0x3010), .driver_data = AZX_DRIVER_GENERIC },
         /* VMware HDAudio */
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 3acb5824ad3..172370b3793 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4061,7 +4061,7 @@ static void cx_auto_init_digital(struct hda_codec *codec)
 static int cx_auto_init(struct hda_codec *codec)
 {
         struct conexant_spec *spec = codec->spec;
-        /*snd_hda_sequence_write(codec, cx_auto_init_verbs);*/
+        snd_hda_gen_apply_verbs(codec);
         cx_auto_init_output(codec);
         cx_auto_init_input(codec);
         cx_auto_init_digital(codec);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 224410e8e9e..f8f4906e498 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1896,6 +1896,7 @@ static int alc_init(struct hda_codec *codec)
         alc_fix_pll(codec);
         alc_auto_init_amp(codec, spec->init_amp);
 
+        snd_hda_gen_apply_verbs(codec);
         alc_init_special_input_src(codec);
         alc_auto_init_std(codec);
 
@@ -6439,6 +6440,7 @@ enum {
         ALC662_FIXUP_ASUS_MODE7,
         ALC662_FIXUP_ASUS_MODE8,
         ALC662_FIXUP_NO_JACK_DETECT,
+        ALC662_FIXUP_ZOTAC_Z68,
 };
 
 static const struct alc_fixup alc662_fixups[] = {
@@ -6588,6 +6590,13 @@ static const struct alc_fixup alc662_fixups[] = {
                 .type = ALC_FIXUP_FUNC,
                 .v.func = alc_fixup_no_jack_detect,
         },
+        [ALC662_FIXUP_ZOTAC_Z68] = {
+                .type = ALC_FIXUP_PINS,
+                .v.pins = (const struct alc_pincfg[]) {
+                        { 0x1b, 0x02214020 }, /* Front HP */
+                        { }
+                }
+        },
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6601,6 +6610,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
         SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
         SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
+        SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
         SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
 
 #if 0
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index a75c3766aed..0418fa11e6b 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -99,8 +99,9 @@ static void wm2000_reset(struct wm2000_priv *wm2000)
 }
 
 static int wm2000_poll_bit(struct i2c_client *i2c,
-                           unsigned int reg, u8 mask, int timeout)
+                           unsigned int reg, u8 mask)
 {
+        int timeout = 4000;
         int val;
 
         val = wm2000_read(i2c, reg);
@@ -119,7 +120,7 @@ static int wm2000_poll_bit(struct i2c_client *i2c,
 static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int ret, timeout;
+        int ret;
 
         BUG_ON(wm2000->anc_mode != ANC_OFF);
 
@@ -140,13 +141,13 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 
         /* Wait for ANC engine to become ready */
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "ANC engine failed to reset\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_BOOT_COMPLETE, 1)) {
+                             WM2000_STATUS_BOOT_COMPLETE)) {
                 dev_err(&i2c->dev, "ANC engine failed to initialise\n");
                 return -ETIMEDOUT;
         }
@@ -173,16 +174,13 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
         dev_dbg(&i2c->dev, "Download complete\n");
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_MOUSE_ENABLE |
                              WM2000_MODE_THERMAL_ENABLE);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_MOUSE_ENABLE |
                              WM2000_MODE_THERMAL_ENABLE);
@@ -201,9 +199,8 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, timeout)) {
-                dev_err(&i2c->dev, "Timed out waiting for device after %dms\n",
-                        timeout * 10);
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
+                dev_err(&i2c->dev, "Timed out waiting for device\n");
                 return -ETIMEDOUT;
         }
 
@@ -218,28 +215,25 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 static int wm2000_power_down(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, 248 / 4);
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_POWER_DOWN);
         } else {
-                timeout = 10;
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_POWER_DOWN);
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_POWER_DOWN_COMPLETE, timeout)) {
+                             WM2000_STATUS_POWER_DOWN_COMPLETE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC power down\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC engine idle\n");
                 return -ETIMEDOUT;
         }
@@ -268,13 +262,13 @@ static int wm2000_enter_bypass(struct i2c_client *i2c, int analogue)
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_ANC_DISABLED, 10)) {
+                             WM2000_STATUS_ANC_DISABLED)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC disable\n");
                 return -ETIMEDOUT;
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT,
-                             WM2000_ANC_ENG_IDLE, 1)) {
+                             WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev, "Timeout waiting for ANC engine idle\n");
                 return -ETIMEDOUT;
         }
@@ -311,7 +305,7 @@ static int wm2000_exit_bypass(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, 10)) {
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
                 dev_err(&i2c->dev, "Timed out waiting for MOUSE\n");
                 return -ETIMEDOUT;
         }
@@ -325,38 +319,32 @@ static int wm2000_exit_bypass(struct i2c_client *i2c, int analogue)
 static int wm2000_enter_standby(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         BUG_ON(wm2000->anc_mode != ANC_ACTIVE);
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PD_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_STANDBY_ENTRY);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_STANDBY_ENTRY);
         }
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_ANC_DISABLED, timeout)) {
+                             WM2000_STATUS_ANC_DISABLED)) {
                 dev_err(&i2c->dev,
                         "Timed out waiting for ANC disable after 1ms\n");
                 return -ETIMEDOUT;
         }
 
-        if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT, WM2000_ANC_ENG_IDLE,
-                             1)) {
+        if (!wm2000_poll_bit(i2c, WM2000_REG_ANC_STAT, WM2000_ANC_ENG_IDLE)) {
                 dev_err(&i2c->dev,
-                        "Timed out waiting for standby after %dms\n",
-                        timeout * 10);
+                        "Timed out waiting for standby\n");
                 return -ETIMEDOUT;
         }
 
@@ -374,23 +362,19 @@ static int wm2000_enter_standby(struct i2c_client *i2c, int analogue)
 static int wm2000_exit_standby(struct i2c_client *i2c, int analogue)
 {
         struct wm2000_priv *wm2000 = dev_get_drvdata(&i2c->dev);
-        int timeout;
 
         BUG_ON(wm2000->anc_mode != ANC_STANDBY);
 
         wm2000_write(i2c, WM2000_REG_SYS_CTL1, 0);
 
         if (analogue) {
-                timeout = 248;
-                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, timeout / 4);
+                wm2000_write(i2c, WM2000_REG_ANA_VMID_PU_TIME, 248 / 4);
 
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_ANA_SEQ_INCLUDE |
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_MOUSE_ENABLE);
         } else {
-                timeout = 10;
-
                 wm2000_write(i2c, WM2000_REG_SYS_MODE_CNTRL,
                              WM2000_MODE_THERMAL_ENABLE |
                              WM2000_MODE_MOUSE_ENABLE);
@@ -400,9 +384,8 @@ static int wm2000_exit_standby(struct i2c_client *i2c, int analogue)
         wm2000_write(i2c, WM2000_REG_SYS_CTL2, WM2000_ANC_INT_N_CLR);
 
         if (!wm2000_poll_bit(i2c, WM2000_REG_SYS_STATUS,
-                             WM2000_STATUS_MOUSE_ACTIVE, timeout)) {
-                dev_err(&i2c->dev, "Timed out waiting for MOUSE after %dms\n",
-                        timeout * 10);
+                             WM2000_STATUS_MOUSE_ACTIVE)) {
+                dev_err(&i2c->dev, "Timed out waiting for MOUSE\n");
                 return -ETIMEDOUT;
         }
 
diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
index 993639d694c..aa8c98b628d 100644
--- a/sound/soc/codecs/wm8994.c
+++ b/sound/soc/codecs/wm8994.c
@@ -46,6 +46,39 @@
 #define WM8994_NUM_DRC 3
 #define WM8994_NUM_EQ  3
 
+static struct {
+        unsigned int reg;
+        unsigned int mask;
+} wm8994_vu_bits[] = {
+        { WM8994_LEFT_LINE_INPUT_1_2_VOLUME, WM8994_IN1_VU },
+        { WM8994_RIGHT_LINE_INPUT_1_2_VOLUME, WM8994_IN1_VU },
+        { WM8994_LEFT_LINE_INPUT_3_4_VOLUME, WM8994_IN2_VU },
+        { WM8994_RIGHT_LINE_INPUT_3_4_VOLUME, WM8994_IN2_VU },
+        { WM8994_SPEAKER_VOLUME_LEFT, WM8994_SPKOUT_VU },
+        { WM8994_SPEAKER_VOLUME_RIGHT, WM8994_SPKOUT_VU },
+        { WM8994_LEFT_OUTPUT_VOLUME, WM8994_HPOUT1_VU },
+        { WM8994_RIGHT_OUTPUT_VOLUME, WM8994_HPOUT1_VU },
+        { WM8994_LEFT_OPGA_VOLUME, WM8994_MIXOUT_VU },
+        { WM8994_RIGHT_OPGA_VOLUME, WM8994_MIXOUT_VU },
+
+        { WM8994_AIF1_DAC1_LEFT_VOLUME, WM8994_AIF1DAC1_VU },
+        { WM8994_AIF1_DAC1_RIGHT_VOLUME, WM8994_AIF1DAC1_VU },
+        { WM8994_AIF1_DAC2_LEFT_VOLUME, WM8994_AIF1DAC2_VU },
+        { WM8994_AIF1_DAC2_RIGHT_VOLUME, WM8994_AIF1DAC2_VU },
+        { WM8994_AIF2_DAC_LEFT_VOLUME, WM8994_AIF2DAC_VU },
+        { WM8994_AIF2_DAC_RIGHT_VOLUME, WM8994_AIF2DAC_VU },
+        { WM8994_AIF1_ADC1_LEFT_VOLUME, WM8994_AIF1ADC1_VU },
+        { WM8994_AIF1_ADC1_RIGHT_VOLUME, WM8994_AIF1ADC1_VU },
+        { WM8994_AIF1_ADC2_LEFT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_AIF1_ADC2_RIGHT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_AIF2_ADC_LEFT_VOLUME, WM8994_AIF2ADC_VU },
+        { WM8994_AIF2_ADC_RIGHT_VOLUME, WM8994_AIF1ADC2_VU },
+        { WM8994_DAC1_LEFT_VOLUME, WM8994_DAC1_VU },
+        { WM8994_DAC1_RIGHT_VOLUME, WM8994_DAC1_VU },
+        { WM8994_DAC2_LEFT_VOLUME, WM8994_DAC2_VU },
+        { WM8994_DAC2_RIGHT_VOLUME, WM8994_DAC2_VU },
+};
+
 static int wm8994_drc_base[] = {
         WM8994_AIF1_DRC1_1,
         WM8994_AIF1_DRC2_1,
@@ -989,6 +1022,7 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
         struct snd_soc_codec *codec = w->codec;
         struct wm8994 *control = codec->control_data;
         int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
+        int i;
         int dac;
         int adc;
         int val;
@@ -1047,6 +1081,13 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
                                     WM8994_AIF1DAC2L_ENA);
                 break;
 
+        case SND_SOC_DAPM_POST_PMU:
+                for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                        snd_soc_write(codec, wm8994_vu_bits[i].reg,
+                                      snd_soc_read(codec,
+                                                   wm8994_vu_bits[i].reg));
+                break;
+
         case SND_SOC_DAPM_PRE_PMD:
         case SND_SOC_DAPM_POST_PMD:
                 snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
@@ -1072,6 +1113,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
                       struct snd_kcontrol *kcontrol, int event)
 {
         struct snd_soc_codec *codec = w->codec;
+        int i;
         int dac;
         int adc;
         int val;
@@ -1122,6 +1164,13 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
                                     WM8994_AIF2DACR_ENA);
                 break;
 
+        case SND_SOC_DAPM_POST_PMU:
+                for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                        snd_soc_write(codec, wm8994_vu_bits[i].reg,
+                                      snd_soc_read(codec,
+                                                   wm8994_vu_bits[i].reg));
+                break;
+
         case SND_SOC_DAPM_PRE_PMD:
         case SND_SOC_DAPM_POST_PMD:
                 snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
@@ -1190,17 +1239,19 @@ static int late_enable_ev(struct snd_soc_dapm_widget *w,
         switch (event) {
         case SND_SOC_DAPM_PRE_PMU:
                 if (wm8994->aif1clk_enable) {
-                        aif1clk_ev(w, kcontrol, event);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMU);
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK,
                                             WM8994_AIF1CLK_ENA);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMU);
                         wm8994->aif1clk_enable = 0;
                 }
                 if (wm8994->aif2clk_enable) {
-                        aif2clk_ev(w, kcontrol, event);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMU);
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK,
                                             WM8994_AIF2CLK_ENA);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMU);
                         wm8994->aif2clk_enable = 0;
                 }
                 break;
@@ -1221,15 +1272,17 @@ static int late_disable_ev(struct snd_soc_dapm_widget *w,
         switch (event) {
         case SND_SOC_DAPM_POST_PMD:
                 if (wm8994->aif1clk_disable) {
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMD);
                         snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
                                             WM8994_AIF1CLK_ENA_MASK, 0);
-                        aif1clk_ev(w, kcontrol, event);
+                        aif1clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMD);
                         wm8994->aif1clk_disable = 0;
                 }
                 if (wm8994->aif2clk_disable) {
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_PRE_PMD);
                         snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
                                             WM8994_AIF2CLK_ENA_MASK, 0);
-                        aif2clk_ev(w, kcontrol, event);
+                        aif2clk_ev(w, kcontrol, SND_SOC_DAPM_POST_PMD);
                         wm8994->aif2clk_disable = 0;
                 }
                 break;
@@ -1527,9 +1580,11 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
 
 static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
 SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
-                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                    SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
-                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
+                    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
+                    SND_SOC_DAPM_PRE_PMD),
 SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
 SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
                    left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
@@ -3879,39 +3934,11 @@ static int wm8994_codec_probe(struct snd_soc_codec *codec)
 
         pm_runtime_put(codec->dev);
 
-        /* Latch volume updates (right only; we always do left then right). */
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC1_LEFT_VOLUME,
-                            WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC1_RIGHT_VOLUME,
-                            WM8994_AIF1DAC1_VU, WM8994_AIF1DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC2_LEFT_VOLUME,
-                            WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_DAC2_RIGHT_VOLUME,
-                            WM8994_AIF1DAC2_VU, WM8994_AIF1DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_DAC_LEFT_VOLUME,
-                            WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_DAC_RIGHT_VOLUME,
-                            WM8994_AIF2DAC_VU, WM8994_AIF2DAC_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC1_LEFT_VOLUME,
-                            WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC1_RIGHT_VOLUME,
-                            WM8994_AIF1ADC1_VU, WM8994_AIF1ADC1_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC2_LEFT_VOLUME,
-                            WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF1_ADC2_RIGHT_VOLUME,
-                            WM8994_AIF1ADC2_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_ADC_LEFT_VOLUME,
-                            WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_AIF2_ADC_RIGHT_VOLUME,
-                            WM8994_AIF2ADC_VU, WM8994_AIF1ADC2_VU);
-        snd_soc_update_bits(codec, WM8994_DAC1_LEFT_VOLUME,
-                            WM8994_DAC1_VU, WM8994_DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_DAC1_RIGHT_VOLUME,
-                            WM8994_DAC1_VU, WM8994_DAC1_VU);
-        snd_soc_update_bits(codec, WM8994_DAC2_LEFT_VOLUME,
-                            WM8994_DAC2_VU, WM8994_DAC2_VU);
-        snd_soc_update_bits(codec, WM8994_DAC2_RIGHT_VOLUME,
-                            WM8994_DAC2_VU, WM8994_DAC2_VU);
+        /* Latch volume update bits */
+        for (i = 0; i < ARRAY_SIZE(wm8994_vu_bits); i++)
+                snd_soc_update_bits(codec, wm8994_vu_bits[i].reg,
+                                    wm8994_vu_bits[i].mask,
+                                    wm8994_vu_bits[i].mask);
 
         /* Set the low bit of the 3D stereo depth so TLV matches */
         snd_soc_update_bits(codec, WM8994_AIF1_DAC1_FILTERS_2,
diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c
index f23700359c6..080327414c6 100644
--- a/sound/soc/fsl/imx-audmux.c
+++ b/sound/soc/fsl/imx-audmux.c
@@ -26,6 +26,7 @@
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <linux/pinctrl/consumer.h>
 
 #include "imx-audmux.h"
 
@@ -249,6 +250,7 @@ EXPORT_SYMBOL_GPL(imx_audmux_v2_configure_port);
 static int __devinit imx_audmux_probe(struct platform_device *pdev)
 {
         struct resource *res;
+        struct pinctrl *pinctrl;
         const struct of_device_id *of_id =
                         of_match_device(imx_audmux_dt_ids, &pdev->dev);
 
@@ -257,6 +259,12 @@ static int __devinit imx_audmux_probe(struct platform_device *pdev)
         if (!audmux_base)
                 return -EADDRNOTAVAIL;
 
+        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+        if (IS_ERR(pinctrl)) {
+                dev_err(&pdev->dev, "setup pinctrl failed!");
+                return PTR_ERR(pinctrl);
+        }
+
         audmux_clk = clk_get(&pdev->dev, "audmux");
         if (IS_ERR(audmux_clk)) {
                 dev_dbg(&pdev->dev, "cannot get clock: %ld\n",
diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
index 90ee77d2409..89eae93445c 100644
--- a/sound/soc/soc-dapm.c
+++ b/sound/soc/soc-dapm.c
@@ -913,7 +913,7 @@ static int is_connected_input_ep(struct snd_soc_dapm_widget *widget,
                         /* do we need to add this widget to the list ? */
                         if (list) {
                                 int err;
-                                err = dapm_list_add_widget(list, path->sink);
+                                err = dapm_list_add_widget(list, path->source);
                                 if (err < 0) {
                                         dev_err(widget->dapm->dev, "could not add widget %s\n",
                                                 widget->name);
@@ -954,7 +954,7 @@ int snd_soc_dapm_dai_get_connected_widgets(struct snd_soc_dai *dai, int stream,
         if (stream == SNDRV_PCM_STREAM_PLAYBACK)
                 paths = is_connected_output_ep(dai->playback_widget, list);
         else
-                paths = is_connected_input_ep(dai->playback_widget, list);
+                paths = is_connected_input_ep(dai->capture_widget, list);
 
         trace_snd_soc_dapm_connected(paths, stream);
         dapm_clear_walk(&card->dapm);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index bedd1717a37..48fd15b312c 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -794,6 +794,9 @@ static struct snd_soc_pcm_runtime *dpcm_get_be(struct snd_soc_card *card,
                 for (i = 0; i < card->num_links; i++) {
                         be = &card->rtd[i];
 
+                        if (!be->dai_link->no_pcm)
+                                continue;
+
                         if (be->cpu_dai->playback_widget == widget ||
                                 be->codec_dai->playback_widget == widget)
                                 return be;
@@ -803,6 +806,9 @@ static struct snd_soc_pcm_runtime *dpcm_get_be(struct snd_soc_card *card,
                 for (i = 0; i < card->num_links; i++) {
                         be = &card->rtd[i];
 
+                        if (!be->dai_link->no_pcm)
+                                continue;
+
                         if (be->cpu_dai->capture_widget == widget ||
                                 be->codec_dai->capture_widget == widget)
                                 return be;
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 57cd419f743..f43edb364a1 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -629,3 +629,4 @@ MODULE_AUTHOR("Stephen Warren <swarren@nvidia.com>");
 MODULE_DESCRIPTION("Tegra30 AHUB driver");
 MODULE_LICENSE("GPL v2");
 MODULE_ALIAS("platform:" DRV_NAME);
+MODULE_DEVICE_TABLE(of, tegra30_ahub_of_match);
diff --git a/sound/usb/card.h b/sound/usb/card.h
index 0d37238b845..2b9fffff23b 100644
--- a/sound/usb/card.h
+++ b/sound/usb/card.h
@@ -119,6 +119,7 @@ struct snd_usb_substream {
         unsigned long unlink_mask;      /* bitmask of unlinked urbs */
 
         /* data and sync endpoints for this stream */
+        unsigned int ep_num;            /* the endpoint number */
         struct snd_usb_endpoint *data_endpoint;
         struct snd_usb_endpoint *sync_endpoint;
         unsigned long flags;
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 6b7d7a2b7ba..083ed81160e 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -97,6 +97,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
         subs->formats |= fp->formats;
         subs->num_formats++;
         subs->fmt_type = fp->fmt_type;
+        subs->ep_num = fp->endpoint;
 }
 
 /*
@@ -119,9 +120,7 @@ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                 if (as->fmt_type != fp->fmt_type)
                         continue;
                 subs = &as->substream[stream];
-                if (!subs->data_endpoint)
-                        continue;
-                if (subs->data_endpoint->ep_num == fp->endpoint) {
+                if (subs->ep_num == fp->endpoint) {
                         list_add_tail(&fp->list, &subs->fmt_list);
                         subs->num_formats++;
                         subs->formats |= fp->formats;
@@ -134,7 +133,7 @@ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
                 if (as->fmt_type != fp->fmt_type)
                         continue;
                 subs = &as->substream[stream];
-                if (subs->data_endpoint)
+                if (subs->ep_num)
                         continue;
                 err = snd_pcm_new_stream(as->pcm, stream, 1);
                 if (err < 0)
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 5476bc0a1ea..b4b572e8c10 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,4 +1,6 @@
 tools/perf
+tools/scripts
+tools/lib/traceevent
 include/linux/const.h
 include/linux/perf_event.h
 include/linux/rbtree.h
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 8c767c6bca9..25249f76329 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -152,7 +152,7 @@ static int perf_evsel__add_hist_entry(struct perf_evsel *evsel,
 
         if (symbol_conf.use_callchain) {
                 err = callchain_append(he->callchain,
-                                       &evsel->hists.callchain_cursor,
+                                       &callchain_cursor,
                                        sample->period);
                 if (err)
                         return err;
@@ -162,7 +162,7 @@ static int perf_evsel__add_hist_entry(struct perf_evsel *evsel,
          * so we don't allocated the extra space needed because the stdio
          * code will not use it.
          */
-        if (al->sym != NULL && use_browser > 0) {
+        if (he->ms.sym != NULL && use_browser > 0) {
                 struct annotation *notes = symbol__annotation(he->ms.sym);
 
                 assert(evsel != NULL);
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 62ae30d34fa..262589991ea 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -1129,7 +1129,7 @@ static int add_default_attributes(void)
                 return 0;
 
         if (!evsel_list->nr_entries) {
-                if (perf_evlist__add_attrs_array(evsel_list, default_attrs) < 0)
+                if (perf_evlist__add_default_attrs(evsel_list, default_attrs) < 0)
                         return -1;
         }
 
@@ -1139,21 +1139,21 @@ static int add_default_attributes(void)
                 return 0;
 
         /* Append detailed run extra attributes: */
-        if (perf_evlist__add_attrs_array(evsel_list, detailed_attrs) < 0)
+        if (perf_evlist__add_default_attrs(evsel_list, detailed_attrs) < 0)
                 return -1;
 
         if (detailed_run < 2)
                 return 0;
 
         /* Append very detailed run extra attributes: */
-        if (perf_evlist__add_attrs_array(evsel_list, very_detailed_attrs) < 0)
+        if (perf_evlist__add_default_attrs(evsel_list, very_detailed_attrs) < 0)
                 return -1;
 
         if (detailed_run < 3)
                 return 0;
 
         /* Append very, very detailed run extra attributes: */
-        return perf_evlist__add_attrs_array(evsel_list, very_very_detailed_attrs);
+        return perf_evlist__add_default_attrs(evsel_list, very_very_detailed_attrs);
 }
 
 int cmd_stat(int argc, const char **argv, const char *prefix __used)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 871b540293e..6bb0277b7df 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -787,7 +787,7 @@ static void perf_event__process_sample(struct perf_tool *tool,
                 }
 
                 if (symbol_conf.use_callchain) {
-                        err = callchain_append(he->callchain, &evsel->hists.callchain_cursor,
+                        err = callchain_append(he->callchain, &callchain_cursor,
                                                sample->period);
                         if (err)
                                 return;
diff --git a/tools/perf/design.txt b/tools/perf/design.txt
index bd0bb1b1279..67e5d0cace8 100644
--- a/tools/perf/design.txt
+++ b/tools/perf/design.txt
@@ -409,14 +409,15 @@ Counters can be enabled and disabled in two ways: via ioctl and via
 prctl.  When a counter is disabled, it doesn't count or generate
 events but does continue to exist and maintain its count value.
 
-An individual counter or counter group can be enabled with
+An individual counter can be enabled with
 
-        ioctl(fd, PERF_EVENT_IOC_ENABLE);
+        ioctl(fd, PERF_EVENT_IOC_ENABLE, 0);
 
 or disabled with
 
-        ioctl(fd, PERF_EVENT_IOC_DISABLE);
+        ioctl(fd, PERF_EVENT_IOC_DISABLE, 0);
 
+For a counter group, pass PERF_IOC_FLAG_GROUP as the third argument.
 Enabling or disabling the leader of a group enables or disables the
 whole group; that is, while the group leader is disabled, none of the
 counters in the group will count.  Enabling or disabling a member of a
diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index 4deea6aaf92..34b1c46eaf4 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -668,7 +668,7 @@ static int annotate_browser__run(struct annotate_browser *browser, int evidx,
                 "q/ESC/CTRL+C  Exit\n\n"
                 "->            Go to target\n"
                 "<-            Exit\n"
-                "h             Cycle thru hottest instructions\n"
+                "H             Cycle thru hottest instructions\n"
                 "j             Toggle showing jump to target arrows\n"
                 "J             Toggle showing number of jump sources on targets\n"
                 "n             Search next string\n"
diff --git a/tools/perf/util/PERF-VERSION-GEN b/tools/perf/util/PERF-VERSION-GEN
index ad73300f7ba..95264f30417 100755
--- a/tools/perf/util/PERF-VERSION-GEN
+++ b/tools/perf/util/PERF-VERSION-GEN
@@ -12,7 +12,7 @@ LF='
 # First check if there is a .git to get the version from git describe
 # otherwise try to get the version from the kernel makefile
 if test -d ../../.git -o -f ../../.git &&
-        VN=$(git describe --abbrev=4 HEAD 2>/dev/null) &&
+        VN=$(git describe --match 'v[0-9].[0-9]*' --abbrev=4 HEAD 2>/dev/null) &&
         case "$VN" in
         *$LF*) (exit 1) ;;
         v[0-9]*)
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index 9f7106a8d9a..3a6bff47614 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -18,6 +18,8 @@
 #include "util.h"
 #include "callchain.h"
 
+__thread struct callchain_cursor callchain_cursor;
+
 bool ip_callchain__valid(struct ip_callchain *chain,
                          const union perf_event *event)
 {
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 7f9c0f1ae3a..3bdb407f9cd 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -76,6 +76,8 @@ struct callchain_cursor {
         struct callchain_cursor_node    *curr;
 };
 
+extern __thread struct callchain_cursor callchain_cursor;
+
 static inline void callchain_init(struct callchain_root *root)
 {
         INIT_LIST_HEAD(&root->node.siblings);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 4ac5f5ae4ce..7400fb3fc50 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -159,6 +159,17 @@ out_delete_partial_list:
         return -1;
 }
 
+int __perf_evlist__add_default_attrs(struct perf_evlist *evlist,
+                                     struct perf_event_attr *attrs, size_t nr_attrs)
+{
+        size_t i;
+
+        for (i = 0; i < nr_attrs; i++)
+                event_attr_init(attrs + i);
+
+        return perf_evlist__add_attrs(evlist, attrs, nr_attrs);
+}
+
 static int trace_event__id(const char *evname)
 {
         char *filename, *colon;
@@ -263,7 +274,8 @@ void perf_evlist__disable(struct perf_evlist *evlist)
         for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
                 list_for_each_entry(pos, &evlist->entries, node) {
                         for (thread = 0; thread < evlist->threads->nr; thread++)
-                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_DISABLE);
+                                ioctl(FD(pos, cpu, thread),
+                                      PERF_EVENT_IOC_DISABLE, 0);
                 }
         }
 }
@@ -276,7 +288,8 @@ void perf_evlist__enable(struct perf_evlist *evlist)
         for (cpu = 0; cpu < evlist->cpus->nr; cpu++) {
                 list_for_each_entry(pos, &evlist->entries, node) {
                         for (thread = 0; thread < evlist->threads->nr; thread++)
-                                ioctl(FD(pos, cpu, thread), PERF_EVENT_IOC_ENABLE);
+                                ioctl(FD(pos, cpu, thread),
+                                      PERF_EVENT_IOC_ENABLE, 0);
                 }
         }
 }
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 58abb63ac13..989bee9624c 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -54,6 +54,8 @@ void perf_evlist__add(struct perf_evlist *evlist, struct perf_evsel *entry);
 int perf_evlist__add_default(struct perf_evlist *evlist);
 int perf_evlist__add_attrs(struct perf_evlist *evlist,
                            struct perf_event_attr *attrs, size_t nr_attrs);
+int __perf_evlist__add_default_attrs(struct perf_evlist *evlist,
+                                     struct perf_event_attr *attrs, size_t nr_attrs);
 int perf_evlist__add_tracepoints(struct perf_evlist *evlist,
                                  const char *tracepoints[], size_t nr_tracepoints);
 int perf_evlist__set_tracepoints_handlers(struct perf_evlist *evlist,
@@ -62,6 +64,8 @@ int perf_evlist__set_tracepoints_handlers(struct perf_evlist *evlist,
 
 #define perf_evlist__add_attrs_array(evlist, array) \
         perf_evlist__add_attrs(evlist, array, ARRAY_SIZE(array))
+#define perf_evlist__add_default_attrs(evlist, array) \
+        __perf_evlist__add_default_attrs(evlist, array, ARRAY_SIZE(array))
 
 #define perf_evlist__add_tracepoints_array(evlist, array) \
         perf_evlist__add_tracepoints(evlist, array, ARRAY_SIZE(array))
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 91d19138f3e..9f6cebd798e 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -494,16 +494,24 @@ int perf_evsel__open_per_thread(struct perf_evsel *evsel,
 }
 
 static int perf_event__parse_id_sample(const union perf_event *event, u64 type,
-                                       struct perf_sample *sample)
+                                       struct perf_sample *sample,
+                                       bool swapped)
 {
         const u64 *array = event->sample.array;
+        union u64_swap u;
 
         array += ((event->header.size -
                    sizeof(event->header)) / sizeof(u64)) - 1;
 
         if (type & PERF_SAMPLE_CPU) {
-                u32 *p = (u32 *)array;
-                sample->cpu = *p;
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                }
+
+                sample->cpu = u.val32[0];
                 array--;
         }
 
@@ -523,9 +531,16 @@ static int perf_event__parse_id_sample(const union perf_event *event, u64 type,
         }
 
         if (type & PERF_SAMPLE_TID) {
-                u32 *p = (u32 *)array;
-                sample->pid = p[0];
-                sample->tid = p[1];
+                u.val64 = *array;
+                if (swapped) {
+                        /* undo swap of u64, then swap on individual u32s */
+                        u.val64 = bswap_64(u.val64);
+                        u.val32[0] = bswap_32(u.val32[0]);
+                        u.val32[1] = bswap_32(u.val32[1]);
+                }
+
+                sample->pid = u.val32[0];
+                sample->tid = u.val32[1];
         }
 
         return 0;
@@ -562,7 +577,7 @@ int perf_event__parse_sample(const union perf_event *event, u64 type,
         if (event->header.type != PERF_RECORD_SAMPLE) {
                 if (!sample_id_all)
                         return 0;
-                return perf_event__parse_id_sample(event, type, data);
+                return perf_event__parse_id_sample(event, type, data, swapped);
         }
 
         array = event->sample.array;
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 1293b5ebea4..514e2a4b367 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -378,7 +378,7 @@ void hist_entry__free(struct hist_entry *he)
  * collapse the histogram
  */
 
-static bool hists__collapse_insert_entry(struct hists *hists,
+static bool hists__collapse_insert_entry(struct hists *hists __used,
                                          struct rb_root *root,
                                          struct hist_entry *he)
 {
@@ -397,8 +397,9 @@ static bool hists__collapse_insert_entry(struct hists *hists,
                         iter->period += he->period;
                         iter->nr_events += he->nr_events;
                         if (symbol_conf.use_callchain) {
-                                callchain_cursor_reset(&hists->callchain_cursor);
-                                callchain_merge(&hists->callchain_cursor, iter->callchain,
+                                callchain_cursor_reset(&callchain_cursor);
+                                callchain_merge(&callchain_cursor,
+                                                iter->callchain,
                                                 he->callchain);
                         }
                         hist_entry__free(he);
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index cfc64e293f9..34bb556d621 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -67,8 +67,6 @@ struct hists {
         struct events_stats     stats;
         u64                     event_stream;
         u16                     col_len[HISTC_NR_COLS];
-        /* Best would be to reuse the session callchain cursor */
-        struct callchain_cursor callchain_cursor;
 };
 
 struct hist_entry *__hists__add_entry(struct hists *self,
diff --git a/tools/perf/util/pager.c b/tools/perf/util/pager.c
index 1915de20dca..3322b8446e8 100644
--- a/tools/perf/util/pager.c
+++ b/tools/perf/util/pager.c
@@ -57,6 +57,10 @@ void setup_pager(void)
         }
         if (!pager)
                 pager = getenv("PAGER");
+        if (!pager) {
+                if (!access("/usr/bin/pager", X_OK))
+                        pager = "/usr/bin/pager";
+        }
         if (!pager)
                 pager = "less";
         else if (!*pager || !strcmp(pager, "cat"))
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 59dccc98b55..0dda25d82d0 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -2164,16 +2164,12 @@ int del_perf_probe_events(struct strlist *dellist)
 
 error:
         if (kfd >= 0) {
-                if (namelist)
-                        strlist__delete(namelist);
-
+                strlist__delete(namelist);
                 close(kfd);
         }
 
         if (ufd >= 0) {
-                if (unamelist)
-                        strlist__delete(unamelist);
-
+                strlist__delete(unamelist);
                 close(ufd);
         }
 
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 93d355d2710..2600916efa8 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -288,7 +288,8 @@ struct branch_info *machine__resolve_bstack(struct machine *self,
         return bi;
 }
 
-int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
+int machine__resolve_callchain(struct machine *self,
+                               struct perf_evsel *evsel __used,
                                struct thread *thread,
                                struct ip_callchain *chain,
                                struct symbol **parent)
@@ -297,7 +298,12 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
         unsigned int i;
         int err;
 
-        callchain_cursor_reset(&evsel->hists.callchain_cursor);
+        callchain_cursor_reset(&callchain_cursor);
+
+        if (chain->nr > PERF_MAX_STACK_DEPTH) {
+                pr_warning("corrupted callchain. skipping...\n");
+                return 0;
+        }
 
         for (i = 0; i < chain->nr; i++) {
                 u64 ip;
@@ -317,7 +323,14 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
                         case PERF_CONTEXT_USER:
                                 cpumode = PERF_RECORD_MISC_USER;        break;
                         default:
-                                break;
+                                pr_debug("invalid callchain context: "
+                                         "%"PRId64"\n", (s64) ip);
+                                /*
+                                 * It seems the callchain is corrupted.
+                                 * Discard all.
+                                 */
+                                callchain_cursor_reset(&callchain_cursor);
+                                return 0;
                         }
                         continue;
                 }
@@ -333,7 +346,7 @@ int machine__resolve_callchain(struct machine *self, struct perf_evsel *evsel,
                                 break;
                 }
 
-                err = callchain_cursor_append(&evsel->hists.callchain_cursor,
+                err = callchain_cursor_append(&callchain_cursor,
                                               ip, al.map, al.sym);
                 if (err)
                         return err;
@@ -441,37 +454,65 @@ void mem_bswap_64(void *src, int byte_size)
         }
 }
 
-static void perf_event__all64_swap(union perf_event *event)
+static void swap_sample_id_all(union perf_event *event, void *data)
+{
+        void *end = (void *) event + event->header.size;
+        int size = end - data;
+
+        BUG_ON(size % sizeof(u64));
+        mem_bswap_64(data, size);
+}
+
+static void perf_event__all64_swap(union perf_event *event,
+                                   bool sample_id_all __used)
 {
         struct perf_event_header *hdr = &event->header;
         mem_bswap_64(hdr + 1, event->header.size - sizeof(*hdr));
 }
 
-static void perf_event__comm_swap(union perf_event *event)
+static void perf_event__comm_swap(union perf_event *event, bool sample_id_all)
 {
         event->comm.pid = bswap_32(event->comm.pid);
         event->comm.tid = bswap_32(event->comm.tid);
+
+        if (sample_id_all) {
+                void *data = &event->comm.comm;
+
+                data += ALIGN(strlen(data) + 1, sizeof(u64));
+                swap_sample_id_all(event, data);
+        }
 }
 
-static void perf_event__mmap_swap(union perf_event *event)
+static void perf_event__mmap_swap(union perf_event *event,
+                                  bool sample_id_all)
 {
         event->mmap.pid   = bswap_32(event->mmap.pid);
         event->mmap.tid   = bswap_32(event->mmap.tid);
         event->mmap.start = bswap_64(event->mmap.start);
         event->mmap.len   = bswap_64(event->mmap.len);
         event->mmap.pgoff = bswap_64(event->mmap.pgoff);
+
+        if (sample_id_all) {
+                void *data = &event->mmap.filename;
+
+                data += ALIGN(strlen(data) + 1, sizeof(u64));
+                swap_sample_id_all(event, data);
+        }
 }
 
-static void perf_event__task_swap(union perf_event *event)
+static void perf_event__task_swap(union perf_event *event, bool sample_id_all)
 {
         event->fork.pid  = bswap_32(event->fork.pid);
         event->fork.tid  = bswap_32(event->fork.tid);
         event->fork.ppid = bswap_32(event->fork.ppid);
         event->fork.ptid = bswap_32(event->fork.ptid);
         event->fork.time = bswap_64(event->fork.time);
+
+        if (sample_id_all)
+                swap_sample_id_all(event, &event->fork + 1);
 }
 
-static void perf_event__read_swap(union perf_event *event)
+static void perf_event__read_swap(union perf_event *event, bool sample_id_all)
 {
         event->read.pid          = bswap_32(event->read.pid);
         event->read.tid          = bswap_32(event->read.tid);
@@ -479,6 +520,9 @@ static void perf_event__read_swap(union perf_event *event)
         event->read.time_enabled = bswap_64(event->read.time_enabled);
         event->read.time_running = bswap_64(event->read.time_running);
         event->read.id           = bswap_64(event->read.id);
+
+        if (sample_id_all)
+                swap_sample_id_all(event, &event->read + 1);
 }
 
 static u8 revbyte(u8 b)
@@ -530,7 +574,8 @@ void perf_event__attr_swap(struct perf_event_attr *attr)
         swap_bitfield((u8 *) (&attr->read_format + 1), sizeof(u64));
 }
 
-static void perf_event__hdr_attr_swap(union perf_event *event)
+static void perf_event__hdr_attr_swap(union perf_event *event,
+                                      bool sample_id_all __used)
 {
         size_t size;
 
@@ -541,18 +586,21 @@ static void perf_event__hdr_attr_swap(union perf_event *event)
         mem_bswap_64(event->attr.id, size);
 }
 
-static void perf_event__event_type_swap(union perf_event *event)
+static void perf_event__event_type_swap(union perf_event *event,
+                                        bool sample_id_all __used)
 {
         event->event_type.event_type.event_id =
                 bswap_64(event->event_type.event_type.event_id);
 }
 
-static void perf_event__tracing_data_swap(union perf_event *event)
+static void perf_event__tracing_data_swap(union perf_event *event,
+                                          bool sample_id_all __used)
 {
         event->tracing_data.size = bswap_32(event->tracing_data.size);
 }
 
-typedef void (*perf_event__swap_op)(union perf_event *event);
+typedef void (*perf_event__swap_op)(union perf_event *event,
+                                    bool sample_id_all);
 
 static perf_event__swap_op perf_event__swap_ops[] = {
         [PERF_RECORD_MMAP]                = perf_event__mmap_swap,
@@ -986,6 +1034,15 @@ static int perf_session__process_user_event(struct perf_session *session, union
         }
 }
 
+static void event_swap(union perf_event *event, bool sample_id_all)
+{
+        perf_event__swap_op swap;
+
+        swap = perf_event__swap_ops[event->header.type];
+        if (swap)
+                swap(event, sample_id_all);
+}
+
 static int perf_session__process_event(struct perf_session *session,
                                        union perf_event *event,
                                        struct perf_tool *tool,
@@ -994,9 +1051,8 @@ static int perf_session__process_event(struct perf_session *session,
         struct perf_sample sample;
         int ret;
 
-        if (session->header.needs_swap &&
-            perf_event__swap_ops[event->header.type])
-                perf_event__swap_ops[event->header.type](event);
+        if (session->header.needs_swap)
+                event_swap(event, session->sample_id_all);
 
         if (event->header.type >= PERF_RECORD_HEADER_MAX)
                 return -EINVAL;
@@ -1428,7 +1484,6 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                           int print_sym, int print_dso, int print_symoffset)
 {
         struct addr_location al;
-        struct callchain_cursor *cursor = &evsel->hists.callchain_cursor;
         struct callchain_cursor_node *node;
 
         if (perf_event__preprocess_sample(event, machine, &al, sample,
@@ -1446,10 +1501,10 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                                 error("Failed to resolve callchain. Skipping\n");
                         return;
                 }
-                callchain_cursor_commit(cursor);
+                callchain_cursor_commit(&callchain_cursor);
 
                 while (1) {
-                        node = callchain_cursor_current(cursor);
+                        node = callchain_cursor_current(&callchain_cursor);
                         if (!node)
                                 break;
 
@@ -1460,12 +1515,12 @@ void perf_event__print_ip(union perf_event *event, struct perf_sample *sample,
                         }
                         if (print_dso) {
                                 printf(" (");
-                                map__fprintf_dsoname(al.map, stdout);
+                                map__fprintf_dsoname(node->map, stdout);
                                 printf(")");
                         }
                         printf("\n");
 
-                        callchain_cursor_advance(cursor);
+                        callchain_cursor_advance(&callchain_cursor);
                 }
 
         } else {
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index e2ba8858f3e..3e2e5ea0f03 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -323,6 +323,7 @@ struct dso *dso__new(const char *name)
                 dso->sorted_by_name = 0;
                 dso->has_build_id = 0;
                 dso->kernel = DSO_TYPE_USER;
+                dso->needs_swap = DSO_SWAP__UNSET;
                 INIT_LIST_HEAD(&dso->node);
         }
 
@@ -1156,6 +1157,33 @@ static size_t elf_addr_to_index(Elf *elf, GElf_Addr addr)
         return -1;
 }
 
+static int dso__swap_init(struct dso *dso, unsigned char eidata)
+{
+        static unsigned int const endian = 1;
+
+        dso->needs_swap = DSO_SWAP__NO;
+
+        switch (eidata) {
+        case ELFDATA2LSB:
+                /* We are big endian, DSO is little endian. */
+                if (*(unsigned char const *)&endian != 1)
+                        dso->needs_swap = DSO_SWAP__YES;
+                break;
+
+        case ELFDATA2MSB:
+                /* We are little endian, DSO is big endian. */
+                if (*(unsigned char const *)&endian != 0)
+                        dso->needs_swap = DSO_SWAP__YES;
+                break;
+
+        default:
+                pr_err("unrecognized DSO data encoding %d\n", eidata);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                          int fd, symbol_filter_t filter, int kmodule,
                          int want_symtab)
@@ -1187,6 +1215,9 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                 goto out_elf_end;
         }
 
+        if (dso__swap_init(dso, ehdr.e_ident[EI_DATA]))
+                goto out_elf_end;
+
         /* Always reject images with a mismatched build-id: */
         if (dso->has_build_id) {
                 u8 build_id[BUILD_ID_SIZE];
@@ -1272,7 +1303,7 @@ static int dso__load_sym(struct dso *dso, struct map *map, const char *name,
                 if (opdsec && sym.st_shndx == opdidx) {
                         u32 offset = sym.st_value - opdshdr.sh_addr;
                         u64 *opd = opddata->d_buf + offset;
-                        sym.st_value = *opd;
+                        sym.st_value = DSO__SWAP(dso, u64, *opd);
                         sym.st_shndx = elf_addr_to_index(elf, sym.st_value);
                 }
 
@@ -2786,8 +2817,11 @@ int machine__load_vmlinux_path(struct machine *machine, enum map_type type,
 
 struct map *dso__new_map(const char *name)
 {
+        struct map *map = NULL;
         struct dso *dso = dso__new(name);
-        struct map *map = map__new2(0, dso, MAP__FUNCTION);
+
+        if (dso)
+                map = map__new2(0, dso, MAP__FUNCTION);
 
         return map;
 }
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 5649d63798c..af0752b1aca 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -9,6 +9,7 @@
 #include <linux/list.h>
 #include <linux/rbtree.h>
 #include <stdio.h>
+#include <byteswap.h>
 
 #ifdef HAVE_CPLUS_DEMANGLE
 extern char *cplus_demangle(const char *, int);
@@ -160,11 +161,18 @@ enum dso_kernel_type {
         DSO_TYPE_GUEST_KERNEL
 };
 
+enum dso_swap_type {
+        DSO_SWAP__UNSET,
+        DSO_SWAP__NO,
+        DSO_SWAP__YES,
+};
+
 struct dso {
         struct list_head node;
         struct rb_root   symbols[MAP__NR_TYPES];
         struct rb_root   symbol_names[MAP__NR_TYPES];
         enum dso_kernel_type    kernel;
+        enum dso_swap_type      needs_swap;
         u8               adjust_symbols:1;
         u8               has_build_id:1;
         u8               hit:1;
@@ -182,6 +190,28 @@ struct dso {
         char             name[0];
 };
 
+#define DSO__SWAP(dso, type, val)                       \
+({                                                      \
+        type ____r = val;                               \
+        BUG_ON(dso->needs_swap == DSO_SWAP__UNSET);     \
+        if (dso->needs_swap == DSO_SWAP__YES) {         \
+                switch (sizeof(____r)) {                \
+                case 2:                                 \
+                        ____r = bswap_16(val);          \
+                        break;                          \
+                case 4:                                 \
+                        ____r = bswap_32(val);          \
+                        break;                          \
+                case 8:                                 \
+                        ____r = bswap_64(val);          \
+                        break;                          \
+                default:                                \
+                        BUG_ON(1);                      \
+                }                                       \
+        }                                               \
+        ____r;                                          \
+})
+
 struct dso *dso__new(const char *name);
 void dso__delete(struct dso *dso);
 
diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index ab2f682fd44..16de7ad4850 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -73,8 +73,8 @@ int backwards_count;
 char *progname;
 
 int num_cpus;
-cpu_set_t *cpu_mask;
-size_t cpu_mask_size;
+cpu_set_t *cpu_present_set, *cpu_mask;
+size_t cpu_present_setsize, cpu_mask_size;
 
 struct counters {
         unsigned long long tsc;         /* per thread */
@@ -103,6 +103,12 @@ struct timeval tv_even;
 struct timeval tv_odd;
 struct timeval tv_delta;
 
+int mark_cpu_present(int pkg, int core, int cpu)
+{
+        CPU_SET_S(cpu, cpu_present_setsize, cpu_present_set);
+        return 0;
+}
+
 /*
  * cpu_mask_init(ncpus)
  *
@@ -118,6 +124,18 @@ void cpu_mask_init(int ncpus)
         }
         cpu_mask_size = CPU_ALLOC_SIZE(ncpus);
         CPU_ZERO_S(cpu_mask_size, cpu_mask);
+
+        /*
+         * Allocate and initialize cpu_present_set
+         */
+        cpu_present_set = CPU_ALLOC(ncpus);
+        if (cpu_present_set == NULL) {
+                perror("CPU_ALLOC");
+                exit(3);
+        }
+        cpu_present_setsize = CPU_ALLOC_SIZE(ncpus);
+        CPU_ZERO_S(cpu_present_setsize, cpu_present_set);
+        for_all_cpus(mark_cpu_present);
 }
 
 void cpu_mask_uninit()
@@ -125,6 +143,9 @@ void cpu_mask_uninit()
         CPU_FREE(cpu_mask);
         cpu_mask = NULL;
         cpu_mask_size = 0;
+        CPU_FREE(cpu_present_set);
+        cpu_present_set = NULL;
+        cpu_present_setsize = 0;
 }
 
 int cpu_migrate(int cpu)
@@ -912,6 +933,8 @@ int is_snb(unsigned int family, unsigned int model)
         switch (model) {
         case 0x2A:
         case 0x2D:
+        case 0x3A:      /* IVB */
+        case 0x3D:      /* IVB Xeon */
                 return 1;
         }
         return 0;
@@ -1047,6 +1070,9 @@ int fork_it(char **argv)
         int retval;
         pid_t child_pid;
         get_counters(cnt_even);
+
+        /* clear affinity side-effect of get_counters() */
+        sched_setaffinity(0, cpu_present_setsize, cpu_present_set);
         gettimeofday(&tv_even, (struct timezone *)NULL);
 
         child_pid = fork();
diff --git a/virt/kvm/irq_comm.c b/virt/kvm/irq_comm.c
index a6a0365475e..5afb4311402 100644
--- a/virt/kvm/irq_comm.c
+++ b/virt/kvm/irq_comm.c
@@ -332,6 +332,7 @@ static int setup_routing_entry(struct kvm_irq_routing_table *rt,
          */
         hlist_for_each_entry(ei, n, &rt->map[ue->gsi], link)
                 if (ei->type == KVM_IRQ_ROUTING_MSI ||
+                    ue->type == KVM_IRQ_ROUTING_MSI ||
                     ue->u.irqchip.irqchip == ei->irqchip.irqchip)
                         return r;